set up tailscale cert resolver with name default

README.md

@@ -1,2 +1,3 @@
 # apps-deployments
 
+This repo contains the docker compose files that I'm using to deploy the apps I self host, accessing them via Tailscale.

audiobookshelf/.env.example

@@ -0,0 +1,3 @@
+TAILSCALE_OAUTH_KEY=
+TAILSCALE_TAGS=
+MEDIA_FOLDER=

audiobookshelf/docker-compose.yml

@@ -0,0 +1,37 @@
+---
+services:
+  ts-audiobookshelf:
+    image: tailscale/tailscale:latest
+    container_name: ts-audiobookshelf
+    hostname: audiobookshelf
+    environment:
+      - TS_AUTHKEY=${TAILSCALE_OAUTH_KEY}
+      - TS_EXTRA_ARGS=--advertise-tags=${TAILSCALE_TAGS}
+      - TS_SERVE_CONFIG=/config/audiobookshelf.json
+      - TS_STATE_DIR=/var/lib/tailscale
+    volumes:
+      - ts-audiobookshelf-state:/var/lib/tailscale
+      - ${PWD}/ts-audiobookshelf/config:/config
+      - /dev/net/tun:/dev/net/tun
+    cap_add:
+      - net_admin
+      - sys_module
+    restart: unless-stopped
+
+  audiobookshelf-front:
+    image: ghcr.io/advplyr/audiobookshelf:latest
+    volumes:
+      - ${MEDIA_FOLDER}/audiobooks:/audiobooks
+      - ${MEDIA_FOLDER}/podcasts:/podcasts
+      - audiobookshelf-config:/config
+      - audiobookshelf-metadata:/metadata
+    environment:
+      - TZ=Europe/Lisbon
+
+volumes:
+  ts-audiobookshelf-state:
+    driver: local
+  audiobookshelf-config:
+    driver: local
+  audiobookshelf-metadata:
+    driver: local

audiobookshelf/ts-audiobookshelf/config/audiobookshelf.json

@@ -0,0 +1,20 @@
+{
+    "TCP": {
+      "443": {
+        "HTTPS": true
+      }
+    },
+    "Web": {
+      "${TS_CERT_DOMAIN}:443": {
+        "Handlers": {
+          "/": {
+            "Proxy": "http://audiobookshelf-front:80"
+          }
+        }
+      }
+    },
+    "AllowFunnel": {
+      "${TS_CERT_DOMAIN}:443": false
+    }
+  }
+  

immich/ts-immich/config/immich.json

@@ -14,7 +14,7 @@
       }
     },
     "AllowFunnel": {
-      "${TS_CERT_DOMAIN}:443": false
+      "${TS_CERT_DOMAIN}:443": true
     }
   }
   

matrix/additional-containers/docker-compose.yml

@@ -20,7 +20,7 @@ services:
     restart: unless-stopped
 
   traefik:
-    image: "traefik:v3.0"
+    image: "traefik:v3.1"
     restart: always
     container_name: "traefik"
     networks:
@@ -51,4 +51,4 @@ networks:
 
 volumes:
   ts-matrix-state:
-    driver: local
+    driver: local

matrix/ansible-playbook-config/example/vars.yml

@@ -0,0 +1,122 @@
+---
+# The bare domain name which represents your Matrix identity.
+# Matrix user ids for your server will be of the form (`@user:<matrix-domain>`).
+#
+# Note: this playbook does not touch the server referenced here.
+# Installation happens on another server ("matrix.<matrix-domain>").
+#
+# If you've deployed using the wrong domain, you'll have to run the Uninstalling step,
+# because you can't change the Domain after deployment.
+#
+# Example value: example.com
+matrix_domain: "{{ vault_matrix_domain }}"
+
+# The Matrix homeserver software to install.
+# See:
+#  - `roles/custom/matrix-base/defaults/main.yml` for valid options
+# - the `docs/configuring-playbook-IMPLEMENTATION_NAME.md` documentation page, if one is available for your implementation choice
+matrix_homeserver_implementation: synapse
+
+# A secret used as a base, for generating various other secrets.
+# You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
+matrix_homeserver_generic_secret_key: "{{ vault_matrix_homeserver_generic_secret_key }}"
+
+# By default, the playbook manages its own Traefik (https://doc.traefik.io/traefik/) reverse-proxy server.
+# It will retrieve SSL certificates for you on-demand and forward requests to all other components.
+# For alternatives, see `docs/configuring-playbook-own-webserver.md`.
+matrix_playbook_reverse_proxy_type: other-traefik-container
+
+# Uncomment and adjust if your Traefik container is on another network
+matrix_playbook_reverse_proxy_container_network: traefik
+
+# Adjust to point to your Traefik container
+matrix_playbook_reverse_proxy_hostname: traefik
+
+devture_traefik_certs_dumper_ssl_dir_path: "/path/to/your/traefiks/acme.json/directory"
+
+# Uncomment and tweak the variable below if the name of your federation entrypoint is different
+# than the default value (matrix-federation).
+# matrix_federation_traefik_entrypoint_name: matrix-federation
+
+# This is something which is provided to Let's Encrypt when retrieving SSL certificates for domains.
+#
+# In case SSL renewal fails at some point, you'll also get an email notification there.
+#
+# If you decide to use another method for managing SSL certificates (different than the default Let's Encrypt),
+# you won't be required to define this variable (see `docs/configuring-playbook-ssl-certificates.md`).
+#
+# Example value: someone@example.com
+devture_traefik_config_certificatesResolvers_acme_email: ''
+# Defined in the separate traefik container
+devture_traefik_certResolver_primary: default
+
+# A Postgres password to use for the superuser Postgres user (called `matrix` by default).
+#
+# The playbook creates additional Postgres users and databases (one for each enabled service)
+# using this superuser account.
+devture_postgres_connection_password: "{{ vault_devture_postgres_connection_password }}"
+
+# By default, we configure Coturn's external IP address using the value specified for `ansible_host` in your `inventory/hosts` file.
+# If this value is an external IP address, you can skip this section.
+#
+# If `ansible_host` is not the server's external IP address, you have 2 choices:
+# 1. Uncomment the line below, to allow IP address auto-detection to happen (more on this below)
+# 2. Uncomment and adjust the line below to specify an IP address manually
+#
+# By default, auto-detection will be attempted using the `https://ifconfig.co/json` API.
+# Default values for this are specified in `matrix_coturn_turn_external_ip_address_auto_detection_*` variables in the Coturn role
+# (see `roles/custom/matrix-coturn/defaults/main.yml`).
+#
+# If your server has multiple IP addresses, you may define them in another variable which allows a list of addresses.
+# Example: `matrix_coturn_turn_external_ip_addresses: ['1.2.3.4', '4.5.6.7']`
+#
+# matrix_coturn_turn_external_ip_address: ''
+
+# No coturn needed for my own personal server
+matrix_coturn_enabled: false
+
+# No need for a client (and this way no issue with the domain)
+matrix_client_element_enabled: false
+
+# Handle users with synapse admin
+matrix_synapse_admin_enabled: true
+
+# Use Keycloak authentication
+matrix_synapse_oidc_enabled: true
+
+matrix_synapse_oidc_providers:
+  - idp_id: keycloak
+    idp_name: "KeyCloak"
+    issuer: "{{ vault_issuer }}"
+    client_id: "Matrix"
+    client_secret: "{{ vault_synapse_keycloak }}"
+    scopes: ["openid", "profile"]
+    user_mapping_provider:
+      config:
+        localpart_template: "{% raw %}{{ user.preferred_username }}{% endraw %}"
+        display_name_template: "{% raw %}{{ user.name }}{% endraw %}"
+        email_template: "{% raw %}{{ user.email }}{% endraw %}"
+    allow_existing_users: true # Optional
+    backchannel_logout_enabled: true # Optional
+
+# Bridges
+
+# Enable double puppeting for all bridges
+matrix_appservice_double_puppet_enabled: true
+
+matrix_synapse_ext_password_provider_shared_secret_auth_enabled: true
+matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret: "{{ vault_matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret }}"
+
+matrix_mautrix_whatsapp_enabled: true
+
+matrix_mautrix_telegram_enabled: true
+matrix_mautrix_telegram_api_id: "{{ vault_matrix_mautrix_telegram_api_id }}"
+matrix_mautrix_telegram_api_hash: "{{ vault_matrix_mautrix_telegram_api_hash }}"
+
+matrix_mautrix_signal_enabled: true
+matrix_mautrix_signal_configuration_extension_yaml: "{{ vault_matrix_mautrix_signal_configuration_extension_yaml }}"
+
+matrix_mautrix_slack_enabled: true
+
+matrix_mautrix_discord_enabled: true
+matrix_mautrix_discord_configuration_extension_yaml: "{{ vault_matrix_mautrix_discord_configuration_extension_yaml }}"

matrix/ansible-playbook-config/inventory/host_vars/matrix.yourdomain/vars.yml

@@ -106,9 +106,13 @@ matrix_mautrix_telegram_api_hash: "{{ vault_matrix_mautrix_telegram_api_hash }}"
 
 matrix_mautrix_signal_enabled: true
 
-matrix_appservice_slack_enabled: true
+matrix_appservice_slack_enabled: false
 matrix_appservice_slack_control_room_id: "{{ vault_matrix_appservice_slack_control_room_id }}"
 matrix_appservice_slack_puppeting_enabled: true
 matrix_appservice_slack_puppeting_slackapp_client_id: "{{ vault_matrix_appservice_slack_puppeting_slackapp_client_id }}"
 matrix_appservice_slack_puppeting_slackapp_client_secret: "{{ vault_matrix_appservice_slack_puppeting_slackapp_client_secret }}"
-matrix_appservice_slack_team_sync_enabled: true
+matrix_appservice_slack_team_sync_enabled: true
+
+matrix_mautrix_slack_enabled: true
+
+matrix_mautrix_discord_enabled: true