created major large-scale changes

2026-07-12 15:27:58 -04:00
parent e8b29bb8e8
commit e53d6255e0
99 changed files with 4183 additions and 2093 deletions
--- a/roles/init-server/templates/user/all.env.j2
+++ b/roles/init-server/templates/user/all.env.j2
@@ -0,0 +1,17 @@
+{% if compose.mode == "dev" %}
+SERVER_FQDN_SCHEME=http
+SERVER_FQDN={{ (certbot.domains | map("regex_replace", "\\.([^\\.]*)$", ".test") | reject("regex", "^\\*\\.") | list)[0] }}
+{% elif compose.mode == "prod" %}
+SERVER_FQDN_SCHEME=https
+SERVER_FQDN={{ (certbot.domains | reject("regex", "^\\*\\.") | list)[0] }}
+{% endif %}
+
+{% if nextcloud.subdomain is defined and nextcloud != None %}
+NEXTCLOUD_SUBDOMAIN={{ nextcloud.subdomain }}
+{% endif %}
+{% if gitea is defined and gitea != None %}
+GITEA_SUBDOMAIN={{ gitea.subdomain }}
+{% endif %}
+{% if gist is defined and gist != None %}
+OG_SUBDOMAIN={{ gist.subdomain }}
+{% endif %}
--- a/roles/init-server/templates/user/aria2/aria2.conf.j2
+++ b/roles/init-server/templates/user/aria2/aria2.conf.j2
@@ -0,0 +1,196 @@
+# GENERAL
+max-concurrent-downloads={{ aria.dl.max.concurrent | string }}
+dir={{ ansible_user_home.stdout + "/downloads/aria2" }}
+log={{ ansible_user_home.stdout + "/.aria2/aria2.log" }}
+log-level={{ aria.log }}
+console-log-level=notice
+continue=true
+
+{% if aria.dl.resume %}
+always-resume=true
+{% else %}
+always-resume=false
+{% endif %}
+
+{% if aria.dl.overwriting %}
+allow-overwrite=true
+{% else %}
+allow-overwrite=false
+{% endif %}
+
+{% if aria.dl.autorenaming %}
+auto-file-renaming=true
+{% else %}
+auto-file-renaming=false
+{% endif %}
+
+file-allocation={{ aria.alloc }}
+disk-cache={{ aria.dcache | string }}
+enable-mmap=true
+enable-color=true
+human-readable=true
+keep-unfinished-download-result=true
+max-download-result=500
+max-resume-failure-tries=0
+
+# RPC
+{% if aria.rpc.enabled %}
+enable-rpc=true
+
+{% if mode == "prod" or aria.rpc.scheme == "https" %}
+rpc-secure=true
+
+{% if not certbot.containerized %}
+rpc-certificate={{ "/etc/letsencrypt/live/" + web_fqdn + "/fullchain.pem" }}
+rpc-private-key={{ "/etc/letsencrypt/live/" + web_fqdn + "/privkey.pem" }}
+{% else %}
+rpc-certificate={{ ansible_user_home.stdout + "/.config/letsencrypt/live/" + web_fqdn + "/fullchain.pem" }}
+rpc-private-key={{ ansible_user_home.stdout + "/.config/letsencrypt/live/" + web_fqdn + "/privkey.pem" }}
+{% endif %}
+
+{% endif %}
+
+{% if aria.rpc.listen_all %}
+rpc-listen-all=true
+{% else %}
+rpc-listen-all=false
+{% endif %}
+
+rpc-listen-port={{ aria.rpc.port | string }}
+
+{% if aria.rpc.credentials is undefined or aria.rpc.credentials == None %}
+rpc-secret={{ aria.rpc.secret | default(lookup('password', './.tmp/' + inventory_hostname + '-aria/aria.secret', chars=['ascii_lowercase', 'digits'], length=32)) }}
+{% else %}
+rpc-user={{ aria.rpc.credentials.username }}
+rpc-password={{ aria.rpc.credentials.password }}
+{% endif %}
+
+{% else %}
+enable-rpc=false
+{% endif %}
+
+
+# (HT/SF/F)TP
+{% if aria.conn.proxy.enabled %}
+all-proxy={{ aria.conn.proxy.uri }}
+no-proxy={{ aria.conn.proxy.excluded | join(",") }}
+{% endif %}
+
+max-connection-per-server={{ aria.conn.max.per_server | string }}
+split={{ aria.conn.split | string }}
+max-tries={{ aria.conn.max.attempts | string }}
+retry-wait=15
+netrc-path={{ ansible_user_home.stdout + "/.netrc" }}
+server-stat-if={{ ansible_user_home.stdout + "/.aria2/dl.log" }}
+server-stat-of={{ ansible_user_home.stdout + "/.aria2/dl.log" }}
+uri-selector={{ aria.dl.algorithm }}
+
+
+# HTTP
+{% if aria.http.gzip %}
+http-accept-gzip=true
+{% else %}
+http-accept-gzip=false
+{% endif %}
+
+{% if aria.http.cache %}
+http-no-cache=true
+{% else %}
+http-no-cache=false
+{% endif %}
+
+{% if aria.http.sustain %}
+enable-http-keep-alive=true
+{% else %}
+enable-http-keep-alive=false
+{% endif %}
+
+{% if aria.http.agent is defined and aria.http.agent != None %}
+user-agent={{ aria.http.agent }}
+{% endif %}
+
+
+# (S)FTP
+{% if aria.ftp.mode == "passive" %}
+ftp-pasv=true
+{% elif aria.ftp.mode == "active" %}
+ftp-pasv=false
+{% endif %}
+
+ftp-type={{ aria.ftp.data_type }}
+
+
+# METALINKS/TORRENTS
+
+
+# TORRENTS
+bt-detach-seed-only=true
+
+{% if aria.trnt.local_discovery %}
+bt-enable-lpd=true
+{% else %}
+bt-enable-lpd=false
+{% endif %}
+
+{% if aria.trnt.encrypt %}
+bt-force-encryption=true
+{% else %}
+bt-force-encryption=false
+{% endif %}
+
+bt-max-peers={{ aria.trnt.peers.max }}
+
+{% if aria.trnt.trackers is defined and aria.trnt.trackers != None and (aria.trnt.trackers | length) > 0 %}
+bt-tracker={{ aria.trnt.trackers | join(",") }}
+{% endif %}
+
+{% if aria.trnt.dht.enabled %}
+enable-dht=true
+enable-dht6=true
+dht-file-path={{ ansible_user_home.stdout + "/.aria2/dht.dat" }}
+dht-file-path6={{ ansible_user_home.stdout + "/.aria2/dht6.dat" }}
+
+{% if aria.trnt.dht.entrypoint is defined and aria.trnt.dht.entrypoint != None %}
+dht-entry-point={{ aria.trnt.dht.entrypoint }}
+dht-entry-point6={{ aria.trnt.dht.entrypoint }}
+{% endif %}
+
+dht-listen-port={{ aria.trnt.dht.port | string }}
+{% endif %}
+
+{% if aria.trnt.peers.agent is defined and aria.trnt.peers.agent != None %}
+peer-agent={{ aria.trnt.peers.agent }}
+{% endif %}
+
+{% if aria.trnt.peers.prefix is defined and aria.trnt.peers.prefix != None %}
+peer-id-prefix={{ aria.trnt.peers.prefix }}
+{% endif %}
+
+{% if aria.trnt.peers.exchange %}
+enable-peer-exchange=true
+{% else %}
+enable-peer-exchange=false
+{% endif %}
+
+seed-ratio={{ aria.trnt.seeding.ratio | string }}
+seed-time={{ aria.trnt.seeding.time | string }}
+
+max-overall-upload-limit={{ aria.ul.max.overall | string }}
+max-upload-limit={{ aria.ul.max.per_entry | string }}
+
+# METALINK
+{% if aria.meta.follow == "mem" %}
+follow-metalink={{ aria.meta.follow }}
+{% elif aria.meta.follow %}
+follow-metalink=true
+{% else %}
+follow-metalink=false
+{% endif %}
+
+metalink-language={{ aria.meta.lang }}
+
+{% if aria.meta.locs is defined and aria.meta.locs != None and (aria.meta.locs | length) > 0 %}
+metalink-location={{ aria.meta.locs | join(",") }}
+{% endif %}
+
+metalink-preferred-protocol={{ aria.meta.protocol_pref }}
--- a/roles/init-server/templates/user/certbot.env.j2
+++ b/roles/init-server/templates/user/certbot.env.j2
@@ -0,0 +1,14 @@
+CERTBOT_EMAIL="{{ certbot.email }}"
+CERTBOT_AUTHENTICATOR={{ certbot.auth_method }}
+SERVER_WEBROOT_PATH={{ ansible_user_home.stdout + "/srv/acme." + inventory_hostname }}
+{% if compose.mode == "dev" %}
+# @TODO find a better way to have processed the below in Ansible
+CERTBOT_CHALLENGE_DOMAINS={{ certbot.domains | map("regex_replace", "\\.([^\\.]*)$", ".test") | list | join(",") }}
+STAGING=1
+DEBUG=1
+VERBOSE=1
+RUN_ONCE=1
+{% elif compose.mode == "prod" %}
+CERTBOT_CHALLENGE_DOMAINS={{ certbot.domains | join(",") }}
+CRON={{ certbot.cron }}
+{% endif %}
--- a/roles/init-server/templates/user/config/caddy/Caddyfile.j2
+++ b/roles/init-server/templates/user/config/caddy/Caddyfile.j2
@@ -0,0 +1,11 @@
+http://<< inventory_hostname >> {
+	handle /.well-known/acme-challenge/* {
+		reverse_proxy localhost:80
+	}
+}
+
+:80 {
+	root * /srv/<< inventory_hostname >>
+	file_server
+	encode gzip
+}
--- a/roles/init-server/templates/user/config/containers/storage.conf.j2
+++ b/roles/init-server/templates/user/config/containers/storage.conf.j2
@@ -0,0 +1,15 @@
+[storage]
+# Storage driver - use overlay with fuse-overlayfs for rootless
+driver = "overlay"
+
+# Root directory for storage (default: $HOME/.local/share/containers/storage)
+# Uncomment to customize:
+graphroot = "{{ ansible_user_home.stdout }}/volumes"
+
+# Run directory for transient data
+runroot = "/run/user/1000/containers"
+
+[storage.options]
+[storage.options.overlay]
+# Use fuse-overlayfs for rootless overlay support on older kernels
+mount_program = "/usr/bin/fuse-overlayfs"
--- a/roles/init-server/templates/user/config/glance/glance.yml.j2
+++ b/roles/init-server/templates/user/config/glance/glance.yml.j2
@@ -0,0 +1,339 @@
+server:
+  port: {{ glance.port }}
+  {% if glance.proxied %}
+  proxied: true
+  {% endif %}
+  base-url: /
+pages:
+  - name: home
+    head-widgets:
+      - type: search
+        search-engine: {{ glance.search.engine }}
+        bangs:
+          - title: Linux Kernel
+            shortcut: "@linuxkernel"
+            url: "https://www.kernel.org/doc/html/latest/search.html?q={QUERY}"
+          - title: Linux
+            shortcut: "@linux"
+            url: https://cse.google.com/cse?cx=017644269519104757279%3Agm62gtzaoky&q={QUERY}&sa=go
+          - title: Debian
+            shortcut: "@deb"
+            url: https://search.debian.org/cgi-bin/omega?DB=en&P={QUERY}
+          - title: C++
+            shortcut: "@cpp"
+            url: https://learn.microsoft.com/en-us/search/?scope=C%2B%2B&view=msvc-170&terms={QUERY}
+          - title: Rust
+            shortcut: "@rust"
+            url: https://doc.rust-lang.org/book/?search={QUERY}
+          - title: Python
+            shortcut: "@python"
+            url: https://docs.python.org/3/search.html?check_keywords=yes&area=default&q={QUERY}
+          - title: Python Click
+            shortcut: "@pyclick"
+            url: https://click.palletsprojects.com/en/stable/search/?q={QUERY}
+          - title: Ansible
+            shortcut: "@ansible"
+            url: https://docs.ansible.com/projects/ansible/latest/search.html?q={QUERY}&check_keywords=yes&area=default
+          - title: Podman
+            shortcut: "@podman"
+            url: https://docs.podman.io/en/latest/search.html?q={QUERY}
+          - title: Podman Compose
+            shortcut: "@podcompose"
+            url: https://docs.podman.io/en/latest/search.html?q={QUERY}
+          - title: Elixir
+            shortcut: "@elixir"
+            url: https://hexdocs.pm/?packages=elixir%3A1.20.2%2Ceex%3A1.20.2%2Cex_unit%3A1.20.2%2Ciex%3A1.20.2%2Clogger%3A1.20.2%2Cmix%3A1.20.2&q={QUERY}
+          - title: Elixir Phoenix
+            shortcut: "@exphoenix"
+            url: https://hexdocs.pm/?q={QUERY}&packages=plug%3Alatest%2Cphoenix%3Alatest%2Cphoenix_html%3Alatest%2Cphoenix_live_view%3Alatest%2Cphoenix_pubsub%3Alatest%2Cphoenix_template%3Alatest
+          - title: Javascript
+            shortcut: "@js"
+            shortcut: https://javascript.info/search?query={QUERY}
+          - title: MDN
+            shortcut: "@mdn"
+            url: https://developer.mozilla.org/en-US/search?q={QUERY}
+          - title: PHP
+            shortcut: "@php"
+            url: https://www.php.net/search.php#gsc.tab=0&gsc.q={QUERY}&gsc.sort=
+          - title: PostgreSQL
+            shortcut: "@pgsql"
+            url: https://www.postgresql.org/search/?q={QUERY}
+          - title: MySQL
+            shortcut: "@mysql"
+            url: https://dev.mysql.com/doc/search/?q={QUERY}
+          - title: Julia
+            shortcut: "@julia"
+            url: https://docs.julialang.org/en/v1/?q={QUERY}
+          - title: Gitea
+            shortcut: "@gitea"
+            url: https://docs.gitea.com/search/?q={QUERY}
+          - title: Git
+            shortcut: "@git"
+            url: https://git-scm.com/search/results?search={QUERY}&language=en
+          - title: Elixir Phoenix
+            shortcut: "@exphoenix"
+            url: https://hexdocs.pm/?q={QUERY}&packages=plug%3Alatest%2Cphoenix%3Alatest%2Cphoenix_html%3Alatest%2Cphoenix_live_view%3Alatest%2Cphoenix_pubsub%3Alatest%2Cphoenix_template%3Alatest
+          # @TODO add more documentation searches
+      - type: group
+        widgets:
+          - type: clock
+            hour-format: 24h
+            timezones:
+              - timezone: {{ glance.timezone.id}}
+                label: {{ glance.timezone.name }}
+          - type: weather
+            units: metric
+            hour-format: 24h
+            location: {{ glance.weather_loc }}
+    columns:
+      - size: small
+        widgets:
+          - type: calendar
+            first-day-of-week: sunday
+          - type: bookmarks
+            groups:
+              - title: strat
+                links:
+                  - title: The New Oil
+                    url: https://thenewoil.org/en/
+                  - title: Resilient by Design
+                    url: https://theanarchistlibrary.org/library/the-techno-anarchist-resilient-by-design
+              - title: complang dox
+                links:
+                  - name: Raspberry Pi
+                    url: https://www.raspberrypi.com/documentation/
+                  - name: Arduino
+                    url: https://docs.arduino.cc/
+                  - name: NASM x86 Assembly
+                    url: https://www.tutorialspoint.com/assembly_programming/index.htm
+                  - name: WASM
+                    url: https://webassembly.org/docs/faq/
+                  - name: Linux Kernel
+                    url: https://www.kernel.org/doc/html/latest/index.html
+                  - name: Linux
+                    url: https://tldp.org/guides.html
+                  - name: Debian
+                    url: https://www.debian.org/doc/
+                  - name: Zig
+                    url: https://ziglang.org/documentation/
+                  - name: Rust
+                    url: https://doc.rust-lang.org/
+                  - name: Cargo
+                    url: https://doc.rust-lang.org/cargo/
+                  - name: C++
+                    url: https://learn.microsoft.com/en-us/cpp/
+                  - name: vcpkg
+                    url: https://learn.microsoft.com/en-us/vcpkg/
+                  - name: C#
+                    url: https://learn.microsoft.com/en-us/dotnet/csharp/
+                  - name: nuget
+                    url: https://learn.microsoft.com/en-us/nuget/
+                  - name: Python
+                    url: https://docs.python.org/
+                  - name: Python uv
+                    url: https://docs.astral.sh/uv/
+                  - name: Ansible
+                    url: https://docs.ansible.com/projects/ansible/latest/
+                  - name: Podman
+                    url: https://docs.podman.io/en/latest/
+                  - name: Podman Compose
+                    url: https://docs.podman.io/en/latest/markdown/podman-compose.1.html
+                  - name: Erlang
+                    url: https://www.erlang.org/docs.html
+                  - name: Elixir
+                    url: https://elixir-lang.org/docs.html
+                  - name: Hex
+                    url: https://hex.pm/docs/usage
+                  - name: Lua
+                    url: https://www.lua.org/docs.html
+                  - name: LuaRocks
+                    url: https://luarocks.org/docs
+                  - name: GDScript
+                    url: https://docs.godotengine.org/en/latest/tutorials/scripting/gdscript/index.html
+                  - name: Julia
+                    url: https://docs.julialang.org/
+                  - name: NodeJS
+                    url: https://nodejs.org/docs/latest/api/
+                  - name: NPMJS
+                    url: https://docs.npmjs.com/
+                  - name: Go
+                    url: https://go.dev/doc/
+                  - name: CSS
+                    url: https://www.w3.org/Style/CSS/Overview.en.html
+                  - name: HTML
+                    url: https://html.spec.whatwg.org/multipage/
+                  - name: Javascript
+                    url: https://javascript.info/
+                  - name: Javascript DOM
+                    url: https://dom.spec.whatwg.org/
+                  - name: JSON
+                    url: https://www.json.org/json-en.html
+                  - name: Client-Side Web Languages
+                    url: https://developer.mozilla.org/en-US/
+                  - name: PHP
+                    url: https://www.php.net/docs.php
+                  - name: PHP Composer
+                    url: https://getcomposer.org/doc/
+                  - name: SQL
+                    url: https://www.postgresql.org/docs/current/sql.html
+                  - name: SASS
+                    url: https://sass-lang.com/documentation/
+                  - name: YAML
+                    url: https://www.yaml.info/
+                  - name: TOML
+                    url: https://toml.io/en/
+                  - name: ActivityPub
+                    url: https://activitypub.rocks/
+                  - name: SuperCollider
+                    url: https://doc.sccode.org/
+                  - name: CSound
+                    url: https://csound.com/docs/manual/index.html
+                  - name: FAUST
+                    url: https://faustdoc.grame.fr/
+                  - name: regexp
+                    url: https://regexbox.com/cheatsheet
+              - title: warez dox
+                links:
+                  - name: glance
+                    url: https://github.com/glanceapp/glance/tree/main/docs
+                  - name: Nextcloud
+                    url: https://docs.nextcloud.com/
+                  - name: Wireguard
+                    url: https://www.wireguard.com/#conceptual-overview
+                  - name: Headscale
+                    url: https://docs.headscale.org/
+                  - name: Tailscale
+                    url: https://tailscale.com/docs
+                  - name: Gitea
+                    url: https://docs.gitea.com/
+                  - name: OpenGist
+                    url: https://opengist.io/docs/
+                  - name: Caddy
+                    url: https://caddyserver.com/docs/
+                  - name: MySQL
+                    url: https://dev.mysql.com/doc/
+                  - name: Certbot
+                    url: https://eff-certbot.readthedocs.io/en/stable/
+                  - name: git
+                    url: https://git-scm.dev/doc
+              # - title: api
+              # - title: src
+              # - title: warez
+      - size: full
+        widgets:
+          - type: split-column
+            widgets:
+              - type: rss
+                title: technoscience
+                style: detailed-list
+                collapse-after: 5
+                feeds:
+                  - url: https://feeds.arstechnica.com/arstechnica/features
+                    title: arstechnica
+                  - url: https://rss.slashdot.org/Slashdot/slashdotMain
+                    title: slashdot
+                  - url: https://torrentfreak.com/feed/
+                    title: torrentfreak
+                  - url: https://blog.p2pfoundation.net/feed/
+                    title: p2p foundation
+                  - url: https://www.wired.com/feed/category/backchannel/latest/rss
+                    title: wired
+                  - url: https://www.quantamagazine.org/feed/
+                    title: quanta
+                  - url: https://www.sciencedaily.com/rss/matter_energy/telecommunications.xml
+                    title: scidaily - telecomms
+                  - url: https://www.sciencedaily.com/rss/computers_math/quantum_computers.xml
+                    title: scidaily - quancomp
+                  - url: https://www.sciencedaily.com/rss/matter_energy/engineering_and_construction.xml
+                    title: scidaily - engi
+                  - url: https://www.sciencedaily.com/rss/matter_energy/energy_and_resources.xml
+                    title: scidaily - energy & fuel
+                  - url: https://www.sciencedaily.com/rss/earth_climate/energy.xml
+                    title: scidaily - climate change
+                  - url: https://www.sciencedaily.com/rss/earth_climate/global_warming.xml
+                    title: scidaily - global warming
+                  - url: https://www.sciencedaily.com/rss/earth_climate/sustainability.xml
+                    title: scidaily - sustainability
+                  - url: https://www.sciencedaily.com/rss/computers_math/computer_programming.xml
+                    title: scidaily - compprog
+                  - url: https://www.sciencedaily.com/rss/computers_math/information_technology.xml
+                    title: scidaily - infotech
+                  - url: https://phys.org/rss-feed/biology-news/ecology/
+                    title: phys - ecology
+              - type: rss
+                title: politics
+                style: detailed-list
+                collapse-after: 5
+                feeds:
+                  - url: https://www.democracynow.org/democracynow.rss
+                    title: democracy now
+                  - url: https://www.nakedcapitalism.com/feed
+                    title: naked capitalism
+                  - url: https://www.thenews.coop/feed/
+                    title: co-operative news
+                  - url: http://feeds.propublica.org/propublica/main
+                    title: propublica
+                  - url: https://unicornriot.ninja/feed/rss/
+                    title: unicorn riot
+                  - url: https://crimethinc.com/feed
+                    title: crimethinc
+                  - url: https://anarchistnews.org/rss.xml
+                    title: anarchist news
+              - type: rss
+                title: misc
+                style: detailed-list
+                collapse-after: 5
+                feeds:
+                  - url: https://www.radicalphilosophy.com/feed
+                    title: radical philosophy
+                  - url: http://spectrejournal.com/feed/rss
+                    title: spectre
+                  - url: https://nautil.us/feed
+                    title: nautilus
+                  - url: https://theconversation.com/us/home-page/articles.atom
+                    title: the conversation
+                  - url: https://thebaffler.com/latest/feed
+                    title: the baffler
+          - type: videos
+            style: horizontal-cards
+            channels:
+              - UCjEDZ_R_ypSc-MUBRkiW1lw
+              - UCIZ5ZOeiXYbmKTl_85ghNPw
+              - UCdcemy56JtVTrsFIOoqvV8g
+              - UCSkzHxIcfoEr69MWBdo0ppg
+              - UCW6TXMZ5Pq6yL6_k5NZ2e0Q
+              - UC4a-Gbdw7vOaccHmFo40b9g
+              - UCwbyKKmjVdCpWzZZY-WnajA
+              - UCMMBpWfWUd3xlcOxrot_neA
+              - UCJXa3_WNNmIpewOtCHf3B0g
+              - UCmfF7JZv26UUKyRedViGIlw
+              - UCEmQRq5bxIUNGvAWj41AoaA
+              - UCHkYOD-3fZbuGhwsADBd9ZQ
+              - UCHa8J-xnRYOg5VuudfWpBgg
+              - UCJZv4d5rbIKd4QHMPkcABCw
+              - UCZUyPT9DkJWmS_DzdOi7RIA
+              - UChbS_z6KHQiIu9et38O37eQ
+              - UCxX9wt5FWQUAAz4UrysqK9A
+              - UCX6b17PVsYBQ0ip5gyeme-Q
+              - UCk0fGHsCEzGig-rSzkfCjMw
+              - UCYO_jab_esuFRV4b17AJtAw
+              - UChKIQpndVpX1ung-7IkGhzA
+              - UCaM7SQvF5q9sz4NgL16PNRA
+              - UC7pdnrWVj8eDfCI0bRe_0kQ
+              - UCtuXekfqj-paqsxtqVNCC2A
+              - UCgkjg1UbcQZHW40IO1BEt5A
+              - UCGKEMK3s-ZPbjVOIuAV8clQ
+              - UCbiGcwDWZjz05njNPrJU7jA
+              - UC6biysICWOJ-C3P4Tyeggzg
+              - UCbi3ei431gvBpgZ3R-_Wk5Q
+              - UCA5yXa0rDsGaJFOuj6pxw1w
+              - UCDG73pGqESS1XcEVY_0xwWw
+              - UCR2uRTQ53V_egXKFflMMaaw
+              - UCzGUT9PjV3SMBwjWXUYh4HA
+  - name: services
+    columns:
+      - size: full
+        widgets:
+          - type: docker-containers
+            title: status
+            hide-by-default: false
--- a/roles/init-server/templates/user/config/opengist/config.yml.j2
+++ b/roles/init-server/templates/user/config/opengist/config.yml.j2
@@ -0,0 +1,9 @@
+db-uri: {{ gist.db.type + "://" + mysql.users.admin.username + ":" + mysql.users.admin.password + "@localhost:3306/" + mysql.users.admin.databases.opengist.name }}
+{% if mode == "dev" %}
+log-level: debug
+{% else %}
+log-level: info
+{% endif %}
+custom.static-links:
+  - name: Playbooks
+    path: {{ "https://" + gitea.subdomain + "." + web_fqdn + "/admin/skato-ansible" }}
--- a/roles/init-server/templates/user/config/tailscale/conf.json.j2
+++ b/roles/init-server/templates/user/config/tailscale/conf.json.j2
@@ -0,0 +1,39 @@
+{
+  "TCP": {
+<% if mode == "prod" %>
+    "443": {
+      "HTTPS": true
+    }
+<% elif mode == "dev" or tailscale.scheme == "http" %>
+    "80": {
+      "HTTPS": false
+    }
+<% endif %>
+  },
+  "Web": {
+<% if mode == "prod" %>
+    "${TS_CERT_DOMAIN}:443": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://localhost:8080"
+        }
+      }
+    }
+<% elif mode == "dev" or tailscale.scheme == "http" %>
+    "${TS_CERT_DOMAIN}:80": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://localhost:8080"
+        }
+      }
+    }
+<% endif %>
+  },
+  "AllowFunnel": {
+<% if mode == "prod" %>
+    "${TS_CERT_DOMAIN}:443": false
+<% elif mode == "dev" or tailscale.scheme == "http" %>
+    "${TS_CERT_DOMAIN}:80": false
+<% endif %>
+  }
+}
--- a/roles/init-server/templates/user/email.env.j2
+++ b/roles/init-server/templates/user/email.env.j2
@@ -0,0 +1,10 @@
+{% if email.smtp is defined or email.smtp != None %}
+EMAIL_SEND_PROTOCOL=smtp
+EMAIL_SMTP_HOST={{ email.smtp.host }}
+EMAIL_SMTP_PORT={{ email.smtp.port }}
+EMAIL_SMTP_SECURE={{ email.smtp.conn_mode }}
+EMAIL_SMTP_USERNAME={{ email.smtp.username }}
+EMAIL_SMTP_AUTHTYPE={{ email.smtp.auth_meth.upper() }}
+EMAIL_SMTP_USER_ALIAS={{ (email.smtp.alias | split("@"))[0] }}
+EMAIL_SMTP_EMAIL_ALIAS={{ (email.smtp.alias | split("@"))[1] }}
+{% endif %}
--- a/roles/init-server/templates/user/flexget/config.yml.j2
+++ b/roles/init-server/templates/user/flexget/config.yml.j2
@@ -38,7 +38,7 @@ tasks:
  populate_folders:
    {% if download_mode == 'direct' %}
    proxy:
-      https: 'socks5://<< sox.hostname >>:<< sox.port >>'
+      https: 'socks5://<< tor.proxy.hostname >>:<< tor.proxy.port >>'
    {% endif %}
    if:
      - "'batch' in title.lower()": reject
@@ -63,16 +63,19 @@ tasks:
    template: limited_series
    {% if flexget.download_mode == 'aria2' %}
    aria2:
-      server: << aria.hostname >>
-      port: << aria.port >>
-      {% if aria.secret != None or aria.secret is defined %}
-      secret: << aria.secret >>
+      server: << aria.rpc.hostname >>
+      port: << aria.rpc.port >>
+      {% if aria.rpc.secret != None and aria.rpc.secret is defined %}
+      secret: << aria.rpc.secret >>
+      {% elif aria.rpc.credentials != None and aria.rpc.credentials is defined %}
+      username: << aria.rpc.credentials.username >>
+      password: << aria.rpc.credentials.password >>
      {% endif %}
-      {% if aria.credentials != None or aria.credentials is defined %}
-      username: << aria.credentials.username >>
-      password: << aria.credentials.password >>
+      {% if mode == 'prod' %}
+      scheme: << aria.rpc.scheme >>
+      {% else %}
+      scheme: http
      {% endif %}
-      scheme: << aria.scheme >>
      rpc_mode: json
      rpc_path: jsonrpc
      path: '~/downloads/media/vids/{{ series_name }}'
@@ -85,21 +88,25 @@ tasks:
  fap_queue:
    {% if download_mode == 'direct' %}
    proxy:
-      https: 'socks5://<< sox.hostname >>:<< sox.port >>'
+      https: 'socks5://<< tor.proxy.hostname >>:<< tor.proxy.port >>'
    {% endif %}
    template: porn_vids
    {% if flexget.download_mode == 'aria2' %}
    aria2:
-      server: << aria.hostname >>
-      port: << aria.port >>
-      {% if aria.secret != None or aria.secret is defined %}
-      secret: << aria.secret >>
+      server: << aria.rpc.hostname >>
+      port: << aria.rpc.port >>
+      {% if aria.rpc.secret != None and aria.rpc.secret is defined %}
+      secret: << aria.rpc.secret >>
      {% endif %}
-      {% if aria.credentials != None or aria.credentials is defined %}
-      username: << aria.credentials.username >>
-      password: << aria.credentials.password >>
+      {% if aria.rpc.credentials != None and aria.rpc.credentials is defined %}
+      username: << aria.rpc.credentials.username >>
+      password: << aria.rpc.credentials.password >>
+      {% endif %}
+      {% if mode == 'prod' %}
+      scheme: << aria.rpc.scheme >>
+      {% else %}
+      scheme: http
      {% endif %}
-      scheme: << aria.scheme >>
      rpc_mode: json
      rpc_path: jsonrpc
      path: ~/downloads/.xxx/media/vids
@@ -112,21 +119,25 @@ tasks:
  film_queue:
    {% if download_mode == 'direct' %}
    proxy:
-      https: 'socks5://<< sox.hostname >>:<< sox.port >>'
+      https: 'socks5://<< tor.proxy.hostname >>:<< tor.proxy.port >>'
    {% endif %}
    template: feature_films
    {% if flexget.download_mode == 'aria2' %}
    aria2:
-      server: << aria.hostname >>
-      port: << aria.port >>
-      {% if aria.secret != None or aria.secret is defined %}
-      secret: << aria.secret >>
+      server: << aria.rpc.hostname >>
+      port: << aria.rpc.port >>
+      {% if aria.rpc.secret != None or aria.rpc.secret is defined %}
+      secret: << aria.rpc.secret >>
      {% endif %}
-      {% if aria.credentials != None or aria.credentials is defined %}
-      username: << aria.credentials.username >>
-      password: << aria.credentials.password >>
+      {% if aria.rpc.credentials != None or aria.rpc.credentials is defined %}
+      username: << aria.rpc.credentials.username >>
+      password: << aria.rpc.credentials.password >>
+      {% endif %}
+      {% if mode == 'prod' %}
+      scheme: << aria.rpc.scheme >>
+      {% else %}
+      scheme: http
      {% endif %}
-      scheme: << aria.scheme >>
      rpc_mode: json
      rpc_path: jsonrpc
      path: ~/downloads/media/vids
--- a/roles/init-server/templates/user/gitea.env.j2
+++ b/roles/init-server/templates/user/gitea.env.j2
@@ -0,0 +1,17 @@
+GITEA_MODE={{ mode | default("dev") }}
+GITEA_NAME={{ (web_fqdn | split("."))[0].upper() + " Nous" }}
+GITEA_SSH_PORT={{ gitea.ssh.port }}
+GITEA_LANDING={{ gitea.site.landing }}
+GITEA_TRUSTED_PROXIES={{ gitea.trusted.proxies | join(",") }}
+
+{% if gitea.site.registration.enabled %}
+GITEA_PROHIBIT_REGISTRATION=false
+{% else %}
+GITEA_PROHIBIT_REGISTRATION=true
+{% endif %}
+
+GITEA_DB_TYPE={{ gitea.db.type }}
+
+{% if gitea.db.type == "mysql" %}
+GITEA_DB_NAME={{ gitea.db.name }}
+{% endif %}
--- a/roles/init-server/templates/user/journal/blog/_index.md.j2
+++ b/roles/init-server/templates/user/journal/blog/_index.md.j2
@@ -0,0 +1,12 @@
+++
+title = '{{ web_fqdn }}'
+draft = false
+++
+
+![sisyphus-with-boulder](./mythe-sisyphus-klein.png)
+
+## Under Construction
+
+### Err. 503: Service Unavailable
+
+Working on building or migrating the content, layout or theme for this blog.
--- a/roles/init-server/templates/user/journal/notes/index.md.j2
+++ b/roles/init-server/templates/user/journal/notes/index.md.j2
@@ -0,0 +1,11 @@
+---
+title: {{ web_fqdn }}
+---
+
+![sisyphus-with-boulder](./mythe-sisyphus-klein.png)
+
+## Under Construction
+
+### Err. 503: Service Unavailable
+
+Working on building or migrating Obsidian vault entries for this server.
--- a/roles/init-server/templates/user/journal/notes/mythe-sisyphus-klein.png
+++ b/roles/init-server/templates/user/journal/notes/mythe-sisyphus-klein.png
--- a/roles/init-server/templates/user/mysql.env.j2
+++ b/roles/init-server/templates/user/mysql.env.j2
@@ -0,0 +1,3 @@
+MYSQL_DB_HOST=localhost
+MYSQL_DB_USER={{ mysql.users.admin.username }}
+MYSQL_DB_NAME={{ mysql.users.admin.databases.init.name }}
--- a/roles/init-server/templates/user/netrc.j2
+++ b/roles/init-server/templates/user/netrc.j2
@@ -0,0 +1,3 @@
+machine {{ source_code.host }}
+login {{ source_code.user }}
+password {{ source_code.http_password }}
--- a/roles/init-server/templates/user/nextcloud.env.j2
+++ b/roles/init-server/templates/user/nextcloud.env.j2
@@ -0,0 +1,19 @@
+{% if nextcloud.db.type == "mysql" or nextcloud.db.type == "mariadb" %}
+NEXTCLOUD_DB_NAME={{ nextcloud.db.name | default("nextcloud") }}
+{% elif nextcloud.db.type == "sqlite" %}
+SQLITE_DATABASE={{ nextcloud.db.name + ".db" }}
+{% endif %}
+
+{% if not nextcloud.rewrite_ip %}
+NEXTCLOUD_APACHE_DISABLE_REWRITE_IP=1
+{% endif %}
+
+NEXTCLOUD_TRUSTED_PROXIES={{ nextcloud.trusted.proxies | join(" ") }}
+NEXTCLOUD_TRUSTED_FQDNS={{ "cloud." + web_fqdn }}
+{% if compose.mode == "prod" %}
+NEXTCLOUD_URL_REWRITE={{ "https://cloud." + web_fqdn }}
+NEXTCLOUD_PROTOCOL_REWRITE=https
+{% elif compose.mode == "dev" %}
+NEXTCLOUD_URL_REWRITE={{ "http://cloud." + web_fqdn }}
+NEXTCLOUD_PROTOCOL_REWRITE=http
+{% endif %}
--- a/roles/init-server/templates/user/opengist.env.j2
+++ b/roles/init-server/templates/user/opengist.env.j2
@@ -0,0 +1,18 @@
+OG_DB_TYPE={{ gist.db.type }}
+
+{% if gist.db.type == "mysql" %}
+OG_DB_NAME={{ gist.db.name }}
+{% endif %}
+
+OG_SEARCH_DEFAULT={{ gist.search.priority | join(",") }}
+
+{% if ssh is defined and ssh != None %}
+OG_SSH_PORT={{ gist.ssh.port }}
+OG_SSH_GIT_ENABLED=true
+{% else %}
+OG_SSH_GIT_ENABLED=false
+{% endif %}
+
+OG_NAME={{ (web_fqdn | split("."))[0].upper() + " Grimoire" }}
+OG_LOGO=logo.svg
+OG_FAVICON=logo.ico
--- a/roles/init-server/templates/user/redis.env.j2
+++ b/roles/init-server/templates/user/redis.env.j2
@@ -0,0 +1 @@
+REDIS_PARAMS={{ "--requirepass " + redis.password + " --appendonly yes" }}
--- a/roles/init-server/templates/user/vimrc.j2
+++ b/roles/init-server/templates/user/vimrc.j2
@@ -56,7 +56,7 @@ set wildmenu

 " Make wildmenu behave like similar to Bash completion.
 set wildmode=list:longest
-{% if vimrc.typed_paths.ignore is defined or vimrc.typed_paths.ignore != None %}
+{% if vimrc.typed_paths.ignore is defined and vimrc.typed_paths.ignore != None %}

 " There are certain files that we would never want to edit with Vim.
 " Wildmenu will ignore files with these extensions.
				`@@ -0,0 +1 @@`
				`REDIS_PARAMS={{ "--requirepass " + redis.password + " --appendonly yes" }}`