Initial commit: bastion server project

Add Docker configurations for Ghost, Git server, and Nginx services
with documentation and architecture diagrams.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

18 files changed, 874 insertions, 0 deletions

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4c49bd7
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.env
diff --git a/Readme.md b/Readme.md
new file mode 100644
index 0000000..bb77cd9
--- /dev/null
+++ b/Readme.md
@@ -0,0 +1,103 @@
+# BASTION
+It's server system, that serves for control projects.
+
+
+## Architecture
+All architecture can be seen in Documentation/bastion.{jpg/drawio}
+
+Bastion are separates on parts (stacks), that works in containers 
+
+
+
+## Host
+
+Requirments
+1) debian 
+
+2) docker
+
+installing docker: https://docs.docker.com/engine/install/debian/#install-using-the-repository
+
+## Each stack
+
+### Portainer
+Portainer is great option for control docker on machine and fast deploy stacks.
+
+docker run -d --name="portainer" --restart on-failure -p 9000:9000 -p 8000:8000 -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest
+
+### Nginx 
+Main Web server. Through it each other container goes out. 
+Locates on each stack network (to working reverse proxy)
+
+Has one working container
+Web-Server container
+main nginx container, has outs to 80, 8000, 443
+has next volumes:
+1. nginx conf directory, each service has own nginx file
+2. letsencrypt etc - letsencrypt SSL certs
+3. lts_site - letsencrypt plug site (now not works)
+4. dhparam - dhparam cert
+
+certbot
+letsencrypt container, that gives certs to certs volume
+for work need running nginx container (acma) (and in firtst case it needed to disable ssl part of nginx conf)
+it runs via run_certbot.sh script, where i can setup email, domian...
+
+
+Instruction for build
+1) create directories:
+a. nginx conf (f.e. /var/nginx/conf) and copy nginx.conf to it
+b. dh_param (f.e. /var/dh_param) and create cert: sudo openssl dhparam -out dhparam-2048.pem 2048
+c. letsencrypt dir (f.e. /var/letsencrypt) and two subdirs for it: 
+ c.a. /var/letsencrypt/etc - for lts certificates
+ c.b. /var/letsencrypt/lts_site - for lts site (now not worknig :( ) and copy index.html to it 
+
+2) run nginx server 
+docker compose up 
+IMPORTANT: now there is bug, where i can run nginx without ready certs, therefore it needed to comment ssl part of nginx.conf
+3) run certbot script, it will create certs
+4) rerun nginx server (with uncommented SSL part)
+
+TODO:
+1) make automatic renew of certificate
+2) make normal locating of nginx configs
+
+Usefull links:
+https://phoenixnap.com/kb/letsencrypt-docker
+https://stackoverflow.com/questions/51399883/adding-ssl-certs-to-nginx-docker-container
+
+
+
+
+### Ghost 
+### Git
+Git stack has git server, cgit and gerrit.
+
+Git server, that provides access to git repos via ssh(22 port) and git(9418)
+It's simple container with openssh, git and git daemon.
+
+Based on https://github.com/jkarlosb/git-server-docker/
+
+Notes:
+1) git daemon runnnig via runuser, because we need to run daemon from git user
+
+Usefull links:
+https://gpanders.com/blog/creating-your-own-git-server
+https://linuxconfig.org/how-to-export-repositories-with-the-git-daemon
+https://askubuntu.com/questions/1550366/ssh-sshd-breaking-changes-in-24-04 (why choose debian instead of ubuntu)
+
+TODO:
+1) maybe create git.service with systemd (somehow) instead of running from script with detach?
+
+
+Cgit
+
+### Jenkins
+### Nexus
+
+
+## Firewall
+ATM is developing
+In final it must allow only 80,8080, 8000, 443, 22, 4096, ssh port and maybe some debug purpose port
+
+## Backup
diff --git a/doc/December.drawio b/doc/December.drawio
new file mode 100644
index 0000000..c433002
--- /dev/null
+++ b/doc/December.drawio
@@ -0,0 +1,178 @@
+<mxfile host="app.diagrams.net" agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" version="29.2.9">
+  <diagram name="Page-1" id="vdW78jsPRzWQe5W3cWmC">
+    <mxGraphModel dx="2528" dy="2031" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
+      <root>
+        <mxCell id="0" />
+        <mxCell id="1" parent="0" />
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-18" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;dashed=1;dashPattern=8 4 1 4;verticalAlign=top;align=left;" value="GHOST NETWORK" vertex="1">
+          <mxGeometry height="580" width="630" x="-460" y="300" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-11" parent="1" style="rounded=0;whiteSpace=wrap;html=1;dashed=1;fillColor=none;align=left;verticalAlign=top;" value="GHOST STACK" vertex="1">
+          <mxGeometry height="480" width="530" x="-390" y="350" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="NGINX" vertex="1">
+          <mxGeometry height="60" width="120" x="430" y="200" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-4" parent="1" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" value="swave.lol" vertex="1">
+          <mxGeometry height="80" width="120" x="420" y="-40" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-6" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.775;entryY=0.913;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-4">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-7" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-6" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="443" vertex="1">
+          <mxGeometry relative="1" x="0.5697" y="-7" as="geometry">
+            <mxPoint as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-9" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-8" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" target="ukYa1G1XDBr4NXfLDrGU-1">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-17" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-9" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="2368" vertex="1">
+          <mxGeometry relative="1" x="0.0371" as="geometry">
+            <mxPoint as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-8" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="GHOST" vertex="1">
+          <mxGeometry height="60" width="120" x="-170" y="380" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-26" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-10" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" target="ukYa1G1XDBr4NXfLDrGU-25">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-10" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="&lt;div&gt;GHOST-DB&lt;/div&gt;&lt;div&gt;(mysql)&lt;/div&gt;" vertex="1">
+          <mxGeometry height="60" width="120" x="-300" y="570" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-13" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="ACTIVITYPUB" vertex="1">
+          <mxGeometry height="60" width="120" x="-300" y="460" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-23" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-15" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" target="ukYa1G1XDBr4NXfLDrGU-21">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-15" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="ACTIVITYPUB MIGRATE (executes ones)" vertex="1">
+          <mxGeometry height="60" width="120" y="430" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-21" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="GHOST_DATA&amp;nbsp;&lt;div&gt;locates on host: /var/ghost&lt;/div&gt;" vertex="1">
+          <mxGeometry height="100" width="150" x="-80" y="620" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-22" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-8" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-21">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-24" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-13" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-21">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-25" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="MYSQL_DB&lt;div&gt;locates on host: /var/mysql_db&lt;/div&gt;" vertex="1">
+          <mxGeometry height="110" width="180" x="-330" y="700" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-29" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-28" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=1;entryY=0.5;entryDx=0;entryDy=0;" target="ukYa1G1XDBr4NXfLDrGU-1">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-30" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-29" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="9000" vertex="1">
+          <mxGeometry relative="1" x="-0.0014" y="-1" as="geometry">
+            <mxPoint as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-28" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="PORTAINER.IO" vertex="1">
+          <mxGeometry height="60" width="120" x="840" y="20" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-31" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="portainer_data" vertex="1">
+          <mxGeometry height="80" width="120" x="730" y="150" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-32" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-28" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-31">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-33" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="docker.sock" vertex="1">
+          <mxGeometry height="80" width="110" x="910" y="150" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-34" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-28" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-33">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-35" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.454;entryY=0.936;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-4">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-36" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-35" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="80" vertex="1">
+          <mxGeometry relative="1" x="0.4183" y="-1" as="geometry">
+            <mxPoint as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-37" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;dashed=1;dashPattern=8 4 1 4;align=left;verticalAlign=top;" value="JENKINS NETWORK" vertex="1">
+          <mxGeometry height="480" width="570" x="650" y="340" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-38" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=default;dashed=1;dashPattern=8 4 1 4;align=left;verticalAlign=top;" value="NEXUS ARTIFACTS NETWORK" vertex="1">
+          <mxGeometry height="300" width="410" x="210" y="340" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-46" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-40" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=1;entryDx=0;entryDy=0;" target="ukYa1G1XDBr4NXfLDrGU-1">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-40" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="NEXUS" vertex="1">
+          <mxGeometry height="60" width="120" x="360" y="370" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-41" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="ARTIFACTORY&lt;div&gt;locates on host: /var/artifactory&lt;/div&gt;" vertex="1">
+          <mxGeometry height="120" width="190" x="370" y="490" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-43" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-40" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-41">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-47" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=1;entryY=0.75;entryDx=0;entryDy=0;" target="ukYa1G1XDBr4NXfLDrGU-1">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="850" y="245" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-59" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-47" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="8080" vertex="1">
+          <mxGeometry relative="1" x="-0.6204" y="1" as="geometry">
+            <mxPoint as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-54" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" target="ukYa1G1XDBr4NXfLDrGU-50">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="850" y="540" />
+              <mxPoint x="1060" y="540" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-55" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" target="ukYa1G1XDBr4NXfLDrGU-48">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-56" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-55" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="run jobs" vertex="1">
+          <mxGeometry relative="1" x="-0.1179" y="-1" as="geometry">
+            <mxPoint as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-57" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=1;entryY=0.75;entryDx=0;entryDy=0;" target="ukYa1G1XDBr4NXfLDrGU-1">
+          <mxGeometry relative="1" as="geometry">
+            <Array as="points">
+              <mxPoint x="810" y="245" />
+            </Array>
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-58" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-57" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="50000" vertex="1">
+          <mxGeometry relative="1" x="-0.6026" y="-2" as="geometry">
+            <mxPoint as="offset" />
+          </mxGeometry>
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-44" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="JENKINS" vertex="1">
+          <mxGeometry height="60" width="120" x="790" y="370" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-45" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=1;entryY=0.5;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-41">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-51" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-48" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" target="ukYa1G1XDBr4NXfLDrGU-50">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-48" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="JENKINS-DOCKER" vertex="1">
+          <mxGeometry height="60" width="120" x="990" y="370" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-49" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="JENKINS_DATA" vertex="1">
+          <mxGeometry height="100" width="170" x="720" y="650" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-50" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="JENKINS_CERTS" vertex="1">
+          <mxGeometry height="90" width="160" x="980" y="650" as="geometry" />
+        </mxCell>
+        <mxCell id="ukYa1G1XDBr4NXfLDrGU-53" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-49">
+          <mxGeometry relative="1" as="geometry" />
+        </mxCell>
+      </root>
+    </mxGraphModel>
+  </diagram>
+</mxfile>
diff --git a/ghost/.env.example b/ghost/.env.example
new file mode 100644
index 0000000..b15abff
--- /dev/null
+++ b/ghost/.env.example
@@ -0,0 +1,55 @@
+# Based on https://github.com/TryGhost/ghost-docker
+#
+
+# Use the below flags to enable the Analytics or ActivityPub containers as well
+COMPOSE_PROFILES=activitypub
+
+# Ghost domain
+# Custom public domain Ghost will run on
+DOMAIN=swawe.lol
+
+# Ghost Admin domain
+# If you have Ghost Admin setup on a separate domain uncomment the line below and add the domain
+# You also need to uncomment the corresponding block in your Caddyfile
+# ADMIN_DOMAIN=
+
+# Database settings
+# All database settings must not be changed once the database is initialised
+DATABASE_ROOT_PASSWORD=
+DATABASE_USER=
+DATABASE_PASSWORD=
+
+# ActivityPub
+# If you'd prefer to self-host ActivityPub yourself uncomment the line below
+ACTIVITYPUB_TARGET=activitypub:8080
+
+# Ghost configuration (https://ghost.org/docs/config/)
+
+# SMTP Email (https://ghost.org/docs/config/#mail)
+# Transactional email is required for logins, account creation (staff invites), password resets and other features
+# This is not related to bulk mail / newsletter sending
+#mail__transport=SMTP
+#mail__options__host=smtp.example.com
+#mail__options__port=465
+#mail__options__secure=true
+#mail__options__auth__user=postmaster@example.com
+#mail__options__auth__pass=1234567890
+
+# Advanced customizations
+
+# Force Ghost version
+# You should only do this if you need to pin a specific version
+# The update commands won't work
+# GHOST_VERSION=6-alpine
+
+# Port Ghost should listen on
+# You should only need to edit this if you want to host
+# multiple sites on the same server
+# GHOST_PORT=2368
+
+# Data locations
+# Location to store uploaded data
+UPLOAD_LOCATION=./docker/ghost/
+
+# Location for database data
+MYSQL_DATA_LOCATION=./docker/mysql
diff --git a/ghost/compose.yml b/ghost/compose.yml
new file mode 100644
index 0000000..10ca118
--- /dev/null
+++ b/ghost/compose.yml
@@ -0,0 +1,105 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/compose-spec/compose-spec/main/schema/compose-spec.json
+# Based on https://github.com/TryGhost/ghost-docker and https://noted.lol/self-host-ghost/
+# I removed caddy and tinnybird
+services:
+
+  ghost:
+    # Do not alter this without updating the Tinybird Sync container as well
+    image: ghost:${GHOST_VERSION:-6-alpine}
+    restart: always
+    ports: # we need ports for testing
+      - 2368:2368
+        #expose:
+        #- "127.0.0.1:${GHOST_PORT:-2368}"
+    # This is required to import current config when migrating
+    # IMPORTANT
+    # In usual install use .env
+    # In case of portainer.io use stack.env
+    env_file:
+      stack.env
+    environment:
+      NODE_ENV: production
+      url: http://${DOMAIN:?DOMAIN environment variable is required}
+      #url: https://${DOMAIN:?DOMAIN environment variable is required} ATM i have not SSL for it
+      #admin__url: ${ADMIN_DOMAIN:+https://${ADMIN_DOMAIN}}
+      admin__url: ${ADMIN_DOMAIN:+http://${ADMIN_DOMAIN}}
+      database__client: mysql
+      database__connection__host: ghost-db
+      database__connection__user: ${DATABASE_USER:-ghost}
+      database__connection__password: ${DATABASE_PASSWORD:?DATABASE_PASSWORD environment variable is required}
+      database__connection__database: ghost
+    volumes:
+      - ${UPLOAD_LOCATION:-./data/ghost}:/var/lib/ghost/content
+    depends_on:
+      ghost-db:
+        condition: service_healthy
+      activitypub:
+        condition: service_started
+        required: false
+    networks:
+      - ghost_network
+
+  ghost-db:
+    image: mysql:8
+    restart: always
+    expose:
+      - "3306"
+    environment:
+      MYSQL_ROOT_PASSWORD: ${DATABASE_ROOT_PASSWORD:?DATABASE_ROOT_PASSWORD environment variable is required}
+      MYSQL_USER: ${DATABASE_USER:-ghost}
+      MYSQL_PASSWORD: ${DATABASE_PASSWORD:?DATABASE_PASSWORD environment variable is required}
+      MYSQL_DATABASE: ghost
+      MYSQL_MULTIPLE_DATABASES: activitypub
+    volumes:
+      - /var/lib/docker/mysql-init-script:/docker-entrypoint-initdb.d
+      - ${MYSQL_DATA_LOCATION:-./data/mysql}:/var/lib/mysql
+    healthcheck:
+      test: mysqladmin ping -p$$MYSQL_ROOT_PASSWORD -h 127.0.0.1
+      interval: 1s
+      start_period: 30s
+      start_interval: 10s
+      retries: 120
+    networks:
+      - ghost_network
+
+  activitypub:
+    image: ghcr.io/tryghost/activitypub:1.1.0
+    restart: always
+    expose:
+      - "8080"
+    volumes:
+      - ${UPLOAD_LOCATION:-./data/ghost}:/opt/activitypub/content
+    environment:
+      # See https://github.com/TryGhost/ActivityPub/blob/main/docs/env-vars.md
+      NODE_ENV: production
+      MYSQL_HOST: ghost-db
+      MYSQL_USER: ${DATABASE_USER:-ghost}
+      MYSQL_PASSWORD: ${DATABASE_PASSWORD:?DATABASE_PASSWORD environment variable is required}
+      MYSQL_DATABASE: activitypub
+      LOCAL_STORAGE_PATH: /opt/activitypub/content/images/activitypub
+      LOCAL_STORAGE_HOSTING_URL: https://${DOMAIN}/content/images/activitypub
+    depends_on:
+      ghost-db:
+        condition: service_healthy
+      activitypub-migrate:
+        condition: service_completed_successfully
+    profiles: [activitypub]
+    networks:
+      - ghost_network
+
+  # Suporting Services
+  activitypub-migrate:
+    image: ghcr.io/tryghost/activitypub-migrations:1.1.0
+    environment:
+      MYSQL_DB: mysql://${DATABASE_USER:-ghost}:${DATABASE_PASSWORD:?DATABASE_PASSWORD environment variable is required}@tcp(ghost-db:3306)/activitypub
+    networks:
+      - ghost_network
+    depends_on:
+      ghost-db:
+        condition: service_healthy
+    profiles: [activitypub]
+    restart: no
+
+networks:
+  ghost_network:
diff --git a/ghost/mysql-init-script/create-multiple-databases.sh b/ghost/mysql-init-script/create-multiple-databases.sh
new file mode 100644
index 0000000..6b0d32e
--- /dev/null
+++ b/ghost/mysql-init-script/create-multiple-databases.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -e
+set -u
+
+if [ -n "$MYSQL_MULTIPLE_DATABASES" ]; then
+  echo "Creating multiple databases: $MYSQL_MULTIPLE_DATABASES"
+
+  for db in $(echo "$MYSQL_MULTIPLE_DATABASES" | tr ',' ' '); do
+    echo "Creating database: $db"
+    mysql -u root -p"$MYSQL_ROOT_PASSWORD" <<-EOSQL
+      CREATE DATABASE IF NOT EXISTS \`$db\`;
+      GRANT ALL ON \`$db\`.* TO '$MYSQL_USER'@'%';
+EOSQL
+  done
+
+  echo "Multiple databases created"
+fi
diff --git a/ghost/stack.env b/ghost/stack.env
new file mode 100644
index 0000000..941f07e
--- /dev/null
+++ b/ghost/stack.env
@@ -0,0 +1,54 @@
+# Based on https://github.com/TryGhost/ghost-docker
+#
+
+# Use the below flags to enable the Analytics or ActivityPub containers as well
+COMPOSE_PROFILES=activitypub
+
+# Ghost domain
+# Custom public domain Ghost will run on
+DOMAIN=swave.lol:2368
+
+# Ghost Admin domain
+# If you have Ghost Admin setup on a separate domain uncomment the line below and add the domain
+# You also need to uncomment the corresponding block in your Caddyfile
+# ADMIN_DOMAIN=
+
+# Database settings
+# All database settings must not be changed once the database is initialised
+DATABASE_ROOT_PASSWORD=ghostuserp@ssword
+DATABASE_USER=ghost
+DATABASE_PASSWORD=ghostghostpasswOrd
+# ActivityPub
+# If you'd prefer to self-host ActivityPub yourself uncomment the line below
+ACTIVITYPUB_TARGET=activitypub:8080
+
+# Ghost configuration (https://ghost.org/docs/config/)
+
+# SMTP Email (https://ghost.org/docs/config/#mail)
+# Transactional email is required for logins, account creation (staff invites), password resets and other features
+# This is not related to bulk mail / newsletter sending
+#mail__transport=SMTP
+#mail__options__host=smtp.example.com
+#mail__options__port=465
+#mail__options__secure=true
+#mail__options__auth__user=postmaster@example.com
+#mail__options__auth__pass=1234567890
+
+# Advanced customizations
+
+# Force Ghost version
+# You should only do this if you need to pin a specific version
+# The update commands won't work
+# GHOST_VERSION=6-alpine
+
+# Port Ghost should listen on
+# You should only need to edit this if you want to host
+# multiple sites on the same server
+# GHOST_PORT=2368
+
+# Data locations
+# Location to store uploaded data
+UPLOAD_LOCATION=./docker/ghost/
+
+# Location for database data
+MYSQL_DATA_LOCATION=./docker/mysql
diff --git a/git-server/Dockerfile b/git-server/Dockerfile
new file mode 100644
index 0000000..b8a905f
--- /dev/null
+++ b/git-server/Dockerfile
@@ -0,0 +1,35 @@
+#Use basic ubuntu to git server and git daemon
+FROM debian:latest
+
+RUN apt-get -y update && apt-get -y install openssh-server git
+
+# Key generation on the server
+RUN ssh-keygen -A
+
+WORKDIR /git-server/
+
+# -D flag avoids password generation
+# -s flag changes user's shell
+RUN mkdir /git-server/keys \
+  && adduser --disabled-password --shell /usr/bin/git-shell git \
+  && echo git:12345 | chpasswd \
+  && mkdir /home/git/.ssh
+
+
+# This is a login shell for SSH accounts to provide restricted Git access.
+# It permits execution only of server-side Git commands implementing the
+# pull/push functionality, plus custom commands present in a subdirectory
+# named git-shell-commands in the user’s home directory.
+# More info: https://git-scm.com/docs/git-shell
+COPY git-shell-commands /home/git/git-shell-commands
+
+
+# sshd_config file is edited for enable access key and disable access password
+COPY sshd_config /etc/ssh/sshd_config
+COPY start.sh start.sh
+#COPY git.service /etc/systemd/git.service
+
+EXPOSE 22
+EXPOSE 9418
+
+CMD ["sh", "start.sh"]
diff --git a/git-server/Readme.md b/git-server/Readme.md
new file mode 100644
index 0000000..60e0073
--- /dev/null
+++ b/git-server/Readme.md
@@ -0,0 +1 @@
+Based on https://github.com/jkarlosb/git-server-docker/
diff --git a/git-server/git-shell-commands/no-interactive-login b/git-server/git-shell-commands/no-interactive-login
new file mode 100755
index 0000000..cb88a07
--- /dev/null
+++ b/git-server/git-shell-commands/no-interactive-login
@@ -0,0 +1,5 @@
+#!/bin/sh
+printf '%s\n' "Welcome to git-server-docker!"
+printf '%s\n' "You've successfully authenticated, but I do not"
+printf '%s\n' "provide interactive shell access."
+exit 128
diff --git a/git-server/git.service b/git-server/git.service
new file mode 100644
index 0000000..f7df6a4
--- /dev/null
+++ b/git-server/git.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Start Git Daemon
+
+[Service]
+User=git
+Group=git
+ExecStart=/usr/bin/git daemon --reuseaddr --base-path=/repos --export-all --informative-errors --verbose
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target
diff --git a/git-server/server.yaml b/git-server/server.yaml
new file mode 100644
index 0000000..af6b381
--- /dev/null
+++ b/git-server/server.yaml
@@ -0,0 +1,27 @@
+version: '2'
+
+services:
+
+  git-server:
+    image: git-server
+    restart: always
+    container_name: git-server
+    ports:
+      - "22:22"
+      - "9418:9418"
+    volumes:
+    - /var/git_ssh_keys:/git-server/keys
+    - /var/git:/repos
+    networks:
+      git-network:
+        ipv4_address: 172.22.0.2
+
+
+networks:
+  git-network:
+    name: git-network
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.22.0.0/16
+          gateway: 172.22.0.1
diff --git a/git-server/sshd_config b/git-server/sshd_config
new file mode 100644
index 0000000..102169d
--- /dev/null
+++ b/git-server/sshd_config
@@ -0,0 +1,145 @@
+#	$OpenBSD: sshd_config,v 1.98 2016/02/17 05:29:04 djm Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+# The default requires explicit activation of protocol 1
+#Protocol 2
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 1024
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+#PermitRootLogin prohibit-password
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+# RSAAuthentication yes
+PubkeyAuthentication yes
+
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+# but this is overridden so installations will only check .ssh/authorized_keys
+AuthorizedKeysFile	.ssh/authorized_keys
+#AuthorizedKeysFile	/home/git/.ssh/authorized_keys
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#RhostsRSAAuthentication no
+# similar for protocol version 2
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication no
+#PermitEmptyPasswords no
+
+# Change to no to disable s/key passwords
+#ChallengeResponseAuthentication yes
+
+# Kerberos options (deprecated)
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options (deprecated)
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+#UsePAM no
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+#UsePrivilegeSeparation sandbox
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem	sftp	/usr/lib/ssh/sftp-server
+
+# the following are HPN related configuration options
+# tcp receive buffer polling. disable in non autotuning kernels
+#TcpRcvBufPoll yes
+
+# disable hpn performance boosts
+#HPNDisabled no
+
+# buffer size for hpn to non-hpn connections
+#HPNBufferSize 2048
+
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server
diff --git a/git-server/start.sh b/git-server/start.sh
new file mode 100644
index 0000000..dcfb471
--- /dev/null
+++ b/git-server/start.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+# If there is some public key in keys folder
+# then it copies its contain in authorized_keys file
+if [ "$(ls -A /git-server/keys/)" ]; then
+  cd /home/git
+  cat /git-server/keys/*.pub > .ssh/authorized_keys
+  chown -R git:git .ssh
+  chmod 700 .ssh
+  chmod -R 600 .ssh/*
+fi
+
+# Checking permissions and fixing SGID bit in repos folder
+# More info: https://github.com/jkarlosb/git-server-docker/issues/1
+if [ "$(ls -A /repos/)" ]; then
+  cd /repos
+  chown -R git:git .
+  chmod -R ug+rwX .
+  find . -type d -exec chmod g+s '{}' +
+fi
+
+# Run git daemon
+#systemctl enable --now git.service
+runuser -u  git --  git daemon --reuseaddr --base-path=/repos --export-all --informative-errors --verbose --detach
+
+# -D flag avoids executing sshd as a daemon
+/usr/sbin/sshd -D
diff --git a/nginx/docker-compose.yaml b/nginx/docker-compose.yaml
new file mode 100644
index 0000000..8aa8c4e
--- /dev/null
+++ b/nginx/docker-compose.yaml
@@ -0,0 +1,25 @@
+version: '3'
+
+services:
+  webserver:
+    image: nginx:latest
+    ports:
+      - 80:80
+        #- 8000:8000
+      - 443:443
+    restart: always
+    volumes:
+      - /var/nginx/conf/:/etc/nginx/conf.d:ro
+      - /var/letsencrypt/etc:/var/letsencrypt/etc:ro #letsencrypt SSL certs
+      - /var/letsencrypt/lts_site:/var/letsencrypt/lts_site:ro #letsencrypt plug site
+      - /var/dh_param/dhparam-2048.pem:/etc/ssl/certs/dhparam-2048.pem #dhparam cert
+    networks:
+      git-network:
+        ipv4_address: 172.22.0.254
+
+networks:
+  #write each stack network (or connect it manually later)
+  git-network:
+    name: git-network
+    external: true
+
diff --git a/nginx/letsencrypt/index.html b/nginx/letsencrypt/index.html
new file mode 100644
index 0000000..bd4cee4
--- /dev/null
+++ b/nginx/letsencrypt/index.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8" />
+    <title>LetsEncrypt Certs setup</title>
+</head>
+<body>
+    
+    <p>LetsEncrypt Certs setup</p>
+</body>
+</html>
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
new file mode 100644
index 0000000..9e49ae7
--- /dev/null
+++ b/nginx/nginx.conf
@@ -0,0 +1,52 @@
+error_log /var/log/nginx/error.log warn;
+
+server {
+    listen 80;
+    listen [::]:80;
+
+    server_name swave.lol;
+
+    location / {
+        rewrite ^ https://$host$request_uri? permanent;
+    }
+
+    #for certbot challenges (renewal process)
+    location ~ /.well-known/acme-challenge {
+        allow all;
+        root /var/letsencrypt/lts_site;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name swave.com;
+
+    server_tokens off;
+
+    ssl_certificate /var/letsencrypt/etc/letsencrypt/live/swave.lol/fullchain.pem;
+    ssl_certificate_key /var/letsencrypt/etc/letsencrypt/live/swave.lol/privkey.pem;
+
+    ssl_buffer_size 8k;
+
+    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
+    ssl_prefer_server_ciphers on;
+
+    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
+
+    ssl_ecdh_curve secp384r1;
+    ssl_session_tickets off;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    resolver 8.8.8.8;
+
+
+    # Define the specified charset to the “Content-Type” response header field
+    charset utf-8;
+}
+
diff --git a/nginx/run_certbot.sh b/nginx/run_certbot.sh
new file mode 100644
index 0000000..27e9127
--- /dev/null
+++ b/nginx/run_certbot.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+email=arseney300@gmail.com
+domain=swave.lol
+dir=/var/
+lts_dir=$dir/letsencrypt
+
+#create dir for lts etc
+mkdir $lts_dir/etc
+mkdir $lts_dir/lts_site
+cp letsencrypt/index.html $lts_dir/lts_site
+
+docker run -it --rm \
+  -v $lts_dir/etc:/etc/letsencrypt \
+  -v $lts_dir/lts_site:/data/letsencrypt \
+  certbot/certbot \
+  certonly --webroot \
+  --email $email \
+  --agree-tos --no-eff-email \
+  --webroot-path=/data/letsencrypt \
+  -d $domain