updating monitoring-ng to latest main version so secret length doesnt bone us

Reviewed-on: #21

README.md

@@ -12,7 +12,6 @@ $ cd rtm-config
 $ abra server add laylotta.resisttechmonopolies.online
 $ abra server add mango.resisttechmonmopolies.online
 $ abra server add sootie.resisttechmonopolies.online
-$ abra server add hazel.resisttechmonopolies.online
 ```
 
 If you skipped the `--recurse-submodules` flag, you can still do `git submodule update --init` later to get the rtm-astro-recipe recipe.

abra/servers/laylotta.resisttechmonopolies.online/listmonk.resisttechmonopolies.online.env

@@ -0,0 +1,6 @@
+TYPE=listmonk:5.1.0+v6.1.0
+
+DOMAIN=listmonk.resisttechmonopolies.online
+LETS_ENCRYPT_ENV=production
+
+SECRET_DB_PASSWORD_VERSION=v1

abra/servers/laylotta.resisttechmonopolies.online/m.laylotta.resisttechmonopolies.online.env

@@ -1,4 +1,4 @@
-TYPE=monitoring-ng:23b13cb8
+TYPE=monitoring-ng:main
 LETS_ENCRYPT_ENV=production
 COMPOSE_FILE=compose.yml
 DOMAIN=m.laylotta.resisttechmonopolies.online
@@ -6,14 +6,15 @@ TIMEOUT=120
 ENABLE_BACKUPS=true
 
 ## Enable this secret for Promtail / Prometheus
+COMPOSE_FILE="$COMPOSE_FILE:compose.basic-auth.yml"
 SECRET_BASIC_AUTH_VERSION=v1
 
 ## Promtail (Gathering Logs)
-COMPOSE_FILE="$COMPOSE_FILE:compose.promtail.yml"
-LOKI_PUSH_URL=https://loki.${DOMAIN}/loki/api/v1/push
+#COMPOSE_FILE="$COMPOSE_FILE:compose.promtail.yml"
+#LOKI_PUSH_URL=https://loki.${DOMAIN}/loki/api/v1/push
 
 ## Expose node and cadvisor ports instead of traefik
-COMPOSE_FILE="$COMPOSE_FILE:compose.expose-ports.yml"
+#COMPOSE_FILE="$COMPOSE_FILE:compose.expose-ports.yml"
 
 # Monitoring Server
 #
@@ -26,7 +27,7 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.pushgateway.yml"
 
 ## Loki
 # Loki Server
-COMPOSE_FILE="$COMPOSE_FILE:compose.loki.yml"
+#COMPOSE_FILE="$COMPOSE_FILE:compose.loki.yml"
 
 # Set to 0 to disable retention
 LOKI_RETENTION_PERIOD=744h
@@ -39,39 +40,40 @@ LOKI_STORAGE_FILESYSTEM=1
 # LOKI_ACCESS_KEY_ID=bush-debrief-approval-robust-scraggly-molecule
 # LOKI_BUCKET_NAMES=loki
 # SECRET_LOKI_AWS_SECRET_ACCESS_KEY_VERSION=v1
-#
+
 ## Grafana
-#
-# COMPOSE_FILE="$COMPOSE_FILE:compose.grafana.yml"
-# GF_SERVER_ROOT_URL=https://monitoring.example.com
-# SECRET_GRAFANA_ADMIN_PASSWORD_VERSION=v1
+COMPOSE_FILE="$COMPOSE_FILE:compose.grafana.yml"
+GF_SERVER_ROOT_URL=https://monitoring.${DOMAIN}
+SECRET_GF_ADMINPASSWD_VERSION=v1
 ## Seperate domain for Grafana
-#GRAFANA_DOMAIN=grafana.example.com
-#
+GRAFANA_DOMAIN=grafana.${DOMAIN}
+
 ## Single-Sign-On with OIDC
-# OIDC_ENABLED=1
-# SECRET_GRAFANA_OIDC_CLIENT_SECRET_VERSION=v1
-# OIDC_CLIENT_ID=grafana
-# OIDC_AUTH_URL="https://authentik.example.com/application/o/authorize/"
-# OIDC_API_URL="https://authentik.example.com/application/o/userinfo/"
-# OIDC_TOKEN_URL="https://authentik.example.com/application/o/token/"
-#
+COMPOSE_FILE="$COMPOSE_FILE:compose.grafana-oidc.yml"
+OIDC_ENABLED=1
+SECRET_GF_OIDC_SECRET_VERSION=v1
+OIDC_CLIENT_ID=grafana
+OIDC_AUTH_URL="https://auth.resisttechmonopolies.online/application/o/authorize/"
+OIDC_API_URL="https://auth.resisttechmonopolies.online/application/o/userinfo/"
+OIDC_TOKEN_URL="https://auth.resisttechmonopolies.online/application/o/token/"
+
 ## Additional grafana settings (unlikely to require editing)
 # GF_SECURITY_ALLOW_EMBEDDING=1
 # GF_INSTALL_PLUGINS=grafana-piechart-panel
 #
 ## grafana SMTP configuration (optional)
+# COMPOSE_FILE="$COMPOSE_FILE:compose.grafana-smtp.yml"
 # GF_SMTP_HOST=changeme
 # GF_SMTP_USER=changme
 # GF_SMTP_ENABLED=true
 # GF_SMTP_FROM_ADDRESS=grafana@example.com
 # GF_SMTP_SKIP_VERIFY=false
-# SECRET_GRAFANA_SMTP_PASSWORD_VERSION=v1
+SECRET_GF_SMTP_PASSWORD_VERSION=v1
 #
 
 ## Grafana Matrix Contact Point (optional)
 #COMPOSE_FILE="$COMPOSE_FILE:compose.matrix-alertmanager-receiver.yml"
-#SECRET_MATRIX_ACCESS_TOKEN_VERSION=v1
+#SECRET_MATRIX_TOKEN_VERSION=v1
 #GF_MATRIX_USER_ID="<user-id>"
 #GF_MATRIX_ROOM_ID="<room-id>"
 #GF_MATRIX_HOMESERVER_URL="<homeserver-url>"
@@ -81,4 +83,9 @@ LOKI_STORAGE_FILESYSTEM=1
 #ALERT_BACKUP_MISSING_ENABLED=true
 #ALERT_BACKUP_NOT_SUCCESSFULL_ENABLED=true
 #ALERT_NODE_DISK_SPACE_ENABLED=true
-#ALERT_NODE_MEMORY_USAGE_ENABLED=true
+#ALERT_NODE_MEMORY_USAGE_ENABLED=true
+# Node disk space alert will trigger when free disk space left is below the given number in percent
+#ALERT_NODE_DISK_SPACE_LEFT=10
+
+# Node memory usage alert will trigger when memory usage is above the given number in percent
+#ALERT_NODE_MEMORY_USAGE=85

abra/servers/laylotta.resisttechmonopolies.online/resisttechmonopolies.online.env

@@ -4,6 +4,7 @@ DOMAIN=resisttechmonopolies.online
 
 ## Domain aliases
 #EXTRA_DOMAINS=', `www.website.resisttechmonopolies.online`'
+EXTRA_DOMAINS=", `www.resisttechmonopolies.online`"
 
 LETS_ENCRYPT_ENV=production
-VERSION=0.0.21
+VERSION=0.0.26

abra/servers/sootie.resisttechmonopolies.online/calibre.resisttechmonopolies.online.env

@@ -1,13 +0,0 @@
-TYPE=calibre-web
-
-DOMAIN=calibre.resisttechmonopolies.online
-LETS_ENCRYPT_ENV=production
-
-DOCKER_MODS="linuxserver/calibre-web:calibre"
-OAUTHLIB_RELAX_TOKEN_SCOPE=1
-TZ="America/Los_Angeles"
-
-DEBUG=False
-
-# oauth2 support
-COMPOSE_FILE="compose.yml:compose.oauth2.yml"

abra/servers/sootie.resisttechmonopolies.online/collabora.resisttechmonopolies.online.env

@@ -1,7 +0,0 @@
-TYPE=collabora
-DOMAIN=collabora.resisttechmonopolies.online
-LETS_ENCRYPT_ENV=production
-NEXTCLOUD_DOMAIN=nextcloud.resisttechmonopolies.online
-ADMIN_USERNAME=admin
-SECRET_ADMIN_PASSWORD_VERSION=v1
-FRAME_ANCESTORS=

abra/servers/sootie.resisttechmonopolies.online/focalboard.resisttechmonopolies.online.env

@@ -1,7 +0,0 @@
-TYPE=focalboard
-
-DOMAIN=focalboard.resisttechmonopolies.online
-
-## Domain aliases
-#EXTRA_DOMAINS=', `www.focalboard.resisttechmonopolies.online`'
-LETS_ENCRYPT_ENV=production

abra/servers/sootie.resisttechmonopolies.online/hedgedoc.resisttechmonopolies.online.env

@@ -0,0 +1,59 @@
+TYPE=hedgedoc:3.0.8+1.10.7
+TIMEOUT=300
+ENABLE_AUTO_UPDATE=true
+ENABLE_BACKUPS=true
+
+DOMAIN=hedgedoc.resisttechmonopolies.online
+## Domain aliases
+#EXTRA_DOMAINS=', `www.hedgedoc.resisttechmonopolies.online`'
+LETS_ENCRYPT_ENV=production
+
+SECRET_SESSION_SECRET_VERSION=v1
+
+COMPOSE_FILE="compose.yml"
+
+# Anubis
+#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis.yml"
+
+# PostgreSQL
+
+#COMPOSE_FILE="$COMPOSE_FILE:compose.postgresql.yml"
+#SECRET_DB_PASSWORD_VERSION=v1
+
+# OAuth, see https://docs.hedgedoc.org/guides/auth/keycloak/
+
+#COMPOSE_FILE="$COMPOSE_FILE:compose.oauth.yml"
+#CMD_OAUTH2_PROVIDERNAME="Keycloak"
+#CMD_OAUTH2_CLIENT_ID="hedgedoc"
+#CMD_OAUTH2_AUTHORIZATION_URL="https://keycloak.example.com/auth/realms/realmname/protocol/openid-connect/auth"
+#CMD_OAUTH2_TOKEN_URL="https://keycloak.example.com/auth/realms/realmname/protocol/openid-connect/token"
+#CMD_OAUTH2_USER_PROFILE_URL="https://keycloak.example.com/auth/realms/realmname/protocol/openid-connect/userinfo"
+#CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR=ocs.data.id
+#CMD_OAUTH2_USER_PROFILE_ID_ATTR=
+#CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR=ocs.data.display-name
+#CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR=ocs.data.email
+#CMD_OAUTH2_PROVIDERNAME=Keycloak
+#CMD_OAUTH2_SCOPE="openid email profile"
+#
+#SECRET_OAUTH_KEY_VERSION=v1
+
+# Options, see https://docs.hedgedoc.org/configuration/
+
+# CMD_ALLOW_ANONYMOUS=true
+# CMD_ALLOW_ANONYMOUS_EDITS=false
+# CMD_ALLOW_EMAIL_REGISTER=true
+# CMD_ALLOW_FREEURL=false
+# CMD_REQUIRE_FREEURL_AUTHENTICATION=true
+# CMD_ALLOW_GRAVATAR=true
+# CMD_ALLOW_ORIGIN=localhost
+# CMD_COOKIE_POLICY=lax
+# CMD_CSP_ADD_DISQUS=false
+# CMD_CSP_ADD_GOOGLE_ANALYTICS=false
+# CMD_CSP_ENABLE=true
+# CMD_CSP_REPORTURI=undefined
+# CMD_DEFAULT_PERMISSION=editable
+# CMD_EMAIL=true
+# CMD_SESSION_LIFE=1209600000
+# Only present in config.json (no equivalent env var):
+# DOCUMENT_MAX_LENGTH=100000
+# CMD_ENABLE_UPLOADS=registered

abra/servers/sootie.resisttechmonopolies.online/mb.sootie.resisttechmonopolies.online.env

@@ -0,0 +1,18 @@
+TYPE=maubot:1.3.0+v0.6.0
+
+DOMAIN=mb.sootie.resisttechmonopolies.online
+
+## Domain aliases
+#EXTRA_DOMAINS=', `www.maubot.resisttechmonopolies.online`'
+
+LETS_ENCRYPT_ENV=production
+
+HOMESERVER_HOST=matrix.resisttechmonopolies.online
+# Client-server API URL
+HOMESERVER_URL=https://matrix.resisttechmonopolies.online
+
+ADMIN_USER_NAME=charlie
+
+## Secrets
+SECRET_ADMIN_PASSWORD_VERSION=v1
+SECRET_HOMESERVER_REGISTRATION_VERSION=v1

abra/servers/sootie.resisttechmonopolies.online/radicale.resisttechmonopolies.online.env

@@ -1,6 +1,6 @@
-TYPE=radicale
+TYPE=radicale:0.1.0+3.0.6.0
 
 DOMAIN=radicale.resisttechmonopolies.online
 ## Domain aliases
 #EXTRA_DOMAINS=', `www.radicale.resisttechmonopolies.online`'
-LETS_ENCRYPT_ENV=production
+LETS_ENCRYPT_ENV=production

abra/servers/sootie.resisttechmonopolies.online/t.sootie.resisttechmonopolies.online.env

@@ -1,13 +1,13 @@
 TYPE=traefik:5.1.1+v3.6.15
-TIMEOUT=300
+#TIMEOUT=300
 ENABLE_AUTO_UPDATE=true
 ENABLE_BACKUPS=true
 
-DOMAIN=traefik.hazel.resisttechmonopolies.online
+DOMAIN=t.sootie.resisttechmonopolies.online
 LETS_ENCRYPT_ENV=production
 
-LETS_ENCRYPT_EMAIL=besties@resisttechmonopolies.online
-DASHBOARD_ENABLED=false
+LETS_ENCRYPT_EMAIL=linnealovespie@proton.me
+DASHBOARD_ENABLED=true
 # WARN, INFO etc.
 LOG_LEVEL=WARN
 LOG_MAX_AGE=1
@@ -125,7 +125,7 @@ COMPOSE_FILE="compose.yml"
 ## BASIC_AUTH should also be enabled
 #COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
 #METRICS_ENABLED=1
-#METRICS_FQDN=metrics.traefik.hazel.resisttechmonopolies.online
+#METRICS_FQDN=metrics.t.sootie.resisttechmonopolies.online
 
 #####################################################################
 # File provider directory configuration                             #

abra/servers/sootie.resisttechmonopolies.online/traefik.resisttechmonopolies.online.env

@@ -1,148 +0,0 @@
-TYPE=traefik:3.7.0+v3.6.2
-TIMEOUT=300
-ENABLE_AUTO_UPDATE=true
-ENABLE_BACKUPS=true
-
-DOMAIN=traefik.resisttechmonopolies.online
-LETS_ENCRYPT_ENV=production
-LETS_ENCRYPT_EMAIL=linnealovespie@proton.me
-DASHBOARD_ENABLED=false
-# WARN, INFO etc.
-LOG_LEVEL=WARN
-
-# This is here so later lines can extend it; you likely don't wanna edit
-COMPOSE_FILE="compose.yml"
-
-#####################################################################
-# General settings                                                  #
-#####################################################################
-
-## Host-mode networking
-COMPOSE_FILE="$COMPOSE_FILE:compose.host.yml"
-
-## "Headless mode" (no domain configured)
-#COMPOSE_FILE="$COMPOSE_FILE:compose.headless.yml"
-
-#####################################################################
-# Automatic DNS set-up for Letsencrypt                              #
-#####################################################################
-
-## Enable dns challenge (for wildcard domains)
-##   https://doc.traefik.io/traefik/https/acme/#dnschallenge
-#LETS_ENCRYPT_DNS_CHALLENGE_ENABLED=1
-#LETS_ENCRYPT_DNS_CHALLENGE_PROVIDER=ovh
-
-## OVH, https://ovh.com
-#COMPOSE_FILE="$COMPOSE_FILE:compose.ovh.yml"
-#OVH_ENABLED=1
-#OVH_APPLICATION_KEY=
-#OVH_ENDPOINT=
-#SECRET_OVH_APP_SECRET_VERSION=v1
-#SECRET_OVH_CONSUMER_KEY=v1
-
-## Gandi, https://gandi.net
-## note(3wc): only "V5" (new) API is supported, so far
-#COMPOSE_FILE="$COMPOSE_FILE:compose.gandi-api-key.yml"
-#GANDI_API_KEY_ENABLED=1
-#SECRET_GANDIV5_API_KEY_VERSION=v1
-
-## Gandi, https://gandi.net
-## note: uses GandiV5 Personal Access Token
-#COMPOSE_FILE="$COMPOSE_FILE:compose.gandi-personal-access-token.yml"
-#GANDI_PERSONAL_ACCESS_TOKEN_ENABLED=1
-#SECRET_GANDIV5_PERSONAL_ACCESS_TOKEN_VERSION=v1
-
-## DigitalOcean, https://digitalocean.com
-#COMPOSE_FILE="$COMPOSE_FILE:compose.digitalocean.yml"
-#DIGITALOCEAN_ENABLED=1
-#SECRET_DIGITALOCEAN_AUTH_TOKEN_VERSION=v1
-
-#####################################################################
-# Manual wildcard certificate insertion                             #
-#####################################################################
-
-# Set wildcards = 1, and uncomment compose_file to enable.
-# Create your certs elsewhere and add them like:
-# abra app secret insert {myapp.example.coop} ssl_cert v1 "$(cat /path/to/fullchain.pem)"
-# abra app secret insert {myapp.example.coop} ssl_key v1 "$(cat /path/to/privkey.pem)"
-#WILDCARDS_ENABLED=1
-#SECRET_WILDCARD_CERT_VERSION=v1
-#SECRET_WILDCARD_KEY_VERSION=v1
-#COMPOSE_FILE="$COMPOSE_FILE:compose.wildcard.yml"
-
-#####################################################################
-# Authentication                                                    #
-#####################################################################
-
-## Enable Keycloak
-#COMPOSE_FILE="$COMPOSE_FILE:compose.keycloak.yml"
-#KEYCLOAK_MIDDLEWARE_ENABLED=1
-#KEYCLOAK_TFA_SERVICE=traefik-forward-auth_app
-#KEYCLOAK_MIDDLEWARE_2_ENABLED=1
-#KEYCLOAK_TFA_SERVICE_2=traefik-forward-auth_app
-
-## BASIC_AUTH
-## Use httpasswd to generate the secret
-#COMPOSE_FILE="$COMPOSE_FILE:compose.basicauth.yml"
-#BASIC_AUTH=1
-#SECRET_USERSFILE_VERSION=v1
-
-#####################################################################
-# Prometheus metrics                                                #
-#####################################################################
-
-## Enable prometheus metrics collection
-## used used by the coop-cloud monitoring stack
-#COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
-#METRICS_ENABLED=1
-
-#####################################################################
-# File provider directory configuration                             #
-# (Route bare metal and non-docker services on the machine!)        #
-#####################################################################
-FILE_PROVIDER_DIRECTORY_ENABLED=1
-
-#####################################################################
-# Additional services                                               #
-#####################################################################
-
-## SMTP port 587
-#COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
-#SMTP_ENABLED=1
-
-## Compy
-#COMPOSE_FILE="$COMPOSE_FILE:compose.compy.yml"
-#COMPY_ENABLED=1
-
-## Gitea SSH
-# COMPOSE_FILE="$COMPOSE_FILE:compose.gitea.yml"
-# GITEA_SSH_ENABLED=1
-
-## Foodsoft SMTP
-# COMPOSE_FILE="$COMPOSE_FILE:compose.foodsoft.yml"
-# FOODSOFT_SMTP_ENABLED=1
-
-## Peertube RTMP
-#COMPOSE_FILE="$COMPOSE_FILE:compose.peertube.yml"
-#PEERTUBE_RTMP_ENABLED=1
-
-## Secure Scuttlebutt MUXRPC
-#COMPOSE_FILE="$COMPOSE_FILE:compose.ssb.yml"
-#SSB_MUXRPC_ENABLED=1
-
-## MSSQL
-#COMPOSE_FILE="$COMPOSE_FILE:compose.mssql.yml"
-#MSSQL_ENABLED=1
-
-## Mumble
-#COMPOSE_FILE="$COMPOSE_FILE:compose.mumble.yml"
-#MUMBLE_ENABLED=1
-
-## Matrix
-#COMPOSE_FILE="$COMPOSE_FILE:compose.matrix.yml"
-#MATRIX_FEDERATION_ENABLED=1
-
-## "Web alt", an alternative web port
-# NOTE(3wc): as of 2024-04-01 only the `icecast` recipe uses this
-#COMPOSE_FILE="$COMPOSE_FILE:compose.web-alt.yml"
-#WEB_ALT_ENABLED=1