Changes:
- Reviewed all docker-compose files to identify required variables
- Updated all .env.example files to include ONLY variables used in their respective compose files
- Changed all placeholder values to empty strings for cleaner configuration
- Fixed variable name inconsistency: DOWNLOADS_DIR -> DOWNLOAD_DIR (to match main .env)
- Removed unnecessary variables that aren't used by the compose files
All .env.example files now:
- Contain only the variables actually used in the stack
- Have empty values instead of example placeholders
- Match the variable names used in docker-compose files
This ensures clean, minimal .env files for each stack without any extraneous variables or confusing placeholder values.
- Added STACKS_DIR to dashboards/.env.example (needed for homepage volume mount)
- Added HOMEPAGE_VAR_TITLE to dashboards/.env.example
- Added CODE_SERVER_PASSWORD and CODE_SERVER_SUDO_PASSWORD to infrastructure/.env.example
These variables are required by the docker-compose files but were missing from the .env.example files, causing Docker Compose to fail with 'variable is not set' errors.
Major improvements to environment variable management:
1. Added .env.example files for ALL stacks
- Each stack now has its own .env.example with only required variables
- Variables include comments explaining their purpose
- Examples: core, dockge, infrastructure, dashboards, arcane, media, media-management, transcoders, monitoring, sablier, utilities, productivity, wikis, vpn, homeassistant, alternatives
2. Created .env.global generation
- Generates /opt/stacks/.env.global with all variables
- Strips comments and blank lines for clean output
- Available to all stacks for reference
3. Improved variable replacement strategy
- Variable replacement now ONLY targets labels and x-dockge sections in docker-compose files
- Configuration files (traefik, authelia) still get full variable replacement
- Uses Python script for precise section detection
- Preserves environment variables and volume mounts as-is
4. New deployment approach
- Each stack copies .env.example to .env
- Values populated from main ~/EZ-Homelab/.env file
- No more manual sed commands to remove unused variables
- Consistent approach across all deployment functions
5. Updated deployment functions
- deploy_dockge, deploy_core, deploy_infrastructure, deploy_dashboards, deploy_arcane, deploy_sablier_stack
- All now use process_stack_env() for clean .env handling
- All use updated localize_yml_file() for targeted variable replacement
Benefits:
- Clean, minimal .env files for each stack
- No unnecessary variables or comments in deployed .env files
- Variables in compose files preserved for Docker Compose to handle
- Easier to understand what each stack needs
- Uniform deployment approach across all stacks
- Added ARCANE_ENCRYPTION_KEY and ARCANE_JWT_SECRET to .env.example
- Created deploy_arcane() function in ez-homelab.sh
- Auto-generate Arcane secrets after Authelia secrets
- Deploy Arcane in both Option 2 (Core Server) and Option 3 (Additional Server)
- Added Arcane docker-compose.yml configuration
Changes:
- docker-compose/core/docker-compose.yml: Added pihole service with full Traefik configuration
- docker-compose/infrastructure/docker-compose.yml: Removed pihole service
- docker-compose/dockge/docker-compose.yml.template: Deleted (no longer needed)
Pihole is now part of core infrastructure alongside Traefik, Authelia, and DuckDNS.
This ensures DNS services are always available on the core server.
Issue: Option 3 deployment failed because traefik-network wasn't created,
but the cleanup function didn't properly strip network references from files.
Changes:
- scripts/ez-homelab.sh: Add traefik-network creation in Step 2
(Network is harmless if unused - prevents docker compose errors)
- Improve sed patterns in configure_remote_server_routing():
* Use anchored patterns (^ and $) to match exact lines
* Fix network removal regex to match indentation correctly
The traefik-network will exist but remain unused on additional servers.
Services are accessed via core Traefik's manual HTTP routes.
- Add ports 80/443 to remote Traefik template
- Enable API access (insecure=true) for debugging
- Update configure_remote_server_routing to use HTTP-only config
- Change entrypoint from websecure to web
- Remove TLS cert resolver references
- Remove authelia middleware references
- Replace Docker TLS provider with manual HTTP routes
- Core Traefik now uses file provider with direct URLs
- Fixes 404/gateway timeout errors on remote services
- Routes HTTPS from core to HTTP on remote servers
- Fix port in routes (dozzle uses 8085, not 8082)
Resolves issues with remote server service accessibility.
Major features:
- Automated SSH key setup between remote and core servers
- Docker TLS configuration with shared CA certificates
- Automatic deployment of Dockge, Traefik, Sablier, and Infrastructure stacks
- Copy all stacks (except core) to remote server for on-demand deployment
- New standalone Traefik stack for remote server container discovery
- Locale-aware SSH/SCP commands to handle Raspberry Pi warnings
- Variable expansion support in .env files (${VAR} references)
- Comprehensive error handling and verbose deployment logging
Technical improvements:
- setup_ssh_key_to_core() - Automated RSA 4096-bit key generation and installation
- setup_multi_server_tls() - Fetch shared CA from core server via SSH
- copy_all_stacks_for_remote() - Deploy all stacks except core
- deploy_traefik_stack() - Local Traefik for container discovery
- Enhanced localization with envsubst support
- Docker network creation (traefik-network, homelab-network)
- Password authentication with special character handling
Fixes:
- Fixed SSH key path handling for non-root users
- Fixed SCP exit code checking (was checking grep instead of scp)
- Fixed CA file detection with proper test commands
- Removed unnecessary prepare_deployment() function call
- Added ACTUAL_USER variable initialization for remote deployments
Introduce multi-server architecture documentation and reorganize README content. Top-level README now documents Core vs Remote server roles, links to local docs instead of wiki pages, and highlights Traefik/Sablier multi-server behavior. docker-compose/README.md was rewritten to be a template-style reference with single- and multi-server deployment guidance, Traefik label examples, and sablier usage; dockge README was moved into docker-compose/dockge/. docker-compose/core/README.md was updated to describe core responsibilities, shared CA artifacts, and startup order for multi-server deployments. Several obsolete/duplicated docs and action reports were removed and a new multi-server deployment doc was added to centralize on-demand/remote service guidance. Overall this cleans up legacy docs and documents the multi-server workflow and TLS/shared-CA requirements.
- Replace hardcoded password in code-server config with ${CODE_SERVER_PASSWORD}
- Replace domain kelin-hass.duckdns.org with yourdomain.duckdns.org in docs
- Replace domain kelinreij.duckdns.org with yourdomain.duckdns.org in homepage config
- Replace personal emails with example addresses
- Replace DuckDNS token and credentials in markup.yml with placeholders
- Replace Let's Encrypt account numbers with placeholders
Co-authored-by: kelinfoxy <67766943+kelinfoxy@users.noreply.github.com>
- Changed Dozzle service port from 8085 to 8080 (correct port)
- Removed authelia config template files (no longer needed)
- Removed db.sqlite3 runtime data file
- Move users_database.yml template from config/ to secrets/ folder
- Authelia configuration expects users file at /secrets/users_database.yml
- Replace hardcoded values in configuration.yml with variables:
- jwt_secret, session secret, storage encryption_key
- Domain references (kelinreij.duckdns.org → ${DOMAIN})
- Update deploy script to not move config files (already in subdirectories)
- Fix sed command path to target config/configuration.yml
- Remove unnecessary mkdir and mv commands from deploy_core()
This ensures Authelia uses the correctly generated file with user credentials.
- Replace hardcoded placeholders with Docker Compose variables
- docker-compose.yml: Use ${DUCKDNS_SUBDOMAINS}, ${DUCKDNS_TOKEN}, ${DOMAIN}, ${SERVER_IP}
- traefik.yml: Use ${DEFAULT_EMAIL} for ACME email
- users_database.yml: Use ${AUTHELIA_ADMIN_USER}, ${AUTHELIA_ADMIN_EMAIL}, ${AUTHELIA_ADMIN_PASSWORD_HASH}
- sablier/docker-compose.yml: Fix to use ${DOMAIN} instead of {{DUCKDNS_DOMAIN}}
This aligns with the correct strategy:
- Docker-compose files use variables (${VAR})
- .env files use placeholders or actual values
- Implement multi-server Traefik + Sablier architecture
- Add label-based automatic service discovery
- Create separate Sablier stack deployment
- Add remote server deployment workflow (Option 3)
- Add 9 new functions for multi-server management
- Remove deprecated config-templates folder
- Replace hardcoded private data with placeholders
- Update backup timestamp format to YY_MM_DD_hh_mm
- Add markup.yml to .gitignore
Breaking changes:
- Removed Sablier from core docker-compose.yml (now separate stack)
- Config templates moved from config-templates/ to docker-compose/core/
- REQUIRED_VARS now dynamic based on deployment type
- Update localize_users_database_file to properly resolve nested variables in AUTHELIA_ADMIN_EMAIL
- Fix template to use correct AUTHELIA_* variables instead of DEFAULT_* variables
- Update deploy-core.sh to only process files containing variables and fix .env path
- Fix file permissions for authelia config files
- Reorganize Authelia configuration files
- Add new dynamic routing files for Traefik
- Update various service docker-compose files
- Remove outdated templates and scripts
- Add traefik.docker.network=traefik-network label to all local services with traefik.enable=true
- Ensures consistent network selection for Traefik IP discovery
- Prevents routing conflicts when services are on multiple networks
- Updated 12 docker-compose files with 32+ service labels
- Maintains dual network access (homelab-network + traefik-network) for web UIs
- Add traefik.docker.network=traefik-network label to homepage service
- Prevent Traefik from using wrong IP from homelab-network
- Resolve 504 Gateway Timeout issues after authentication
- Update various docker-compose configurations and templates
- Clean up unused configuration files
- Change sablier volumes to use ./shared-ca:/certs:ro (matches script generation)
- Fix x-dockge URLs to use http:// for local access and correct variable syntax
- Ensure consistency with local working setup
- Generate shared CA during core deployment for consistent trust across servers
- Modify setup_docker_tls() to use shared CA instead of per-server CAs
- Update share_certs_with_core() to copy shared CA from core server
- Re-enable TLS verification (DOCKER_TLS_VERIFY=1) in Sablier
- Fix Sablier certificate mounting for proper TLS connection
- Add docker-tls/ to .gitignore to prevent certificate leaks
- Update documentation for shared CA approach
- Rename transcoders/docker-compose.yaml to .yml
- Rename wikis/docker-compose.yaml to .yml
- Maintains consistency with other docker-compose files in the project
Standardizes file extensions across all Docker Compose configurations.
- Add Sablier middleware configuration to Jupyter in productivity stack
- Update .gitignore to properly ignore service data files
- Ignore database files, logs, settings.json, and key files
Jupyter now supports on-demand startup via Sablier middleware.
- Add Sablier middleware to all 32 services across stacks
- Update vaultwarden port from 80 to 8091 to avoid conflicts
- Add tdarr-server and unmanic services with lazy loading
- Optimize health checks (wget for some services, dozzle built-in)
- Update Traefik routers and service definitions
- Update port documentation
All services now support on-demand startup via Sablier middleware.
- Add health checks to all services using Sablier lazy loading
- Utilities stack: Backrest, Duplicati, Form.io, Vaultwarden
- Productivity stack: Nextcloud, WordPress, Gitea, BookStack, MediaWiki
- Media Management stack: Sonarr, Radarr, Prowlarr, Jellyseerr
- Infrastructure stack: Dozzle, Glances, Code Server
- Dashboards stack: Homarr
- Health checks use curl to service endpoints with 30s intervals
- Appropriate start_period delays for service initialization
- This resolves Sablier warnings about missing health checks
- Change MediaWiki from port 8084 to 8086 to resolve conflict with TasmoAdmin
- Update Traefik loadbalancer port for MediaWiki
- Add MediaWiki to ports-in-use.md documentation
- TasmoAdmin now uses port 8084, MediaWiki uses port 8086
- Resolve port conflicts: TasmoAdmin (8084), Form.io (3002), Gitea (3010)
- Add missing Authelia SSO and Sablier lazy loading to utilities stack
- Standardize Form.io labels to match TRAEFIK CONFIGURATION guidelines
- Reorganize ports-in-use.md with stack-based table and proper column order
- Remove Dokuwiki deployment from ez-homelab.sh (already in productivity stack)
- Update service restart policies for lazy loading compatibility
- Remove authelia middleware from Vaultwarden (Bitwarden) for app compatibility
- Simplify all compose files to use only homelab-network and traefik-network
- Remove unnecessary isolated networks (nextcloud-network, wordpress-network, etc.)
- Remove monitoring-network, formio-network, and media-network
- All services now communicate through the unified homelab-network
- Maintain traefik-network for proxied services only
- Uncomment Authelia middleware for Vaultwarden (was disabled for app compatibility but should use SSO by default)
- Verify all other services have Authelia middleware except:
- Jellyfin (media app access)
- Plex (media app access)
- Authelia itself (authentication service)
- All x-dockge sections are properly formatted with urls list
- Replace all ${VARIABLE:-default} with ${VARIABLE} in compose files
- Ensure explicit variable requirements without default values
- Updated 10 docker-compose.yml files across all stacks
- Made reset-ondemand-services.sh executable
- Changed Nextcloud port from 80 to 8099
- Changed Mealie port from 9000 to 9001
- Changed WordPress port from 80 to 8089
- Changed Gitea port from 3000 to 3011
- Changed DokuWiki port from 80 to 8088
- Changed BookStack port from 80 to 6876
- Updated all corresponding Traefik loadbalancer ports
- Resolved conflicts with external host services in external-host-production.yml
- Changed all Sablier groups to ${SERVER_HOSTNAME}-arr for coordinated lazy loading
- Moved x-dockge URLs to top-level section with urls list format
- Added both HTTPS and localhost URLs for service discovery
- Updated guidelines and instructions to reflect new x-dockge format
