LibrePortal v0.1.0 — initial release

A free, open, self-hosted app platform (GNU AGPLv3): one-click app deploys,
Traefik reverse proxy with automatic SSL, rootless Docker support, gluetun
VPN routing, and a web dashboard to manage it all.

Free & open forever to self-host; optional paid hosted services fund it.
See PROMISE.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Signed-off-by: librelad <librelad@digitalangels.vip>

.claude/settings.json

@@ -0,0 +1,5 @@
+{
+  "enabledPlugins": {
+    "frontend-design@claude-plugins-official": true
+  }
+}

.gitignore

@@ -0,0 +1,12 @@
+# Claude sandbox + working notes.
+# .claude-work was getting mirrored back into SRC by update.sh, creating
+# nested copies on every run. Excluding the directory name everywhere belts-
+# and-suspenders the fix in update.sh (the missing trailing slash on rsync).
+.claude-work/
+
+# Living spec authored in the sandbox; persisted at SRC root but not tracked.
+/APPS.md
+
+# Node dependencies — installed via `npm ci` at image build, never vendored.
+node_modules/
+npm-debug.log*

CONTRIBUTING.md

@@ -0,0 +1,40 @@
+# Contributing to LibrePortal
+
+Thanks for wanting to help — LibrePortal is built in the open, and
+contributions are genuinely welcome.
+
+## Ground rules
+
+- LibrePortal is **AGPLv3**. By contributing, your work is offered under that
+  same license (see the DCO below).
+- **Match the surrounding code** — keep it simple and readable, and follow
+  the style of the file you're editing.
+- Keep pull requests focused: one change per PR where you can.
+
+## Developer Certificate of Origin (DCO)
+
+We use the [DCO](https://developercertificate.org/) instead of a CLA — no
+paperwork, just a sign-off certifying you have the right to submit your code.
+
+Add a `Signed-off-by` line to every commit by committing with `-s`:
+
+```bash
+git commit -s -m "your message"
+```
+
+That appends:
+
+```
+Signed-off-by: Your Name <you@example.com>
+```
+
+By signing off, you agree to the DCO: that you wrote the patch (or otherwise
+have the right to submit it) and that it may be included under the project's
+AGPLv3 license.
+
+## Bugs & ideas
+
+Open an issue — clear steps to reproduce and your environment details help a
+lot.
+
+Thanks for helping keep self-hosting free and open. 🕊️

LICENSE

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

PROMISE.md

@@ -0,0 +1,46 @@
+# The LibrePortal Promise
+
+LibrePortal is free software, and it always will be. This is our commitment
+to you — in plain language, so you can hold us to it.
+
+## What "free" means here
+
+You can **run, study, modify, share, and fully use 100% of LibrePortal —
+every feature — for free, forever.** The entire platform is licensed under
+the GNU AGPLv3 (see [LICENSE](LICENSE)). There are **no feature paywalls in
+the software, no crippled "community edition," and no telemetry** phoning
+home.
+
+If you self-host LibrePortal, you get everything. No asterisks.
+
+## How we keep the lights on
+
+Building and maintaining this takes real work, and we want to do it
+sustainably — without betraying a word of the above. So we charge only for
+things that **aren't the software**:
+
+- **LibrePortal Cloud** — optional hosted services we run for you: remote
+  access (no port-forwarding), off-site encrypted backups, a free subdomain
+  with automatic HTTPS, phone notifications, and more.
+- **Managed hosting** — we run LibrePortal for you, if you'd rather not.
+- **Support** — priority help for those who want it.
+
+## The line we will not cross
+
+**Every paid service has a free, self-hostable equivalent in the open code.**
+You pay us for the convenience of not running it yourself — *never* to
+*unlock* a capability. Want to run your own relay or point backups at your
+own storage? The code to do that is right here, free.
+
+**Our litmus test:** before anything becomes paid, we ask — *could you do
+this yourself with the open code?* If yes, we may also offer a hosted
+version. If the only way to get it is to pay us, we don't ship it.
+
+## What we will never do
+
+- Paywall a feature of the software you run on your own machine.
+- Add tracking or telemetry.
+- **Rug-pull.** What is open stays open — we will never relicense released
+  code out from under the community.
+
+That's the deal. Thanks for trusting us with your corner of the internet. 🕊️

README.md

@@ -0,0 +1,49 @@
+# LibrePortal
+
+**Your own private corner of the internet — free, open, and yours.**
+
+LibrePortal is a self-hosted platform for running the apps you rely on, on
+your own server: one-click installs, a reverse proxy with automatic SSL,
+rootless Docker, optional VPN routing, and a clean web dashboard to manage
+it all.
+
+> ⚠️ **v0.1.0 — early days.** Expect rough edges while things settle.
+
+## Free & open — forever
+
+The entire platform is **free software under the [GNU AGPLv3](LICENSE)**.
+Self-host it and you get **everything** — every feature, no paywalls, no
+telemetry. See [our Promise](PROMISE.md) for exactly what that means.
+
+## What you get
+
+- 📦 One-click self-hosted apps (Nextcloud, Vaultwarden, Jellyfin, Gitea, …)
+- 🔀 Traefik reverse proxy + automatic Let's Encrypt SSL
+- 🔒 Rootless Docker, CrowdSec, sane security defaults
+- 🛡️ Optional VPN routing (gluetun) for any app
+- 🖥️ A web dashboard to install, configure, back up, and monitor everything
+
+## Quick start
+
+```bash
+git clone https://gitea.scottwebstar.co.uk/Webstar/LibrePortal.git
+cd LibrePortal
+./init.sh
+```
+
+## LibrePortal Cloud (optional)
+
+Self-hosting is free and complete. If you'd rather not run the fiddly parts
+yourself, **LibrePortal Cloud** offers them as paid, hosted services — remote
+access, off-site backups, notifications, and more. **Every one has a free,
+self-hostable equivalent in this repo** — you pay for convenience, never to
+unlock. [Our Promise](PROMISE.md) spells out exactly where that line sits.
+
+## Contributing
+
+PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). We use a lightweight
+DCO sign-off (`git commit -s`), no CLA.
+
+## License
+
+[GNU AGPLv3](LICENSE). What's open stays open.

configs/backup/.category

@@ -0,0 +1,5 @@
+TITLE=Backup
+DESCRIPTION=Backup schedules, retention, and engine settings
+ICON=backup
+ORDER=3
+SUBCATEGORY_ORDER=backup_general,backup_retention,backup_advanced

configs/backup/backup_advanced

@@ -0,0 +1,8 @@
+# ================================================================================
+# Backup Advanced - **ADVANCED** Engine-level knobs most users won't need to touch
+# ================================================================================
+CFG_BACKUP_ENGINE=restic                                       # Default Backup Engine - Fallback engine for new locations (each location can override) [restic:restic|borg:BorgBackup|kopia:Kopia]
+CFG_BACKUP_STRATEGY=stop-snapshot-start                        # Backup Strategy - How containers are quiesced before snapshotting [stop-snapshot-start:Stop → snapshot → start (safe default)|pause-snapshot-unpause:Pause → snapshot → unpause (less downtime)|live:Live — snapshot while running (only with DB dump hooks)]
+CFG_BACKUP_VERIFY_AFTER=true                                   # Verify After Backup - Run integrity check after each backup
+CFG_BACKUP_VERIFY_DATA_PERCENT=5                               # Verify Data Sample % - Percentage of repo data to checksum-verify weekly
+CFG_BACKUP_PARALLEL_REPOS=true                                 # Parallel Repos - Push to all enabled locations in parallel

configs/backup/backup_general

@@ -0,0 +1,5 @@
+# ================================================================================
+# Backup General - Scheduling
+# ================================================================================
+CFG_BACKUP_CRONTAB_APP="0 5 * * *"                             # App Backup Schedule - Crontab schedule for application backups
+CFG_BACKUP_CRONTAB_APP_INTERVAL=3                              # App Backup Interval - Minutes between app backup checks

configs/backup/backup_retention

@@ -0,0 +1,13 @@
+# ================================================================================
+# Backup Retention - Default retention policy applied at every forget pass.
+# Per-location overrides supported via the Locations edit modal.
+#
+# Most users should pick a "Backup style" preset on the Schedule page rather
+# than editing these directly. Blank values mean "do not enforce this tier".
+# ================================================================================
+CFG_BACKUP_KEEP_LAST=                                           # Keep Last N - Always keep this many most-recent snapshots
+CFG_BACKUP_KEEP_DAILY=30                                        # Keep Daily - Keep one snapshot per day for this many days
+CFG_BACKUP_KEEP_WEEKLY=                                         # Keep Weekly - Keep one snapshot per week for this many weeks
+CFG_BACKUP_KEEP_MONTHLY=                                        # Keep Monthly - Keep one snapshot per month for this many months
+CFG_BACKUP_KEEP_YEARLY=                                         # Keep Yearly - Keep one snapshot per year for this many years
+CFG_BACKUP_PRUNE_AFTER_FORGET=true                              # Prune After Forget - Reclaim repo space after forgetting snapshots

configs/backup/locations/1/location.config

@@ -0,0 +1,27 @@
+# Backup location 1 — default local repo seeded with LibrePortal.
+# Edit via the Locations page on /backup, or directly here.
+CFG_BACKUP_LOC_1_NAME="Local disk"                              # Location Name - Friendly label shown in the UI
+CFG_BACKUP_LOC_1_ENABLED=true                                   # Enabled - Snapshot to this location
+CFG_BACKUP_LOC_1_ENGINE=restic                                  # Engine - Backup engine used at this location [restic:restic|borg:BorgBackup|kopia:Kopia]
+CFG_BACKUP_LOC_1_PASSWORD=RANDOMIZEDPASSWORD1                   # Repository Password - Used to encrypt/decrypt snapshots — back up offline!
+CFG_BACKUP_LOC_1_TYPE=local                                     # Type - Backend [local:Local / mounted path|sftp:SFTP|rest:REST|s3:S3|b2:Backblaze B2|gs:Google Cloud Storage|azure:Azure|rclone:rclone]
+CFG_BACKUP_LOC_1_PATH_MODE=auto                                 # Path Mode - Where this location stores its data [auto:Automatic (/docker/backups/<id>)|custom:Custom path]
+CFG_BACKUP_LOC_1_PATH=                                          # Custom Path - Filesystem path on this server (used when Path Mode = Custom)
+CFG_BACKUP_LOC_1_URI=                                           # URI Override - Custom restic URI (leave blank to build from the fields below)
+CFG_BACKUP_LOC_1_SSH_USER=                                      # SSH User - For sftp type
+CFG_BACKUP_LOC_1_SSH_HOST=                                      # SSH Host - For sftp type
+CFG_BACKUP_LOC_1_SSH_PORT=22                                    # SSH Port - For sftp type
+CFG_BACKUP_LOC_1_SSH_PATH=                                      # SSH Remote Path - Path on the remote host where the repo lives
+CFG_BACKUP_LOC_1_SSH_AUTH=key                                   # SSH Authentication - [key:SSH key (~/.ssh/id_rsa)|password:Password (via sshpass)]
+CFG_BACKUP_LOC_1_SSH_PASS=                                      # SSH Password - Used only when SSH Authentication is set to Password
+CFG_BACKUP_LOC_1_S3_ACCESS_KEY=                                 # S3 Access Key - For s3 type
+CFG_BACKUP_LOC_1_S3_SECRET_KEY=                                 # S3 Secret Key - For s3 type
+CFG_BACKUP_LOC_1_B2_ACCOUNT_ID=                                 # B2 Account ID - For b2 type
+CFG_BACKUP_LOC_1_B2_ACCOUNT_KEY=                                # B2 Account Key - For b2 type
+CFG_BACKUP_LOC_1_APPEND_ONLY=false                              # Append-only - Refuse forget/prune for this location (ransomware-safe)
+CFG_BACKUP_LOC_1_CUSTOM_RETENTION=false                         # Custom Retention - Override the global retention for this location
+CFG_BACKUP_LOC_1_KEEP_LAST=                                     # Keep Last - Snapshots to always retain (blank = global)
+CFG_BACKUP_LOC_1_KEEP_DAILY=                                    # Keep Daily - Days (blank = global)
+CFG_BACKUP_LOC_1_KEEP_WEEKLY=                                   # Keep Weekly - Weeks (blank = global)
+CFG_BACKUP_LOC_1_KEEP_MONTHLY=                                  # Keep Monthly - Months (blank = global)
+CFG_BACKUP_LOC_1_KEEP_YEARLY=                                   # Keep Yearly - Years (blank = global)

configs/features/.category

@@ -0,0 +1,5 @@
+TITLE=Features
+DESCRIPTION=Toggle system components and features
+ICON=features
+ORDER=5
+SUBCATEGORY_ORDER=features_core,features_security,features_terminal

configs/features/features_core

@@ -0,0 +1,18 @@
+# ================================================================================
+# Core Features - Essential LibrePortal functionality and core services
+# ================================================================================
+CFG_REQUIREMENT_CONFIG=true                               # Configuration Management - Enable configuration management system for LibrePortal settings
+CFG_REQUIREMENT_COMMAND=true                              # Command Line Tool - Install the libreportal command line tool for system management
+CFG_REQUIREMENT_WEBUI=true                                # Web Interface - Install and manage the LibrePortal web based management interface
+CFG_REQUIREMENT_WEBUI_SERVICE=true                        # Web Task Service - Install the task management systemd service for the web interface
+CFG_REQUIREMENT_DATABASE=true                             # Database Support - Install and configure database support for application data storage
+CFG_REQUIREMENT_PASSWORDS=true                            # Password Management - Enable password generation and management features
+CFG_REQUIREMENT_DOCKER_CE=true                            # Docker CE - Install Docker Community Edition instead of the default Docker version
+CFG_REQUIREMENT_DOCKER_COMPOSE=true                       # Docker Compose - Install Docker Compose for multi container application management
+CFG_REQUIREMENT_DOCKER_NETWORK=true                       # Docker Network - Create and manage Docker network for container communication
+CFG_REQUIREMENT_UFW=true                                  # Firewall Protection - Install and configure the Uncomplicated Firewall for system security
+CFG_REQUIREMENT_UFWD=true                                 # Docker Firewall - Install UFW Docker for container aware firewall management which is rooted Docker specific
+CFG_REQUIREMENT_SSLCERTS=true                             # SSL Certificates - Generate and manage SSL certificates for secure HTTPS connections
+CFG_REQUIREMENT_CRONTAB=true                              # Scheduled Tasks - Setup scheduled tasks and automated maintenance jobs
+CFG_REQUIREMENT_WHITELIST_PORT_UPDATER=true               # Auto Port Management - Automatically update port whitelist when applications are installed or removed
+CFG_REQUIREMENT_BCRYPT_SAVE=true                          # Password Encryption - Encrypt saved passwords using bcrypt for enhanced security

configs/features/features_security

@@ -0,0 +1,7 @@
+# ================================================================================
+# Security and Authentication - SSH access and security configuration
+# ================================================================================
+CFG_REQUIREMENT_SSHKEY_DOWNLOADER=false                   # SSH Key Downloader - Enable SSH key download functionality for remote access
+CFG_REQUIREMENT_SSH_DISABLE_PASSWORDS=false               # SSH Password Disable - Disable password authentication for SSH requiring key based access only
+CFG_REQUIREMENT_GLUETUN_FOR_ALL=false                     # Gluetun For All Apps - Allow routing through Gluetun VPN for every app (default: only curated categories)
+

configs/features/features_terminal

@@ -0,0 +1,11 @@
+# ================================================================================
+# Terminal Only - Advanced terminal based features and utilities **ADVANCED**
+# ================================================================================
+CFG_REQUIREMENT_SUGGEST_INSTALLS=false                    # Install Suggestions - Enable application suggestions and recommendations during installation
+CFG_REQUIREMENT_SUGGEST_METRICS=true                      # Metrics Suggestions - Offer Prometheus and Grafana during first install (requires Install Suggestions enabled)
+CFG_REQUIREMENT_CONTINUE_PROMPT=false                     # Continue Prompts - Show continue prompts during installation for user confirmation
+CFG_REQUIREMENT_CONFIGS_CHECK=true                        # Config Validation - Validate configuration files on startup for errors and consistency
+CFG_REQUIREMENT_CONFIGS_AUTO_UPDATE=true                  # Auto Config Updates - Automatically update configuration files when system changes are detected
+CFG_REQUIREMENT_MISSING_IPS=false                         # IP Configuration Check - Check for and alert about missing IP configurations
+CFG_REQUIREMENT_DOCKER_NETWORK_PRUNE=true                 # Docker Network Cleanup - Enable automatic cleanup of unused Docker networks
+CFG_REQUIREMENT_DOCKER_SWITCHER=true                      # Docker Switcher - Install Docker version switching utility for managing multiple Docker versions

configs/general/.category

@@ -0,0 +1,5 @@
+TITLE=General
+DESCRIPTION=Basic system settings and identification
+ICON=general
+ORDER=1
+SUBCATEGORY_ORDER=general_basic,general_mail,general_install,general_docker_install,general_terminal,general_libreportal

configs/general/general_basic

@@ -0,0 +1,5 @@
+# ================================================================================
+# General - Basic system settings and identification
+# ================================================================================
+CFG_INSTALL_NAME=Change-Me                               # Installation Name - The name for your LibrePortal instance
+CFG_TIMEZONE=Etc/UTC                                     # System Timezone - Timezone for scheduled tasks and logging timestamps

configs/general/general_docker_install

@@ -0,0 +1,7 @@
+# ================================================================================
+# Docker - Container runtime installation and configuration **ADVANCED**
+# ================================================================================
+CFG_DOCKER_INSTALL_TYPE=rooted                           # Docker Installation Type - Security based setup rooted or rootless Docker installation [rooted|rootless]
+CFG_DOCKER_INSTALL_USER=dockerinstall                    # Docker Install User - Username for Docker installation operations
+CFG_DOCKER_INSTALL_PASS=RANDOMIZEDPASSWORD2              # Docker Install Password - Password for Docker install user
+

configs/general/general_install

@@ -0,0 +1,9 @@
+# ================================================================================
+# Installation Setup - Local or Git Repository configuration and version control
+# ================================================================================
+CFG_INSTALL_MODE=local                     # Installation Mode - Method used for installation of LibrePortal
+CFG_GIT_URL=changeme                                     # Git Repository URL - Git repository URL for LibrePortal configuration
+CFG_GIT_USER=changeme                                    # Git Username - Git username for repository authentication
+CFG_GIT_KEY=changeme                                     # Git Access Key - SSH key or API key for Git repository access
+CFG_GIT_UPDATES=true                                     # Auto Check Updates - Check for Git repository updates automatically
+CFG_GIT_AUTO_UPDATES=true                                # Auto Apply Updates - Automatically apply Git updates when available

configs/general/general_libreportal

@@ -0,0 +1,4 @@
+# ================================================================================
+# LibrePortal - Specific LibrePortal configurations **ADVANCED**
+# ================================================================================
+CFG_LIBREPORTAL_USER_PASS=changeme                        # LibrePortal User Password - Password for the LibrePortal system user account

configs/general/general_mail

@@ -0,0 +1,10 @@
+# ================================================================================
+# Mail - Mail Server Settings
+# ================================================================================
+CFG_MAIL_ENABLED=false                                # Mail Enabled - Enable mail server configuration for applications
+CFG_MAIL_HOST=mail.domain.com                     # Mail Server Host - Your mail server hostname
+CFG_MAIL_PORT=587                                 # Mail Server Port - Usually 587 for TLS, 465 for SSL, 25 for none
+CFG_MAIL_SECURE=tls                               # Security - tls, ssl, or none
+CFG_MAIL_USERNAME=your-email@domain.com            # Mail Username - Your email address for authentication
+CFG_MAIL_PASSWORD=your-app-password                 # Mail Password - Use app password for authentication
+CFG_MAIL_FROM=noreply@domain.com                  # From Email Address - Sender email address

configs/general/general_terminal

@@ -0,0 +1,9 @@
+# ================================================================================
+# Terminal - System utilities and advanced settings **ADVANCED**
+# ================================================================================
+CFG_UPDATER_CHECK=60                                     # Update Check Interval - Hours between system update checks
+CFG_SWAPFILE_SIZE=2G                                     # Swap File Size - Size of swap file for memory management
+CFG_GENERATED_PASS_LENGTH=14                             # Password Length - Length for auto generated passwords
+CFG_GENERATED_USER_LENGTH=8                              # Username Length - Length for auto generated usernames
+CFG_UFW_LOGGING=off                                      # Firewall Logging - UFW firewall logging level [off|low|medium|high|full]
+CFG_TEXT_EDITOR=nano                                     # Text Editor - Default text editor for system operations [nano|vim]

configs/network/.category

@@ -0,0 +1,5 @@
+TITLE=Network
+DESCRIPTION=Network configuration and domain management
+ICON=network
+ORDER=4
+SUBCATEGORY_ORDER=network_domains,network_whitelist,network_dns,network_docker,network_ports,network_headscale

configs/network/network_dns

@@ -0,0 +1,8 @@
+# ================================================================================
+# DNS - Dynamic Name Server Addresses
+# ================================================================================
+
+CFG_DNS_SERVER_1=9.9.9.9                                 # Primary DNS - Primary DNS server for network resolution
+CFG_DNS_SERVER_2=9.9.9.11                                # Secondary DNS - Secondary DNS server for network resolution
+
+CFG_REQUIREMENT_DNS_UPDATER=false                        # DNS Updater - Use AdGuard or Pi-hole as this server's DNS resolver when installed (rewrites /etc/resolv.conf). Off by default.

configs/network/network_docker

@@ -0,0 +1,7 @@
+# ================================================================================
+# Docker Network - Network settings for the Docker Network **ADVANCED**
+# ================================================================================
+
+CFG_NETWORK_NAME=vpn                                     # Network Name - Docker network name for container communication
+CFG_NETWORK_SUBNET=10.100.0.0/16                         # Network Subnet - Subnet range for Docker network
+CFG_NETWORK_MTU=1500                                     # Network MTU - Maximum transmission unit for network packets

configs/network/network_domains

@@ -0,0 +1,12 @@
+# ================================================================================
+# Domains - Domain configuration for Traefik web services
+# ================================================================================
+CFG_DOMAIN_1=                                            # Domain 1 - Domain slot 1 for a Traefik
+CFG_DOMAIN_2=                                            # Domain 2 - Domain slot 2 for a Traefik
+CFG_DOMAIN_3=                                            # Domain 3 - Domain slot 3 for a Traefik
+CFG_DOMAIN_4=                                            # Domain 4 - Domain slot 4 for a Traefik
+CFG_DOMAIN_5=                                            # Domain 5 - Domain slot 5 for a Traefik
+CFG_DOMAIN_6=                                            # Domain 6 - Domain slot 6 for a Traefik
+CFG_DOMAIN_7=                                            # Domain 7 - Domain slot 7 for a Traefik
+CFG_DOMAIN_8=                                            # Domain 8 - Domain slot 8 for a Traefik
+CFG_DOMAIN_9=                                            # Domain 9 - Domain slot 9 for a Traefik

configs/network/network_headscale

@@ -0,0 +1,5 @@
+# ================================================================================
+# Headscale - VPN service configuration **ADVANCED**
+# ================================================================================
+CFG_HEADSCALE_HOST=                                      # Headscale Host - Headscale server hostname for VPN services
+CFG_HEADSCALE_KEY=                                       # Headscale Key - Authentication key for Headscale server

configs/network/network_ports

@@ -0,0 +1,5 @@
+# ================================================================================
+# Ports - Settings for the Network Ports **ADVANCED**
+# ================================================================================
+
+CFG_PORT_RANGE=3000-9999                                 # Port allocation range - Range for port allocation Start to End

configs/network/network_whitelist

@@ -0,0 +1,4 @@
+# ================================================================================
+# Whitelist - Allow specific IPs for Specified Treafik Apps
+# ================================================================================
+CFG_IPS_WHITELIST=HOSTIPHERE                             # IP Whitelist - Comma separated list of allowed IP addresses

configs/security/.category

@@ -0,0 +1,5 @@
+TITLE=Security
+DESCRIPTION=Intrusion prevention, bouncers, and host firewall configuration
+ICON=security
+ORDER=5
+SUBCATEGORY_ORDER=security_logins

configs/security/security_logins

@@ -0,0 +1,5 @@
+# ================================================================================
+# Logins - User accounts and authentication credentials
+# ================================================================================
+CFG_TRAEFIK_USER=RANDOMIZEDUSERNAME1                       # Traefik Username - Username for Traefik Admin Panel login and protected apps
+CFG_TRAEFIK_PASS=RANDOMIZEDPASSWORD2                       # Traefik Password - Password for Traefik Admin Panel login and protected apps

configs/webui/.category

@@ -0,0 +1,5 @@
+TITLE=WebUI
+DESCRIPTION=Web interface settings and preferences
+ICON=webui
+ORDER=2
+SUBCATEGORY_ORDER=webui_logins,webui_logs

configs/webui/webui_logins

@@ -0,0 +1,5 @@
+# ================================================================================
+# WebUI Logins - Web interface authentication settings
+# ================================================================================
+CFG_WEBUI_USERNAME=RANDOMIZEDUSERNAME1                                    # WebUI Username - Username for web interface login
+CFG_WEBUI_PASSWORD=RANDOMIZEDPASSWORD1                                 # WebUI Password - Password for web interface login

configs/webui/webui_logs

@@ -0,0 +1,6 @@
+# ================================================================================
+# WebUI Logs - Log-streaming behaviour for the Services tab **ADVANCED**
+# ================================================================================
+CFG_WEBUI_LOG_STREAM_IDLE_TIMEOUT_MINUTES=10               # Idle Timeout - Disconnect a log stream after this much silence. The viewer overlays a Resume button so the user can re-open the stream. 0 disables.
+CFG_WEBUI_LOG_STREAM_MAX_DURATION_MINUTES=60               # Max Duration - Hard cap on a single stream. Resume button appears at the cap. 0 disables (not recommended).
+CFG_WEBUI_LOG_STREAM_MAX_LINES_PER_SEC=200                 # Max Lines per Second - Burst ceiling. Excess lines drop with a per-second notice.

containers/adguard/adguard.config

@@ -0,0 +1,79 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# AUTHELIA = if true, use Authelia authentication, if false turned off.
+# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
+# USER = admin username for the AdGuardHome web UI
+# PASSWORD = plain text admin password for the AdGuardHome web UI
+# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
+#
+CFG_ADGUARD_APP_NAME=adguard
+CFG_ADGUARD_BACKUP=true
+CFG_ADGUARD_COMPOSE_FILE=default
+CFG_ADGUARD_HEALTHCHECK=true
+CFG_ADGUARD_AUTHELIA=false
+CFG_ADGUARD_HEADSCALE=false
+CFG_ADGUARD_USER=admin
+CFG_ADGUARD_PASSWORD=RANDOMIZEDPASSWORD1
+CFG_ADGUARD_MONITORING=false
+#
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+#
+CFG_ADGUARD_CATEGORY="networking"
+CFG_ADGUARD_TITLE="AdGuard"
+CFG_ADGUARD_DESCRIPTION="DNS based Ad Blocking"
+CFG_ADGUARD_LONG_DESCRIPTION="AdGuard Home is a network-wide software for advertisements and tracking blocking that operates as a DNS server and returns the IP address of a local, blackhole DNS server for domains that should be blocked"
+CFG_ADGUARD_URL="https://github.com/AdguardTeam/AdGuardHome"
+CFG_ADGUARD_ACTIONS="configure|install|restart|shutdown|uninstall"
+#
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# HOST_NAME = subdomain name e.g test is the name for test.website.com
+# WHITELIST = if true only allow whitelisted ips on traefik, if false allow all
+#
+CFG_ADGUARD_DOMAIN=1
+CFG_ADGUARD_WHITELIST=false
+CFG_ADGUARD_HOST_NAME=adguard
+CFG_ADGUARD_NETWORK=default
+#
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, dns, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_ADGUARD_PORT_1="adguard-service|webui|random:3000|public|tcp|true|true|true|Admin Interface|"
+CFG_ADGUARD_PORT_2="adguard-service|dns-tcp|random:53|public|tcp|false|false|false|DNS Server (TCP)|"
+CFG_ADGUARD_PORT_3="adguard-service|dns-udp|random:53|public|udp|false|false|false|DNS Server (UDP)|"
+CFG_ADGUARD_PORT_4="adguard-service|dns-alt|random:8053|disabled|tcp|false|false|false|Alternative DNS|"
+CFG_ADGUARD_PORT_5="adguard-service|dot|random:853|disabled|tcp|false|false|false|DNS-over-TLS|"
+CFG_ADGUARD_PORT_6="adguard-exporter|metrics|9617:9617|disabled|tcp|false|false|false|Metrics Exporter (sidecar, docker-network only)|"
+
+
+# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
+CFG_ADGUARD_AUTH_PROFILE=single_password
+CFG_ADGUARD_ADMIN_USER=
+CFG_ADGUARD_ADMIN_PASSWORD=RANDOMIZEDPASSWORD2

containers/adguard/adguard.sh

@@ -0,0 +1,276 @@
+#!/bin/bash
+
+# Category : Networking
+# Description : AdGuard - DNS based Ad Blocking (c/u/s/r/i):
+
+installAdguard()
+{
+    local config_variables="$1"
+
+    if [[ "$adguard" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent adguard;
+        local app_name=$CFG_ADGUARD_APP_NAME
+    	initializeAppVariables $app_name;
+    fi
+
+    if [[ "$adguard" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$adguard" == *[uU]* ]]; then
+        dockerUninstallApp $app_name;
+    fi
+
+    if [[ "$adguard" == *[sS]* ]]; then
+        dockerComposeDown $app_name;
+    fi
+
+    if [[ "$adguard" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$adguard" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+        monitoringToggleAppConfig "$app_name" "docker-compose.yml";
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Completing AdGuardHome initial setup automatically"
+        echo ""
+
+        # The legacy `$usedport1` variable is no longer populated by the
+        # current install pipeline; the resolved host port is stored in the
+        # PORTS_TAG_1 docker-compose tag (format `external:internal`). Pull
+        # it from there so the curl + URL printout actually point somewhere.
+        local adguard_compose_file="$containers_dir$app_name/docker-compose.yml"
+        local adguard_port_pair
+        adguard_port_pair=$(tagsManagerGetTagContent "$adguard_compose_file" "PORTS_TAG_1")
+        local adguard_admin_port="${adguard_port_pair%%:*}"
+
+        if [[ -n "$public_ip_v4" && -n "$adguard_admin_port" ]]; then
+            echo "    External : http://$public_ip_v4:$adguard_admin_port/"
+        fi
+        if [[ -n "$host_setup" ]]; then
+            echo "    Hostname : http://$host_setup/"
+        fi
+        echo ""
+
+        # AdGuardHome ships a setup wizard that normally needs five clicks in a
+        # browser before the daemon writes its config file. Same wizard is
+        # exposed as an HTTP API (POST /control/install/configure), so we
+        # drive it from here and skip the manual interaction. We pre-poll the
+        # admin endpoint until the container is up, then send the form, then
+        # let the existing post-install sed edits run against the freshly
+        # written AdGuardHome.yaml.
+        local adguard_setup_url="http://127.0.0.1:${adguard_admin_port}"
+        local adguard_attempts=0
+        local adguard_max_attempts=60
+        while ((adguard_attempts < adguard_max_attempts)); do
+            if curl -fsS -o /dev/null --max-time 2 "${adguard_setup_url}/control/status" 2>/dev/null \
+               || curl -fsS -o /dev/null --max-time 2 "${adguard_setup_url}/control/install/get_addresses" 2>/dev/null; then
+                break
+            fi
+            sleep 2
+            ((adguard_attempts++))
+        done
+
+        if ((adguard_attempts >= adguard_max_attempts)); then
+            isError "AdGuardHome admin endpoint did not respond on $adguard_setup_url within $((adguard_max_attempts * 2))s — open the URL and complete setup manually, then re-run the installer to apply the post-setup tweaks."
+        else
+            local adguard_user="${CFG_ADGUARD_USER:-admin}"
+            local adguard_pass="${CFG_ADGUARD_PASSWORD:-}"
+            if [[ -z "$adguard_pass" ]]; then
+                adguard_pass=$(generateRandomPassword)
+                updateConfigOption "CFG_ADGUARD_PASSWORD" "$adguard_pass" >/dev/null 2>&1 || true
+                isNotice "Generated a random AdGuardHome admin password and saved it to CFG_ADGUARD_PASSWORD."
+            fi
+
+            # Internal container ports are fixed (3000 admin, 53 DNS); host
+            # mapping is what `usedport1` etc. handle.
+            local adguard_payload
+            adguard_payload=$(cat <<JSON
+{
+  "web": { "ip": "0.0.0.0", "port": 3000, "autofix": false },
+  "dns": { "ip": "0.0.0.0", "port": 53, "autofix": false },
+  "username": "${adguard_user}",
+  "password": "${adguard_pass}"
+}
+JSON
+)
+            if curl -fsS -X POST \
+                 -H 'Content-Type: application/json' \
+                 --data "$adguard_payload" \
+                 --max-time 15 \
+                 "${adguard_setup_url}/control/install/configure" >/dev/null 2>&1; then
+                isSuccessful "AdGuardHome admin setup completed automatically (user: $adguard_user)."
+            else
+                # 422/403 here typically means setup was already done on a
+                # previous install; the post-setup tweaks below are still
+                # safe to run against the existing yaml.
+                isNotice "AdGuardHome /control/install/configure rejected the request — assuming it's already configured. If this is a fresh install, complete setup manually at $adguard_setup_url."
+            fi
+            # Small breather so AdGuardHome finishes flushing AdGuardHome.yaml
+            # to disk before the sed edits below touch it.
+            #sleep 3
+        fi
+
+        #result=$(sudo sed -i "s/address: 0.0.0.0:80/address: 0.0.0.0:${usedport2}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        #checkSuccess "Changing port 80 to $usedport2 for Admin Panel"
+
+        #result=$(sudo sed -i "s/port: 53/port: ${usedport3}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        #checkSuccess "Changing port 53 to $usedport3 for DNS Port"
+
+        #result=$(sudo sed -i "s/port_https: 443/port_https: ${usedport4}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        #checkSuccess "Changing port 443 to $usedport4 for DNS Port"
+
+        #result=$(sudo sed -i "s/port_dns_over_tls: 853/port_dns_over_tls: ${usedport5}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        #checkSuccess "Changing port 853 to $usedport5 for port_dns_over_tls"
+
+        #result=$(sudo sed -i "s/port_dns_over_quic: 853/port_dns_over_quic: ${usedport5}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        #checkSuccess "Changing port 853 to $usedport5 for port_dns_over_quic"
+
+        # NOTE: We deliberately do *not* force `tls.enabled: true` here.
+        # That section configures encrypted DNS (DoT/DoH/DoQ) and AdGuardHome
+        # crash-loops on startup with `[fatal] creating dns server: parsing
+        # tls key pair: tls: failed to find any PEM data in certificate input`
+        # if `enabled: true` is set without a real certificate pair pointed
+        # at by `certificate_path` / `private_key_path`. The admin user can
+        # opt into encrypted DNS from Settings → Encryption once they've
+        # provided a cert.
+
+        if [[ $public == "true" ]]; then
+            result=$(sudo sed -i "s|allow_unencrypted_doh: false|allow_unencrypted_doh: true|g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+            checkSuccess "Setting allow_unencrypted_doh to false for Traefik"
+        fi
+
+        result=$(sudo sed -i "s|anonymize_client_ip: false: false|anonymize_client_ip: true|g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        checkSuccess "Setting anonymize_client_ip to true for privacy reasons"
+
+        # Force the admin web bind back to 0.0.0.0:3000 inside the container.
+        # The docker-compose mapping is `<host_port>:3000`, so the container
+        # MUST listen on 3000 internally for the host port to reach it. After
+        # the install API call AdGuardHome sometimes ends up bound to 0.0.0.0:80
+        # (its build-time default) instead of the port we sent — which is
+        # exactly what causes "unable to connect" on the host port.
+        local adguard_yaml="$containers_dir$app_name/conf/AdGuardHome.yaml"
+        if [[ -f "$adguard_yaml" ]]; then
+            # New schema (v0.107+): single `address: 0.0.0.0:NN` line under `http:`.
+            sudo sed -i 's|^\(\s*address:\s*\)0\.0\.0\.0:[0-9]\+|\10.0.0.0:3000|' "$adguard_yaml"
+            # Old schema fallback: separate `bind_host:` / `bind_port:` keys.
+            sudo sed -i 's|^\(\s*bind_host:\s*\).*|\10.0.0.0|' "$adguard_yaml"
+            sudo sed -i 's|^\(\s*bind_port:\s*\)[0-9]\+|\13000|' "$adguard_yaml"
+            checkSuccess "Pinned AdGuardHome admin bind to 0.0.0.0:3000 (matches the compose port mapping)."
+        fi
+
+        dockerComposeRestart "$app_name";
+
+        # Health-check after the restart so the user finds out *here* if
+        # AdGuardHome didn't come back up cleanly, rather than later when
+        # they try to open the URL and just see "unable to connect".
+        #
+        # Drop `-f` and accept any HTTP status code: now that the admin
+        # account is configured, `/control/status` returns 401 to an
+        # unauthenticated request — which is fine, it means the server is
+        # up and answering. We only care whether the connection succeeded
+        # at all, not what the response body says. `-w '%{http_code}'`
+        # gives us a 3-digit code on success and an empty string on a
+        # connection failure / timeout.
+        local adguard_health_attempts=0
+        while ((adguard_health_attempts < 20)); do
+            local adguard_health_code
+            adguard_health_code=$(curl -sS -o /dev/null --max-time 2 \
+                -w '%{http_code}' "${adguard_setup_url}/control/status" 2>/dev/null)
+            if [[ "$adguard_health_code" =~ ^[1-5][0-9][0-9]$ ]]; then
+                isSuccessful "AdGuardHome admin UI is reachable on $adguard_setup_url (HTTP $adguard_health_code)"
+                break
+            fi
+            sleep 1
+            ((adguard_health_attempts++))
+        done
+        if ((adguard_health_attempts >= 20)); then
+            isError "AdGuardHome admin UI did not respond after restart on $adguard_setup_url. Check the container logs (\`docker logs adguard-service\`) and the conf/AdGuardHome.yaml bind address."
+        fi
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating the WebUI config file."
+        echo ""
+
+        webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Refreshing monitoring integration."
+		echo ""
+
+		monitoringRefreshAll;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using any of the options below : "
+        echo ""
+
+        # Same final-summary call shape as wireguard / vaultwarden. Pass the
+        # admin user/password we just configured so the user sees the
+        # credentials exactly once, at the end of the install.
+        menuShowFinalMessages "$app_name" "${CFG_ADGUARD_USER:-admin}" "$CFG_ADGUARD_PASSWORD";
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    adguard=n
+}

containers/adguard/adguard.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 512 512"><path d="M505.8 58.8C428.2 18.4 334.1 0 256 0h-.3v511.8c-21.5-12.7-41.1-26-59.1-39.6 18 13.7 37.8 27 59.4 39.8C506.8 363.4 505.8 146 505.8 58.8" style="fill-rule:evenodd;clip-rule:evenodd;fill:#68bc71"/><path d="M255.7 511.8C5.2 363.3 6.2 146 6.2 58.8 83.7 18.4 177.7 0 255.7 0z" style="fill-rule:evenodd;clip-rule:evenodd;fill:#67b279"/><path d="m246.9 341.6 151-203.6c-11.1-8.9-20.8-2.6-26.1 2.2h-.2l-125.9 131-47.4-57.1c-22.6-26.2-53.4-6.2-60.6-.9z" style="fill-rule:evenodd;clip-rule:evenodd;fill:#fff"/></svg>

containers/adguard/docker-compose.yml

@@ -0,0 +1,61 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+  adguard-service: #LIBREPORTAL|SERVICE_TAG_1|adguard-service
+    container_name: adguard-service
+    image: adguard/adguardhome
+    restart: unless-stopped
+    hostname: adguard
+    # GLUETUN_OFF_BEGIN
+    ports:
+      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+      - "PORTS_DATA_2" #LIBREPORTAL|PORTS_TAG_2|PORTS_DATA_2
+      - "PORTS_DATA_3" #LIBREPORTAL|PORTS_TAG_3|PORTS_DATA_3
+      - "PORTS_DATA_4" #LIBREPORTAL|PORTS_TAG_4|PORTS_DATA_4
+      - "PORTS_DATA_5" #LIBREPORTAL|PORTS_TAG_5|PORTS_DATA_5
+    # GLUETUN_OFF_END
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
+      traefik.http.routers.adguard-service-webui.entrypoints: web,websecure
+      traefik.http.routers.adguard-service-webui.rule: Host(`DOMAINSUBNAME_DATA`) #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      traefik.http.routers.adguard-service-webui.service: adguard-service-webui
+      traefik.http.routers.adguard-service-webui.tls: true
+      traefik.http.routers.adguard-service-webui.tls.certresolver: production
+      traefik.http.services.adguard-service-webui.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+      traefik.http.routers.adguard-service-webui.middlewares: MIDDLEWARE_DATA_1 #LIBREPORTAL|MIDDLEWARE_TAG_1|MIDDLEWARE_DATA_1
+    healthcheck:
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+    volumes:
+      - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
+      - "./work:/opt/adguardhome/work"
+      - "./conf:/opt/adguardhome/conf"
+      - "./tailscale:/usr/local/bin/"
+    # GLUETUN_OFF_BEGIN
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+    # GLUETUN_OFF_END
+    # GLUETUN_ON_BEGIN
+    # network_mode: "container:gluetun-service"
+    # GLUETUN_ON_END
+
+  # >>> libreportal-monitoring >>>
+  #adguard-exporter:
+  #  container_name: adguard-exporter
+  #  image: ebrianne/adguard-exporter:latest
+  #  restart: unless-stopped
+  #  environment:
+  #    - ADGUARD_PROTOCOL=http
+  #    - ADGUARD_HOSTNAME=adguard-service:PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+  #    - ADGUARD_USERNAME=ADGUARD_USER_DATA #LIBREPORTAL|ADGUARD_USER_TAG|ADGUARD_USER_DATA
+  #    - ADGUARD_PASSWORD=ADGUARD_PASSWORD_DATA #LIBREPORTAL|ADGUARD_PASSWORD_TAG|ADGUARD_PASSWORD_DATA
+  #    - INTERVAL=30s
+  #    - LOG_LIMIT=10000
+  #    - SERVER_PORT=PORT_INTERNAL_DATA_6 #LIBREPORTAL|PORT_INTERNAL_TAG_6|PORT_INTERNAL_DATA_6
+  #  networks:
+  #    DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+  # <<< libreportal-monitoring <<<

containers/adguard/resources/monitoring/grafana-dashboards/adguard.json

@@ -0,0 +1,74 @@
+{
+  "annotations": { "list": [{ "builtIn": 1, "datasource": { "type": "grafana", "uid": "-- Grafana --" }, "enable": true, "hide": true, "iconColor": "rgba(0, 211, 255, 1)", "name": "Annotations & Alerts", "type": "dashboard" }] },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": null,
+  "links": [],
+  "panels": [
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] } } },
+      "gridPos": { "h": 4, "w": 6, "x": 0, "y": 0 },
+      "id": 1,
+      "options": { "colorMode": "value", "graphMode": "area", "reduceOptions": { "calcs": ["lastNotNull"] }, "textMode": "auto" },
+      "targets": [{ "datasource": { "type": "prometheus", "uid": "Prometheus" }, "expr": "adguard_num_dns_queries", "refId": "A" }],
+      "title": "DNS Queries",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }, { "color": "red", "value": 1 }] } } },
+      "gridPos": { "h": 4, "w": 6, "x": 6, "y": 0 },
+      "id": 2,
+      "options": { "colorMode": "value", "graphMode": "area", "reduceOptions": { "calcs": ["lastNotNull"] }, "textMode": "auto" },
+      "targets": [{ "datasource": { "type": "prometheus", "uid": "Prometheus" }, "expr": "adguard_num_blocked_filtering", "refId": "A" }],
+      "title": "Blocked (Filtering)",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] } } },
+      "gridPos": { "h": 4, "w": 6, "x": 12, "y": 0 },
+      "id": 3,
+      "options": { "colorMode": "value", "graphMode": "area", "reduceOptions": { "calcs": ["lastNotNull"] }, "textMode": "auto" },
+      "targets": [{ "datasource": { "type": "prometheus", "uid": "Prometheus" }, "expr": "adguard_num_replaced_safebrowsing", "refId": "A" }],
+      "title": "Replaced (Safe Browsing)",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }, "unit": "s" } },
+      "gridPos": { "h": 4, "w": 6, "x": 18, "y": 0 },
+      "id": 4,
+      "options": { "colorMode": "value", "graphMode": "area", "reduceOptions": { "calcs": ["lastNotNull"] }, "textMode": "auto" },
+      "targets": [{ "datasource": { "type": "prometheus", "uid": "Prometheus" }, "expr": "adguard_avg_processing_time", "refId": "A" }],
+      "title": "Avg Processing Time",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "fillOpacity": 10, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "showPoints": "never", "spanNulls": false } } },
+      "gridPos": { "h": 9, "w": 24, "x": 0, "y": 4 },
+      "id": 5,
+      "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "single", "sort": "none" } },
+      "targets": [
+        { "datasource": { "type": "prometheus", "uid": "Prometheus" }, "expr": "rate(adguard_num_dns_queries[5m])", "legendFormat": "queries/s", "refId": "A" },
+        { "datasource": { "type": "prometheus", "uid": "Prometheus" }, "expr": "rate(adguard_num_blocked_filtering[5m])", "legendFormat": "blocked/s", "refId": "B" }
+      ],
+      "title": "DNS Activity",
+      "type": "timeseries"
+    }
+  ],
+  "refresh": "30s",
+  "schemaVersion": 38,
+  "tags": ["libreportal", "adguard"],
+  "templating": { "list": [] },
+  "time": { "from": "now-6h", "to": "now" },
+  "timepicker": {},
+  "timezone": "",
+  "title": "AdGuard Home",
+  "uid": "libreportal-adguard",
+  "version": 1,
+  "weekStart": ""
+}

containers/adguard/resources/monitoring/prometheus-scrape.yml

@@ -0,0 +1,4 @@
+- job_name: adguard
+  metrics_path: /metrics
+  static_configs:
+    - targets: ['adguard-exporter:PORT_INTERNAL_DATA_6'] #LIBREPORTAL|PORT_INTERNAL_TAG_6|PORT_INTERNAL_DATA_6

containers/authelia/authelia.config

@@ -0,0 +1,74 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# REQUIRES = comma-separated install prerequisites (see scripts/checks/requirements/check_app_install.sh)
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# AUTHELIA = if true, use Authelia authentication, if false turned off.
+# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
+# THEME = UI theme for Authelia interface
+# ADMIN_USERNAME = username for the seeded Authelia admin account
+# ADMIN_PASSWORD = password for the seeded Authelia admin account
+# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
+#
+CFG_AUTHELIA_APP_NAME=authelia
+CFG_AUTHELIA_REQUIRES="domain,traefik"
+CFG_AUTHELIA_BACKUP=true
+CFG_AUTHELIA_COMPOSE_FILE=default
+CFG_AUTHELIA_HEALTHCHECK=true
+CFG_AUTHELIA_AUTHELIA=false
+CFG_AUTHELIA_HEADSCALE=false
+CFG_AUTHELIA_THEME=dark
+CFG_AUTHELIA_ADMIN_USERNAME=admin
+CFG_AUTHELIA_ADMIN_PASSWORD=RANDOMIZEDPASSWORD1
+CFG_AUTHELIA_MONITORING=false
+#
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+# REQUIRES_SERVICE = name of another LibrePortal app that must be installed before this one can be configured
+#
+CFG_AUTHELIA_CATEGORY="security"
+CFG_AUTHELIA_TITLE="Authelia"
+CFG_AUTHELIA_DESCRIPTION="Authentication & SSO"
+CFG_AUTHELIA_LONG_DESCRIPTION="Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on for your applications"
+CFG_AUTHELIA_URL="https://github.com/authelia/authelia"
+CFG_AUTHELIA_ACTIONS="configure|install|restart|shutdown|uninstall"
+CFG_AUTHELIA_REQUIRES_SERVICE=traefik
+#
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# HOST_NAME = subdomain name e.g test is the name for test.website.com
+# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
+#
+CFG_AUTHELIA_DOMAIN=1
+CFG_AUTHELIA_WHITELIST=false
+CFG_AUTHELIA_HOST_NAME=authelia
+CFG_AUTHELIA_NETWORK=default
+#
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, dns, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_AUTHELIA_PORT_1="authelia-service|webui|random:9091|public|tcp|false|true|true|Web Interface|"

containers/authelia/authelia.sh

@@ -0,0 +1,208 @@
+#!/bin/bash
+
+# Category : Security
+# Description : Authelia - Authentication & SSO (c/u/s/r/i):
+
+installAuthelia()
+{
+    local config_variables="$1"
+
+    if [[ "$authelia" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent authelia;
+        local app_name=$CFG_AUTHELIA_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$authelia" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+	if [[ "$authelia" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$authelia" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+    if [[ "$authelia" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$authelia" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+        # Pre-flight: bail out before touching any compose/config if the
+        # global prerequisites aren't met. CFG_AUTHELIA_REQUIRES lists
+        # what's needed (currently "domain,traefik"); the helper prints a
+        # clear list of what's missing so the user knows what to fix.
+        if ! appInstallCheckRequirements "$app_name" "$CFG_AUTHELIA_REQUIRES"; then
+            authelia=n
+            return 1
+        fi
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+        local result=$(copyResource "$app_name" "configuration.yml" "config" | sudo tee -a "$logs_dir/$docker_log_file" 2>&1)
+        checkSuccess "Copying configuration.yml to $containers_dir$app_name/config"
+
+        local result=$(copyResource "$app_name" "users_database.yml" "config" | sudo tee -a "$logs_dir/$docker_log_file" 2>&1)
+        checkSuccess "Copying users_database.yml to $containers_dir$app_name/config"
+
+        local authelia_config_file="$containers_dir$app_name/config/configuration.yml"
+        sudo sed -i "s|AUTHELIA_THEME_PLACEHOLDER|$CFG_AUTHELIA_THEME|g" "$authelia_config_file"
+        sudo sed -i "s|AUTHELIA_DOMAIN_PLACEHOLDER|$domain_full|g" "$authelia_config_file"
+        sudo sed -i "s|AUTHELIA_HOST_PLACEHOLDER|$host_setup|g" "$authelia_config_file"
+        checkSuccess "Substituting Authelia configuration values (theme=$CFG_AUTHELIA_THEME domain=$domain_full host=$host_setup)"
+
+        local authelia_secrets_dir="$containers_dir$app_name/secrets"
+        sudo mkdir -p "$authelia_secrets_dir"
+        for secret_name in JWT_SECRET SESSION_SECRET STORAGE_ENCRYPTION_KEY; do
+            local secret_file="$authelia_secrets_dir/$secret_name"
+            if [[ ! -s "$secret_file" ]]; then
+                openssl rand -hex 64 | sudo tee "$secret_file" >/dev/null
+                sudo chmod 600 "$secret_file"
+            fi
+        done
+        sudo chown -R "$docker_install_user":"$docker_install_user" "$authelia_secrets_dir"
+        checkSuccess "Generated Authelia secrets at $authelia_secrets_dir"
+
+        # Enable Authelia's telemetry/metrics endpoint only when
+        # CFG_AUTHELIA_MONITORING=true (toggles the libreportal-monitoring
+        # marker block in configuration.yml).
+        monitoringToggleAppConfig "$app_name" "config/configuration.yml";
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Configuring Authelia admin account"
+        echo ""
+
+        local authelia_admin_user="${CFG_AUTHELIA_ADMIN_USERNAME:-admin}"
+        local authelia_admin_pass="${CFG_AUTHELIA_ADMIN_PASSWORD:-authelia}"
+        local authelia_users_file="$containers_dir$app_name/config/users_database.yml"
+        local authelia_attempts=0
+        while ((authelia_attempts < 30)); do
+            if sudo docker exec authelia-service authelia --version >/dev/null 2>&1; then
+                break
+            fi
+            sleep 2
+            ((authelia_attempts++))
+        done
+
+        if ((authelia_attempts >= 30)); then
+            isNotice "Authelia container did not become responsive in time — admin left at default (admin / authelia)."
+        else
+            local authelia_hash
+            authelia_hash=$(sudo docker exec authelia-service authelia crypto hash generate argon2 --password "$authelia_admin_pass" 2>/dev/null \
+                | grep -oE '\$argon2[^[:space:]]+')
+            if [[ -z "$authelia_hash" ]]; then
+                isNotice "Could not generate Authelia password hash — admin left at default (admin / authelia)."
+            else
+                sudo tee "$authelia_users_file" >/dev/null <<EOF
+---
+users:
+  ${authelia_admin_user}:
+    disabled: false
+    displayname: "Admin"
+    password: "${authelia_hash}"
+    email: ${authelia_admin_user}@${domain_full:-example.com}
+    groups:
+      - admins
+EOF
+                sudo chown "$docker_install_user":"$docker_install_user" "$authelia_users_file"
+                isSuccessful "Configured Authelia admin (user: $authelia_admin_user)."
+                dockerComposeRestart "$app_name";
+            fi
+        fi
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Updating WebUI config file."
+		echo ""
+
+		webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Refreshing monitoring integration."
+		echo ""
+
+		# Self-correcting: adds Authelia's scrape target + dashboard to
+		# Prometheus/Grafana when CFG_AUTHELIA_MONITORING=true, removes them
+		# when it's off. No-ops with a notice if either app isn't installed.
+		monitoringRefreshAll;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your new service using one of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+        echo ""
+        isNotice "Authelia admin login:"
+        echo ""
+        echo "      Username : ${authelia_admin_user}"
+        echo "      Password : ${authelia_admin_pass}"
+        echo ""
+
+		menu_number=0
+        #sleep 3s
+        cd
+	fi
+	authelia=n
+}

containers/authelia/authelia.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 512 512"><linearGradient id="authelia_svg__a" x1="-7.464" x2="485.846" y1="532.755" y2="535.394" gradientTransform="translate(0 -278)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#3f51b4"/><stop offset="1" style="stop-color:#123156"/></linearGradient><path d="M256.7 128c67.4-1.9 128.3 52.3 128.6 127.9.3 72.7-58.1 128.6-129.3 128.5-70.2-.1-128.5-58.2-128-128.5.4-74.2 61.9-130.2 128.7-127.9m33.3 77.4c0-16.3-9.6-29.3-24.7-33.2-14.8-3.8-30.2 2.8-37.7 16-7.8 13.9-5.6 29.4 6.8 40.6 5.7 5.1 6.7 9.9 4.8 16.9-5.7 21.9-10.9 43.9-16.2 65.9-2 8.4.3 15.4 7.1 20.6 13.3 10.3 34.4 11.4 48.9 2.8 10.7-6.4 13.9-12.9 11.1-25-5.2-22.6-10.7-45.1-16.3-67.5-1.3-5.1-.7-8.4 3.8-11.9 7.9-6.3 13-14.5 12.4-25.2" style="fill:url(#authelia_svg__a)"/><linearGradient id="authelia_svg__b" x1="-7.511" x2="485.799" y1="541.56" y2="544.198" gradientTransform="translate(0 -278)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#3f51b4"/><stop offset="1" style="stop-color:#123156"/></linearGradient><path d="M254.9 447.7C163.1 450.2 76.7 380.2 65 279.1c-7.6-65.8 12.4-122.5 62-167.3 11.8-10.7 26.3-18.7 40.1-27 9.8-5.9 18.6-3 23.9 5.9 5.4 9.3 3.1 17.8-6.7 24.5-9.7 6.7-20.1 12.6-29.1 20.2-32.7 27.4-50.9 62.7-54.9 105.1-3.6 38.7 5 74.9 28.2 106.3C158.8 387.9 200 410 251.3 412c45.7 1.7 85.1-14.5 116.6-46.9 12.8-13.2 21.7-30.3 31.8-46.1 5.4-8.5 12.7-13 20.8-10.9 11.2 3 17.2 12.7 11.9 23.9-7.2 15.2-15.2 30.6-25.6 43.7-33.4 42.1-78 65-131.1 71.7-.8.1-1.5.2-2.3.2-6.2.1-12.4.1-18.5.1" style="fill:url(#authelia_svg__b)"/><linearGradient id="authelia_svg__c" x1="-7.285" x2="486.025" y1="499.335" y2="501.973" gradientTransform="translate(0 -278)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#3f51b4"/><stop offset="1" style="stop-color:#123156"/></linearGradient><path d="M226.6 4.5c4.1 0 8.2.1 12.3 0 7.4-.1 13.2 2 15 10.2 1.7 7.7-1.7 16.9-8.5 19.7-5.3 2.2-11.3 3.2-17.1 4-41.8 5.5-79.6 20.8-112 47.8C71 124 43.4 172 36.9 231.2c-6.4 58.4 8.9 111 43.5 158.1 5.6 7.6 12.4 14.4 18.2 22 6.8 8.8 5.7 17-2.6 24.5-6.9 6.3-16.4 6.1-23.5-1.2-42-43.2-66.3-94.5-71.4-154.9-2.2-26.1-1.2-51.8 4.1-77.4 8.1-39 25.1-73.9 49.8-104.9 39-48.8 89.4-79.6 150.9-91.7 6.7-1.3 13.8-1.1 20.7-1.6z" style="fill:url(#authelia_svg__c)"/><linearGradient id="authelia_svg__d" x1="-7.857" x2="485.453" y1="606.3" y2="608.938" gradientTransform="translate(0 -278)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#3f51b4"/><stop offset="1" style="stop-color:#123156"/></linearGradient><path d="M282.8 507.8c-2.8 0-5.7.2-8.5 0-9.2-.8-15.5-6.5-16.4-14.6-1-8.7 4.4-16.6 13.7-18.8 7.2-1.7 14.7-2.4 22-3.7 68.3-12.6 120-48.6 154.5-109.2C466 330 475.4 295.9 476.3 260c.7-27.3-3.7-54.3-13.8-80.1-1.6-4-2.5-9.2-1.4-13.2 2.1-7.5 7.2-13.1 15.8-13.8 8-.6 14.9 3 17.9 11.8 4.9 14.3 9.7 28.8 12.5 43.7 10 53.6 4.1 105.5-19.3 155-19.1 40.2-46.7 73.6-83.1 99.5-32.4 23-68.1 38.1-107.5 44.1-1.8.3-3.5.8-5.3.9-3.1 0-6.2-.1-9.3-.1" style="fill:url(#authelia_svg__d)"/><linearGradient id="authelia_svg__e" x1="-6.927" x2="486.383" y1="432.424" y2="435.062" gradientTransform="translate(0 -278)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#3f51b4"/><stop offset="1" style="stop-color:#123156"/></linearGradient><path d="M444.5 215.5c0 11.9-5.2 18.6-14.3 20.3-8.8 1.6-16.2-2.9-19.6-12.3-4.5-12.3-8.1-25-13.6-36.8-14.9-32.2-39.1-55.6-70.8-71.3-2.8-1.4-5.6-2.6-8.2-4.2-8.4-5.2-11.6-14.9-7.8-23.4 4-9 12.9-13.8 22.3-9.2 14.5 7 29 14.6 41.8 24.3 34.8 26.3 57.1 61.4 68.5 103.4.9 3.7 1.4 7.5 1.7 9.2" style="fill:url(#authelia_svg__e)"/></svg>

containers/authelia/docker-compose.yml

@@ -0,0 +1,43 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+  authelia-service: #LIBREPORTAL|SERVICE_TAG_1|authelia-service
+    container_name: authelia-service
+    image: docker.io/authelia/authelia:latest
+    restart: unless-stopped
+    # GLUETUN_OFF_BEGIN
+    ports:
+      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+    # GLUETUN_OFF_END
+    environment:
+      - AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE=/secrets/JWT_SECRET
+      - AUTHELIA_SESSION_SECRET_FILE=/secrets/SESSION_SECRET
+      - AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/secrets/STORAGE_ENCRYPTION_KEY
+      - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+    volumes:
+      - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
+      - ./config:/config
+      - ./secrets:/secrets
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
+      traefik.http.routers.authelia-service.entrypoints: web,websecure
+      traefik.http.routers.authelia-service.rule: Host(`DOMAINSUBNAME_DATA`) #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      traefik.http.routers.authelia-service.tls: true
+      traefik.http.routers.authelia-service.tls.certresolver: production
+      traefik.http.services.authelia-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+      traefik.http.routers.authelia-service.middlewares: MIDDLEWARE_DATA #LIBREPORTAL|MIDDLEWARE_TAG|MIDDLEWARE_DATA
+      traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    healthcheck:
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+    # GLUETUN_OFF_BEGIN
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+    # GLUETUN_OFF_END
+    # GLUETUN_ON_BEGIN
+    # network_mode: "container:gluetun-service"
+    # GLUETUN_ON_END

containers/authelia/resources/configuration.yml

@@ -0,0 +1,76 @@
+---
+theme: AUTHELIA_THEME_PLACEHOLDER
+
+default_2fa_method: ""
+
+server:
+  address: 'tcp://0.0.0.0:9091/'
+  buffers:
+    read: 4096
+    write: 4096
+
+log:
+  level: info
+
+# >>> libreportal-monitoring >>>
+#telemetry:
+#  metrics:
+#    enabled: true
+#    address: 'tcp://0.0.0.0:9959/'
+# <<< libreportal-monitoring <<<
+
+totp:
+  disable: false
+  issuer: AUTHELIA_DOMAIN_PLACEHOLDER
+  algorithm: sha1
+  digits: 6
+  period: 30
+  skew: 1
+
+authentication_backend:
+  password_reset:
+    disable: false
+  refresh_interval: 5m
+  file:
+    path: /config/users_database.yml
+    watch: false
+    search:
+      email: false
+      case_insensitive: false
+    password:
+      algorithm: argon2
+      argon2:
+        variant: argon2id
+        iterations: 3
+        memory: 65536
+        parallelism: 4
+        key_length: 32
+        salt_length: 16
+
+access_control:
+  default_policy: one_factor
+
+session:
+  name: authelia_session
+  expiration: 1h
+  inactivity: 5m
+  remember_me: 1M
+  cookies:
+    - name: authelia_session
+      domain: AUTHELIA_DOMAIN_PLACEHOLDER
+      authelia_url: https://AUTHELIA_HOST_PLACEHOLDER
+      default_redirection_url: https://AUTHELIA_DOMAIN_PLACEHOLDER
+
+regulation:
+  max_retries: 3
+  find_time: 2m
+  ban_time: 5m
+
+storage:
+  local:
+    path: /config/db.sqlite3
+
+notifier:
+  disable_startup_check: true
+  filesystem:
+    filename: /config/notification.txt

containers/authelia/resources/monitoring/prometheus-scrape.yml

@@ -0,0 +1,9 @@
+# Prometheus scrape job for Authelia. Gathered into
+# prometheus/scrape.d/authelia.yml by monitoringRefreshPrometheus when
+# CFG_AUTHELIA_MONITORING=true. Authelia's telemetry.metrics endpoint listens
+# on :9959 inside the container; reachable from the Prometheus container by
+# the service name on the shared docker network.
+- job_name: authelia
+  metrics_path: /metrics
+  static_configs:
+    - targets: ['authelia-service:9959']

containers/authelia/resources/users_database.yml

@@ -0,0 +1,11 @@
+---
+users:
+  admin:
+    disabled: false
+    displayname: "Admin User"
+    # Password: authelia
+    password: "$argon2id$v=19$m=65536,t=3,p=4$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM"
+    email: admin@example.com
+    groups:
+      - admins
+      - dev

containers/bookstack/bookstack.config

@@ -0,0 +1,76 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# AUTHELIA = if true, use Authelia authentication, if false turned off.
+# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
+# ADMIN_EMAIL = email used for the Bookstack admin account
+# ADMIN_PASSWORD = password used for the Bookstack admin account
+#
+CFG_BOOKSTACK_APP_NAME=bookstack
+CFG_BOOKSTACK_BACKUP=true
+CFG_BOOKSTACK_COMPOSE_FILE=default
+CFG_BOOKSTACK_HEALTHCHECK=true
+CFG_BOOKSTACK_AUTHELIA=false
+CFG_BOOKSTACK_HEADSCALE=false
+CFG_BOOKSTACK_ADMIN_EMAIL=admin@example.com
+CFG_BOOKSTACK_ADMIN_PASSWORD=RANDOMIZEDPASSWORD3
+# Secrets below feed the compose via #LIBREPORTAL|BOOKSTACK_<KEY>_TAG| tags —
+# auto-generated, and (unlike a RANDOMIZED* placeholder in the compose)
+# preserved across reinstalls. DB_PASSWORD is shared by the app + db services.
+CFG_BOOKSTACK_APP_KEY=RANDOMIZEDAPPKEY1
+CFG_BOOKSTACK_DB_PASSWORD=RANDOMIZEDPASSWORD1
+CFG_BOOKSTACK_DB_ROOT_PASSWORD=RANDOMIZEDPASSWORD2
+#
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+#
+CFG_BOOKSTACK_CATEGORY="knowledge"
+CFG_BOOKSTACK_TITLE="Bookstack"
+CFG_BOOKSTACK_DESCRIPTION="Wiki/Knowledge Base"
+CFG_BOOKSTACK_LONG_DESCRIPTION="BookStack is a simple, self-hosted wiki and documentation platform that provides a pleasant and simple way to organize and store information"
+CFG_BOOKSTACK_URL="https://github.com/BookStackApp/BookStack"
+CFG_BOOKSTACK_ACTIONS="configure|install|restart|shutdown|uninstall"
+#
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# HOST_NAME = subdomain name e.g test is the name for test.website.com
+# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
+#
+CFG_BOOKSTACK_DOMAIN=1
+CFG_BOOKSTACK_WHITELIST=false
+CFG_BOOKSTACK_HOST_NAME=bookstack
+CFG_BOOKSTACK_NETWORK=default
+#
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, dns, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_BOOKSTACK_PORT_1="bookstack-service|webui|random:80|public|tcp|false|true|true|Web Interface|"
+
+# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
+CFG_BOOKSTACK_AUTH_PROFILE=multi_user
+CFG_BOOKSTACK_ADMIN_USER=

containers/bookstack/bookstack.sh

@@ -0,0 +1,180 @@
+#!/bin/bash
+
+# Category : Knowledge Management
+# Description : Bookstack - Wiki/Knowledge Base (c/u/s/r/i):
+
+installBookstack()
+{
+    local config_variables="$1"
+
+    if [[ "$bookstack" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent bookstack;
+        local app_name=$CFG_BOOKSTACK_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$bookstack" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$bookstack" == *[uU]* ]]; then
+        dockerUninstallApp $app_name;
+    fi
+
+    if [[ "$bookstack" == *[sS]* ]]; then
+        dockerComposeDown $app_name;
+    fi
+
+    if [[ "$bookstack" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$bookstack" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Updating WebUI config file."
+		echo ""
+
+		webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using any of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+        bookstack_target_email="${CFG_BOOKSTACK_ADMIN_EMAIL:-admin@admin.com}"
+        bookstack_target_pass="${CFG_BOOKSTACK_ADMIN_PASSWORD:-password}"
+
+        bookstack_compose_file="$containers_dir$app_name/docker-compose.yml"
+        bookstack_port_pair=$(tagsManagerGetTagContent "$bookstack_compose_file" "PORTS_TAG_1")
+        bookstack_host_port="${bookstack_port_pair%%:*}"
+        bookstack_probe_url="http://127.0.0.1:${bookstack_host_port}/login"
+
+        isNotice "Waiting for Bookstack to come online at ${bookstack_probe_url} ..."
+        isNotice "This may take up to 20 seconds, please wait..."
+
+        bookstack_attempts=0
+        bookstack_ready=0
+        while ((bookstack_attempts < 60)); do
+            bookstack_http_code=$(curl -sS -o /dev/null --max-time 3 -w '%{http_code}' "$bookstack_probe_url" 2>/dev/null)
+            if [[ "$bookstack_http_code" =~ ^(200|302)$ ]]; then
+                bookstack_ready=1
+                break
+            fi
+            sleep 2
+            ((bookstack_attempts++))
+        done
+
+        if ((bookstack_ready == 0)); then
+            isNotice "Bookstack did not respond on ${bookstack_probe_url} within $((60 * 2))s — admin account left at upstream defaults."
+            echo ""
+            isNotice "Bookstack admin login (default):"
+            echo ""
+            echo "      Email    : admin@admin.com"
+            echo "      Password : password"
+            echo ""
+        else
+            isSuccessful "Bookstack is online (HTTP ${bookstack_http_code})."
+
+            bookstack_create_output=$(sudo docker exec \
+                -e EZ_BS_NEW_EMAIL="$bookstack_target_email" \
+                -e EZ_BS_NEW_PASS="$bookstack_target_pass" \
+                bookstack sh -c 'cd /app/www && s6-setuidgid abc php artisan bookstack:create-admin --no-ansi --email="$EZ_BS_NEW_EMAIL" --name=Admin --password="$EZ_BS_NEW_PASS" 2>&1')
+            bookstack_create_rc=$?
+            if [[ $bookstack_create_rc -eq 0 ]]; then
+                isSuccessful "Bookstack admin account created (email: $bookstack_target_email)."
+
+                if [[ "$bookstack_target_email" != "admin@admin.com" ]]; then
+                    sudo docker exec -i bookstack php /app/www/artisan tinker --no-ansi >/dev/null 2>&1 <<'PHP'
+$c = class_exists('\BookStack\Users\Models\User') ? '\BookStack\Users\Models\User' : '\BookStack\Auth\User';
+optional($c::where('email', 'admin@admin.com')->first())->delete();
+PHP
+                    isSuccessful "Removed seeded admin@admin.com account."
+                fi
+
+                echo ""
+                isNotice "Bookstack admin login:"
+                echo ""
+                echo "      Email    : ${bookstack_target_email}"
+                echo "      Password : ${bookstack_target_pass}"
+                echo ""
+            else
+                isNotice "Bookstack admin auto-create failed (exit $bookstack_create_rc). Output:"
+                echo "$bookstack_create_output" | sed 's/^/        /'
+                echo ""
+                isNotice "Falling back to upstream defaults — update from inside Bookstack."
+                echo ""
+                isNotice "Bookstack admin login (default):"
+                echo ""
+                echo "      Email    : admin@admin.com"
+                echo "      Password : password"
+                echo ""
+            fi
+        fi
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    bookstack=n
+}

containers/bookstack/bookstack.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 512 512"><path d="m218.5 367 288.3-166.5v-63.4L403.9 77.7l-9.4-5.4-93.7-54.1L12.5 184.7c-13.6 24 0 63.4 0 63.4-16.8 25.5 0 63.4 0 63.4l206 118.9 182.8-105.5-182.8 105.6-206-118.9c-16.8 25.5 0 63.4 0 63.4l206 118.9 288.3-166.5V264l.1-.1v-63.4z" style="fill-rule:evenodd;clip-rule:evenodd;fill:#fff"/><path d="M218.5 496.3q-.6 0-1.2-.3l-206-119c-.4-.3-.8-.6-1-1.1-.7-1.6-17.1-39.4.2-65.7.7-1.1 2.1-1.4 3.2-.8l204.8 118.2 287.1-165.8c.7-.4 1.7-.4 2.4 0s1.2 1.2 1.2 2.1v63.4c0 .9-.5 1.6-1.2 2.1L219.7 495.9c-.3.3-.8.4-1.2.4m-204.1-123 204.1 117.8L504.4 326v-57.9L219.7 432.5c-.7.4-1.7.4-2.4 0l-204-117.7c-12.7 22.2-.9 53.4 1.1 58.5M218.5 306q-.6 0-1.2-.3l-206-118.9c-.7-.4-1.2-1.2-1.2-2.1s.5-1.6 1.2-2.1L299.6 16.1c.7-.4 1.7-.4 2.4 0L508 135c.7.4 1.2 1.2 1.2 2.1s-.5 1.6-1.2 2.1L219.7 305.6c-.3.3-.8.4-1.2.4M17.3 184.7l201.2 116.1L502 137.1 300.8 20.9zm201.2 184.7q-.6 0-1.2-.3l-206-118.9c-.5-.3-.9-.7-1.1-1.3-.6-1.7-13.8-40.7.2-65.4.3-.6.8-1 1.5-1.1.6-.2 1.3-.1 1.8.2l204.8 118.2L505.6 135c.7-.4 1.7-.4 2.4 0s1.2 1.2 1.2 2.1v63.4c0 .9-.5 1.6-1.2 2.1L219.7 369c-.3.3-.8.4-1.2.4m-204-123 204 117.7L504.4 199v-57.9L219.7 305.6c-.7.4-1.7.4-2.4 0L13.5 188c-10.1 21-.7 52.9 1 58.4m204 186.4q-.6 0-1.2-.3l-206-118.9c-.4-.3-.8-.6-1-1.1-.7-1.6-17.1-39.4.2-65.7.7-1.1 2.1-1.4 3.2-.8l204.8 118.2 287.2-165.7c.7-.4 1.7-.4 2.4 0s1.2 1.2 1.2 2.1V264c0 .9-.5 1.7-1.2 2.1L219.7 432.4c-.3.3-.8.4-1.2.4m-204.1-123 204.1 117.8 286-165v-57.9L219.7 369c-.7.4-1.7.4-2.4 0l-204-117.7c-12.7 22.2-.9 53.4 1.1 58.5m265.9-158.4c-.3 0-.6-.1-.9-.2-.7-.3-1.2-.9-1.4-1.6l-6.5-26-46.4-3.9c-1-.1-1.9-.8-2.1-1.9-.2-1 .2-2.1 1.1-2.6l123.6-71.3c.7-.4 1.7-.4 2.4 0l55 31.7a2.438 2.438 0 0 1 0 4.2L281.5 151c-.3.3-.8.4-1.2.4m-47.1-35.9 40.5 3.4c1 .1 1.9.8 2.1 1.8l6.1 24.6 117.2-67.6-50.2-28.9z" style="fill:#0288d1"/></svg>

containers/bookstack/docker-compose.yml

@@ -0,0 +1,68 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+  bookstack-service: #LIBREPORTAL|SERVICE_TAG_1|bookstack-service
+    image: lscr.io/linuxserver/bookstack
+    container_name: bookstack
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+      - APP_URL=APP_URL_DATA #LIBREPORTAL|APP_URL_TAG|APP_URL_DATA
+      - APP_KEY=BOOKSTACK_APP_KEY_DATA #LIBREPORTAL|BOOKSTACK_APP_KEY_TAG|BOOKSTACK_APP_KEY_DATA
+      - DB_HOST=bookstack_db
+      - DB_PORT=3306
+      - DB_USERNAME=bookstack
+      - DB_PASSWORD=BOOKSTACK_DB_PASSWORD_DATA #LIBREPORTAL|BOOKSTACK_DB_PASSWORD_TAG|BOOKSTACK_DB_PASSWORD_DATA
+      - DB_DATABASE=bookstackapp
+    volumes:
+      - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
+      - ./data:/config
+    # GLUETUN_OFF_BEGIN
+    ports:
+      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+    # GLUETUN_OFF_END
+    restart: unless-stopped
+    depends_on:
+      - bookstack_db
+    healthcheck:
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
+      traefik.http.routers.bookstack-service.entrypoints: web,websecure
+      traefik.http.routers.bookstack-service.rule: Host(`DOMAINSUBNAME_DATA`) #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      traefik.http.routers.bookstack-service.tls: true
+      traefik.http.routers.bookstack-service.tls.certresolver: production
+      traefik.http.services.bookstack-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+      traefik.http.routers.bookstack-service.middlewares: MIDDLEWARE_DATA #LIBREPORTAL|MIDDLEWARE_TAG|MIDDLEWARE_DATA
+      traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    # GLUETUN_OFF_BEGIN
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+    # GLUETUN_OFF_END
+    # GLUETUN_ON_BEGIN
+    # network_mode: "container:gluetun-service"
+    # GLUETUN_ON_END
+
+  bookstack_db: #LIBREPORTAL|SERVICE_TAG_2|bookstack_db
+    image: lscr.io/linuxserver/mariadb
+    container_name: bookstack_db
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+      - MYSQL_ROOT_PASSWORD=BOOKSTACK_DB_ROOT_PASSWORD_DATA #LIBREPORTAL|BOOKSTACK_DB_ROOT_PASSWORD_TAG|BOOKSTACK_DB_ROOT_PASSWORD_DATA
+      - MYSQL_DATABASE=bookstackapp
+      - MYSQL_USER=bookstack
+      - MYSQL_PASSWORD=BOOKSTACK_DB_PASSWORD_DATA #LIBREPORTAL|BOOKSTACK_DB_PASSWORD_TAG|BOOKSTACK_DB_PASSWORD_DATA
+    volumes:
+      - ./db:/config
+    restart: unless-stopped
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_2 #LIBREPORTAL|IP_TAG_2|IP_DATA_2

containers/crowdsec/crowdsec.config

@@ -0,0 +1,68 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# HOST_INSTALL = true means apt + systemd install on the host, not Docker
+# HOST_PACKAGE = dpkg package name; drives the "installed" badge
+# HOST_SERVICE = primary systemd unit; stop/restart actions hit this
+# HOST_SERVICES = all units; feeds the Services + Logs tabs
+# HOST_LOG_FILES = <unit>|<path>,... mapping for the log viewer
+# BACKUP = include in backup operations
+# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed; ships the official CrowdSec Grafana dashboards)
+# PROMETHEUS_LISTEN = address CrowdSec's metrics endpoint binds to; must be reachable from the Prometheus container (default: all interfaces, port 6060 — keep the :6060 port)
+#
+CFG_CROWDSEC_APP_NAME=crowdsec
+CFG_CROWDSEC_HOST_INSTALL=true
+CFG_CROWDSEC_HOST_PACKAGE=crowdsec
+CFG_CROWDSEC_HOST_SERVICE=crowdsec
+CFG_CROWDSEC_HOST_SERVICES=crowdsec.service,crowdsec-firewall-bouncer.service
+CFG_CROWDSEC_HOST_LOG_FILES="crowdsec.service|/var/log/crowdsec.log,crowdsec-firewall-bouncer.service|/var/log/crowdsec-firewall-bouncer.log"
+CFG_CROWDSEC_BACKUP=true
+CFG_CROWDSEC_MONITORING=false
+CFG_CROWDSEC_PROMETHEUS_LISTEN=0.0.0.0:6060
+#
+# =============================================================================
+# BEHAVIOUR
+# =============================================================================
+# ENABLED = master switch; false disables services (package stays)
+# AUTO_UPDATE = pull hub parser/scenario updates from hub.crowdsec.net
+# COMMUNITY_BLOCKLIST = subscribe to the free pooled blocklist (CAPI)
+# CONSOLE_ENROLL = enroll this agent with the hosted SaaS at app.crowdsec.net (NOT the local dashboard)
+# CONSOLE_TOKEN = enrollment token from app.crowdsec.net (only used when CONSOLE_ENROLL=true)
+# BOUNCER = attach the Traefik bouncer middleware to every public route
+#
+CFG_CROWDSEC_ENABLED=true
+CFG_CROWDSEC_AUTO_UPDATE=true
+CFG_CROWDSEC_COMMUNITY_BLOCKLIST=true
+CFG_CROWDSEC_CONSOLE_ENROLL=false
+CFG_CROWDSEC_CONSOLE_TOKEN=
+CFG_CROWDSEC_BOUNCER=true
+#
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = grouping in the app grid
+# TITLE = display name
+# DESCRIPTION = one-liner
+# LONG_DESCRIPTION = card body text
+# URL = source / docs link
+# ACTIONS = available lifecycle verbs
+#
+CFG_CROWDSEC_CATEGORY="security,recommended"
+CFG_CROWDSEC_TITLE="CrowdSec"
+CFG_CROWDSEC_DESCRIPTION="Intrusion Prevention"
+CFG_CROWDSEC_LONG_DESCRIPTION="CrowdSec is an open-source intrusion prevention system. It detects attacks from log patterns — brute-force, scans, web exploits — and blocks offending IPs at the firewall. Includes community-shared threat intelligence."
+CFG_CROWDSEC_URL="https://www.crowdsec.net"
+CFG_CROWDSEC_ACTIONS="configure|install|restart|shutdown|uninstall|tools"
+#
+# =============================================================================
+# ADVANCED
+# =============================================================================
+# LAPI_HOST = LAPI bind address; 0.0.0.0 so Traefik can reach via host.docker.internal
+# BOUNCER_NAME_TRAEFIK = bouncer name registered with cscli bouncers add
+# TRAEFIK_LAPI_KEY = auto-generated by installCrowdsec; use the rotate Tools action to change
+#
+CFG_CROWDSEC_LAPI_HOST=0.0.0.0:8080
+CFG_CROWDSEC_BOUNCER_NAME_TRAEFIK=traefik-bouncer
+CFG_CROWDSEC_TRAEFIK_LAPI_KEY=

containers/crowdsec/crowdsec.sh

@@ -0,0 +1,100 @@
+#!/bin/bash
+
+# Category : Security
+# Description : CrowdSec - Intrusion Prevention (c/u/s/r/i):
+#
+# Host-installed agent (apt + systemd) — no Docker container. Host install
+# logic lives in scripts/install/install_crowdsec.sh (installCrowdsecHost);
+# install registration uses the shared hostAppInstall helper
+# (scripts/install/host_app.sh). uninstall/stop/restartCrowdsec (below) are the
+# host-side hooks dockerUninstallApp / dockerStopApp / dockerRestartApp invoke.
+
+installCrowdsec()
+{
+    local config_variables="$1"
+
+    if [[ "$crowdsec" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent crowdsec;
+        initializeAppVariables "$CFG_CROWDSEC_APP_NAME";
+    fi
+    local app_name=$CFG_CROWDSEC_APP_NAME
+
+    if [[ "$crowdsec" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    # Uninstall / stop / restart are NOT dispatched here — the CLI and menu call
+    # dockerUninstallApp / dockerStopApp / dockerRestartApp directly. Those run
+    # the generic docker teardown (a no-op for a host app) and then invoke the
+    # uninstall/stop/restartCrowdsec hooks (bottom of this file) for the
+    # host-side work.
+
+    if [[ "$crowdsec" == *[iI]* ]]; then
+        installCrowdsecHost;
+
+        if command -v cscli >/dev/null 2>&1; then
+            # Register crowdsec as an installed host app — apps DB row + WebUI regen.
+            hostAppInstall "$app_name";
+
+            # Monitoring: gather crowdsec's scrape fragment + Grafana dashboards
+            # into Prometheus/Grafana. Run unconditionally — the refresh is
+            # self-correcting (adds when CFG_CROWDSEC_MONITORING=true, removes
+            # crowdsec's entry when it's been toggled off). No-ops with a notice
+            # when Prometheus/Grafana aren't installed.
+            monitoringRefreshAll;
+        else
+            isNotice "cscli missing — crowdsec host install did not complete. Skipping registration."
+        fi
+    fi
+}
+
+# Host-side uninstall, invoked by dockerUninstallApp's uninstall<App> hook.
+# dockerUninstallApp already handles the generic teardown (data dir, DB rows,
+# WebUI regen) — this does what the generic path can't: stopping + purging the
+# apt packages and detaching the log bind-mounts.
+uninstallCrowdsec()
+{
+    ((menu_number++))
+    echo ""
+    echo "---- $menu_number. Stopping CrowdSec host services."
+    echo ""
+    local result=$(sudo systemctl disable --now crowdsec-firewall-bouncer 2>&1)
+    checkSuccess "Disabling firewall bouncer"
+    local result=$(sudo systemctl disable --now crowdsec 2>&1)
+    checkSuccess "Disabling agent"
+
+    ((menu_number++))
+    echo ""
+    echo "---- $menu_number. Removing CrowdSec packages."
+    echo ""
+    local result=$(sudo DEBIAN_FRONTEND=noninteractive apt-get purge -y -q crowdsec crowdsec-firewall-bouncer-nftables </dev/null 2>&1)
+    checkSuccess "Purged packages"
+    local result=$(sudo DEBIAN_FRONTEND=noninteractive apt-get autoremove -y -q </dev/null 2>&1)
+    checkSuccess "Removed orphaned dependencies"
+
+    crowdsecToggleLibrePortalLogMounts off
+}
+
+# Host-side stop, invoked by dockerStopApp's stop<App> hook. crowdsec ships no
+# docker container, so dockerStopApp is a no-op — this stops the host agent +
+# bouncer. The package stays installed; only Uninstall removes it.
+stopCrowdsec()
+{
+    isNotice "Stopping CrowdSec host services..."
+    local result=$(sudo systemctl stop crowdsec-firewall-bouncer 2>&1)
+    checkSuccess "Stopped firewall bouncer"
+    local result=$(sudo systemctl stop crowdsec 2>&1)
+    checkSuccess "Stopped agent"
+}
+
+# Host-side restart, invoked by dockerRestartApp's restart<App> hook. crowdsec
+# ships no docker container, so dockerRestartApp is a no-op — this restarts the
+# host agent + bouncer.
+restartCrowdsec()
+{
+    isNotice "Restarting CrowdSec host services..."
+    local result=$(sudo systemctl restart crowdsec 2>&1)
+    checkSuccess "Restarted agent"
+    local result=$(sudo systemctl restart crowdsec-firewall-bouncer 2>&1)
+    checkSuccess "Restarted firewall bouncer"
+}

containers/crowdsec/crowdsec.svg

@@ -0,0 +1,32 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" fill="none">
+  <!-- Shield silhouette -->
+  <path d="M64 8 L112 24 V60 C112 86 92 110 64 120 C36 110 16 86 16 60 V24 Z"
+        fill="url(#cs-grad)" stroke="#5dd3ff" stroke-width="2.5" stroke-linejoin="round"/>
+  <defs>
+    <linearGradient id="cs-grad" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#1a2b3d"/>
+      <stop offset="1" stop-color="#0a1420"/>
+    </linearGradient>
+    <radialGradient id="cs-eye" cx="0.5" cy="0.5" r="0.5">
+      <stop offset="0" stop-color="#5dd3ff"/>
+      <stop offset="0.5" stop-color="#2b8fc7"/>
+      <stop offset="1" stop-color="#0a3554"/>
+    </radialGradient>
+  </defs>
+  <!-- Eye (almond) -->
+  <path d="M30 64 Q64 38 98 64 Q64 90 30 64 Z"
+        fill="#0a1420" stroke="#5dd3ff" stroke-width="2.2" stroke-linejoin="round"/>
+  <!-- Iris -->
+  <circle cx="64" cy="64" r="14" fill="url(#cs-eye)"/>
+  <!-- Pupil -->
+  <circle cx="64" cy="64" r="6" fill="#06121b"/>
+  <!-- Highlight -->
+  <circle cx="60" cy="60" r="2.4" fill="#dffaff" opacity="0.9"/>
+  <!-- Crosshair ticks signalling watcher/detector -->
+  <g stroke="#5dd3ff" stroke-width="2" stroke-linecap="round">
+    <line x1="64" y1="42" x2="64" y2="48"/>
+    <line x1="64" y1="80" x2="64" y2="86"/>
+    <line x1="42" y1="64" x2="48" y2="64"/>
+    <line x1="80" y1="64" x2="86" y2="64"/>
+  </g>
+</svg>

containers/crowdsec/resources/monitoring/grafana-dashboards/insight.json

@@ -0,0 +1,811 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": "-- Grafana --",
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "target": {
+          "limit": 100,
+          "matchAny": false,
+          "tags": [],
+          "type": "dashboard"
+        },
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "gnetId": null,
+  "graphTooltip": 0,
+  "id": null,
+  "iteration": 1655915159751,
+  "links": [],
+  "panels": [
+    {
+      "collapsed": true,
+      "datasource": null,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 22,
+      "panels": [
+        {
+          "cacheTimeout": null,
+          "datasource": "Prometheus",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "mappings": [
+                {
+                  "options": {
+                    "match": "null",
+                    "result": {
+                      "text": "N/A"
+                    }
+                  },
+                  "type": "special"
+                }
+              ],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "dateTimeAsIso"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 9,
+            "w": 5,
+            "x": 2,
+            "y": 1
+          },
+          "id": 2,
+          "interval": null,
+          "links": [],
+          "maxDataPoints": 100,
+          "options": {
+            "colorMode": "none",
+            "graphMode": "none",
+            "justifyMode": "auto",
+            "orientation": "horizontal",
+            "reduceOptions": {
+              "calcs": [
+                "lastNotNull"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "text": {},
+            "textMode": "auto"
+          },
+          "pluginVersion": "8.1.2",
+          "targets": [
+            {
+              "exemplar": true,
+              "expr": "(process_start_time_seconds{instance=\"$instance\"})*1000",
+              "interval": "",
+              "legendFormat": "{{instance}}",
+              "refId": "A"
+            }
+          ],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Up since",
+          "type": "stat"
+        },
+        {
+          "datasource": "Prometheus",
+          "fieldConfig": {
+            "defaults": {
+              "displayName": "",
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              },
+              "unit": "decbytes"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 9,
+            "w": 5,
+            "x": 7,
+            "y": 1
+          },
+          "id": 4,
+          "options": {
+            "orientation": "auto",
+            "reduceOptions": {
+              "calcs": [
+                "mean"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "showThresholdLabels": false,
+            "showThresholdMarkers": false,
+            "text": {}
+          },
+          "pluginVersion": "8.1.2",
+          "targets": [
+            {
+              "exemplar": true,
+              "expr": "process_resident_memory_bytes{instance=\"$instance\"}",
+              "format": "time_series",
+              "interval": "",
+              "intervalFactor": 3,
+              "legendFormat": "{{instance}}",
+              "refId": "A"
+            }
+          ],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Average Mem Usage",
+          "transparent": true,
+          "type": "gauge"
+        },
+        {
+          "datasource": "Prometheus",
+          "fieldConfig": {
+            "defaults": {
+              "mappings": [],
+              "max": 100,
+              "min": 0,
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 50
+                  }
+                ]
+              },
+              "unit": "percent"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 9,
+            "w": 5,
+            "x": 12,
+            "y": 1
+          },
+          "id": 6,
+          "options": {
+            "orientation": "auto",
+            "reduceOptions": {
+              "calcs": [
+                "mean"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "showThresholdLabels": false,
+            "showThresholdMarkers": true,
+            "text": {}
+          },
+          "pluginVersion": "8.1.2",
+          "targets": [
+            {
+              "exemplar": true,
+              "expr": "rate(process_cpu_seconds_total{instance=\"$instance\"}[$__interval])*100",
+              "interval": "",
+              "intervalFactor": 2,
+              "legendFormat": "{{instance}}",
+              "refId": "A"
+            }
+          ],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Average CPU Usage",
+          "transparent": true,
+          "type": "gauge"
+        },
+        {
+          "cacheTimeout": null,
+          "datasource": "Prometheus",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "mappings": [
+                {
+                  "options": {
+                    "match": "null",
+                    "result": {
+                      "text": "N/A"
+                    }
+                  },
+                  "type": "special"
+                }
+              ],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "none"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 9,
+            "w": 5,
+            "x": 17,
+            "y": 1
+          },
+          "id": 20,
+          "interval": null,
+          "links": [],
+          "maxDataPoints": 100,
+          "options": {
+            "colorMode": "background",
+            "graphMode": "none",
+            "justifyMode": "auto",
+            "orientation": "horizontal",
+            "reduceOptions": {
+              "calcs": [
+                "lastNotNull"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "text": {},
+            "textMode": "auto"
+          },
+          "pluginVersion": "8.1.2",
+          "targets": [
+            {
+              "exemplar": true,
+              "expr": "process_max_fds{instance=\"$instance\"}",
+              "interval": "",
+              "legendFormat": "{{instance}}",
+              "refId": "A"
+            }
+          ],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Process Max FDs",
+          "type": "stat"
+        },
+        {
+          "cacheTimeout": null,
+          "datasource": "Prometheus",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "mappings": [
+                {
+                  "options": {
+                    "match": "null",
+                    "result": {
+                      "text": "N/A"
+                    }
+                  },
+                  "type": "special"
+                }
+              ],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "none"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 9,
+            "w": 5,
+            "x": 2,
+            "y": 10
+          },
+          "id": 11,
+          "interval": null,
+          "links": [],
+          "maxDataPoints": 100,
+          "options": {
+            "colorMode": "background",
+            "graphMode": "none",
+            "justifyMode": "auto",
+            "orientation": "horizontal",
+            "reduceOptions": {
+              "calcs": [
+                "sum"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "text": {},
+            "textMode": "auto"
+          },
+          "pluginVersion": "8.1.2",
+          "targets": [
+            {
+              "exemplar": true,
+              "expr": "sum(increase(cs_filesource_hits_total{instance=\"$instance\"}[$__interval]) or up * 0) + sum(increase(cs_cloudwatch_stream_hits_total{instance=\"$instance\"}[$__interval]) or up * 0) + sum(increase(cs_journalctlsource_hits_total{instance=\"$instance\"}[$__interval]) or up * 0) + sum(increase(cs_syslogsource_hits_total{instance=\"$instance\"}[$__interval]) or up * 0)",
+              "interval": "",
+              "intervalFactor": 2,
+              "legendFormat": "",
+              "refId": "A"
+            }
+          ],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Total raw lines",
+          "type": "stat"
+        },
+        {
+          "cacheTimeout": null,
+          "datasource": "Prometheus",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "mappings": [
+                {
+                  "options": {
+                    "match": "null",
+                    "result": {
+                      "text": "N/A"
+                    }
+                  },
+                  "type": "special"
+                }
+              ],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "none"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 9,
+            "w": 5,
+            "x": 7,
+            "y": 10
+          },
+          "id": 12,
+          "interval": null,
+          "links": [],
+          "maxDataPoints": 100,
+          "options": {
+            "colorMode": "background",
+            "graphMode": "none",
+            "justifyMode": "auto",
+            "orientation": "horizontal",
+            "reduceOptions": {
+              "calcs": [
+                "sum"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "text": {},
+            "textMode": "auto"
+          },
+          "pluginVersion": "8.1.2",
+          "targets": [
+            {
+              "exemplar": true,
+              "expr": "sum(increase(cs_parser_hits_ok_total{instance=\"$instance\"}[$__interval]))",
+              "interval": "",
+              "intervalFactor": 2,
+              "legendFormat": "",
+              "refId": "A"
+            }
+          ],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Total parsed lines",
+          "type": "stat"
+        },
+        {
+          "cacheTimeout": null,
+          "datasource": "Prometheus",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "mappings": [
+                {
+                  "options": {
+                    "match": "null",
+                    "result": {
+                      "text": "N/A"
+                    }
+                  },
+                  "type": "special"
+                }
+              ],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "short"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 9,
+            "w": 5,
+            "x": 12,
+            "y": 10
+          },
+          "id": 8,
+          "interval": null,
+          "links": [],
+          "maxDataPoints": 100,
+          "options": {
+            "colorMode": "background",
+            "graphMode": "none",
+            "justifyMode": "auto",
+            "orientation": "horizontal",
+            "reduceOptions": {
+              "calcs": [
+                "sum"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "text": {},
+            "textMode": "auto"
+          },
+          "pluginVersion": "8.1.2",
+          "targets": [
+            {
+              "exemplar": true,
+              "expr": "sum(increase(cs_bucket_overflowed_total{instance=\"$instance\"}[$__interval]))",
+              "interval": "",
+              "intervalFactor": 2,
+              "legendFormat": "",
+              "refId": "A"
+            }
+          ],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Total Overflows",
+          "type": "stat"
+        },
+        {
+          "cacheTimeout": null,
+          "datasource": "Prometheus",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "mappings": [
+                {
+                  "options": {
+                    "match": "null",
+                    "result": {
+                      "text": "N/A"
+                    }
+                  },
+                  "type": "special"
+                }
+              ],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "none"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 9,
+            "w": 5,
+            "x": 17,
+            "y": 10
+          },
+          "id": 18,
+          "interval": null,
+          "links": [],
+          "maxDataPoints": 100,
+          "options": {
+            "colorMode": "background",
+            "graphMode": "none",
+            "justifyMode": "auto",
+            "orientation": "horizontal",
+            "reduceOptions": {
+              "calcs": [
+                "lastNotNull"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "text": {},
+            "textMode": "auto"
+          },
+          "pluginVersion": "8.1.2",
+          "targets": [
+            {
+              "exemplar": true,
+              "expr": "process_open_fds{instance=\"$instance\"}",
+              "interval": "",
+              "legendFormat": "{{instance}}",
+              "refId": "A"
+            }
+          ],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Process Open FDs",
+          "type": "stat"
+        },
+        {
+          "cacheTimeout": null,
+          "datasource": "Prometheus",
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "mappings": [
+                {
+                  "options": {
+                    "match": "null",
+                    "result": {
+                      "text": "N/A"
+                    }
+                  },
+                  "type": "special"
+                }
+              ],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "none"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 9,
+            "w": 5,
+            "x": 4,
+            "y": 19
+          },
+          "id": 14,
+          "interval": null,
+          "links": [],
+          "maxDataPoints": 100,
+          "options": {
+            "colorMode": "background",
+            "graphMode": "none",
+            "justifyMode": "auto",
+            "orientation": "horizontal",
+            "reduceOptions": {
+              "calcs": [
+                "sum"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "text": {},
+            "textMode": "auto"
+          },
+          "pluginVersion": "8.1.2",
+          "targets": [
+            {
+              "expr": "sum(increase(cs_parser_hits_ko_total{instance=\"$instance\"}[$__interval]))",
+              "interval": "",
+              "intervalFactor": 2,
+              "legendFormat": "",
+              "refId": "A"
+            }
+          ],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Total unparsed lines",
+          "type": "stat"
+        },
+        {
+          "datasource": "Prometheus",
+          "fieldConfig": {
+            "defaults": {
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 9,
+            "w": 10,
+            "x": 9,
+            "y": 19
+          },
+          "id": 16,
+          "options": {
+            "displayMode": "gradient",
+            "orientation": "horizontal",
+            "reduceOptions": {
+              "calcs": [
+                "sum"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "showUnfilled": false,
+            "text": {}
+          },
+          "pluginVersion": "8.1.2",
+          "repeat": null,
+          "repeatDirection": "v",
+          "targets": [
+            {
+              "exemplar": true,
+              "expr": "sum(increase(cs_bucket_overflowed_total{instance=\"$instance\"}[$__interval])) by (name)",
+              "format": "time_series",
+              "instant": false,
+              "interval": "",
+              "intervalFactor": 2,
+              "legendFormat": "{{name}}",
+              "refId": "A"
+            }
+          ],
+          "timeFrom": null,
+          "timeShift": null,
+          "title": "Top scenarios",
+          "transparent": true,
+          "type": "bargauge"
+        }
+      ],
+      "repeat": "instance",
+      "title": "$instance",
+      "type": "row"
+    }
+  ],
+  "schemaVersion": 30,
+  "style": "dark",
+  "tags": [],
+  "templating": {
+    "list": [
+      {
+        "allValue": null,
+        "current": {},
+        "datasource": "Prometheus",
+        "definition": "label_values(cs_info, instance)",
+        "description": null,
+        "error": null,
+        "hide": 0,
+        "includeAll": true,
+        "label": "instance",
+        "multi": true,
+        "name": "instance",
+        "options": [],
+        "query": {
+          "query": "label_values(cs_info, instance)",
+          "refId": "Prometheus-instance-Variable-Query"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 1,
+        "tagValuesQuery": "",
+        "tagsQuery": "",
+        "type": "query",
+        "useTags": false
+      }
+    ]
+  },
+  "time": {
+    "from": "now-24h",
+    "to": "now"
+  },
+  "timepicker": {
+    "refresh_intervals": [
+      "5s",
+      "10s",
+      "30s",
+      "1m",
+      "5m",
+      "15m",
+      "30m",
+      "1h",
+      "2h",
+      "1d"
+    ]
+  },
+  "timezone": "",
+  "title": "Crowdsec Insight",
+  "uid": "e7sWOBVnk",
+  "version": 8
+}

containers/crowdsec/resources/monitoring/grafana-dashboards/lapi-metrics.json

@@ -0,0 +1,515 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": "-- Grafana --",
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "target": {
+          "limit": 100,
+          "matchAny": false,
+          "tags": [],
+          "type": "dashboard"
+        },
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "gnetId": null,
+  "graphTooltip": 0,
+  "id": null,
+  "iteration": 1655915193937,
+  "links": [],
+  "panels": [
+    {
+      "collapsed": false,
+      "datasource": null,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 10,
+      "panels": [],
+      "title": "Agents",
+      "type": "row"
+    },
+    {
+      "datasource": "Prometheus",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 1
+      },
+      "id": 2,
+      "options": {
+        "displayMode": "gradient",
+        "orientation": "vertical",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showUnfilled": false,
+        "text": {}
+      },
+      "pluginVersion": "8.1.2",
+      "repeat": "query0",
+      "repeatDirection": "h",
+      "targets": [
+        {
+          "exemplar": false,
+          "expr": "sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint=\"/v1/watchers/login\", instance=\"$lapi\"}[$__rate_interval])) by (le)",
+          "format": "heatmap",
+          "interval": "",
+          "legendFormat": "{{le}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Agents Login",
+      "type": "heatmap"
+    },
+    {
+      "datasource": "Prometheus",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 1
+      },
+      "id": 6,
+      "options": {
+        "displayMode": "gradient",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showUnfilled": false,
+        "text": {}
+      },
+      "pluginVersion": "8.1.2",
+      "targets": [
+        {
+          "exemplar": true,
+          "expr": "sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint=\"/v1/watchers/login\"}[$__rate_interval])) by (le)",
+          "format": "heatmap",
+          "interval": "",
+          "legendFormat": "{{le}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Heartbeat",
+      "type": "heatmap"
+    },
+    {
+      "collapsed": false,
+      "datasource": null,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 9
+      },
+      "id": 12,
+      "panels": [],
+      "title": "Decisions",
+      "type": "row"
+    },
+    {
+      "datasource": "Prometheus",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 10
+      },
+      "id": 4,
+      "options": {
+        "displayMode": "gradient",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showUnfilled": false,
+        "text": {}
+      },
+      "pluginVersion": "8.1.2",
+      "targets": [
+        {
+          "exemplar": true,
+          "expr": "sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint= \"/v1/decisions\", instance=\"$lapi\", method=~\"(GET)|(HEAD)\"}[$__rate_interval])) by (le)",
+          "format": "heatmap",
+          "interval": "",
+          "legendFormat": "{{le}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Decisions GET (live)",
+      "type": "heatmap"
+    },
+    {
+      "datasource": "Prometheus",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 10
+      },
+      "id": 13,
+      "options": {
+        "displayMode": "gradient",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showUnfilled": false,
+        "text": {}
+      },
+      "pluginVersion": "8.1.2",
+      "targets": [
+        {
+          "exemplar": true,
+          "expr": "sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint= \"/v1/decisions/stream\", instance=\"$lapi\", method=~\"(GET)|(HEAD)\"}[$__rate_interval])) by (le)",
+          "format": "heatmap",
+          "interval": "",
+          "legendFormat": "{{le}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Decisions GET (stream)",
+      "type": "heatmap"
+    },
+    {
+      "datasource": "Prometheus",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 18
+      },
+      "id": 8,
+      "options": {
+        "displayMode": "gradient",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showUnfilled": false,
+        "text": {}
+      },
+      "pluginVersion": "8.1.2",
+      "targets": [
+        {
+          "exemplar": true,
+          "expr": "sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint=~\"/v1/decisions.*\", instance=\"$lapi\", method=\"DELETE\"}[$__rate_interval])) by (le)",
+          "format": "heatmap",
+          "interval": "",
+          "legendFormat": "{{le}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Decisions DELETE",
+      "type": "heatmap"
+    },
+    {
+      "collapsed": false,
+      "datasource": null,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 26
+      },
+      "id": 15,
+      "panels": [],
+      "title": "Alerts",
+      "type": "row"
+    },
+    {
+      "datasource": "Prometheus",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 27
+      },
+      "id": 17,
+      "options": {
+        "displayMode": "gradient",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showUnfilled": false,
+        "text": {}
+      },
+      "pluginVersion": "8.1.2",
+      "targets": [
+        {
+          "exemplar": true,
+          "expr": "sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint=\"/v1/alerts\",instance=\"$lapi\",method=\"POST\"}[$__rate_interval])) by (le)",
+          "format": "heatmap",
+          "interval": "",
+          "legendFormat": "{{le}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Alerts POST",
+      "type": "heatmap"
+    },
+    {
+      "datasource": "Prometheus",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 27
+      },
+      "id": 18,
+      "options": {
+        "displayMode": "gradient",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showUnfilled": false,
+        "text": {}
+      },
+      "pluginVersion": "8.1.2",
+      "targets": [
+        {
+          "exemplar": true,
+          "expr": "sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint=\"/v1/alerts\",instance=\"$lapi\",method=~\"(GET)|(HEAD)\"}[$__rate_interval])) by (le)",
+          "format": "heatmap",
+          "interval": "",
+          "legendFormat": "{{le}}",
+          "refId": "A"
+        }
+      ],
+      "title": "Alerts GET",
+      "type": "heatmap"
+    }
+  ],
+  "schemaVersion": 30,
+  "style": "dark",
+  "tags": [],
+  "templating": {
+    "list": [
+      {
+        "allValue": null,
+        "current": {},
+        "datasource": "Prometheus",
+        "definition": "label_values(cs_info, instance)",
+        "description": null,
+        "error": null,
+        "hide": 0,
+        "includeAll": false,
+        "label": null,
+        "multi": false,
+        "name": "lapi",
+        "options": [],
+        "query": {
+          "query": "label_values(cs_info, instance)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-6h",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "LAPI Metrics",
+  "uid": "ofdKJG37k",
+  "version": 11
+}

containers/crowdsec/resources/monitoring/prometheus-scrape.yml

@@ -0,0 +1,9 @@
+# Prometheus scrape job for the CrowdSec host agent. Gathered into
+# prometheus/scrape.d/crowdsec.yml by monitoringRefreshPrometheus when
+# CFG_CROWDSEC_MONITORING=true. CrowdSec runs on the host, so the target is
+# host.docker.internal (the Prometheus container has the host-gateway alias);
+# installCrowdsecHost binds CrowdSec's metrics endpoint to a reachable address.
+- job_name: crowdsec
+  metrics_path: /metrics
+  static_configs:
+    - targets: ['host.docker.internal:6060']

containers/dashy/dashy.config

@@ -0,0 +1,85 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# AUTHELIA = if true, use Authelia authentication, if false turned off.
+# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
+#
+CFG_DASHY_APP_NAME=dashy
+CFG_DASHY_BACKUP=true
+CFG_DASHY_COMPOSE_FILE=default
+CFG_DASHY_HEALTHCHECK=true
+CFG_DASHY_AUTHELIA=false
+CFG_DASHY_HEADSCALE=false
+#
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+#
+CFG_DASHY_CATEGORY="productivity"
+CFG_DASHY_TITLE="Dashy"
+CFG_DASHY_DESCRIPTION="Dashboard Tool"
+CFG_DASHY_LONG_DESCRIPTION="Dashy is a self-hostable personal dashboard for monitoring your self-hosted services and applications with a beautiful, intuitive interface"
+CFG_DASHY_URL="https://github.com/Lissy93/dashy"
+CFG_DASHY_ACTIONS="configure|install|restart|shutdown|uninstall|tools"
+#
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# HOST_NAME = subdomain name e.g test is the name for test.website.com
+# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
+#
+CFG_DASHY_DOMAIN=1
+CFG_DASHY_WHITELIST=false
+CFG_DASHY_HOST_NAME=dashy
+CFG_DASHY_NETWORK=default
+#
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, dns, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_DASHY_PORT_1="dashy-service|webui|random:8080|private|tcp|false|false|true|Dashboard|"
+# Comma-separated list of installed app slugs to surface as shortcuts on
+# the dashy dashboard. Managed via the Tools tab → "Manage Shortcuts".
+# Empty = no app shortcuts (only the static page header survives).
+CFG_DASHY_SHORTCUTS=
+#
+# =============================================================================
+# DASHBOARD CUSTOMIZATION
+# =============================================================================
+# THEME = built-in dashy theme name (Nord-Frost, Dracula, Cyberpunk, ...)
+# PAGE_TITLE = page header title (blank = "Dashy - LibrePortal - <install_name>")
+# PAGE_DESCRIPTION = page header subtitle (blank = default welcome line)
+# LAYOUT = item layout: auto / horizontal / vertical
+# ICON_SIZE = tile icon size: small / medium / large
+# OPEN_TARGET = where tile clicks open: newtab / sametab / modal / workspace
+# STATUS_CHECK = if true, dashy pings each tile and shows up/down status
+#
+CFG_DASHY_THEME="Nord-Frost"
+CFG_DASHY_PAGE_TITLE=
+CFG_DASHY_PAGE_DESCRIPTION=
+CFG_DASHY_LAYOUT="auto"
+CFG_DASHY_ICON_SIZE="medium"
+CFG_DASHY_OPEN_TARGET="newtab"
+CFG_DASHY_STATUS_CHECK=false

containers/dashy/dashy.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+
+# Category : Miscellaneous
+# Description : Dashy - Dashboard Tool (c/t/u/s/r/i):
+
+installDashy()
+{
+    local config_variables="$1"
+
+    if [[ "$dashy" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent dashy;
+        local app_name=$CFG_DASHY_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$dashy" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$dashy" == *[tT]* ]]; then
+        dashyToolsMenu;
+    fi
+
+    if [[ "$dashy" == *[uU]* ]]; then
+        dockerUninstallApp $app_name;
+    fi
+
+    if [[ "$dashy" == *[sS]* ]]; then
+        dockerComposeDown $app_name;
+    fi
+
+    if [[ "$dashy" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$dashy" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Updating WebUI config file."
+		echo ""
+
+		webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your new service using one of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    dashy=n
+}

containers/dashy/docker-compose.yml

@@ -0,0 +1,45 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+  dashy-service: #LIBREPORTAL|SERVICE_TAG_1|dashy-service
+    image: lissy93/dashy
+    container_name: dashy
+    volumes:
+      - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
+      - ./etc:/app/user-data
+    # GLUETUN_OFF_BEGIN
+    ports:
+      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+    # GLUETUN_OFF_END
+    environment:
+      - NODE_ENV=production
+      - TZ:TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+    restart: unless-stopped
+    healthcheck:
+      test: ['CMD', 'node', '/app/services/healthcheck']
+      interval: 1m30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
+      traefik.http.routers.dashy-service.entrypoints: web,websecure
+      traefik.http.routers.dashy-service.rule: Host(`DOMAINSUBNAME_DATA`) #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      traefik.http.routers.dashy-service.tls: true
+      traefik.http.routers.dashy-service.tls.certresolver: production
+      traefik.http.services.dashy-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+      traefik.http.routers.dashy-service.middlewares: MIDDLEWARE_DATA #LIBREPORTAL|MIDDLEWARE_TAG|MIDDLEWARE_DATA
+      traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    # GLUETUN_OFF_BEGIN
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+    # GLUETUN_OFF_END
+    # GLUETUN_ON_BEGIN
+    # network_mode: "container:gluetun-service"
+    # GLUETUN_ON_END

containers/dashy/resources/conf.yml

@@ -0,0 +1,232 @@
+---
+# Page meta info, like heading, footer text and nav links
+pageInfo:
+  title: INSTALLNAMEHERE - LibrePortal Dashy
+  description: Welcome to your LibrePortal Dashy dashboard!
+  navLinks:
+  - title: Dashy GitHub
+    path: http://github.com/Lissy93/dashy
+  - title: Dashy Documentation
+    path: http://dashy.to/docs
+
+# Optional app settings and configuration
+appConfig:
+  theme: Nord-Frost
+
+# Main content - An array of sections, each containing an array of items
+sections:
+
+#### category system 
+#- name: System Applications
+#  icon: fas fa-rocket
+#  items:
+
+  #### app traefik
+  #- title: Traefik
+  #  description: For VPN connections
+  #  icon: si-traefikproxy
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: false
+  #  target: newtab
+
+  #### app adguard
+  #- title: Adguard
+  #  description: DNS Server with AdBlocking DNS-over-TLS
+  #  icon: hl-adblock
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app pihole
+  #- title: Pi-Hole
+  #  description: DNS Server with AdBlocking and Unbound
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app portainer
+  #- title: Portainer
+  #  description: Docker service management panel
+  #  icon: hl-portainer
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app authelia
+  #- title: Authelia
+  #  description: Single Sign-On Platform
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app grafana
+  #- title: Grafana
+  #  description: Metrics Visualizer
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app prometheus
+  #- title: Prometheus
+  #  description: Metrics Collector
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app headscale
+  #- title: Headscale
+  #  description: VPN Networking
+  #  icon: si-traefikmesh
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app duplicati
+  #- title: Duplicati
+  #  description: Docker backup system
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+#### category privacy
+#- name: Privacy Apps
+#  icon: fas fa-rocket
+#  items:
+
+  #### app mailcow
+  #- title: Mail Cow
+  #  description: Mail Server
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app vaultwarden
+  #- title: VaultWarden
+  #  description: Password Manager
+  #  icon: hl-bitwarden
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app trillium
+  #- title: Trilium
+  #  description: Note Manager
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app invidious
+  #- title: Invidious
+  #  description: Alternative YouTube Frontend
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app searxng
+  #- title: SearXNG
+  #  description: Privacy based Search Engine
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app speedtest
+  #- title: SpeedTest
+  #  description: Used for testing the speed of your internet
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app firefly
+  #- title: FireFly iii
+  #  description: Money Budgetting Platform
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app ipinfo
+  #- title: IP Info
+  #  description: Shows your current IP Address
+  #  icon: hl-docker
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+#### category user
+#- name: User Apps
+#  icon: fas fa-rocket
+#  items:
+
+  #### app mattermost
+  #- title: Mattermost
+  #  description: Project Management & Chat Platform
+  #  icon: hl-mattermost
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app jitsimeet
+  #- title: Jitsi Meet
+  #  description: Video Conferencing Platform (Zoom alternative)
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app owncloud
+  #- title: OwnCloud
+  #  description: File & Document Hosting
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app onlyoffice
+  #- title: OnlyOffice
+  #  description: Document Collaboration Connector
+  #  icon: hl-onlyoffice
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app kimai
+  #- title: Kimai
+  #  description: Time Management Client Platform
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app killbill
+  #- title: Kill Bill
+  #  description: Payment Processing Platform
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app rustdesk
+  #- title: RustDesk
+  #  description: Remote Desktop Server
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab
+
+  #### app tiledesk
+  #- title: TileDesk
+  #  description: Live Chat Platform
+  #  icon: favicon-local
+  #  url: http://APPADDRESSHERE/
+  #  statusCheck: true
+  #  target: newtab

containers/focalboard/docker-compose.yml

@@ -0,0 +1,44 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+  focalboard-service: #LIBREPORTAL|SERVICE_TAG_1|focalboard-service
+    image: mattermost/focalboard
+    container_name: focalboard-service
+    # GLUETUN_OFF_BEGIN
+    ports:
+      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+    # GLUETUN_OFF_END
+    volumes:
+      - ./data:/data
+    environment:
+      - VIRTUAL_HOST:DOMAINSUBNAME_DATA #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      - VIRTUAL_PORT:8000
+      - TZ:TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+    restart: unless-stopped
+    healthcheck:
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
+      traefik.http.routers.focalboard-service.entrypoints: web,websecure
+      traefik.http.routers.focalboard-service.rule: Host(`DOMAINSUBNAME_DATA`) #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      traefik.http.routers.focalboard-service.tls: true
+      traefik.http.routers.focalboard-service.tls.certresolver: production
+      traefik.http.services.focalboard-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+      traefik.http.routers.focalboard-service.middlewares: MIDDLEWARE_DATA #LIBREPORTAL|MIDDLEWARE_TAG|MIDDLEWARE_DATA
+      traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    # GLUETUN_OFF_BEGIN
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+    # GLUETUN_OFF_END
+    # GLUETUN_ON_BEGIN
+    # network_mode: "container:gluetun-service"
+    # GLUETUN_ON_END
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "1m"

containers/focalboard/focalboard.config

@@ -0,0 +1,68 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# AUTHELIA = if true, use Authelia authentication, if false turned off.
+# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
+#
+CFG_FOCALBOARD_APP_NAME=focalboard
+CFG_FOCALBOARD_BACKUP=true
+CFG_FOCALBOARD_COMPOSE_FILE=default
+CFG_FOCALBOARD_HEALTHCHECK=true
+CFG_FOCALBOARD_AUTHELIA=false
+CFG_FOCALBOARD_HEADSCALE=false
+
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+#
+CFG_FOCALBOARD_CATEGORY="productivity"
+CFG_FOCALBOARD_TITLE="Focalboard"
+CFG_FOCALBOARD_DESCRIPTION="Project Management"
+CFG_FOCALBOARD_LONG_DESCRIPTION="Focalboard is an open source, self-hosted alternative to Trello, Notion, and Asana that helps organize projects and tasks"
+CFG_FOCALBOARD_URL="https://github.com/mattermost/focalboard"
+CFG_FOCALBOARD_ACTIONS="configure|install|restart|shutdown|uninstall"
+
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# HOST_NAME = subdomain name e.g test is the name for test.website.com
+# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
+#
+CFG_FOCALBOARD_DOMAIN=1
+CFG_FOCALBOARD_WHITELIST=false
+CFG_FOCALBOARD_HOST_NAME=board
+CFG_FOCALBOARD_NETWORK=default
+
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, dns, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_FOCALBOARD_PORT_1="focalboard-service|webui|random:8000|public|tcp|false|true|true|Web Interface|"
+
+# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
+CFG_FOCALBOARD_AUTH_PROFILE=multi_user
+CFG_FOCALBOARD_ADMIN_USER=
+CFG_FOCALBOARD_ADMIN_EMAIL=
+CFG_FOCALBOARD_ADMIN_PASSWORD=RANDOMIZEDPASSWORD1

containers/focalboard/focalboard.sh

@@ -0,0 +1,110 @@
+#!/bin/bash
+
+# Category : Productivity
+# Description : Focalboard - Project Management (c/u/s/r/i):
+
+installFocalboard()
+{
+    local config_variables="$1"
+
+    if [[ "$focalboard" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent focalboard;
+        local app_name=$CFG_FOCALBOARD_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$focalboard" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+	if [[ "$focalboard" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$focalboard" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+    if [[ "$focalboard" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$focalboard" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Updating WebUI config file."
+		echo ""
+
+		webuiContainerSetup $app_name install;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using one of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+	fi
+	focalboard=n
+}

containers/focalboard/focalboard.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 512 512"><path d="m346 92-5.7-25.8L374.6 0l21 35.4 41.1-1.4-37.1 64.6-26.4 9.8-74 135.4c8.4 9.7 12.4 23.1 7.7 36.9-6.9 20.3-29.5 30.9-50.5 23.8s-32.5-29.3-25.7-49.6c4.6-13.6 16.3-22.9 29.9-25.4 3.4-.7 6.9-.8 10.3-.5zm37.9 41.6-3.7 39.1c37.2 39.3 53.9 95.9 34.7 152.5-27 79.8-116 121.7-198.9 93.7-82.8-28-128.1-115.4-101.1-195.2 23.9-70.6 96.4-110.2 166.6-101.4L310.4 97C208.7 69.2 93.1 123.5 56 233.1 18.6 343.6 77.8 463.4 188.3 500.8 298.7 538.2 418.6 479 456 368.5c30.5-90.2-3.8-182.3-72.1-234.9m-225.6 98.3c-10 29.4-6.6 60.2 6.8 86.2 13.4 25.8 36.7 46.9 66.9 57.1s61.5 7.7 87.8-4.7c26.5-12.5 47.8-34.9 57.8-64.3 6.3-18.7 7.2-37.2 3.9-54.5-4-20.8-14.1-39.8-28.2-55.2-1.4-1.6-2.9-3.1-4.4-4.6l-8.2 41c4.5 7.7 7.7 16 9.4 24.8 2.3 12.1 1.7 25.1-2.8 38.2-7.1 20.9-22.3 36.8-41.2 45.7-19.1 9-41.9 10.8-63.9 3.3s-39.1-22.8-48.8-41.5c-9.6-18.5-12-40.4-5-61.3 4.7-13.8 12.8-25.4 23.3-34.2 10.9-9.3 24.3-15.5 38.6-18.1h.2c2.4-.5 4.7-.8 7.1-1l28.8-30.2c-13.6-2.6-27.7-2.9-41.9-.1-19.9 3.6-38.4 12.3-53.5 25.1-14.5 12.4-26.1 28.8-32.7 48.3" style="fill:#1c58d9"/></svg>

containers/gitea/docker-compose.yml

@@ -0,0 +1,92 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+  gitea-service: #LIBREPORTAL|SERVICE_TAG_1|gitea-service
+    container_name: gitea-service
+    image: gitea/gitea:latest
+    restart: unless-stopped
+    # GLUETUN_OFF_BEGIN
+    depends_on:
+      gitea-cache:
+        condition: service_healthy
+    # GLUETUN_OFF_END
+    volumes:
+      - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
+      - ./data/gitea:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "1m"
+    environment:
+      - APP_NAME="Gitea"
+      - USER_UID=1000
+      - USER_GID=1000
+      - USER=git
+      - RUN_MODE=prod
+      - DOMAIN=DOMAINSUBNAME_DATA #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      - SSH_DOMAIN=DOMAINSUBNAME_DATA #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      - HTTP_PORT=PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+      - ROOT_URL=https://DOMAINSUBNAME_DATA #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      - SSH_PORT=PORT_INTERNAL_DATA_2 #LIBREPORTAL|PORT_INTERNAL_TAG_2|PORT_INTERNAL_DATA_2
+      - SSH_LISTEN_PORT=PORT_INTERNAL_DATA_2 #LIBREPORTAL|PORT_INTERNAL_TAG_2|PORT_INTERNAL_DATA_2
+      - DB_TYPE=sqlite3
+      - GITEA__cache__ENABLED=true
+      - GITEA__cache__ADAPTER=redis
+      - GITEA__cache__HOST=redis://gitea-cache:6379/0?pool_size=100&idle_timeout=180s
+      - GITEA__cache__ITEM_TTL=24h
+      - TZ:TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+      # >>> libreportal-monitoring >>>
+      #- GITEA__metrics__ENABLED=true
+      #- GITEA__metrics__TOKEN=GITEA_METRICS_TOKEN_DATA #LIBREPORTAL|GITEA_METRICS_TOKEN_TAG|GITEA_METRICS_TOKEN_DATA
+      # <<< libreportal-monitoring <<<
+    # GLUETUN_OFF_BEGIN
+    ports:
+      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+      - "PORTS_DATA_2" #LIBREPORTAL|PORTS_TAG_2|PORTS_DATA_2
+    # GLUETUN_OFF_END
+    healthcheck:
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+    # GLUETUN_OFF_BEGIN
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+    # GLUETUN_OFF_END
+    # GLUETUN_ON_BEGIN
+    # network_mode: "container:gluetun-service"
+    # depends_on:
+    #   gitea-cache:
+    #     condition: service_healthy
+    # GLUETUN_ON_END
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
+      traefik.http.routers.gitea-service.entrypoints: web,websecure
+      traefik.http.routers.gitea-service.rule: Host(`DOMAINSUBNAME_DATA`) #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      traefik.http.routers.gitea.tls: true
+      traefik.http.routers.gitea.tls.certresolver: production
+      traefik.http.services.gitea.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+      traefik.http.routers.gitea.middlewares: MIDDLEWARE_DATA #LIBREPORTAL|MIDDLEWARE_TAG|MIDDLEWARE_DATA
+      traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+
+  gitea-cache: #LIBREPORTAL|SERVICE_TAG_2|gitea-cache
+    container_name: gitea-cache
+    image: redis:6-alpine
+    restart: unless-stopped
+    healthcheck:
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 15s
+      timeout: 3s
+      retries: 30
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "1m"
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_2 #LIBREPORTAL|IP_TAG_2|IP_DATA_2

containers/gitea/gitea.config

@@ -0,0 +1,73 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# AUTHELIA = if true, use Authelia authentication, if false turned off.
+# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
+# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
+# METRICS_TOKEN = bearer token guarding /metrics (rides the public web port); auto-generated, mirrored into the Prometheus scrape config
+#
+CFG_GITEA_APP_NAME=gitea
+CFG_GITEA_BACKUP=true
+CFG_GITEA_COMPOSE_FILE=default
+CFG_GITEA_HEALTHCHECK=true
+CFG_GITEA_AUTHELIA=false
+CFG_GITEA_HEADSCALE=false
+CFG_GITEA_MONITORING=false
+CFG_GITEA_METRICS_TOKEN=RANDOMIZEDPASSWORD1
+
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+#
+CFG_GITEA_CATEGORY="development"
+CFG_GITEA_TITLE="Gitea"
+CFG_GITEA_DESCRIPTION="Git Repository Management"
+CFG_GITEA_LONG_DESCRIPTION="Gitea is a lightweight, self-hosted Git service written in Go that provides a painless self-hosted Git service with a minimal setup"
+CFG_GITEA_URL="https://github.com/go-gitea/gitea"
+CFG_GITEA_ACTIONS="configure|install|restart|shutdown|uninstall"
+#
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# HOST_NAME = subdomain name e.g test is the name for test.website.com
+# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
+#
+CFG_GITEA_DOMAIN=1
+CFG_GITEA_WHITELIST=false
+CFG_GITEA_HOST_NAME=gitea
+CFG_GITEA_NETWORK=default
+#
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, dns, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_GITEA_PORT_1="gitea-service|webui|random:3000|public|tcp|false|true|true|Web Interface|"
+CFG_GITEA_PORT_2="gitea-service|ssh|random:22|private|tcp|false|false|false|Git SSH Access|"
+
+# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
+CFG_GITEA_AUTH_PROFILE=multi_user
+CFG_GITEA_ADMIN_USER=
+CFG_GITEA_ADMIN_EMAIL=
+CFG_GITEA_ADMIN_PASSWORD=RANDOMIZEDPASSWORD1

containers/gitea/gitea.sh

@@ -0,0 +1,139 @@
+#!/bin/bash
+
+# Category : Development & Version Control
+# Description : Gitea - Git Repository Management (c/u/s/r/i):
+
+installGitea()
+{
+    local config_variables="$1"
+
+    if [[ "$gitea" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent gitea;
+        local app_name=$CFG_GITEA_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$gitea" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+	if [[ "$gitea" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$gitea" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+    if [[ "$gitea" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$gitea" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+        # Enable Gitea's /metrics endpoint only when CFG_GITEA_MONITORING=true
+        # (toggles the libreportal-monitoring marker block in the compose).
+        monitoringToggleAppConfig "$app_name" "docker-compose.yml";
+
+        # /metrics rides Gitea's public web port, so it's locked behind a
+        # bearer token. CFG_GITEA_METRICS_TOKEN lives in the .config (filled
+        # once by the RANDOMIZEDPASSWORD scanner, preserved across reinstalls)
+        # and reaches the compose via the GITEA_METRICS_TOKEN_TAG tag — mirror
+        # that same value into the Prometheus scrape fragment so the two agree.
+        if monitoringAppEnabled "$app_name"; then
+            if [[ -n "$CFG_GITEA_METRICS_TOKEN" ]]; then
+                sudo sed -i "s|GITEA_METRICS_TOKEN_PLACEHOLDER|${CFG_GITEA_METRICS_TOKEN}|g" \
+                    "$containers_dir$app_name/resources/monitoring/prometheus-scrape.yml"
+                checkSuccess "Synced Gitea /metrics token to the Prometheus scrape config"
+            else
+                isNotice "CFG_GITEA_METRICS_TOKEN is empty — Gitea /metrics scrape may 401."
+            fi
+        fi
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating WebUI config file."
+        echo ""
+
+        webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Refreshing monitoring integration."
+		echo ""
+
+		# Self-correcting: adds Gitea's scrape target + dashboard to
+		# Prometheus/Grafana when CFG_GITEA_MONITORING=true, removes them when
+		# it's off. No-ops with a notice if either app isn't installed.
+		monitoringRefreshAll;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using one of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+	fi
+	gitea=n
+}

containers/gitea/gitea.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 512 512">
+<path d="M414.4 376.5 200 379.6l-1.4-256.7 103.5-15.2 108.8-1.5z" style="fill:#fff"/>
+<path d="M502.6 103.7c-3.3-3.3-7.8-3.3-7.8-3.3s-95.5 5.4-144.9 6.5c-10.8.2-21.6.5-32.3.6V203c-4.5-2.1-9-4.3-13.5-6.4 0-29.6-.1-88.9-.1-88.9-23.6.3-72.7-1.8-72.7-1.8s-115.2-5.8-127.7-6.9c-8-.5-18.3-1.7-31.8 1.2-7.1 1.5-27.3 6-43.8 21.9C-8.7 154.8.7 206.7 1.9 214.5c1.4 9.5 5.6 36 25.8 59 37.3 45.7 117.6 44.6 117.6 44.6s9.9 23.5 24.9 45.2c20.4 27 41.3 48 61.7 50.5 51.3 0 153.9-.1 153.9-.1s9.8.1 23-8.4c11.4-6.9 21.6-19.1 21.6-19.1s10.5-11.2 25.2-36.9c4.5-7.9 8.2-15.6 11.5-22.8 0 0 45-95.4 45-188.2-1-28-7.9-33-9.5-34.6M97.7 269.9c-21.1-6.9-30.1-15.2-30.1-15.2S52 243.8 44.2 222.3c-13.4-36-1.1-58-1.1-58s6.8-18.3 31.4-24.4c11.2-3 25.2-2.5 25.2-2.5s5.8 48.4 12.8 76.7c5.9 23.8 20.2 63.3 20.2 63.3s-21.3-2.6-35-7.5m289.4-4.5c-5.2 12.6-44.8 92.1-44.8 92.1s-5 11.8-16 12.5c-4.7.3-8.4-1-8.4-1s-.2-.1-4.3-1.7l-92-44.8s-8.9-4.6-10.4-12.7c-1.8-6.6 2.2-14.7 2.2-14.7l44.2-91.1s3.9-7.9 9.9-10.6c.5-.2 1.9-.8 3.7-1.2 6.6-1.7 14.7 2.3 14.7 2.3l18.4 8.9c-3.7 7.6-7.5 15.2-11.2 22.9-5.5-.1-10.5 2.9-13.1 7.7-2.8 5.1-2.2 11.5 1.5 16.1-6.6 13.8-13.3 27.5-19.9 41.1-6.7.1-12.5 4.7-14.1 11.2-1.5 6.5 1.6 13.3 7.4 16.3 6.3 3.3 14.3 1.5 18.5-4.4 4.2-5.8 3.5-13.8-1.5-18.8l19.5-40c1.2.1 3 .2 5-.4 3.3-.7 5.8-2.9 5.8-2.9 3.4 1.5 7 3.1 10.8 5 3.9 2 7.6 4 10.9 5.9.7.4 1.5.9 2.3 1.5 1.3 1.1 2.8 2.5 3.8 4.5 1.5 4.5-1.5 12.1-1.5 12.1-1.9 6.2-15 33.1-15 33.1-6.6-.2-12.5 4.1-14.4 10.2-2.1 6.6.9 14.1 7.2 17.3 6.4 3.3 14.2 1.4 18.3-4.3 4.1-5.5 3.7-13.3-.9-18.4l4.6-9.2c4.1-8.5 11-24.8 11-24.8.7-1.4 4.6-8.4 2.2-17.3-2-9.3-10.3-13.6-10.3-13.6-9.9-6.4-23.8-12.4-23.8-12.4s0-3.3-.9-5.8-2.3-4.2-3.2-5.1c3.6-7.6 7.4-15.1 11-22.6l61.8 29.9s10.3 4.6 12.5 13.2c1.5 6-.4 11.4-1.5 14" style="fill:#609926"/>
+</svg>

containers/gitea/resources/monitoring/prometheus-scrape.yml

@@ -0,0 +1,13 @@
+# Prometheus scrape job for Gitea. Gathered into
+# prometheus/scrape.d/gitea.yml by monitoringRefreshPrometheus when
+# CFG_GITEA_MONITORING=true. Gitea's /metrics rides the main HTTP port (3000),
+# which is the public web port — so it's locked behind a bearer token.
+# The compose fills GITEA__metrics__TOKEN via the framework's RANDOMIZEDPASSWORD
+# mechanism; gitea.sh mirrors that generated value into this fragment so the
+# two always match.
+- job_name: gitea
+  metrics_path: /metrics
+  authorization:
+    credentials: GITEA_METRICS_TOKEN_PLACEHOLDER
+  static_configs:
+    - targets: ['gitea-service:3000']

containers/gluetun/docker-compose.yml

@@ -0,0 +1,55 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+  gluetun-service: #LIBREPORTAL|SERVICE_TAG_1|gluetun-service
+    container_name: gluetun-service
+    image: qmcgaw/gluetun:latest
+    restart: unless-stopped
+    hostname: gluetun
+    cap_add:
+      - NET_ADMIN
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+      - VPN_SERVICE_PROVIDER=GLUETUN_VPN_SERVICE_PROVIDER_DATA #LIBREPORTAL|GLUETUN_VPN_SERVICE_PROVIDER_TAG|GLUETUN_VPN_SERVICE_PROVIDER_DATA
+      - VPN_TYPE=GLUETUN_VPN_TYPE_DATA #LIBREPORTAL|GLUETUN_VPN_TYPE_TAG|GLUETUN_VPN_TYPE_DATA
+      - SERVER_COUNTRIES=GLUETUN_VPN_COUNTRIES_DATA #LIBREPORTAL|GLUETUN_VPN_COUNTRIES_TAG|GLUETUN_VPN_COUNTRIES_DATA
+      - OPENVPN_USER=GLUETUN_OPENVPN_USER_DATA #LIBREPORTAL|GLUETUN_OPENVPN_USER_TAG|GLUETUN_OPENVPN_USER_DATA
+      - OPENVPN_PASSWORD=GLUETUN_OPENVPN_PASSWORD_DATA #LIBREPORTAL|GLUETUN_OPENVPN_PASSWORD_TAG|GLUETUN_OPENVPN_PASSWORD_DATA
+      - WIREGUARD_PRIVATE_KEY=GLUETUN_WIREGUARD_PRIVATE_KEY_DATA #LIBREPORTAL|GLUETUN_WIREGUARD_PRIVATE_KEY_TAG|GLUETUN_WIREGUARD_PRIVATE_KEY_DATA
+      - WIREGUARD_ADDRESSES=GLUETUN_WIREGUARD_ADDRESSES_DATA #LIBREPORTAL|GLUETUN_WIREGUARD_ADDRESSES_TAG|GLUETUN_WIREGUARD_ADDRESSES_DATA
+      - HTTP_CONTROL_SERVER_AUTH_FILE_PATH=/gluetun/auth/config.toml
+      - HEALTH_TARGET_ADDRESSES=GLUETUN_HEALTH_TARGETS_DATA #LIBREPORTAL|GLUETUN_HEALTH_TARGETS_TAG|GLUETUN_HEALTH_TARGETS_DATA
+      - HEALTH_ICMP_TARGET_IPS=GLUETUN_HEALTH_ICMP_IPS_DATA #LIBREPORTAL|GLUETUN_HEALTH_ICMP_IPS_TAG|GLUETUN_HEALTH_ICMP_IPS_DATA
+    volumes:
+      - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
+      - ./gluetun-data:/gluetun
+    ports:
+      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+      # GLUETUN_FORWARDED_PORTS_BEGIN
+      # GLUETUN_FORWARDED_PORTS_END
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+    healthcheck:
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+
+  # >>> libreportal-monitoring >>>
+  #gluetun-exporter:
+  #  container_name: gluetun-exporter
+  #  image: damianr1/gluetun-exporter:latest
+  #  restart: unless-stopped
+  #  depends_on:
+  #    - gluetun-service
+  #  environment:
+  #    - GLUETUN_API_URL=http://gluetun-service:8000
+  #    - LISTEN_ADDRESS=:PORT_INTERNAL_DATA_2 #LIBREPORTAL|PORT_INTERNAL_TAG_2|PORT_INTERNAL_DATA_2
+  #  networks:
+  #    DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+  # <<< libreportal-monitoring <<<

containers/gluetun/gluetun.config

@@ -0,0 +1,96 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# AUTHELIA = if true, use Authelia authentication, if false turned off.
+# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
+# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
+#
+CFG_GLUETUN_APP_NAME=gluetun
+CFG_GLUETUN_BACKUP=true
+CFG_GLUETUN_COMPOSE_FILE=default
+CFG_GLUETUN_HEALTHCHECK=true
+CFG_GLUETUN_AUTHELIA=false
+CFG_GLUETUN_HEADSCALE=false
+CFG_GLUETUN_MONITORING=false
+#
+# =============================================================================
+# APPLICATION CONFIGURATION
+# =============================================================================
+# VPN_SERVICE_PROVIDER = VPN provider name (mullvad, nordvpn, protonvpn, surfshark, expressvpn, etc.)
+# VPN_TYPE = wireguard or openvpn
+# VPN_COUNTRIES = comma-separated country list (e.g. "Switzerland,Sweden") or empty for any
+# OPENVPN_USER = OpenVPN account username (only when VPN_TYPE=openvpn)
+# OPENVPN_PASSWORD = OpenVPN account password (only when VPN_TYPE=openvpn)
+# WIREGUARD_PRIVATE_KEY = WireGuard private key (only when VPN_TYPE=wireguard)
+# WIREGUARD_ADDRESSES = WireGuard interface address (e.g. "10.64.0.2/32")
+# CONTROL_SERVER_API_KEY = API key for the gluetun HTTP control server, blank to disable auth
+#
+CFG_GLUETUN_VPN_SERVICE_PROVIDER=mullvad
+CFG_GLUETUN_VPN_TYPE=wireguard
+CFG_GLUETUN_VPN_COUNTRIES=
+CFG_GLUETUN_OPENVPN_USER=
+CFG_GLUETUN_OPENVPN_PASSWORD=
+CFG_GLUETUN_WIREGUARD_PRIVATE_KEY=
+CFG_GLUETUN_WIREGUARD_ADDRESSES=
+CFG_GLUETUN_CONTROL_SERVER_API_KEY=RANDOMIZEDPASSWORD1
+# HEALTH_TARGETS = comma-separated host:port list pinged over HTTPS to
+#   confirm the VPN tunnel is healthy. Defaults are privacy-respecting
+#   (Mullvad — your VPN provider; EFF — privacy non-profit). Override
+#   with your own targets if you want to check different sites.
+# HEALTH_ICMP_IPS = comma-separated IPv4 list pinged over ICMP for the
+#   small recurring health check. Default Quad9 (Swiss non-profit DNS,
+#   no logging).
+#
+CFG_GLUETUN_HEALTH_TARGETS="mullvad.net:443,eff.org:443"
+CFG_GLUETUN_HEALTH_ICMP_IPS="9.9.9.9"
+#
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+#
+CFG_GLUETUN_CATEGORY="networking,recommended"
+CFG_GLUETUN_TITLE="Gluetun"
+CFG_GLUETUN_DESCRIPTION="VPN Container Router"
+CFG_GLUETUN_LONG_DESCRIPTION="Run all of your containers through a VPN provider. Supports 30+ providers over WireGuard and OpenVPN with a built-in kill-switch, DNS-over-TLS, port forwarding, and an HTTP control server."
+CFG_GLUETUN_URL="https://github.com/qdm12/gluetun"
+CFG_GLUETUN_ACTIONS="configure|install|restart|shutdown|uninstall"
+#
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# HOST_NAME = subdomain name e.g test is the name for test.website.com
+# WHITELIST = if true only allow whitelisted ips on traefik, if false allow all
+#
+CFG_GLUETUN_DOMAIN=1
+CFG_GLUETUN_WHITELIST=false
+CFG_GLUETUN_HOST_NAME=gluetun
+CFG_GLUETUN_NETWORK=default
+#
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, api, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_GLUETUN_PORT_1="gluetun-service|control|random:8000|private|tcp|false|false|false|HTTP Server|"
+CFG_GLUETUN_PORT_2="gluetun-exporter|metrics|8090:8090|disabled|tcp|false|false|false|Metrics Exporter (sidecar, docker-network only)|"

containers/gluetun/gluetun.sh

@@ -0,0 +1,136 @@
+#!/bin/bash
+
+# Category : Networking
+# Description : Gluetun - VPN client for routing other containers (c/u/s/r/i):
+
+installGluetun()
+{
+    local config_variables="$1"
+
+    if [[ "$gluetun" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent gluetun;
+        local app_name=$CFG_GLUETUN_APP_NAME
+        initializeAppVariables $app_name;
+    fi
+
+    if [[ "$gluetun" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$gluetun" == *[uU]* ]]; then
+        dockerUninstallApp $app_name;
+    fi
+
+    if [[ "$gluetun" == *[sS]* ]]; then
+        dockerComposeDown $app_name;
+    fi
+
+    if [[ "$gluetun" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$gluetun" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+        monitoringToggleAppConfig "$app_name" "docker-compose.yml";
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+        fixPermissionsBeforeStart $app_name;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+        dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+        setupHeadscale $app_name;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+        databaseInstallApp $app_name;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating the WebUI config file."
+        echo ""
+
+        webuiContainerSetup $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Refreshing Gluetun provider snapshot."
+        echo ""
+
+        webuiGenerateGluetunProviders;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Re-attaching gluetun-routed apps (post-recreate)."
+        echo ""
+
+        # Gluetun was just (re)created — every existing routed app holds a
+        # stale container ID in its network_mode. Reattach them now so the
+        # user doesn't have to chase silent netns drift later.
+        appGluetunRoutedRecreate
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Routing existing apps through Gluetun (optional)."
+        echo ""
+
+        gluetunRouteExistingAppsPrompt;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Refreshing monitoring integration."
+		echo ""
+
+		monitoringRefreshAll;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+
+        menuShowFinalMessages "$app_name";
+
+        menu_number=0
+        cd
+    fi
+    gluetun=n
+}

containers/gluetun/gluetun.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" fill="none">
+  <defs>
+    <linearGradient id="g" x1="0" y1="0" x2="64" y2="64" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#22d3ee"/>
+      <stop offset="1" stop-color="#6366f1"/>
+    </linearGradient>
+  </defs>
+  <path d="M32 4 L56 13 V32 C56 46 45 56 32 60 C19 56 8 46 8 32 V13 Z"
+        fill="url(#g)" stroke="#0ea5e9" stroke-width="2" stroke-linejoin="round"/>
+  <path d="M22 30 C26 24 38 24 42 30 M25 35 C28 31 36 31 39 35 M29 40 C30 38 34 38 35 40"
+        stroke="#ffffff" stroke-width="2.5" stroke-linecap="round" fill="none"/>
+  <circle cx="32" cy="44" r="2.2" fill="#ffffff"/>
+</svg>

containers/gluetun/resources/monitoring/grafana-dashboards/gluetun.json

@@ -0,0 +1,67 @@
+{
+  "annotations": { "list": [{ "builtIn": 1, "datasource": { "type": "grafana", "uid": "-- Grafana --" }, "enable": true, "hide": true, "iconColor": "rgba(0, 211, 255, 1)", "name": "Annotations & Alerts", "type": "dashboard" }] },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": null,
+  "links": [],
+  "panels": [
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "thresholds" },
+          "mappings": [{ "options": { "0": { "text": "DOWN" }, "1": { "text": "UP" } }, "type": "value" }],
+          "thresholds": { "mode": "absolute", "steps": [{ "color": "red", "value": null }, { "color": "green", "value": 1 }] }
+        }
+      },
+      "gridPos": { "h": 4, "w": 8, "x": 0, "y": 0 },
+      "id": 1,
+      "options": { "colorMode": "background", "graphMode": "none", "reduceOptions": { "calcs": ["lastNotNull"] }, "textMode": "value" },
+      "targets": [{ "datasource": { "type": "prometheus", "uid": "Prometheus" }, "expr": "gluetun_up", "refId": "A" }],
+      "title": "VPN Tunnel",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] } } },
+      "gridPos": { "h": 4, "w": 8, "x": 8, "y": 0 },
+      "id": 2,
+      "options": { "colorMode": "value", "graphMode": "area", "reduceOptions": { "calcs": ["lastNotNull"] }, "textMode": "auto" },
+      "targets": [{ "datasource": { "type": "prometheus", "uid": "Prometheus" }, "expr": "gluetun_public_ip_info", "legendFormat": "{{country}} / {{public_ip}}", "refId": "A" }],
+      "title": "Public IP / Country",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }, "unit": "s" } },
+      "gridPos": { "h": 4, "w": 8, "x": 16, "y": 0 },
+      "id": 3,
+      "options": { "colorMode": "value", "graphMode": "area", "reduceOptions": { "calcs": ["lastNotNull"] }, "textMode": "auto" },
+      "targets": [{ "datasource": { "type": "prometheus", "uid": "Prometheus" }, "expr": "time() - gluetun_start_timestamp_seconds", "refId": "A" }],
+      "title": "Uptime",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "fillOpacity": 10, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "showPoints": "never", "spanNulls": false } } },
+      "gridPos": { "h": 9, "w": 24, "x": 0, "y": 4 },
+      "id": 4,
+      "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "single", "sort": "none" } },
+      "targets": [{ "datasource": { "type": "prometheus", "uid": "Prometheus" }, "expr": "gluetun_up", "legendFormat": "up", "refId": "A" }],
+      "title": "Tunnel Health Over Time",
+      "type": "timeseries"
+    }
+  ],
+  "refresh": "30s",
+  "schemaVersion": 38,
+  "tags": ["libreportal", "gluetun"],
+  "templating": { "list": [] },
+  "time": { "from": "now-6h", "to": "now" },
+  "timepicker": {},
+  "timezone": "",
+  "title": "Gluetun",
+  "uid": "libreportal-gluetun",
+  "version": 1,
+  "weekStart": ""
+}

containers/gluetun/resources/monitoring/prometheus-scrape.yml

@@ -0,0 +1,4 @@
+- job_name: gluetun
+  metrics_path: /metrics
+  static_configs:
+    - targets: ['gluetun-exporter:PORT_INTERNAL_DATA_2'] #LIBREPORTAL|PORT_INTERNAL_TAG_2|PORT_INTERNAL_DATA_2

containers/grafana/docker-compose.yml

@@ -0,0 +1,43 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+  grafana-service: #LIBREPORTAL|SERVICE_TAG_1|grafana-service
+    image: grafana/grafana-enterprise
+    container_name: grafana-service
+    restart: unless-stopped
+    environment:
+      - GF_SERVER_ROOT_URL:https://DOMAINSUBNAME_DATA/ #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      - GF_INSTALL_PLUGINS=grafana-clock-panel
+      - GF_SERVER_HTTP_PORT:PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+      - TZ:TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+    # GLUETUN_OFF_BEGIN
+    ports:
+      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+    # GLUETUN_OFF_END
+    volumes:
+      - ./grafana_storage:/var/lib/grafana
+      - ./provisioning:/etc/grafana/provisioning
+      - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
+      traefik.http.routers.grafana-service.entrypoints: web,websecure
+      traefik.http.routers.grafana-service.rule: Host(`DOMAINSUBNAME_DATA`) #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      traefik.http.routers.grafana-service.tls: true
+      traefik.http.routers.grafana-service.tls.certresolver: production
+      traefik.http.services.grafana-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+      traefik.http.routers.grafana-service.middlewares: MIDDLEWARE_DATA #LIBREPORTAL|MIDDLEWARE_TAG|MIDDLEWARE_DATA
+      traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    healthcheck:
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+    # GLUETUN_OFF_BEGIN
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+    # GLUETUN_OFF_END
+    # GLUETUN_ON_BEGIN
+    # network_mode: "container:gluetun-service"
+    # GLUETUN_ON_END

containers/grafana/grafana.config

@@ -0,0 +1,67 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# REQUIRES = comma-separated install prerequisites (see scripts/checks/requirements/check_app_install.sh)
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# AUTHELIA = if true, use Authelia authentication, if false turned off.
+# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
+# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
+#
+CFG_GRAFANA_APP_NAME=grafana
+CFG_GRAFANA_REQUIRES="prometheus"
+CFG_GRAFANA_BACKUP=true
+CFG_GRAFANA_COMPOSE_FILE=default
+CFG_GRAFANA_HEALTHCHECK=true
+CFG_GRAFANA_AUTHELIA=false
+CFG_GRAFANA_HEADSCALE=false
+CFG_GRAFANA_MONITORING=false
+#
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+#
+CFG_GRAFANA_CATEGORY="monitoring"
+CFG_GRAFANA_TITLE="Grafana"
+CFG_GRAFANA_DESCRIPTION="Metrics Visualizer"
+CFG_GRAFANA_LONG_DESCRIPTION="The open source analytics and monitoring solution for every database with beautiful dashboards and alerting capabilities"
+CFG_GRAFANA_URL="https://github.com/grafana/grafana"
+CFG_GRAFANA_ACTIONS="configure|install|restart|shutdown|uninstall"
+CFG_GRAFANA_REQUIRES_SERVICE=prometheus
+#
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# HOST_NAME = subdomain name e.g test is the name for test.website.com
+# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
+#
+CFG_GRAFANA_DOMAIN=1
+CFG_GRAFANA_WHITELIST=false
+CFG_GRAFANA_HOST_NAME=grafana
+CFG_GRAFANA_NETWORK=default
+#
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, dns, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_GRAFANA_PORT_1="grafana-service|webui|random:3000|public|tcp|false|true|true|Web Interface|"

containers/grafana/grafana.sh

@@ -0,0 +1,133 @@
+#!/bin/bash
+
+# Category : Development & Version Control
+# Description : Grafana - Metrics Visualizer (c/u/s/r/i):
+
+installGrafana()
+{
+    local config_variables="$1"
+
+    if [[ "$grafana" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent grafana;
+        local app_name=$CFG_GRAFANA_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$grafana" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+	if [[ "$grafana" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$grafana" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+	if [[ "$grafana" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+	fi
+
+    if [[ "$grafana" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+        if ! appInstallCheckRequirements "$app_name" "$CFG_GRAFANA_REQUIRES"; then
+            grafana=n
+            return 1
+        fi
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        # Grafana
+        if [ -d "${containers_dir}grafana/grafana_storage" ]; then
+            local result=$(sudo chmod -R 777 "${containers_dir}grafana/grafana_storage")
+            checkSuccess "Set permissions to grafana_storage folder."
+        fi
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Updating WebUI config file."
+        echo ""
+
+        webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Provisioning monitoring dashboards from installed apps."
+		echo ""
+
+		# Re-gather the Prometheus datasource + every monitoring-enabled app's
+		# dashboards into provisioning/ — so a fresh (or re-)install of Grafana
+		# picks up the apps that already had CFG_<APP>_MONITORING=true.
+		# monitoringRefreshAll also covers Grafana's own scrape target when
+		# CFG_GRAFANA_MONITORING=true.
+		monitoringRefreshAll;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using any of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    grafana=n
+}

containers/grafana/grafana.svg

@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 21.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 viewBox="0 0 142.5 145.6" style="enable-background:new 0 0 142.5 145.6;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:#565656;}
+	.st1{fill:url(#SVGID_1_);}
+</style>
+<g>
+	<path class="st0" d="M28.7,131.5c-0.3,7.9-6.6,14.1-14.4,14.1C6.1,145.6,0,139,0,130.9s6.6-14.7,14.7-14.7c3.6,0,7.2,1.6,10.2,4.4
+		l-2.3,2.9c-2.3-2-5.1-3.4-7.9-3.4c-5.9,0-10.8,4.8-10.8,10.8c0,6.1,4.6,10.8,10.4,10.8c5.2,0,9.3-3.8,10.2-8.8H12.6v-3.5h16.1
+		V131.5z"/>
+	<path class="st0" d="M42.3,129.5h-2.2c-2.4,0-4.4,2-4.4,4.4v11.4h-3.9v-19.6H35v1.6c1.1-1.1,2.7-1.6,4.6-1.6h4.2L42.3,129.5z"/>
+	<path class="st0" d="M63.7,145.3h-3.4v-2.5c-2.6,2.5-6.6,3.7-10.7,1.9c-3-1.3-5.3-4.1-5.9-7.4c-1.2-6.3,3.7-11.9,9.9-11.9
+		c2.6,0,5,1.1,6.7,2.8v-2.5h3.4V145.3z M59.7,137c0.9-4-2.1-7.6-6-7.6c-3.4,0-6.1,2.8-6.1,6.1c0,3.8,3.3,6.7,7.2,6.1
+		C57.1,141.2,59.1,139.3,59.7,137z"/>
+	<path class="st0" d="M71.5,124.7v1.1h6.2v3.4h-6.2v16.1h-3.8v-20.5c0-4.3,3.1-6.8,7-6.8h4.7l-1.6,3.7h-3.1
+		C72.9,121.6,71.5,123,71.5,124.7z"/>
+	<path class="st0" d="M98.5,145.3h-3.3v-2.5c-2.6,2.5-6.6,3.7-10.7,1.9c-3-1.3-5.3-4.1-5.9-7.4c-1.2-6.3,3.7-11.9,9.9-11.9
+		c2.6,0,5,1.1,6.7,2.8v-2.5h3.4v19.6H98.5z M94.5,137c0.9-4-2.1-7.6-6-7.6c-3.4,0-6.1,2.8-6.1,6.1c0,3.8,3.3,6.7,7.2,6.1
+		C92,141.2,93.9,139.3,94.5,137z"/>
+	<path class="st0" d="M119.4,133.8v11.5h-3.9v-11.6c0-2.4-2-4.4-4.4-4.4c-2.5,0-4.4,2-4.4,4.4v11.6h-3.9v-19.6h3.2v1.7
+		c1.4-1.3,3.3-2,5.2-2C115.8,125.5,119.4,129.2,119.4,133.8z"/>
+	<path class="st0" d="M142.4,145.3h-3.3v-2.5c-2.6,2.5-6.6,3.7-10.7,1.9c-3-1.3-5.3-4.1-5.9-7.4c-1.2-6.3,3.7-11.9,9.9-11.9
+		c2.6,0,5,1.1,6.7,2.8v-2.5h3.4v19.6H142.4z M138.4,137c0.9-4-2.1-7.6-6-7.6c-3.4,0-6.1,2.8-6.1,6.1c0,3.8,3.3,6.7,7.2,6.1
+		C135.9,141.2,137.8,139.3,138.4,137z"/>
+</g>
+<linearGradient id="SVGID_1_" gradientUnits="userSpaceOnUse" x1="71.25" y1="10.4893" x2="71.25" y2="113.3415" gradientTransform="matrix(1 0 0 -1 0 148.6)">
+	<stop  offset="0" style="stop-color:#FCEE1F"/>
+	<stop  offset="1" style="stop-color:#F15B2A"/>
+</linearGradient>
+<path class="st1" d="M122.9,49.9c-0.2-1.9-0.5-4.1-1.1-6.5c-0.6-2.4-1.6-5-2.9-7.8c-1.4-2.7-3.1-5.6-5.4-8.3
+	c-0.9-1.1-1.9-2.1-2.9-3.2c1.6-6.3-1.9-11.8-1.9-11.8c-6.1-0.4-9.9,1.9-11.3,2.9c-0.2-0.1-0.5-0.2-0.7-0.3c-1-0.4-2.1-0.8-3.2-1.2
+	c-1.1-0.3-2.2-0.7-3.3-0.9c-1.1-0.3-2.3-0.5-3.5-0.7c-0.2,0-0.4-0.1-0.6-0.1C83.5,3.6,75.9,0,75.9,0c-8.7,5.6-10.4,13.1-10.4,13.1
+	s0,0.2-0.1,0.4c-0.5,0.1-0.9,0.3-1.4,0.4c-0.6,0.2-1.3,0.4-1.9,0.7c-0.6,0.3-1.3,0.5-1.9,0.8c-1.3,0.6-2.5,1.2-3.8,1.9
+	c-1.2,0.7-2.4,1.4-3.5,2.2c-0.2-0.1-0.3-0.2-0.3-0.2c-11.7-4.5-22.1,0.9-22.1,0.9c-0.9,12.5,4.7,20.3,5.8,21.7
+	c-0.3,0.8-0.5,1.5-0.8,2.3c-0.9,2.8-1.5,5.7-1.9,8.7c-0.1,0.4-0.1,0.9-0.2,1.3c-10.8,5.3-14,16.3-14,16.3c9,10.4,19.6,11,19.6,11
+	l0,0c1.3,2.4,2.9,4.7,4.6,6.8c0.7,0.9,1.5,1.7,2.3,2.6c-3.3,9.4,0.5,17.3,0.5,17.3c10.1,0.4,16.7-4.4,18.1-5.5c1,0.3,2,0.6,3,0.9
+	c3.1,0.8,6.3,1.3,9.4,1.4c0.8,0,1.6,0,2.4,0h0.4H80h0.5H81l0,0c4.7,6.8,13.1,7.7,13.1,7.7c5.9-6.3,6.3-12.4,6.3-13.8l0,0
+	c0,0,0,0,0-0.1s0-0.2,0-0.2l0,0c0-0.1,0-0.2,0-0.3c1.2-0.9,2.4-1.8,3.6-2.8c2.4-2.1,4.4-4.6,6.2-7.2c0.2-0.2,0.3-0.5,0.5-0.7
+	c6.7,0.4,11.4-4.2,11.4-4.2c-1.1-7-5.1-10.4-5.9-11l0,0c0,0,0,0-0.1-0.1l-0.1-0.1l0,0l-0.1-0.1c0-0.4,0.1-0.8,0.1-1.3
+	c0.1-0.8,0.1-1.5,0.1-2.3v-0.6v-0.3v-0.1c0-0.2,0-0.1,0-0.2v-0.5v-0.6c0-0.2,0-0.4,0-0.6s0-0.4-0.1-0.6l-0.1-0.6l-0.1-0.6
+	c-0.1-0.8-0.3-1.5-0.4-2.3c-0.7-3-1.9-5.9-3.4-8.4c-1.6-2.6-3.5-4.8-5.7-6.8c-2.2-1.9-4.6-3.5-7.2-4.6c-2.6-1.2-5.2-1.9-7.9-2.2
+	c-1.3-0.2-2.7-0.2-4-0.2h-0.5h-0.1h-0.2h-0.2h-0.5c-0.2,0-0.4,0-0.5,0c-0.7,0.1-1.4,0.2-2,0.3c-2.7,0.5-5.2,1.5-7.4,2.8
+	c-2.2,1.3-4.1,3-5.7,4.9s-2.8,3.9-3.6,6.1c-0.8,2.1-1.3,4.4-1.4,6.5c0,0.5,0,1.1,0,1.6c0,0.1,0,0.3,0,0.4v0.4c0,0.3,0,0.5,0.1,0.8
+	c0.1,1.1,0.3,2.1,0.6,3.1c0.6,2,1.5,3.8,2.7,5.4s2.5,2.8,4,3.8s3,1.7,4.6,2.2c1.6,0.5,3.1,0.7,4.5,0.6c0.2,0,0.4,0,0.5,0
+	c0.1,0,0.2,0,0.3,0s0.2,0,0.3,0c0.2,0,0.3,0,0.5,0h0.1h0.1c0.1,0,0.2,0,0.3,0c0.2,0,0.4-0.1,0.5-0.1c0.2,0,0.3-0.1,0.5-0.1
+	c0.3-0.1,0.7-0.2,1-0.3c0.6-0.2,1.2-0.5,1.8-0.7c0.6-0.3,1.1-0.6,1.5-0.9c0.1-0.1,0.3-0.2,0.4-0.3c0.5-0.4,0.6-1.1,0.2-1.6
+	c-0.4-0.4-1-0.5-1.5-0.3C88,74,87.9,74,87.7,74.1c-0.4,0.2-0.9,0.4-1.3,0.5c-0.5,0.1-1,0.3-1.5,0.4c-0.3,0-0.5,0.1-0.8,0.1
+	c-0.1,0-0.3,0-0.4,0c-0.1,0-0.3,0-0.4,0s-0.3,0-0.4,0c-0.2,0-0.3,0-0.5,0c0,0-0.1,0,0,0h-0.1h-0.1c-0.1,0-0.1,0-0.2,0
+	s-0.3,0-0.4-0.1c-1.1-0.2-2.3-0.5-3.4-1c-1.1-0.5-2.2-1.2-3.1-2.1c-1-0.9-1.8-1.9-2.5-3.1c-0.7-1.2-1.1-2.5-1.3-3.8
+	c-0.1-0.7-0.2-1.4-0.1-2.1c0-0.2,0-0.4,0-0.6c0,0.1,0,0,0,0v-0.1v-0.1c0-0.1,0-0.2,0-0.3c0-0.4,0.1-0.7,0.2-1.1c0.5-3,2-5.9,4.3-8.1
+	c0.6-0.6,1.2-1.1,1.9-1.5c0.7-0.5,1.4-0.9,2.1-1.2c0.7-0.3,1.5-0.6,2.3-0.8s1.6-0.4,2.4-0.4c0.4,0,0.8-0.1,1.2-0.1
+	c0.1,0,0.2,0,0.3,0h0.3h0.2c0.1,0,0,0,0,0h0.1h0.3c0.9,0.1,1.8,0.2,2.6,0.4c1.7,0.4,3.4,1,5,1.9c3.2,1.8,5.9,4.5,7.5,7.8
+	c0.8,1.6,1.4,3.4,1.7,5.3c0.1,0.5,0.1,0.9,0.2,1.4v0.3V66c0,0.1,0,0.2,0,0.3c0,0.1,0,0.2,0,0.3v0.3v0.3c0,0.2,0,0.6,0,0.8
+	c0,0.5-0.1,1-0.1,1.5c-0.1,0.5-0.1,1-0.2,1.5s-0.2,1-0.3,1.5c-0.2,1-0.6,1.9-0.9,2.9c-0.7,1.9-1.7,3.7-2.9,5.3
+	c-2.4,3.3-5.7,6-9.4,7.7c-1.9,0.8-3.8,1.5-5.8,1.8c-1,0.2-2,0.3-3,0.3H81h-0.2h-0.3H80h-0.3c0.1,0,0,0,0,0h-0.1
+	c-0.5,0-1.1,0-1.6-0.1c-2.2-0.2-4.3-0.6-6.4-1.2c-2.1-0.6-4.1-1.4-6-2.4c-3.8-2-7.2-4.9-9.9-8.2c-1.3-1.7-2.5-3.5-3.5-5.4
+	s-1.7-3.9-2.3-5.9c-0.6-2-0.9-4.1-1-6.2v-0.4v-0.1v-0.1v-0.2V60v-0.1v-0.1v-0.2v-0.5V59l0,0v-0.2c0-0.3,0-0.5,0-0.8
+	c0-1,0.1-2.1,0.3-3.2c0.1-1.1,0.3-2.1,0.5-3.2c0.2-1.1,0.5-2.1,0.8-3.2c0.6-2.1,1.3-4.1,2.2-6c1.8-3.8,4.1-7.2,6.8-9.9
+	c0.7-0.7,1.4-1.3,2.2-1.9c0.3-0.3,1-0.9,1.8-1.4c0.8-0.5,1.6-1,2.5-1.4c0.4-0.2,0.8-0.4,1.3-0.6c0.2-0.1,0.4-0.2,0.7-0.3
+	c0.2-0.1,0.4-0.2,0.7-0.3c0.9-0.4,1.8-0.7,2.7-1c0.2-0.1,0.5-0.1,0.7-0.2c0.2-0.1,0.5-0.1,0.7-0.2c0.5-0.1,0.9-0.2,1.4-0.4
+	c0.2-0.1,0.5-0.1,0.7-0.2c0.2,0,0.5-0.1,0.7-0.1c0.2,0,0.5-0.1,0.7-0.1l0.4-0.1l0.4-0.1c0.2,0,0.5-0.1,0.7-0.1
+	c0.3,0,0.5-0.1,0.8-0.1c0.2,0,0.6-0.1,0.8-0.1c0.2,0,0.3,0,0.5-0.1h0.3h0.2h0.2c0.3,0,0.5,0,0.8-0.1h0.4c0,0,0.1,0,0,0h0.1h0.2
+	c0.2,0,0.5,0,0.7,0c0.9,0,1.8,0,2.7,0c1.8,0.1,3.6,0.3,5.3,0.6c3.4,0.6,6.7,1.7,9.6,3.2c2.9,1.4,5.6,3.2,7.8,5.1
+	c0.1,0.1,0.3,0.2,0.4,0.4c0.1,0.1,0.3,0.2,0.4,0.4c0.3,0.2,0.5,0.5,0.8,0.7c0.3,0.2,0.5,0.5,0.8,0.7c0.2,0.3,0.5,0.5,0.7,0.8
+	c1,1,1.9,2.1,2.7,3.1c1.6,2.1,2.9,4.2,3.9,6.2c0.1,0.1,0.1,0.2,0.2,0.4c0.1,0.1,0.1,0.2,0.2,0.4s0.2,0.5,0.4,0.7
+	c0.1,0.2,0.2,0.5,0.3,0.7c0.1,0.2,0.2,0.5,0.3,0.7c0.4,0.9,0.7,1.8,1,2.7c0.5,1.4,0.8,2.6,1.1,3.6c0.1,0.4,0.5,0.7,0.9,0.7
+	c0.5,0,0.8-0.4,0.8-0.9C123,52.7,123,51.4,122.9,49.9z"/>
+</svg>

containers/grafana/resources/monitoring/grafana-dashboards/grafana.json

@@ -0,0 +1,233 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": { "type": "grafana", "uid": "-- Grafana --" },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": null,
+  "links": [],
+  "panels": [
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "thresholds" },
+          "mappings": [],
+          "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 4, "w": 6, "x": 0, "y": 0 },
+      "id": 1,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
+        "textMode": "auto"
+      },
+      "pluginVersion": "10.0.0",
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "grafana_stat_totals_dashboard",
+          "refId": "A"
+        }
+      ],
+      "title": "Total Dashboards",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "thresholds" },
+          "mappings": [],
+          "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 4, "w": 6, "x": 6, "y": 0 },
+      "id": 2,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
+        "textMode": "auto"
+      },
+      "pluginVersion": "10.0.0",
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "grafana_stat_totals_orgs",
+          "refId": "A"
+        }
+      ],
+      "title": "Total Orgs",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "thresholds" },
+          "mappings": [],
+          "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 4, "w": 6, "x": 12, "y": 0 },
+      "id": 3,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
+        "textMode": "auto"
+      },
+      "pluginVersion": "10.0.0",
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "grafana_stat_totals_users",
+          "refId": "A"
+        }
+      ],
+      "title": "Total Users",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "thresholds" },
+          "mappings": [],
+          "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] },
+          "unit": "decbytes"
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 4, "w": 6, "x": 18, "y": 0 },
+      "id": 4,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
+        "textMode": "auto"
+      },
+      "pluginVersion": "10.0.0",
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "process_resident_memory_bytes{job=\"grafana\"}",
+          "refId": "A"
+        }
+      ],
+      "title": "Memory (RSS)",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "palette-classic" },
+          "custom": {
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "showPoints": "never",
+            "spanNulls": false
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 9, "w": 12, "x": 0, "y": 4 },
+      "id": 5,
+      "options": {
+        "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
+        "tooltip": { "mode": "single", "sort": "none" }
+      },
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "rate(grafana_http_request_duration_seconds_count[5m])",
+          "legendFormat": "{{method}} {{status_code}}",
+          "refId": "A"
+        }
+      ],
+      "title": "HTTP Request Rate",
+      "type": "timeseries"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "palette-classic" },
+          "custom": {
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "showPoints": "never",
+            "spanNulls": false
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 9, "w": 12, "x": 12, "y": 4 },
+      "id": 6,
+      "options": {
+        "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
+        "tooltip": { "mode": "single", "sort": "none" }
+      },
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "histogram_quantile(0.95, sum by (le) (rate(grafana_http_request_duration_seconds_bucket[5m])))",
+          "legendFormat": "p95",
+          "refId": "A"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "histogram_quantile(0.50, sum by (le) (rate(grafana_http_request_duration_seconds_bucket[5m])))",
+          "legendFormat": "p50",
+          "refId": "B"
+        }
+      ],
+      "title": "HTTP Request Latency",
+      "type": "timeseries"
+    }
+  ],
+  "refresh": "30s",
+  "schemaVersion": 38,
+  "tags": ["libreportal", "grafana"],
+  "templating": { "list": [] },
+  "time": { "from": "now-6h", "to": "now" },
+  "timepicker": {},
+  "timezone": "",
+  "title": "Grafana",
+  "uid": "libreportal-grafana",
+  "version": 1,
+  "weekStart": ""
+}

containers/grafana/resources/monitoring/prometheus-scrape.yml

@@ -0,0 +1,4 @@
+- job_name: grafana
+  metrics_path: /metrics
+  static_configs:
+    - targets: ['grafana-service:3000']

containers/headscale/docker-compose.yml

@@ -0,0 +1,70 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+  headscale-service: #LIBREPORTAL|SERVICE_TAG_1|headscale-service
+    container_name: headscale-service
+    image: headscale/headscale:latest
+    volumes:
+      - ./config:/etc/headscale/
+      - ./data:/var/lib/headscale
+    # GLUETUN_OFF_BEGIN
+    ports:
+      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+    # GLUETUN_OFF_END
+    command: headscale serve
+    restart: unless-stopped
+    environment:
+      - TZ:TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+    healthcheck:
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+    # GLUETUN_OFF_BEGIN
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+    # GLUETUN_OFF_END
+    # GLUETUN_ON_BEGIN
+    # network_mode: "container:gluetun-service"
+    # GLUETUN_ON_END
+    
+  headscale-webui-service: #LIBREPORTAL|SERVICE_TAG_2|headscale-webui-service
+    image: ghcr.io/ifargle/headscale-webui:latest
+    container_name: headscale-webui
+    environment:
+      - TZ:TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+      - PGID=1000
+      - PUID=1000
+      - COLOR=blue                              # Use the base colors (ie, no darken-3, etc) - 
+      - HS_SERVER:https://DOMAINSUBNAME_DATA    #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      - DOMAIN_NAME:https://DOMAINSUBNAME_DATA  #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      - SCRIPT_NAME=/admin                     # This is your applications base path (wsgi requires the name "SCRIPT_NAME").  Remove if you are hosing at the root /
+      - KEY="a-really-long-key-you-create-with-the-command-in-the-comment"             # Generate with "openssl rand -base64 32" - used to encrypt your key on disk.
+      - AUTH_TYPE=Basic                        # AUTH_TYPE is either Basic or OIDC.  Empty for no authentication
+      - LOG_LEVEL=info                         # Log level.  "DEBUG", "ERROR", "WARNING", or "INFO".  Default "INFO"
+      # ENV for Basic Auth (Used only if AUTH_TYPE is "Basic").  Can be omitted if you aren't using Basic Auth
+      - BASIC_AUTH_USER=libreportal                   # Used for basic auth
+      - BASIC_AUTH_PASS=HEADSCALE_BASIC_AUTH_PASS_DATA #LIBREPORTAL|HEADSCALE_BASIC_AUTH_PASS_TAG|HEADSCALE_BASIC_AUTH_PASS_DATA
+      # ENV for OIDC (Used only if AUTH_TYPE is "OIDC").  Can be omitted if you aren't using OIDC
+      #- OIDC_AUTH_URL=https://yourauthserver.com/application/o/headscale/.well-known/openid-configuration # URL for your OIDC issuer's well-known endpoint
+      #- OIDC_CLIENT_ID=your-auth-server-client-id-info-here         # Your OIDC Issuer's Client ID for Headscale-WebUI
+      #- OIDC_CLIENT_SECRET=your-oidc-auth-server-client-secret-key-will-go-here-and-be-very-long-indeed      # Your OIDC Issuer's Secret Key for Headscale-WebUI
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
+      traefik.http.routers.headscale-webui-service.rule: Host(`admin.DOMAINSUBNAME_DATA`) #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      traefik.http.services.headscale-webui-service.loadbalancer.server.port: PORT_INTERNAL_DATA_2 #LIBREPORTAL|PORT_INTERNAL_TAG_2|PORT_INTERNAL_DATA_2
+      traefik.http.routers.headscale-webui-service.middlewares: MIDDLEWARE_DATA #LIBREPORTAL|MIDDLEWARE_TAG|MIDDLEWARE_DATA
+      traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    ports:
+      - "PORTS_DATA_2" #LIBREPORTAL|PORTS_TAG_2|PORTS_DATA_2
+    volumes:
+      - ./volume:/data                         # Headscale-WebUI's storage.  Make sure ./volume is readable by UID 1000 (chown 1000:1000 ./volume)
+      - ./config/:/etc/headscale/:ro           # Headscale's config storage location.  Used to read your Headscale config.
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_2 #LIBREPORTAL|IP_TAG_2|IP_DATA_2

containers/headscale/headscale.config

@@ -0,0 +1,63 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# BASIC_AUTH_PASS = password for the headscale-ui basic auth; auto-generated, fed to the compose via HEADSCALE_BASIC_AUTH_PASS_TAG
+# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
+#
+CFG_HEADSCALE_APP_NAME=headscale
+CFG_HEADSCALE_BACKUP=true
+CFG_HEADSCALE_COMPOSE_FILE=default
+CFG_HEADSCALE_HEALTHCHECK=true
+CFG_HEADSCALE_BASIC_AUTH_PASS=RANDOMIZEDPASSWORD1
+CFG_HEADSCALE_MONITORING=false
+#
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+#
+CFG_HEADSCALE_CATEGORY="networking"
+CFG_HEADSCALE_TITLE="Headscale"
+CFG_HEADSCALE_DESCRIPTION="WireGuard VPN Controller"
+CFG_HEADSCALE_LONG_DESCRIPTION="Headscale is an open source, self-hosted implementation of the Tailscale control server that works with the Tailscale client"
+CFG_HEADSCALE_URL="https://github.com/juanfont/headscale"
+CFG_HEADSCALE_ACTIONS="configure|install|restart|shutdown|uninstall"
+#
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# HOST_NAME = subdomain name e.g test is the name for test.website.com
+# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
+#
+CFG_HEADSCALE_DOMAIN=1
+CFG_HEADSCALE_WHITELIST=false
+CFG_HEADSCALE_HOST_NAME=headscale
+CFG_HEADSCALE_NETWORK=default
+#
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, dns, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_HEADSCALE_PORT_1="headscale-service|api|random:8080|private|tcp|false|false|false|Headscale API Server|"
+CFG_HEADSCALE_PORT_2="headscale-webui-service|webui|random:5000|private|tcp|false|true|true|Web UI|"

containers/headscale/headscale.sh

@@ -0,0 +1,127 @@
+#!/bin/bash
+
+# Category : Networking
+# Description : Self-hosted WireGuard orchestrator (c/u/s/r/i):
+
+installHeadscale()
+{
+    local config_variables="$1"
+
+    if [[ "$headscale" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent headscale;
+        local app_name=$CFG_HEADSCALE_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$headscale" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$headscale" == *[uU]* ]]; then
+        dockerUninstallApp $app_name;
+    fi
+
+    if [[ "$headscale" == *[sS]* ]]; then
+        dockerComposeDown $app_name;
+    fi
+
+    if [[ "$headscale" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$headscale" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+        local result=$(createFolders "loud" $docker_install_user $containers_dir$app_name/config)
+        checkSuccess "Create config folder"
+
+		local result=$(copyResource "$app_name" "config.yaml" "config" | sudo tee -a "$logs_dir/$docker_log_file" 2>&1)
+		checkSuccess "Copying config.yaml to config folder."
+
+        configSetupFileWithData $app_name "config.yaml" "config";
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up database records"
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating WebUI config file."
+        echo ""
+
+        webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Refreshing monitoring integration."
+		echo ""
+
+		monitoringRefreshAll;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using any of the options below : "
+        echo ""
+        echo "    NOTE - The password to login in defined in the yml install file that was installed"
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    headscale=n
+}

containers/headscale/headscale.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 512 512"><ellipse cx="49.5" cy="258.3" rx="49.5" ry="49.9" style="fill-rule:evenodd;clip-rule:evenodd;fill:#f8b5cb"/><path d="M135.9 220.2c7.8 0 14.2 6.3 14.2 14s-6.4 14-14.2 14-14.2-6.3-14.2-14 6.4-14 14.2-14m0 49c7.8 0 14.2 6.3 14.2 14s-6.4 14-14.2 14-14.2-6.3-14.2-14 6.4-14 14.2-14m64 0c7.8 0 14.2 6.3 14.2 14s-6.4 14-14.2 14-14.2-6.3-14.2-14 6.4-14 14.2-14m.2-49c7.8 0 14.2 6.3 14.2 14s-6.4 14-14.2 14-14.2-6.3-14.2-14 6.4-14 14.2-14" style="fill-rule:evenodd;clip-rule:evenodd;fill:#a2a2a2"/><path d="M325 208.8c27.4 0 49.6 22.4 49.6 50s-22.2 50-49.6 50-49.6-22.4-49.6-50 22.2-50 49.6-50m106.6 0c27.4 0 49.6 22.4 49.6 50s-22.2 50-49.6 50-49.6-22.4-49.6-50 22.2-50 49.6-50" style="fill-rule:evenodd;clip-rule:evenodd;fill:#8d8d8d"/><path d="M273.3 173.5h-28.8v165h28.8v-11.9h-17v-141h17zm209.9 0H512v165h-28.8v-11.9h17v-141h-17z" style="fill-rule:evenodd;clip-rule:evenodd;fill:#303030"/></svg>

containers/headscale/resources/config.yaml

@@ -0,0 +1,327 @@
+---
+# headscale will look for a configuration file named `config.yaml` (or `config.json`) in the following order:
+#
+# - `/etc/headscale`
+# - `~/.headscale`
+# - current working directory
+
+# The url clients will connect to.
+# Typically this will be a domain like:
+#
+# https://myheadscale.example.com:443
+#
+server_url: https://DOMAINSUBNAMEHERE
+
+# Address to listen to / bind to on the server
+#
+# For production:
+# listen_addr: 0.0.0.0:8080
+listen_addr: 0.0.0.0:PORT1
+
+# Address to listen to /metrics, you may want
+# to keep this endpoint private to your internal
+# network. Bound to the docker network only (no compose port mapping), so
+# only sibling containers like Prometheus can reach it.
+#
+metrics_listen_addr: 0.0.0.0:9090
+
+# Address to listen for gRPC.
+# gRPC is used for controlling a headscale server
+# remotely with the CLI
+# Note: Remote access _only_ works if you have
+# valid certificates.
+#
+# For production:
+# grpc_listen_addr: 0.0.0.0:50443
+grpc_listen_addr: 127.0.0.1:50443
+
+# Allow the gRPC admin interface to run in INSECURE
+# mode. This is not recommended as the traffic will
+# be unencrypted. Only enable if you know what you
+# are doing.
+grpc_allow_insecure: false
+
+# Private key used to encrypt the traffic between headscale
+# and Tailscale clients.
+# The private key file will be autogenerated if it's missing.
+#
+private_key_path: /var/lib/headscale/private.key
+
+# The Noise section includes specific configuration for the
+# TS2021 Noise protocol
+noise:
+  # The Noise private key is used to encrypt the
+  # traffic between headscale and Tailscale clients when
+  # using the new Noise-based protocol. It must be different
+  # from the legacy private key.
+  private_key_path: /var/lib/headscale/noise_private.key
+
+# List of IP prefixes to allocate tailaddresses from.
+# Each prefix consists of either an IPv4 or IPv6 address,
+# and the associated prefix length, delimited by a slash.
+# It must be within IP ranges supported by the Tailscale
+# client - i.e., subnets of 100.64.0.0/10 and fd7a:115c:a1e0::/48.
+# See below:
+# IPv6: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#LL81C52-L81C71
+# IPv4: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#L33
+# Any other range is NOT supported, and it will cause unexpected issues.
+ip_prefixes:
+  - 100.64.0.0/10
+  - fd7a:115c:a1e0::/48
+
+# DERP is a relay system that Tailscale uses when a direct
+# connection cannot be established.
+# https://tailscale.com/blog/how-tailscale-works/#encrypted-tcp-relays-derp
+#
+# headscale needs a list of DERP servers that can be presented
+# to the clients.
+derp:
+  server:
+    # If enabled, runs the embedded DERP server and merges it into the rest of the DERP config
+    # The Headscale server_url defined above MUST be using https, DERP requires TLS to be in place
+    enabled: false
+
+    # Region ID to use for the embedded DERP server.
+    # The local DERP prevails if the region ID collides with other region ID coming from
+    # the regular DERP config.
+    region_id: 999
+
+    # Region code and name are displayed in the Tailscale UI to identify a DERP region
+    region_code: "headscale"
+    region_name: "Headscale Embedded DERP"
+
+    # Listens over UDP at the configured address for STUN connections - to help with NAT traversal.
+    # When the embedded DERP server is enabled stun_listen_addr MUST be defined.
+    #
+    # For more details on how this works, check this great article: https://tailscale.com/blog/how-tailscale-works/
+    stun_listen_addr: "0.0.0.0:3478"
+
+  # List of externally available DERP maps encoded in JSON
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+
+  # Locally available DERP map files encoded in YAML
+  #
+  # This option is mostly interesting for people hosting
+  # their own DERP servers:
+  # https://tailscale.com/kb/1118/custom-derp-servers/
+  #
+  # paths:
+  #   - /etc/headscale/derp-example.yaml
+  paths: []
+
+  # If enabled, a worker will be set up to periodically
+  # refresh the given sources and update the derpmap
+  # will be set up.
+  auto_update_enabled: true
+
+  # How often should we check for DERP updates?
+  update_frequency: 24h
+
+# Disables the automatic check for headscale updates on startup
+disable_check_updates: true
+
+# Time before an inactive ephemeral node is deleted?
+ephemeral_node_inactivity_timeout: 30m
+
+# Period to check for node updates within the tailnet. A value too low will severely affect
+# CPU consumption of Headscale. A value too high (over 60s) will cause problems
+# for the nodes, as they won't get updates or keep alive messages frequently enough.
+# In case of doubts, do not touch the default 10s.
+node_update_check_interval: 10s
+
+# SQLite config
+db_type: sqlite3
+
+# For production:
+db_path: /var/lib/headscale/db.sqlite
+
+# # Postgres config
+# If using a Unix socket to connect to Postgres, set the socket path in the 'host' field and leave 'port' blank.
+# db_type: postgres
+# db_host: localhost
+# db_port: 5432
+# db_name: headscale
+# db_user: foo
+# db_pass: bar
+
+# If other 'sslmode' is required instead of 'require(true)' and 'disabled(false)', set the 'sslmode' you need
+# in the 'db_ssl' field. Refers to https://www.postgresql.org/docs/current/libpq-ssl.html Table 34.1.
+# db_ssl: false
+
+### TLS configuration
+#
+## Let's encrypt / ACME
+#
+# headscale supports automatically requesting and setting up
+# TLS for a domain with Let's Encrypt.
+#
+# URL to ACME directory
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+
+# Email to register with ACME provider
+acme_email: ""
+
+# Domain name to request a TLS certificate for:
+tls_letsencrypt_hostname: ""
+
+# Path to store certificates and metadata needed by
+# letsencrypt
+# For production:
+tls_letsencrypt_cache_dir: /var/lib/headscale/cache
+
+# Type of ACME challenge to use, currently supported types:
+# HTTP-01 or TLS-ALPN-01
+# See [docs/tls.md](docs/tls.md) for more information
+tls_letsencrypt_challenge_type: HTTP-01
+# When HTTP-01 challenge is chosen, letsencrypt must set up a
+# verification endpoint, and it will be listening on:
+# :http = port 80
+tls_letsencrypt_listen: ":http"
+
+## Use already defined certificates:
+tls_cert_path: ""
+tls_key_path: ""
+
+log:
+  # Output formatting for logs: text or json
+  format: text
+  level: info
+
+# Path to a file containg ACL policies.
+# ACLs can be defined as YAML or HUJSON.
+# https://tailscale.com/kb/1018/acls/
+acl_policy_path: ""
+
+## DNS
+#
+# headscale supports Tailscale's DNS configuration and MagicDNS.
+# Please have a look to their KB to better understand the concepts:
+#
+# - https://tailscale.com/kb/1054/dns/
+# - https://tailscale.com/kb/1081/magicdns/
+# - https://tailscale.com/blog/2021-09-private-dns-with-magicdns/
+#
+dns_config:
+  # Whether to prefer using Headscale provided DNS or use local.
+  override_local_dns: true
+
+  # List of DNS servers to expose to clients.
+  nameservers:
+    - 9.9.9.9
+
+  # NextDNS (see https://tailscale.com/kb/1218/nextdns/).
+  # "abc123" is example NextDNS ID, replace with yours.
+  #
+  # With metadata sharing:
+  # nameservers:
+  #   - https://dns.nextdns.io/abc123
+  #
+  # Without metadata sharing:
+  # nameservers:
+  #   - 2a07:a8c0::ab:c123
+  #   - 2a07:a8c1::ab:c123
+
+  # Split DNS (see https://tailscale.com/kb/1054/dns/),
+  # list of search domains and the DNS to query for each one.
+  #
+  # restricted_nameservers:
+  #   foo.bar.com:
+  #     - 1.1.1.1
+  #   darp.headscale.net:
+  #     - 1.1.1.1
+  #     - 8.8.8.8
+
+  # Search domains to inject.
+  domains: []
+
+  # Extra DNS records
+  # so far only A-records are supported (on the tailscale side)
+  # See https://github.com/juanfont/headscale/blob/main/docs/dns-records.md#Limitations
+  # extra_records:
+  #   - name: "grafana.myvpn.example.com"
+  #     type: "A"
+  #     value: "100.64.0.3"
+  #
+  #   # you can also put it in one line
+  #   - { name: "prometheus.myvpn.example.com", type: "A", value: "100.64.0.3" }
+
+  # Whether to use [MagicDNS](https://tailscale.com/kb/1081/magicdns/).
+  # Only works if there is at least a nameserver defined.
+  magic_dns: true
+
+  # Defines the base domain to create the hostnames for MagicDNS.
+  # `base_domain` must be a FQDNs, without the trailing dot.
+  # The FQDN of the hosts will be
+  # `hostname.user.base_domain` (e.g., _myhost.myuser.example.com_).
+  base_domain: DOMAINSUBNAMEHERE
+
+# Unix socket used for the CLI to connect without authentication
+# Note: for production you will want to set this to something like:
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+#
+# headscale supports experimental OpenID connect support,
+# it is still being tested and might have some bugs, please
+# help us test it.
+# OpenID Connect
+# oidc:
+#   only_start_if_oidc_is_available: true
+#   issuer: "https://your-oidc.issuer.com/path"
+#   client_id: "your-oidc-client-id"
+#   client_secret: "your-oidc-client-secret"
+#   # Alternatively, set `client_secret_path` to read the secret from the file.
+#   # It resolves environment variables, making integration to systemd's
+#   # `LoadCredential` straightforward:
+#   client_secret_path: "${CREDENTIALS_DIRECTORY}/oidc_client_secret"
+#   # client_secret and client_secret_path are mutually exclusive.
+#
+#   # The amount of time from a node is authenticated with OpenID until it
+#   # expires and needs to reauthenticate.
+#   # Setting the value to "0" will mean no expiry.
+#   expiry: 180d
+#
+#   # Use the expiry from the token received from OpenID when the user logged
+#   # in, this will typically lead to frequent need to reauthenticate and should
+#   # only been enabled if you know what you are doing.
+#   # Note: enabling this will cause `oidc.expiry` to be ignored.
+#   use_expiry_from_token: false
+#
+#   # Customize the scopes used in the OIDC flow, defaults to "openid", "profile" and "email" and add custom query
+#   # parameters to the Authorize Endpoint request. Scopes default to "openid", "profile" and "email".
+#
+#   scope: ["openid", "profile", "email", "custom"]
+#   extra_params:
+#     domain_hint: example.com
+#
+#   # List allowed principal domains and/or users. If an authenticated user's domain is not in this list, the
+#   # authentication request will be rejected.
+#
+#   allowed_domains:
+#     - example.com
+#   # Note: Groups from keycloak have a leading '/'
+#   allowed_groups:
+#     - /headscale
+#   allowed_users:
+#     - alice@example.com
+#
+#   # If `strip_email_domain` is set to `true`, the domain part of the username email address will be removed.
+#   # This will transform `first-name.last-name@example.com` to the user `first-name.last-name`
+#   # If `strip_email_domain` is set to `false` the domain part will NOT be removed resulting to the following
+#   user: `first-name.last-name.example.com`
+#
+#   strip_email_domain: true
+
+# Logtail configuration
+# Logtail is Tailscales logging and auditing infrastructure, it allows the control panel
+# to instruct tailscale nodes to log their activity to a remote server.
+logtail:
+  # Enable logtail for this headscales clients.
+  # As there is currently no support for overriding the log server in headscale, this is
+  # disabled by default. Enabling this will make your clients send logs to Tailscale Inc.
+  enabled: false
+
+# Enabling this option makes devices prefer a random port for WireGuard traffic over the
+# default static port 41641. This option is intended as a workaround for some buggy
+# firewall devices. See https://tailscale.com/kb/1181/firewalls/ for more information.
+randomize_client_port: false

containers/headscale/resources/monitoring/grafana-dashboards/headscale.json

@@ -0,0 +1,200 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": { "type": "grafana", "uid": "-- Grafana --" },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": null,
+  "links": [],
+  "panels": [
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "thresholds" },
+          "mappings": [],
+          "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 4, "w": 6, "x": 0, "y": 0 },
+      "id": 1,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
+        "textMode": "auto"
+      },
+      "pluginVersion": "10.0.0",
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "sum(headscale_machine_registrations_total)",
+          "refId": "A"
+        }
+      ],
+      "title": "Total Machine Registrations",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "thresholds" },
+          "mappings": [],
+          "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 4, "w": 6, "x": 6, "y": 0 },
+      "id": 2,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
+        "textMode": "auto"
+      },
+      "pluginVersion": "10.0.0",
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "headscale_machines_active_total",
+          "refId": "A"
+        }
+      ],
+      "title": "Active Machines",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "thresholds" },
+          "mappings": [],
+          "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] },
+          "unit": "decbytes"
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 4, "w": 6, "x": 12, "y": 0 },
+      "id": 3,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
+        "textMode": "auto"
+      },
+      "pluginVersion": "10.0.0",
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "process_resident_memory_bytes{job=\"headscale\"}",
+          "refId": "A"
+        }
+      ],
+      "title": "Memory (RSS)",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "thresholds" },
+          "mappings": [],
+          "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 4, "w": 6, "x": 18, "y": 0 },
+      "id": 4,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
+        "textMode": "auto"
+      },
+      "pluginVersion": "10.0.0",
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "go_goroutines{job=\"headscale\"}",
+          "refId": "A"
+        }
+      ],
+      "title": "Goroutines",
+      "type": "stat"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "Prometheus" },
+      "fieldConfig": {
+        "defaults": {
+          "color": { "mode": "palette-classic" },
+          "custom": {
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "drawStyle": "line",
+            "fillOpacity": 10,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "showPoints": "never",
+            "spanNulls": false
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 9, "w": 24, "x": 0, "y": 4 },
+      "id": 5,
+      "options": {
+        "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
+        "tooltip": { "mode": "single", "sort": "none" }
+      },
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "rate(headscale_node_update_count_total[5m])",
+          "legendFormat": "node updates/s",
+          "refId": "A"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "Prometheus" },
+          "expr": "rate(headscale_grpc_requests_total[5m])",
+          "legendFormat": "grpc {{method}} /s",
+          "refId": "B"
+        }
+      ],
+      "title": "Activity",
+      "type": "timeseries"
+    }
+  ],
+  "refresh": "30s",
+  "schemaVersion": 38,
+  "tags": ["libreportal", "headscale"],
+  "templating": { "list": [] },
+  "time": { "from": "now-6h", "to": "now" },
+  "timepicker": {},
+  "timezone": "",
+  "title": "Headscale",
+  "uid": "libreportal-headscale",
+  "version": 1,
+  "weekStart": ""
+}

containers/headscale/resources/monitoring/prometheus-scrape.yml

@@ -0,0 +1,4 @@
+- job_name: headscale
+  metrics_path: /metrics
+  static_configs:
+    - targets: ['headscale-service:9090']

containers/invidious/docker-compose.yml

@@ -0,0 +1,76 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+  invidious-service: #LIBREPORTAL|SERVICE_TAG_1|invidious-service
+    container_name: invidious-service
+    image: quay.io/invidious/invidious:latest
+    restart: unless-stopped
+    depends_on:
+      - invidious-db
+    # GLUETUN_OFF_BEGIN
+    ports:
+      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+    # GLUETUN_OFF_END
+    environment:
+      INVIDIOUS_CONFIG: |
+        db:
+          dbname: invidious
+          user: kemal
+          password: kemal
+          host: invidious-db
+          port: 5432
+        check_tables: true
+        # external_port:
+        # domain:
+        # https_only: false
+        # statistics_enabled: false
+        hmac_key: "INVIDIOUS_HMAC_KEY_DATA" #LIBREPORTAL|INVIDIOUS_HMAC_KEY_TAG|INVIDIOUS_HMAC_KEY_DATA
+    healthcheck:
+      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/api/v1/comments/jNQXAC9IVRw || exit 1
+      interval: 30s
+      timeout: 5s
+      retries: 2
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+    logging:
+      options:
+        max-size: "1G"
+        max-file: "4"
+    volumes:
+      - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
+      traefik.http.routers.invidious-service.entrypoints: web,websecure
+      traefik.http.routers.invidious-service.rule: Host(`DOMAINSUBNAME_DATA`) #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      traefik.http.routers.invidious-service.tls: true
+      traefik.http.routers.invidious-service.tls.certresolver: production
+      traefik.http.services.invidious-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+      traefik.http.routers.invidious-service.middlewares: MIDDLEWARE_DATA #LIBREPORTAL|MIDDLEWARE_TAG|MIDDLEWARE_DATA
+      traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    # GLUETUN_OFF_BEGIN
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+    # GLUETUN_OFF_END
+    # GLUETUN_ON_BEGIN
+    # network_mode: "container:gluetun-service"
+    # GLUETUN_ON_END
+
+  invidious-db: #LIBREPORTAL|SERVICE_TAG_2|invidious-db
+    container_name: invidious-db
+    image: docker.io/library/postgres:14
+    restart: unless-stopped
+    volumes:
+      - ./postgresdata:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: invidious
+      POSTGRES_USER: kemal
+      POSTGRES_PASSWORD: kemal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_2 #LIBREPORTAL|IP_TAG_2|IP_DATA_2

containers/invidious/invidious.config

@@ -0,0 +1,71 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# AUTHELIA = if true, use Authelia authentication, if false turned off.
+# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
+#
+CFG_INVIDIOUS_APP_NAME=invidious
+CFG_INVIDIOUS_BACKUP=false
+CFG_INVIDIOUS_COMPOSE_FILE=default
+CFG_INVIDIOUS_HEALTHCHECK=false
+CFG_INVIDIOUS_AUTHELIA=false
+CFG_INVIDIOUS_HEADSCALE=false
+# HMAC_KEY = signs Invidious tokens/links; auto-generated, fed to the compose
+#            via the INVIDIOUS_HMAC_KEY_TAG tag (preserved across reinstalls)
+CFG_INVIDIOUS_HMAC_KEY=RANDOMIZEDPASSWORD1
+#
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+#
+CFG_INVIDIOUS_CATEGORY="media"
+CFG_INVIDIOUS_TITLE="Invidious"
+CFG_INVIDIOUS_DESCRIPTION="YouTube Frontend"
+CFG_INVIDIOUS_LONG_DESCRIPTION="Invidious is an alternative front-end to YouTube that focuses on privacy and providing a distraction-free viewing experience"
+CFG_INVIDIOUS_URL="https://github.com/iv-org/invidious"
+CFG_INVIDIOUS_ACTIONS="configure|install|restart|shutdown|uninstall|tools"
+#
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# HOST_NAME = subdomain name e.g test is the name for test.website.com
+# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
+#
+CFG_INVIDIOUS_DOMAIN=1
+CFG_INVIDIOUS_WHITELIST=false
+CFG_INVIDIOUS_HOST_NAME=invidious
+CFG_INVIDIOUS_NETWORK=default
+#
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, dns, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_INVIDIOUS_PORT_1="invidious-service|webui|random:3000|public|tcp|false|true|true|Web Interface|"
+
+# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
+CFG_INVIDIOUS_AUTH_PROFILE=multi_user
+CFG_INVIDIOUS_ADMIN_USER=
+CFG_INVIDIOUS_ADMIN_EMAIL=
+CFG_INVIDIOUS_ADMIN_PASSWORD=RANDOMIZEDPASSWORD1

containers/invidious/invidious.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+
+# Category : Media & Streaming
+# Description : Invidious - Privacy-focused YouTube Frontend (c/u/s/r/i/t):
+
+installInvidious()
+{
+    local config_variables="$1"
+
+    if [[ "$invidious" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent invidious;
+        local app_name=$CFG_INVIDIOUS_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$invidious" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$invidious" == *[tT]* ]]; then
+        invidiousToolsMenu;
+    fi
+
+	if [[ "$invidious" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$invidious" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+	if [[ "$invidious" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+	fi
+
+    if [[ "$invidious" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Updating WebUI config file."
+		echo ""
+
+		webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using any of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    invidious=n
+}

containers/invidious/invidious.svg

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 512 512"><path d="M244.2 502.3c-25.1-1-49.2-5.4-72.6-13.3-77.4-26.1-138-87.1-161.3-162.4C.2 294.1-2.5 258 2.3 222.3c4.7-34.9 17.3-68 37.3-98.2 15.3-23.2 37-46.1 60-63.3 46.9-35.1 109.2-54 168.2-51 32.9 1.7 63.4 8.6 92.9 21.1 10.4 4.4 25.4 12.3 35.2 18.5 18 11.3 28.4 19.7 43.8 35 16.8 16.8 28.1 30.8 38.6 48.1 9.2 15.1 17.9 34.5 23.2 51.3 2 6.5 5.6 20.9 7.2 28.8 3 15.1 3.4 20 3.4 42.3 0 23.5-.6 31-3.7 46.7-11.8 59.6-45.2 112-95.1 149.4-29 21.7-63.5 37.5-99.8 45.5-21.3 4.8-45.1 6.7-69.3 5.8m-44.6-100.1c0-.7-.1-2.6-.2-4.3l-.2-3.1-6-.3c-5.1-.3-6.1-.4-6.8-1-2.6-1.9-1.9-7.7 2.9-23.4 1.1-3.7 4.2-14.4 7-23.8 2.7-9.5 6.6-22.7 8.6-29.3 2-6.7 5.3-18.1 7.4-25.5 2.1-7.3 4.6-15.8 5.5-18.8s4.1-14 7.2-24.5c6.3-21.6 10.4-35.2 11.4-37.9.7-1.8.7-1.8 1.3-1.2.3.3 4.9 9.4 10.1 20.1 5.3 10.7 16.6 33.8 25.3 51.2 21.8 44.1 48.1 97.3 55 111.3l5.8 11.8 14.4-.1c7.9-.1 14.8-.2 15.2-.4.7-.3.7-.4-1.7-5.5-1.4-2.9-10.3-21.1-20-40.5-62.1-125-78-157.4-86.5-176-6-13.1-8.8-18.8-9.8-20-1.1-1.2-2.1-1.4-3-.3-1.5 1.7-5.2 12.8-11.9 35.9-2.6 9-8.3 28.5-12.6 43.3-8.4 28.7-10.8 36.9-18.2 62.1-2.6 8.8-6.1 20.8-7.8 26.6s-5.1 17.5-7.6 26.1c-5.5 18.9-7.8 26.5-9.4 30.8-2.7 7.3-3.3 8-6.3 8.6-1.1.2-3.1.4-4.3.4-2.8 0-4.5.5-5.2 1.4-.5.8-.7 6.2-.2 7 .3.4 3.1.5 29.6.7l10.9.1zm46.7-261.1c5.5-1.2 10.7-6.3 12-11.7.5-2 .4-6.3-.1-8.2-1.1-4-4.2-8-7.7-9.9-4.8-2.6-12-2.6-16.9 0-7.6 4.1-10.4 14.1-6.1 22.1 3.5 6.4 10.7 9.4 18.8 7.7" style="fill:#f0f0f0"/><path d="M2712.8 5196.2c-157.5-82.6-156.2-323.9 3.8-405.2 109.2-55.9 249-20.3 313.7 78.8 73.7 110.5 33 268-85.1 327.7-64.7 33-167.6 33-232.4-1.3z" style="fill:#00b6f0;stroke:#00b6f0;stroke-width:.297;stroke-miterlimit:10" transform="matrix(.0699 0 0 -.0699 44.236 474.48)"/><path d="M2833.5 4483.6c-15.2-20.3-80-210.9-129.6-384.9-38.1-132.1-128.3-444.6-209.6-717.7-25.4-87.6-73.7-252.8-108-368.4-33-115.6-81.3-280.7-108-368.4-25.4-87.6-73.7-252.8-108-368.4-33-115.6-81.3-280.7-108-368.4-25.4-87.6-72.4-247.7-102.9-355.7-74.9-262.9-118.1-379.8-146.1-393.8-12.7-7.6-44.5-12.7-71.1-12.7-92.7 0-106.7-10.2-102.9-68.6l3.8-52.1 289.6-3.8 289.6-2.5-3.8 59.7-3.8 61-92.7 3.8c-83.8 3.8-94 6.4-106.7 34.3-16.5 35.6 0 132.1 47 285.8 16.5 52.1 59.7 198.2 95.3 323.9 35.6 125.8 83.8 292.2 108 368.4 22.9 77.5 71.1 242.6 108 368.4 35.6 125.8 83.8 292.2 108 368.4 22.9 77.5 71.1 242.6 108 368.4 108 377.3 156.2 532.2 166.4 544.9 6.4 6.4 21.6-14 35.6-44.5 12.7-30.5 243.9-499.2 511.9-1040.3s567.8-1145.7 664.3-1343.9l176.6-358.2h213.4c116.9 0 213.4 5.1 213.4 10.2s-95.3 200.7-210.9 434.4C3613.4 2965.6 3129.4 3950 3048.2 4130.4c-36.8 80-87.6 191.8-113.1 247.7-55.9 120.8-73.7 139.8-101.6 105.5" style="fill:#575757" transform="matrix(.0699 0 0 -.0699 44.236 474.48)"/></svg>

containers/ipinfo/docker-compose.yml

@@ -0,0 +1,38 @@
+networks:
+  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    external: true
+
+services:
+  ipinfo-service: #LIBREPORTAL|SERVICE_TAG_1|ipinfo-service
+    container_name: ipinfo-service
+    image: peterdavehello/ipinfo.tw:latest
+    restart: unless-stopped
+    # GLUETUN_OFF_BEGIN
+    ports:
+      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
+    # GLUETUN_OFF_END
+    environment:
+      - TZ:TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
+    labels:
+      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
+      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
+      traefik.http.routers.ipinfo-service.entrypoints: web,websecure
+      traefik.http.routers.ipinfo-service.rule: Host(`DOMAINSUBNAME_DATA`) #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      traefik.http.routers.ipinfo-service.tls: true
+      traefik.http.routers.ipinfo-service.tls.certresolver: production
+      traefik.http.services.ipinfo-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
+      traefik.http.routers.ipinfo-service.middlewares: MIDDLEWARE_DATA #LIBREPORTAL|MIDDLEWARE_TAG|MIDDLEWARE_DATA
+      traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+    healthcheck:
+      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
+    volumes:
+      - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
+    # GLUETUN_OFF_BEGIN
+    networks:
+      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
+        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
+    # GLUETUN_OFF_END
+    # GLUETUN_ON_BEGIN
+    # network_mode: "container:gluetun-service"
+    # GLUETUN_ON_END

containers/ipinfo/ipinfo.config

@@ -0,0 +1,62 @@
+#
+# =============================================================================
+# GENERAL CONFIGURATION
+# =============================================================================
+# APP_NAME = name of application for use in scripts
+# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
+# BACKUP = if true, include this application in backup operations
+# HEALTHCHECK = if true, default docker health checks for that container will be enabled
+# AUTHELIA = if true, use Authelia authentication, if false turned off.
+# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
+#
+CFG_IPINFO_APP_NAME=ipinfo
+CFG_IPINFO_BACKUP=false
+CFG_IPINFO_COMPOSE_FILE=default
+CFG_IPINFO_HEALTHCHECK=true
+CFG_IPINFO_AUTHELIA=false
+CFG_IPINFO_HEADSCALE=false
+#
+# =============================================================================
+# METADATA
+# =============================================================================
+# CATEGORY = application category for grouping
+# TITLE = display name for the application
+# DESCRIPTION = short description of the application
+# LONG_DESCRIPTION = detailed description of the application
+# URL = source repository or documentation URL
+# ACTIONS = available actions for this application
+#
+CFG_IPINFO_CATEGORY="networking"
+CFG_IPINFO_TITLE="IPinfo"
+CFG_IPINFO_DESCRIPTION="IP Information"
+CFG_IPINFO_LONG_DESCRIPTION="IPinfo is a simple IP address lookup service that provides detailed information about IP addresses including geolocation and ISP data"
+CFG_IPINFO_URL="https://github.com/ipinfo/cli"
+CFG_IPINFO_ACTIONS="configure|install|restart|shutdown|uninstall"
+#
+# =============================================================================
+# NETWORK CONFIGURATION
+# =============================================================================
+# DOMAIN = number of domain from the general config, useful when using multiple domains
+# HOST_NAME = subdomain name e.g test is the name for test.website.com
+# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
+#
+CFG_IPINFO_DOMAIN=1
+CFG_IPINFO_WHITELIST=false
+CFG_IPINFO_HOST_NAME=ipinfo
+CFG_IPINFO_NETWORK=default
+#
+# =============================================================================
+# PORT CONFIGURATION
+# =============================================================================
+# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
+#   - app: application name
+#   - name: service identifier (webui, dns, ssh, etc.)
+#   - external:internal: port mapping (external can be 'random' for auto-allocation)
+#   - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
+#   - protocol: 'tcp' or 'udp'
+#   - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
+#   - traefik: if true, Traefik handles this port (reverse proxy)
+#   - webui: if true, this port serves the main web interface
+#   - description: human-readable description of the service
+#
+CFG_IPINFO_PORT_1="ipinfo-service|webui|random:8080|public|tcp|false|true|true|Web Interface|"