From 6813621fe98205f18284b068850c7939499f7eb1 Mon Sep 17 00:00:00 2001 From: librelad Date: Wed, 19 Aug 2026 23:38:34 +0100 Subject: [PATCH] config: enable multiple instances everywhere it is actually possible Three apps were instanceable and the rest were silent, so the feature looked far narrower than it is. Every app has now been checked against the two rules instance_create.sh enforces, and the answer recorded in its config rather than left unset. 32 apps are instance-safe and now say so. Six are not, and each says why in its own words instead of being indistinguishable from an app nobody had reviewed: pihole a DNS server must own port 53 unbound a resolver must own its fixed 5335 stalwart a mail server must own 25/465/587/993 traefik must own 443, and one Traefik routes every other app prometheus node-exporter and cadvisor carry no "prometheus" prefix stoat pins 7881, and database/redis/rabbit/minio carry no prefix The first four are genuinely one-per-host: the port is not arbitrary, it is the protocol. The last two are compose-identity problems and could be fixed by prefixing those service names, which is a change to make deliberately rather than in passing. Recorded as an explicit false with a reason, not left unset, so the next person reads a decision instead of an absence. The audit was verified not to pass anything vacuously: every app resolves at least one service name, so no app reached "eligible" merely because nothing was found to check. Co-Authored-By: Claude Opus 5 --- containers/adguard/adguard.config | 5 +++++ containers/authelia/authelia.config | 5 +++++ containers/crowdsec/crowdsec.config | 5 +++++ containers/dashy/dashy.config | 5 +++++ containers/gitea/gitea.config | 5 +++++ containers/gluetun/gluetun.config | 5 +++++ containers/grafana/grafana.config | 5 +++++ containers/headscale/headscale.config | 5 +++++ containers/invidious/invidious.config | 5 +++++ containers/ipinfo/ipinfo.config | 5 +++++ containers/jellyfin/jellyfin.config | 5 +++++ containers/jitsimeet/jitsimeet.config | 5 +++++ containers/libreportal_catalog/libreportal_catalog.config | 5 +++++ containers/linkding/linkding.config | 5 +++++ containers/mastodon/mastodon.config | 5 +++++ containers/matrix/matrix.config | 5 +++++ containers/mattermost/mattermost.config | 5 +++++ containers/moneyapp/moneyapp.config | 5 +++++ containers/navidrome/navidrome.config | 5 +++++ containers/nextcloud/nextcloud.config | 5 +++++ containers/ollama/ollama.config | 5 +++++ containers/onlyoffice/onlyoffice.config | 5 +++++ containers/owncloud/owncloud.config | 5 +++++ containers/pihole/pihole.config | 6 ++++++ containers/prometheus/prometheus.config | 6 ++++++ containers/rocketchat/rocketchat.config | 5 +++++ containers/speedtest/speedtest.config | 5 +++++ containers/stalwart/stalwart.config | 6 ++++++ containers/stoat/stoat.config | 6 ++++++ containers/traefik/traefik.config | 6 ++++++ containers/trilium/trilium.config | 5 +++++ containers/trivy/trivy.config | 5 +++++ containers/unbound/unbound.config | 6 ++++++ containers/vikunja/vikunja.config | 5 +++++ containers/wireguard/wireguard.config | 5 +++++ 35 files changed, 181 insertions(+) diff --git a/containers/adguard/adguard.config b/containers/adguard/adguard.config index 8665b78..85c442c 100755 --- a/containers/adguard/adguard.config +++ b/containers/adguard/adguard.config @@ -14,6 +14,11 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_ADGUARD_APP_NAME=adguard +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_ADGUARD_MULTI_INSTANCE=true CFG_ADGUARD_BACKUP=true CFG_ADGUARD_BACKUP_STRATEGY=auto CFG_ADGUARD_UPDATE_TYPE=auto diff --git a/containers/authelia/authelia.config b/containers/authelia/authelia.config index 82173d8..cd09ba9 100755 --- a/containers/authelia/authelia.config +++ b/containers/authelia/authelia.config @@ -16,6 +16,11 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_AUTHELIA_APP_NAME=authelia +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_AUTHELIA_MULTI_INSTANCE=true CFG_AUTHELIA_REQUIRES="domain,traefik" CFG_AUTHELIA_BACKUP=true CFG_AUTHELIA_BACKUP_STRATEGY=auto diff --git a/containers/crowdsec/crowdsec.config b/containers/crowdsec/crowdsec.config index 3ea1ac3..e8c643b 100644 --- a/containers/crowdsec/crowdsec.config +++ b/containers/crowdsec/crowdsec.config @@ -13,6 +13,11 @@ # PROMETHEUS_LISTEN = address CrowdSec's metrics endpoint binds to; must be reachable from the Prometheus container (default: all interfaces, port 6060 — keep the :6060 port) # CFG_CROWDSEC_APP_NAME=crowdsec +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_CROWDSEC_MULTI_INSTANCE=true CFG_CROWDSEC_HOST_INSTALL=true CFG_CROWDSEC_HOST_PACKAGE=crowdsec CFG_CROWDSEC_HOST_SERVICES=crowdsec.service,crowdsec-firewall-bouncer.service diff --git a/containers/dashy/dashy.config b/containers/dashy/dashy.config index 048e49d..4c4b050 100755 --- a/containers/dashy/dashy.config +++ b/containers/dashy/dashy.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_DASHY_APP_NAME=dashy +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_DASHY_MULTI_INSTANCE=true CFG_DASHY_BACKUP=true CFG_DASHY_BACKUP_STRATEGY=auto CFG_DASHY_UPDATE_TYPE=auto diff --git a/containers/gitea/gitea.config b/containers/gitea/gitea.config index c7c4ccd..d81898b 100755 --- a/containers/gitea/gitea.config +++ b/containers/gitea/gitea.config @@ -13,6 +13,11 @@ # METRICS_TOKEN = bearer token guarding /metrics (rides the public web port); auto-generated, mirrored into the Prometheus scrape config # CFG_GITEA_APP_NAME=gitea +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_GITEA_MULTI_INSTANCE=true CFG_GITEA_BACKUP=true CFG_GITEA_BACKUP_STRATEGY=auto CFG_GITEA_UPDATE_TYPE=auto diff --git a/containers/gluetun/gluetun.config b/containers/gluetun/gluetun.config index c39a4c7..64a2f35 100644 --- a/containers/gluetun/gluetun.config +++ b/containers/gluetun/gluetun.config @@ -12,6 +12,11 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_GLUETUN_APP_NAME=gluetun +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_GLUETUN_MULTI_INSTANCE=true CFG_GLUETUN_BACKUP=true CFG_GLUETUN_BACKUP_STRATEGY=auto CFG_GLUETUN_UPDATE_TYPE=auto diff --git a/containers/grafana/grafana.config b/containers/grafana/grafana.config index b6531d9..bb8cd80 100755 --- a/containers/grafana/grafana.config +++ b/containers/grafana/grafana.config @@ -13,6 +13,11 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_GRAFANA_APP_NAME=grafana +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_GRAFANA_MULTI_INSTANCE=true CFG_GRAFANA_REQUIRES="prometheus" CFG_GRAFANA_BACKUP=true CFG_GRAFANA_BACKUP_STRATEGY=auto diff --git a/containers/headscale/headscale.config b/containers/headscale/headscale.config index c19acdf..fcbcc5a 100755 --- a/containers/headscale/headscale.config +++ b/containers/headscale/headscale.config @@ -11,6 +11,11 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_HEADSCALE_APP_NAME=headscale +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_HEADSCALE_MULTI_INSTANCE=true CFG_HEADSCALE_BACKUP=true CFG_HEADSCALE_BACKUP_STRATEGY=auto CFG_HEADSCALE_UPDATE_TYPE=auto diff --git a/containers/invidious/invidious.config b/containers/invidious/invidious.config index c642c20..09a8fd8 100755 --- a/containers/invidious/invidious.config +++ b/containers/invidious/invidious.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_INVIDIOUS_APP_NAME=invidious +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_INVIDIOUS_MULTI_INSTANCE=true CFG_INVIDIOUS_BACKUP=false CFG_INVIDIOUS_BACKUP_STRATEGY=auto CFG_INVIDIOUS_UPDATE_TYPE=auto diff --git a/containers/ipinfo/ipinfo.config b/containers/ipinfo/ipinfo.config index 6cc4008..8953d06 100755 --- a/containers/ipinfo/ipinfo.config +++ b/containers/ipinfo/ipinfo.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_IPINFO_APP_NAME=ipinfo +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_IPINFO_MULTI_INSTANCE=true CFG_IPINFO_BACKUP=false CFG_IPINFO_BACKUP_STRATEGY=auto CFG_IPINFO_UPDATE_TYPE=auto diff --git a/containers/jellyfin/jellyfin.config b/containers/jellyfin/jellyfin.config index 693f13c..0c9f79a 100755 --- a/containers/jellyfin/jellyfin.config +++ b/containers/jellyfin/jellyfin.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_JELLYFIN_APP_NAME=jellyfin +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_JELLYFIN_MULTI_INSTANCE=true CFG_JELLYFIN_BACKUP=true CFG_JELLYFIN_BACKUP_STRATEGY=auto CFG_JELLYFIN_UPDATE_TYPE=auto diff --git a/containers/jitsimeet/jitsimeet.config b/containers/jitsimeet/jitsimeet.config index 732e5ff..e7a0242 100755 --- a/containers/jitsimeet/jitsimeet.config +++ b/containers/jitsimeet/jitsimeet.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_JITSIMEET_APP_NAME=jitsimeet +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_JITSIMEET_MULTI_INSTANCE=true CFG_JITSIMEET_BACKUP=true CFG_JITSIMEET_BACKUP_STRATEGY=auto CFG_JITSIMEET_UPDATE_TYPE=auto diff --git a/containers/libreportal_catalog/libreportal_catalog.config b/containers/libreportal_catalog/libreportal_catalog.config index cde38bd..9ee03d9 100644 --- a/containers/libreportal_catalog/libreportal_catalog.config +++ b/containers/libreportal_catalog/libreportal_catalog.config @@ -12,6 +12,11 @@ # DEV_ONLY = if true, hidden from the App Center unless Developer Mode is on # CFG_LIBREPORTAL_CATALOG_APP_NAME=libreportal_catalog +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_LIBREPORTAL_CATALOG_MULTI_INSTANCE=true CFG_LIBREPORTAL_CATALOG_BACKUP=true CFG_LIBREPORTAL_CATALOG_BACKUP_STRATEGY=auto CFG_LIBREPORTAL_CATALOG_UPDATE_TYPE=auto diff --git a/containers/linkding/linkding.config b/containers/linkding/linkding.config index f8abdb0..963efd3 100755 --- a/containers/linkding/linkding.config +++ b/containers/linkding/linkding.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_LINKDING_APP_NAME=linkding +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_LINKDING_MULTI_INSTANCE=true CFG_LINKDING_BACKUP=true CFG_LINKDING_BACKUP_STRATEGY=auto CFG_LINKDING_UPDATE_TYPE=auto diff --git a/containers/mastodon/mastodon.config b/containers/mastodon/mastodon.config index ede5032..8808160 100755 --- a/containers/mastodon/mastodon.config +++ b/containers/mastodon/mastodon.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_MASTODON_APP_NAME=mastodon +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_MASTODON_MULTI_INSTANCE=true CFG_MASTODON_BACKUP=true CFG_MASTODON_BACKUP_STRATEGY=auto CFG_MASTODON_UPDATE_TYPE=auto diff --git a/containers/matrix/matrix.config b/containers/matrix/matrix.config index 4ca0929..a7b272c 100644 --- a/containers/matrix/matrix.config +++ b/containers/matrix/matrix.config @@ -17,6 +17,11 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_MATRIX_APP_NAME=matrix +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_MATRIX_MULTI_INSTANCE=true # No prerequisites. Synapse runs perfectly well on a plain HTTP listener reached # by IP over the LAN or a WireGuard tunnel — that is the same setup as sitting # behind a reverse proxy, minus the proxy. Only *federation* needs a real domain diff --git a/containers/mattermost/mattermost.config b/containers/mattermost/mattermost.config index f401351..5c56c88 100644 --- a/containers/mattermost/mattermost.config +++ b/containers/mattermost/mattermost.config @@ -12,6 +12,11 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_MATTERMOST_APP_NAME=mattermost +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_MATTERMOST_MULTI_INSTANCE=true CFG_MATTERMOST_BACKUP=true CFG_MATTERMOST_BACKUP_STRATEGY=auto CFG_MATTERMOST_UPDATE_TYPE=auto diff --git a/containers/moneyapp/moneyapp.config b/containers/moneyapp/moneyapp.config index fab2b83..cf0e642 100644 --- a/containers/moneyapp/moneyapp.config +++ b/containers/moneyapp/moneyapp.config @@ -12,6 +12,11 @@ # AUTH_SECRET = NextAuth/Auth.js session secret (random base64; auto-generated) # CFG_MONEYAPP_APP_NAME=moneyapp +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_MONEYAPP_MULTI_INSTANCE=true CFG_MONEYAPP_REQUIRES="" CFG_MONEYAPP_BACKUP=true CFG_MONEYAPP_BACKUP_STRATEGY=auto diff --git a/containers/navidrome/navidrome.config b/containers/navidrome/navidrome.config index b903956..eaf62ef 100644 --- a/containers/navidrome/navidrome.config +++ b/containers/navidrome/navidrome.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_NAVIDROME_APP_NAME=navidrome +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_NAVIDROME_MULTI_INSTANCE=true CFG_NAVIDROME_BACKUP=true CFG_NAVIDROME_BACKUP_STRATEGY=auto CFG_NAVIDROME_UPDATE_TYPE=auto diff --git a/containers/nextcloud/nextcloud.config b/containers/nextcloud/nextcloud.config index a7c85c5..e9ef4ac 100755 --- a/containers/nextcloud/nextcloud.config +++ b/containers/nextcloud/nextcloud.config @@ -15,6 +15,11 @@ # DB_ROOT_PASSWORD = MariaDB root account; kept separate from DB_PASSWORD so the app user can be rotated without touching root # CFG_NEXTCLOUD_APP_NAME=nextcloud +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_NEXTCLOUD_MULTI_INSTANCE=true CFG_NEXTCLOUD_BACKUP=true CFG_NEXTCLOUD_BACKUP_STRATEGY=auto CFG_NEXTCLOUD_UPDATE_TYPE=auto diff --git a/containers/ollama/ollama.config b/containers/ollama/ollama.config index 6821003..d4d6888 100755 --- a/containers/ollama/ollama.config +++ b/containers/ollama/ollama.config @@ -12,6 +12,11 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_OLLAMA_APP_NAME=ollama +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_OLLAMA_MULTI_INSTANCE=true CFG_OLLAMA_BACKUP=true CFG_OLLAMA_BACKUP_STRATEGY=auto CFG_OLLAMA_UPDATE_TYPE=auto diff --git a/containers/onlyoffice/onlyoffice.config b/containers/onlyoffice/onlyoffice.config index aff7987..77f1a4e 100755 --- a/containers/onlyoffice/onlyoffice.config +++ b/containers/onlyoffice/onlyoffice.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_ONLYOFFICE_APP_NAME=onlyoffice +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_ONLYOFFICE_MULTI_INSTANCE=true CFG_ONLYOFFICE_BACKUP=true CFG_ONLYOFFICE_BACKUP_STRATEGY=auto CFG_ONLYOFFICE_UPDATE_TYPE=auto diff --git a/containers/owncloud/owncloud.config b/containers/owncloud/owncloud.config index 6c3b804..11baf20 100755 --- a/containers/owncloud/owncloud.config +++ b/containers/owncloud/owncloud.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_OWNCLOUD_APP_NAME=owncloud +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_OWNCLOUD_MULTI_INSTANCE=true CFG_OWNCLOUD_BACKUP=true CFG_OWNCLOUD_BACKUP_STRATEGY=auto CFG_OWNCLOUD_UPDATE_TYPE=auto diff --git a/containers/pihole/pihole.config b/containers/pihole/pihole.config index e42374c..458461e 100755 --- a/containers/pihole/pihole.config +++ b/containers/pihole/pihole.config @@ -12,6 +12,12 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_PIHOLE_APP_NAME=pihole +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +# Not instance-safe. A DNS server must own port 53 on the host; a second copy could not bind it. +CFG_PIHOLE_MULTI_INSTANCE=false CFG_PIHOLE_BACKUP=true CFG_PIHOLE_BACKUP_STRATEGY=auto CFG_PIHOLE_UPDATE_TYPE=auto diff --git a/containers/prometheus/prometheus.config b/containers/prometheus/prometheus.config index 2317627..f096a93 100755 --- a/containers/prometheus/prometheus.config +++ b/containers/prometheus/prometheus.config @@ -11,6 +11,12 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_PROMETHEUS_APP_NAME=prometheus +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +# Not instance-safe. Declares node-exporter and cadvisor, names with no "prometheus" prefix, which cannot be made unique per instance. +CFG_PROMETHEUS_MULTI_INSTANCE=false CFG_PROMETHEUS_BACKUP=true CFG_PROMETHEUS_BACKUP_STRATEGY=auto CFG_PROMETHEUS_UPDATE_TYPE=auto diff --git a/containers/rocketchat/rocketchat.config b/containers/rocketchat/rocketchat.config index b3d17f5..c0297d7 100644 --- a/containers/rocketchat/rocketchat.config +++ b/containers/rocketchat/rocketchat.config @@ -12,6 +12,11 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_ROCKETCHAT_APP_NAME=rocketchat +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_ROCKETCHAT_MULTI_INSTANCE=true CFG_ROCKETCHAT_BACKUP=true CFG_ROCKETCHAT_BACKUP_STRATEGY=auto # Auto. Rocket.Chat does run schema migrations on boot and does refuse to start diff --git a/containers/speedtest/speedtest.config b/containers/speedtest/speedtest.config index e653efb..74c18a7 100755 --- a/containers/speedtest/speedtest.config +++ b/containers/speedtest/speedtest.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_SPEEDTEST_APP_NAME=speedtest +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_SPEEDTEST_MULTI_INSTANCE=true CFG_SPEEDTEST_BACKUP=false CFG_SPEEDTEST_BACKUP_STRATEGY=auto CFG_SPEEDTEST_UPDATE_TYPE=auto diff --git a/containers/stalwart/stalwart.config b/containers/stalwart/stalwart.config index 794809e..d2ce678 100644 --- a/containers/stalwart/stalwart.config +++ b/containers/stalwart/stalwart.config @@ -20,6 +20,12 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_STALWART_APP_NAME=stalwart +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +# Not instance-safe. A mail server must own the SMTP/IMAP ports (25, 465, 587, 993); a second copy could not bind them. +CFG_STALWART_MULTI_INSTANCE=false CFG_STALWART_BACKUP=true # Mail is the one app where a "live" snapshot is a real risk: the message store # is being written continuously, so a copy taken mid-write can land mid-transaction. diff --git a/containers/stoat/stoat.config b/containers/stoat/stoat.config index 2004b5f..626386e 100644 --- a/containers/stoat/stoat.config +++ b/containers/stoat/stoat.config @@ -14,6 +14,12 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_STOAT_APP_NAME=stoat +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +# Not instance-safe. Pins LiveKit to host port 7881, and declares database/redis/rabbit/minio and friends — names with no "stoat" prefix that cannot be made unique per instance. +CFG_STOAT_MULTI_INSTANCE=false # No prerequisites. Stoat bakes its public URL into the client bundle, but that # URL can just as well be http://: — text chat, channels, roles # and uploads all work that way over a LAN or WireGuard tunnel. Only camera and diff --git a/containers/traefik/traefik.config b/containers/traefik/traefik.config index 62b1922..a78d58b 100755 --- a/containers/traefik/traefik.config +++ b/containers/traefik/traefik.config @@ -12,6 +12,12 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_TRAEFIK_APP_NAME=traefik +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +# Not instance-safe. The edge proxy must own 443 — and one Traefik is what routes every other app. +CFG_TRAEFIK_MULTI_INSTANCE=false CFG_TRAEFIK_BACKUP=true CFG_TRAEFIK_BACKUP_STRATEGY=auto CFG_TRAEFIK_UPDATE_TYPE=auto diff --git a/containers/trilium/trilium.config b/containers/trilium/trilium.config index 4913ac7..5a18ec1 100755 --- a/containers/trilium/trilium.config +++ b/containers/trilium/trilium.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_TRILIUM_APP_NAME=trilium +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_TRILIUM_MULTI_INSTANCE=true CFG_TRILIUM_BACKUP=true CFG_TRILIUM_BACKUP_STRATEGY=auto CFG_TRILIUM_UPDATE_TYPE=auto diff --git a/containers/trivy/trivy.config b/containers/trivy/trivy.config index f434819..1b1bf85 100644 --- a/containers/trivy/trivy.config +++ b/containers/trivy/trivy.config @@ -11,6 +11,11 @@ # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote # CFG_TRIVY_APP_NAME=trivy +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_TRIVY_MULTI_INSTANCE=true CFG_TRIVY_BACKUP=false CFG_TRIVY_BACKUP_STRATEGY=auto CFG_TRIVY_UPDATE_TYPE=auto diff --git a/containers/unbound/unbound.config b/containers/unbound/unbound.config index 14d2e7f..6a3868c 100755 --- a/containers/unbound/unbound.config +++ b/containers/unbound/unbound.config @@ -12,6 +12,12 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_UNBOUND_APP_NAME=unbound +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +# Not instance-safe. A DNS resolver must own its fixed port 5335; a second copy could not bind it. +CFG_UNBOUND_MULTI_INSTANCE=false CFG_UNBOUND_BACKUP=true CFG_UNBOUND_BACKUP_STRATEGY=auto CFG_UNBOUND_UPDATE_TYPE=auto diff --git a/containers/vikunja/vikunja.config b/containers/vikunja/vikunja.config index 6f1cb79..bb1243b 100644 --- a/containers/vikunja/vikunja.config +++ b/containers/vikunja/vikunja.config @@ -12,6 +12,11 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_VIKUNJA_APP_NAME=vikunja +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_VIKUNJA_MULTI_INSTANCE=true CFG_VIKUNJA_BACKUP=true CFG_VIKUNJA_BACKUP_STRATEGY=auto CFG_VIKUNJA_UPDATE_TYPE=auto diff --git a/containers/wireguard/wireguard.config b/containers/wireguard/wireguard.config index 81c4c26..fcb7c45 100755 --- a/containers/wireguard/wireguard.config +++ b/containers/wireguard/wireguard.config @@ -12,6 +12,11 @@ # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) # CFG_WIREGUARD_APP_NAME=wireguard +# MULTI_INSTANCE = if true, this app can run as multiple isolated instances +# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on +# apps whose compose identity (container_name, Traefik routers, backup labels) +# is instance-safe — see scripts/instance/instance_create.sh. +CFG_WIREGUARD_MULTI_INSTANCE=true CFG_WIREGUARD_SUBNET= CFG_WIREGUARD_BACKUP=true CFG_WIREGUARD_BACKUP_STRATEGY=auto