Rename role for intersect docker applications

2020-04-26 13:56:26 +01:00
parent 05c7690b83
commit 92c85904bd
54 changed files with 1 additions and 1 deletions
--- a/ansible/roles/intersect-docker/files/calibre/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/calibre/docker-compose.yml
@ -0,0 +1,18 @@
+version: "2.3"
+services:
+  calibre:
+    image: linuxserver/calibre-web:0.6.6-ls58
+    container_name: calibre
+    environment:
+      - PUID={{ docker_user.id }}
+      - PGID={{ docker_user.id }}
+      - TZ=Europe/London
+    restart: unless-stopped
+    volumes:
+      - ./config:/config
+      - /srv/nextcloud-data/data/jake/files/EBooks:/books:ro
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.calibre.rule=Host(`calibre.jakehoward.tech`)"
+      - "traefik.http.routers.calibre.tls=true"
+      - "traefik.http.routers.calibre.tls.certresolver=le"
--- a/ansible/roles/intersect-docker/files/duplicati/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/duplicati/docker-compose.yml
@ -0,0 +1,22 @@
+version: "2.3"
+services:
+  duplicati:
+    image: linuxserver/duplicati:v2.0.5.1-2.0.5.1_beta_2020-01-18-ls56
+    container_name: duplicati
+    environment:
+      - PUID={{ docker_user.id }}
+      - PGID={{ docker_user.id }}
+      - TZ=Europe/London
+    volumes:
+      - ./config:/config
+      - ./backups:/backups
+      - /srv/nextcloud-data/data/:/source/nextcloud:ro
+      - /opt/gitea/repos/repositories:/source/repositories:ro
+      - /scratch/db-backups:/source/db-backups:ro
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.duplicati.rule=Host(`duplicati.jakehoward.tech`)"
+      - "traefik.http.routers.duplicati.tls=true"
+      - "traefik.http.routers.duplicati.tls.certresolver=le"
+      - "traefik.http.routers.duplicati.middlewares=internal-only@file"
--- a/ansible/roles/intersect-docker/files/emby/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/emby/docker-compose.yml
@ -0,0 +1,22 @@
+version: "2.3"
+
+services:
+  emby:
+    image: linuxserver/emby:4.4.2.0-ls41
+    container_name: emby
+    environment:
+      - PUID={{ docker_user.id }}
+      - PGID={{ docker_user.id }}
+      - TZ=Europe/London
+    volumes:
+      - ./config:/config
+      - /mnt/media/TV:/mnt/TV
+      - /mnt/media/Movies:/mnt/Movies
+    ports:
+      - 8096:8096
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.emby.rule=Host(`media.jakehoward.tech`)"
+      - "traefik.http.routers.emby.tls=true"
+      - "traefik.http.routers.emby.tls.certresolver=le"
--- a/ansible/roles/intersect-docker/files/folding-at-home/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/folding-at-home/docker-compose.yml
@ -0,0 +1,17 @@
+version: "2.3"
+
+services:
+  folding-at-home:
+    image: linuxserver/foldingathome:latest
+    container_name: folding-at-home
+    cpus: 1.5
+    environment:
+      - TZ=Europe/London
+      - PUID={{ docker_user.id }}
+      - GUID={{ docker_user.id }}
+    volumes:
+      - ./config:/config
+    ports:
+      - 7396:7396
+      - 36330:36330
+    restart: unless-stopped
--- a/ansible/roles/intersect-docker/files/gitea/app.ini
+++ b/ansible/roles/intersect-docker/files/gitea/app.ini
@ -0,0 +1,98 @@
+APP_NAME = Gitea: Git with a cup of tea
+RUN_MODE = prod
+RUN_USER = git
+
+[repository]
+ROOT = /data/git/repositories
+
+[repository.local]
+LOCAL_COPY_PATH = /data/gitea/tmp/local-repo
+
+[repository.upload]
+TEMP_PATH = /data/gitea/uploads
+
+[server]
+APP_DATA_PATH    = /data/gitea
+SSH_DOMAIN       = git.0rng.one
+HTTP_PORT        = 3000
+ROOT_URL         = https://git.0rng.one/
+DISABLE_SSH      = false
+SSH_PORT         = 22
+SSH_LISTEN_PORT  = 3022
+START_SSH_SERVER = true
+LFS_START_SERVER = true
+LFS_CONTENT_PATH = /data/git/lfs
+DOMAIN           = git.0rng.one
+LFS_JWT_SECRET   = {{ gitea.lfs_jwt_secret }}
+OFFLINE_MODE     = false
+LANDING_PAGE     = explore
+ENABLE_GZIP      = true
+
+[ui]
+DEFAULT_THEME    = arc-green
+THEMES           = gitea,arc-green
+
+[database]
+DB_TYPE  = postgres
+HOST     = db:5432
+NAME     = gitea
+USER     = gitea
+PASSWD   = gitea
+SSL_MODE = disable
+CHARSET  = utf8
+LOG_SQL  = false
+
+[indexer]
+ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
+
+[session]
+PROVIDER_CONFIG = /data/gitea/sessions
+PROVIDER        = file
+COOKIE_NAME     = session
+
+[picture]
+AVATAR_UPLOAD_PATH            = /data/gitea/avatars
+REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars
+DISABLE_GRAVATAR              = false
+ENABLE_FEDERATED_AVATAR       = true
+
+[attachment]
+PATH = /data/gitea/attachments
+
+[log]
+ROOT_PATH = /data/gitea/log
+MODE      = file
+LEVEL     = info
+
+[security]
+INSTALL_LOCK   = true
+SECRET_KEY     = {{ gitea.secret_key }}
+INTERNAL_TOKEN = {{ gitea.internal_token }}
+COOKIE_USERNAME = gitea_username
+COOKIE_REMEMBER_NAME = gitea_remember
+
+[service]
+DISABLE_REGISTRATION              = true
+REQUIRE_SIGNIN_VIEW               = false
+REGISTER_EMAIL_CONFIRM            = false
+ENABLE_NOTIFY_MAIL                = false
+ALLOW_ONLY_EXTERNAL_REGISTRATION  = false
+ENABLE_CAPTCHA                    = false
+DEFAULT_KEEP_EMAIL_PRIVATE        = false
+DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+DEFAULT_ENABLE_TIMETRACKING       = true
+NO_REPLY_ADDRESS                  = noreply.example.org
+
+[oauth2]
+JWT_SECRET = {{ gitea.jwt_secret }}
+
+[mailer]
+ENABLED = false
+
+[openid]
+ENABLE_OPENID_SIGNIN = false
+ENABLE_OPENID_SIGNUP = false
+
+[cache]
+ADAPTER         = memory
+INTERVAL        = 60
--- a/ansible/roles/intersect-docker/files/gitea/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/gitea/docker-compose.yml
@ -0,0 +1,47 @@
+version: "2.3"
+
+services:
+  gitea:
+    image: gitea/gitea:1.11.4
+    container_name: gitea
+    restart: unless-stopped
+    environment:
+      - USER_UID={{ docker_user.id }}
+      - USER_GID={{ docker_user.id }}
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.gitea.rule=(Host(`git.theorangeone.net`) || Host(`git.0rng.one`))"
+      - "traefik.http.routers.gitea.tls=true"
+      - "traefik.http.routers.gitea.tls.certresolver=le"
+      - "traefik.http.services.gitea-gitea.loadbalancer.server.port=3000"
+    ports:
+      - "{{ wireguard.clients.intersect.ip }}:3022:3022"
+    volumes:
+      - ./gitea:/data
+      - ./repos:/data/git
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+
+  db:
+    image: postgres:12-alpine
+    restart: unless-stopped
+    volumes:
+      - ./postgres:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_PASSWORD=gitea
+      - POSTGRES_USER=gitea
+
+  db-backups:
+    image: prodrigestivill/postgres-backup-local:12-alpine
+    restart: unless-stopped
+    volumes:
+      - /scratch/db-backups:/backups
+    depends_on:
+      - db
+    environment:
+      - POSTGRES_HOST=db
+      - POSTGRES_PASSWORD=gitea
+      - POSTGRES_USER=gitea
+      - POSTGRES_DB=gitea
+      - BACKUP_KEEP_MONTHS=1
+      - BACKUP_KEEP_WEEKS=1
--- a/ansible/roles/intersect-docker/files/gotify/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/gotify/docker-compose.yml
@ -0,0 +1,15 @@
+version: "2.3"
+services:
+  duplicati:
+    image: gotify/server:2.0.14
+    container_name: gotify
+    environment:
+      - TZ=Europe/London
+    volumes:
+      - ./data:/app/data
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.gotify.rule=Host(`gotify.jakehoward.tech`)"
+      - "traefik.http.routers.gotify.tls=true"
+      - "traefik.http.routers.gotify.tls.certresolver=le"
--- a/ansible/roles/intersect-docker/files/librespeed/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/librespeed/docker-compose.yml
@ -0,0 +1,16 @@
+version: "2.3"
+services:
+  librespeed:
+    image: linuxserver/librespeed:5.2-ls11
+    container_name: librespeed
+    environment:
+      - PUID={{ docker_user.id }}
+      - PGID={{ docker_user.id }}
+      - TZ=Europe/London
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.librespeed.rule=Host(`speed.jakehoward.tech`)"
+      - "traefik.http.routers.librespeed.tls=true"
+      - "traefik.http.routers.librespeed.tls.certresolver=le"
+      - "traefik.http.routers.librespeed.middlewares=internal-only@file"
--- a/ansible/roles/intersect-docker/files/nextcloud/config.php
+++ b/ansible/roles/intersect-docker/files/nextcloud/config.php
@ -0,0 +1,39 @@
+<?php
+$CONFIG = array (
+  'memcache.local' => '\\OC\\Memcache\\APCu',
+  'memcache.locking' => '\\OC\\Memcache\\Redis',
+  'memcache.distributed' => '\\OC\\Memcache\\Redis',
+  'filelocking.enabled' => true,
+  'redis' =>
+  array (
+    'host' => 'redis',
+    'port' => 6379,
+    'timeout' => 0.0,
+  ),
+  'datadirectory' => '/data',
+  'instanceid' => '{{ nextcloud.instance_id }}',
+  'passwordsalt' => '{{ nextcloud.passwordsalt }}',
+  'secret' => '{{ nextcloud.secret }}',
+  'trusted_domains' =>
+  array (
+    0 => 'intersect.jakehoward.tech',
+  ),
+  'dbtype' => 'pgsql',
+  'version' => '18.0.4.2',
+  'overwrite.cli.url' => 'https://intersect.jakehoward.tech',
+  'dbname' => 'nextcloud',
+  'dbhost' => 'db',
+  'dbport' => '5432',
+  'dbtableprefix' => 'oc_',
+  'mysql.utf8mb4' => true,
+  'dbuser' => 'nextcloud',
+  'dbpassword' => 'nextcloud',
+  'installed' => true,
+  'trusted_proxies' =>
+  array (
+    0 => '10.23.0.1/24',
+  ),
+  'maintenance' => false,
+  'theme' => '',
+  'loglevel' => 2,
+);
--- a/ansible/roles/intersect-docker/files/nextcloud/default.conf
+++ b/ansible/roles/intersect-docker/files/nextcloud/default.conf
@ -0,0 +1,89 @@
+upstream php-handler {
+    server 127.0.0.1:9000;
+}
+#server {
+#    listen 80;
+#    listen [::]:80;
+#    server_name _;
+#    return 301 https://$host$request_uri;
+#}
+server {
+    #listen 443 ssl http2;
+    #listen [::]:443 ssl http2;
+    listen 80;
+    server_name _;
+    #ssl_certificate /config/keys/cert.crt;
+    #ssl_certificate_key /config/keys/cert.key;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    add_header X-Robots-Tag none;
+    add_header X-Download-Options noopen;
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Permitted-Cross-Domain-Policies none;
+    add_header Referrer-Policy no-referrer;
+    add_header Strict-Transport-Security "max-age=15768000;";
+    fastcgi_hide_header X-Powered-By;
+    root /config/www/nextcloud/;
+    location = /robots.txt {
+        allow all;
+        log_not_found off;
+        access_log off;
+    }
+    location = /.well-known/carddav {
+      return 301 https://$host/remote.php/dav;
+    }
+    location = /.well-known/caldav {
+      return 301 https://$host/remote.php/dav;
+    }
+    client_max_body_size 10G;
+    fastcgi_buffers 64 4K;
+    gzip on;
+    gzip_vary on;
+    gzip_comp_level 4;
+    gzip_min_length 256;
+    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+    location / {
+        rewrite ^ /index.php;
+    }
+    location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
+        deny all;
+    }
+    location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
+        deny all;
+    }
+    location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|ocm-provider\/.+)\.php(?:$|\/) {
+        fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
+        try_files $fastcgi_script_name =404;
+        include /etc/nginx/fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_param HTTPS on;
+        fastcgi_param modHeadersAvailable true;
+        fastcgi_param front_controller_active true;
+        fastcgi_pass php-handler;
+        fastcgi_intercept_errors on;
+        fastcgi_request_buffering off;
+    }
+
+    location ~ ^\/(?:updater|ocs-provider|ocm-provider)(?:$|\/) {
+        try_files $uri/ =404;
+        index index.php;
+    }
+    location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
+        try_files $uri /index.php$request_uri;
+        add_header Cache-Control "public, max-age=15778463";
+        add_header X-Content-Type-Options nosniff;
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Robots-Tag none;
+        add_header X-Download-Options noopen;
+        add_header X-Frame-Options "SAMEORIGIN";
+        add_header X-Permitted-Cross-Domain-Policies none;
+        add_header Referrer-Policy no-referrer;
+        access_log off;
+    }
+    location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
+        try_files $uri /index.php$request_uri;
+        access_log off;
+    }
+}
--- a/ansible/roles/intersect-docker/files/nextcloud/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/nextcloud/docker-compose.yml
@ -0,0 +1,70 @@
+version: "2.3"
+
+services:
+  nextcloud:
+    image: linuxserver/nextcloud:18.0.4-ls76
+    container_name: nextcloud
+    environment:
+      - PUID={{ docker_user.id }}
+      - PGID={{ docker_user.id }}
+      - TZ=Europe/London
+    volumes:
+      - ./nextcloud/config:/config/www/nextcloud/config
+      - ./nextcloud/apps:/config/www/nextcloud/apps
+      - ./nextcloud/nginx-default.conf:/config/nginx/site-confs/default
+      - /srv/nextcloud-data/data:/data
+      - /opt/gitea/repos:/repos:ro
+      - /mnt/media:/content:ro
+    restart: unless-stopped
+    tmpfs:
+      - /config/log
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.nextcloud.rule=Host(`intersect.jakehoward.tech`)"
+      - "traefik.http.routers.nextcloud.tls=true"
+      - "traefik.http.routers.nextcloud.tls.certresolver=le"
+
+  db:
+    image: postgres:12-alpine
+    restart: unless-stopped
+    volumes:
+      - ./postgres:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_PASSWORD=nextcloud
+      - POSTGRES_USER=nextcloud
+
+  db-backups:
+    image: prodrigestivill/postgres-backup-local:12-alpine
+    restart: unless-stopped
+    volumes:
+      - /scratch/db-backups:/backups
+    depends_on:
+      - db
+    environment:
+      - POSTGRES_HOST=db
+      - POSTGRES_PASSWORD=nextcloud
+      - POSTGRES_USER=nextcloud
+      - POSTGRES_DB=nextcloud
+      - BACKUP_KEEP_MONTHS=1
+      - BACKUP_KEEP_WEEKS=1
+
+  redis:
+    image: redis:5-alpine
+    restart: unless-stopped
+    volumes:
+      - ./redis:/data
+
+  onlyoffice:
+    image: onlyoffice/documentserver
+    container_name: onlyoffice
+    restart: unless-stopped
+    environment:
+      - JWT_ENABLED=true
+      - JWT_SECRET={{ nextcloud.onlyoffice_jwt_secret }}
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.onlyoffice.rule=Host(`onlyoffice.jakehoward.tech`)"
+      - "traefik.http.routers.onlyoffice.tls=true"
+      - "traefik.http.routers.onlyoffice.tls.certresolver=le"
+      - "traefik.http.routers.onlyoffice.middlewares=oo-header"
+      - "traefik.http.middlewares.oo-header.headers.customRequestHeaders.X-Forwarded-Proto=https"
--- a/ansible/roles/intersect-docker/files/pihole/dnsmasq-vpn.conf
+++ b/ansible/roles/intersect-docker/files/pihole/dnsmasq-vpn.conf
@ -0,0 +1,5 @@
+localise-queries
+
+{% for host in internal_hostnames %}
+host-record={{ host }},{{ wireguard.clients.intersect.ip }}
+{% endfor %}
--- a/ansible/roles/intersect-docker/files/pihole/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/pihole/docker-compose.yml
@ -0,0 +1,23 @@
+version: "2.3"
+
+services:
+  pihole:
+    container_name: pihole
+    image: pihole/pihole:v4.4
+    ports:
+      - "{{ wireguard.clients.intersect.ip }}:53:53/tcp"
+      - "{{ wireguard.clients.intersect.ip }}:53:53/udp"
+    environment:
+      - TZ=Europe/London
+      - VIRTUAL_HOST=pihole.jakehoward.tech
+    volumes:
+      - ./pihole/:/etc/pihole/
+      - ./dnsmasq.d/:/etc/dnsmasq.d/
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.pihole.rule=Host(`pihole.jakehoward.tech`)"
+      - "traefik.http.routers.pihole.tls=true"
+      - "traefik.http.routers.pihole.tls.certresolver=le"
+      - "traefik.http.routers.pihole.middlewares=internal-only@file"
+      - "traefik.http.services.pihole-pihole.loadbalancer.server.port=80"
--- a/ansible/roles/intersect-docker/files/quassel/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/quassel/docker-compose.yml
@ -0,0 +1,34 @@
+version: "2.3"
+services:
+  quassel-core:
+    image: linuxserver/quassel-core:0.13.1-ls50
+    container_name: quassel
+    environment:
+      - PUID={{ docker_user.id }}
+      - PGID={{ docker_user.id }}
+      - TZ=Europe/London
+      - DB_BACKEND=PostgreSQL
+      - DB_PGSQL_USERNAME=quassel
+      - DB_PGSQL_PASSWORD=quassel
+      - DB_PGSQL_HOSTNAME=db
+      - DB_PGSQL_PORT=5432
+      - AUTH_AUTHENTICATOR=Database
+      - RUN_OPTS=--config-from-environment
+    restart: unless-stopped
+    depends_on:
+      - db
+    ports:
+      - "{{ wireguard.clients.intersect.ip }}:4242:4242"
+
+  db:
+    image: postgres:12-alpine
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=quassel
+      - POSTGRES_PASSWORD=quassel
+    volumes:
+      - ./postgresql:/var/lib/postgresql/data
+
+  tor-socks-proxy:
+    image: peterdavehello/tor-socks-proxy:latest
+    restart: unless-stopped
--- a/ansible/roles/intersect-docker/files/statping/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/statping/docker-compose.yml
@ -0,0 +1,38 @@
+version: "2.3"
+
+services:
+  statping:
+    image: hunterlong/statping:v0.80.70
+    container_name: statping
+    restart: unless-stopped
+    volumes:
+      - ./statping:/app
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.statping.rule=Host(`stats.theorangeone.net`)"
+      - "traefik.http.routers.statping.tls=true"
+      - "traefik.http.routers.statping.tls.certresolver=le"
+
+  db:
+    image: postgres:12-alpine
+    restart: unless-stopped
+    volumes:
+      - ./postgres:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_PASSWORD=statping
+      - POSTGRES_USER=statping
+
+  db-backups:
+    image: prodrigestivill/postgres-backup-local:12-alpine
+    restart: unless-stopped
+    volumes:
+      - /scratch/db-backups:/backups
+    depends_on:
+      - db
+    environment:
+      - POSTGRES_HOST=db
+      - POSTGRES_PASSWORD=statping
+      - POSTGRES_USER=statping
+      - POSTGRES_DB=statping
+      - BACKUP_KEEP_MONTHS=1
+      - BACKUP_KEEP_WEEKS=1
--- a/ansible/roles/intersect-docker/files/synapse/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/synapse/docker-compose.yml
@ -0,0 +1,33 @@
+version: "2.3"
+
+services:
+
+  synapse:
+    image: matrixdotorg/synapse:v1.12.4
+    restart: unless-stopped
+    environment:
+      - SYNAPSE_CONFIG_PATH=/etc/homeserver.yaml
+      - SYNAPSE_REPORT_STATS=yes
+      - UID=0
+      - GID=0
+    volumes:
+      - ./homeserver.yaml:/etc/homeserver.yaml
+      - ./files:/data
+    expose:
+      - 8008
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.synapse.rule=Host(`matrix.jakehoward.tech`)"
+      - "traefik.http.routers.synapse.tls=true"
+      - "traefik.http.routers.synapse.tls.certresolver=le"
+      - "traefik.http.routers.synapse.entrypoints=web-secure,matrix"
+
+  db:
+    image: postgres:12-alpine
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=synapse
+      - POSTGRES_PASSWORD=synapse
+    volumes:
+      - ./postgresql:/var/lib/postgresql/data
+      - ./synapse_scripts:/opt/synapse_scripts:ro
--- a/ansible/roles/intersect-docker/files/synapse/homeserver.yml
+++ b/ansible/roles/intersect-docker/files/synapse/homeserver.yml
--- a/ansible/roles/intersect-docker/files/theorangeone.net/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/theorangeone.net/docker-compose.yml
@ -0,0 +1,23 @@
+version: "2.3"
+services:
+  website:
+    image: docker.pkg.github.com/realorangeone/theorangeone.net/theorangeone.net:latest
+    container_name: theorangeone.net
+    environment:
+      - TZ=Europe/London
+    restart: unless-stopped
+    volumes:
+      - ./access.log:/var/log/nginx/access.log
+      - ./report.html:/usr/share/nginx/html/stats/index.html:ro
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.website.rule=Host(`theorangeone.net`) || Host(`www.theorangeone.net`)"
+      - "traefik.http.routers.website.tls=true"
+      - "traefik.http.routers.website.tls.certresolver=le"
+
+  stats:
+    image: theorangeone/goaccess-static:latest
+    restart: unless-stopped
+    volumes:
+      - ./report.html:/var/www/goaccess/report.html
+      - ./access.log:/goaccess/access.log:ro
--- a/ansible/roles/intersect-docker/files/todoist-github/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/todoist-github/docker-compose.yml
@ -0,0 +1,11 @@
+version: "2.3"
+
+services:
+  todoist-github:
+    image: theorangeone/todoist-github:latest
+    container_name: todoist-github
+    restart: unless-stopped
+    command: python3 -m todoist_github --interval 900
+    environment:
+      - TODOIST_TOKEN={{ todoist_github.todoist_token }}
+      - GITHUB_TOKEN={{ todoist_github.github_token }}
--- a/ansible/roles/intersect-docker/files/torrent/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/torrent/docker-compose.yml
@ -0,0 +1,26 @@
+version: "2.3"
+services:
+  deluge:
+    image: linuxserver/deluge:2.0.3-2201906121747ubuntu18.04.1-ls57
+    container_name: deluge
+    environment:
+      - PUID={{ docker_user.id }}
+      - PGID={{ docker_user.id }}
+      - TZ=Europe/London
+      - DELUGE_LOGLEVEL=debug
+    volumes:
+      - ./deluge:/config
+      - /scratch/deluge:/downloads
+    ports:
+      - 8112:8112
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.deluge.rule=Host(`deluge.jakehoward.tech`)"
+      - "traefik.http.routers.deluge.tls=true"
+      - "traefik.http.routers.deluge.tls.certresolver=le"
+      - "traefik.http.routers.deluge.middlewares=internal-only@file"
+
+  tor-socks-proxy:
+    image: peterdavehello/tor-socks-proxy:latest
+    restart: unless-stopped
--- a/ansible/roles/intersect-docker/files/tt-rss/config.php
+++ b/ansible/roles/intersect-docker/files/tt-rss/config.php
@ -0,0 +1,82 @@
+<?php
+  // *******************************************
+  // *** Database configuration (important!) ***
+  // *******************************************
+
+  define('DB_TYPE', 'pgsql');
+  define('DB_HOST', 'db');
+  define('DB_USER', 'tt-rss');
+  define('DB_NAME', 'tt-rss');
+  define('DB_PASS', 'tt-rss');
+  define('DB_PORT', '5432');
+  define('MYSQL_CHARSET', 'UTF8');
+
+  // ***********************************
+  // *** Basic settings (important!) ***
+  // ***********************************
+
+  define('SELF_URL_PATH', 'https://tt-rss.jakehoward.tech/');
+  define('SINGLE_USER_MODE', false);
+  define('SIMPLE_UPDATE_MODE', false);
+
+  // *****************************
+  // *** Files and directories ***
+  // *****************************
+
+  define('PHP_EXECUTABLE', '/usr/bin/php');
+  define('LOCK_DIRECTORY', 'lock');
+  define('CACHE_DIR', 'cache');
+  define('ICONS_DIR', "feed-icons");
+  define('ICONS_URL', "feed-icons");
+
+  // **********************
+  // *** Authentication ***
+  // **********************
+
+  define('AUTH_AUTO_CREATE', true);
+  define('AUTH_AUTO_LOGIN', true);
+
+  // *********************
+  // *** Feed settings ***
+  // *********************
+
+  define('FORCE_ARTICLE_PURGE', 0);
+
+  // ****************************
+  // *** Sphinx search plugin ***
+  // ****************************
+
+  define('SPHINX_SERVER', 'localhost:9312');
+  define('SPHINX_INDEX', 'ttrss, delta');
+
+  // ***********************************
+  // *** Self-registrations by users ***
+  // ***********************************
+
+  define('ENABLE_REGISTRATION', false);
+  define('REG_NOTIFY_ADDRESS', 'user@your.domain.dom');
+  define('REG_MAX_USERS', 10);
+
+  // **********************************
+  // *** Cookies and login sessions ***
+  // **********************************
+
+  define('SESSION_COOKIE_LIFETIME', 864000);
+
+  // *********************************
+  // *** Email and digest settings ***
+  // *********************************
+
+  define('SMTP_FROM_NAME', 'Tiny Tiny RSS');
+  define('SMTP_FROM_ADDRESS', 'noreply@your.domain.dom');
+  define('DIGEST_SUBJECT', '[tt-rss] New headlines for last 24 hours');
+
+  // ************************
+  // *** General settings ***
+  // ************************
+
+  define('CHECK_FOR_UPDATES', false);
+  define('ENABLE_GZIP_OUTPUT', true);
+  define('PLUGINS', 'auth_internal, note');
+  define('LOG_DESTINATION', 'sql');
+  define('CONFIG_VERSION', 26);
--- a/ansible/roles/intersect-docker/files/tt-rss/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/tt-rss/docker-compose.yml
@ -0,0 +1,42 @@
+version: "2.3"
+
+services:
+  tt-rss:
+    image: lunik1/tt-rss:latest
+    container_name: tt-rss
+    environment:
+      - PUID={{ docker_user.id }}
+      - PGID={{ docker_user.id }}
+      - TZ=Europe/London
+    volumes:
+      - ./config:/config
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.tt-rss.rule=Host(`tt-rss.jakehoward.tech`)"
+      - "traefik.http.routers.tt-rss.tls=true"
+      - "traefik.http.routers.tt-rss.tls.certresolver=le"
+
+  db:
+    image: postgres:12-alpine
+    restart: unless-stopped
+    volumes:
+      - ./postgres:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_PASSWORD=tt-rss
+      - POSTGRES_USER=tt-rss
+
+  db-backups:
+    image: prodrigestivill/postgres-backup-local:12-alpine
+    restart: unless-stopped
+    volumes:
+      - /scratch/db-backups:/backups
+    depends_on:
+      - db
+    environment:
+      - POSTGRES_HOST=db
+      - POSTGRES_PASSWORD=tt-rss
+      - POSTGRES_USER=tt-rss
+      - POSTGRES_DB=tt-rss
+      - BACKUP_KEEP_MONTHS=1
+      - BACKUP_KEEP_WEEKS=1
--- a/ansible/roles/intersect-docker/files/wallabag/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/wallabag/docker-compose.yml
@ -0,0 +1,24 @@
+version: "2.3"
+
+services:
+  wallabag:
+    image: wallabag/wallabag:2.3.8
+    container_name: wallabag
+    restart: unless-stopped
+    environment:
+      - SYMFONY__ENV__SECRET={{ wallabag_secret }}
+      - SYMFONY__ENV__DOMAIN_NAME=https://wallabag.jakehoward.tech
+    volumes:
+      - ./data:/var/www/wallabag/data
+      - ./images:/var/www/wallabag/images
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.wallabag.rule=Host(`wallabag.jakehoward.tech`)"
+      - "traefik.http.routers.wallabag.tls=true"
+      - "traefik.http.routers.wallabag.tls.certresolver=le"
+
+  redis:
+    image: redis:5-alpine
+    restart: unless-stopped
+    volumes:
+      - ./redis:/data
--- a/ansible/roles/intersect-docker/files/whoami/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/whoami/docker-compose.yml
@ -0,0 +1,12 @@
+version: "2.3"
+
+services:
+  whoami:
+    image: containous/whoami:latest
+    container_name: whoami
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.whoami.rule=Host(`whoami.theorangeone.net`) || Host(`who.0rng.one`)"
+      - "traefik.http.routers.whoami.tls=true"
+      - "traefik.http.routers.whoami.tls.certresolver=le"
--- a/ansible/roles/intersect-docker/files/yourls/docker-compose.yml
+++ b/ansible/roles/intersect-docker/files/yourls/docker-compose.yml
@ -0,0 +1,33 @@
+version: "2.3"
+
+services:
+  yourls:
+    image: yourls:1.7.9-apache
+    container_name: yourls
+    restart: unless-stopped
+    depends_on:
+      - mysql
+    environment:
+      - YOURLS_DB_PASS=yourls
+      - YOURLS_DB_USER=yourls
+      - YOURLS_USER=jake
+      - YOURLS_PASS={{ yourls.user_password }}
+      - YOURLS_SITE=https://0rng.one
+    volumes:
+      - ./index.html:/var/www/html/index.html
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.yourls.rule=Host(`go.theorangeone.net`) || Host(`0rng.one`)"
+      - "traefik.http.routers.yourls.tls=true"
+      - "traefik.http.routers.yourls.tls.certresolver=le"
+
+  mysql:
+    image: mariadb:10.4
+    environment:
+      - MYSQL_ROOT_PASSWORD=root
+      - MYSQL_DATABASE=yourls
+      - MYSQL_USER=yourls
+      - MYSQL_PASSWORD=yourls
+    volumes:
+      - ./mariadb:/config
+    restart: unless-stopped
--- a/ansible/roles/intersect-docker/files/yourls/index.html
+++ b/ansible/roles/intersect-docker/files/yourls/index.html
@ -0,0 +1,8 @@
+<html>
+  <head>
+    <meta http-equiv="refresh" content="0; url=/admin/" />
+  </head>
+  <body>
+    <h1>Redirecting to admin...</h1>
+  </body>
+</html>
--- a/ansible/roles/intersect-docker/tasks/calibre.yml
+++ b/ansible/roles/intersect-docker/tasks/calibre.yml
@ -0,0 +1,29 @@
+- name: Create calibre directory
+  file:
+    path: /opt/calibre
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install calibre compose file
+  template:
+    src: files/calibre/docker-compose.yml
+    dest: /opt/calibre/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle calibre container
+  docker_compose:
+    project_src: /opt/calibre
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/duplicati.yml
+++ b/ansible/roles/intersect-docker/tasks/duplicati.yml
@ -0,0 +1,29 @@
+- name: Create duplicati directory
+  file:
+    path: /opt/duplicati
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install duplicati compose file
+  template:
+    src: files/duplicati/docker-compose.yml
+    dest: /opt/duplicati/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle duplicati container
+  docker_compose:
+    project_src: /opt/duplicati
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/emby.yml
+++ b/ansible/roles/intersect-docker/tasks/emby.yml
@ -0,0 +1,29 @@
+- name: Create emby directory
+  file:
+    path: /opt/emby
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install emby compose file
+  template:
+    src: files/emby/docker-compose.yml
+    dest: /opt/emby/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle emby container
+  docker_compose:
+    project_src: /opt/emby
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/folding-at-home.yml
+++ b/ansible/roles/intersect-docker/tasks/folding-at-home.yml
@ -0,0 +1,29 @@
+- name: Create folding-at-home directory
+  file:
+    path: /opt/folding-at-home
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install folding@home compose file
+  template:
+    src: files/folding-at-home/docker-compose.yml
+    dest: /opt/folding-at-home/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle folding@home container
+  docker_compose:
+    project_src: /opt/folding-at-home
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/gitea.yml
+++ b/ansible/roles/intersect-docker/tasks/gitea.yml
@ -0,0 +1,48 @@
+- name: Include gitea variables
+  include_vars: gitea.yml
+
+- name: Create gitea directory
+  file:
+    path: /opt/gitea
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Create gitea config directory
+  file:
+    path: /opt/gitea/gitea/gitea/conf
+    state: directory
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install gitea compose file
+  template:
+    src: files/gitea/docker-compose.yml
+    dest: /opt/gitea/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Install gitea config file
+  template:
+    src: files/gitea/app.ini
+    dest: /opt/gitea/gitea/gitea/conf/app.ini
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+  register: gitea_config_file
+  become: true
+
+- name: Cycle gitea container
+  docker_compose:
+    project_src: /opt/gitea
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed or gitea_config_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/gotify.yml
+++ b/ansible/roles/intersect-docker/tasks/gotify.yml
@ -0,0 +1,29 @@
+- name: Create gotify directory
+  file:
+    path: /opt/gotify
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install gotify compose file
+  template:
+    src: files/gotify/docker-compose.yml
+    dest: /opt/gotify/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle gotify container
+  docker_compose:
+    project_src: /opt/gotify
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/librespeed.yml
+++ b/ansible/roles/intersect-docker/tasks/librespeed.yml
@ -0,0 +1,29 @@
+- name: Create librespeed directory
+  file:
+    path: /opt/librespeed
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install librespeed compose file
+  template:
+    src: files/librespeed/docker-compose.yml
+    dest: /opt/librespeed/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle librespeed container
+  docker_compose:
+    project_src: /opt/librespeed
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/main.yml
+++ b/ansible/roles/intersect-docker/tasks/main.yml
@ -0,0 +1,56 @@
+- name: Install calibre
+  include: calibre.yml
+
+- name: Install duplicati
+  include: duplicati.yml
+
+- name: Install emby
+  include: emby.yml
+
+- name: Install folding-at-home
+  include: folding-at-home.yml
+
+- name: Install gitea
+  include: gitea.yml
+
+- name: Install gotify
+  include: gotify.yml
+
+- name: Install librespeed
+  include: librespeed.yml
+
+- name: Install nextcloud
+  include: nextcloud.yml
+
+- name: Install pihole
+  include: pihole.yml
+
+- name: Install quassel
+  include: quassel.yml
+
+- name: Install statping
+  include: statping.yml
+
+- name: Install synapse
+  include: synapse.yml
+
+- name: Install todoist-github
+  include: todoist-github.yml
+
+- name: Install torrent
+  include: torrent.yml
+
+- name: Install theorangeone.net
+  include: theorangeone.net.yml
+
+- name: Install tt-rss
+  include: tt-rss.yml
+
+- name: Install wallabag
+  include: wallabag.yml
+
+- name: Install whoami
+  include: whoami.yml
+
+- name: Install yourls
+  include: yourls.yml
--- a/ansible/roles/intersect-docker/tasks/nextcloud.yml
+++ b/ansible/roles/intersect-docker/tasks/nextcloud.yml
@ -0,0 +1,57 @@
+- name: Include nextcloud variables
+  include_vars: nextcloud.yml
+
+- name: Create nextcloud directory
+  file:
+    path: /opt/nextcloud
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install nextcloud compose file
+  template:
+    src: files/nextcloud/docker-compose.yml
+    dest: /opt/nextcloud/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Create nextcloud config directory
+  file:
+    path: /opt/nextcloud/nextcloud/config
+    state: directory
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install nextcloud config
+  template:
+    src: files/nextcloud/config.php
+    dest: /opt/nextcloud/nextcloud/config/config.php
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+  register: config_file
+  become: true
+
+- name: Install nextcloud custom nginx config
+  template:
+    src: files/nextcloud/default.conf
+    dest: /opt/nextcloud/nextcloud/nginx-default.conf
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+  register: nginx_config
+  become: true
+
+- name: Cycle nextcloud container
+  docker_compose:
+    project_src: /opt/nextcloud
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed or config_file.changed or nginx_config.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/pihole.yml
+++ b/ansible/roles/intersect-docker/tasks/pihole.yml
@ -0,0 +1,48 @@
+- name: Include pihole variables
+  include_vars: pihole.yml
+
+- name: Create pihole directory
+  file:
+    path: /opt/pihole
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install pihole compose file
+  template:
+    src: files/pihole/docker-compose.yml
+    dest: /opt/pihole/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Create dnsmasq directory
+  file:
+    path: /opt/pihole/dnsmasq.d/
+    state: directory
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install dnsmasq hosts config
+  template:
+    src: files/pihole/dnsmasq-vpn.conf
+    dest: /opt/pihole/dnsmasq.d/02-vpn.conf
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+  register: dnsmasq_vpn_hosts
+  become: true
+
+- name: Cycle pihole container
+  docker_compose:
+    project_src: /opt/pihole
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed or dnsmasq_vpn_hosts.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/quassel.yml
+++ b/ansible/roles/intersect-docker/tasks/quassel.yml
@ -0,0 +1,29 @@
+- name: Create quassel directory
+  file:
+    path: /opt/quassel
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install quassel compose file
+  template:
+    src: files/quassel/docker-compose.yml
+    dest: /opt/quassel/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle quassel container
+  docker_compose:
+    project_src: /opt/quassel
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/statping.yml
+++ b/ansible/roles/intersect-docker/tasks/statping.yml
@ -0,0 +1,29 @@
+- name: Create statping directory
+  file:
+    path: /opt/statping
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install statping compose file
+  template:
+    src: files/statping/docker-compose.yml
+    dest: /opt/statping/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle statping container
+  docker_compose:
+    project_src: /opt/statping
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/synapse.yml
+++ b/ansible/roles/intersect-docker/tasks/synapse.yml
@ -0,0 +1,47 @@
+- name: Include synapse variables
+  include_vars: synapse.yml
+
+- name: Create synapse directory
+  file:
+    path: /opt/synapse
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install synapse compose file
+  template:
+    src: files/synapse/docker-compose.yml
+    dest: /opt/synapse/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Install synapse config
+  template:
+    src: files/synapse/homeserver.yml
+    dest: /opt/synapse/homeserver.yaml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+  register: homeserver_config
+  become: true
+
+- name: Cycle synapse container
+  docker_compose:
+    project_src: /opt/synapse
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed or homeserver_config.changed
+  loop:
+    - absent
+    - present
+
+- name: Install helper scripts
+  git:
+    repo: https://github.com/xwiki-labs/synapse_scripts
+    dest: /opt/synapse/synapse_scripts
+    force: true
--- a/ansible/roles/intersect-docker/tasks/theorangeone.net.yml
+++ b/ansible/roles/intersect-docker/tasks/theorangeone.net.yml
@ -0,0 +1,29 @@
+- name: Create theorangeone.net directory
+  file:
+    path: /opt/theorangeone.net
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install theorangeone.net compose file
+  template:
+    src: files/theorangeone.net/docker-compose.yml
+    dest: /opt/theorangeone.net/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle theorangeone.net container
+  docker_compose:
+    project_src: /opt/theorangeone.net
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/todoist-github.yml
+++ b/ansible/roles/intersect-docker/tasks/todoist-github.yml
@ -0,0 +1,32 @@
+- name: Include todoist-github variables
+  include_vars: todoist-github.yml
+
+- name: Create todoist-github directory
+  file:
+    path: /opt/todoist-github
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install todoist-github compose file
+  template:
+    src: files/todoist-github/docker-compose.yml
+    dest: /opt/todoist-github/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle todoist-github container
+  docker_compose:
+    project_src: /opt/todoist-github
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/torrent.yml
+++ b/ansible/roles/intersect-docker/tasks/torrent.yml
@ -0,0 +1,29 @@
+- name: Create torrent directory
+  file:
+    path: /opt/torrent
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install torrent compose file
+  template:
+    src: files/torrent/docker-compose.yml
+    dest: /opt/torrent/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle torrent container
+  docker_compose:
+    project_src: /opt/torrent
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/tt-rss.yml
+++ b/ansible/roles/intersect-docker/tasks/tt-rss.yml
@ -0,0 +1,45 @@
+- name: Create tt-rss directory
+  file:
+    path: /opt/tt-rss
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install tt-rss compose file
+  template:
+    src: files/tt-rss/docker-compose.yml
+    dest: /opt/tt-rss/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Create tt-rss config directory
+  file:
+    path: /opt/tt-rss/config
+    state: directory
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install tt-rss config
+  template:
+    src: files/tt-rss/config.php
+    dest: /opt/tt-rss/config/config.php
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+  register: config_file
+  become: true
+
+- name: Cycle tt-rss container
+  docker_compose:
+    project_src: /opt/tt-rss
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed or config_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/wallabag.yml
+++ b/ansible/roles/intersect-docker/tasks/wallabag.yml
@ -0,0 +1,32 @@
+- name: Include wallabag variables
+  include_vars: wallabag.yml
+
+- name: Create wallabag directory
+  file:
+    path: /opt/wallabag
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install wallabag compose file
+  template:
+    src: files/wallabag/docker-compose.yml
+    dest: /opt/wallabag/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle wallabag container
+  docker_compose:
+    project_src: /opt/wallabag
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/whoami.yml
+++ b/ansible/roles/intersect-docker/tasks/whoami.yml
@ -0,0 +1,29 @@
+- name: Create whoami directory
+  file:
+    path: /opt/whoami
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install whoami compose file
+  template:
+    src: files/whoami/docker-compose.yml
+    dest: /opt/whoami/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Cycle whoami container
+  docker_compose:
+    project_src: /opt/whoami
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/tasks/yourls.yml
+++ b/ansible/roles/intersect-docker/tasks/yourls.yml
@ -0,0 +1,40 @@
+- name: Include yourls variables
+  include_vars: yourls.yml
+
+- name: Create yourls directory
+  file:
+    path: /opt/yourls
+    state: directory
+    owner: "{{ docker_user.name }}"
+    mode: "{{ docker_compose_directory_mask }}"
+  become: true
+
+- name: Install yourls compose file
+  template:
+    src: files/yourls/docker-compose.yml
+    dest: /opt/yourls/docker-compose.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+    validate: /usr/bin/docker-compose -f %s config
+  register: compose_file
+  become: true
+
+- name: Install yourls index
+  template:
+    src: files/yourls/index.html
+    dest: /opt/yourls/index.html
+    mode: "{{ docker_compose_file_mask }}"
+  register: config_file
+  become: true
+
+- name: Cycle yourls container
+  docker_compose:
+    project_src: /opt/yourls
+    pull: true
+    remove_orphans: true
+    remove_volumes: true
+    state: "{{ item }}"
+  when: compose_file.changed or config_file.changed
+  loop:
+    - absent
+    - present
--- a/ansible/roles/intersect-docker/vars/gitea.yml
+++ b/ansible/roles/intersect-docker/vars/gitea.yml
@ -0,0 +1,38 @@
+gitea:
+  jwt_secret: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    37303933656432653862343063386566363732663764363530336134356536353039386637326564
+    3830323764306333643061393339313236616435666365660a643637353339353737636565313338
+    62643435393639376531326464333539623931363866396230633361313031303763313637383734
+    6338613633626661660a653133623561373237346266346666376666653737613536633232313536
+    38623262653837353065386266633261363431333535666539636365396237616361393064323163
+    3938306666643861636138366563386439323761386335623962
+  secret_key: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    38373166333035376233393336346366616334633864643365316131363931393266343532386130
+    3764653861303064613965313665313266393762636239370a366366626662373164383532353366
+    35393837646238646136663133356261633464653935393665616531323335636134336634373065
+    6666646263636532380a346264386638656538356265373066616463653036373766383861623731
+    30643762303436313736633962356630393330373862353561326534653736336566386635316230
+    30666361643065306237653131623439396530333161643637383861623433656165626435316633
+    32646263636232313135623134306139633163333839316463656236343966383463643064396463
+    61643436333135373865
+  internal_token: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    63306138636431656236306432666164326565643132666633313434626338306633343263356238
+    6236333661303439653837633165366661653330643038620a356432343262396132643234656134
+    66623031666461633038653933356235626163306238343035373630343162353831393561323032
+    3132656639393665660a623034313035643861623865383562303562373862346139313761346636
+    36633863386537393230633864646162313338623363616162373433643333656233363733306564
+    35633737343836613034373866353062323466636430346266393066346466313166663634313162
+    36663761333065653764613762643230326163643138643266383936663735366263623637306266
+    34616435313863393530336565323231626466343033383139376333633032633466643732343537
+    63306235613130616339316664616630663332333866373032373935653437306232
+  lfs_jwt_secret: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    32333832306662373064626334633465346437656230303162313735626530646638643564383439
+    6261663332613938373161316563646639353166633339310a393936353735663430333733383962
+    31376636663065656435376637663438363039643234626335393238386162393232613934303537
+    6431663036333331350a303332366162333862616534346161316531323039643762316365333865
+    35383235633166353930363034373235646466336530646463616661336361393835643533343534
+    3235316165373239633832316438303266343639356161303439
--- a/ansible/roles/intersect-docker/vars/nextcloud.yml
+++ b/ansible/roles/intersect-docker/vars/nextcloud.yml
@ -0,0 +1,32 @@
+nextcloud:
+  onlyoffice_jwt_secret: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    62303266376363626466323834663133366565393165373435636663663665306334666434313233
+    6539396130326335653663646430613939323535616536340a363766386361616431353665636531
+    30303930373864333836363565303165613663613938356133616363396231376463623839383765
+    6563363263363039320a386134373931363733393636343539393133376463643962396231646565
+    32366533633564376561373534363662393361656563633230646439653361663836653339666439
+    3463633137313030363130636663373931623038616365333931
+  instance_id: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    30343838333336366638343832633063343135393262336238633632333962656236656666343930
+    6438366539333138303263383532643866333434633261350a366530326432393837343934656136
+    64396131386165383237356463616436643263613931363030643262373963326337356338636435
+    3233376662343033320a333332626162363438356266663335633038323538373365393765363538
+    3430
+  passwordsalt: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    66623930383738323135663662643465663230376431383035626131623866313166366239653330
+    3731393939623461366263616265363434663137313532640a356565623135616231643433626563
+    62393936656532366139653530393731663634663463663334303731363564376466393238393062
+    6663393830656161630a613334366332623535383937663863363136336661633332333638643939
+    66343163613066303466613032306465353563623331633837333166346163616231
+  secret: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    62383337306165336235353864623232363330643239363733653639396665336463303563376131
+    6634313135663936613935333561396130643236313634630a633136643538666333386663333835
+    66323334666364343038663335313735346134353231663830383262353564316361346366386238
+    6437363863353461380a323164356163343236636334313166336265323363386638383239613233
+    39343533363830613338623064633861623362623537636363373232663134353639386166663135
+    63613361353965336332323935383032623362363265303035666533386565393261343031653034
+    313965383063353036633438613439333562
--- a/ansible/roles/intersect-docker/vars/pihole.yml
+++ b/ansible/roles/intersect-docker/vars/pihole.yml
@ -0,0 +1,5 @@
+internal_hostnames:
+  - duplicati.jakehoward.tech
+  - deluge.jakehoward.tech
+  - speed.jakehoward.tech
+  - pihole.jakehoward.tech
--- a/ansible/roles/intersect-docker/vars/synapse.yml
+++ b/ansible/roles/intersect-docker/vars/synapse.yml
@ -0,0 +1,28 @@
+synapse:
+  registration_shared_secret: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    36363037303531333331356363393631623633636366653139346665316638623039323031633066
+    3262366439396362336338313933363539616262383461330a353638613364616134613130616665
+    66643239366363623536663163386138633535353066613633346131366333316538643031396537
+    3634356163353232620a663538393966353961353562376136303161336636663535376238383938
+    66623539643032353131313538313131326237313936313061616566643639623939313161633230
+    33663666633130373138393937323939383865623939623035373835626363386466663233333534
+    376362626664643664653833646162333863
+  macaroon_secret_key: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    64643336366430326631643331316239646539363362383531313335396231306335623538333761
+    3565393330656363376233356631353665636139643261360a656362623264353931613936666531
+    64373437366364313862326564623135643838343834633364656238356565353463393230326631
+    6438383561666561390a323965353136383264376265633364356265346463316161383563663939
+    66653565623666353833353639386634633631366234643933323836633033613963373863303466
+    66326435393266326233613833616263623739346634613531346535346136373965336333373566
+    316535323861356438623065313530346461
+  form_secret: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    36313462383034633133373938613161316436313631333061346664653861353062316539393536
+    3436373931363139653232353764393534303530366231310a643335333735656361333632346332
+    30393931366466666535363837663436633533366662373834643362636663386439356236393933
+    3532363432623637330a663263643263333764383637373339616665353631616130643537326263
+    38386538393032353365313733393835303630356536303635373764633139626162356165343539
+    64343135323833356130363262353638353533396563656566666635663263383065646630663063
+    366137356638386537376236623531326636
--- a/ansible/roles/intersect-docker/vars/todoist-github.yml
+++ b/ansible/roles/intersect-docker/vars/todoist-github.yml
@ -0,0 +1,17 @@
+todoist_github:
+  github_token: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    38636136313732653936343433346331623531306562663731306365346165323331343266303064
+    6565356165333030666130366134383539663631613261350a666537653430356633383339313434
+    37663032333362623035393665633663663065373032616131326239646465616666313838333536
+    3166353065613232630a666539396136306534646164346634373335666164396630646261626261
+    65323163633661326631623363346239373332343037613765313063623338306563616566336136
+    6632616363306462376161323437383137623738366332393033
+  todoist_token: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    39373238353963623932643335303864346431346162656464663631656631343335316535396333
+    6462303133643333633930333337666435326461656337370a386130636661656633643666396432
+    32336631393738323633353233333837346634353439363962623832323635633230613830326161
+    3133623634376336640a303733613164306665333638386635353466386638643131343264656138
+    38373236343136323138626436383035616262626434313334353364653563303361326530346565
+    6533313763383333353664303836626332636234336537356635
--- a/ansible/roles/intersect-docker/vars/wallabag.yml
+++ b/ansible/roles/intersect-docker/vars/wallabag.yml
@ -0,0 +1,11 @@
+wallabag_secret: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  64353939666265306238333239316631373533643030663638316338356330653539643837373637
+  6638323330373264363535316339616432373132613939360a653533393164386266646337663234
+  33306333663165303431343537336465383937646437643630313037326135643666656435373331
+  6563303734643532370a313361656434333537366636366265653861656636386164373261666633
+  31646263326539303862386261623938323338333839656135656663643231653361663438326136
+  65306537383931393432633561333131386138333132383737383539646233313735613566633537
+  61656630396333376635393264346266356238626134316331623638393234363161336439303939
+  31393361393432366638613865323663326630306432363364663266663264656339323939306266
+  62646464306363353032326638613361633433303433633361656662353237396631
--- a/ansible/roles/intersect-docker/vars/yourls.yml
+++ b/ansible/roles/intersect-docker/vars/yourls.yml
@ -0,0 +1,12 @@
+yourls:
+  user_password: !vault |
+    $ANSIBLE_VAULT;1.1;AES256
+    66613263376130663031363539633863343432323330396135633639613138343139333930643030
+    3131316364323235623237373435356635333230336463660a626266396133383261353264333536
+    32356634396631323961366537393063373032373538373733663564336163376634363766613337
+    6431373166323137300a643766303932353434393266393566663738633864313934623466613235
+    33653439313766633334393433376430393138636564383861306631353633653365366432616338
+    31626535646630376666386437393633336530343265656464653164356463346135383562363965
+    34303039363662643261306139373139646264613630623362613438333466356434636166636162
+    33636662353336373838336437346233343338383731316538323366653261363265643239653536
+    36326461396235353533653136626361363631363539363830623663386435313332