Load enabled services from machine config

flake.nix

@@ -45,6 +45,7 @@
     valhalla = {
       DerGeret = import ./profiles/machines/manuel/DerGeret/Arch/config.nix;
       ManuSurface = import ./profiles/machines/manuel/ManuSurface/Arch/config.nix;
+      server = import ./profiles/machines/manuel/server.nix;
     };
   };
 }

lib/modules/programs.nix

@@ -30,7 +30,6 @@ let
     ["aliae" "aliae"]
     ["brave" "Brave Browser"]
     ["discord" "Discord"]
-    ["docker" "docker"]
     ["firefox" "Firefox Web Browser"]
     ["openssh" "OpenSSH"]
     ["osu!lazer" "osu!lazer"]
@@ -51,6 +50,7 @@ let
     ["logo-ls" "logo-ls"]
     ["lutris" "Lutris"]
     ["minegrub-theme" "Minegrub Theme"]
+    ["nginx" "nginx"]
     ["nodejs-n" "n"]
     ["nuke-usb" "nuke-usb"]
     ["nvidia-dkms" "Nvidia Drivers"]
@@ -83,6 +83,7 @@ let
   ];
 in {
   imports = [
+    ./programs/docker.nix
     ./programs/git.nix
     ./programs/nextcloud.nix
     ./programs/oh-my-posh.nix

lib/modules/programs/docker.nix

@@ -0,0 +1,42 @@
+{ lib, ... }:
+let
+  inherit (lib) mkEnableOption mkOption types;
+
+  commonOptions = {
+    enable = mkEnableOption "docker";
+  };
+in {
+  options = {
+    valhalla = {
+      programs.docker = commonOptions;
+
+      users = mkOption {
+        type = types.attrsOf (types.submodule (
+          { ... }: {
+            options = {
+              programs.docker = commonOptions;
+            };
+          }));
+      };
+
+      linux = {
+        programs = {
+          docker = {
+            services = {
+              anki-sync.enable = mkEnableOption "Anki Sync server";
+              drone.enable = mkEnableOption "drone server";
+              forgejo.enable = mkEnableOption "Forgejo server";
+              jellyfin.enable = mkEnableOption "Jellyfin media server";
+              minecraft.enable = mkEnableOption "Minecraft server";
+              nextcloud.enable = mkEnableOption "Nextcloud server";
+              teamspeak.enable = mkEnableOption "TeamSpeak server";
+              trackmania.enable = mkEnableOption "TrackMania server";
+              vaultwarden.enable = mkEnableOption "Vaultwarden server";
+              woodpecker.enable = mkEnableOption "Woodpecker CI server";
+            };
+          };
+        };
+      };
+    };
+  };
+}

profiles/machines/manuel/server.nix

@@ -0,0 +1,73 @@
+{ lib, config, ... }:
+let fs = import ../../../lib/modules/partition/fs.nix;
+in {
+  imports = [ ./defaults.nix ];
+
+  config = {
+    valhalla = {
+      partition = {
+        os = {
+          partitions = {
+            Boot = {
+              index = 1;
+              type = "uefi";
+              size = "+1G";
+              format = fs.fat32;
+              mountPoint = config.valhalla.boot.efiMountPoint;
+            };
+
+            Swap = {
+              index = 2;
+              type = "swap";
+            };
+
+            OS = {
+              index = 3;
+              label = lib.mkDefault config.valhalla.boot.label;
+              type = "linux";
+              format = fs.ext4;
+              mountPoint = "/";
+            };
+          };
+        };
+      };
+
+      hostname = "nuth.ch";
+      timeZone = "Europe/Zurich";
+      keyMap = "de_CH-latin1";
+      keyboardLayout = "ch";
+
+      i18n = {
+        localeSettings = let defaultLocale = "en_US.UTF-8";
+        in {
+          LANG = "de_CH.UTF-8";
+          LANGUAGE = defaultLocale;
+          LC_MESSAGE = defaultLocale;
+        };
+      };
+
+      software = {
+        essential = true;
+        server = true;
+      };
+
+      programs.docker.enable = true;
+
+      linux.programs = {
+        docker = {
+          services = {
+            drone.enable = true;
+            forgejo.enable = true;
+            jellyfin.enable = true;
+            minecraft.enable = true;
+            nextcloud.enable = true;
+            teamspeak.enable = true;
+            trackmania.enable = true;
+            vaultwarden.enable = true;
+            woodpecker.enable = true;
+          };
+        };
+      };
+    };
+  };
+}

scripts/Arch/OS/install.fish

@@ -27,7 +27,7 @@ begin
         and yayinst \
             linux-headers \
             pacman-contrib \
-            yq
+            go-yq
     end
 
     source "$dir/../../Common/OS/install.fish"

scripts/Arch/Software/docker/main.fish

@@ -10,6 +10,8 @@ begin
             docker-compose \
             docker-buildx \
             docker-scan
+
+        installSWBase $argv
     end
 
     runInstaller $argv

scripts/Common/OS/backup.fish

@@ -14,31 +14,33 @@ function backupAction -V dir
 
     set -l deployScript (getDeploymentScript)
 
-    if fish "$dir/../../../lib/modules/partition/confirm.fish" "Do you wish to store the backup on an SSH server?" n
+    if [ -z "$VALHALLA_BACKUP_DIR" ]
-        read -xP "Please specify the host name of the SSH server: " VALHALLA_BACKUP_SERVER
+        if fish "$dir/../../../lib/modules/partition/confirm.fish" "Do you wish to store the backup on an SSH server?" n
-        read -xP "Please specify the port of the SSH server (default 22): " VALHALLA_BACKUP_SERVER_PORT
+            read -xP "Please specify the host name of the SSH server: " VALHALLA_BACKUP_SERVER
-        read -xP "Please specify the name of the user to log in to the SSH server: " VALHALLA_BACKUP_SERVER_USER
+            read -xP "Please specify the port of the SSH server (default 22): " VALHALLA_BACKUP_SERVER_PORT
+            read -xP "Please specify the name of the user to log in to the SSH server: " VALHALLA_BACKUP_SERVER_USER
     
-        if [ -z "$VALHALLA_BACKUP_SERVER_PORT" ]
+            if [ -z "$VALHALLA_BACKUP_SERVER_PORT" ]
-            set -x VALHALLA_BACKUP_SERVER_PORT 22
+                set -x VALHALLA_BACKUP_SERVER_PORT 22
+            end
+    
+            if [ -n "$VALHALLA_BACKUP_USER" ]
+                set -x VALHALLA_BACKUP_SERVER "$VALHALLA_BACKUP_SERVER_USER@$VALHALLA_BACKUP_SERVER"
+            end
+    
+            echo
+            echo "$(tput setaf 3)==== WARNING ====$(tput sgr0)"
+            echo "For a seamless experience, please make sure that you are able to establish an unattended ssh connection using key authentication."
+            echo
+            echo "$(tput bold)This command should succeed without user interaction:$(tput sgr0)"
+            echo "ssh -o PasswordAuthentication=no -p $VALHALLA_BACKUP_SERVER_PORT $VALHALLA_BACKUP_SERVER true"
+            read -P "Press enter once you're done: "
+            echo
         end
 
-        if [ -n "$VALHALLA_BACKUP_USER" ]
+        read -xP "Please specify the path to the directory to save the backup to: " VALHALLA_BACKUP_DIR
-            set -x VALHALLA_BACKUP_SERVER "$VALHALLA_BACKUP_SERVER_USER@$VALHALLA_BACKUP_SERVER"
-        end
-
-        echo
-        echo "$(tput setaf 3)==== WARNING ====$(tput sgr0)"
-        echo "For a seamless experience, please make sure that you are able to establish an unattended ssh connection using key authentication."
-        echo
-        echo "$(tput bold)This command should succeed without user interaction:$(tput sgr0)"
-        echo "ssh -o PasswordAuthentication=no -p $VALHALLA_BACKUP_SERVER_PORT $VALHALLA_BACKUP_SERVER true"
-        read -P "Press enter once you're done: "
-        echo
     end
 
-    read -xP "Please specify the path to the directory to save the backup to: " VALHALLA_BACKUP_DIR
-
     runHook backupSoftware || begin
         echo "Backing up software..."
 

scripts/Common/Software/aliae/Manage.ps1

@@ -27,7 +27,7 @@ $null = New-Module {
                 Value = "$Value";
             } `
             -User $User `
-            ".alias |= [((. // [])[] | select(.name != env.Name))] + [{ name: env.Name, value: env.Value }]";
+            ".alias |= [((. // [])[] | select(.name != env(Name)))] + [{ name: env(Name), value: env(Value) }]";
     }
 
     <#
@@ -53,7 +53,7 @@ $null = New-Module {
                 Value = "$Value";
             } `
             -User $User `
-            ".env |= [((. // [])[] | select(.name != env.Name))] + [{ name: env.Name, value: env.Value }]";
+            ".env |= [((. // [])[] | select(.name != env(Name)))] + [{ name: env(Name), value: env(Value) }]";
     }
 
     <#
@@ -92,7 +92,7 @@ $null = New-Module {
             }
 
             sudo @using:flags pwsh -CommandWithArgs 'Get-Content -Raw $args[0]' $using:path | Set-Content $file;
-            yq -yi $using:Script $file;
+            yq -i $using:Script $file;
             sudo @using:flags pwsh -CommandWithArgs 'Set-Content $args[0] -Value $args[1]' $using:path (Get-Content -Raw $file);
             Remove-Item $file;
         } | Receive-Job -Wait;

scripts/Common/Software/docker/main.fish

@@ -12,5 +12,19 @@ begin
         sudo usermod -aG docker "$_flag_user"
     end
 
+    function installSWDependencies -V dir -V args
+        source "$dir/../../../lib/settings.fish"
+        set -la argv $args
+        argparse -i "name=" "user=" -- $argv
+        set -l services (getProgramConfig --name "$_flag_name" --json | jq '.services')
+
+        for service in (echo "$services" | jq '. | keys[]' --raw-output0 | string split0)
+
+            if echo "$services" | SERVICE=$service jq --exit-status ".[env.SERVICE].enable" >/dev/null
+                fish "$dir/services/$service/main.fish" $argv
+            end
+        end
+    end
+
     runInstaller $argv
 end

scripts/Common/Software/docker/services/anki-sync/main.fish

@@ -8,11 +8,11 @@ begin
     function installSW -V dir -V source
         set -l pw (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
         set -l userKey ".services.anki.environment.SYNC_USER1"
-        set -l user (yq --raw-output "$userKey" "$source" | sed "s/:.*\$/:$pw/")
+        set -l user (yq "$userKey" "$source" | sed "s/:.*\$/:$pw/")
         initializeServiceInstallation $argv
         sudo cp "$dir/docker-compose.base.yml" (getServiceRoot $argv)
 
-        USER=$user yq "$userKey = env.USER" "$source" | \
+        USER=$user yq "$userKey = env(USER)" "$source" | \
             sudo tee (getServiceSecretsConfig $argv) >/dev/null
 
         installDockerService $argv

scripts/Common/Software/docker/services/drone/main.fish

@@ -63,30 +63,27 @@ begin
                 echo "DRONE_RPC_SECRET=$secret" | sudo tee "$root/$SECRET_ENV" >/dev/null
 
                 yq "$ciKey = $ciTemplate" "$tmpConfig" | \
-                    ENTRY="./data/$name:/data" yq "$ciKey.volumes = [ env.ENTRY ]" | \
+                    ENTRY="./data/$name:/data" yq "$ciKey.volumes = [ env(ENTRY) ]" | \
-                    yq "$ciKey.env_file |= . + [ env.SECRET_ENV ]" | \
+                    yq "$ciKey.env_file |= . + [ env(SECRET_ENV) ]" | \
-                    PROTO=https yq "$ciEnv.DRONE_SERVER_PROTO = env.PROTO" | \
+                    PROTO=https yq "$ciEnv.DRONE_SERVER_PROTO = env(PROTO)" | \
-                    HOST=(getServiceDomain "$subdomain" "$domain") yq "$ciEnv.DRONE_SERVER_HOST = env.HOST" | \
+                    HOST=(getServiceDomain "$subdomain" "$domain") yq "$ciEnv.DRONE_SERVER_HOST = env(HOST)" | \
                     yq "$dockerKey = $dockerTemplate" | \
                     yq "$sshKey = $sshTemplate" | \
-                    yq "$dockerKey.depends_on = [ env.CI_NAME ]" | \
+                    yq "$dockerKey.depends_on = [ env(CI_NAME) ]" | \
-                    yq -y "." | \
                     sudo tee "$config" >/dev/null
 
                 for key in $dockerKey $sshKey
                     set -l file (mktemp)
 
-                    yq "$key.depends_on = [ env.CI_NAME ]" "$config" | \
+                    yq "$key.depends_on = [ env(CI_NAME) ]" "$config" | \
-                        yq "$key.env_file |= . + [ env.RUNNER_ENV, env.SECRET_ENV ]" | \
+                        yq "$key.env_file |= . + [ env(RUNNER_ENV), env(SECRET_ENV) ]" | \
-                        yq -y "." | \
                         tee "$file" >/dev/null
 
                     sudo cp "$file" "$config"
                     rm "$file"
                 end
 
-                PORT="127.0.0.1:1337:80" yq "$ciKey.ports = [ env.PORT ]" "$tmpSecrets" | \
+                PORT="127.0.0.1:1337:80" yq "$ciKey.ports = [ env(PORT) ]" "$tmpSecrets" | \
-                    yq -y "." | \
                     sudo tee "$secrets" >/dev/null
             end
         end

scripts/Common/Software/docker/services/forgejo/main.fish

@@ -21,20 +21,19 @@ begin
         sudo cp "$dir/docker-compose.base.yml" "$root"
 
         installDockerService $argv
-        set port (yq (getSSHPortKey) "$source" --raw-output | mutatePort "$port")
+        set port (yq (getSSHPortKey) "$source" | mutatePort "$port")
 
         DOMAIN=(getServiceDomain $server) PW=$pw DB=Git USER=forgejo PW=$pw begin
                 set -l gitEnv "$(getServiceKey "$service").environment"
                 set -l dbEnv "$(getServiceKey "db").environment"
 
-                PORT=$port yq "$(getSSHPortKey) = env.PORT" "$source" | \
+                PORT=$port yq "$(getSSHPortKey) = env(PORT)" "$source" | \
-                    yq "$gitEnv.FORGEJO__database__NAME = env.DB" | \
+                    yq "$gitEnv.FORGEJO__database__NAME = env(DB)" | \
-                    yq "$gitEnv.FORGEJO__database__USER = env.USER" | \
+                    yq "$gitEnv.FORGEJO__database__USER = env(USER)" | \
-                    yq "$gitEnv.FORGEJO__database__PASSWD = env.PW" | \
+                    yq "$gitEnv.FORGEJO__database__PASSWD = env(PW)" | \
-                    yq "$dbEnv.MARIADB_DATABASE = env.DB" | \
+                    yq "$dbEnv.MARIADB_DATABASE = env(DB)" | \
-                    yq "$dbEnv.MARIADB_USER = env.USER" | \
+                    yq "$dbEnv.MARIADB_USER = env(USER)" | \
-                    yq "$dbEnv.MARIADB_PASSWORD = env.PW" | \
+                    yq "$dbEnv.MARIADB_PASSWORD = env(PW)" | \
-                    yq -y . | \
                     sudo tee "$secrets" >/dev/null
             end
     end
@@ -65,14 +64,13 @@ begin
 
         and yq "$envKey.USER_UID = $uid" "$file" | \
             yq "$envKey.USER_GID = $gid" | \
-            yq -y . |
             sudo tee "$config" >/dev/null
 
         mkdir -p "$dir"
         and chown -R $uid:$gid "$dir"
         rm "$file"
 
-        set port (yq (getSSHPortKey) "$secrets" --raw-output | extractPort)
+        set port (yq (getSSHPortKey) "$secrets" | extractPort)
 
         begin
             printf "%s\n" \

scripts/Common/Software/docker/services/jellyfin/main.fish

@@ -50,7 +50,7 @@ begin
         for name in $service $flood
             set -l userKey "$(getServiceKey "$name").user"
             cp "$config" "$file"
-            USER=$uid:$gid yq -y "$userKey = env.USER" "$file" | sudo tee "$config" >/dev/null
+            USER=$uid:$gid yq "$userKey = env(USER)" "$file" | sudo tee "$config" >/dev/null
         end
 
         for name in $servarr rtorrent
@@ -64,8 +64,7 @@ begin
         end
 
         cp "$config" "$file"
-        URL="https://$(getServiceDomain "$domain" "")/" yq "$(getServiceKey "$service").environment.JELLYFIN_PublishedServerUrl = env.URL" "$file" | \
+        URL="https://$(getServiceDomain "$domain" "")/" yq "$(getServiceKey "$service").environment.JELLYFIN_PublishedServerUrl = env(URL)" "$file" | \
-            yq -y . | \
             sudo tee "$config" >/dev/null
 
         for dir in "$root"/{downloads,config/{,jellyfin,flood,rtorrent,radarr,sonarr,lidarr,prowlarr},media/{,movies,series,music}}

scripts/Common/Software/docker/services/minecraft/main.fish

@@ -30,13 +30,12 @@ begin
         set uid (id -u $user)
         set gid (id -g $user)
 
-        for service in (yq --raw-output0 ".services | keys[]" "$config" | string split0)
+        for service in (yq -0 ".services | keys[]" "$config" | string split0)
             set -l envKey "$(getServiceKey "$service").environment"
             cp "$config" "$file"
 
             and yq "$envKey.UID = $uid" "$file" | \
                 yq "$envKey.GID = $gid" | \
-                yq -y . | \
                 sudo tee "$config" >/dev/null
         end
 

scripts/Common/Software/docker/services/nextcloud/main.fish

@@ -65,16 +65,14 @@ begin
         PROTO="https" DOMAIN="$domain" begin
             set -l envKey "$(getServiceKey "$service").environment"
 
-            yq "$envKey.NEXTCLOUD_TRUSTED_DOMAINS = env.DOMAIN" "$source" | \
+            yq "$envKey.NEXTCLOUD_TRUSTED_DOMAINS = env(DOMAIN)" "$source" | \
-                yq "$envKey.OVERWRITEPROTOCOL = env.PROTO" | \
+                yq "$envKey.OVERWRITEPROTOCOL = env(PROTO)" | \
-                yq "$envKey.OVERWRITEHOST = env.DOMAIN" | \
+                yq "$envKey.OVERWRITEHOST = env(DOMAIN)" | \
-                URL="$PROTO://$DOMAIN" yq "$envKey.OVERWRITECLIURL = env.URL" | \
+                URL="$PROTO://$DOMAIN" yq "$envKey.OVERWRITECLIURL = env(URL)" | \
-                yq -y . | \
                 sudo tee "$core" >/dev/null
 
-            DOMAIN=(getServiceDomain $officeDomain) yq "$officeEnv.server_name = env.DOMAIN" "$baseSource" | \
+            DOMAIN=(getServiceDomain $officeDomain) yq "$officeEnv.server_name = env(DOMAIN)" "$baseSource" | \
-                URL="https://$(string escape --style regex "$DOMAIN"):443" yq "$officeEnv.aliasgroup1 = env.URL" | \
+                URL="https://$(string escape --style regex "$DOMAIN"):443" yq "$officeEnv.aliasgroup1 = env(URL)" | \
-                yq -y . | \
                 sudo tee "$base" >/dev/null
         end
 
@@ -83,17 +81,16 @@ begin
 
             PW="--static-auth-secret=$turnPW" \
             DOMAIN="--realm=$domain" \
-                yq "$key |= . + [env.PW, env.DOMAIN]" "$secretsSource" | \
+                yq "$key |= . + [env(PW), env(DOMAIN)]" "$secretsSource" | \
-                yq -y . | \
                 sudo tee "$secrets" >/dev/null
         end
         
         installDockerService $argv
-        set turnPort (yq --raw-output (getServicePortKey "$turn") "$secrets" | extractPort)
+        set turnPort (yq (getServicePortKey "$turn") "$secrets" | extractPort)
-        set turnPort (yq --raw-output "$portKey" "$secrets" | mutatePort "$turnPort")
+        set turnPort (yq "$portKey" "$secrets" | mutatePort "$turnPort")
 
         cp "$secrets" "$file"
-        PORT="$turnPort" yq -y "$portKey = env.PORT" "$file" | sudo tee "$secrets" >/dev/null
+        PORT="$turnPort" yq "$portKey = env(PORT)" "$file" | sudo tee "$secrets" >/dev/null
         rm "$file"
     end
 

scripts/Common/Software/docker/services/ryot/main.fish

@@ -13,12 +13,12 @@ begin
         set -l pw (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
         set -l envKey ".services.$service.environment"
         set -l dbKey "$envKey.DATABASE_URL"
-        set -l dbUrl (yq --raw-output "$dbKey" "$source" | sed "s/^\(.*:\/\/.*:\).*\(@.*\/.*\)\$/\1$pw\2/")
+        set -l dbUrl ( "$dbKey" "$source" | sed "s/^\(.*:\/\/.*:\).*\(@.*\/.*\)\$/\1$pw\2/")
         initializeServiceInstallation $argv
         sudo cp "$file" "$root"
 
-        URL=$dbUrl yq "$dbKey = env.URL" "$source" | \
+        URL=$dbUrl yq "$dbKey = env(URL)" "$source" | \
-            PW=$pw yq ".services.db.environment.POSTGRES_PASSWORD = env.PW" | \
+            PW=$pw yq ".services.db.environment.POSTGRES_PASSWORD = env(PW)" | \
             sudo tee (getServiceSecretsConfig $argv) >/dev/null
 
         installDockerService $argv

scripts/Common/Software/docker/services/service.fish

@@ -80,7 +80,7 @@ begin
         set -l url
         set -l config (getServiceSecretsConfig $argv)
         set -l portKey (getServicePortKey "$service")
-        set -l port (yq --raw-output "$portKey" "$config" | extractPort)
+        set -l port (yq "$portKey" "$config" | extractPort)
 
         if [ -n "$_flag_url" ]
             set url "$_flag_url"
@@ -136,8 +136,8 @@ begin
                 sudo mkdir -p "$nginxRoot"
                 cp "$config" "$file"
 
-                set exposedPort (yq --raw-output "$portKey" "$file" | mutatePort $port)
+                set exposedPort (yq "$portKey" "$file" | mutatePort $port)
-                PORT=$exposedPort yq -y "$portKey = env.PORT" "$file" | sudo tee "$config" >/dev/null
+                PORT=$exposedPort yq "$portKey = env(PORT)" "$file" | sudo tee "$config" >/dev/null
             end
         end
     end
@@ -173,6 +173,6 @@ begin
     end
 
     function getBackupArgs
-        printf "%s\n" --hidden --no-ignore . --exclude "docker-compose"{,.base}".yml" (getServiceRoot $argv)
+        printf "%s\n" --base-directory (getServiceRoot $argv) --hidden --no-ignore "^(docker-compose\.secrets\.yml|data)\$"
     end
 end

scripts/Common/Software/docker/services/teamspeak/main.fish

@@ -14,18 +14,17 @@ begin
         cp "$dir/docker-compose.base.yml" (getServiceRoot $argv)
 
         USER="$service" begin
-            yq "$tsEnv.TS3SERVER_DB_USER = env.USER" "$source" | \
+            yq "$tsEnv.TS3SERVER_DB_USER = env(USER)" "$source" | \
-            yq "$dbEnv.MARIADB_USER = env.USER"
+            yq "$dbEnv.MARIADB_USER = env(USER)"
         end | \
         PW="$pw" begin
-            yq "$tsEnv.TS3SERVER_DB_PASSWORD = env.PW" | \
+            yq "$tsEnv.TS3SERVER_DB_PASSWORD = env(PW)" | \
-            yq "$dbEnv.MARIADB_PASSWORD = env.PW"
+            yq "$dbEnv.MARIADB_PASSWORD = env(PW)"
         end | \
         DB="$db" begin
-            yq "$tsEnv.TS3SERVER_DB_NAME = env.DB" | \
+            yq "$tsEnv.TS3SERVER_DB_NAME = env(DB)" | \
-            yq "$dbEnv.MARIADB_DATABASE = env.DB"
+            yq "$dbEnv.MARIADB_DATABASE = env(DB)"
         end | \
-            yq . | \
             sudo tee (getServiceSecretsConfig $argv) >/dev/null
 
         installDockerService $argv

scripts/Common/Software/docker/services/trackmania/.dockerignore

@@ -0,0 +1 @@
+data/

scripts/Common/Software/docker/services/trackmania/docker-compose.base.yml

@@ -0,0 +1,72 @@
+services:
+  game:
+    build:
+      context: .
+      dockerfile: trackmania.Dockerfile
+    restart: unless-stopped
+    extends:
+      file: docker-compose.core.yml
+      service: tm
+    stdin_open: true
+    environment:
+      TM_XMLRPC_ALLOWED_REMOTE: xaseco
+    volumes:
+      - ./data/tm/cache:/app/GameData/Cache
+    healthcheck:
+      test: [CMD, bash, -c, echo '' >/dev/tcp/127.0.0.1/5000]
+      start_period: 1m
+      start_interval: 10s
+      interval: 5s
+      timeout: 3s
+      retries: 5
+  downloader:
+    extends:
+      file: docker-compose.core.yml
+      service: xaseco-installer
+    volumes:
+      - ./initdb.d:/cache/localdb
+    healthcheck:
+      test: [CMD, bash, -c, ls /cache/localdb/*]
+      start_period: 1m
+      start_interval: 10s
+      interval: 5s
+      timeout: 3s
+      retries: 5
+  xaseco:
+    restart: unless-stopped
+    extends:
+      file: docker-compose.core.yml
+      service: xaseco
+    depends_on:
+      game:
+        condition: service_healthy
+      db:
+        condition: service_healthy
+    environment:
+      TM_SERVER_HOST: game
+      MYSQL_HOST: db
+    volumes:
+      - ./data/xaseco:/data
+  db:
+    image: mysql:5
+    restart: unless-stopped
+    extends:
+      file: docker-compose.core.yml
+      service: db
+    depends_on:
+      downloader:
+        condition: service_completed_successfully
+    command: --sql_mode=""
+    environment:
+      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
+    volumes:
+      - ./data/db:/var/lib/mysql
+      - ./initdb.d:/docker-entrypoint-initdb.d
+    healthcheck:
+      test: [CMD, bash, -c, mysqladmin ping -hlocalhost -u "$$MYSQL_USER" -p"$$MYSQL_PASSWORD"]
+      timeout: 20s
+      retries: 10
+
+volumes:
+  tm-server: {}
+  xaseco: {}

scripts/Common/Software/docker/services/trackmania/docker-compose.core.secrets.yml

@@ -0,0 +1,19 @@
+services:
+  tm:
+    environment: &tm-config
+      TM_SUPERADMIN_PASSWORD: pw
+      TM_SERVER_USER: null
+      TM_SERVER_PASSWORD: null
+    volumes: &tm-volumes
+      - ./data/tm/tracks:/app/GameData/Tracks/Challenges
+  db:
+    environment: &db-config
+      MYSQL_USER: xaseco
+      MYSQL_PASSWORD: pw
+      MYSQL_DATABASE: Aseco
+  xaseco:
+    environment:
+      <<:
+        - *tm-config
+        - *db-config
+    volumes: *tm-volumes

scripts/Common/Software/docker/services/trackmania/docker-compose.core.yml

@@ -0,0 +1,30 @@
+services:
+  tm:
+    extends:
+      file: docker-compose.core.secrets.yml
+      service: tm
+    volumes: &tm-volumes
+      - tm-server:/app
+  xaseco-installer:
+    build: &xaseco-build
+      context: .
+      dockerfile: xaseco.Dockerfile
+    restart: on-failure
+    command: "true"
+    <<: &xaseco-base
+      privileged: true
+    volumes: &xaseco-volumes
+      - xaseco:/cache
+  xaseco:
+    extends:
+      file: docker-compose.core.secrets.yml
+      service: xaseco
+    <<: 
+      - *xaseco-base
+      - volumes: *tm-volumes
+      - volumes: *xaseco-volumes
+    build: *xaseco-build
+  db:
+    extends:
+      file: docker-compose.core.secrets.yml
+      service: db

scripts/Common/Software/docker/services/trackmania/docker-compose.secrets.yml

@@ -0,0 +1,12 @@
+services:
+  game:
+    ports:
+      - 2350:2350
+      - 2350:2350/udp
+      - 2353:2353
+      - 2353:2353/udp
+    command:
+      - /game_settings=MatchSettings/Nations/NationsBlue.txt
+    environment: {}
+  xaseco:
+    environment: {}

scripts/Common/Software/docker/services/trackmania/docker-compose.yml

@@ -0,0 +1,4 @@
+include:
+  - path:
+    - docker-compose.base.yml
+    - docker-compose.secrets.yml

scripts/Common/Software/docker/services/trackmania/main.fish

@@ -0,0 +1,37 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    set -l source "$dir/docker-compose.core.secrets.yml"
+    source "$dir/../service.fish"
+
+    function installSW -V dir -V domain -V source
+        set -l root (getServiceRoot $argv)
+        set -l tmPW (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
+        set -l sqlPW (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
+        initializeServiceInstallation $argv
+
+        cp -rf "$dir"/{.dockerignore,docker-compose{.base,{,.core}{,.secrets}}.yml,parser.patch,tmforever-entrypoint.sh,trackmania.Dockerfile,xaseco-entrypoint.sh,xaseco.Dockerfile} "$root"
+
+        PW="$tmPW" yq "$(getServiceKey "tm").environment.TM_SUPERADMIN_PASSWORD = env(PW)" "$source" | \
+            PW="$sqlPW" yq "$(getServiceKey "db").environment.MYSQL_PASSWORD = env(PW)" | \
+            sudo tee "$root/$(basename "$source")" >/dev/null
+
+        installDockerService $argv
+    end
+
+    function configureSW -V dir
+        configureDockerService $argv
+    end
+
+    function getServiceServers
+    end
+
+    function getServiceLocations
+    end
+
+    function getBackupArgs
+        printf "%s\n" --hidden --no-ignore "^docker-compose\.(.*\.)\?.secrets.yml|data\$" (getServiceRoot $argv)
+    end
+
+    runInstaller --force $argv --name "tm-forever"
+end

scripts/Common/Software/docker/services/trackmania/parser.patch

@@ -0,0 +1,11 @@
+--- a/includes/xmlparser.inc.php
++++ b/includes/xmlparser.inc.php
+@@ -37,8 +37,6 @@
+ 		else
+ 			$this->data = $source;
+ 
+-		// escape '&' characters
+-		$this->data = str_replace('&', '<![CDATA[&]]>', $this->data);
+ 
+ 		// parse xml file
+ 		$parsed = xml_parse($this->parser, $this->data);

scripts/Common/Software/docker/services/trackmania/tmforever-entrypoint.sh

@@ -0,0 +1,145 @@
+#!/bin/bash
+set -e
+configSource="GameData/Config/dedicated_cfg"
+configFile="GameData/Config/live_config.xml"
+settingsPath="/dedicated"
+authLevelsPath="$settingsPath/authorization_levels/level"
+accountPath="$settingsPath/masterserver_account"
+serverPath="$settingsPath/server_options"
+systemPath="$settingsPath/system_config"
+
+TM_SUPERADMIN_PASSWORD="${TM_SUPERADMIN_PASSWORD:-$(openssl rand -base64 33)}"
+TM_ADMIN_PASSWORD="${TM_ADMIN_PASSWORD:-$(openssl rand -base64 33)}"
+
+echo "Checking whether the server is present…"
+
+levels=(
+    TM_SUPERADMIN_PASSWORD 1
+    TM_ADMIN_PASSWORD 2
+    TM_USER_PASSWORD 3
+)
+
+accountOption=(
+    TM_SERVER_USER login
+    TM_SERVER_PASSWORD password
+    TM_SERVER_VALIDATION_KEY validation_key
+)
+
+serverOptions=(
+    TM_TITLE name
+    TM_COMMENT comment
+    TM_HIDDEN hide_server
+
+    TM_MAX_PLAYERS max_players
+    TM_PLAYER_PASSWORD password
+
+    TM_MAX_SPECTATORS max_spectators
+    TM_SPECTATOR_PASSWORD password_spectator
+
+    TM_LADDER_MODE ladder_mode
+    TM_LADDER_LIMIT_MIN ladder_serverlimit_min
+    TM_LADDER_LIMIT_MAX ladder_serverlimit_max
+
+    TM_ENABLE_P2P_UPLOAD enable_p2p_upload
+    TM_ENABLE_P2P_DOWNLOAD enable_p2p_download
+
+    TM_CALLVOTE_TIMEOUT callvote_timeout
+    TM_CALLVOTE_RATIO callvote_ratio
+
+    TM_ALLOW_CHALLENGE_DOWNLOAD allow_challenge_download
+    TM_AUTOSAVE_REPLAYS autosave_replays
+    TM_AUTOSAVE_VALIDATION_REPLAYS autosave_validation_replays
+
+    TM_REFEREE_PASSWORD referee_password
+    TM_REFEREE_VALIDATION_MODE referee_validation_mode
+
+    TM_USE_CHANGING_VALIDATION_SEED use_changing_validation_seed
+)
+
+systemOptions=(
+    TM_BIND_IP bind_ip_address
+    TM_BIND_PORT server_port
+    TM_P2P_PORT server_p2p_port
+    TM_CLIENT_PORT client_port
+    TM_USE_NAT_UPNP use_nat_upnp
+
+    TM_XMLRPC_PORT xmlrpc_port
+    TM_XMLRPC_ALLOWED_REMOTE xmlrpc_allowremote
+
+    TM_PACKMASK packmask
+
+    TM_CONNECTION_UPLOADRATE connection_uploadrate
+    TM_CONNECTION_DOWNLOADRATE connection_downloadrate
+
+    TM_P2P_CACHE_SIZE p2p_cache_size
+
+    TM_BLACKLIST_URL blacklist_url
+    TM_GUESTLIST_FILENAME guestlist_filename
+    TM_BLACKLIST_FILENAME blacklist_filename
+
+    TM_ALLOW_SPECTATOR_RELAYS allow_spectator_relays
+
+    TM_USE_PROXY use_proxy
+    TM_PROXY_LOGIN proxy_login
+    TM_PROXY_PASSWORD proxy_password
+)
+
+if [[ ! -x "./TrackmaniaServer" ]] || [ ! -f "$configSource".* ]; then
+    echo "Server not found!"
+    echo "Downloading TrackMania Forever Dedicated Server…"
+    file="$(mktemp)"
+    dir="$(mktemp -d)"
+    wget http://files2.trackmaniaforever.com/TrackmaniaServer_2011-02-21.zip -O "$file" && unzip -o "$file" -d .
+fi
+
+if [ -f "$configSource.xml" ]; then
+    cp "$configSource.xml" "$configFile"
+elif [ -f "$configSource.txt" ]; then
+    cp "$configSource.txt" "$configFile"
+fi
+
+for i in $(seq 0 2 $((${#levels[@]} - 1))); do
+    var="${levels[$i]}"
+    index="${levels[$(($i + 1))]}"
+    password="${!var}"
+
+    if [ -n "$password" ]; then
+        xmlstarlet edit --inplace --update "$authLevelsPath[$index]/password" --value "$password" "$configFile"
+    fi
+done
+
+for i in $(seq 0 2 $((${#accountOption[@]} - 1))); do
+    var="${accountOption[$i]}"
+    option="${accountOption[$(($i + 1))]}"
+    value="${!var}"
+
+    if [ -n "$value" ]; then
+        xmlstarlet edit --inplace --update "$accountPath/$option" --value "$value" "$configFile"
+    fi
+done
+
+for i in $(seq 0 2 $((${#serverOptions[@]} - 1))); do
+    var="${serverOptions[$i]}"
+    option="${serverOptions[$(($i + 1))]}"
+    value="${!var}"
+
+    if [ -n "$value" ]; then
+        xmlstarlet edit --inplace --update "$serverPath/$option" --value "$value" "$configFile"
+    fi
+done
+
+for i in $(seq 0 2 $((${#systemOptions[@]} - 1))); do
+    var="${systemOptions[$i]}"
+    option="${systemOptions[$(($i + 1))]}"
+    value="${!var}"
+
+    if [ -n "$value" ]; then
+        xmlstarlet edit --inplace --update "$systemPath/$option" --value "$value" "$configFile"
+    fi
+done
+
+if [ -z "$TM_LOG_FILES" ]; then
+    set -- "$@" /nologs
+fi
+
+unbuffer -p ./TrackmaniaServer /dedicated_cfg="$(basename "$configFile")" /nodaemon $@

scripts/Common/Software/docker/services/trackmania/trackmania.Dockerfile

@@ -0,0 +1,78 @@
+FROM debian:11.3
+RUN apt-get update -y \
+    && apt-get install -y \
+        expect \
+        inotify-tools \
+        parallel \
+        rsync \
+        unzip \
+        wget \
+        xmlstarlet \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir /app
+WORKDIR /app
+COPY ./tmforever-entrypoint.sh /usr/local/bin/tmforever-foreground
+
+ENV \
+    TM_BIND_IP="" \
+    TM_BIND_PORT="" \
+    TM_P2P_PORT="" \
+    TM_CLIENT_PORT="" \
+    TM_USE_NAT_UPNP="" \
+    \
+    TM_XMLRPC_PORT="" \
+    TM_XMLRPC_ALLOWED_REMOTE="" \
+    \
+    TM_SERVER_USER="" \
+    TM_SERVER_PASSWORD="" \
+    TM_SERVER_VALIDATION_KEY="" \
+    \
+    TM_TITLE="" \
+    TM_COMMENT="" \
+    TM_HIDDEN="" \
+    \
+    TM_PACKMASK="" \
+    \
+    TM_MAX_PLAYERS="" \
+    TM_PLAYER_PASSWORD="" \
+    \
+    TM_MAX_SPECTATORS="" \
+    TM_SPECTATOR_PASSWORD="" \
+    \
+    TM_LADDER_MODE="" \
+    TM_LADDER_LIMIT_MIN="" \
+    TM_LADDER_LIMIT_MAX="" \
+    \
+    TM_ENABLE_P2P_UPLOAD="" \
+    TM_ENABLE_P2P_DOWNLOAD="" \
+    \
+    TM_CALLVOTE_TIMEOUT="" \
+    TM_CALLVOTE_RATIO="" \
+    \
+    TM_ALLOW_CHALLENGE_DOWNLOAD="" \
+    TM_AUTOSAVE_REPLAYS="" \
+    TM_AUTOSAVE_VALIDATION_REPLAYS="" \
+    \
+    TM_REFEREE_PASSWORD="" \
+    TM_REFEREE_VALIDATION_MODE="" \
+    \
+    TM_USE_CHANGING_VALIDATION_SEED="" \
+    \
+    TM_SUPERADMIN_PASSWORD="" \
+    TM_ADMIN_PASSWORD="" \
+    \
+    TM_CONNECTION_UPLOADRATE="" \
+    TM_CONNECTION_DOWNLOADRATE="" \
+    TM_P2P_CACHE_SIZE="" \
+    TM_BLACKLIST_URL="" \
+    TM_GUESTLIST_FILENAME="" \
+    TM_BLACKLIST_FILENAME="" \
+    TM_ALLOW_SPECTATOR_RELAYS="" \
+    TM_USE_PROXY="" \
+    TM_PROXY_LOGIN="" \
+    TM_PROXY_PASSWORD="" \
+    \
+    TM_LOG_FILES=""
+
+ENTRYPOINT [ "tmforever-foreground" ]

scripts/Common/Software/docker/services/trackmania/xaseco-entrypoint.sh

@@ -0,0 +1,155 @@
+#!/bin/bash
+export TM_USER="${TM_USER:-SuperAdmin}"
+export TM_PASSWORD="${TM_PASSWORD:-$TM_SUPERADMIN_PASSWORD}"
+export TM_SERVER_PORT="${TM_SERVER_PORT:-$TM_XMLRPC_PORT}"
+export DEDI_USER="${DEDI_USER:-$TM_SERVER_USER}"
+export DEDI_PASSWORD="${DEDI_PASSWORD:-$TM_SERVER_PASSWORD}"
+overlay="$(mktemp -d)"
+upperDir="$overlay/upper"
+workDir="$overlay/work"
+cache="/cache"
+data="/data"
+runDir="/opt/xaseco"
+entrypoint="$cache/aseco.php"
+config="$runDir/config.xml"
+dbConfig="$runDir/localdatabase.xml"
+dediConfig="$runDir/dedimania.xml"
+pluginConfig="$runDir/plugins.xml"
+settingsPath="/settings"
+serverPath="$settingsPath/tmserver"
+pluginTag="plugin"
+pluginPath="/aseco_plugins"
+
+tmOptions=(
+    TM_SERVER_HOST ip
+    TM_SERVER_PORT port
+    TM_USER login
+    TM_PASSWORD password
+    TM_TIMEOUT timeout
+)
+
+sqlOptions=(
+    MYSQL_HOST mysql_server
+    MYSQL_USER mysql_login
+    MYSQL_PASSWORD mysql_password
+    MYSQL_DATABASE mysql_database
+)
+
+dediOptions=(
+    DEDI_URL url
+    DEDI_NAME name
+    DEDI_USER login
+    DEDI_PASSWORD password
+    DEDI_NATION nation
+    DEDI_LOG_NEWS log_news
+    DEDI_SHOW_MOTD show_welcome
+)
+
+if [ ! -f "$entrypoint" ]; then
+    file="$(mktemp -u).zip"
+    root="$(mktemp -d)"
+    mkdir -p "$(dirname "$file")"
+    curl -v --insecure https://www.gamers.org/tmn/xaseco_116.zip -o "$file"
+    unzip -o "$file" -d "$root"
+    cp -r "$root"/xaseco/* "$cache"
+fi
+
+script="$(
+    printf "%s\n" \
+        'file="$(basename "$1")";' \
+        'if [[ "$file" == *".php" ]];' \
+        '    then dir="includes";' \
+        'else' \
+        '    dir=".";' \
+        'fi;' \
+        'if [ ! -f "$0/$dir/$file" ]; then' \
+        '    mkdir -p "$0/$dir";' \
+        '    cp "$1" "$0/$dir";' \
+        'fi;'
+)"
+
+find "$cache/newinstall" -type f -exec bash -c "$script" "$cache" \{\} \;
+
+mount -t tmpfs tmpfs "$overlay"
+mkdir -p "$upperDir" "$workDir"
+mount -t overlay overlay -o lowerdir="$cache:$data",upperdir="$upperDir",workdir="$workDir" "$runDir"
+cd "$runDir"
+
+dos2unix "/root/parser.patch" ./includes/xmlparser.inc.php
+patch -p 1 ./includes/xmlparser.inc.php "/root/parser.patch"
+
+if [ -n "$MASTERADMIN_USER" ]; then
+    loginTag="tmlogin"
+    ipTag="ipaddress"
+    adminPath="$settingsPath/aseco/masteradmins"
+    nodesPath="$adminPath/*"
+    namePath="$nodesPath[1]"
+    ipPath="$nodesPath[2]"
+
+    if [ "$(xmlstarlet select --template -v "count($nodesPath)" "$config")" -lt 1 ]; then
+        xmlstarlet edit --inplace --subnode "$adminPath" --type elem -n "$loginTag" "$config"
+    fi
+
+    if [ "$(xmlstarlet select --template -v "count($nodesPath)" "$config")" -lt 2 ] ||
+        [ "$(xmlstarlet select --template -v "name($ipPath)" "$config")" != "$ipTag" ]; then
+        xmlstarlet edit --inplace --append "$namePath" --type elem -n "$ipTag" "$config"
+    fi
+
+    xmlstarlet edit --inplace --update "$namePath" --value "$MASTERADMIN_USER" "$config"
+
+    if [ -z "$MASTERADMIN_IP" ]; then
+        xmlstarlet edit --inplace --delete "$ipPath" "$config"
+    else
+        xmlstarlet edit --inplace --update "$ipPath" --value "$MASTERADMIN_IP" "$config"
+    fi
+fi
+
+for i in $(seq 0 2 $((${#tmOptions[@]} - 1))); do
+    var="${tmOptions[$i]}"
+    option="${tmOptions[$(($i + 1))]}"
+    value="${!var}"
+
+    if [ -n "$value" ]; then
+        xmlstarlet edit --inplace --update "$serverPath/$option" --value "$value" "$config"
+    fi
+done
+
+for i in $(seq 0 2 $((${#sqlOptions[@]} - 1))); do
+    var="${sqlOptions[$i]}"
+    option="${sqlOptions[$(($i + 1))]}"
+    value="${!var}"
+    xmlstarlet edit --inplace --update "$settingsPath/$option" --value "$value" "$dbConfig"
+done
+
+for i in $(seq 0 2 $((${#dediOptions[@]} - 1))); do
+    var="${dediOptions[$i]}"
+    option="${dediOptions[$(($i + 1))]}"
+    value="${!var}"
+
+    if [ -n "$value" ]; then
+        xmlstarlet edit --inplace --update "/dedimania/masterserver_account/$option" --value "$value" "$dediConfig"
+    fi
+done
+
+if [ -n "$X1_EXTRA_PLUGINS" ]; then
+    echo "adding plugins: $X1_EXTRA_PLUGINS"
+    for plugin in $X1_EXTRA_PLUGINS; do
+        xmlstarlet edit --inplace --subnode "$pluginPath" --type elem -n "$pluginTag" --value "$plugin" "$pluginConfig"
+    done
+fi
+
+if [ -n "$X1_DISABLED_PLUGINS" ]; then
+    for i in $(seq 1 "$(xmlstarlet select --template -v "count($pluginPath/$pluginTag)" "$pluginConfig")"); do
+        for plugin in $X1_DISABLED_PLUGINS; do
+            path="$pluginPath/$pluginTag[$i]"
+
+            if [ "$(xmlstarlet select --template -v "$path/text()" "$pluginConfig")" == "$plugin" ]; then
+                xmlstarlet edit --inplace --delete "$path" "$pluginConfig"
+            fi
+        done
+    done
+fi
+
+if [ "$1" != "download" ]; then
+    $@
+fi

scripts/Common/Software/docker/services/trackmania/xaseco.Dockerfile

@@ -0,0 +1,58 @@
+FROM alpine:3.14 AS base
+RUN apk add xmlstarlet
+
+FROM php:5.5-alpine
+USER root
+RUN apk update \
+    && apk add \
+        bash \
+        unzip \
+        ca-certificates \
+        # xmlstarlet dependencies
+        musl \
+        libxslt \
+        libxml2
+RUN update-ca-certificates
+RUN docker-php-ext-install mysql
+COPY --from=base /usr/bin/xmlstarlet /usr/bin
+COPY ./xaseco-entrypoint.sh /usr/local/bin/xaseco-foreground
+COPY ./parser.patch /root/parser.patch
+# Server dir
+RUN mkdir /cache
+# Override dir
+RUN mkdir /data
+# Merged dir
+RUN mkdir -p /opt/xaseco
+WORKDIR /opt/xaseco
+
+ENV \
+    MASTERADMIN_USER="" \
+    MASTERADMIN_IP="" \
+    \
+    X1_EXTRA_PLUGINS="" \
+    X1_DISABLED_PLUGINS="" \
+    \
+    TM_SERVER_HOST="" \
+    TM_SERVER_PORT="" \
+    TM_XMLRPC_PORT="" \
+    TM_TIMEOUT="" \
+    \
+    TM_USER="" \
+    TM_PASSWORD="" \
+    TM_SUPERADMIN_PASSWORD="" \
+    \
+    MYSQL_HOST="" \
+    MYSQL_USER="" \
+    MYSQL_PASSWORD="" \
+    MYSQL_DATABASE="" \
+    \
+    DEDI_URL="" \
+    DEDI_NAME="" \
+    DEDI_USER="" \
+    DEDI_PASSWORD="" \
+    DEDI_NATION="" \
+    DEDI_LOG_NEWS="" \
+    DEDI_SHOW_MOTD=""
+
+ENTRYPOINT [ "xaseco-foreground" ]
+CMD [ "php", "./aseco.php" ]

scripts/Common/Software/docker/services/vaultwarden/main.fish

@@ -10,15 +10,15 @@ begin
         set -l pw (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
         set -l envKey ".services.vaultwarden.environment"
         set -l dbKey "$envKey.DATABASE_URL"
-        set -l dbUrl (yq --raw-output "$dbKey" "$source" | sed "s/^\(.*:\/\/.*:\).*\(@.*\/.*\)\$/\1$pw\2/")
+        set -l dbUrl (yq "$dbKey" "$source" | sed "s/^\(.*:\/\/.*:\).*\(@.*\/.*\)\$/\1$pw\2/")
         initializeServiceInstallation $argv
 
-        URL="https://$domain.$(getMachineFQDN)" yq "$envKey.DOMAIN = env.URL" "$file" | \
+        URL="https://$domain.$(getMachineFQDN)" yq "$envKey.DOMAIN = env(URL)" "$file" | \
-            ADDRESS="noreply@$(getMachineFQDN)" yq -y "$envKey.SMTP_FROM = env.ADDRESS" | \
+            ADDRESS="noreply@$(getMachineFQDN)" yq "$envKey.SMTP_FROM = env(ADDRESS)" | \
             sudo tee "$(getServiceRoot $argv)/$(basename "$file")" >/dev/null
 
-        URL=$dbUrl yq "$dbKey = env.URL" "$source" | \
+        URL=$dbUrl yq "$dbKey = env(URL)" "$source" | \
-            PW=$pw yq ".services.db.environment.MARIADB_PASSWORD = env.PW" | \
+            PW=$pw yq ".services.db.environment.MARIADB_PASSWORD = env(PW)" | \
             sudo tee (getServiceSecretsConfig $argv) >/dev/null
 
         installDockerService $argv

scripts/Common/Software/docker/services/wekan/docker-compose.base.yml

@@ -0,0 +1,29 @@
+services:
+  wekan:
+    image: wekanteam/wekan
+    restart: unless-stopped
+    depends_on:
+      - db
+    user: 1337:1337
+    environment:
+      WRITABLE_PATH: /data
+      ROOT_URL: https://example.com
+      MONGO_URL: mongodb://db:27017/wekan
+      MONGO_OPLOG_URL:
+      WITH_API: "true"
+      RICHER_CARD_COMMENT_EDITOR: "true"
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ./data/wekan:/data
+  db:
+    image: mongo
+    restart: unless-stopped
+    command: mongod --logpath /dev/null --oplogSize 128 --quiet
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - ./data/database:/data/db
+  bridge:
+    image: shenxn/protonmail-bridge
+    restart: unless-stopped
+    volumes:
+      - ./data/bridge:/root

scripts/Common/Software/docker/services/wekan/docker-compose.secrets.yml

@@ -0,0 +1,4 @@
+services:
+  wekan:
+    ports:
+      - 127.0.0.1:1337:8080

scripts/Common/Software/docker/services/wekan/main.fish

@@ -0,0 +1,51 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    set -l service wekan
+    set -l domain due ""
+    source "$dir/../service.fish"
+
+    function installSW -V dir -V service -V domain
+        set -l domain (getServiceDomain $domain)
+        set -l file "$dir/docker-compose.base.yml"
+        initializeServiceInstallation $argv
+
+        URL="https://$domain" yq "$(getServiceKey "$service").environment.DOMAIN = env(URL)" "$file" | \
+            sudo tee "$(getServiceRoot $argv)/$(basename "$file")" >/dev/null
+
+        sudo cp "$dir/docker-compose.secrets.yml" (getServiceRoot $argv)
+        installDockerService $argv
+    end
+
+    function configureSW -V dir -V service
+        set -l uid
+        set -l gid
+        set -l user "$service"
+        set -l root (getServiceRoot $argv)
+        set -l data "data/wekan"
+        configureDockerService $argv
+
+        and sudo useradd \
+            --system \
+            --shell /bin/false \
+            --comment 'Wekan server' \
+            --create-home \
+            "$user"
+
+        set uid (id -u "$user")
+        set gid (id -g "$user")
+        USER="$uid:$gid" yq -i "$(getServiceKey "$service").user = env(USER)" "$root/docker-compose.base.yml"
+        mkdir -p "$root/$data"
+        chown -R "$uid:$gid" "$root/$data"
+    end
+
+    function getServiceServers -V domain
+        printf "%s\0" $domain
+    end
+
+    function getServiceLocations -V service
+        printf "%s\0" "$service" /
+    end
+
+    runInstaller --force $argv
+end

scripts/Common/Software/docker/services/woodpecker/.dockerignore

@@ -0,0 +1 @@
+data/

scripts/Common/Software/docker/services/woodpecker/ci.Dockerfile

@@ -0,0 +1,7 @@
+FROM tetafro/golang-gcc AS builder
+RUN apk add -U --no-cache git
+RUN git clone -b "v2.20.0" --depth=1 https://github.com/drone/drone.git
+RUN cd drone && go build -trimpath -ldflags='-w -s' -tags nolimit -o /usr/local/bin/drone-server ./cmd/drone-server
+
+FROM drone/drone
+COPY --from=builder /usr/local/bin/drone-server /bin/

scripts/Common/Software/docker/services/woodpecker/docker-compose.templates.yml

@@ -0,0 +1,26 @@
+services:
+  ci-template:
+    image: woodpeckerci/woodpecker-server
+    restart: unless-stopped
+    depends_on: []
+    env_file:
+      - ci.common.env
+    environment:
+      WOODPECKER_DATABASE_DRIVER: mysql
+    volumes: []
+  agent-template:
+    image: woodpeckerci/woodpecker-agent
+    restart: unless-stopped
+    depends_on: []
+    command: agent
+    env_file:
+      - agent.common.env
+    environment: {} 
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+  db-template:
+    image: mariadb
+    restart: unless-stopped
+    environment:
+      MARIADB_RANDOM_ROOT_PASSWORD: "yes"
+    volumes: []

scripts/Common/Software/docker/services/woodpecker/main.fish

@@ -0,0 +1,116 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    set -l source "$dir/docker-compose.templates.yml"
+    source "$dir/../service.fish"
+
+    set -l environments \
+        my ci "" \
+        codeberg bergwache "" \
+        github gh.ci ""
+
+    function installSW -V dir -V environments -V source
+        set -l root (getServiceRoot $argv)
+        set -l config "$root/docker-compose.base.yml"
+        set -l secrets (getServiceSecretsConfig $argv)
+        set -l ciTemplate (yq -oj (getServiceKey ci-template) "$source")
+        set -l agentTemplate (yq -oj (getServiceKey agent-template) "$source")
+        set -l dbTemplate (yq -oj (getServiceKey db-template) "$source")
+        initializeServiceInstallation $argv
+        echo "{}" | sudo tee "$config" >/dev/null
+        echo "{}" | sudo tee "$secrets" >/dev/null
+
+        cp "$dir/.dockerignore" "$root"
+        sudo touch "$root"/{agent,ci}.common.env
+
+        for i in (seq 1 3 (count $environments))
+            set -l name $environments[$i]
+            set -l domain $environments[(math $i + 2)]
+            set -l subdomain $environments[(math $i + 1)]
+            set -l secret (openssl rand -hex 32)
+            set -l services ci db agent
+            set -l tmpConfig (mktemp)
+            set -l tmpSecrets (mktemp)
+            set -l ciName "$name-ci"
+            set -l dbName "$name-db"
+            set -l agentName "$name-agent"
+            set -l ciEnv
+            set -l dbEnv
+            set -l agentEnv
+            set -l ciKey
+            set -l dbKey
+            set -l agentKey
+            set -l db Woodpecker
+            set -l dbUser woodpecker
+            set -l pw (nix-shell -p keepassxc --run "keepassxc-cli generate --length 32")
+            set -l domain (getServiceDomain "$subdomain" "$domain")
+
+            cp "$config" "$tmpConfig"
+            cp "$secrets" "$tmpSecrets"
+
+            for serviceName in $services
+                set -l file (mktemp)
+                set -l nameVar "$serviceName""Name"
+                set -l serviceKey (getServiceKey "$$nameVar")
+                set "$serviceName""Key" "$serviceKey"
+                set "$serviceName""Env" "$serviceKey.environment"
+            end
+
+            CI_NAME=$ciName \
+            SECRET_ENV="$name.secret.env" begin
+                begin
+                    echo "WOODPECKER_AGENT_SECRET=$secret"
+                end | sudo tee "$root/$SECRET_ENV" >/dev/null
+
+                yq "$ciKey = $ciTemplate" "$tmpConfig" | \
+                    DB="$dbName" yq "$ciKey.depends_on |= . + [ env(DB) ]" | \
+                    ENTRY="./data/$name/ci:/data" yq "$ciKey.volumes = [ env(ENTRY) ]" | \
+                    yq "$ciKey.env_file |= . + [ env(SECRET_ENV) ]" | \
+                    yq "$agentKey = $agentTemplate" | \
+                    yq "$agentKey.depends_on |= . + [ env(CI_NAME) ]" | \
+                    yq "$agentKey.env_file |= . + [ env(SECRET_ENV) ]" | \
+                    SERVER="$ciName:9000" yq "$agentEnv.WOODPECKER_SERVER = env(SERVER)" | \
+                    yq "$dbKey = $dbTemplate" | \
+                    ENTRY="./data/$name/database:/var/lib/mysql" yq "$dbKey.volumes |= . + [ env(ENTRY) ]" | \
+                    sudo tee "$config" >/dev/null
+
+                PORT="127.0.0.1:1337:8000" yq "$ciKey.ports = [ env(PORT) ]" "$tmpSecrets" | \
+                    HOST="https://$domain" yq "$ciEnv.WOODPECKER_HOST = env(HOST)" | \
+                    DB="$dbUser:$pw@tcp($dbName:3306)/$db?parseTime=true" yq "$ciEnv.WOODPECKER_DATABASE_DATASOURCE = env(DB)" | \
+                    USER="$dbUser" yq "$dbEnv.MARIADB_USER = env(USER)" | \
+                    PW="$pw" yq "$dbEnv.MARIADB_PASSWORD = env(PW)" | \
+                    DB="$db" yq "$dbEnv.MARIADB_DATABASE = env(DB)" | \
+                    sudo tee "$secrets" >/dev/null
+            end
+        end
+
+        installDockerService $argv
+    end
+
+    function configureSW -V dir
+        configureDockerService $argv
+    end
+
+    function getServiceServers -V environments
+        argparse -i "name=" -- $argv
+        set -l name "$_flag_name"
+
+        for i in (seq 1 3 (count $environments))
+            set -l domain $environments[(math $i + 2)]
+            set -l subdomain  $environments[(math $i + 1)]
+            printf "%s\0" "$subdomain" "$domain"
+        end
+    end
+
+    function getServiceLocations -a index -V environments
+        set -l i (math (math (math $index - 1) / 2 "*" 3) + 1)
+        set -l name $environments[$i]
+        printf "%s\0" "$name-ci" /
+    end
+
+    function getBackupArgs
+        printf "%s\n" --hidden --no-ignore "data|\.secrets?\." (getServiceRoot $argv)
+    end
+
+    runInstaller --force $argv
+end

scripts/lib/action.fish

@@ -10,14 +10,15 @@ function runActionSetup -V dir
     and runHook prepareNix || installNixPkgs
 
     and echo "Flagging repository as safe..."
-    and sudo git config --system --add safe.directory (realpath "$(status dirname)/../..")
+    and sudo git config --system --add safe.directory (realpath -m "$(status dirname)/../..")
     and runHook actionPreRun || true
 end
 
-function runActionConfigure
+function runActionConfigure -V dir
     and if [ -z "$CONFIG_NAME" ]
+        source "$dir/settings.fish"
         selectProfile config
-        set -x CONFIG_NAME "$config"
+        set -gx CONFIG_NAME "$config"
     end
 end
 
@@ -37,39 +38,44 @@ function runAction -V dir
 end
 
 function runSetupUserAction -V dir
-    if [ (id -u) -eq 0 ]
+    source "$dir/settings.fish"
+    runActionSetup
+    runActionConfigure
+    set -l env "CONFIG_NAME=$CONFIG_NAME"
+    set -l name (getOSConfig setupUser.name)
+
+    if [ "$USER" != "$name" ]
         set -l cmdline (cat /proc/$fish_pid/cmdline | string split0)
 
-        if [ -z "$TMUX" ]
+        if [ (id -u) -ne 0 ]
-            runActionSetup
+            sudo --set-home --preserve-env $cmdline
-            tmux new-session -e "CONFIG_NAME=$CONFIG_NAME" $cmdline
         else
-            source "$dir/settings.fish"
+            if [ -z "$TMUX" ]
-            runActionConfigure
+                tmux new-session -e "$env" $cmdline
-            set -l sudoConfig "/etc/sudoers.d/PortValhalla"
+            else
-            set -l name (getOSConfig setupUser.name)
+                set -l sudoConfig "/etc/sudoers.d/PortValhalla"
 
-            and begin
+                begin
-                echo "Creating setup user"
+                    echo "Creating setup user"
 
-                and useradd \
+                    and useradd \
-                    --comment "PortValhalla Setup User" \
+                            --comment "PortValhalla Setup User" \
-                    --system \
+                            --system \
-                    --no-user-group \
+                            --groups nix-users \
-                    --groups nix-users \
+                            --create-home \
-                    --create-home \
+                            --uid (getOSConfig setupUser.id --json) \
-                    --uid (getOSConfig setupUser.id --json) \
+                            "$name"
-                    "$name"
+
+                    and begin
+                        echo "$name ALL=(ALL:ALL) NOPASSWD: ALL"
+                    end >"$sudoConfig"
+
+                    and sudo --preserve-env --set-home --user "$name" $cmdline
+                    disposeAction
+                    rm "$sudoConfig"
+                    userdel -rf "$name"
+                end
             end
-
-            and begin
-                echo "$name ALL=(ALL:ALL) NOPASSWD: ALL"
-            end >"$sudoConfig"
-
-            and sudo --preserve-env --set-home --user "$name" $cmdline
-            disposeAction
-            rm "$sudoConfig"
-            userdel -rf "$name"
         end
     else
         $argv

scripts/lib/nix.fish

@@ -3,10 +3,14 @@ begin
     set -l config "$dir/config.fish"
     set nixPkgsDir "/nix/var/nix/profiles/per-user/root/channels/nixpkgs"
 
+    function __isNixModule -a path
+        nix-instantiate --eval --expr "{ path }: import path" --argstr path "$path" &>/dev/null
+    end
+
     function downloadNixPkgs -V config
         source "$config"
 
-        if [ ! -d "$nixPkgsCache" ]
+        if ! __isNixModule "$nixPkgsCache"
             mkdir -p "$nixPkgsCache"
             and git clone https://github.com/NixOS/nixpkgs.git --depth=1 -b "$nixPkgsVersion" "$nixPkgsCache"
             and rm -rf "$nixPkgsCache/.git"
@@ -16,8 +20,8 @@ begin
     function installNixPkgs -V config -V nixPkgsDir
         source "$config"
 
-        if [ ! -d "$nixPkgsDir" ]
+        if ! __isNixModule "$nixPkgsDir"
-            if [ ! -d "$nixPkgsCache" ]
+            if ! __isNixModule "$nixPkgsCache"
                 downloadNixPkgs
             end