init stacks

2026-03-21 14:12:55 +01:00
commit d3e8da2e25
1919 changed files with 200787 additions and 0 deletions
@@ -0,0 +1 @@
+18_openclaw/config/agents/
@@ -0,0 +1,35 @@
+services:
+  adguardhome:
+    image: adguard/adguardhome:latest
+    restart: unless-stopped
+
+    ports:
+      - 53:53/udp
+      - 53:53/tcp
+      - 853:853
+
+    volumes:
+      - /home/docker/DenNamer/conf:/opt/adguardhome/conf
+      - /home/docker/DenNamer/work:/opt/adguardhome/work
+
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.10
+
+    labels:
+      - traefik.enable=true
+
+      # Router HTTPS
+      - traefik.http.routers.adguard.rule=Host(`guard.luckyden.org`)
+      - traefik.http.routers.adguard.entrypoints=websecure
+      - traefik.http.routers.adguard.tls.certresolver=cloudflare
+
+      # Service → port interne AdGuard
+      - traefik.http.services.adguard.loadbalancer.server.port=80
+
+      # Optionnel mais recommandé
+      - traefik.http.middlewares.adguard-headers.headers.customrequestheaders.X-Forwarded-Proto=https
+
+networks:
+  tan-network:
+    external: true
@@ -0,0 +1,22 @@
+services:
+
+  npm:
+    image: 'jc21/nginx-proxy-manager:latest'
+    restart: unless-stopped
+    ports:
+      - "8080:80"
+      - "8180:81"
+      - "4443:443"
+    environment:
+      DB_SQLITE_FILE: "/data/database.sqlite"
+    volumes:
+      - /home/docker/DenFury/data:/data
+      - /home/docker/DenFury/letsencrypt:/etc/letsencrypt
+      - /home/docker/DenFury/logs:/var/log/nginx
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.2
+
+networks:
+  tan-network:
+    external: true
@@ -0,0 +1,2 @@
+ADM_EMAIL=[email protected]
+CF_DNS_API_TOKEN=cfat_LJUOrlKgDJFmELY25VnrlQzrpqm9bpYhUTJyqQBy69400a1f
@@ -0,0 +1,44 @@
+services:
+  traefik:
+    image: traefik:latest
+    restart: unless-stopped
+
+    command:
+      - --api.dashboard=true
+      - --api.insecure=true
+
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+
+      - --entrypoints.web.address=:80
+      - --entrypoints.websecure.address=:443
+
+      - --certificatesresolvers.cloudflare.acme.dnschallenge=true
+      - --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
+      - --certificatesresolvers.cloudflare.acme.email=${ADM_EMAIL}
+      - --certificatesresolvers.cloudflare.acme.storage=/letsencrypt/acme.json
+
+      - --entrypoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22
+      - --entrypoints.websecure.forwardedHeaders.insecure=true
+ 
+    ports:
+      - 80:80
+      - 443:443
+
+    environment:
+      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
+
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /home/docker/DenRoute/letsencrypt:/letsencrypt
+
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.20
+      nextcloud-aio:
+
+networks:
+  tan-network:
+    external: true
+  nextcloud-aio:
+    external: true
@@ -0,0 +1,14 @@
+DENACCESS_POSTGRES_DB=authentik-luckyden-db
+DENACCESS_POSTGRES_USER=authentik-luckyden-admin
+DENACCESS_POSTGRES_PASSWORD=6OCBfxO4mL!8
+DENACCESS_AUTHENTIK_SECRET_KEY=qliGSpJEuJgEFSszeQgUVaEhVqISKbVZyWzmFzpmHGqWX0A1GkrBoL4ttkmRQ
+DENACCESS_AUTHENTIK_HOST=https://access.luckyden.org/
+
+AUTHENTIK_EMAIL__HOST=smtp.gmail.com
+AUTHENTIK_EMAIL__PORT=465
+AUTHENTIK_EMAIL__USERNAME=[email protected]
+AUTHENTIK_EMAIL__PASSWORD=hlbf dfyx geny iqjb
+AUTHENTIK_EMAIL__USE_TLS=false
+AUTHENTIK_EMAIL__USE_SSL=true
+AUTHENTIK_EMAIL__TIMEOUT=10
+AUTHENTIK_EMAIL__FROM=[email protected]
@@ -0,0 +1,141 @@
+services:
+  postgresql:
+    image: docker.io/library/postgres:16-alpine
+    restart: unless-stopped
+
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - pg_isready -d $${DENACCESS_POSTGRES_DB} -U $${DENACCESS_POSTGRES_USER}
+      start_period: 20s
+      interval: 30s
+      retries: 5
+      timeout: 5s
+
+    volumes:
+      - /home/docker/DenAccess/database:/var/lib/postgresql/data
+
+    environment:
+      - POSTGRES_PASSWORD=${DENACCESS_POSTGRES_PASSWORD}
+      - POSTGRES_USER=${DENACCESS_POSTGRES_USER}
+      - POSTGRES_DB=${DENACCESS_POSTGRES_DB}
+
+    env_file:
+      - .env
+
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.30
+
+
+  redis:
+    image: docker.io/library/redis:alpine
+    command: --save 60 1 --loglevel warning
+    restart: unless-stopped
+
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - redis-cli ping | grep PONG
+      start_period: 20s
+      interval: 30s
+      retries: 5
+      timeout: 3s
+
+    volumes:
+      - /home/docker/DenAccess/redis:/data
+
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.31
+
+
+  server:
+    image: ghcr.io/goauthentik/server:2025.10.2
+    restart: unless-stopped
+    command: server
+
+    environment:
+      - AUTHENTIK_REDIS__HOST=redis
+      - AUTHENTIK_POSTGRESQL__HOST=postgresql
+      - AUTHENTIK_POSTGRESQL__USER=${DENACCESS_POSTGRES_USER}
+      - AUTHENTIK_POSTGRESQL__NAME=${DENACCESS_POSTGRES_DB}
+      - AUTHENTIK_POSTGRESQL__PASSWORD=${DENACCESS_POSTGRES_PASSWORD}
+      - AUTHENTIK_ERROR_REPORTING__ENABLED=true
+      - AUTHENTIK_SECRET_KEY=${DENACCESS_AUTHENTIK_SECRET_KEY}
+      - AUTHENTIK_HOST=${DENACCESS_AUTHENTIK_HOST}
+      - AUTHENTIK_INSECURE=false
+      - AUTHENTIK_COOKIE__SECURE=true
+      - AUTHENTIK_SESSION__COOKIE_SECURE=true
+      - TRUSTED_PROXIES=10.10.0.20
+
+    volumes:
+      - /home/docker/DenAccess/media:/media
+      - /home/docker/DenAccess/custom-templates:/templates
+
+    env_file:
+      - .env
+
+    depends_on:
+      - postgresql
+      - redis
+
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.32
+
+    labels:
+      - traefik.enable=true
+
+      # ROUTER
+      - traefik.http.routers.authentik.rule=Host(`access.luckyden.org`)
+      - traefik.http.routers.authentik.entrypoints=websecure
+      - traefik.http.routers.authentik.tls=true
+
+      # SERVICE (HTTP interne uniquement !)
+      - traefik.http.services.authentik.loadbalancer.server.port=9000
+
+      # HEADERS IMPORTANT (auth flows)
+      - traefik.http.middlewares.authentik-headers.headers.customrequestheaders.X-Forwarded-Proto=https
+      - traefik.http.routers.authentik.middlewares=authentik-headers
+
+
+  worker:
+    image: ghcr.io/goauthentik/server:2025.10.2
+    restart: unless-stopped
+    command: worker
+
+    environment:
+      - AUTHENTIK_REDIS__HOST=redis
+      - AUTHENTIK_POSTGRESQL__HOST=postgresql
+      - AUTHENTIK_POSTGRESQL__USER=${DENACCESS_POSTGRES_USER}
+      - AUTHENTIK_POSTGRESQL__NAME=${DENACCESS_POSTGRES_DB}
+      - AUTHENTIK_POSTGRESQL__PASSWORD=${DENACCESS_POSTGRES_PASSWORD}
+      - AUTHENTIK_ERROR_REPORTING__ENABLED=true
+      - AUTHENTIK_SECRET_KEY=${DENACCESS_AUTHENTIK_SECRET_KEY}
+      - AUTHENTIK_HOST=${DENACCESS_AUTHENTIK_HOST}
+      - AUTHENTIK_INSECURE=false
+
+    user: root
+
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /home/docker/DenAccess/media:/media
+      - /home/docker/DenAccess/certs:/certs
+      - /home/docker/DenAccess/custom-templates:/templates
+
+    env_file:
+      - .env
+
+    depends_on:
+      - postgresql
+      - redis
+
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.33
+
+
+networks:
+  tan-network:
+    external: true
@@ -0,0 +1,17 @@
+DENHUB_ENC_KEY=e25536f36d47d0443f04b6d9ee1d63dcda684e70960b1f0a650b24a0c8809a69
+DENHUB_URL=https://dashboard.luckyden.org
+      
+TURBODEN_APP_KEY=base64:YJHR04kuQ/siVg24Cq0GwlXm0y1Ii0KIXua6dQzYM7c=
+TURBODEN_MAIL_USERNAME=[email protected]
+TURBODEN_MAIL_PASSWORD=hlbf dfyx geny iqjb
+TURBODEN_MAIL_FROM_ADDRESS=[email protected]
+TURBODEN_MAIL_FROM_NAME=TurboDen
+TURBODEN_SPEEDTEST_SERVERS=32565
+
+DIPDEN_POSTGRES_DB=guacamole_db
+DIPDEN_POSTGRES_USER=guacamole_user
+DIPDEN_POSTGRES_PASSWORD=db#tan2023
+DIPDEN_POSTGRESQL_HOST=guacamole_db
+DIPDEN_POSTGRESQL_DATABASE=guacamole_db
+DIPDEN_POSTGRESQL_USERNAME=guacamole_user
+DIPDEN_POSTGRESQL_PASSWORD=db#tan2023
@@ -0,0 +1,164 @@
+services:
+
+  dash:
+    restart: unless-stopped
+    image: mauricenino/dashdot:latest
+    privileged: true
+    environment:
+      - DASHDOT_PORT=3002
+      - DASHDOT_WIDGET_LIST=os,cpu,storage,ram,network
+      - DASHDOT_PAGE_TITLE=EyeDen
+      - DASHDOT_ALWAYS_SHOW_PERCENTAGES=true
+      - DASHDOT_ENABLE_CPU_TEMPS=true
+      - DASHDOT_SHOW_HOST=true
+      - DASHDOT_FS_VIRTUAL_MOUNTS=//192.168.0.6/docker
+      - TZ=Europe/Paris
+      - TRUSTED_PROXIES=10.10.0.20
+    volumes:
+      - /:/mnt/host:ro
+    devices:
+      - /dev/dri:/dev/dri
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.41
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.dash.rule=Host(`dash.luckyden.org`)
+      - traefik.http.routers.dash.entrypoints=websecure
+      - traefik.http.routers.dash.tls.certresolver=cloudflare
+      - traefik.http.services.dash.loadbalancer.server.port=3002
+
+  homarr:
+    restart: unless-stopped
+    image: ghcr.io/homarr-labs/homarr:latest
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /home/docker/DenHub/homarr/data:/appdata
+    environment:
+      - SECRET_ENCRYPTION_KEY=${DENHUB_ENC_KEY}
+      - BASE_URL=${DENHUB_URL}
+      - TRUSTED_PROXIES=10.10.0.20
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.42
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.homarr.rule=Host(`dashboard.luckyden.org`)
+      - traefik.http.routers.homarr.entrypoints=websecure
+      - traefik.http.routers.homarr.tls.certresolver=cloudflare
+      - traefik.http.services.homarr.loadbalancer.server.port=7575
+
+  uptime-kuma:
+    restart: unless-stopped
+    image: louislam/uptime-kuma:2
+    volumes:
+      - /home/docker//DenBear/data:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.43
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.kuma.rule=Host(`kuma.luckyden.org`)
+      - traefik.http.routers.kuma.entrypoints=websecure
+      - traefik.http.routers.kuma.tls.certresolver=cloudflare
+      - traefik.http.services.kuma.loadbalancer.server.port=3001
+
+  guacamole_db:
+    restart: unless-stopped
+    image: postgres:17
+    volumes:
+      - /home/docker/DipDen/init:/docker-entrypoint-initdb.d:ro
+      - /home/docker/DipDen/guacamole_db:/var/lib/postgresql/data:rw
+    environment:
+      - POSTGRES_DB=${DIPDEN_POSTGRES_DB}
+      - POSTGRES_USER=${DIPDEN_POSTGRES_USER}
+      - POSTGRES_PASSWORD=${DIPDEN_POSTGRES_PASSWORD}
+    env_file:
+      - .env
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.44
+
+  guacd:
+    restart: unless-stopped
+    image: guacamole/guacd:latest
+    volumes:
+      - /home/docker/DipDen/guacd_drive:/drive:rw
+      - /home/docker/DipDen/guacd_record:/record:rw
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.45
+
+  guacamole:
+    restart: unless-stopped
+    hostname: DipDen
+    image: guacamole/guacamole:latest
+    volumes:
+      - /home/docker/DipDen/guacamole_home:/etc/guacamole
+    environment:
+      - GUACD_HOSTNAME=guacd
+      - GUACAMOLE_HOME=/etc/guacamole
+      - POSTGRESQL_HOST=${DIPDEN_POSTGRESQL_HOST}
+      - POSTGRESQL_DATABASE=${DIPDEN_POSTGRESQL_DATABASE}
+      - POSTGRESQL_USERNAME=${DIPDEN_POSTGRESQL_USERNAME}
+      - POSTGRESQL_PASSWORD=${DIPDEN_POSTGRESQL_PASSWORD}
+      - POSTGRESQL_AUTO_CREATE_ACCOUNTS=true
+      - REMOTE_IP_VALVE_ENABLED=true
+      - TRUSTED_PROXIES=10.10.0.20
+    env_file:
+      - .env
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.46
+    depends_on:
+      - guacamole_db
+      - guacd
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.guac.rule=Host(`guaca.luckyden.org`)
+      - traefik.http.routers.guac.entrypoints=websecure
+      - traefik.http.routers.guac.tls.certresolver=cloudflare
+      - traefik.http.services.guac.loadbalancer.server.port=8080
+
+  speedtest:
+    restart: unless-stopped
+    image: lscr.io/linuxserver/speedtest-tracker:latest
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - APP_NAME=TurboDen
+      - APP_TIMEZONE=Europe/Paris
+      - DISPLAY_TIMEZONE=Europe/Paris
+      - APP_KEY=${TURBODEN_APP_KEY}
+      - DB_CONNECTION=sqlite
+      - SPEEDTEST_SCHEDULE=0,30 * * * *
+      - SPEEDTEST_SERVERS=${TURBODEN_SPEEDTEST_SERVERS}
+      - PRUNE_RESULTS_OLDER_THAN=7
+      - TZ=Europe/Paris
+      - MAIL_MAILER=smtp
+      - MAIL_HOST=smtp.gmail.com
+      - MAIL_PORT=465
+      - MAIL_USERNAME=${TURBODEN_MAIL_USERNAME}
+      - MAIL_PASSWORD=${TURBODEN_MAIL_PASSWORD}
+      - MAIL_ENCRYPTION=tls
+      - MAIL_FROM_ADDRESS=${TURBODEN_MAIL_FROM_ADDRESS}
+      - MAIL_FROM_NAME=${TURBODEN_MAIL_FROM_NAME}
+      - TRUSTED_PROXIES=10.10.0.20
+    env_file:
+      - .env
+    volumes:
+      - /home/docker/TurboDen/config:/config
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.47
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.speedtest.rule=Host(`speed.luckyden.org`)
+      - traefik.http.routers.speedtest.entrypoints=websecure
+      - traefik.http.routers.speedtest.tls.certresolver=cloudflare
+      - traefik.http.services.speedtest.loadbalancer.server.port=80
+
+networks:
+  tan-network:
+    external: true
@@ -0,0 +1,666 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+--
+
+--
+-- Table of connection groups. Each connection group has a name.
+--
+
+CREATE TABLE `guacamole_connection_group` (
+
+  `connection_group_id`   int(11)      NOT NULL AUTO_INCREMENT,
+  `parent_id`             int(11),
+  `connection_group_name` varchar(128) NOT NULL,
+  `type`                  enum('ORGANIZATIONAL',
+                               'BALANCING') NOT NULL DEFAULT 'ORGANIZATIONAL',
+
+  -- Concurrency limits
+  `max_connections`          int(11),
+  `max_connections_per_user` int(11),
+  `enable_session_affinity`  boolean NOT NULL DEFAULT 0,
+
+  PRIMARY KEY (`connection_group_id`),
+  UNIQUE KEY `connection_group_name_parent` (`connection_group_name`, `parent_id`),
+
+  CONSTRAINT `guacamole_connection_group_ibfk_1`
+    FOREIGN KEY (`parent_id`)
+    REFERENCES `guacamole_connection_group` (`connection_group_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of connections. Each connection has a name, protocol, and
+-- associated set of parameters.
+-- A connection may belong to a connection group.
+--
+
+CREATE TABLE `guacamole_connection` (
+
+  `connection_id`       int(11)      NOT NULL AUTO_INCREMENT,
+  `connection_name`     varchar(128) NOT NULL,
+  `parent_id`           int(11),
+  `protocol`            varchar(32)  NOT NULL,
+  
+  -- Guacamole proxy (guacd) overrides
+  `proxy_port`              integer,
+  `proxy_hostname`          varchar(512),
+  `proxy_encryption_method` enum('NONE', 'SSL'),
+
+  -- Concurrency limits
+  `max_connections`          int(11),
+  `max_connections_per_user` int(11),
+  
+  -- Load-balancing behavior
+  `connection_weight`        int(11),
+  `failover_only`            boolean NOT NULL DEFAULT 0,
+
+  PRIMARY KEY (`connection_id`),
+  UNIQUE KEY `connection_name_parent` (`connection_name`, `parent_id`),
+
+  CONSTRAINT `guacamole_connection_ibfk_1`
+    FOREIGN KEY (`parent_id`)
+    REFERENCES `guacamole_connection_group` (`connection_group_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of base entities which may each be either a user or user group. Other
+-- tables which represent qualities shared by both users and groups will point
+-- to guacamole_entity, while tables which represent qualities specific to
+-- users or groups will point to guacamole_user or guacamole_user_group.
+--
+
+CREATE TABLE `guacamole_entity` (
+
+  `entity_id`     int(11)            NOT NULL AUTO_INCREMENT,
+  `name`          varchar(128)       NOT NULL,
+  `type`          enum('USER',
+                       'USER_GROUP') NOT NULL,
+
+  PRIMARY KEY (`entity_id`),
+  UNIQUE KEY `guacamole_entity_name_scope` (`type`, `name`)
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of users. Each user has a unique username and a hashed password
+-- with corresponding salt. Although the authentication system will always set
+-- salted passwords, other systems may set unsalted passwords by simply not
+-- providing the salt.
+--
+
+CREATE TABLE `guacamole_user` (
+
+  `user_id`       int(11)      NOT NULL AUTO_INCREMENT,
+  `entity_id`     int(11)      NOT NULL,
+
+  -- Optionally-salted password
+  `password_hash` binary(32)   NOT NULL,
+  `password_salt` binary(32),
+  `password_date` datetime     NOT NULL,
+
+  -- Account disabled/expired status
+  `disabled`      boolean      NOT NULL DEFAULT 0,
+  `expired`       boolean      NOT NULL DEFAULT 0,
+
+  -- Time-based access restriction
+  `access_window_start`    TIME,
+  `access_window_end`      TIME,
+
+  -- Date-based access restriction
+  `valid_from`  DATE,
+  `valid_until` DATE,
+
+  -- Timezone used for all date/time comparisons and interpretation
+  `timezone` VARCHAR(64),
+
+  -- Profile information
+  `full_name`           VARCHAR(256),
+  `email_address`       VARCHAR(256),
+  `organization`        VARCHAR(256),
+  `organizational_role` VARCHAR(256),
+
+  PRIMARY KEY (`user_id`),
+
+  UNIQUE KEY `guacamole_user_single_entity` (`entity_id`),
+
+  CONSTRAINT `guacamole_user_entity`
+    FOREIGN KEY (`entity_id`)
+    REFERENCES `guacamole_entity` (`entity_id`)
+    ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of user groups. Each user group may have an arbitrary set of member
+-- users and member groups, with those members inheriting the permissions
+-- granted to that group.
+--
+
+CREATE TABLE `guacamole_user_group` (
+
+  `user_group_id` int(11)      NOT NULL AUTO_INCREMENT,
+  `entity_id`     int(11)      NOT NULL,
+
+  -- Group disabled status
+  `disabled`      boolean      NOT NULL DEFAULT 0,
+
+  PRIMARY KEY (`user_group_id`),
+
+  UNIQUE KEY `guacamole_user_group_single_entity` (`entity_id`),
+
+  CONSTRAINT `guacamole_user_group_entity`
+    FOREIGN KEY (`entity_id`)
+    REFERENCES `guacamole_entity` (`entity_id`)
+    ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of users which are members of given user groups.
+--
+
+CREATE TABLE `guacamole_user_group_member` (
+
+  `user_group_id`    int(11)     NOT NULL,
+  `member_entity_id` int(11)     NOT NULL,
+
+  PRIMARY KEY (`user_group_id`, `member_entity_id`),
+
+  -- Parent must be a user group
+  CONSTRAINT `guacamole_user_group_member_parent_id`
+    FOREIGN KEY (`user_group_id`)
+    REFERENCES `guacamole_user_group` (`user_group_id`) ON DELETE CASCADE,
+
+  -- Member may be either a user or a user group (any entity)
+  CONSTRAINT `guacamole_user_group_member_entity_id`
+    FOREIGN KEY (`member_entity_id`)
+    REFERENCES `guacamole_entity` (`entity_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of sharing profiles. Each sharing profile has a name, associated set
+-- of parameters, and a primary connection. The primary connection is the
+-- connection that the sharing profile shares, and the parameters dictate the
+-- restrictions/features which apply to the user joining the connection via the
+-- sharing profile.
+--
+
+CREATE TABLE guacamole_sharing_profile (
+
+  `sharing_profile_id`    int(11)      NOT NULL AUTO_INCREMENT,
+  `sharing_profile_name`  varchar(128) NOT NULL,
+  `primary_connection_id` int(11)      NOT NULL,
+
+  PRIMARY KEY (`sharing_profile_id`),
+  UNIQUE KEY `sharing_profile_name_primary` (sharing_profile_name, primary_connection_id),
+
+  CONSTRAINT `guacamole_sharing_profile_ibfk_1`
+    FOREIGN KEY (`primary_connection_id`)
+    REFERENCES `guacamole_connection` (`connection_id`)
+    ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of connection parameters. Each parameter is simply a name/value pair
+-- associated with a connection.
+--
+
+CREATE TABLE `guacamole_connection_parameter` (
+
+  `connection_id`   int(11)       NOT NULL,
+  `parameter_name`  varchar(128)  NOT NULL,
+  `parameter_value` varchar(4096) NOT NULL,
+
+  PRIMARY KEY (`connection_id`,`parameter_name`),
+
+  CONSTRAINT `guacamole_connection_parameter_ibfk_1`
+    FOREIGN KEY (`connection_id`)
+    REFERENCES `guacamole_connection` (`connection_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of sharing profile parameters. Each parameter is simply
+-- name/value pair associated with a sharing profile. These parameters dictate
+-- the restrictions/features which apply to the user joining the associated
+-- connection via the sharing profile.
+--
+
+CREATE TABLE guacamole_sharing_profile_parameter (
+
+  `sharing_profile_id` integer       NOT NULL,
+  `parameter_name`     varchar(128)  NOT NULL,
+  `parameter_value`    varchar(4096) NOT NULL,
+
+  PRIMARY KEY (`sharing_profile_id`, `parameter_name`),
+
+  CONSTRAINT `guacamole_sharing_profile_parameter_ibfk_1`
+    FOREIGN KEY (`sharing_profile_id`)
+    REFERENCES `guacamole_sharing_profile` (`sharing_profile_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of arbitrary user attributes. Each attribute is simply a name/value
+-- pair associated with a user. Arbitrary attributes are defined by other
+-- extensions. Attributes defined by this extension will be mapped to
+-- properly-typed columns of a specific table.
+--
+
+CREATE TABLE guacamole_user_attribute (
+
+  `user_id`         int(11)       NOT NULL,
+  `attribute_name`  varchar(128)  NOT NULL,
+  `attribute_value` varchar(4096) NOT NULL,
+
+  PRIMARY KEY (user_id, attribute_name),
+  KEY `user_id` (`user_id`),
+
+  CONSTRAINT guacamole_user_attribute_ibfk_1
+    FOREIGN KEY (user_id)
+    REFERENCES guacamole_user (user_id) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of arbitrary user group attributes. Each attribute is simply a
+-- name/value pair associated with a user group. Arbitrary attributes are
+-- defined by other extensions. Attributes defined by this extension will be
+-- mapped to properly-typed columns of a specific table.
+--
+
+CREATE TABLE guacamole_user_group_attribute (
+
+  `user_group_id`   int(11)       NOT NULL,
+  `attribute_name`  varchar(128)  NOT NULL,
+  `attribute_value` varchar(4096) NOT NULL,
+
+  PRIMARY KEY (`user_group_id`, `attribute_name`),
+  KEY `user_group_id` (`user_group_id`),
+
+  CONSTRAINT `guacamole_user_group_attribute_ibfk_1`
+    FOREIGN KEY (`user_group_id`)
+    REFERENCES `guacamole_user_group` (`user_group_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of arbitrary connection attributes. Each attribute is simply a
+-- name/value pair associated with a connection. Arbitrary attributes are
+-- defined by other extensions. Attributes defined by this extension will be
+-- mapped to properly-typed columns of a specific table.
+--
+
+CREATE TABLE guacamole_connection_attribute (
+
+  `connection_id`   int(11)       NOT NULL,
+  `attribute_name`  varchar(128)  NOT NULL,
+  `attribute_value` varchar(4096) NOT NULL,
+
+  PRIMARY KEY (connection_id, attribute_name),
+  KEY `connection_id` (`connection_id`),
+
+  CONSTRAINT guacamole_connection_attribute_ibfk_1
+    FOREIGN KEY (connection_id)
+    REFERENCES guacamole_connection (connection_id) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of arbitrary connection group attributes. Each attribute is simply a
+-- name/value pair associated with a connection group. Arbitrary attributes are
+-- defined by other extensions. Attributes defined by this extension will be
+-- mapped to properly-typed columns of a specific table.
+--
+
+CREATE TABLE guacamole_connection_group_attribute (
+
+  `connection_group_id` int(11)       NOT NULL,
+  `attribute_name`      varchar(128)  NOT NULL,
+  `attribute_value`     varchar(4096) NOT NULL,
+
+  PRIMARY KEY (connection_group_id, attribute_name),
+  KEY `connection_group_id` (`connection_group_id`),
+
+  CONSTRAINT guacamole_connection_group_attribute_ibfk_1
+    FOREIGN KEY (connection_group_id)
+    REFERENCES guacamole_connection_group (connection_group_id) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of arbitrary sharing profile attributes. Each attribute is simply a
+-- name/value pair associated with a sharing profile. Arbitrary attributes are
+-- defined by other extensions. Attributes defined by this extension will be
+-- mapped to properly-typed columns of a specific table.
+--
+
+CREATE TABLE guacamole_sharing_profile_attribute (
+
+  `sharing_profile_id` int(11)       NOT NULL,
+  `attribute_name`     varchar(128)  NOT NULL,
+  `attribute_value`    varchar(4096) NOT NULL,
+
+  PRIMARY KEY (sharing_profile_id, attribute_name),
+  KEY `sharing_profile_id` (`sharing_profile_id`),
+
+  CONSTRAINT guacamole_sharing_profile_attribute_ibfk_1
+    FOREIGN KEY (sharing_profile_id)
+    REFERENCES guacamole_sharing_profile (sharing_profile_id) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of connection permissions. Each connection permission grants a user or
+-- user group specific access to a connection.
+--
+
+CREATE TABLE `guacamole_connection_permission` (
+
+  `entity_id`     int(11) NOT NULL,
+  `connection_id` int(11) NOT NULL,
+  `permission`    enum('READ',
+                       'UPDATE',
+                       'DELETE',
+                       'ADMINISTER') NOT NULL,
+
+  PRIMARY KEY (`entity_id`,`connection_id`,`permission`),
+
+  CONSTRAINT `guacamole_connection_permission_ibfk_1`
+    FOREIGN KEY (`connection_id`)
+    REFERENCES `guacamole_connection` (`connection_id`) ON DELETE CASCADE,
+
+  CONSTRAINT `guacamole_connection_permission_entity`
+    FOREIGN KEY (`entity_id`)
+    REFERENCES `guacamole_entity` (`entity_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of connection group permissions. Each group permission grants a user
+-- or user group specific access to a connection group.
+--
+
+CREATE TABLE `guacamole_connection_group_permission` (
+
+  `entity_id`           int(11) NOT NULL,
+  `connection_group_id` int(11) NOT NULL,
+  `permission`          enum('READ',
+                             'UPDATE',
+                             'DELETE',
+                             'ADMINISTER') NOT NULL,
+
+  PRIMARY KEY (`entity_id`,`connection_group_id`,`permission`),
+
+  CONSTRAINT `guacamole_connection_group_permission_ibfk_1`
+    FOREIGN KEY (`connection_group_id`)
+    REFERENCES `guacamole_connection_group` (`connection_group_id`) ON DELETE CASCADE,
+
+  CONSTRAINT `guacamole_connection_group_permission_entity`
+    FOREIGN KEY (`entity_id`)
+    REFERENCES `guacamole_entity` (`entity_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of sharing profile permissions. Each sharing profile permission grants
+-- a user or user group specific access to a sharing profile.
+--
+
+CREATE TABLE guacamole_sharing_profile_permission (
+
+  `entity_id`          integer NOT NULL,
+  `sharing_profile_id` integer NOT NULL,
+  `permission`         enum('READ',
+                            'UPDATE',
+                            'DELETE',
+                            'ADMINISTER') NOT NULL,
+
+  PRIMARY KEY (`entity_id`, `sharing_profile_id`, `permission`),
+
+  CONSTRAINT `guacamole_sharing_profile_permission_ibfk_1`
+    FOREIGN KEY (`sharing_profile_id`)
+    REFERENCES `guacamole_sharing_profile` (`sharing_profile_id`) ON DELETE CASCADE,
+
+  CONSTRAINT `guacamole_sharing_profile_permission_entity`
+    FOREIGN KEY (`entity_id`)
+    REFERENCES `guacamole_entity` (`entity_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of system permissions. Each system permission grants a user or user
+-- group a system-level privilege of some kind.
+--
+
+CREATE TABLE `guacamole_system_permission` (
+
+  `entity_id`  int(11) NOT NULL,
+  `permission` enum('CREATE_CONNECTION',
+                    'CREATE_CONNECTION_GROUP',
+                    'CREATE_SHARING_PROFILE',
+                    'CREATE_USER',
+                    'CREATE_USER_GROUP',
+                    'ADMINISTER') NOT NULL,
+
+  PRIMARY KEY (`entity_id`,`permission`),
+
+  CONSTRAINT `guacamole_system_permission_entity`
+    FOREIGN KEY (`entity_id`)
+    REFERENCES `guacamole_entity` (`entity_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of user permissions. Each user permission grants a user or user group
+-- access to another user (the "affected" user) for a specific type of
+-- operation.
+--
+
+CREATE TABLE `guacamole_user_permission` (
+
+  `entity_id`        int(11) NOT NULL,
+  `affected_user_id` int(11) NOT NULL,
+  `permission`       enum('READ',
+                          'UPDATE',
+                          'DELETE',
+                          'ADMINISTER') NOT NULL,
+
+  PRIMARY KEY (`entity_id`,`affected_user_id`,`permission`),
+
+  CONSTRAINT `guacamole_user_permission_ibfk_1`
+    FOREIGN KEY (`affected_user_id`)
+    REFERENCES `guacamole_user` (`user_id`) ON DELETE CASCADE,
+
+  CONSTRAINT `guacamole_user_permission_entity`
+    FOREIGN KEY (`entity_id`)
+    REFERENCES `guacamole_entity` (`entity_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of user group permissions. Each user group permission grants a user
+-- or user group access to a another user group (the "affected" user group) for
+-- a specific type of operation.
+--
+
+CREATE TABLE `guacamole_user_group_permission` (
+
+  `entity_id`              int(11) NOT NULL,
+  `affected_user_group_id` int(11) NOT NULL,
+  `permission`             enum('READ',
+                                'UPDATE',
+                                'DELETE',
+                                'ADMINISTER') NOT NULL,
+
+  PRIMARY KEY (`entity_id`, `affected_user_group_id`, `permission`),
+
+  CONSTRAINT `guacamole_user_group_permission_affected_user_group`
+    FOREIGN KEY (`affected_user_group_id`)
+    REFERENCES `guacamole_user_group` (`user_group_id`) ON DELETE CASCADE,
+
+  CONSTRAINT `guacamole_user_group_permission_entity`
+    FOREIGN KEY (`entity_id`)
+    REFERENCES `guacamole_entity` (`entity_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- Table of connection history records. Each record defines a specific user's
+-- session, including the connection used, the start time, and the end time
+-- (if any).
+--
+
+CREATE TABLE `guacamole_connection_history` (
+
+  `history_id`           int(11)      NOT NULL AUTO_INCREMENT,
+  `user_id`              int(11)      DEFAULT NULL,
+  `username`             varchar(128) NOT NULL,
+  `remote_host`          varchar(256) DEFAULT NULL,
+  `connection_id`        int(11)      DEFAULT NULL,
+  `connection_name`      varchar(128) NOT NULL,
+  `sharing_profile_id`   int(11)      DEFAULT NULL,
+  `sharing_profile_name` varchar(128) DEFAULT NULL,
+  `start_date`           datetime     NOT NULL,
+  `end_date`             datetime     DEFAULT NULL,
+
+  PRIMARY KEY (`history_id`),
+  KEY `user_id` (`user_id`),
+  KEY `connection_id` (`connection_id`),
+  KEY `sharing_profile_id` (`sharing_profile_id`),
+  KEY `start_date` (`start_date`),
+  KEY `end_date` (`end_date`),
+  KEY `connection_start_date` (`connection_id`, `start_date`),
+
+  CONSTRAINT `guacamole_connection_history_ibfk_1`
+    FOREIGN KEY (`user_id`)
+    REFERENCES `guacamole_user` (`user_id`) ON DELETE SET NULL,
+
+  CONSTRAINT `guacamole_connection_history_ibfk_2`
+    FOREIGN KEY (`connection_id`)
+    REFERENCES `guacamole_connection` (`connection_id`) ON DELETE SET NULL,
+
+  CONSTRAINT `guacamole_connection_history_ibfk_3`
+    FOREIGN KEY (`sharing_profile_id`)
+    REFERENCES `guacamole_sharing_profile` (`sharing_profile_id`) ON DELETE SET NULL
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- User login/logout history
+--
+
+CREATE TABLE guacamole_user_history (
+
+  `history_id`           int(11)      NOT NULL AUTO_INCREMENT,
+  `user_id`              int(11)      DEFAULT NULL,
+  `username`             varchar(128) NOT NULL,
+  `remote_host`          varchar(256) DEFAULT NULL,
+  `start_date`           datetime     NOT NULL,
+  `end_date`             datetime     DEFAULT NULL,
+
+  PRIMARY KEY (history_id),
+  KEY `user_id` (`user_id`),
+  KEY `start_date` (`start_date`),
+  KEY `end_date` (`end_date`),
+  KEY `user_start_date` (`user_id`, `start_date`),
+
+  CONSTRAINT guacamole_user_history_ibfk_1
+    FOREIGN KEY (user_id)
+    REFERENCES guacamole_user (user_id) ON DELETE SET NULL
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--
+-- User password history
+--
+
+CREATE TABLE guacamole_user_password_history (
+
+  `password_history_id` int(11) NOT NULL AUTO_INCREMENT,
+  `user_id`             int(11) NOT NULL,
+
+  -- Salted password
+  `password_hash` binary(32) NOT NULL,
+  `password_salt` binary(32),
+  `password_date` datetime   NOT NULL,
+
+  PRIMARY KEY (`password_history_id`),
+  KEY `user_id` (`user_id`),
+
+  CONSTRAINT `guacamole_user_password_history_ibfk_1`
+    FOREIGN KEY (`user_id`)
+    REFERENCES `guacamole_user` (`user_id`) ON DELETE CASCADE
+
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+--
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+--
+
+-- Create default user "guacadmin" with password "guacadmin"
+INSERT INTO guacamole_entity (name, type) VALUES ('guacadmin', 'USER');
+INSERT INTO guacamole_user (entity_id, password_hash, password_salt, password_date)
+SELECT
+    entity_id,
+    x'CA458A7D494E3BE824F5E1E175A1556C0F8EEF2C2D7DF3633BEC4A29C4411960',  -- 'guacadmin'
+    x'FE24ADC5E11E2B25288D1704ABE67A79E342ECC26064CE69C5B3177795A82264',
+    NOW()
+FROM guacamole_entity WHERE name = 'guacadmin';
+
+-- Grant this user all system permissions
+INSERT INTO guacamole_system_permission (entity_id, permission)
+SELECT entity_id, permission
+FROM (
+          SELECT 'guacadmin'  AS username, 'CREATE_CONNECTION'       AS permission
+    UNION SELECT 'guacadmin'  AS username, 'CREATE_CONNECTION_GROUP' AS permission
+    UNION SELECT 'guacadmin'  AS username, 'CREATE_SHARING_PROFILE'  AS permission
+    UNION SELECT 'guacadmin'  AS username, 'CREATE_USER'             AS permission
+    UNION SELECT 'guacadmin'  AS username, 'CREATE_USER_GROUP'       AS permission
+    UNION SELECT 'guacadmin'  AS username, 'ADMINISTER'              AS permission
+) permissions
+JOIN guacamole_entity ON permissions.username = guacamole_entity.name AND guacamole_entity.type = 'USER';
+
+-- Grant admin permission to read/update/administer self
+INSERT INTO guacamole_user_permission (entity_id, affected_user_id, permission)
+SELECT guacamole_entity.entity_id, guacamole_user.user_id, permission
+FROM (
+          SELECT 'guacadmin' AS username, 'guacadmin' AS affected_username, 'READ'       AS permission
+    UNION SELECT 'guacadmin' AS username, 'guacadmin' AS affected_username, 'UPDATE'     AS permission
+    UNION SELECT 'guacadmin' AS username, 'guacadmin' AS affected_username, 'ADMINISTER' AS permission
+) permissions
+JOIN guacamole_entity          ON permissions.username = guacamole_entity.name AND guacamole_entity.type = 'USER'
+JOIN guacamole_entity affected ON permissions.affected_username = affected.name AND guacamole_entity.type = 'USER'
+JOIN guacamole_user            ON guacamole_user.entity_id = affected.entity_id;
@@ -0,0 +1,23 @@
+services:
+  vaultwarden:
+    image: vaultwarden/server:latest
+    restart: unless-stopped
+    environment:
+      - DOMAIN=https://vault.luckyden.org
+      - SIGNUPS_ALLOWED=true
+      - TRUSTED_PROXIES=10.10.0.20
+    volumes:
+      - /home/docker/KeyDen/data:/data
+    networks:
+      tan-network:
+        ipv4_address: 10.10.0.55
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.vault.rule=Host(`vault.luckyden.org`)
+      - traefik.http.routers.vault.entrypoints=websecure
+      - traefik.http.routers.vault.tls.certresolver=cloudflare
+      - traefik.http.services.vault.loadbalancer.server.port=80
+
+networks:
+  tan-network:
+    external: true
@@ -0,0 +1,3 @@
+JWT_SECRET=90bc954426a07802fb8d3efcf38413ac45f655e97abacd3efa258761d1838ceb
+COOKIE_SECRET=6a56c01f879cb7f35ace735ebad0d948c769372a2ef81a6a1481a6da13eee0f5
+DB_PASSWORD=tracearr
@@ -0,0 +1,13 @@
+FROM jellyfin/jellyfin:latest
+
+# Switch to root to install packages
+
+USER root
+
+# Install ffmpeg (no-install-recommends to keep image small)
+
+RUN apt-get update && apt-get install -y --no-install-recommends ffmpeg && apt-get clean && rm -rf /var/lib/apt/lists/*
+
+# Return to jellyfin user for security
+
+# USER jellyfin
@@ -0,0 +1,2 @@
+file appendonly.aof.1.base.rdb seq 1 type b
+file appendonly.aof.1.incr.aof seq 1 type i startoffset 0
@@ -0,0 +1 @@
+16
--- a/Show More
+++ b/Show More