initial

docker/.env.example

@@ -7,3 +7,5 @@ DOCMOST_DB_PASSWORD=change_me_secure_db_password
 DOCMOST_SECRET=change_me_super_secret_key
 PAPERLESS_DB_PASSWORD=change_me_secure_db_password
 PAPERLESS_SECRET=change_me_super_secret_key
+FREESCOUT_DB_PASSWORD=change_me_secure_db_password
+FREESCOUT_ROOT_PASSWORD=change_me_secure_root_password

docker/docker-compose.yml

@@ -12,6 +12,8 @@ volumes:
   homepage_config:
   authentik_db:
   authentik_redis:
+  authentik_media:
+  authentik_certs:
   simplelogin_data:
   simplelogin_postgres:
   simplelogin_redis:
@@ -29,6 +31,9 @@ volumes:
   paperless_redis:
   calibre_data:
   uptime_kuma:
+  freescout_data:
+  freescout_db:
+  freescout_redis:
 
 services:
   # ==========================================
@@ -58,7 +63,6 @@ services:
       - PUID=1000
       - PGID=1000
       - HOMEPAGE_ALLOWED_HOSTS=*
-
     networks:
       - proxy-net
       - internal-net
@@ -67,7 +71,70 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
 
   # ==========================================
-  # 3. EMAIL ALIAS SERVICE (SimpleLogin)
+  # 3. AUTHENTICATION / SSO (Authentik)
+  # ==========================================
+  authentik-db:
+    image: postgres:15-alpine
+    restart: unless-stopped
+    environment:
+      - POSTGRES_DB=authentik
+      - POSTGRES_USER=authentik
+      - POSTGRES_PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password}
+    networks:
+      - internal-net
+    volumes:
+      - authentik_db:/var/lib/postgresql/data
+
+  authentik-redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    networks:
+      - internal-net
+
+  authentik-server:
+    image: ghcr.io/goauthentik/server:2024.12.3
+    restart: unless-stopped
+    command: server
+    environment:
+      - AUTHENTIK_REDIS__HOST=authentik-redis
+      - AUTHENTIK_POSTGRESQL__HOST=authentik-db
+      - AUTHENTIK_POSTGRESQL__USER=authentik
+      - AUTHENTIK_POSTGRESQL__NAME=authentik
+      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password}
+      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET:-super_secret_key}
+    networks:
+      - proxy-net
+      - internal-net
+    volumes:
+      - authentik_media:/media
+      - authentik_certs:/certs
+    depends_on:
+      - authentik-db
+      - authentik-redis
+
+  authentik-worker:
+    image: ghcr.io/goauthentik/server:2024.12.3
+    restart: unless-stopped
+    command: worker
+    environment:
+      - AUTHENTIK_REDIS__HOST=authentik-redis
+      - AUTHENTIK_POSTGRESQL__HOST=authentik-db
+      - AUTHENTIK_POSTGRESQL__USER=authentik
+      - AUTHENTIK_POSTGRESQL__NAME=authentik
+      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD:-secure_db_password}
+      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET:-super_secret_key}
+    networks:
+      - proxy-net
+      - internal-net
+    volumes:
+      - authentik_media:/media
+      - authentik_certs:/certs
+    depends_on:
+      - authentik-db
+      - authentik-redis
+
+  # ==========================================
+  # 4. EMAIL ALIAS SERVICE (SimpleLogin)
   # ==========================================
   simplelogin-app:
     image: simplelogin/app:latest
@@ -106,7 +173,7 @@ services:
       - internal-net
 
   # ==========================================
-  # 4. CLOUD PLATFORM & OFFICE (Nextcloud + Collabora)
+  # 5. CLOUD PLATFORM & OFFICE (Nextcloud + Collabora)
   # ==========================================
   nextcloud:
     image: nextcloud:apache
@@ -150,7 +217,7 @@ services:
       - MKNOD
 
   # ==========================================
-  # 5. GIT & CI/CD (Forgejo)
+  # 6. GIT & CI/CD (Forgejo)
   # ==========================================
   forgejo:
     image: codeberg.org/forgejo/forgejo:10
@@ -167,7 +234,7 @@ services:
       - "222:22" # SSH port mapping
 
   # ==========================================
-  # 6. KNOWLEDGE BASE & WIKI (Docmost)
+  # 7. KNOWLEDGE BASE & WIKI (Docmost)
   # ==========================================
   docmost:
     image: docmost/docmost:latest
@@ -205,7 +272,7 @@ services:
       - internal-net
 
   # ==========================================
-  # 7. DOCUMENT ARCHIVING (Paperless-ngx)
+  # 8. DOCUMENT ARCHIVING (Paperless-ngx)
   # ==========================================
   paperless-webserver:
     image: ghcr.io/paperless-ngx/paperless-ngx:latest
@@ -247,7 +314,7 @@ services:
       - internal-net
 
   # ==========================================
-  # 8. E-BOOK LIBRARY (Calibre-Web)
+  # 9. E-BOOK LIBRARY (Calibre-Web)
   # ==========================================
   calibre-web:
     image: lscr.io/linuxserver/calibre-web:latest
@@ -265,13 +332,43 @@ services:
       - /srv/company/books:/books
 
   # ==========================================
-  # 9. MONITORING (Uptime Kuma)
+  # 11. HELP DESK (FreeScout)
   # ==========================================
-  uptime-kuma:
+  freescout:
-    image: louislam/uptime-kuma:1
+    image: tiredofit/freescout:latest
     restart: unless-stopped
+    environment:
+      - DB_TYPE=mysql
+      - DB_HOST=freescout-db
+      - DB_NAME=freescout
+      - DB_USER=freescout
+      - DB_PASSWORD=${FREESCOUT_DB_PASSWORD:-secure_password}
+      - SITE_URL=https://support.techarmor.pl
+      - APP_ENV=production
     networks:
       - proxy-net
       - internal-net
     volumes:
-      - uptime_kuma:/app/data
+      - freescout_data:/data
+    depends_on:
+      - freescout-db
+      - freescout-redis
+
+  freescout-db:
+    image: mariadb:10.11
+    restart: unless-stopped
+    environment:
+      - MYSQL_DATABASE=freescout
+      - MYSQL_USER=freescout
+      - MYSQL_PASSWORD=${FREESCOUT_DB_PASSWORD:-secure_password}
+      - MYSQL_ROOT_PASSWORD=${FREESCOUT_ROOT_PASSWORD:-root_password}
+    networks:
+      - internal-net
+    volumes:
+      - freescout_db:/var/lib/mysql
+
+  freescout-redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    networks:
+      - internal-net

docker/homepage/services.yaml

@@ -32,3 +32,7 @@
         icon: uptime-kuma.png
         href: https://status.techarmor.pl
         description: System health & uptime
+    - Help Desk:
+        icon: freescout.png
+        href: https://support.techarmor.pl
+        description: Support tickets & communication

terraform/main.tf

@@ -1,3 +1,14 @@
+# Authentik SSO & Identity Provider
+resource "nginxproxymanager_proxy_host" "auth" {
+  domain_names            = ["auth.${var.domain}"]
+  forward_host            = "authentik-server"
+  forward_port            = 9000
+  forward_scheme          = "http"
+  enabled                 = true
+  block_exploits          = true
+  allow_websocket_upgrade = true
+}
+
 # Central Dashboard
 resource "nginxproxymanager_proxy_host" "dashboard" {
   domain_names            = ["dashboard.${var.domain}"]

terraform/terraform.tfstate

@@ -1,10 +1,50 @@
 {
   "version": 4,
   "terraform_version": "1.11.0",
-  "serial": 11,
+  "serial": 24,
   "lineage": "8e77a2a6-a8be-5186-4b43-950cf5faa83a",
   "outputs": {},
   "resources": [
+    {
+      "mode": "managed",
+      "type": "nginxproxymanager_proxy_host",
+      "name": "auth",
+      "provider": "provider[\"registry.terraform.io/sander0542/nginxproxymanager\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_list_id": null,
+            "advanced_config": "",
+            "allow_websocket_upgrade": true,
+            "block_exploits": true,
+            "caching_enabled": false,
+            "certificate_id": null,
+            "created_on": "2026-08-27 06:07:25",
+            "domain_names": [
+              "auth.techarmor.pl"
+            ],
+            "enabled": true,
+            "forward_host": "authentik-server",
+            "forward_port": 9000,
+            "forward_scheme": "http",
+            "hsts_enabled": false,
+            "hsts_subdomains": false,
+            "http2_support": false,
+            "id": 13,
+            "locations": [],
+            "meta": {
+              "nginx_err": null,
+              "nginx_online": "true"
+            },
+            "modified_on": "2026-08-27 06:07:25",
+            "owner_user_id": 1,
+            "ssl_forced": false
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    },
     {
       "mode": "managed",
       "type": "nginxproxymanager_proxy_host",
@@ -33,7 +73,10 @@
             "http2_support": false,
             "id": 10,
             "locations": [],
-            "meta": null,
+            "meta": {
+              "nginx_err": null,
+              "nginx_online": "true"
+            },
             "modified_on": "2026-08-27 00:02:03",
             "owner_user_id": 1,
             "ssl_forced": false
@@ -70,7 +113,10 @@
             "http2_support": false,
             "id": 6,
             "locations": [],
-            "meta": null,
+            "meta": {
+              "nginx_err": null,
+              "nginx_online": "true"
+            },
             "modified_on": "2026-08-27 00:02:03",
             "owner_user_id": 1,
             "ssl_forced": false
@@ -79,6 +125,47 @@
         }
       ]
     },
+    {
+      "mode": "managed",
+      "type": "nginxproxymanager_proxy_host",
+      "name": "dashboard",
+      "provider": "provider[\"registry.terraform.io/sander0542/nginxproxymanager\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_list_id": null,
+            "advanced_config": "",
+            "allow_websocket_upgrade": true,
+            "block_exploits": true,
+            "caching_enabled": false,
+            "certificate_id": null,
+            "created_on": "2026-08-26 20:39:14",
+            "domain_names": [
+              "dashboard.techarmor.pl",
+              "techarmor.pl"
+            ],
+            "enabled": true,
+            "forward_host": "homepage",
+            "forward_port": 3000,
+            "forward_scheme": "http",
+            "hsts_enabled": false,
+            "hsts_subdomains": false,
+            "http2_support": false,
+            "id": 3,
+            "locations": [],
+            "meta": {
+              "nginx_err": null,
+              "nginx_online": "true"
+            },
+            "modified_on": "2026-08-27 07:55:03",
+            "owner_user_id": 1,
+            "ssl_forced": false
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    },
     {
       "mode": "managed",
       "type": "nginxproxymanager_proxy_host",
@@ -107,7 +194,10 @@
             "http2_support": false,
             "id": 9,
             "locations": [],
-            "meta": null,
+            "meta": {
+              "nginx_err": null,
+              "nginx_online": "true"
+            },
             "modified_on": "2026-08-27 00:02:03",
             "owner_user_id": 1,
             "ssl_forced": false
@@ -144,7 +234,10 @@
             "http2_support": false,
             "id": 7,
             "locations": [],
-            "meta": null,
+            "meta": {
+              "nginx_err": null,
+              "nginx_online": "true"
+            },
             "modified_on": "2026-08-27 00:02:03",
             "owner_user_id": 1,
             "ssl_forced": false
@@ -181,7 +274,10 @@
             "http2_support": false,
             "id": 8,
             "locations": [],
-            "meta": null,
+            "meta": {
+              "nginx_err": null,
+              "nginx_online": "true"
+            },
             "modified_on": "2026-08-27 00:02:03",
             "owner_user_id": 1,
             "ssl_forced": false
@@ -218,7 +314,10 @@
             "http2_support": false,
             "id": 11,
             "locations": [],
-            "meta": null,
+            "meta": {
+              "nginx_err": null,
+              "nginx_online": "true"
+            },
             "modified_on": "2026-08-27 00:02:03",
             "owner_user_id": 1,
             "ssl_forced": false
@@ -227,6 +326,46 @@
         }
       ]
     },
+    {
+      "mode": "managed",
+      "type": "nginxproxymanager_proxy_host",
+      "name": "status",
+      "provider": "provider[\"registry.terraform.io/sander0542/nginxproxymanager\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_list_id": null,
+            "advanced_config": "",
+            "allow_websocket_upgrade": true,
+            "block_exploits": false,
+            "caching_enabled": false,
+            "certificate_id": null,
+            "created_on": "2026-08-26 21:17:47",
+            "domain_names": [
+              "status.techarmor.pl"
+            ],
+            "enabled": true,
+            "forward_host": "uptime-kuma",
+            "forward_port": 3001,
+            "forward_scheme": "http",
+            "hsts_enabled": false,
+            "hsts_subdomains": false,
+            "http2_support": false,
+            "id": 4,
+            "locations": [],
+            "meta": {
+              "nginx_err": null,
+              "nginx_online": "true"
+            },
+            "modified_on": "2026-08-27 00:06:00",
+            "owner_user_id": 1,
+            "ssl_forced": false
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    },
     {
       "mode": "managed",
       "type": "nginxproxymanager_proxy_host",
@@ -255,7 +394,10 @@
             "http2_support": false,
             "id": 12,
             "locations": [],
-            "meta": null,
+            "meta": {
+              "nginx_err": null,
+              "nginx_online": "true"
+            },
             "modified_on": "2026-08-27 00:02:03",
             "owner_user_id": 1,
             "ssl_forced": false
@@ -292,8 +434,11 @@
             "http2_support": false,
             "id": 5,
             "locations": [],
-            "meta": null,
+            "meta": {
-            "modified_on": "2026-08-27 00:02:02",
+              "nginx_err": null,
+              "nginx_online": "true"
+            },
+            "modified_on": "2026-08-27 00:02:03",
             "owner_user_id": 1,
             "ssl_forced": false
           },