caddy: netbird proxy to k3s, flush_interval fixes, transport tuning

.gitignore

@@ -1,5 +1,3 @@
 Volumes
 .env
-Piped-Docker
 pterodactyl
-piped.yml

Caddyfile

@@ -2,6 +2,14 @@
 	acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
 }
 
+netbird.archfox.org {
+	@grpc header Content-Type application/grpc*
+	reverse_proxy @grpc h2c://10.0.1.135:80
+	@backend path /relay* /ws-proxy/* /api/* /oauth2/*
+	reverse_proxy @backend 10.0.1.135:80
+	reverse_proxy /* 10.0.1.135:80
+}
+
 matrix.archfox.org {
 	reverse_proxy continuwuity:6167
 }
@@ -19,25 +27,36 @@ searxng.archfox.org {
 }
 
 git.archfox.org {
-	reverse_proxy gitea:3000
-}
-
-jelly.archfox.org {
-	reverse_proxy jellyfin:8096 {
-		header_up +Content-Security-Policy "default-src https: data: blob:; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/accentlist.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/base.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/bottombarprogress.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/fixes.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/jf_font.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/overlayprogress.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/rounding.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/rounding_circlehover.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/smallercast.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/rounding_circlehover.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/cornerindicator/indicator_floating.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/cornerindicator/indicator_corner.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/effects/glassy.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/effects/pan-animation.css https://ctalvio.github.io/Monochromic/backdrop-hack_style.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/effects/hoverglow.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/effects/scrollfade.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/episodelist/episodes_compactlist.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/episodelist/episodes_grid.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/fields/fields_border.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/fields/fields_noborder.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/header/header_transparent.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/header/header_transparent-dashboard.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/login/login_frame.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/login/login_minimalistic.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/login/login_frame.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/presets/monochromic_preset.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/presets/kaleidochromic_preset.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/presets/novachromic_preset.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/titlepage/title_banner.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/titlepage/title_banner-logo.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/titlepage/title_simple.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/titlepage/title_simple-logo.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/type/light.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/type/dark.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/type/colorful.css https://cdn.jsdelivr.net/gh/CTalvio/Ultrachromic/type/dark_withaccent.css https://fonts.googleapis.com/css2; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'"
+	reverse_proxy gitea:3000 {
+		flush_interval -1
 	}
 }
 
+jelly.archfox.org {
+	reverse_proxy jellyfin:8096
+}
+
 vault.archfox.org {
-	reverse_proxy vaultwarden:80
+	reverse_proxy vaultwarden:80 {
+		flush_interval -1
+	}
 }
 
 aria.archfox.org {
-	reverse_proxy ariang:8080
+	reverse_proxy ariang:8080 {
+		flush_interval -1
+	}
 }
 
 nextcloud.archfox.org {
-	reverse_proxy 10.0.1.45:11000
+	reverse_proxy 10.0.1.45:11000 {
+		flush_interval -1
+		transport http {
+			versions 1.1
+			read_buffer 64KB
+			write_buffer 64KB
+		}
+	}
 }
 
 bookstack.archfox.org {
@@ -45,7 +64,9 @@ bookstack.archfox.org {
 }
 
 panel.archfox.org {
-	reverse_proxy tpanel:80
+	reverse_proxy tpanel:80 {
+		flush_interval -1
+	}
 
 	php_fastcgi unix//run/php/php8.3-fpm.sock {
 		root /var/www/pterodactyl/public
@@ -73,24 +94,26 @@ panel.archfox.org {
 	header Access-Control-Allow-Headers "Authorization, Content-Type"
 
 	request_body {
-		max_size 100m
+		max_size 100g
 	}
 
 	respond /.ht* 403
 }
 
 wings.archfox.org {
-	reverse_proxy twings:443
+	reverse_proxy twings:443 {
+		flush_interval -1
+	}
 }
 
-#omada.archfox.org {
-#	reverse_proxy host.docker.internal:8043 {
-#		transport http {
-#			tls_insecure_skip_verify
-#		}
-#		header_up Host "omada.archfox.org:443"
-#	}
-#}
+omada.archfox.org {
+	reverse_proxy host.docker.internal:8043 {
+		transport http {
+			tls_insecure_skip_verify
+		}
+		header_up Host "omada.archfox.org:443"
+	}
+}
 
 ai.archfox.org {
 	reverse_proxy open-webui:8080

docker-compose.d/Documentation/gitea.yml

@@ -14,12 +14,10 @@ services:
     restart: unless-stopped
     networks:
       - caddy
-
 networks:
   caddy:
     name: caddy
     external: true
-
 volumes:
   gitea:
     name: gitea

docker-compose.d/Media/continuwuity.yml

@@ -13,11 +13,13 @@ services:
       CONTINUWUITY_MAX_REQUEST_SIZE: 200000000
       CONTINUWUITY_ALLOW_REGISTRATION: 'true'
       CONTINUWUITY_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
-      CONTINUWUITY_REGISTRATION_TOKEN: 'Grandson-Clumsily-Riverboat2'
+      CONTINUWUITY_SUSPEND_ON_REGISTER: 'true'
       CONTINUWUITY_ALLOW_FEDERATION: 'true'
       CONTINUWUITY_ALLOW_CHECK_FOR_UPDATES: 'true'
       CONTINUWUITY_TRUSTED_SERVERS: '["matrix.org"]'
       CONTINUWUITY_ADDRESS: 0.0.0.0
       CONTINUWUITY_CONFIG: '/etc/continuwuity.toml'
+      CONTINUWUITY_TURN_URIS: '["turn:turn.archfox.org?transport=udp", "turn:turn.archfox.org?transport=tcp"]'
+      CONTINUWUITY_TURN_SECRET: ${COTURN_KEY}
     networks:
       - caddy

docker-compose.d/Media/coturn.yml

@@ -0,0 +1,8 @@
+services:
+  coturn:
+    image: docker.io/coturn/coturn
+    container_name: coturn
+    restart: always
+    network_mode: "host"
+    volumes:
+      - ${Volumes}/coturn/coturn.conf:/etc/coturn/turnserver.conf

docker-compose.d/Networking/caddy.yml

@@ -14,18 +14,17 @@ services:
       - caddy_srv:/srv
       - caddy_data:/data
       - caddy_config:/config
+      - /tmp:/tmp:ro
     environment:
       - CLOUDFLARE_API_TOKEN=${CF_CADDY_KEY}
     extra_hosts:
       - "host.docker.internal:host-gateway"
     networks:
       - caddy
-
 networks:
   caddy:
     name: caddy
     external: true
-
 volumes:
   caddy_config:
     name: caddy_config

docker-compose.d/Tools/nextcloud-aio.yml

@@ -14,7 +14,21 @@ services:
       - APACHE_IP_BINDING=0.0.0.0
       - NEXTCLOUD_MOUNT=/mnt/nextcloud/
       - NEXTCLOUD_MEMORY_LIMIT=4096M
-
+  nextcloud-mcp:
+    container_name: nextcloud-mcp
+    image: ghcr.io/cbcoutinho/nextcloud-mcp-server:latest
+    ports:
+      - 8000:8000
+    environment:
+      - NEXTCLOUD_HOST=https://nextcloud.archfox.org
+      - MCP_DEPLOYMENT_MODE=single_user_basic
+      - NEXTCLOUD_USERNAME=poslop
+      - NEXTCLOUD_PASSWORD=miatana
+      - TRANSPORT=streamable-http
+    #volumes:
+    # For persistent OAuth client storage
+    #- ./oauth-storage:/app/.oauth
+    restart: unless-stopped
 volumes:
   nextcloud_aio_mastercontainer:
     name: nextcloud_aio_mastercontainer

docker-compose.d/Tools/pterodactyl.yml.tmp

@@ -40,6 +40,7 @@ services:
       - ${DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock
       - /tmp/pterodactyl/:/tmp/pterodactyl/
       - ${TPATH}conf.d/daemon:/etc/pterodactyl
+      - /run/wings:/run/wings
     working_dir: ${DAEMON_DATA_DIRECTORY:-/var/lib/pterodactyl}
     networks:
       - pterodactyl_nw

docker-compose.d/Tools/qbit.yml

@@ -16,10 +16,8 @@ services:
     depends_on:
       gluetun:
         condition: service_healthy
-
-
   gluetun:
-    image: qmcgaw/gluetun:v3
+    image: qmcgaw/gluetun:latest
     cap_add:
       - NET_ADMIN
     container_name: gluetun
@@ -27,10 +25,10 @@ services:
       - VPN_SERVICE_PROVIDER=mullvad
       - VPN_TYPE=wireguard
       - WIREGUARD_PRIVATE_KEY=${MULLKEY}
-      - WIREGUARD_ADDRESSES=10.75.99.140/32
+      - WIREGUARD_ADDRESSES=10.67.20.141/32
       - SERVER_COUNTRIES=USA
       - SERVER_CITIES=Chicago IL
-      #- DNS_ADDRESS=10.64.0.1
+      - DNS_ADDRESS=10.64.0.1
     volumes:
       - gluetun:/gluetun
     devices:
@@ -42,13 +40,11 @@ services:
     restart: unless-stopped
     networks:
       - qbit
-
 volumes:
   qbittorrent:
     external: true
   gluetun:
     external: true
-
 networks:
   qbit:
     external: true

docker-compose.d/Tools/redbot.yml

@@ -6,7 +6,7 @@ services:
     volumes:
       - ${Volumes}/redbot/data:/data
     environment:
-      - TOKEN=MTQ1OTM0NzUwMDA1NzIzNTU2Mg.G7_CcI.xZCcpt_IxCkmbi-EpfQB-Mi2WanHAfkNE7aJsw
+      - TOKEN=${DISCORD_BOT_TOKEN}
       - PREFIX=.
       - TZ=America/Chicago
       - PUID=1000
@@ -14,7 +14,6 @@ services:
       - EXTRA_ARGS=--rpc --rpc-port 6133
     networks:
       - caddy
-
   reddash:
     command:
       - sh
@@ -32,7 +31,6 @@ services:
       redbot:
         condition: service_started
         required: true
-
 networks:
   caddy:
     name: caddy

docker-compose.d/Tools/searxng.yml

@@ -5,17 +5,11 @@ services:
     environment:
       - BASE_URL=https://searxng.archfox.org
     volumes:
-      - searxng:/etc/searxng
+      - ${Volumes}/searxng:/etc/searxng
     restart: unless-stopped
     networks:
       - caddy
-
 networks:
   caddy:
     name: caddy
     external: true
-
-volumes:
-  searxng:
-    name: searxng
-    external: true

docker-compose.d/Tools/watchtower.yml

@@ -1,6 +0,0 @@
-services:
-  watchtower:
-    container_name: watchtower
-    image: containrrr/watchtower
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock

scripts/caddyreload

@@ -1,2 +1,3 @@
 caddy_container_id=$(docker ps | grep caddy | awk '{print $1;}')
 docker exec -w /etc/caddy $caddy_container_id caddy reload
+docker exec -w /etc/caddy $caddy_container_id caddy fmt --overwrite

scripts/run-all.sh

@@ -13,6 +13,7 @@ services=(
     "Documentation/vaultwarden.yml"
     "Media/arr.yml"
     "Media/continuwuity.yml"
+    "Media/coturn.yml"
     "Media/jellyfin.yml"
     "Media/shoko.yml"
     "Networking/caddy.yml"
@@ -30,10 +31,27 @@ services=(
     "Tools/redbot.yml"
     "Tools/searxng.yml"
     "Tools/sftpgo.yml"
-    "Tools/watchtower.yml"
     "pterodactyl/docker-compose.yml"
 )
 
+# Initialize update flag
+UPDATE=false
+
+# Parse command line arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -u|--update)
+            UPDATE=true
+            shift
+            ;;
+        *)
+            echo "Unknown option: $1"
+            echo "Usage: $0 [-u|--update]"
+            exit 1
+            ;;
+    esac
+done
+
 # Start building the docker compose command with multiple -f flags
 COMPOSE_COMMAND="docker compose --env-file \"$ENV_FILE\""
 
@@ -42,10 +60,23 @@ for service in "${services[@]}"; do
     COMPOSE_COMMAND+=" -f \"$COMPOSE_DIR/$service\""
 done
 
+# If update flag is set, pull all images first
+if $UPDATE; then
+    COMPOSE_UPDATE_COMMAND="$COMPOSE_COMMAND pull"
+    echo "Pulling latest images..."
+    eval $COMPOSE_UPDATE_COMMAND
+    echo "Images pulled successfully."
+    echo ""
+fi
+
 # Add the up command to the final docker compose command
-COMPOSE_COMMAND+=" --profile panel --profile daemon up -d"
+COMPOSE_COMMAND+=" --profile panel --profile daemon up -d --remove-orphans"
 
 # Execute the composed command
 eval $COMPOSE_COMMAND
 
-echo "All services have been started."
+if $UPDATE; then
+    echo "All containers have been updated and started."
+else
+    echo "All services have been started."
+fi