switch Authentik SMTP to use SSL instead of TLS

Also add a README.md with instructions on how to use submodules

.gitignore

@@ -1,4 +1,6 @@
 *~
 abra/catalogue
-abra/recipes
-abra/logs
+abra/recipes/*
+!abra/recipes/rtm-astro-recipe
+!abra/recipes/mapbattle-recipe
+abra/logs

.gitmodules

@@ -0,0 +1,6 @@
+[submodule "abra/recipes/rtm-astro-recipe"]
+	path = abra/recipes/rtm-astro-recipe
+	url = https://git.coopcloud.tech/RTM/rtm-astro-recipe
+[submodule "abra/recipes/mapbattle-recipe"]
+	path = abra/recipes/mapbattle-recipe
+	url = ssh://git@git.coopcloud.tech:2222/RTM/mapbattle-recipe.git

README.md

@@ -0,0 +1,33 @@
+## Setup
+
+Members of RTM: check out the "RTM Reference" collective on our nextcloud for information on how to set up tailscale, ssh access, and user accounts on our servers. Without this, you won't be able to do operations.
+
+Once you have network access, install abra. Read the "Install" and "Quick start"/"New operators tutorial" sections of https://docs.coopcloud.tech/abra/, which will guide you through `wget`ting abra.
+
+Then, run:
+
+```
+$ git clone --recurse-submodules https://git.coopcloud.tech/RTM/rtm-config.git
+$ cd rtm-config
+$ abra server add laylotta.resisttechmonopolies.online
+$ abra server add mango.resisttechmonmopolies.online
+$ abra server add sootie.resisttechmonopolies.online
+```
+
+If you skipped the `--recurse-submodules` flag, you can still do `git submodule update --init` later to get the rtm-astro-recipe recipe.
+
+## Usage
+
+Once you've got this repo cloned and abra installed, you can run abra commands. To test:
+
+```
+$ abra app logs resisttechmonopolies.online
+```
+
+Should give a list of logs for our website! Other abra commands will work here.
+
+From here, use `abra` to make changes (and reach out to a member of our infra/member-services working group for a tutorial if you would like!). Then, contribute your git changes back to this repository so everyone else sees what you've done and doesn't clobber your changes.
+
+## Dev environment
+
+Sootie is our dev server. If you would like to experiment with changes and fuck around there, use sootie! The implication here is that sootie has a greater chance of having uncommitted changes in its environment than other servers, and that these changes are safe to clobber over.

abra/servers/laylotta.resisttechmonopolies.online/auth.resisttechmonopolies.online.env

@@ -1,4 +1,4 @@
-TYPE=authentik:7.4.0+2025.6.3
+TYPE=authentik:11.0.4+2026.2.1
 TIMEOUT=900
 ENABLE_AUTO_UPDATE=true
 POST_DEPLOY_CMDS="worker set_admin_pass"
@@ -25,11 +25,11 @@ AUTHENTIK_LOG_LEVEL=info
 AUTHENTIK_BOOTSTRAP_EMAIL=ammar@ammaratef45.ddns.net
 
 ## EMAIL
-AUTHENTIK_EMAIL__HOST=smtp.protonmail.ch
-AUTHENTIK_EMAIL__PORT=587
+AUTHENTIK_EMAIL__HOST=mail.resisttechmonopolies.online
+AUTHENTIK_EMAIL__PORT=465
 AUTHENTIK_EMAIL__USERNAME="besties@resisttechmonopolies.online"
-AUTHENTIK_EMAIL__USE_TLS=true
-AUTHENTIK_EMAIL__USE_SSL=false
+AUTHENTIK_EMAIL__USE_TLS=false
+AUTHENTIK_EMAIL__USE_SSL=true
 AUTHENTIK_EMAIL__TIMEOUT=10
 AUTHENTIK_EMAIL__FROM=besties@resisttechmonopolies.online
 
@@ -38,7 +38,7 @@ SECRET_SECRET_KEY_VERSION=v1
 SECRET_DB_PASSWORD_VERSION=v1
 SECRET_ADMIN_TOKEN_VERSION=v1
 SECRET_ADMIN_PASS_VERSION=v1
-SECRET_EMAIL_PASS_VERSION=v2
+SECRET_EMAIL_PASS_VERSION=v5
 
 # X_FRAME_OPTIONS_ALLOW_FROM=dashboard.example.org
 

abra/servers/laylotta.resisttechmonopolies.online/headscale.laylotta.resisttechmonopolies.online.env

@@ -0,0 +1,29 @@
+TYPE=headscale:00a12a21
+
+DOMAIN=headscale.laylotta.resisttechmonopolies.online
+
+## Domain aliases
+#EXTRA_DOMAINS=', `www.headscale.laylotta.resisttechmonopolies.online`'
+
+LETS_ENCRYPT_ENV=production
+
+COMPOSE_FILE="compose.yml"
+
+# Defines the base domain to create the hostnames for MagicDNS.
+BASE_DOMAIN=rtm.online
+
+# set this to true to enable using the built-in DERP rather than tailscale's
+ENABLE_DERP=true
+
+# enable oidc
+OIDC_ENABLED=1
+OIDC_ISSUER=https://auth.resisttechmonopolies.online/application/o/headscale/
+SECRET_OIDC_CLIENT_KEY_VERSION=v1
+COMPOSE_FILE="$COMPOSE_FILE:compose.oidc.yml"
+
+# See https://git.coopcloud.tech/coop-cloud/backup-bot-two
+ENABLE_BACKUPS=true
+
+## allow cron updater
+COMPOSE_FILE="$COMPOSE_FILE:compose.dns.yml"
+DNS_REPO=RTM/sootie-dynamic-dns

abra/servers/laylotta.resisttechmonopolies.online/loomio.resisttechmonopolies.online.env

@@ -1,4 +1,4 @@
-TYPE=loomio:5.1.3+v3.0.0
+TYPE=loomio:5.2.0+v3.0.20
 COMPOSE_FILE="compose.yml"
 
 DOMAIN=loomio.resisttechmonopolies.online

abra/servers/laylotta.resisttechmonopolies.online/m.laylotta.resisttechmonopolies.online.env

@@ -1,4 +1,4 @@
-TYPE=monitoring-ng:1.6.0+v1.8.1
+TYPE=monitoring-ng:23b13cb8
 LETS_ENCRYPT_ENV=production
 COMPOSE_FILE=compose.yml
 DOMAIN=m.laylotta.resisttechmonopolies.online
@@ -6,33 +6,32 @@ TIMEOUT=120
 ENABLE_BACKUPS=true
 
 ## Enable this secret for Promtail / Prometheus
-# SECRET_BASIC_AUTH_VERSION=v1
-#
-# Promtail (Gathering Logs)
-# COMPOSE_FILE="$COMPOSE_FILE:compose.promtail.yml"
-# LOKI_PUSH_URL=https://loki.monitoring.example.org/loki/api/v1/push
+SECRET_BASIC_AUTH_VERSION=v1
+
+## Promtail (Gathering Logs)
+COMPOSE_FILE="$COMPOSE_FILE:compose.promtail.yml"
+LOKI_PUSH_URL=https://loki.${DOMAIN}/loki/api/v1/push
 
 ## Expose node and cadvisor ports instead of traefik
-# COMPOSE_FILE="$COMPOSE_FILE:compose.expose-ports.yml"
+COMPOSE_FILE="$COMPOSE_FILE:compose.expose-ports.yml"
 
 # Monitoring Server
 #
 ## Prometheus
-# COMPOSE_FILE="$COMPOSE_FILE:compose.prometheus.yml"
-# PROMETHEUS_RETENTION_TIME=1y
-#
+COMPOSE_FILE="$COMPOSE_FILE:compose.prometheus.yml"
+PROMETHEUS_RETENTION_TIME=1y
+
 ## Prometheus Pushgateway
-# COMPOSE_FILE="$COMPOSE_FILE:compose.pushgateway.yml"
-#
+COMPOSE_FILE="$COMPOSE_FILE:compose.pushgateway.yml"
+
 ## Loki
 # Loki Server
-#
-# COMPOSE_FILE="$COMPOSE_FILE:compose.loki.yml"
-#
+COMPOSE_FILE="$COMPOSE_FILE:compose.loki.yml"
+
 # Set to 0 to disable retention
-# LOKI_RETENTION_PERIOD=744h
-# LOKI_STORAGE_FILESYSTEM=1
-#
+LOKI_RETENTION_PERIOD=744h
+LOKI_STORAGE_FILESYSTEM=1
+
 ## S3 Storage
 # LOKI_STORAGE_S3=1
 # LOKI_AWS_ENDPOINT=https://minio.autonomic.zone

abra/servers/laylotta.resisttechmonopolies.online/m.laylotta.resisttechmonopolies.online.scrape-config.yml

@@ -0,0 +1,6 @@
+# https://git.coopcloud.tech/coop-cloud/monitoring-ng/src/branch/main/scrape-config.example.yml
+# https://prometheus.io/docs/prometheus/latest/getting_started/#configure-prometheus-to-monitor-the-sample-targets
+- targets
+  - 'm.laylotta.resisttechmonopolies.online:8082'
+  - 'node.m.laylotta.resisttechmonopolies.online'
+  - 'cadvisor.m.laylotta.resisttechmonopolies.online'

abra/servers/laylotta.resisttechmonopolies.online/mail.resisttechmonopolies.online.env

@@ -4,7 +4,7 @@
 ###############################################################################
 # BOILERPLATE SETTINGS (shouldn't need to change these)                       #
 ###############################################################################
-TYPE=mailu:23309a1a+U
+TYPE=mailu:3.0.1+2024.06.37
 LETS_ENCRYPT_ENV=production
 COMPOSE_FILE="compose.yml"
 

abra/servers/laylotta.resisttechmonopolies.online/nextcloud.resisttechmonopolies.online.occ

@@ -19,3 +19,5 @@ abra app command nextcloud.resisttechmonopolies.online app run_occ "'db:add-miss
 #     Your installation has no default phone region set. This is required to validate phone numbers in the profile settings without a country code. To allow numbers without a country code, please add "default_phone_region" with the respective ISO 3166-1 code of the region to your config file.
 # Solution found at: https://help.nextcloud.com/t/your-installation-has-no-default-phone-region-set/153632/3
 abra app command nextcloud.resisttechmonopolies.online app run_occ "'config:system:set default_phone_region --value=\"us\"'"
+# move shared folder: "Node for share not found": https://github.com/nextcloud/server/issues/46467#issuecomment-2336672900
+abra app command nextcloud.resisttechmonopolies.online app run_occ "'sharing:delete-orphan-shares'"

abra/servers/laylotta.resisttechmonopolies.online/resisttechmonopolies.online.env

@@ -0,0 +1,9 @@
+TYPE=rtm-astro-recipe:6e6418fb
+
+DOMAIN=resisttechmonopolies.online
+
+## Domain aliases
+#EXTRA_DOMAINS=', `www.website.resisttechmonopolies.online`'
+
+LETS_ENCRYPT_ENV=production
+VERSION=0.0.21

abra/servers/laylotta.resisttechmonopolies.online/shlink.resisttechmonopolies.online.env

@@ -1,4 +1,4 @@
-TYPE=shlink:21d93464
+TYPE=shlink:0.1.0+4.4
 
 DOMAIN=shlink.resisttechmonopolies.online
 

abra/servers/mango.resisttechmonopolies.online/uk.mango.resisttechmonopolies.online.env

@@ -1,4 +1,4 @@
-TYPE=uptime-kuma:2.0.0+2.0.0-beta.1
+TYPE=uptime-kuma:3.0.0+2.2.1
 COMPOSE_FILE="compose.yml"
 LETS_ENCRYPT_ENV=production
 

abra/servers/mango.resisttechmonopolies.online/vw.resisttechmonopolies.online.env

@@ -1,4 +1,4 @@
-TYPE=vaultwarden:2.1.1+1.34.3
+TYPE=vaultwarden:2.1.3+1.35.4
 
 DOMAIN=vw.resisttechmonopolies.online
 LETS_ENCRYPT_ENV=production

abra/servers/resisttechmonopolies.online/resisttechmonopolies.online.env

@@ -1,10 +0,0 @@
-TYPE=rtm-astro-recipe:6e6418f
-
-DOMAIN=resisttechmonopolies.online
-
-## Domain aliases
-#EXTRA_DOMAINS=', `www.resisttechmonopolies.online`'
-
-LETS_ENCRYPT_ENV=production
-
-VERSION=0.0.10