wip

Allow force destroying an instance.
Fixing dashboard error when instance in progress.
2026-08-23 12:06:15 -07:00 · 2026-07-27 16:21:01 -07:00 · 2026-07-27 16:20:46 -07:00 · 2026-07-27 16:20:28 -07:00 · 2026-07-27 16:19:19 -07:00 · 2026-07-27 16:18:34 -07:00
118 changed files with 5017 additions and 1702 deletions
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
@@ -1,96 +1,70 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 TERRAFORM_ENV := production

 config_dir := ./config/
 apps_config := $(config_dir)apps.config

+BUTANE := butane -d ${PWD}
+
+ifeq ($(shell command -v docker >/dev/null 2>&1 && echo yes),yes)
+	BUTANE := docker run --rm --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd
+endif
+
+IMAGE_DEPS :=
+
+COMPOSE_ENVS := $(shell if [ -d app/ ]; then find app/ -type f -name '.compose-env'; fi)
+
+ALL_APPS_FILES = $(shell find all-apps/ -type f -name '*')
+
+APP_MAKEFILES := $(shell if [ -d app/ ]; then find app/ -type f -name 'Makefile'; fi)
+-include $(APP_MAKEFILES)
+
 # .dirstamp plus && $@ is like make magic to get this rule
 # to only run if the contents of all-apps changes
-app/.dirstamp: all-apps/app.service all-apps/docker-compose.yaml all-apps/.env \
-all-apps/restic-snapshot.service \
-all-apps/instance-control/webhook_secret \
-all-apps/instance-control/hooks/hooks.json \
-all-apps/lb/Caddyfile \
-$(wildcard all-apps/lb/*) \
-$(wildcard all-apps/instance-control/*) \
-$(wildcard all-apps/nextcloud/*) \
-$(wildcard all-apps/wg-easy/*) \
-$(wildcard all-apps/ghost/*) \
-$(wildcard all-apps/nassella/*) \
-all-apps/nassella/authelia-config/configuration.yml \
-all-apps/nassella/lldap-config/lldap_config.toml \
-$(wildcard all-apps/dozzle/*)
-
+app/.dirstamp: copy-apps.sh $(apps_config) $(ALL_APPS_FILES)
 	rm -Rf app/
 	mkdir app/
 	cp all-apps/app.service app/
 	cp all-apps/restic-snapshot.service app/
-	cp all-apps/docker-compose.yaml app/
-	cp all-apps/.env app/
+	./make-top-level-docker-compose.sh $(apps_config) > app/docker-compose.yaml
 	./copy-apps.sh $(apps_config) && touch $@

-# compose .env files
-# (compose only supports one .env file at the root by default)
-all-apps/.env: all-apps/ghost/.compose-env
-	find all-apps/ -name ".compose-env" -exec cat > all-apps/.env {} +
+# # compose .env files
+# # (compose only supports one .env file at the root by default)
+app/.env: $(apps_config) $(COMPOSE_ENVS)
+	find app/ -name ".compose-env" -exec cat > app/.env {} +

 # Caddy / lb
-all-apps/lb/Caddyfile: $(apps_config) make-caddyfile.sh
-	mkdir -p all-apps/lb
-	./make-caddyfile.sh $(apps_config) > all-apps/lb/Caddyfile
+app/lb/lb.env: $(apps_config) app/.dirstamp make-caddyfile-env.sh
+	mkdir -p app/lb
+	./make-caddyfile-env.sh $(apps_config) > $@

-# Instance Control
-all-apps/instance-control/webhook_secret: $(apps_config)
-	bash -c 'source $(apps_config); printf "%s\n" "$$INSTANCE_CONTROL_WEBHOOKS_SECRET" > $@'
-all-apps/instance-control/hooks/hooks.json: $(apps_config) make-instance-control-config.sh
-	./make-instance-control-config.sh $(apps_config)
-
-# Nextcloud
-all-apps/nextcloud/nextcloud_admin_user: $(apps_config)
-	bash -c 'source $(apps_config); printf "%s\n" "$$NEXTCLOUD_ADMIN_USER" > $@'
-all-apps/nextcloud/nextcloud_admin_password: $(apps_config)
-	bash -c 'source $(apps_config); printf "%s\n" "$$NEXTCLOUD_ADMIN_PASSWORD" > $@'
-all-apps/nextcloud/postgres_db: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_POSTGRES_DB" > $@'
-all-apps/nextcloud/postgres_user: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_POSTGRES_USER" > $@'
-all-apps/nextcloud/postgres_password: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_POSTGRES_PASSWORD" > $@'
-all-apps/nextcloud/redis_password: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_REDIS_PASSWORD" > $@'
-all-apps/nextcloud/nextcloud.env: $(apps_config) all-apps/nextcloud/nextcloud.env.tmpl make-nextcloud-env.sh
-	./make-nextcloud-env.sh $(apps_config)
-
-# Nassella
-all-apps/nassella/postgres_db: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_POSTGRES_DB" > $@'
-all-apps/nassella/postgres_user: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_POSTGRES_USER" > $@'
-all-apps/nassella/postgres_password: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_POSTGRES_PASSWORD" > $@'
-all-apps/nassella/authelia_postgres_db: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_AUTHELIA_POSTGRES_DB" > $@'
-all-apps/nassella/authelia_postgres_user: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_AUTHELIA_POSTGRES_USER" > $@'
-all-apps/nassella/authelia_postgres_password: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_AUTHELIA_POSTGRES_PASSWORD" > $@'
-all-apps/nassella/lldap_postgres_db: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_POSTGRES_DB" > $@'
-all-apps/nassella/lldap_postgres_user: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_POSTGRES_USER" > $@'
-all-apps/nassella/lldap_postgres_password: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_POSTGRES_PASSWORD" > $@'
-all-apps/nassella/lldap_admin_password: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_ADMIN_PASSWORD" > $@'
-all-apps/nassella/stripe_api_key: $(apps_config)
-	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_STRIPE_API_KEY" > $@'
-all-apps/nassella/authelia-config/configuration.yml: $(apps_config) all-apps/nassella/authelia-config/configuration.yml.tmpl make-nassella-authelia-config.sh
-	./make-nassella-authelia-config.sh $(apps_config)
-all-apps/nassella/lldap-config/lldap_config.toml: $(apps_config) all-apps/nassella/lldap-config/lldap_config.toml.tmpl make-nassella-lldap-config.sh
-	./make-nassella-lldap-config.sh $(apps_config)
-
-# Ghost
-all-apps/ghost/.compose-env: $(apps_config) all-apps/ghost/.compose.env.tmpl make-ghost-env.sh
-	./make-ghost-env.sh $(apps_config)
+app/lb/Caddyfile: $(apps_config) app/.dirstamp
+	echo "(maintenance_intercept) {" > app/lb/Caddyfile-tmp
+	echo "@maintenanceModeActive file /maintenance/maintenance.on {" >> app/lb/Caddyfile-tmp
+	echo "  root /" >> app/lb/Caddyfile-tmp
+	echo "}" >> app/lb/Caddyfile-tmp
+	echo "handle @maintenanceModeActive {" >> app/lb/Caddyfile-tmp
+	echo "  respond \"We are performing a maintenance, come back later\" 503" >> app/lb/Caddyfile-tmp
+	echo "}" >> app/lb/Caddyfile-tmp
+	echo "}" >> app/lb/Caddyfile-tmp
+	find app/ -name "Caddyfile" -exec cat >> app/lb/Caddyfile-tmp {} +
+	mv app/lb/Caddyfile-tmp $@

 # Backups / Restic / Backblaze
 restic-env: $(apps_config) make-restic-generated.sh
@@ -98,37 +72,25 @@ restic-env: $(apps_config) make-restic-generated.sh
 restic-password: $(apps_config) make-restic-password.sh
 	./make-restic-password.sh $(apps_config) > restic-password

+app.tar.gz: app/.dirstamp \
+app/.env \
+app/lb/lb.env \
+app/lb/Caddyfile
+	tar cfz app.tar.gz app/
+
 ignition.json: cl.yaml app/.dirstamp \
-all-apps/lb/Caddyfile \
-all-apps/instance-control/webhook_secret \
-all-apps/instance-control/hooks/hooks.json \
-all-apps/nextcloud/nextcloud_admin_user \
-all-apps/nextcloud/nextcloud_admin_password \
-all-apps/nextcloud/postgres_db \
-all-apps/nextcloud/postgres_user \
-all-apps/nextcloud/postgres_password \
-all-apps/nextcloud/redis_password \
-all-apps/nextcloud/nextcloud.env \
-all-apps/nassella/postgres_db \
-all-apps/nassella/postgres_user \
-all-apps/nassella/postgres_password \
-all-apps/nassella/lldap_postgres_db \
-all-apps/nassella/lldap_postgres_user \
-all-apps/nassella/lldap_postgres_password \
-all-apps/nassella/authelia_postgres_db \
-all-apps/nassella/authelia_postgres_user \
-all-apps/nassella/authelia_postgres_password \
-all-apps/nassella/nassella.env \
-all-apps/nassella/authelia-config/configuration.yml \
-all-apps/nassella/lldap-config/lldap_config.toml \
-all-apps/ghost/.compose-env \
+$(IMAGE_DEPS) \
+app/lb/lb.env \
+app/lb/Caddyfile \
 restic-env \
 restic-password \
 restic-restore.sh \
 restic-snapshot.sh \
-all-apps/.env \
-$(config_dir)ssh-keys
-	cat cl.yaml | docker run --rm --volume $(config_dir)/ssh-keys:/pwd/ssh-keys --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json
+restic-scheduled-snapshot.sh \
+app/.env \
+$(config_dir)ssh-keys \
+app.tar.gz
+	cat cl.yaml | $(BUTANE) > ignition.json

 generated.tfvars: $(apps_config) make-generated.sh
 	./make-generated.sh $(apps_config) > generated.tfvars
@@ -141,13 +103,19 @@ plan: ignition.json $(config_dir)$(TERRAFORM_ENV).tfvars generated.tfvars
 announce-start:
 	echo "NASSELLA_CONFIG: start"

+# run this first to generate the all/ dir
+# then we can 'include' all the Makefiles in all/
+.PHONY: preapply
+preapply: app/.dirstamp
+	echo "app generated"
+
 apply: announce-start restic-init ignition.json $(config_dir)$(TERRAFORM_ENV).tfvars generated.tfvars
 	echo "NASSELLA_CONFIG: end"
-	terraform init
+	terraform init --upgrade
 	bash -c "terraform apply -auto-approve -input=false -var-file=<(cat $(config_dir)$(TERRAFORM_ENV).tfvars generated.tfvars)"

 destroy: ignition.json $(config_dir)$(TERRAFORM_ENV).tfvars generated.tfvars
-	terraform init
+	terraform init --upgrade
 	bash -c "terraform destroy -auto-approve -input=false -var-file=<(cat $(config_dir)$(TERRAFORM_ENV).tfvars generated.tfvars)"

 .PHONY: restic-init
@@ -161,10 +129,13 @@ restic-snapshots: $(apps_config) restic-password

 .PHONY: archive
 archive:
-	tar -cf nassella-latest.tar all-apps cl.yaml init-restic.sh main.tf make-caddyfile.sh Makefile \
-		make-generated.sh make-nextcloud-env.sh make-ghost-env.sh make-restic-generated.sh make-restic-password.sh restic-snapshots.sh copy-apps.sh restic-restore.sh restic-snapshot.sh \
-		make-nassella-authelia-config.sh make-nassella-lldap-config.sh .terraform.lock.hcl \
-		make-instance-control-config.sh
+	echo "(" > all-apps/root-napp.scm
+	find all-apps/ -name "napp.scm" -exec cat >> all-apps/root-napp.scm {} +
+	echo ")" >> all-apps/root-napp.scm
+	tar -cf nassella-latest.tar all-apps cl.yaml init-restic.sh main.tf make-caddyfile-env.sh make-top-level-docker-compose.sh Makefile \
+		make-generated.sh make-restic-generated.sh make-restic-password.sh restic-snapshots.sh copy-apps.sh restic-restore.sh restic-snapshot.sh \
+		restic-scheduled-snapshot.sh \
+		.terraform.lock.hcl
 	cp nassella-latest.tar src/

 ## to help me remember the command to run to test the config locally
@@ -1,2 +1,18 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 run:
 	sudo docker-compose -f docker-compose.yaml $(find . -mindepth 2 -maxdepth 2 -type f -name docker-compose.yaml -exec echo -f {} \;) up
@@ -1,3 +1,19 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 [Unit]
 Description=Main App
 After=restic-restore.service
@@ -0,0 +1,30 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+#{$authelia_SUBDOMAIN}.{$ROOT_DOMAIN} {
+#  route {
+#    @authelia path /authelia /authelia/*
+#    handle @authelia {
+#      reverse_proxy authelia:9091
+#    }
+#    forward_auth authelia:9091 {
+#      uri /api/authz/forward-auth
+#      copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+#    }
+#    reverse_proxy authelia:9091
+#  }
+#}
+
@@ -0,0 +1,35 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/authelia/postgres_db \
+app/authelia/postgres_user \
+app/authelia/postgres_password \
+app/authelia/authelia-config/configuration.yml \
+app/authelia/authelia-config/users.yml
+
+app/authelia/postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$AUTHELIA_POSTGRES_DB" > $@'
+app/authelia/postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$AUTHELIA_POSTGRES_USER" > $@'
+app/authelia/postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$AUTHELIA_POSTGRES_PASSWORD" > $@'
+app/authelia/authelia-config/configuration.yml: $(apps_config) app/authelia/authelia-config/configuration.yml.tmpl \
+app/authelia/make-authelia-config.sh
+	./app/authelia/make-authelia-config.sh $(apps_config)
+app/authelia/authelia-config/users.yml: $(apps_config) app/authelia/authelia-config/users.yml.tmpl \
+app/authelia/make-authelia-users-config.sh
+	./app/authelia/make-authelia-users-config.sh $(apps_config)
@@ -0,0 +1,121 @@
+---
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+###############################################################
+#                   Authelia configuration                    #
+###############################################################
+
+server:
+  address: 'tcp://:9091/authelia'
+  endpoints:
+    authz:
+      forward-auth:
+        implementation: 'ForwardAuth'
+
+log:
+  level: 'debug'
+
+totp:
+  issuer: 'authelia.com'
+
+identity_validation:
+  reset_password:
+    jwt_secret: '$AUTHELIA_JWT_SECRET'
+
+authentication_backend:
+  disable_reset_password: true
+  file:
+    path: '/config/users.yml'
+    watch: false
+    search:
+      email: false
+      case_insensitive: false
+    extra_attributes:
+      extra_example:
+        multi_valued: false
+        value_type: 'string'
+    password:
+      algorithm: 'argon2'
+      argon2:
+        variant: 'argon2id'
+        iterations: 3
+        memory: 65536
+        parallelism: 4
+        key_length: 32
+        salt_length: 16
+      scrypt:
+        variant: 'scrypt'
+        iterations: 16
+        block_size: 8
+        parallelism: 1
+        key_length: 32
+        salt_length: 16
+      pbkdf2:
+        variant: 'sha512'
+        iterations: 310000
+        salt_length: 16
+      sha2crypt:
+        variant: 'sha512'
+        iterations: 50000
+        salt_length: 16
+      bcrypt:
+        variant: 'standard'
+        cost: 12
+
+access_control:
+  default_policy: 'deny'
+  rules:
+    # - domain: 'public.x.localhost'
+    #   policy: 'bypass'
+    # - domain: 'app.nassella.org'
+    #   policy: 'one_factor'
+    - domain: '$DOZZLE_FULL_DOMAIN'
+      policy: 'two_factor'
+
+session:
+  secret: '$AUTHELIA_SESSION_SECRET'
+
+  cookies:
+    - name: 'dozzle_session'
+      domain: '$DOZZLE_FULL_DOMAIN'  # Should match whatever your root protected domain is
+      authelia_url: 'https://$DOZZLE_FULL_DOMAIN/authelia'
+      expiration: '1 hour'  # 1 hour
+      inactivity: '5 minutes'  # 5 minutes
+      default_redirection_url: 'https://$DOZZLE_FULL_DOMAIN/'
+
+regulation:
+  max_retries: 3
+  find_time: '2 minutes'
+  ban_time: '5 minutes'
+
+storage:
+  encryption_key: '$AUTHELIA_ENCRYPTION_KEY'
+  postgres:
+    address: 'tcp://authelia_db:5432'
+    servers: []
+    database: '$AUTHELIA_POSTGRES_DB'
+    schema: 'public'
+    username: '$AUTHELIA_POSTGRES_USER'
+    password: '$AUTHELIA_POSTGRES_PASSWORD'
+    timeout: '5s'
+
+notifier:
+  smtp:
+    address: 'submission://$SMTP_HOST:$SMTP_PORT'
+    username: '$SMTP_AUTH_USER'
+    password: '$SMTP_AUTH_PASSWORD'
+    sender: '$SMTP_FROM'
+...
@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://www.authelia.com/schemas/latest/json-schema/user-database.json
+users:
+  admin:
+    disabled: false
+    displayname: 'Admin'
+    password: '$HOST_ADMIN_PASSWORD'
+    email: '$HOST_ADMIN_USER'
@@ -0,0 +1,69 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+secrets:
+  authelia_postgres_db:
+    file: ./authelia/postgres_db
+  authelia_postgres_password:
+    file: ./authelia/postgres_password
+  authelia_postgres_user:
+    file: ./authelia/postgres_user
+
+services:
+  authelia_db:
+    image: postgres:18-trixie
+    environment:
+      - POSTGRES_DB_FILE=/run/secrets/authelia_postgres_db
+      - POSTGRES_USER_FILE=/run/secrets/authelia_postgres_user
+      - POSTGRES_PASSWORD_FILE=/run/secrets/authelia_postgres_password
+    shm_size: 128mb
+    restart: always
+    volumes:
+      - /nassella/authelia/var-lib-postgresql:/var/lib/postgresql
+    networks:
+      - authelia_internal_db
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d `cat $$POSTGRES_DB_FILE` -U `cat $$POSTGRES_USER_FILE`"]
+      start_period: 15s
+      interval: 30s
+      retries: 3
+      timeout: 5s
+    secrets:
+      - authelia_postgres_db
+      - authelia_postgres_password
+      - authelia_postgres_user
+
+  authelia:
+    image: 'authelia/authelia'
+    volumes:
+      - ./authelia/authelia-config/configuration.yml:/config/configuration.yml:ro
+      - ./authelia/authelia-config/users.yml:/config/users.yml:ro
+    networks:
+      - lb
+      - authelia_internal_db
+    depends_on:
+      authelia_db:
+        condition: service_healthy
+    restart: 'unless-stopped'
+    healthcheck:
+      ## In production the healthcheck section should be commented.
+      disable: true
+
+networks:
+  lb:
+  authelia_internal_db:
+    driver: bridge
+    internal: true
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+authelia_subdomain=
+dozzle_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "authelia" ]; then
+       authelia_subdomain="$subdomain"
+    fi
+
+    if [ "$app" = "dozzle" ]; then
+       dozzle_subdomain="$subdomain"
+    fi
+done
+
+export AUTHELIA_FULL_DOMAIN="$authelia_subdomain.$ROOT_DOMAIN"
+export DOZZLE_FULL_DOMAIN="$dozzle_subdomain.$ROOT_DOMAIN"
+envsubst < app/authelia/authelia-config/configuration.yml.tmpl > app/authelia/authelia-config/configuration.yml
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+envsubst < app/authelia/authelia-config/users.yml.tmpl > app/authelia/authelia-config/users.yml
@@ -1,24 +0,0 @@
-version: '3'
-services:
-  lb:
-    image: docker.io/caddy:2.11.4-alpine
-    volumes:
-#      - /app/lb:/etc/caddy
-      - ./lb/:/etc/caddy
-      - /nassella/lb/config:/config
-      - /nassella/lb/data:/data
-      - /app/maintenance:/maintenance
-    networks:
-      - lb
-    restart: unless-stopped
-    ports:
-      - "443:443"
-      - "80:80"
-  nginx:
-    image: nginx
-    restart: unless-stopped
-    networks:
-      - lb
-networks:
-  lb:
-
@@ -0,0 +1,29 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$dozzle_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  route {
+    @authelia path /authelia /authelia/*
+    handle @authelia {
+      reverse_proxy authelia:9091
+    }
+    forward_auth authelia:9091 {
+      uri /api/authz/forward-auth
+      copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+    }
+    reverse_proxy http://dozzle:8080
+  }
+}
@@ -0,0 +1,26 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+services:
+  dozzle:
+    container_name: dozzle
+    image: amir20/dozzle:latest
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - lb
+networks:
+  lb:
@@ -1,10 +0,0 @@
-services:
-  dozzle:
-    container_name: dozzle
-    image: amir20/dozzle:latest
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-    networks:
-      - lb
-networks:
-  lb:
@@ -35,7 +35,7 @@
 mail__transport=SMTP
 # mail__options__host=
 # mail__options__port=
-mail__options__secure=true
+# mail__options__secure=true
 # mail__options__auth__user=
 # mail__options__auth__pass=
 # mail__from=""
@@ -0,0 +1,20 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$ghost_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  import maintenance_intercept
+  reverse_proxy http://ghost:2368
+}
@@ -0,0 +1,21 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/ghost/.compose-env
+
+app/ghost/.compose-env: $(apps_config) app/ghost/.compose.env.tmpl app/ghost/make-ghost-env.sh
+	./app/ghost/make-ghost-env.sh $(apps_config)
@@ -2,7 +2,8 @@ services:
  ghost:
    image: ghost:${GHOST_VERSION:-6-alpine}
    restart: always
-    # This is required to import current config when migrating
+    env_file:
+      - /app/.env
    environment:
      NODE_ENV: production
      url: https://${GHOST_DOMAIN:?GHOST_DOMAIN environment variable is required}
@@ -57,6 +58,14 @@ services:
      retries: 120
    networks:
      - ghost_network
+    command:
+      - --performance-schema=OFF
+      - --innodb-buffer-pool-size=64M
+      - --max-connections=10
+      - --table-open-cache=128
+      - --table-definition-cache=128
+      - --thread-cache-size=2
+      - --innodb-log-buffer-size=8M

  ghost_traffic-analytics:
    image: ghost/traffic-analytics:1.0
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+ghost_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "ghost" ]; then
+       ghost_subdomain="$subdomain"
+    fi
+done
+
+# write compose env file
+echo "GHOST_DOMAIN=\"$ghost_subdomain.$ROOT_DOMAIN\"" > app/ghost/.compose-env
+echo "GHOST_DATABASE_ROOT_PASSWORD=\"$GHOST_DATABASE_ROOT_PASSWORD\"" >> app/ghost/.compose-env
+echo "GHOST_DATABASE_PASSWORD=\"$GHOST_DATABASE_PASSWORD\"" >> app/ghost/.compose-env
+echo "mail__options__host=\"$SMTP_HOST\"" >> app/ghost/.compose-env
+echo "mail__options__port=\"$SMTP_PORT\"" >> app/ghost/.compose-env
+echo "mail__options__auth__user=\"$SMTP_AUTH_USER\"" >> app/ghost/.compose-env
+echo "mail__options__auth__pass=\"$SMTP_AUTH_PASSWORD\"" >> app/ghost/.compose-env
+echo "mail__from=\"$SMTP_FROM\"" >> app/ghost/.compose-env
+cat app/ghost/.compose.env.tmpl >> app/ghost/.compose-env
@@ -0,0 +1,19 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$instance_control_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  reverse_proxy http://instance_control:9000
+}
@@ -0,0 +1,24 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/instance-control/webhook_secret \
+app/instance-control/hooks/hooks.json
+
+app/instance-control/webhook_secret: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$INSTANCE_CONTROL_WEBHOOKS_SECRET" > $@'
+app/instance-control/hooks/hooks.json: $(apps_config) app/instance-control/make-instance-control-config.sh
+	./app/instance-control/make-instance-control-config.sh $(apps_config)
@@ -0,0 +1,38 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+version: '3'
+
+secrets:
+  instance_control_webhooks_secret:
+    file: ./instance-control/webhook_secret
+
+services:
+  instance_control:
+    image: almir/webhook
+    volumes:
+      - ./instance-control/hooks/:/etc/webhook
+      - /tmp/restic:/tmp/restic
+    secrets:
+      - instance_control_webhooks_secret
+    command:
+      - "-hooks=/etc/webhook/hooks.json"
+      - -verbose
+    networks:
+      - lb
+    restart: unless-stopped
+networks:
+  lb:
@@ -0,0 +1,31 @@
+#!/bin/sh
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+# TODO the systemd unit should actually do this
+# touch /maintenance/maintenance.on
+# rm /maintenance/maintenance.on
+
+# for instance-control docker compose setup:
+# make a directory in /tmp for these pipes and mount that as a volume
+# into the container
+
+# TODO read 'version' arg from request and make sure it
+# matches the version of this script
+
+# use a named pipe
+printf "%s\t%s\t%s\t%s\n" "$HOOK_tag" "$HOOK_request_id" "$HOOK_path" "false" > /tmp/restic/snapshot_trigger_pipe
@@ -0,0 +1,31 @@
+#!/bin/sh
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+# TODO the systemd unit should actually do this
+# touch /maintenance/maintenance.on
+# rm /maintenance/maintenance.on
+
+# for instance-control docker compose setup:
+# make a directory in /tmp for these pipes and mount that as a volume
+# into the container
+
+# TODO read 'version' arg from request and make sure it
+# matches the version of this script
+
+# use a named pipe
+printf "%s\t%s\t%s\t%s\n" "$HOOK_tag" "$HOOK_request_id" "$HOOK_path" "true" > /tmp/restic/snapshot_trigger_pipe
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+# TODO read 'version' arg from request and make sure it
+# matches the version of this script
+
+status=`cat /tmp/restic/snapshot_status_$HOOK_request_id`
+
+echo "{\"status\":\"$status\"}"
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+# substitute template with env var to insert webhooks secret
+envsubst < app/instance-control/hooks/hooks.json.tmpl > app/instance-control/hooks/hooks.json
@@ -1,22 +0,0 @@
-version: '3'
-
-secrets:
-  instance_control_webhooks_secret:
-    file: ./instance-control/webhook_secret
-
-services:
-  instance_control:
-    image: almir/webhook
-    volumes:
-      - ./instance-control/hooks/:/etc/webhook
-      - /tmp/restic:/tmp/restic
-    secrets:
-      - instance_control_webhooks_secret
-    command:
-      - "-hooks=/etc/webhook/hooks.json"
-      - -verbose
-    networks:
-      - lb
-    restart: unless-stopped
-networks:
-  lb:
@@ -1,15 +0,0 @@
-#!/bin/sh
-
-# TODO the systemd unit should actually do this
-# touch /maintenance/maintenance.on
-# rm /maintenance/maintenance.on
-
-# for instance-control docker compose setup:
-# make a directory in /tmp for these pipes and mount that as a volume
-# into the container
-
-# TODO read 'version' arg from request and make sure it
-# matches the version of this script
-
-# use a named pipe
-printf "%s\t%s\t%s\t%s\n" "$HOOK_tag" "$HOOK_request_id" "$HOOK_path" "false" > /tmp/restic/snapshot_trigger_pipe
@@ -1,15 +0,0 @@
-#!/bin/sh
-
-# TODO the systemd unit should actually do this
-# touch /maintenance/maintenance.on
-# rm /maintenance/maintenance.on
-
-# for instance-control docker compose setup:
-# make a directory in /tmp for these pipes and mount that as a volume
-# into the container
-
-# TODO read 'version' arg from request and make sure it
-# matches the version of this script
-
-# use a named pipe
-printf "%s\t%s\t%s\t%s\n" "$HOOK_tag" "$HOOK_request_id" "$HOOK_path" "true" > /tmp/restic/snapshot_trigger_pipe
@@ -1,10 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# TODO read 'version' arg from request and make sure it
-# matches the version of this script
-
-status=`cat /tmp/restic/snapshot_status_$HOOK_request_id`
-
-echo "{\"status\":\"$status\"}"
@@ -0,0 +1,20 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$lldap_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  import maintenance_intercept
+  reverse_proxy http://lldap:17170
+}
@@ -0,0 +1,37 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/lldap/postgres_db \
+app/lldap/postgres_user \
+app/lldap/postgres_password \
+app/lldap/admin_password \
+app/lldap/jwt_secret \
+app/lldap/lldap-config/lldap_config.toml
+
+app/lldap/postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$LLDAP_POSTGRES_DB" > $@'
+app/lldap/postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$LLDAP_POSTGRES_USER" > $@'
+app/lldap/postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$LLDAP_POSTGRES_PASSWORD" > $@'
+app/lldap/admin_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$LLDAP_ADMIN_PASSWORD" > $@'
+app/lldap/jwt_secret: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$LLDAP_JWT_SECRET" > $@'
+app/lldap/lldap-config/lldap_config.toml: $(apps_config) app/lldap/lldap-config/lldap_config.toml.tmpl \
+app/lldap/make-lldap-config.sh
+	./app/lldap/make-lldap-config.sh $(apps_config)
@@ -0,0 +1,81 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+secrets:
+  lldap_postgres_db:
+    file: ./lldap/postgres_db
+  lldap_postgres_password:
+    file: ./lldap/postgres_password
+  lldap_postgres_user:
+    file: ./lldap/postgres_user
+  lldap_admin_password:
+    file: ./lldap/admin_password
+  lldap_jwt_secret:
+    file: ./lldap/jwt_secret
+
+services:
+  lldap_db:
+    image: postgres:18-trixie
+    environment:
+      - POSTGRES_DB_FILE=/run/secrets/lldap_postgres_db
+      - POSTGRES_USER_FILE=/run/secrets/lldap_postgres_user
+      - POSTGRES_PASSWORD_FILE=/run/secrets/lldap_postgres_password
+    shm_size: 128mb
+    restart: always
+    volumes:
+      - /nassella/lldap/var-lib-postgresql:/var/lib/postgresql
+    networks:
+      - lldap_db_internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d `cat $$POSTGRES_DB_FILE` -U `cat $$POSTGRES_USER_FILE`"]
+      start_period: 15s
+      interval: 30s
+      retries: 3
+      timeout: 5s
+    secrets:
+      - lldap_postgres_db
+      - lldap_postgres_password
+      - lldap_postgres_user
+
+  lldap:
+    image: lldap/lldap:stable
+    environment:
+      - LLDAP_JWT_SECRET_FILE=/run/secrets/lldap_jwt_secret
+      - LLDAP_LDAP_USER_PASS_FILE=/run/secrets/lldap_admin_password
+    volumes:
+      - ./lldap/lldap-config/:/data
+    networks:
+      - lb
+      - lldap_internal
+      - lldap_db_internal
+    depends_on:
+      lldap_db:
+        condition: service_healthy
+    secrets:
+      - lldap_postgres_db
+      - lldap_postgres_password
+      - lldap_postgres_user
+      - lldap_jwt_secret
+      - lldap_admin_password
+
+networks:
+  lb:
+  lldap_internal:
+    driver: bridge
+    internal: true
+  lldap_db_internal:
+    driver: bridge
+    internal: true
@@ -0,0 +1,161 @@
+## Default configuration for Docker.
+## All the values can be overridden through environment variables, prefixed
+## with "LLDAP_". For instance, "ldap_port" can be overridden with the
+## "LLDAP_LDAP_PORT" variable.
+
+## Tune the logging to be more verbose by setting this to be true.
+## You can set it with the LLDAP_VERBOSE environment variable.
+# verbose=false
+
+## The host address that the LDAP server will be bound to.
+## To enable IPv6 support, simply switch "ldap_host" to "::":
+## To only allow connections from localhost (if you want to restrict to local self-hosted services),
+## change it to "127.0.0.1" ("::1" in case of IPv6).
+## If LLDAP server is running in docker, set it to "0.0.0.0" ("::" for IPv6) to allow connections
+## originating from outside the container.
+ldap_host = "0.0.0.0"
+
+## The port on which to have the LDAP server.
+#ldap_port = 3890
+
+## The host address that the HTTP server will be bound to.
+## To enable IPv6 support, simply switch "http_host" to "::".
+## To only allow connections from localhost (if you want to restrict to local self-hosted services),
+## change it to "127.0.0.1" ("::1" in case of IPv6).
+## If LLDAP server is running in docker, set it to "0.0.0.0" ("::" for IPv6) to allow connections
+## originating from outside the container.
+http_host = "0.0.0.0"
+
+## The port on which to have the HTTP server, for user login and
+## administration.
+#http_port = 17170
+
+## The public URL of the server, for password reset links.
+http_url = "https://$LLDAP_FULL_DOMAIN"
+
+## The path to the front-end assets (relative to the working directory).
+#assets_path = "./app"
+
+## Random secret for JWT signature.
+## This secret should be random, and should be shared with application
+## servers that need to consume the JWTs.
+## Changing this secret will invalidate all user sessions and require
+## them to re-login.
+## You should probably set it through the LLDAP_JWT_SECRET environment
+## variable from a secret ".env" file.
+## This can also be set from a file's contents by specifying the file path
+## in the LLDAP_JWT_SECRET_FILE environment variable
+## You can generate it with (on linux):
+## LC_ALL=C tr -dc 'A-Za-z0-9!#%&'\''()*+,-./:;<=>?@[\]^_{|}~' </dev/urandom | head -c 32; echo ''
+# jwt_secret = "$NASSELLA_LLDAP_JWT_SECRET"
+
+## Base DN for LDAP.
+## This is usually your domain name, and is used as a
+## namespace for your users. The choice is arbitrary, but will be needed
+## to configure the LDAP integration with other services.
+## The sample value is for "example.com", but you can extend it with as
+## many "dc" as you want, and you don't actually need to own the domain
+## name.
+ldap_base_dn = "dc=nassella,dc=org"
+
+## Admin username.
+## For the LDAP interface, a value of "admin" here will create the LDAP
+## user "cn=admin,ou=people,dc=example,dc=com" (with the base DN above).
+## For the administration interface, this is the username.
+#ldap_user_dn = "admin"
+
+## Admin email.
+## Email for the admin account. It is only used when initially creating
+## the admin user, and can safely be omitted.
+ldap_user_email = "$LLDAP_USER_EMAIL"
+
+## Admin password.
+## Password for the admin account, both for the LDAP bind and for the
+## administration interface. It is only used when initially creating
+## the admin user.
+## It should be minimum 8 characters long.
+## You can set it with the LLDAP_LDAP_USER_PASS environment variable.
+## This can also be set from a file's contents by specifying the file path
+## in the LLDAP_LDAP_USER_PASS_FILE environment variable
+## Note: you can create another admin user for user administration, this
+## is just the default one.
+# ldap_user_pass = ""
+
+## Force reset of the admin password.
+## Break glass in case of emergency: if you lost the admin password, you
+## can set this to true to force a reset of the admin password to the value
+## of ldap_user_pass above.
+## Alternatively, you can set it to "always" to reset every time the server starts.
+# force_ldap_user_pass_reset = false
+
+## Database URL.
+## This encodes the type of database (SQlite, MySQL, or PostgreSQL)
+## , the path, the user, password, and sometimes the mode (when
+## relevant).
+## Note: SQlite should come with "?mode=rwc" to create the DB
+## if not present.
+## Example URLs:
+##  - "postgres://postgres-user:password@postgres-server/my-database"
+##  - "mysql://mysql-user:password@mysql-server/my-database"
+##
+## This can be overridden with the LLDAP_DATABASE_URL env variable.
+database_url = "postgres://lldap:$LLDAP_POSTGRES_PASSWORD@lldap_db/lldap"
+
+## Private key file.
+## Not recommended, use key_seed instead.
+## Contains the secret private key used to store the passwords safely.
+## Note that even with a database dump and the private key, an attacker
+## would still have to perform an (expensive) brute force attack to find
+## each password.
+## Randomly generated on first run if it doesn't exist.
+## Env variable: LLDAP_KEY_FILE
+#key_file = "/data/private_key"
+
+## Seed to generate the server private key, see key_file above.
+## This can be any random string, the recommendation is that it's at least 12
+## characters long.
+## Env variable: LLDAP_KEY_SEED
+key_seed = "$LLDAP_KEY_SEED"
+
+## Ignored attributes.
+## Some services will request attributes that are not present in LLDAP. When it
+## is the case, LLDAP will warn about the attribute being unknown. If you want
+## to ignore the attribute and the service works without, you can add it to this
+## list to silence the warning.
+#ignored_user_attributes = [ "sAMAccountName" ]
+#ignored_group_attributes = [ "mail", "userPrincipalName" ]
+
+## Options to configure SMTP parameters, to send password reset emails.
+## To set these options from environment variables, use the following format
+## (example with "password"): LLDAP_SMTP_OPTIONS__PASSWORD
+[smtp_options]
+## Whether to enabled password reset via email, from LLDAP.
+enable_password_reset=true
+## The SMTP server.
+server="$SMTP_HOST"
+## The SMTP port.
+port=$SMTP_PORT
+## How the connection is encrypted, either "NONE" (no encryption), "TLS" or "STARTTLS".
+smtp_encryption = "TLS"
+## The SMTP user, usually your email address.
+user="$SMTP_AUTH_USER"
+## The SMTP password.
+password="$SMTP_AUTH_PASSSWORD"
+## The header field, optional: how the sender appears in the email. The first
+## is a free-form name, followed by an email between <>.
+from="$SMTP_FROM"
+## Same for reply-to, optional.
+#reply_to="Do not reply <noreply@localhost>"
+
+## Options to configure LDAPS.
+## To set these options from environment variables, use the following format
+## (example with "port"): LLDAP_LDAPS_OPTIONS__PORT
+[ldaps_options]
+## Whether to enable LDAPS.
+#enabled=true
+## Port on which to listen.
+#port=6360
+## Certificate file.
+#cert_file="/data/cert.pem"
+## Certificate key file.
+#key_file="/data/key.pem"
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+lldap_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "lldap" ]; then
+       lldap_subdomain="$subdomain"
+    fi
+done
+
+export LLDAP_FULL_DOMAIN="$lldap_subdomain.$ROOT_DOMAIN"
+envsubst < app/lldap/lldap-config/lldap_config.toml.tmpl > app/lldap/lldap-config/lldap_config.toml
@@ -0,0 +1,42 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$nassella_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  import maintenance_intercept
+
+  route {
+    @authelia path /authelia /authelia/*
+    handle @authelia {
+      reverse_proxy nassella_authelia:9091
+    }
+
+    handle /unsecured/* {
+      reverse_proxy http://nassella:8080
+    }
+
+    forward_auth nassella_authelia:9091 {
+      uri /api/authz/forward-auth
+      copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+    }
+
+    reverse_proxy http://nassella:8080
+  }
+}
+
+lldap.{$nassella_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  import maintenance_intercept
+  reverse_proxy nassella_lldap:17170
+}
@@ -0,0 +1,60 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/nassella/postgres_db \
+app/nassella/postgres_user \
+app/nassella/postgres_password \
+app/nassella/lldap_postgres_db \
+app/nassella/lldap_postgres_user \
+app/nassella/lldap_postgres_password \
+app/nassella/authelia_postgres_db \
+app/nassella/authelia_postgres_user \
+app/nassella/authelia_postgres_password \
+app/nassella/lldap_admin_password \
+app/nassella/stripe_api_key \
+app/nassella/nassella.env \
+app/nassella/authelia-config/configuration.yml \
+app/nassella/lldap-config/lldap_config.toml
+
+app/nassella/postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_POSTGRES_DB" > $@'
+app/nassella/postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_POSTGRES_USER" > $@'
+app/nassella/postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_POSTGRES_PASSWORD" > $@'
+app/nassella/authelia_postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_AUTHELIA_POSTGRES_DB" > $@'
+app/nassella/authelia_postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_AUTHELIA_POSTGRES_USER" > $@'
+app/nassella/authelia_postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_AUTHELIA_POSTGRES_PASSWORD" > $@'
+app/nassella/lldap_postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_POSTGRES_DB" > $@'
+app/nassella/lldap_postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_POSTGRES_USER" > $@'
+app/nassella/lldap_postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_POSTGRES_PASSWORD" > $@'
+app/nassella/lldap_admin_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_LLDAP_ADMIN_PASSWORD" > $@'
+app/nassella/stripe_api_key: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NASSELLA_STRIPE_API_KEY" > $@'
+app/nassella/authelia-config/configuration.yml: $(apps_config) app/nassella/authelia-config/configuration.yml.tmpl \
+app/nassella/make-nassella-authelia-config.sh
+	./app/nassella/make-nassella-authelia-config.sh $(apps_config)
+app/nassella/lldap-config/lldap_config.toml: $(apps_config) app/nassella/lldap-config/lldap_config.toml.tmpl \
+app/nassella/make-nassella-lldap-config.sh
+	./app/nassella/make-nassella-lldap-config.sh $(apps_config)
@@ -84,7 +84,7 @@ access_control:
      policy: 'two_factor'

 session:
-  secret: 'insecure_session_secret'
+  secret: 'insecure_session_secret' # TODO fix

  cookies:
    - name: 'authelia_session'
@@ -1,4 +1,18 @@
-version: '3'
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.

 secrets:
  nassella_postgres_db:
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+nassella_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "nassella" ]; then
+       nassella_subdomain="$subdomain"
+    fi
+done
+
+export NASSELLA_FULL_DOMAIN="$nassella_subdomain.$ROOT_DOMAIN"
+export NASSELLA_FULL_LLDAP_DOMAIN="$NASSELLA_LLDAP_SUBDOMAIN.$nassella_subdomain.$ROOT_DOMAIN"
+envsubst < app/nassella/authelia-config/configuration.yml.tmpl > app/nassella/authelia-config/configuration.yml
+
+# write secrets
+echo "$NASSELLA_POSTGRES_DB" > app/nassella/postgres_db
+echo "$NASSELLA_POSTGRES_USER" > app/nassella/postgres_user
+echo "$NASSELLA_POSTGRES_PASSWORD" > app/nassella/postgres_password
+
+echo "$NASSELLA_AUTHELIA_POSTGRES_DB" > app/nassella/authelia_postgres_db
+echo "$NASSELLA_AUTHELIA_POSTGRES_USER" > app/nassella/authelia_postgres_user
+echo "$NASSELLA_AUTHELIA_POSTGRES_PASSWORD" > app/nassella/authelia_postgres_password
+
+echo "$NASSELLA_LLDAP_POSTGRES_DB" > app/nassella/lldap_postgres_db
+echo "$NASSELLA_LLDAP_POSTGRES_USER" > app/nassella/lldap_postgres_user
+echo "$NASSELLA_LLDAP_POSTGRES_PASSWORD" > app/nassella/lldap_postgres_password
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -a # export everything in the config for later use by envsubst
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+nassella_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "nassella" ]; then
+       nassella_subdomain="$subdomain"
+    fi
+done
+
+export NASSELLA_FULL_DOMAIN="$nassella_subdomain.$ROOT_DOMAIN"
+export NASSELLA_FULL_LLDAP_DOMAIN="$NASSELLA_LLDAP_SUBDOMAIN.$nassella_subdomain.$ROOT_DOMAIN"
+envsubst < app/nassella/lldap-config/lldap_config.toml.tmpl > app/nassella/lldap-config/lldap_config.toml
+
+# write secrets
+echo "$NASSELLA_POSTGRES_DB" > app/nassella/postgres_db
+echo "$NASSELLA_POSTGRES_USER" > app/nassella/postgres_user
+echo "$NASSELLA_POSTGRES_PASSWORD" > app/nassella/postgres_password
+
+echo "$NASSELLA_AUTHELIA_POSTGRES_DB" > app/nassella/authelia_postgres_db
+echo "$NASSELLA_AUTHELIA_POSTGRES_USER" > app/nassella/authelia_postgres_user
+echo "$NASSELLA_AUTHELIA_POSTGRES_PASSWORD" > app/nassella/authelia_postgres_password
+
+echo "$NASSELLA_LLDAP_POSTGRES_DB" > app/nassella/lldap_postgres_db
+echo "$NASSELLA_LLDAP_POSTGRES_USER" > app/nassella/lldap_postgres_user
+echo "$NASSELLA_LLDAP_POSTGRES_PASSWORD" > app/nassella/lldap_postgres_password
@@ -0,0 +1,20 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$nextcloud_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  import maintenance_intercept
+  reverse_proxy http://nextcloud:80
+}
@@ -0,0 +1,39 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/nextcloud/nextcloud_admin_user \
+app/nextcloud/nextcloud_admin_password \
+app/nextcloud/postgres_db \
+app/nextcloud/postgres_user \
+app/nextcloud/postgres_password \
+app/nextcloud/redis_password \
+app/nextcloud/nextcloud.env
+
+app/nextcloud/nextcloud_admin_user: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$NEXTCLOUD_ADMIN_USER" > $@'
+app/nextcloud/nextcloud_admin_password: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$NEXTCLOUD_ADMIN_PASSWORD" > $@'
+app/nextcloud/postgres_db: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_POSTGRES_DB" > $@'
+app/nextcloud/postgres_user: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_POSTGRES_USER" > $@'
+app/nextcloud/postgres_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_POSTGRES_PASSWORD" > $@'
+app/nextcloud/redis_password: $(apps_config)
+	bash -c 'source ./$(apps_config); printf "%s\n" "$$NEXTCLOUD_REDIS_PASSWORD" > $@'
+app/nextcloud/nextcloud.env: $(apps_config) app/nextcloud/nextcloud.env.tmpl app/nextcloud/make-nextcloud-env.sh
+	./app/nextcloud/make-nextcloud-env.sh $(apps_config)
@@ -1,4 +1,18 @@
-version: '3'
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.

 secrets:
  nextcloud_postgres_db:
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+nextcloud_subdomain=
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    if [ "$app" = "nextcloud" ]; then
+       nextcloud_subdomain="$subdomain"
+    fi
+done
+
+# write container env file
+echo "DOMAIN=\"$nextcloud_subdomain.$ROOT_DOMAIN\"" > app/nextcloud/nextcloud.env
+cat app/nextcloud/nextcloud.env.tmpl >> app/nextcloud/nextcloud.env
+
+# write secrets
+echo "$NEXTCLOUD_POSTGRES_DB" > app/nextcloud/nextcloud_postgres_db
+echo "$NEXTCLOUD_POSTGRES_USER" > app/nextcloud/nextcloud_postgres_user
+echo "$NEXTCLOUD_POSTGRES_PASSWORD" > app/nextcloud/nextcloud_postgres_password
+echo "$NEXTCLOUD_REDIS_PASSWORD" > app/nextcloud/nextcloud_redis_password
@@ -0,0 +1,20 @@
+DOMAIN="nextcloud.nassella.cc"
+NEXTCLOUD_TRUSTED_DOMAINS=${DOMAIN}
+
+# reverse proxy config
+OVERWRITEHOST=${DOMAIN}
+OVERWRITECLIURL=https://${DOMAIN}
+OVERWRITEPROTOCOL=https
+TRUSTED_PROXIES=172.16.0.0/24 # trust the local lb
+PHP_MEMORY_LIMIT=1G
+PHP_UPLOAD_LIMIT=10G
+POSTGRES_HOST=db
+POSTGRES_DB_FILE=/run/secrets/postgres_db
+POSTGRES_USER_FILE=/run/secrets/postgres_user
+POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
+# admin user
+NEXTCLOUD_ADMIN_PASSWORD_FILE=/run/secrets/nextcloud_admin_password
+NEXTCLOUD_ADMIN_USER_FILE=/run/secrets/nextcloud_admin_user
+# redis
+REDIS_HOST=redis
+REDIS_HOST_PASSWORD_FILE=/run/secrets/redis_password
@@ -0,0 +1 @@
+foodisgood
@@ -0,0 +1 @@
+admin
@@ -0,0 +1 @@
+nextcloud
@@ -0,0 +1 @@
+dbpassword
@@ -0,0 +1 @@
+nextcloud
@@ -0,0 +1 @@
+redispassword
@@ -0,0 +1,25 @@
+((name . "Nextcloud")
+ (key . nextcloud)
+ (dir . "nextcloud")
+ (current-version . "34")
+ (versions . (("34")))
+ (website . "https://nextcloud.com")
+ (docker-secrets . (("NEXTCLOUD_ADMIN_USER" "nextcloud_admin_user")
+                    ("NEXTCLOUD_ADMIN_PASSWORD" "nextcloud_admin_password")
+                    ("NEXTCLOUD_POSTGRES_DB" "postgres_db")
+                    ("NEXTCLOUD_POSTGRES_USER" "postgres_user")
+                    ("NEXTCLOUD_POSTGRES_PASSWORD" "postgres_password")
+                    ("NEXTCLOUD_REDIS_PASSWORD" "redis_password")))
+ (scripts . (("make-nextcloud-env.sh"
+              ((deps . ("nextcloud.env.tmpl"))
+               (output . "nextcloud.env")))))
+ (apps-config . (("NEXTCLOUD_ADMIN_USER" admin-user)
+                 ("NEXTCLOUD_ADMIN_PASSWORD" admin-password)
+                 ("NEXTCLOUD_POSTGRES_DB" "nextcloud")
+                 ("NEXTCLOUD_POSTGRES_USER" "nextcloud")
+                 ("NEXTCLOUD_POSTGRES_PASSWORD" postgres-password)
+                 ("NEXTCLOUD_REDIS_PASSWORD" redis-password)))
+ (general . ((smtp . #t)))
+ (caddyfile . "  reverse_proxy http://nextcloud:80")
+ (passwd . ((name . "nextcloud")
+            (uid . "1001"))))
@@ -1,3 +1,19 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 [Unit]
 Description=Restic Snapshotter
 After=app.service
@@ -0,0 +1,19 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$wg_easy_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  reverse_proxy http://wg-easy:80
+}
@@ -0,0 +1,7 @@
+((name . "wg-easy")
+ (key . wg-easy)
+ (dir . "wg-easy")
+ (current-version . "15")
+ (versions . (("15")))
+ (website . "https://wg-easy.github.io/wg-easy/Pre-release/")
+ (caddyfile . "  reverse_proxy http://wg-easy:80"))
@@ -0,0 +1,19 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+{$wordpress_SUBDOMAIN}.{$ROOT_DOMAIN} {
+  reverse_proxy http://wordpress_caddy:80
+}
@@ -0,0 +1,27 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+:80 {
+    root * /var/www/html
+
+    encode gzip zstd
+
+    php_fastcgi wordpress:9000 {
+        trusted_proxies 172.30.0.0/16
+    }
+
+    file_server
+}
@@ -0,0 +1,24 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+IMAGE_DEPS := $(IMAGE_DEPS) \
+app/wordpress/wordpress_db_password \
+app/wordpress/wordpress_db_root_password
+
+app/wordpress/wordpress_db_password: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$WORDPRESS_DB_PASSWORD" > $@'
+app/wordpress/wordpress_db_root_password: $(apps_config)
+	bash -c 'source $(apps_config); printf "%s\n" "$$WORDPRESS_DB_ROOT_PASSWORD" > $@'
@@ -0,0 +1,4 @@
+upload_max_filesize = 256M
+post_max_size = 256M
+memory_limit = 256M
+max_execution_time = 300
@@ -0,0 +1,117 @@
+secrets:
+  wordpress_db_password:
+    file: ./wordpress/wordpress_db_password
+  wordpress_db_root_password:
+    file: ./wordpress/wordpress_db_root_password
+
+services:
+
+  wordpress_caddy:
+    image: docker.io/caddy:2.11.4-alpine
+    volumes:
+      - ./wordpress/Caddyfile-internal:/etc/caddy/Caddyfile:ro
+      - /nassella/wordpress/caddy-config:/config
+      - /nassella/wordpress/caddy-data:/data
+      - /nassella/wordpress/var-www-html:/var/www/html:ro
+    networks:
+      - lb
+      - wordpress_instance
+    restart: unless-stopped
+    depends_on:
+      - wordpress
+  wordpress:
+    image: wordpress:php8.4-fpm
+    restart: unless-stopped
+    environment:
+      WORDPRESS_DB_HOST: wordpress_db
+      WORDPRESS_DB_USER: wordpress
+      WORDPRESS_DB_PASSWORD_FILE: /run/secrets/wordpress_db_password
+      WORDPRESS_DB_NAME: wordpress
+    depends_on:
+      wordpress_db:
+        condition: service_healthy
+    volumes:
+      - /nassella/wordpress/var-www-html:/var/www/html
+      - ./wordpress/custom.ini:/usr/local/etc/php/conf.d/custom.ini:ro
+    networks:
+      - wordpress_db
+      - wordpress_instance
+      - wordpress_outbound
+      - lb
+    secrets:
+      - wordpress_db_password
+
+  wordpress_db:
+    image: mysql:9.7
+    restart: always
+    environment:
+      MYSQL_DATABASE: wordpress
+      MYSQL_USER: wordpress
+      MYSQL_PASSWORD_FILE: /run/secrets/wordpress_db_password
+      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/wordpress_db_root_password
+    volumes:
+      - /nassella/wordpress/var-lib-mysql:/var/lib/mysql
+    networks:
+      - wordpress_db
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "MYSQL_PWD=$$(cat /run/secrets/wordpress_mysql_root_password) mysqladmin ping -h 127.0.0.1 -uroot --silent"
+        ]
+      interval: 1s
+      start_period: 30s
+      start_interval: 10s
+      retries: 120
+    secrets:
+      - wordpress_db_password
+      - wordpress_db_root_password
+    command:
+      - --performance-schema=OFF
+      - --innodb-buffer-pool-size=64M
+      - --max-connections=10
+      - --table-open-cache=128
+      - --table-definition-cache=128
+      - --thread-cache-size=2
+      - --innodb-log-buffer-size=8M
+
+  # wordpress_init:
+  #   image: wordpress:cli-php8.4
+  #   restart: "no"
+  #   depends_on:
+  #     - wordpress_db
+  #     - wordpress
+  #   environment:
+  #     WORDPRESS_DB_HOST: db
+  #     WORDPRESS_DB_USER: exampleuser
+  #     WORDPRESS_DB_PASSWORD: examplepass
+  #     WORDPRESS_DB_NAME: exampledb
+
+  #     WP_URL: "https://wp.nassella.org"
+  #     WP_TITLE: "Nassella"
+  #     WP_ADMIN_USER: "admin"
+  #     WP_ADMIN_PASSWORD: "admin"
+  #     WP_ADMIN_EMAIL: "admin@example.org"
+
+  #     OIDC_CLIENT_ID: wordpress
+  #     OIDC_CLIENT_SECRET: "secret"
+  #     OIDC_PROVIDER: "https://auth.nassella.org"
+
+  #   volumes:
+  #     - /nassella/wordpress/var-www-html:/var/www/html
+  #     - ./init:/scripts
+
+  #   entrypoint:
+  #     - /bin/bash
+  #     - /scripts/init.sh
+
+networks:
+  lb:
+  wordpress_instance:
+    driver: bridge
+    internal: true
+  wordpress_outbound:
+    driver: bridge
+  wordpress_db:
+    driver: bridge
+    internal: true
@@ -0,0 +1,64 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+echo "Waiting for db..."
+
+until wp db check --allow-root
+do
+    sleep 5
+done
+
+echo "db ready"
+
+if ! wp core is-installed --allow-root
+then
+    echo "installing wp"
+
+    wp core install \
+       --url="$WP_URL" \
+       --title="$WP_TITLE" \
+       --admin_user="$WP_ADMIN_USER" \
+       --admin_password="$WP_ADMIN_PASSWORD" \
+       --admin_email="$WP_ADMIN_EMAIL" \
+       --skip-email \
+       --allow-root
+fi
+
+echo "installing plugins"
+
+if ! wp plugin is-installed daggerhart-openid-connect-generic
+then
+    wp plugin install daggerhart-openid-connect-generic \
+       --activate \
+       --allow-root
+fi
+
+if ! wp plugin is-active daggerhart-openid-connect-generic
+then
+    wp plugin activate daggerhart-openid-connect-generic
+fi
+
+echo "plugins installed. configuring plugins"
+
+# after installing the plugs we can then use the plugin's CLI
+# to configure the plugin
+wp option update openid_connect_generic_settings 'the settings' # TODO lookup
+# or
+wp option patch update ...
@@ -1,10 +1,26 @@
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 variant: flatcar
 version: 1.1.0
 passwd:
  users:
    - name: core
      ssh_authorized_keys_local:
-        - /ssh-keys
+        - config/ssh-keys
    - name: nextcloud
      uid: 1001
 systemd:
@@ -49,7 +65,7 @@ systemd:
        [Service]
        Type=oneshot
        EnvironmentFile=/restic-env
-        ExecStart=/usr/bin/bash -c "docker run --rm --volume /nassella:/nassella --volume /restic-password:/restic-password -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} -i restic/restic:0.18.0 backup --verbose --repo s3:${BACKBLAZE_BUCKET_URL} --password-file /restic-password --tag daily_automatic /nassella"
+        ExecStart=/restic-scheduled-snapshot.sh
        ExecStopPost=systemctl start app.service

    - name: restic-backup.timer
@@ -64,6 +80,18 @@ systemd:
        [Install]
        WantedBy=multi-user.target

+    - name: unpack-app.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Unpack /app
+        Before=app.service
+        [Service]
+        Type=oneshot
+        ExecStart=/unpack-app
+        [Install]
+        WantedBy=multi-user.target
+
    ### docker-compose sysext
    ### https://flatcar.github.io/sysext-bakery/docker_compose/
    - name: systemd-sysupdate.timer
@@ -101,10 +129,14 @@ storage:
    - device: /dev/disk/by-partlabel/appstorage
      format: ext4
      wipe_filesystem: false
-  trees:
-    - path: /app
-      local: app
+  # trees:
+  #   - path: /app
+  #     local: app
  files:
+    - path: /app.tar.gz
+      mode: 0600
+      contents:
+        local: app.tar.gz
    - path: /restic-password
      contents:
        local: restic-password
@@ -120,6 +152,10 @@ storage:
      mode: 0755
      contents:
        local: restic-snapshot.sh
+    - path: /restic-scheduled-snapshot.sh
+      mode: 0755
+      contents:
+        local: restic-scheduled-snapshot.sh
    - path: /etc/ssh/sshd_config.d/custom.conf
      overwrite: true
      mode: 0600
@@ -127,6 +163,15 @@ storage:
        inline: |
          PermitRootLogin no
          AllowUsers core
+    - path: /unpack-app
+      mode: 0755
+      contents:
+        inline: |
+          #!/bin/sh
+          set -e
+          mkdir /app
+          tar -xzf /app.tar.gz -C /
+          rm /app.tar.gz
    ### docker-compose sysext
    ### https://flatcar.github.io/sysext-bakery/docker_compose/
    - path: /opt/extensions/docker-compose/docker-compose-5.1.4-x86-64.raw
@@ -1,5 +1,5 @@
 ROOT_DOMAIN=  # example.com :: the root of the domain that all apps should be subdomains of
-APP_CONFIGS="nextcloud,nextcloud wg-easy,wg-easy ghost,ghost" # apps to deploy and their corresponding sub-domain (app,sub-domain)
+APP_CONFIGS="nextcloud,nextcloud,34 wg-easy,wg-easy,15 ghost,ghost,2" # apps to deploy and their corresponding sub-domain and all-apps version (app,sub-domain,version)
 NEXTCLOUD_ADMIN_USER=admin # admin user for nextcloud, can be whatever you want
 NEXTCLOUD_ADMIN_PASSWORD=  # the password for the nextcloud admin user
 NEXTCLOUD_POSTGRES_DB=nextcloud # recommended to leave as 'nextcloud'. The postgres db nextcloud uses
@@ -1,22 +1,38 @@
 #!/bin/bash

+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 # this script copys over the docker configs
 # for in-use apps

 # it depends on apps.config which should define:
 # ROOT_DOMAIN - the root domain for all apps
-# APP_CONFIGS - app-subdomain pairs, configured via a comma, like:
-#   app1,subdomain1 app2,subdomain2 app3,subdomain3
+# APP_CONFIGS - app-subdomain-version pairs, configured via a comma, like:
+#   app1,subdomain1,version app2,subdomain2,version app3,subdomain3,version
 # full example:
 #   ROOT_DOMAIN=nassella.cc
-#   APP_CONFIGS="app1,subdomain1 app2,subdomain2 app3,subdomain3"
+#   APP_CONFIGS="app1,subdomain1,1 app2,subdomain2,1 app3,subdomain3,1"

 set -e

-. $1 # source the apps.config file with then env vars
+. $1 # source the apps.config file with the env vars

 read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
-APP_CONFIGS+=('lb,root')
+# APP_CONFIGS+=('lb,root,1') # TODO is this used anymore?


 for config_string in ${APP_CONFIGS[@]}; do
@@ -24,8 +40,6 @@ for config_string in ${APP_CONFIGS[@]}; do
    read -r -a config <<< "$config_string"

    app=${config[0]}
-    cp -a all-apps/$app app/
+    version=${config[2]}
+    cp -a all-apps/$app/$version app/$app
 done
-
-
-
@@ -1,5 +1,21 @@
 #!/bin/bash

+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 . $1 # source the apps.config file with the env vars

 # if we are on a dev machine try to use docker
@@ -17,7 +33,7 @@ if [ $? -ne 0 ]; then

    if [ $status -eq 10 ]; then
        # restic repo is not initialized so initialize it
-        AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic init --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password
+        AWS_ACCESS_KEY_ID="$BACKBLAZE_KEY_ID" AWS_SECRET_ACCESS_KEY="$BACKBLAZE_APPLICATION_KEY" restic init --repo s3:$BACKBLAZE_BUCKET_URL --password-file restic-password
        init_status=$?
    elif [ $status -ne 0  ]; then
        # something unexpected happened, exit
@@ -2,23 +2,19 @@ terraform {
  required_providers {
    digitalocean = {
      source  = "digitalocean/digitalocean"
-      version = "2.62.0"
+      version = "2.96.0"
    }
    ct = {
      source  = "poseidon/ct"
-      version = "0.13.0"
+      version = "0.14.0"
    }
    null = {
      source  = "hashicorp/null"
-      version = "3.2.4"
-    }
-    time = {
-      source  = "hashicorp/time"
-      version = "0.13.1"
+      version = "3.3.0"
    }
    cloudflare = {
      source = "cloudflare/cloudflare"
-      version = "5.8.2"
+      version = "5.22.0"
    }
  }
 }
@@ -86,6 +82,10 @@ variable "digitalocean_volume_size" {

 provider "digitalocean" {
  token = var.do_token
+
+  http_retry_max      = 10
+  http_retry_wait_min = 2
+  http_retry_wait_max = 60
 }

 provider "cloudflare" {
@@ -142,21 +142,11 @@ resource "digitalocean_droplet" "machine" {
  size      = var.server_type
  ssh_keys  = [digitalocean_ssh_key.first.fingerprint]
  user_data = file("ignition.json")
-  lifecycle {
-    create_before_destroy = true
-  }
 }
-
-resource "time_sleep" "wait_10_seconds" {
-  create_duration = "10s"
-}
-
 resource "digitalocean_reserved_ip_assignment" "machine" {
+  depends_on = [digitalocean_volume_attachment.machine]
  ip_address = digitalocean_reserved_ip.machine.ip_address
  droplet_id = digitalocean_droplet.machine.id
-  # sometimes digital ocean throws an error for this resource
-  # saying the droplet has a pending event so we delay a few seconds
-  depends_on = [time_sleep.wait_10_seconds]
 }

 resource "digitalocean_volume_attachment" "machine" {
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+# this script generates the load-balancer
+# config for the Caddy server.
+
+# it depends on apps.config which should define:
+# ROOT_DOMAIN - the root domain for all apps
+# APP_CONFIGS - app-subdomain pairs, configured via a comma, like:
+#   app1,subdomain1 app2,subdomain2 app3,subdomain3
+# full example:
+#   ROOT_DOMAIN=nassella.cc
+#   APP_CONFIGS="app1,subdomain1 app2,subdomain2 app3,subdomain3"
+
+set -e
+
+. $1 # source the apps.config file with then env vars
+
+# host_admin_password_encoded=`echo "$HOST_ADMIN_PASSWORD" | docker run --rm -i caddy:2 caddy hash-password`
+host_admin_password_encoded="password" # unused
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+APP_CONFIGS+=('lb,root')
+
+echo "ROOT_DOMAIN=\"${ROOT_DOMAIN}\""
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    app=${config[0]}
+    subdomain=${config[1]}
+
+    echo "${app//-/_}_SUBDOMAIN=\"${subdomain}\""
+done
@@ -1,100 +0,0 @@
-#!/bin/bash
-
-# this script generates the load-balancer
-# config for the Caddy server.
-
-# it depends on apps.config which should define:
-# ROOT_DOMAIN - the root domain for all apps
-# APP_CONFIGS - app-subdomain pairs, configured via a comma, like:
-#   app1,subdomain1 app2,subdomain2 app3,subdomain3
-# full example:
-#   ROOT_DOMAIN=nassella.cc
-#   APP_CONFIGS="app1,subdomain1 app2,subdomain2 app3,subdomain3"
-
-set -e
-
-. $1 # source the apps.config file with then env vars
-
-host_admin_password_encoded=`echo "$HOST_ADMIN_PASSWORD" | docker run --rm -i caddy:2 caddy hash-password`
-
-
-read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
-APP_CONFIGS+=('lb,root')
-
-
-declare -A bodys
-bodys["nextcloud"]="  reverse_proxy http://nextcloud:80"
-bodys["wg-easy"]="  reverse_proxy http://wg-easy:80"
-bodys["ghost"]="  reverse_proxy http://ghost:2368"
-bodys["nassella"]=$(cat <<EOF
-  route {
-    @authelia path /authelia /authelia/*
-    handle @authelia {
-      reverse_proxy nassella_authelia:9091
-    }
-
-    handle /unsecured/* {
-      reverse_proxy http://nassella:8080
-    }
-
-    forward_auth nassella_authelia:9091 {
-      uri /api/authz/forward-auth
-      copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
-    }
-
-    reverse_proxy http://nassella:8080
-  }
-EOF
-)
-bodys["dozzle"]=$(cat <<EOF
-  basic_auth {
-    $HOST_ADMIN_USER $host_admin_password_encoded
-  }
-  reverse_proxy http://dozzle:8080
-EOF
-)
-bodys["instance-control"]="  reverse_proxy http://instance_control:9000"
-bodys["lb"]="  reverse_proxy http://nginx:80"
-
-for config_string in ${APP_CONFIGS[@]}; do
-    IFS=','
-    read -r -a config <<< "$config_string"
-
-    app=${config[0]}
-    subdomain=${config[1]}
-    body=${bodys[$app]}
-    fulldomain="$subdomain.$ROOT_DOMAIN"
-
-    echo "$fulldomain {"
-    if [ "$app" != "instance-control" ] && [ "$app" != "dozzle" ]; then
-        # config for maintenance mode
-        echo "@maintenanceModeActive file /maintenance/maintenance.on {"
-        echo "  root /"
-        echo "}"
-        echo "handle @maintenanceModeActive {"
-        echo "  respond \"We are performing a maintenance, come back later\" 503"
-        echo "}"
-    fi
-
-    echo $body
-    echo "}"
-
-    # this is a hack specifically for nassella
-    # because lldap should be on a separate domain
-    # for security but this was not designed for one app
-    # to map to multiple caddy blocks
-    # currently this is hardcoded to prefix the nassella
-    # domain with 'lldap'
-    if [ "$app" = "nassella" ]; then
-       echo "lldap.$subdomain.$ROOT_DOMAIN {"
-       # config for maintenance mode
-       echo "@maintenanceModeActive file /maintenance/maintenance.on {"
-       echo "  root /"
-       echo "}"
-       echo "handle @maintenanceModeActive {"
-       echo "  respond \"We are performing a maintenance, come back later\" 503"
-       echo "}"
-       echo "  reverse_proxy nassella_lldap:17170"
-       echo "}"
-    fi
-done
@@ -1,5 +1,21 @@
 #!/bin/bash

+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 # this script generates the shared values for the
 # terraform config (domain & subdomain variables)

@@ -1,32 +0,0 @@
-#!/bin/bash
-
-set -e
-
-. $1 # source the apps.config file with then env vars
-
-read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
-
-nextcloud_subdomain=
-
-for config_string in ${APP_CONFIGS[@]}; do
-    IFS=','
-    read -r -a config <<< "$config_string"
-
-    app=${config[0]}
-    subdomain=${config[1]}
-
-    if [ "$app" = "ghost" ]; then
-       ghost_subdomain="$subdomain"
-    fi
-done
-
-# write compose env file
-echo "GHOST_DOMAIN=\"$ghost_subdomain.$ROOT_DOMAIN\"" > all-apps/ghost/.compose-env
-echo "GHOST_DATABASE_ROOT_PASSWORD=\"$GHOST_DATABASE_ROOT_PASSWORD\"" >> all-apps/ghost/.compose-env
-echo "GHOST_DATABASE_PASSWORD=\"$GHOST_DATABASE_PASSWORD\"" >> all-apps/ghost/.compose-env
-echo "mail__options__host=\"$SMTP_HOST\"" >> all-apps/ghost/.compose-env
-echo "mail__options__port=\"$SMTP_PORT\"" >> all-apps/ghost/.compose-env
-echo "mail__options__auth__user=\"$SMTP_AUTH_USER\"" >> all-apps/ghost/.compose-env
-echo "mail__options__auth__pass=\"$SMTP_AUTH_PASSWORD\"" >> all-apps/ghost/.compose-env
-echo "mail__from=\"$SMTP_FROM\"" >> all-apps/ghost/.compose-env
-cat all-apps/ghost/.compose.env.tmpl >> all-apps/ghost/.compose-env
@@ -1,9 +0,0 @@
-#!/bin/bash
-
-set -e
-set -a # export everything in the config for later use by envsubst
-
-. $1 # source the apps.config file with then env vars
-
-# substitute template with env var to insert webhooks secret
-envsubst < all-apps/instance-control/hooks/hooks.json.tmpl > all-apps/instance-control/hooks/hooks.json
@@ -1,39 +0,0 @@
-#!/bin/bash
-
-set -e
-set -a # export everything in the config for later use by envsubst
-
-. $1 # source the apps.config file with then env vars
-
-read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
-
-nassella_subdomain=
-
-for config_string in ${APP_CONFIGS[@]}; do
-    IFS=','
-    read -r -a config <<< "$config_string"
-
-    app=${config[0]}
-    subdomain=${config[1]}
-
-    if [ "$app" = "nassella" ]; then
-       nassella_subdomain="$subdomain"
-    fi
-done
-
-export NASSELLA_FULL_DOMAIN="$nassella_subdomain.$ROOT_DOMAIN"
-export NASSELLA_FULL_LLDAP_DOMAIN="$NASSELLA_LLDAP_SUBDOMAIN.$nassella_subdomain.$ROOT_DOMAIN"
-envsubst < all-apps/nassella/authelia-config/configuration.yml.tmpl > all-apps/nassella/authelia-config/configuration.yml
-
-# write secrets
-echo "$NASSELLA_POSTGRES_DB" > all-apps/nassella/postgres_db
-echo "$NASSELLA_POSTGRES_USER" > all-apps/nassella/postgres_user
-echo "$NASSELLA_POSTGRES_PASSWORD" > all-apps/nassella/postgres_password
-
-echo "$NASSELLA_AUTHELIA_POSTGRES_DB" > all-apps/nassella/authelia_postgres_db
-echo "$NASSELLA_AUTHELIA_POSTGRES_USER" > all-apps/nassella/authelia_postgres_user
-echo "$NASSELLA_AUTHELIA_POSTGRES_PASSWORD" > all-apps/nassella/authelia_postgres_password
-
-echo "$NASSELLA_LLDAP_POSTGRES_DB" > all-apps/nassella/lldap_postgres_db
-echo "$NASSELLA_LLDAP_POSTGRES_USER" > all-apps/nassella/lldap_postgres_user
-echo "$NASSELLA_LLDAP_POSTGRES_PASSWORD" > all-apps/nassella/lldap_postgres_password
@@ -1,39 +0,0 @@
-#!/bin/bash
-
-set -e
-set -a # export everything in the config for later use by envsubst
-
-. $1 # source the apps.config file with then env vars
-
-read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
-
-nassella_subdomain=
-
-for config_string in ${APP_CONFIGS[@]}; do
-    IFS=','
-    read -r -a config <<< "$config_string"
-
-    app=${config[0]}
-    subdomain=${config[1]}
-
-    if [ "$app" = "nassella" ]; then
-       nassella_subdomain="$subdomain"
-    fi
-done
-
-export NASSELLA_FULL_DOMAIN="$nassella_subdomain.$ROOT_DOMAIN"
-export NASSELLA_FULL_LLDAP_DOMAIN="$NASSELLA_LLDAP_SUBDOMAIN.$nassella_subdomain.$ROOT_DOMAIN"
-envsubst < all-apps/nassella/lldap-config/lldap_config.toml.tmpl > all-apps/nassella/lldap-config/lldap_config.toml
-
-# write secrets
-echo "$NASSELLA_POSTGRES_DB" > all-apps/nassella/postgres_db
-echo "$NASSELLA_POSTGRES_USER" > all-apps/nassella/postgres_user
-echo "$NASSELLA_POSTGRES_PASSWORD" > all-apps/nassella/postgres_password
-
-echo "$NASSELLA_AUTHELIA_POSTGRES_DB" > all-apps/nassella/authelia_postgres_db
-echo "$NASSELLA_AUTHELIA_POSTGRES_USER" > all-apps/nassella/authelia_postgres_user
-echo "$NASSELLA_AUTHELIA_POSTGRES_PASSWORD" > all-apps/nassella/authelia_postgres_password
-
-echo "$NASSELLA_LLDAP_POSTGRES_DB" > all-apps/nassella/lldap_postgres_db
-echo "$NASSELLA_LLDAP_POSTGRES_USER" > all-apps/nassella/lldap_postgres_user
-echo "$NASSELLA_LLDAP_POSTGRES_PASSWORD" > all-apps/nassella/lldap_postgres_password
@@ -1,31 +0,0 @@
-#!/bin/bash
-
-set -e
-
-. $1 # source the apps.config file with then env vars
-
-read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
-
-nextcloud_subdomain=
-
-for config_string in ${APP_CONFIGS[@]}; do
-    IFS=','
-    read -r -a config <<< "$config_string"
-
-    app=${config[0]}
-    subdomain=${config[1]}
-
-    if [ "$app" = "nextcloud" ]; then
-       nextcloud_subdomain="$subdomain"
-    fi
-done
-
-# write container env file
-echo "DOMAIN=\"$nextcloud_subdomain.$ROOT_DOMAIN\"" > all-apps/nextcloud/nextcloud.env
-cat all-apps/nextcloud/nextcloud.env.tmpl >> all-apps/nextcloud/nextcloud.env
-
-# write secrets
-echo "$NEXTCLOUD_POSTGRES_DB" > all-apps/nextcloud/nextcloud_postgres_db
-echo "$NEXTCLOUD_POSTGRES_USER" > all-apps/nextcloud/nextcloud_postgres_user
-echo "$NEXTCLOUD_POSTGRES_PASSWORD" > all-apps/nextcloud/nextcloud_postgres_password
-echo "$NEXTCLOUD_REDIS_PASSWORD" > all-apps/nextcloud/nextcloud_redis_password
@@ -1,5 +1,21 @@
 #!/bin/bash

+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 set -e

 . $1 # source the apps.config file with then env vars
@@ -1,5 +1,21 @@
 #!/bin/bash

+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 set -e

 . $1 # source the apps.config file with then env vars
@@ -0,0 +1,60 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+
+. $1 # source the apps.config file with then env vars
+
+read -r -a APP_CONFIGS <<< "$APP_CONFIGS"
+
+cat <<'EOF'
+services:
+  lb:
+    image: docker.io/caddy:2.11.4-alpine
+    env_file:
+      - ./lb/lb.env
+    volumes:
+      - ./lb/:/etc/caddy
+      - /nassella/lb/config:/config
+      - /nassella/lb/data:/data
+      - /app/maintenance:/maintenance
+    networks:
+      lb:
+        aliases:
+EOF
+
+for config_string in ${APP_CONFIGS[@]}; do
+    IFS=','
+    read -r -a config <<< "$config_string"
+
+    subdomain=${config[1]}
+
+    echo "          - $subdomain.$ROOT_DOMAIN"
+done
+
+cat <<'EOF'
+    restart: unless-stopped
+    ports:
+      - "443:443"
+      - "80:80"
+networks:
+  lb:
+    ipam:
+      config:
+        - subnet: 172.30.0.0/16
+EOF
@@ -1,4 +1,21 @@
 #!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 MARKER=/var/lib/firstboot.done

 if [ ! -f "$MARKER" ] && [ -n "$RESTIC_SNAPSHOT_ID" ]; then
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
+docker run --rm --volume /nassella:/nassella --volume /restic-password:/restic-password -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} -i restic/restic:0.18.0 backup --verbose --repo s3:${BACKBLAZE_BUCKET_URL} --password-file /restic-password --tag daily_automatic /nassella
+
+# only keep one snapshot per day for the last week and one snapshot per month for the last 3 months
+docker run --rm --volume /nassella:/nassella --volume /restic-password:/restic-password -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} -i restic/restic:0.18.0 forget --tag daily_automatic --keep-daily 7 --keep-monthly 3 --verbose --repo s3:${BACKBLAZE_BUCKET_URL} --password-file /restic-password /nassella
@@ -1,5 +1,21 @@
 #!/bin/bash

+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 # curl -X POST -H "Content-Type: application/json" -d '{"path":"/","tag":"test3","request_id":"1","version":0}' http://127.0.0.1:9000/hooks/queue-restic-snapshot

 pipe="/tmp/restic/snapshot_trigger_pipe"
@@ -1,5 +1,21 @@
 #!/bin/bash

+# Copyright 2025-2026 Thomas Hintz
+
+# This file is part of Nassella.
+
+# Nassella is free software: you can redistribute it and/or modify it under the
+# terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+
+# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
+
 set -e

 . $1 # source the apps.config file with then env vars
@@ -30,7 +30,7 @@ RUN chicken-install srfi-1 srfi-13 srfi-18 srfi-19 srfi-158 srfi-194 \
        sxml-transforms schematra \
        uri-common http-client medea intarweb \
        sql-null openssl postgresql crypto-tools \
-        hmac sha2 string-utils
+        hmac sha2 string-utils base64

 WORKDIR /var
 RUN mkdir nassella
@@ -43,10 +43,19 @@ COPY run.scm run.scm
 RUN csc -O3 -o nassella-run run.scm
 RUN chmod +x nassella-run

+FROM quay.io/coreos/butane:release AS butane
+FROM hashicorp/terraform:1.15 AS terraform
+FROM authelia/authelia:latest AS authelia
+
 FROM debian:trixie-slim
 RUN apt-get update && apt-get -y --no-install-recommends install \
- libpq-dev ca-certificates gettext-base openssh-client restic \
+ libpq-dev ca-certificates gettext-base openssh-client restic make \
 && rm -rf /var/lib/apt/lists/*
+
+COPY --from=butane /usr/local/bin/butane /usr/local/bin/butane
+COPY --from=terraform /bin/terraform /usr/local/bin/terraform
+COPY --from=authelia /app/authelia /usr/local/bin/authelia
+
 COPY --from=buildeggs /usr/local/ /usr/local/

 WORKDIR /var
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
tjhintz	863d839563	wip	2026-08-23 12:06:15 -07:00
tjhintz	12d014eda9	Allow force destroying an instance.	2026-07-27 16:21:01 -07:00
tjhintz	1c57b865b7	Fixing dashboard error when instance in progress.	2026-07-27 16:20:46 -07:00
tjhintz	85ad1c9311	Refactor authelia for logs to use file backed users.	2026-07-27 16:20:28 -07:00
tjhintz	38d718533c	Fixing terraform race condition.	2026-07-27 16:19:19 -07:00
tjhintz	cf1edb5d58	Upgrading terraform providers.	2026-07-27 16:18:34 -07:00
tjhintz	609a315c25	Adding "instance-up" deployment status.	2026-07-27 16:18:05 -07:00
tjhintz	bc301d6b29	Making the dashboard app display less confusing.	2026-07-25 11:02:09 -07:00
tjhintz	9f89356c85	Don't try to make a backup on inital deployment.	2026-07-25 11:00:20 -07:00
tjhintz	2721249a89	User selects backblaze bucket instead of providing bucket url	2026-07-25 10:02:25 -07:00
tjhintz	a64247de4e	Reworking backblaze bucket delete to handle all key types	2026-07-24 20:54:14 -07:00
tjhintz	420a7756af	Working delete instance for all cases.	2026-07-24 16:27:42 -07:00
tjhintz	1a0252de1a	Adding better support for undeployed instances.	2026-07-24 12:29:22 -07:00
tjhintz	d74e913023	Fixing nextcloud validation.	2026-07-24 12:28:35 -07:00
tjhintz	7ffbe713e9	Fixing restic call for non-docker envs	2026-07-24 12:28:15 -07:00
tjhintz	1a60f94b13	Improving theme, cleaning UI, adding validations.	2026-07-20 21:41:47 -07:00
tjhintz	8173b798a8	Re-sync db-init.sql	2026-07-20 21:41:01 -07:00
tjhintz	b492ff208f	Fixing nassella-in-production bugs.	2026-07-15 15:18:34 -07:00
tjhintz	321578a74a	Fixing backblaze connection test in prod setups.	2026-07-15 12:19:18 -07:00
tjhintz	7236c8854d	Fixing create-instance after app db refactor	2026-07-15 12:18:38 -07:00
tjhintz	7ee27178f9	Fixing missing Nassella make rules	2026-07-15 12:18:23 -07:00
tjhintz	f9bf59aa56	Fixing ghost docker config	2026-07-11 16:42:10 -07:00
tjhintz	1ff8b5348d	Bumping up flatcar version.	2026-07-11 14:37:55 -07:00
tjhintz	ce4882816b	Properly escape apps.config	2026-07-11 14:37:43 -07:00
tjhintz	ce948a86ce	Add retention policy for restic.	2026-07-11 13:44:26 -07:00
tjhintz	7bca829134	Actually test backblaze connection in wizard.	2026-07-11 13:07:39 -07:00
tjhintz	1019377cd8	Re-enable backups before deploy and cleanup old TODOs	2026-07-10 18:31:14 -07:00
tjhintz	4115922257	Moving /app tree in ignition to gzipped file	2026-07-10 18:04:13 -07:00
tjhintz	7ff7be6819	Adding back accidentally removed terraform lock	2026-07-10 18:03:49 -07:00
tjhintz	80684cadb9	Adding copyright and license info	2026-07-10 17:06:01 -07:00
tjhintz	5e4e21e352	Adding domains to lb docker aliases for loopback.	2026-07-08 15:20:41 -07:00
tjhintz	b8605f02ab	Adding lldap and authelia.	2026-07-08 14:48:54 -07:00
tjhintz	e62593bf44	Adding wordpress app.	2026-07-04 12:54:54 -07:00
tjhintz	422d2a38d2	Finishing make app refactor.	2026-07-03 10:14:03 -07:00
tjhintz	0f82b97ff6	Fixing update-selected-apps for dynamic app refactor.	2026-07-02 20:07:01 -07:00
tjhintz	04407b16b0	First stage refactor for dynamic app specs (napps.scm).	2026-07-02 19:39:56 -07:00