gwolaniuk/techarmor-iaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

initial

Browse source
This commit is contained in:
Grzegorz Wolaniuk 2026-08-27 11:24:02 +02:00
parent 2417ee852e
commit 5454f0df02
5 changed files with 280 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docker/.env.example
View file

@ -7,3 +7,5 @@ DOCMOST_DB_PASSWORD=change_me_secure_db_password
DOCMOST_SECRET=change_me_super_secret_key
PAPERLESS_DB_PASSWORD=change_me_secure_db_password
PAPERLESS_SECRET=change_me_super_secret_key
FREESCOUT_DB_PASSWORD=change_me_secure_db_password
FREESCOUT_ROOT_PASSWORD=change_me_secure_root_password

119
docker/docker-compose.yml
View file

@ -12,6 +12,8 @@ volumes:
homepage_config:
authentik_db:
authentik_redis:
authentik_media:
authentik_certs:
simplelogin_data:
simplelogin_postgres:
simplelogin_redis:
@ -29,6 +31,9 @@ volumes:
paperless_redis:
calibre_data:
uptime_kuma:
freescout_data:
freescout_db:
freescout_redis:
services:
# ==========================================
@ -58,7 +63,6 @@ services:
- PUID=1000
- PGID=1000
- HOMEPAGE_ALLOWED_HOSTS=*
networks:
- proxy-net
- internal-net
@ -67,7 +71,70 @@ services:
- /var/run/docker.sock:/var/run/docker.sock:ro
# ==========================================
# 3. EMAIL ALIAS SERVICE (SimpleLogin)
# 3. AUTHENTICATION / SSO (Authentik)
# ==========================================
authentik-db:
image: postgres:15-alpine
restart: unless-stopped
environment:
- POSTGRES_DB=authentik
- POSTGRES_USER=authentik
- POSTGRES_PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password}
networks:
- internal-net
volumes:
- authentik_db:/var/lib/postgresql/data
authentik-redis:
image: redis:7-alpine
restart: unless-stopped
networks:
- internal-net
authentik-server:
image: ghcr.io/goauthentik/server:2024.12.3
restart: unless-stopped
command: server
environment:
- AUTHENTIK_REDIS__HOST=authentik-redis
- AUTHENTIK_POSTGRESQL__HOST=authentik-db
- AUTHENTIK_POSTGRESQL__USER=authentik
- AUTHENTIK_POSTGRESQL__NAME=authentik
- AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password}
- AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET:-super_secret_key}
networks:
- proxy-net
- internal-net
volumes:
- authentik_media:/media
- authentik_certs:/certs
depends_on:
- authentik-db
- authentik-redis
authentik-worker:
image: ghcr.io/goauthentik/server:2024.12.3
restart: unless-stopped
command: worker
environment:
- AUTHENTIK_REDIS__HOST=authentik-redis
- AUTHENTIK_POSTGRESQL__HOST=authentik-db
- AUTHENTIK_POSTGRESQL__USER=authentik
- AUTHENTIK_POSTGRESQL__NAME=authentik
- AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password}
- AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET:-super_secret_key}
networks:
- proxy-net
- internal-net
volumes:
- authentik_media:/media
- authentik_certs:/certs
depends_on:
- authentik-db
- authentik-redis
# ==========================================
# 4. EMAIL ALIAS SERVICE (SimpleLogin)
# ==========================================
simplelogin-app:
image: simplelogin/app:latest
@ -106,7 +173,7 @@ services:
- internal-net
# ==========================================
# 4. CLOUD PLATFORM & OFFICE (Nextcloud + Collabora)
# 5. CLOUD PLATFORM & OFFICE (Nextcloud + Collabora)
# ==========================================
nextcloud:
image: nextcloud:apache
@ -150,7 +217,7 @@ services:
- MKNOD
# ==========================================
# 5. GIT & CI/CD (Forgejo)
# 6. GIT & CI/CD (Forgejo)
# ==========================================
forgejo:
image: codeberg.org/forgejo/forgejo:10
@ -167,7 +234,7 @@ services:
- "222:22" # SSH port mapping
# ==========================================
# 6. KNOWLEDGE BASE & WIKI (Docmost)
# 7. KNOWLEDGE BASE & WIKI (Docmost)
# ==========================================
docmost:
image: docmost/docmost:latest
@ -205,7 +272,7 @@ services:
- internal-net
# ==========================================
# 7. DOCUMENT ARCHIVING (Paperless-ngx)
# 8. DOCUMENT ARCHIVING (Paperless-ngx)
# ==========================================
paperless-webserver:
image: ghcr.io/paperless-ngx/paperless-ngx:latest
@ -247,7 +314,7 @@ services:
- internal-net
# ==========================================
# 8. E-BOOK LIBRARY (Calibre-Web)
# 9. E-BOOK LIBRARY (Calibre-Web)
# ==========================================
calibre-web:
image: lscr.io/linuxserver/calibre-web:latest
@ -265,13 +332,43 @@ services:
- /srv/company/books:/books
# ==========================================
# 9. MONITORING (Uptime Kuma)
# 11. HELP DESK (FreeScout)
# ==========================================
uptime-kuma:
image: louislam/uptime-kuma:1
freescout:
image: tiredofit/freescout:latest
restart: unless-stopped
environment:
- DB_TYPE=mysql
- DB_HOST=freescout-db
- DB_NAME=freescout
- DB_USER=freescout
- DB_PASSWORD=${FREESCOUT_DB_PASSWORD:-secure_password}
- SITE_URL=https://support.techarmor.pl
- APP_ENV=production
networks:
- proxy-net
- internal-net
volumes:
- uptime_kuma:/app/data
- freescout_data:/data
depends_on:
- freescout-db
- freescout-redis
freescout-db:
image: mariadb:10.11
restart: unless-stopped
environment:
- MYSQL_DATABASE=freescout
- MYSQL_USER=freescout
- MYSQL_PASSWORD=${FREESCOUT_DB_PASSWORD:-secure_password}
- MYSQL_ROOT_PASSWORD=${FREESCOUT_ROOT_PASSWORD:-root_password}
networks:
- internal-net
volumes:
- freescout_db:/var/lib/mysql
freescout-redis:
image: redis:7-alpine
restart: unless-stopped
networks:
- internal-net

4
docker/homepage/services.yaml
View file

@ -32,3 +32,7 @@
icon: uptime-kuma.png
href: https://status.techarmor.pl
description: System health & uptime
- Help Desk:
icon: freescout.png
href: https://support.techarmor.pl
description: Support tickets & communication

11
terraform/main.tf
View file

@ -1,3 +1,14 @@
# Authentik SSO & Identity Provider
resource "nginxproxymanager_proxy_host" "auth" {
domain_names = ["auth.${var.domain}"]
forward_host = "authentik-server"
forward_port = 9000
forward_scheme = "http"
enabled = true
block_exploits = true
allow_websocket_upgrade = true
}
# Central Dashboard
resource "nginxproxymanager_proxy_host" "dashboard" {
domain_names = ["dashboard.${var.domain}"]

165
terraform/terraform.tfstate
View file

@ -1,10 +1,50 @@
{
"version": 4,
"terraform_version": "1.11.0",
"serial": 11,
"serial": 24,
"lineage": "8e77a2a6-a8be-5186-4b43-950cf5faa83a",
"outputs": {},
"resources": [
{
"mode": "managed",
"type": "nginxproxymanager_proxy_host",
"name": "auth",
"provider": "provider[\"registry.terraform.io/sander0542/nginxproxymanager\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"access_list_id": null,
"advanced_config": "",
"allow_websocket_upgrade": true,
"block_exploits": true,
"caching_enabled": false,
"certificate_id": null,
"created_on": "2026-08-27 06:07:25",
"domain_names": [
"auth.techarmor.pl"
],
"enabled": true,
"forward_host": "authentik-server",
"forward_port": 9000,
"forward_scheme": "http",
"hsts_enabled": false,
"hsts_subdomains": false,
"http2_support": false,
"id": 13,
"locations": [],
"meta": {
"nginx_err": null,
"nginx_online": "true"
},
"modified_on": "2026-08-27 06:07:25",
"owner_user_id": 1,
"ssl_forced": false
},
"sensitive_attributes": []
}
]
},
{
"mode": "managed",
"type": "nginxproxymanager_proxy_host",
@ -33,7 +73,10 @@
"http2_support": false,
"id": 10,
"locations": [],
"meta": null,
"meta": {
"nginx_err": null,
"nginx_online": "true"
},
"modified_on": "2026-08-27 00:02:03",
"owner_user_id": 1,
"ssl_forced": false
@ -70,7 +113,10 @@
"http2_support": false,
"id": 6,
"locations": [],
"meta": null,
"meta": {
"nginx_err": null,
"nginx_online": "true"
},
"modified_on": "2026-08-27 00:02:03",
"owner_user_id": 1,
"ssl_forced": false
@ -79,6 +125,47 @@
}
]
},
{
"mode": "managed",
"type": "nginxproxymanager_proxy_host",
"name": "dashboard",
"provider": "provider[\"registry.terraform.io/sander0542/nginxproxymanager\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"access_list_id": null,
"advanced_config": "",
"allow_websocket_upgrade": true,
"block_exploits": true,
"caching_enabled": false,
"certificate_id": null,
"created_on": "2026-08-26 20:39:14",
"domain_names": [
"dashboard.techarmor.pl",
"techarmor.pl"
],
"enabled": true,
"forward_host": "homepage",
"forward_port": 3000,
"forward_scheme": "http",
"hsts_enabled": false,
"hsts_subdomains": false,
"http2_support": false,
"id": 3,
"locations": [],
"meta": {
"nginx_err": null,
"nginx_online": "true"
},
"modified_on": "2026-08-27 07:55:03",
"owner_user_id": 1,
"ssl_forced": false
},
"sensitive_attributes": []
}
]
},
{
"mode": "managed",
"type": "nginxproxymanager_proxy_host",
@ -107,7 +194,10 @@
"http2_support": false,
"id": 9,
"locations": [],
"meta": null,
"meta": {
"nginx_err": null,
"nginx_online": "true"
},
"modified_on": "2026-08-27 00:02:03",
"owner_user_id": 1,
"ssl_forced": false
@ -144,7 +234,10 @@
"http2_support": false,
"id": 7,
"locations": [],
"meta": null,
"meta": {
"nginx_err": null,
"nginx_online": "true"
},
"modified_on": "2026-08-27 00:02:03",
"owner_user_id": 1,
"ssl_forced": false
@ -181,7 +274,10 @@
"http2_support": false,
"id": 8,
"locations": [],
"meta": null,
"meta": {
"nginx_err": null,
"nginx_online": "true"
},
"modified_on": "2026-08-27 00:02:03",
"owner_user_id": 1,
"ssl_forced": false
@ -218,7 +314,10 @@
"http2_support": false,
"id": 11,
"locations": [],
"meta": null,
"meta": {
"nginx_err": null,
"nginx_online": "true"
},
"modified_on": "2026-08-27 00:02:03",
"owner_user_id": 1,
"ssl_forced": false
@ -227,6 +326,46 @@
}
]
},
{
"mode": "managed",
"type": "nginxproxymanager_proxy_host",
"name": "status",
"provider": "provider[\"registry.terraform.io/sander0542/nginxproxymanager\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"access_list_id": null,
"advanced_config": "",
"allow_websocket_upgrade": true,
"block_exploits": false,
"caching_enabled": false,
"certificate_id": null,
"created_on": "2026-08-26 21:17:47",
"domain_names": [
"status.techarmor.pl"
],
"enabled": true,
"forward_host": "uptime-kuma",
"forward_port": 3001,
"forward_scheme": "http",
"hsts_enabled": false,
"hsts_subdomains": false,
"http2_support": false,
"id": 4,
"locations": [],
"meta": {
"nginx_err": null,
"nginx_online": "true"
},
"modified_on": "2026-08-27 00:06:00",
"owner_user_id": 1,
"ssl_forced": false
},
"sensitive_attributes": []
}
]
},
{
"mode": "managed",
"type": "nginxproxymanager_proxy_host",
@ -255,7 +394,10 @@
"http2_support": false,
"id": 12,
"locations": [],
"meta": null,
"meta": {
"nginx_err": null,
"nginx_online": "true"
},
"modified_on": "2026-08-27 00:02:03",
"owner_user_id": 1,
"ssl_forced": false
@ -292,8 +434,11 @@
"http2_support": false,
"id": 5,
"locations": [],
"meta": null,
"modified_on": "2026-08-27 00:02:02",
"meta": {
"nginx_err": null,
"nginx_online": "true"
},
"modified_on": "2026-08-27 00:02:03",
"owner_user_id": 1,
"ssl_forced": false
},