Update quadlets

authentik/quadlets/.env

@@ -0,0 +1,27 @@
+#database shi
+POSTGRES_DB=authentik
+POSTGRES_USER=authentik
+POSTGRES_PASSWORD={YOUR DB PASSWORD}
+
+# authentik stuff
+AUTHENTIK_SECRET_KEY={YOUR SECRET KEY}
+AUTHENTIK_ERROR_REPORTING__ENABLED=false
+
+AUTHENTIK_POSTGRESQL__HOST=authentik-postgres
+AUTHENTIK_POSTGRESQL__NAME=authentik
+AUTHENTIK_POSTGRESQL__PASSWORD={YOUR DB PASSWORD}
+AUTHENTIK_POSTGRESQL__USER=authentik
+
+# SMTP Host Emails are sent to
+AUTHENTIK_EMAIL__HOST=
+AUTHENTIK_EMAIL__PORT=
+# Optionally authenticate (don't add quotation marks to your password)
+AUTHENTIK_EMAIL__USERNAME=
+AUTHENTIK_EMAIL__PASSWORD=
+# Use StartTLS
+AUTHENTIK_EMAIL__USE_TLS=false
+# Use SSL
+AUTHENTIK_EMAIL__USE_SSL=false
+AUTHENTIK_EMAIL__TIMEOUT=10
+# Email address authentik will send from, should have a correct @domain
+AUTHENTIK_EMAIL__FROM=

authentik/quadlets/authentik-postgres.container

@@ -0,0 +1,29 @@
+[Unit]
+Description=postgres for authentik
+
+After=authentik-database.volume
+Requires=authentik-database.volume
+
+PartOf=authentik.target
+
+[Container]
+Image=docker.io/library/postgres:16-alpine
+ContainerName=authentik-postgres
+
+Volume=auth_database:/var/lib/postgresql/data
+
+Network=authentik.network
+
+EnvironmentFile=%h/services/authentik/.env
+
+HealthCmd=pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+HealthInterval=30s
+HealthRetries=5
+HealthStartPeriod=20s
+HealthTimeout=5s
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=authentik.target

authentik/quadlets/authentik-server.container

@@ -0,0 +1,30 @@
+[Unit]
+Description=server for authentik
+
+After=authentik-postgres.service
+Requires=authentik-postgres.service
+
+PartOf=authentik.target
+
+[Container]
+Image=ghcr.io/goauthentik/server:2026.2.2
+
+ContainerName=authentik-server
+Exec=server
+
+EnvironmentFile=%h/services/authentik/.env
+
+PublishPort=127.0.0.1:9000:9000
+PublishPort=127.0.0.1:9443:9443
+
+Network=authentik.network
+
+Volume=%h/services/authentik/data:/data
+Volume=%h/services/authentik/custom-templates:/templates
+ShmSize=512m
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=authentik.target

authentik/quadlets/authentik-worker.container

@@ -0,0 +1,31 @@
+[Unit]
+Description=authentik worker
+
+After=authentik-postgres.service
+Requires=authentik-postgres.service
+
+PartOf=authentik.target
+
+[Container]
+Image=ghcr.io/goauthentik/server:2026.2.2
+
+ContainerName=authentik-worker
+Exec=worker
+
+EnvironmentFile=%h/services/authentik/.env
+
+User=root
+Network=authentik.network
+
+Volume=/var/run/docker.sock:/var/run/docker.sock
+Volume=%h/services/authentik/data:/data
+Volume=%h/services/authentik/certs:/certs
+Volume=%h/services/authentik/custom-templates:/templates
+
+ShmSize=512m
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=authentik.target

authentik/quadlets/authentik.network

@@ -0,0 +1,7 @@
+[Unit]
+Description=authentik Podman Network
+
+PartOf=authentik.target
+
+[Network]
+NetworkName=authentik

authentik/quadlets/authentik.target

@@ -0,0 +1,9 @@
+[Unit]
+Description=authentik container stack
+
+Wants=authentik-postgres.service
+Wants=authentik-worker.service
+Wants=authentik-server.service
+
+[Install]
+WantedBy=default.target

forgejo/quadlets/forgejo-postgres.container

@@ -0,0 +1,22 @@
+[Unit]
+Description=forgejo postgres
+
+PartOf=forgejo.target
+
+[Container]
+ContainerName=forgejo-postgres
+Environment=POSTGRES_USER={YOUR POSTGRESS USER}
+Environment=POSTGRES_PASSWORD={YOUR POSTGRESS PASSWORD}
+Environment=POSTGRES_DB=forgejo-sql
+Image=postgres:17
+Network=forgejo.network
+Volume=%h/services/forgejo/postgresql/data:/var/lib/postgresql/data
+User=999
+Group=999
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=forgejo.target
+

forgejo/quadlets/forgejo-server.container

@@ -0,0 +1,28 @@
+[Unit]
+Description=forgejo server
+
+Requires=forgejo-postgres.service
+After=forgejo-postgres.service
+
+PartOf=forgejo.target
+
+[Container]
+ContainerName=forgejo-app
+Environment=USER_UID=1000 USER_GID=1000
+Environment=FORGEJO__database__HOST=forgejo-postgres
+Image=codeberg.org/forgejo/forgejo:11
+
+Network=forgejo.network
+#AddHost=(something something pasta is dogshit put domain here from host NIC):host-gateway
+
+PublishPort=127.0.0.1:3000:3000
+PublishPort=127.0.0.1:2232:222
+Volume=%h/services/forgejo/data:/data
+Volume=/etc/timezone:/etc/timezone:ro
+Volume=/etc/localtime:/etc/localtime:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=forgejo.target

forgejo/quadlets/forgejo.network

@@ -0,0 +1,7 @@
+[Unit]
+Description=forgejo podman network
+
+PartOf=forgejo.target
+
+[Network]
+NetworkName=forgejo

forgejo/quadlets/forgejo.target

@@ -0,0 +1,8 @@
+[Unit]
+Description=forgejo container stack
+
+Wants=forgejo-server.service
+Wants=forgejo-postgres.service
+
+[Install]
+WantedBy=default.target

mailu/quadlets/mailu-admin.container

@@ -0,0 +1,24 @@
+[Unit]
+Description=mailu admin
+Requires=mailu-redis.service mailu-resolver.service
+After=mailu-redis.service mailu-resolver.service
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-admin
+DNS=10.230.230.254
+Environment=I_KNOW_MY_SETUP_DOESNT_FIT_REQUIREMENTS_AND_WONT_FILE_ISSUES_WITHOUT_PATCHES=1
+EnvironmentFile=%h/services/mailu/mailu.env
+HostName=admin
+Image=ghcr.io/mailu/admin:2024.06
+LogDriver=journald
+LogOpt=tag=mailu-admin
+Network=mailu-default.network:alias=admin
+Volume=%h/services/mailu/data:/data
+Volume=%h/services/mailu/dkim:/dkim
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-antispam.container

@@ -0,0 +1,25 @@
+[Unit]
+Description=mailu antispam
+Requires=mailu-front.service mailu-redis.service mailu-oletools.service mailu-antivirus.service mailu-resolver.service
+After=mailu-front.service mailu-redis.service mailu-oletools.service mailu-antivirus.service mailu-resolver.service
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-antispam
+DNS=10.230.230.254
+EnvironmentFile=%h/services/mailu/mailu.env
+HostName=antispam
+Image=ghcr.io/mailu/rspamd:2024.06
+LogDriver=journald
+LogOpt=tag=mailu-antispam
+Network=mailu-default.network
+Network=mailu-oletools.network
+Network=mailu-clamav.network
+Volume=%h/services/mailu/filter:/var/lib/rspamd
+Volume=%h/services/mailu/overrides/rspamd:/overrides:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-antivirus.container

@@ -0,0 +1,18 @@
+[Unit]
+Description=mailu antivirus
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-antivirus
+HealthCmd=none
+Image=clamav/clamav-debian:1.4
+LogDriver=journald
+LogOpt=tag=mailu-antivirus
+Network=mailu-clamav.network:alias=antivirus
+Volume=%h/services/mailu/clamav:/var/lib/clamav
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-clamav.network

@@ -0,0 +1,7 @@
+[Unit]
+Description=mailu clamav network
+PartOf=mailu.target
+
+[Network]
+NetworkName=mailu-clamav
+Driver=bridge

mailu/quadlets/mailu-default.network

@@ -0,0 +1,8 @@
+[Unit]
+Description=mailu default network
+PartOf=mailu.target
+
+[Network]
+NetworkName=mailu-default
+Driver=bridge
+Subnet=10.230.230.0/24

mailu/quadlets/mailu-fetchmail.container

@@ -0,0 +1,22 @@
+[Unit]
+Description=mailu fetchmail
+Requires=mailu-admin.service mailu-smtp.service mailu-imap.service mailu-resolver.service
+After=mailu-admin.service mailu-smtp.service mailu-imap.service mailu-resolver.service
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-fetchmail
+DNS=10.230.230.254
+EnvironmentFile=%h/services/mailu/mailu.env
+Image=ghcr.io/mailu/fetchmail:2024.06
+LogDriver=journald
+LogOpt=tag=mailu-fetchmail
+Network=mailu-default.network:alias=fetchmail
+Volume=%h/services/mailu/data/fetchmail:/data
+Volume=%h/services/mailu/clamav/clamd.conf:/etc/clamav/clamd.conf:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-front.container

@@ -0,0 +1,40 @@
+[Unit]
+Description=mailu front
+Requires=mailu-resolver.service
+After=mailu-resolver.service
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-front
+DNS=10.230.230.254
+EnvironmentFile=%h/services/mailu/mailu.env
+Image=ghcr.io/mailu/nginx:2024.06
+LogDriver=journald
+LogOpt=tag=mailu-front
+Network=mailu-default.network:alias=front
+Network=mailu-webmail.network:alias=front
+Network=mailu-radicale.network:alias=front
+PublishPort=127.0.0.1:7071:80
+PublishPort=127.0.0.1:555:443
+PublishPort=0.0.0.0:25:25
+PublishPort=0.0.0.0:465:465
+PublishPort=127.0.0.1:588:587
+
+# PublishPort=0.0.0.0:110:110
+
+# PublishPort=0.0.0.0:995:995
+
+# PublishPort=0.0.0.0:143:143
+
+# PublishPort=0.0.0.0:993:993
+
+PublishPort=127.0.0.1:4190:4190
+Volume=%h/services/mailu/certs:/certs
+Volume=%h/services/mailu/dkim:/dkim
+Volume=%h/services/mailu/overrides/rspamd:/rspamd/local.d:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-fts-attachments.container

@@ -0,0 +1,25 @@
+[Unit]
+Description=mailu fts attachments
+Requires=mailu-resolver.service
+After=mailu-resolver.service
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-attachments
+DNS=10.230.230.254
+HealthCmd=wget -nv -t1 -O /dev/null http://127.0.0.1:9998/tika || exit 1
+HealthInterval=10s
+HealthRetries=3
+HealthStartPeriod=10s
+HealthTimeout=5s
+HostName=tika
+Image=apache/tika:latest-full
+LogDriver=journald
+LogOpt=tag=mailu-tika
+Network=mailu-fts-attachments.network:alias=tika
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-fts-attachments.network

@@ -0,0 +1,8 @@
+[Unit]
+Description=mailu fts attachments
+PartOf=mailu.target
+
+[Network]
+NetworkName=mailu-fts-attachments
+Driver=bridge
+Internal=true

mailu/quadlets/mailu-imap.container

@@ -0,0 +1,23 @@
+[Unit]
+Description=mailu imap
+Requires=mailu-front.service mailu-fts-attachments.service mailu-resolver.service
+After=mailu-front.service mailu-fts-attachments.service mailu-resolver.service
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-imap
+DNS=10.230.230.254
+EnvironmentFile=%h/services/mailu/mailu.env
+Image=ghcr.io/mailu/dovecot:2024.06
+LogDriver=journald
+LogOpt=tag=mailu-imap
+Network=mailu-default.network:alias=imap
+Network=mailu-fts-attachments.network
+Volume=%h/services/mailu/mail:/mail
+Volume=%h/services/mailu/overrides/dovecot:/overrides:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-oletools.container

@@ -0,0 +1,20 @@
+[Unit]
+Description=mailu oletools
+Requires=mailu-resolver.service
+After=mailu-resolver.service
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-oletools
+DNS=10.230.230.254
+HostName=oletools
+Image=ghcr.io/mailu/oletools:2024.06
+LogDriver=journald
+LogOpt=tag=mailu-oletools
+Network=mailu-oletools.network:alias=oletools
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-oletools.network

@@ -0,0 +1,8 @@
+[Unit]
+Description=mailu oletools
+PartOf=mailu.target
+
+[Network]
+NetworkName=mailu-oletools
+Driver=bridge
+Internal=true

mailu/quadlets/mailu-radicale.network

@@ -0,0 +1,7 @@
+[Unit]
+Description=mailu radicale network
+PartOf=mailu.target
+
+[Network]
+NetworkName=mailu-radicale
+Driver=bridge

mailu/quadlets/mailu-redis.container

@@ -0,0 +1,18 @@
+[Unit]
+Description=Mailu Redis Container
+Requires=mailu-resolver.service
+After=mailu-resolver.service
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-redis
+DNS=10.230.230.254
+Image=redis:alpine
+Network=mailu-default.network:alias=redis
+Volume=%h/services/mailu/redis:/data
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-resolver.container

@@ -0,0 +1,17 @@
+[Unit]
+Description=mailu resolver
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-resolver
+EnvironmentFile=%h/services/mailu/mailu.env
+Image=ghcr.io/mailu/unbound:2024.06
+LogDriver=journald
+LogOpt=tag=mailu-resolver
+Network=mailu-default.network:ip=10.230.230.254
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-smtp.container

@@ -0,0 +1,22 @@
+[Unit]
+Description=mailu smtp
+Requires=mailu-front.service mailu-resolver.service
+After=mailu-front.service mailu-resolver.service
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-smtp
+DNS=10.230.230.254
+EnvironmentFile=%h/services/mailu/mailu.env
+Image=ghcr.io/mailu/postfix:2024.06
+LogDriver=journald
+LogOpt=tag=mailu-smtp
+Network=mailu-default.network:alias=smtp
+Volume=%h/services/mailu/mailqueue:/queue
+Volume=%h/services/mailu/overrides/postfix:/overrides:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-webdav.container

@@ -0,0 +1,17 @@
+[Unit]
+Description=mailu webdav container
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-webdav
+Image=ghcr.io/mailu/radicale:2024.06
+LogDriver=journald
+LogOpt=tag=mailu-webdav
+Network=mailu-radicale.network:alias=webdav
+Volume=%h/services/mailu/dav:/data
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-webmail.container

@@ -0,0 +1,21 @@
+[Unit]
+Description=mailu webmail
+Requires=mailu-front.service
+After=mailu-front.service
+PartOf=mailu.target
+
+[Container]
+ContainerName=mailu-webmail
+EnvironmentFile=%h/services/mailu/mailu.env
+Image=ghcr.io/mailu/webmail:2024.06
+LogDriver=journald
+LogOpt=tag=mailu-webmail
+Network=mailu-webmail.network:alias=webmail
+Volume=%h/services/mailu/webmail:/data
+Volume=%h/services/mailu/overrides/snappymail:/overrides:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=mailu.target

mailu/quadlets/mailu-webmail.network

@@ -0,0 +1,7 @@
+[Unit]
+Description=mailu webmail network
+PartOf=mailu.target
+
+[Network]
+NetworkName=mailu-webmail
+Driver=bridge

mailu/quadlets/mailu.target

@@ -0,0 +1,44 @@
+[Unit]
+Description=Mailu Mail Server
+Wants=mailu-default.network
+Wants=mailu-clamav.network
+Wants=mailu-fts-attachments.network
+Wants=mailu-oletools.network
+Wants=mailu-radicale.network
+Wants=mailu-webmail.network
+Wants=mailu-admin.service
+Wants=mailu-antivirus.service
+Wants=mailu-antispam.service
+Wants=mailu-fetchmail.service
+Wants=mailu-front.service
+Wants=mailu-fts-attachments.service
+Wants=mailu-imap.service
+Wants=mailu-oletools.service
+Wants=mailu-redis.service
+Wants=mailu-resolver.service
+Wants=mailu-smtp.service
+Wants=mailu-webdav.service
+Wants=mailu-webmail.service
+
+After=mailu-default.network
+After=mailu-clamav.network
+After=mailu-fts-attachments.network
+After=mailu-oletools.network
+After=mailu-radicale.network
+After=mailu-webmail.network
+After=mailu-admin.service
+After=mailu-antivirus.service
+After=mailu-antispam.service
+After=mailu-fetchmail.service
+After=mailu-front.service
+After=mailu-fts-attachments.service
+After=mailu-imap.service
+After=mailu-oletools.service
+After=mailu-redis.service
+After=mailu-resolver.service
+After=mailu-smtp.service
+After=mailu-webdav.service
+After=mailu-webmail.service
+
+[Install]
+WantedBy=default.target

matrix/configs/NGINX-domainroot.conf

@@ -0,0 +1,28 @@
+    location ~ ^(/_matrix|/_synapse/client|/_synapse/admin) {
+        # otherwise nginx will canonicalise the URI and cause signature verification
+        # errors.
+        proxy_pass http://localhost:8008;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+
+        # Nginx by default only allows file uploads up to 1M in size
+        # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
+
+    # Synapse responses may be chunked, which is an HTTP/1.1 feature.
+    proxy_http_version 1.1;
+    }
+
+
+location /.well-known/matrix/client {
+    alias /var/www/html/.well-known/matrix/client;
+    default_type application/json;
+    add_header Access-Control-Allow-Origin *;
+}
+
+
+    location /.well-known/element/element.json {
+        root /var/www/html;       # points to the folder containing '.well-known'
+        default_type application/json;
+        add_header Access-Control-Allow-Origin *;
+    }

matrix/configs/NGINX-element-web.conf

@@ -0,0 +1,56 @@
+server {
+    listen 443 ssl;
+    server_name element.YOURDOMAIN.COM;
+
+    http2 on;
+
+    ssl_certificate /etc/letsencrypt/live/element.YOURDOMAIN.COM/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/element.YOURDOMAIN.COM/privkey.pem;
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript application/xml text/javascript;
+    gzip_min_length 256;
+
+    location / {
+        proxy_pass http://127.0.0.1:8445;
+
+       proxy_set_header Connection "upgrade";
+       proxy_set_header Upgrade $http_upgrade;
+
+       proxy_set_header Host $host;
+       proxy_set_header X-Forwarded-Server $host;
+       proxy_set_header X-Real-IP $remote_addr;
+       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+       proxy_set_header X-Forwarded-Proto $scheme;
+
+
+#unrelated ccs and background injection
+
+#add_header X-Frame-Options SAMEORIGIN;
+#add_header X-Content-Type-Options nosniff;
+#add_header X-XSS-Protection "1; mode=block";
+#add_header Content-Security-Policy "frame-ancestors 'self'";
+
+#proxy_set_header Accept-Encoding "";
+#    sub_filter_once off;
+#    sub_filter '</head>' '<link rel="stylesheet" href="/custom.css"></head>';
+#    }
+
+#    location /custom.css {
+#       alias /var/www/html/nginx/custom_element.css;
+#       default_type text/css;
+#       add_header Access-Control-Allow-Origin *;
+#}
+
+
+#    location /themes/element/img/backgrounds/lake.jpg {
+#       alias /var/www/html/nginx/background.jpg;
+#       add_header Access-Control-Allow-Origin *;
+#    }
+
+}
+
+
+
+
+

matrix/configs/NGINX-jwt-matrixrtc.conf

@@ -0,0 +1,32 @@
+ server {
+    listen 443 ssl;
+    server_name jwt.matrixrtc.YOURDOMAIN.COM;
+
+    http2 on;
+
+    ssl_certificate /etc/letsencrypt/live/jwt.matrixrtc.YOURDOMAIN.COM/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/jwt.matrixrtc.YOURDOMAIN.COM/privkey.pem;
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript application/xml text/javascript;
+    gzip_min_length 256;
+
+    location / {
+        proxy_pass http://127.0.0.1:8909;
+
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
+
+      proxy_send_timeout 120;
+      proxy_read_timeout 120;
+      proxy_buffering off;
+
+      proxy_set_header Accept-Encoding gzip;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+
+
+    }
+}

matrix/configs/NGINX-matrix-federation.conf

@@ -0,0 +1,20 @@
+ server {
+
+    listen 8448 ssl;
+
+    server_name YOURDOMAIN.COM;
+
+    ssl_certificate /etc/letsencrypt/live/YOURDOMAIN.COM/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/YOURDOMAIN.COM/privkey.pem;
+
+    location / {
+        proxy_pass http://127.0.0.1:8449;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+}
+
+

matrix/configs/NGINX-matrixrtc.conf

@@ -0,0 +1,26 @@
+server {
+    listen 443 ssl;
+    server_name matrixrtc.YOURDOMAIN.COM;
+
+    http2 on;
+
+    ssl_certificate /etc/letsencrypt/live/matrixrtc.YOURDOMAIN.COM/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/matrixrtc.YOURDOMAIN.COM/privkey.pem;
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript application/xml text/javascript;
+    gzip_min_length 256;
+
+    location / {
+        proxy_pass http://127.0.0.1:7880;
+
+       proxy_set_header Connection "upgrade";
+       proxy_set_header Upgrade $http_upgrade;
+
+       proxy_set_header Host $host;
+       proxy_set_header X-Forwarded-Server $host;
+       proxy_set_header X-Real-IP $remote_addr;
+       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+       proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

matrix/configs/element-config.json

@@ -0,0 +1,13 @@
+{
+  "default_server_config": {
+    "m.homeserver": {
+      "base_url": "https://{YOURDOMAIN.COM}",
+      "server_name": "{YOURNAME}"
+    }
+  },
+  "disable_custom_urls": true,
+  "disable_guests": true,
+  "features": {
+    "feature_group_calls": true
+  }
+}

matrix/configs/homeserver.yaml

@@ -0,0 +1,46 @@
+turn_uris: ["turn:terrorist.academy:3478?transport=udp", "turn:terrorist.academy:3478?transport=tcp", "turn:terrorist.academy:5349?transport=tcp"]
+
+turn_shared_secret: {YOUR TURNSERVER SECRET}
+
+# ABSOLUTE MUST DO NOT IGNORE
+url_preview_ip_range_blacklist:
+  - '10.0.0.0/8'
+  - "100.0.0.0/8"
+  - '172.16.0.0/12'
+  - '192.168.0.0/16'
+  - '100.64.0.0/10'
+  - '169.254.0.0/16'
+  - '::1/128'
+  - 'fe80::/64'
+  - 'fc00::/7'
+
+database:
+  name: psycopg2
+  args:
+    user: synapse
+    password: {YOUR DATABASE PASSWORD}
+    database: synapse
+    host: postgres
+    port: 5432
+
+# config for proxy
+  - port: 8008
+    tls: false
+    bind_addresses:
+      - '0.0.0.0'
+    type: http
+    x_forwarded: true
+
+    resources:
+      - names: [client]
+        compress: true
+
+  - port: 8448
+    type: http
+    bind_addresses: ['0.0.0.0']
+    resources:
+      - names: [federation]
+        compress: false
+
+#there are regirstration options somewhere just skim over the whole file these are mainly the important settings
+# theres email settings too somewhere theres also a list of experimental features you can activate its somehwere in the github or sm

matrix/configs/livekit-config.yaml

@@ -0,0 +1,28 @@
+# Basic LiveKit configuration
+port: 7880 # Port LiveKit listens on internally
+bind_addresses:
+  - "0.0.0.0" # Listen on all interfaces within the container
+
+rtc:
+  tcp_port: 7881
+  port_range_start: 50100 # Match docker-compose port range
+  port_range_end: 50200   # Match docker-compose port range
+  use_external_ip: false # Rely on reverse proxy/NAT
+
+logging:
+  level: info
+
+# Disable LiveKit's internal TURN server, since you probably have something already set up for the classic P2P calls.
+turn:
+  enabled: false
+  # domain: matrixrtc.fariszr.com # Not needed if disabled, updated comment for consistency
+  # cert_file: ""
+  # key_file: ""
+  # tls_port: 5349 # Default
+  # udp_port: 443 # Default
+  # external_tls: true # If using external certs, but disabled anyway
+
+# Keys are provided via environment variable LIVEKIT_KEYS in docker-compose.yml
+# keys:
+#   (livekit_api_key): (livekit_api_secret)
+

matrix/configs/turnserver.conf

@@ -0,0 +1,22 @@
+listening-port=3478
+tls-listening-port=5349
+
+realm=YOURDOMAIN.COM
+server-name=YOURDOMAIN.COM
+
+cert=/etc/coturn/fullchain.pem
+pkey=/etc/coturn/privkey.pem
+
+fingerprint
+use-auth-secret
+static-auth-secret={YOUR TURNSERVER SECRET}
+
+total-quota=100
+stale-nonce=600
+
+no-multicast-peers
+
+listening-ip=0.0.0.0
+
+min-port=49152
+max-port=49999

matrix/configs/well known (this shit suckkks).txt

@@ -0,0 +1,19 @@
+well known files suck dih but quite simple
+
+serve under /.well-known/matrix/client under domainroot
+{
+  "m.homeserver": {
+    "base_url": "https://terrorist.academy"
+  },
+  "org.matrix.msc4143.rtc_foci": [
+    {
+      "type": "livekit",
+      "livekit_service_url": "https://jwt.matrixrtc.terrorist.academy"
+    }
+  ],
+  "org.matrix.msc3575.proxy": {
+    "url": "https://matrixrtc.terrorist.academy"
+  }
+}
+
+serve under .well-known/element/element.json same thing

matrix/quadlets/matrix-coturn.container

@@ -0,0 +1,26 @@
+[Unit]
+Description=coturn for matrix
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-coturn
+
+Environment=TURN_CERT_PATH=/etc/coturn/fullchain.pem TURN_KEY_PATH=/etc/coturn/privkey.pem
+
+Image=coturn/coturn:latest
+PublishPort=3478:3478/udp
+PublishPort=3478:3478/tcp
+PublishPort=5349:5349/tcp
+PublishPort=0.0.0.0:49152-49999:49152-49999/udp
+
+Volume=%h/services/matrix/synapse/turnserver.conf:/etc/coturn/turnserver.conf:ro
+Volume=%h/services/matrix/synapse/homeserver.log:/homeserver.log
+Volume=/etc/letsencrypt/live/{YOURDOMAIN.COM}/fullchain.pem:/etc/coturn/fullchain.pem
+Volume=/etc/letsencrypt/live/{YOURDOMAIN.COM}/privkey.pem:/etc/coturn/privkey.pem
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-element-web.container

@@ -0,0 +1,19 @@
+[Unit]
+Description=element web intance
+
+PartOf=matrix.target
+
+[Container]
+AddCapability=NET_BIND_SERVICE
+
+ContainerName=matrix-element-web
+
+Image=vectorim/element-web:latest
+PublishPort=127.0.0.1:8445:80
+Volume=%h/services/matrix/element-config.json:/app/config.json:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-livekit-jwt.container

@@ -0,0 +1,23 @@
+[Unit]
+Description=matrix livekit jtw
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-lk-jtw
+
+Environment=LK_JWT_PORT=8080
+Environment=LIVEKIT_URL=wss://matrixrtc.{YOURDOMAIN.COM}
+Environment=LIVEKIT_KEY={YOUR LIVEKIT KEY}
+Environment=LIVEKIT_SECRET={YOUR LIVEKIT SECRET}
+Environment=LIVEKIT_FULL_ACCESS_HOMESERVERS=terrorist.academy
+
+PublishPort=127.0.0.1:8909:8080
+Image=ghcr.io/element-hq/lk-jwt-service:latest
+AddHost=(matrixrtc.{YOURDOMAIN.COM}):host-gateway
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-livekit.container

@@ -0,0 +1,23 @@
+[Unit]
+Description=livekit for matrix
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-livekit
+
+Environment="LIVEKIT_KEYS={YOUR LIVEKIT KEY}: {YOUR LIVEKIT SECRET}"
+Environment=LIVEKIT_WS_UR=wss://matrixrtc.{YOURDOMAIN>COM}
+Exec=--config /etc/livekit.yaml
+
+Image=livekit/livekit-server:latest
+PublishPort=127.0.0.1:7880:7880
+PublishPort=50100-50200:50100-50200/udp
+
+Volume=%h/services/matrix/synapse/livekit-config.yaml:/etc/livekit.yaml:ro
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-postgres.container

@@ -0,0 +1,23 @@
+[Unit]
+Description=postres database for matrix
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-postgres
+
+Environment=POSTGRES_PASSWORD={YOUR POSTGRES PASSWORD}
+Environment=POSTGRES_USER=synapse
+HostName=matrix-postres
+Image=postgres:14
+
+Volume=%h/services/matrix/pgdata:/var/lib/postgresql/data
+Volume=%h/services/matrix/turn:/var/lib/turn
+
+Network=matrix.network
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-synapse-admin.container

@@ -0,0 +1,16 @@
+[Unit]
+Description=synapse admin for matrix
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-synapse-admin
+HostName=synapse-admin
+Image=awesometechnologies/synapse-admin:latest
+PublishPort=127.0.0.1:9092:80
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target

matrix/quadlets/matrix-synapse.container

@@ -0,0 +1,30 @@
+[Unit]
+Description=main matrix server
+
+Requires=matrix-postgres.service
+After=matrix-postgres.service
+
+PartOf=matrix.target
+
+[Container]
+ContainerName=matrix-synapse
+
+Environment=SYNAPSE_SERVER_NAME={YOURDOMAIN.COM}
+Environment=SYNAPSE_REPORT_STATS=no
+
+Image=matrixdotorg/synapse:latest
+PublishPort=127.0.0.1:8008:8008
+PublishPort=127.0.0.1:8449:8448
+
+Volume=%h/services/matrix/synapse:/data
+Volume=%h/services/matrix/synapse/app:/app
+Volume=%h/services/matrix/synapse/logs/:/log/
+
+Network=matrix.network
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=matrix.target
+

matrix/quadlets/matrix.network

@@ -0,0 +1,7 @@
+[Unit]
+Description=Matrix Podman Network
+
+PartOf=matrix.target
+
+[Network]
+NetworkName=matrix

matrix/quadlets/matrix.target

@@ -0,0 +1,13 @@
+[Unit]
+Description=matrix synapse container stack
+
+Wants=matrix-coturn.service
+Wants=matrix-livekit.service
+Wants=matrix-postgres.service
+Wants=matrix-synapse.service
+Wants=matrix-element-web.service
+Wants=matrix-livekit-jwt.service
+Wants=matrix-synapse-admin.service
+
+[Install]
+WantedBy=default.target

opentogethertube/quadlets/opentogethertube-postgres.container

@@ -0,0 +1,22 @@
+[Unit]
+Description=opentogethertube postgres
+
+PartOf=opentogethertube.target
+
+[Container]
+ContainerName=opentogethertube-postgres
+
+Environment=POSTGRES_DB=opentogethertube
+Environment=POSTGRES_USER=opentogethertube
+Environment=POSTGRES_PASSWORD={YOUR PASSWORD}
+
+HealthCmd=pg_isready -U opentogethertube
+Image=postgres:15-bullseye
+Network=opentogethertube.network
+Volume=%h/services/opentogethertube/postgres:/var/lib/postgresql/data
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=opentogethertube.target

opentogethertube/quadlets/opentogethertube-redis.container

@@ -0,0 +1,18 @@
+[Unit]
+Description=opentogethertube redis
+
+PartOf=opentogethertube.target
+
+[Container]
+
+ContainerName=opentogethertube-redis
+HealthCmd=redis-cli ping
+Image=redis
+Network=opentogethertube.network
+Volume=%h/services/opentogethertube/redis:/data
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=opentogethertube.target

opentogethertube/quadlets/opentogethertube-server.container

@@ -0,0 +1,33 @@
+[Unit]
+Description=server for opentogethertube
+
+After=opentogethertube-redis_db.service opentogethertube-postgres_db.service
+Requires=opentogethertube-redis_db.service opentogethertube-postgres_db.service
+
+PartOf=opentogethertube.target
+
+[Container]
+ContainerName=opentogethertube-server
+Environment=PORT=8080 
+Environment=REDIS_HOST=opentogethertube-redis
+Environment=REDIS_PORT=6379
+Environment=FFPROBE_PATH=/usr/bin/ffprobe
+Environment=POSTGRES_USER=opentogethertube
+Environment=POSTGRES_DB=opentogethertube
+Environment=POSTGRES_HOST=opentogethertube-postgres 
+Environment=POSTGRES_PASSWORD={YOUR PASSWORD}
+Environment=DOCKER=1
+
+Image=dyc3/opentogethertube:latest
+
+Network=opentogethertube.network
+
+PublishPort=127.0.0.1:4958:8080
+
+Volume=%h/services/opentogethertube/env:/app/env
+
+[Service]
+Restart=unless-stopped
+
+[Install]
+WantedBy=opentogethertube.target

opentogethertube/quadlets/opentogethertube.network

@@ -0,0 +1,7 @@
+[Unit]
+Description=opentogethertube network
+
+PartOf=opentogethertube.target
+
+[Network]
+NetworkName=opentogethertube

opentogethertube/quadlets/opentogethertube.target

@@ -0,0 +1,10 @@
+[Unit]
+Description=opentogethertube container stack
+
+Wants=opentogethertube-redis_db.service
+Wants=opentogethertube-server.service
+Wants=opentogethertube-postgres_db.service
+
+[Install]
+WantedBy=default.target
+

singles/quadlets/gatus.container

@@ -0,0 +1,21 @@
+[Unit]
+Description=gatus uptime tracker
+
+PartOf=singlestarget
+
+[Container]
+ContainerName=gatus
+Environment=TZ=Europe/Amsterdam
+Image=twinproduction/gatus:latest
+Volume=%h/services/singles/gatus/config:/config
+Volume=%h/services/singles/gatus/data:/data/
+Volume=/etc/timezone:/etc/timezone:ro
+Volume=/etc/localtime:/etc/localtime:ro
+
+Network=host
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=singles.target

singles/quadlets/homepage.container

@@ -0,0 +1,23 @@
+[Unit]
+Description=homepage container
+
+PartOf=singles.target
+
+[Container]
+ContainerName=homepage
+Environment=HOMEPAGE_ALLOWED_HOSTS={YOURDOMAIN.COM} 
+Environment=PUID=1000 PGID=1000
+Image=ghcr.io/gethomepage/homepage:latest
+Volume=%h/services/singles/homepage/config:/app/config
+Volume=%h/services/singles/homepage/assets:/app/public/images
+Volume=/home:/home
+
+Environment=PORT=3303
+Environment=HOSTNAME=127.0.0.1
+Network=host
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=singles.target

singles/quadlets/searxng.container

@@ -0,0 +1,18 @@
+[Unit]
+Description=searxng search engine
+
+PartOf=singlestarget
+
+[Container]
+ContainerName=searxng
+Environment=USER_UID=1000 USER_GID=1000
+Image=docker.io/searxng/searxng:latest
+PublishPort=127.0.0.1:8889:8080
+Volume=%h/services/singles/searxng/config:/etc/searxng
+Volume=%h/services/singles/searxng/cache:/cache/searxng
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=singles.target

singles/quadlets/singles.target

@@ -0,0 +1,13 @@
+[Unit]
+Description=Single services
+
+Wants=gatus.service
+Wants=homepage.service
+Wants=searxng.service
+
+After=gatus.service
+After=homepage.service
+After=searxng.service
+
+[Install]
+WantedBy=install.target