Format all files

FIx handling users with no docker services
Fix invalid git cli call
2024-11-29 01:15:08 +01:00 · 2024-11-29 01:15:08 +01:00 · 2024-11-29 01:15:08 +01:00 · 2024-11-29 01:15:08 +01:00 · 2024-11-29 01:15:08 +01:00 · 2024-11-29 01:15:08 +01:00
106 changed files with 2638 additions and 797 deletions
--- a/archiso/airootfs/root/.zlogin
+++ b/archiso/airootfs/root/.zlogin
@ -5,17 +5,16 @@ fi

 ~/.automated_script.sh

-if bash -c "ls /sys/class/backlight/*/max_brightness" > /dev/null 2>&1
-then
+if bash -c "ls /sys/class/backlight/*/max_brightness" >/dev/null 2>&1; then
    cat /sys/class/backlight/*/max_brightness >/sys/class/backlight/*/brightness
 fi

 cd "/root/PortValhalla" || exit

-git diff -p -R --no-ext-diff --no-color --diff-filter=M \
-    | grep -E "^(diff|(old|new) mode)" --color=never  \
-    | sed "/^diff/{ x; d; }; x; /./{ p; z; }; x;" \
-    | git apply
+git diff -p -R --no-ext-diff --no-color --diff-filter=M |
+    grep -E "^(diff|(old|new) mode)" --color=never |
+    sed "/^diff/{ x; d; }; x; /./{ p; z; }; x;" |
+    git apply

 loadkeys de_CH-latin1
 ./scripts/Arch/OS/setup.fish
--- a/archiso/scripts/show-diff.fish
+++ b/archiso/scripts/show-diff.fish
@ -16,8 +16,7 @@ begin
        and begin
            git -C "$projectDir" ls-files
            git -C "$projectDir" ls-files --exclude-standard --others
-        end | \
-            rsync --files-from=/dev/stdin --exclude={.gitignore,README.md,scripts,LICENSE,valhalla.patch} "$dir/.." "$contextRoot"
+        end | rsync --files-from=/dev/stdin --exclude={.gitignore,README.md,scripts,LICENSE,valhalla.patch} "$dir/.." "$contextRoot"
    end &>/dev/null

    and git -C "$contextRoot" diff
--- a/archiso/scripts/valhalla.patch
+++ b/archiso/scripts/valhalla.patch
@ -1,23 +1,22 @@
 diff --git a/airootfs/root/.zlogin b/airootfs/root/.zlogin
-index bf6bc8f..bdbe55c 100644
+index bf6bc8f..e71dc26 100644
 --- a/airootfs/root/.zlogin
 +++ b/airootfs/root/.zlogin
-@@ -4,3 +4,18 @@ if grep -Fqa 'accessibility=' /proc/cmdline &> /dev/null; then
+@@ -4,3 +4,17 @@ if grep -Fqa 'accessibility=' /proc/cmdline &> /dev/null; then
 fi
 
 ~/.automated_script.sh
 +
-+if bash -c "ls /sys/class/backlight/*/max_brightness" > /dev/null 2>&1
-+then
+if bash -c "ls /sys/class/backlight/*/max_brightness" >/dev/null 2>&1; then
 +    cat /sys/class/backlight/*/max_brightness >/sys/class/backlight/*/brightness
 +fi
 +
 +cd "/root/PortValhalla" || exit
 +
-+git diff -p -R --no-ext-diff --no-color --diff-filter=M \
-+    | grep -E "^(diff|(old|new) mode)" --color=never  \
-+    | sed "/^diff/{ x; d; }; x; /./{ p; z; }; x;" \
-+    | git apply
+git diff -p -R --no-ext-diff --no-color --diff-filter=M |
+    grep -E "^(diff|(old|new) mode)" --color=never |
+    sed "/^diff/{ x; d; }; x; /./{ p; z; }; x;" |
+    git apply
 +
 +loadkeys de_CH-latin1
 +./scripts/Arch/OS/setup.fish
--- a/flake.nix
+++ b/flake.nix
@ -45,6 +45,7 @@
    valhalla = {
      DerGeret = import ./profiles/machines/manuel/DerGeret/Arch/config.nix;
      ManuSurface = import ./profiles/machines/manuel/ManuSurface/Arch/config.nix;
+      server = import ./profiles/machines/manuel/server.nix;
    };
  };
 }
--- a/lib/eval-attribute.nix
+++ b/lib/eval-attribute.nix
@ -5,8 +5,10 @@ let
    overlay = [ ];
  };
  property = (builtins.getEnv "PROPERTY");
-  processor = if (builtins.stringLength property > 0) then
+  processor =
+    if (builtins.stringLength property > 0) then
      (_: lib.attrsets.getAttrFromPath (lib.strings.splitString "." property) _)
    else
      (_: _);
-in _: processor (lib.evalModules { modules = [ _ ]; }).config
+in
+_: processor (lib.evalModules { modules = [ _ ]; }).config
--- a/lib/modules/hardware.nix
+++ b/lib/modules/hardware.nix
@ -3,7 +3,8 @@ let
  inherit (lib) mkOption types;
  optionalAttrs = lib.attrsets.optionalAttrs;
  hw = config.valhalla.hardware;
-in {
+in
+{
  options = {
    valhalla = {
      hardware = {
--- a/lib/modules/os.nix
+++ b/lib/modules/os.nix
@ -4,7 +4,8 @@ in {
  options = {
    valhalla = mkOption {
      type = types.submodule (
-        { extendModules, ... }: let
+        { extendModules, ... }:
+        let
          osVariant = extendModules {
            modules = [
              ({ config, ... }: {
@ -35,7 +36,8 @@ in {
          };

          windowsVariant = osVariant.extendModules { };
-        in {
+        in
+        {
          options = {
            linux = mkOption {
              inherit (linuxVariant) type;
@ -51,7 +53,8 @@ in {
              visible = "shallow";
            };
          };
-        });
+        }
+      );

      description = "Configuration for PortValhalla.";
      default = { };
--- a/lib/modules/partition/disks.nix
+++ b/lib/modules/partition/disks.nix
@ -34,12 +34,14 @@ let
        };

        devicePath = mkOption {
-          type = if osDisk then
+          type =
+            if osDisk then
              types.nullOr types.str
            else
              types.str;
          description = "The path to the device.";
-          default = if osDisk && config.deviceName == null then
+          default =
+            if osDisk && config.deviceName == null then
              null
            else
              "/dev/${config.deviceName}";
@ -69,7 +71,8 @@ let
        };
      };

-      config = let
+      config =
+        let
          diskVarName = "${diskListVarName}[${config.id}]";
          diskVar = "\${${diskVarName}}";

@ -88,7 +91,8 @@ let
              if builtins.isInt type then
                "${lib.trivial.toHexString type}"
              else
-              type);
+                type
+            );

          fdiskCommand = arguments: "sudo sfdisk ${arguments}";
          fdiskScript = script: args: append:
@ -110,7 +114,8 @@ let
            (lib.optionals config.wipe [
              cleanup
              (wipeScript "label: gpt")
-          ] ++ (builtins.concatMap (
+            ] ++ (builtins.concatMap
+              (
                partition:
                let
                  inherit (partition) format index keepExisting label sizeScript type;
@ -148,24 +153,31 @@ let
                      ${create}
                    fi
                  '';
-              in [
+                in
+                [
                  ''local diskPath="$(find -L /dev/disk/by-diskseq -samefile ${diskVar})"''
                  ''local ${partVarName}="$diskPath-part${toString index}"''
                  (if keepExisting then fallback else create)
                  "sudo ${labelScripts.${format} label}"
-              ]) partitions));
+                ]
+              )
+              partitions));

-        fixType = lib.strings.concatLines (builtins.concatMap (
+          fixType = lib.strings.concatLines (builtins.concatMap
+            (
              partition:
              lib.optional
                (partition.keepExisting && !(builtins.isNull partition.type))
-              ''sudo sfdisk --part-type ${diskVar} ${toString partition.index} ${mkType partition.type}'')
+                ''sudo sfdisk --part-type ${diskVar} ${toString partition.index} ${mkType partition.type}''
+            )
            partitions);
-      in {
+        in
+        {
          id = if osDisk then "os" else "disk-${name}";
          deviceVariable = diskVar;

-        deviceScript = if osDisk && config.devicePath == null then ''
+          deviceScript =
+            if osDisk && config.devicePath == null then ''
              ${diskSelector}
            '' else ''
              ${diskVarName}=${config.devicePath}
@ -197,7 +209,8 @@ let
            partition
          '';
        };
-    });
+    }
+  );

  partitionType = types.submodule (
    { name, config, ... }: {
@ -228,7 +241,8 @@ let
        format = mkOption {
          type = types.enum (builtins.attrValues fs);
          description = "The file system format of the partition.";
-          default = if (isSwap config) then
+          default =
+            if (isSwap config) then
              fs.swap
            else
              throw ("Partition format not specified.");
@ -271,8 +285,10 @@ let
        else
          "echo ${lib.strings.escapeShellArg (toString config.size)}");
      };
-    });
-in {
+    }
+  );
+in
+{
  options = {
    valhalla = {
      partition = {
@ -304,7 +320,8 @@ in {
  config = {
    valhalla = {
      partition = {
-        script = lib.mkDefault (let
+        script = lib.mkDefault (
+          let
            cfg = config.valhalla.partition;
            inherit (cfg) os rootDir;
            inherit (lib.strings) normalizePath;
@ -312,7 +329,8 @@ in {
            disks = ([ os ] ++ (builtins.attrValues cfg.disks));
            partitions = (builtins.concatMap (_: (builtins.attrValues _.partitions)) disks);

-          mountScript = lib.strings.concatLines (builtins.concatMap (
+            mountScript = lib.strings.concatLines (builtins.concatMap
+              (
                _: [
                  probeScript
                  (builtins.concatStringsSep " " ([
@ -320,22 +338,29 @@ in {
                    "mount"
                    "--mkdir"
                  ] ++ (lib.optionals (_.format == "ntfs") [
-                  "-t" "ntfs3"
+                    "-t"
+                    "ntfs3"
                  ]) ++ [
                    (builtins.concatStringsSep " " (builtins.map (_: "-o ${_}") _.mountOptions))
                    (partPath _)
                    (normalizePath "/${rootDir}/${_.mountPoint}")
                  ]))
-            ]) (lib.lists.sortOn
+                ]
+              )
+              (lib.lists.sortOn
                (_: normalizePath "/${_.mountPoint}")
                (builtins.filter (_: _.mountPoint != null) partitions)));

-          swapScript = lib.strings.concatLines (builtins.map (
+            swapScript = lib.strings.concatLines (builtins.map
+              (
                _: ''
                  ${probeScript}
                  sudo swapon ${partPath _}
-            '') (builtins.filter (_: _.useSwap) partitions));
-        in lib.strings.concatLines ([
+                ''
+              )
+              (builtins.filter (_: _.useSwap) partitions));
+          in
+          lib.strings.concatLines ([
            "#!/bin/bash"
            "set -o errexit"
          ]
@ -353,7 +378,8 @@ in {
          ] ++ (builtins.map (_: _.script) disks) ++ [
            mountScript
            swapScript
-          ]));
+          ])
+        );
      };
    };
  };
--- a/lib/modules/programs.nix
+++ b/lib/modules/programs.nix
@ -11,26 +11,32 @@ let
        };

        config = {
-          programs = builtins.mapAttrs (
+          programs = builtins.mapAttrs
+            (
              name: config: {
                enable = mkDefault config.enable;
-            }) osConfig.programs;
+              }
+            )
+            osConfig.programs;
        };
-    }));
+      }
+    ));
  };

-  mkPrograms = infos: builtins.foldl' (programs: info:
+  mkPrograms = infos: builtins.foldl'
+    (programs: info:
      programs // {
        ${builtins.elemAt info 0} = {
          enable = mkEnableOption (builtins.elemAt info 1);
        };
-    }) { } infos;
+      })
+    { }
+    infos;

  programs = mkPrograms [
    [ "aliae" "aliae" ]
    [ "brave" "Brave Browser" ]
    [ "discord" "Discord" ]
-    ["docker" "docker"]
    [ "firefox" "Firefox Web Browser" ]
    [ "openssh" "OpenSSH" ]
    [ "osu!lazer" "osu!lazer" ]
@ -51,6 +57,7 @@ let
    [ "logo-ls" "logo-ls" ]
    [ "lutris" "Lutris" ]
    [ "minegrub-theme" "Minegrub Theme" ]
+    [ "nginx" "nginx" ]
    [ "nodejs-n" "n" ]
    [ "nuke-usb" "nuke-usb" ]
    [ "nvidia-dkms" "Nvidia Drivers" ]
@ -81,8 +88,10 @@ let
    [ "visualstudio" "Visual Studio" ]
    [ "winscp" "WinSCP" ]
  ];
-in {
+in
+{
  imports = [
+    ./programs/docker.nix
    ./programs/git.nix
    ./programs/nextcloud.nix
    ./programs/oh-my-posh.nix
--- a/lib/modules/programs/docker.nix
+++ b/lib/modules/programs/docker.nix
@ -0,0 +1,45 @@
+{ lib, ... }:
+let
+  inherit (lib) mkEnableOption mkOption types;
+
+  commonOptions = {
+    enable = mkEnableOption "docker";
+  };
+in
+{
+  options = {
+    valhalla = {
+      programs.docker = commonOptions;
+
+      users = mkOption {
+        type = types.attrsOf (types.submodule (
+          { ... }: {
+            options = {
+              programs.docker = commonOptions;
+            };
+          }
+        ));
+      };
+
+      linux = {
+        programs = {
+          docker = {
+            services = {
+              anki-sync.enable = mkEnableOption "Anki Sync server";
+              drone.enable = mkEnableOption "drone server";
+              forgejo.enable = mkEnableOption "Forgejo server";
+              jellyfin.enable = mkEnableOption "Jellyfin media server";
+              minecraft.enable = mkEnableOption "Minecraft server";
+              nextcloud.enable = mkEnableOption "Nextcloud server";
+              teamspeak.enable = mkEnableOption "TeamSpeak server";
+              terraria.enable = mkEnableOption "Terraria server";
+              trackmania.enable = mkEnableOption "TrackMania server";
+              vaultwarden.enable = mkEnableOption "Vaultwarden server";
+              woodpecker.enable = mkEnableOption "Woodpecker CI server";
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/lib/modules/programs/git.nix
+++ b/lib/modules/programs/git.nix
@ -31,7 +31,8 @@ let
      default = { };
    };
  };
-in {
+in
+{
  options = {
    valhalla = {
      programs.git = gitOption;
@ -42,7 +43,8 @@ in {
            options = {
              programs.git = gitOption;
            };
-          }));
+          }
+        ));
      };
    };
  };
--- a/lib/modules/programs/nextcloud.nix
+++ b/lib/modules/programs/nextcloud.nix
@ -31,7 +31,8 @@ let
      default = [ ];
    };
  };
-in {
+in
+{
  options = {
    valhalla = {
      programs.nextcloud = commonOptions;
@ -42,7 +43,8 @@ in {
            options = {
              programs.nextcloud = commonOptions;
            };
-          }));
+          }
+        ));
      };

      windows.users = mkOption {
@ -51,7 +53,8 @@ in {
            options = {
              programs.nextcloud = userOptions;
            };
-          }));
+          }
+        ));
      };
    };
  };
--- a/lib/modules/programs/oh-my-posh.nix
+++ b/lib/modules/programs/oh-my-posh.nix
@ -16,7 +16,8 @@ let
          default = lib.strings.removeSuffix ".omp" (lib.strings.removeSuffix ".json" (builtins.baseNameOf config.source));
        };
      };
-    });
+    }
+  );

  commonOptions = {
    enable = mkEnableOption "Oh My Posh";
@ -35,7 +36,8 @@ let
      default = [ ];
    };
  };
-in {
+in
+{
  options = {
    valhalla = {
      programs.oh-my-posh = commonOptions;
@ -46,7 +48,8 @@ in {
            options = {
              programs.oh-my-posh = userOptions;
            };
-          }));
+          }
+        ));
      };
    };
  };
--- a/lib/modules/programs/rclone.nix
+++ b/lib/modules/programs/rclone.nix
@ -16,7 +16,8 @@ let
          default = null;
        };
      };
-    });
+    }
+  );

  commonOptions = {
    enable = mkEnableOption "rclone";
@ -29,7 +30,8 @@ let
      default = { };
    };
  };
-in {
+in
+{
  options = {
    valhalla.linux = {
      programs.rclone = commonOptions;
@ -40,7 +42,8 @@ in {
            options = {
              programs.rclone = userOptions;
            };
-          }));
+          }
+        ));
      };
    };
  };
--- a/lib/modules/software.nix
+++ b/lib/modules/software.nix
@ -14,11 +14,16 @@
          cfg = config;
          inherit (cfg.software) coding desktopExperience essential gaming server socialMedia;

-              mkPrograms = programs: builtins.foldl' (
+          mkPrograms = programs: builtins.foldl'
+            (
              programs: name: programs // {
                ${name}.enable = true;
-                }) {} programs;
-            in {
+              }
+            )
+            { }
+            programs;
+        in
+        {
          options = {
            software = {
              essential = mkOption {
@ -144,7 +149,8 @@
              "tm-united-forever"
            ]));
          };
-            });
+        }
+      );
    };
  };
 }
--- a/lib/modules/users.nix
+++ b/lib/modules/users.nix
@ -25,7 +25,8 @@ let
          default = [ ];
        };
      };
-    });
+    }
+  );

  linuxUserType = types.submodule (
    { ... }: {
@ -36,7 +37,8 @@ let
          default = null;
        };
      };
-    });
+    }
+  );

  winUserType = types.submodule (
    { ... }: {
@ -47,8 +49,10 @@ let
          default = false;
        };
      };
-    });
-in {
+    }
+  );
+in
+{
  options = {
    valhalla = {
      users = mkOption {
--- a/lib/modules/windows.nix
+++ b/lib/modules/windows.nix
@ -2,7 +2,8 @@
 let
  inherit (lib) mkDefault mkEnableOption mkIf mkOption types;
  capitalize = (import ../text.nix { inherit lib; }).capitalize;
-in {
+in
+{
  options = {
    valhalla = {
      windows = {
--- a/profiles/machines/manuel/Generic/config.nix
+++ b/profiles/machines/manuel/Generic/config.nix
@ -37,7 +37,8 @@ in {
      keyboardLayout = "ch";

      i18n = {
-        localeSettings = let defaultLocale = "en_US.UTF-8";
+        localeSettings =
+          let defaultLocale = "en_US.UTF-8";
          in {
            LANG = "de_CH.UTF-8";
            LANGUAGE = defaultLocale;
@ -58,7 +59,8 @@ in {
      linux.programs.grub.enable = true;

      programs = {
-        git = let defaultBranch = "main";
+        git =
+          let defaultBranch = "main";
          in {
            inherit defaultBranch;

--- a/profiles/machines/manuel/server.nix
+++ b/profiles/machines/manuel/server.nix
@ -0,0 +1,75 @@
+{ lib, config, ... }:
+let fs = import ../../../lib/modules/partition/fs.nix;
+in {
+  imports = [ ./defaults.nix ];
+
+  config = {
+    valhalla = {
+      partition = {
+        os = {
+          partitions = {
+            Boot = {
+              index = 1;
+              type = "uefi";
+              size = "+1G";
+              format = fs.fat32;
+              mountPoint = config.valhalla.boot.efiMountPoint;
+            };
+
+            Swap = {
+              index = 2;
+              type = "swap";
+            };
+
+            OS = {
+              index = 3;
+              label = lib.mkDefault config.valhalla.boot.label;
+              type = "linux";
+              format = fs.ext4;
+              mountPoint = "/";
+            };
+          };
+        };
+      };
+
+      hostname = "nuth.ch";
+      timeZone = "Europe/Zurich";
+      keyMap = "de_CH-latin1";
+      keyboardLayout = "ch";
+
+      i18n = {
+        localeSettings =
+          let defaultLocale = "en_US.UTF-8";
+          in {
+            LANG = "de_CH.UTF-8";
+            LANGUAGE = defaultLocale;
+            LC_MESSAGE = defaultLocale;
+          };
+      };
+
+      software = {
+        essential = true;
+        server = true;
+      };
+
+      programs.docker.enable = true;
+
+      linux.programs = {
+        docker = {
+          services = {
+            drone.enable = true;
+            forgejo.enable = true;
+            jellyfin.enable = true;
+            minecraft.enable = true;
+            nextcloud.enable = true;
+            teamspeak.enable = true;
+            terraria.enable = true;
+            trackmania.enable = true;
+            vaultwarden.enable = true;
+            woodpecker.enable = true;
+          };
+        };
+      };
+    };
+  };
+}
--- a/profiles/users/manuel/desktop.nix
+++ b/profiles/users/manuel/desktop.nix
@ -29,10 +29,12 @@
      windows.users.manuel = {
        programs = {
          nextcloud = {
-            folderSyncs = let
+            folderSyncs =
+              let
                localPath = "C:/tools/RetroArch-Win64";
                remotePath = "/Saved Games/RetroArch";
-            in [
+              in
+              [
                {
                  remotePath = "${remotePath}/Saves";
                  localPath = "${localPath}/saves";
--- a/scripts/Arch/Config/SecureBoot/main.fish
+++ b/scripts/Arch/Config/SecureBoot/main.fish
@ -20,11 +20,11 @@ begin
        sudo sed -i \
            -e "/esp=/{" \
                -e "a esp=$(echo "$efiDir" | string escape)" \
-                -e "d" \
+                -e d \
            -e "}" \
            -e "/bootloader_id=/{" \
                -e "a bootloader_id=$(echo "$label" | string escape)" \
-                -e "d" \
+                -e d \
            -e "}" \
            /etc/secureboot.conf

--- a/scripts/Arch/OS/install.fish
+++ b/scripts/Arch/OS/install.fish
@ -27,7 +27,7 @@ begin
        and yayinst \
            linux-headers \
            pacman-contrib \
-            yq
+            go-yq
    end

    source "$dir/../../Common/OS/install.fish"
--- a/scripts/Arch/OS/setup.fish
+++ b/scripts/Arch/OS/setup.fish
@ -61,7 +61,7 @@ begin
            and arch-chroot "$mountDir" hwclock --systohc

            and begin
-                getOSConfig i18n.localeSettings --json | \
+                getOSConfig i18n.localeSettings --json |
                    jq --raw-output '[.[] | split(".") | .[0]] | unique | join("\\\\|")'
            end | begin
                read LOCALES
@ -70,7 +70,7 @@ begin
            end

            and begin
-                getOSConfig i18n.localeSettings --json | \
+                getOSConfig i18n.localeSettings --json |
                    jq --raw-output '[keys[] as $key | "\($key)=\(.[$key])"] | join("\n")'
            end | arch-chroot "$mountDir" tee /etc/locale.conf >/dev/null

--- a/scripts/Arch/Software/docker/main.fish
+++ b/scripts/Arch/Software/docker/main.fish
@ -10,6 +10,8 @@ begin
            docker-compose \
            docker-buildx \
            docker-scan
+
+        installSWBase $argv
    end

    runInstaller $argv
--- a/scripts/Arch/lib/deploy.fish
+++ b/scripts/Arch/lib/deploy.fish
@ -147,7 +147,7 @@ function deploySoftware -d "Deploys a the specified software action" -a action
        and yayinst propertree-git # mac .plist config file editor
    end

-    and if isProgramEnabled "thunderbird" && $isInstall
+    and if isProgramEnabled thunderbird && $isInstall
        yayinst thunderbird
    end

@ -200,7 +200,7 @@ function deploySoftware -d "Deploys a the specified software action" -a action
                audius-client-bin
        end

-        and if isProgramEnabled "nextcloud"
+        and if isProgramEnabled nextcloud
            yayinst nextcloud-client
        end
    end
@ -284,7 +284,7 @@ function deploySoftware -d "Deploys a the specified software action" -a action
            yayinst osu-lazer-bin
        end

-        and if isProgramEnabled "retroarch"
+        and if isProgramEnabled retroarch
            yayinst libretro
        end
    end
--- a/scripts/Common/OS/backup.fish
+++ b/scripts/Common/OS/backup.fish
@ -14,10 +14,12 @@ function backupAction -V dir

    set -l deployScript (getDeploymentScript)

+    if [ -z "$VALHALLA_BACKUP_DIR" ]
        if fish "$dir/../../../lib/modules/partition/confirm.fish" "Do you wish to store the backup on an SSH server?" n
            read -xP "Please specify the host name of the SSH server: " VALHALLA_BACKUP_SERVER
            read -xP "Please specify the port of the SSH server (default 22): " VALHALLA_BACKUP_SERVER_PORT
            read -xP "Please specify the name of the user to log in to the SSH server: " VALHALLA_BACKUP_SERVER_USER
+            read -xP "Please specify the path to the key file for logging in to the SSH server: " VALHALLA_BACKUP_SERVER_KEY

            if [ -z "$VALHALLA_BACKUP_SERVER_PORT" ]
                set -x VALHALLA_BACKUP_SERVER_PORT 22
@ -32,12 +34,13 @@ function backupAction -V dir
            echo "For a seamless experience, please make sure that you are able to establish an unattended ssh connection using key authentication."
            echo
            echo "$(tput bold)This command should succeed without user interaction:$(tput sgr0)"
-        echo "ssh -o PasswordAuthentication=no -p $VALHALLA_BACKUP_SERVER_PORT $VALHALLA_BACKUP_SERVER true"
+            echo "sudo ssh -o PasswordAuthentication=no -i $(string escape -- "$VALHALLA_BACKUP_SERVER_KEY") -p $VALHALLA_BACKUP_SERVER_PORT $VALHALLA_BACKUP_SERVER true"
            read -P "Press enter once you're done: "
            echo
        end

        read -xP "Please specify the path to the directory to save the backup to: " VALHALLA_BACKUP_DIR
+    end

    runHook backupSoftware || begin
        echo "Backing up software..."
@ -51,7 +54,7 @@ function backupAction -V dir
        if [ -n "$deployScript" ]
            for name in (getUsers | jq '.[]' --raw-output0 | string split0)
                echo "Backing up user `$name`..."
-                and source $deployScript userBackup $name
+                and source $deployScript userBackup --user $name
            end
        end
    end
--- a/scripts/Common/OS/install.fish
+++ b/scripts/Common/OS/install.fish
@ -34,7 +34,7 @@ function installAction -V dir

            for name in (getUsers | jq '.[]' --raw-output0 | string split0)
                echo "Configuring user `$name`..."
-                and source $deployScript userConfig $name
+                and source $deployScript userConfig --user $name
            end
        end
    end
--- a/scripts/Common/Software/aliae/Manage.ps1
+++ b/scripts/Common/Software/aliae/Manage.ps1
@ -27,7 +27,7 @@ $null = New-Module {
                Value = "$Value";
            } `
            -User $User `
-            ".alias |= [((. // [])[] | select(.name != env.Name))] + [{ name: env.Name, value: env.Value }]";
+            ".alias |= [((. // [])[] | select(.name != env(Name)))] + [{ name: env(Name), value: env(Value) }]";
    }

    <#
@ -53,7 +53,7 @@ $null = New-Module {
                Value = "$Value";
            } `
            -User $User `
-            ".env |= [((. // [])[] | select(.name != env.Name))] + [{ name: env.Name, value: env.Value }]";
+            ".env |= [((. // [])[] | select(.name != env(Name)))] + [{ name: env(Name), value: env(Value) }]";
    }

    <#
@ -92,7 +92,7 @@ $null = New-Module {
            }

            sudo @using:flags pwsh -CommandWithArgs 'Get-Content -Raw $args[0]' $using:path | Set-Content $file;
-            yq -yi $using:Script $file;
+            yq -i $using:Script $file;
            sudo @using:flags pwsh -CommandWithArgs 'Set-Content $args[0] -Value $args[1]' $using:path (Get-Content -Raw $file);
            Remove-Item $file;
        } | Receive-Job -Wait;
--- a/scripts/Common/Software/docker/main.fish
+++ b/scripts/Common/Software/docker/main.fish
@ -12,5 +12,19 @@ begin
        sudo usermod -aG docker "$_flag_user"
    end

+    function installSWDependencies -V dir -V args
+        source "$dir/../../../lib/settings.fish"
+        set -la argv $args
+        argparse -i "name=" "user=" -- $argv
+        set -l services (getProgramConfig --name "$_flag_name" --json | jq '.services')
+
+        for service in (echo "$services" | jq '. // {} | keys[]' --raw-output0 | string split0)
+
+            if echo "$services" | SERVICE=$service jq --exit-status ".[env.SERVICE].enable" >/dev/null
+                fish "$dir/services/$service/main.fish" $argv
+            end
+        end
+    end
+
    runInstaller $argv
 end
--- a/scripts/Common/Software/docker/services/anki-sync/docker-compose.base.yml
+++ b/scripts/Common/Software/docker/services/anki-sync/docker-compose.base.yml
@ -2,8 +2,5 @@ services:
  anki:
    image: yangchuansheng/anki-sync-server
    restart: unless-stopped
-    extends:
-      file: docker-compose.secrets.yml
-      service: anki
    volumes:
      - ./data:/ankisyncdir
--- a/scripts/Common/Software/docker/services/anki-sync/docker-compose.overrides.yml
+++ b/scripts/Common/Software/docker/services/anki-sync/docker-compose.overrides.yml
--- a/scripts/Common/Software/docker/services/anki-sync/main.fish
+++ b/scripts/Common/Software/docker/services/anki-sync/main.fish
@ -2,18 +2,18 @@
 begin
    set -l name anki
    set -l dir (status dirname)
-    set -l source "$dir/docker-compose.secrets.yml"
+    set -l source "$dir/docker-compose.overrides.yml"
    source "$dir/../service.fish"

    function installSW -V dir -V source
        set -l pw (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
        set -l userKey ".services.anki.environment.SYNC_USER1"
-        set -l user (yq --raw-output "$userKey" "$source" | sed "s/:.*\$/:$pw/")
+        set -l user (yq "$userKey" "$source" | sed "s/:.*\$/:$pw/")
        initializeServiceInstallation $argv
-        sudo cp "$dir/docker-compose.yml" (getServiceRoot $argv)
+        sudo cp "$dir/docker-compose.base.yml" (getServiceRoot $argv)

-        USER=$user yq "$userKey = env.USER" "$source" | \
-            sudo tee (getServiceSecretsConfig $argv) >/dev/null
+        USER=$user yq "$userKey = env(USER)" "$source" |
+            sudo tee (getServiceOverrides $argv) >/dev/null

        installDockerService $argv
    end
--- a/scripts/Common/Software/docker/services/docker-compose.yml
+++ b/scripts/Common/Software/docker/services/docker-compose.yml
@ -0,0 +1,4 @@
+include:
+  - path:
+    - docker-compose.base.yml
+    - docker-compose.overrides.yml
--- a/scripts/Common/Software/docker/services/drone/docker-compose.core.yml
+++ b/scripts/Common/Software/docker/services/drone/docker-compose.core.yml
@ -0,0 +1,23 @@
+services:
+  ci:
+    build:
+      context: .
+      dockerfile: ci.Dockerfile
+    restart: unless-stopped
+    env_file:
+      - server.common.env
+  docker:
+    image: drone/drone-runner-docker
+    restart: unless-stopped
+    env_file: runner.common.env
+    environment:
+      DRONE_RUNNER_NAME: docker-runner
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+  ssh:
+    image: drone/drone-runner-ssh
+    restart: unless-stopped
+    env_file:
+      - runner.common.env
+    environment:
+      DRONE_RUNNER_NAME: ssh-runner
--- a/scripts/Common/Software/docker/services/drone/docker-compose.secrets.yml
+++ b/scripts/Common/Software/docker/services/drone/docker-compose.secrets.yml
--- a/scripts/Common/Software/docker/services/drone/docker-compose.templates.yml
+++ b/scripts/Common/Software/docker/services/drone/docker-compose.templates.yml
@ -1,35 +1,19 @@
 services:
  ci-template:
-    build:
-      context: .
-      dockerfile: ci.Dockerfile
    extends:
-      file: docker-compose.secrets.yml
-      service: template
-    restart: unless-stopped
-    env_file:
-      - server.common.env
+      file: docker-compose.core.yml
+      service: ci
+    env_file: []
+    environment: {}
  docker-template:
-    image: drone/drone-runner-docker
-    restart: unless-stopped
    extends:
-      file: docker-compose.secrets.yml
-      service: template
+      file: docker-compose.core.yml
+      service: docker
    depends_on: []
-    env_file:
-      - runner.common.env
-    environment:
-      DRONE_RUNNER_NAME: docker-runner
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+    env_file: []
  ssh-template:
-    image: drone/drone-runner-ssh
-    restart: unless-stopped
    extends:
-      file: docker-compose.secrets.yml
-      service: template
+      file: docker-compose.core.yml
+      service: ssh
    depends_on: []
-    env_file:
-      - runner.common.env
-    environment:
-      DRONE_RUNNER_NAME: ssh-runner
+    env_file: []
--- a/scripts/Common/Software/docker/services/drone/main.fish
+++ b/scripts/Common/Software/docker/services/drone/main.fish
@ -10,16 +10,16 @@ begin

    function installSW -V dir -V environments -V source
        set -l root (getServiceRoot $argv)
-        set -l config "$root/docker-compose.yml"
-        set -l secrets (getServiceSecretsConfig $argv)
-        set -l ciTemplate (yq (getServiceKey ci-template) "$source")
-        set -l dockerTemplate (yq (getServiceKey docker-template) "$source")
-        set -l sshTemplate (yq (getServiceKey ssh-template) "$source")
+        set -l config "$root/docker-compose.base.yml"
+        set -l overrides (getServiceOverrides $argv)
+        set -l ciTemplate (yq -oj (getServiceKey ci-template) "$source")
+        set -l dockerTemplate (yq -oj (getServiceKey docker-template) "$source")
+        set -l sshTemplate (yq -oj (getServiceKey ssh-template) "$source")
        initializeServiceInstallation $argv
        echo "{}" | sudo tee "$config" >/dev/null
-        echo "{}" | sudo tee "$secrets" >/dev/null
+        echo "{}" | sudo tee "$overrides" >/dev/null

-        cp "$dir"/{ci.Dockerfile,.dockerignore} "$root"
+        cp "$dir"/{ci.Dockerfile,docker-compose.core.yml,.dockerignore} "$root"
        echo "DRONE_JSONNET_ENABLED=true" | sudo tee "$root/server.common.env" >/dev/null
        echo "DRONE_RUNNER_CAPACITY=2" | sudo tee "$root/runner.common.env" >/dev/null

@ -32,7 +32,7 @@ begin
            set -l runners ssh docker
            set -l services ci $runners
            set -l tmpConfig (mktemp)
-            set -l tmpSecrets (mktemp)
+            set -l tmpOverrides (mktemp)
            set -l ciName "$name-ci"
            set -l sshName "$name-ssh-runner"
            set -l dockerName "$name-docker-runner"
@ -41,7 +41,7 @@ begin
            set -l dockerEnv

            cp "$config" "$tmpConfig"
-            cp "$secrets" "$tmpSecrets"
+            cp "$overrides" "$tmpOverrides"

            for serviceName in $services
                set -l file (mktemp)
@ -62,53 +62,32 @@ begin

                echo "DRONE_RPC_SECRET=$secret" | sudo tee "$root/$SECRET_ENV" >/dev/null

-                yq "$ciKey = $ciTemplate" "$tmpConfig" | \
-                    ENTRY="./data/$name:/data" yq "$ciKey.volumes = [ env.ENTRY ]" | \
-                    yq "$ciKey.env_file |= . + [ env.SECRET_ENV ]" | \
-                    PROTO=https yq "$ciEnv.DRONE_SERVER_PROTO = env.PROTO" | \
-                    HOST=(getServiceDomain "$subdomain" "$domain") yq "$ciEnv.DRONE_SERVER_HOST = env.HOST" | \
-                    yq "$dockerKey = $dockerTemplate" | \
-                    yq "$sshKey = $sshTemplate" | \
-                    yq "$dockerKey.depends_on = [ env.CI_NAME ]" | \
-                    yq -y "." | \
+                yq "$ciKey = $ciTemplate" "$tmpConfig" |
+                    ENTRY="./data/$name:/data" yq "$ciKey.volumes = [ env(ENTRY) ]" |
+                    yq "$ciKey.env_file |= . + [ env(SECRET_ENV) ]" |
+                    PROTO=https yq "$ciEnv.DRONE_SERVER_PROTO = env(PROTO)" |
+                    HOST=(getServiceDomain "$subdomain" "$domain") yq "$ciEnv.DRONE_SERVER_HOST = env(HOST)" |
+                    yq "$dockerKey = $dockerTemplate" |
+                    yq "$sshKey = $sshTemplate" |
+                    yq "$dockerKey.depends_on = [ env(CI_NAME) ]" |
                    sudo tee "$config" >/dev/null

                for key in $dockerKey $sshKey
                    set -l file (mktemp)

-                    yq "$key.depends_on = [ env.CI_NAME ]" "$config" | \
-                        yq "$key.env_file |= . + [ env.RUNNER_ENV, env.SECRET_ENV ]" | \
-                        yq -y "." | \
+                    yq "$key.depends_on = [ env(CI_NAME) ]" "$config" |
+                        yq "$key.env_file |= . + [ env(RUNNER_ENV), env(SECRET_ENV) ]" |
                        tee "$file" >/dev/null

                    sudo cp "$file" "$config"
                    rm "$file"
                end

-                PORT="127.0.0.1:1337:80" yq "$ciKey.ports = [ env.PORT ]" "$tmpSecrets" | \
-                    yq -y "." | \
-                    sudo tee "$secrets" >/dev/null
+                PORT="127.0.0.1:1337:80" yq "$ciKey.ports = [ env(PORT) ]" "$tmpOverrides" |
+                    sudo tee "$overrides" >/dev/null
            end
        end

-        set -l services (yq --raw-output0 ".services | keys[]" "$config" | string split0)
-
-        for service in $services
-            set -l file (mktemp)
-            set -l key "$(getServiceKey "$service").extends"
-
-            cat "$config" | if string match "*-ci" "$service" >/dev/null
-                SERVICE="$service" yq "$key.service |= env.SERVICE" "$config" 
-            else
-                yq "del($key)" "$config"
-            end | \
-                yq -y "." | \
-                tee "$file" >/dev/null
-
-            sudo cp "$file" "$config"
-            rm "$file"
-        end
-
        installDockerService $argv
    end

@ -133,8 +112,8 @@ begin
        printf "%s\0" "$name-ci" /
    end

-    function getBackupArgs
-        printf "%s\n" --hidden --no-ignore "data|\.secrets?\." (getServiceRoot $argv)
+    function getExtraBackupPatterns
+        echo "\.secret\.env\$"
    end

    runInstaller --force $argv
--- a/scripts/Common/Software/docker/services/forgejo/docker-compose.base.yml
+++ b/scripts/Common/Software/docker/services/forgejo/docker-compose.base.yml
@ -2,9 +2,6 @@ services:
  forgejo:
    image: codeberg.org/forgejo/forgejo:7
    restart: unless-stopped
-    extends:
-      file: docker-compose.secrets.yml
-      service: forgejo
    depends_on:
      - db
    environment:
@ -31,9 +28,6 @@ services:
  db:
    image: mariadb
    restart: unless-stopped
-    extends:
-      file: docker-compose.secrets.yml
-      service: db
    environment:
      MARIADB_RANDOM_ROOT_PASSWORD: "yes"
      MARIADB_AUTO_UPGRADE: "yes"
@ -46,7 +40,7 @@ services:
    image: shenxn/protonmail-bridge
    restart: unless-stopped
    volumes:
-      - ./bridge:/root
+      - ./data/bridge:/root
  runner:
    image: gitea/act_runner
    restart: unless-stopped
--- a/scripts/Common/Software/docker/services/forgejo/docker-compose.overrides.yml
+++ b/scripts/Common/Software/docker/services/forgejo/docker-compose.overrides.yml
@ -5,3 +5,4 @@ services:
      - 127.0.0.1:1337:3000
      - 127.0.0.1:1338:22
  db: {}
+  runner: {}
--- a/scripts/Common/Software/docker/services/forgejo/main.fish
+++ b/scripts/Common/Software/docker/services/forgejo/main.fish
@ -1,8 +1,8 @@
 #!/bin/env fish
 begin
    set -l dir (status dirname)
-    set -l user "forgejo"
-    set -l domain "git"
+    set -l user forgejo
+    set -l domain git
    set -l server "$domain" ""
    set -l service $user
    source "$dir/../service.fish"
@ -13,28 +13,30 @@ begin

    function installSW -V dir -V domain -V server -V service
        set -l root (getServiceRoot $argv)
-        set -l secrets (getServiceSecretsConfig $argv)
-        set -l source "$dir/$(basename "$secrets")"
+        set -l overrides (getServiceOverrides $argv)
+        set -l source "$dir/$(basename "$overrides")"
        set -l pw (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
        set -l port (getRandomPort)
        initializeServiceInstallation $argv
-        sudo cp "$dir/docker-compose.yml" "$root"
+        sudo cp "$dir/docker-compose.base.yml" "$root"

-        set port (yq (getSSHPortKey) "$source" --raw-output | mutatePort "$port")
+        set port (yq (getSSHPortKey) "$source" | mutatePort "$port")

        DOMAIN=(getServiceDomain $server) PW=$pw DB=Git USER=forgejo PW=$pw begin
            set -l gitEnv "$(getServiceKey "$service").environment"
+            set -l actEnv "$(getServiceKey "runner").environment"
            set -l dbEnv "$(getServiceKey "db").environment"

-                PORT=$port yq "$(getSSHPortKey) = env.PORT" "$source" | \
-                    yq "$gitEnv.FORGEJO__database__NAME = env.DB" | \
-                    yq "$gitEnv.FORGEJO__database__USER = env.USER" | \
-                    yq "$gitEnv.FORGEJO__database__PASSWD = env.PW" | \
-                    yq "$dbEnv.MARIADB_DATABASE = env.DB" | \
-                    yq "$dbEnv.MARIADB_USER = env.USER" | \
-                    yq "$dbEnv.MARIADB_PASSWORD = env.PW" | \
-                    yq -y . | \
-                    sudo tee "$secrets" >/dev/null
+            PORT=$port yq "$(getSSHPortKey) = env(PORT)" "$source" |
+                yq "$gitEnv.FORGEJO__server__DOMAIN = env(DOMAIN)" |
+                yq "$gitEnv.FORGEJO__database__NAME = env(DB)" |
+                yq "$gitEnv.FORGEJO__database__USER = env(USER)" |
+                yq "$gitEnv.FORGEJO__database__PASSWD = env(PW)" |
+                yq "$dbEnv.MARIADB_DATABASE = env(DB)" |
+                yq "$dbEnv.MARIADB_USER = env(USER)" |
+                yq "$dbEnv.MARIADB_PASSWORD = env(PW)" |
+                URL="https://$DOMAIN/" yq "$actEnv.GITEA_INSTANCE_URL = env(URL)" |
+                sudo tee "$overrides" >/dev/null
        end

        installDockerService $argv
@ -47,9 +49,9 @@ begin
        set -l file (mktemp)
        set -l root (getServiceRoot $argv)
        set -l dir "$root/data"
-        set -l bin "/usr/local/bin/forgejo"
-        set -l config "$root/docker-compose.yml"
-        set -l secrets (getServiceSecretsConfig $argv)
+        set -l bin /usr/local/bin/forgejo
+        set -l config "$root/docker-compose.base.yml"
+        set -l overrides (getServiceOverrides $argv)
        set -l envKey "$(getServiceKey "$service").environment"
        configureDockerService $argv
        cp "$config" "$file"
@ -64,16 +66,15 @@ begin
        set uid (id -u $user)
        set gid (id -g $user)

-        and yq "$envKey.USER_UID = $uid" "$file" | \
-            yq "$envKey.USER_GID = $gid" | \
-            yq -y . |
+        and yq "$envKey.USER_UID = $uid" "$file" |
+            yq "$envKey.USER_GID = $gid" |
            sudo tee "$config" >/dev/null

        mkdir -p "$dir"
        and chown -R $uid:$gid "$dir"
        rm "$file"

-        set port (yq (getSSHPortKey) "$secrets" --raw-output | extractPort)
+        set port (yq (getSSHPortKey) "$overrides" | extractPort)

        begin
            printf "%s\n" \
@ -93,9 +94,5 @@ begin
        printf "%s\0" "$_flag_name" /
    end

-    function getBackupArgs
-        printf "%s\n" --hidden --no-ignore . --exclude "docker-compose.yml" (getServiceRoot $argv)
-    end
-
    runInstaller --force $argv
 end
--- a/scripts/Common/Software/docker/services/jellyfin/docker-compose.base.yml
+++ b/scripts/Common/Software/docker/services/jellyfin/docker-compose.base.yml
@ -2,12 +2,8 @@ services:
  jellyfin:
    image: jellyfin/jellyfin
    restart: unless-stopped
-    extends:
-      file: docker-compose.secrets.yml
-      service: jellyfin
    user: 1337:1337
    hostname: Jellyfin
-    environment: {}
    volumes:
      - ./config/jellyfin:/config
      - cache:/cache
@ -15,9 +11,6 @@ services:
  radarr:
    image: linuxserver/radarr
    restart: unless-stopped
-    extends:
-      file: docker-compose.secrets.yml
-      service: radarr
    environment:
      PUID: 1337
      PGID: 1337
@ -29,9 +22,6 @@ services:
  sonarr:
    image: linuxserver/sonarr
    restart: unless-stopped
-    extends:
-      file: docker-compose.secrets.yml
-      service: sonarr
    environment:
      PUID: 1337
      PGID: 1337
@ -43,9 +33,6 @@ services:
  lidarr:
    image: linuxserver/lidarr
    restart: unless-stopped
-    extends:
-      file: docker-compose.secrets.yml
-      service: lidarr
    environment:
      PUID: 1337
      PGID: 1337
@ -57,9 +44,6 @@ services:
  prowlarr:
    image: linuxserver/prowlarr
    restart: unless-stopped
-    extends:
-      file: docker-compose.secrets.yml
-      service: prowlarr
    environment:
      PUID: 1337
      PGID: 1337
@ -85,9 +69,6 @@ services:
  flood:
    image: jesec/flood
    restart: unless-stopped
-    extends:
-      file: docker-compose.secrets.yml
-      service: flood
    user: 1337:1337
    command: --baseuri /flood
             --rundir /flood
@ -114,14 +95,43 @@ services:
             -o directory.default.set=/downloads
             -o 'method.set=group.seeding.ratio.command, "d.cloase = ; d.erase = "'
    volumes:
+      - /etc/localtime:/etc/localtime:ro
      - ./config/rtorrent:/config
      - ./downloads:/downloads
-      - /etc/localtime:/etc/localtime:ro
      - ./proton:/proton
    devices:
      - /dev/net/tun
    cap_add:
      - NET_ADMIN
+#  transmission:
+#    build:
+#      dockerfile: ./transmission.Dockerfile
+#      context: .
+#    restart: unless-stopped
+#    hostname: transmission
+#    env_file:
+#      - ./proton.env
+#    environment:
+#      PUID: 1337
+#      PGID: 1337
+#      PVPN_TIER: 1337
+#      TZ: Europe/Zurich
+#      TRANSMISSION_WEB_HOME: /transmission
+#      TRANSMISSION_WEB_USER: "scott"
+#      TRANSMISSION_WEB_PASS: "tiger"
+#      MAX_UPTIME: -1
+#    command: --no-incomplete-dir
+#             --download-dir /downloads
+#    ports:
+#      - 127.0.0.1:1337:9091
+#    volumes:
+#      - ./config/transmission:/config
+#      - ./downloads:/downloads
+#      - /etc/localtime:/etc/localtime:ro
+#    devices:
+#      - /dev/net/tun
+#    cap_add:
+#      - NET_ADMIN

 volumes:
  cache: {}
--- a/scripts/Common/Software/docker/services/jellyfin/docker-compose.overrides.yml
+++ b/scripts/Common/Software/docker/services/jellyfin/docker-compose.overrides.yml
@ -1,5 +1,6 @@
 services:
  jellyfin:
+    environment: {}
    ports:
      - 127.0.0.1:1337:8096
  radarr:
--- a/scripts/Common/Software/docker/services/jellyfin/main.fish
+++ b/scripts/Common/Software/docker/services/jellyfin/main.fish
@ -1,8 +1,8 @@
 #!/bin/env fish
 begin
    set -l dir (status dirname)
-    set -l user "jellyfin"
-    set -l domain "media"
+    set -l user jellyfin
+    set -l domain media
    set -l server "$domain" ""
    set -l servarr radarr sonarr lidarr prowlarr
    set -l flood flood
@ -11,16 +11,16 @@ begin

    function installSW -V dir -V domain -V server -V service
        set -l root (getServiceRoot $argv)
-        set -l secrets (getServiceSecretsConfig $argv)
-        set -l source "$dir/$(basename "$secrets")"
+        set -l overrides (getServiceOverrides $argv)
+        set -l source "$dir/$(basename "$overrides")"
        set -l port (getRandomPort)
        set -l servarrKeys
        initializeServiceInstallation $argv
-        sudo cp "$dir/docker-compose.yml" "$root"
+        sudo cp "$dir/docker-compose.base.yml" "$root"
        sudo cp "$dir/.dockerignore" "$root"
        sudo cp "$dir/pvpn-cli.py" "$root"
        sudo cp "$dir/rtorrent.Dockerfile" "$root"
-        sudo cp "$source" "$secrets"
+        sudo cp "$source" "$overrides"

        installDockerService $argv
    end
@ -31,9 +31,9 @@ begin
        set -l port
        set -l file (mktemp)
        set -l root (getServiceRoot $argv)
-        set -l bin "/usr/local/bin/forgejo"
-        set -l config "$root/docker-compose.yml"
-        set -l secrets (getServiceSecretsConfig $argv)
+        set -l bin /usr/local/bin/forgejo
+        set -l config "$root/docker-compose.base.yml"
+        set -l overrides (getServiceOverrides $argv)
        set -l envKey "$(getServiceKey "$service").environment"
        configureDockerService $argv

@ -50,23 +50,21 @@ begin
        for name in $service $flood
            set -l userKey "$(getServiceKey "$name").user"
            cp "$config" "$file"
-            USER=$uid:$gid yq -y "$userKey = env.USER" "$file" | sudo tee "$config" >/dev/null
+            USER=$uid:$gid yq "$userKey = env(USER)" "$file" | sudo tee "$config" >/dev/null
        end

        for name in $servarr rtorrent
            set -l envKey "$(getServiceKey "$name").environment"
            sudo cp "$config" "$file"

-            and yq "$envKey.PUID = $uid" "$file" | \
-                yq "$envKey.PGID = $gid" | \
-                yq -y . | \
+            and yq "$envKey.PUID = $uid" "$file" |
+                yq "$envKey.PGID = $gid" |
                sudo tee "$config" >/dev/null
        end

-        cp "$config" "$file"
-        URL="https://$(getServiceDomain "$domain" "")/" yq "$(getServiceKey "$service").environment.JELLYFIN_PublishedServerUrl = env.URL" "$file" | \
-            yq -y . | \
-            sudo tee "$config" >/dev/null
+        cp "$overrides" "$file"
+        URL="https://$(getServiceDomain "$domain" "")/" yq "$(getServiceKey "$service").environment.JELLYFIN_PublishedServerUrl = env(URL)" "$file" |
+            sudo tee "$overrides" >/dev/null

        for dir in "$root"/{downloads,config/{,jellyfin,flood,rtorrent,radarr,sonarr,lidarr,prowlarr},media/{,movies,series,music}}
            sudo mkdir -p "$dir"
@ -109,7 +107,7 @@ begin

            getServiceDefaultProxy $domain $s "$location" --comment "Proxy main Jellyfin traffic" $argv
            getServiceDefaultProxy $domain $s "= /web/" --path "/web/index.html" --comment "Proxy main Jellyfin traffic" $argv
-            getServiceDefaultProxy $domain $s "/socket" --comment "Proxy Jellyfin Websockets traffic" $argv
+            getServiceDefaultProxy $domain $s /socket --comment "Proxy Jellyfin Websockets traffic" $argv
        else if [ "$s" = "$flood" ]
            getServiceDefaultProxy $argv

@ -128,7 +126,7 @@ begin
                printf "%s\n" \
                    "# Disable buffering when the nginx proxy gets very resource heavy upon streaming" \
                    "proxy_buffering off;"
-            else if [ "$location" = "/socket" ]
+            else if [ "$location" = /socket ]
                printf "%s\n" \
                    '# Websocket' \
                    "proxy_http_version 1.1;" \
@ -138,8 +136,8 @@ begin
        end
    end

-    function getBackupArgs
-        printf "%s\n" --hidden --no-ignore . --exclude "docker-compose.yml" (getServiceRoot $argv)
+    function getExtraBackupPatterns
+        echo "^proton\.env\$"
    end

    runInstaller --force $argv
--- a/scripts/Common/Software/docker/services/jellyfin/pvpn-cli.py
+++ b/scripts/Common/Software/docker/services/jellyfin/pvpn-cli.py
@ -7,6 +7,7 @@ import subprocess
 import sys
 from protonvpn_cli.cli import FeatureEnum, protonvpn

+
 def run_proton(args):
    exit(
        subprocess.run(
@ -17,6 +18,7 @@ def run_proton(args):
                PIPENV_VENV_IN_PROJECT=f"{1}",
                PVPN_CMD_ARGS=" ".join(args))).returncode)

+
 protonvpn.ensure_connectivity()

 args = sys.argv[1:]
@ -56,9 +58,11 @@ else:
    try:
        session.ensure_valid()
    except:
-        raise Exception("Your current session is invalid. Please initialize the session using the `init` subcommand.")
+        raise Exception(
+            "Your current session is invalid. Please initialize the session using the `init` subcommand.")

-    environ["PVPN_USERNAME"] = session.vpn_username + (environ.get("PVPN_TAGS") or "")
+    environ["PVPN_USERNAME"] = session.vpn_username + \
+        (environ.get("PVPN_TAGS") or "")
    environ["PVPN_PASSWORD"] = session.vpn_password
    environ["PVPN_TIER"] = f"{session.vpn_tier}"

@ -95,6 +99,7 @@ else:

            run_proton(["connect", server.name])
        else:
-            raise Exception(f"Unable to find a server matching the specified criteria {args[1:]}!")
+            raise Exception(
+                f"Unable to find a server matching the specified criteria {args[1:]}!")
    else:
        run_proton(args)
--- a/scripts/Common/Software/docker/services/minecraft/docker-compose.yml
+++ b/scripts/Common/Software/docker/services/minecraft/docker-compose.yml
@ -0,0 +1,30 @@
+services:
+  legacy:
+    image: itzg/minecraft-server
+    restart: unless-stopped
+    environment:
+      UID: 1337
+      GID: 1337
+      EULA: "TRUE"
+    ports:
+      - 25565:25565
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ./mods:/mods
+      - ./config/legacy:/config
+      - ./data/legacy:/data
+      - ./legacy.properties:/data/server.properties
+  bedrock:
+    image: itzg/minecraft-bedrock-server
+    restart: unless-stopped
+    environment:
+      UID: 1337
+      GID: 1337
+      EULA: "TRUE"
+    ports:
+      - 19132:19132/udp
+      - 19133:19133/udp
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ./data/bedrock:/data
+      - ./bedrock.properties:/data/server.properties
--- a/scripts/Common/Software/docker/services/minecraft/main.fish
+++ b/scripts/Common/Software/docker/services/minecraft/main.fish
@ -0,0 +1,73 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    set -l user minecraft
+    source "$dir/../service.fish"
+
+    function installSW -V dir -V domain -V server -V service
+        initializeServiceInstallation $argv
+        sudo cp "$dir/docker-compose.yml" (getServiceRoot $argv)
+        installDockerService $argv
+    end
+
+    function configureSW -V dir -V user -V service
+        set -l uid
+        set -l gid
+        set -l file (mktemp)
+        set -l root (getServiceRoot $argv)
+        set -l dirs "$root"/{mods,{data,config}/{legacy,bedrock}}
+        set -l files "$root"/{legacy,bedrock}.properties
+        set -l config "$root/docker-compose.yml"
+        configureDockerService $argv
+
+        and sudo useradd \
+            --system \
+            --shell /bin/false \
+            --comment 'Minecraft server' \
+            --groups docker \
+            $user
+
+        set uid (id -u $user)
+        set gid (id -g $user)
+
+        for service in (yq -0 ".services | keys[]" "$config" | string split0)
+            set -l envKey "$(getServiceKey "$service").environment"
+            cp "$config" "$file"
+
+            and yq "$envKey.UID = $uid" "$file" |
+                yq "$envKey.GID = $gid" |
+                sudo tee "$config" >/dev/null
+        end
+
+        and for dir in $dirs
+            sudo mkdir -p "$dir"
+        end
+
+        and begin
+            set -l file
+
+            for file in $files
+                sudo mkdir -p (dirname "$file")
+                sudo touch "$file"
+            end
+        end
+
+        and for item in $dirs $files
+            sudo chown -R $uid:$gid "$item"
+        end
+
+        rm "$file"
+    end
+
+    function getServiceServers -V server
+    end
+
+    function getServiceLocations
+    end
+
+    function getExtraBackupPatterns
+        echo "\.properties\$|^(config|mods)\$"
+    end
+
+    runInstaller --force $argv
+end
--- a/scripts/Common/Software/docker/services/nextcloud/.dockerignore
+++ b/scripts/Common/Software/docker/services/nextcloud/.dockerignore
@ -0,0 +1 @@
+*
--- a/scripts/Common/Software/docker/services/nextcloud/cache.Dockerfile
+++ b/scripts/Common/Software/docker/services/nextcloud/cache.Dockerfile
@ -0,0 +1,3 @@
+FROM redis
+ENV REDIS_HOST_PASSWORD default-password
+CMD ["sh", "-c", "exec redis-server --requirepass \"${REDIS_HOST_PASSWORD}\""]
--- a/scripts/Common/Software/docker/services/nextcloud/cloud.Dockerfile
+++ b/scripts/Common/Software/docker/services/nextcloud/cloud.Dockerfile
@ -0,0 +1,33 @@
+FROM nextcloud:fpm
+
+# Workaround for Nextcloud image not including `bz2`
+RUN apt-get update && \
+    apt-get install -y \
+        libbz2-dev \
+        libfcgi-bin && \
+    rm -rf /var/lib/apt/lists/* && \
+    docker-php-ext-install bz2
+
+RUN apt-get update && \
+    curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - && \
+    apt-get install -y nodejs && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        libmagickcore-6.q16-6-extra \
+        libxss1 \
+        libx11-xcb1 \
+        wget && \
+    wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - && \
+    sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' && \
+    apt-get update && \
+    apt-get install -y google-chrome-stable --no-install-recommends && \
+    apt-get remove -y wget gnupg && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm /etc/apt/sources.list.d/google.list
+
+RUN curl -Lo /usr/local/bin/php-fpm-healthcheck https://raw.githubusercontent.com/renatomefi/php-fpm-healthcheck/v0.5.0/php-fpm-healthcheck && \
+    chmod +x /usr/local/bin/php-fpm-healthcheck
+
+RUN npm install --global pageres-cli --unsafe-perm
--- a/scripts/Common/Software/docker/services/nextcloud/docker-compose.base.yml
+++ b/scripts/Common/Software/docker/services/nextcloud/docker-compose.base.yml
@ -0,0 +1,107 @@
+services:
+  web:
+    image: nginx
+    extends:
+      file: docker-compose.core.yml
+      service: web
+    volumes:
+      - ./nginx/web.conf:/etc/nginx/nginx.conf
+      - ./nginx/logs/nginx:/var/log/nginx
+    depends_on:
+      core:
+        condition: service_healthy
+  installer:
+    extends:
+      file: docker-compose.core.yml
+      service: setup
+    image: nextcloud:fpm
+    restart: on-failure
+    entrypoint:
+      - bash
+      - -c
+      - /entrypoint.sh php-fpm & while ! echo '' 2>/dev/null >/dev/tcp/127.0.0.1/9000; do sleep 1; done; kill -9 $!; true;
+  db:
+    image: mariadb:lts
+    restart: unless-stopped
+    env_file: db.env
+    environment:
+      MARIADB_RANDOM_ROOT_PASSWORD: "yes"
+      MARIADB_MYSQL_LOCALHOST_USER: 1
+    volumes:
+      - ./data/db:/var/lib/mysql
+    command:
+      - --innodb_read_only_compressed=OFF
+    healthcheck:
+      test: [CMD, healthcheck.sh, --su-mysql, --connect, --innodb_initialized]
+      start_period: 1m
+      start_interval: 10s
+      interval: 1m
+      timeout: 5s
+      retries: 3
+  cache:
+    build:
+      context: .
+      dockerfile: cache.Dockerfile
+    restart: unless-stopped
+    env_file:
+      - cache.env
+    volumes:
+      - ./data/cache:/data
+    healthcheck:
+      test: [CMD, bash, -c, echo '' > /dev/tcp/127.0.0.1/6379]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+  core:
+    extends:
+      file: docker-compose.core.yml
+      service: nextcloud
+    build:
+      context: .
+      dockerfile: cloud.Dockerfile
+    cap_add:
+      - SYS_ADMIN
+    depends_on: &nextcloud-conditions
+      db:
+        condition: service_healthy
+      cache:
+        condition: service_healthy
+      installer:
+        condition: service_completed_successfully
+        restart: true
+    healthcheck:
+      test: [CMD, bash, -c , php-fpm-healthcheck]
+      start_period: 1m
+      start_interval: 10s
+      interval: 1m
+      timeout: 5s
+      retries: 5
+  cron:
+    extends:
+      file: docker-compose.core.yml
+      service: nextcloud
+    image: nextcloud:fpm
+    depends_on:
+      <<: *nextcloud-conditions
+    entrypoint: /cron.sh
+  bridge:
+    image: shenxn/protonmail-bridge
+    restart: unless-stopped
+    volumes:
+      - ./data/bridge:/root
+  turn:
+    image: instrumentisto/coturn
+    restart: unless-stopped
+  collabora:
+    image: collabora/code
+    restart: unless-stopped
+    environment:
+      dictionaries: de_CH de en
+      extra_params: '--o:logging.level_startup=warning --o:ssl.enable=true --o:ssl.termination=true --o:user_interface.mode=notebookbar'
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+    cap_add:
+      - MKNOD
+
+volumes:
+  webroot: {}
--- a/scripts/Common/Software/docker/services/nextcloud/docker-compose.core.yml
+++ b/scripts/Common/Software/docker/services/nextcloud/docker-compose.core.yml
@ -0,0 +1,32 @@
+services:
+  web:
+    restart: unless-stopped
+    volumes:
+      - webroot:/var/www/html:z
+      - ./php.ini:/usr/local/etc/php/conf.d/nextcloud.ini
+      - ./data/cloud/apps:/var/www/html/custom_apps
+      - ./data/cloud/config:/var/www/html/config
+      - ./data/cloud/data:/var/www/html/data
+      - ./data/cloud/themes:/var/www/html/themes
+      - ./data/public:/public
+      - ../jellyfin/downloads:/downloads
+  setup:
+    extends:
+      service: web
+    environment:
+      FCGI_STATUS_PATH: "/fpm-status"
+    env_file:
+      - db.env
+      - cache.env
+    volumes:
+      - ./fpm/nextcloud.conf:/usr/local/etc/php-fpm.d/zz-nextcloud.conf
+      - ./fpm/status.conf:/usr/local/etc/php-fpm.d/zz-status.conf
+  nextcloud:
+    extends:
+      service: setup
+    env_file:
+      - nextcloud.env
+    environment:
+      MYSQL_HOST: db
+      REDIS_HOST: cache
+      TRUSTED_PROXIES: 172.16.0.0/12
--- a/scripts/Common/Software/docker/services/nextcloud/docker-compose.overrides.yml
+++ b/scripts/Common/Software/docker/services/nextcloud/docker-compose.overrides.yml
@ -0,0 +1,12 @@
+services:
+  web:
+    ports:
+      - 127.0.0.1:1337:80
+  turn:
+    ports:
+      - 1337:3478/tcp
+      - 1337:3478/udp
+    command: [-n, --log-file=stdout, --min-port=49160, --max-port=49200, --use-auth-secret]
+  collabora:
+    ports:
+      - 127.0.0.1:1337:9980
--- a/scripts/Common/Software/docker/services/nextcloud/fpm/nextcloud.conf
+++ b/scripts/Common/Software/docker/services/nextcloud/fpm/nextcloud.conf
@ -0,0 +1,5 @@
+[www]
+; pm.max_children = 200
+; pm.start_servers = 50
+; pm.min_spare_servers = 50
+; pm.max_spare_servers = 150
--- a/scripts/Common/Software/docker/services/nextcloud/fpm/status.conf
+++ b/scripts/Common/Software/docker/services/nextcloud/fpm/status.conf
@ -0,0 +1 @@
+pm.status_path = /fpm-status
--- a/scripts/Common/Software/docker/services/nextcloud/main.fish
+++ b/scripts/Common/Software/docker/services/nextcloud/main.fish
@ -0,0 +1,108 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    set -l turn turn
+    set -l domain cloud ""
+    set -l service web
+    set -l office collabora
+    set -l officeDomain office ""
+    set -l server $service $domain
+
+    set -l services \
+        $server \
+        $turn turn "" \
+        $office $officeDomain
+
+    source "$dir/../service.fish"
+
+    function installSW -V dir -V domain -V service -V turn -V office -V officeDomain
+        set -l genPW __generatePW
+
+        function $genPW -a length
+            if [ -z "$length" ]
+                set length 32
+            end
+
+            nix-shell -p keepassxc --run "keepassxc-cli generate --length $length"
+        end
+
+        set -l file (mktemp)
+        set -l root (getServiceRoot $argv)
+        set -l source "$dir/docker-compose.core.yml"
+        set -l core "$root/$(basename "$source")"
+        set -l domain (getServiceDomain $domain)
+        set -l overrides (getServiceOverrides $argv)
+        set -l overridesSource "$dir/$(basename "$overrides")"
+        set -l turnKey "$(getServiceKey "$turn")"
+        set -l portKey "$turnKey.ports[1]"
+        set -l officeEnv "$(getServiceKey "$office").environment"
+        set -l dbPW ($genPW)
+        set -l turnPW ($genPW)
+        set -l turnPort
+        set -l redisPW ($genPW)
+        set -l nextcloudPW ($genPW 64)
+
+        initializeServiceInstallation $argv
+        sudo cp -r "$dir"/{cache.Dockerfile,cloud.Dockerfile,docker-compose.{base,core}.yml,.dockerignore,fpm,nginx,php.ini} "$root"
+
+        begin
+            printf "%s\n" \
+                "MYSQL_DATABASE=Nextcloud" \
+                "MYSQL_USER=nextcloud" \
+                "MYSQL_PASSWORD=$dbPW"
+        end | sudo tee "$root/db.env" >/dev/null
+
+        echo "REDIS_HOST_PASSWORD=$redisPW" | sudo tee "$root/cache.env" >/dev/null
+
+        begin
+            printf "%s\n" \
+                "NEXTCLOUD_ADMIN_USER=admin" \
+                "NEXTCLOUD_ADMIN_PASSWORD=$nextcloudPW" \
+                "NEXTCLOUD_TRUSTED_DOMAINS=$domain" \
+                "OVERWRITEPROTOCOL=https" \
+                "OVERWRITEHOST=$domain" \
+                "OVERWRITECLIURL=https://$domain"
+        end | sudo tee "$root/nextcloud.env" >/dev/null
+
+        PROTO="https" DOMAIN="$domain" begin
+            set -l key "$turnKey.command"
+
+            PW="--static-auth-secret=$turnPW" \
+                DOMAIN="--realm=$domain" \
+                yq "$key |= . + [env(PW), env(DOMAIN)]" "$overridesSource" |
+                DOMAIN=(getServiceDomain $officeDomain) yq "$officeEnv.server_name = env(DOMAIN)" |
+                URL="https://$(string escape --style regex "$DOMAIN"):443" yq "$officeEnv.aliasgroup1 = env(URL)" |
+                sudo tee "$overrides" >/dev/null
+        end
+
+        installDockerService $argv
+        set turnPort (yq (getServicePortKey "$turn") "$overrides" | extractPort)
+        set turnPort (yq "$portKey" "$overrides" | mutatePort "$turnPort")
+
+        cp "$overrides" "$file"
+        PORT="$turnPort" yq "$portKey = env(PORT)" "$file" | sudo tee "$overrides" >/dev/null
+        rm "$file"
+    end
+
+    function configureSW -V dir
+        configureDockerService $argv
+    end
+
+    function getServiceServers -V services
+        for i in (seq 1 3 (count $services))
+            printf "%s\0" $services[(math $i + 1)] $services[(math $i + 2)]
+        end
+    end
+
+    function getServiceLocations -V services -a index
+        set -l i (math (math (math $index - 1) / 2 "*" 3) + 1)
+        set -l name $services[$i]
+        printf "%s\0" "$name" /
+    end
+
+    function getExtraBackupPatterns
+        echo "^(cache|db|nextcloud)\.env\$"
+    end
+
+    runInstaller --force $argv
+end
--- a/scripts/Common/Software/docker/services/nextcloud/nginx/web.conf
+++ b/scripts/Common/Software/docker/services/nextcloud/nginx/web.conf
@ -0,0 +1,185 @@
+worker_processes 8;
+
+error_log   /var/log/nginx/error.log warn;
+pid         /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include         mime.types;
+    default_type    application/octet-stream;
+
+    types {
+        application/javascript cjs mjs;
+    }
+
+    log_format  main    '$remote_addr - $remote_user [$time_local] "$request" '
+                        '$status $body_bytes_sent "$http_referer" '
+                        '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log /var/log/nginx/access.log main;
+    sendfile on;
+    server_tokens off;
+    keepalive_timeout 65;
+
+    # Set the `immutable` cache control options only for assets with a cache busting `v` argument
+    map $arg_v $asset_immutable {
+        "" "";
+        default "immutable";
+    }
+
+    upstream php-handler {
+        server core:9000;
+    }
+
+    server {
+        listen 80;
+
+        # set max upload size and increase upload timeout:
+        client_max_body_size 512M;
+        client_body_timeout 300s;
+        fastcgi_buffers 64 4K;
+
+        # The settings allow you to optimize the HTTP2 bandwith.
+        # See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
+        # for tuning hints
+        client_body_buffer_size 512k;
+
+        # Enable gzip but do not remove ETag headers
+        gzip                on;
+        gzip_vary           on;
+        gzip_comp_level     4;
+        gzip_min_length     256;
+        gzip_proxied        expired no-cache no-store private no_last_modified no_etag auth;
+        gzip_types          application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+        # HTTP response headers
+        add_header Referrer-Policy                      "no-referrer"       always;
+        add_header X-Content-Type-Options               "nosniff"           always;
+        add_header X-Frame-Options                      "SAMEORIGIN"        always;
+        add_header X-Permitted-Cross-Domain-Policies    "none"              always;
+        add_header X-Robots-Tag                         "noindex, nofollow" always;
+        add_header X-XSS-Protection                     "1; mode=block"     always;
+
+        # Remove X-Powered-By, which is an information leak
+        fastcgi_hide_header X-Powered-By;
+
+        # Path to the root of your installation
+        root /var/www/html;
+
+        # Specify how to handle directories -- specifying `/index.php$request_uri`
+        # here as the fallback means that Nginx always exhibits the desired behaviour
+        # when a client requests a path that corresponds to a directory that exists
+        # on the server. In particular, if that directory contains an index.php file,
+        # that file is correctly served; if it doesn't, then the request is passed to
+        # the front-end controller. This consistent behaviour means that we don't need
+        # to specify custom rules for certain paths (e.g. images and other assets,
+        # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
+        # `try_files $uri $uri/ /index.php$request_uri`
+        # always provides the desired behaviour.
+        index index.php index.html /index.php$request_uri;
+
+        # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
+        location = / {
+            if ( $http_user_agent ~ ^DavClnt ) {
+                return 302 /remote.php/webdav/$is_args$args;
+            }
+        }
+
+        location = /robots.txt {
+            allow all;
+            log_not_found off;
+            access_log off;
+        }
+
+        # Make a regex exception for `/.well-known` so that clients can still
+        # access it despite the existence of the regex rule
+        # `location ~ /(\.|autotest|...)` which would otherwise handle requests
+        # for `/.well-known`.
+        location ^~ /.well-known {
+            # The rules in this block are an adaptation of the rules
+            # in `.htaccess` that concern `/.well-known`.
+
+            location = /.well-known/carddav { return 301 /remote.php/dav/; }
+            location = /.well-known/caldav  { return 301 /remote.php/dav/; }
+
+            # Let Nextcloud's API for `/.well-known` URIs handle all other
+            # requests by passing them to the front-end controller.
+            return 301 /index.php$request_uri;
+        }
+
+        # Rules borrowed from `.htaccess` to hide certain paths from clients
+        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
+        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
+
+        # Ensure this block, which passes PHP files to the PHP process, is above the blocks
+        # which handle static assets (as seen below). If this block is not declared first,
+        # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
+        # to the URI, resulting in a HTTP 500 error response.
+        location ~ \.php(?:$|/) {
+            # Required for legacy support
+            rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
+
+            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+            set $path_info $fastcgi_path_info;
+
+            try_files $fastcgi_script_name =404;
+
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            fastcgi_param PATH_INFO $path_info;
+            fastcgi_param HTTPS on;
+
+            fastcgi_param modHeadersAvailable       true;   # Avoid sending the security headers twice
+            fastcgi_param front_controller_active   true;   # Enable pretty urls
+            fastcgi_pass php-handler;
+
+            fastcgi_intercept_errors on;
+            fastcgi_request_buffering off;
+
+            fastcgi_max_temp_file_size 0;
+        }
+
+        # Javascript mimetype fixes for nginx
+        # Note: The block below should be removed, and the js|mjs section should be
+        # added to the block below this one. This is a temporary fix until Nginx
+        # upstream fixes the js mime-type
+        location ~* \.(?:js|mjs)$ {
+            types {
+                text/javascript js mjs;
+            }
+
+            try_files $uri /index.php$request_uri;
+            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
+            access_log off;
+        }
+
+        # Serve static files
+        location ~ \.(?:css|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
+            try_files $uri /index.php$request_uri;
+            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
+            access_log off; # Optional: Don't log access to assets
+
+            location ~ \.wasm$ {
+                default_type application/wasm;
+            }
+        }
+
+        location ~ \.woff2?$ {
+            try_files $uri /index.php$request_uri;
+            expires 7d;     # Cache-Control policy borrowed from `.htaccess`
+            access_log off; # Optional: Don't log access to assets
+        }
+
+        # Rule borrowed from `.htaccess`
+        location /remote {
+            return 301 /remote.php$request_uri;
+        }
+
+        location / {
+            try_files $uri $uri/ /index.php$request_uri;
+        }
+    }
+}
--- a/scripts/Common/Software/docker/services/nextcloud/php.ini
+++ b/scripts/Common/Software/docker/services/nextcloud/php.ini
@ -0,0 +1,5 @@
+memory_limit        = 1G
+upload_max_filesize = 16G
+post_max_size       = 1G
+max_input_time      = 3600
+max_execution_time  = 3600
--- a/scripts/Common/Software/docker/services/ryot/docker-compose.base.yml
+++ b/scripts/Common/Software/docker/services/ryot/docker-compose.base.yml
@ -0,0 +1,11 @@
+services:
+  ryot:
+    image: ghcr.io/ignisda/ryot:latest
+    restart: unless-stopped
+    volumes:
+      - ./data:/data
+  db:
+    image: postgres
+    restart: unless-stopped
+    volumes:
+      - ./database:/var/lib/postgresql/data
--- a/scripts/Common/Software/docker/services/ryot/docker-compose.overrides.yml
+++ b/scripts/Common/Software/docker/services/ryot/docker-compose.overrides.yml
@ -0,0 +1,11 @@
+services:
+  ryot:
+    environment:
+      DATABASE_URL: postgres://ryot:pw@db/Ryot
+    ports:
+      - 127.0.0.1:1337:8000
+  db:
+    environment:
+      POSTGRES_DB: Ryot
+      POSTGRES_USER: ryot
+      POSTGRES_PASSWORD: pw
--- a/scripts/Common/Software/docker/services/ryot/main.fish
+++ b/scripts/Common/Software/docker/services/ryot/main.fish
@ -0,0 +1,44 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    set -l domain tracker ""
+    set -l service ryot
+    set -l source "$dir/docker-compose.overrides.yml"
+    source "$dir/../service.fish"
+
+    function installSW -V dir -V domain -V service -V source
+        set -l domain (getServiceDomain $domain)
+        set -l root (getServiceRoot $argv)
+        set -l file "$dir/docker-compose.base.yml"
+        set -l pw (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
+        set -l envKey ".services.$service.environment"
+        set -l dbKey "$envKey.DATABASE_URL"
+        set -l dbUrl (yq "$dbKey" "$source" | sed "s/^\(.*:\/\/.*:\).*\(@.*\/.*\)\$/\1$pw\2/")
+        initializeServiceInstallation $argv
+        sudo cp "$file" "$root"
+
+        URL=$dbUrl yq "$dbKey = env(URL)" "$source" |
+            PW=$pw yq ".services.db.environment.POSTGRES_PASSWORD = env(PW)" |
+            sudo tee (getServiceOverrides $argv) >/dev/null
+
+        installDockerService $argv
+    end
+
+    function configureSW -V dir
+        configureDockerService $argv
+    end
+
+    function getServiceServers -V domain
+        printf "%s\0" $domain
+    end
+
+    function getServiceLocations -V service
+        printf "%s\0" $service /
+    end
+
+    function getBackupArgs
+        printf "%s\n" --hidden --no-ignore . --exclude "docker-compose.yml" (getServiceRoot $argv)
+    end
+
+    runInstaller --force $argv
+end
--- a/scripts/Common/Software/docker/services/service.fish
+++ b/scripts/Common/Software/docker/services/service.fish
@ -2,7 +2,7 @@
 begin
    set -l dir (status dirname)
    set -l root /usr/local/lib
-    set -l secretsFile "docker-compose.secrets.yml"
+    set -l overrides "docker-compose.overrides.yml"
    set -l nginxRoot "/etc/nginx/conf.d"
    source "$dir/../../../../lib/software.fish"

@ -11,7 +11,7 @@ begin
    end

    function getPortPattern
-        echo "^\([.[:digit:]]\+:\)\([[:digit:]]\+\)\(:[[:digit:]]\+\)"
+        echo "^\([.[:digit:]]\+:\)\?\([[:digit:]]\+\)\(:[[:digit:]]\+\(\/tcp\|udp\)\?\)"
    end

    function __substitutePort -a substitution
@ -48,11 +48,11 @@ begin
        echo "$nginxRoot/$(getServiceName $argv).conf"
    end

-    function getServiceSecretsConfig -V secretsFile
-        echo "$(getServiceRoot $argv)/$secretsFile"
+    function getServiceOverrides -V overrides
+        echo "$(getServiceRoot $argv)/$overrides"
    end

-    function __getServicePortKey -V secretsFile -a name
+    function getServicePortKey -V overrides -a name
        echo "$(getServiceKey "$name").ports[0]"
    end

@ -78,9 +78,9 @@ begin
    function getServiceDefaultProxy -a domain service location
        argparse -i "comment=" "path=" "url=" -- $argv
        set -l url
-        set -l config (getServiceSecretsConfig $argv)
-        set -l portKey (__getServicePortKey "$service")
-        set -l port (yq --raw-output "$portKey" "$config" | extractPort)
+        set -l config (getServiceOverrides $argv)
+        set -l portKey (getServicePortKey "$service")
+        set -l port (yq "$portKey" "$config" | extractPort)

        if [ -n "$_flag_url" ]
            set url "$_flag_url"
@ -111,14 +111,17 @@ begin
    function getExtraLocationSettings -a domain service location
    end

-    function initializeServiceInstallation -V nginxRoot
+    function initializeServiceInstallation -V dir -V nginxRoot
+        set -l root (getServiceRoot $argv)
        sudo mkdir -p (getServiceRoot $argv)
        sudo mkdir -p "$nginxRoot"
-        sudo mkdir -p (dirname (getServiceSecretsConfig $argv))
+        sudo mkdir -p (dirname (getServiceOverrides $argv))
+        sudo touch "$root/docker-compose.overrides.yml"
+        sudo cp "$dir/docker-compose.yml" "$root"
    end

    function installDockerService -V dir -V nginxRoot
-        set -l config (getServiceSecretsConfig $argv)
+        set -l config (getServiceOverrides $argv)
        set -l servers (getServiceServers $argv | string split0)

        for i in (seq 1 2 (count $servers))
@ -128,14 +131,14 @@ begin
                set -l file (mktemp)
                set -l port (getRandomPort)
                set -l service $locations[$j]
-                set -l portKey (__getServicePortKey "$service")
+                set -l portKey (getServicePortKey "$service")
                set -l exposedPort
                sudo mkdir -p (getServiceRoot $argv)
                sudo mkdir -p "$nginxRoot"
                cp "$config" "$file"

-                set exposedPort (yq --raw-output "$portKey" "$file" | mutatePort $port)
-                PORT=$exposedPort yq -y "$portKey = env.PORT" "$file" | sudo tee "$config" >/dev/null
+                set exposedPort (yq "$portKey" "$file" | mutatePort $port)
+                PORT=$exposedPort yq "$portKey = env(PORT)" "$file" | sudo tee "$config" >/dev/null
            end
        end
    end
@ -170,7 +173,17 @@ begin
        sudo systemctl restart nginx
    end

+    function getExtraBackupPatterns
+        echo ""
+    end
+
    function getBackupArgs
-        printf "%s\n" --hidden --no-ignore . --exclude "docker-compose.yml" (getServiceRoot $argv)
+        set -l extraPatterns (getExtraBackupPatterns)
+
+        if [ -n "$extraPatterns" ]
+            set extraPatterns "|$extraPatterns"
+        end
+
+        printf "%s\n" --base-directory (getServiceRoot $argv) --hidden --no-ignore "^(docker-compose\.overrides\.yml|data)\$$extraPatterns"
    end
 end
--- a/scripts/Common/Software/docker/services/teamspeak/docker-compose.base.yml
+++ b/scripts/Common/Software/docker/services/teamspeak/docker-compose.base.yml
@ -0,0 +1,21 @@
+services:
+  teamspeak:
+    image: teamspeak
+    restart: unless-stopped
+    depends_on:
+      - db
+    environment:
+      TS3SERVER_DB_PLUGIN: ts3db_mariadb
+      TS3SERVER_DB_SQLCREATEPATH: create_mariadb
+      TS3SERVER_DB_HOST: db
+      TS3SERVER_DB_WAITUNTILREADY: 30
+      TS3SERVER_LICENSE: accept
+    volumes:
+      - ./data/teamspeak:/var/ts3server
+  db:
+    image: mariadb
+    restart: unless-stopped
+    environment:
+      MARIADB_RANDOM_ROOT_PASSWORD: "yes"
+    volumes:
+      - ./data/db:/var/lib/mysql
--- a/scripts/Common/Software/docker/services/teamspeak/docker-compose.overrides.yml
+++ b/scripts/Common/Software/docker/services/teamspeak/docker-compose.overrides.yml
@ -0,0 +1,6 @@
+services:
+  teamspeak:
+    ports:
+      - 9987:9987/udp
+      - 10011:10011
+      - 30033:30033
--- a/scripts/Common/Software/docker/services/teamspeak/main.fish
+++ b/scripts/Common/Software/docker/services/teamspeak/main.fish
@ -0,0 +1,44 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    set -l source "$dir/docker-compose.overrides.yml"
+    source "$dir/../service.fish"
+
+    function installSW -V dir -V domain -V source
+        set -l service teamspeak
+        set -l pw (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
+        set -l db TeamSpeak
+        set -l tsEnv "$(getServiceKey "$service").environment"
+        set -l dbEnv "$(getServiceKey db).environment"
+        initializeServiceInstallation $argv
+        cp "$dir/docker-compose.base.yml" (getServiceRoot $argv)
+
+        USER="$service" begin
+            yq "$tsEnv.TS3SERVER_DB_USER = env(USER)" "$source" |
+                yq "$dbEnv.MARIADB_USER = env(USER)"
+        end | \
+            PW="$pw" begin
+            yq "$tsEnv.TS3SERVER_DB_PASSWORD = env(PW)" |
+                yq "$dbEnv.MARIADB_PASSWORD = env(PW)"
+        end | \
+            DB="$db" begin
+            yq "$tsEnv.TS3SERVER_DB_NAME = env(DB)" |
+                yq "$dbEnv.MARIADB_DATABASE = env(DB)"
+        end |
+            sudo tee (getServiceOverrides $argv) >/dev/null
+
+        installDockerService $argv
+    end
+
+    function configureSW -V dir
+        configureDockerService $argv
+    end
+
+    function getServiceServers -V server
+    end
+
+    function getServiceLocations
+    end
+
+    runInstaller --force $argv
+end
--- a/scripts/Common/Software/docker/services/terraria/docker-compose.base.yml
+++ b/scripts/Common/Software/docker/services/terraria/docker-compose.base.yml
@ -0,0 +1,8 @@
+services:
+  terraria:
+    image: ryshe/terraria:latest
+    restart: unless-stopped
+    tty: true
+    stdin_open: true
+    volumes:
+      - ./data:/root/.local/share/Terraria/Worlds
--- a/scripts/Common/Software/docker/services/terraria/docker-compose.overrides.yml
+++ b/scripts/Common/Software/docker/services/terraria/docker-compose.overrides.yml
@ -0,0 +1,8 @@
+services:
+  terraria:
+    environment: {}
+    command:
+      -autocreate 1
+      -difficulty 1
+      -seed "AwesomeSeed"
+      -lang "en-US"
--- a/scripts/Common/Software/docker/services/terraria/main.fish
+++ b/scripts/Common/Software/docker/services/terraria/main.fish
@ -0,0 +1,24 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    source "$dir/../service.fish"
+
+    function installSW -V dir
+        set -l root (getServiceRoot $argv)
+        initializeServiceInstallation $argv
+        cp -rf "$dir"/docker-compose{.base,.overrides}.yml "$root"
+        installDockerService $argv
+    end
+
+    function configureSW -V dir
+        configureDockerService $argv
+    end
+
+    function getServiceServers
+    end
+
+    function getServiceLocations
+    end
+
+    runInstaller --force $argv
+end
--- a/scripts/Common/Software/docker/services/trackmania/.dockerignore
+++ b/scripts/Common/Software/docker/services/trackmania/.dockerignore
@ -0,0 +1 @@
+data/
--- a/scripts/Common/Software/docker/services/trackmania/docker-compose.base.yml
+++ b/scripts/Common/Software/docker/services/trackmania/docker-compose.base.yml
@ -0,0 +1,72 @@
+services:
+  game:
+    build:
+      context: .
+      dockerfile: trackmania.Dockerfile
+    restart: unless-stopped
+    extends:
+      file: docker-compose.core.yml
+      service: tm
+    stdin_open: true
+    environment:
+      TM_XMLRPC_ALLOWED_REMOTE: xaseco
+    volumes:
+      - ./data/tm/data:/app/GameData
+    healthcheck:
+      test: [CMD, bash, -c, echo '' >/dev/tcp/127.0.0.1/5000]
+      start_period: 1m
+      start_interval: 10s
+      interval: 5s
+      timeout: 3s
+      retries: 5
+  downloader:
+    extends:
+      file: docker-compose.core.yml
+      service: xaseco-installer
+    volumes:
+      - ./initdb.d:/cache/localdb
+    healthcheck:
+      test: [CMD, bash, -c, ls /cache/localdb/*]
+      start_period: 1m
+      start_interval: 10s
+      interval: 5s
+      timeout: 3s
+      retries: 5
+  xaseco:
+    restart: unless-stopped
+    extends:
+      file: docker-compose.core.yml
+      service: xaseco
+    depends_on:
+      game:
+        condition: service_healthy
+      db:
+        condition: service_healthy
+    environment:
+      TM_SERVER_HOST: game
+      MYSQL_HOST: db
+    volumes:
+      - ./data/xaseco:/data
+  db:
+    image: mysql:5
+    restart: unless-stopped
+    extends:
+      file: docker-compose.core.yml
+      service: db
+    depends_on:
+      downloader:
+        condition: service_completed_successfully
+    command: --sql_mode=""
+    environment:
+      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
+    volumes:
+      - ./data/db:/var/lib/mysql
+      - ./initdb.d:/docker-entrypoint-initdb.d
+    healthcheck:
+      test: [CMD, bash, -c, mysqladmin ping -hlocalhost -u "$$MYSQL_USER" -p"$$MYSQL_PASSWORD"]
+      timeout: 20s
+      retries: 10
+
+volumes:
+  tm-server: {}
+  xaseco: {}
--- a/scripts/Common/Software/docker/services/trackmania/docker-compose.core.overrides.yml
+++ b/scripts/Common/Software/docker/services/trackmania/docker-compose.core.overrides.yml
@ -0,0 +1,19 @@
+services:
+  tm:
+    environment: &tm-config
+      TM_SUPERADMIN_PASSWORD: pw
+      TM_SERVER_USER: null
+      TM_SERVER_PASSWORD: null
+    volumes: &tm-volumes
+      - ./data/tm/tracks:/app/GameData/Tracks/Challenges
+  db:
+    environment: &db-config
+      MYSQL_USER: xaseco
+      MYSQL_PASSWORD: pw
+      MYSQL_DATABASE: Aseco
+  xaseco:
+    environment:
+      <<:
+        - *tm-config
+        - *db-config
+    volumes: *tm-volumes
--- a/scripts/Common/Software/docker/services/trackmania/docker-compose.core.yml
+++ b/scripts/Common/Software/docker/services/trackmania/docker-compose.core.yml
@ -0,0 +1,30 @@
+services:
+  tm:
+    extends:
+      file: docker-compose.core.overrides.yml
+      service: tm
+    volumes: &tm-volumes
+      - tm-server:/app
+  xaseco-installer:
+    build: &xaseco-build
+      context: .
+      dockerfile: xaseco.Dockerfile
+    restart: on-failure
+    command: "true"
+    <<: &xaseco-base
+      privileged: true
+    volumes: &xaseco-volumes
+      - xaseco:/cache
+  xaseco:
+    extends:
+      file: docker-compose.core.overrides.yml
+      service: xaseco
+    <<: 
+      - *xaseco-base
+      - volumes: *tm-volumes
+      - volumes: *xaseco-volumes
+    build: *xaseco-build
+  db:
+    extends:
+      file: docker-compose.core.overrides.yml
+      service: db
--- a/scripts/Common/Software/docker/services/trackmania/docker-compose.overrides.yml
+++ b/scripts/Common/Software/docker/services/trackmania/docker-compose.overrides.yml
@ -0,0 +1,12 @@
+services:
+  game:
+    command:
+      - /game_settings=MatchSettings/Nations/NationsBlue.txt
+    environment: {}
+    ports:
+      - 2350:2350
+      - 2350:2350/udp
+      - 2353:2353
+      - 2353:2353/udp
+  xaseco:
+    environment: {}
--- a/scripts/Common/Software/docker/services/trackmania/main.fish
+++ b/scripts/Common/Software/docker/services/trackmania/main.fish
@ -0,0 +1,37 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    set -l source "$dir/docker-compose.core.overrides.yml"
+    source "$dir/../service.fish"
+
+    function installSW -V dir -V domain -V source
+        set -l root (getServiceRoot $argv)
+        set -l tmPW (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
+        set -l sqlPW (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
+        initializeServiceInstallation $argv
+
+        cp -rf "$dir"/{.dockerignore,docker-compose{.base,.overrides,.core{,.overrides}}.yml,parser.patch,tmforever-entrypoint.sh,trackmania.Dockerfile,xaseco-entrypoint.sh,xaseco.Dockerfile} "$root"
+
+        PW="$tmPW" yq "$(getServiceKey "tm").environment.TM_SUPERADMIN_PASSWORD = env(PW)" "$source" |
+            PW="$sqlPW" yq "$(getServiceKey "db").environment.MYSQL_PASSWORD = env(PW)" |
+            sudo tee "$root/$(basename "$source")" >/dev/null
+
+        installDockerService $argv
+    end
+
+    function configureSW -V dir
+        configureDockerService $argv
+    end
+
+    function getServiceServers
+    end
+
+    function getServiceLocations
+    end
+
+    function getExtraBackupPatterns
+        echo "^docker-compose\.core\.overrides\.yml\$"
+    end
+
+    runInstaller --force $argv --name tm-forever
+end
--- a/scripts/Common/Software/docker/services/trackmania/parser.patch
+++ b/scripts/Common/Software/docker/services/trackmania/parser.patch
@ -0,0 +1,11 @@
+--- a/includes/xmlparser.inc.php
+++ b/includes/xmlparser.inc.php
+@@ -37,8 +37,6 @@
+ 		else
+ 			$this->data = $source;
+ 
+-		// escape '&' characters
+-		$this->data = str_replace('&', '<![CDATA[&]]>', $this->data);
+ 
+ 		// parse xml file
+ 		$parsed = xml_parse($this->parser, $this->data);
--- a/scripts/Common/Software/docker/services/trackmania/tmforever-entrypoint.sh
+++ b/scripts/Common/Software/docker/services/trackmania/tmforever-entrypoint.sh
@ -0,0 +1,145 @@
+#!/bin/bash
+set -e
+configSource="GameData/Config/dedicated_cfg"
+configFile="GameData/Config/live_config.xml"
+settingsPath="/dedicated"
+authLevelsPath="$settingsPath/authorization_levels/level"
+accountPath="$settingsPath/masterserver_account"
+serverPath="$settingsPath/server_options"
+systemPath="$settingsPath/system_config"
+
+TM_SUPERADMIN_PASSWORD="${TM_SUPERADMIN_PASSWORD:-$(openssl rand -base64 33)}"
+TM_ADMIN_PASSWORD="${TM_ADMIN_PASSWORD:-$(openssl rand -base64 33)}"
+
+echo "Checking whether the server is present…"
+
+levels=(
+    TM_SUPERADMIN_PASSWORD 1
+    TM_ADMIN_PASSWORD 2
+    TM_USER_PASSWORD 3
+)
+
+accountOption=(
+    TM_SERVER_USER login
+    TM_SERVER_PASSWORD password
+    TM_SERVER_VALIDATION_KEY validation_key
+)
+
+serverOptions=(
+    TM_TITLE name
+    TM_COMMENT comment
+    TM_HIDDEN hide_server
+    \
+    TM_MAX_PLAYERS max_players
+    TM_PLAYER_PASSWORD password
+    \
+    TM_MAX_SPECTATORS max_spectators
+    TM_SPECTATOR_PASSWORD password_spectator
+    \
+    TM_LADDER_MODE ladder_mode
+    TM_LADDER_LIMIT_MIN ladder_serverlimit_min
+    TM_LADDER_LIMIT_MAX ladder_serverlimit_max
+    \
+    TM_ENABLE_P2P_UPLOAD enable_p2p_upload
+    TM_ENABLE_P2P_DOWNLOAD enable_p2p_download
+    \
+    TM_CALLVOTE_TIMEOUT callvote_timeout
+    TM_CALLVOTE_RATIO callvote_ratio
+    \
+    TM_ALLOW_CHALLENGE_DOWNLOAD allow_challenge_download
+    TM_AUTOSAVE_REPLAYS autosave_replays
+    TM_AUTOSAVE_VALIDATION_REPLAYS autosave_validation_replays
+    \
+    TM_REFEREE_PASSWORD referee_password
+    TM_REFEREE_VALIDATION_MODE referee_validation_mode
+    \
+    TM_USE_CHANGING_VALIDATION_SEED use_changing_validation_seed
+)
+
+systemOptions=(
+    TM_BIND_IP bind_ip_address
+    TM_BIND_PORT server_port
+    TM_P2P_PORT server_p2p_port
+    TM_CLIENT_PORT client_port
+    TM_USE_NAT_UPNP use_nat_upnp
+    \
+    TM_XMLRPC_PORT xmlrpc_port
+    TM_XMLRPC_ALLOWED_REMOTE xmlrpc_allowremote
+    \
+    TM_PACKMASK packmask
+    \
+    TM_CONNECTION_UPLOADRATE connection_uploadrate
+    TM_CONNECTION_DOWNLOADRATE connection_downloadrate
+    \
+    TM_P2P_CACHE_SIZE p2p_cache_size
+    \
+    TM_BLACKLIST_URL blacklist_url
+    TM_GUESTLIST_FILENAME guestlist_filename
+    TM_BLACKLIST_FILENAME blacklist_filename
+    \
+    TM_ALLOW_SPECTATOR_RELAYS allow_spectator_relays
+    \
+    TM_USE_PROXY use_proxy
+    TM_PROXY_LOGIN proxy_login
+    TM_PROXY_PASSWORD proxy_password
+)
+
+if [[ ! -x "./TrackmaniaServer" ]] || [ ! -f "$configSource".* ]; then
+    echo "Server not found!"
+    echo "Downloading TrackMania Forever Dedicated Server…"
+    file="$(mktemp)"
+    dir="$(mktemp -d)"
+    wget http://files2.trackmaniaforever.com/TrackmaniaServer_2011-02-21.zip -O "$file" && unzip -o "$file" -d .
+fi
+
+if [ -f "$configSource.xml" ]; then
+    cp "$configSource.xml" "$configFile"
+elif [ -f "$configSource.txt" ]; then
+    cp "$configSource.txt" "$configFile"
+fi
+
+for i in $(seq 0 2 $((${#levels[@]} - 1))); do
+    var="${levels[$i]}"
+    index="${levels[$(($i + 1))]}"
+    password="${!var}"
+
+    if [ -n "$password" ]; then
+        xmlstarlet edit --inplace --update "$authLevelsPath[$index]/password" --value "$password" "$configFile"
+    fi
+done
+
+for i in $(seq 0 2 $((${#accountOption[@]} - 1))); do
+    var="${accountOption[$i]}"
+    option="${accountOption[$(($i + 1))]}"
+    value="${!var}"
+
+    if [ -n "$value" ]; then
+        xmlstarlet edit --inplace --update "$accountPath/$option" --value "$value" "$configFile"
+    fi
+done
+
+for i in $(seq 0 2 $((${#serverOptions[@]} - 1))); do
+    var="${serverOptions[$i]}"
+    option="${serverOptions[$(($i + 1))]}"
+    value="${!var}"
+
+    if [ -n "$value" ]; then
+        xmlstarlet edit --inplace --update "$serverPath/$option" --value "$value" "$configFile"
+    fi
+done
+
+for i in $(seq 0 2 $((${#systemOptions[@]} - 1))); do
+    var="${systemOptions[$i]}"
+    option="${systemOptions[$(($i + 1))]}"
+    value="${!var}"
+
+    if [ -n "$value" ]; then
+        xmlstarlet edit --inplace --update "$systemPath/$option" --value "$value" "$configFile"
+    fi
+done
+
+if [ -z "$TM_LOG_FILES" ]; then
+    set -- "$@" /nologs
+fi
+
+unbuffer -p ./TrackmaniaServer /dedicated_cfg="$(basename "$configFile")" /nodaemon $@
--- a/scripts/Common/Software/docker/services/trackmania/trackmania.Dockerfile
+++ b/scripts/Common/Software/docker/services/trackmania/trackmania.Dockerfile
@ -0,0 +1,75 @@
+FROM debian:11.3
+RUN apt-get update -y \
+    && apt-get install -y \
+        expect \
+        unzip \
+        wget \
+        xmlstarlet \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir /app
+WORKDIR /app
+COPY ./tmforever-entrypoint.sh /usr/local/bin/tmforever-foreground
+
+ENV \
+    TM_BIND_IP="" \
+    TM_BIND_PORT="" \
+    TM_P2P_PORT="" \
+    TM_CLIENT_PORT="" \
+    TM_USE_NAT_UPNP="" \
+    \
+    TM_XMLRPC_PORT="" \
+    TM_XMLRPC_ALLOWED_REMOTE="" \
+    \
+    TM_SERVER_USER="" \
+    TM_SERVER_PASSWORD="" \
+    TM_SERVER_VALIDATION_KEY="" \
+    \
+    TM_TITLE="" \
+    TM_COMMENT="" \
+    TM_HIDDEN="" \
+    \
+    TM_PACKMASK="" \
+    \
+    TM_MAX_PLAYERS="" \
+    TM_PLAYER_PASSWORD="" \
+    \
+    TM_MAX_SPECTATORS="" \
+    TM_SPECTATOR_PASSWORD="" \
+    \
+    TM_LADDER_MODE="" \
+    TM_LADDER_LIMIT_MIN="" \
+    TM_LADDER_LIMIT_MAX="" \
+    \
+    TM_ENABLE_P2P_UPLOAD="" \
+    TM_ENABLE_P2P_DOWNLOAD="" \
+    \
+    TM_CALLVOTE_TIMEOUT="" \
+    TM_CALLVOTE_RATIO="" \
+    \
+    TM_ALLOW_CHALLENGE_DOWNLOAD="" \
+    TM_AUTOSAVE_REPLAYS="" \
+    TM_AUTOSAVE_VALIDATION_REPLAYS="" \
+    \
+    TM_REFEREE_PASSWORD="" \
+    TM_REFEREE_VALIDATION_MODE="" \
+    \
+    TM_USE_CHANGING_VALIDATION_SEED="" \
+    \
+    TM_SUPERADMIN_PASSWORD="" \
+    TM_ADMIN_PASSWORD="" \
+    \
+    TM_CONNECTION_UPLOADRATE="" \
+    TM_CONNECTION_DOWNLOADRATE="" \
+    TM_P2P_CACHE_SIZE="" \
+    TM_BLACKLIST_URL="" \
+    TM_GUESTLIST_FILENAME="" \
+    TM_BLACKLIST_FILENAME="" \
+    TM_ALLOW_SPECTATOR_RELAYS="" \
+    TM_USE_PROXY="" \
+    TM_PROXY_LOGIN="" \
+    TM_PROXY_PASSWORD="" \
+    \
+    TM_LOG_FILES=""
+
+ENTRYPOINT [ "tmforever-foreground" ]
--- a/scripts/Common/Software/docker/services/trackmania/xaseco-entrypoint.sh
+++ b/scripts/Common/Software/docker/services/trackmania/xaseco-entrypoint.sh
@ -0,0 +1,177 @@
+#!/bin/bash
+export TM_USER="${TM_USER:-SuperAdmin}"
+export TM_PASSWORD="${TM_PASSWORD:-$TM_SUPERADMIN_PASSWORD}"
+export TM_SERVER_PORT="${TM_SERVER_PORT:-$TM_XMLRPC_PORT}"
+export DEDI_USER="${DEDI_USER:-$TM_SERVER_USER}"
+export DEDI_PASSWORD="${DEDI_PASSWORD:-$TM_SERVER_PASSWORD}"
+overlay="$(mktemp -d)"
+upperDir="$overlay/upper"
+workDir="$overlay/work"
+cache="/cache"
+data="/data"
+runDir="/opt/xaseco"
+entrypoint="$cache/aseco.php"
+config="$runDir/config.xml"
+adminConfig="$runDir/adminops.xml"
+dbConfig="$runDir/localdatabase.xml"
+dediConfig="$runDir/dedimania.xml"
+pluginConfig="$runDir/plugins.xml"
+settingsPath="/settings"
+serverPath="$settingsPath/tmserver"
+pluginTag="plugin"
+pluginPath="/aseco_plugins"
+
+userPattern="^(.+?)(@([[:digit:]]+(.[[:digit:]]+){3}))?\$"
+
+tmOptions=(
+    TM_SERVER_HOST ip
+    TM_SERVER_PORT port
+    TM_USER login
+    TM_PASSWORD password
+    TM_TIMEOUT timeout
+)
+
+groups=(
+    ADMINS admins
+    OPERATORS operators
+)
+
+sqlOptions=(
+    MYSQL_HOST mysql_server
+    MYSQL_USER mysql_login
+    MYSQL_PASSWORD mysql_password
+    MYSQL_DATABASE mysql_database
+)
+
+dediOptions=(
+    DEDI_URL url
+    DEDI_NAME name
+    DEDI_USER login
+    DEDI_PASSWORD password
+    DEDI_NATION nation
+    DEDI_LOG_NEWS log_news
+    DEDI_SHOW_MOTD show_welcome
+)
+
+if [ ! -f "$entrypoint" ]; then
+    file="$(mktemp -u).zip"
+    root="$(mktemp -d)"
+    mkdir -p "$(dirname "$file")"
+    curl -v --insecure https://www.gamers.org/tmn/xaseco_116.zip -o "$file"
+    unzip -o "$file" -d "$root"
+    cp -r "$root"/xaseco/* "$cache"
+fi
+
+script="$(
+    printf "%s\n" \
+        'file="$(basename "$1")";' \
+        'if [[ "$file" == *".php" ]];' \
+        '    then dir="includes";' \
+        'else' \
+        '    dir=".";' \
+        'fi;' \
+        'if [ ! -f "$0/$dir/$file" ]; then' \
+        '    mkdir -p "$0/$dir";' \
+        '    cp "$1" "$0/$dir";' \
+        'fi;'
+)"
+
+find "$cache/newinstall" -type f -exec bash -c "$script" "$cache" \{\} \;
+
+mount -t tmpfs tmpfs "$overlay"
+mkdir -p "$upperDir" "$workDir"
+mount -t overlay overlay -o lowerdir="$cache:$data",upperdir="$upperDir",workdir="$workDir" "$runDir"
+cd "$runDir"
+
+dos2unix "/root/parser.patch" ./includes/xmlparser.inc.php
+patch -p 1 ./includes/xmlparser.inc.php "/root/parser.patch"
+
+if [ -n "$MASTERADMIN_USER" ]; then
+    loginTag="tmlogin"
+    ipTag="ipaddress"
+    adminPath="$settingsPath/aseco/masteradmins"
+    nodesPath="$adminPath/*"
+    namePath="$nodesPath[1]"
+    ipPath="$nodesPath[2]"
+
+    if [ "$(xmlstarlet select --template -v "count($nodesPath)" "$config")" -lt 1 ]; then
+        xmlstarlet edit --inplace --subnode "$adminPath" --type elem -n "$loginTag" "$config"
+    fi
+
+    if [ "$(xmlstarlet select --template -v "count($nodesPath)" "$config")" -lt 2 ] ||
+        [ "$(xmlstarlet select --template -v "name($ipPath)" "$config")" != "$ipTag" ]; then
+        xmlstarlet edit --inplace --append "$namePath" --type elem -n "$ipTag" "$config"
+    fi
+
+    xmlstarlet edit --inplace --update "$namePath" --value "$MASTERADMIN_USER" "$config"
+
+    if [ -z "$MASTERADMIN_IP" ]; then
+        xmlstarlet edit --inplace --delete "$ipPath" "$config"
+    else
+        xmlstarlet edit --inplace --update "$ipPath" --value "$MASTERADMIN_IP" "$config"
+    fi
+fi
+
+for i in $(seq 0 2 $((${#tmOptions[@]} - 1))); do
+    var="${tmOptions[$i]}"
+    option="${tmOptions[$(($i + 1))]}"
+    value="${!var}"
+
+    if [ -n "$value" ]; then
+        xmlstarlet edit --inplace --update "$serverPath/$option" --value "$value" "$config"
+    fi
+done
+
+for i in $(seq 0 2 $((${#groups[@]} - 1))); do
+    var="${groups[$i]}"
+    group="${groups[$(($i + 1))]}"
+    value="${!var}"
+    path="/lists/$group"
+
+    echo "$value" | while read user; do
+        name="$(echo "$user" | LC_ALL="C" perl -pe "s/$userPattern/\1/")"
+        ip="$(echo "$user" | LC_ALL="C" perl -pe "s/$userPattern/\3/")"
+        xmlstarlet edit --inplace --subnode "$path" --type elem -n "tmlogin" --value "$name" "$adminConfig"
+
+        if [ -n "$ip" ]; then
+            xmlstarlet edit --inplace --subnode "$path" --type elem -n "ipaddress" --value "$ip" "$adminConfig"
+        fi
+    done
+done
+
+for i in $(seq 0 2 $((${#sqlOptions[@]} - 1))); do
+    var="${sqlOptions[$i]}"
+    option="${sqlOptions[$(($i + 1))]}"
+    value="${!var}"
+    xmlstarlet edit --inplace --update "$settingsPath/$option" --value "$value" "$dbConfig"
+done
+
+for i in $(seq 0 2 $((${#dediOptions[@]} - 1))); do
+    var="${dediOptions[$i]}"
+    option="${dediOptions[$(($i + 1))]}"
+    value="${!var}"
+
+    if [ -n "$value" ]; then
+        xmlstarlet edit --inplace --update "/dedimania/masterserver_account/$option" --value "$value" "$dediConfig"
+    fi
+done
+
+if [ -n "$X1_EXTRA_PLUGINS" ]; then
+    for plugin in $X1_EXTRA_PLUGINS; do
+        xmlstarlet edit --inplace --subnode "$pluginPath" --type elem -n "$pluginTag" --value "$plugin" "$pluginConfig"
+    done
+fi
+
+if [ -n "$X1_DISABLED_PLUGINS" ]; then
+    for i in $(seq 1 "$(xmlstarlet select --template -v "count($pluginPath/$pluginTag)" "$pluginConfig")"); do
+        for plugin in $X1_DISABLED_PLUGINS; do
+            path="$pluginPath/$pluginTag[$i]"
+
+            if [ "$(xmlstarlet select --template -v "$path/text()" "$pluginConfig")" == "$plugin" ]; then
+                xmlstarlet edit --inplace --delete "$path" "$pluginConfig"
+            fi
+        done
+    done
+fi
+
+$@
--- a/scripts/Common/Software/docker/services/trackmania/xaseco.Dockerfile
+++ b/scripts/Common/Software/docker/services/trackmania/xaseco.Dockerfile
@ -0,0 +1,62 @@
+FROM alpine:3.14 AS base
+RUN apk add xmlstarlet
+
+FROM php:5.5-alpine
+USER root
+RUN apk update \
+    && apk add \
+        bash \
+        unzip \
+        ca-certificates \
+        # xmlstarlet dependencies
+        musl \
+        libxslt \
+        libxml2 \
+        perl
+RUN update-ca-certificates
+RUN docker-php-ext-install mysql
+COPY --from=base /usr/bin/xmlstarlet /usr/bin
+COPY ./xaseco-entrypoint.sh /usr/local/bin/xaseco-foreground
+COPY ./parser.patch /root/parser.patch
+# Server dir
+RUN mkdir /cache
+# Override dir
+RUN mkdir /data
+# Merged dir
+RUN mkdir -p /opt/xaseco
+WORKDIR /opt/xaseco
+
+ENV \
+    MASTERADMIN_USER="" \
+    MASTERADMIN_IP="" \
+    \
+    ADMINS="" \
+    OPERATORS="" \
+    \
+    X1_EXTRA_PLUGINS="" \
+    X1_DISABLED_PLUGINS="" \
+    \
+    TM_SERVER_HOST="" \
+    TM_SERVER_PORT="" \
+    TM_XMLRPC_PORT="" \
+    TM_TIMEOUT="" \
+    \
+    TM_USER="" \
+    TM_PASSWORD="" \
+    TM_SUPERADMIN_PASSWORD="" \
+    \
+    MYSQL_HOST="" \
+    MYSQL_USER="" \
+    MYSQL_PASSWORD="" \
+    MYSQL_DATABASE="" \
+    \
+    DEDI_URL="" \
+    DEDI_NAME="" \
+    DEDI_USER="" \
+    DEDI_PASSWORD="" \
+    DEDI_NATION="" \
+    DEDI_LOG_NEWS="" \
+    DEDI_SHOW_MOTD=""
+
+ENTRYPOINT [ "xaseco-foreground" ]
+CMD [ "php", "./aseco.php" ]
--- a/scripts/Common/Software/docker/services/vaultwarden/docker-compose.base.yml
+++ b/scripts/Common/Software/docker/services/vaultwarden/docker-compose.base.yml
@ -2,17 +2,12 @@ services:
  vaultwarden:
    image: vaultwarden/server
    restart: unless-stopped
-    extends:
-      file: docker-compose.secrets.yml
-      service: vaultwarden
    volumes:
-      - ./data:/data
      - /etc/localtime:/etc/localtime:ro
+      - ./data/vault:/data
    environment:
-      DOMAIN: null
      SMTP_HOST: bridge
-      SMTP_FROM: null
-      SMTP_FROM_VALUE: vaultwarden
+      SMTP_FROM_VALUE: Vaultwarden
      SMTP_PORT: 25
      SMTP_ACCEPT_INVALID_CERTS: "true"
      SIGNUPS_ALLOWED: "false"
@ -20,16 +15,13 @@ services:
  db:
    image: mariadb
    restart: unless-stopped
-    extends:
-      file: docker-compose.secrets.yml
-      service: db
    volumes:
-      - ./db:/var/lib/mysql
      - /etc/localtime:/etc/localtime:ro
+      - ./data/db:/var/lib/mysql
    environment:
      MARIADB_RANDOM_ROOT_PASSWORD: "yes"
  bridge:
    image: shenxn/protonmail-bridge
    restart: unless-stopped
    volumes:
-      - ./bridge:/root
+      - ./data/bridge:/root
--- a/scripts/Common/Software/docker/services/vaultwarden/docker-compose.overrides.yml
+++ b/scripts/Common/Software/docker/services/vaultwarden/docker-compose.overrides.yml
@ -1,6 +1,8 @@
 services:
  vaultwarden:
    environment:
+      DOMAIN: null
+      SMTP_FROM: null
      DATABASE_URL: mysql://vaultwarden:pw@db/vault
    ports:
      - 127.0.0.1:1337:80
--- a/scripts/Common/Software/docker/services/vaultwarden/main.fish
+++ b/scripts/Common/Software/docker/services/vaultwarden/main.fish
@ -1,25 +1,24 @@
 #!/bin/env fish
 begin
    set -l dir (status dirname)
-    set -l domain "passwords"
-    set -l source "$dir/docker-compose.secrets.yml"
+    set -l domain passwords
+    set -l source "$dir/docker-compose.overrides.yml"
    source "$dir/../service.fish"

    function installSW -V dir -V domain -V source
-        set -l file "$dir/docker-compose.yml"
+        set -l file "$dir/docker-compose.base.yml"
        set -l pw (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
        set -l envKey ".services.vaultwarden.environment"
        set -l dbKey "$envKey.DATABASE_URL"
-        set -l dbUrl (yq --raw-output "$dbKey" "$source" | sed "s/^\(.*:\/\/.*:\).*\(@.*\/.*\)\$/\1$pw\2/")
+        set -l dbUrl (yq "$dbKey" "$source" | sed "s/^\(.*:\/\/.*:\).*\(@.*\/.*\)\$/\1$pw\2/")
        initializeServiceInstallation $argv
+        cp "$dir/docker-compose.base.yml" (getServiceRoot $argv)

-        URL="https://$domain.$(getMachineFQDN)" yq "$envKey.DOMAIN = env.URL" "$file" | \
-            ADDRESS="noreply@$(getMachineFQDN)" yq -y "$envKey.SMTP_FROM = env.ADDRESS" | \
-            sudo tee "$(getServiceRoot $argv)/$(basename "$file")" >/dev/null
-
-        URL=$dbUrl yq "$dbKey = env.URL" "$source" | \
-            PW=$pw yq ".services.db.environment.MARIADB_PASSWORD = env.PW" | \
-            sudo tee (getServiceSecretsConfig $argv) >/dev/null
+        URL="https://$domain.$(getMachineFQDN)" yq "$envKey.DOMAIN = env(URL)" "$source" |
+            ADDRESS="no-reply@$(getMachineFQDN)" yq "$envKey.SMTP_FROM = env(ADDRESS)" |
+            URL=$dbUrl yq "$dbKey = env(URL)" |
+            PW=$pw yq ".services.db.environment.MARIADB_PASSWORD = env(PW)" |
+            sudo tee (getServiceOverrides $argv) >/dev/null

        installDockerService $argv
    end
@ -37,9 +36,5 @@ begin
        printf "%s\0" "$_flag_name" /
    end

-    function getBackupArgs
-        printf "%s\n" --hidden --no-ignore . --exclude "docker-compose.yml" (getServiceRoot $argv)
-    end
-
    runInstaller --force $argv
 end
--- a/scripts/Common/Software/docker/services/wekan/docker-compose.base.yml
+++ b/scripts/Common/Software/docker/services/wekan/docker-compose.base.yml
@ -0,0 +1,28 @@
+services:
+  wekan:
+    image: wekanteam/wekan
+    restart: unless-stopped
+    depends_on:
+      - db
+    user: 1337:1337
+    environment:
+      WRITABLE_PATH: /data
+      MONGO_URL: mongodb://db:27017/wekan
+      MONGO_OPLOG_URL:
+      WITH_API: "true"
+      RICHER_CARD_COMMENT_EDITOR: "true"
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ./data/wekan:/data
+  db:
+    image: mongo
+    restart: unless-stopped
+    command: mongod --logpath /dev/null --oplogSize 128 --quiet
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ./data/db:/data/db
+  bridge:
+    image: shenxn/protonmail-bridge
+    restart: unless-stopped
+    volumes:
+      - ./data/bridge:/root
--- a/scripts/Common/Software/docker/services/wekan/docker-compose.overrides.yml
+++ b/scripts/Common/Software/docker/services/wekan/docker-compose.overrides.yml
@ -0,0 +1,6 @@
+services:
+  wekan:
+    environment:
+      ROOT_URL: https://example.com
+    ports:
+      - 127.0.0.1:1337:8080
--- a/scripts/Common/Software/docker/services/wekan/main.fish
+++ b/scripts/Common/Software/docker/services/wekan/main.fish
@ -0,0 +1,30 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    set -l service wekan
+    set -l domain due ""
+    source "$dir/../service.fish"
+
+    function installSW -V dir -V service -V domain
+        set -l domain (getServiceDomain $domain)
+        set -l overrides (getServiceOverrides $argv)
+        initializeServiceInstallation $argv
+
+        sudo cp "$dir/docker-compose.base.yml" (getServiceRoot $argv)
+
+        URL="https://$domain" yq "$(getServiceKey "$service").environment.ROOT_URL = env(URL)" "$dir/$(basename "$overrides")" |
+            sudo tee "$overrides" >/dev/null
+
+        installDockerService $argv
+    end
+
+    function getServiceServers -V domain
+        printf "%s\0" $domain
+    end
+
+    function getServiceLocations -V service
+        printf "%s\0" "$service" /
+    end
+
+    runInstaller --force $argv
+end
--- a/scripts/Common/Software/docker/services/woodpecker/.dockerignore
+++ b/scripts/Common/Software/docker/services/woodpecker/.dockerignore
@ -0,0 +1 @@
+data/
--- a/scripts/Common/Software/docker/services/woodpecker/ci.Dockerfile
+++ b/scripts/Common/Software/docker/services/woodpecker/ci.Dockerfile
@ -0,0 +1,7 @@
+FROM tetafro/golang-gcc AS builder
+RUN apk add -U --no-cache git
+RUN git clone -b "v2.20.0" --depth=1 https://github.com/drone/drone.git
+RUN cd drone && go build -trimpath -ldflags='-w -s' -tags nolimit -o /usr/local/bin/drone-server ./cmd/drone-server
+
+FROM drone/drone
+COPY --from=builder /usr/local/bin/drone-server /bin/
--- a/scripts/Common/Software/docker/services/woodpecker/docker-compose.templates.yml
+++ b/scripts/Common/Software/docker/services/woodpecker/docker-compose.templates.yml
@ -0,0 +1,26 @@
+services:
+  ci-template:
+    image: woodpeckerci/woodpecker-server
+    restart: unless-stopped
+    depends_on: []
+    env_file:
+      - ci.common.env
+    environment:
+      WOODPECKER_DATABASE_DRIVER: mysql
+    volumes: []
+  agent-template:
+    image: woodpeckerci/woodpecker-agent
+    restart: unless-stopped
+    depends_on: []
+    command: agent
+    env_file:
+      - agent.common.env
+    environment: {} 
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+  db-template:
+    image: mariadb
+    restart: unless-stopped
+    environment:
+      MARIADB_RANDOM_ROOT_PASSWORD: "yes"
+    volumes: []
--- a/scripts/Common/Software/docker/services/woodpecker/main.fish
+++ b/scripts/Common/Software/docker/services/woodpecker/main.fish
@ -0,0 +1,116 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    set -l source "$dir/docker-compose.templates.yml"
+    source "$dir/../service.fish"
+
+    set -l environments \
+        my ci "" \
+        codeberg bergwache "" \
+        github gh.ci ""
+
+    function installSW -V dir -V environments -V source
+        set -l root (getServiceRoot $argv)
+        set -l config "$root/docker-compose.base.yml"
+        set -l overrides (getServiceOverrides $argv)
+        set -l ciTemplate (yq -oj (getServiceKey ci-template) "$source")
+        set -l agentTemplate (yq -oj (getServiceKey agent-template) "$source")
+        set -l dbTemplate (yq -oj (getServiceKey db-template) "$source")
+        initializeServiceInstallation $argv
+        echo "{}" | sudo tee "$config" >/dev/null
+        echo "{}" | sudo tee "$overrides" >/dev/null
+
+        cp "$dir/.dockerignore" "$root"
+        sudo touch "$root"/{agent,ci}.common.env
+
+        for i in (seq 1 3 (count $environments))
+            set -l name $environments[$i]
+            set -l domain $environments[(math $i + 2)]
+            set -l subdomain $environments[(math $i + 1)]
+            set -l secret (openssl rand -hex 32)
+            set -l services ci db agent
+            set -l tmpConfig (mktemp)
+            set -l tmpOverrides (mktemp)
+            set -l ciName "$name-ci"
+            set -l dbName "$name-db"
+            set -l agentName "$name-agent"
+            set -l ciEnv
+            set -l dbEnv
+            set -l agentEnv
+            set -l ciKey
+            set -l dbKey
+            set -l agentKey
+            set -l db Woodpecker
+            set -l dbUser woodpecker
+            set -l pw (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
+            set -l domain (getServiceDomain "$subdomain" "$domain")
+
+            cp "$config" "$tmpConfig"
+            cp "$overrides" "$tmpOverrides"
+
+            for serviceName in $services
+                set -l file (mktemp)
+                set -l nameVar "$serviceName""Name"
+                set -l serviceKey (getServiceKey "$$nameVar")
+                set "$serviceName""Key" "$serviceKey"
+                set "$serviceName""Env" "$serviceKey.environment"
+            end
+
+            CI_NAME=$ciName \
+                SECRET_ENV="$name.secret.env" begin
+                begin
+                    echo "WOODPECKER_AGENT_SECRET=$secret"
+                end | sudo tee "$root/$SECRET_ENV" >/dev/null
+
+                yq "$ciKey = $ciTemplate" "$tmpConfig" |
+                    DB="$dbName" yq "$ciKey.depends_on |= . + [ env(DB) ]" |
+                    ENTRY="./data/$name/ci:/var/lib/woodpecker" yq "$ciKey.volumes = [ env(ENTRY) ]" |
+                    yq "$ciKey.env_file |= . + [ env(SECRET_ENV) ]" |
+                    yq "$agentKey = $agentTemplate" |
+                    yq "$agentKey.depends_on |= . + [ env(CI_NAME) ]" |
+                    yq "$agentKey.env_file |= . + [ env(SECRET_ENV) ]" |
+                    SERVER="$ciName:9000" yq "$agentEnv.WOODPECKER_SERVER = env(SERVER)" |
+                    yq "$dbKey = $dbTemplate" |
+                    ENTRY="./data/$name/db:/var/lib/mysql" yq "$dbKey.volumes |= . + [ env(ENTRY) ]" |
+                    sudo tee "$config" >/dev/null
+
+                HOST="https://$domain" yq "$ciEnv.WOODPECKER_HOST = env(HOST)" "$tmpOverrides" |
+                    PORT="127.0.0.1:1337:8000" yq "$ciKey.ports = [ env(PORT) ]" |
+                    DB="$dbUser:$pw@tcp($dbName:3306)/$db?parseTime=true" yq "$ciEnv.WOODPECKER_DATABASE_DATASOURCE = env(DB)" |
+                    USER="$dbUser" yq "$dbEnv.MARIADB_USER = env(USER)" |
+                    PW="$pw" yq "$dbEnv.MARIADB_PASSWORD = env(PW)" |
+                    DB="$db" yq "$dbEnv.MARIADB_DATABASE = env(DB)" |
+                    sudo tee "$overrides" >/dev/null
+            end
+        end
+
+        installDockerService $argv
+    end
+
+    function configureSW -V dir
+        configureDockerService $argv
+    end
+
+    function getServiceServers -V environments
+        argparse -i "name=" -- $argv
+        set -l name "$_flag_name"
+
+        for i in (seq 1 3 (count $environments))
+            set -l domain $environments[(math $i + 2)]
+            set -l subdomain $environments[(math $i + 1)]
+            printf "%s\0" "$subdomain" "$domain"
+        end
+    end
+
+    function getServiceLocations -a index -V environments
+        set -l i (math (math (math $index - 1) / 2 "*" 3) + 1)
+        set -l name $environments[$i]
+        printf "%s\0" "$name-ci" /
+    end
+
+    function getExtraBackupPatterns
+        echo "\.secret\.env\$"
+    end
+
+    runInstaller --force $argv
+end
--- a/scripts/Common/Software/linux/main.fish
+++ b/scripts/Common/Software/linux/main.fish
@ -5,6 +5,6 @@ begin

    function getUserBackupArgs
        argparse -i "user=" -- $argv
-        printf "%s\n" --base-directory ~"$_flag_user" --exact-depth 1 --hidden "^(\\.ssh|[^.])" --exclude "Games" --exclude "Desktop" ~ --exec fd . {}
+        printf "%s\n" --base-directory ~"$_flag_user" --exact-depth 1 --hidden "^(\\.ssh|[^.])" --exclude Games --exclude Desktop ~ --exec fd . {}
    end
 end
--- a/scripts/Common/Software/nuke-usb/nuke-usb.sh
+++ b/scripts/Common/Software/nuke-usb/nuke-usb.sh
@ -11,6 +11,7 @@ sleep_secs="1"
 # * 'ehci-pci' - USB 2.0
 # * 'xhci_hcd' - USB 3.0
 echo "Looking for USB standards ..."
+
 for usb_std in "$base/"?hci[-_]?c*; do
    echo "* USB standard '$usb_std' ..."

@ -25,4 +26,5 @@ for usb_std in "$base/"?hci[-_]?c*; do

    echo "  done."
 done
+
 echo "done."
--- a/scripts/Windows/Software/tobii-gamehub/GameHub.ahk
+++ b/scripts/Windows/Software/tobii-gamehub/GameHub.ahk
@ -1,5 +1,4 @@
-InstallGameHub()
-{
+InstallGameHub() {
    SetDefaultMouseSpeed(100)
    SetTitleMatchMode("RegEx")
    windowTitle := "^Tobii Game Hub$"
--- a/scripts/Windows/Software/tobii-ghost/Ghost.ahk
+++ b/scripts/Windows/Software/tobii-ghost/Ghost.ahk
@ -1,5 +1,4 @@
-InstallGhost()
-{
+InstallGhost() {
    SetDefaultMouseSpeed(100)
    SetTitleMatchMode("RegEx")
    windowTitle := "^Tobii Ghost$"
--- a/scripts/lib/Settings.ps1
+++ b/scripts/lib/Settings.ps1
@ -186,7 +186,8 @@ $null = New-Module {
        $programs = & {
            if ($User) {
                return Get-UserConfig -UserName $User @args;
-            } else {
+            }
+            else {
                return Get-OSConfig @args;
            }
        } "programs";
@ -207,7 +208,8 @@ $null = New-Module {

        try {
            (Get-ProgramConfig @PSBoundParameters).enable;
-        } catch {
+        }
+        catch {
            $false;
        }
    }
--- a/scripts/lib/action.fish
+++ b/scripts/lib/action.fish
@ -10,14 +10,15 @@ function runActionSetup -V dir
    and runHook prepareNix || installNixPkgs

    and echo "Flagging repository as safe..."
-    and sudo git config --system --add safe.directory (realpath "$(status dirname)/../..")
+    and sudo git config --system --add safe.directory (realpath -m "$(status dirname)/../..")
    and runHook actionPreRun || true
 end

-function runActionConfigure
+function runActionConfigure -V dir
    and if [ -z "$CONFIG_NAME" ]
+        source "$dir/settings.fish"
        selectProfile config
-        set -x CONFIG_NAME "$config"
+        set -gx CONFIG_NAME "$config"
    end
 end

@ -26,7 +27,7 @@ function disposeAction -V dir
    source "$dir/nix.fish"
    runHook actionPostRun || true
    and uninstallNixPkgs
-    and sudo git config remove-section --system safe || true
+    and sudo git config --remove-section --system safe || true
 end

 function runAction -V dir
@ -37,40 +38,44 @@ function runAction -V dir
 end

 function runSetupUserAction -V dir
-    if [ (id -u) -eq 0 ]
-        set -l cmdline (cat /proc/$fish_pid/cmdline | string split0)
-
-        if [ -z "$TMUX" ]
-            runActionSetup
-            tmux new-session -e "CONFIG_NAME=$CONFIG_NAME" $cmdline
-        else
    source "$dir/settings.fish"
+    runActionSetup
    runActionConfigure
-            set -l sudoConfig "/etc/sudoers.d/PortValhalla"
    set -l name (getOSConfig setupUser.name)

-            and begin
+    if [ "$USER" != "$name" ]
+        set -l cmdline (cat /proc/$fish_pid/cmdline | string split0)
+
+        if [ (id -u) -ne 0 ]
+            sudo --set-home --preserve-env env "PATH=$PATH" $cmdline
+        else
+            if [ -z "$TMUX" ]
+                tmux new-session env (env) $cmdline
+            else
+                set -l sudoConfig "/etc/sudoers.d/PortValhalla"
+
+                begin
                    echo "Creating setup user"

                    and useradd \
                        --comment "PortValhalla Setup User" \
                        --system \
-                    --no-user-group \
                        --groups nix-users \
                        --create-home \
                        --uid (getOSConfig setupUser.id --json) \
                        "$name"
-            end

                    and begin
                        echo "$name ALL=(ALL:ALL) NOPASSWD: ALL"
                    end >"$sudoConfig"

-            and sudo --preserve-env --set-home --user "$name" $cmdline
+                    and sudo --preserve-env --set-home --user "$name" env "PATH=$PATH" $cmdline
                    disposeAction
                    rm "$sudoConfig"
                    userdel -rf "$name"
                end
+            end
+        end
    else
        $argv
    end
--- a/scripts/lib/nix.fish
+++ b/scripts/lib/nix.fish
@ -1,12 +1,16 @@
 begin
    set -l dir (status dirname)
    set -l config "$dir/config.fish"
-    set nixPkgsDir "/nix/var/nix/profiles/per-user/root/channels/nixpkgs"
+    set nixPkgsDir /nix/var/nix/profiles/per-user/root/channels/nixpkgs
+
+    function __isNixModule -a path
+        nix-instantiate --eval --expr "{ path }: import path" --argstr path "$path" &>/dev/null
+    end

    function downloadNixPkgs -V config
        source "$config"

-        if [ ! -d "$nixPkgsCache" ]
+        if ! __isNixModule "$nixPkgsCache"
            mkdir -p "$nixPkgsCache"
            and git clone https://github.com/NixOS/nixpkgs.git --depth=1 -b "$nixPkgsVersion" "$nixPkgsCache"
            and rm -rf "$nixPkgsCache/.git"
@ -16,8 +20,8 @@ begin
    function installNixPkgs -V config -V nixPkgsDir
        source "$config"

-        if [ ! -d "$nixPkgsDir" ]
-            if [ ! -d "$nixPkgsCache" ]
+        if ! __isNixModule "$nixPkgsDir"
+            if ! __isNixModule "$nixPkgsCache"
                downloadNixPkgs
            end

--- a/scripts/lib/restoration.fish
+++ b/scripts/lib/restoration.fish
@ -62,7 +62,7 @@ function runRestorationCommand
            set -a args -p $VALHALLA_BACKUP_SERVER_PORT
        end

-        ssh $args "$VALHALLA_BACKUP_SERVER" (string escape -- $argv)
+        sudo ssh -i $(string escape -- "$VALHALLA_BACKUP_SERVER_KEY") $args "$VALHALLA_BACKUP_SERVER" (string escape -- $argv)
    end
 end

--- a/scripts/lib/software.fish
+++ b/scripts/lib/software.fish
@ -109,12 +109,12 @@ begin
    end

    function runInstallerAction -V dir -V actions
-        argparse -i "force" "name=" "action=" -- $argv
+        argparse -i force "name=" "action=" -- $argv
        set -l install
        set -l name $_flag_name
        set -l action $_flag_action
        set -l args $_flag_force --name "$name"
-        set -l dependencyFunction "installSWDependencies"
+        set -l dependencyFunction installSWDependencies
        set -l installDependencies
        source "$dir/settings.fish"

@ -149,8 +149,8 @@ begin
            if [ "$action" = "$actions[$i]" ]
                set -l message
                set -l function $actions[(math $i + 1)]
-                set -l preRun "__preRun"
-                set -l postRun "__postRun"
+                set -l preRun __preRun
+                set -l postRun __postRun
                functions -e $preRun
                functions -e $postRun

--- a/scripts/test/arch-install.fish
+++ b/scripts/test/arch-install.fish
@ -2,7 +2,7 @@
 set -l dir (status dirname)
 set -l container valhalla-test
 set -l containerDir "/var/lib/lxc/$container"
-set -l valhallaRoot "opt/PortValhalla"
+set -l valhallaRoot opt/PortValhalla
 sudo lxc-stop "$container"
 sudo lxc-destroy "$container"
 sudo lxc-create "$container" -t download -- --dist archlinux --release current --arch amd64
@ -15,7 +15,11 @@ begin
        "lxc.apparmor.profile = unconfined" \
        "" \
        "# Shared Folder" \
-        "lxc.mount.entry = $(realpath "$dir/../..") $valhallaRoot none bind 0 0"
+        "lxc.mount.entry = $(realpath "$dir/../..") $valhallaRoot none bind 0 0" \
+        "" \
+        "# VPN" \
+        "lxc.cgroup.devices.allow = c 10:200 rwm" \
+        "lxc.mount.entry = /dev/net dev/net none bind,create=dir 0 0"
 end | sudo tee -a "$containerDir/config" >/dev/null

 sudo lxc-start "$container"
Author	SHA1	Message	Date
Manuel Thalmann	d218d0495d	Format all files	2024-11-29 01:15:08 +01:00
Manuel Thalmann	6d1c9fee53	FIx handling users with no docker services	2024-11-29 01:15:08 +01:00
Manuel Thalmann	7f9616be02	Fix invalid `git` cli call	2024-11-29 01:15:08 +01:00
Manuel Thalmann	e20681a1bd	Add missing function argument	2024-11-29 01:15:08 +01:00
Manuel Thalmann	597fa1ee1f	Inherit all env variables in the `tmux` session	2024-11-29 01:15:08 +01:00
Manuel Thalmann	98ff044bc2	Back up `teamspeak` properly	2024-11-29 01:15:08 +01:00
Manuel Thalmann	85b6f8ccc6	Force creation of an ssh key for backups	2024-11-29 01:15:08 +01:00
Manuel Thalmann	d1588b4d9f	Preserve `PATH` for setup actions	2024-11-29 01:15:08 +01:00
Manuel Thalmann	9b53e96561	Add scripts for installing a `terraria` server	2024-11-29 01:15:08 +01:00
Manuel Thalmann	70d2323d68	Back up extra files using `getExtraBackupPatterns`	2024-11-29 01:15:08 +01:00
Manuel Thalmann	2e1fa261bd	Remove world mounts for minecraft services	2024-11-29 01:15:08 +01:00
Manuel Thalmann	080d3d3222	Simplify xaseco command handling	2024-11-29 01:15:08 +01:00
Manuel Thalmann	1e2ce910c2	Silence unnecessary output	2024-11-29 01:15:08 +01:00
Manuel Thalmann	f259592064	Allow specifying xaseco operators and admins	2024-11-29 01:15:08 +01:00
Manuel Thalmann	df1077ffe8	Normalize display name of vaultwarden mailer	2024-11-29 01:15:08 +01:00
Manuel Thalmann	8bed36aed5	Store all game data of TrackMania service	2024-11-29 01:15:08 +01:00
Manuel Thalmann	3b9943f1a1	Add declaration of `transmission` service	2024-11-29 01:15:08 +01:00
Manuel Thalmann	05d0d5a692	Leave user of `wekan` container unchanged	2024-11-29 01:15:08 +01:00
Manuel Thalmann	5970d729af	Store domain names in overrides	2024-11-29 01:15:08 +01:00
Manuel Thalmann	3b489ee5fb	Normalize the save path of service data	2024-11-29 01:15:08 +01:00
Manuel Thalmann	ad1d72d85b	Improve the format of the docker files	2024-11-29 01:15:08 +01:00
Manuel Thalmann	54b6eccbf0	Rename `secrets` files to `overrides`	2024-11-29 01:15:08 +01:00
Manuel Thalmann	d3134647dd	Store Jellyfin domain in secrets	2024-11-29 01:15:08 +01:00
Manuel Thalmann	3ab2b71afb	Allow specifying overrides for docker services	2024-11-29 01:15:08 +01:00
Manuel Thalmann	d144876afb	Allow specifying additional patterns to back up	2024-11-29 01:15:08 +01:00
Manuel Thalmann	18e531141b	Configure forgejo runner by default	2024-11-29 01:15:08 +01:00
Manuel Thalmann	4db9a640b3	Store all forgejo files in `data/`	2024-11-29 01:15:08 +01:00
Manuel Thalmann	5ee149e42a	Set forgejo domain by default	2024-11-29 01:15:08 +01:00
Manuel Thalmann	269f8b89e9	Reduce redundancy of drone setup	2024-11-29 01:15:08 +01:00
Manuel Thalmann	d9ace95328	Fix order of properties in drone templates	2024-11-29 01:15:08 +01:00
Manuel Thalmann	7248ec703a	Load enabled services from machine config	2024-11-29 01:15:08 +01:00
Manuel Thalmann	e25c00cd39	Ensure nix channels are functioning	2024-11-29 01:15:08 +01:00
Manuel Thalmann	df2e0ffc16	Force running actions as setup-user	2024-11-29 01:15:08 +01:00
Manuel Thalmann	981e6eaa5c	Skip backup questions if specified	2024-11-29 01:15:08 +01:00
Manuel Thalmann	222467b5ae	Create backup whitelist for docker-compose	2024-11-29 01:15:08 +01:00
Manuel Thalmann	f8e4e94af5	Add a profile for the server	2024-11-29 01:15:08 +01:00
Manuel Thalmann	67e5e04a06	Add options for enabling docker-compose services	2024-11-29 01:15:08 +01:00
Manuel Thalmann	3df1501fbc	Add scripts for installing woodpecker	2024-11-29 01:15:08 +01:00
Manuel Thalmann	395d69c974	Add scripts for installing wekan	2024-11-29 01:15:08 +01:00
Manuel Thalmann	567a0d8070	Add scripts for installing TrackMania server	2024-11-29 01:15:08 +01:00
Manuel Thalmann	b4b87f37ea	Replace `yq` with `go-yq`	2024-11-29 01:15:08 +01:00
Manuel Thalmann	5e1686402c	Add scripts for installing TeamSpeak	2024-11-29 01:15:08 +01:00
Manuel Thalmann	885e7cf9d0	Add scripts for installing ryot	2024-11-29 01:15:08 +01:00
Manuel Thalmann	8b9758dea0	Add scripts for installing nextcloud	2024-11-29 01:15:08 +01:00
Manuel Thalmann	ed237fb750	Restructure service overrides	2024-11-29 01:15:08 +01:00
Manuel Thalmann	61276f51c9	Add scripts for installing Minecraft	2024-11-29 01:15:08 +01:00
Manuel Thalmann	a4bd5c60d2	Add settings for allowing VPN access in lxc	2024-11-29 01:15:08 +01:00