vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

Refresh ana-docker + esh-docker-vm snapshots after moving inline secrets to .env

Browse Source 
Upstream compose files on both hosts now reference ${DB_ROOT_PW} (seafile)
  and ${ADGUARD_WIDGET_PASSWORD} (esh adguard) from their respective .env,
  so next refreshes no longer capture the literal passwords.
This commit is contained in:
Vuong Hoang
2026-04-20 14:30:07 -07:00
parent e376d0aec9
commit b443b5c220
2 changed files with 129 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/ana-docker/system-details.txt
+116 -55
View File
@@ -2,8 +2,8 @@
===== HOST =====
Hostname: ana-docker.phasefinal.com
Date: 2026-04-19T22:15:55-07:00
Uptime: up 2 weeks, 5 days, 23 hours, 24 minutes
Date: 2026-04-20T14:27:52-07:00
Uptime: up 2 weeks, 6 days, 15 hours, 36 minutes
OS: Debian GNU/Linux 12 (bookworm)
Kernel: 6.1.0-44-amd64
Arch: x86_64
@@ -13,7 +13,7 @@ Arch: x86_64
CPU cores: 8
CPU model: QEMU Virtual CPU version 2.5+
MemTotal: 15.6 GB
MemAvailable: 10.5 GB
MemAvailable: 11.1 GB
===== GPUS =====
@@ -22,7 +22,7 @@ nvidia-smi not present (no NVIDIA GPUs or driver not installed)
===== FILESYSTEMS (df) =====
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 245G 79G 154G 34% /
/dev/sda1 245G 79G 153G 34% /
10.250.50.50:/mnt/docker 20T 0 20T 0% /mnt/compose
10.250.50.50:/mnt/backup 20T 1.1G 20T 1% /mnt/backup
10.250.50.50:/mnt/pve-VMStorage 22T 2.4T 20T 11% /mnt/tnvms
@@ -50,34 +50,35 @@ UUID=ab0fa49a-61d4-4b2a-af7e-bc32f84bbd3b none swap sw
total 32
drwxrwxrwx 6 root root 4096 2026-04-15 23:28 .
drwxr-xr-x 4 root root 4096 2026-04-02 22:12 ..
drwxr-xr-x 20 lkraven lkraven 4096 2026-04-19 19:41 compose
drwxr-xr-x 21 lkraven lkraven 4096 2026-04-19 22:47 compose
drwxr-xr-x 10 lkraven lkraven 4096 2026-04-18 18:57 conf
drwxr-xr-x 7 lkraven lkraven 4096 2025-02-05 19:28 data
drwxr-xr-x 8 lkraven lkraven 4096 2026-04-15 23:47 .git
-rw-r--r-- 1 lkraven lkraven 14 2024-05-30 18:44 .gitignore
-rw-r--r-- 1 lkraven lkraven 60 2024-05-30 15:33 README.md
/opt/docker/compose (total: 224K)
total 84
drwxr-xr-x 20 lkraven lkraven 4096 2026-04-19 19:41 .
/opt/docker/compose (total: 244K)
total 88
drwxr-xr-x 21 lkraven lkraven 4096 2026-04-19 22:47 .
drwxrwxrwx 6 root root 4096 2026-04-15 23:28 ..
drwxr-xr-x 2 lkraven lkraven 4096 2026-04-19 22:11 backrest
drwxr-xr-x 2 root root 4096 2026-04-19 00:50 beszel
drwxr-xr-x 2 root root 4096 2026-04-15 23:02 crowdsec
drwxr-xr-x 2 lkraven lkraven 4096 2026-04-19 00:50 beszel
drwxr-xr-x 2 lkraven lkraven 4096 2026-04-15 23:02 crowdsec
drwxr-xr-x 2 lkraven lkraven 4096 2024-05-30 18:50 dockge
drwxr-xr-x 2 root root 4096 2026-04-19 00:25 dozzle-hub
drwxr-xr-x 2 lkraven lkraven 4096 2026-04-19 00:25 dozzle-hub
drwxr-xr-x 2 lkraven lkraven 4096 2024-05-30 18:50 gitea
drwxr-xr-x 2 root root 4096 2025-03-18 22:07 ittools
drwxr-xr-x 2 lkraven lkraven 4096 2025-03-18 22:07 ittools
drwxr-xr-x 2 lkraven lkraven 4096 2024-05-30 18:50 mailrise
drwxr-xr-x 2 lkraven lkraven 4096 2024-05-30 18:50 mattermost
drwxr-xr-x 2 root root 4096 2025-02-05 21:53 openwebui
drwxr-xr-x 2 lkraven lkraven 4096 2025-02-05 21:53 openwebui
-rw-r--r-- 1 lkraven lkraven 25 2024-05-30 15:33 README.md
drwxr-xr-x 2 lkraven lkraven 4096 2024-05-30 18:50 restic
drwxr-xr-x 2 lkraven lkraven 4096 2026-04-19 22:47 rest-server-ana
drwxr-xr-x 2 lkraven lkraven 4096 2024-05-30 18:50 rustdesk
drwxr-xr-x 2 lkraven lkraven 4096 2024-05-30 18:50 seafile
drwxr-xr-x 2 root root 4096 2026-04-18 18:55 searxng
drwxr-xr-x 2 root root 4096 2025-02-05 19:29 sillytavern
drwxr-xr-x 2 linus linus 4096 2026-04-11 13:59 synapse
drwxr-xr-x 2 lkraven lkraven 4096 2026-04-20 14:26 seafile
drwxr-xr-x 2 lkraven lkraven 4096 2026-04-18 18:55 searxng
drwxr-xr-x 2 lkraven lkraven 4096 2025-02-05 19:29 sillytavern
drwxr-xr-x 2 lkraven lkraven 4096 2026-04-11 13:59 synapse
drwxr-xr-x 2 lkraven lkraven 4096 2024-05-30 18:50 traefik
drwxr-xr-x 2 lkraven lkraven 4096 2024-05-30 18:50 vaultwarden
@@ -114,7 +115,7 @@ Server: 20.10.24+dfsg1 Client: 20.10.24+dfsg1
----- docker info -----
Containers: 26 (running 24, paused 0, stopped 2)
Images: 62
Images: 63
Runtimes: map[io.containerd.runc.v2:{runc [] <nil>} io.containerd.runtime.v1.linux:{runc [] <nil>} runc:{runc [] <nil>}]
Default runtime: runc
Storage driver: overlay2
@@ -122,40 +123,44 @@ Root dir: /var/lib/docker
Server version: 20.10.24+dfsg1
----- running containers -----
NAMES IMAGE STATUS PORTS
backrest garethgeorge/backrest:latest Up 3 minutes (healthy) 0.0.0.0:9898->9898/tcp, :::9898->9898/tcp
dockge-dockge-1 louislam/dockge:latest Up 2 hours (healthy) 0.0.0.0:5001->5001/tcp, :::5001->5001/tcp
searxng searxng/searxng:latest Up 10 hours (healthy) 0.0.0.0:9996->8080/tcp, :::9996->8080/tcp
beszel henrygd/beszel:latest Up 10 hours (healthy) 0.0.0.0:8090->8090/tcp, :::8090->8090/tcp
beszel-agent henrygd/beszel-agent:latest Up 10 hours
dozzle amir20/dozzle:latest Up 22 hours (healthy) 0.0.0.0:8088->8080/tcp, :::8088->8080/tcp
blocklist-mirror crowdsecurity/blocklist-mirror:latest Up 3 days 0.0.0.0:41412->41412/tcp, :::41412->41412/tcp
vaultwarden vaultwarden/server:latest Up 3 days (healthy) 0.0.0.0:9080->80/tcp, :::9080->80/tcp
crowdsec crowdsecurity/crowdsec:latest Up 3 days
traefik traefik:latest Up 3 days 0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:8380->8080/tcp, :::8380->8080/tcp
gitea gitea/gitea:latest Up 3 days 0.0.0.0:3000->3000/tcp, :::3000->3000/tcp, 0.0.0.0:222->22/tcp, :::222->22/tcp
element-web vectorim/element-web:v1.11.80 Up 4 days 80/tcp
synapse matrixdotorg/synapse:v1.120.0 Up 4 days (healthy) 8008-8009/tcp, 8448/tcp
synapse-db postgres:16-alpine Up 4 days (healthy) 5432/tcp
sillytavern ghcr.io/sillytavern/sillytavern:latest Up 2 weeks 0.0.0.0:8100->8000/tcp, :::8100->8000/tcp
seafile seafileltd/seafile-mc:11.0-latest Up 2 weeks 0.0.0.0:9180->80/tcp, :::9180->80/tcp
seafile-mysql mariadb:10.6 Up 2 weeks 3306/tcp
openwebui-open-webui-1 ghcr.io/open-webui/open-webui:main Up 2 weeks (healthy) 0.0.0.0:3100->8080/tcp, :::3100->8080/tcp
rest_server restic/rest-server Up 2 weeks 0.0.0.0:8000->8000/tcp, :::8000->8000/tcp
hbbs rustdesk/rustdesk-server:latest Up 2 weeks
hbbr rustdesk/rustdesk-server:latest Up 2 weeks
it-tools corentinth/it-tools:latest Up 2 weeks 0.0.0.0:8780->80/tcp, :::8780->80/tcp
seafile-memcached memcached:1.6.18 Up 2 weeks 11211/tcp
mailrise yoryan/mailrise:latest Up 2 weeks 0.0.0.0:8025->8025/tcp, :::8025->8025/tcp
NAMES IMAGE STATUS PORTS
seafile seafileltd/seafile-mc:11.0-latest Up About a minute 0.0.0.0:9180->80/tcp, :::9180->80/tcp
seafile-mysql mariadb:10.6 Up About a minute 3306/tcp
seafile-memcached memcached:1.6.18 Up About a minute 11211/tcp
rest-server restic/rest-server:latest Up 3 hours (healthy) 0.0.0.0:8000->8000/tcp, :::8000->8000/tcp
backrest garethgeorge/backrest:latest Up 16 hours (healthy) 0.0.0.0:9898->9898/tcp, :::9898->9898/tcp
dockge-dockge-1 louislam/dockge:latest Up 19 hours (healthy) 0.0.0.0:5001->5001/tcp, :::5001->5001/tcp
searxng searxng/searxng:latest Up 26 hours (healthy) 0.0.0.0:9996->8080/tcp, :::9996->8080/tcp
beszel henrygd/beszel:latest Up 27 hours (healthy) 0.0.0.0:8090->8090/tcp, :::8090->8090/tcp
beszel-agent henrygd/beszel-agent:latest Up 27 hours
dozzle amir20/dozzle:latest Up 38 hours (healthy) 0.0.0.0:8088->8080/tcp, :::8088->8080/tcp
blocklist-mirror crowdsecurity/blocklist-mirror:latest Up 3 days 0.0.0.0:41412->41412/tcp, :::41412->41412/tcp
vaultwarden vaultwarden/server:latest Up 3 days (healthy) 0.0.0.0:9080->80/tcp, :::9080->80/tcp
crowdsec crowdsecurity/crowdsec:latest Up 3 days
traefik traefik:latest Up 3 days 0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:8380->8080/tcp, :::8380->8080/tcp
gitea gitea/gitea:latest Up 3 days 0.0.0.0:3000->3000/tcp, :::3000->3000/tcp, 0.0.0.0:222->22/tcp, :::222->22/tcp
element-web vectorim/element-web:v1.11.80 Up 4 days 80/tcp
synapse matrixdotorg/synapse:v1.120.0 Up 4 days (healthy) 8008-8009/tcp, 8448/tcp
synapse-db postgres:16-alpine Up 4 days (healthy) 5432/tcp
sillytavern ghcr.io/sillytavern/sillytavern:latest Up 2 weeks 0.0.0.0:8100->8000/tcp, :::8100->8000/tcp
openwebui-open-webui-1 ghcr.io/open-webui/open-webui:main Up 2 weeks (healthy) 0.0.0.0:3100->8080/tcp, :::3100->8080/tcp
hbbs rustdesk/rustdesk-server:latest Up 2 weeks
hbbr rustdesk/rustdesk-server:latest Up 2 weeks
it-tools corentinth/it-tools:latest Up 2 weeks 0.0.0.0:8780->80/tcp, :::8780->80/tcp
mailrise yoryan/mailrise:latest Up 2 weeks 0.0.0.0:8025->8025/tcp, :::8025->8025/tcp
----- all containers -----
NAMES IMAGE STATUS
backrest garethgeorge/backrest:latest Up 3 minutes (healthy)
dockge-dockge-1 louislam/dockge:latest Up 2 hours (healthy)
searxng searxng/searxng:latest Up 10 hours (healthy)
beszel henrygd/beszel:latest Up 10 hours (healthy)
beszel-agent henrygd/beszel-agent:latest Up 10 hours
dozzle amir20/dozzle:latest Up 22 hours (healthy)
seafile seafileltd/seafile-mc:11.0-latest Up About a minute
seafile-mysql mariadb:10.6 Up About a minute
seafile-memcached memcached:1.6.18 Up About a minute
rest-server restic/rest-server:latest Up 3 hours (healthy)
backrest garethgeorge/backrest:latest Up 16 hours (healthy)
dockge-dockge-1 louislam/dockge:latest Up 19 hours (healthy)
searxng searxng/searxng:latest Up 26 hours (healthy)
beszel henrygd/beszel:latest Up 27 hours (healthy)
beszel-agent henrygd/beszel-agent:latest Up 27 hours
dozzle amir20/dozzle:latest Up 38 hours (healthy)
blocklist-mirror crowdsecurity/blocklist-mirror:latest Up 3 days
vaultwarden vaultwarden/server:latest Up 3 days (healthy)
crowdsec crowdsecurity/crowdsec:latest Up 3 days
@@ -167,14 +172,10 @@ element-web vectorim/element-web:v1.11.80 Up 4 days
synapse matrixdotorg/synapse:v1.120.0 Up 4 days (healthy)
synapse-db postgres:16-alpine Up 4 days (healthy)
sillytavern ghcr.io/sillytavern/sillytavern:latest Up 2 weeks
seafile seafileltd/seafile-mc:11.0-latest Up 2 weeks
seafile-mysql mariadb:10.6 Up 2 weeks
openwebui-open-webui-1 ghcr.io/open-webui/open-webui:main Up 2 weeks (healthy)
rest_server restic/rest-server Up 2 weeks
hbbs rustdesk/rustdesk-server:latest Up 2 weeks
hbbr rustdesk/rustdesk-server:latest Up 2 weeks
it-tools corentinth/it-tools:latest Up 2 weeks
seafile-memcached memcached:1.6.18 Up 2 weeks
mailrise yoryan/mailrise:latest Up 2 weeks
----- networks -----
@@ -247,7 +248,7 @@ gitea
ittools
mailrise
openwebui
restic
rest-server-ana
rustdesk
seafile
searxng
@@ -714,6 +715,66 @@ networks:
name: traefik-net
external: true
>>> /opt/docker/compose/rest-server-ana/compose.yaml
# rest-server (Anaheim) — restic backup target for the fleet.
#
# Deploys to ana-docker. Data dir is on the TrueNAS NFS mount
# (/mnt/backup/restic/repo/ana) so snapshots on the NAS side protect the
# backup blobs themselves.
#
# Mirrors stacks/rest-server-nh3/ in every meaningful way — same auth
# model, same on-disk layout, same operational semantics — so each client
# host uses an identical URL shape against either endpoint:
#
# rest:http://<user>:<pw>@10.100.50.50:8000/<user>/ (NH3 Synology)
# rest:http://<user>:<pw>@10.250.50.70:8000/<user>/ (this stack)
#
# Auth model:
# --private-repos : URL path must start with /<user>/ and the HTTP
# basic-auth user must match. Per-host repos are
# strictly isolated.
# --append-only : on-disk data can be added but not removed or
# rewritten; a compromised host can't wipe its own
# history. Prune requires disabling this (see README).
#
# Credentials come from /data/.htpasswd — see README for populating it.
#
# All tunables live in .env — edit that, not this file.
services:
rest-server:
image: restic/rest-server:${REST_SERVER_VERSION}
container_name: rest-server
restart: unless-stopped
# Run as the UID that owns the NFS-backed data dir, so file I/O
# is not subject to NFS root_squash. On ana-docker this is lkraven (1000).
user: ${REST_UID:-1000}:${REST_GID:-1000}
ports:
- ${REST_PORT}:8000
volumes:
- ${DATA_DIR}:/data
environment:
- OPTIONS=--private-repos --append-only --prometheus ${EXTRA_OPTIONS:-}
- TZ=${TZ:-America/Los_Angeles}
healthcheck:
test: ["CMD", "nc", "-z", "localhost", "8000"]
interval: 30s
timeout: 10s
retries: 3
start_period: 15s
networks:
- tnet
labels:
- homepage.group=PFI-ANA
- homepage.name=Restic (rest-server)
- homepage.icon=mdi-cloud-upload
- homepage.description=Anaheim restic endpoint (data on TrueNAS NFS)
- homepage.href=http://10.250.50.70:${REST_PORT}
networks:
tnet:
name: traefik-net
external: true
>>> /opt/docker/compose/rustdesk/compose.yaml
version: "3"
services:
@@ -754,7 +815,7 @@ services:
image: mariadb:10.6
container_name: seafile-mysql
environment:
- MYSQL_ROOT_PASSWORD=[REDACTED-upstream-compose-inlines-this] # Requested, set the root's password of MySQL service.
- MYSQL_ROOT_PASSWORD=${DB_ROOT_PW}
- MYSQL_LOG_CONSOLE=true
volumes:
- seafile_db:/var/lib/mysql # Requested, specifies the path to MySQL data persistent store.
servers/esh-docker-vm/system-details.txt
+13 -13
View File
@@ -2,8 +2,8 @@
===== HOST =====
Hostname: esh-vm-docker.esteban.net
Date: 2026-04-19T22:15:59-07:00
Uptime: up 2 weeks, 6 days, 5 hours, 59 minutes
Date: 2026-04-20T14:28:06-07:00
Uptime: up 2 weeks, 6 days, 22 hours, 11 minutes
OS: Debian GNU/Linux 12 (bookworm)
Kernel: 6.1.0-41-amd64
Arch: x86_64
@@ -58,11 +58,11 @@ UUID=4f4fa84b-2b71-4ee5-9be4-2deb4c287d8e none swap sw
-rw-r--r-- 1 lkraven lkraven 1059 2025-03-18 23:58 LICENSE
-rw-r--r-- 1 lkraven lkraven 60 2025-03-18 23:58 README.md
/opt/docker/compose (total: 172K)
/opt/docker/compose (total: 180K)
total 76
drwxr-xr-x 18 lkraven lkraven 4096 2026-04-19 01:08 .
drwxr-xr-x 5 lkraven lkraven 4096 2025-03-18 23:58 ..
drwxr-xr-x 2 lkraven lkraven 4096 2025-03-18 23:58 adguard
drwxr-xr-x 2 lkraven lkraven 4096 2026-04-20 14:27 adguard
drwxr-xr-x 2 root root 4096 2026-04-19 01:07 beszel-esh-vm-docker
drwxr-xr-x 2 lkraven lkraven 4096 2025-03-18 23:58 calibre
drwxr-xr-x 2 lkraven lkraven 4096 2025-03-18 23:58 calibre-web
@@ -114,14 +114,14 @@ Server version: 20.10.24+dfsg1
----- running containers -----
NAMES IMAGE STATUS PORTS
beszel-agent henrygd/beszel-agent:latest Up 21 hours
dozzle-agent amir20/dozzle:latest Up 22 hours 0.0.0.0:7007->7007/tcp, 8080/tcp
traefik traefik:latest Up 3 days 0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:8380->8080/tcp, :::8380->8080/tcp
beszel-agent henrygd/beszel-agent:latest Up 37 hours
dozzle-agent amir20/dozzle:latest Up 38 hours 0.0.0.0:7007->7007/tcp, 8080/tcp
traefik traefik:latest Up 4 days 0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:8380->8080/tcp, :::8380->8080/tcp
paperless-ngx-webserver-1 ghcr.io/paperless-ngx/paperless-ngx:latest Up 2 weeks (healthy) 0.0.0.0:8200->8000/tcp, :::8200->8000/tcp
paperless-ngx-broker-1 redis:7 Up 2 weeks 6379/tcp
paperless-ngx-backup-1 offen/docker-volume-backup:latest Up 2 weeks
homepage ghcr.io/gethomepage/homepage:latest Up 2 weeks (healthy) 0.0.0.0:5100->3000/tcp, :::5100->3000/tcp
homeassistant homeassistant/home-assistant:latest Up 30 hours
homeassistant homeassistant/home-assistant:latest Up 46 hours
mosquitto eclipse-mosquitto:latest Up 2 weeks 0.0.0.0:1883->1883/tcp, :::1883->1883/tcp
adguardhome adguard/adguardhome Up 2 weeks 67-68/udp, 0.0.0.0:53->53/udp, :::53->53/udp, 443/udp, 0.0.0.0:53->53/tcp, :::53->53/tcp, 853/udp, 0.0.0.0:853->853/tcp, :::853->853/tcp, 3000/udp, 5443/tcp, 0.0.0.0:3000->3000/tcp, 0.0.0.0:784->784/udp, :::3000->3000/tcp, :::784->784/udp, 5443/udp, 6060/tcp, 0.0.0.0:8080->80/tcp, :::8080->80/tcp, 0.0.0.0:8443->443/tcp, :::8443->443/tcp
cloudflare-ddns timothyjmiller/cloudflare-ddns:latest Up 2 weeks
@@ -138,14 +138,14 @@ portainer portainer/portainer-ce:latest Up 2 we
----- all containers -----
NAMES IMAGE STATUS
beszel-agent henrygd/beszel-agent:latest Up 21 hours
dozzle-agent amir20/dozzle:latest Up 22 hours
traefik traefik:latest Up 3 days
beszel-agent henrygd/beszel-agent:latest Up 37 hours
dozzle-agent amir20/dozzle:latest Up 38 hours
traefik traefik:latest Up 4 days
paperless-ngx-webserver-1 ghcr.io/paperless-ngx/paperless-ngx:latest Up 2 weeks (healthy)
paperless-ngx-broker-1 redis:7 Up 2 weeks
paperless-ngx-backup-1 offen/docker-volume-backup:latest Up 2 weeks
homepage ghcr.io/gethomepage/homepage:latest Up 2 weeks (healthy)
homeassistant homeassistant/home-assistant:latest Up 30 hours
homeassistant homeassistant/home-assistant:latest Up 46 hours
mosquitto eclipse-mosquitto:latest Up 2 weeks
adguardhome adguard/adguardhome Up 2 weeks
friendly_maxwell 0745ced90756 Exited (13) 4 months ago
@@ -260,7 +260,7 @@ services:
- homepage.widget.type=adguard
- homepage.widget.url=http://10.0.50.45:8080
- homepage.widget.username=lkraven
- homepage.widget.password=[REDACTED-upstream-compose-inlines-this]
- homepage.widget.password=${ADGUARD_WIDGET_PASSWORD}
networks:
- tnet