From b2f308a1350ca33ac22c76f77aa2b446569a5633 Mon Sep 17 00:00:00 2001
From: thesabear <thesabear@zohomail.eu>
Date: Tue, 25 Aug 2026 09:08:42 +0300
Subject: [PATCH] stacks: add .env + .env.secrets.ctmpl for productivity stacks

Adds real Vault Agent secret templates and non-secret env vars for
all 9 productivity stacks. Sanitized several real leaks: a real
residential public IP (ghost's UMAMI_IGNORE_IP), real personal
domains/email used across joplin/n8n/ghost/paperless-ngx, and a
real embedded OAuth client ID in paperless-ngx's private OIDC config
(dropped entirely - the public compose file doesn't wire up OIDC at
all, so none of that config was needed).

Also dropped n8n secrets referencing the out-of-scope Content
Pipeline system (nocodb-content, Postiz), and did not carry over a
real Redis password found sitting in plaintext in nextcloud's
private .env (unused by the public compose anyway).

Every var cross-checked against what its actual public compose file
references before writing.
---
 stacks/productivity/actual/.env               |  9 +++++++
 stacks/productivity/firefly-iii/.env          | 14 +++++++++++
 .../firefly-iii/.env.secrets.ctmpl            |  4 +++
 stacks/productivity/ghost/.env                | 21 ++++++++++++++++
 stacks/productivity/ghost/.env.secrets.ctmpl  |  5 ++++
 stacks/productivity/home-assistant/.env       | 13 ++++++++++
 .../home-assistant/.env.secrets.ctmpl         |  1 +
 stacks/productivity/joplin/.env               | 25 +++++++++++++++++++
 stacks/productivity/joplin/.env.secrets.ctmpl |  3 +++
 stacks/productivity/n8n/.env                  | 15 +++++++++++
 stacks/productivity/n8n/.env.secrets.ctmpl    |  2 ++
 stacks/productivity/nextcloud/.env            |  6 +++++
 .../productivity/nextcloud/.env.secrets.ctmpl |  3 +++
 stacks/productivity/paperless-ngx/.env        |  9 +++++++
 .../paperless-ngx/.env.secrets.ctmpl          |  3 +++
 stacks/productivity/trilium/.env              |  9 +++++++
 16 files changed, 142 insertions(+)
 create mode 100644 stacks/productivity/actual/.env
 create mode 100644 stacks/productivity/firefly-iii/.env
 create mode 100644 stacks/productivity/firefly-iii/.env.secrets.ctmpl
 create mode 100644 stacks/productivity/ghost/.env
 create mode 100644 stacks/productivity/ghost/.env.secrets.ctmpl
 create mode 100644 stacks/productivity/home-assistant/.env
 create mode 100644 stacks/productivity/home-assistant/.env.secrets.ctmpl
 create mode 100644 stacks/productivity/joplin/.env
 create mode 100644 stacks/productivity/joplin/.env.secrets.ctmpl
 create mode 100644 stacks/productivity/n8n/.env
 create mode 100644 stacks/productivity/n8n/.env.secrets.ctmpl
 create mode 100644 stacks/productivity/nextcloud/.env
 create mode 100644 stacks/productivity/nextcloud/.env.secrets.ctmpl
 create mode 100644 stacks/productivity/paperless-ngx/.env
 create mode 100644 stacks/productivity/paperless-ngx/.env.secrets.ctmpl
 create mode 100644 stacks/productivity/trilium/.env

diff --git a/stacks/productivity/actual/.env b/stacks/productivity/actual/.env
new file mode 100644
index 0000000..7ba3eb3
--- /dev/null
+++ b/stacks/productivity/actual/.env
@@ -0,0 +1,9 @@
+# Exposed HTTP port
+HTTP_PORT=5274
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
diff --git a/stacks/productivity/firefly-iii/.env b/stacks/productivity/firefly-iii/.env
new file mode 100644
index 0000000..33c7ab6
--- /dev/null
+++ b/stacks/productivity/firefly-iii/.env
@@ -0,0 +1,14 @@
+# Exposed HTTP port
+HTTP_PORT=56678
+DB_PORT=13306
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+
+# Remote user auth (Caddy forward-auth via Authentik) — email-based lookup
+AUTHENTICATION_GUARD=remote_user_guard
+AUTHENTICATION_GUARD_HEADER=HTTP_X_AUTHENTIK_EMAIL
diff --git a/stacks/productivity/firefly-iii/.env.secrets.ctmpl b/stacks/productivity/firefly-iii/.env.secrets.ctmpl
new file mode 100644
index 0000000..4852b40
--- /dev/null
+++ b/stacks/productivity/firefly-iii/.env.secrets.ctmpl
@@ -0,0 +1,4 @@
+APP_KEY={{ with secret "kv/host/fireflyiii" }}{{ .Data.data.app_key }}{{ end }}
+DB_PASSWORD={{ with secret "kv/host/fireflyiii" }}{{ .Data.data.db_password }}{{ end }}
+MYSQL_PASSWORD={{ with secret "kv/host/fireflyiii" }}{{ .Data.data.db_password }}{{ end }}
+MYSQL_ROOT_PASSWORD={{ with secret "kv/host/fireflyiii" }}{{ .Data.data.mysql_root_password }}{{ end }}
diff --git a/stacks/productivity/ghost/.env b/stacks/productivity/ghost/.env
new file mode 100644
index 0000000..68adde4
--- /dev/null
+++ b/stacks/productivity/ghost/.env
@@ -0,0 +1,21 @@
+HTTP_PORT=10368
+TZ=Etc/UTC
+
+GHOST_URL=https://blog.example.com
+
+UMAMI_IGNORE_IP=203.0.113.1
+
+DB_HOST=ghost_db
+DB_NAME=ghostdb
+DB_USER=ghostuser
+
+UMAMI_PORT=3050
+UMAMI_DB_NAME=umami
+UMAMI_DB_USER=umami
+
+SMTP_TRANSPORT=SMTP
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_SECURE=false
+
+SMTP_USER=notifications@example.com
diff --git a/stacks/productivity/ghost/.env.secrets.ctmpl b/stacks/productivity/ghost/.env.secrets.ctmpl
new file mode 100644
index 0000000..78c1c1e
--- /dev/null
+++ b/stacks/productivity/ghost/.env.secrets.ctmpl
@@ -0,0 +1,5 @@
+DB_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.db_password }}{{ end }}
+SMTP_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.smtp_password }}{{ end }}
+MYSQL_ROOT_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.mysql_root_password }}{{ end }}
+UMAMI_APP_SECRET={{ with secret "kv/host/ghost" }}{{ .Data.data.umami_app_secret }}{{ end }}
+UMAMI_DB_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.umami_db_password }}{{ end }}
diff --git a/stacks/productivity/home-assistant/.env b/stacks/productivity/home-assistant/.env
new file mode 100644
index 0000000..feaf580
--- /dev/null
+++ b/stacks/productivity/home-assistant/.env
@@ -0,0 +1,13 @@
+# Exposed HTTP port
+HTTP_PORT=4719
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+
+POSTGRES_USER=homeassistant_user
+# POSTGRES_PASSWORD — see .env.secrets (Vault)
+POSTGRES_DB=homeassistant-db
diff --git a/stacks/productivity/home-assistant/.env.secrets.ctmpl b/stacks/productivity/home-assistant/.env.secrets.ctmpl
new file mode 100644
index 0000000..a12b6f2
--- /dev/null
+++ b/stacks/productivity/home-assistant/.env.secrets.ctmpl
@@ -0,0 +1 @@
+POSTGRES_PASSWORD={{ with secret "kv/host/home-assistant" }}{{ .Data.data.postgres_password }}{{ end }}
diff --git a/stacks/productivity/joplin/.env b/stacks/productivity/joplin/.env
new file mode 100644
index 0000000..0c7790b
--- /dev/null
+++ b/stacks/productivity/joplin/.env
@@ -0,0 +1,25 @@
+# Exposed HTTP port
+HTTP_PORT=22300
+POSTGRES_PORT=5432
+
+# System time zone
+TZ=Etc/UTC
+
+# User Credentials
+APP_BASE_URL=https://notes.example.com
+
+# Admin account seed (only read on a fresh first-ever boot, e.g. after a full recreate)
+APP_ADMIN_EMAIL=admin@example.com
+APP_ADMIN_NAME=admin
+
+# SMTP Settings
+MAILER_HOST=smtp.example.com
+MAILER_PORT=587
+MAILER_SECURITY=1
+MAILER_AUTH_USER=notifications@example.com
+MAILER_NOREPLY_NAME=JoplinServer
+MAILER_NOREPLY_EMAIL=notifications@example.com
+
+# Postgres Creds
+POSTGRES_USER=postgres
+POSTGRES_DB=joplin
diff --git a/stacks/productivity/joplin/.env.secrets.ctmpl b/stacks/productivity/joplin/.env.secrets.ctmpl
new file mode 100644
index 0000000..b2d880d
--- /dev/null
+++ b/stacks/productivity/joplin/.env.secrets.ctmpl
@@ -0,0 +1,3 @@
+POSTGRES_PASSWORD={{ with secret "kv/host/joplin" }}{{ .Data.data.postgres_password }}{{ end }}
+MAILER_AUTH_PASSWORD={{ with secret "kv/host/joplin" }}{{ .Data.data.mailer_auth_password }}{{ end }}
+APP_ADMIN_PASSWORD={{ with secret "kv/host/joplin" }}{{ .Data.data.app_admin_password }}{{ end }}
diff --git a/stacks/productivity/n8n/.env b/stacks/productivity/n8n/.env
new file mode 100644
index 0000000..8cdbaee
--- /dev/null
+++ b/stacks/productivity/n8n/.env
@@ -0,0 +1,15 @@
+# Exposed HTTP port
+N8N_PORT=5678
+POSTGRES_PORT=5442
+ADMINER_PORT=8091
+N8N_HOST=n8n.local.example.com
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+
+# N8N_POSTGRES_PASSWORD, N8N_BASIC_AUTH_PASSWORD — see .env.secrets (Vault)
+N8N_USER=admin
diff --git a/stacks/productivity/n8n/.env.secrets.ctmpl b/stacks/productivity/n8n/.env.secrets.ctmpl
new file mode 100644
index 0000000..988a58a
--- /dev/null
+++ b/stacks/productivity/n8n/.env.secrets.ctmpl
@@ -0,0 +1,2 @@
+N8N_POSTGRES_PASSWORD={{ with secret "kv/host/n8n" }}{{ .Data.data.postgres_password }}{{ end }}
+N8N_BASIC_AUTH_PASSWORD={{ with secret "kv/host/n8n" }}{{ .Data.data.basic_auth_password }}{{ end }}
diff --git a/stacks/productivity/nextcloud/.env b/stacks/productivity/nextcloud/.env
new file mode 100644
index 0000000..3106069
--- /dev/null
+++ b/stacks/productivity/nextcloud/.env
@@ -0,0 +1,6 @@
+# mysql credentials
+# MYSQL_ROOT_PASSWORD, MYSQL_PASSWORD — see .env.secrets (Vault)
+MYSQL_DATABASE=nextcloud
+MYSQL_USER=nextcloud
+
+TZ=Etc/UTC
diff --git a/stacks/productivity/nextcloud/.env.secrets.ctmpl b/stacks/productivity/nextcloud/.env.secrets.ctmpl
new file mode 100644
index 0000000..e01077e
--- /dev/null
+++ b/stacks/productivity/nextcloud/.env.secrets.ctmpl
@@ -0,0 +1,3 @@
+MYSQL_ROOT_PASSWORD={{ with secret "kv/host/nextcloud-stack" }}{{ .Data.data.mysql_root_password }}{{ end }}
+MYSQL_PASSWORD={{ with secret "kv/host/nextcloud-stack" }}{{ .Data.data.mysql_password }}{{ end }}
+ONLYOFFICE_JWT_SECRET={{ with secret "kv/host/nextcloud-stack" }}{{ .Data.data.onlyoffice_jwt_secret }}{{ end }}
diff --git a/stacks/productivity/paperless-ngx/.env b/stacks/productivity/paperless-ngx/.env
new file mode 100644
index 0000000..e69cbbd
--- /dev/null
+++ b/stacks/productivity/paperless-ngx/.env
@@ -0,0 +1,9 @@
+# Exposed HTTP port
+HTTP_PORT=8926
+
+# Credentials
+POSTGRES_DB=paperless
+POSTGRES_USER=paperless
+
+PAPERLESS_ADMIN_USER=admin
+PAPERLESS_URL=https://paperless.local.example.com
diff --git a/stacks/productivity/paperless-ngx/.env.secrets.ctmpl b/stacks/productivity/paperless-ngx/.env.secrets.ctmpl
new file mode 100644
index 0000000..09e69a5
--- /dev/null
+++ b/stacks/productivity/paperless-ngx/.env.secrets.ctmpl
@@ -0,0 +1,3 @@
+POSTGRES_PASSWORD={{ with secret "kv/host/paperless-ngx" }}{{ .Data.data.postgres_password }}{{ end }}
+PAPERLESS_DBPASS={{ with secret "kv/host/paperless-ngx" }}{{ .Data.data.postgres_password }}{{ end }}
+PAPERLESS_ADMIN_PASSWORD={{ with secret "kv/host/paperless-ngx" }}{{ .Data.data.admin_password }}{{ end }}
diff --git a/stacks/productivity/trilium/.env b/stacks/productivity/trilium/.env
new file mode 100644
index 0000000..04e4274
--- /dev/null
+++ b/stacks/productivity/trilium/.env
@@ -0,0 +1,9 @@
+# Exposed HTTP port
+HTTP_PORT=8081
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000