From 4fe385f3b5ea086a1c7ba53bbf03cf10f7872c33 Mon Sep 17 00:00:00 2001 From: thesabear Date: Tue, 25 Aug 2026 08:58:45 +0300 Subject: [PATCH] stacks: add .env + .env.secrets.ctmpl for platform stacks, fix var-name mismatches Adds real Vault Agent secret templates and non-secret env vars for 14 platform stacks (caddy, caddy-internal, dashy, docker-socket- proxy, dockhand, gitea, grafana-stack, hawser, kestra, kopia, mosquitto, nocodb, node-red, speedtest-tracker), sanitized per the kv/host/... convention established for identity-and-security. Also fixes 6 variable-name mismatches discovered while cross-checking every new .env/.ctmpl against what its actual public compose file references (the public compose files were already adapted from the private originals during an earlier reorg pass, so names don't always match 1:1): authentik (PG_USER/PG_DB/PG_PASS), gitea (added GITEA_DOMAIN/GITEA_ROOT_URL, dropped an unused duplicate-instance pair of vars), grafana-stack (GRAFANA_ADMIN_PASSWORD), kestra (added USERNAME/PASSWORD), kopia (SECRET_PASSWORD), nocodb (JWT_SECRET). Also dropped an unused DOCKER var across most stacks where the compose file hardcodes its path instead of referencing it. --- stacks/identity-and-security/authentik/.env | 3 --- .../authentik/.env.secrets.ctmpl | 3 +-- stacks/identity-and-security/vaultwarden/.env | 2 -- stacks/identity-and-security/wazuh/.env | 1 - stacks/platform/caddy-internal/.env | 3 +++ stacks/platform/caddy/.env | 3 +++ stacks/platform/dashy/.env | 7 +++++++ stacks/platform/dockhand/.env | 2 ++ stacks/platform/gitea/.env | 17 +++++++++++++++ stacks/platform/gitea/.env.secrets.ctmpl | 1 + stacks/platform/grafana-stack/.env | 14 +++++++++++++ .../platform/grafana-stack/.env.secrets.ctmpl | 2 ++ stacks/platform/hawser/.env | 6 ++++++ stacks/platform/hawser/.env.secrets.ctmpl | 1 + stacks/platform/kestra/.env | 10 +++++++++ stacks/platform/kestra/.env.secrets.ctmpl | 2 ++ stacks/platform/kopia/.env | 7 +++++++ stacks/platform/kopia/.env.secrets.ctmpl | 1 + stacks/platform/mosquitto/.env | 2 ++ stacks/platform/nocodb/.env | 10 +++++++++ stacks/platform/nocodb/.env.secrets.ctmpl | 3 +++ stacks/platform/node-red/.env | 10 +++++++++ stacks/platform/node-red/.env.secrets.ctmpl | 21 +++++++++++++++++++ stacks/platform/speedtest-tracker/.env | 16 ++++++++++++++ .../speedtest-tracker/.env.secrets.ctmpl | 1 + 25 files changed, 140 insertions(+), 8 deletions(-) create mode 100644 stacks/platform/caddy-internal/.env create mode 100644 stacks/platform/caddy/.env create mode 100644 stacks/platform/dashy/.env create mode 100644 stacks/platform/dockhand/.env create mode 100644 stacks/platform/gitea/.env create mode 100644 stacks/platform/gitea/.env.secrets.ctmpl create mode 100644 stacks/platform/grafana-stack/.env create mode 100644 stacks/platform/grafana-stack/.env.secrets.ctmpl create mode 100644 stacks/platform/hawser/.env create mode 100644 stacks/platform/hawser/.env.secrets.ctmpl create mode 100644 stacks/platform/kestra/.env create mode 100644 stacks/platform/kestra/.env.secrets.ctmpl create mode 100644 stacks/platform/kopia/.env create mode 100644 stacks/platform/kopia/.env.secrets.ctmpl create mode 100644 stacks/platform/mosquitto/.env create mode 100644 stacks/platform/nocodb/.env create mode 100644 stacks/platform/nocodb/.env.secrets.ctmpl create mode 100644 stacks/platform/node-red/.env create mode 100644 stacks/platform/node-red/.env.secrets.ctmpl create mode 100644 stacks/platform/speedtest-tracker/.env create mode 100644 stacks/platform/speedtest-tracker/.env.secrets.ctmpl diff --git a/stacks/identity-and-security/authentik/.env b/stacks/identity-and-security/authentik/.env index 538abf7..302ea6e 100644 --- a/stacks/identity-and-security/authentik/.env +++ b/stacks/identity-and-security/authentik/.env @@ -3,9 +3,6 @@ AUTHENTIK_URL=https://authentik.local.example.com # Exposed HTTP port COMPOSE_PORT_HTTP=9000 -# Volume Home -DOCKER=/path/to/docker_volumes - AUTHENTIK_EMAIL__HOST=smtp.example.com AUTHENTIK_EMAIL__PORT=587 AUTHENTIK_EMAIL__USERNAME=notifications@example.com diff --git a/stacks/identity-and-security/authentik/.env.secrets.ctmpl b/stacks/identity-and-security/authentik/.env.secrets.ctmpl index d336c2a..048c4f7 100644 --- a/stacks/identity-and-security/authentik/.env.secrets.ctmpl +++ b/stacks/identity-and-security/authentik/.env.secrets.ctmpl @@ -1,4 +1,3 @@ AUTHENTIK_SECRET_KEY={{ with secret "kv/host/authentik" }}{{ .Data.data.authentik_secret_key }}{{ end }} AUTHENTIK_EMAIL__PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.email_password }}{{ end }} -POSTGRES_PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.pg_pass }}{{ end }} -AUTHENTIK_POSTGRESQL__PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.pg_pass }}{{ end }} +PG_PASS={{ with secret "kv/host/authentik" }}{{ .Data.data.pg_pass }}{{ end }} diff --git a/stacks/identity-and-security/vaultwarden/.env b/stacks/identity-and-security/vaultwarden/.env index f996ad0..c2999b3 100644 --- a/stacks/identity-and-security/vaultwarden/.env +++ b/stacks/identity-and-security/vaultwarden/.env @@ -8,5 +8,3 @@ TZ=Etc/UTC PUID=1000 PGID=1000 -# Volume Home -DOCKER=/path/to/docker_volumes diff --git a/stacks/identity-and-security/wazuh/.env b/stacks/identity-and-security/wazuh/.env index 727b7c3..24e3832 100644 --- a/stacks/identity-and-security/wazuh/.env +++ b/stacks/identity-and-security/wazuh/.env @@ -1,2 +1 @@ -DOCKER=/path/to/docker_volumes TZ=Etc/UTC diff --git a/stacks/platform/caddy-internal/.env b/stacks/platform/caddy-internal/.env new file mode 100644 index 0000000..97547e1 --- /dev/null +++ b/stacks/platform/caddy-internal/.env @@ -0,0 +1,3 @@ +# Exposed HTTP port +HTTPS_PORT=443 + diff --git a/stacks/platform/caddy/.env b/stacks/platform/caddy/.env new file mode 100644 index 0000000..97547e1 --- /dev/null +++ b/stacks/platform/caddy/.env @@ -0,0 +1,3 @@ +# Exposed HTTP port +HTTPS_PORT=443 + diff --git a/stacks/platform/dashy/.env b/stacks/platform/dashy/.env new file mode 100644 index 0000000..634e214 --- /dev/null +++ b/stacks/platform/dashy/.env @@ -0,0 +1,7 @@ +# Exposed HTTP port +HTTP_PORT=10981 + +# ID's +PUID=1000 +PGID=1000 + diff --git a/stacks/platform/dockhand/.env b/stacks/platform/dockhand/.env new file mode 100644 index 0000000..10248c5 --- /dev/null +++ b/stacks/platform/dockhand/.env @@ -0,0 +1,2 @@ +# Exposed HTTP port +HTTP_PORT=3030 diff --git a/stacks/platform/gitea/.env b/stacks/platform/gitea/.env new file mode 100644 index 0000000..d85035f --- /dev/null +++ b/stacks/platform/gitea/.env @@ -0,0 +1,17 @@ +# System +PUID=1000 +PGID=1000 +TZ=Etc/UTC + +# Ports +HTTP_PORT=3000 +SSH_PORT=2222 + +# Postgres (shared creds, separate DBs/instances) +# POSTGRES_PASSWORD — see .env.secrets (Vault) +POSTGRES_USER=gitea +POSTGRES_DB=gitea + +# App URL +GITEA_DOMAIN=gitea.local.example.com +GITEA_ROOT_URL=https://gitea.local.example.com/ diff --git a/stacks/platform/gitea/.env.secrets.ctmpl b/stacks/platform/gitea/.env.secrets.ctmpl new file mode 100644 index 0000000..6d3948b --- /dev/null +++ b/stacks/platform/gitea/.env.secrets.ctmpl @@ -0,0 +1 @@ +POSTGRES_PASSWORD={{ with secret "kv/host/gitea" }}{{ .Data.data.postgres_password }}{{ end }} diff --git a/stacks/platform/grafana-stack/.env b/stacks/platform/grafana-stack/.env new file mode 100644 index 0000000..a6b544b --- /dev/null +++ b/stacks/platform/grafana-stack/.env @@ -0,0 +1,14 @@ +# Exposed HTTP_PORT_prometheus +HTTP_PORT_prometheus=9796 + +# Exposed HTTP_PORT_grafana +HTTP_PORT_grafana=3693 + +# Exposed HTTP_PORT_loki +HTTP_PORT_loki=3100 + +GF_AUTH_GENERIC_OAUTH_CLIENT_ID=example-oauth-client-id +# GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET — see .env.secrets (Vault) +AUTHENTIK_URL=https://authentik.caddy.example.com +GRAFANA_URL=https://grafana.local.example.com +# GRAFANA_ADMIN_PASSWORD — see .env.secrets (Vault) diff --git a/stacks/platform/grafana-stack/.env.secrets.ctmpl b/stacks/platform/grafana-stack/.env.secrets.ctmpl new file mode 100644 index 0000000..b4e5b8a --- /dev/null +++ b/stacks/platform/grafana-stack/.env.secrets.ctmpl @@ -0,0 +1,2 @@ +GRAFANA_ADMIN_PASSWORD={{ with secret "kv/host/grafana-stack" }}{{ .Data.data.admin_password | replaceAll "$" "$$" }}{{ end }} +GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET={{ with secret "kv/host/grafana-stack" }}{{ .Data.data.oauth_client_secret | replaceAll "$" "$$" }}{{ end }} diff --git a/stacks/platform/hawser/.env b/stacks/platform/hawser/.env new file mode 100644 index 0000000..e0f2ec8 --- /dev/null +++ b/stacks/platform/hawser/.env @@ -0,0 +1,6 @@ +# Exposed HTTP_PORT +HTTP_PORT=2376 + +# System time zone +TZ=Etc/UTC + diff --git a/stacks/platform/hawser/.env.secrets.ctmpl b/stacks/platform/hawser/.env.secrets.ctmpl new file mode 100644 index 0000000..86dab18 --- /dev/null +++ b/stacks/platform/hawser/.env.secrets.ctmpl @@ -0,0 +1 @@ +TOKEN={{ with secret "kv/host/hawser" }}{{ .Data.data.token }}{{ end }} diff --git a/stacks/platform/kestra/.env b/stacks/platform/kestra/.env new file mode 100644 index 0000000..33ba2e1 --- /dev/null +++ b/stacks/platform/kestra/.env @@ -0,0 +1,10 @@ +# Exposed HTTP port +HTTP_PORT=10374 + +# Basic-auth login +USERNAME=admin@example.com + +# Postgres Creds +# POSTGRES_PASSWORD — see .env.secrets (Vault) +POSTGRES_USER=kestra +POSTGRES_DB=kestra diff --git a/stacks/platform/kestra/.env.secrets.ctmpl b/stacks/platform/kestra/.env.secrets.ctmpl new file mode 100644 index 0000000..87a7499 --- /dev/null +++ b/stacks/platform/kestra/.env.secrets.ctmpl @@ -0,0 +1,2 @@ +POSTGRES_PASSWORD={{ with secret "kv/host/kestra" }}{{ .Data.data.postgres_password }}{{ end }} +PASSWORD={{ with secret "kv/host/kestra" }}{{ .Data.data.ui_password }}{{ end }} diff --git a/stacks/platform/kopia/.env b/stacks/platform/kopia/.env new file mode 100644 index 0000000..ce179c4 --- /dev/null +++ b/stacks/platform/kopia/.env @@ -0,0 +1,7 @@ +# Exposed HTTP port +HTTP_PORT=51515 + +# System time zone +TZ=Etc/UTC + +USERNAME=user diff --git a/stacks/platform/kopia/.env.secrets.ctmpl b/stacks/platform/kopia/.env.secrets.ctmpl new file mode 100644 index 0000000..52054d9 --- /dev/null +++ b/stacks/platform/kopia/.env.secrets.ctmpl @@ -0,0 +1 @@ +SECRET_PASSWORD={{ with secret "kv/host/kopia" }}{{ .Data.data.secret_password }}{{ end }} diff --git a/stacks/platform/mosquitto/.env b/stacks/platform/mosquitto/.env new file mode 100644 index 0000000..03384b3 --- /dev/null +++ b/stacks/platform/mosquitto/.env @@ -0,0 +1,2 @@ +# Exposed HTTP_PORT +HTTP_PORT=1883 diff --git a/stacks/platform/nocodb/.env b/stacks/platform/nocodb/.env new file mode 100644 index 0000000..a99aaee --- /dev/null +++ b/stacks/platform/nocodb/.env @@ -0,0 +1,10 @@ +# Exposed HTTP port +HTTP_PORT=8090 + +# System time zone +TZ=Etc/UTC + + +# DB Creds +POSTGRES_DB=nocodb +POSTGRES_USER=nocodb diff --git a/stacks/platform/nocodb/.env.secrets.ctmpl b/stacks/platform/nocodb/.env.secrets.ctmpl new file mode 100644 index 0000000..27a697e --- /dev/null +++ b/stacks/platform/nocodb/.env.secrets.ctmpl @@ -0,0 +1,3 @@ +NC_DB=pg://nocodb_db:5432?u=nocodb&p={{ with secret "kv/host/nocodb" }}{{ .Data.data.postgres_password }}{{ end }}&d=nocodb +JWT_SECRET={{ with secret "kv/host/nocodb" }}{{ .Data.data.jwt_secret }}{{ end }} +POSTGRES_PASSWORD={{ with secret "kv/host/nocodb" }}{{ .Data.data.postgres_password }}{{ end }} diff --git a/stacks/platform/node-red/.env b/stacks/platform/node-red/.env new file mode 100644 index 0000000..60ba8d3 --- /dev/null +++ b/stacks/platform/node-red/.env @@ -0,0 +1,10 @@ +# Exposed HTTP port +HTTP_PORT=1856 + +# System time zone +TZ=Etc/UTC + +# ID's +PUID=1000 +PGID=1000 + diff --git a/stacks/platform/node-red/.env.secrets.ctmpl b/stacks/platform/node-red/.env.secrets.ctmpl new file mode 100644 index 0000000..f4c351c --- /dev/null +++ b/stacks/platform/node-red/.env.secrets.ctmpl @@ -0,0 +1,21 @@ +PAPERLESS_API_TOKEN={{ with secret "kv/host/node-red" }}{{ .Data.data.paperless_api_token }}{{ end }} +FIREFLY_API_TOKEN={{ with secret "kv/host/node-red" }}{{ .Data.data.firefly_api_token }}{{ end }} +{{ with secret "kv/host/node-red" }} +ABS_TOKEN={{ .Data.data.abs_token }} +AUTHENTIK_TOKEN={{ .Data.data.authentik_token }} +BAZARR_KEY={{ .Data.data.bazarr_key }} +JELLYFIN_KEY={{ .Data.data.jellyfin_key }} +KESTRA_PASS={{ .Data.data.kestra_pass }} +LIDARR_KEY={{ .Data.data.lidarr_key }} +NOCODB_TOKEN={{ .Data.data.nocodb_token }} +PBS_API_TOKEN={{ .Data.data.pbs_api_token }} +PVE_API_TOKEN={{ .Data.data.pve_api_token }} +RADARR_KEY={{ .Data.data.radarr_key }} +SEERR_KEY={{ .Data.data.seerr_key }} +SLACK_TOKEN={{ .Data.data.slack_token }} +SONARR_KEY={{ .Data.data.sonarr_key }} +TECHNITIUM_TOKEN={{ .Data.data.technitium_token }} +VAULT_TOKEN={{ .Data.data.vault_token }} +WAZUH_API_PASS={{ .Data.data.wazuh_api_pass }} +WAZUH_INDEXER_AUTH={{ .Data.data.wazuh_indexer_auth }} +{{ end }} diff --git a/stacks/platform/speedtest-tracker/.env b/stacks/platform/speedtest-tracker/.env new file mode 100644 index 0000000..4725d49 --- /dev/null +++ b/stacks/platform/speedtest-tracker/.env @@ -0,0 +1,16 @@ +# Exposed HTTP port +HTTPS_PORT=6443 + +# System time zone +TZ=Etc/UTC + +# Display time zone +DISPLAY_TIMEZONE=Etc/UTC + +# ID's +PUID=1000 +PGID=1000 + + +#App URL +APP_URL=https://speedtest-tracker.local.example.com diff --git a/stacks/platform/speedtest-tracker/.env.secrets.ctmpl b/stacks/platform/speedtest-tracker/.env.secrets.ctmpl new file mode 100644 index 0000000..53f5c4c --- /dev/null +++ b/stacks/platform/speedtest-tracker/.env.secrets.ctmpl @@ -0,0 +1 @@ +APP_KEY={{ with secret "kv/host/speedtest-tracker" }}{{ .Data.data.app_key }}{{ end }}