Updates

Add Yamtrack

.docker/ca.pem

@@ -1,35 +1,35 @@
 -----BEGIN CERTIFICATE-----
-MIIGDTCCA/WgAwIBAgIUDgmjZIgIVa0kvOLS27ljhGL2fQ8wDQYJKoZIhvcNAQEL
+MIIGDTCCA/WgAwIBAgIUdAhU4hnAkB2x7/pAxs4QqrlH13MwDQYJKoZIhvcNAQEL
 BQAwWjEaMBgGA1UEAxMRQ29udGFpbmVyIFN0YXRpb24xDTALBgNVBAoTBFFOQVAx
 DzANBgNVBAgTBlRhaXBlaTEPMA0GA1UEBxMGVGFpcGVpMQswCQYDVQQGEwJUVzAe
-Fw0yNDExMDcxMDQ3MDhaFw0yNzExMDcxMDQ3MDhaMFoxGjAYBgNVBAMTEUNvbnRh
+Fw0yNTA4MTMwMjM1MjRaFw0yODA4MTIwMjM1MjRaMFoxGjAYBgNVBAMTEUNvbnRh
 aW5lciBTdGF0aW9uMQ0wCwYDVQQKEwRRTkFQMQ8wDQYDVQQIEwZUYWlwZWkxDzAN
 BgNVBAcTBlRhaXBlaTELMAkGA1UEBhMCVFcwggIiMA0GCSqGSIb3DQEBAQUAA4IC
-DwAwggIKAoICAQDLDGADghOnXWqR0b5NAB+yixk8iChvW6xAYq21CUgxHDNrriEM
-m11gmyIWx+W8kVh67dWY1xzzeeuJt7q0Xuxan/vAQt5w/9UIhnF3MS0NrHEDVkXj
-q33DndxW0s9kj8fkaPwmPEpiQ+7x4uSU7IeBv4YYEUCRa0dV7QO4GLwEnJJM40oh
-UDIj9hL6dojVXFCYV2ta/MVLj5eimU+HBUZoFnCxppywpC/oTHDMEuYtGeY3VDxl
-nwLB2q4tKHjguqvOmDO1dph+tpe7VeVrGDUE0vEwXqx0mSZ/dDlhEjmKDO/v2LbE
-09XvjoG59e7u5JTrErvEXmH7tQ9QI13uE3HXmlV4nP3JJJ50PYQjousj7bmAGhZp
-WpA+1sPx8oOlKwNKbhU3134062p5LiJrLMDyC9IjllHrJhJjpgrPdJOK6STwWTtP
-qywHfPBGNKL0a9e4SBPjvisyRiDjpyM00ZTGSIb6Qe1fMH7wJlhveI3TBT6al0c8
-g5YD+jBcphWyQ/Dp/XiAu7ecfXPTzknHa2PuKeuBOZ3kSt1x9apn7cO1LrdckBxf
-m0qELqXmhr85EzBn9xiQ9JtbgNXFzgEKQ9CMJtHxkiz3EVeKj970wl0BfEoZ6sMY
-I605zbH2JfvfEzHTsTvrZEse24hfrRkt8flXiQA0xbgH2DtR06p5ZcEy6wIDAQAB
-o4HKMIHHMB0GA1UdDgQWBBRccVm1miBD05mqI1kVNHlKKdtvNjCBlwYDVR0jBIGP
-MIGMgBRccVm1miBD05mqI1kVNHlKKdtvNqFepFwwWjEaMBgGA1UEAxMRQ29udGFp
+DwAwggIKAoICAQCkQ3UfH4sIieOQvmnKIMW0gF+tGsnNUtdet7TyS7/PUZWLuRag
+/Jsxyehr4bOMDexrhYRGBe+DxkvqUby+oPQk2d07rYsd4zVWBcHdVHp/JDiAUr7g
+7J7p/epDhzGE6siuYOwIf8fKSWxqxX7kEi8g7wxXaZTUi6Ub0I+2RS/95oCwFHqn
+nmaxEjr9YwmonColNa7YmYqEp6MBvd/a7Sls1GGezNZkBRJe0fQPdX96TKCPviWR
+p5ogGOXHOdoruRKieiuqJGGvg+nLMKSMSZHDBUyiSuhGqOQEqQP7TEYLXsrQfpoY
+A0/BRyIkbTsB9EyhYMP18GS7vorKfJYe+76nvLzAqWYFCV4JpR/DBSKcUiLbRVy2
+oQViaYGnk0W1WjpR9d9UvY+uDhNZJwI2gpWxOWBS0e+Hd0aRs/0erYZdYynnKqmU
+2PHNPcTjUAU5AbYUP86dYjSWTI7tkgvZVHloCWYUoCmKX/abzjrpvgHBIgmCi9Dt
+0J/OgfYUV5HpISX5pstOPbcnCmrnhhwTYZEmkibJN6QoNr4huB5ECbSQ0cxTdyF4
+ruBBMjOwEI8uCZ4WwajURIJOr8uPatD0+zPKMKYuphEqrnxIqRXbvZBalpia1o95
+YOtfR7RClvyQ58B4/CZPwug7FW4A5Vr8ylNYKl0fkPz7oiwxWkZBei11lQIDAQAB
+o4HKMIHHMB0GA1UdDgQWBBSVugZSd2jDJoE1oJh+IzJWtV60wzCBlwYDVR0jBIGP
+MIGMgBSVugZSd2jDJoE1oJh+IzJWtV60w6FepFwwWjEaMBgGA1UEAxMRQ29udGFp
 bmVyIFN0YXRpb24xDTALBgNVBAoTBFFOQVAxDzANBgNVBAgTBlRhaXBlaTEPMA0G
-A1UEBxMGVGFpcGVpMQswCQYDVQQGEwJUV4IUDgmjZIgIVa0kvOLS27ljhGL2fQ8w
-DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAf09EJU15F/TWe/c4ERZw
-ihPk7yjZntG2c5ZFtgIKzXr/FITJihz61Otc7PM8KWXpGp6TE5HWfV74tCT9UiP9
-HYX+nTajLGwxknbqDezAO+5oo9/xzKrK4vdABuSghG/scrauPLzw8ZX2f890x/T9
-8YLBptYaamDufBQsWUGI5cHs5zTne752TOPmfs0kzSGCM8Ct1AOM4lFC64EZu82y
-u1QEUiV9tEBC77TtZu8hbiVUhtkgp0566NzcB7Yl55rMkQ9yKcQDYfutQH2lxwTa
-271lfGuHsZZwYPhTqLMs8GNzffmkK1pa7OQeOqu4T+jyOXFGlxULDn7UtaA4li8b
-ZZFvFQy/Ab3Pz1ls49AlAR1vsV45yWqxwaQXR9APjCYMLkyi/RGGy/H6DU5Dx+ti
-dtHPMabcS+gO4Dhu5C+8Q6ue9cH6wsZlYMoJLtCcJdGksfOQHoGa/wG+/p9dETww
-gF1ayM/KR+ZZ5F+jAlO5fANywmiE8NJ0W8vRQ1Z55T2F5fxNEgupV9EEYPL2wiVl
-7lJOVutj9l+pxxWEtdha5azEM5gqdfSASWV0mLdJAyOcNdAKgn4+cc4nxZnWwkUQ
-gLd4/6VgXGRE4B/FV3fv32+8G+R+MRux4+du0XjcNJzv0X9Y3rMTXC0XJV8gLrFV
-LisvvfPhD/QYBIxqDbIZBvk=
+A1UEBxMGVGFpcGVpMQswCQYDVQQGEwJUV4IUdAhU4hnAkB2x7/pAxs4QqrlH13Mw
+DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAE/XMNmFNW1U0lu6rx4TZ
+c9GM/Qal3poWcSEKhbH4hinyfGYLQ67hx9vtcBcbgNLqNjnZt0Tio9JnAcFEFFnT
+slCrpnQ9KrHUEDMPgStD2nvg33RkFK6OZdHSm0KxzX1HQFnFMc/HbBtvvx1rTLeC
+RHj4bpwoE00GtOKgvKUfahqRX0yOIsqwok5OBi+Z8BbiSZzLKAjVQ3C+yeu7xsVL
+5kRAIWG3orFJObOP9j9LyRRnzn8v3yUZ48w38oF2PD2l0notCMPDgWfst0T6RdCO
+lwrKqxTcC/4Y23Yz6LUJoWQH5W58cZo2KbH6X5PKbJYpuBxRQp1ShlQvnDxE8E/I
+Z9C3X8drxIw1aqFOHqAfPafEmMkVT0HMA0w6AhX84R2NGhtVaU8Rp+7bMKoU8It0
++HpFVrTyo8DrYUMkDVH8OHM/CxPDNM20DA6g/+pHij/EiL+5WF4ZixhpHe415sBn
+2D43OwSuvmF5XS0kWeQrsfTteUjjyMQXJ82DHn5jUmtzoQSbPEAzJvNL8dxS4deh
+kB/TzkEbCTbzZSPxZjWyf4x3ZwibHhxtz+21Vt1vUe+L6Dui6BBW28UEeLb4O04P
+zgHE8ULD/9Q3fivxABKSt2PgAz1fTD+ywFC4jbzbmI13BVbS6f3BcrL10Auy0KmP
+etHm3Irulez4LlRQOaH8wAU=
 -----END CERTIFICATE-----

.docker/cert.pem

@@ -1,30 +1,31 @@
 -----BEGIN CERTIFICATE-----
-MIIFHTCCAwWgAwIBAgIUVRyOS3aToT5Ztjegz/2yBASD4fkwDQYJKoZIhvcNAQEL
+MIIFXTCCA0WgAwIBAgIUX1k7YkWIPXHhz1JzwppSwHo2vZMwDQYJKoZIhvcNAQEL
 BQAwWjEaMBgGA1UEAxMRQ29udGFpbmVyIFN0YXRpb24xDTALBgNVBAoTBFFOQVAx
 DzANBgNVBAgTBlRhaXBlaTEPMA0GA1UEBxMGVGFpcGVpMQswCQYDVQQGEwJUVzAe
-Fw0yNDExMDcxMDQ3MTRaFw0yNTExMDcxMDQ3MTRaMBExDzANBgNVBAMTBmNsaWVu
-dDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMVhGZd9iTKEJ2Oqg62H
-diNdLqdbK668u2z/H7ianlNwKjBWNYq7HmA4obyK5Kmjbet0y3eJ1cXr4eo0gqay
-fdnqlfw5TaGhvEGRHgjgKEyfKHwzcMUr23JqrFUkrXWNl6oKvPmGagMF8gWyh9eG
-zBNT9fx7NQkj2gP1uiCrGAJlWYfUENIKems07yZhb3qbjNrbIqlYn9Xq2v+sOgQk
-JP3kayh4CIw/tqFJbh8VPii5R5Fv4wFSxLzfGdtaGw+K1Ia7oEdM37grYtjhEQX4
-tUezg9NSCD5NIARxWVx4tOzYW1hle4QVfQBfqUyGrjeC8TcVFWvQh8X4a6k/IMbl
-kOXV/HSIi8w2eTgPlCZn8jIQTN7gBvRfwqVINfzBDaygqYrBvUrRmdH7ge1cwjo3
-oVeTmruxWU0KgCQmQVsIABB/eJcWiMrSkp+wporFNhJ+ITP4OHTSkC7IV00P43lV
-LgzbzOnu0eQbVPMtaZ1U3+CQit7VebADot1nMZ3TrSPBwnNSzTqP4NmT1b9vqBIV
-HgcKdfxRH8Qg85bBPbElhDvw7Rhj3TZs+3WOEb+xMTZJPS+SE1DxmHwlOACSA8SV
-75w9LRF5jW8sGfjKC1IjSOxr7TozamT7g3fH2rZlN9/iQIQyfj/frZb38tzjQ9Jy
-UDn6dlKfc1/iAhhKn8XsKG9NAgMBAAGjJDAiMBMGA1UdJQQMMAoGCCsGAQUFBwMC
-MAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAT6QBEdS4ejB2GKGlRdHX
-SkIGcp9CN9TEUxmnp+V+qAmUB9k4Y6pLD2CR2Pn85qxLBFP1InTxzxfyJdHoUPRV
-C7/mF/S5efc9+geLMUVcl1+79rFv1DUYhlWKo1CBb+Yx762m9XixID2/WU0k5o8I
-p2xjsamRO/ATomtqzbrApsjgo3qAPStybzkQEI4HoouU3Uf/kXre0qd4IQ4GddPR
-6Gbmh90+ylBxiJ0wQ8bW2rh/BdhqDI/whS0ri4xU6jO0MbWfNm94VLj9h7BluVE1
-hewhF8A90VIAivoAraQxHCnDh6Iy+COKbmSLi4Ct/SosbY23Py0rd8D3kv/98a4d
-ftvHhMYPHtzLn6agH8YO0ow93in1Yua5ul/YSTMwn7wUUGPgpHb/SaWIlZeqv5H4
-TL1R/KGyIUoAn1+488SkvoRtcd+cSZouTVgCUiQxkVLl5+8a2CmWOakkLoM1uxhH
-BLa3ssr5tnGncNYxOKY//v81jEpHE0uJTp7A/uggdLkR3TNh4ZPe3X0wDnroLG6w
-w0ewOleKsbcgMag9Gcx1bYmM9MG+qqJ5QIkLMGCYD2TDoCmTBZsd4fc0t1bxBW2L
-8lIHMaPvfUHYk6PX0RMsUo9x9RP3MY6GUCpQO2ZwsQthU6cqXllnsEK8rChGN1/K
-gVisIAv9yllt8sxGU8xKVdM=
+Fw0yNTA4MTMwMjM1NDFaFw0yNjA4MTMwMjM1NDFaMBExDzANBgNVBAMTBmNsaWVu
+dDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJ/Be4+vKxjdlM+CRtFv
+rlQSEx8lKr943FOPktxtV84oXnm0w+KiKPHNnJDupqh2TBjWnMvMNNZrdkrG5Ryz
+zhT3MjlAWAM9wfd20LSqxevLclFCZZEvyYjAKHFcw9Y7tGZeHvhCRZ08vIdTPwg8
+0JqZyOQH7uERvUGPZfZJicNcU7z9cJZXteRhZTJexwKDwt3MbROo43HSYxUXK378
+wB+lvN/hZ5WGd8hF89O9CyF24irLXKJq5gPkLf5+amhM9raEGtH5YL7KsOCAkyE4
+Rh3c9rmlxR9jQrpo0x6KA6qAXtM4A/FxTqWe5NSwKTeC+LCZgiNGLcj+wem2N9HI
+vyjmqEzYv5jmEp3eNXJhR+sKawitijdTouyb2aI5Q9kCtQXgAjYcI3bmfT0wFfE9
+Vb/RpJhf70QK3ZA8Ej1ZZngHEfyHUUDdxZvZeCzxv+8N4XeqThy878ljWl5kFeRT
+a/YMfYlQxW7F4usxT6p2QWKb7oq0AsmyKWby75XyUQTiZDoxbZNh9HZRouKAvxhd
+n9v0OKyrVAMEIx3g3fPJ+zMt43pcZQS6BHv+SucXf443wm094P8VpsO4s99xWXQI
+we4jF31jI4011HnOHJ/3p/c9aXco+2nEJN2MyV8tB0YO/v6aHjpsWdhJBVnybuf6
+WpgbF75KSZX1r0leUzxRCpCrAgMBAAGjZDBiMBMGA1UdJQQMMAoGCCsGAQUFBwMC
+MAsGA1UdDwQEAwIHgDAdBgNVHQ4EFgQU/9dtJ1ThWEBazrAYHropGKATowkwHwYD
+VR0jBBgwFoAUlboGUndowyaBNaCYfiMyVrVetMMwDQYJKoZIhvcNAQELBQADggIB
+ABKl/jaCgvA++4XsIpdfUTj2zAKBtiENMTE/ih+oXq3j3Ks6FG+ok3kBBxfdW9Sw
+eInm3YzQR8Yq6i/tkxQWRHo9nLxsSNOznlT5Mx8CkC7QNoOi6oLE/L+vRfM0XnhB
+332immequMIgimnkNWZKb6AxItnCMuaNiaAYT1PXofcCdHQ+xXiIZksYqHv9eyyo
+vAObguto3zAJ5JTqZkq+BuOw4gLl7IJkqOxHby5rha1iNNFw1RM6QVUsADo4h7r6
+Ghh5lY6IBRy72TS6oIIz2FzdqW3QzSEWwy8uQ/DIAaCqcp8v9yPQBl4rqbziR8LW
+Jg1arhekJwivPgrvpGJyAAnsUYkaYiy4QtIq0XU/BauHpch3EEwbfajdjhiMtL0B
+fjfz8uc0HChzHlVYeGOHQqLAShjUNMPWFUxFg4uZV0Zr5JnaaWk5yR96zhKUa54Z
+SI4zAvmH1sB0zzSMwvNCfAdBxujVRjVZCy50l/OkAKZ+3twTtYRggr01Jbi7BVBH
+CUP9wBahk+JfDu/TYrs9eSjXhEHH7B4zfWjaYlq2DToV/aIY6gyuAJmz4VSoCHOp
+UqR51UzyWmaDW+Ktmj9HbhGk42dqrFwcPlmjlgOsXh6kCOP0mUBDY5Tp5TuqtCmI
+Re94OL/qIBTWLETAJxo9RbmjFJG3OJuw9be5fqGuqpF6
 -----END CERTIFICATE-----

.docker/key.pem

@@ -1,51 +1,52 @@
------BEGIN RSA PRIVATE KEY-----
-MIIJKQIBAAKCAgEAxWEZl32JMoQnY6qDrYd2I10up1srrry7bP8fuJqeU3AqMFY1
-irseYDihvIrkqaNt63TLd4nVxevh6jSCprJ92eqV/DlNoaG8QZEeCOAoTJ8ofDNw
-xSvbcmqsVSStdY2Xqgq8+YZqAwXyBbKH14bME1P1/Hs1CSPaA/W6IKsYAmVZh9QQ
-0gp6azTvJmFvepuM2tsiqVif1era/6w6BCQk/eRrKHgIjD+2oUluHxU+KLlHkW/j
-AVLEvN8Z21obD4rUhrugR0zfuCti2OERBfi1R7OD01IIPk0gBHFZXHi07NhbWGV7
-hBV9AF+pTIauN4LxNxUVa9CHxfhrqT8gxuWQ5dX8dIiLzDZ5OA+UJmfyMhBM3uAG
-9F/CpUg1/MENrKCpisG9StGZ0fuB7VzCOjehV5Oau7FZTQqAJCZBWwgAEH94lxaI
-ytKSn7CmisU2En4hM/g4dNKQLshXTQ/jeVUuDNvM6e7R5BtU8y1pnVTf4JCK3tV5
-sAOi3WcxndOtI8HCc1LNOo/g2ZPVv2+oEhUeBwp1/FEfxCDzlsE9sSWEO/DtGGPd
-Nmz7dY4Rv7ExNkk9L5ITUPGYfCU4AJIDxJXvnD0tEXmNbywZ+MoLUiNI7GvtOjNq
-ZPuDd8fatmU33+JAhDJ+P9+tlvfy3OND0nJQOfp2Up9zX+ICGEqfxewob00CAwEA
-AQKCAgBBYB8E4UyvEbymM1U4BdUoc3W/cuAuGU8PFBWipHvqcQ1YQ0WqtL2j6z4O
-4AZK9dmzklTOPDY1PyLt2wSnSBmNMzkIeMZw0cwz/2fuUqimcFUNhlBEznj6FcEM
-1oApnoNsi+/5yf6VD8QRBQgfaANyJ24jeX+gjmJoy1wh8+mY6Y7VAXWszFGt7rOD
-h+RPvPPTjZ+WbcdLKGXvJ1F0C7DA84ZWuiNCqNvJ4jN6UiPrgyrkTiXnS03krRS4
-ZcjuxfIMylqVIy46pwwvf6SO0MjifeAc/1/BmvQO5KhPi5+Jj0P6LGrT3fYwSH8f
-3MAZnOJedzpIIqLF/LlULpehqWnrUZ3qOeuyeT3BwPIqV7ubow6Q9q73AHrwl7n6
-sz9ZlE5FD335ZiWfvthf/qIXmKSZVC66e9be87SvcP1+PMV7S6KRtgquCHKTexnS
-+9qmsE2rbMYklmxN3GJC1312S0DDHVO/8/ybCgkYPRwldTYL6qZ/vW8NzQLai2Vh
-51xBOXV677cyUbh5uwx8uEP/sQf+W9jnycUzX22jTcxEYlYwW8ujpGvgyUjaKVh5
-OkoM+gXEr4qFdIawM+GDTdnw29pexeOn0a6IKsnWD6//Ecdpx+IVLhZhNMLhZrO1
-V6g/lQI6fFeym/UwAb402QsXyTMYcn3hi6tLlOO7q7dePLJ5gQKCAQEA5K0bv9Zx
-N9SJmIhCiq9hZIvd+9D2YQHUYyoWvUZKdQRhn7odA8ysP3MeKHKpK0xq321h/qTf
-T6eH+cg3IOi4FVJ8St1RbTJEZ91wZLpYorj95Ty0SWN5wu8DnozcdwK4XfejOxBU
-kAa+nZuzXl1YbtYmHmrooPlPRga0tHw5xaasNO4kQ28+IHUFhvO62tH/OGKNs3qm
-Amnd2+IPeOfsOU5A5vDp5cjLMsW4OclFFEgFjhjXm0qE4Qf5IMfOdjGfxCkG2PQ2
-KQRYHECqmSlF4Nl1wn+gxYwG23HIcLk+aEqhaD50cBkDgRQaW+Bl1q4BE5z7V2OY
-mDXdcokloRpnYQKCAQEA3PapfQfnodCBhhWCl+F9ymcUDYYt7iAJCQ6PDB2/skrj
-sinBqyPjrI9TBPiQUfIwuxxrQHUoylvYejRYsuKOo7PPebx6vSvaYsxbZdqG6PQY
-p/aPCDn+tcze0j3KRqKCl0v2QyVVNM+WeuzpgrRJZ+5Q6PtUJqlTFrUsW/XzpaF5
-qrsIv7oboJdeLr+700j7tev/yPNahJAVAl/1JBtOgLLQjX+btREbnk/Cy8vpeDHt
-ZMbFiK80txgoMDnXjs9ZvnBL/o16bSqWGxSmOKkkwMk+cS6EKLWw2UqbqwC4pcBx
-rCl4Y/1lfo6Ux3l95Mcm08l0aqRQU2TXj8tQWEFLbQKCAQEAlcNNnijqQz890hjD
-Q6KyrS/w9N+YzFVvbHZ/J/yl/NcevIYeRIPB91gEU0csxb+paqRvfl8qJTe6FPts
-J3BiRwybfEhP8KzwIfnjhwSH0iJHnd9Qz5OHhgQVIbxtEsBEUL5DOAZs61qPchcr
-tMx7gzNbCabIrcw5f8oahO2qxGhw9cVVGJj9XjJlqUlsgazwclQRK49Ss9fzxfLa
-YTu6+JjoZpc3CBemBJ17FtVbGXpFsRdR9VErj1kybqaM79l2Ifkgk+v0oI5IylAL
-qn1eV3Dz76q4d0hKoWN2e2TGm3TtGqF0jonDQsEQtkVTTPLun5K7BTOkF2OHoWBy
-tXzeYQKCAQEAyY2l5IrFWvDadPhB+1CQcYO84uk2FDPcigphqWepaHSvZeB47Cb8
-knbZ/3rMCjOlB8hQfKdh4dQNjssY7XODMQffhOfL/ap2thA6fpnq3atqoithJNvh
-3utVhOkgDXZHMML1iyIOqvGADfj0t2jEXK0h2KMIi4uAYwI3yFp9OOQmGvoobNrS
-QJZSLspuBbhZAgSXeTGhq7HRuCzXa2wNG5AAdFGmMm+8hZez1DnYaO8B4B8AKEHJ
-EApU/kiEu5uf/PpqF3Pt7I4gBeu8A4smH0RyVMNdgdTZ0BsiC8XIqEj2Z1gcnPiT
-D/H2/E1x7LFMVXs5Wd0v+CHQDzYhv58vsQKCAQAS8NTOVa2PnFu98qp/HZUWgm3B
-t3Ed80D1SOEWQx2ejTnxo6VWpJUdv7cLvY45iRktGZ/mBaEw52LZTThomZmWU7G/
-vaBB/o61Xo/FbVK9SrFgN7x8a+VsxotKqdPU2Ddi+yeJyXeLPJRqHhIjhbYAq0eo
-pb6cLDMrXV71y7O7eFRfv5fnv1zHZkRU1bG1qWuod1oz6NUoEh9mH4+jrRtoSd6H
-1o5c5orPyaNOCGVMdlKAOZwWlvkC+cI+9vBMbKR+wfE3Cdg73v/bvZS/iwVCchPu
-79tcZf81Jk7mW4MBWfR+esDazChBEMEMZ/g4QUxQZreUnYIJZluIuTiilcPB
------END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQCfwXuPrysY3ZTP
+gkbRb65UEhMfJSq/eNxTj5LcbVfOKF55tMPioijxzZyQ7qaodkwY1pzLzDTWa3ZK
+xuUcs84U9zI5QFgDPcH3dtC0qsXry3JRQmWRL8mIwChxXMPWO7RmXh74QkWdPLyH
+Uz8IPNCamcjkB+7hEb1Bj2X2SYnDXFO8/XCWV7XkYWUyXscCg8LdzG0TqONx0mMV
+Fyt+/MAfpbzf4WeVhnfIRfPTvQshduIqy1yiauYD5C3+fmpoTPa2hBrR+WC+yrDg
+gJMhOEYd3Pa5pcUfY0K6aNMeigOqgF7TOAPxcU6lnuTUsCk3gviwmYIjRi3I/sHp
+tjfRyL8o5qhM2L+Y5hKd3jVyYUfrCmsIrYo3U6Lsm9miOUPZArUF4AI2HCN25n09
+MBXxPVW/0aSYX+9ECt2QPBI9WWZ4BxH8h1FA3cWb2Xgs8b/vDeF3qk4cvO/JY1pe
+ZBXkU2v2DH2JUMVuxeLrMU+qdkFim+6KtALJsilm8u+V8lEE4mQ6MW2TYfR2UaLi
+gL8YXZ/b9Disq1QDBCMd4N3zyfszLeN6XGUEugR7/krnF3+ON8JtPeD/FabDuLPf
+cVl0CMHuIxd9YyONNdR5zhyf96f3PWl3KPtpxCTdjMlfLQdGDv7+mh46bFnYSQVZ
+8m7n+lqYGxe+SkmV9a9JXlM8UQqQqwIDAQABAoICABPVeSozFLYvGGEU6wbohyuv
+3Mjim+aOskf7jL+qIZsaPvR8QU+bU1sF7Hi/8Ff86+CvkGLq9OpkCBkrjVldZ2oJ
+8KXT+7lXSwQWr72mcBEgvo4hIKwAU1STitHcMwIfgnutFso6rBrj5gIlDy/OIRX4
+nszUwU8XHTiM/ZswsRZcmZbenkJEHHSAtQgmZS3GPwS7cxVcQ/SnKp79M+y9o3qq
+YIMpIGubeLaYHLf+genDMTwf6F3PyMPV6fHtLvfJCl5Jk2zbOawmTQRqYhnfOzFM
+9CLDVnBZqfirt/5UIzVhX6R4kWDB8QI18nIHdu6J56dBP7tyZI/ONTP3aAG3Gyhd
+yc9X4RDz8KMuZZddX6C3OmIunAjL65jYMnf0UFbFUvRW/UNC/uWojSiJi6oKx3m1
+N0VlrPJMia7ueTSFPdtiBcyutTW5JoYZT9UiVcH9mHqYAW3EbCwngeiENryiwS5x
+5Sa39GMv70kCmwXP7HmWYGbnaNaW/k/Za+d1tQyIYBwzGMv5BPTPgJHApO0saYWq
+FPko/DXDkRsK+U9s7gY4z70Dg9y3UMy3oQcLSuvXd1x3dM78LwhrZ/0Wkr+UQY4f
+Pp/QktQQCBjrGkboK/dFewhFRqPUqOY6KQns4+Em1FpoWHJz0jOGO4LN07ZeZX+C
+uoI/q+wX7k6NF2buy32NAoIBAQDhuohKX4+GUQOJCWI0HhXDdZguLOLgtRdnfJB0
+7Zy9SXlGI4jRVD3/wr0KjaKCWUbN5EmhYuPZQloH1kuTbIJDfCCfDwAfLfdJbS/a
+WGhFOF4QmjqYyIu9PaqfVkUklk24CguHWf93O/JPIuozuj4qOokvaPBTCfk93drP
+O0d9wvLxXCKDX5MdJ2D82kaMbBB0dvGGHqECu1n8S/i11k+lG/27zXTzBc5Z6fcL
+pQnglNPinzcFUw+b/jebvqfyYVsgGL1IVFs/PXl5F87W4T/NvfymRlV3qInXPveq
+buCJvZPngsGC0ZaCMG8gvs1oVGRXNPDV8PYaIPO0S++aXz+fAoIBAQC1Lgr7ASos
+mCV2Mypm7hTugz8p20usEclxnMsTeSQiQMERUQWZ5yEh6p7lOyw/omTjUDduit3H
+i2cHqYvpvPb6p+mT6NIv9kq5i4Rwz3RuABr8OpWUjqxszMz/h4sgHZd+o+TTR7As
+lBiWCG3sJwmsdf+7AkZ9uUnQ9BCiep5vixAey8N3TlY0RBdeFdA/xgB2yRHwEkMZ
+lsCCEE77vvmQTNlTVpE0C6/w78JeEWJtQkW/tc3CRCxZvDtI1/j4LyI9AWQ12PHI
+ZZsPxyofiZXd4C/q3nMyrbpK+3bp4RdD2/TUl5PF+VsrZw//d16bJxmQocDQ++z2
+dcs+xaapGGN1AoIBAQCagtBf+GGKE1JULzQlcKJ9FLWChf8WyV6n28AWCb/MYcq9
+k/1HLF7z/xzfaGvgxbONo8Iy0jocsSpnSuyYkSHph8Hcnqv6q8AlZrPmxbU6DId2
+3dtWUZA1jUyJnMffb3LrkxSpJZWUzFfki4W8urNqvH7DERXQAXe2PXJVf8JD93nM
+dMC7JGTTA+2DpvW7kQ0Ca5iPsc+MyymhZW9tKLGD11EriEuRPlwtd9U/B01niPgw
+m8NRxbVdlfoChdL4OmPh6I1IQVXkR/QqS32t4KmH75BNUL+YFKmlyNhGtXbFUhs3
+0W0cWtKncvfedjysOXglqXthNnt/DydCNuhfxusJAoIBACdvqzIxcbWdNGJDBtK6
+tdGovcHlmtYMVRWmtEk70BKol52mThrOxVZ1lDp/I8WCGoWj+zzTeyyo+jcfv3WU
+DQpILD5mqgGIkYFLjftkHIqo+Ta3pcFdQMi511EzdqP57PTCxdb7PqylW6ikkxCY
++rEQSiaxexh4kUmrJkfHet76nPqnDZfVdEwSGif/hYGsHoO8hmwD/Zj/SE3HMPn4
++qdfItrR9+8lMBm4hk0laZAwoa/16aCEaEbsAtd7MxUKZWB0AhT6cL5W52aKym9s
+6jMOTj/IRbjdObSCgcKsnPzHTsZLa/3mpeKPn1rS58PLwfPKUYbrnwuSXjf+m6Uo
+ytUCggEAfGt5I3vGt9teDhBNgHwx87TP6LxMi0eiTdo+Tv7aIt+EJcsK+rdVzr3l
+vTRemlbk3OOU2bat1i7IHuEFu9HIIw2S25sPTrFtHbR4Ux4i/wur3j69/3dOKmsZ
+V8hkZ4zJy5EarbwLg+tlGG8ikaEUuGgy1fxJ4OUOGiHDi+/GOR9Pox7T1oRwIjEI
+5RQXbtR9xI1SL1USGPWsR3CsqI64VNZyNZfWmt/1t6SzTmmshceo7c/72kMHopP8
+PkatcTLiMuTeXCuL4UIWaBKw4Y/aaxJCDDXFUNTryDkuZIxVyhQgvLpzucfRUH+t
+rz9TdKIcHTWfelGC5dFiuBW2cPo35w==
+-----END PRIVATE KEY-----

_disabled/freshrss.tf

@@ -11,7 +11,7 @@ resource "docker_container" "freshrss" {
   image = docker_image.freshrss.image_id
   name = "freshrss"
   restart = "always"
-  env = ["TZ=Europe/Paris", "CRON_MIN=1,31", "OIDC_ENABLED=0", "FRESHRSS_INSTALL=--api_enabled --base_url https://freshrss.xz1.nl --db-base freshrss --db-host 192.168.2.127 --db-password utquCzXEnrjFU2BbDqYT --db-type mysql --db-user freshrss --default_user admin --language en", "FRESHRSS_USER=--api_password CmZpTF3pUYz7rVtFrDTQ --email freshrss@xz1.nl --language en --password CmZpTF3pUYz7rVtFrDTQ --user admin"]
+  env = ["TZ=Europe/Paris", "CRON_MIN=1,31", "OIDC_ENABLED=0", "FRESHRSS_INSTALL=--api_enabled --base_url https://freshrss.xz1.nl --db-base freshrss --db-host 192.168.3.24 --db-password utquCzXEnrjFU2BbDqYT --db-type mysql --db-user freshrss --default_user admin --language en", "FRESHRSS_USER=--api_password CmZpTF3pUYz7rVtFrDTQ --email freshrss@xz1.nl --language en --password CmZpTF3pUYz7rVtFrDTQ --user admin"]
   mounts {
     target = "/var/www/FreshRSS/data"
     source = "/share/appdata/freshrss/data"

core-os-podman/.terraform.lock.hcl

@@ -6,6 +6,7 @@ provider "registry.opentofu.org/kreuzwerker/docker" {
   constraints = "3.6.2"
   hashes = [
     "h1:1K3j0xUY2D0+E+DBDQc6k1u6Al9MkuNWrIC9rnvwFSM=",
+    "h1:sbdKCURC0XeBU6kPVfj24w7mtZtKbuibaqxtZEZ4bjU=",
     "zh:22b51a8fb63481d290bdad9a221bc8c9e45d66d1a0cd45beed3f3627bf1debd8",
     "zh:2b902eb80a1ae033af1135cc165d192668820a7f8ea15beb5472f811c18bea1f",
     "zh:57815dcea28aedb86ed33924cd186aaee8bd31670bd78437a2a2daf2b00ce2ae",

core-os-podman/configarr.tf

@@ -10,7 +10,6 @@ resource "docker_image" "configarr" {
 resource "docker_container" "configarr" {
   image = docker_image.configarr.image_id
   name = "configarr"
-  # restart = "always"
 
   log_driver = "local"
 
@@ -20,20 +19,20 @@ resource "docker_container" "configarr" {
 
   mounts {
     target = "/app/config"
-    source = "/share/appdata/configarr/config"
+    source = "/var/lib/containers/configarr/config"
     type = "bind"
   }
 
 
   mounts {
     target = "/app/cfs"
-    source = "/share/appdata/configarr/cfs"
+    source = "/var/lib/containers/configarr/cfs"
     type = "bind"
   }
 
   mounts {
     target = "/app/templates"
-    source = "/share/appdata/configarr/templates"
+    source = "/var/lib/containers/configarr/templates"
     type = "bind"
   }
 

core-os-podman/deluge.tf

@@ -12,6 +12,9 @@ resource "docker_container" "deluge" {
   name = "deluge"
   restart = "always"
 
+  memory = 1000
+  memory_swap = 1000
+
   log_driver = "local"
 
   env = [
@@ -20,26 +23,17 @@ resource "docker_container" "deluge" {
     "UMASK=002"
   ]
 
-  # networks_advanced {
-  #   name = docker_network.bridge.name
-  #   ipv4_address = "192.168.2.137"
-  # }
-  #
-  # networks_advanced {
-  #   name = docker_network.gluetun.name
-  # }
-
   network_mode = "container:gluetun"
 
   mounts {
     target = "/config"
-    source = "/share/appdata/deluge"
+    source = "/var/lib/containers/deluge"
     type = "bind"
   }
 
   volumes {
     container_path = "/data"
-    volume_name = "truenas-arr"
+    volume_name = docker_volume.truenas-arr.name
   }
 
   depends_on = [

core-os-podman/elasticsearch.tf

@@ -0,0 +1,48 @@
+data "docker_registry_image" "elasticsearch" {
+  name = "docker.elastic.co/elasticsearch/elasticsearch-wolfi:9.1.5"
+}
+
+resource "docker_image" "elasticsearch" {
+  name = data.docker_registry_image.elasticsearch.name
+  pull_triggers = [data.docker_registry_image.elasticsearch.sha256_digest]
+}
+
+resource "docker_container" "elasticsearch" {
+  image = docker_image.elasticsearch.image_id
+  name = "elasticsearch"
+
+  restart = "always"
+
+  memory = 5000
+  memory_swap = 5000
+
+  mounts {
+    target = "/usr/share/elasticsearch/data"
+    source = "/var/lib/containers/elasticsearch/data"
+    type = "bind"
+  }
+
+  # mounts {
+  #   target = "/usr/share/elasticsearch/config"
+  #   source = "/var/lib/containers/elasticsearch/config"
+  #   type = "bind"
+  # }
+
+  mounts {
+    target = "/usr/share/elasticsearch/log"
+    source = "/var/lib/containers/elasticsearch/log"
+    type = "bind"
+  }
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.46"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}

core-os-podman/fail2ban.tf

@@ -0,0 +1,51 @@
+data "docker_registry_image" "fail2ban" {
+  name = "linuxserver/fail2ban:latest"
+}
+
+resource "docker_image" "fail2ban" {
+  name = data.docker_registry_image.fail2ban.name
+  pull_triggers = [data.docker_registry_image.fail2ban.sha256_digest]
+}
+
+resource "docker_container" "fail2ban" {
+  image = docker_image.fail2ban.image_id
+  name = "fail2ban"
+  restart = "always"
+
+  capabilities {
+    add = ["CAP_NET_ADMIN", "CAP_NET_RAW"]
+  }
+
+  env = [
+    "TZ=Europe/Amsterdam",
+    "PUID=1000",
+    "PGID=1000"
+  ]
+
+  mounts {
+    target = "/config"
+    source = "/var/lib/containers/fail2ban/config"
+    type = "bind"
+  }
+
+  mounts {
+    target = "/var/log"
+    source = "/var/log"
+    type = "bind"
+    read_only = true
+  }
+
+  mounts {
+    target = "/remotelogs/nginx"
+    source = "/var/lib/containers/nginx-lb/log"
+    type = "bind"
+    read_only = true
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}

core-os-podman/freshrss.tf

@@ -0,0 +1,44 @@
+data "docker_registry_image" "freshrss" {
+  name = "freshrss/freshrss:latest"
+}
+
+resource "docker_image" "freshrss" {
+  name = data.docker_registry_image.freshrss.name
+  pull_triggers = [data.docker_registry_image.freshrss.sha256_digest]
+}
+
+resource "docker_container" "freshrss" {
+  image = docker_image.freshrss.image_id
+  name = "freshrss"
+  restart = "always"
+  env = [
+    "TZ=Europe/Amsterdam",
+    "CRON_MIN=1,31",
+    "OIDC_ENABLED=0",
+    "FRESHRSS_INSTALL=--api_enabled --base_url https://freshrss.rescla.me --db-base freshrss --db-host 192.168.3.24 --db-password utquCzXEnrjFU2BbDqYT --db-type mysql --db-user freshrss --default_user admin --language en",
+    "FRESHRSS_USER=--api_password CmZpTF3pUYz7rVtFrDTQ --email freshrss@xz1.nl --language en --password CmZpTF3pUYz7rVtFrDTQ --user admin"
+  ]
+
+  mounts {
+    target = "/var/www/FreshRSS/data"
+    source = "/var/lib/containers/freshrss/data"
+    type = "bind"
+  }
+
+  mounts {
+    target = "/var/www/FreshRSS/extensions"
+    source = "/var/lib/containers/freshrss/extensions"
+    type = "bind"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.45"
+  }
+}

core-os-podman/gitea.tf

@@ -17,7 +17,7 @@ resource "docker_container" "gitea" {
 
   env = [
     "GITEA__database__DB_TYPE=mysql",
-    "GITEA__database__HOST=192.168.2.127:3306",
+    "GITEA__database__HOST=192.168.3.24:3306",
     "GITEA__database__NAME=gitea",
     "GITEA__database__USER=gitea",
     "GITEA__database__PASSWD=3uM4kBGaNQDo3tsRa9Nh",
@@ -27,13 +27,13 @@ resource "docker_container" "gitea" {
 
   mounts {
     target = "/var/lib/gitea"
-    source = "/share/appdata/gitea/data"
+    source = "/var/lib/containers/gitea/data"
     type = "bind"
   }
 
   mounts {
     target = "/etc/gitea"
-    source = "/share/appdata/gitea/config"
+    source = "/var/lib/containers/gitea/config"
     type = "bind"
   }
 
@@ -52,7 +52,7 @@ resource "docker_container" "gitea" {
   }
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.131"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.25"
   }
 }

core-os-podman/gluetun.tf

@@ -13,7 +13,7 @@ resource "docker_container" "gluetun" {
   hostname = "proxy"
 
   capabilities {
-    add = ["NET_ADMIN"]
+    add = ["CAP_NET_ADMIN"]
   }
 
   env = [
@@ -25,6 +25,8 @@ resource "docker_container" "gluetun" {
     "WIREGUARD_ADDRESSES=10.159.242.252/32",
     "FIREWALL_VPN_INPUT_PORTS=47836",
     "SERVER_COUNTRIES=Netherlands",
+
+    # 8112 = Deluge
     "FIREWALL_INPUT_PORTS=8112"
   ]
 
@@ -36,7 +38,7 @@ resource "docker_container" "gluetun" {
 
   mounts {
     target = "/gluetun/config"
-    source = "/share/appdata/gluetun"
+    source = "/var/lib/containers/gluetun"
     type = "bind"
   }
 
@@ -44,8 +46,12 @@ resource "docker_container" "gluetun" {
   restart = "always"
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.137"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.27"
+  }
+
+  networks_advanced {
+    name = docker_network.piped.name
   }
 
   lifecycle {

core-os-podman/goaccess.tf_disabled

@@ -0,0 +1,52 @@
+data "docker_registry_image" "goaccess" {
+  name = "allinurl/goaccess:latest"
+}
+
+resource "docker_image" "goaccess" {
+  name = data.docker_registry_image.goaccess.name
+  pull_triggers = [data.docker_registry_image.goaccess.sha256_digest]
+}
+
+resource "docker_container" "goaccess" {
+  image = docker_image.goaccess.image_id
+  name = "goaccess"
+  restart = "always"
+
+  command = [
+    "srv/logs/nginx/access.log",
+    "-a",
+    "--real-time-html",
+    "-p /srv/config/goaccess.conf"
+  ]
+
+  env = [
+    "TZ=Europe/Amsterdam",
+    "PUID=1000",
+    "PGID=1000"
+  ]
+
+  mounts {
+    target = "/srv/config/goaccess.conf"
+    source = "/var/lib/containers/goaccess/goaccess.conf"
+    type = "bind"
+  }
+
+  mounts {
+    target = "/srv/logs/nginx"
+    source = "/var/lib/containers/nginx-lb/log"
+    type = "bind"
+    read_only = true
+  }
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.49"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}

core-os-podman/grafana.tf

@@ -13,15 +13,17 @@ resource "docker_container" "grafana" {
 
   restart = "always"
 
+  user = "1000:1000"
+
   mounts {
     target = "/var/lib/grafana"
-    source = "/share/appdata/grafana"
+    source = "/var/lib/containers/grafana"
     type = "bind"
   }
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.79"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.41"
   }
 
   lifecycle {

core-os-podman/grocy.tf

@@ -20,11 +20,10 @@ resource "docker_container" "grocy" {
 
   mounts {
     target = "/config"
-    source = "/share/appdata/grocy"
+    source = "/var/lib/containers/grocy"
     type = "bind"
   }
 
-
   lifecycle {
     ignore_changes = [
       ulimit,
@@ -33,16 +32,7 @@ resource "docker_container" "grocy" {
   }
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.142"
-  }
-
-  networks_advanced {
-    name = docker_network.grocy.name
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.38"
   }
 }
-
-
-resource "docker_network" "grocy" {
-  name = "grocy"
-}

core-os-podman/homer.tf

@@ -21,17 +21,13 @@ resource "docker_container" "homer" {
   ]
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.153"
-  }
-
-  networks_advanced {
-    name = docker_network.whisper-asr.name
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.22"
   }
 
   mounts {
     target = "/www/assets"
-    source = "/share/appdata/homer"
+    source = "/var/lib/containers/homer"
     type = "bind"
   }
 

core-os-podman/jellyseerr.tf

@@ -19,13 +19,13 @@ resource "docker_container" "jellyseerr" {
   ]
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.135"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.37"
   }
 
   mounts {
     target = "/app/config"
-    source = "/share/appdata/jellyseerr"
+    source = "/var/lib/containers/jellyseerr"
     type = "bind"
   }
 

core-os-podman/lidarr.tf

@@ -21,19 +21,19 @@ resource "docker_container" "lidarr" {
   ]
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.154"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.33"
   }
 
   mounts {
     target = "/config"
-    source = "/share/appdata/lidarr"
+    source = "/var/lib/containers/lidarr"
     type = "bind"
   }
 
   volumes {
     container_path = "/data"
-    volume_name = "truenas-arr"
+    volume_name = docker_volume.truenas-arr.name
   }
 
   lifecycle {

core-os-podman/malla.tf

@@ -0,0 +1,76 @@
+
+data "docker_registry_image" "malla" {
+  name = "ghcr.io/zenitram/malla:latest"
+}
+
+resource "docker_image" "malla" {
+  name = data.docker_registry_image.malla.name
+  pull_triggers = [data.docker_registry_image.malla.sha256_digest]
+}
+
+
+resource "docker_container" "malla-capture" {
+  image = docker_image.malla.image_id
+  name = "malla-capture"
+  restart = "always"
+
+  command = ["/app/.venv/bin/malla-capture"]
+
+  env = [
+    "MALLA_SECRET_KEY=GDESl5REQFGDGXCq7EDkwwwlGC5szJlvTMedTom6ILCuPX1Di6V3JUw8BHSZj6xM",
+    "MALLA_MQTT_BROKER_ADDRESS=mqtt.meshnet.nl",
+    # "MALLA_MQTT_BROKER_ADDRESS=mqtt.meshtastic.org",
+    "MALLA_MQTT_PORT=1883",
+    "MALLA_MQTT_USERNAME=downlink",
+    "MALLA_MQTT_PASSWORD=mq!Down!1nk",
+    "MALLA_DATABASE_FILE=/app/data/meshtastic_history.db"
+  ]
+
+  mounts {
+    target = "/app/data"
+    source = "/var/lib/containers/malla"
+    type = "bind"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}
+
+resource "docker_container" "malla-web" {
+  image = docker_image.malla.image_id
+  name = "malla-web"
+  restart = "always"
+
+  env = [
+    "MALLA_SECRET_KEY=GDESl5REQFGDGXCq7EDkwwwlGC5szJlvTMedTom6ILCuPX1Di6V3JUw8BHSZj6xM",
+    "MALLA_MQTT_BROKER_ADDRESS=mqtt.meshnet.nl",
+    "MALLA_MQTT_PORT=8883",
+    "MALLA_MQTT_USERNAME=boreft",
+    "MALLA_MQTT_PASSWORD=meshboreft",
+    "MALLA_DATABASE_FILE=/app/data/meshtastic_history.db"
+  ]
+
+  command = ["/app/.venv/bin/malla-web-gunicorn"]
+  
+  mounts {
+    target = "/app/data"
+    source = "/var/lib/containers/malla"
+    type = "bind"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.50"
+  }
+}

core-os-podman/mariadb.tf

@@ -7,17 +7,16 @@ resource "docker_image" "mariadb" {
   pull_triggers = [data.docker_registry_image.mariadb.sha256_digest]
 }
 
-resource "docker_network" "mariadb" {
-  name = "mariadb"
-}
-
 resource "docker_container" "mariadb" {
   image = docker_image.mariadb.image_id
   name = "mariadb"
 
+  memory = 5000
+  memory_swap = 5000
+
   mounts {
     target = "/var/lib/mysql"
-    source = "/share/appdata/mariadb"
+    source = "/var/lib/containers/mariadb"
     type = "bind"
   }
 
@@ -28,12 +27,8 @@ resource "docker_container" "mariadb" {
   restart = "always"
 
   networks_advanced {
-    name = docker_network.mariadb.name
-  }
-
-  networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.127"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.24"
   }
 
   lifecycle {

core-os-podman/mealie.tf

@@ -0,0 +1,48 @@
+
+data "docker_registry_image" "mealie" {
+  name = "ghcr.io/mealie-recipes/mealie:v3.1.2"
+}
+
+resource "docker_image" "mealie" {
+  name = data.docker_registry_image.mealie.name
+  pull_triggers = [data.docker_registry_image.mealie.sha256_digest]
+}
+
+resource "docker_container" "mealie" {
+  image = docker_image.mealie.image_id
+  name = "mealie"
+  restart = "always"
+
+  memory = 1000
+  memory_swap = 1000
+
+  env = [
+    "ALLOW_SIGNUP=false",
+    "TZ=Europe/Amsterdam",
+    "PUID=1000",
+    "PGID=1000",
+    "BASE_URL=https://mealie.rescla.me",
+    "SMTP_HOST=mail.smtp2go.com",
+    "SMTP_FROM_EMAIL=mealie@xz1.nl",
+    "SMTP_USER=mealie@xz1.nl",
+    "SMTP_PASSWORD=VDHnraVWlA2P1Hbu"
+  ]
+
+  mounts {
+    target = "/app/data"
+    source = "/var/lib/containers/mealie"
+    type = "bind"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.39"
+  }
+}

core-os-podman/memos.tf

@@ -0,0 +1,39 @@
+data "docker_registry_image" "memos" {
+  name = "neosmemo/memos:stable"
+}
+
+resource "docker_image" "memos" {
+  name = data.docker_registry_image.memos.name
+  pull_triggers = [data.docker_registry_image.memos.sha256_digest]
+}
+
+resource "docker_container" "memos" {
+  image = docker_image.memos.image_id
+  name = "memos"
+  restart = "always"
+
+  log_driver = "local"
+
+  env = [
+    "MEMOS_MODE=prod",
+    "MEMOS_PORT=80"
+  ]
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.40"
+  }
+
+  mounts {
+    target = "/var/opt/memos"
+    source = "/var/lib/containers/memos"
+    type = "bind"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}

core-os-podman/meshtastic.tf

@@ -0,0 +1,28 @@
+data "docker_registry_image" "meshtastic" {
+  name = "ghcr.io/meshtastic/web:latest"
+}
+
+resource "docker_image" "meshtastic" {
+  name = data.docker_registry_image.meshtastic.name
+  pull_triggers = [data.docker_registry_image.meshtastic.sha256_digest]
+}
+
+resource "docker_container" "meshtastic" {
+  image = docker_image.meshtastic.image_id
+  name = "meshtastic"
+  restart = "always"
+
+  log_driver = "local"
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.44"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}

core-os-podman/nginx-lb.tf

@@ -21,34 +21,43 @@ resource "docker_container" "nginx-lb" {
 
   mounts {
     target = "/etc/nginx/nginx.conf"
-    source = "/share/appdata/nginx-lb/nginx.conf"
+    source = "/var/lib/containers/nginx-lb/nginx.conf"
     type = "bind"
   }
 
   mounts {
     target = "/etc/nginx/config"
-    source = "/share/appdata/nginx-lb/conf"
+    source = "/var/lib/containers/nginx-lb/conf"
     type = "bind"
   }
 
   mounts {
     target = "/etc/nginx/user_conf.d"
-    source = "/share/appdata/nginx-lb/user_conf.d"
+    source = "/var/lib/containers/nginx-lb/user_conf.d"
+    type = "bind"
+  }
+  
+  mounts {
+    target = "/etc/letsencrypt"
+    source = "/var/lib/containers/nginx-lb/secrets"
     type = "bind"
   }
 
-
   mounts {
-    target = "/etc/letsencrypt"
-    source = "/share/appdata/nginx-lb/secrets"
+    target = "/var/log/nginx"
+    source = "/var/lib/containers/nginx-lb/log"
     type = "bind"
   }
 
   restart = "always"
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.115"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.29"
+  }
+
+  networks_advanced {
+    name = docker_network.nginx-lb.name
   }
 
   lifecycle {

core-os-podman/node-red.tf

@@ -11,9 +11,12 @@ resource "docker_container" "node-red" {
   image = docker_image.node-red.image_id
   name = "node-red"
 
+  memory = 1000
+  memory_swap = 1000
+
   mounts {
     target = "/data"
-    source = "/share/appdata/node-red"
+    source = "/var/lib/containers/node-red"
     type = "bind"
   }
 
@@ -24,8 +27,8 @@ resource "docker_container" "node-red" {
   restart = "always"
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.124"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.21"
   }
 
   lifecycle {

core-os-podman/ntfy.tf

@@ -0,0 +1,61 @@
+data "docker_registry_image" "ntfy" {
+  name = "binwiederhier/ntfy"
+}
+
+resource "docker_image" "ntfy" {
+  name = data.docker_registry_image.ntfy.name
+  pull_triggers = [data.docker_registry_image.ntfy.sha256_digest]
+}
+
+resource "docker_container" "ntfy" {
+  image = docker_image.ntfy.image_id
+  name = "ntfy"
+
+  restart = "always"
+
+  env = [
+    "TZ=Europe/Amsterdam"
+  ]
+
+  user = "1000:1000"
+
+  command = ["serve"]
+
+  mounts {
+    target = "/etc/ntfy/server.yml"
+    source = "/var/lib/containers/ntfy/server.yml"
+    type = "bind"
+    read_only = true
+  }
+
+  mounts {
+    target = "/etc/ntfy/templates"
+    source = "/var/lib/containers/ntfy/templates"
+    type = "bind"
+    read_only = true
+  }
+
+  mounts {
+    target = "/var/cache/ntfy"
+    source = "/var/lib/containers/ntfy/cache"
+    type = "bind"
+  }
+
+  mounts {
+    target = "/var/lib/ntfy/auth"
+    source = "/var/lib/containers/ntfy/auth"
+    type = "bind"
+  }
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.51"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}

core-os-podman/ofelia.tf

@@ -23,7 +23,7 @@ resource "docker_container" "ofelia" {
 
   mounts {
     target = "/etc/ofelia"
-    source = "/share/appdata/ofelia"
+    source = "/var/lib/containers/ofelia"
     type = "bind"
   }
 

core-os-podman/photoprism-tineke.tf

@@ -4,6 +4,9 @@ resource "docker_container" "photoprism-tineke" {
 
   restart = "always"
 
+  memory = 10000
+  memory_swap = 10000
+
   env = [
     "PHOTOPRISM_UPLOAD_NSFW=true",
     "PHOTOPRISM_ADMIN_PASSWORD=pyjm73tM%UPa8B5t5zhWX*F",
@@ -11,7 +14,7 @@ resource "docker_container" "photoprism-tineke" {
     "PHOTOPRISM_HTTP_HOST=192.168.3.11",
     "PHOTOPRISM_DISABLE_TLS=true",
     "PHOTOPRISM_DATABASE_DRIVER=mysql",
-    "PHOTOPRISM_DATABASE_SERVER=192.168.2.127",
+    "PHOTOPRISM_DATABASE_SERVER=192.168.3.24",
     "PHOTOPRISM_DATABASE_NAME=photoprism_tineke",
     "PHOTOPRISM_DATABASE_USER=photoprism",
     "PHOTOPRISM_DATABASE_PASSWORD=YL43KVRekqUjbgPLGzz",

core-os-podman/photoprism.tf

@@ -13,6 +13,9 @@ resource "docker_container" "photoprism" {
 
   restart = "always"
 
+  memory = 10000
+  memory_swap = 10000
+
   env = [
     "PHOTOPRISM_UPLOAD_NSFW=true",
     "PHOTOPRISM_ADMIN_PASSWORD=UAmpojHADcS5aB",
@@ -20,7 +23,7 @@ resource "docker_container" "photoprism" {
     "PHOTOPRISM_HTTP_HOST=192.168.3.12",
     "PHOTOPRISM_DISABLE_TLS=true",
     "PHOTOPRISM_DATABASE_DRIVER=mysql",
-    "PHOTOPRISM_DATABASE_SERVER=192.168.2.127",
+    "PHOTOPRISM_DATABASE_SERVER=192.168.3.24",
     "PHOTOPRISM_DATABASE_NAME=photoprism",
     "PHOTOPRISM_DATABASE_USER=photoprism",
     "PHOTOPRISM_DATABASE_PASSWORD=YL43KVRekqUjbgPLGzz",

core-os-podman/piped.tf

@@ -0,0 +1,144 @@
+data "docker_registry_image" "piped-backend" {
+  name = "1337kavin/piped:latest"
+}
+
+data "docker_registry_image" "piped-frontend" {
+  name = "1337kavin/piped-frontend:latest"
+}
+
+data "docker_registry_image" "piped-proxy" {
+  name = "1337kavin/piped-proxy:latest"
+}
+
+data "docker_registry_image" "piped-bg-helper" {
+  name = "1337kavin/bg-helper-server:latest"
+}
+
+resource "docker_image" "piped-backend" {
+  name = data.docker_registry_image.piped-backend.name
+  pull_triggers = [data.docker_registry_image.piped-backend.sha256_digest]
+}
+
+
+resource "docker_image" "piped-frontend" {
+  name = data.docker_registry_image.piped-frontend.name
+  pull_triggers = [data.docker_registry_image.piped-frontend.sha256_digest]
+}
+
+resource "docker_image" "piped-proxy" {
+  name = data.docker_registry_image.piped-proxy.name
+  pull_triggers = [data.docker_registry_image.piped-proxy.sha256_digest]
+}
+
+resource "docker_image" "piped-bg-helper" {
+  name = data.docker_registry_image.piped-bg-helper.name
+  pull_triggers = [data.docker_registry_image.piped-bg-helper.sha256_digest]
+}
+
+resource "docker_network" "piped" {
+  name = "piped"
+}
+
+resource "docker_container" "piped-backend" {
+  image = docker_image.piped-backend.image_id
+  name = "piped-backend"
+  hostname = "piped-backend"
+  restart = "always"
+
+  memory = 1000
+  memory_swap = 1000
+
+  log_driver = "local"
+
+  networks_advanced {
+    name = docker_network.nginx-lb.name
+  }
+
+  networks_advanced {
+    name = docker_network.piped.name
+  }
+
+  depends_on = [
+    docker_container.gluetun,
+    docker_container.postgres
+  ]
+
+  mounts {
+    target = "/app/config.properties"
+    source = "/var/lib/containers/piped/config.properties"
+    type = "bind"
+    read_only = true
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}
+
+
+resource "docker_container" "piped-frontend" {
+  image = docker_image.piped-frontend.image_id
+  name = "piped-frontend"
+  hostname = "piped-frontend"
+
+  restart = "always"
+
+  log_driver = "local"
+
+  env = [
+    "BACKEND_HOSTNAME=piped-api.rescla.me"
+  ]
+
+  networks_advanced {
+    name = docker_network.nginx-lb.name
+  }
+  
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}
+
+resource "docker_container" "piped-proxy" {
+  image = docker_image.piped-proxy.image_id
+  name = "piped-proxy"
+  hostname = "piped-proxy"
+  restart = "always"
+
+  log_driver = "local"
+
+  networks_advanced {
+    name = docker_network.nginx-lb.name
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}
+
+resource "docker_container" "piped-bg-helper" {
+  image = docker_image.piped-bg-helper.image_id
+  name = "piped-bg-helper"
+  restart = "always"
+
+  log_driver = "local"
+
+  networks_advanced {
+    name = docker_network.piped.name
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}

core-os-podman/postgres.tf

@@ -0,0 +1,49 @@
+data "docker_registry_image" "postgres" {
+  name = "pgautoupgrade/pgautoupgrade:16-alpine"
+}
+
+resource "docker_image" "postgres" {
+  name = data.docker_registry_image.postgres.name
+  pull_triggers = [data.docker_registry_image.postgres.sha256_digest]
+}
+
+resource "docker_container" "postgres" {
+  image = docker_image.postgres.image_id
+  name = "postgres"
+  hostname = "postgres"
+
+  restart = "always"
+
+  memory = 1000
+  memory_swap = 1000
+
+  log_driver = "local"
+
+  env = [
+    "POSTGRES_DB=piped",
+    "POSTGRES_USER=piped",
+    "POSTGRES_PASSWORD=YDoVrAXCxim%lOK8^"
+  ]
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.43"
+  }
+
+  networks_advanced {
+    name = docker_network.piped.name
+  }
+
+  mounts {
+    target = "/var/lib/postgresql/data"
+    source = "/var/lib/containers/postgres/data"
+    type = "bind"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}

core-os-podman/prometheus.tf

@@ -11,25 +11,33 @@ resource "docker_container" "prometheus" {
   image = docker_image.prometheus.image_id
   name = "prometheus"
 
-  command = ["--config.file=/etc/prometheus/prometheus.yml","--storage.tsdb.path=/prometheus", "--web.console.libraries=/usr/share/prometheus/console_libraries","--web.console.templates=/usr/share/prometheus/consoles", "--storage.tsdb.retention.time=2y"]
+  command = [
+    "--config.file=/etc/prometheus/prometheus.yml",
+    "--storage.tsdb.path=/prometheus",
+    "--web.console.libraries=/usr/share/prometheus/console_libraries",
+    "--web.console.templates=/usr/share/prometheus/consoles",
+    "--storage.tsdb.retention.time=5y"
+  ]
+
+  user = "1000:1000"
 
   mounts {
-    target = "/etc/prometheus"
-    source = "/share/appdata/prometheus/config"
+    target = "/etc/prometheus/prometheus.yml"
+    source = "/var/lib/containers/prometheus/config/prometheus.yml"
     type = "bind"
   }
 
   mounts {
     target = "/prometheus"
-    source = "/share/appdata/prometheus/data"
+    source = "/var/lib/containers/prometheus/data"
     type = "bind"
   }
 
   restart = "always"
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.80"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.42"
   }
 
   lifecycle {

core-os-podman/prowlarr.tf

@@ -22,13 +22,13 @@ resource "docker_container" "prowlarr" {
   ]
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.141"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.34"
   }
 
   mounts {
     target = "/config"
-    source = "/share/appdata/prowlarr"
+    source = "/var/lib/containers/prowlarr"
     type = "bind"
   }
 

core-os-podman/radarr.tf

@@ -21,19 +21,19 @@ resource "docker_container" "radarr" {
   ]
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.138"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.35"
   }
 
   mounts {
     target = "/config"
-    source = "/share/appdata/radarr"
+    source = "/var/lib/containers/radarr"
     type = "bind"
   }
 
   volumes {
     container_path = "/data"
-    volume_name = "truenas-arr"
+    volume_name = docker_volume.truenas-arr.name
   }
 
   lifecycle {

core-os-podman/ripe-atlas.tf

@@ -0,0 +1,46 @@
+data "docker_registry_image" "ripe-atlas" {
+  name = "jamesits/ripe-atlas:latest"
+}
+
+resource "docker_image" "ripe-atlas" {
+  name = data.docker_registry_image.ripe-atlas.name
+  pull_triggers = [data.docker_registry_image.ripe-atlas.sha256_digest]
+}
+
+resource "docker_container" "ripe-atlas" {
+  image = docker_image.ripe-atlas.image_id
+  name = "ripe-atlas"
+  restart = "always"
+
+  log_driver = "local"
+
+  mounts {
+    target = "/etc/ripe-atlas"
+    source = "/var/lib/containers/atlas-probe/etc"
+    type = "bind"
+  }
+
+  mounts {
+    target = "/run/ripe-atlas"
+    source = "/var/lib/containers/atlas-probe/run"
+    type = "bind"
+  }
+
+  mounts {
+    target = "/var/spool/ripe-atlas"
+    source = "/var/lib/containers/atlas-probe/spool"
+    type = "bind"
+  }
+
+  capabilities {
+    drop = ["ALL"]
+    add = ["CAP_CHOWN", "CAP_SETUID", "CAP_SETGID", "CAP_DAC_OVERRIDE", "CAP_NET_RAW", "CAP_KILL", "CAP_FOWNER"]
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}

core-os-podman/rssbridge.tf

@@ -0,0 +1,36 @@
+data "docker_registry_image" "rssbridge" {
+  name = "rssbridge/rss-bridge:latest"
+}
+
+resource "docker_image" "rssbridge" {
+  name = data.docker_registry_image.rssbridge.name
+  pull_triggers = [data.docker_registry_image.rssbridge.sha256_digest]
+}
+
+resource "docker_container" "rssbridge" {
+  image = docker_image.rssbridge.image_id
+  name = "rssbridge"
+  restart = "always"
+
+  env = [
+    "TZ=Europe/Amsterdam"
+  ]
+
+  mounts {
+    target = "/config"
+    source = "/var/lib/containers/rssbridge"
+    type = "bind"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.47"
+  }
+}

core-os-podman/sabnzdb.tf

@@ -22,19 +22,19 @@ resource "docker_container" "sabnzdb" {
 
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.140"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.32"
   }
 
   mounts {
     target = "/config"
-    source = "/share/appdata/sabnzdb"
+    source = "/var/lib/containers/sabnzdb"
     type = "bind"
   }
 
   volumes {
     container_path = "/data"
-    volume_name = "truenas-arr"
+    volume_name = docker_volume.truenas-arr.name
   }
 
   lifecycle {

core-os-podman/searxng.tf

@@ -0,0 +1,87 @@
+
+data "docker_registry_image" "searxng" {
+  name = "searxng/searxng:latest"
+}
+
+data "docker_registry_image" "searxng-valkey" {
+  name = "valkey/valkey:9"
+}
+
+resource "docker_image" "searxng" {
+  name = data.docker_registry_image.searxng.name
+  pull_triggers = [data.docker_registry_image.searxng.sha256_digest]
+}
+
+resource "docker_image" "searxng-valkey" {
+  name = data.docker_registry_image.searxng-valkey.name
+  pull_triggers = [data.docker_registry_image.searxng-valkey.sha256_digest]
+}
+
+resource "docker_network" "searxng" {
+  name = "searxng"
+}
+
+resource "docker_container" "searxng-valkey" {
+  image   = docker_image.searxng-valkey.image_id
+  name    = "searxng-valkey"
+  restart = "always"
+  hostname = "valkey"
+
+  command = ["valkey-server", "--save 30 1", "--loglevel warning"]
+
+  mounts {
+    target = "/data"
+    source = "/var/lib/containers/searxng/valkey-data"
+    type = "bind"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+
+  networks_advanced {
+    name = docker_network.searxng.name
+  }
+}
+
+resource "docker_container" "searxng" {
+  image = docker_image.searxng.image_id
+  name = "searxng"
+  restart = "always"
+
+  env = [
+    "TZ=Europe/Amsterdam",
+    "SEARXNG_HOSTNAME=search.rescla.me"
+  ]
+
+  mounts {
+    target = "/var/cache/searxng"
+    source = "/var/lib/containers/searxng/searxng-data"
+    type = "bind"
+  }
+
+  mounts {
+    target = "/etc/searxng"
+    source = "/var/lib/containers/searxng/data"
+    type = "bind"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.52"
+  }
+
+  networks_advanced {
+    name = docker_network.searxng.name
+  }
+}

core-os-podman/smokeping.tf

@@ -20,21 +20,21 @@ resource "docker_container" "smokeping" {
 
   mounts {
     target = "/config"
-    source = "/share/appdata/smokeping/config"
+    source = "/var/lib/containers/smokeping/config"
     type = "bind"
   }
 
   mounts {
     target = "/data"
-    source = "/share/appdata/smokeping/data"
+    source = "/var/lib/containers/smokeping/data"
     type = "bind"
   }
 
   restart = "always"
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.126"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.26"
   }
 
   dns = ["172.20.0.0"]

core-os-podman/sonarr.tf

@@ -21,19 +21,19 @@ resource "docker_container" "sonarr" {
   ]
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.136"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.36"
   }
 
   mounts {
     target = "/config"
-    source = "/share/appdata/sonarr"
+    source = "/var/lib/containers/sonarr"
     type = "bind"
   }
 
   volumes {
     container_path = "/data"
-    volume_name = "truenas-arr"
+    volume_name = docker_volume.truenas-arr.name
   }
 
   lifecycle {

core-os-podman/synapse.tf

@@ -0,0 +1,50 @@
+/**
+Running for the first time:
+
+docker run -it --rm \
+    --mount type=bind,src=/var/lib/containers/synapse,dst=/data \
+    -e SYNAPSE_SERVER_NAME=matrix.rescla.me \
+    -e SYNAPSE_REPORT_STATS=no \
+    ghcr.io/element-hq/synapse:latest generate
+
+
+ */
+
+data "docker_registry_image" "synapse" {
+  name = "ghcr.io/element-hq/synapse:latest"
+}
+
+resource "docker_image" "synapse" {
+  name = data.docker_registry_image.synapse.name
+  pull_triggers = [data.docker_registry_image.synapse.sha256_digest]
+}
+
+resource "docker_container" "synapse" {
+  image = docker_image.synapse.image_id
+  name = "synapse"
+  restart = "always"
+
+  depends_on = [docker_container.postgres]
+
+  env = [
+    "TZ=Europe/Amsterdam"
+  ]
+
+  mounts {
+    target = "/data"
+    source = "/var/lib/containers/synapse"
+    type = "bind"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.48"
+  }
+}

core-os-podman/traccar.tf

@@ -1,5 +1,5 @@
 data "docker_registry_image" "traccar" {
-  name = "traccar/traccar"
+  name = "traccar/traccar:debian"
 }
 
 resource "docker_image" "traccar" {
@@ -13,25 +13,21 @@ resource "docker_container" "traccar" {
 
   mounts {
     target = "/opt/traccar/logs"
-    source = "/share/appdata/traccar/logs"
+    source = "/var/lib/containers/traccar/logs"
     type = "bind"
   }
 
   mounts {
     target = "/opt/traccar/conf/traccar.xml"
-    source = "/share/appdata/traccar/traccar.xml"
+    source = "/var/lib/containers/traccar/traccar.xml"
     type = "bind"
   }
 
   restart = "always"
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.113"
-  }
-
-  networks_advanced {
-    name = docker_network.mariadb.name
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.23"
   }
 
   lifecycle {

core-os-podman/unifi.tf

@@ -11,17 +11,20 @@ resource "docker_container" "unifi" {
   image = docker_image.unifi.image_id
   name = "unifi"
 
+  memory = 3000
+  memory_swap = 3000
+
   mounts {
     target = "/unifi"
-    source = "/share/appdata/unifi"
+    source = "/var/lib/containers/unifi"
     type = "bind"
   }
 
   restart = "always"
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.67"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.30"
   }
 
   lifecycle {

core-os-podman/uptime-kuma.tf

@@ -15,13 +15,13 @@ resource "docker_container" "uptime-kuma" {
 
   mounts {
     target = "/app/data"
-    source = "/share/appdata/uptime-kuma"
+    source = "/var/lib/containers/uptime-kuma"
     type = "bind"
   }
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.133"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.31"
   }
 
   lifecycle {

core-os-podman/vikunja.tf

@@ -16,7 +16,7 @@ resource "docker_container" "vikunja" {
 
   env = [
     "VIKUNJA_SERVICE_PUBLICURL=https://vikunja.rescla.me",
-    "VIKUNJA_DATABASE_HOST=192.168.2.127",
+    "VIKUNJA_DATABASE_HOST=192.168.3.24",
     "VIKUNJA_DATABASE_PASSWORD=4PU^B%Kz8R*8!cT8R",
     "VIKUNJA_DATABASE_TYPE=mysql",
     "VIKUNJA_DATABASE_USER=vikunja",
@@ -33,13 +33,13 @@ resource "docker_container" "vikunja" {
   ]
 
   networks_advanced {
-    name = docker_network.bridge.name
-    ipv4_address = "192.168.2.143"
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.28"
   }
 
   mounts {
     target = "/files"
-    source = "/share/appdata/vikunja"
+    source = "/var/lib/containers/vikunja"
     type = "bind"
   }
 

core-os-podman/yamtrack.tf

@@ -0,0 +1,77 @@
+data "docker_registry_image" "yamtrack" {
+  name = "ghcr.io/fuzzygrim/yamtrack"
+}
+
+data "docker_registry_image" "yamtrack-redis" {
+  name = "redis:7-alpine"
+}
+
+resource "docker_image" "yamtrack" {
+  name = data.docker_registry_image.yamtrack.name
+  pull_triggers = [data.docker_registry_image.yamtrack.sha256_digest]
+}
+
+resource "docker_image" "yamtrack-redis" {
+  name = data.docker_registry_image.yamtrack-redis.name
+  pull_triggers = [data.docker_registry_image.yamtrack-redis.sha256_digest]
+}
+
+resource "docker_network" "yamtrack" {
+  name = "yamtrack"
+}
+
+resource "docker_container" "yamtrack-redis" {
+  image = docker_image.yamtrack-redis.image_id
+  name = "yamtrack-redis"
+  restart = "always"
+  hostname = "redis"
+
+  log_driver = "local"
+
+  mounts {
+    target = "/data"
+    source = "/var/lib/containers/yamtrack/data"
+    type = "bind"
+  }
+
+  networks_advanced {
+    name = docker_network.yamtrack.name
+  }
+}
+
+
+resource "docker_container" "yamtrack" {
+  image = docker_image.yamtrack.image_id
+  name = "yamtrack"
+  restart = "always"
+
+  log_driver = "local"
+
+  env = [
+    "TZ=Europe/Amsterdam",
+    "SECRET=dx43FYAAD1ZULJ1G0&8*hP6A5!rzXSB7Z0B9DdRlBwlgsv2W2CToekYP6UNdnUv2",
+    "REDIS_URL=redis://redis:6379"
+  ]
+
+  networks_advanced {
+    name = docker_network.container-public.name
+    ipv4_address = "192.168.3.53"
+  }
+
+  networks_advanced {
+    name = docker_network.yamtrack.name
+  }
+
+  mounts {
+    target = "/yamtrack/db"
+    source = "/var/lib/containers/yamtrack/db"
+    type = "bind"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      ulimit,
+      log_opts
+    ]
+  }
+}