Merge branch 'master' into leanpub-preview

2026-10-31 21:18:18 +00:00 · 2020-03-25 13:09:21 +13:00
commit 37c2f9a159
@@ -111,8 +111,8 @@ networks:

 Now work your way through the list of tools below, adding whichever tools your want to use, and finishing with the **end** section:

-* [SABnzbd](/recipes/autopirate/sabnzbd.md)
-* [NZBGet](/recipes/autopirate/nzbget.md)
+* [SABnzbd](/recipes/autopirate/sabnzbd/)
+* [NZBGet](/recipes/autopirate/nzbget/)
 * [RTorrent](/recipes/autopirate/rtorrent/)
 * [Sonarr](/recipes/autopirate/sonarr/)
 * [Radarr](/recipes/autopirate/radarr/)
@@ -125,7 +125,7 @@ Now work your way through the list of tools below, adding whichever tools your w
 * [Jackett](/recipes/autopirate/jackett/)
 * [End](/recipes/autopirate/end/) (launch the stack)

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -13,7 +13,7 @@ Log into each of your new tools at its respective HTTPS URL. You'll be prompted

 1. This is a complex stack. Sing out in the comments if you found a flaw or need a hand :)

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -74,7 +74,7 @@ Continue through the list of tools below, adding whichever tools your want to us

 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -81,7 +81,7 @@ Continue through the list of tools below, adding whichever tools your want to us
 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.
 2. The inclusion of Heimdall was due to the efforts of @gkoerk in our [Discord server](http://chat.funkypenguin.co.nz). Thanks gkoerk!

-### Tip your waiter (donate) 👏
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏

@@ -74,7 +74,7 @@ Continue through the list of tools below, adding whichever tools your want to us

 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -87,7 +87,7 @@ Continue through the list of tools below, adding whichever tools your want to us
 1. The calibre-server container co-exists within the Lazy Librarian (LL) containers so that LL can automatically add a book to Calibre using the calibre-server interface. The calibre library can then be properly viewed using the [calibre-web](/recipes/calibre-web) recipe.
 2. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -76,7 +76,7 @@ Continue through the list of tools below, adding whichever tools your want to us
 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.
 2. The addition of the Lidarr recipe was contributed by our very own @gpulido in Discord (http://chat.funkypenguin.co.nz) - Thanks Gabriel!

-### Tip your waiter (donate) 👏
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏

@@ -72,7 +72,11 @@ Continue through the list of tools below, adding whichever tools your want to us

 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.

-### Tip your waiter (donate) 
+2. If you intend to configure Mylar to perform its own NZB searches and push the hits to a downloader such as SABnzbd, then in addition to configuring the connection to SAB with host, port and api key, you will need to set the parameter `host_return` parameter to the fully qualified Mylar address (e.g. `http://mylar:8090`).
+
+    This will provide the link to the downloader necessary to initiate the download.  This parameter is not presented in the user interface so the config file (`$MYLAR_HOME/config.ini`) will need to be manually updated.  The parameter can be found under the [Interface] section of the file. ([Details](https://github.com/evilhero/mylar/issues/2242))
+
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -79,7 +79,7 @@ Continue through the list of tools below, adding whichever tools your want to us

 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -78,7 +78,7 @@ Continue through the list of tools below, adding whichever tools your want to us

 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -94,7 +94,7 @@ Continue through the list of tools below, adding whichever tools your want to us
 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra2, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.
 2. Note that NZBHydra2 _can_ co-exist with NZBHydra (1), but if you want your tools (Sonarr, Radarr, etc) to use NZBHydra2, you'll need to change both the target hostname (_to "hydra2"_) and the target port (_to 5076_).

-### Tip your waiter (donate) 👏
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏

@@ -79,7 +79,7 @@ Continue through the list of tools below, adding whichever tools your want to us

 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -90,7 +90,7 @@ Continue through the list of tools below, adding whichever tools your want to us

 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -79,7 +79,7 @@ Continue through the list of tools below, adding whichever tools your want to us

 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -86,7 +86,7 @@ Continue through the list of tools below, adding whichever tools your want to us

 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.

-### Tip your waiter (donate) 👏
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏

@@ -76,7 +76,7 @@ Continue through the list of tools below, adding whichever tools your want to us

 1. In many cases, tools will integrate with each other. I.e., Radarr needs to talk to SABnzbd and NZBHydra, Ombi needs to talk to Radarr, etc. Since each tool runs within the stack under its own name, just refer to each tool by name (i.e. "radarr"), and docker swarm will resolve the name to the appropriate container. You can identify the tool-specific port by looking at the docker-compose service definition.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -0,0 +1,101 @@
+# Bitwarden
+
+Heard about the [latest password breach](https://www.databreaches.net) (*since lunch*)? [HaveYouBeenPowned](http://haveibeenpwned.com) yet (*today*)? [Passwords are broken](https://www.theguardian.com/technology/2008/nov/13/internet-passwords), and as the amount of sites for which you need to store credentials grows exponetially, so does the risk of using a common password.
+
+"*Duh, use a password manager*", you say. Sure, but be aware that [even password managers have security flaws](https://www.securityevaluators.com/casestudies/password-manager-hacking/).
+
+**OK, look smartass..** no software is perfect, and there will always be a risk of your credentials being exposed in ways you didn't intend. You can at least **minimize** the impact of such exposure by using a password manager to store unique credentials per-site. While [1Password](http://1password.com) is king of the commercial password manager, [BitWarden](https://bitwarden.com) is king of the open-source, self-hosted password manager.
+
+Enter Bitwarden..
+
+![BitWarden Screenshot](../images/bitwarden.png)
+
+Bitwarden is a free and open source password management solution for individuals, teams, and business organizations. While Bitwarden does offer a paid / hosted version, the free version comes with the following (*better than any other free password manager!*):
+
+* Access & install all Bitwarden apps
+* Sync all of your devices, no limits!
+* Store unlimited items in your vault
+* Logins, secure notes, credit cards, & identities
+* Two-step authentication (2FA)
+* Secure password generator
+* Self-host on your own server (optional)
+
+## Ingredients
+
+!!! summary "Ingredients"
+    Existing:
+
+    1. [X] [Docker swarm cluster](/ha-docker-swarm/design/) with [persistent shared storage](/ha-docker-swarm/shared-storage-ceph.md)
+    2. [X] [Traefik](/ha-docker-swarm/traefik_public) configured per design
+    3. [X] DNS entry for the hostname you intend to use, pointed to your [keepalived](ha-docker-swarm/keepalived/) IP
+
+## Preparation
+
+### Setup data locations
+
+We'll need to create a directory to bind-mount into our container, so create `/var/data/bitwarden`:
+
+```
+mkdir /var/data/bitwarden
+```
+### Setup environment
+
+Create `/var/data/config/bitwarden/bitwarden.env`, and **leave it empty for now**.
+
+!!! question
+    What, why an empty env file? Well, the container supports lots of customizations via environment variables, for things like toggling self-registration, 2FA, etc. These are too complex to go into for this recipe, but readers are recommended to review the [dani-garcia/bitwarden_rs wiki](https://github.com/dani-garcia/bitwarden_rs), and customize their installation to suite.
+
+### Setup Docker Swarm
+
+Create a docker swarm config file in docker-compose syntax (v3), something like this:
+
+!!! tip
+        I share (_with my [patreon patrons](https://www.patreon.com/funkypenguin)_) a private "_premix_" git repository, which includes necessary docker-compose and env files for all published recipes. This means that patrons can launch any recipe with just a ```git pull``` and a ```docker stack deploy``` 👍
+
+
+```
+version: "3"
+services:
+  bitwarden:
+    image: bitwardenrs/server
+    env_file: /var/data/config/bitwarden/bitwarden.env
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /var/data/bitwarden:/data/:rw
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.web.frontend.rule=Host:bitwarden.example.com
+        - traefik.web.port=80
+        - traefik.hub.frontend.rule=Host:bitwarden.example.com;Path:/notifications/hub
+        - traefik.hub.port=3012
+        - traefik.docker.network=traefik_public
+    networks:
+        - traefik_public
+
+networks:
+  traefik_public:
+    external: true
+```
+
+!!! note
+    Note the clever use of two Traefik frontends to expose the notifications hub on port 3012. Thanks @gkoerk!
+
+
+## Serving
+
+### Launch Bitwarden stack
+
+Launch the Bitwarden stack by running ```docker stack deploy bitwarden -c <path -to-docker-compose.yml>```
+
+Browse to your new instance at https://**YOUR-FQDN**, and create a new user account and master password (*Just click the **Create Account** button without filling in your email address or master password*)
+
+### Get the apps / extensions
+
+Once you've created your account, jump over to https://bitwarden.com/#download and download the apps for your mobile and browser, and start adding your logins!
+
+## Chef's Notes 📓
+
+1. You'll notice we're not using the *official* container images (*[all 6 of them required](https://help.bitwarden.com/article/install-on-premise/#install-bitwarden)!)*, but rather a [more lightweight version ideal for self-hosting](https://hub.docker.com/r/bitwardenrs/server). All of the elements are contained within a single container, and SQLite is used for the database backend.
+2. As mentioned above, readers should refer to the [dani-garcia/bitwarden_rs wiki](https://github.com/dani-garcia/bitwarden_rs) for details on customizing the behaviour of Bitwarden.
+3. The inclusion of Bitwarden was due to the efforts of @gkoerk in our [Discord server](http://chat.funkypenguin.co.nz)- Thanks Gerry!
@@ -13,7 +13,7 @@ I like to protect my public-facing web UIs with an [oauth_proxy](/reference/oaut
 ## Ingredients

 1. [Docker swarm cluster](/ha-docker-swarm/design/) with [persistent shared storage](/ha-docker-swarm/shared-storage-ceph.md)
-2. [Traefik](/ha-docker-swarm/traefik_public) configured per design
+2. [Traefik](/ha-docker-swarm/traefik/) configured per design
 3. DNS entry for the hostname you intend to use, pointed to your [keepalived](ha-docker-swarm/keepalived/) IP

 ## Preparation
@@ -141,12 +141,6 @@ Launch the BookStack stack by running ```docker stack deploy bookstack -c <path

 Log into your new instance at https://**YOUR-FQDN**, authenticate with oauth_proxy, and then login with username 'admin@admin.com' and password 'password'.

-## Chef's Notes
+## Chef's Notes 📓

-1. If you wanted to expose the BookStack UI directly, you could remove the oauth2_proxy from the design, and move the traefik_public-related labels directly to the bookstack container. You'd also need to add the traefik_public network to the bookstack container.
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
+1. If you wanted to expose the BookStack UI directly, you could remove the oauth2_proxy from the design, and move the traefik_public-related labels directly to the bookstack container. You'd also need to add the traefik_public network to the bookstack container.
@@ -122,13 +122,7 @@ Launch the Calibre-Web stack by running ```docker stack deploy calibre-web -c <p

 Log into your new instance at https://**YOUR-FQDN**. You'll be directed to the initial GUI configuraition. Set the first field (_Location of Calibre database_) to "_/books/_", and when complete, login using defaults username of "**admin**" with password "**admin123**".

-## Chef's Notes
+## Chef's Notes 📓

 1. Yes, Calibre does provide a server component. But it's not as fully-featured as Calibre-Web (_i.e., you can't use it to send ebooks directly to your Kindle_)
 2. A future enhancement might be integrating this recipe with the filestore for [NextCloud](/recipes/nextcloud/), so that the desktop database (Calibre) can be kept synced with Calibre-Web.
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -300,12 +300,7 @@ Now browse your NextCloud files. Click the plus (+) sign to create a new documen

    [![Common Observatory](../images/common_observatory.png)](https://www.observe.global/)

-## Chef's Notes
+## Chef's Notes 📓

 1. Yes, this recipe is complicated. And you probably only care if you feel strongly about using Open Source rich document editing in the browser, vs using something like Google Docs. It works impressively well however, once it works. I hope to make this recipe simpler once the CODE developers have documented how to pass optional parameters as environment variables.

-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
@@ -23,15 +23,6 @@ This recipe isn't for everyone - if you just want to make some money from crypto

 For readability, I've split this recipe into multiple sub-recipes, which can be found below, or in the navigation links on the right-hand side:

-<<<<<<< HEAD:manuscript/recipies/cryptominer.md
-1. Build your [mining rig](/recipies/cryptominer/mining-rig/) 💻
-2. Setup your [AMD](/recipies/cryptominer/amd-gpu/) or [Nvidia](/recipies/cryptominer/nvidia-gpu/) GPUs 🎨
-3. Sign up for [mining pools](/recipies/cryptominer/mining-pool/) :swimmer:
-4. Setup your miners with [Miner Hotel](/recipies/cryptominer/minerhotel/) 🏨
-5. Send your coins to [exchanges](/recipies/cryptominer/exchange/) or [wallets](/recipies/cryptominer/wallet/) 💹
-6. [Monitor](/recipies/cryptominer/monitor/) your empire :heartbeat:
-7. [Profit](/recipies/cryptominer/profit/)! 
-=======
 1. Build your [mining rig](/recipes/cryptominer/mining-rig/) 💻
 2. Setup your [AMD](/recipes/cryptominer/amd-gpu/) or [Nvidia](/recipes/cryptominer/nvidia-gpu/) GPUs 🎨
 3. Sign up for [mining pools](/recipes/cryptominer/mining-pool/) :swimmer:
@@ -39,13 +30,12 @@ For readability, I've split this recipe into multiple sub-recipes, which can be
 5. Send your coins to [exchanges](/recipes/cryptominer/exchange/) or [wallets](/recipes/cryptominer/wallet/) 💹
 6. [Monitor](/recipes/cryptominer/monitor/) your empire :heartbeat:
 7. [Profit](/recipes/cryptominer/profit/)! 💰
->>>>>>> master:manuscript/recipes/cryptominer.md

 ## Chef's Notes

 1. Ultimately I hope to move all the configuration / mining executables into docker containers, but for now, they're running on a CentOS7 host for direct access to GPUs. (Apparently it _may_ be possible to pass-thru the GPUs to docker containers, but I wanted stability first, before abstracting my hardware away from my miners)

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -149,15 +149,6 @@ If you want to tweak the BIOS yourself, download the [Polaris bios editor](https

 Now, continue to the next stage of your grand mining adventure:

-<<<<<<< HEAD:manuscript/recipies/cryptominer/amd-gpu.md
-1. Build your [mining rig](/recipies/cryptominer/mining-rig/) 💻
-2. Setup your AMD (_this page_) or [Nvidia](/recipies/cryptominer/nvidia-gpu/) GPUs 🎨
-3. Sign up for [mining pools](/recipies/cryptominer/mining-pool/) :swimmer:
-3. Setup your miners with [Miner Hotel](/recipies/cryptominer/minerhotel/) 🏨
-4. Send your coins to [exchanges](/recipies/cryptominer/exchange/) or [wallets](/recipies/cryptominer/wallet/) 💹
-5. [Monitor](/recipies/cryptominer/monitor/) your empire :heartbeat:
-6. [Profit](/recipies/cryptominer/profit/)! 
-=======
 1. Build your [mining rig](/recipes/cryptominer/mining-rig/) 💻
 2. Setup your AMD (_this page_) or [Nvidia](/recipes/cryptominer/nvidia-gpu/) GPUs 🎨
 3. Sign up for [mining pools](/recipes/cryptominer/mining-pool/) :swimmer:
@@ -165,14 +156,13 @@ Now, continue to the next stage of your grand mining adventure:
 4. Send your coins to [exchanges](/recipes/cryptominer/exchange/) or [wallets](/recipes/cryptominer/wallet/) 💹
 5. [Monitor](/recipes/cryptominer/monitor/) your empire :heartbeat:
 6. [Profit](/recipes/cryptominer/profit/)! 💰
->>>>>>> master:manuscript/recipes/cryptominer/amd-gpu.md


 ## Chef's Notes

 1. My two RX580 cards (_bought alongside each other_) perform slightly differently. GPU0 works with a 2050Mhz memory clock, but GPU1 only works at 2000Mhz. Anything over 2000Mhz causes system instability. YMMV.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -37,15 +37,6 @@ Once you have enough coins in your exchange wallet, you can "trade" them into th

 Now, continue to the next stage of your grand mining adventure:

-<<<<<<< HEAD:manuscript/recipies/cryptominer/exchange.md
-1. Build your [mining rig](/recipies/cryptominer/mining-rig/) 💻
-2. Setup your [AMD](/recipies/cryptominer/amd-gpu/) or [Nvidia](/recipies/cryptominer/nvidia-gpu/) GPUs 🎨
-3. Sign up for [mining pools](/recipies/cryptominer/mining-pool/) :swimmer:
-4. Setup your miners with [Miner Hotel](/recipies/cryptominer/minerhotel/) 🏨
-5. Send your coins to exchanges (_This page_) or [wallets](/recipies/cryptominer/wallet/) 💹
-6. [Monitor](/recipies/cryptominer/monitor/) your empire :heartbeat:
-7. [Profit](/recipies/cryptominer/profit/)! 
-=======
 1. Build your [mining rig](/recipes/cryptominer/mining-rig/) 💻
 2. Setup your [AMD](/recipes/cryptominer/amd-gpu/) or [Nvidia](/recipes/cryptominer/nvidia-gpu/) GPUs 🎨
 3. Sign up for [mining pools](/recipes/cryptominer/mining-pool/) :swimmer:
@@ -53,12 +44,11 @@ Now, continue to the next stage of your grand mining adventure:
 5. Send your coins to exchanges (_This page_) or [wallets](/recipes/cryptominer/wallet/) 💹
 6. [Monitor](/recipes/cryptominer/monitor/) your empire :heartbeat:
 7. [Profit](/recipes/cryptominer/profit/)! 💰
->>>>>>> master:manuscript/recipes/cryptominer/exchange.md


 ## Chef's Notes

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -91,20 +91,14 @@ Now, continue to the next stage of your grand mining adventure:
 2. Setup your [AMD](/recipes/cryptominer/amd-gpu/) or [Nvidia](/recipes/cryptominer/nvidia-gpu/) GPUs 🎨
 3. Sign up for [mining pools](/recipes/cryptominer/mining-pool/) :swimmer:
 4. Setup your miners with Miner Hotel 🏨 (_This page_)
-<<<<<<< HEAD:manuscript/recipies/cryptominer/minerhotel.md
-5. Send your coins to [exchanges](/recipies/cryptominer/exchange/) or [wallets](/recipies/cryptominer/wallet/) 💹
-6. [Monitor](/recipies/cryptominer/monitor/) your empire :heartbeat:
-7. [Profit](/recipies/cryptominer/profit/)! 
-=======
 5. Send your coins to [exchanges](/recipes/cryptominer/exchange/) or [wallets](/recipes/cryptominer/wallet/) 💹
 6. [Monitor](/recipes/cryptominer/monitor/) your empire :heartbeat:
 7. [Profit](/recipes/cryptominer/profit/)! 💰
->>>>>>> master:manuscript/recipes/cryptominer/minerhotel.md


 ## Chef's Notes

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -40,15 +40,6 @@ As noted by IronicBadger [here](https://www.linuxserver.io/2018/01/20/how-to-bui

 Now, continue to the next stage of your grand mining adventure:

-<<<<<<< HEAD:manuscript/recipies/cryptominer/mining-pool.md
-1. Build your [mining rig](/recipies/cryptominer/mining-rig/) 💻
-2. Setup your [AMD](/recipies/cryptominer/amd-gpu/) or [Nvidia](/recipies/cryptominer/nvidia-gpu/) GPUs 🎨
-3. Sign up for [mining pools](/recipies/cryptominer/mining-pool/) :swimmer:
-4. Setup your miners with [Miner Hotel](/recipies/cryptominer/minerhotel/) 🏨
-5. Send your coins to exchanges (_This page_) or [wallets](/recipies/cryptominer/wallet/) 💹
-6. [Monitor](/recipies/cryptominer/monitor/) your empire :heartbeat:
-7. [Profit](/recipies/cryptominer/profit/)! 
-=======
 1. Build your [mining rig](/recipes/cryptominer/mining-rig/) 💻
 2. Setup your [AMD](/recipes/cryptominer/amd-gpu/) or [Nvidia](/recipes/cryptominer/nvidia-gpu/) GPUs 🎨
 3. Sign up for [mining pools](/recipes/cryptominer/mining-pool/) :swimmer:
@@ -56,12 +47,11 @@ Now, continue to the next stage of your grand mining adventure:
 5. Send your coins to exchanges (_This page_) or [wallets](/recipes/cryptominer/wallet/) 💹
 6. [Monitor](/recipes/cryptominer/monitor/) your empire :heartbeat:
 7. [Profit](/recipes/cryptominer/profit/)! 💰
->>>>>>> master:manuscript/recipes/cryptominer/mining-pool.md


 ## Chef's Notes

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -31,21 +31,12 @@ I recommend this design (_with the board with little holes in it_) - it takes up
 Now, continue to the next stage of your grand mining adventure:

 1. Build your mining rig 💻 (This page)
-<<<<<<< HEAD:manuscript/recipies/cryptominer/mining-rig.md
-2. Setup your [AMD](/recipies/cryptominer/amd-gpu/) or [Nvidia](/recipies/cryptominer/nvidia-gpu/) GPUs 🎨
-3. Sign up for [mining pools](/recipies/cryptominer/mining-pool/) :swimmer:
-4. Setup your miners with [Miner Hotel](/recipies/cryptominer/minerhotel/) 🏨
-5. Send your coins to [exchanges](/recipies/cryptominer/exchange/) or [wallets](/recipies/cryptominer/wallet/) 💹
-6. [Monitor](/recipies/cryptominer/monitor/) your empire :heartbeat:
-7. [Profit](/recipies/cryptominer/profit/)! 
-=======
 2. Setup your [AMD](/recipes/cryptominer/amd-gpu/) or [Nvidia](/recipes/cryptominer/nvidia-gpu/) GPUs 🎨
 3. Sign up for [mining pools](/recipes/cryptominer/mining-pool/) :swimmer:
 4. Setup your miners with [Miner Hotel](/recipes/cryptominer/minerhotel/) 🏨
 5. Send your coins to [exchanges](/recipes/cryptominer/exchange/) or [wallets](/recipes/cryptominer/wallet/) 💹
 6. [Monitor](/recipes/cryptominer/monitor/) your empire :heartbeat:
 7. [Profit](/recipes/cryptominer/profit/)! 💰
->>>>>>> master:manuscript/recipes/cryptominer/mining-rig.md



@@ -57,7 +48,7 @@ Yes. It's the ultimate _#firstworldproblem_, but if you have a means to remotely

 (_I hooked up a remote-controlled outlet to my rig, so that I can power-cycle it without having to crawl under the desk!_)

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -80,17 +80,13 @@ Now, continue to the next stage of your grand mining adventure:
 4. Setup your miners with [Miner Hotel](/recipes/cryptominer/minerhotel/) 🏨
 5. Send your coins to [exchanges](/recipes/cryptominer/exchange/) or [wallets](/recipes/cryptominer/wallet/) 💹
 6. Monitor your empire :heartbeat: (_this page_)
-<<<<<<< HEAD:manuscript/recipies/cryptominer/monitor.md
-7. [Profit](/recipies/cryptominer/profit/)! 
-=======
 7. [Profit](/recipes/cryptominer/profit/)! 💰
->>>>>>> master:manuscript/recipes/cryptominer/monitor.md

 ## Chef's Notes

 1. Ultimately I hope to move all the configuration / mining executables into docker containers, but for now, they're running on a CentOS7 host for direct access to GPUs. (_Apparently it **may** be possible to pass-thru the GPUs to docker containers, but I wanted stability first, before abstracting my hardware away from my miners_)

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -146,15 +146,6 @@ Play with changing your settings.conf file until you break it, and then go back

 Now, continue to the next stage of your grand mining adventure:

-<<<<<<< HEAD:manuscript/recipies/cryptominer/nvidia-gpu.md
-1. Build your [mining rig](/recipies/cryptominer/mining-rig/) 💻
-2. Setup your [AMD](/recipies/cryptominer/amd-gpu/) or Nvidia (_this page_) GPUs 🎨
-3. Sign up for [mining pools](/recipies/cryptominer/mining-pool/) :swimmer:
-4. Setup your miners with [Miner Hotel](/recipies/cryptominer/minerhotel/) 🏨
-5. Send your coins to [exchanges](/recipies/cryptominer/exchange/) or [wallets](/recipies/cryptominer/wallet/) 💹
-6. [Monitor](/recipies/cryptominer/monitor/) your empire :heartbeat:
-7. [Profit](/recipies/cryptominer/profit/)! 
-=======
 1. Build your [mining rig](/recipes/cryptominer/mining-rig/) 💻
 2. Setup your [AMD](/recipes/cryptominer/amd-gpu/) or Nvidia (_this page_) GPUs 🎨
 3. Sign up for [mining pools](/recipes/cryptominer/mining-pool/) :swimmer:
@@ -162,12 +153,11 @@ Now, continue to the next stage of your grand mining adventure:
 5. Send your coins to [exchanges](/recipes/cryptominer/exchange/) or [wallets](/recipes/cryptominer/wallet/) 💹
 6. [Monitor](/recipes/cryptominer/monitor/) your empire :heartbeat:
 7. [Profit](/recipes/cryptominer/profit/)! 💰
->>>>>>> master:manuscript/recipes/cryptominer/nvidia-gpu.md


 ## Chef's Notes

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -6,15 +6,6 @@ Well, that's it really. You're a cryptominer. Welcome to the party.

 To recap, you did all this:

-<<<<<<< HEAD:manuscript/recipies/cryptominer/profit.md
-1. Build your [mining rig](/recipies/cryptominer/mining-rig/) 💻
-2. Setup your [AMD](/recipies/cryptominer/amd-gpu/) or [Nvidia](/recipies/cryptominer/nvidia-gpu/) GPUs 🎨
-3. Sign up for [mining pools](/recipies/cryptominer/mining-pool/) :swimmer:
-4. Setup your miners with [Miner Hotel](/recipies/cryptominer/minerhotel/) 🏨
-5. Send your coins to [exchanges](/recipies/cryptominer/exchange/)  or [wallets](/recipies/cryptominer/wallet/) 💹
-6. [Monitor](/recipies/cryptominer/monitor/) your empire :heartbeat:
-7. Profit! (_This page_) 
-=======
 1. Build your [mining rig](/recipes/cryptominer/mining-rig/) 💻
 2. Setup your [AMD](/recipes/cryptominer/amd-gpu/) or [Nvidia](/recipes/cryptominer/nvidia-gpu/) GPUs 🎨
 3. Sign up for [mining pools](/recipes/cryptominer/mining-pool/) :swimmer:
@@ -22,7 +13,6 @@ To recap, you did all this:
 5. Send your coins to [exchanges](/recipes/cryptominer/exchange/)  or [wallets](/recipes/cryptominer/wallet/) 💹
 6. [Monitor](/recipes/cryptominer/monitor/) your empire :heartbeat:
 7. Profit! (_This page_) 💰
->>>>>>> master:manuscript/recipes/cryptominer/profit.md


 ## What next?
@@ -31,7 +21,7 @@ Get in touch and share your experience - there's a special [discord](https://dis

 ## Chef's Notes

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -23,15 +23,6 @@ I mine most of my coins to Exchanges, but I do have the following wallets:

 Now, continue to the next stage of your grand mining adventure:

-<<<<<<< HEAD:manuscript/recipies/cryptominer/wallet.md
-1. Build your [mining rig](/recipies/cryptominer/mining-rig/) 💻
-2. Setup your [AMD](/recipies/cryptominer/amd-gpu/) or [Nvidia](/recipies/cryptominer/nvidia-gpu/) GPUs 🎨
-3. Sign up for [mining pools](/recipies/cryptominer/mining-pool/) :swimmer:
-4. Setup your miners with [Miner Hotel](/recipies/cryptominer/minerhotel/) 🏨
-5. Send your coins to [exchanges](/recipies/cryptominer/exchange/)  or wallets (_This page_) 💹
-6. [Monitor](/recipies/cryptominer/monitor/) your empire :heartbeat:
-7. [Profit](/recipies/cryptominer/profit/)! 
-=======
 1. Build your [mining rig](/recipes/cryptominer/mining-rig/) 💻
 2. Setup your [AMD](/recipes/cryptominer/amd-gpu/) or [Nvidia](/recipes/cryptominer/nvidia-gpu/) GPUs 🎨
 3. Sign up for [mining pools](/recipes/cryptominer/mining-pool/) :swimmer:
@@ -39,12 +30,11 @@ Now, continue to the next stage of your grand mining adventure:
 5. Send your coins to [exchanges](/recipes/cryptominer/exchange/)  or wallets (_This page_) 💹
 6. [Monitor](/recipes/cryptominer/monitor/) your empire :heartbeat:
 7. [Profit](/recipes/cryptominer/profit/)! 💰
->>>>>>> master:manuscript/recipes/cryptominer/wallet.md


 ## Chef's Notes

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -160,13 +160,7 @@ Launch Duplicity stack by running ```docker stack deploy duplicity -c <path -to-

 Nothing will happen. Very boring. But when the cron script fires (daily), duplicity will do its thing, and backup everything in /var/data to your cloud destination.

-## Chef's Notes
+## Chef's Notes 📓

 1. Automatic backup can still fail if nobody checks that it's running successfully. I'll be working on an upcoming recipe to monitor the elements of the stack, including the success/failure of duplicity jobs.
 2. The container provides the facility to specify an SMTP host and port, but not credentials, which makes it close to useless. As a result, I've left SMTP out of this recipe. To enable email notifications (if your SMTP server doesn't require auth), add ```SMTP_HOST```, ```SMTP_PORT```, ```EMAIL_FROM``` and ```EMAIL_TO``` variables to duplicity.env
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -243,13 +243,7 @@ This takes you to a list of backup names and file paths. You can choose to downl

    [![Common Observatory](../images/common_observatory.png)](https://www.observe.global/)

-## Chef's Notes
+## Chef's Notes 📓

 1. If you wanted to expose the ElkarBackup UI directly, you could remove the oauth2_proxy from the design, and move the traefik_public-related labels directly to the app service. You'd also need to add the traefik_public network to the app service.
 2. The original inclusion of ElkarBackup was due to the efforts of @gpulido in our [Discord server](http://chat.funkypenguin.co.nz). Thanks Gabriel!
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
@@ -83,14 +83,8 @@ Launch the stack by running ```docker stack deploy emby -c <path -to-docker-comp

 Log into your new instance at https://**YOUR-FQDN**, and complete the wizard-based setup to complete deploying your Emby.

-## Chef's Notes
+## Chef's Notes 📓

 1. I didn't use an [oauth2_proxy](/reference/oauth_proxy/) for this stack, because it would interfere with mobile client support.
 2. Got an NVIDIA GPU? See [this blog post](https://www.funkypenguin.co.nz/note/gpu-transcoding-with-emby-plex-using-docker-nvidia/) re how to use your GPU to transcode your media!
 3. We don't bother exposing the HTTPS port for Emby, since [Traefik](/ha-docker-swarm/traefik/) is doing the SSL termination for us already.
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -39,7 +39,7 @@ services:
     - /etc/localtime:/etc/localtime:ro
     - /var/data/ghost/:/var/lib/ghost/content
    networks:
-    - traefik
+    - traefik_public
    deploy:
      labels:
        - traefik.frontend.rule=Host:ghost.example.com
@@ -47,7 +47,7 @@ services:
        - traefik.port=2368

 networks:
-  traefik:
+  traefik_public:
    external: true
 ```

@@ -60,7 +60,7 @@ Launch the Ghost stack by running ```docker stack deploy ghost -c <path -to-dock

 Create your first administrative account at https://**YOUR-FQDN**/admin/

-## Chef's Notes
+## Chef's Notes 📓

 1. If I wasn't committed to a [static-site-generated blog](https://www.funkypenguin.co.nz/blog/), Ghost is the platform I'd use for my blog.
 2. A default using the SQlite database takes 548k of space:
@@ -69,9 +69,3 @@ Create your first administrative account at https://**YOUR-FQDN**/admin/
 548K	/var/data/ghost/
 [root@ds1 ghost]#
 ```
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -33,17 +33,17 @@ Create a docker swarm config file in docker-compose syntax (v3), something like
 version: '3'

 services:
-  1:
+  thing1:
    image: gitlab/gitlab-runner
    volumes:
-    - /var/data/gitlab-runner/1:/var/data/gitlab/runners/1
+    - /var/data/gitlab/runners/1:/etc/gitlab-runner
    networks:
    - internal

-  2:
+  thing2:
    image: gitlab/gitlab-runner
    volumes:
-    - /var/data/gitlab-runner/:/var/data/gitlab/runners/2
+    - /var/data/gitlab/runners/2:/etc/gitlab-runner
    networks:
    - internal

@@ -58,7 +58,7 @@ networks:

 ### Configure runners

-From your GitLab UI, you can retrieve a "token" necessary to register a new runner. To register the runner, you can either create config.toml in each runner's bind-mounted folder (example below), or just "docker exec" into each runner container and execute ```gitlab-container register``` to interactively generate config.toml.
+From your GitLab UI, you can retrieve a "token" necessary to register a new runner. To register the runner, you can either create config.toml in each runner's bind-mounted folder (example below), or just "docker exec" into each runner container and execute ```gitlab-runner register``` to interactively generate config.toml.

 Sample runner config.toml:

@@ -89,14 +89,7 @@ Launch the mail server stack by running ```docker stack deploy gitlab-runner -c

 Log into your new instance at https://**YOUR-FQDN**, with user "root" and the password you specified in gitlab.env.

-## Chef's Notes
+## Chef's Notes 📓

 1. You'll note that I setup 2 runners. One is locked to a single project (this cookbook build), and the other is a shared runner. I wanted to ensure that one runner was always available to run CI for this project, even if I'd tied up another runner on something heavy-duty, like a container build. Customize this to your use case.
 2. Originally I deployed runners in the same stack as GitLab, but I found that they would frequently fail to start properly when I launched the stack. I think that this was because the runners started so quickly (and GitLab starts so slowly!), that they always started up reporting that the GitLab instance was invalid or unavailable. I had issues with CI builds stuck permanently in a "pending" state, which were only resolved by restarting the runner. Having the runners deployed in a separate stack to GitLab avoids this problem.
-
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -129,15 +129,8 @@ Launch the mail server stack by running ```docker stack deploy gitlab -c <path -
 Log into your new instance at https://[your FQDN], with user "root" and the password you specified in gitlab.env.


-## Chef's Notes
+## Chef's Notes 📓

 A few comments on decisions taken in this design:

 1. I use the **sameersbn/gitlab:latest** image, rather than a specific version. This lets me execute updates simply by redeploying the stack (and why **wouldn't** I want the latest version?)
-
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -125,12 +125,6 @@ Launch the Gollum stack by running ```docker stack deploy gollum -c <path-to-doc

 Authenticate against your OAuth provider, and then start editing your wiki!

-## Chef's Notes
+## Chef's Notes 📓

 1. In the current implementation, Gollum is a "single user" tool only. The contents of the wiki are saved as markdown files under /var/data/gollum, and all the git commits are currently "Anonymous"
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -128,12 +128,6 @@ Launch the Home Assistant stack by running ```docker stack deploy homeassistant

 Log into your new instance at https://**YOUR-FQDN**, the password you created in configuration.yml as "frontend - api_key". Then setup a bunch of sensors, and log into https://grafana.**YOUR FQDN** and create some beautiful graphs :)

-## Chef's Notes
+## Chef's Notes 📓

 1. I **tried** to protect Home Assistant using [oauth2_proxy](/reference/oauth_proxy), but HA is incompatible with the websockets implementation used by Home Assistant. Until this can be fixed, I suggest that geeks set frontend: api_key to a long and complex string, and rely on this to prevent malevolent internet miscreants from turning their lights on at 2am!
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -22,3 +22,5 @@ Generate your own UUID, or get a random one at https://www.uuidgenerator.net/
 Plug in your iBeacon, launch LightBlue Explorer, and find your iBeacon. The first time you attempt to interrogate it, you'll be prompted to pair. Although it's not recorded anywhere in the documentation (_grr!_), the pairing code is **123456**

 Having paired, you'll be able to see the vital statistics of your iBeacon.
+
+## Chef's Notes 📓
@@ -142,12 +142,6 @@ Launch the Huginn stack by running ```docker stack deploy huginn -c <path -to-do

 Log into your new instance at https://**YOUR-FQDN**. You'll need to use the "Sign Up" button, and (optionally) enter your invitation code in order to create your account.

-## Chef's Notes
+## Chef's Notes 📓

 1. I initially considered putting an oauth proxy in front of Huginn, but since the invitation code logic prevents untrusted access, and since using a proxy would break oauth for sevices like Twitter integration, I left it out.
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -125,12 +125,6 @@ After swarm deploys, you won't see much, but you can monitor what InstaPy is doi

 You can **also** watch the bot at work by VNCing to your docker swarm, password "secret". You'll see Selenium browser window cycling away, interacting with all your real/fake friends on Instagram :)

-## Chef's Notes
+## Chef's Notes 📓

 1. Amazingly, my bot has ended up tagging more _non-penguins_ than actual penguins. I don't understand how Instagrammers come up with their hashtags!
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -180,12 +180,6 @@ QmbqPBLJNXWpbXEX6bVhYLo2ruEBE7mh1tfT9s6VXUzYYx | 28c13ec68f33 | Sees 2 other pee
 ```


-## Chef's Notes
+## Chef's Notes 📓

-1. I'm still trying to work out how to _mount_ the ipfs data in my filesystem in a usable way. Which is why this is still a WIP :)
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
+1. I'm still trying to work out how to _mount_ the ipfs data in my filesystem in a usable way. Which is why this is still a WIP :)
@@ -116,13 +116,7 @@ Launch the Kanboard stack by running ```docker stack deploy kanboard -c <path -t

 Log into your new instance at https://**YOUR-FQDN**. Default credentials are admin/admin, after which you can change (_under 'profile'_) and add more users.

-## Chef's Notes
+## Chef's Notes 📓

 1. The default theme can be significantly improved by applying the [ThemePlus](https://github.com/phsteffen/kanboard-themeplus) plugin.
 2. Kanboard becomes more useful when you integrate in/outbound email with [MailGun](https://github.com/kanboard/plugin-mailgun), [SendGrid](https://github.com/kanboard/plugin-sendgrid), or [Postmark](https://github.com/kanboard/plugin-postmark).
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -1,9 +1,9 @@
 # KeyCloak

-[KeyCloak](https://www.keycloak.org/) is "an open source identity and access management solution." Using a local database, or a variety of backends (_think [OpenLDAP](/recipes/openldap/)_), you can provide Single Sign-On (SSO) using OpenID, OAuth 2.0, and SAML.
+[KeyCloak](https://www.keycloak.org/) is "*an open source identity and access management solution*". Using a local database, or a variety of backends (_think [OpenLDAP](/recipes/openldap/)_), you can provide Single Sign-On (SSO) using OpenID, OAuth 2.0, and SAML. KeyCloak's OpenID provider can be used in combination with [Traefik Forward Auth](/ha-docker-swarm/traefik-forward-auth/), to protect [vulnerable services](/recipe/nzbget/) with an extra layer of authentication.

 !!! important
-    Development of this recipe is sponsored by [The Common Observatory](https://www.observe.global/). Thanks guys!
+    Initial development of this recipe was sponsored by [The Common Observatory](https://www.observe.global/). Thanks guys!

    [![Common Observatory](../images/common_observatory.png)](https://www.observe.global/)

@@ -11,9 +11,12 @@

 ## Ingredients

-1. [Docker swarm cluster](/ha-docker-swarm/design/) with [persistent shared storage](/ha-docker-swarm/shared-storage-ceph.md)
-2. [Traefik](/ha-docker-swarm/traefik_public) configured per design
-3. DNS entry for the hostname (_i.e. "keycloak.your-domain.com"_) you intend to use for LDAP Account Manager, pointed to your [keepalived](ha-docker-swarm/keepalived/) IP
+!!! Summary
+    Existing:
+
+    * [X] [Docker swarm cluster](/ha-docker-swarm/design/) with [persistent shared storage](/ha-docker-swarm/shared-storage-ceph/)
+    * [X] [Traefik](/ha-docker-swarm/traefik_public) configured per design
+    * [X] DNS entry for the hostname (_i.e. "keycloak.your-domain.com"_) you intend to use, pointed to your [keepalived](/ha-docker-swarm/keepalived/) IP

 ## Preparation

@@ -22,13 +25,13 @@
 We'll need several directories to bind-mount into our container for both runtime and backup data, so create them as follows

 ```
-mkdir /var/data/runtime/keycloak/database
-mkdir /var/data/keycloak/database-dump
+mkdir -p /var/data/runtime/keycloak/database
+mkdir -p /var/data/keycloak/database-dump
 ```

 ### Prepare environment

-Create ```/var/data/keycloak/keycloak.env```, and populate with the following variables, customized for your own domain structure.
+Create `/var/data/keycloak/keycloak.env`, and populate with the following variables, customized for your own domain structure.

 ```
 # Technically, this could be auto-detected, but we prefer to be prescriptive
@@ -51,7 +54,7 @@ POSTGRES_USER=keycloak
 POSTGRES_PASSWORD=myuberpassword
 ```

-Create /var/data/keycloak/keycloak-backup.env, and populate with the following, so that your database can be backed up to the filesystem, daily:
+Create `/var/data/keycloak/keycloak-backup.env`, and populate with the following, so that your database can be backed up to the filesystem, daily:

 ```
 PGHOST=keycloak-db
@@ -77,7 +80,8 @@ services:
    volumes:
      - /etc/localtime:/etc/localtime:ro    
    networks:
-    - traefik_public
+      - traefik_public
+      - internal
    deploy:
      labels:
        - traefik.frontend.rule=Host:keycloak.batcave.com
@@ -91,7 +95,7 @@ services:
      - /var/data/runtime/keycloak/database:/var/lib/postgresql/data
      - /etc/localtime:/etc/localtime:ro    
    networks:
-    - traefik_public
+      - internal

  keycloak-db-backup:
    image: postgres:10.1
@@ -110,76 +114,34 @@ services:
      done
      EOF'
    networks:
-    - traefik_public
+      - internal

 networks:
  traefik_public:
    external: true
+  internal:
+    driver: overlay
+    ipam:
+      config:
+        - subnet: 172.16.49.0/24    
 ```

-!!! warning
-    **Normally**, we set unique static subnets for every stack you deploy, and put the non-public facing components (like databases) in an dedicated <stack\>_internal network. This avoids IP/gateway conflicts which can otherwise occur when you're creating/removing stacks a lot. See [my list](/reference/networks/) here.
-
-    However, KeyCloak's JBOSS startup script assumes a single interface, and will crash in a ball of 🔥 if you try to assign multiple interfaces to the container. This means that we can't use a "keycloak_internal" network for our supporting containers. This is why unlike our other recipes, all the supporting services are prefixed with "keycloak-".
+!!! note
+    Setup unique static subnets for every stack you deploy. This avoids IP/gateway conflicts which can otherwise occur when you're creating/removing stacks a lot. See [my list](/reference/networks/) here.


 ## Serving

 ### Launch KeyCloak stack

-Launch the OpenLDAP stack by running ```docker stack deploy keycloak -c <path -to-docker-compose.yml>```
+Launch the KeyCloak stack by running ```docker stack deploy keycloak -c <path -to-docker-compose.yml>```

-Log into your new instance at https://**YOUR-FQDN**, and login with the user/password you defined in keycloak.env.
-
-### Integrating into OpenLDAP
-
-KeyCloak gets really sexy when you integrate it into your [OpenLDAP](/recipes/openldap/) stack (_also, it's great not to have to play with ugly LDAP tree UIs_).
-
-You'll need to have completed the [OpenLDAP](/recipes/openldap/) recipe
-
-You start in the "Master" realm - but mouseover the realm name, to a dropdown box allowing you add an new realm:
-
-![KeyCloak Add Realm Screenshot](/images/sso-stack-keycloak-1.png)
-
-Enter a name for your new realm, and click "_Create_":
-
-![KeyCloak Add Realm Screenshot](/images/sso-stack-keycloak-2.png)
-
-Once in the desired realm, click on **User Federation**, and click **Add Provider**. On the next page ("_Required Settings_"), set the following:
-
-* **Edit Mode** : Writeable
-* **Vendor** : Other
-* **Connection URL** : ldap://openldap
-* **Users DN** : ou=People,<your base DN\>
-* **Authentication Type** : simple
-* **Bind DN** : cn=admin,<your base DN\>
-* **Bind Credential** : <your chosen admin password\>
-
-Save your changes, and then navigate back to "User Federation" > Your LDAP name > Mappers:
-
-![KeyCloak Add Realm Screenshot](/images/sso-stack-keycloak-3.png)
-
-For each of the following mappers, click the name, and set the "_Read Only_" flag to "_Off_" (_this enables 2-way sync between KeyCloak and OpenLDAP_)
-
-* last name
-* username
-* email
-* first name
-
-![KeyCloak Add Realm Screenshot](/images/sso-stack-keycloak-4.png)
+Log into your new instance at https://**YOUR-FQDN**, and login with the user/password you defined in `keycloak.env`.

 !!! important
-    Development of this recipe is sponsored by [The Common Observatory](https://www.observe.global/). Thanks guys!
+    Initial development of this recipe was sponsored by [The Common Observatory](https://www.observe.global/). Thanks guys!

    [![Common Observatory](../images/common_observatory.png)](https://www.observe.global/)


 ## Chef's Notes
-
-1. I wanted to be able to add multiple networks to KeyCloak (_i.e., a dedicated overlay network for LDAP authentication_), but the entrypoint used by the container produces an error when more than one network is configured. This could theoretically be corrected in future, with a PR, but the [GitHub repo](https://github.com/jboss-dockerfiles/keycloak) has no issues enabled, so I wasn't sure where to start.
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
@@ -0,0 +1,68 @@
+# Authenticate KeyCloak against OpenLDAP
+
+!!! warning
+    This is not a complete recipe - it's an **optional** component of the [Keycloak recipe](/recipes/keycloak/), but has been split into its own page to reduce complexity.
+
+KeyCloak gets really sexy when you integrate it into your [OpenLDAP](/recipes/openldap/) stack (_also, it's great not to have to play with ugly LDAP tree UIs_). Note that OpenLDAP integration is **not necessary** if you want to use KeyCloak with [Traefik Forward Auth](/ha-docker-swarm/traefik-forward-auth/) - all you need for that is [local users](/recipes/keycloak/create-user/), and an [OIDC client](http://localhost:8000/recipes/keycloak/setup-oidc-provider/).
+
+## Ingredients
+
+!!! Summary
+    Existing:
+
+    * [X] [KeyCloak](/recipes/keycloak/) recipe deployed successfully
+  
+    New:
+    
+    * [ ] An [OpenLDAP server](/recipes/openldap/) (*assuming you want to authenticate against it*)
+
+## Preparation
+
+You'll need to have completed the [OpenLDAP](/recipes/openldap/) recipe
+
+You start in the "Master" realm - but mouseover the realm name, to a dropdown box allowing you add an new realm:
+
+### Create Realm
+
+![KeyCloak Add Realm Screenshot](/images/sso-stack-keycloak-1.png)
+
+Enter a name for your new realm, and click "_Create_":
+
+![KeyCloak Add Realm Screenshot](/images/sso-stack-keycloak-2.png)
+
+### Setup User Federation
+
+Once in the desired realm, click on **User Federation**, and click **Add Provider**. On the next page ("_Required Settings_"), set the following:
+
+* **Edit Mode** : Writeable
+* **Vendor** : Other
+* **Connection URL** : ldap://openldap
+* **Users DN** : ou=People,<your base DN\>
+* **Authentication Type** : simple
+* **Bind DN** : cn=admin,<your base DN\>
+* **Bind Credential** : <your chosen admin password\>
+
+Save your changes, and then navigate back to "User Federation" > Your LDAP name > Mappers:
+
+![KeyCloak Add Realm Screenshot](/images/sso-stack-keycloak-3.png)
+
+For each of the following mappers, click the name, and set the "_Read Only_" flag to "_Off_" (_this enables 2-way sync between KeyCloak and OpenLDAP_)
+
+* last name
+* username
+* email
+* first name
+
+![KeyCloak Add Realm Screenshot](/images/sso-stack-keycloak-4.png)
+
+
+## Summary
+
+We've setup a new realm in KeyCloak, and configured read-write federation to an [OpenLDAP](/recipes/openldap/) backend. We can now manage our LDAP users using either KeyCloak or LDAP directly, and we can protect vulnerable services using [Traefik Forward Auth](/ha-docker-swarm/traefik-forward-auth/).
+
+!!! Summary
+    Created:
+
+    * [X] KeyCloak realm in read-write federation with [OpenLDAP](/recipes/openldap/) directory
+
+## Chef's Notes 📓
@@ -0,0 +1,38 @@
+# Create KeyCloak Users
+
+!!! warning
+    This is not a complete recipe - it's an optional component of the [Keycloak recipe](/recipes/keycloak/), but has been split into its own page to reduce complexity.
+
+Unless you plan to authenticate against an outside provider (*[OpenLDAP](/recipes/keycloak/openldap/), below, for example*), you'll want to create some local users..
+
+## Ingredients
+
+!!! Summary
+    Existing:
+
+    * [X] [KeyCloak](/recipes/keycloak/) recipe deployed successfully
+  
+### Create User
+
+Within the "Master" realm (*no need for more realms yet*), navigate to **Manage** -> **Users**, and then click **Add User** at the top right:
+
+![Navigating to the add user interface in Keycloak](/images/keycloak-add-user-1.png)
+
+Populate your new user's username (it's the only mandatory field)
+
+![Populating a username in the add user interface in Keycloak](/images/keycloak-add-user-2.png)
+
+### Set User Credentials
+
+Once your user is created, to set their password, click on the "**Credentials**" tab, and procede to reset it. Set the password to non-temporary, unless you like extra work!
+
+![Resetting a user's password in Keycloak](/images/keycloak-add-user-3.png)
+
+## Summary
+
+We've setup users in KeyCloak, which we can now use to authenticate to KeyCloak, when it's used as an [OIDC Provider](/recipes/keycloak/setup-oidc-provider/), potentially to secure vulnerable services using [Traefik Forward Auth](/ha-docker-swarm/traefik-forward-auth/).
+
+!!! Summary
+    Created:
+
+    * [X] Username / password to authenticate against [KeyCloak](/recipes/keycloak/)
@@ -0,0 +1,55 @@
+# Add OIDC Provider to KeyCloak
+
+!!! warning
+    This is not a complete recipe - it's an optional component of the [Keycloak recipe](/recipes/keycloak/), but has been split into its own page to reduce complexity.
+
+Having an authentication provider is not much use until you start authenticating things against it! In order to authenticate against KeyCloak using OpenID Connect (OIDC), which is required for [Traefik Forward Auth](/recipe/traefik-forward-auth/), we'll setup a client in KeyCloak...
+
+## Ingredients
+
+!!! Summary
+    Existing:
+
+    * [X] [KeyCloak](/recipes/keycloak/) recipe deployed successfully
+
+    New:
+
+    * [ ] The URI(s) to protect with the OIDC provider. Refer to the [Traefik Forward Auth](/recipe/traefik-forward-auth/) recipe for more information  
+
+## Preparation 
+
+### Create Client
+
+Within the "Master" realm (*no need for more realms yet*), navigate to **Clients**, and then click **Create** at the top right:
+
+![Navigating to the add user interface in Keycloak](/images/keycloak-add-client-1.png)
+
+Enter a name for your client (*remember, we're authenticating **applications** now, not users, so use an application-specific name*):
+
+![Adding a client in KeyCloak](/images/keycloak-add-client-2.png)
+
+### Configure Client
+
+Once your client is created, set at **least** the following, and click **Save**
+
+* **Access Type** : Confidential
+* **Valid Redirect URIs** : <The URIs you want to protect\>
+
+![Set KeyCloak client to confidential access type, add redirect URIs](/images/keycloak-add-client-3.png)
+
+### Retrieve Client Secret
+
+Now that you've changed the access type, and clicked **Save**, an additional **Credentials** tab appears at the top of the window. Click on the tab, and capture the KeyCloak-generated secret. This secret, plus your client name, is required to authenticate against KeyCloak via OIDC.
+
+![Capture client secret from KeyCloak](/images/keycloak-add-client-4.png)
+
+## Summary
+
+We've setup an OIDC client in KeyCloak, which we can now use to protect vulnerable services using [Traefik Forward Auth](/ha-docker-swarm/traefik-forward-auth/). The OIDC URL provided by KeyCloak in the master realm, is *https://<your-keycloak-url\>/realms/master/.well-known/openid-configuration*
+
+!!! Summary
+    Created:
+
+    * [X] Client ID and Client Secret used to authenticate against KeyCloak with OpenID Connect
+
+## Chef's Notes 📓
@@ -264,7 +264,7 @@ To look at the Kanboard pod's logs, run ```kubectl logs -n kanboard <name of pod

 1. The simplest deployment of Kanboard uses the default SQLite database backend, stored on the persistent volume. You can convert this to a "real" database running MySQL or PostgreSQL, and running an an additional database pod and service. Contact me if you'd like further details ;)

-### Tip your waiter (donate) 👏
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏

@@ -321,7 +321,7 @@ To look at the Miniflux pod's logs, run ```kubectl logs -n miniflux <name of pod

 ## Chef's Notes

-### Tip your waiter (donate) 👏
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏

@@ -126,7 +126,7 @@ Log into your new instance at https://**YOUR-FQDN**, with user "root" and the pa

 1. If you wanted to expose the Wekan UI directly, you could remove the oauth2_proxy from the design, and move the traefik_public-related labels directly to the wekan container. You'd also need to add the traefik_public network to the wekan container.

-### Tip your waiter (donate) 👏
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏

@@ -119,7 +119,7 @@ Log into your new instance at https://**YOUR-FQDN**, with user "root" and the pa

 1. If you wanted to expose the Wekan UI directly, you could remove the oauth2_proxy from the design, and move the traefik_public-related labels directly to the wekan container. You'd also need to add the traefik_public network to the wekan container.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -126,7 +126,7 @@ Log into your new instance at https://**YOUR-FQDN**, with user "root" and the pa

 1. If you wanted to expose the Wekan UI directly, you could remove the oauth2_proxy from the design, and move the traefik_public-related labels directly to the wekan container. You'd also need to add the traefik_public network to the wekan container.

-### Tip your waiter (donate) 👏
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏

@@ -264,7 +264,7 @@ To look at the Kanboard pod's logs, run ```kubectl logs -n kanboard <name of pod

 1. The simplest deployment of Kanboard uses the default SQLite database backend, stored on the persistent volume. You can convert this to a "real" database running MySQL or PostgreSQL, and running an an additional database pod and service. Contact me if you'd like further details ;)

-### Tip your waiter (donate) 👏
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏

@@ -178,14 +178,8 @@ SSL_TYPE=letsencrypt

 Launch the mail server stack by running ```docker stack deploy docker-mailserver -c <path-to-docker-mailserver.yml>```

-## Chef's Notes
+## Chef's Notes 📓

 1. One of the elements of this design which I didn't appreciate at first is that since the config is entirely file-based, **setup.sh** can be run on any container host, provided it has the shared data mounted. This means that even though docker-mailserver was not designed with docker swarm in mind, it works perfectl with swarm. I.e., from any node, regardless of where the container is actually running, you're able to add/delete email addresses, view logs, etc.

 2. If you're using sieve with Rainloop, take note of the [workaround](https://discourse.geek-kitchen.funkypenguin.co.nz/t/mail-server-funky-penguins-geek-cookbook/70/15) identified by [ggilley](https://discourse.geek-kitchen.funkypenguin.co.nz/u/ggilley)
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -116,12 +116,6 @@ Launch the MatterMost stack by running ```docker stack deploy mattermost -c <pat

 Log into your new instance at https://**YOUR-FQDN**, with user "root" and the password you specified in gitlab.env.

-## Chef's Notes
+## Chef's Notes 📓

-1. If you wanted to expose the Wekan UI directly, you could remove the oauth2_proxy from the design, and move the traefik_public-related labels directly to the wekan container. You'd also need to add the traefik_public network to the wekan container.
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
+1. If you wanted to expose the Wekan UI directly, you could remove the oauth2_proxy from the design, and move the traefik_public-related labels directly to the wekan container. You'd also need to add the traefik_public network to the wekan container.
@@ -136,12 +136,6 @@ Launch the Miniflux stack by running ```docker stack deploy miniflux -c <path -t

 Log into your new instance at https://**YOUR-FQDN**, using the credentials you setup in the environment flie. After this, change your user/password as you see fit, and comment out the ```CREATE_ADMIN``` line in the env file (_if you don't, then an **additional** admin will be created the next time you deploy_)

-## Chef's Notes
+## Chef's Notes 📓

 1. Find the bookmarklet under the **Settings -> Integration** page.
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -170,14 +170,9 @@ To permanently mount an S3 bucket using goofys, I'd add something like this to /
 goofys#bucket   /mnt/mountpoint        fuse     _netdev,allow_other,--file-mode=0666    0       0
 ```

-## Chef's Notes
+## Chef's Notes 📓

 1. There are many S3-filesystem-mounting tools available, I just picked Goofys because it's simple. Google is your friend :)
 2. Some applications (_like [NextCloud](/recipes/nextcloud/)_) can natively mount S3 buckets
 3. Some backup tools (_like [Duplicity](/recipes/duplicity/)_) can backup directly to S3 buckets

-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
@@ -204,10 +204,4 @@ mqtt-65f4d96945-bjj44         1/1       Running   0          5m

 To actually **use** your new MQTT broker, you'll need to connect to any one of your nodes (```kubectl get nodes -o wide```) on port 30883 (_the nodeport service we created earlier_). More info on that, and a loadbalancer design, to follow shortly :)

-## Chef's Notes
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
+## Chef's Notes 📓
@@ -134,12 +134,6 @@ Launch the Munin stack by running ```docker stack deploy munin -c <path -to-dock

 Log into your new instance at https://**YOUR-FQDN**, with user and password password you specified in munin.env above.

-## Chef's Notes
+## Chef's Notes 📓

-1. If you wanted to expose the Munin UI directly, you could remove the oauth2_proxy from the design, and move the traefik-related labels directly to the munin container. You'd also need to add the traefik_public network to the munin container.
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
+1. If you wanted to expose the Munin UI directly, you could remove the oauth2_proxy from the design, and move the traefik-related labels directly to the munin container. You'd also need to add the traefik_public network to the munin container.
@@ -229,13 +229,7 @@ Note that this .htaccess can be overwritten by NextCloud, and you may have to re

    [![Common Observatory](../images/common_observatory.png)](https://www.observe.global/)

-## Chef's Notes
+## Chef's Notes 📓

 1. Since many of my other recipes use PostgreSQL, I'd have preferred to use Postgres over MariaDB, but MariaDB seems to be the [preferred database type](https://github.com/nextcloud/server/issues/5912).
 2. I'm [not the first user](https://github.com/nextcloud/docker/issues/528) to stumble across the service discovery bug with reverse proxies.
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -74,7 +74,7 @@ Create ```/var/data/openldap/lam/config/config.cfg``` as follows:

    ```
    # password to add/delete/rename configuration profiles (default: lam)
-    password: {SSHA}54haBZN/kfgNVJ+W3YJrI2dCic4= iCXkNA==
+    password: {SSHA}D6AaX93kPmck9wAxNlq3GF93S7A= R7gkjQ==

    # default profile, without ".conf"
    default: batcave
@@ -371,7 +371,7 @@ services:
        - traefik.port=4180
    command: |
      -cookie-secure=false
-      -upstream=http://lam:80
+      -upstream=http://lam:8080
      -redirect-url=https://lam.batcave.com
      -http-address=http://0.0.0.0:4180
      -email-domain=batcave.com
@@ -398,17 +398,25 @@ networks:
 Create **another** stack config file (```/var/data/config/openldap/auth.yml```) containing just the auth_internal network, and a dummy container:

 ```
-version: '3'
+version: "3.2"
+
+# What is this?
+#
+# This stack exists solely to deploy the auth_internal overlay network, so that
+# other stacks (including keycloak and openldap) can attach to it

 services:
-  helloworld:
-    image: hello-world
+  scratch:
+    image: scratch
+    deploy:
+      replicas: 0
    networks:
      - internal

 networks:
  internal:
    driver: overlay
+    attachable: true
    ipam:
      config:
        - subnet: 172.16.39.0/24
@@ -421,7 +429,7 @@ networks:

 ### Launch OpenLDAP stack

-Create the auth_internal overlay network, by running ```docker stack deploy auth -c /var/data/config/openldap/auth.yml`, then launch the OpenLDAP stack by running ```docker stack deploy openldap -c /var/data/config/openldap/openldap.yml```
+Create the auth_internal overlay network, by running ```docker stack deploy auth -c /var/data/config/openldap/auth.yml```, then launch the OpenLDAP stack by running ```docker stack deploy openldap -c /var/data/config/openldap/openldap.yml```

 Log into your new LAM instance at https://**YOUR-FQDN**.

@@ -437,12 +445,6 @@ Create your users using the "**New User**" button.

    [![Common Observatory](../images/common_observatory.png)](https://www.observe.global/)

-## Chef's Notes
+## Chef's Notes 📓

-1. The KeyCloak](/recipes/keycloak/) recipe illustrates how to integrate KeyCloak with your LDAP directory, giving you a cleaner interface to manage users, and a raft of SSO / OAuth features.
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
+1. [The KeyCloak](/recipes/keycloak/authenticate-against-openldap/) recipe illustrates how to integrate KeyCloak with your LDAP directory, giving you a cleaner interface to manage users, and a raft of SSO / OAuth features.
@@ -35,9 +35,8 @@ OAUTH2_PROXY_CLIENT_SECRET=
 OAUTH2_PROXY_COOKIE_SECRET=

 OTR_USER=recorder
-OTR_PASSWD=yourpassword
-MQTTHOSTNAME=owntracks.example.com
-HOSTLIST=owntracks.example.com
+OTR_PASS=yourpassword
+OTR_HOST=owntracks.example.com
 ```

 ### Setup Docker Swarm
@@ -109,14 +108,8 @@ Launch the OwnTracks stack by running ```docker stack deploy owntracks -c <path

 Log into your new instance at https://**YOUR-FQDN**, with user "root" and the password you specified in gitlab.env.

-## Chef's Notes
+## Chef's Notes 📓

 1. If you wanted to expose the OwnTracks Web UI directly, you could remove the oauth2_proxy from the design, and move the traefik-related labels directly to the wekan container. You'd also need to add the traefik network to the owntracks container.
 2. I'm using my own image rather than owntracks/recorderd, because of a [potentially swarm-breaking bug](https://github.com/owntracks/recorderd/issues/14) I found in the official container. If this gets resolved (_or if I was mistaken_) I'll update the recipe accordingly.
 3. By default, you'll get a fully accessible, unprotected MQTT broker. This may not be suitable for public exposure, so you'll want to look into securing mosquitto with TLS and ACLs.
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
@@ -205,12 +205,6 @@ Launch the phpIPAM stack by running ```docker stack deploy phpipam -c <path -to-

 Log into your new instance at https://**YOUR-FQDN**, and follow the on-screen prompts to set your first user/password.

-## Chef's Notes
+## Chef's Notes 📓

-1. If you wanted to expose the phpIPAM UI directly, you could remove the oauth2_proxy and the nginx services from the design, and move the traefik_public-related labels directly to the phpipam container. You'd also need to add the traefik_public network to the phpipam container.
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
+1. If you wanted to expose the phpIPAM UI directly, you could remove the oauth2_proxy and the nginx services from the design, and move the traefik_public-related labels directly to the phpipam container. You'd also need to add the traefik_public network to the phpipam container.
@@ -92,7 +92,7 @@ Launch the Piwik stack by running ```docker stack deploy piwik -c <path -to-dock

 Log into your new instance at https://**YOUR-FQDN**, and follow the wizard to complete the setup.

-### Tip your waiter (donate) 
+### Tip your waiter (support me) 👏

 Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 

@@ -94,13 +94,7 @@ Launch the Plex stack by running ```docker stack deploy plex -c <path -to-docker

 Log into your new instance at https://**YOUR-FQDN** (You'll need to setup a plex.tv login for remote access / discovery to work from certain clients)

-## Chef's Notes
+## Chef's Notes 📓

 1. Plex uses port 32400 for remote access, using your plex.tv user/password to authenticate you. The inclusion of the traefik proxy in this recipe is simply to allow you to use the web client (as opposed to a client app) by connecting directly to your instance, as opposed to browsing your media via https://plex.tv/web
 2. Got an NVIDIA GPU? See [this blog post](https://www.funkypenguin.co.nz/note/gpu-transcoding-with-emby-plex-using-docker-nvidia/) re how to use your GPU to transcode your media!
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -64,12 +64,6 @@ Launch the Portainer stack by running ```docker stack deploy portainer -c <path

 Log into your new instance at https://**YOUR-FQDN**. You'll be prompted to set your admin user/password.

-## Chef's Notes
+## Chef's Notes 📓

 1. I wanted to use oauth2_proxy to provide an additional layer of security for Portainer, but the proxy seems to break the authentication mechanism, effectively making the stack **so** secure, that it can't be logged into!
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -58,13 +58,7 @@ Launch the PrivateBin stack by running ```docker stack deploy privatebin -c <pat

 Log into your new instance at https://**YOUR-FQDN**, with user "root" and the password you specified in gitlab.env.

-## Chef's Notes
+## Chef's Notes 📓

 1. The [PrivateBin repo](https://github.com/PrivateBin/PrivateBin/blob/master/INSTALL.md) explains how to tweak configuration options, or to use a database instead of file storage, if your volume justifies it :)
 2. The inclusion of PrivateBin was due to the efforts of @gkoerk in our [Discord server](http://chat.funkypenguin.co.nz). Thanks Jerry!!
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
@@ -108,13 +108,7 @@ Launch the Wekan stack by running ```docker stack deploy realms -c <path -to-doc

 Log into your new instance at https://**YOUR-FQDN**, authenticate against oauth_proxy, and you're immediately presented with Realms wiki, waiting for a fresh edit ;)

-## Chef's Notes
+## Chef's Notes 📓

 1. If you wanted to expose the Realms UI directly, you could remove the oauth2_proxy from the design, and move the traefik_public-related labels directly to the realms container. You'd also need to add the traefik_public network to the realms container.
-2. The inclusion of Realms was due to the efforts of @gkoerk in our [Discord server](http://chat.funkypenguin.co.nz). Thanks gkoerk!
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
+2. The inclusion of Realms was due to the efforts of @gkoerk in our [Discord server](http://chat.funkypenguin.co.nz). Thanks gkoerk!
@@ -160,7 +160,7 @@ Create a docker swarm config file in docker-compose syntax (v3), based on the or
                memory: 64M

        grafana:
-          image: stefanprodan/swarmprom-grafana:5.0.1
+          image: stefanprodan/swarmprom-grafana:5.3.4
          networks:
            - internal
          env_file: /var/data/config/swarmprom/grafana.env
@@ -289,7 +289,7 @@ Create a docker swarm config file in docker-compose syntax (v3), based on the or


        node-exporter:
-          image: stefanprodan/swarmprom-node-exporter:v0.15.2
+          image: stefanprodan/swarmprom-node-exporter:v0.16.0
          networks:
            - internal
          environment:
@@ -317,7 +317,7 @@ Create a docker swarm config file in docker-compose syntax (v3), based on the or
                memory: 64M

        prometheus:
-          image: stefanprodan/swarmprom-prometheus:v2.2.0-rc.0
+          image: stefanprodan/swarmprom-prometheus:v2.5.0
          networks:
            - internal
          command:
@@ -391,12 +391,6 @@ Launch the Swarm stack by running ```docker stack deploy swarmprom -c <path -to-

 Log into your new grafana instance, check out your beautiful graphs. Move onto drooling over Prometheus, AlertManager, and Unsee.

-## Chef's Notes
+## Chef's Notes 📓

-1. Pay close attention to the ```grafana.env``` config. If you encounter errors about ```basic auth failed```, or failed CSS, it's likely due to misconfiguration of one of the grafana environment variables.
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬
+1. Pay close attention to the ```grafana.env``` config. If you encounter errors about ```basic auth failed```, or failed CSS, it's likely due to misconfiguration of one of the grafana environment variables.
@@ -114,12 +114,6 @@ Launch the Wekan stack by running ```docker stack deploy wekan -c <path -to-dock

 Log into your new instance at https://**YOUR-FQDN**, with user "root" and the password you specified in gitlab.env.

-## Chef's Notes
+## Chef's Notes 📓

 1. If you wanted to expose the Wekan UI directly, you could remove the oauth2_proxy from the design, and move the traefik_public-related labels directly to the wekan container. You'd also need to add the traefik_public network to the wekan container.
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -127,7 +127,7 @@ Launch the TTRSS stack by running ```docker stack deploy ttrss -c <path -to-dock
 Log into your new instance at https://**YOUR-FQDN** - the first user you create will be an administrative user.


-## Chef's Notes
+## Chef's Notes 📓

 There are several TTRSS containers available on docker hub, none of them "official". I chose [x86dev's container](https://github.com/x86dev/docker-ttrss) for its features - such as my favorite skins and plugins, and the daily automatic updates from the "rolling release" master. Some of the features of the container I use are due to a [PR](https://github.com/x86dev/docker-ttrss/pull/12) I submitted:

@@ -135,8 +135,3 @@ There are several TTRSS containers available on docker hub, none of them "offici

 2. The upstream git URL [changed recently](https://discourse.tt-rss.org/t/gitlab-is-overbloated-shit-garbage/325/6), but my experience of the new repository is that it's **SO** slow, that the initial "git clone" on setup of the container times out. To work around this, I created [my own repo](https://github.com/funkypenguin/tt-rss.git), cloned upstream, pushed it into my repo, and pointed the container at my own repo with TTRSS_REPO. I don't get the _latest_ code changes, but at least the app container starts up. When upstream git is performing properly, I'll remove TTRSS_REPO to revert back to the "rolling release".

-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -438,7 +438,7 @@ TurtleCoin is a baby cryptocurrency. There are scaling issues to solve, and larg

 Jump into the [TurtleCoin Discord server](http://chat.turtlecoin.lol/) to ask questions, contribute, and send/receive some TRTL tips!

-## Chef's Notes
+## Chef's Notes 📓

 1. Because Docker Swarm performs ingress NAT for its load-balanced "routing mesh", the source address of inbound miner traffic is rewritten to a (_common_) docker node IP address. This means it's [not possible to determine the actual source IP address](https://github.com/moby/moby/issues/25526) of a miner. Which, in turn, means that any **one** misconfigured miner could trigger an IP ban, and lock out all other miners for 5 minutes at a time.

@@ -447,11 +447,3 @@ Two possible solutions to this are (1) disable banning, or (2) update the pool b
 2. The traefik labels in the docker-compose are to permit automatic LetsEncrypt SSL-protected proxying of your pool UI and API addresses.

 3. After a [power fault in my datacenter caused daemon DB corruption](https://www.reddit.com/r/TRTL/comments/8jftzt/funky_penguin_nz_mining_pool_down_with_daemon/), I added a second daemon, running in parallel to the first. The failsafe daemon runs once an hour, syncs with the running daemons, and shuts down again, providing a safely halted version of the daemon DB for recovery.
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-Also, you could send me some   to _TRTLv2qCKYChMbU5sNkc85hzq2VcGpQidaowbnV2N6LAYrFNebMLepKKPrdif75x5hAizwfc1pX4gi5VsR9WQbjQgYcJm21zec4_
-
-### Your comments? 
@@ -196,13 +196,7 @@ Even with all these elements in place, you still need to enable Redis under Inte
 ![Wallabag Imports](../images/wallabag_imports.png)


-## Chef's Notes
+## Chef's Notes 📓

 1. If you wanted to expose the Wallabag UI directly (_required for the iOS/Android apps_), you could remove the oauth2_proxy from the design, and move the traefik-related labels directly to the wallabag container. You'd also need to add the traefik_public network to the wallabag container. I found the iOS app to be unreliable and clunky, so elected to leave my oauth_proxy enabled, and to simply use the webUI on my mobile devices instead. YMMMV.
 2. I've not tested the email integration, but you'd need an SMTP server listening on port 25 (_since we can't change the port_) to use it
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -140,12 +140,6 @@ Launch the Wekan stack by running ```docker stack deploy wekan -c <path -to-dock

 Log into your new instance at https://**YOUR-FQDN**, with user "root" and the password you specified in gitlab.env.

-## Chef's Notes
+## Chef's Notes 📓

 1. If you wanted to expose the Wekan UI directly, you could remove the oauth2_proxy from the design, and move the traefik-related labels directly to the wekan container. You'd also need to add the traefik network to the wekan container.
-
-### Tip your waiter (donate) 
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 
-
-### Your comments? 
@@ -98,13 +98,7 @@ Launch the Wetty stack by running ```docker stack deploy wetty -c <path -to-dock

 Browse to your new browser-cli-terminal at https://**YOUR-FQDN**. Authenticate with your OAuth provider, and then proceed to login, either to the remote host you specified (_batcomputer.batcave.com, in the example above_), or using user and password "term" to log directly into the Wetty alpine container (_from which you can establish egress SSH_)

-## Chef's Notes
+## Chef's Notes 📓

 1. You could set SSHHOST to the IP of the "docker0" interface on your host, which is normally 172.17.0.1. (_Or run ```/sbin/ip route|awk '/default/ { print $3 }'``` in the container_) This would then provide you the ability to remote-manage your swarm with only web access to Wetty.
 2. The inclusion of Wetty was due to the efforts of @gpulido in our [Discord server](http://chat.funkypenguin.co.nz). Thanks Gabriel!
-
-### Tip your waiter (donate) 👏
-
-Did you receive excellent service? Want to make your waiter happy? (_..and support development of current and future recipes!_) See the [support](/support/) page for (_free or paid)_ ways to say thank you! 👏
-
-### Your comments? 💬