initial commit

.gitignore

@@ -0,0 +1,3 @@
+gitolite/.env
+ansible/.env
+ansible/known_hosts

Makefile

@@ -0,0 +1,44 @@
+images=backup buku ddclient gitolite gitolite-stagit git-daemon rss-bridge syncthing tasks tor vdirsyncer wallabag xandikos
+.PHONY: all $(images)
+all: $(images)
+
+BUILD = make -C $@
+
+backup:
+	$(BUILD)
+
+buku:
+	$(BUILD)
+
+ddclient:
+	$(BUILD)
+
+gitolite:
+	$(BUILD)
+
+gitolite-stagit:
+	$(BUILD)
+
+git-daemon:
+	$(BUILD)
+
+rss-bridge:
+	$(BUILD)
+
+syncthing:
+	$(BUILD)
+
+tasks:
+	$(BUILD)
+
+tor:
+	$(BUILD)
+
+vdirsyncer:
+	$(BUILD)
+
+xandikos:
+	$(BUILD)
+
+wallabag:
+	$(BUILD)

ansible/Dockerfile

@@ -0,0 +1,24 @@
+FROM alpine:3.12
+
+RUN apk add --no-cache openssh python3 py3-pip && \
+    apk add --no-cache --virtual .build-deps \
+        gcc \
+        libffi-dev \
+        musl-dev \
+        openssl-dev \
+        python3-dev && \
+    pip install \
+        ansible==2.9 \
+        cryptography \
+        mitogen && \
+    apk del .build-deps
+
+RUN apk add --no-cache openssl
+
+COPY get_password.sh /usr/local/bin/get_password
+RUN chmod +x /usr/local/bin/get_password
+
+COPY ansible.cfg /etc/ansible/ansible.cfg
+
+RUN mkdir -p /srv
+WORKDIR /srv

ansible/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = ansible
+
+.PHONY: build build-nc
+
+build: Dockerfile
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

ansible/ansible.cfg

@@ -0,0 +1,528 @@
+# Example config file for ansible -- https://ansible.com/
+# =======================================================
+
+# Nearly all parameters can be overridden in ansible-playbook
+# or with command line flags. Ansible will read ANSIBLE_CONFIG,
+# ansible.cfg in the current working directory, .ansible.cfg in
+# the home directory, or /etc/ansible/ansible.cfg, whichever it
+# finds first
+
+# For a full list of available options, run ansible-config list or see the
+# documentation: https://docs.ansible.com/ansible/latest/reference_appendices/config.html.
+
+[defaults]
+inventory       = /etc/ansible/hosts.yml
+interpreter_python = auto_silent
+#library         = ~/.ansible/plugins/modules:/usr/share/ansible/plugins/modules
+#module_utils    = ~/.ansible/plugins/module_utils:/usr/share/ansible/plugins/module_utils
+#remote_tmp      = ~/.ansible/tmp
+#local_tmp       = ~/.ansible/tmp
+#forks           = 5
+#poll_interval   = 0.001
+#ask_pass        = False
+#transport       = smart
+strategy_plugins = /usr/lib/python3.8/site-packages/ansible_mitogen/plugins/strategy
+strategy = mitogen_linear
+
+# Plays will gather facts by default, which contain information about
+# the remote system.
+#
+# smart - gather by default, but don't regather if already gathered
+# implicit - gather by default, turn off with gather_facts: False
+# explicit - do not gather by default, must say gather_facts: True
+#gathering = implicit
+
+# This only affects the gathering done by a play's gather_facts directive,
+# by default gathering retrieves all facts subsets
+# all - gather all subsets
+# network - gather min and network facts
+# hardware - gather hardware facts (longest facts to retrieve)
+# virtual - gather min and virtual facts
+# facter - import facts from facter
+# ohai - import facts from ohai
+# You can combine them using comma (ex: network,virtual)
+# You can negate them using ! (ex: !hardware,!facter,!ohai)
+# A minimal set of facts is always gathered.
+#
+#gather_subset = all
+
+# some hardware related facts are collected
+# with a maximum timeout of 10 seconds. This
+# option lets you increase or decrease that
+# timeout to something more suitable for the
+# environment.
+#
+#gather_timeout = 10
+
+# Ansible facts are available inside the ansible_facts.* dictionary
+# namespace. This setting maintains the behaviour which was the default prior
+# to 2.5, duplicating these variables into the main namespace, each with a
+# prefix of 'ansible_'.
+# This variable is set to True by default for backwards compatibility. It
+# will be changed to a default of 'False' in a future release.
+#
+#inject_facts_as_vars = True
+
+# Paths to search for collections, colon separated
+# collections_paths = ~/.ansible/collections:/usr/share/ansible/collections
+
+# Paths to search for roles, colon separated
+#roles_path = ~/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
+
+# Host key checking is enabled by default
+#host_key_checking = True
+
+# You can only have one 'stdout' callback type enabled at a time. The default
+# is 'default'. The 'yaml' or 'debug' stdout callback plugins are easier to read.
+#
+#stdout_callback = default
+#stdout_callback = yaml
+#stdout_callback = debug
+
+
+# Ansible ships with some plugins that require whitelisting,
+# this is done to avoid running all of a type by default.
+# These setting lists those that you want enabled for your system.
+# Custom plugins should not need this unless plugin author disables them
+# by default.
+#
+# Enable callback plugins, they can output to stdout but cannot be 'stdout' type.
+#callback_whitelist = timer, mail
+
+# Determine whether includes in tasks and handlers are "static" by
+# default. As of 2.0, includes are dynamic by default. Setting these
+# values to True will make includes behave more like they did in the
+# 1.x versions.
+#
+#task_includes_static = False
+#handler_includes_static = False
+
+# Controls if a missing handler for a notification event is an error or a warning
+#error_on_missing_handler = True
+
+# Default timeout for connection plugins
+#timeout = 10
+
+# Default user to use for playbooks if user is not specified
+# Uses the connection plugin's default, normally the user currently executing Ansible,
+# unless a different user is specified here.
+#
+#remote_user = root
+
+# Logging is off by default unless this path is defined.
+#log_path = /var/log/ansible.log
+
+# Default module to use when running ad-hoc commands
+#module_name = command
+
+# Use this shell for commands executed under sudo.
+# you may need to change this to /bin/bash in rare instances
+# if sudo is constrained.
+#
+#executable = /bin/sh
+
+# By default, variables from roles will be visible in the global variable
+# scope. To prevent this, set the following option to True, and only
+# tasks and handlers within the role will see the variables there
+#
+#private_role_vars = False
+
+# List any Jinja2 extensions to enable here.
+#jinja2_extensions = jinja2.ext.do,jinja2.ext.i18n
+
+# If set, always use this private key file for authentication, same as
+# if passing --private-key to ansible or ansible-playbook
+#
+#private_key_file = /path/to/file
+
+# If set, configures the path to the Vault password file as an alternative to
+# specifying --vault-password-file on the command line. This can also be
+# an executable script that returns the vault password to stdout.
+#
+vault_password_file = /usr/local/bin/get_password
+
+# Format of string {{ ansible_managed }} available within Jinja2
+# templates indicates to users editing templates files will be replaced.
+# replacing {file}, {host} and {uid} and strftime codes with proper values.
+#
+#ansible_managed = Ansible managed: {file} modified on %Y-%m-%d %H:%M:%S by {uid} on {host}
+
+# {file}, {host}, {uid}, and the timestamp can all interfere with idempotence
+# in some situations so the default is a static string:
+#
+#ansible_managed = Ansible managed
+
+# By default, ansible-playbook will display "Skipping [host]" if it determines a task
+# should not be run on a host. Set this to "False" if you don't want to see these "Skipping"
+# messages. NOTE: the task header will still be shown regardless of whether or not the
+# task is skipped.
+#
+#display_skipped_hosts = True
+
+# By default, if a task in a playbook does not include a name: field then
+# ansible-playbook will construct a header that includes the task's action but
+# not the task's args. This is a security feature because ansible cannot know
+# if the *module* considers an argument to be no_log at the time that the
+# header is printed. If your environment doesn't have a problem securing
+# stdout from ansible-playbook (or you have manually specified no_log in your
+# playbook on all of the tasks where you have secret information) then you can
+# safely set this to True to get more informative messages.
+#
+#display_args_to_stdout = False
+
+# Ansible will raise errors when attempting to dereference
+# Jinja2 variables that are not set in templates or action lines. Uncomment this line
+# to change this behavior.
+#
+#error_on_undefined_vars = False
+
+# Ansible may display warnings based on the configuration of the
+# system running ansible itself. This may include warnings about 3rd party packages or
+# other conditions that should be resolved if possible.
+# To disable these warnings, set the following value to False:
+#
+#system_warnings = True
+
+# Ansible may display deprecation warnings for language
+# features that should no longer be used and will be removed in future versions.
+# To disable these warnings, set the following value to False:
+#
+#deprecation_warnings = True
+
+# Ansible can optionally warn when usage of the shell and
+# command module appear to be simplified by using a default Ansible module
+# instead. These warnings can be silenced by adjusting the following
+# setting or adding warn=yes or warn=no to the end of the command line
+# parameter string. This will for example suggest using the git module
+# instead of shelling out to the git command.
+#
+#command_warnings = False
+
+
+# set plugin path directories here, separate with colons
+#action_plugins     = /usr/share/ansible/plugins/action
+#become_plugins     = /usr/share/ansible/plugins/become
+#cache_plugins      = /usr/share/ansible/plugins/cache
+#callback_plugins   = /usr/share/ansible/plugins/callback
+#connection_plugins = /usr/share/ansible/plugins/connection
+#lookup_plugins     = /usr/share/ansible/plugins/lookup
+#inventory_plugins  = /usr/share/ansible/plugins/inventory
+#vars_plugins       = /usr/share/ansible/plugins/vars
+#filter_plugins     = /usr/share/ansible/plugins/filter
+#test_plugins       = /usr/share/ansible/plugins/test
+#terminal_plugins   = /usr/share/ansible/plugins/terminal
+#strategy_plugins   = /usr/share/ansible/plugins/strategy
+
+
+# Ansible will use the 'linear' strategy but you may want to try another one.
+#strategy = linear
+
+# By default, callbacks are not loaded for /bin/ansible. Enable this if you
+# want, for example, a notification or logging callback to also apply to
+# /bin/ansible runs
+#
+#bin_ansible_callbacks = False
+
+
+# Don't like cows?  that's unfortunate.
+# set to 1 if you don't want cowsay support or export ANSIBLE_NOCOWS=1
+#nocows = 1
+
+# Set which cowsay stencil you'd like to use by default. When set to 'random',
+# a random stencil will be selected for each task. The selection will be filtered
+# against the `cow_whitelist` option below.
+#
+#cow_selection = default
+#cow_selection = random
+
+# When using the 'random' option for cowsay, stencils will be restricted to this list.
+# it should be formatted as a comma-separated list with no spaces between names.
+# NOTE: line continuations here are for formatting purposes only, as the INI parser
+#       in python does not support them.
+#
+#cow_whitelist=bud-frogs,bunny,cheese,daemon,default,dragon,elephant-in-snake,elephant,eyes,\
+#              hellokitty,kitty,luke-koala,meow,milk,moofasa,moose,ren,sheep,small,stegosaurus,\
+#              stimpy,supermilker,three-eyes,turkey,turtle,tux,udder,vader-koala,vader,www
+
+# Don't like colors either?
+# set to 1 if you don't want colors, or export ANSIBLE_NOCOLOR=1
+#
+#nocolor = 1
+
+# If set to a persistent type (not 'memory', for example 'redis') fact values
+# from previous runs in Ansible will be stored. This may be useful when
+# wanting to use, for example, IP information from one group of servers
+# without having to talk to them in the same playbook run to get their
+# current IP information.
+#
+#fact_caching = memory
+
+# This option tells Ansible where to cache facts. The value is plugin dependent.
+# For the jsonfile plugin, it should be a path to a local directory.
+# For the redis plugin, the value is a host:port:database triplet: fact_caching_connection = localhost:6379:0
+#
+#fact_caching_connection=/tmp
+
+# retry files
+# When a playbook fails a .retry file can be created that will be placed in ~/
+# You can enable this feature by setting retry_files_enabled to True
+# and you can change the location of the files by setting retry_files_save_path
+#
+#retry_files_enabled = False
+#retry_files_save_path = ~/.ansible-retry
+
+# prevents logging of task data, off by default
+#no_log = False
+
+# prevents logging of tasks, but only on the targets, data is still logged on the master/controller
+#no_target_syslog = False
+
+# Controls whether Ansible will raise an error or warning if a task has no
+# choice but to create world readable temporary files to execute a module on
+# the remote machine. This option is False by default for security. Users may
+# turn this on to have behaviour more like Ansible prior to 2.1.x. See
+# https://docs.ansible.com/ansible/latest/user_guide/become.html#becoming-an-unprivileged-user
+# for more secure ways to fix this than enabling this option.
+#
+#allow_world_readable_tmpfiles = False
+
+# Controls what compression method is used for new-style ansible modules when
+# they are sent to the remote system. The compression types depend on having
+# support compiled into both the controller's python and the client's python.
+# The names should match with the python Zipfile compression types:
+# * ZIP_STORED (no compression. available everywhere)
+# * ZIP_DEFLATED (uses zlib, the default)
+# These values may be set per host via the ansible_module_compression inventory variable.
+#
+#module_compression = 'ZIP_DEFLATED'
+
+# This controls the cutoff point (in bytes) on --diff for files
+# set to 0 for unlimited (RAM may suffer!).
+#
+#max_diff_size = 104448
+
+# Controls showing custom stats at the end, off by default
+#show_custom_stats = False
+
+# Controls which files to ignore when using a directory as inventory with
+# possibly multiple sources (both static and dynamic)
+#
+#inventory_ignore_extensions = ~, .orig, .bak, .ini, .cfg, .retry, .pyc, .pyo
+
+# This family of modules use an alternative execution path optimized for network appliances
+# only update this setting if you know how this works, otherwise it can break module execution
+#
+#network_group_modules=eos, nxos, ios, iosxr, junos, vyos
+
+# When enabled, this option allows lookups (via variables like {{lookup('foo')}} or when used as
+# a loop with `with_foo`) to return data that is not marked "unsafe". This means the data may contain
+# jinja2 templating language which will be run through the templating engine.
+# ENABLING THIS COULD BE A SECURITY RISK
+#
+#allow_unsafe_lookups = False
+
+# set default errors for all plays
+#any_errors_fatal = False
+
+
+[inventory]
+# List of enabled inventory plugins and the order in which they are used.
+#enable_plugins = host_list, script, auto, yaml, ini, toml
+
+# Ignore these extensions when parsing a directory as inventory source
+#ignore_extensions = .pyc, .pyo, .swp, .bak, ~, .rpm, .md, .txt, ~, .orig, .ini, .cfg, .retry
+
+# ignore files matching these patterns when parsing a directory as inventory source
+#ignore_patterns=
+
+# If 'True' unparsed inventory sources become fatal errors, otherwise they are warnings.
+#unparsed_is_failed = False
+
+
+[privilege_escalation]
+#become = False
+#become_method = sudo
+#become_ask_pass = False
+
+
+## Connection Plugins ##
+
+# Settings for each connection plugin go under a section titled '[[plugin_name]_connection]'
+# To view available connection plugins, run ansible-doc -t connection -l
+# To view available options for a connection plugin, run ansible-doc -t connection [plugin_name]
+# https://docs.ansible.com/ansible/latest/plugins/connection.html
+
+[paramiko_connection]
+# uncomment this line to cause the paramiko connection plugin to not record new host
+# keys encountered. Increases performance on new host additions. Setting works independently of the
+# host key checking setting above.
+#record_host_keys=False
+
+# by default, Ansible requests a pseudo-terminal for commands executed under sudo. Uncomment this
+# line to disable this behaviour.
+#pty = False
+
+# paramiko will default to looking for SSH keys initially when trying to
+# authenticate to remote devices. This is a problem for some network devices
+# that close the connection after a key failure. Uncomment this line to
+# disable the Paramiko look for keys function
+#look_for_keys = False
+
+# When using persistent connections with Paramiko, the connection runs in a
+# background process. If the host doesn't already have a valid SSH key, by
+# default Ansible will prompt to add the host key. This will cause connections
+# running in background processes to fail. Uncomment this line to have
+# Paramiko automatically add host keys.
+#host_key_auto_add = True
+
+
+[ssh_connection]
+# ssh arguments to use
+# Leaving off ControlPersist will result in poor performance, so use
+# paramiko on older platforms rather than removing it, -C controls compression use
+ssh_args = -C -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes
+
+# The base directory for the ControlPath sockets.
+# This is the "%(directory)s" in the control_path option
+#
+# Example:
+# control_path_dir = /tmp/.ansible/cp
+#control_path_dir = ~/.ansible/cp
+
+# The path to use for the ControlPath sockets. This defaults to a hashed string of the hostname,
+# port and username (empty string in the config). The hash mitigates a common problem users
+# found with long hostnames and the conventional %(directory)s/ansible-ssh-%%h-%%p-%%r format.
+# In those cases, a "too long for Unix domain socket" ssh error would occur.
+#
+# Example:
+# control_path = %(directory)s/%%C
+#control_path =
+
+# Enabling pipelining reduces the number of SSH operations required to
+# execute a module on the remote server. This can result in a significant
+# performance improvement when enabled, however when using "sudo:" you must
+# first disable 'requiretty' in /etc/sudoers
+#
+# By default, this option is disabled to preserve compatibility with
+# sudoers configurations that have requiretty (the default on many distros).
+#
+pipelining = True
+
+# Control the mechanism for transferring files (old)
+#   * smart = try sftp and then try scp [default]
+#   * True = use scp only
+#   * False = use sftp only
+#scp_if_ssh = smart
+
+# Control the mechanism for transferring files (new)
+# If set, this will override the scp_if_ssh option
+#   * sftp  = use sftp to transfer files
+#   * scp   = use scp to transfer files
+#   * piped = use 'dd' over SSH to transfer files
+#   * smart = try sftp, scp, and piped, in that order [default]
+#transfer_method = smart
+
+# If False, sftp will not use batch mode to transfer files. This may cause some
+# types of file transfer failures impossible to catch however, and should
+# only be disabled if your sftp version has problems with batch mode
+#sftp_batch_mode = False
+
+# The -tt argument is passed to ssh when pipelining is not enabled because sudo
+# requires a tty by default.
+#usetty = True
+
+# Number of times to retry an SSH connection to a host, in case of UNREACHABLE.
+# For each retry attempt, there is an exponential backoff,
+# so after the first attempt there is 1s wait, then 2s, 4s etc. up to 30s (max).
+#retries = 3
+
+
+[persistent_connection]
+# Configures the persistent connection timeout value in seconds. This value is
+# how long the persistent connection will remain idle before it is destroyed.
+# If the connection doesn't receive a request before the timeout value
+# expires, the connection is shutdown. The default value is 30 seconds.
+#connect_timeout = 30
+
+# The command timeout value defines the amount of time to wait for a command
+# or RPC call before timing out. The value for the command timeout must
+# be less than the value of the persistent connection idle timeout (connect_timeout)
+# The default value is 30 second.
+#command_timeout = 30
+
+
+## Become Plugins ##
+
+# Settings for become plugins go under a section named '[[plugin_name]_become_plugin]'
+# To view available become plugins, run ansible-doc -t become -l
+# To view available options for a specific plugin, run ansible-doc -t become [plugin_name]
+# https://docs.ansible.com/ansible/latest/plugins/become.html
+
+[sudo_become_plugin]
+#flags = -H -S -n
+#user = root
+
+
+[selinux]
+# file systems that require special treatment when dealing with security context
+# the default behaviour that copies the existing context or uses the user default
+# needs to be changed to use the file system dependent context.
+#special_context_filesystems=fuse,nfs,vboxsf,ramfs,9p,vfat
+
+# Set this to True to allow libvirt_lxc connections to work without SELinux.
+#libvirt_lxc_noseclabel = False
+
+
+[colors]
+#highlight = white
+#verbose = blue
+#warn = bright purple
+#error = red
+#debug = dark gray
+#deprecate = purple
+#skip = cyan
+#unreachable = red
+#ok = green
+#changed = yellow
+#diff_add = green
+#diff_remove = red
+#diff_lines = cyan
+
+
+[diff]
+# Always print diff when running ( same as always running with -D/--diff )
+#always = False
+
+# Set how many context lines to show in diff
+#context = 3
+
+[galaxy]
+# Controls whether the display wheel is shown or not
+#display_progress=
+
+# Validate TLS certificates for Galaxy server
+#ignore_certs = False
+
+# Role or collection skeleton directory to use as a template for
+# the init action in ansible-galaxy command
+#role_skeleton=
+
+# Patterns of files to ignore inside a Galaxy role or collection
+# skeleton directory
+#role_skeleton_ignore="^.git$", "^.*/.git_keep$"
+
+# Galaxy Server URL
+#server=https://galaxy.ansible.com
+
+# A list of Galaxy servers to use when installing a collection.
+#server_list=automation_hub, release_galaxy
+
+# Server specific details which are mentioned in server_list
+#[galaxy_server.automation_hub]
+#url=https://cloud.redhat.com/api/automation-hub/
+#auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
+#token=my_ah_token
+#
+#[galaxy_server.release_galaxy]
+#url=https://galaxy.ansible.com/
+#token=my_token

ansible/get_password.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+[ -n "$VAULT_PASSWORD" ] && echo "$VAULT_PASSWORD"

backup/Dockerfile

@@ -0,0 +1,6 @@
+FROM alpine:3.11
+
+RUN apk --no-cache add squashfs-tools
+COPY make_backup.sh /bin/make_backup
+RUN chmod +x /bin/make_backup
+CMD "/bin/make_backup"

backup/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = backup
+
+.PHONY: build build-nc
+
+build: Dockerfile make_backup.sh
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile make_backup.sh
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

backup/make_backup.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+
+if [ -n "$EXCLUDE" ]; then
+    dirs=$( \
+    	echo "${EXCLUDE}" | \
+		tr " " "\n" |  \
+		awk -F' ' '{print "/src/"$0}' | \
+		tr "\n" " " \
+    )
+    exclude_opt="-e ${dirs}"
+else
+    exclude_opt=""
+fi
+
+echo running:
+echo mksquashfs \
+    /src \
+    "/dest/$(date +%F).sfs" \
+    -comp gzip \
+    -xattrs \
+    -progress \
+    -mem 512M \
+    ${exclude_opt}
+
+mksquashfs \
+    /src \
+    "/dest/$(date +%F).sfs" \
+    -comp gzip \
+    -xattrs \
+    -progress \
+    -mem 512M \
+    ${exclude_opt}

buku/Dockerfile

@@ -0,0 +1,34 @@
+# buku
+
+FROM python:3.8-alpine3.11
+
+ENV BUKUSERVER_PORT=5001
+
+RUN apk add --no-cache --virtual .build-deps \
+        gcc \
+        openssl-dev \
+        musl-dev \
+        libffi-dev \
+        git && \
+    mkdir -p /usr/local/src && \
+    git clone https://github.com/jarun/buku /usr/local/src/buku && \
+    pip install -U --no-cache-dir \
+        pip \
+        gunicorn \
+        "/usr/local/src/buku[server]" && \
+    apk del .build-deps && \
+    rm -r /usr/local/src
+
+RUN adduser -u 1006 -h /var/lib/buku -D buku && \
+    adduser -u 1001 -D syncthing && addgroup syncthing buku && \
+    mkdir -p /var/lib/buku/.local/share/buku && \
+    chown -R buku:buku /var/lib/buku && \
+    chown -R syncthing:buku /var/lib/buku/.local/share/buku && \
+    chmod '2775' /var/lib/buku/.local/share/buku && \
+    touch /var/lib/buku/.local/share/buku/bookmarks.db && chmod '664' /var/lib/buku/.local/share/buku/bookmarks.db
+
+VOLUME /var/lib/buku/.local/share/buku
+EXPOSE ${BUKUSERVER_PORT}
+
+USER buku
+ENTRYPOINT gunicorn --bind "0.0.0.0:${BUKUSERVER_PORT}" "bukuserver.server:create_app()"

buku/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = buku
+
+.PHONY: build build-nc
+
+build: Dockerfile
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

ddclient/Dockerfile

@@ -0,0 +1,19 @@
+FROM alpine:3.12
+
+ENV VERSION 3.9.1
+ENV DL_URL https://github.com/ddclient/ddclient/archive/v${VERSION}.tar.gz
+#ENV PERL_MM_USE_DEFAULT 1
+
+RUN apk add --no-cache \
+        curl make wget \
+        perl perl-utils perl-test-taint perl-netaddr-ip perl-net-ip \
+        perl-yaml perl-log-log4perl perl-io-socket-ssl && \
+    curl -L http://cpanmin.us | perl - Data::Validate::IP && \
+    tmp=$(mktemp -d) && \
+    curl -L "${DL_URL}" --output "${tmp}/ddclient.tar.gz" && \
+    tar -xzf "${tmp}/ddclient.tar.gz" -C "${tmp}" && \
+    cp "${tmp}/ddclient-${VERSION}/ddclient" /usr/bin/ddclient && \
+    rm -r "${tmp}" && \
+    mkdir -p /etc/ddclient /var/cache/ddclient
+
+CMD ["/usr/bin/ddclient", "-foreground"]

ddclient/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = ddclient
+
+.PHONY: build build-nc
+
+build: Dockerfile
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

git-daemon/Dockerfile

@@ -0,0 +1,12 @@
+FROM alpine:3.12
+
+RUN apk --no-cache add \
+    fcgiwrap \
+    spawn-fcgi \
+    git-daemon
+
+COPY entrypoint /usr/local/bin/entrypoint
+RUN chmod +x /usr/local/bin/entrypoint
+
+ENTRYPOINT ["/usr/local/bin/entrypoint"]
+CMD "daemon"

git-daemon/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = git-daemon
+
+.PHONY: build build-nc
+
+build: Dockerfile entrypoint
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile entrypoint
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

git-daemon/entrypoint

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+case $1 in
+    daemon)
+        [ -n "$REPOS_DIR" ] && [ -d "$REPOS_DIR" ] && \
+            exec git daemon \
+                --reuseaddr \
+                --base-path=/var/lib/git/repositories \
+                /var/lib/git/repositories
+        ;;
+    fcgi)
+        FCGI_PORT=${FCGI_PORT:-9000}
+        exec spawn-fcgi -p "${FCGI_PORT}" -n /usr/bin/fcgiwrap
+        ;;
+    *)
+        exec "$@"
+esac

gitolite-stagit/Dockerfile

@@ -0,0 +1,46 @@
+FROM alpine:3.12
+
+RUN apk add --no-cache \
+        gitolite \
+        openssh-server \
+        su-exec \
+        libgit2 && \
+    apk add --no-cache --virtual .build-deps \
+        gcc \
+        make \
+        musl-dev \
+        libgit2-dev && \
+    git clone git://git.codemadness.org/stagit /tmp/stagit && \
+    make -C /tmp/stagit && \
+    make -C /tmp/stagit install && \
+    rm -r /tmp/stagit && \
+    apk del .build-deps && \
+    passwd -u git && \
+    mkdir -p /opt/gitolite-local/hooks/common
+
+COPY sshd_config /etc/ssh/sshd_config
+COPY gitolite.rc /var/lib/git/.gitolite.rc
+
+COPY bin/. /usr/local/bin/
+COPY local_code/. /opt/gitolite-local/
+
+RUN chown -R git:git /var/lib/git && \
+    chmod +x \
+        /usr/local/bin/entrypoint \
+        /usr/local/bin/build-stagit-index \
+        /usr/local/bin/build-stagit-repo \
+        /usr/local/bin/build-stagit-repos \
+        /usr/local/bin/set-url \
+        /usr/local/bin/set-urls \
+        /usr/local/bin/set-owner \
+        /usr/local/bin/set-owners \
+        /opt/gitolite-local/hooks/common/post-receive \
+        /opt/gitolite-local/triggers/build-stagit-index \
+        /opt/gitolite-local/triggers/build-stagit-repos \
+        /opt/gitolite-local/triggers/set-url \
+        /opt/gitolite-local/triggers/set-urls \
+        /opt/gitolite-local/triggers/set-owners \
+        /opt/gitolite-local/triggers/set-owner
+
+ENTRYPOINT ["/usr/local/bin/entrypoint"]
+CMD ["/usr/sbin/sshd", "-D", "-e"]

gitolite-stagit/Makefile

@@ -0,0 +1,16 @@
+USERNAME = rilla
+IMG_NAME = gitolite-stagit
+
+.PHONY: build build-nc
+
+BIN=$(wildcard bin/*)
+HOOKS=$(wildcard local_code/hooks/*)
+TRIGGERS=$(wildcard local_code/triggers/*)
+
+DEPS=Dockerfile $(BIN) $(HOOKS) $(TRIGGERS) gitolite.rc sshd_config
+
+build: $(DEPS)
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: $(DEPS)
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

gitolite-stagit/bin/build-stagit-index

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+set -e
+
+STAGIT_DIR="${STAGIT_DIR:-/var/lib/git/stagit}"
+GL_REPO_BASE="${GL_REPO_BASE:-/var/lib/git/repositories}"
+
+gitolite list-phy-repos | \
+    gitolite access % stagit R any | \
+    awk \
+        -F'\t' \
+        -v d="${GL_REPO_BASE}" \
+        '{if ($3 !~ "DENIED") print d"/"$1".git"}' | \
+    xargs -r /usr/local/bin/stagit-index | \
+    sed 's|\(<a href=".*\)/log.html\(">\)|\1\2|' > \
+    "${STAGIT_DIR}/index.html"

gitolite-stagit/bin/build-stagit-repo

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -e
+
+[ -z "${1}" ] && exit
+
+STAGIT_DIR="${STAGIT_DIR:-/var/lib/git/stagit}"
+GL_REPO_BASE="${GL_REPO_BASE:-/var/lib/git/repositories}"
+
+out_dir="${STAGIT_DIR}/${1}"
+repo_dir="${GL_REPO_BASE}/${1}.git"
+
+echo "running stagit for '${1}'"
+
+if gitolite access "${1}" stagit R any; then
+    mkdir -p "${out_dir}" && \
+    cd "${out_dir}" && \
+    /usr/local/bin/stagit "${repo_dir}" &&
+    ln -sf files.html index.html
+else
+    rm -rf "${out_dir}"
+fi

gitolite-stagit/bin/build-stagit-repos

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -e
+
+for repo in $(gitolite list-phy-repos); do
+    /usr/local/bin/build-stagit-repo "${repo}"
+done

gitolite-stagit/bin/entrypoint

@@ -0,0 +1,51 @@
+#!/bin/sh
+
+set -e
+
+env | awk -F"=" '{ print $1"=\""$2"\"" }' > /etc/env
+
+for algorithm in rsa dsa ecdsa ed25519; do
+    keyfile="/etc/ssh/keys/ssh_host_${algorithm}_key"
+    [ -f "$keyfile" ] || \
+        ssh-keygen -q -N '' -f "$keyfile" -t "$algorithm"
+done
+
+BASE_DIR=/var/lib/git
+
+echo "fixing permissions..."
+
+mkdir -p \
+    "${BASE_DIR}/.gitolite/conf" \
+    "${BASE_DIR}/.gitolite/hooks" \
+    "${BASE_DIR}/.gitolite/keydir" \
+    "${BASE_DIR}/.gitolite/logs"
+chown -R git:git \
+    "${BASE_DIR}/.gitolite" \
+    "${BASE_DIR}/.ssh" \
+    "${BASE_DIR}/stagit" \
+    "${BASE_DIR}/repositories"
+
+if [ ! -f "${BASE_DIR}/.ssh/authorized_keys" ]; then
+    if [ -z "$SSH_KEY" ]; then
+        echo "SSH_KEY needs to be set"
+        exit 1
+    fi
+    SSH_KEY_NAME=${SSH_KEY_NAME:-admin}
+    echo "$SSH_KEY" > "/tmp/${SSH_KEY_NAME}.pub"
+    echo "gitolite's initial setup"
+    su-exec git gitolite setup -pk "/tmp/${SSH_KEY_NAME}.pub"
+    rm "/tmp/${SSH_KEY_NAME}.pub"
+else
+    # stuff is already set up, but check the setup anyway
+    echo "gitolite's sanity setup"
+    su-exec git gitolite setup
+fi
+
+echo "building static site"
+su-exec git set-urls
+su-exec git set-owners
+su-exec git build-stagit-repos
+su-exec git build-stagit-index
+
+echo "gitolite is ready,starting sshd"
+exec "$@"

gitolite-stagit/bin/set-owner

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+set -e
+
+[ -z "$1" ] && exit 0
+
+GL_REPO_BASE="${GL_REPO_BASE:-/var/lib/git/repositories}"
+owner_file="${GL_REPO_BASE}/${1}.git/owner"
+
+if owner=$(gitolite git-config "${1}" gitweb.owner); then
+    echo "setting owner for '${1}'"
+    echo "${owner}" > "${owner_file}"
+else
+    echo "usetting owner for '${1}'"
+    rm -f "${owner_file}"
+fi

gitolite-stagit/bin/set-owners

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -e
+
+for repo in $(gitolite list-phy-repos); do
+    /usr/local/bin/set-owner "${repo}"
+done

gitolite-stagit/bin/set-url

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+set -e
+
+[ -z "$1" ] && exit 0
+
+GL_REPO_BASE="${GL_REPO_BASE:-/var/lib/git/repositories}"
+repo_dir="${GL_REPO_BASE}/${1}.git"
+
+# shellcheck disable=SC1091
+[ -z "${REPOS_URL}" ] && [ -f /etc/env ] && . /etc/env
+
+echo "setting url for '${1}'"
+if [ -z "$REPOS_URL" ]; then
+    echo "REPOS_URL not set"
+    exit 0
+fi
+[ -d "$repo_dir" ] && echo "${REPOS_URL}/${1}" > "${repo_dir}/url"

gitolite-stagit/bin/set-urls

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -e
+
+for repo in $(gitolite list-phy-repos); do
+    /usr/local/bin/set-url "${repo}"
+done

gitolite-stagit/gitolite.rc

@@ -0,0 +1,216 @@
+# configuration variables for gitolite
+
+# This file is in perl syntax.  But you do NOT need to know perl to edit it --
+# just mind the commas, use single quotes unless you know what you're doing,
+# and make sure the brackets and braces stay matched up!
+
+# (Tip: perl allows a comma after the last item in a list also!)
+
+# HELP for commands can be had by running the command with "-h".
+
+# HELP for all the other FEATURES can be found in the documentation (look for
+# "list of non-core programs shipped with gitolite" in the master index) or
+# directly in the corresponding source file.
+
+%RC = (
+
+    # ------------------------------------------------------------------
+
+    # default umask gives you perms of '0700'; see the rc file docs for
+    # how/why you might change this
+    UMASK                           =>  0077,
+
+    # look for "git-config" in the documentation
+    GIT_CONFIG_KEYS                 =>  'gitweb.description gitweb.owner',
+
+    # comment out if you don't need all the extra detail in the logfile
+    LOG_EXTRA                       =>  1,
+    # logging options
+    # 1. leave this section as is for 'normal' gitolite logging (default)
+    # 2. uncomment this line to log ONLY to syslog:
+    # LOG_DEST                      => 'syslog',
+    # 3. uncomment this line to log to syslog and the normal gitolite log:
+    # LOG_DEST                      => 'syslog,normal',
+    # 4. prefixing "repo-log," to any of the above will **also** log just the
+    #    update records to "gl-log" in the bare repo directory:
+    # LOG_DEST                      => 'repo-log,normal',
+    # LOG_DEST                      => 'repo-log,syslog',
+    # LOG_DEST                      => 'repo-log,syslog,normal',
+    # syslog 'facility': defaults to 'local0', uncomment if needed.  For example:
+    # LOG_FACILITY                  => 'local4',
+
+    # roles.  add more roles (like MANAGER, TESTER, ...) here.
+    #   WARNING: if you make changes to this hash, you MUST run 'gitolite
+    #   compile' afterward, and possibly also 'gitolite trigger POST_COMPILE'
+    ROLES => {
+        READERS                     =>  1,
+        WRITERS                     =>  1,
+    },
+
+    # enable caching (currently only Redis).  PLEASE RTFM BEFORE USING!!!
+    # CACHE                         =>  'Redis',
+
+    # ------------------------------------------------------------------
+
+    # rc variables used by various features
+
+    # the 'info' command prints this as additional info, if it is set
+        # SITE_INFO                 =>  'Please see http://blahblah/gitolite for more help',
+
+    # the CpuTime feature uses these
+        # display user, system, and elapsed times to user after each git operation
+        # DISPLAY_CPU_TIME          =>  1,
+        # display a warning if total CPU times (u, s, cu, cs) crosses this limit
+        # CPU_TIME_WARN_LIMIT       =>  0.1,
+
+    # the Mirroring feature needs this
+        # HOSTNAME                  =>  "foo",
+
+    # TTL for redis cache; PLEASE SEE DOCUMENTATION BEFORE UNCOMMENTING!
+        # CACHE_TTL                 =>  600,
+
+    # ------------------------------------------------------------------
+
+    # suggested locations for site-local gitolite code (see cust.html)
+
+        # this one is managed directly on the server
+        LOCAL_CODE => "/opt/gitolite-local",
+        #LOCAL_CODE => "$ENV{HOME}/local",
+
+        # or you can use this, which lets you put everything in a subdirectory
+        # called "local" in your gitolite-admin repo.  For a SECURITY WARNING
+        # on this, see http://gitolite.com/gitolite/non-core.html#pushcode
+        # LOCAL_CODE                =>  "$rc{GL_ADMIN_BASE}/local",
+
+    # ------------------------------------------------------------------
+
+    #POST_COMPILE => [],
+    POST_COMPILE => [
+        'set-urls',
+        'set-owners',
+        'build-stagit-repos',
+        'build-stagit-index'
+    ],
+
+    POST_CREATE => [
+        'set-url',
+        'set-owner'
+    ],
+
+    # List of commands and features to enable
+    ENABLE => [
+
+        # COMMANDS
+
+            # These are the commands enabled by default
+            'help',
+            'desc',
+            'info',
+            'perms',
+            'writable',
+
+            # Uncomment or add new commands here.
+            # 'create',
+            # 'fork',
+            # 'mirror',
+            # 'readme',
+            # 'sskm',
+            # 'D',
+
+        # These FEATURES are enabled by default.
+
+            # essential (unless you're using smart-http mode)
+            'ssh-authkeys',
+
+            # creates git-config entries from gitolite.conf file entries like 'config foo.bar = baz'
+            'git-config',
+
+            # creates git-daemon-export-ok files; if you don't use git-daemon, comment this out
+            'daemon',
+
+            # creates projects.list file; if you don't use gitweb, comment this out
+            #'gitweb',
+
+        # These FEATURES are disabled by default; uncomment to enable.  If you
+        # need to add new ones, ask on the mailing list :-)
+
+        # user-visible behaviour
+
+            # prevent wild repos auto-create on fetch/clone
+            # 'no-create-on-read',
+            # no auto-create at all (don't forget to enable the 'create' command!)
+            # 'no-auto-create',
+
+            # access a repo by another (possibly legacy) name
+            # 'Alias',
+
+            # give some users direct shell access.  See documentation in
+            # sts.html for details on the following two choices.
+            # "Shell $ENV{HOME}/.gitolite.shell-users",
+            # 'Shell alice bob',
+
+            # set default roles from lines like 'option default.roles-1 = ...', etc.
+            # 'set-default-roles',
+
+            # show more detailed messages on deny
+            # 'expand-deny-messages',
+
+            # show a message of the day
+            # 'Motd',
+
+        # system admin stuff
+
+            # enable mirroring (don't forget to set the HOSTNAME too!)
+            # 'Mirroring',
+
+            # allow people to submit pub files with more than one key in them
+            # 'ssh-authkeys-split',
+
+            # selective read control hack
+            # 'partial-copy',
+
+            # manage local, gitolite-controlled, copies of read-only upstream repos
+            # 'upstream',
+
+            # updates 'description' file instead of 'gitweb.description' config item
+            'cgit',
+
+            # allow repo-specific hooks to be added
+            #'repo-specific-hooks',
+
+        # performance, logging, monitoring...
+
+            # be nice
+            # 'renice 10',
+
+            # log CPU times (user, system, cumulative user, cumulative system)
+            # 'CpuTime',
+
+
+        # syntactic_sugar for gitolite.conf and included files
+
+            # allow backslash-escaped continuation lines in gitolite.conf
+            # 'continuation-lines',
+
+            # create implicit user groups from directory names in keydir/
+            # 'keysubdirs-as-groups',
+
+            # allow simple line-oriented macros
+            'macros',
+
+        # Kindergarten mode
+
+            # disallow various things that sensible people shouldn't be doing anyway
+            # 'Kindergarten',
+    ],
+
+);
+
+# ------------------------------------------------------------------------------
+# per perl rules, this should be the last line in such a file:
+1;
+
+# Local variables:
+# mode: perl
+# End:
+# vi: ft=perl

gitolite-stagit/local_code/hooks/common/post-receive

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -e
+
+[ -n "${GL_REPO}" ] && \
+    /usr/local/bin/set-url "${GL_REPO}" && \
+    /usr/local/bin/set-owner "${GL_REPO}" && \
+    /usr/local/bin/build-stagit-repo "${GL_REPO}"

gitolite-stagit/local_code/triggers/build-stagit-index

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+/usr/local/bin/build-stagit-index

gitolite-stagit/local_code/triggers/build-stagit-repos

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+/usr/local/bin/build-stagit-repos

gitolite-stagit/local_code/triggers/set-owner

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+[ -n "$2" ] && /usr/local/bin/set-owner "$2"

gitolite-stagit/local_code/triggers/set-owners

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+/usr/local/bin/set-owners

gitolite-stagit/local_code/triggers/set-url

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+[ -n "$2" ] && /usr/local/bin/set-url "$2"

gitolite-stagit/local_code/triggers/set-urls

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+/usr/local/bin/set-urls

gitolite-stagit/sshd_config

@@ -0,0 +1,23 @@
+Port 22
+Protocol 2
+
+PermitRootLogin no
+AllowUsers git
+
+PasswordAuthentication no
+PermitEmptyPasswords no
+PubkeyAuthentication yes
+
+HostKey /etc/ssh/keys/ssh_host_rsa_key
+HostKey /etc/ssh/keys/ssh_host_dsa_key
+HostKey /etc/ssh/keys/ssh_host_ecdsa_key
+HostKey /etc/ssh/keys/ssh_host_ed25519_key
+
+X11Forwarding no
+PrintMotd no
+
+ClientAliveInterval 300
+ClientAliveCountMax 2
+KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group18-sha512
+MACs umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
+HostKeyAlgorithms ssh-rsa,rsa-sha2-256,rsa-sha2-512

gitolite/Dockerfile

@@ -0,0 +1,36 @@
+FROM alpine:3.12
+
+RUN apk add --update --no-cache \
+        docker-compose \
+        docker \
+        git \
+        openssh-server \
+        perl  \
+        shadow \
+        su-exec
+
+RUN adduser -h /var/lib/git -D git && \
+    adduser git docker && \
+    mkdir -p /var/lib/git/local/hooks && \
+    chown -R git:git /var/lib/git && \
+    usermod -p '*' git && \
+    passwd -u git
+
+RUN mkdir -p /usr/local/src && \
+    git clone https://github.com/sitaramc/gitolite /usr/local/src/gitolite && \
+    /usr/local/src/gitolite/install -ln /usr/local/bin
+
+RUN mkdir -p /opt/docker-services
+
+COPY sshd_config /etc/ssh/sshd_config
+
+VOLUME /etc/ssh/keys
+VOLUME /var/lib/git
+
+COPY docker-entrypoint.sh /entrypoint
+RUN chmod +x /entrypoint
+ENTRYPOINT ["/entrypoint"]
+
+EXPOSE 22
+
+CMD ["/usr/sbin/sshd", "-D", "-e"]

gitolite/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = gitolite
+
+.PHONY: build build-nc
+
+build: Dockerfile docker-entrypoint.sh sshd_config
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile docker-entrypoint.sh sshd_config
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

gitolite/docker-entrypoint.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+
+set -xe
+
+[ -n "$DOCKER_GID" ] && groupmod -g "${DOCKER_GID}" docker
+
+for algorithm in rsa dsa ecdsa ed25519
+do
+    keyfile="/etc/ssh/keys/ssh_host_${algorithm}_key"
+    [ -f "$keyfile" ] || ssh-keygen -q -N '' -f "$keyfile" -t "$algorithm"
+done
+
+BASE_DIR=/var/lib/git
+
+echo "fixing gitolite's permissions..."
+find "${BASE_DIR}" \
+    -not -path "${BASE_DIR}/.gitolite.rc" \
+    -and -not -path "${BASE_DIR}/local/hooks/repo-specific*" \
+    -exec chown git:git {} \;
+
+if [ ! -f "${BASE_DIR}/.ssh/authorized_keys" ]
+then
+    if [ -n "$SSH_KEY" ]
+    then
+        [ -n "$SSH_KEY_NAME" ] || SSH_KEY_NAME="admin"
+	echo "$SSH_KEY" > "/tmp/${SSH_KEY_NAME}.pub"
+	echo "gitolite's initial setup"
+        su-exec git gitolite setup -pk "/tmp/${SSH_KEY_NAME}.pub"
+	rm "/tmp/${SSH_KEY_NAME}.pub"
+    else
+        echo "SSH_KEY needs to be set"
+	exit 1
+    fi
+else
+    # stuff is already set up, but check the setup anyway
+    echo "gitolite's sanity setup"
+    su-exec git gitolite setup
+fi
+
+echo "gitolite is ready,starting sshd"
+exec "$@"

gitolite/sshd_config

@@ -0,0 +1,23 @@
+Port 22
+Protocol 2
+
+PermitRootLogin no
+AllowUsers git
+
+PasswordAuthentication no
+PermitEmptyPasswords no
+PubkeyAuthentication yes
+
+HostKey /etc/ssh/keys/ssh_host_rsa_key
+HostKey /etc/ssh/keys/ssh_host_dsa_key
+HostKey /etc/ssh/keys/ssh_host_ecdsa_key
+HostKey /etc/ssh/keys/ssh_host_ed25519_key
+
+X11Forwarding no
+PrintMotd no
+
+ClientAliveInterval 300
+ClientAliveCountMax 2
+KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group18-sha512
+MACs umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
+HostKeyAlgorithms ssh-rsa,rsa-sha2-256,rsa-sha2-512

ledger-web/Dockerfile

@@ -0,0 +1,24 @@
+# ledger-web
+
+FROM python:3.8-slim-buster
+
+RUN apt-get update && \
+    apt-get install -y git g++ gosu && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN useradd -m ledger
+
+RUN git clone https://github.com/vifon/ledger-web /home/ledger/ledger-web
+
+RUN pip install -r /home/ledger/ledger-web/requirements.txt
+
+RUN mkdir -p /home/ledger/db
+VOLUME /home/ledger/db
+
+COPY docker-entrypoint.sh /entrypoint
+
+RUN chmod +x /entrypoint
+
+WORKDIR /home/ledger/ledger-web
+
+ENTRYPOINT ["/entrypoint"]

ledger-web/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = ledger-web
+
+.PHONY: build build-nc
+
+build: Dockerfile
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

ledger-web/docker-entrypoint.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+gosu ledger /home/ledger/ledger-web/manage.py makemigrations && \
+gosu ledger /home/ledger/ledger-web/manage.py migrate
+
+exec gosu ledger "$@"

ledger-web/settings.py

@@ -0,0 +1,136 @@
+"""
+Django settings for ledger project.
+
+Generated by 'django-admin startproject' using Django 2.1.7.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/2.1/topics/settings/
+
+For the full list of settings and their values, see
+https://docs.djangoproject.com/en/2.1/ref/settings/
+"""
+
+import os
+
+# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
+BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+
+# Quick-start development settings - unsuitable for production
+# See https://docs.djangoproject.com/en/2.1/howto/deployment/checklist/
+
+# SECURITY WARNING: keep the secret key used in production secret!
+SECRET_KEY = 'km&+&g_pcaj03g9dqhzg+qcg2)5bvu_rc*_n17!ol3571a8%u8'
+
+# SECURITY WARNING: don't run with debug turned on in production!
+DEBUG = True
+
+ALLOWED_HOSTS = []
+
+
+# Application definition
+
+INSTALLED_APPS = [
+    'ledger_ui.apps.LedgerUiConfig',
+    'ledger_query.apps.LedgerQueryConfig',
+    'ledger_submit.apps.LedgerSubmitConfig',
+    'accounts.apps.AccountsConfig',
+    'django.contrib.admin',
+    'django.contrib.auth',
+    'django.contrib.contenttypes',
+    'django.contrib.sessions',
+    'django.contrib.messages',
+    'django.contrib.staticfiles',
+]
+
+MIDDLEWARE = [
+    'django.middleware.security.SecurityMiddleware',
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django.contrib.messages.middleware.MessageMiddleware',
+    'ledger_ui.middleware.HandleExceptionsMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
+]
+
+ROOT_URLCONF = 'ledger.urls'
+
+TEMPLATES = [
+    {
+        'BACKEND': 'django.template.backends.django.DjangoTemplates',
+        'DIRS': [],
+        'APP_DIRS': True,
+        'OPTIONS': {
+            'context_processors': [
+                'django.template.context_processors.debug',
+                'django.template.context_processors.request',
+                'django.contrib.auth.context_processors.auth',
+                'django.contrib.messages.context_processors.messages',
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = 'ledger.wsgi.application'
+
+
+# Database
+# https://docs.djangoproject.com/en/2.1/ref/settings/#databases
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',
+        'NAME': '/home/ledger/db/db.sqlite3',
+    }
+}
+
+
+# Password validation
+# https://docs.djangoproject.com/en/2.1/ref/settings/#auth-password-validators
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
+    },
+]
+
+
+# Internationalization
+# https://docs.djangoproject.com/en/2.1/topics/i18n/
+
+LANGUAGE_CODE = 'en-us'
+
+TIME_ZONE = 'Europe/Warsaw'
+
+USE_I18N = True
+
+USE_L10N = True
+
+USE_TZ = True
+
+
+# Static files (CSS, JavaScript, Images)
+# https://docs.djangoproject.com/en/2.1/howto/static-files/
+
+STATIC_URL = '/static/'
+
+STATICFILES_DIRS = [
+    os.path.join(BASE_DIR, "static"),
+]
+
+LOGIN_REDIRECT_URL = 'ledger_ui:index'
+
+LEDGER_ENTRY_COUNT = 20
+LEDGER_DEFAULT_CURRENCY = '$'
+LEDGER_DEFAULT_FROM = 'Liabilities:Credit Card'
+LEDGER_DEFAULT_TO = 'Expenses:Uncategorized'

ledger-web/test.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+make && \
+    docker run -it \
+        -v $(pwd)/settings.py:/home/ledger/ledger-web/ledger/settings.py:ro \
+        -v $(pwd)/db:/home/ledger/db \
+        rilla/ledger-web \
+        bash

rss-bridge/Dockerfile

@@ -0,0 +1,20 @@
+FROM alpine:3.12
+
+RUN apk add --no-cache \
+        git su-exec nginx php7 php7-fpm \
+        php7-curl php7-json php7-mbstring php7-openssl php7-pecl-memcached \
+        php7-simplexml php7-sqlite3 php7-xml && \
+    sed -i.bak 's/^listen = 127.0.0.1:9000/listen = 9000/' /etc/php7/php-fpm.d/www.conf && \
+    mkdir -p /var/www && \
+    git clone https://github.com/RSS-Bridge/rss-bridge /var/www/rss-bridge  && \
+    adduser -D -h /var/www/rss-bridge rssbridge && \
+    chown -R rssbridge:rssbridge \
+        /var/www/rss-bridge \
+        /var/log/php7
+
+WORKDIR /var/www/rss-bridge
+
+COPY entrypoint.sh /entrypoint
+RUN chmod 700 /entrypoint
+ENTRYPOINT ["/entrypoint"]
+CMD ["rss-bridge"]

rss-bridge/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = rss-bridge
+
+.PHONY: build build-nc
+
+build: Dockerfile
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

rss-bridge/entrypoint.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+set -ex
+
+case $1 in
+    rss-bridge)
+        exec su-exec rssbridge php-fpm7 -F
+        ;;
+    nginx)
+        exec nginx -g 'daemon off;'
+        ;;
+    *)
+        exec su-exec rssbridge "$@"
+esac

syncthing/Dockerfile

@@ -0,0 +1,32 @@
+# syncthing
+
+FROM alpine:3.12
+
+ARG ARCH
+ENV VER v1.12.0
+ENV REL syncthing-linux-${ARCH}-${VER}
+ENV URI https://github.com/syncthing/syncthing/releases/download/${VER}/${REL}.tar.gz
+
+RUN apk add --no-cache su-exec
+
+RUN adduser -u 1001 -h /var/lib/syncthing -D syncthing && \
+    addgroup -S -g 1005 books && addgroup syncthing books && \
+    addgroup -S -g 1006 buku  && addgroup syncthing buku
+
+RUN mkdir -p /data       && chown -R syncthing:syncthing /data && \
+    mkdir -p /data/books && chown -R syncthing:books     /data/books && chmod '2775' /data/books && \
+    mkdir -p /data/buku  && chown -R syncthing:buku      /data/buku  && chmod '2775' /data/buku
+
+VOLUME /data /data/books /data/buku /var/lib/syncthing
+
+RUN cd /tmp && \
+    wget ${URI} && \
+    tar -xzf ${REL}.tar.gz && \
+    cp /tmp/${REL}/syncthing /usr/local/bin/syncthing && \
+    rm -r /tmp/${REL} /tmp/${REL}.tar.gz
+
+COPY docker-entrypoint.sh /entrypoint
+
+RUN chmod +x /entrypoint
+ENTRYPOINT ["/entrypoint"]
+CMD ["/usr/local/bin/syncthing", "-home=/var/lib/syncthing"]

syncthing/Makefile

@@ -0,0 +1,19 @@
+USERNAME = rilla
+IMG_NAME = syncthing
+
+.PHONY: build build-nc
+
+hw=$(shell uname -m)
+ifeq ($(hw), x86_64)
+	ARCH=amd64
+else ifeq ($(hw), aarch64)
+	ARCH=arm64
+else
+	ARCH=$(hw)
+endif
+
+build: Dockerfile docker-entrypoint.sh
+	docker build -t $(USERNAME)/$(IMG_NAME) --build-arg ARCH=$(ARCH) .
+
+build-nc: Dockerfile docker-entrypoint.sh
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) --build-arg ARCH=$(ARCH) .

syncthing/docker-entrypoint.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+chown -R syncthing:syncthing /data
+chown -R syncthing:syncthing /var/lib/syncthing
+chown -R syncthing:books /data/books
+chown -R syncthing:buku /data/buku && touch /data/buku/bookmarks.db && chmod '664' /data/buku/bookmarks.db
+chmod '2775' /data/books
+
+exec su-exec syncthing "$@"

tasks/Dockerfile

@@ -0,0 +1,10 @@
+FROM alpine:3.12
+
+RUN apk add --update --no-cache \
+        docker-compose \
+        docker
+
+COPY entrypoint.sh /entrypoint
+RUN chmod +x /entrypoint
+
+ENTRYPOINT ["/entrypoint"]

tasks/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = tasks
+
+.PHONY: build build-nc
+
+build: Dockerfile entrypoint.sh
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile entrypoint.sh
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

tasks/entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+[ -f /tasks/tasks.cron ] && crontab /tasks/tasks.cron
+
+if [ -n "$*" ]; then
+    exec "$@"
+else
+    exec crond -f -L /dev/stdout
+fi

tor/Dockerfile

@@ -0,0 +1,7 @@
+FROM alpine:3.12
+
+RUN apk add --no-cache tor su-exec shadow
+COPY entrypoint.sh /entrypoint
+RUN chmod +x entrypoint
+ENTRYPOINT ["/entrypoint"]
+CMD ["tor"]

tor/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = tor
+
+.PHONY: build build-nc
+
+build: Dockerfile
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

tor/entrypoint.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+set -xe
+
+[ -n "${USER_ID}" ] && usermod -u "${USER_ID}" tor
+
+for dir in $(awk '{if ($1 == "HiddenServiceDir") print $2}' /etc/tor/torrc)
+do
+    mkdir -p "${dir}"
+    chown tor "${dir}"
+    chmod 700 "${dir}"
+done
+
+su-exec tor "$@"

vdirsyncer/Dockerfile

@@ -0,0 +1,21 @@
+FROM alpine:3.11
+
+RUN apk add --no-cache python3 su-exec && \
+    apk add --no-cache --virtual .build-deps py3-pip && \
+    pip3 install --upgrade pip && \
+    pip3 install vdirsyncer vdirsyncer[google] requests_oauthlib && \
+    apk del .build-deps && \
+    adduser -D -h /var/lib/vdirsyncer vdirsyncer && \
+    mkdir -p /var/lib/vdirsyncer/status /var/lib/vdirsyncer/tokens && \
+    touch /var/lib/vdirsyncer/config && \
+    chown -R vdirsyncer:vdirsyncer /var/lib/vdirsyncer
+
+COPY crontab /crontab
+COPY entrypoint.sh /entrypoint
+COPY do_sync.sh /do_sync
+RUN chmod +x /entrypoint /do_sync
+
+ENTRYPOINT ["/entrypoint"]
+CMD ["task"]
+
+ENV VDIRSYNCER_CONFIG /var/lib/vdirsyncer/config

vdirsyncer/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = vdirsyncer
+
+.PHONY: build build-nc
+
+build: Dockerfile entrypoint.sh crontab do_sync.sh
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile entrypoint.sh crontab do_sync.sh
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

vdirsyncer/crontab

@@ -0,0 +1 @@
+*/15 * * * * /do_sync

vdirsyncer/do_sync.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+export VDIRSYNCER_CONFIG=/var/lib/vdirsyncer/config
+vdirsyncer discover && vdirsyncer sync

vdirsyncer/entrypoint.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+mkdir -p /var/lib/vdirsyncer/tokens /var/lib/vdirsyncer/status
+chown -R vdirsyncer:vdirsyncer \
+    /var/lib/vdirsyncer/tokens \
+    /var/lib/vdirsyncer/status
+
+export VDIRSYNCER_CONFIG=/var/lib/vdirsyncer/config
+
+case $1 in
+    discover)
+        exec su-exec vdirsyncer vdirsyncer "$@"
+        ;;
+    sync)
+        exec su-exec vdirsyncer vdirsyncer "$@"
+        ;;
+    task)
+        su-exec vdirsyncer vdirsyncer discover && \
+            /usr/bin/crontab -u vdirsyncer /crontab && \
+            exec /usr/sbin/crond -f -L /dev/stdout
+        ;;
+    *)
+        exec "$@"
+        ;;
+esac

wallabag/Dockerfile

@@ -0,0 +1,43 @@
+FROM alpine:3.12
+
+ARG WALLABAG_VERSION=2.4.0
+
+RUN apk --no-cache add \
+        git su-exec make nginx curl php7 \
+        php7-bcmath php7-ctype php7-curl php7-dom php7-fpm php7-gd \
+        php7-gettext php7-iconv php7-intl php7-json php7-mbstring \
+        php7-openssl php7-pdo_sqlite php7-phar php7-session php7-simplexml \
+        php7-sockets php7-tidy php7-tokenizer php7-xml php7-xmlreader
+
+RUN curl -s https://getcomposer.org/installer | php && \
+    mv composer.phar /usr/local/bin/composer
+
+RUN mkdir -p /etc/nginx /etc/php7
+COPY php-fpm.conf php.ini /etc/php7/
+
+RUN mkdir -p /var/www && \
+    git clone \
+        --branch $WALLABAG_VERSION \
+        --depth 1 \
+        https://github.com/wallabag/wallabag.git \
+        /var/www/wallabag
+
+COPY parameters.yml /var/www/wallabag/app/config/parameters.yml
+
+WORKDIR /var/www/wallabag
+
+RUN SYMFONY_ENV=prod composer install \
+        --no-dev \
+        -o \
+        --prefer-dist \
+        --no-progress
+
+RUN addgroup -g 1000 wallabag && \
+    adduser -D -h /var/www -G wallabag -u 1000 wallabag && \
+    chown -R wallabag:wallabag /var/www/wallabag
+
+COPY entrypoint.sh /entrypoint
+RUN chmod +x /entrypoint
+
+ENTRYPOINT ["/entrypoint"]
+CMD ["wallabag"]

wallabag/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = wallabag
+
+.PHONY: build build-nc
+
+build: Dockerfile
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

wallabag/entrypoint.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+
+set -ex
+
+INSTALL_DIR=/var/www/wallabag
+
+set_permissions () {
+    mkdir -p \
+        "${INSTALL_DIR}/data/assets" \
+        "${INSTALL_DIR}/data/db"
+    chown -R wallabag:wallabag "${INSTALL_DIR}/data" 
+}
+
+db_install () {
+    [ -f "${INSTALL_DIR}/data/db/wallabag.sqlite" ] || \
+        su-exec wallabag php "${INSTALL_DIR}/bin/console" \
+                    wallabag:install --env=prod -n
+}
+
+case $1 in
+    wallabag)
+	set_permissions
+	db_install
+        exec su-exec wallabag php-fpm7 -F
+        ;;
+    nginx)
+        exec nginx -c /etc/nginx/nginx.conf -g "daemon off;"
+        ;;
+    import)
+	set_permissions
+        exec su-exec wallabag "${INSTALL_DIR}/bin/console" \
+                wallabag:import:redis-worker -e=prod "$2" -vv
+        ;;
+    migrate)
+	set_permissions
+        exec su-exec wallabag "${INSTALL_DIR}/bin/console" \
+                doctrine:migrations:migrate --env=prod --no-interaction
+        ;;
+    *)
+	set_permissions
+        exec su-exec wallabag "$@"
+esac

wallabag/parameters.yml

@@ -0,0 +1,64 @@
+parameters:
+    database_driver: pdo_sqlite
+    database_host: 127.0.0.1
+    database_port: ~
+    database_name: symfony
+    database_user: root
+    database_password: ~
+    database_path: "%kernel.root_dir%/../data/db/wallabag.sqlite"
+    database_table_prefix: wallabag_
+    database_socket: null
+    database_charset: utf8
+    database_driver_class: null
+
+    domain_name: https://your-wallabag-url-instance.com
+
+    test_database_driver: pdo_sqlite
+    test_database_host: 127.0.0.1
+    test_database_port: ~
+    test_database_name: ~
+    test_database_user: ~
+    test_database_password: ~
+    test_database_path: "%kernel.root_dir%/../data/db/wallabag_test.sqlite"
+
+    mailer_transport:  smtp
+    mailer_user:       ~
+    mailer_password:   ~
+    mailer_host:       127.0.0.1
+    mailer_port:       false
+    mailer_encryption: ~
+    mailer_auth_mode:  ~
+
+    locale:            en
+
+    # A secret key that's used to generate certain security-related tokens
+    secret: ovmpmAWXRCabNlMgzlzFXDYmCFfzGv
+
+    # two factor stuff
+    twofactor_auth: true
+    twofactor_sender: no-reply@wallabag.org
+
+    # fosuser stuff
+    fosuser_registration: true
+    fosuser_confirmation: true
+
+    from_email: no-reply@wallabag.org
+
+    rss_limit: 50
+
+    # RabbitMQ processing
+    rabbitmq_host: localhost
+    rabbitmq_port: 5672
+    rabbitmq_user: guest
+    rabbitmq_password: guest
+    rabbitmq_prefetch_count: 10
+
+    # Redis processing
+    redis_scheme: tcp
+    redis_host: localhost
+    redis_port: 6379
+    redis_path: null
+    redis_password: null
+
+    # Sentry
+    sentry_dsn: ~

wallabag/php-fpm.conf

@@ -0,0 +1,539 @@
+;;;;;;;;;;;;;;;;;;;;;
+; FPM Configuration ;
+;;;;;;;;;;;;;;;;;;;;;
+
+; All relative paths in this configuration file are relative to PHP's install
+; prefix (/usr). This prefix can be dynamically changed by using the
+; '-p' argument from the command line.
+
+; Include one or more files. If glob(3) exists, it is used to include a bunch of
+; files from a glob(3) pattern. This directive can be used everywhere in the
+; file.
+; Relative path can also be used. They will be prefixed by:
+;  - the global prefix if it's been set (-p argument)
+;  - /usr otherwise
+;include=etc/fpm.d/*.conf
+
+;;;;;;;;;;;;;;;;;;
+; Global Options ;
+;;;;;;;;;;;;;;;;;;
+
+[global]
+; Pid file
+; Note: the default prefix is /var
+; Default Value: none
+;pid = run/php-fpm.pid
+
+; Error log file
+; If it's set to "syslog", log is sent to syslogd instead of being written
+; in a local file.
+; Note: the default prefix is /var
+; Default Value: log/php-fpm.log
+error_log = /dev/stdout
+
+; syslog_facility is used to specify what type of program is logging the
+; message. This lets syslogd specify that messages from different facilities
+; will be handled differently.
+; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)
+; Default Value: daemon
+;syslog.facility = daemon
+
+; syslog_ident is prepended to every message. If you have multiple FPM
+; instances running on the same server, you can change the default value
+; which must suit common needs.
+; Default Value: php-fpm
+;syslog.ident = php-fpm
+
+; Log level
+; Possible Values: alert, error, warning, notice, debug
+; Default Value: notice
+;log_level = notice
+
+; If this number of child processes exit with SIGSEGV or SIGBUS within the time
+; interval set by emergency_restart_interval then FPM will restart. A value
+; of '0' means 'Off'.
+; Default Value: 0
+;emergency_restart_threshold = 0
+
+; Interval of time used by emergency_restart_interval to determine when 
+; a graceful restart will be initiated.  This can be useful to work around
+; accidental corruptions in an accelerator's shared memory.
+; Available Units: s(econds), m(inutes), h(ours), or d(ays)
+; Default Unit: seconds
+; Default Value: 0
+;emergency_restart_interval = 0
+
+; Time limit for child processes to wait for a reaction on signals from master.
+; Available units: s(econds), m(inutes), h(ours), or d(ays)
+; Default Unit: seconds
+; Default Value: 0
+;process_control_timeout = 0
+
+; The maximum number of processes FPM will fork. This has been design to control
+; the global number of processes when using dynamic PM within a lot of pools.
+; Use it with caution.
+; Note: A value of 0 indicates no limit
+; Default Value: 0
+; process.max = 128
+
+; Specify the nice(2) priority to apply to the master process (only if set)
+; The value can vary from -19 (highest priority) to 20 (lower priority)
+; Note: - It will only work if the FPM master process is launched as root
+;       - The pool process will inherit the master process priority
+;         unless it specified otherwise
+; Default Value: no set
+; process.priority = -19
+
+; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.
+; Default Value: yes
+;daemonize = yes
+ 
+; Set open file descriptor rlimit for the master process.
+; Default Value: system defined value
+;rlimit_files = 1024
+ 
+; Set max core size rlimit for the master process.
+; Possible Values: 'unlimited' or an integer greater or equal to 0
+; Default Value: system defined value
+;rlimit_core = 0
+
+; Specify the event mechanism FPM will use. The following is available:
+; - select     (any POSIX os)
+; - poll       (any POSIX os)
+; - epoll      (linux >= 2.5.44)
+; - kqueue     (FreeBSD >= 4.1, OpenBSD >= 2.9, NetBSD >= 2.0)
+; - /dev/poll  (Solaris >= 7)
+; - port       (Solaris >= 10)
+; Default Value: not set (auto detection)
+;events.mechanism = epoll
+
+; When FPM is build with systemd integration, specify the interval,
+; in second, between health report notification to systemd.
+; Set to 0 to disable.
+; Available Units: s(econds), m(inutes), h(ours)
+; Default Unit: seconds
+; Default value: 10
+;systemd_interval = 10
+
+;;;;;;;;;;;;;;;;;;;;
+; Pool Definitions ; 
+;;;;;;;;;;;;;;;;;;;;
+
+; Multiple pools of child processes may be started with different listening
+; ports and different management options.  The name of the pool will be
+; used in logs and stats. There is no limitation on the number of pools which
+; FPM can handle. Your system will tell you anyway :)
+
+; Start a new pool named 'www'.
+; the variable $pool can we used in any directive and will be replaced by the
+; pool name ('www' here)
+[www]
+
+; Per pool prefix
+; It only applies on the following directives:
+; - 'access.log'
+; - 'slowlog'
+; - 'listen' (unixsocket)
+; - 'chroot'
+; - 'chdir'
+; - 'php_values'
+; - 'php_admin_values'
+; When not set, the global prefix (or /usr) applies instead.
+; Note: This directive can also be relative to the global prefix.
+; Default Value: none
+;prefix = /path/to/pools/$pool
+
+; Unix user/group of processes
+; Note: The user is mandatory. If the group is not set, the default user's group
+;       will be used.
+user = nobody
+group = nobody
+
+; The address on which to accept FastCGI requests.
+; Valid syntaxes are:
+;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
+;                            a specific port;
+;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
+;                            a specific port;
+;   'port'                 - to listen on a TCP socket to all IPv4 addresses on a
+;                            specific port;
+;   '[::]:port'            - to listen on a TCP socket to all addresses
+;                            (IPv6 and IPv4-mapped) on a specific port;
+;   '/path/to/unix/socket' - to listen on a unix socket.
+; Note: This value is mandatory.
+;listen = 127.0.0.1:9000
+listen = 0.0.0.0:9000
+
+; Set listen(2) backlog.
+; Default Value: 65535 (-1 on FreeBSD and OpenBSD)
+;listen.backlog = 65535
+
+; Set permissions for unix socket, if one is used. In Linux, read/write
+; permissions must be set in order to allow connections from a web server. Many
+; BSD-derived systems allow connections regardless of permissions. 
+; Default Values: user and group are set as the running user
+;                 mode is set to 0660
+;listen.owner = nobody
+;listen.group = nobody
+;listen.mode = 0660
+; When POSIX Access Control Lists are supported you can set them using
+; these options, value is a comma separated list of user/group names.
+; When set, listen.owner and listen.group are ignored
+;listen.acl_users =
+;listen.acl_groups =
+ 
+; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
+; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
+; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
+; must be separated by a comma. If this value is left blank, connections will be
+; accepted from any ip address.
+; Default Value: any
+;listen.allowed_clients = 127.0.0.1
+
+; Specify the nice(2) priority to apply to the pool processes (only if set)
+; The value can vary from -19 (highest priority) to 20 (lower priority)
+; Note: - It will only work if the FPM master process is launched as root
+;       - The pool processes will inherit the master process priority
+;         unless it specified otherwise
+; Default Value: no set
+; process.priority = -19
+
+; Choose how the process manager will control the number of child processes.
+; Possible Values:
+;   static  - a fixed number (pm.max_children) of child processes;
+;   dynamic - the number of child processes are set dynamically based on the
+;             following directives. With this process management, there will be
+;             always at least 1 children.
+;             pm.max_children      - the maximum number of children that can
+;                                    be alive at the same time.
+;             pm.start_servers     - the number of children created on startup.
+;             pm.min_spare_servers - the minimum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is less than this
+;                                    number then some children will be created.
+;             pm.max_spare_servers - the maximum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is greater than this
+;                                    number then some children will be killed.
+;  ondemand - no children are created at startup. Children will be forked when
+;             new requests will connect. The following parameter are used:
+;             pm.max_children           - the maximum number of children that
+;                                         can be alive at the same time.
+;             pm.process_idle_timeout   - The number of seconds after which
+;                                         an idle process will be killed.
+; Note: This value is mandatory.
+pm = dynamic
+
+; The number of child processes to be created when pm is set to 'static' and the
+; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
+; This value sets the limit on the number of simultaneous requests that will be
+; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
+; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
+; CGI. The below defaults are based on a server without much resources. Don't
+; forget to tweak pm.* to fit your needs.
+; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
+; Note: This value is mandatory.
+pm.max_children = 5
+
+; The number of child processes created on startup.
+; Note: Used only when pm is set to 'dynamic'
+; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
+pm.start_servers = 2
+
+; The desired minimum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.min_spare_servers = 1
+
+; The desired maximum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.max_spare_servers = 3
+
+; The number of seconds after which an idle process will be killed.
+; Note: Used only when pm is set to 'ondemand'
+; Default Value: 10s
+;pm.process_idle_timeout = 10s;
+ 
+; The number of requests each child process should execute before respawning.
+; This can be useful to work around memory leaks in 3rd party libraries. For
+; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
+; Default Value: 0
+;pm.max_requests = 500
+
+; The URI to view the FPM status page. If this value is not set, no URI will be
+; recognized as a status page. It shows the following informations:
+;   pool                 - the name of the pool;
+;   process manager      - static, dynamic or ondemand;
+;   start time           - the date and time FPM has started;
+;   start since          - number of seconds since FPM has started;
+;   accepted conn        - the number of request accepted by the pool;
+;   listen queue         - the number of request in the queue of pending
+;                          connections (see backlog in listen(2));
+;   max listen queue     - the maximum number of requests in the queue
+;                          of pending connections since FPM has started;
+;   listen queue len     - the size of the socket queue of pending connections;
+;   idle processes       - the number of idle processes;
+;   active processes     - the number of active processes;
+;   total processes      - the number of idle + active processes;
+;   max active processes - the maximum number of active processes since FPM
+;                          has started;
+;   max children reached - number of times, the process limit has been reached,
+;                          when pm tries to start more children (works only for
+;                          pm 'dynamic' and 'ondemand');
+; Value are updated in real time.
+; Example output:
+;   pool:                 www
+;   process manager:      static
+;   start time:           01/Jul/2011:17:53:49 +0200
+;   start since:          62636
+;   accepted conn:        190460
+;   listen queue:         0
+;   max listen queue:     1
+;   listen queue len:     42
+;   idle processes:       4
+;   active processes:     11
+;   total processes:      15
+;   max active processes: 12
+;   max children reached: 0
+;
+; By default the status page output is formatted as text/plain. Passing either
+; 'html', 'xml' or 'json' in the query string will return the corresponding
+; output syntax. Example:
+;   http://www.foo.bar/status
+;   http://www.foo.bar/status?json
+;   http://www.foo.bar/status?html
+;   http://www.foo.bar/status?xml
+;
+; By default the status page only outputs short status. Passing 'full' in the
+; query string will also return status for each pool process.
+; Example: 
+;   http://www.foo.bar/status?full
+;   http://www.foo.bar/status?json&full
+;   http://www.foo.bar/status?html&full
+;   http://www.foo.bar/status?xml&full
+; The Full status returns for each process:
+;   pid                  - the PID of the process;
+;   state                - the state of the process (Idle, Running, ...);
+;   start time           - the date and time the process has started;
+;   start since          - the number of seconds since the process has started;
+;   requests             - the number of requests the process has served;
+;   request duration     - the duration in µs of the requests;
+;   request method       - the request method (GET, POST, ...);
+;   request URI          - the request URI with the query string;
+;   content length       - the content length of the request (only with POST);
+;   user                 - the user (PHP_AUTH_USER) (or '-' if not set);
+;   script               - the main script called (or '-' if not set);
+;   last request cpu     - the %cpu the last request consumed
+;                          it's always 0 if the process is not in Idle state
+;                          because CPU calculation is done when the request
+;                          processing has terminated;
+;   last request memory  - the max amount of memory the last request consumed
+;                          it's always 0 if the process is not in Idle state
+;                          because memory calculation is done when the request
+;                          processing has terminated;
+; If the process is in Idle state, then informations are related to the
+; last request the process has served. Otherwise informations are related to
+; the current request being served.
+; Example output:
+;   ************************
+;   pid:                  31330
+;   state:                Running
+;   start time:           01/Jul/2011:17:53:49 +0200
+;   start since:          63087
+;   requests:             12808
+;   request duration:     1250261
+;   request method:       GET
+;   request URI:          /test_mem.php?N=10000
+;   content length:       0
+;   user:                 -
+;   script:               /home/fat/web/docs/php/test_mem.php
+;   last request cpu:     0.00
+;   last request memory:  0
+;
+; Note: There is a real-time FPM status monitoring sample web page available
+;       It's available in: /usr/share/php/fpm/status.html
+;
+; Note: The value must start with a leading slash (/). The value can be
+;       anything, but it may not be a good idea to use the .php extension or it
+;       may conflict with a real PHP file.
+; Default Value: not set 
+;pm.status_path = /status
+ 
+; The ping URI to call the monitoring page of FPM. If this value is not set, no
+; URI will be recognized as a ping page. This could be used to test from outside
+; that FPM is alive and responding, or to
+; - create a graph of FPM availability (rrd or such);
+; - remove a server from a group if it is not responding (load balancing);
+; - trigger alerts for the operating team (24/7).
+; Note: The value must start with a leading slash (/). The value can be
+;       anything, but it may not be a good idea to use the .php extension or it
+;       may conflict with a real PHP file.
+; Default Value: not set
+;ping.path = /ping
+
+; This directive may be used to customize the response of a ping request. The
+; response is formatted as text/plain with a 200 response code.
+; Default Value: pong
+;ping.response = pong
+
+; The access log file
+; Default: not set
+;access.log = log/$pool.access.log
+access.log = /dev/stdout
+
+; The access log format.
+; The following syntax is allowed
+;  %%: the '%' character
+;  %C: %CPU used by the request
+;      it can accept the following format:
+;      - %{user}C for user CPU only
+;      - %{system}C for system CPU only
+;      - %{total}C  for user + system CPU (default)
+;  %d: time taken to serve the request
+;      it can accept the following format:
+;      - %{seconds}d (default)
+;      - %{miliseconds}d
+;      - %{mili}d
+;      - %{microseconds}d
+;      - %{micro}d
+;  %e: an environment variable (same as $_ENV or $_SERVER)
+;      it must be associated with embraces to specify the name of the env
+;      variable. Some exemples:
+;      - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
+;      - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
+;  %f: script filename
+;  %l: content-length of the request (for POST request only)
+;  %m: request method
+;  %M: peak of memory allocated by PHP
+;      it can accept the following format:
+;      - %{bytes}M (default)
+;      - %{kilobytes}M
+;      - %{kilo}M
+;      - %{megabytes}M
+;      - %{mega}M
+;  %n: pool name
+;  %o: output header
+;      it must be associated with embraces to specify the name of the header:
+;      - %{Content-Type}o
+;      - %{X-Powered-By}o
+;      - %{Transfert-Encoding}o
+;      - ....
+;  %p: PID of the child that serviced the request
+;  %P: PID of the parent of the child that serviced the request
+;  %q: the query string 
+;  %Q: the '?' character if query string exists
+;  %r: the request URI (without the query string, see %q and %Q)
+;  %R: remote IP address
+;  %s: status (response code)
+;  %t: server time the request was received
+;      it can accept a strftime(3) format:
+;      %d/%b/%Y:%H:%M:%S %z (default)
+;  %T: time the log has been written (the request has finished)
+;      it can accept a strftime(3) format:
+;      %d/%b/%Y:%H:%M:%S %z (default)
+;  %u: remote user
+;
+; Default: "%R - %u %t \"%m %r\" %s"
+;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
+ 
+; The log file for slow requests
+; Default Value: not set
+; Note: slowlog is mandatory if request_slowlog_timeout is set
+;slowlog = log/$pool.log.slow
+ 
+; The timeout for serving a single request after which a PHP backtrace will be
+; dumped to the 'slowlog' file. A value of '0s' means 'off'.
+; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
+; Default Value: 0
+;request_slowlog_timeout = 0
+ 
+; The timeout for serving a single request after which the worker process will
+; be killed. This option should be used when the 'max_execution_time' ini option
+; does not stop script execution for some reason. A value of '0' means 'off'.
+; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
+; Default Value: 0
+;request_terminate_timeout = 0
+ 
+; Set open file descriptor rlimit.
+; Default Value: system defined value
+;rlimit_files = 1024
+ 
+; Set max core size rlimit.
+; Possible Values: 'unlimited' or an integer greater or equal to 0
+; Default Value: system defined value
+;rlimit_core = 0
+ 
+; Chroot to this directory at the start. This value must be defined as an
+; absolute path. When this value is not set, chroot is not used.
+; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
+; of its subdirectories. If the pool prefix is not set, the global prefix
+; will be used instead.
+; Note: chrooting is a great security feature and should be used whenever 
+;       possible. However, all PHP paths will be relative to the chroot
+;       (error_log, sessions.save_path, ...).
+; Default Value: not set
+;chroot = 
+ 
+; Chdir to this directory at the start.
+; Note: relative path can be used.
+; Default Value: current directory or / when chroot
+;chdir = /var/www
+ 
+; Redirect worker stdout and stderr into main error log. If not set, stdout and
+; stderr will be redirected to /dev/null according to FastCGI specs.
+; Note: on highloaded environement, this can cause some delay in the page
+; process time (several ms).
+; Default Value: no
+;catch_workers_output = yes
+
+; Clear environment in FPM workers
+; Prevents arbitrary environment variables from reaching FPM worker processes
+; by clearing the environment in workers before env vars specified in this
+; pool configuration are added.
+; Setting to "no" will make all environment variables available to PHP code
+; via getenv(), $_ENV and $_SERVER.
+; Default Value: yes
+;clear_env = no
+
+; Limits the extensions of the main script FPM will allow to parse. This can
+; prevent configuration mistakes on the web server side. You should only limit
+; FPM to .php extensions to prevent malicious users to use other extensions to
+; exectute php code.
+; Note: set an empty value to allow all extensions.
+; Default Value: .php
+;security.limit_extensions = .php .php3 .php4 .php5
+ 
+; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
+; the current environment.
+; Default Value: clean env
+;env[HOSTNAME] = $HOSTNAME
+env[PATH] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+;env[TMP] = /tmp
+;env[TMPDIR] = /tmp
+;env[TEMP] = /tmp
+
+; Additional php.ini defines, specific to this pool of workers. These settings
+; overwrite the values previously defined in the php.ini. The directives are the
+; same as the PHP SAPI:
+;   php_value/php_flag             - you can set classic ini defines which can
+;                                    be overwritten from PHP call 'ini_set'. 
+;   php_admin_value/php_admin_flag - these directives won't be overwritten by
+;                                     PHP call 'ini_set'
+; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
+
+; Defining 'extension' will load the corresponding shared extension from
+; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
+; overwrite previously defined php.ini values, but will append the new value
+; instead.
+
+; Note: path INI options can be relative and will be expanded with the prefix
+; (pool, global or /usr)
+
+; Default Value: nothing is defined by default except the values in php.ini and
+;                specified at startup with the -d argument
+;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
+;php_flag[display_errors] = off
+;php_admin_value[error_log] = /var/log/fpm-php.www.log
+;php_admin_flag[log_errors] = on
+;php_admin_value[memory_limit] = 32M

xandikos/Dockerfile

@@ -0,0 +1,30 @@
+FROM alpine:3.11
+
+RUN apk add --no-cache \
+        git \
+        python3 \
+        su-exec && \
+    apk add --no-cache --virtual .build-deps \
+        gcc \
+        musl-dev \
+        py3-pip \
+        python3-dev && \
+    pip3 install --upgrade pip && \
+    pip3 install \
+        aiohttp \
+        defusedxml \
+        dulwich \
+        icalendar \
+        jinja2 \
+        prometheus-client && \
+    apk del .build-deps && \
+    mkdir -p /opt && \
+    git clone https://github.com/jelmer/xandikos /opt/xandikos && \
+    adduser -D -h /var/lib/xandikos xandikos && \
+    mkdir -p /var/lib/xandikos/data && \
+    chown -R xandikos:xandikos /var/lib/xandikos
+
+COPY entrypoint.sh /entrypoint
+RUN chmod +x /entrypoint
+ENTRYPOINT ["/entrypoint"]
+CMD ["xandikos"]

xandikos/Makefile

@@ -0,0 +1,10 @@
+USERNAME = rilla
+IMG_NAME = xandikos
+
+.PHONY: build build-nc
+
+build: Dockerfile entrypoint.sh
+	docker build -t $(USERNAME)/$(IMG_NAME) .
+
+build-nc: Dockerfile entrypoint.sh
+	docker build --no-cache -t $(USERNAME)/$(IMG_NAME) .

xandikos/entrypoint.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+
+set -xe
+
+PORT=${PORT:-8000}
+ROUTE_PREFIX=${ROUTE_PREFIX:-/}
+
+current_user_principal="/user"
+
+chown -R xandikos:xandikos /var/lib/xandikos
+
+case $1 in
+    xandikos)
+        cd /opt/xandikos
+        exec su-exec xandikos python3 -m xandikos.web \
+                --port="${PORT}" \
+                --listen-address='0.0.0.0' \
+                -d /var/lib/xandikos/data \
+                --current-user-principal="${current_user_principal}" \
+                --route-prefix "${ROUTE_PREFIX}" \
+                --autocreate \
+                --defaults
+        ;;
+    *)
+        exec "$@"
+        ;;
+esac
+