Disable hitparade service

It's back to plain text

.gitea/workflows/check.yaml

@@ -2,7 +2,7 @@ name: Check
 "on": [push]
 jobs:
   "Lint Ansible Files":
-    runs-on: node-22-bookworm
+    runs-on: node-26-trixie
     steps:
       - run: apt-get update
       - run: apt-get upgrade -y
@@ -11,6 +11,6 @@ jobs:
       - name: Check out repo
         uses: actions/checkout@v3
       - run: python3 -m venv venv
-      - run: venv/bin/pip --disable-pip-version-check install ansible==11.1.0 ansible-lint==24.12.1
+      - run: venv/bin/pip --disable-pip-version-check install ansible==12.0.0 ansible-lint==25.8.2
       - run: venv/bin/ansible-lint -c .ansible-lint ansible
   # TODO: Reimplement ansible-play --check step from old drone config

README.md

@@ -21,3 +21,6 @@ to avoid checking for a new version every single run.
 ## TODO
 
 - [x] Migrate to `community.docker.docker_compose_v2` (`v1` is deprecated)
+- [x] Nix Gitea Action runner
+- [x] Install but disable zomboid server
+- [x] Download volume for yore

TODO.md

@@ -5,14 +5,11 @@
 - [x] Use `/var/lib/pbri/docker/...` instead of Docker volumes (makes backups easier)
     - [x] Make it inaccessible to anyone but root (`-rw------`)
 - [x] Add [Drone runner](https://docs.drone.io/runner/docker/installation/linux/)
-- [ ] Figure out how to dependably store `.env` files (Ansible vault? Something else?)
-    - [ ] In vault, seperate from other config
+- [x] Figure out how to dependably store `.env` files (Ansible vault? Something else?)
+    - [x] In vault, seperate from other config
 - [x] Check out docker swarm and current best practices for Ansible
 - [x] Use Gitea instead of GitLab
-- [ ] Add drone exec runner for Nix builds with shared `/nix`
-- [ ] Lint caddy file, add gzip and disable admin interface
 - [x] Make Gitea display graphs in Notebooks (see https://docs.gitea.io/en-us/external-renderers/).
 - [x] Factorio server
-- [ ] Add flag for Gitea backups (after which Gitea will be up but no contain the sites source code)
 - [x] Add Gitea actions
-- [ ] Remove drone
+- [x] Remove drone

ansible/README.md

@@ -9,25 +9,26 @@ To drop into a shell with `ansible-*` commands, run:
 nix develop
 ```
 
-## `misc.yaml`
+## `nanna-setup.yaml`
 
-Server for miscellaneous stuff, e.g. the website.
-Expects to have a user `paul who can `sudo`.
+Small VPS for self-hosted services.
+Expects to have a user `paul` who can `sudo`.
 Sets up:
 
 - Some basic packages
 - Docker and `docker-compose`
 - Nix multi-user installation
 
-## `misc-docker.yaml`
+## `nanna-docker.yaml`
 
-Deploys Docker configurations from `../docker`:
+Deploys Docker Compose configurations from `../docker`:
 
 - Sets up the docker network `caddy-network` for services that are reverse proxied by caddy
 - Copies configuration into `/etc/pbri/docker`
 - Creates folder `/var/lib/pbri/docker` for storing application files
 - Creates users with `42xxx` UIDs for running containers
+- `docker compose {up,down}`s all enabled/disabled services
 
-## `misc-sites.yaml`
+## `nanna-sites.yaml`
 
 Checks out static sites into `/home/paul/Sites` which is mounted into `/srv` in the Caddy container.

ansible/group_vars/gods/vars.yaml

@@ -13,3 +13,6 @@ gods_users:
   - name: caddy
     uid: 42002
     state: present
+  - name: yore
+    uid: 42004
+    state: present

ansible/host_vars/nanna/vars.yaml

@@ -1,8 +1,10 @@
 $ANSIBLE_VAULT;1.1;AES256
-37646262396235383766303137613134323330396364346261653036303935663935323930663630
-3562306337383765323635623838646538376362396638360a366336336134616163663533373836
-30333834306466633162613264376266646239343432646162396132643437663934613464363437
-6530653234336133360a666232386537353835386364613065343063613536613638393736666635
-65363362363766353231646461343764306637353465373633363861333436336263393561656330
-39613761373437313663613737613961666330373135666365373433376437383232383461633861
-333763383538633430303663636338363537
+62643463383563343863376537643438356663636666356636346465613165363231653664323164
+3137343761613064616566656133346339613462333330360a626431653366643162316435373066
+65323863373361363765623563653863366338616564623532363233646466316539376666356564
+3034393930376630350a396632393262316238663162346533343464386135666364383663313539
+63393536353334666432393639616130636232343630626235663337393438336430666637663133
+65316161646161376333376330353063363966383936396566323633366435663835346564356137
+65633262623133373865643230303236663532623863386264326662393364396636306537653264
+62326264393039343733643138313639333635366532383137613131656163356534303738336338
+6339

ansible/playbooks/nanna-docker.yaml

@@ -44,22 +44,22 @@
     - name: Upload and decrypt docker environment vars
       become: true
       ansible.builtin.copy:
-        src: "../../docker/envs/{{ item.name }}/.env"
-        dest: /etc/pbri/docker/{{ item.name }}/.env
+        src: "../../docker/envs/{{ item.path }}"
+        dest: "/etc/pbri/docker/{{ item.path }}"
         # Files should inaccessible to non-root users.
         mode: u=rw,g=,o=
         # This is true by default but I put it here anyways
         # to emphasize what's happening
         decrypt: true
       loop:
-        - name: gitea
-          state: present
-        - name: codi
-          state: present
-        - name: vrnp
-          state: present
-        - name: zomboid
-          state: present
+        - path: gitea/.env
+        - path: codi/.env
+        - path: vrnp/.env
+        - path: zomboid/.env
+        - path: yore/.env
+        - path: factorio/.env
+        - path: hitparade/.env
+        - path: hitparade/pollmaster-config.yml
     # This needs to be done for any services where user:
     # is set in docker-compose.yaml.
     - name: Create volume directories with correct permissions
@@ -77,6 +77,14 @@
           user: caddy
         - name: codi_uploads
           user: hackmd
+        - name: nix_runner_etc
+          user: 1000
+        - name: nix_runner_nix
+          user: 1000
+        - name: nix_runner_home_node
+          user: 1000
+        - name: yore_data
+          user: yore
     # Since some docker-compose configuration might want to pull
     # images from the Gitea package repository, we need to ensure
     # that Gitea is reachable before those configurations are deployed.
@@ -117,5 +125,11 @@
           state: present
         - name: vrnp
           state: present
-        - name: zomboid
+        - name: yore
           state: present
+        - name: hitparade
+          state: absent
+        - name: factorio
+          state: absent
+        - name: zomboid
+          state: absent

ansible/playbooks/nanna-setup.yaml

@@ -53,6 +53,39 @@ nxEdyH1aEGOGGRqDCp3U/SG46 davidtanner@coolerLaptop2.fritz.box"
         create: true
         state: present
         mode: "0600"
+    - name: Add Jakobs group
+      become: true
+      ansible.builtin.group:
+        name: "jakob"
+        state: "present"
+    - name: Add Jakob
+      become: true
+      ansible.builtin.user:
+        name: "jakob"
+        group: "jakob"
+        state: "present"
+        shell: "/bin/bash"
+        append: true
+        groups:
+          - sudo
+    - name: Create Jakob SSH directory
+      become: true
+      ansible.builtin.file:
+        path: /home/jakob/.ssh
+        owner: jakob
+        group: jakob
+        state: directory
+        mode: "0700"
+    - name: Set Jakob SSH key
+      become: true
+      ansible.builtin.lineinfile:
+        path: /home/jakob/.ssh/authorized_keys
+        line: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHzStuc1f7CfTsmp1qLz5x/YCwJ2wHVjxOv2Fvocs3xH pbrinkmeier.de@jakob.moser.contact"
+        owner: jakob
+        group: jakob
+        create: true
+        state: present
+        mode: "0600"
     - name: Add work SSH key
       become: true
       ansible.builtin.lineinfile:
@@ -64,6 +97,9 @@ FbxfbWlo/HQNoA8vaaBZj58Cp paul@MacBook-Pro.meqo"
         create: true
         state: present
         mode: "0600"
+    - name: Install Nix
+      ansible.builtin.include_role:
+        name: install_nix
 
   handlers:
     - name: Restart sshd

ansible/playbooks/nanna-sites.yaml

@@ -10,7 +10,7 @@
           checkouts:
             - path: /home/paul/Sites/pbrinkmeier.de
               url: https://git.pbrinkmeier.de/paul/pbrinkmeier.de
-              commit: 611cee6f405f1bf8b8a87f597ff5a4222621493a
+              commit: 1df3566997535ab563b5fa76724a8c6c55b96483
               owner: paul
             - path: /home/paul/Sites/tichy.click
               url: https://github.com/pbrinkmeier/tichy-clicker
@@ -40,3 +40,11 @@
         owner: david
         group: david
         mode: "0775"
+    - name: Create beany.club directory
+      become: true
+      ansible.builtin.file:
+        path: /home/paul/Sites/beany.club
+        state: directory
+        owner: paul
+        group: paul
+        mode: "0775"

ansible/roles/install_nix/files/install-nix

@@ -26,38 +26,43 @@ require_util() {
 
 case "$(uname -s).$(uname -m)" in
     Linux.x86_64)
-        hash=0b32afd8c9147532bf8ce8908395b1b4d6dde9bedb0fcf5ace8b9fe0bd4c075c
-        path=0zij5bm5f2gm3p2c8dkkv58684j1k100/nix-2.8.0-x86_64-linux.tar.xz
+        hash=d1f67c86eed016214864ba08bfb9529c307aea7e8fafb74853f96fcc3bfd8a60
+        path=n1j9ng0120ql98l5a8mi626ka8wvixq4/nix-2.31.2-x86_64-linux.tar.xz
         system=x86_64-linux
         ;;
     Linux.i?86)
-        hash=3f4bb50f639515df069fb682bb68da77565e5ca8678a3b0fb7dcc79ef591f518
-        path=kjpj1rn6x5lh20fkyfyyzgmgjdra1jpy/nix-2.8.0-i686-linux.tar.xz
+        hash=9e8a403421c68683557180444f089861469e12b41d41ee2f9be4c8e731b7d160
+        path=zjcwglfyf0fvjb4j86kgijzwhzaqbngc/nix-2.31.2-i686-linux.tar.xz
         system=i686-linux
         ;;
     Linux.aarch64)
-        hash=d29ea31c581e1ba7a651e6b22999cef8923e852e1d6fe7008d9545f4275f5343
-        path=npadny2da5149lcycbfmacf1r936n9zg/nix-2.8.0-aarch64-linux.tar.xz
+        hash=64db528412096d718b4bf8f78f85e5ac2b714b774e5005500dee37d23f560456
+        path=0aw1ka8njh94nvjy8596va5bbx4wd2nw/nix-2.31.2-aarch64-linux.tar.xz
         system=aarch64-linux
         ;;
-    Linux.armv6l_linux)
-        hash=69d5cb0e95bc83154099debd139d4f767622d94b17149fa127d492017c2e3896
-        path=jb1l7y40im5dsbq5gamppss59y0c7jmj/nix-2.8.0-armv6l-linux.tar.xz
+    Linux.armv6l)
+        hash=5e088d3f4fe27dd35991b1888c1ea5284edade24965328604968b9a1cc20a94c
+        path=2pzkwf2ysf0znsnz5i9gfn6w2gikhlys/nix-2.31.2-armv6l-linux.tar.xz
         system=armv6l-linux
         ;;
-    Linux.armv7l_linux)
-        hash=25857729f23dc25fe92dabd376917d83fe0f23038f82c1f2ab230171eb70f648
-        path=firp24ikxcygwrwd4208lyla4b6jl3sh/nix-2.8.0-armv7l-linux.tar.xz
+    Linux.armv7l)
+        hash=4e2c1e8a3172ae71f041b9b647aa8153fb24518272d1a9bc3d9b384ab7ad54a1
+        path=nkp9wbvnsxinr9xl7sn0yy96wvc4chn0/nix-2.31.2-armv7l-linux.tar.xz
         system=armv7l-linux
         ;;
+    Linux.riscv64)
+        hash=79601e08b6389df130b5bf1e0a48590aea044ac18bc61660545cf65843b39251
+        path=dhqxgwygm94vd6rdiwscxxz98kh8jal3/nix-2.31.2-riscv64-linux.tar.xz
+        system=riscv64-linux
+        ;;
     Darwin.x86_64)
-        hash=ebf383f1b499d3e4897cd61d068dc46e118e5f53667f5f28748b0b3682d7649a
-        path=wwf7b61nyhgj3z0vvgnnb4yzi081jkjp/nix-2.8.0-x86_64-darwin.tar.xz
+        hash=ed8df6a1046dea90ba4068a827bdeaf372d522867c4d2b48cdb37145c200eeba
+        path=5zp5bzz45sn9ff2bfhh03cmavvm1r6gs/nix-2.31.2-x86_64-darwin.tar.xz
         system=x86_64-darwin
         ;;
     Darwin.arm64|Darwin.aarch64)
-        hash=f320f381299e0fc2f907ae81ac123d0689245cb39f0672f8a65dffea12fa0240
-        path=fr5rcinvqzgcrggxw3phrzcck9wpzz83/nix-2.8.0-aarch64-darwin.tar.xz
+        hash=3baa0af88a1ef4e2cc82cb64cd384b1805ecc3771b574e97277ae213d52711d8
+        path=b7hidzsb4i3gx6s23ig9mp7mwmiljzfk/nix-2.31.2-aarch64-darwin.tar.xz
         system=aarch64-darwin
         ;;
     *) oops "sorry, there is no binary distribution of Nix for your platform";;
@@ -71,10 +76,10 @@ if [ "${1:-}" = "--tarball-url-prefix" ]; then
     url=${2}/${path}
     shift 2
 else
-    url=https://releases.nixos.org/nix/nix-2.8.0/nix-2.8.0-$system.tar.xz
+    url=https://releases.nixos.org/nix/nix-2.31.2/nix-2.31.2-$system.tar.xz
 fi
 
-tarball=$tmpDir/nix-2.8.0-$system.tar.xz
+tarball=$tmpDir/nix-2.31.2-$system.tar.xz
 
 require_util tar "unpack the binary tarball"
 if [ "$(uname -s)" != "Darwin" ]; then
@@ -89,7 +94,7 @@ else
     oops "you don't have wget or curl installed, which I need to download the binary tarball"
 fi
 
-echo "downloading Nix 2.8.0 binary tarball for $system from '$url' to '$tmpDir'..."
+echo "downloading Nix 2.31.2 binary tarball for $system from '$url' to '$tmpDir'..."
 fetch "$url" "$tarball" || oops "failed to download '$url'"
 
 if command -v sha256sum > /dev/null 2>&1; then

docker/docker/caddy/Caddyfile

@@ -24,6 +24,13 @@ dt.beany.club {
     }
 }
 
+vorschlagzumklangvongeschichtsschreibendenprozessen.de {
+    file_server {
+        root /srv/vorschlagzumklangvongeschichtsschreibendenprozessen.de
+        browse
+    }
+}
+
 tichy.click {
     file_server {
         root /srv/tichy.click
@@ -39,18 +46,21 @@ pad.pbrinkmeier.de {
 }
 
 git.pbrinkmeier.de {
-    reverse_proxy gitea:3000
-}
-
-ci.pbrinkmeier.de {
-    reverse_proxy drone:80
-}
-
-jupyter.pbrinkmeier.de {
-    reverse_proxy jupyter:8888
-    basicauth {
-        wug JDJhJDE0JEJrQXUzVWxFZ2JGVmx6YlZWTkpYdy5IMjRXdnZZdGw5SjZDcUg2ZWMxOEVjcEV6dWhIRmhD
+    # Allow apps to requests tokens 'n stuff
+    @oauth path /login/oauth/*
+    header @oauth {
+        Access-Control-Allow-Origin "*"
+        Access-Control-Allow-Methods "GET, POST, OPTIONS"
+        Access-Control-Allow-Headers "Content-Type, Authorization"
     }
+
+    @oauth_preflight {
+        path /login/oauth/*
+        method OPTIONS
+    }
+    respond @oauth_preflight 204
+
+    reverse_proxy gitea:3000
 }
 
 plantuml.pbrinkmeier.de {
@@ -64,3 +74,17 @@ utoy.beany.club {
 vrnp.beany.club {
     reverse_proxy vrnp:8000
 }
+
+fz.beany.club {
+    reverse_proxy yore:3000
+}
+
+beany.club, www.beany.club {
+    file_server {
+        root /srv/beany.club
+    }
+}
+
+qr.beany.club {
+    redir https://beany.club{uri}
+}

docker/docker/caddy/Dockerfile

@@ -1,4 +1,4 @@
-FROM caddy
+FROM caddy:latest
 
 COPY Caddyfile /etc/caddy/Caddyfile
 RUN chown 42002:42002 /etc/caddy/Caddyfile

docker/docker/caddy/docker-compose.yaml

@@ -6,15 +6,20 @@ services:
     ports:
       - "80:80"
       - "443:443"
+      # For hitparade/pollmaster
+      - "12080:12080"
+      - "12081:12081"
     user: "42002"
     volumes:
       - /var/lib/pbri/docker/caddy_data:/data
       - /var/lib/pbri/docker/caddy_config:/config
       # See nanna-sites playbook/Caddyfile
       - /home/david/Sites/dt.beany.club:/srv/dt.beany.club:ro
+      - /home/david/Sites/vorschlagzumklangvongeschichtsschreibendenprozessen.de:/srv/vorschlagzumklangvongeschichtsschreibendenprozessen.de:ro
       - /home/paul/Sites/files.pbrinkmeier.de:/srv/files.pbrinkmeier.de:ro
       - /home/paul/Sites/pbrinkmeier.de:/srv/pbrinkmeier.de:ro
       - /home/paul/Sites/tichy.click:/srv/tichy.click:ro
+      - /home/paul/Sites/beany.club:/srv/beany.club:ro
     restart: always
 
 networks:

docker/docker/codi/README.md

@@ -6,5 +6,3 @@ CODI_DB_USER=...
 CODI_DB_PASSWORD=...
 CODI_DB_DB=...
 ```
-
-See also: https://docs.drone.io/server/provider/gitea/.

docker/docker/codi/docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
   codi:
-    image: hackmdio/hackmd:2.5.4
+    image: hackmdio/hackmd:2.6.1
     user: hackmd
     environment:
       # Admin stuff

docker/docker/factorio/Dockerfile

@@ -0,0 +1,4 @@
+FROM factoriotools/factorio:2.0.73
+
+COPY server-settings.json /server-settings.json
+ENTRYPOINT [ "/bin/sh", "-c", "mkdir -p /factorio/config && envsubst < /server-settings.json > /factorio/config/server-settings.json && exec /docker-entrypoint.sh" ]

docker/docker/factorio/README.md

@@ -0,0 +1,10 @@
+# factorio
+
+Add a `.env` file like this:
+
+```
+GAME_PASSWORD=...
+```
+
+Environment variables are put into `server-settings.json` during startup using `envsubst`.
+See also: https://hub.docker.com/r/factoriotools/factorio.

docker/docker/factorio/docker-compose.yaml

@@ -0,0 +1,15 @@
+---
+
+services:
+  factorio:
+    image: pbrinkmeier/factorio
+    build: .
+    restart: always
+    environment:
+      GAME_PASSWORD: "${GAME_PASSWORD}"
+      DLC_SPACE_AGE: false
+    volumes:
+      - /var/lib/pbri/docker/factorio:/factorio
+    ports:
+      - "34197:34197/udp"
+      - "27015:27015/tcp"

docker/docker/factorio/server-settings.json

@@ -0,0 +1,72 @@
+{
+    "name": "le epic factorio server",
+    "description": "Description of the game that will appear in the listing",
+    "tags": ["game", "tags"],
+  
+    "_comment_max_players": "Maximum number of players allowed, admins can join even a full server. 0 means unlimited.",
+    "max_players": 0,
+  
+    "_comment_visibility": ["public: Game will be published on the official Factorio matching server",
+                            "lan: Game will be broadcast on LAN"],
+    "visibility":
+    {
+      "public": false,
+      "lan": false
+    },
+  
+    "_comment_credentials": "Your factorio.com login credentials. Required for games with visibility public",
+    "username": "",
+    "password": "",
+  
+    "_comment_token": "Authentication token. May be used instead of 'password' above.",
+    "token": "",
+  
+    "game_password": "${GAME_PASSWORD}",
+  
+    "_comment_require_user_verification": "When set to true, the server will only allow clients that have a valid Factorio.com account",
+    "require_user_verification": false,
+  
+    "_comment_max_upload_in_kilobytes_per_second" : "optional, default value is 0. 0 means unlimited.",
+    "max_upload_in_kilobytes_per_second": 0,
+  
+    "_comment_max_upload_slots" : "optional, default value is 5. 0 means unlimited.",
+    "max_upload_slots": 5,
+  
+    "_comment_minimum_latency_in_ticks": "optional one tick is 16ms in default speed, default value is 0. 0 means no minimum.",
+    "minimum_latency_in_ticks": 0,
+  
+    "_comment_max_heartbeats_per_second": "Network tick rate. Maximum rate game updates packets are sent at before bundling them together. Minimum value is 6, maximum value is 240.",
+    "max_heartbeats_per_second": 60,
+  
+    "_comment_ignore_player_limit_for_returning_players": "Players that played on this map already can join even when the max player limit was reached.",
+    "ignore_player_limit_for_returning_players": false,
+  
+    "_comment_allow_commands": "possible values are, true, false and admins-only",
+    "allow_commands": "admins-only",
+  
+    "_comment_autosave_interval": "Autosave interval in minutes",
+    "autosave_interval": 10,
+  
+    "_comment_autosave_slots": "server autosave slots, it is cycled through when the server autosaves.",
+    "autosave_slots": 5,
+  
+    "_comment_afk_autokick_interval": "How many minutes until someone is kicked when doing nothing, 0 for never.",
+    "afk_autokick_interval": 5,
+  
+    "_comment_auto_pause": "Whether should the server be paused when no players are present.",
+    "auto_pause": true,
+  
+    "only_admins_can_pause_the_game": true,
+  
+    "_comment_autosave_only_on_server": "Whether autosaves should be saved only on server or also on all connected clients. Default is true.",
+    "autosave_only_on_server": true,
+  
+    "_comment_non_blocking_saving": "Highly experimental feature, enable only at your own risk of losing your saves. On UNIX systems, server will fork itself to create an autosave. Autosaving on connected Windows clients will be disabled regardless of autosave_only_on_server option.",
+    "non_blocking_saving": false,
+  
+    "_comment_segment_sizes": "Long network messages are split into segments that are sent over multiple ticks. Their size depends on the number of peers currently connected. Increasing the segment size will increase upload bandwidth requirement for the server and download bandwidth requirement for clients. This setting only affects server outbound messages. Changing these settings can have a negative impact on connection stability for some clients.",
+    "minimum_segment_size": 25,
+    "minimum_segment_size_peer_count": 20,
+    "maximum_segment_size": 100,
+    "maximum_segment_size_peer_count": 10
+  }

docker/docker/gitea/Dockerfile

@@ -1,3 +1,3 @@
- FROM gitea/act_runner:0.2.11
+ FROM gitea/runner:5.0.0
 
  COPY runner-config.yaml /opt/runner-config.yaml

docker/docker/gitea/docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
   gitea:
-    image: gitea/gitea:1.23.1
+    image: gitea/gitea:1.27.3
     restart: unless-stopped
     environment:
       # Ref: https://docs.gitea.io/en-us/config-cheat-sheet
@@ -23,8 +23,6 @@ services:
       GITEA__database__NAME: gitea
       GITEA__database__USER: gitea
       GITEA__database__PASSWD: "${GITEA_DB_PASSWORD}"
-      GITEA__picture__DISABLE_GRAVATAR: "true"
-      GITEA__picture__FEDERATED_AVATAR: "false"
       GITEA__service__DISABLE_REGISTRATION: "true"
       GITEA__service__REGISTER_EMAIL_CONFIRM: "true"
       GITEA__service__ENABLE_NOTIFY_MAIL: "true"
@@ -65,7 +63,7 @@ services:
 
   gitea_runner:
     # Make sure to keep this in sync with the version in the Dockerfile
-    image: pbrinkmeier/act_runner:0.2.11
+    image: pbrinkmeier/gitea-runner:5.0.0
     build: .
     restart: unless-stopped
     environment:

docker/docker/gitea/runner-config.yaml

@@ -34,6 +34,7 @@ runner:
     - "ubuntu-22.04:docker://node:16-bullseye"
     - "node-22-bullseye:docker://node:22-bullseye"
     - "node-22-bookworm:docker://node:22-bookworm"
+    - "node-26-trixie:docker://node:26-trixie"
 
 cache:
   # Enable cache server to use actions/cache.
@@ -74,7 +75,10 @@ container:
   # If you want to allow any volume, please use the following configuration:
   # valid_volumes:
   #   - '**'
-  valid_volumes: []
+  valid_volumes:
+    - /var/lib/pbri/docker/nix_runner_etc
+    - /var/lib/pbri/docker/nix_runner_nix
+    - /var/lib/pbri/docker/nix_runner_home_node
   # overrides the docker client host with the specified one.
   # If it's empty, act_runner will find an available docker host automatically.
   # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.

docker/docker/hitparade/Dockerfile

@@ -0,0 +1,3 @@
+FROM mariadb:10.6
+
+COPY pollmaster_scheme.sql /docker-entrypoint-initdb.d/init.sql

docker/docker/hitparade/docker-compose.yaml

@@ -0,0 +1,30 @@
+services:
+  pollmaster_db:
+    image: pbrinkmeier/pollmaster_db
+    build: .
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD}"
+      MYSQL_DATABASE: 'pollmaster'
+      MYSQL_USER: 'pollmaster'
+      MYSQL_PASSWORD: "${MYSQL_PASSWORD}"
+    volumes:
+      - /var/lib/pbri/docker/hitparade_pollmaster_db_data:/var/lib/mysql
+
+  # Caddy terminates https for :12080 and :12081
+  pollmaster:
+    image: git.pbrinkmeier.de/paul/pollmaster:4
+    volumes:
+      - /etc/pbri/docker/hitparade/pollmaster-config.yml:/config.yml:ro
+      - /var/lib/pbri/docker/pollmaster_sessions:/app/pollmaster/sessions
+    depends_on:
+      - pollmaster_db
+
+  # Doesn't need further config, the pollmaster URL is baked into the image
+  voter:
+    image: git.pbrinkmeier.de/paul/voter:4
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/docker/hitparade/pollmaster_scheme.sql

@@ -0,0 +1,114 @@
+CREATE TABLE IF NOT EXISTS `admin` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `name` varchar(50) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `password` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `image` mediumtext CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `Schlüssel 2` (`name`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `artist` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `name` varchar(300) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `locked` tinyint(1) NOT NULL DEFAULT 0,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `Name` (`name`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=2285 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `track` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `uri` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `name` varchar(300) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `album` varchar(300) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `year` varchar(50) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `length` mediumint(8) unsigned NOT NULL,
+  `image` varchar(200) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `locked` tinyint(1) unsigned NOT NULL DEFAULT 0,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `URI` (`uri`) USING BTREE,
+  KEY `Name` (`name`)
+) ENGINE=InnoDB AUTO_INCREMENT=3570 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `playback` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `track_id` int(10) unsigned NOT NULL,
+  `timestamp` bigint(20) unsigned NOT NULL,
+  PRIMARY KEY (`id`),
+  KEY `FK_playback_track` (`track_id`),
+  KEY `Time` (`timestamp`),
+  CONSTRAINT `FK_playback_track` FOREIGN KEY (`track_id`) REFERENCES `track` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB AUTO_INCREMENT=227 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `playlist` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `name` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `uri` varchar(80) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `Schlüssel 2` (`name`),
+  KEY `Schlüssel 3` (`uri`)
+) ENGINE=InnoDB AUTO_INCREMENT=6 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `playlist_track` (
+  `playlist_id` int(10) unsigned NOT NULL,
+  `track_id` int(10) unsigned NOT NULL,
+  `position` int(10) unsigned NOT NULL,
+  PRIMARY KEY (`playlist_id`,`track_id`),
+  KEY `FK_playlist_track_track` (`track_id`),
+  KEY `FK_playlist_track_playlist` (`playlist_id`),
+  CONSTRAINT `FK_playlist_track_playlist` FOREIGN KEY (`playlist_id`) REFERENCES `playlist` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `FK_playlist_track_track` FOREIGN KEY (`track_id`) REFERENCES `track` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `search_term` (
+  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
+  `term` varchar(200) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `first_search` bigint(20) unsigned NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `Schlüssel 2` (`term`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=88 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `search_term_track` (
+  `search_term_id` int(10) unsigned NOT NULL,
+  `track_id` int(10) unsigned NOT NULL,
+  PRIMARY KEY (`search_term_id`,`track_id`),
+  KEY `FK_search_term_tracks_track` (`track_id`),
+  CONSTRAINT `FK_search_term_tracks_search_term` FOREIGN KEY (`search_term_id`) REFERENCES `search_term` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `FK_search_term_tracks_track` FOREIGN KEY (`track_id`) REFERENCES `track` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `session` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `name` varchar(50) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `image` mediumtext CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `last_seen` bigint(20) unsigned NOT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `Schlüssel 2` (`name`) USING BTREE
+) ENGINE=InnoDB AUTO_INCREMENT=14 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `setting` (
+  `key` varchar(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `value` varchar(500) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  PRIMARY KEY (`key`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `track_artist` (
+  `track_id` int(10) unsigned NOT NULL,
+  `artist_id` int(10) unsigned NOT NULL,
+  PRIMARY KEY (`artist_id`,`track_id`),
+  KEY `FK__track` (`track_id`),
+  KEY `FK__artist` (`artist_id`),
+  CONSTRAINT `FK__artist` FOREIGN KEY (`artist_id`) REFERENCES `artist` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `FK__track` FOREIGN KEY (`track_id`) REFERENCES `track` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS `vote` (
+  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+  `track_id` int(10) unsigned NOT NULL,
+  `session_id` int(10) unsigned DEFAULT NULL,
+  `timestamp` bigint(20) unsigned NOT NULL,
+  PRIMARY KEY (`id`),
+  KEY `FK_vote_track` (`track_id`),
+  KEY `FK_vote_session` (`session_id`),
+  CONSTRAINT `FK_vote_track` FOREIGN KEY (`track_id`) REFERENCES `track` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB AUTO_INCREMENT=319 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+

docker/docker/utoy/docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
   utoy:
-    image: git.pbrinkmeier.de/paul/utoy:0.6.2
+    image: git.pbrinkmeier.de/paul/utoy:0.6.3
     restart: always
 
 networks:

docker/docker/yore/docker-compose.yaml

@@ -0,0 +1,34 @@
+services:
+  yore:
+    image: git.pbrinkmeier.de/paul/yore:0.0.12
+    restart: always
+    environment:
+      # For dbmate (migrations)
+      DATABASE_URL: "postgres://yore:${YORE_DB_PASSWORD}@yore_db/yore-db?sslmode=disable&search_path=public"
+      # For yore itself
+      YORE_DB: "host=yore_db dbname=yore-db user=yore password=${YORE_DB_PASSWORD}"
+      YORE_DOWNLOAD_DIR: /data/downloads
+      YORE_DBMATE_DIR: /data/dbmate
+    user: 42004:42004
+    volumes:
+      - /etc/passwd:/etc/passwd:ro
+      - /etc/group:/etc/group:ro
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+      - /var/lib/pbri/docker/yore_data:/data
+
+  yore_db:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: yore-db
+      POSTGRES_USER: yore
+      POSTGRES_PASSWORD: "${YORE_DB_PASSWORD}"
+    volumes:
+      - /var/lib/pbri/docker/yore_db:/var/lib/postgresql/data
+
+
+networks:
+  default:
+    name: caddy-network
+    external: true

docker/envs/factorio/.env

@@ -0,0 +1,6 @@
+$ANSIBLE_VAULT;1.1;AES256
+33633161386465383663373137623030626264653862373161353564343662346433376437353530
+6265356266663464613439663434373531333939326538330a313064343637366632633866343534
+38313234303830636364383361613538666338636333323262333438313134353134356635626239
+6366336439353266660a633161383062666130396566396431383534313266343431633064376463
+38623562656564363565346166396363303636323062336636313838653638663833

docker/envs/hitparade/.env

@@ -0,0 +1,11 @@
+$ANSIBLE_VAULT;1.1;AES256
+39313233623136333531343838643537373064363466356664326339323237623032303436613735
+6233383831383339366365663931333837313161646263390a646237306331386263323031373164
+33383365643735343834643839356238646161613330353938643738636135653562646430303330
+3332306436613537370a653234353464646639366236623665623162643363353230643963636361
+65386363623336396664333237313066383764656438363233653831623238623062333064343263
+36336132393563333031656366313066383132663732313964376261656331613863393965393232
+66383031366564313636643363653239663537616537623263383135326464376330636333303736
+32316530316139323264353136633865373634323761653763326262383238396639646664653039
+31376639346138343635343937613061623261666465323332313361363064393035663038346231
+3734333734656334626265643030303634383864613536373934

docker/envs/hitparade/pollmaster-config.yml

@@ -0,0 +1,30 @@
+$ANSIBLE_VAULT;1.1;AES256
+62303232383236386431613965343261333235646564616235643363393462646166613531303230
+6361343030396633663262333363616538323230313733620a306237396132663064316633323937
+62313339383336613066653662663066323330396234303435373137326435343637623465366133
+3534643534396639640a373834656135393733373465663138316564383662613561353065613861
+62643438383165316132333737623038336132666264353531633965663032333165666630626633
+65643632616363343938643138353238636231383134383733656466346531626634346163626434
+32383065316231363737663463663562373031313965346363336134653536663365613264383261
+61616434383537666334663166393536376634386231343030343465393837326439363465633064
+62643661643063316465623034646566363962353431623430356432366461613835633133663663
+35663836383830616161656265316463396335326330623439383935323039366136366232303235
+38323262316432343762663865333036313137396235396530656632366531303535626364363666
+32613030346636646136636532653134616639396237643866356464363138633863363061656534
+34646431393238386166306239666331376166316635333361616464396363626635343963306663
+30363930366332343934613830396464633534653565306138613066383933346633323337656264
+62636337326266633162356363373430626433653837346330653338306530356261383462336261
+65333364656263623335653937386439326164623838613463613031323037383762343165363230
+38343366346130383632316234656166313935336464666530373939333063356461303139643033
+38636133313037613431663161383836653137653964393866346564663339363764643535333037
+36616337666636653835313334373164666165313066366163373739393462653362306135396538
+66303636623535353231373839383539613165353463643961643130666563633465353534623931
+31343039313336323932373230643137323432313737396538353834376639353235306332353334
+65303231623138386237383437383234366461356464343236396631303234353566346534326665
+34316436326335333737633463386635356432326162346463646665643034626339643161383938
+63363531393131363464643232376232363639306564656463323162316362343233376663633662
+31333164316565383436326461316533386536623062373531323037373033373265333437393836
+36613530303163393931363666613865616566626533356131613239626162633236643635613938
+30393362316461396532393261643464376365643337633233323666336135366535653536386130
+35623564626135303232656337313430346136376361376232343166663232353763376464376230
+39356565373364353635386630333238616263306639663963616662633137343965

docker/envs/yore/.env

@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+36313063633538313631386664353535373166306563613830316430613035306438326564396331
+6336306566306166616266643630343262616465306631350a393932613665346164613361333037
+39386135396364666630623962653462623234386430383034353731353361663837343036393130
+3261633964626135610a626364363761373734333762373764366363643537316662643634616263
+32383730663230303064626130393164616237636362656331313333316439323135366535303334
+3436323333383739666261656531363335326532616562353166

flake.lock

@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1737753628,
-        "narHash": "sha256-vwRbCpftG6/QrBeu3eQO1l5wzAg/pAMdvGOOLeXWeM4=",
+        "lastModified": 1779042148,
+        "narHash": "sha256-0/iVMQ31Zna06KJselli3hFuGy4HKacyJ8UxmWMrNZI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f22b0184bd0f4bb3061580b1e807feb68a85d90d",
+        "rev": "3ef9dc56727d66ad28c2c3608da7261391ca18ad",
         "type": "github"
       },
       "original": {