First commit

.env

@@ -0,0 +1,153 @@
+# Environment file for docker-compose.yaml
+# Generate new passwords with:
+# openssl rand -hex 32
+
+# Fill in registry
+REGISTRY=
+
+# Forgejo
+FORGEJO_PORT=3000
+FORGEJO_SSH=2222
+FORGEJO_DBNAME=forgejo
+FORGEJO_DBUSER=forgejo
+FORGEJO_DBPASS=forgejo
+FORGEJO_TITLE=Forgejo
+FORGEJO_URL=http://localhost:${FORGEJO_PORT:-3000}
+
+# Dashy
+DASHY_PORT=80
+
+# Nextcloud
+NEXTCLOUD_PORT=80
+NEXTCLOUD_DBNAME=nextcloud
+NEXTCLOUD_DBUSER=nextcloud
+NEXTCLOUD_DBPASS=nextcloud
+
+# Onlyoffice Document Server
+ONLYOFFICE_DS_JWTSECRET=onlyoffice
+ONLYOFFICE_DS_JWTHEADER=onlyoffice
+ONLYOFFICE_DS_DBNAME=onlyoffice
+ONLYOFFICE_DS_DBUSER=onlyoffice
+
+# Onlyoffice Community Server
+ONLYOFFICE_CS_PORT=80
+ONLYOFFICE_CS_MACHINEKEY=onlyoffice
+ONLYOFFICE_CS_DBNAME=onlyoffice
+ONLYOFFICE_CS_DBROOT=onlyoffice
+ONLYOFFICE_CS_DBUSER=onlyoffice
+ONLYOFFICE_CS_DBPASS=onlyoffice
+
+# Jellyfin
+JELLYFIN_PORT=8096
+JELLYFIN_MEDIA_DIR=/jellyfin
+
+# Matrix
+MATRIX_PORT=8008
+MATRIX_DBNAME=synapse
+MATRIX_DBUSER=synapse
+MATRIX_DBPASS=synapse
+
+# Memos
+MEMOS_PORT=5230
+
+# Linkding
+LINKDING_PORT=9090
+LINKDING_DBNAME=linkding
+LINKDING_DBUSER=linkding
+LINKDING_DBPASS=linkding
+LINKDING_URL=http://localhost:${LINKDING_PORT:-9090}
+
+# Tandoor
+TANDOOR_PORT=8080
+TANDOOR_SECRETKEY=tandoor
+TANDOOR_DBNAME=tandoor
+TANDOOR_DBUSER=tandoor
+TANDOOR_DBPASS=tandoor
+
+# PasswordPusher
+PWPUSHER_PORT=5100
+PWPUSHER_TITLE=PasswordPusher
+
+# Paperless
+PAPERLESS_PORT=8000
+PAPERLESS_DBNAME=paperless
+PAPERLESS_DBUSER=paperless
+PAPERLESS_DBPASS=paperless
+PAPERLESS_URL=http://localhost:${PAPERLESS_PORT:-8000}
+PAPERLESS_SECRETKEY=paperless
+
+# Vikunja
+VIKUNJA_PORT=3456
+VIKUNJA_DBNAME=vikunja
+VIKUNJA_DBUSER=vikunja
+VIKUNJA_DBPASS=vikunja
+VIKUNJA_JWTSECRET=vikunja
+VIKUNJA_URL=http://localhost:${VIKUNJA_PORT:-3456}
+
+# Psitransfer
+PSITRANSFER_PORT=8080
+PSITRANSFER_UPLOADPASS=
+
+# Send
+SEND_PORT=1443
+SEND_TITLE=Send
+
+# Stirling PDF
+STIRLINGPDF_PORT=8080
+
+# Neko
+NEKO_PORT=8080
+NEKO_ADMINPASS=neko
+NEKO_USERPASS=neko
+
+# Linkstack
+LINKSTACK_PORT=443
+LINKSTACK_ADMIN=admin
+LINKSTACK_DOMAIN=localhost
+
+# Commafeed
+COMMAFEED_PORT=8082
+COMMAFEED_DBNAME=commafeed
+COMMAFEED_DBUSER=commafeed
+COMMAFEED_DBPASS=commafeed
+COMMAFEED_URL=http://localhost:${COMMAFEED_PORT:-8082}
+
+# Fireshare
+FIRESHARE_PORT=
+FIRESHARE_ADMIN=admin
+FIRESHARE_PASSWORD=fireshare
+FIRESHARE_SECRET=fireshare
+FIRESHARE_URL=
+
+# Shlink
+SHLINK_WEBUI_PORT=
+SHLINK_PORT=
+SHLINK_URL=
+SHLINK_DBNAME=shlink
+SHLINK_DBUSER=shlink
+SHLINK_DBPASS=shlink
+
+# Ghost
+GHOST_PORT=
+GHOST_URL=
+GHOST_DBNAME=ghost
+GHOST_DBPASS=ghost
+
+# Olivetin
+OLIVETIN_PORT=
+
+# Vaultwarden
+VAULTWARDEN_PORT=
+VAULTWARDEN_URL=
+VAULTWARDEN_DBPASS=
+
+# Ollama
+OLLAMA_PORT=
+
+# Immich
+IMMICH_PORT=
+IMMICH_REDIS_HOST=immich-redis
+IMMICH_DB_HOST=immich-postgresql
+IMMICH_DB_NAME=immich
+IMMICH_DB_USER=immich
+IMMICH_DB_PASS=immich

nextcloud/nginx.conf

@@ -0,0 +1,239 @@
+# https://github.com/nextcloud/docker/raw/master/.examples/docker-compose/with-nginx-proxy/postgres/fpm/web/nginx.conf
+# https://github.com/ONLYOFFICE/docker-onlyoffice-nextcloud/raw/master/nginx.conf
+
+worker_processes auto;
+
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    # Prevent nginx HTTP Server Detection
+    server_tokens   off;
+
+    keepalive_timeout  65;
+
+    # Set the `immutable` cache control options only for assets with a cache busting `v` argument
+    map $arg_v $asset_immutable {
+        "" "";
+    default "immutable";
+    }
+
+    map $http_host $this_host {
+        "" $host;
+        default $http_host;
+    }
+
+    map $http_x_forwarded_proto $the_scheme {
+        default $http_x_forwarded_proto;
+        "" $scheme;
+    }
+
+    map $http_x_forwarded_host $the_host {
+       default $http_x_forwarded_host;
+       "" $this_host;
+    }
+
+    upstream php-handler {
+        server nextcloud:9000;
+    }
+
+    #gzip  on;
+
+    server {
+        listen 80;
+
+        # HSTS settings
+        # WARNING: Only add the preload option once you read about
+        # the consequences in https://hstspreload.org/. This option
+        # will add the domain to a hardcoded list that is shipped
+        # in all major browsers and getting removed from this list
+        # could take several months.
+        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
+
+        # set max upload size and increase upload timeout:
+        client_max_body_size 0;
+        client_body_timeout 300s;
+        fastcgi_buffers 64 4K;
+
+        # The settings allows you to optimize the HTTP2 bandwidth.
+        # See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
+        # for tuning hints
+        client_body_buffer_size 512k;
+
+        # Enable gzip but do not remove ETag headers
+        gzip on;
+        gzip_vary on;
+        gzip_comp_level 4;
+        gzip_min_length 256;
+        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+        gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+        # Pagespeed is not supported by Nextcloud, so if your server is built
+        # with the `ngx_pagespeed` module, uncomment this line to disable it.
+        #pagespeed off;
+
+        # HTTP response headers borrowed from Nextcloud `.htaccess`
+        add_header Referrer-Policy                      "no-referrer"       always;
+        add_header X-Content-Type-Options               "nosniff"           always;
+        add_header X-Frame-Options                      "SAMEORIGIN"        always;
+        add_header X-Permitted-Cross-Domain-Policies    "none"              always;
+        add_header X-Robots-Tag                         "noindex, nofollow" always;
+        add_header X-XSS-Protection                     "1; mode=block"     always;
+
+        # Remove X-Powered-By, which is an information leak
+        fastcgi_hide_header X-Powered-By;
+
+        # Path to the root of your installation
+        root /var/www/html;
+
+        # Specify how to handle directories -- specifying `/index.php$request_uri`
+        # here as the fallback means that Nginx always exhibits the desired behaviour
+        # when a client requests a path that corresponds to a directory that exists
+        # on the server. In particular, if that directory contains an index.php file,
+        # that file is correctly served; if it doesn't, then the request is passed to
+        # the front-end controller. This consistent behaviour means that we don't need
+        # to specify custom rules for certain paths (e.g. images and other assets,
+        # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
+        # `try_files $uri $uri/ /index.php$request_uri`
+        # always provides the desired behaviour.
+        index index.php index.html /index.php$request_uri;
+
+        # Onlyoffice
+        location ~* ^/ds-vpath/ {
+            rewrite /ds-vpath/(.*) /$1  break;
+            proxy_pass http://onlyoffice-document-server;
+            proxy_redirect     off;
+
+            client_max_body_size 100m;
+
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Host $the_host/ds-vpath;
+            proxy_set_header X-Forwarded-Proto $the_scheme;
+        }
+
+        # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
+        location = / {
+            if ( $http_user_agent ~ ^DavClnt ) {
+                return 302 /remote.php/webdav/$is_args$args;
+            }
+        }
+
+        location = /robots.txt {
+            allow all;
+            log_not_found off;
+            access_log off;
+        }
+
+        # Make a regex exception for `/.well-known` so that clients can still
+        # access it despite the existence of the regex rule
+        # `location ~ /(\.|autotest|...)` which would otherwise handle requests
+        # for `/.well-known`.
+        location ^~ /.well-known {
+            # The rules in this block are an adaptation of the rules
+            # in `.htaccess` that concern `/.well-known`.
+
+            location = /.well-known/carddav { return 301 /remote.php/dav/; }
+            location = /.well-known/caldav  { return 301 /remote.php/dav/; }
+
+            location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
+            location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
+
+            # Let Nextcloud's API for `/.well-known` URIs handle all other
+            # requests by passing them to the front-end controller.
+            return 301 /index.php$request_uri;
+        }
+
+        # Rules borrowed from `.htaccess` to hide certain paths from clients
+        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
+        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
+
+        # Ensure this block, which passes PHP files to the PHP process, is above the blocks
+        # which handle static assets (as seen below). If this block is not declared first,
+        # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
+        # to the URI, resulting in a HTTP 500 error response.
+        location ~ \.php(?:$|/) {
+            # Required for legacy support
+            rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
+
+            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+            set $path_info $fastcgi_path_info;
+
+            try_files $fastcgi_script_name =404;
+
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            fastcgi_param PATH_INFO $path_info;
+            fastcgi_param HTTPS on;
+
+            fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
+            fastcgi_param front_controller_active true;     # Enable pretty urls
+            fastcgi_pass php-handler;
+
+            fastcgi_intercept_errors on;
+            fastcgi_request_buffering off;
+
+            fastcgi_max_temp_file_size 0;
+        }
+
+        # Javascript mimetype fixes for nginx
+        # Note: The block below should be removed, and the js|mjs section should be
+        # added to the block below this one. This is a temporary fix until Nginx
+        # upstream fixes the js mime-type
+        location ~* \.(?:js|mjs)$ {
+            types {
+                text/javascript js mjs;
+            }
+            try_files $uri /index.php$request_uri;
+            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
+            access_log off;
+        }
+
+        # Serve static files
+        location ~ \.(?:css|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
+            try_files $uri /index.php$request_uri;
+            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
+            access_log off;     # Optional: Don't log access to assets
+
+            location ~ \.wasm$ {
+                default_type application/wasm;
+            }
+        }
+
+        location ~ \.woff2?$ {
+            try_files $uri /index.php$request_uri;
+            expires 7d;         # Cache-Control policy borrowed from `.htaccess`
+            access_log off;     # Optional: Don't log access to assets
+        }
+
+        # Rule borrowed from `.htaccess`
+        location /remote {
+            return 301 /remote.php$request_uri;
+        }
+
+        location / {
+            try_files $uri $uri/ /index.php$request_uri;
+        }
+    }
+}

nextcloud/php-fpm.conf

@@ -0,0 +1,5 @@
+[www]
+pm = ondemand
+pm.max_children = 300
+pm.process_idle_timeout = 30s
+pm.max_requests = 500

onlyoffice/mysql/conf.d/onlyoffice.cnf

@@ -0,0 +1,5 @@
+[mysqld]
+sql_mode = 'NO_ENGINE_SUBSTITUTION'
+max_connections = 1000
+max_allowed_packet = 1048576000
+group_concat_max_len = 2048

onlyoffice/mysql/docker-entrypoint-initdb.d/setup.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+mysql -uroot -p${ONLYOFFICE_CS_DBROOT:-onlyoffice} <<onlyoffice
+CREATE DATABASE IF NOT EXISTS ${ONLYOFFICE_CS_DBNAME:-onlyoffice} CHARACTER SET "utf8" COLLATE "utf8_general_ci";
+
+ALTER USER 'root'@'%' IDENTIFIED BY '${ONLYOFFICE_CS_DBROOT:-onlyoffice}';
+CREATE USER IF NOT EXISTS '${ONLYOFFICE_CS_DBUSER:-onlyoffice}'@'%' IDENTIFIED BY '${ONLYOFFICE_CS_DBPASS:-onlyoffice}';
+
+GRANT ALL PRIVILEGES ON *.* TO 'root'@'%';
+GRANT ALL PRIVILEGES ON *.* TO '${ONLYOFFICE_CS_DBUSER:-onlyoffice}'@'%';
+
+FLUSH PRIVILEGES;
+onlyoffice

stirling/tesseract.sh

@@ -0,0 +1,2 @@
+#!/bin/sh
+git clone https://git.myvelabs.app/myvelabs/tesseract-ocr.git