diff --git a/gateway/authelia/config/configuration.yml b/gateway/authelia/config/configuration.yml index 4229345..55b46ca 100644 --- a/gateway/authelia/config/configuration.yml +++ b/gateway/authelia/config/configuration.yml @@ -44,7 +44,7 @@ server: endpoints: authz: forward-auth: - implementation: 'ForwardAuth' + implementation: "ForwardAuth" # SMTP Notifier https://www.authelia.com/configuration/notifications/smtp/ # Set also AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE @@ -90,14 +90,14 @@ identity_providers: client_name: Gitea client_secret: {{ secret "/run/secrets/GITEA_CLIENT_SECRET" }} public: false - authorization_policy: 'two_factor' + authorization_policy: "two_factor" consent_mode: pre-configured - token_endpoint_auth_method: 'client_secret_basic' + token_endpoint_auth_method: "client_secret_post" pre_configured_consent_duration: 1w scopes: - - 'openid' - - 'email' - - 'profile' + - "openid" + - "email" + - "profile" redirect_uris: - https://gitea.64815139.xyz/user/oauth2/Authelia/callback - client_id: Qzmj9S-sJi0bDpUFhuJgqwJPiiGqEBtUGLmjqcZxFpLfQzb7Y9LxnmvZ2K1YoZT2vAXDqWi5 @@ -106,7 +106,7 @@ identity_providers: public: false authorization_policy: two_factor consent_mode: pre-configured - token_endpoint_auth_method: 'client_secret_basic' + token_endpoint_auth_method: "client_secret_post" pre_configured_consent_duration: 1w scopes: - openid diff --git a/gateway/caddy/Caddyfile b/gateway/caddy/Caddyfile index d3dfd83..6058449 100644 --- a/gateway/caddy/Caddyfile +++ b/gateway/caddy/Caddyfile @@ -50,125 +50,31 @@ www.64815139.xyz { redir https://www.{host}{uri} } -search.64815139.xyz { - log { - output discard - } - - import secure * - - @api { - path /config - path /healthz - path /stats/errors - path /stats/checker - } - - @static { - path /static/* - } - - @notstatic { - not path /static/* - } - - @imageproxy { - path /image_proxy - } - - @notimageproxy { - not path /image_proxy - } - - header { - # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS - Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" - - # Enable cross-site filter (XSS) and tell browser to block detected attacks - X-XSS-Protection "1; mode=block" - - # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type - X-Content-Type-Options "nosniff" - - # Disable some features - Permissions-Policy "accelerometer=(),ambient-light-sensor=(),autoplay=(),camera=(),encrypted-media=(),focus-without-user-activation=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),speaker=(),sync-xhr=(),usb=(),vr=()" - - # Disable some features (legacy) - Feature-Policy "accelerometer 'none';ambient-light-sensor 'none'; autoplay 'none';camera 'none';encrypted-media 'none';focus-without-user-activation 'none'; geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';midi 'none';payment 'none';picture-in-picture 'none'; speaker 'none';sync-xhr 'none';usb 'none';vr 'none'" - - # Referer - Referrer-Policy "no-referrer" - - # X-Robots-Tag - X-Robots-Tag "noindex, noarchive, nofollow" - - # Remove Server header - -Server - } - - header @api { - Access-Control-Allow-Methods "GET, OPTIONS" - Access-Control-Allow-Origin "*" - } - - # Cache - header @static { - # Cache - Cache-Control "public, max-age=31536000" - defer - } - - header @notstatic { - # No Cache - Cache-Control "no-cache, no-store" - Pragma "no-cache" - } - - # CSP (see http://content-security-policy.com/ ) - header @imageproxy { - Content-Security-Policy "default-src 'none'; img-src 'self' data:" - } - - header @notimageproxy { - Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com" - } - - handle { - encode zstd gzip - - reverse_proxy 192.168.0.210:8080 { - header_up X-Forwarded-Port {http.request.port} - header_up X-Forwarded-Proto {http.request.scheme} - header_up X-Real-IP {remote_host} - } - } -} - gitea.64815139.xyz { route { crowdsec rewrite /user/login /user/oauth2/Authelia - reverse_proxy 192.168.0.210:3000 + reverse_proxy 192.168.0.216:3000 } } immich.64815139.xyz { route { crowdsec - reverse_proxy 192.168.0.210:2283 + reverse_proxy 192.168.0.216:2283 } } uptime.64815139.xyz { route { crowdsec - reverse_proxy 192.168.0.210:4393 + reverse_proxy 192.168.0.216:4393 } } oaT3cqYuCAegcoM4Xc4Pun1BUMOschxR.64815139.xyz { route { crowdsec - reverse_proxy 192.168.0.210:4449 + reverse_proxy 192.168.0.216:4449 } } diff --git a/gateway/cloudflare-ddns/config.json b/gateway/cloudflare-ddns/config.json index 23ad2ef..2079d7c 100644 --- a/gateway/cloudflare-ddns/config.json +++ b/gateway/cloudflare-ddns/config.json @@ -18,10 +18,6 @@ "name": "auth", "proxied": false }, - { - "name": "search", - "proxied": false - }, { "name": "gitea", "proxied": false diff --git a/immich/.env b/immich/.env index 099b004..7ef4843 100644 --- a/immich/.env +++ b/immich/.env @@ -10,6 +10,7 @@ DB_DATA_LOCATION=./data/postgres # The Immich version to use. You can pin this to a specific version like "v1.71.0" IMMICH_VERSION=release +IMMICH_HOST=0.0.0.0 # The values below this line do not need to be changed ################################################################################### diff --git a/immich/docker-compose.yml b/immich/docker-compose.yml index 7d77698..37bc00f 100644 --- a/immich/docker-compose.yml +++ b/immich/docker-compose.yml @@ -62,7 +62,7 @@ services: database: container_name: immich_postgres - image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0 + image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0 secrets: - POSTGRES_PASSWORD environment: @@ -73,12 +73,7 @@ services: volumes: # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file - ${DB_DATA_LOCATION}:/var/lib/postgresql/data - healthcheck: - test: pg_isready --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' || exit 1; Chksum="$$(psql --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1 - interval: 5m - start_interval: 30s - start_period: 5m - command: ["postgres", "-c", "shared_preload_libraries=vectors.so", "-c", 'search_path="$$user", public, vectors', "-c", "logging_collector=on", "-c", "max_wal_size=2GB", "-c", "shared_buffers=512MB", "-c", "wal_compression=on"] + shm_size: 128mb restart: always volumes: diff --git a/searxng/config/limiter.toml b/searxng/config/limiter.toml deleted file mode 100644 index 190f8df..0000000 --- a/searxng/config/limiter.toml +++ /dev/null @@ -1,6 +0,0 @@ -# This configuration file updates the default configuration file -# See https://github.com/searxng/searxng/blob/master/searx/limiter.toml - -[botdetection.ip_limit] -# activate link_token method in the ip_limit method -link_token = true diff --git a/searxng/config/settings.yml b/searxng/config/settings.yml deleted file mode 100644 index d5bc53c..0000000 --- a/searxng/config/settings.yml +++ /dev/null @@ -1,9 +0,0 @@ -# see https://docs.searxng.org/admin/settings/settings.html#settings-use-default-settings -use_default_settings: true -server: - limiter: false # can be disabled for a private instance - image_proxy: true -ui: - static_use_hash: true -redis: - url: redis://redis:6379/0 diff --git a/searxng/config/uwsgi.ini b/searxng/config/uwsgi.ini deleted file mode 100644 index 072e9f3..0000000 --- a/searxng/config/uwsgi.ini +++ /dev/null @@ -1,54 +0,0 @@ -[uwsgi] -# Who will run the code -uid = searxng -gid = searxng - -# Number of workers (usually CPU count) -# default value: %k (= number of CPU core, see Dockerfile) -workers = 2 - -# Number of threads per worker -# default value: 4 (see Dockerfile) -threads = 2 - -# The right granted on the created socket -chmod-socket = 666 - -# Plugin to use and interpreter config -single-interpreter = true -master = true -plugin = python3 -lazy-apps = true -enable-threads = 2 - -# Module to import -module = searx.webapp - -# Virtualenv and python path -pythonpath = /usr/local/searxng/ -chdir = /usr/local/searxng/searx/ - -# automatically set processes name to something meaningful -auto-procname = true - -# Disable request logging for privacy -disable-logging = true -log-5xx = true - -# Set the max size of a request (request-body excluded) -buffer-size = 8192 - -# No keep alive -# See https://github.com/searx/searx-docker/issues/24 -add-header = Connection: close - -# Follow SIGTERM convention -# See https://github.com/searxng/searxng/issues/3427 -die-on-term - -# uwsgi serves the static files -static-map = /static=/usr/local/searxng/searx/static -# expires set to one day -static-expires = /* 86400 -static-gzip-all = True -offload-threads = 2 diff --git a/searxng/docker-compose.yaml b/searxng/docker-compose.yaml deleted file mode 100644 index 5f78110..0000000 --- a/searxng/docker-compose.yaml +++ /dev/null @@ -1,61 +0,0 @@ -name: searxng -secrets: - SECRET_KEY: - file: './secrets/SECRET_KEY' -services: - redis: - container_name: searxng_redis - image: docker.io/valkey/valkey:8-alpine - command: valkey-server --save 30 1 --loglevel warning - restart: unless-stopped - networks: - - default - volumes: - - valkey-data:/data - cap_drop: - - ALL - cap_add: - - SETGID - - SETUID - - DAC_OVERRIDE - logging: - driver: "json-file" - options: - max-size: "1m" - max-file: "1" - - searxng: - container_name: searxng_app - image: docker.io/searxng/searxng:latest - restart: unless-stopped - networks: - - default - ports: - - "8080:8080" - volumes: - - ./config:/etc/searxng:rw - secrets: - - SECRET_KEY - environment: - - SEARXNG_BASE_URL=https://search.64815139.xyz - - SEARXNG_SECRET= /run/secrets/SECRET_KEY - - UWSGI_WORKERS=4 - - UWSGI_THREADS=4 - cap_drop: - - ALL - cap_add: - - CHOWN - - SETGID - - SETUID - logging: - driver: "json-file" - options: - max-size: "1m" - max-file: "1" - -networks: - default: - external: false - -volumes: - valkey-data: