add config to traefik for gitea

README.md

@@ -26,12 +26,22 @@ Set Root-Password (by hand)
 # groupadd containers
 # useradd -m -g containers containers
 # passwd containers
+
+For containers User, add the following to ~/.bash_profile:
+
+# User specific environment and startup programs
+export XDG_RUNTIME_DIR=/run/user/$(id -u)
+
 # hostnamectl set-hostname onyx.nbit.ch
 # timedatectl set-timezone Europe/Zurich
 # dnf install glibc-langpack-de
 # localectl set-locale LANG=en_US.UTF-8
 # localectl set-locale LC_TIME=de_CH.UTF-8
 
+Set Journalctl-Config to persistent Storage:
+/etc/systemd/journald.conf:
+Storage=persistent
+
 # Enable Selinux in Enforcing Mode: change /etc/selinux/config
 # dnf install setroubleshoot
 `
@@ -48,6 +58,7 @@ enable EPEL Repo:
 # firewall-cmd --add-service={http,https} --permanent
 # firewall-cmd --remove-service=cockpit --permanent
 # firewall-cmd --add-port=1883/tcp --permanent   ; only for MQTT
+# firewall-cmd --add-port=25/tcp --permanent     ; for Postfix
 # firewall-cmd --reload
 
 List Rules:
@@ -72,6 +83,7 @@ command to check who is banned:
 ## Install Software
 
 ```bash
+# dnf install passt
 # dnf install git
 # dnf install podman
 # dnf install jq
@@ -183,7 +195,6 @@ if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)
 
 ### Setup Env for Podman
 
-we use /data/<podname> for persitent data:
 ```bash
 # mkdir /data
 # chown containers:containers /data
@@ -195,11 +206,10 @@ containers$ cat ~/.config/containers/containers.conf
 network_backend = "netavark"
 
 
-Credentials for Gitlab Registry should be available after Reboot
+Credentials for Docker Registry should be available after Reboot
 
-# User: drpuur, Password: Token from Gitlab (glpat-L5fU-_eZ6u74-3a8Jsnn)
+[containers@onyx-dev ~]$ podman login git.nbit.ch
-[containers@onyx-dev ~]$ podman login registry.gitlab.com
+Username: jlehmann
-Username: drpuur
 Password:
 Login Succeeded!
 
@@ -248,6 +258,29 @@ export XDG_RUNTIME_DIR=/run/user/$(id -u)
 containers$ touch /data/traefik/acme.json
 containers$ chmod 0600 /data/traefik/acme.json
 
+!!!!!!!!!!!!!!
+IMPORTANT: we changed the startup Method to Quadlets, put into
+~containers/.config/containers/systemd/
+
+See also https://www.redhat.com/sysadmin/quadlet-podman
+
+Example of such a quadlet config (Network=pasta is not to be used for Traefik):
+
+[containers@onyx-dev ~]$ more ~containers/.config/containers/systemd/onyx-dev-mqtt.kube
+[Unit]
+Description=MQTT
+Before=local-fs.target
+
+[Kube]
+Yaml=/home/containers/onyx-dev_pods/mqtt/mqtt.yaml
+LogDriver=journald
+Network=pasta
+
+[Install]
+# Start by default on boot
+WantedBy=multi-user.target default.target
+!!!!!!!!!!!!!!
+
 containers$ mkdir -p ~/.config/systemd/user/
 containers$ cd ~/.config/systemd/user/
 
@@ -271,7 +304,45 @@ containers$ systemctl --user start podman-kube@$escaped.service
 containers$ systemctl --user enable podman-kube@$escaped.service
 ```
 
+## Postfix
 
+```bash
+# dnf install postfix
+
+/etc/postfix/main.cf:
+---
+inet_interfaces = all
+
+smtpd_tls_security_level = none
+
+virtual_alias_domains = wo-bisch.ch mini-beieli.ch
+virtual_alias_maps = hash:/etc/postfix/virtual
+---
+
+# tail -12 /etc/postfix/virtual
+abuse@mini-beieli.ch nbitinf@nbit.ch
+hostmaster@mini-beieli.ch nbitinf@nbit.ch
+info@mini-beieli.ch nbitinf@nbit.ch
+mail@mini-beieli.ch nbitinf@nbit.ch
+postmaster@mini-beieli.ch nbitinf@nbit.ch
+register@mini-beieli.ch nbitinf@nbit.ch
+abuse@wo-bisch.ch nbitinf@nbit.ch
+hostmaster@wo-bisch.ch nbitinf@nbit.ch
+info@wo-bisch.ch nbitinf@nbit.ch
+mail@wo-bisch.ch nbitinf@nbit.ch
+postmaster@wo-bisch.ch nbitinf@nbit.ch
+register@wo-bisch.ch nbitinf@nbit.ch
+
+# postmap /etc/postfix/virtual
+
+# systemctl enable postfix
+# systemctl start postfix
+
+Creat DNS Records:
+mx1.nbit.ch and mx2.nbit.ch (A/AAAA Records to the same IPs as onyx and onyx-dev)
+
+Change SPF Records to include mx1 and mx2
+```
 
 ## Secondary Nameserver
 

gitea/gitea.yaml

@@ -3,8 +3,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/gitea/data: z
-    bind-mount-options:/data/gitea/config: z
     io.kubernetes.cri-o.TTY/gitea: "false"
     io.podman.annotations.autoremove/gitea: "FALSE"
     io.podman.annotations.init/gitea: "FALSE"

minibeieli/minibeieli.yaml

@@ -2,10 +2,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/minibeieli/influxdb: z
-    bind-mount-options:/data/minibeieli/redis: z
-    bind-mount-options:/data/minibeieli/lorahandlerdata: z
-    bind-mount-options:/home/containers/onyx_pods/minibeieli/telegraf.conf: z
     io.kubernetes.cri-o.TTY/minibeieli: "false"
     io.podman.annotations.autoremove/minibeieli: "FALSE"
     io.podman.annotations.init/minibeieli: "FALSE"
@@ -18,8 +14,10 @@ metadata:
 spec:
   containers:
   - name: mini-beieli-web
-    image: registry.gitlab.com/drpuur/mini-beieli-web:2023020301
+    image: git.nbit.ch/drpuur/mini-beieli-web:2025092001
     env:
+    - name: CONFIG_ENVVAR
+      value: nbit Informatik GmbH<br />Untere Stockteile 16<br />3806 B&ouml;nigen b. Interlaken<br /><br />+41 31 792 00 40<br /><a href='&#109;ai&#108;&#116;o&#58;i&#37;6Ef&#111;&#64;%6Ebi&#116;&#46;%63h'>&#105;nfo&#64;nbit&#46;ch</a>,CHF 200.--,CHF 80.--
     - name: REDIS_CONNECTION_STRING
       value: 127.0.0.1:6379
     - name: INFLUX_URL
@@ -31,7 +29,7 @@ spec:
     - name: STRIPE_PK
       value: pk_live_G9vgPopd9opsY81AfzguwMrq
     - name: MAILSERVER_HOST
-      value: mail.nbit.ch
+      value: 127.0.0.1
     ports:
     - containerPort: 4000
       hostPort: 9070
@@ -43,7 +41,7 @@ spec:
         - CAP_NET_RAW
         - CAP_AUDIT_WRITE
   - name: mini-beieli-lorahandler
-    image: registry.gitlab.com/drpuur/mini-beieli-lorahandler:2022122801
+    image: git.nbit.ch/drpuur/mini-beieli-lorahandler:2022122801
     env:
     - name: REDIS_CONNECTION_STRING
       value: 127.0.0.1:6379
@@ -61,9 +59,10 @@ spec:
     - mountPath: /data
       name: lorahandlerdata
   - name: influxdb
-    image: docker.io/library/influxdb:2.6
+    image: docker.io/library/influxdb:2.7
     ports:
     - containerPort: 8086
+      hostPort: 9072
     resources: {}
     securityContext:
       capabilities:
@@ -79,6 +78,7 @@ spec:
     args: ["--save 60 1", "--loglevel warning"]
     ports:
     - containerPort: 5432
+      hostPort: 9073
     resources: {}
     securityContext:
       capabilities:
@@ -97,6 +97,8 @@ spec:
         drop:
         - CAP_MKNOD
         - CAP_AUDIT_WRITE
+        add:
+        - CAP_NET_RAW
     volumeMounts:
     - mountPath: /data
       name: lorahandlerdata

nbitwebsite/nbitwebsite.yaml

@@ -3,7 +3,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/nbitwebsite/document_root: z
     io.kubernetes.cri-o.TTY/nbitwebsite: "false"
     io.podman.annotations.autoremove/nbitwebsite: "FALSE"
     io.podman.annotations.init/nbitwebsite: "FALSE"
@@ -29,8 +28,14 @@ spec:
     volumeMounts:
     - mountPath: /usr/share/nginx/html
       name: data-nbitwebsite-host-0
+    - mountPath: /etc/nginx/conf.d
+      name: data-nbitwebsite-config-0
   volumes:
   - hostPath:
       path: /data/nbitwebsite/document_root
       type: Directory
     name: data-nbitwebsite-host-0
+  - hostPath:
+      path: /data/nbitwebsite/conf.d
+      type: Directory
+    name: data-nbitwebsite-config-0

nbitwiki/nbitwiki.yaml

@@ -3,7 +3,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/nbitwiki/config: z
     io.kubernetes.cri-o.TTY/nbitwiki: "false"
     io.podman.annotations.autoremove/nbitwiki: "FALSE"
     io.podman.annotations.init/nbitwiki: "FALSE"

traefik/configuration/gitea.yml

@@ -15,4 +15,3 @@ http:
       loadBalancer:
         servers:
         - url: http://127.0.0.1:9080/
-        passHostHeader: false

traefik/configuration/minibeieli.yml

@@ -8,7 +8,7 @@ http:
         domains:
           - main: "mini-beieli.ch"
             sans: "www.mini-beieli.ch"
-      rule: "Host(`mini-beieli.ch`,`www.mini-beieli.ch`)"
+      rule: "Host(`mini-beieli.ch`) || Host(`www.mini-beieli.ch`)"
       service: minibeieli-web
 
     minibeieli-lorahandler:
@@ -19,7 +19,7 @@ http:
         domains:
           - main: "mini-beieli.ch"
             sans: "www.mini-beieli.ch"
-      rule: "Host(`mini-beieli.ch`,`www.mini-beieli.ch`) && PathPrefix(`/lorahandler`)"
+      rule: "Host(`mini-beieli.ch`) && PathPrefix(`/lorahandler`) || Host(`www.mini-beieli.ch`) && PathPrefix(`/lorahandler`)"
       service: minibeieli-lorahandler
 
   services:

traefik/configuration/nbitwebsite.yml

@@ -7,8 +7,8 @@ http:
         certresolver: "myresolver"
         domains:
           - main: "nbit.ch"
-            sans: "www.nbit.ch,linux-freelancer.ch,www.linux-freelancer.ch"
+            sans: "www.nbit.ch"
-      rule: "Host(`nbit.ch`,`www.nbit.ch`,`linux-freelancer.ch`,`www.linux-freelancer.ch`)"
+      rule: "Host(`nbit.ch`) || Host(`www.nbit.ch`)"
       service: nbitwebsite
 
   services:

traefik/configuration/wobisch.yml

@@ -8,7 +8,7 @@ http:
         domains:
           - main: "wo-bisch.ch"
             sans: "www.wo-bisch.ch"
-      rule: "Host(`wo-bisch.ch`,`www.wo-bisch.ch`)"
+      rule: "Host(`wo-bisch.ch`) || Host(`www.wo-bisch.ch`)"
       service: wobisch-web
 
     wobisch-lorahandler:
@@ -19,7 +19,7 @@ http:
         domains:
           - main: "wo-bisch.ch"
             sans: "www.wo-bisch.ch"
-      rule: "Host(`wo-bisch.ch`,`www.wo-bisch.ch`) && PathPrefix(`/lorahandler`)"
+      rule: "Host(`wo-bisch.ch`) && PathPrefix(`/lorahandler`) || Host(`www.wo-bisch.ch`) && PathPrefix(`/lorahandler`)"
       service: wobisch-lorahandler
 
   services:

traefik/configuration/wordpressacmoag.yml

@@ -8,11 +8,11 @@ http:
         domains:
           - main: "www.acmoag.com"
             sans: "acmoag.com"
-      rule: "Host(`acmoag.com`,`www.acmoag.com`)"
+      rule: "Host(`acmoag.com`) || Host(`www.acmoag.com`)"
-      service: wordpresscmoag
+      service: wordpressacmoag
 
   services:
-    wordpresscmoag:
+    wordpressacmoag:
       loadBalancer:
         servers:
         - url: http://127.0.0.1:9030/

traefik/traefik.yaml

@@ -3,8 +3,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/home/containers/onyx_pods/traefik/configuration: z
-    bind-mount-options:/data/traefik/acme.json: z
     io.kubernetes.cri-o.TTY/traefik: "false"
     io.podman.annotations.autoremove/traefik: "FALSE"
     io.podman.annotations.init/traefik: "FALSE"

wobisch/wobisch.yaml

@@ -2,10 +2,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/wobisch/influxdb: z
-    bind-mount-options:/data/wobisch/redis: z
-    bind-mount-options:/data/wobisch/lorahandlerdata: z
-    bind-mount-options:/home/containers/onyx_pods/wobisch/telegraf.conf: z
     io.kubernetes.cri-o.TTY/wobisch: "false"
     io.podman.annotations.autoremove/wobisch: "FALSE"
     io.podman.annotations.init/wobisch: "FALSE"
@@ -18,7 +14,7 @@ metadata:
 spec:
   containers:
   - name: wo-bisch-web
-    image: registry.gitlab.com/drpuur/wo-bisch-web:2023020304
+    image: git.nbit.ch/drpuur/wo-bisch-web:2025051401
     env:
     - name: REDIS_CONNECTION_STRING
       value: 127.0.0.1:6379
@@ -31,7 +27,7 @@ spec:
     - name: STRIPE_PK
       value: pk_live_51Icq29K2XyHQRTs2oNQMPT75m7J96ajcKDADEE8FCSA3WWD98je6IZgN0E7Q2t5Vccdu1ar5kQZUIjbPhRluTkS500rgdMr0dF
     - name: MAILSERVER_HOST
-      value: mail.nbit.ch
+      value: 127.0.0.1
     ports:
     - containerPort: 4000
       hostPort: 9060
@@ -43,12 +39,12 @@ spec:
         - CAP_NET_RAW
         - CAP_AUDIT_WRITE
   - name: wo-bisch-lorahandler
-    image: registry.gitlab.com/drpuur/wo-bisch-lorahandler:2022122801
+    image: git.nbit.ch/drpuur/wo-bisch-lorahandler:2022122801
     env:
     - name: REDIS_CONNECTION_STRING
       value: 127.0.0.1:6379
     - name: MAILSERVER_HOST
-      value: mail.nbit.ch
+      value: 127.0.0.1
     ports:
     - containerPort: 8080
       hostPort: 9061
@@ -63,10 +59,10 @@ spec:
     - mountPath: /data
       name: lorahandlerdata
   - name: influxdb
-    image: docker.io/library/influxdb:2.6
+    image: docker.io/library/influxdb:2.7
     ports:
     - containerPort: 8086
-      hostPort: 8087
+      hostPort: 9062
     resources: {}
     securityContext:
       capabilities:
@@ -82,6 +78,7 @@ spec:
     args: ["--save 60 1", "--loglevel warning"]
     ports:
     - containerPort: 5432
+      hostPort: 9063
     resources: {}
     securityContext:
       capabilities:
@@ -100,6 +97,8 @@ spec:
         drop:
         - CAP_MKNOD
         - CAP_AUDIT_WRITE
+        add:
+        - CAP_NET_RAW
     volumeMounts:
     - mountPath: /data
       name: lorahandlerdata

wordpressacmoag/wordpressacmoag.yaml

@@ -2,9 +2,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/wordpressacmoag/wp: z
-    bind-mount-options:/home/containers/onyx_pods/wordpressacmoag/uploads.ini: z
-    bind-mount-options:/data/wordpressacmoag/db: z
     io.kubernetes.cri-o.TTY/wordpressacmoag: "false"
     io.podman.annotations.autoremove/wordpressacmoag: "FALSE"
     io.podman.annotations.init/wordpressacmoag: "FALSE"
@@ -65,6 +62,8 @@ spec:
       name: data-wordpressacmoag-wp-0
     - mountPath: /usr/local/etc/php/conf.d/uploads.ini
       name: data-wordpressacmoag-wp-1
+    - mountPath: /var/log/apache2
+      name: data-wordpressacmoag-logs-0
   restartPolicy: Never
   volumes:
   - hostPath:
@@ -79,3 +78,7 @@ spec:
       path: /data/wordpressacmoag/db
       type: Directory
     name: data-wordpressacmoag-dp-0
+  - hostPath:
+      path: /data/wordpressacmoag/logs
+      type: Directory
+    name: data-wordpressacmoag-logs-0

wordpresscmoag/wordpresscmoag.yaml

@@ -2,9 +2,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/wordpresscmoag/wp: z
-    bind-mount-options:/home/containers/onyx_pods/wordpresscmoag/uploads.ini: z
-    bind-mount-options:/data/wordpresscmoag/db: z
     io.kubernetes.cri-o.TTY/wordpresscmoag: "false"
     io.podman.annotations.autoremove/wordpresscmoag: "FALSE"
     io.podman.annotations.init/wordpresscmoag: "FALSE"
@@ -65,6 +62,8 @@ spec:
       name: data-wordpresscmoag-wp-0
     - mountPath: /usr/local/etc/php/conf.d/uploads.ini
       name: data-wordpresscmoag-wp-1
+    - mountPath: /var/log/apache2
+      name: data-wordpresscmoag-logs-0
   restartPolicy: Never
   volumes:
   - hostPath:
@@ -79,3 +78,7 @@ spec:
       path: /data/wordpresscmoag/db
       type: Directory
     name: data-wordpresscmoag-dp-0
+  - hostPath:
+      path: /data/wordpresscmoag/logs
+      type: Directory
+    name: data-wordpresscmoag-logs-0