stacks: add nextcloud Dockerfiles, fix a broken kodi compose edit

Adds the two Dockerfiles nextcloud's compose build: contexts were
already referencing but never had (custom smbclient support for the
main container, a documentserver base for euro-office) - both had
their real internal-CA-trust mechanism replaced with a comment
explaining what's there and why, per the standing rule against
publishing that detail.

Also fixes a compose bug: kodi-ma-bridge's `environment:` key had
been dropped, leaving KEY=value pairs nested under `env_file:` (which
expects file paths, not inline vars) - would have made docker-compose
try to open a file literally named `TZ=${TZ}`.

Rest of this commit is manual cleanup (comment tidying, dropped
personal media-library volume mounts, a couple of .env comment
trims).

stacks/identity-and-security/wazuh/docker-compose.yaml

@@ -1,5 +1,4 @@
 name: single-node
-# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.manager:
     image: wazuh/wazuh-manager:4.14.6
@@ -18,7 +17,7 @@ services:
       - "514:514/udp"
       - "55000:55000"
     env_file:
-      - .env.secrets   # INDEXER_PASSWORD, API_PASSWORD — never committed
+      - .env.secrets
     environment:
       - TZ=${TZ}
       - INDEXER_URL=https://wazuh.indexer:9200
@@ -78,7 +77,7 @@ services:
     ports:
       - 443:5601
     env_file:
-      - .env.secrets   # INDEXER_PASSWORD, DASHBOARD_PASSWORD, API_PASSWORD — never committed
+      - .env.secrets
     environment:
       - TZ=${TZ}
       - INDEXER_USERNAME=admin

stacks/media/kodi/docker-compose.yaml

@@ -3,7 +3,7 @@ services:
     image: mariadb:latest
     container_name: kodi-mariadb
     env_file:
-      - .env.secrets   # MYSQL_ROOT_PASSWORD, MYSQL_PASSWORD — never committed
+      - .env.secrets
     environment:
       - PUID=${PUID}
       - PGID=${PGID}
@@ -39,7 +39,7 @@ services:
       - ./requirements.txt:/app/requirements.txt:ro
     command: sh -c "pip install --no-cache-dir -r requirements.txt && python bridge.py"
     env_file:
-      - .env.secrets   # KODI_PASSWORD, MA_API_TOKEN — never committed
+      - .env.secrets
     environment:
       - TZ=${TZ}
       - MA_BASE_URL=${MA_BASE_URL}

stacks/media/tinymediamanager/docker-compose.yaml

@@ -12,10 +12,7 @@ services:
       - /path/to/tinymediamanager/data:/data
       - /path/to/tinymediamanager/config/launcher-extra.yml:/app/launcher-extra.yml
       - /path/to/media/movies:/media/movies
-      - /path/to/media/moviesetsartwork:/media/moviesetsartwork
       - /path/to/media/tv:/media/tv shows
-      - /path/to/media/documentaries:/media/documentaries
-      - /path/to/media/stand-up comedy:/media/stand-up comedy
     restart: unless-stopped
     networks:
       - media-net

stacks/platform/gitea/.env

@@ -7,8 +7,6 @@ TZ=Etc/UTC
 HTTP_PORT=3000
 SSH_PORT=22
 
-# Postgres (shared creds, separate DBs/instances)
-# POSTGRES_PASSWORD — see .env.secrets (Vault)
 POSTGRES_USER=gitea
 POSTGRES_DB=gitea
 

stacks/platform/grafana-stack/.env

@@ -8,7 +8,5 @@ HTTP_PORT_grafana=3693
 HTTP_PORT_loki=3100
 
 GF_AUTH_GENERIC_OAUTH_CLIENT_ID=example-oauth-client-id
-# GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET — see .env.secrets (Vault)
 AUTHENTIK_URL=https://authentik.caddy.example.com
 GRAFANA_URL=https://grafana.local.example.com
-# GRAFANA_ADMIN_PASSWORD — see .env.secrets (Vault)

stacks/platform/kestra/.env

@@ -4,7 +4,5 @@ HTTP_PORT=8080
 # Basic-auth login
 USERNAME=[email protected]
 
-# Postgres Creds
-# POSTGRES_PASSWORD — see .env.secrets (Vault)
 POSTGRES_USER=kestra
 POSTGRES_DB=kestra

stacks/productivity/firefly-iii/docker-compose.yaml

@@ -6,7 +6,7 @@ services:
     depends_on:
       - mariadb
     env_file:
-      - .env.secrets   # APP_KEY, DB_PASSWORD — never committed
+      - .env.secrets
     environment:
       - DB_CONNECTION=mysql
       - DB_HOST=mariadb
@@ -30,7 +30,7 @@ services:
     container_name: fireflyiii_db
     restart: unless-stopped
     env_file:
-      - .env.secrets   # MYSQL_PASSWORD, MYSQL_ROOT_PASSWORD — never committed
+      - .env.secrets
     environment:
       - PUID=${PUID}
       - PGID=${PGID}

stacks/productivity/joplin/.env

@@ -6,7 +6,7 @@ POSTGRES_PORT=5432
 TZ=Etc/UTC
 
 # User Credentials
-APP_BASE_URL=https://notes.example.com
+APP_BASE_URL=https://joplin.example.com
 
 # Admin account seed (only read on a fresh first-ever boot, e.g. after a full recreate)
 APP_ADMIN_EMAIL=[email protected]

stacks/productivity/nextcloud/euro-office/Dockerfile

@@ -0,0 +1,4 @@
+FROM ghcr.io/euro-office/documentserver:latest
+
+# Internal-zone apps trust the fleet's own internal CA here (cert copied in,
+# then update-ca-certificates run) — the actual cert and paths are kept private.

stacks/productivity/nextcloud/nextcloud/Dockerfile

@@ -0,0 +1,10 @@
+FROM nextcloud:latest
+
+RUN apt-get update && \
+    apt-get install -y ca-certificates smbclient libsmbclient-dev && \
+    pecl install smbclient && \
+    docker-php-ext-enable smbclient && \
+    rm -rf /var/lib/apt/lists/*
+
+# Internal-zone apps trust the fleet's own internal CA here (cert copied in,
+# then update-ca-certificates run) — the actual cert and paths are kept private.