wip

.gitignore

@@ -1,23 +1,24 @@
 *~
 
 .terraform
-.terraform.lock.hcl
 
 flatcar/flatcar_production_qemu_image.img
 flatcar/flatcar_production_qemu_image.img.fresh
 
-ignition.json
-
-production.tfvars
-
 terraform.tfstate
 terraform.tfstate.backup
 
-app
+config/apps.config
+config/production.tfvars
+config/ssh-keys
 
-apps.config
+# custom chicken eggs for dockerfile
+src/scss
+src/html-widgets
+src/schematra-session
 
 # generated files
+all-apps/.env
 all-apps/lb/Caddyfile
 all-apps/nextcloud/nextcloud.env
 all-apps/nextcloud/nextcloud_admin_user
@@ -26,4 +27,10 @@ all-apps/nextcloud/postgres_db
 all-apps/nextcloud/postgres_user
 all-apps/nextcloud/postgres_password
 all-apps/nextcloud/redis_password
-generated.tfvars
+generated.tfvars
+restic-env
+restic-password
+ignition.json
+app
+nassella-latest.tar
+src/deploy*/*

.terraform.lock.hcl

@@ -0,0 +1,96 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/cloudflare/cloudflare" {
+  version     = "5.8.2"
+  constraints = "5.8.2"
+  hashes = [
+    "h1:q9p622Nl/BMW9QUlnGIgFaYF7O94u7bfif48OQ0H9HE=",
+    "zh:92d133a074a8a95143861960508501711a95e0b267c60dbc722eec0a68053e08",
+    "zh:95b1f349c59d226d9005c49b5ac61e856492f75d8be3ca30954a91512f2ebecf",
+    "zh:a439ebd2e21dd6a4cd782563de372dbbac9853a713ba4e90fb3d317764374c2f",
+    "zh:b0a2313cdb113e8ecc058052bcbadaa312a6d093820e69ed97ed96725ad5fd8f",
+    "zh:c14e2790827a78f0e5274ec47f56e4fff41b76db01caf915fb73d5082c75c645",
+    "zh:ef135fce7d3925988fa2675287788da233a1630c23652ae160a1d6c2a9e8ebce",
+    "zh:f01d39efcb3aa7fa8634394caad10ca68abd694d75d2c8b3875516859d8df9b4",
+    "zh:f03391264e01749c17ead5a8ba33a96a568490a8212424c5ae6e113ad50bfc9f",
+    "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
+  ]
+}
+
+provider "registry.terraform.io/digitalocean/digitalocean" {
+  version     = "2.62.0"
+  constraints = "2.62.0"
+  hashes = [
+    "h1:MPWqSuVPLh6SNduEpKYZHOXDkW4CCtfEOcZMSjKrGnA=",
+    "zh:1004bd408d8982471a7b0971fb2c47ccb3e9b8b3261422a6c8942151e6624713",
+    "zh:173059dd17ab6cb471dd45ee0e2a01db9c2e7d31ac30e33eb3b6269cfca68bbb",
+    "zh:209e8092f3cfcb28406df19386064e31ab89152dc70555db2e252dc1ea9e5703",
+    "zh:2c45405951b64ca3606d4360463eee4745af361520f9a8e28b5e6e784010dc4b",
+    "zh:3b07459b33e56d2cfe2429dc499eb33e83969f75847dcab9a65b8de8cdefebcc",
+    "zh:486277719db85e0062a7a0014bfd0c9a2eda0c2955d9c77020a35f004bc4025f",
+    "zh:7487b77f0e0d33ca460f27cf8eeae08cce50bb4d64a693601cd76ca865d3eb78",
+    "zh:7ac4818386b45253b2e3f8b2794fb0a0837878a37bf03ace4e7a6c7f69345abc",
+    "zh:9a8ad3875867cb707ab50bf0c10fe23abdf95740f0fd48ee8575586aaf9e9817",
+    "zh:9b39578e77688b367f5f99ae4227cf76edb598263937983652b0e7052fad6b65",
+    "zh:a72723121d4548f17cfba7cc14d2cf9cc3ce066c1c81121ceac7dee42eeb84ee",
+    "zh:af2cf2b807af245c4259cd4e9980fe6633e9a3703e114b4997f8ee8a56188674",
+    "zh:b547d28e1e2de2c03ffde90eeb2d301331520b890c219e84aa876263ebf6e4fd",
+    "zh:baa2e3c085de1154fdef4922bc6c27aa62f0dba60535ec80e10017909ea93e2d",
+    "zh:c8425a8cfcba3ee408d9b75586f02f5c9af9c9d01817227731078662720e932f",
+    "zh:dfdfb75ff50d79de30164873c3977dce376ffc09ce5610aeb581f885b3f8b942",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/null" {
+  version     = "3.2.4"
+  constraints = "3.2.4"
+  hashes = [
+    "h1:wTNrZnwQdOOT/TW9pa+7GgJeFK2OvTvDmx78VmUmZXM=",
+    "zh:59f6b52ab4ff35739647f9509ee6d93d7c032985d9f8c6237d1f8a59471bbbe2",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:795c897119ff082133150121d39ff26cb5f89a730a2c8c26f3a9c1abf81a9c43",
+    "zh:7b9c7b16f118fbc2b05a983817b8ce2f86df125857966ad356353baf4bff5c0a",
+    "zh:85e33ab43e0e1726e5f97a874b8e24820b6565ff8076523cc2922ba671492991",
+    "zh:9d32ac3619cfc93eb3c4f423492a8e0f79db05fec58e449dee9b2d5873d5f69f",
+    "zh:9e15c3c9dd8e0d1e3731841d44c34571b6c97f5b95e8296a45318b94e5287a6e",
+    "zh:b4c2ab35d1b7696c30b64bf2c0f3a62329107bd1a9121ce70683dec58af19615",
+    "zh:c43723e8cc65bcdf5e0c92581dcbbdcbdcf18b8d2037406a5f2033b1e22de442",
+    "zh:ceb5495d9c31bfb299d246ab333f08c7fb0d67a4f82681fbf47f2a21c3e11ab5",
+    "zh:e171026b3659305c558d9804062762d168f50ba02b88b231d20ec99578a6233f",
+    "zh:ed0fe2acdb61330b01841fa790be00ec6beaac91d41f311fb8254f74eb6a711f",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/time" {
+  version     = "0.13.1"
+  constraints = "0.13.1"
+  hashes = [
+    "h1:P9h9GNlrWPECzIvIFjHOhF+HVzpxk0eCcdy1G0fWSHw=",
+    "zh:02cb9aab1002f0f2a94a4f85acec8893297dc75915f7404c165983f720a54b74",
+    "zh:04429b2b31a492d19e5ecf999b116d396dac0b24bba0d0fb19ecaefe193fdb8f",
+    "zh:26f8e51bb7c275c404ba6028c1b530312066009194db721a8427a7bc5cdbc83a",
+    "zh:772ff8dbdbef968651ab3ae76d04afd355c32f8a868d03244db3f8496e462690",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:898db5d2b6bd6ca5457dccb52eedbc7c5b1a71e4a4658381bcbb38cedbbda328",
+    "zh:8de913bf09a3fa7bedc29fec18c47c571d0c7a3d0644322c46f3aa648cf30cd8",
+    "zh:9402102c86a87bdfe7e501ffbb9c685c32bbcefcfcf897fd7d53df414c36877b",
+    "zh:b18b9bb1726bb8cfbefc0a29cf3657c82578001f514bcf4c079839b6776c47f0",
+    "zh:b9d31fdc4faecb909d7c5ce41d2479dd0536862a963df434be4b16e8e4edc94d",
+    "zh:c951e9f39cca3446c060bd63933ebb89cedde9523904813973fbc3d11863ba75",
+    "zh:e5b773c0d07e962291be0e9b413c7a22c044b8c7b58c76e8aa91d1659990dfb5",
+  ]
+}
+
+provider "registry.terraform.io/poseidon/ct" {
+  version     = "0.13.0"
+  constraints = "0.13.0"
+  hashes = [
+    "h1:sTtlmMjbYiIuaad/23wVrOCSlihKaurcf2668M3ZWio=",
+    "zh:24d86adcba92ad0f13870d5e0d217c395aa90ff1e9234fe0c9b7c6eb65abb3a8",
+    "zh:317eeadf92d220fe546be624a9002190edeb623ac76ae7f6a93abd9fe1be65fd",
+    "zh:361dbff802ccbd94b87c9d77c0d9db9bdf4d5d408f8cf05e4dae203e60b310ca",
+    "zh:3b25cb8a0327886aa30c273561ecea3315cc4d729677cd6528ed1339486475da",
+    "zh:63455a68fee4ba0c9b131eb7e267eb17707184c55a5feb9e2bad2d9de5889d6a",
+  ]
+}

COPYING

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

Makefile

@@ -1,55 +1,142 @@
-TERRAFORM_ENV=production
+# Copyright 2025-2026 Thomas Hintz
 
-include apps.config
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+TERRAFORM_ENV := production
+
+config_dir := ./config/
+apps_config := $(config_dir)apps.config
+
+BUTANE := butane -d ${PWD}
+
+ifeq ($(shell command -v docker >/dev/null 2>&1 && echo yes),yes)
+	BUTANE := docker run --rm --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd
+endif
+
+IMAGE_DEPS :=
+
+COMPOSE_ENVS := $(shell if [ -d app/ ]; then find app/ -type f -name '.compose-env'; fi)
+
+ALL_APPS_FILES = $(shell find all-apps/ -type f -name '*')
+
+APP_MAKEFILES := $(shell if [ -d app/ ]; then find app/ -type f -name 'Makefile'; fi)
+-include $(APP_MAKEFILES)
 
 # .dirstamp plus && $@ is like make magic to get this rule
 # to only run if the contents of all-apps changes
-app/.dirstamp: all-apps/app.service all-apps/docker-compose.yaml $(wildcard all-apps/lb/*) $(wildcard all-apps/nextcloud/*) $(wildcard all-apps/wg-easy/*)
+app/.dirstamp: copy-apps.sh $(apps_config) $(ALL_APPS_FILES)
 	rm -Rf app/
-	cp -a all-apps app && touch $@
+	mkdir app/
+	cp all-apps/app.service app/
+	cp all-apps/restic-snapshot.service app/
+	./make-top-level-docker-compose.sh $(apps_config) > app/docker-compose.yaml
+	./copy-apps.sh $(apps_config) && touch $@
+
+# # compose .env files
+# # (compose only supports one .env file at the root by default)
+app/.env: $(apps_config) $(COMPOSE_ENVS)
+	find app/ -name ".compose-env" -exec cat > app/.env {} +
 
 # Caddy / lb
-all-apps/lb/Caddyfile: apps.config make-caddyfile.sh
-	./make-caddyfile.sh > all-apps/lb/Caddyfile
+app/lb/lb.env: $(apps_config) app/.dirstamp make-caddyfile-env.sh
+	mkdir -p app/lb
+	./make-caddyfile-env.sh $(apps_config) > $@
 
-# Nextcloud
-all-apps/nextcloud/nextcloud_admin_user: apps.config
-	echo "$(NEXTCLOUD_ADMIN_USER)" > $@
-all-apps/nextcloud/nextcloud_admin_password: apps.config
-	echo "$(NEXTCLOUD_ADMIN_PASSWORD)" > $@
-all-apps/nextcloud/postgres_db: apps.config
-	echo "$(NEXTCLOUD_POSTGRES_DB)" > $@
-all-apps/nextcloud/postgres_user: apps.config
-	echo "$(NEXTCLOUD_POSTGRES_USER)" > $@
-all-apps/nextcloud/postgres_password: apps.config
-	echo "$(NEXTCLOUD_POSTGRES_PASSWORD)" > $@
-all-apps/nextcloud/redis_password: apps.config
-	echo "$(NEXTCLOUD_REDIS_PASSWORD)" > $@
-all-apps/nextcloud/nextcloud.env: apps.config make-nextcloud-env.sh
-	./make-nextcloud-env.sh
+app/lb/Caddyfile: $(apps_config) app/.dirstamp
+	echo "(maintenance_intercept) {" > app/lb/Caddyfile-tmp
+	echo "@maintenanceModeActive file /maintenance/maintenance.on {" >> app/lb/Caddyfile-tmp
+	echo "  root /" >> app/lb/Caddyfile-tmp
+	echo "}" >> app/lb/Caddyfile-tmp
+	echo "handle @maintenanceModeActive {" >> app/lb/Caddyfile-tmp
+	echo "  respond \"We are performing a maintenance, come back later\" 503" >> app/lb/Caddyfile-tmp
+	echo "}" >> app/lb/Caddyfile-tmp
+	echo "}" >> app/lb/Caddyfile-tmp
+	find app/ -name "Caddyfile" -exec cat >> app/lb/Caddyfile-tmp {} +
+	mv app/lb/Caddyfile-tmp $@
+
+# Backups / Restic / Backblaze
+restic-env: $(apps_config) make-restic-generated.sh
+	./make-restic-generated.sh $(apps_config) > restic-env
+restic-password: $(apps_config) make-restic-password.sh
+	./make-restic-password.sh $(apps_config) > restic-password
+
+app.tar.gz: app/.dirstamp \
+app/.env \
+app/lb/lb.env \
+app/lb/Caddyfile
+	tar cfz app.tar.gz app/
 
 ignition.json: cl.yaml app/.dirstamp \
-all-apps/lb/Caddyfile \
-all-apps/nextcloud/nextcloud_admin_user \
-all-apps/nextcloud/nextcloud_admin_password \
-all-apps/nextcloud/postgres_db \
-all-apps/nextcloud/postgres_user \
-all-apps/nextcloud/postgres_password \
-all-apps/nextcloud/redis_password \
-all-apps/nextcloud/nextcloud.env
-	cat cl.yaml | sudo docker run --rm --volume /home/tjhintz/.ssh/id_rsa.pub:/pwd/ssh-keys --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json
+$(IMAGE_DEPS) \
+app/lb/lb.env \
+app/lb/Caddyfile \
+restic-env \
+restic-password \
+restic-restore.sh \
+restic-snapshot.sh \
+restic-scheduled-snapshot.sh \
+app/.env \
+$(config_dir)ssh-keys \
+app.tar.gz
+	cat cl.yaml | $(BUTANE) > ignition.json
 
-generated.tfvars: apps.config make-generated.sh
-	./make-generated.sh > generated.tfvars
+generated.tfvars: $(apps_config) make-generated.sh
+	./make-generated.sh $(apps_config) > generated.tfvars
 
-plan: ignition.json $(TERRAFORM_ENV).tfvars generated.tfvars
-	bash -c "terraform plan -var-file=<(cat $(TERRAFORM_ENV).tfvars generated.tfvars)"
+plan: ignition.json $(config_dir)$(TERRAFORM_ENV).tfvars generated.tfvars
+	terraform init
+	bash -c "terraform plan -var-file=<(cat $(config_dir)$(TERRAFORM_ENV).tfvars generated.tfvars)"
 
-apply: ignition.json $(TERRAFORM_ENV).tfvars generated.tfvars
-	bash -c "terraform apply -var-file=<(cat $(TERRAFORM_ENV).tfvars generated.tfvars)"
+.PHONY: announce-start
+announce-start:
+	echo "NASSELLA_CONFIG: start"
 
-destroy: ignition.json $(TERRAFORM_ENV).tfvars generated.tfvars
-	bash -c "terraform destroy -var-file=<(cat $(TERRAFORM_ENV).tfvars generated.tfvars)"
+# run this first to generate the all/ dir
+# then we can 'include' all the Makefiles in all/
+.PHONY: preapply
+preapply: app/.dirstamp
+	echo "app generated"
+
+apply: announce-start restic-init ignition.json $(config_dir)$(TERRAFORM_ENV).tfvars generated.tfvars
+	echo "NASSELLA_CONFIG: end"
+	terraform init --upgrade
+	bash -c "terraform apply -auto-approve -input=false -var-file=<(cat $(config_dir)$(TERRAFORM_ENV).tfvars generated.tfvars)"
+
+destroy: ignition.json $(config_dir)$(TERRAFORM_ENV).tfvars generated.tfvars
+	terraform init --upgrade
+	bash -c "terraform destroy -auto-approve -input=false -var-file=<(cat $(config_dir)$(TERRAFORM_ENV).tfvars generated.tfvars)"
+
+.PHONY: restic-init
+restic-init: $(apps_config) restic-password
+	./init-restic.sh $(apps_config)
+
+## just an easy way to see snapshots that have been taken
+.PHONY: restic-snapshots
+restic-snapshots: $(apps_config) restic-password
+	./restic-snapshots.sh $(apps_config)
+
+.PHONY: archive
+archive:
+	echo "(" > all-apps/root-napp.scm
+	find all-apps/ -name "napp.scm" -exec cat >> all-apps/root-napp.scm {} +
+	echo ")" >> all-apps/root-napp.scm
+	tar -cf nassella-latest.tar all-apps cl.yaml init-restic.sh main.tf make-caddyfile-env.sh make-top-level-docker-compose.sh Makefile \
+		make-generated.sh make-restic-generated.sh make-restic-password.sh restic-snapshots.sh copy-apps.sh restic-restore.sh restic-snapshot.sh \
+		restic-scheduled-snapshot.sh \
+		.terraform.lock.hcl
+	cp nassella-latest.tar src/
 
 ## to help me remember the command to run to test the config locally
 testlocalhost:
@@ -60,3 +147,4 @@ flatcarbuild: ignition.json
 
 flatcarrun:
 	./flatcar/flatcar_production_qemu.sh -i ignition.json
+

README.org

@@ -0,0 +1,264 @@
+* Development Notes
+
+- Currently, only tested on Linux (Debian). Everything should
+  theoretically also work on Mac but some commands may need updating
+  and it has not been tested, but multi-platform support, except for
+  Windows, was kept in mind during development.
+
+* Project Goal
+
+To make deploying, managing, and updating self-hosted app instances
+easy.
+
+* Short Note On Generative AI
+
+This project does NOT use any code or documentation generated by an
+LLM and no code or text generated by an LLM is acceptable as a
+contribution.
+
+* Supported Services
+
+Currently, only a limited set of external services can be used for
+hosting, DNS, and backups. This can be easily extended later with
+modifications to the Terraform config. As of now, you will need to
+have accounts with these providers:
+
+- DigitalOcean
+- Cloudflare (and have DNS available for a domain)
+- Backblaze B2
+
+* Architecture
+
+The software stack is composed of a "base" command line interface that
+can be used to deploy and manage a single instance with a
+multi-instance, multi-user webapp that invokes the "base" as
+needed. The "base" can be run separately from the webapp. The webapp
+automatically generates the configs the "base" needs to run.
+
+The Makefile at the root of this source tree is the point of interface
+for everything and all commands are run via make.
+
+** "Base" Terraform Layer
+
+The project is designed so that if you want to just manage a single
+instance without the complexity of running a webapp you can easily do
+so. This is both so that individual users can take advantage of this
+but also so that when developing the Terraform and Docker Compose
+setup it can be done and tested without needing to deal with the web
+app as well.
+
+The "base" layer is made up of the following: Flatcar Linux, Docker
+Compose, Terraform, and a Makefile with a set of BASH scripts.
+
+*** Flatcar Linux
+
+The deployed instance runs on Flatcar Linux. Flatcar is a "read only"
+Linux distribution designed to only run containers and nothing
+else. Flatcar is used because it provides a high-level of security and
+the OS itself auto-updates on a two-week schedule. Also, being "read
+only" it is much more difficult for an external attacker to attack and
+much harder for a user that does not know what they are doing to "mess
+up".
+
+*** Docker Compose
+
+Each individual supported web app (like NextCloud, Ghost, etc) runs
+via Docker and is configured via Docker Compose. (The docker compose
+files are all in the "all-apps" directory in this source tree).
+
+The Flatcar Linux config contains a systemd unit (service file) that
+runs "docker compose". The Makefile copies all selected apps' docker
+compose files from all-apps/ to app/. The systemd unit runs all the
+docker compose files in the app/ directory. (The app/ directory is
+what actually gets copied to the Flatcar linux install, not the
+all-apps/ directory.)
+
+The docker compose setup is specific and needs further documentation
+here (to cover things like the shared load-balancer network setup and
+how persistent storage is handled).
+
+*** Terraform
+
+Terraform is used to actually manage the deployed instances. Currently
+it is a static terraform config controlled only via terraform
+variables (see config/production.tfvars.tmpl). The terraform commands
+are run via the Makefile.
+
+** Webapp
+
+The webapp is used both to provide a more "user-friendly" interface
+for setting up and managing instances as well as to provide a
+multi-user and multi-instance service. Internally, to manage an
+instance, the webapp generates the configs and invokes the same
+commands used when running the "base" CLI version by itself.
+
+* Setup "Base" CLI Terraform For Deploying Individual Instance
+
+NOTE: some of this may be outdated. It has not been tested on its own
+outside of running via the webapp for a bit. It does work when run via
+the webapp and all of the services still need to be setup as
+detailed (the data can be input via the webapp instead of only via the
+config files).
+
+** Dependencies
+- [[https://developer.hashicorp.com/terraform/install][terraform]]
+- [[https://www.docker.com/][docker]]
+- bash
+- GNU Make
+
+** Services
+
+*** [[https://www.digitalocean.com/][DigitalOcean]]
+
+- Create a DigitalOcean account and sign in to it
+
+- [[https://cloud.digitalocean.com/account/api/tokens][Click "API" on sidebar]]
+
+- Click "generate a new token"
+  - enter a name (can be anything, just for you to remember)
+  - set expiration as you desire
+  - set the "scope" to "Full Access"
+  - save the generated token for placing in production.tfvars -> do_token
+
+*** [[https://www.cloudflare.com/][Cloudflare]]
+
+- Create a CloudFlare account and sign into it
+
+- Either register a new domain or if you already have a domain not being used you can continue with that
+
+- On sidebar to to "Manage Account" -> "Account API Tokens"
+  - Click "Create Token"
+  - Under "templates" click "edit zone dns"
+  - Under "Zone Resources", in the box labelled "Select..." select the domain you want to use
+  - Click "continue to summary"
+  - Click "create token"
+  - Copy the token for use later on for the "cloudflare_api_token" in config/production.tfvars
+
+- Click "Account Home" to go back to the top level
+
+- Click on the domain you are using
+  - This will show the "Overview"
+  - Scroll down until you see the API heading and copy the "Zone ID" and "Account ID"
+
+    These will be used later on in config/production.tfvars for cloudflare_zone_id and cloudflare_account_id
+
+*** [[https://backblaze.com][Backblaze]]
+
+This is used automated for "off-site" backups / snapshots.
+
+- Create a Backblaze B2 account and sign in to it
+
+- Click "create a bucket"
+  - Give it a unique name (recommended something like [my-domain-com]-app-backups) but replace my-domain-com with your domain
+  - Files in bucket should be set to "Private"
+  - Leave "Default Encryption" as "disabled" (restic will encrypt the data)
+  - Leave "Object Lock" as disabled
+
+- Click on "Lifecycle Settings" under the newly created bucket
+  - Change to "Keep only the last version of the file"
+  - Click "Update Bucket"
+
+- Under the bucket details copy "Endpoint" for use later on in config/apps.config BACKBLAZE_BUCKET_URL
+
+- Click "Application Keys"
+  - Click "Add a new application key"
+  - "Name" can be whatever you want to remember it is a key for the backups for your apps
+  - Change "Allow access to buckets" to only the bucket you created in the previous step
+  - Leave "Type of Access" set to "Read and Write"
+  - Leave other options in their default values
+  - Click "Create new key"
+  - Copy/save the key for later use in config/apps.config BACKBLAZE_APPLICATION_KEY and the "keyID" for BACKBLAZE_KEY_ID
+
+** Configuration
+*** apps.config
+
+- ~cp config/apps.config.tmpl config/apps.config~
+
+- then edit ~config/apps.config~ and fill in all variables
+
+*** production.tfvars
+
+- ~cp config/production.tfvars.tmpl config/production.tfvars~
+
+- then edit ~config/production.tfvars~ and fill in all variables
+
+*** ssh keys
+
+- ~touch config/ssh-keys~
+
+- if you want to add your ssh key(s) for debugging then paste the pub ID in to the file
+
+** Deploy
+
+- ~make apply~
+
+** You're done!
+
+It will take a few minutes to deploy the server, start it, and pull
+all the docker images. But after that you should be able to visit your
+site and the apps running on its subdomains!
+
+* Setup Webapp
+** Dependencies
+
+- [[https://code.call-cc.org/][CHICKEN Scheme 5.3+]]
+- docker
+- GNU Make
+
+The webapp is written in Lisp (CHICKEN Scheme) and connects to a
+PostgreSQL database. It also depends on being able to run some docker
+commands. It has only been tested on Linux. Running the commands on
+other platforms may need work. A Makefile command is provided for
+running the Postgres database via docker so Postgres is not a listed
+as a direct dependency.
+
+** CHICKEN Scheme Libraries
+
+These will need to be installed via the ~chicken-install~ command.
+
+~postgresql sql-null srfi-1 srfi-13 srfi-18 srfi-19 srfi-158 srfi-194 sxml-transforms schematra uri-common http-client medea intarweb sql-null openssl postgresql crypto-tools~
+
+** html-widgets
+
+This is a CHICKEN Scheme library that also needs to be installed but
+it is not available via the ~chicken-install~ repository as I wrote it
+for this project and I have not published it externally yet. You can
+get the project here: [[https://code.thintz.com/tjhintz/html-widgets][code.thintz.com/tjhintz/html-widgets]]
+
+After downloading the project, you can install it by ~cd~ to the
+directory it is in and then running ~chicken-install~.
+
+** Architecture
+
+The webapp was designed to be very simple. Pages and handlers are
+based on the [[https://schematra.com/][Schematra]] CHICKEN Scheme library (Chiccup is NOT
+used). Currently, there are no external dependencies other than
+docker, which is used to run postgres in development as well as
+generate ssh keys for users in production. There is no JavaScript or
+styling libraries. The webapp is built as HTML pages with forms.
+
+The entry point for the webapp is ~src/nassella.scm~.
+
+*** HTML Widgets
+
+The core of page markup is created with the html-widgets library which
+provides the ~define-widget~ function. This would be similar to a
+"component" in something like React. It allows defining properties of
+a widget (component) as well as a name and default values. It also
+handles style transforms, detailed in the next section.
+
+*** Styling
+
+All styling is done via ~style~ attributes on HTML elements. This is
+handled internally by the html-widgets library. The html-widgets
+library will extract all of the styles into a CSS stylesheet and
+replace the ~style~ attributes with a corresponding, auto-generated,
+CSS class name attribute. Nothing is needed to define or manage styles
+other than to set them directly via an HTML ~style~ attribute.
+
+Shared styling values, like colors, are defined in the *style-tokens*
+global variable. It is a tree of style tokens (similar to
+[[https://css-tricks.com/what-are-design-tokens/][Design Tokens]]). ~nassella.scm~ also includes some functions to make it
+easy for widgets to fetch style values. The most common being ~$~
+which allows getting a style token value based on a dotted symbol or a
+symbol list ~($ 'color.primary.contrast)~ or ~($ '(color primary contrast)~

all-apps/Makefile

@@ -1,2 +1,18 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 run:
 	sudo docker-compose -f docker-compose.yaml $(find . -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) up

all-apps/app.service

@@ -1,7 +1,23 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 [Unit]
 Description=Main App
-After=docker.service
-Requires=docker.service
+After=restic-restore.service
+Requires=docker.service restic-restore.service
 [Service]
 TimeoutStartSec=0
 ExecStart=/bin/bash -c '/usr/bin/docker compose -f /app/docker-compose.yaml $(find /app -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) up'

all-apps/authelia/4/Caddyfile

@@ -0,0 +1,30 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+#{$authelia_SUBDOMAIN}.{$ROOT_DOMAIN} {
+#  route {
+#    @authelia path /authelia /authelia/*
+#    handle @authelia {
+#      reverse_proxy authelia:9091
+#    }
+#    forward_auth authelia:9091 {
+#      uri /api/authz/forward-auth
+#      copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+#    }
+#    reverse_proxy authelia:9091
+#  }
+#}
+

all-apps/authelia/4/Makefile

@@ -0,0 +1,35 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/authelia/postgres_db \
+app/authelia/postgres_user \
+app/authelia/postgres_password \
+app/authelia/authelia-config/configuration.yml \
+app/authelia/authelia-config/users.yml
+
+app/authelia/postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$AUTHELIA_POSTGRES_DB" > $@'
+app/authelia/postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$AUTHELIA_POSTGRES_USER" > $@'
+app/authelia/postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$AUTHELIA_POSTGRES_PASSWORD" > $@'
+app/authelia/authelia-config/configuration.yml: $(apps_config) app/authelia/authelia-config/configuration.yml.tmpl \
+app/authelia/make-authelia-config.sh
+	./app/authelia/make-authelia-config.sh $(apps_config)
+app/authelia/authelia-config/users.yml: $(apps_config) app/authelia/authelia-config/users.yml.tmpl \
+app/authelia/make-authelia-users-config.sh
+	./app/authelia/make-authelia-users-config.sh $(apps_config)

all-apps/authelia/4/authelia-config/configuration.yml.tmpl

@@ -0,0 +1,121 @@
+---
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+###############################################################
+#                   Authelia configuration                    #
+###############################################################
+
+server:
+  address: 'tcp://:9091/authelia'
+  endpoints:
+    authz:
+      forward-auth:
+        implementation: 'ForwardAuth'
+
+log:
+  level: 'debug'
+
+totp:
+  issuer: 'authelia.com'
+
+identity_validation:
+  reset_password:
+    jwt_secret: '$AUTHELIA_JWT_SECRET'
+
+authentication_backend:
+  disable_reset_password: true
+  file:
+    path: '/config/users.yml'
+    watch: false
+    search:
+      email: false
+      case_insensitive: false
+    extra_attributes:
+      extra_example:
+        multi_valued: false
+        value_type: 'string'
+    password:
+      algorithm: 'argon2'
+      argon2:
+        variant: 'argon2id'
+        iterations: 3
+        memory: 65536
+        parallelism: 4
+        key_length: 32
+        salt_length: 16
+      scrypt:
+        variant: 'scrypt'
+        iterations: 16
+        block_size: 8
+        parallelism: 1
+        key_length: 32
+        salt_length: 16
+      pbkdf2:
+        variant: 'sha512'
+        iterations: 310000
+        salt_length: 16
+      sha2crypt:
+        variant: 'sha512'
+        iterations: 50000
+        salt_length: 16
+      bcrypt:
+        variant: 'standard'
+        cost: 12
+
+access_control:
+  default_policy: 'deny'
+  rules:
+    # - domain: 'public.x.localhost'
+    #   policy: 'bypass'
+    # - domain: 'app.nassella.org'
+    #   policy: 'one_factor'
+    - domain: '$DOZZLE_FULL_DOMAIN'
+      policy: 'two_factor'
+
+session:
+  secret: '$AUTHELIA_SESSION_SECRET'
+
+  cookies:
+    - name: 'dozzle_session'
+      domain: '$DOZZLE_FULL_DOMAIN'  # Should match whatever your root protected domain is
+      authelia_url: 'https://$DOZZLE_FULL_DOMAIN/authelia'
+      expiration: '1 hour'  # 1 hour
+      inactivity: '5 minutes'  # 5 minutes
+      default_redirection_url: 'https://$DOZZLE_FULL_DOMAIN/'
+
+regulation:
+  max_retries: 3
+  find_time: '2 minutes'
+  ban_time: '5 minutes'
+
+storage:
+  encryption_key: '$AUTHELIA_ENCRYPTION_KEY'
+  postgres:
+    address: 'tcp://authelia_db:5432'
+    servers: []
+    database: '$AUTHELIA_POSTGRES_DB'
+    schema: 'public'
+    username: '$AUTHELIA_POSTGRES_USER'
+    password: '$AUTHELIA_POSTGRES_PASSWORD'
+    timeout: '5s'
+
+notifier:
+  smtp:
+    address: 'submission://$SMTP_HOST:$SMTP_PORT'
+    username: '$SMTP_AUTH_USER'
+    password: '$SMTP_AUTH_PASSWORD'
+    sender: '$SMTP_FROM'
+...

all-apps/authelia/4/authelia-config/users.yml.tmpl

@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://www.authelia.com/schemas/latest/json-schema/user-database.json
+users:
+  admin:
+    disabled: false
+    displayname: 'Admin'
+    password: '$HOST_ADMIN_PASSWORD'
+    email: '$HOST_ADMIN_USER'

all-apps/authelia/4/docker-compose.yaml

@@ -0,0 +1,69 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+secrets:
+  authelia_postgres_db:
+    file: ./authelia/postgres_db
+  authelia_postgres_password:
+    file: ./authelia/postgres_password
+  authelia_postgres_user:
+    file: ./authelia/postgres_user
+
+services:
+  authelia_db:
+    image: postgres:18-trixie
+    environment:
+      - POSTGRES_DB_FILE=/run/secrets/authelia_postgres_db
+      - POSTGRES_USER_FILE=/run/secrets/authelia_postgres_user
+      - POSTGRES_PASSWORD_FILE=/run/secrets/authelia_postgres_password
+    shm_size: 128mb
+    restart: always
+    volumes:
+      - /nassella/authelia/var-lib-postgresql:/var/lib/postgresql
+    networks:
+      - authelia_internal_db
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d `cat $$POSTGRES_DB_FILE` -U `cat $$POSTGRES_USER_FILE`"]
+      start_period: 15s
+      interval: 30s
+      retries: 3
+      timeout: 5s
+    secrets:
+      - authelia_postgres_db
+      - authelia_postgres_password
+      - authelia_postgres_user
+
+  authelia:
+    image: 'authelia/authelia'
+    volumes:
+      - ./authelia/authelia-config/configuration.yml:/config/configuration.yml:ro
+      - ./authelia/authelia-config/users.yml:/config/users.yml:ro
+    networks:
+      - lb
+      - authelia_internal_db
+    depends_on:
+      authelia_db:
+        condition: service_healthy
+    restart: 'unless-stopped'
+    healthcheck:
+      ## In production the healthcheck section should be commented.
+      disable: true
+
+networks:
+  lb:
+  authelia_internal_db:
+    driver: bridge
+    internal: true

all-apps/authelia/4/make-authelia-config.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+authelia_subdomain=
+dozzle_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "authelia" ]; then
+       authelia_subdomain="$subdomain"
+    fi
+
+    if [ "$app" = "dozzle" ]; then
+       dozzle_subdomain="$subdomain"
+    fi
+done
+
+export AUTHELIA_FULL_DOMAIN="$authelia_subdomain.$ROOT_DOMAIN"
+export DOZZLE_FULL_DOMAIN="$dozzle_subdomain.$ROOT_DOMAIN"
+envsubst < app/authelia/authelia-config/configuration.yml.tmpl > app/authelia/authelia-config/configuration.yml

all-apps/authelia/4/make-authelia-users-config.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+envsubst < app/authelia/authelia-config/users.yml.tmpl > app/authelia/authelia-config/users.yml

all-apps/docker-compose.yaml

@@ -1,25 +0,0 @@
-version: '3'
-services:
-  lb:
-    image: docker.io/caddy:2
-    volumes:
-#      - /app/lb:/etc/caddy
-      - ./lb/:/etc/caddy
-      - /nassella/lb/config:/config
-      - /nassella/lb/data:/data
-    networks:
-      - lb
-    restart: unless-stopped
-    ports:
-      - "443:443"
-      - "80:80"
-  nginx:
-    image: nginx
-    restart: unless-stopped
-    networks:
-      - lb
-networks:
-  lb:
-# volumes:
-#   config:
-#   data:

all-apps/dozzle/20/Caddyfile

@@ -0,0 +1,29 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$dozzle_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  route {
+    @authelia path /authelia /authelia/*
+    handle @authelia {
+      reverse_proxy authelia:9091
+    }
+    forward_auth authelia:9091 {
+      uri /api/authz/forward-auth
+      copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+    }
+    reverse_proxy http://dozzle:8080
+  }
+}

all-apps/dozzle/20/docker-compose.yaml

@@ -0,0 +1,26 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+services:
+  dozzle:
+    container_name: dozzle
+    image: amir20/dozzle:latest
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - lb
+networks:
+  lb:

all-apps/ghost/6/.compose.env.tmpl

@@ -0,0 +1,61 @@
+# Use the below flags to enable the Analytics or ActivityPub containers as well
+# COMPOSE_PROFILES=analytics,activitypub
+
+# Ghost domain
+# Custom public domain Ghost will run on
+# GHOST_DOMAIN=www.nassella.cc
+
+# Ghost Admin domain
+# If you have Ghost Admin setup on a separate domain uncomment the line below and add the domain
+# You also need to uncomment the corresponding block in your Caddyfile
+# ADMIN_DOMAIN=
+
+# Database settings
+# All database settings must not be changed once the database is initialised
+# GHOST_DATABASE_ROOT_PASSWORD=reallysecurerootpassword
+# DATABASE_USER=optionalusername
+# GHOST_DATABASE_PASSWORD=ghostpassword
+
+# ActivityPub
+# If you'd prefer to self-host ActivityPub yourself uncomment the line below
+# ACTIVITYPUB_TARGET=activitypub:8080
+
+# Tinybird configuration
+# If you want to run Analytics, paste the output from `docker compose run --rm tinybird-login get-tokens` below
+# TINYBIRD_API_URL=https://api.tinybird.co
+# TINYBIRD_TRACKER_TOKEN=p.eyJxxxxx
+# TINYBIRD_ADMIN_TOKEN=p.eyJxxxxx
+# TINYBIRD_WORKSPACE_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+
+# Ghost configuration (https://ghost.org/docs/config/)
+
+# SMTP Email (https://ghost.org/docs/config/#mail)
+# Transactional email is required for logins, account creation (staff invites), password resets and other features
+# This is not related to bulk mail / newsletter sending
+mail__transport=SMTP
+# mail__options__host=
+# mail__options__port=
+# mail__options__secure=true
+# mail__options__auth__user=
+# mail__options__auth__pass=
+# mail__from=""
+
+# Advanced customizations
+
+# Force Ghost version
+# You should only do this if you need to pin a specific version
+# The update commands won't work
+# GHOST_VERSION=6-alpine
+
+# Port Ghost should listen on
+# You should only need to edit this if you want to host
+# multiple sites on the same server
+# GHOST_PORT=2368
+
+# Data locations
+# Location to store uploaded data
+# GHOST_UPLOAD_LOCATION=./data/ghost
+
+# Location for database data
+# GHOST_MYSQL_DATA_LOCATION=./data/mysql
+# NEWLINE REQUIRED AT END OF FILE

all-apps/ghost/6/Caddyfile

@@ -0,0 +1,20 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$ghost_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  import maintenance_intercept
+  reverse_proxy http://ghost:2368
+}

all-apps/ghost/6/Makefile

@@ -0,0 +1,21 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/ghost/.compose-env
+
+app/ghost/.compose-env: $(apps_config) app/ghost/.compose.env.tmpl app/ghost/make-ghost-env.sh
+	./app/ghost/make-ghost-env.sh $(apps_config)

all-apps/ghost/6/docker-compose.yaml

@@ -0,0 +1,194 @@
+services:
+  ghost:
+    image: ghost:${GHOST_VERSION:-6-alpine}
+    restart: always
+    env_file:
+      - /app/.env
+    environment:
+      NODE_ENV: production
+      url: https://${GHOST_DOMAIN:?GHOST_DOMAIN environment variable is required}
+      admin__url: ${GHOST_ADMIN_DOMAIN:+https://${GHOST_ADMIN_DOMAIN}}
+      database__client: mysql
+      database__connection__host: ghost_db
+      database__connection__user: ${GHOST_DATABASE_USER:-ghost}
+      database__connection__password: ${GHOST_DATABASE_PASSWORD:?GHOST_DATABASE_PASSWORD environment variable is required}
+      database__connection__database: ghost
+      tinybird__tracker__endpoint: https://${GHOST_DOMAIN:?GHOST_DOMAIN environment variable is required}/.ghost/analytics/api/v1/page_hit
+      tinybird__adminToken: ${GHOST_TINYBIRD_ADMIN_TOKEN:-}
+      tinybird__workspaceId: ${GHOST_TINYBIRD_WORKSPACE_ID:-}
+      tinybird__tracker__datasource: analytics_events
+      tinybird__stats__endpoint: ${GHOST_TINYBIRD_API_URL:-https://api.tinybird.co}
+    volumes:
+      - /nassella/ghost/var-lib-ghost-content:/var/lib/ghost/content
+    depends_on:
+      ghost_db:
+        condition: service_healthy
+      ghost_tinybird-sync:
+        condition: service_completed_successfully
+        required: false
+      ghost_tinybird-deploy:
+        condition: service_completed_successfully
+        required: false
+      ghost_activitypub:
+        condition: service_started
+        required: false
+    networks:
+      - ghost_network
+      - lb
+
+  ghost_db:
+    image: mysql:9.7
+    restart: always
+    expose:
+      - "3306"
+    environment:
+      MYSQL_ROOT_PASSWORD: ${GHOST_DATABASE_ROOT_PASSWORD:?GHOST_DATABASE_ROOT_PASSWORD environment variable is required}
+      MYSQL_USER: ${GHOST_DATABASE_USER:-ghost}
+      MYSQL_PASSWORD: ${GHOST_DATABASE_PASSWORD:?GHOST_DATABASE_PASSWORD environment variable is required}
+      MYSQL_DATABASE: ghost
+      MYSQL_MULTIPLE_DATABASES: activitypub
+    volumes:
+      - /nassella/ghost/var-lib-mysql:/var/lib/mysql
+      - ./mysql-init:/docker-entrypoint-initdb.d
+    healthcheck:
+      test: mysqladmin ping -p$$GHOST_MYSQL_ROOT_PASSWORD -h 127.0.0.1
+      interval: 1s
+      start_period: 30s
+      start_interval: 10s
+      retries: 120
+    networks:
+      - ghost_network
+    command:
+      - --performance-schema=OFF
+      - --innodb-buffer-pool-size=64M
+      - --max-connections=10
+      - --table-open-cache=128
+      - --table-definition-cache=128
+      - --thread-cache-size=2
+      - --innodb-log-buffer-size=8M
+
+  ghost_traffic-analytics:
+    image: ghost/traffic-analytics:1.0
+    restart: always
+    expose:
+      - "3000"
+    volumes:
+      - traffic_analytics_data:/data
+    environment:
+      NODE_ENV: production
+      PROXY_TARGET: ${GHOST_TINYBIRD_API_URL:-https://api.tinybird.co}/v0/events
+      SALT_STORE_TYPE: ${GHOST_SALT_STORE_TYPE:-file}
+      SALT_STORE_FILE_PATH: /data/salts.json
+      TINYBIRD_TRACKER_TOKEN: ${GHOST_TINYBIRD_TRACKER_TOKEN:-}
+      LOG_LEVEL: debug
+    profiles: [analytics]
+    networks:
+      - ghost_network
+
+  ghost_activitypub:
+    image: ghcr.io/tryghost/activitypub:1.1.0@sha256:39c212fe23603b182d68e67d555c6b9b04b1e57459dfc0bef26d6e4980eb04d1
+    restart: always
+    expose:
+      - "8080"
+    volumes:
+      - /nassella/ghost/var-lib-ghost-content:/opt/activitypub/content
+    environment:
+      # See https://github.com/TryGhost/ActivityPub/blob/main/docs/env-vars.md
+      NODE_ENV: production
+      MYSQL_HOST: ghost_db
+      MYSQL_USER: ${GHOST_DATABASE_USER:-ghost}
+      MYSQL_PASSWORD: ${GHOST_DATABASE_PASSWORD:?GHOST_DATABASE_PASSWORD environment variable is required}
+      MYSQL_DATABASE: activitypub
+      LOCAL_STORAGE_PATH: /opt/activitypub/content/images/activitypub
+      LOCAL_STORAGE_HOSTING_URL: https://${GHOST_DOMAIN}/content/images/activitypub
+    depends_on:
+      ghost_db:
+        condition: service_healthy
+      ghost_activitypub-migrate:
+        condition: service_completed_successfully
+    profiles: [activitypub]
+    networks:
+      - ghost_network
+
+  # Supporting Services
+
+  ghost_tinybird-login:
+    build:
+      context: ./tinybird
+      dockerfile: Dockerfile
+    working_dir: /home/tinybird
+    command: /usr/local/bin/tinybird-login
+    volumes:
+      - tinybird_home:/home/tinybird
+      - tinybird_files:/data/tinybird
+    profiles: [analytics]
+    networks:
+      - ghost_network
+    tty: false
+    restart: no
+
+  ghost_tinybird-sync:
+    # Do not alter this without updating the Ghost container as well
+    image: ghost:${GHOST_VERSION:-6-alpine}
+    command: >
+      sh -c "
+        if [ -d /var/lib/ghost/current/core/server/data/tinybird ]; then
+          rm -rf /data/tinybird/*;
+          cp -rf /var/lib/ghost/current/core/server/data/tinybird/* /data/tinybird/;
+          echo 'Tinybird files synced into shared volume.';
+        else
+          echo 'Tinybird source directory not found.';
+        fi
+      "
+    volumes:
+      - tinybird_files:/data/tinybird
+    depends_on:
+      ghost_tinybird-login:
+        condition: service_completed_successfully
+    networks:
+      - ghost_network
+    profiles: [analytics]
+    restart: no
+
+  ghost_tinybird-deploy:
+    build:
+      context: ./tinybird
+      dockerfile: Dockerfile
+    working_dir: /data/tinybird
+    command: >
+      sh -c "
+        tb-wrapper --cloud deploy
+      "
+    volumes:
+      - tinybird_home:/home/tinybird
+      - tinybird_files:/data/tinybird
+    depends_on:
+      ghost_tinybird-sync:
+        condition: service_completed_successfully
+    profiles: [analytics]
+    networks:
+      - ghost_network
+    tty: true
+
+  ghost_activitypub-migrate:
+    image: ghcr.io/tryghost/activitypub-migrations:1.1.0@sha256:b3ab20f55d66eb79090130ff91b57fe93f8a4254b446c2c7fa4507535f503662
+    environment:
+      MYSQL_DB: mysql://${GHOST_DATABASE_USER:-ghost}:${GHOST_DATABASE_PASSWORD:?GHOST_DATABASE_PASSWORD environment variable is required}@tcp(ghost_db:3306)/activitypub
+    networks:
+      - ghost_network
+    depends_on:
+      ghost_db:
+        condition: service_healthy
+    profiles: [activitypub]
+    restart: no
+
+volumes:
+  tinybird_files:
+  tinybird_home:
+  traffic_analytics_data:
+
+networks:
+  lb:
+  ghost_network:
+    driver: bridge
+    internal: true

all-apps/ghost/6/make-ghost-env.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+ghost_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "ghost" ]; then
+       ghost_subdomain="$subdomain"
+    fi
+done
+
+# write compose env file
+echo "GHOST_DOMAIN=\"$ghost_subdomain.$ROOT_DOMAIN\"" > app/ghost/.compose-env
+echo "GHOST_DATABASE_ROOT_PASSWORD=\"$GHOST_DATABASE_ROOT_PASSWORD\"" >> app/ghost/.compose-env
+echo "GHOST_DATABASE_PASSWORD=\"$GHOST_DATABASE_PASSWORD\"" >> app/ghost/.compose-env
+echo "mail__options__host=\"$SMTP_HOST\"" >> app/ghost/.compose-env
+echo "mail__options__port=\"$SMTP_PORT\"" >> app/ghost/.compose-env
+echo "mail__options__auth__user=\"$SMTP_AUTH_USER\"" >> app/ghost/.compose-env
+echo "mail__options__auth__pass=\"$SMTP_AUTH_PASSWORD\"" >> app/ghost/.compose-env
+echo "mail__from=\"$SMTP_FROM\"" >> app/ghost/.compose-env
+cat app/ghost/.compose.env.tmpl >> app/ghost/.compose-env

all-apps/instance-control/b0.0.1/Caddyfile

@@ -0,0 +1,19 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$instance_control_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  reverse_proxy http://instance_control:9000
+}

all-apps/instance-control/b0.0.1/Makefile

@@ -0,0 +1,24 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/instance-control/webhook_secret \
+app/instance-control/hooks/hooks.json
+
+app/instance-control/webhook_secret: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$INSTANCE_CONTROL_WEBHOOKS_SECRET" > $@'
+app/instance-control/hooks/hooks.json: $(apps_config) app/instance-control/make-instance-control-config.sh
+	./app/instance-control/make-instance-control-config.sh $(apps_config)

all-apps/instance-control/b0.0.1/docker-compose.yaml

@@ -0,0 +1,38 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+version: '3'
+
+secrets:
+  instance_control_webhooks_secret:
+    file: ./instance-control/webhook_secret
+
+services:
+  instance_control:
+    image: almir/webhook
+    volumes:
+      - ./instance-control/hooks/:/etc/webhook
+      - /tmp/restic:/tmp/restic
+    secrets:
+      - instance_control_webhooks_secret
+    command:
+      - "-hooks=/etc/webhook/hooks.json"
+      - -verbose
+    networks:
+      - lb
+    restart: unless-stopped
+networks:
+  lb:

all-apps/instance-control/b0.0.1/hooks/hooks.json.tmpl

@@ -0,0 +1,64 @@
+[
+    {
+        "id": "queue-restic-snapshot",
+        "pass-environment-to-command": [
+            {"source": "payload", "name": "version"},
+            {"source": "payload", "name": "path"},
+            {"source": "payload", "name": "tag"},
+            {"source": "payload", "name": "request_id"}
+        ],
+        "trigger-rule":
+            {
+                "match": {
+                    "type": "payload-hmac-sha256",
+                    "secret": "$INSTANCE_CONTROL_WEBHOOKS_SECRET",
+                    "parameter": {
+                        "source": "header",
+                        "name": "X-Nassella-Signature"
+                    }
+                }
+            },
+        "execute-command": "/etc/webhook/queue-restic-snapshot.sh"
+    },
+    {
+        "id": "queue-restic-snapshot-no-restart",
+        "pass-environment-to-command": [
+            {"source": "payload", "name": "version"},
+            {"source": "payload", "name": "path"},
+            {"source": "payload", "name": "tag"},
+            {"source": "payload", "name": "request_id"}
+        ],
+        "trigger-rule":
+            {
+                "match": {
+                    "type": "payload-hmac-sha256",
+                    "secret": "$INSTANCE_CONTROL_WEBHOOKS_SECRET",
+                    "parameter": {
+                        "source": "header",
+                        "name": "X-Nassella-Signature"
+                    }
+                }
+            },
+        "execute-command": "/etc/webhook/queue-restic-snapshot-no-restart.sh"
+    },
+    {
+        "id": "restic-snapshot-status",
+        "include-command-output-in-response": true,
+        "pass-environment-to-command": [
+            {"source": "payload", "name": "version"},
+            {"source": "payload", "name": "request_id"}
+        ],
+        "trigger-rule":
+            {
+                "match": {
+                    "type": "payload-hmac-sha256",
+                    "secret": "$INSTANCE_CONTROL_WEBHOOKS_SECRET",
+                    "parameter": {
+                        "source": "header",
+                        "name": "X-Nassella-Signature"
+                    }
+                }
+            },
+        "execute-command": "/etc/webhook/restic-snapshot-status.sh"
+    }
+]

all-apps/instance-control/b0.0.1/hooks/queue-restic-snapshot-no-restart.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+# TODO the systemd unit should actually do this
+# touch /maintenance/maintenance.on
+# rm /maintenance/maintenance.on
+
+# for instance-control docker compose setup:
+# make a directory in /tmp for these pipes and mount that as a volume
+# into the container
+
+# TODO read 'version' arg from request and make sure it
+# matches the version of this script
+
+# use a named pipe
+printf "%s\t%s\t%s\t%s\n" "$HOOK_tag" "$HOOK_request_id" "$HOOK_path" "false" > /tmp/restic/snapshot_trigger_pipe

all-apps/instance-control/b0.0.1/hooks/queue-restic-snapshot.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+# TODO the systemd unit should actually do this
+# touch /maintenance/maintenance.on
+# rm /maintenance/maintenance.on
+
+# for instance-control docker compose setup:
+# make a directory in /tmp for these pipes and mount that as a volume
+# into the container
+
+# TODO read 'version' arg from request and make sure it
+# matches the version of this script
+
+# use a named pipe
+printf "%s\t%s\t%s\t%s\n" "$HOOK_tag" "$HOOK_request_id" "$HOOK_path" "true" > /tmp/restic/snapshot_trigger_pipe

all-apps/instance-control/b0.0.1/hooks/restic-snapshot-status.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+# TODO read 'version' arg from request and make sure it
+# matches the version of this script
+
+status=`cat /tmp/restic/snapshot_status_$HOOK_request_id`
+
+echo "{\"status\":\"$status\"}"

all-apps/instance-control/b0.0.1/make-instance-control-config.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+# substitute template with env var to insert webhooks secret
+envsubst < app/instance-control/hooks/hooks.json.tmpl > app/instance-control/hooks/hooks.json

all-apps/lldap/0.6.3/Caddyfile

@@ -0,0 +1,20 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$lldap_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  import maintenance_intercept
+  reverse_proxy http://lldap:17170
+}

all-apps/lldap/0.6.3/Makefile

@@ -0,0 +1,37 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/lldap/postgres_db \
+app/lldap/postgres_user \
+app/lldap/postgres_password \
+app/lldap/admin_password \
+app/lldap/jwt_secret \
+app/lldap/lldap-config/lldap_config.toml
+
+app/lldap/postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$LLDAP_POSTGRES_DB" > $@'
+app/lldap/postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$LLDAP_POSTGRES_USER" > $@'
+app/lldap/postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$LLDAP_POSTGRES_PASSWORD" > $@'
+app/lldap/admin_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$LLDAP_ADMIN_PASSWORD" > $@'
+app/lldap/jwt_secret: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$LLDAP_JWT_SECRET" > $@'
+app/lldap/lldap-config/lldap_config.toml: $(apps_config) app/lldap/lldap-config/lldap_config.toml.tmpl \
+app/lldap/make-lldap-config.sh
+	./app/lldap/make-lldap-config.sh $(apps_config)

all-apps/lldap/0.6.3/docker-compose.yaml

@@ -0,0 +1,81 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+secrets:
+  lldap_postgres_db:
+    file: ./lldap/postgres_db
+  lldap_postgres_password:
+    file: ./lldap/postgres_password
+  lldap_postgres_user:
+    file: ./lldap/postgres_user
+  lldap_admin_password:
+    file: ./lldap/admin_password
+  lldap_jwt_secret:
+    file: ./lldap/jwt_secret
+
+services:
+  lldap_db:
+    image: postgres:18-trixie
+    environment:
+      - POSTGRES_DB_FILE=/run/secrets/lldap_postgres_db
+      - POSTGRES_USER_FILE=/run/secrets/lldap_postgres_user
+      - POSTGRES_PASSWORD_FILE=/run/secrets/lldap_postgres_password
+    shm_size: 128mb
+    restart: always
+    volumes:
+      - /nassella/lldap/var-lib-postgresql:/var/lib/postgresql
+    networks:
+      - lldap_db_internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d `cat $$POSTGRES_DB_FILE` -U `cat $$POSTGRES_USER_FILE`"]
+      start_period: 15s
+      interval: 30s
+      retries: 3
+      timeout: 5s
+    secrets:
+      - lldap_postgres_db
+      - lldap_postgres_password
+      - lldap_postgres_user
+
+  lldap:
+    image: lldap/lldap:stable
+    environment:
+      - LLDAP_JWT_SECRET_FILE=/run/secrets/lldap_jwt_secret
+      - LLDAP_LDAP_USER_PASS_FILE=/run/secrets/lldap_admin_password
+    volumes:
+      - ./lldap/lldap-config/:/data
+    networks:
+      - lb
+      - lldap_internal
+      - lldap_db_internal
+    depends_on:
+      lldap_db:
+        condition: service_healthy
+    secrets:
+      - lldap_postgres_db
+      - lldap_postgres_password
+      - lldap_postgres_user
+      - lldap_jwt_secret
+      - lldap_admin_password
+
+networks:
+  lb:
+  lldap_internal:
+    driver: bridge
+    internal: true
+  lldap_db_internal:
+    driver: bridge
+    internal: true

all-apps/lldap/0.6.3/lldap-config/lldap_config.toml.tmpl

@@ -0,0 +1,161 @@
+## Default configuration for Docker.
+## All the values can be overridden through environment variables, prefixed
+## with "LLDAP_". For instance, "ldap_port" can be overridden with the
+## "LLDAP_LDAP_PORT" variable.
+
+## Tune the logging to be more verbose by setting this to be true.
+## You can set it with the LLDAP_VERBOSE environment variable.
+# verbose=false
+
+## The host address that the LDAP server will be bound to.
+## To enable IPv6 support, simply switch "ldap_host" to "::":
+## To only allow connections from localhost (if you want to restrict to local self-hosted services),
+## change it to "127.0.0.1" ("::1" in case of IPv6).
+## If LLDAP server is running in docker, set it to "0.0.0.0" ("::" for IPv6) to allow connections
+## originating from outside the container.
+ldap_host = "0.0.0.0"
+
+## The port on which to have the LDAP server.
+#ldap_port = 3890
+
+## The host address that the HTTP server will be bound to.
+## To enable IPv6 support, simply switch "http_host" to "::".
+## To only allow connections from localhost (if you want to restrict to local self-hosted services),
+## change it to "127.0.0.1" ("::1" in case of IPv6).
+## If LLDAP server is running in docker, set it to "0.0.0.0" ("::" for IPv6) to allow connections
+## originating from outside the container.
+http_host = "0.0.0.0"
+
+## The port on which to have the HTTP server, for user login and
+## administration.
+#http_port = 17170
+
+## The public URL of the server, for password reset links.
+http_url = "https://$LLDAP_FULL_DOMAIN"
+
+## The path to the front-end assets (relative to the working directory).
+#assets_path = "./app"
+
+## Random secret for JWT signature.
+## This secret should be random, and should be shared with application
+## servers that need to consume the JWTs.
+## Changing this secret will invalidate all user sessions and require
+## them to re-login.
+## You should probably set it through the LLDAP_JWT_SECRET environment
+## variable from a secret ".env" file.
+## This can also be set from a file's contents by specifying the file path
+## in the LLDAP_JWT_SECRET_FILE environment variable
+## You can generate it with (on linux):
+## LC_ALL=C tr -dc 'A-Za-z0-9!#%&'\''()*+,-./:;<=>?@[\]^_{|}~' </dev/urandom | head -c 32; echo ''
+# jwt_secret = "$NASSELLA_LLDAP_JWT_SECRET"
+
+## Base DN for LDAP.
+## This is usually your domain name, and is used as a
+## namespace for your users. The choice is arbitrary, but will be needed
+## to configure the LDAP integration with other services.
+## The sample value is for "example.com", but you can extend it with as
+## many "dc" as you want, and you don't actually need to own the domain
+## name.
+ldap_base_dn = "dc=nassella,dc=org"
+
+## Admin username.
+## For the LDAP interface, a value of "admin" here will create the LDAP
+## user "cn=admin,ou=people,dc=example,dc=com" (with the base DN above).
+## For the administration interface, this is the username.
+#ldap_user_dn = "admin"
+
+## Admin email.
+## Email for the admin account. It is only used when initially creating
+## the admin user, and can safely be omitted.
+ldap_user_email = "$LLDAP_USER_EMAIL"
+
+## Admin password.
+## Password for the admin account, both for the LDAP bind and for the
+## administration interface. It is only used when initially creating
+## the admin user.
+## It should be minimum 8 characters long.
+## You can set it with the LLDAP_LDAP_USER_PASS environment variable.
+## This can also be set from a file's contents by specifying the file path
+## in the LLDAP_LDAP_USER_PASS_FILE environment variable
+## Note: you can create another admin user for user administration, this
+## is just the default one.
+# ldap_user_pass = ""
+
+## Force reset of the admin password.
+## Break glass in case of emergency: if you lost the admin password, you
+## can set this to true to force a reset of the admin password to the value
+## of ldap_user_pass above.
+## Alternatively, you can set it to "always" to reset every time the server starts.
+# force_ldap_user_pass_reset = false
+
+## Database URL.
+## This encodes the type of database (SQlite, MySQL, or PostgreSQL)
+## , the path, the user, password, and sometimes the mode (when
+## relevant).
+## Note: SQlite should come with "?mode=rwc" to create the DB
+## if not present.
+## Example URLs:
+##  - "postgres://postgres-user:password@postgres-server/my-database"
+##  - "mysql://mysql-user:password@mysql-server/my-database"
+##
+## This can be overridden with the LLDAP_DATABASE_URL env variable.
+database_url = "postgres://lldap:$LLDAP_POSTGRES_PASSWORD@lldap_db/lldap"
+
+## Private key file.
+## Not recommended, use key_seed instead.
+## Contains the secret private key used to store the passwords safely.
+## Note that even with a database dump and the private key, an attacker
+## would still have to perform an (expensive) brute force attack to find
+## each password.
+## Randomly generated on first run if it doesn't exist.
+## Env variable: LLDAP_KEY_FILE
+#key_file = "/data/private_key"
+
+## Seed to generate the server private key, see key_file above.
+## This can be any random string, the recommendation is that it's at least 12
+## characters long.
+## Env variable: LLDAP_KEY_SEED
+key_seed = "$LLDAP_KEY_SEED"
+
+## Ignored attributes.
+## Some services will request attributes that are not present in LLDAP. When it
+## is the case, LLDAP will warn about the attribute being unknown. If you want
+## to ignore the attribute and the service works without, you can add it to this
+## list to silence the warning.
+#ignored_user_attributes = [ "sAMAccountName" ]
+#ignored_group_attributes = [ "mail", "userPrincipalName" ]
+
+## Options to configure SMTP parameters, to send password reset emails.
+## To set these options from environment variables, use the following format
+## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD
+[smtp_options]
+## Whether to enabled password reset via email, from LLDAP.
+enable_password_reset=true
+## The SMTP server.
+server="$SMTP_HOST"
+## The SMTP port.
+port=$SMTP_PORT
+## How the connection is encrypted, either "NONE" (no encryption), "TLS" or "STARTTLS".
+smtp_encryption = "TLS"
+## The SMTP user, usually your email address.
+user="$SMTP_AUTH_USER"
+## The SMTP password.
+password="$SMTP_AUTH_PASSSWORD"
+## The header field, optional: how the sender appears in the email. The first
+## is a free-form name, followed by an email between <>.
+from="$SMTP_FROM"
+## Same for reply-to, optional.
+#reply_to="Do not reply <noreply@localhost>"
+
+## Options to configure LDAPS.
+## To set these options from environment variables, use the following format
+## (example with "port"): LLDAP_LDAPS_OPTIONS__PORT
+[ldaps_options]
+## Whether to enable LDAPS.
+#enabled=true
+## Port on which to listen.
+#port=6360
+## Certificate file.
+#cert_file="/data/cert.pem"
+## Certificate key file.
+#key_file="/data/key.pem"

all-apps/lldap/0.6.3/make-lldap-config.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+lldap_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "lldap" ]; then
+       lldap_subdomain="$subdomain"
+    fi
+done
+
+export LLDAP_FULL_DOMAIN="$lldap_subdomain.$ROOT_DOMAIN"
+envsubst < app/lldap/lldap-config/lldap_config.toml.tmpl > app/lldap/lldap-config/lldap_config.toml

all-apps/nassella/b0.0.1/Caddyfile

@@ -0,0 +1,42 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$nassella_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  import maintenance_intercept
+
+  route {
+    @authelia path /authelia /authelia/*
+    handle @authelia {
+      reverse_proxy nassella_authelia:9091
+    }
+
+    handle /unsecured/* {
+      reverse_proxy http://nassella:8080
+    }
+
+    forward_auth nassella_authelia:9091 {
+      uri /api/authz/forward-auth
+      copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+    }
+
+    reverse_proxy http://nassella:8080
+  }
+}
+
+lldap.{$nassella_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  import maintenance_intercept
+  reverse_proxy nassella_lldap:17170
+}

all-apps/nassella/b0.0.1/Makefile

@@ -0,0 +1,60 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/nassella/postgres_db \
+app/nassella/postgres_user \
+app/nassella/postgres_password \
+app/nassella/lldap_postgres_db \
+app/nassella/lldap_postgres_user \
+app/nassella/lldap_postgres_password \
+app/nassella/authelia_postgres_db \
+app/nassella/authelia_postgres_user \
+app/nassella/authelia_postgres_password \
+app/nassella/lldap_admin_password \
+app/nassella/stripe_api_key \
+app/nassella/nassella.env \
+app/nassella/authelia-config/configuration.yml \
+app/nassella/lldap-config/lldap_config.toml
+
+app/nassella/postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_POSTGRES_DB" > $@'
+app/nassella/postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_POSTGRES_USER" > $@'
+app/nassella/postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_POSTGRES_PASSWORD" > $@'
+app/nassella/authelia_postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_AUTHELIA_POSTGRES_DB" > $@'
+app/nassella/authelia_postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_AUTHELIA_POSTGRES_USER" > $@'
+app/nassella/authelia_postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_AUTHELIA_POSTGRES_PASSWORD" > $@'
+app/nassella/lldap_postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_POSTGRES_DB" > $@'
+app/nassella/lldap_postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_POSTGRES_USER" > $@'
+app/nassella/lldap_postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_POSTGRES_PASSWORD" > $@'
+app/nassella/lldap_admin_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_ADMIN_PASSWORD" > $@'
+app/nassella/stripe_api_key: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_STRIPE_API_KEY" > $@'
+app/nassella/authelia-config/configuration.yml: $(apps_config) app/nassella/authelia-config/configuration.yml.tmpl \
+app/nassella/make-nassella-authelia-config.sh
+	./app/nassella/make-nassella-authelia-config.sh $(apps_config)
+app/nassella/lldap-config/lldap_config.toml: $(apps_config) app/nassella/lldap-config/lldap_config.toml.tmpl \
+app/nassella/make-nassella-lldap-config.sh
+	./app/nassella/make-nassella-lldap-config.sh $(apps_config)

all-apps/nassella/b0.0.1/authelia-config/configuration.yml.tmpl

@@ -0,0 +1,119 @@
+---
+###############################################################
+#                   Authelia configuration                    #
+###############################################################
+
+server:
+  address: 'tcp://:9091/authelia'
+  endpoints:
+    authz:
+      forward-auth:
+        implementation: 'ForwardAuth'
+
+log:
+  level: 'debug'
+
+totp:
+  issuer: 'authelia.com'
+
+identity_validation:
+  reset_password:
+    jwt_secret: '$NASSELLA_AUTHELIA_JWT_SECRET'
+
+# lldap service account user should instead
+# use an account with lldap_password_manager group
+# since that can't be used to change an admin password
+authentication_backend:
+  ldap:
+    address: 'ldap://nassella_lldap:3890'
+    implementation: 'lldap'
+    timeout: '5s'
+    pooling:
+      enable: false
+      count: 5
+      retries: 2
+      timeout: '10 seconds'
+    base_dn: 'DC=nassella,DC=org'
+#    additional_users_dn: 'OU=users'
+#    additional_groups_dn: 'OU=groups'
+#    group_search_mode: 'filter'
+#    permit_referrals: false
+    permit_unauthenticated_bind: false
+    permit_feature_detection_failure: false
+    user: 'uid=admin,ou=people,dc=nassella,dc=org'
+    password: '$NASSELLA_LLDAP_ADMIN_PASSWORD'
+    # attributes:
+    #   distinguished_name: 'distinguishedName'
+    #   username: 'uid'
+    #   display_name: 'displayName'
+    #   family_name: 'sn'
+    #   given_name: 'givenName'
+    #   middle_name: 'middleName'
+    #   nickname: ''
+    #   gender: ''
+    #   birthdate: ''
+    #   website: 'wWWHomePage'
+    #   profile: ''
+    #   picture: ''
+    #   zoneinfo: ''
+    #   locale: ''
+    #   phone_number: 'telephoneNumber'
+    #   phone_extension: ''
+    #   street_address: 'streetAddress'
+    #   locality: 'l'
+    #   region: 'st'
+    #   postal_code: 'postalCode'
+    #   country: 'c'
+    #   mail: 'mail'
+    #   member_of: 'memberOf'
+    #   group_name: 'cn'
+    #   extra:
+    #     extra_example:
+    #       name: ''
+    #       multi_valued: false
+    #       value_type: 'string'
+
+access_control:
+  default_policy: 'deny'
+  rules:
+    # - domain: 'public.x.localhost'
+    #   policy: 'bypass'
+    # - domain: 'app.nassella.org'
+    #   policy: 'one_factor'
+    - domain: '$NASSELLA_FULL_DOMAIN'
+      policy: 'two_factor'
+
+session:
+  secret: 'insecure_session_secret' # TODO fix
+
+  cookies:
+    - name: 'authelia_session'
+      domain: '$NASSELLA_FULL_DOMAIN'  # Should match whatever your root protected domain is
+      authelia_url: 'https://$NASSELLA_FULL_DOMAIN/authelia'
+      expiration: '1 hour'  # 1 hour
+      inactivity: '5 minutes'  # 5 minutes
+      default_redirection_url: 'https://$NASSELLA_FULL_DOMAIN/dashboard'
+
+regulation:
+  max_retries: 3
+  find_time: '2 minutes'
+  ban_time: '5 minutes'
+
+storage:
+  encryption_key: '$NASSELLA_AUTHELIA_KEY_SEED'
+  postgres:
+    address: 'tcp://nassella_authelia_db:5432'
+    servers: []
+    database: 'authelia'
+    schema: 'public'
+    username: 'authelia'
+    password: '$NASSELLA_AUTHELIA_POSTGRES_PASSWORD'
+    timeout: '5s'
+
+notifier:
+  smtp:
+    address: 'submission://$SMTP_HOST:$SMTP_PORT'
+    username: '$SMTP_AUTH_USER'
+    password: '$SMTP_AUTH_PASSWORD'
+    sender: '$SMTP_FROM'
+...

all-apps/nassella/b0.0.1/authelia_postgres_db

@@ -0,0 +1 @@
+authelia

all-apps/nassella/b0.0.1/authelia_postgres_user

@@ -0,0 +1 @@
+authelia

all-apps/nassella/b0.0.1/docker-compose.yaml

@@ -0,0 +1,161 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+secrets:
+  nassella_postgres_db:
+    file: ./nassella/postgres_db
+  nassella_postgres_password:
+    file: ./nassella/postgres_password
+  nassella_postgres_user:
+    file: ./nassella/postgres_user
+  nassella_lldap_postgres_db:
+    file: ./nassella/lldap_postgres_db
+  nassella_lldap_postgres_password:
+    file: ./nassella/lldap_postgres_password
+  nassella_lldap_postgres_user:
+    file: ./nassella/lldap_postgres_user
+  nassella_authelia_postgres_db:
+    file: ./nassella/authelia_postgres_db
+  nassella_authelia_postgres_password:
+    file: ./nassella/authelia_postgres_password
+  nassella_authelia_postgres_user:
+    file: ./nassella/authelia_postgres_user
+  nassella_lldap_admin_password:
+    file: ./nassella/lldap_admin_password
+  nassella_stripe_api_key:
+    file: ./nassella/stripe_api_key
+
+services:
+  nassella_lldap_db:
+    image: postgres:18-trixie
+    environment:
+      - POSTGRES_DB_FILE=/run/secrets/nassella_lldap_postgres_db
+      - POSTGRES_USER_FILE=/run/secrets/nassella_lldap_postgres_user
+      - POSTGRES_PASSWORD_FILE=/run/secrets/nassella_lldap_postgres_password
+    shm_size: 128mb
+    restart: always
+    volumes:
+      - /nassella/nassella/lldap-var-lib-postgresql:/var/lib/postgresql
+    networks:
+      - nassella_internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d `cat $$POSTGRES_DB_FILE` -U `cat $$POSTGRES_USER_FILE`"]
+      start_period: 15s
+      interval: 30s
+      retries: 3
+      timeout: 5s
+    secrets:
+      - nassella_lldap_postgres_db
+      - nassella_lldap_postgres_password
+      - nassella_lldap_postgres_user
+
+  nassella_lldap:
+    image: lldap/lldap:stable
+    volumes:
+      - ./nassella/lldap-config/:/data
+    networks:
+      - lb
+      - nassella_internal
+    depends_on:
+      nassella_lldap_db:
+        condition: service_healthy
+    secrets:
+      - nassella_lldap_postgres_db
+      - nassella_lldap_postgres_password
+      - nassella_lldap_postgres_user
+
+  nassella_authelia_db:
+    image: postgres:18-trixie
+    environment:
+      - POSTGRES_DB_FILE=/run/secrets/nassella_authelia_postgres_db
+      - POSTGRES_USER_FILE=/run/secrets/nassella_authelia_postgres_user
+      - POSTGRES_PASSWORD_FILE=/run/secrets/nassella_authelia_postgres_password
+    shm_size: 128mb
+    restart: always
+    volumes:
+      - /nassella/nassella/authelia-var-lib-postgresql:/var/lib/postgresql
+    networks:
+      - nassella_internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d `cat $$POSTGRES_DB_FILE` -U `cat $$POSTGRES_USER_FILE`"]
+      start_period: 15s
+      interval: 30s
+      retries: 3
+      timeout: 5s
+    secrets:
+      - nassella_authelia_postgres_db
+      - nassella_authelia_postgres_password
+      - nassella_authelia_postgres_user
+
+  nassella_authelia:
+    image: 'authelia/authelia'
+    volumes:
+      - ./nassella/authelia-config/:/config
+    networks:
+      - lb
+      - nassella_internal
+    depends_on:
+      nassella_lldap:
+        condition: service_healthy
+      nassella_authelia_db:
+        condition: service_healthy
+    restart: 'unless-stopped'
+    healthcheck:
+      ## In production the healthcheck section should be commented.
+      disable: true
+
+  nassella_db:
+    image: postgres:18-trixie
+    env_file:
+      - ./nassella/nassella.env
+    shm_size: 128mb
+    restart: always
+    volumes:
+      - /nassella/nassella/var-lib-postgresql:/var/lib/postgresql
+    networks:
+      - nassella_internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d `cat $$POSTGRES_DB_FILE` -U `cat $$POSTGRES_USER_FILE`"]
+      start_period: 15s
+      interval: 30s
+      retries: 3
+      timeout: 5s
+    secrets:
+      - nassella_postgres_db
+      - nassella_postgres_password
+      - nassella_postgres_user
+  nassella:
+    image: nassella/b0.0.1
+    depends_on:
+      nassella_db:
+        condition: service_healthy
+    env_file:
+      - ./nassella/nassella.env
+    secrets:
+      - nassella_postgres_db
+      - nassella_postgres_password
+      - nassella_postgres_user
+      - nassella_lldap_admin_password
+      - nassella_stripe_api_key
+    networks:
+      - lb
+      - nassella_internal
+    restart: unless-stopped
+networks:
+  lb:
+  nassella_internal:
+    driver: bridge
+    internal: true

all-apps/nassella/b0.0.1/lldap-config/lldap_config.toml.tmpl

@@ -0,0 +1,161 @@
+## Default configuration for Docker.
+## All the values can be overridden through environment variables, prefixed
+## with "LLDAP_". For instance, "ldap_port" can be overridden with the
+## "LLDAP_LDAP_PORT" variable.
+
+## Tune the logging to be more verbose by setting this to be true.
+## You can set it with the LLDAP_VERBOSE environment variable.
+# verbose=false
+
+## The host address that the LDAP server will be bound to.
+## To enable IPv6 support, simply switch "ldap_host" to "::":
+## To only allow connections from localhost (if you want to restrict to local self-hosted services),
+## change it to "127.0.0.1" ("::1" in case of IPv6).
+## If LLDAP server is running in docker, set it to "0.0.0.0" ("::" for IPv6) to allow connections
+## originating from outside the container.
+ldap_host = "0.0.0.0"
+
+## The port on which to have the LDAP server.
+#ldap_port = 3890
+
+## The host address that the HTTP server will be bound to.
+## To enable IPv6 support, simply switch "http_host" to "::".
+## To only allow connections from localhost (if you want to restrict to local self-hosted services),
+## change it to "127.0.0.1" ("::1" in case of IPv6).
+## If LLDAP server is running in docker, set it to "0.0.0.0" ("::" for IPv6) to allow connections
+## originating from outside the container.
+http_host = "0.0.0.0"
+
+## The port on which to have the HTTP server, for user login and
+## administration.
+#http_port = 17170
+
+## The public URL of the server, for password reset links.
+http_url = "https://$NASSELLA_FULL_LLDAP_DOMAIN"
+
+## The path to the front-end assets (relative to the working directory).
+#assets_path = "./app"
+
+## Random secret for JWT signature.
+## This secret should be random, and should be shared with application
+## servers that need to consume the JWTs.
+## Changing this secret will invalidate all user sessions and require
+## them to re-login.
+## You should probably set it through the LLDAP_JWT_SECRET environment
+## variable from a secret ".env" file.
+## This can also be set from a file's contents by specifying the file path
+## in the LLDAP_JWT_SECRET_FILE environment variable
+## You can generate it with (on linux):
+## LC_ALL=C tr -dc 'A-Za-z0-9!#%&'\''()*+,-./:;<=>?@[\]^_{|}~' </dev/urandom | head -c 32; echo ''
+jwt_secret = "$NASSELLA_LLDAP_JWT_SECRET"
+
+## Base DN for LDAP.
+## This is usually your domain name, and is used as a
+## namespace for your users. The choice is arbitrary, but will be needed
+## to configure the LDAP integration with other services.
+## The sample value is for "example.com", but you can extend it with as
+## many "dc" as you want, and you don't actually need to own the domain
+## name.
+ldap_base_dn = "dc=nassella,dc=org"
+
+## Admin username.
+## For the LDAP interface, a value of "admin" here will create the LDAP
+## user "cn=admin,ou=people,dc=example,dc=com" (with the base DN above).
+## For the administration interface, this is the username.
+#ldap_user_dn = "admin"
+
+## Admin email.
+## Email for the admin account. It is only used when initially creating
+## the admin user, and can safely be omitted.
+#ldap_user_email = "admin@example.com"
+
+## Admin password.
+## Password for the admin account, both for the LDAP bind and for the
+## administration interface. It is only used when initially creating
+## the admin user.
+## It should be minimum 8 characters long.
+## You can set it with the LLDAP_LDAP_USER_PASS environment variable.
+## This can also be set from a file's contents by specifying the file path
+## in the LLDAP_LDAP_USER_PASS_FILE environment variable
+## Note: you can create another admin user for user administration, this
+## is just the default one.
+ldap_user_pass = "$NASSELLA_LLDAP_ADMIN_PASSWORD"
+
+## Force reset of the admin password.
+## Break glass in case of emergency: if you lost the admin password, you
+## can set this to true to force a reset of the admin password to the value
+## of ldap_user_pass above.
+## Alternatively, you can set it to "always" to reset every time the server starts.
+# force_ldap_user_pass_reset = false
+
+## Database URL.
+## This encodes the type of database (SQlite, MySQL, or PostgreSQL)
+## , the path, the user, password, and sometimes the mode (when
+## relevant).
+## Note: SQlite should come with "?mode=rwc" to create the DB
+## if not present.
+## Example URLs:
+##  - "postgres://postgres-user:password@postgres-server/my-database"
+##  - "mysql://mysql-user:password@mysql-server/my-database"
+##
+## This can be overridden with the LLDAP_DATABASE_URL env variable.
+database_url = "postgres://lldap:$NASSELLA_LLDAP_POSTGRES_PASSWORD@nassella_lldap_db/lldap"
+
+## Private key file.
+## Not recommended, use key_seed instead.
+## Contains the secret private key used to store the passwords safely.
+## Note that even with a database dump and the private key, an attacker
+## would still have to perform an (expensive) brute force attack to find
+## each password.
+## Randomly generated on first run if it doesn't exist.
+## Env variable: LLDAP_KEY_FILE
+#key_file = "/data/private_key"
+
+## Seed to generate the server private key, see key_file above.
+## This can be any random string, the recommendation is that it's at least 12
+## characters long.
+## Env variable: LLDAP_KEY_SEED
+key_seed = "$NASSELLA_LLDAP_KEY_SEED"
+
+## Ignored attributes.
+## Some services will request attributes that are not present in LLDAP. When it
+## is the case, LLDAP will warn about the attribute being unknown. If you want
+## to ignore the attribute and the service works without, you can add it to this
+## list to silence the warning.
+#ignored_user_attributes = [ "sAMAccountName" ]
+#ignored_group_attributes = [ "mail", "userPrincipalName" ]
+
+## Options to configure SMTP parameters, to send password reset emails.
+## To set these options from environment variables, use the following format
+## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD
+[smtp_options]
+## Whether to enabled password reset via email, from LLDAP.
+enable_password_reset=true
+## The SMTP server.
+server="$SMTP_HOST"
+## The SMTP port.
+port=$SMTP_PORT
+## How the connection is encrypted, either "NONE" (no encryption), "TLS" or "STARTTLS".
+smtp_encryption = "TLS"
+## The SMTP user, usually your email address.
+user="$SMTP_AUTH_USER"
+## The SMTP password.
+password="$SMTP_AUTH_PASSSWORD"
+## The header field, optional: how the sender appears in the email. The first
+## is a free-form name, followed by an email between <>.
+from="$SMTP_FROM"
+## Same for reply-to, optional.
+#reply_to="Do not reply <noreply@localhost>"
+
+## Options to configure LDAPS.
+## To set these options from environment variables, use the following format
+## (example with "port"): LLDAP_LDAPS_OPTIONS__PORT
+[ldaps_options]
+## Whether to enable LDAPS.
+#enabled=true
+## Port on which to listen.
+#port=6360
+## Certificate file.
+#cert_file="/data/cert.pem"
+## Certificate key file.
+#key_file="/data/key.pem"

all-apps/nassella/b0.0.1/lldap_postgres_db

@@ -0,0 +1 @@
+lldap

all-apps/nassella/b0.0.1/lldap_postgres_user

@@ -0,0 +1 @@
+lldap

all-apps/nassella/b0.0.1/make-nassella-authelia-config.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+nassella_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "nassella" ]; then
+       nassella_subdomain="$subdomain"
+    fi
+done
+
+export NASSELLA_FULL_DOMAIN="$nassella_subdomain.$ROOT_DOMAIN"
+export NASSELLA_FULL_LLDAP_DOMAIN="$NASSELLA_LLDAP_SUBDOMAIN.$nassella_subdomain.$ROOT_DOMAIN"
+envsubst < app/nassella/authelia-config/configuration.yml.tmpl > app/nassella/authelia-config/configuration.yml
+
+# write secrets
+echo "$NASSELLA_POSTGRES_DB" > app/nassella/postgres_db
+echo "$NASSELLA_POSTGRES_USER" > app/nassella/postgres_user
+echo "$NASSELLA_POSTGRES_PASSWORD" > app/nassella/postgres_password
+
+echo "$NASSELLA_AUTHELIA_POSTGRES_DB" > app/nassella/authelia_postgres_db
+echo "$NASSELLA_AUTHELIA_POSTGRES_USER" > app/nassella/authelia_postgres_user
+echo "$NASSELLA_AUTHELIA_POSTGRES_PASSWORD" > app/nassella/authelia_postgres_password
+
+echo "$NASSELLA_LLDAP_POSTGRES_DB" > app/nassella/lldap_postgres_db
+echo "$NASSELLA_LLDAP_POSTGRES_USER" > app/nassella/lldap_postgres_user
+echo "$NASSELLA_LLDAP_POSTGRES_PASSWORD" > app/nassella/lldap_postgres_password

all-apps/nassella/b0.0.1/make-nassella-lldap-config.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+nassella_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "nassella" ]; then
+       nassella_subdomain="$subdomain"
+    fi
+done
+
+export NASSELLA_FULL_DOMAIN="$nassella_subdomain.$ROOT_DOMAIN"
+export NASSELLA_FULL_LLDAP_DOMAIN="$NASSELLA_LLDAP_SUBDOMAIN.$nassella_subdomain.$ROOT_DOMAIN"
+envsubst < app/nassella/lldap-config/lldap_config.toml.tmpl > app/nassella/lldap-config/lldap_config.toml
+
+# write secrets
+echo "$NASSELLA_POSTGRES_DB" > app/nassella/postgres_db
+echo "$NASSELLA_POSTGRES_USER" > app/nassella/postgres_user
+echo "$NASSELLA_POSTGRES_PASSWORD" > app/nassella/postgres_password
+
+echo "$NASSELLA_AUTHELIA_POSTGRES_DB" > app/nassella/authelia_postgres_db
+echo "$NASSELLA_AUTHELIA_POSTGRES_USER" > app/nassella/authelia_postgres_user
+echo "$NASSELLA_AUTHELIA_POSTGRES_PASSWORD" > app/nassella/authelia_postgres_password
+
+echo "$NASSELLA_LLDAP_POSTGRES_DB" > app/nassella/lldap_postgres_db
+echo "$NASSELLA_LLDAP_POSTGRES_USER" > app/nassella/lldap_postgres_user
+echo "$NASSELLA_LLDAP_POSTGRES_PASSWORD" > app/nassella/lldap_postgres_password

all-apps/nassella/b0.0.1/nassella.env

@@ -0,0 +1,4 @@
+POSTGRES_HOST=nassella_db
+POSTGRES_DB_FILE=/run/secrets/nassella_postgres_db
+POSTGRES_USER_FILE=/run/secrets/nassella_postgres_user
+POSTGRES_PASSWORD_FILE=/run/secrets/nassella_postgres_password

all-apps/nassella/b0.0.1/postgres_db

@@ -0,0 +1 @@
+nassella

all-apps/nassella/b0.0.1/postgres_password

@@ -0,0 +1 @@
+password

all-apps/nassella/b0.0.1/postgres_user

@@ -0,0 +1 @@
+nassella

all-apps/nassella/b0.0.1/stripe_api_key

@@ -0,0 +1 @@
+api_key

all-apps/nextcloud/34/Caddyfile

@@ -0,0 +1,20 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$nextcloud_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  import maintenance_intercept
+  reverse_proxy http://nextcloud:80
+}

all-apps/nextcloud/34/Makefile

@@ -0,0 +1,39 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/nextcloud/nextcloud_admin_user \
+app/nextcloud/nextcloud_admin_password \
+app/nextcloud/postgres_db \
+app/nextcloud/postgres_user \
+app/nextcloud/postgres_password \
+app/nextcloud/redis_password \
+app/nextcloud/nextcloud.env
+
+app/nextcloud/nextcloud_admin_user: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$NEXTCLOUD_ADMIN_USER" > $@'
+app/nextcloud/nextcloud_admin_password: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$NEXTCLOUD_ADMIN_PASSWORD" > $@'
+app/nextcloud/postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_POSTGRES_DB" > $@'
+app/nextcloud/postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_POSTGRES_USER" > $@'
+app/nextcloud/postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_POSTGRES_PASSWORD" > $@'
+app/nextcloud/redis_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_REDIS_PASSWORD" > $@'
+app/nextcloud/nextcloud.env: $(apps_config) app/nextcloud/nextcloud.env.tmpl app/nextcloud/make-nextcloud-env.sh
+	./app/nextcloud/make-nextcloud-env.sh $(apps_config)

all-apps/nextcloud/34/docker-compose.yaml

@@ -0,0 +1,88 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+secrets:
+  nextcloud_postgres_db:
+    file: ./nextcloud/postgres_db
+  nextcloud_postgres_password:
+    file: ./nextcloud/postgres_password
+  nextcloud_postgres_user:
+    file: ./nextcloud/postgres_user
+  nextcloud_redis_password:
+    file: ./nextcloud/redis_password
+
+services:
+  nextcloud_db:
+    image: postgres:18-trixie
+    env_file:
+      - ./nextcloud/nextcloud.env
+    shm_size: 128mb
+    restart: always
+    volumes:
+      - /nassella/nextcloud/var-lib-postgresql:/var/lib/postgresql
+    networks:
+      - nextcloud_internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d `cat $$POSTGRES_DB_FILE` -U `cat $$POSTGRES_USER_FILE`"]
+      start_period: 15s
+      interval: 30s
+      retries: 3
+      timeout: 5s
+    secrets:
+      - nextcloud_postgres_db
+      - nextcloud_postgres_password
+      - nextcloud_postgres_user
+  nextcloud_redis:
+    image: redis:8-trixie
+    env_file:
+      - ./nextcloud/nextcloud.env
+    command: bash -c 'redis-server --requirepass "$$(cat /run/secrets/nextcloud_redis_password)"'
+    secrets:
+      - nextcloud_redis_password
+    restart: always
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli --no-auth-warning -a \"$$(cat /run/secrets/nextcloud_redis_password)\" ping | grep PONG"]
+      start_period: 10s
+      interval: 30s
+      retries: 3
+      timeout: 3s
+    networks:
+      - nextcloud_internal
+  nextcloud:
+    image: nextcloud:34-apache
+    depends_on:
+      nextcloud_redis:
+        condition: service_healthy
+      nextcloud_db:
+        condition: service_healthy
+    env_file:
+      - ./nextcloud/nextcloud.env
+    secrets:
+      - nextcloud_postgres_db
+      - nextcloud_postgres_password
+      - nextcloud_postgres_user
+      - nextcloud_redis_password
+    networks:
+      - lb
+      - nextcloud_internal
+    volumes:
+      - /nassella/nextcloud/var-www-html:/var/www/html
+    restart: unless-stopped
+networks:
+  lb:
+  nextcloud_internal:
+    driver: bridge
+    internal: true

all-apps/nextcloud/34/make-nextcloud-env.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+nextcloud_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "nextcloud" ]; then
+       nextcloud_subdomain="$subdomain"
+    fi
+done
+
+# write container env file
+echo "DOMAIN=\"$nextcloud_subdomain.$ROOT_DOMAIN\"" > app/nextcloud/nextcloud.env
+cat app/nextcloud/nextcloud.env.tmpl >> app/nextcloud/nextcloud.env
+
+# write secrets
+echo "$NEXTCLOUD_POSTGRES_DB" > app/nextcloud/nextcloud_postgres_db
+echo "$NEXTCLOUD_POSTGRES_USER" > app/nextcloud/nextcloud_postgres_user
+echo "$NEXTCLOUD_POSTGRES_PASSWORD" > app/nextcloud/nextcloud_postgres_password
+echo "$NEXTCLOUD_REDIS_PASSWORD" > app/nextcloud/nextcloud_redis_password

all-apps/nextcloud/34/nextcloud.env

@@ -1,3 +1,4 @@
+DOMAIN="nextcloud.nassella.cc"
 NEXTCLOUD_TRUSTED_DOMAINS=${DOMAIN}
 
 # reverse proxy config

all-apps/nextcloud/34/nextcloud.env.tmpl

@@ -0,0 +1,16 @@
+NEXTCLOUD_TRUSTED_DOMAINS=${DOMAIN}
+
+# reverse proxy config
+OVERWRITEHOST=${DOMAIN}
+OVERWRITECLIURL=https://${DOMAIN}
+OVERWRITEPROTOCOL=https
+TRUSTED_PROXIES=172.16.0.0/24 # trust the local lb
+PHP_MEMORY_LIMIT=1G
+PHP_UPLOAD_LIMIT=10G
+POSTGRES_HOST=nextcloud_db
+POSTGRES_DB_FILE=/run/secrets/nextcloud_postgres_db
+POSTGRES_USER_FILE=/run/secrets/nextcloud_postgres_user
+POSTGRES_PASSWORD_FILE=/run/secrets/nextcloud_postgres_password
+# redis
+REDIS_HOST=nextcloud_redis
+REDIS_HOST_PASSWORD_FILE=/run/secrets/nextcloud_redis_password

all-apps/nextcloud/34/nextcloud_admin_password

@@ -0,0 +1 @@
+foodisgood

all-apps/nextcloud/34/nextcloud_admin_user

@@ -0,0 +1 @@
+admin

all-apps/nextcloud/34/postgres_db

@@ -0,0 +1 @@
+nextcloud

all-apps/nextcloud/34/postgres_password

@@ -0,0 +1 @@
+dbpassword

all-apps/nextcloud/34/postgres_user

@@ -0,0 +1 @@
+nextcloud

all-apps/nextcloud/34/redis_password

@@ -0,0 +1 @@
+redispassword

all-apps/nextcloud/docker-compose.yaml

@@ -1,95 +0,0 @@
-version: '3'
-
-secrets:
-  nextcloud_admin_password:
-    file: ./nextcloud/nextcloud_admin_password
-  nextcloud_admin_user:
-    file: ./nextcloud/nextcloud_admin_user
-  postgres_db:
-    file: ./nextcloud/postgres_db
-  postgres_password:
-    file: ./nextcloud/postgres_password
-  postgres_user:
-    file: ./nextcloud/postgres_user
-  redis_password:
-    file: ./nextcloud/redis_password
-
-services:
-  db:
-    image: postgres
-    env_file:
-      - ./nextcloud/nextcloud.env
-    shm_size: 128mb
-    restart: always
-    volumes:
-      - /nassella/nextcloud/var-lib-postgresql-data:/var/lib/postgresql/data
-    environment:
-      - POSTGRES_DB_FILE=/run/secrets/postgres_db
-      - POSTGRES_USER_FILE=/run/secrets/postgres_user
-      - POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
-    networks:
-      - internal
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d `cat $$POSTGRES_DB_FILE` -U `cat $$POSTGRES_USER_FILE`"]
-      start_period: 15s
-      interval: 30s
-      retries: 3
-      timeout: 5s
-    secrets:
-      - postgres_db
-      - postgres_password
-      - postgres_user
-  redis:
-    image: redis
-    env_file:
-      - ./nextcloud/nextcloud.env
-    command: bash -c 'redis-server --requirepass "$$(cat /run/secrets/redis_password)"'
-    secrets:
-      - redis_password
-    restart: always
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli --no-auth-warning -a \"$$(cat /run/secrets/redis_password)\" ping | grep PONG"]
-      start_period: 10s
-      interval: 30s
-      retries: 3
-      timeout: 3s
-    networks:
-      - internal
-  nextcloud:
-    image: nextcloud
-    environment:
-      - POSTGRES_HOST=db
-      - POSTGRES_DB=nextcloud
-      - POSTGRES_USER=nextcloud
-      - POSTGRES_PASSWORD=dbpassword
-      - NEXTCLOUD_ADMIN_PASSWORD=password
-      - NEXTCLOUD_ADMIN_USER=admin
-      - REDIS_HOST=redis
-      - NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.nassella.cc # TODO generate this?
-    ports:
-      - "8080:80"
-    depends_on:
-      redis:
-        condition: service_healthy
-      db:
-        condition: service_healthy
-    env_file:
-      - ./nextcloud/nextcloud.env
-    secrets:
-      - postgres_db
-      - postgres_password
-      - postgres_user
-      - nextcloud_admin_user
-      - nextcloud_admin_password
-      - redis_password
-    networks:
-      - lb
-      - internal
-    volumes:
-      - /nassella/nextcloud/var-www-html:/var/www/html
-    restart: unless-stopped
-networks:
-  lb:
-  internal:
-    driver: bridge
-    internal: true

all-apps/nextcloud/napp.scm

@@ -0,0 +1,25 @@
+((name . "Nextcloud")
+ (key . nextcloud)
+ (dir . "nextcloud")
+ (current-version . "34")
+ (versions . (("34")))
+ (website . "https://nextcloud.com")
+ (docker-secrets . (("NEXTCLOUD_ADMIN_USER" "nextcloud_admin_user")
+                    ("NEXTCLOUD_ADMIN_PASSWORD" "nextcloud_admin_password")
+                    ("NEXTCLOUD_POSTGRES_DB" "postgres_db")
+                    ("NEXTCLOUD_POSTGRES_USER" "postgres_user")
+                    ("NEXTCLOUD_POSTGRES_PASSWORD" "postgres_password")
+                    ("NEXTCLOUD_REDIS_PASSWORD" "redis_password")))
+ (scripts . (("make-nextcloud-env.sh"
+              ((deps . ("nextcloud.env.tmpl"))
+               (output . "nextcloud.env")))))
+ (apps-config . (("NEXTCLOUD_ADMIN_USER" admin-user)
+                 ("NEXTCLOUD_ADMIN_PASSWORD" admin-password)
+                 ("NEXTCLOUD_POSTGRES_DB" "nextcloud")
+                 ("NEXTCLOUD_POSTGRES_USER" "nextcloud")
+                 ("NEXTCLOUD_POSTGRES_PASSWORD" postgres-password)
+                 ("NEXTCLOUD_REDIS_PASSWORD" redis-password)))
+ (general . ((smtp . #t)))
+ (caddyfile . "  reverse_proxy http://nextcloud:80")
+ (passwd . ((name . "nextcloud")
+            (uid . "1001"))))

all-apps/restic-snapshot.service

@@ -0,0 +1,28 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+[Unit]
+Description=Restic Snapshotter
+After=app.service
+Requires=docker.service app.service
+[Service]
+EnvironmentFile=/restic-env
+TimeoutStartSec=0
+ExecStart=/restic-snapshot.sh
+Restart=always
+RestartSec=5s
+[Install]
+WantedBy=multi-user.target

all-apps/wg-easy/15/Caddyfile

@@ -0,0 +1,19 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$wg_easy_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  reverse_proxy http://wg-easy:80
+}

all-apps/wg-easy/15/docker-compose.yaml

@@ -33,5 +33,3 @@ networks:
       config:
         - subnet: 10.42.42.0/24
         - subnet: fdcc:ad94:bacf:61a3::/64
-# volumes:
-#   etc_wireguard:

all-apps/wg-easy/napp.scm

@@ -0,0 +1,7 @@
+((name . "wg-easy")
+ (key . wg-easy)
+ (dir . "wg-easy")
+ (current-version . "15")
+ (versions . (("15")))
+ (website . "https://wg-easy.github.io/wg-easy/Pre-release/")
+ (caddyfile . "  reverse_proxy http://wg-easy:80"))

all-apps/wordpress/8.4/Caddyfile

@@ -0,0 +1,19 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$wordpress_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  reverse_proxy http://wordpress_caddy:80
+}

all-apps/wordpress/8.4/Caddyfile-internal

@@ -0,0 +1,27 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+:80 {
+    root * /var/www/html
+
+    encode gzip zstd
+
+    php_fastcgi wordpress:9000 {
+        trusted_proxies 172.30.0.0/16
+    }
+
+    file_server
+}

all-apps/wordpress/8.4/Makefile

@@ -0,0 +1,24 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/wordpress/wordpress_db_password \
+app/wordpress/wordpress_db_root_password
+
+app/wordpress/wordpress_db_password: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$WORDPRESS_DB_PASSWORD" > $@'
+app/wordpress/wordpress_db_root_password: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$WORDPRESS_DB_ROOT_PASSWORD" > $@'

all-apps/wordpress/8.4/custom.ini

@@ -0,0 +1,4 @@
+upload_max_filesize = 256M
+post_max_size = 256M
+memory_limit = 256M
+max_execution_time = 300

all-apps/wordpress/8.4/docker-compose.yaml

@@ -0,0 +1,117 @@
+secrets:
+  wordpress_db_password:
+    file: ./wordpress/wordpress_db_password
+  wordpress_db_root_password:
+    file: ./wordpress/wordpress_db_root_password
+
+services:
+
+  wordpress_caddy:
+    image: docker.io/caddy:2.11.4-alpine
+    volumes:
+      - ./wordpress/Caddyfile-internal:/etc/caddy/Caddyfile:ro
+      - /nassella/wordpress/caddy-config:/config
+      - /nassella/wordpress/caddy-data:/data
+      - /nassella/wordpress/var-www-html:/var/www/html:ro
+    networks:
+      - lb
+      - wordpress_instance
+    restart: unless-stopped
+    depends_on:
+      - wordpress
+  wordpress:
+    image: wordpress:php8.4-fpm
+    restart: unless-stopped
+    environment:
+      WORDPRESS_DB_HOST: wordpress_db
+      WORDPRESS_DB_USER: wordpress
+      WORDPRESS_DB_PASSWORD_FILE: /run/secrets/wordpress_db_password
+      WORDPRESS_DB_NAME: wordpress
+    depends_on:
+      wordpress_db:
+        condition: service_healthy
+    volumes:
+      - /nassella/wordpress/var-www-html:/var/www/html
+      - ./wordpress/custom.ini:/usr/local/etc/php/conf.d/custom.ini:ro
+    networks:
+      - wordpress_db
+      - wordpress_instance
+      - wordpress_outbound
+      - lb
+    secrets:
+      - wordpress_db_password
+
+  wordpress_db:
+    image: mysql:9.7
+    restart: always
+    environment:
+      MYSQL_DATABASE: wordpress
+      MYSQL_USER: wordpress
+      MYSQL_PASSWORD_FILE: /run/secrets/wordpress_db_password
+      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/wordpress_db_root_password
+    volumes:
+      - /nassella/wordpress/var-lib-mysql:/var/lib/mysql
+    networks:
+      - wordpress_db
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "MYSQL_PWD=$$(cat /run/secrets/wordpress_mysql_root_password) mysqladmin ping -h 127.0.0.1 -uroot --silent"
+        ]
+      interval: 1s
+      start_period: 30s
+      start_interval: 10s
+      retries: 120
+    secrets:
+      - wordpress_db_password
+      - wordpress_db_root_password
+    command:
+      - --performance-schema=OFF
+      - --innodb-buffer-pool-size=64M
+      - --max-connections=10
+      - --table-open-cache=128
+      - --table-definition-cache=128
+      - --thread-cache-size=2
+      - --innodb-log-buffer-size=8M
+
+  # wordpress_init:
+  #   image: wordpress:cli-php8.4
+  #   restart: "no"
+  #   depends_on:
+  #     - wordpress_db
+  #     - wordpress
+  #   environment:
+  #     WORDPRESS_DB_HOST: db
+  #     WORDPRESS_DB_USER: exampleuser
+  #     WORDPRESS_DB_PASSWORD: examplepass
+  #     WORDPRESS_DB_NAME: exampledb
+
+  #     WP_URL: "https://wp.nassella.org"
+  #     WP_TITLE: "Nassella"
+  #     WP_ADMIN_USER: "admin"
+  #     WP_ADMIN_PASSWORD: "admin"
+  #     WP_ADMIN_EMAIL: "admin@example.org"
+
+  #     OIDC_CLIENT_ID: wordpress
+  #     OIDC_CLIENT_SECRET: "secret"
+  #     OIDC_PROVIDER: "https://auth.nassella.org"
+
+  #   volumes:
+  #     - /nassella/wordpress/var-www-html:/var/www/html
+  #     - ./init:/scripts
+
+  #   entrypoint:
+  #     - /bin/bash
+  #     - /scripts/init.sh
+
+networks:
+  lb:
+  wordpress_instance:
+    driver: bridge
+    internal: true
+  wordpress_outbound:
+    driver: bridge
+  wordpress_db:
+    driver: bridge
+    internal: true

all-apps/wordpress/8.4/init.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+echo "Waiting for db..."
+
+until wp db check --allow-root
+do
+    sleep 5
+done
+
+echo "db ready"
+
+if ! wp core is-installed --allow-root
+then
+    echo "installing wp"
+
+    wp core install \
+       --url="$WP_URL" \
+       --title="$WP_TITLE" \
+       --admin_user="$WP_ADMIN_USER" \
+       --admin_password="$WP_ADMIN_PASSWORD" \
+       --admin_email="$WP_ADMIN_EMAIL" \
+       --skip-email \
+       --allow-root
+fi
+
+echo "installing plugins"
+
+if ! wp plugin is-installed daggerhart-openid-connect-generic
+then
+    wp plugin install daggerhart-openid-connect-generic \
+       --activate \
+       --allow-root
+fi
+
+if ! wp plugin is-active daggerhart-openid-connect-generic
+then
+    wp plugin activate daggerhart-openid-connect-generic
+fi
+
+echo "plugins installed. configuring plugins"
+
+# after installing the plugs we can then use the plugin's CLI
+# to configure the plugin
+wp option update openid_connect_generic_settings 'the settings' # TODO lookup
+# or
+wp option patch update ...

apps.config.tmpl

@@ -1,8 +0,0 @@
-ROOT_DOMAIN=example.com
-APP_CONFIGS="nextcloud,nextcloud wg-easy,wg-easy"
-NEXTCLOUD_ADMIN_USER=admin
-NEXTCLOUD_ADMIN_PASSWORD=
-NEXTCLOUD_POSTGRES_DB=nextcloud
-NEXTCLOUD_POSTGRES_USER=nextcloud
-NEXTCLOUD_POSTGRES_PASSWORD=
-NEXTCLOUD_REDIS_PASSWORD=

cl.yaml

@@ -1,10 +1,26 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 variant: flatcar
 version: 1.1.0
 passwd:
   users:
     - name: core
       ssh_authorized_keys_local:
-        - /ssh-keys
+        - config/ssh-keys
     - name: nextcloud
       uid: 1001
 systemd:
@@ -19,9 +35,63 @@ systemd:
 
         [Install]
         RequiredBy=local-fs.target
+    - name: restic-restore.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Run once on first boot, if needed, to restore a backup
+        After=docker.service
+        Requires=docker.service
+
+        [Service]
+        Type=oneshot
+        EnvironmentFile=/restic-env
+        ExecStart=/restic-restore.sh
+
+        [Install]
+        WantedBy=multi-user.target
     - name: app.service
       enabled: true
       contents_local: app/app.service
+    - name: restic-snapshot.service
+      enabled: true
+      contents_local: app/restic-snapshot.service
+    - name: restic-backup.service
+      contents: |
+        [Unit]
+        Description=Backs up application data
+        Conflicts=app.service
+
+        [Service]
+        Type=oneshot
+        EnvironmentFile=/restic-env
+        ExecStart=/restic-scheduled-snapshot.sh
+        ExecStopPost=systemctl start app.service
+
+    - name: restic-backup.timer
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Run restic-backup.service at 3am PT
+
+        [Timer]
+        OnCalendar=*-*-* 10:00:00
+
+        [Install]
+        WantedBy=multi-user.target
+
+    - name: unpack-app.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Unpack /app
+        Before=app.service
+        [Service]
+        Type=oneshot
+        ExecStart=/unpack-app
+        [Install]
+        WantedBy=multi-user.target
+
     ### docker-compose sysext
     ### https://flatcar.github.io/sysext-bakery/docker_compose/
     - name: systemd-sysupdate.timer
@@ -59,16 +129,55 @@ storage:
     - device: /dev/disk/by-partlabel/appstorage
       format: ext4
       wipe_filesystem: false
-  trees:
-    - path: /app
-      local: app
+  # trees:
+  #   - path: /app
+  #     local: app
   files:
+    - path: /app.tar.gz
+      mode: 0600
+      contents:
+        local: app.tar.gz
+    - path: /restic-password
+      contents:
+        local: restic-password
+    - path: /restic-env
+      overwrite: true
+      contents:
+        local: restic-env
+    - path: /restic-restore.sh
+      mode: 0755
+      contents:
+        local: restic-restore.sh
+    - path: /restic-snapshot.sh
+      mode: 0755
+      contents:
+        local: restic-snapshot.sh
+    - path: /restic-scheduled-snapshot.sh
+      mode: 0755
+      contents:
+        local: restic-scheduled-snapshot.sh
+    - path: /etc/ssh/sshd_config.d/custom.conf
+      overwrite: true
+      mode: 0600
+      contents:
+        inline: |
+          PermitRootLogin no
+          AllowUsers core
+    - path: /unpack-app
+      mode: 0755
+      contents:
+        inline: |
+          #!/bin/sh
+          set -e
+          mkdir /app
+          tar -xzf /app.tar.gz -C /
+          rm /app.tar.gz
     ### docker-compose sysext
     ### https://flatcar.github.io/sysext-bakery/docker_compose/
-    - path: /opt/extensions/docker-compose/docker-compose-2.34.0-x86-64.raw
+    - path: /opt/extensions/docker-compose/docker-compose-5.1.4-x86-64.raw
       mode: 0644
       contents:
-        source: https://extensions.flatcar.org/extensions/docker-compose-2.34.0-x86-64.raw
+        source: https://extensions.flatcar.org/extensions/docker-compose-5.1.4-x86-64.raw
     - path: /etc/sysupdate.docker-compose.d/docker-compose.conf
       contents:
         source: https://extensions.flatcar.org/extensions/docker-compose.conf
@@ -76,6 +185,6 @@ storage:
       contents:
         source: https://extensions.flatcar.org/extensions/noop.conf
   links:
-    - target: /opt/extensions/docker-compose/docker-compose-2.34.0-x86-64.raw
+    - target: /opt/extensions/docker-compose/docker-compose-5.1.4-x86-64.raw
       path: /etc/extensions/docker-compose.raw
       hard: false

config/apps.config.tmpl

@@ -0,0 +1,20 @@
+ROOT_DOMAIN=  # example.com :: the root of the domain that all apps should be subdomains of
+APP_CONFIGS="nextcloud,nextcloud,34 wg-easy,wg-easy,15 ghost,ghost,2" # apps to deploy and their corresponding sub-domain and all-apps version (app,sub-domain,version)
+NEXTCLOUD_ADMIN_USER=admin # admin user for nextcloud, can be whatever you want
+NEXTCLOUD_ADMIN_PASSWORD=  # the password for the nextcloud admin user
+NEXTCLOUD_POSTGRES_DB=nextcloud # recommended to leave as 'nextcloud'. The postgres db nextcloud uses
+NEXTCLOUD_POSTGRES_USER=nextcloud # recommended to leave as 'nextcloud'. The postgres user nextcloud uses
+NEXTCLOUD_POSTGRES_PASSWORD= # should be a secure, randomly generated, postgres compatible password, stored in the config so it isn't lost on re-deployment but otherwise unneeded
+NEXTCLOUD_REDIS_PASSWORD= # should be a secure, randomly generated, redis compatible password, stored in the config so it isn't lost on re-deployment but otherwise unneeded
+GHOST_DATABASE_ROOT_PASSWORD=
+GHOST_DATABASE_PASSWORD=
+SMTP_HOST=
+SMTP_PORT=
+SMTP_AUTH_USER=
+SMTP_AUTH_PASSWORD=
+SMTP_FROM=
+BACKBLAZE_KEY_ID= # the key ID for a application key created on backblaze that has permissions for the bucket in BACKBLAZE_BUCKET_URL
+BACKBLAZE_APPLICATION_KEY= # the application key for the application key created on backblaze
+BACKBLAZE_BUCKET_URL= # the full URL for the backblaze bucket, found on the backblaze UI for the bucket
+RESTIC_PASSWORD= # should be a secure, randomly generated, restic compatible password. Used for making encrypted backups of the application data
+INSTANCE_CONTROL_WEBHOOKS_SECRET= # hmac secret used when calling webhooks

config/production.tfvars.tmpl

@@ -0,0 +1,14 @@
+server_type = "s-2vcpu-2gb" # the digital ocean server type to deploy
+
+do_token = "" # token from "API" settings on DigitalOcean
+
+digitalocean_volume_size = # size in GB of the app storage volume
+
+cloudflare_api_token = "" # corresponding API token should allow modifying DNS settings for the Nassella configured domain
+cloudflare_zone_id = "" # corresponding zone ID for API token for the Nassella configured domain
+cloudflare_account_id = "" # corresponding account ID for API token
+
+cluster_name           = "mycluster" # currently only used as the name of the machine on DigitalOcean
+datacenter             = "sfo3" # datacenter to deploy the droplet to
+ssh_keys               = [""] # unused
+flatcar_stable_version = "4459.2.1" # (source <(curl -sSfL https://stable.release.flatcar-linux.net/amd64-usr/current/version.txt); echo "${FLATCAR_VERSION_ID}")

copy-apps.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+# this script copys over the docker configs
+# for in-use apps
+
+# it depends on apps.config which should define:
+# ROOT_DOMAIN - the root domain for all apps
+# APP_CONFIGS - app-subdomain-version pairs, configured via a comma, like:
+#   app1,subdomain1,version app2,subdomain2,version app3,subdomain3,version
+# full example:
+#   ROOT_DOMAIN=nassella.cc
+#   APP_CONFIGS="app1,subdomain1,1 app2,subdomain2,1 app3,subdomain3,1"
+
+set -e
+
+. $1 # source the apps.config file with the env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+# APP_CONFIGS+=('lb,root,1') # TODO is this used anymore?
+
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    version=${config[2]}
+    cp -a all-apps/$app/$version app/$app
+done

flatcar/app/Makefile

@@ -1,2 +0,0 @@
-run:
-	sudo docker-compose -f docker-compose.yaml $(find . -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) up

flatcar/app/app.service

@@ -1,13 +0,0 @@
-[Unit]
-Description=Main App
-After=docker.service
-Requires=docker.service
-[Service]
-TimeoutStartSec=0
-ExecStart=/bin/bash -c '/usr/bin/docker compose -f /app/docker-compose.yaml $(find /app -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) up'
-ExecStop=/bin/bash -c '/usr/bin/docker compose -f /app/docker-compose.yaml $(find /app -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) stop'
-
-Restart=always
-RestartSec=5s
-[Install]
-WantedBy=multi-user.target

flatcar/app/docker-compose.yaml

@@ -1,25 +0,0 @@
-version: '3'
-services:
-  lb:
-    image: docker.io/caddy:2
-    volumes:
-#      - /app/lb:/etc/caddy
-      - ./lb/:/etc/caddy
-      - config:/config
-      - data:/data
-    networks:
-      - lb
-    restart: unless-stopped
-    ports:
-      - "443:443"
-      - "80:80"
-  nginx:
-    image: nginx
-    restart: unless-stopped
-    networks:
-      - lb
-networks:
-  lb:
-volumes:
-  config:
-  data:

flatcar/app/lb/Caddyfile

@@ -1,17 +0,0 @@
-wg-easy1.nassella.cc {
-  reverse_proxy http://wg-easy:80
-
-  # tls internal
-  # x
-  # log
-}
-
-nextcloud1.nassella.cc {
-  reverse_proxy http://nextcloud:80
-  # tls internal
-}
-
-root.nassella.cc {
-  reverse_proxy http://nginx:80
-  # tls internal
-}

flatcar/app/nextcloud/docker-compose.yaml

@@ -1,50 +0,0 @@
-version: '3'
-
-services:
-  db:
-    image: postgres
-    shm_size: 128mb
-    restart: always
-    volumes:
-      - db:/var/lib/postgresql/data
-    environment:
-      - POSTGRES_DB=nextcloud
-      - POSTGRES_USER=nextcloud
-      - POSTGRES_PASSWORD=password
-    networks:
-      - internal
-  redis:
-    image: redis:alpine
-    restart: always
-    networks:
-      - internal
-  nextcloud:
-    image: nextcloud
-    environment:
-      - POSTGRES_HOST=db
-      - POSTGRES_DB=nextcloud
-      - POSTGRES_USER=nextcloud
-      - POSTGRES_PASSWORD=password
-      - NEXTCLOUD_ADMIN_PASSWORD=password
-      - NEXTCLOUD_ADMIN_USER=admin
-      - REDIS_HOST=redis
-      - NEXTCLOUD_TRUSTED_DOMAINS=nextcloud1.nassella.cc
-    ports:
-      - "8080:80"
-    depends_on:
-      - redis
-      - db
-    networks:
-      - lb
-      - internal
-    volumes:
-      - nextcloud:/var/www
-    restart: unless-stopped
-networks:
-  lb:
-  internal:
-    driver: bridge
-    internal: true
-volumes:
-  db:
-  nextcloud:

flatcar/app/wg-easy/docker-compose.yaml

@@ -1,37 +0,0 @@
-version: '3'
-services:
-  wg-easy:
-    image: ghcr.io/wg-easy/wg-easy:15
-    environment:
-      - PORT=80
-    ports:
-      - "51820:51820/udp"
-    networks:
-      lb:
-      wg:
-        ipv4_address: 10.42.42.42
-#        ipv6_address: fdcc:ad94:bacf:61a3::2a
-    volumes:
-      - etc_wireguard:/etc/wireguard
-      - /lib/modules:/lib/modules:ro
-    restart: unless-stopped
-    cap_add:
-      - NET_ADMIN
-      - SYS_MODULE
-    sysctls:
-      - net.ipv4.ip_forward=1
-      - net.ipv4.conf.all.src_valid_mark=1
-      - net.ipv6.conf.all.disable_ipv6=0
-      - net.ipv6.conf.all.forwarding=1
-      - net.ipv6.conf.default.forwarding=1
-networks:
-  lb:
-  wg:
-    driver: bridge
-    ipam:
-      driver: default
-      config:
-        - subnet: 10.42.42.0/24
-        - subnet: fdcc:ad94:bacf:61a3::/64
-volumes:
-  etc_wireguard:

init-restic.sh

@@ -0,0 +1,75 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+. $1 # source the apps.config file with the env vars
+
+# if we are on a dev machine try to use docker
+# otherwise assume we are in prod and restic is installed
+# (since we can't/don't run docker-in-docker)
+docker run --rm hello-world
+if [ $? -ne 0 ]; then
+    # from the restic docs, this allows us to check if the
+    # repo is initialized. If it is not, this will have the
+    # exit code of 10
+    AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic cat config --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password
+
+    status=$?
+    init_status=0
+
+    if [ $status -eq 10 ]; then
+        # restic repo is not initialized so initialize it
+        AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic init --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password
+        init_status=$?
+    elif [ $status -ne 0  ]; then
+        # something unexpected happened, exit
+        exit $status
+    fi
+
+    if [ $init_status -ne 0 ]; then
+        # something unexpected happened, exit
+        exit $init_status
+    fi
+else
+    mkdir -p "emptydir-$ROOT_DOMAIN"
+
+    # from the restic docs, this allows us to check if the
+    # repo is initialized. If it is not, this will have the
+    # exit code of 10
+    docker run --rm --volume "$PWD/emptydir-$ROOT_DOMAIN:/nassella" --volume $PWD/restic-password:/restic-password -e AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" -i restic/restic:0.18.0 cat config --repo s3:$BACKBLAZE_BUCKET_URL --password-file /restic-password
+
+    status=$?
+    init_status=0
+
+    if [ $status -eq 10 ]; then
+        # restic repo is not initialized so initialize it
+        docker run --rm --volume "$PWD/emptydir-$ROOT_DOMAIN:/nassella" --volume $PWD/restic-password:/restic-password -e AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" -i restic/restic:0.18.0 init --repo s3:$BACKBLAZE_BUCKET_URL --password-file /restic-password
+        init_status=$?
+    elif [ $status -ne 0  ]; then
+        # something unexpected happened, exit
+        rm -Rf "emptydir-$ROOT_DOMAIN"
+        exit $status
+    fi
+
+    if [ $init_status -ne 0 ]; then
+        # something unexpected happened, exit
+        rm -Rf "emptydir-$ROOT_DOMAIN"
+        exit $init_status
+    fi
+
+    rm -Rf "emptydir-$ROOT_DOMAIN"
+fi

main.tf

@@ -2,23 +2,19 @@ terraform {
   required_providers {
     digitalocean = {
       source  = "digitalocean/digitalocean"
-      version = "2.62.0"
+      version = "2.96.0"
     }
     ct = {
       source  = "poseidon/ct"
-      version = "0.13.0"
+      version = "0.14.0"
     }
     null = {
       source  = "hashicorp/null"
-      version = "3.2.4"
-    }
-    time = {
-      source  = "hashicorp/time"
-      version = "0.13.1"
+      version = "3.3.0"
     }
     cloudflare = {
       source = "cloudflare/cloudflare"
-      version = "5.8.2"
+      version = "5.22.0"
     }
   }
 }
@@ -79,8 +75,17 @@ variable "subdomains" {
   description = "Subdomains to setup"
 }
 
+variable "digitalocean_volume_size" {
+  type = number
+  description = "Size in GB of the app storage digitalocean volume"
+}
+
 provider "digitalocean" {
   token = var.do_token
+
+  http_retry_max      = 10
+  http_retry_wait_min = 2
+  http_retry_wait_max = 60
 }
 
 provider "cloudflare" {
@@ -104,7 +109,7 @@ resource "digitalocean_reserved_ip" "machine" {
 
 resource "cloudflare_dns_record" "root" {
   zone_id = var.cloudflare_zone_id
-  name    = "@"
+  name    = "nassella-instance"
   content   = digitalocean_reserved_ip.machine.ip_address
   type    = "A"
   proxied = false
@@ -115,7 +120,7 @@ resource "cloudflare_dns_record" "subdomains" {
   for_each  = toset(var.subdomains)
   zone_id = var.cloudflare_zone_id
   name    = each.key
-  content   = var.domain
+  content   = "nassella-instance.${var.domain}"
   type    = "CNAME"
   proxied = false
   ttl = 300
@@ -124,7 +129,7 @@ resource "cloudflare_dns_record" "subdomains" {
 resource "digitalocean_volume" "machine" {
   region    = var.datacenter
   name      = "${var.cluster_name}"
-  size                    = 60
+  size                    = var.digitalocean_volume_size
   initial_filesystem_type = "ext4"
   initial_filesystem_label = "appstorage"
   description             = "persistent storage for docker apps"
@@ -137,21 +142,11 @@ resource "digitalocean_droplet" "machine" {
   size      = var.server_type
   ssh_keys  = [digitalocean_ssh_key.first.fingerprint]
   user_data = file("ignition.json")
-  lifecycle {
-    create_before_destroy = true
-  }
 }
-
-resource "time_sleep" "wait_10_seconds" {
-  create_duration = "10s"
-}
-
 resource "digitalocean_reserved_ip_assignment" "machine" {
+  depends_on = [digitalocean_volume_attachment.machine]
   ip_address = digitalocean_reserved_ip.machine.ip_address
   droplet_id = digitalocean_droplet.machine.id
-  # sometimes digital ocean throws an error for this resource
-  # saying the droplet has a pending event so we delay a few seconds
-  depends_on = [time_sleep.wait_10_seconds]
 }
 
 resource "digitalocean_volume_attachment" "machine" {

make-caddyfile-env.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+# this script generates the load-balancer
+# config for the Caddy server.
+
+# it depends on apps.config which should define:
+# ROOT_DOMAIN - the root domain for all apps
+# APP_CONFIGS - app-subdomain pairs, configured via a comma, like:
+#   app1,subdomain1 app2,subdomain2 app3,subdomain3
+# full example:
+#   ROOT_DOMAIN=nassella.cc
+#   APP_CONFIGS="app1,subdomain1 app2,subdomain2 app3,subdomain3"
+
+set -e
+
+. $1 # source the apps.config file with then env vars
+
+# host_admin_password_encoded=`echo "$HOST_ADMIN_PASSWORD" | docker run --rm -i caddy:2 caddy hash-password`
+host_admin_password_encoded="password" # unused
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+APP_CONFIGS+=('lb,root')
+
+echo "ROOT_DOMAIN=\"${ROOT_DOMAIN}\""
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    echo "${app//-/_}_SUBDOMAIN=\"${subdomain}\""
+done

make-caddyfile.sh

@@ -1,42 +0,0 @@
-#!/bin/bash
-
-# this script generates the load-balancer
-# config for the Caddy server.
-
-# it depends on apps.config which should define:
-# ROOT_DOMAIN - the root domain for all apps
-# APP_CONFIGS - app-subdomain pairs, configured via a comma, like:
-#   app1,subdomain1 app2,subdomain2 app3,subdomain3
-# full example:
-#   ROOT_DOMAIN=nassella.cc
-#   APP_CONFIGS="app1,subdomain1 app2,subdomain2 app3,subdomain3"
-
-set -e
-
-. apps.config
-
-read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
-APP_CONFIGS+=('lb,root')
-
-
-declare -A bodys
-bodys["nextcloud"]="  reverse_proxy http://nextcloud:80"
-bodys["wg-easy"]="  reverse_proxy http://wg-easy:80"
-bodys["lb"]="  reverse_proxy http://nginx:80"
-
-for config_string in ${APP_CONFIGS[@]}; do
-    IFS=','
-    read -r -a config <<< "$config_string"
-
-    app=${config[0]}
-    subdomain=${config[1]}
-    body=${bodys[$app]}
-    fulldomain="$subdomain.$ROOT_DOMAIN"
-
-    echo "$fulldomain {"
-    echo $body
-    echo "}"
-done
-
-
-

make-generated.sh

@@ -1,5 +1,21 @@
 #!/bin/bash
 
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 # this script generates the shared values for the
 # terraform config (domain & subdomain variables)
 
@@ -13,7 +29,7 @@
 
 set -e
 
-. apps.config
+. $1 # source the apps.config file with then env vars
 
 read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
 APP_CONFIGS+=('lb,root')
@@ -27,12 +43,19 @@ for config_string in ${APP_CONFIGS[@]}; do
     IFS=','
     read -r -a config <<< "$config_string"
 
+    app=${config[0]}
     subdomain=${config[1]}
 
     echo -n "$separator"
     echo -n "\"$subdomain\""
 
     separator=', '
+
+    # see note about lldap in make-caddyfile.sh
+    if [ "$app" = "nassella" ]; then
+       echo -n "$separator"
+       echo -n "\"lldap.$subdomain\""
+    fi
 done
 
 echo "]"

make-nextcloud-env.sh

@@ -1,24 +0,0 @@
-#!/bin/bash
-
-set -e
-
-. apps.config
-
-read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
-
-nextcloud_subdomain=
-
-for config_string in ${APP_CONFIGS[@]}; do
-    IFS=','
-    read -r -a config <<< "$config_string"
-
-    app=${config[0]}
-    subdomain=${config[1]}
-
-    if [ "$app" = "nextcloud" ]; then
-       nextcloud_subdomain="$subdomain"
-    fi
-done
-
-echo "DOMAIN=\"$nextcloud_subdomain.$ROOT_DOMAIN\"" > all-apps/nextcloud/nextcloud.env
-cat all-apps/nextcloud/nextcloud.env.tmpl >> all-apps/nextcloud/nextcloud.env

make-restic-generated.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+. $1 # source the apps.config file with then env vars
+
+echo "AWS_ACCESS_KEY_ID=\"$BACKBLAZE_KEY_ID\""
+echo "AWS_SECRET_ACCESS_KEY=\"$BACKBLAZE_APPLICATION_KEY\""
+echo "BACKBLAZE_BUCKET_URL=\"$BACKBLAZE_BUCKET_URL\""
+
+if [ -n "$RESTIC_SNAPSHOT_ID" ]; then
+    echo "RESTIC_SNAPSHOT_ID=\"$RESTIC_SNAPSHOT_ID\""
+fi

make-restic-password.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+. $1 # source the apps.config file with then env vars
+
+echo "$RESTIC_PASSWORD"

make-top-level-docker-compose.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+cat <<'EOF'
+services:
+  lb:
+    image: docker.io/caddy:2.11.4-alpine
+    env_file:
+      - ./lb/lb.env
+    volumes:
+      - ./lb/:/etc/caddy
+      - /nassella/lb/config:/config
+      - /nassella/lb/data:/data
+      - /app/maintenance:/maintenance
+    networks:
+      lb:
+        aliases:
+EOF
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    subdomain=${config[1]}
+
+    echo "          - $subdomain.$ROOT_DOMAIN"
+done
+
+cat <<'EOF'
+    restart: unless-stopped
+    ports:
+      - "443:443"
+      - "80:80"
+networks:
+  lb:
+    ipam:
+      config:
+        - subnet: 172.30.0.0/16
+EOF

restic-restore.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+MARKER=/var/lib/firstboot.done
+
+if [ ! -f "$MARKER" ] && [ -n "$RESTIC_SNAPSHOT_ID" ]; then
+    docker run --rm --volume /nassella:/nassella --volume /restic-password:/restic-password -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} -i restic/restic:0.18.0 restore "$RESTIC_SNAPSHOT_ID" --verbose --repo s3:${BACKBLAZE_BUCKET_URL} --password-file /restic-password --target /
+fi
+
+touch "$MARKER"

restic-scheduled-snapshot.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+docker run --rm --volume /nassella:/nassella --volume /restic-password:/restic-password -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} -i restic/restic:0.18.0 backup --verbose --repo s3:${BACKBLAZE_BUCKET_URL} --password-file /restic-password --tag daily_automatic /nassella
+
+# only keep one snapshot per day for the last week and one snapshot per month for the last 3 months
+docker run --rm --volume /nassella:/nassella --volume /restic-password:/restic-password -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} -i restic/restic:0.18.0 forget --tag daily_automatic --keep-daily 7 --keep-monthly 3 --verbose --repo s3:${BACKBLAZE_BUCKET_URL} --password-file /restic-password /nassella