Wakapi: upgrade to 2.15.0

files/authelia/configuration.template.yml

@@ -725,7 +725,11 @@ access_control:
     ## Rules applied to everyone
     - domain: 'status.vakhrushev.me'
       subject: 'group:admins'
-      policy: 'one_factor'
+      policy: 'two_factor'
+
+    - domain: 'dozzle.vakhrushev.me'
+      subject: 'group:admins'
+      policy: 'two_factor'
 
     - domain: 'rssbridge.vakhrushev.me'
       subject: 'group:admins'

files/authelia/docker-compose.yml.j2

@@ -2,7 +2,7 @@ services:
 
   authelia_app:
     container_name: 'authelia_app'
-    image: 'docker.io/authelia/authelia:4.39.5'
+    image: 'docker.io/authelia/authelia:4.39.8'
     user: '{{ user_create_result.uid }}:{{ user_create_result.group }}'
     restart: 'unless-stopped'
     networks:

files/caddyproxy/Caddyfile.j2

@@ -91,3 +91,14 @@ rssbridge.vakhrushev.me {
     reverse_proxy rssbridge_app:80
 }
 
+dozzle.vakhrushev.me {
+    tls anwinged@ya.ru
+
+    forward_auth authelia_app:9091 {
+        uri /api/authz/forward-auth
+        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name Remote-Filter
+    }
+
+    reverse_proxy dozzle_app:8080
+}
+}

files/caddyproxy/docker-compose.yml.j2

@@ -1,7 +1,7 @@
 services:
 
   {{ service_name }}:
-    image: caddy:2.10.0
+    image: caddy:2.10.2
     restart: unless-stopped
     container_name: {{ service_name }}
     ports:

files/dozzle/docker-compose.yml.j2

@@ -0,0 +1,23 @@
+services:
+  
+  dozzle_app:
+    image: amir20/dozzle:v8.13.12
+    container_name: dozzle_app
+    restart: unless-stopped
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock"
+    networks:
+      - "web_proxy_network"
+    environment:
+      DOZZLE_HOSTNAME: vakhrushev.me
+      DOZZLE_AUTH_PROVIDER: forward-proxy
+    healthcheck:
+      test: ["CMD", "/dozzle", "healthcheck"]
+      interval: 3s
+      timeout: 30s
+      retries: 5
+      start_period: 30s
+
+networks:
+  web_proxy_network:
+    external: true

files/gitea/docker-compose.yml.j2

@@ -1,7 +1,7 @@
 services:
 
   gitea_app:
-    image: gitea/gitea:1.24.4
+    image: gitea/gitea:1.24.5
     restart: unless-stopped
     container_name: gitea_app
     ports:

files/gramps/docker-compose.yml.j2

@@ -3,7 +3,7 @@
 services:
 
   gramps_app: &gramps_app
-    image: ghcr.io/gramps-project/grampsweb:25.7.3
+    image: ghcr.io/gramps-project/grampsweb:25.8.0
     container_name: gramps_app
     depends_on:
       - gramps_redis

files/netdata/docker-compose.yml.j2

@@ -2,7 +2,7 @@
 services:
 
   netdata:
-    image: netdata/netdata:v2.6.1
+    image: netdata/netdata:v2.6.3
     container_name: netdata
     restart: unless-stopped
     cap_add:

files/netdata/go.d/prometheus.conf

@@ -19,3 +19,6 @@ jobs:
     selector:
       allow:
         - "miniflux_*"
+
+  - name: transcriber
+    url: http://transcriber_app:8080/metrics

files/outline/docker-compose.yml.j2

@@ -3,7 +3,7 @@ services:
   # See sample https://github.com/outline/outline/blob/main/.env.sample
 
   outline_app:
-    image: outlinewiki/outline:0.86.0
+    image: outlinewiki/outline:0.87.3
     container_name: outline_app
     restart: unless-stopped
     depends_on:

files/transcriber/config.secrets.toml

@@ -0,0 +1,44 @@
+$ANSIBLE_VAULT;1.1;AES256
+33396537353265633634336630353330653337623861373731613734663938633837613437366537
+3439383366633266623463366530626662346338393165630a663539313066663061353635666366
+61393437393131333166626165306563366661353338363138633239666566313330363331666537
+3763356535396334380a386362383436363732353234333033613133383264643934306432313335
+34646164323664636532663835306230386633316539373564383163346663376666633564326134
+30666135626637343963383766383836653135633739636261353666303666633566346562643962
+63376165636434343066306539653637343736323437653465656436323533636237643333326438
+35626239323530643066363533323039393237333338316135313838643464306161646635313062
+36386565626435373333393566393831366538363864313737306565343162316536353539333864
+63376264643566613266373665666363366662643262616634333132386535383731396462633430
+32343738343039616139343833366661303430383766376139636434616565356161396433643035
+37363165383935373937346464343738643430333764336264373931616332393964346566636638
+39303434343461326464623363323937396663376335316237373166306134636432376435663033
+34346436623435626363636237373965633139343661623135633764303862353465306235666563
+66653764666635636462636434663264646665383236343166643133613966366334653030653262
+38326437313939616332636638323033346139343732653933356239306132613665376163646164
+30316663643666633334653133613764396165646533636534613931663138666366316235396466
+61313964396264626339306135376635633133366433303033633363396132303938363638346333
+66326466326134313535393831343262363862663065323135643630316431336531373833316363
+64376338653366353031333836643137333736363534363164306331313337353663653961623665
+64626562366637336637353433303261303964633236356162363139396339396136393237643935
+34316266326561663834353762343766363933313463313263393063343562613933393361653861
+38363635323231666438366536626435373365323733663139666534636564623666356436346539
+63326436386436356636633637373738343032353664323736653939346234643165313461643833
+35666439613136396264313033336539313537613238393262306365656238396464373936616538
+64316365616464386638313331653030346330393665353539393834346135643434363736323135
+37663433326439356663633162616435313061353662373766633731636439636266666466613363
+39343930386534376330663230623832643933336235636166626534366664366562356165373764
+63343432323864366162376263656565646661633536666336643030363039616666343063386165
+37343238303034313832393538313632396261316232376635633732656663396631323261363433
+38373738363833323934353739643538376237316535623035383965613965636337646537326537
+64663837643632666334393634323264613139353332306263613165383733386662366333316139
+63373839346265366166333331353231663763306163323063613138323835313831303666306561
+39316666343761303464333535336361333462623363633333383363303134336139356436666165
+62616364373030613837353939363636653537373965613531636130383266643637333233316137
+39353866366239643265366162663031346439663234363935353138323739393337313835313062
+33373263326565383735366364316461323930336437623834356132346633636364313732383661
+66346634613762613037386238656334616430633037343066623463313035646339313638653137
+65643166316664626236633332326136303235623934306462643636373437373630346435633835
+66346364393236393563623032306631396561623263653236393939313333373635303365316638
+66373037333565323733656331636337336665363038353635383531386366633632363031623430
+31356461663438653736316464363231303938653932613561633139316361633461626361383132
+396436303634613135383839396566393135

files/transcriber/docker-compose.yml.j2

@@ -0,0 +1,23 @@
+services:
+
+  transcriber_app:
+    image: "{{ registry_transcriber_image }}"
+    container_name: transcriber_app
+    user: '{{ user_create_result.uid }}:{{ user_create_result.group }}'
+    restart: unless-stopped
+    volumes:
+      - "{{ config_file }}:/config/config.toml:ro"
+      - "{{ data_dir }}:/data"
+    networks:
+      - "web_proxy_network"
+      - "monitoring_network"
+    environment:
+      - "USER_UID={{ user_create_result.uid }}"
+      - "USER_GID={{ user_create_result.group }}"
+    command: ./transcriber --config=/config/config.toml
+
+networks:
+  web_proxy_network:
+    external: true
+  monitoring_network:
+    external: true

files/wakapi/docker-compose.yml.j2

@@ -3,7 +3,7 @@
 services:
 
   wakapi_app:
-    image: ghcr.io/muety/wakapi:2.14.1
+    image: ghcr.io/muety/wakapi:2.15.0
     container_name: wakapi_app
     restart: unless-stopped
     user: '{{ user_create_result.uid }}:{{ user_create_result.group }}'

playbook-dozzle.yml

@@ -0,0 +1,34 @@
+---
+- name: "Configure dozzle application"
+  hosts: all
+
+  vars_files:
+    - vars/ports.yml
+    - vars/secrets.yml
+
+  vars:
+    app_name: "dozzle"
+    app_user: "{{ app_name }}"
+    base_dir: "/home/{{ app_user }}"
+
+  tasks:
+    - name: "Create user and environment"
+      ansible.builtin.import_role:
+        name: owner
+      vars:
+        owner_name: "{{ app_user }}"
+        owner_extra_groups: ["docker"]
+
+    - name: "Copy docker compose file"
+      ansible.builtin.template:
+        src: "./files/{{ app_name }}/docker-compose.yml.j2"
+        dest: "{{ base_dir }}/docker-compose.yml"
+        owner: "{{ app_user }}"
+        group: "{{ app_user }}"
+        mode: "0640"
+
+    - name: "Run application with docker compose"
+      community.docker.docker_compose_v2:
+        project_src: "{{ base_dir }}"
+        state: "present"
+        remove_orphans: true

playbook-transcriber.yml

@@ -0,0 +1,92 @@
+---
+- name: "Deploy transcriber application"
+  hosts: all
+
+  vars_files:
+    - vars/ports.yml
+    - vars/secrets.yml
+
+
+  vars:
+    app_name: "transcriber"
+    app_user: "{{ app_name }}"
+    base_dir: "/home/{{ app_user }}"
+
+    config_dir: "{{ (base_dir, 'config') | path_join }}"
+    config_file: "{{ (config_dir, 'config.toml') | path_join }}"
+
+    data_dir: "{{ (base_dir, 'data') | path_join }}"
+    backups_dir: "{{ (base_dir, 'backups') | path_join }}"
+
+    docker_registry_prefix: "cr.yandex/crplfk0168i4o8kd7ade"
+    
+    # transcriber_image: "{{ transcriber_image | default(omit) }}"
+
+
+  tasks:
+    - name: "Create user and environment"
+      ansible.builtin.import_role:
+        name: owner
+      vars:
+        owner_name: "{{ app_user }}"
+        owner_extra_groups: ["docker"]
+
+    - name: "Create application internal directories"
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: "directory"
+        owner: "{{ app_user }}"
+        group: "{{ app_user }}"
+        mode: "0750"
+      loop:
+        - "{{ config_dir }}"
+        - "{{ data_dir }}"
+        - "{{ backups_dir }}"
+
+    - name: "Copy configuration files (templates)"
+      ansible.builtin.copy:
+        src: "files/{{ app_name }}/config.secrets.toml"
+        dest: "{{ config_file }}"
+        owner: "{{ app_user }}"
+        group: "{{ app_user }}"
+        mode: "0600"
+
+    - name: "Login to yandex docker registry."
+      ansible.builtin.script:
+        cmd: "files/yandex-docker-registry-auth.sh"
+
+    - name: "Deploy service"
+      when: transcriber_image is defined
+      block:
+        # - name: "Check is web service image passed"
+        #   ansible.builtin.assert:
+        #     that:
+        #       - "transcriber_image is defined"
+        #     fail_msg: 'You must pass variable "transcriber_image"'
+
+        - name: "Create full image name with container registry"
+          ansible.builtin.set_fact:
+            registry_transcriber_image: "{{ (docker_registry_prefix, transcriber_image) | path_join }}"
+
+        - name: "Push web service image to remote registry"
+          community.docker.docker_image:
+            state: present
+            source: local
+            name: "{{ transcriber_image }}"
+            repository: "{{ registry_transcriber_image }}"
+            push: true
+          delegate_to: 127.0.0.1
+
+        - name: "Copy docker compose file"
+          ansible.builtin.template:
+            src: "./files/{{ app_name }}/docker-compose.yml.j2"
+            dest: "{{ base_dir }}/docker-compose.yml"
+            owner: "{{ app_user }}"
+            group: "{{ app_user }}"
+            mode: "0640"
+
+        - name: "Run application with docker compose"
+          community.docker.docker_compose_v2:
+            project_src: "{{ base_dir }}"
+            state: "present"
+            remove_orphans: true