WIP: shared lego acme

2023-12-29 07:38:39 -08:00
55 changed files with 1470 additions and 1015 deletions
--- a/.secrets-baseline
+++ b/.secrets-baseline
@ -132,7 +132,7 @@
        "filename": "core/authelia.yml",
        "hashed_secret": "a32b08d97b1615dc27f58b6b17f67624c04e2c4f",
        "is_verified": false,
-        "line_number": 189,
+        "line_number": 185,
        "is_secret": false
      }
    ],
@ -187,5 +187,5 @@
      }
    ]
  },
-  "generated_at": "2024-02-20T18:04:29Z"
+  "generated_at": "2023-08-24T20:00:24Z"
 }
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@ -2,39 +2,39 @@
 # Manual edits may be lost in future updates.

 provider "registry.terraform.io/hashicorp/nomad" {
-  version = "2.2.0"
+  version = "2.0.0"
  hashes = [
-    "h1:BAjqzVkuXxHtRKG+l9unaZJPk2kWZpSTCEcQPRcl2so=",
-    "zh:052f909d25121e93dc799290216292fca67943ccde12ba515068b838a6ff8c66",
-    "zh:20e29aeb9989f7a1e04bb4093817c7acc4e1e737bb21a3066f3ea46f2001feff",
-    "zh:2326d101ef427599b72cce30c0e0c1d18ae783f1a897c20f2319fbf54bab0a61",
-    "zh:3420cbe4fd19cdc96d715d0ae8e79c272608023a76033bbf582c30637f6d570f",
-    "zh:41ec570f87f578f1c57655e2e4fbdb9932d94cf92dc9cd11828cccedf36dd4a4",
-    "zh:5f90dcc58e3356ffead82ea211ecb4a2d7094d3c2fbd14ff85527c3652a595a2",
-    "zh:64aaa48609d2db868fcfd347490df0e12c6c3fcb8e4f12908c5d52b1a0adf73f",
+    "h1:lIHIxA6ZmfyTGL3J9YIddhxlfit4ipSS09BLxkwo6L0=",
+    "zh:09b897d64db293f9a904a4a0849b11ec1e3fff5c638f734d82ae36d8dc044b72",
+    "zh:435cc106799290f64078ec24b6c59cb32b33784d609088638ed32c6d12121199",
+    "zh:7073444bd064e8c4ec115ca7d9d7f030cc56795c0a83c27f6668bba519e6849a",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:86b4923e10e6ba407d1d2aab83740b702058e8b01460af4f5f0e4008f40e492c",
-    "zh:ae89dcba33097af33a306344d20e4e25181f15dcc1a860b42db5b7199a97c6a6",
-    "zh:ce56d68cdfba60891765e94f9c0bf69eddb985d44d97db9f91874bea027f08e2",
-    "zh:e993bcde5dbddaedf3331e3014ffab904f98ab0f5e8b5d6082b7ca5083e0a2f1",
+    "zh:79d238c35d650d2d83a439716182da63f3b2767e72e4cbd0b69cb13d9b1aebfc",
+    "zh:7ef5f49344278fe0bbc5447424e6aa5425ff1821d010d944a444d7fa2c751acf",
+    "zh:92179091638c8ba03feef371c4361a790190f9955caea1fa59de2055c701a251",
+    "zh:a8a34398851761368eb8e7c171f24e55efa6e9fdbb5c455f6dec34dc17f631bc",
+    "zh:b38fd5338625ebace5a4a94cea1a28b11bd91995d834e318f47587cfaf6ec599",
+    "zh:b71b273a2aca7ad5f1e07c767b25b5a888881ba9ca93b30044ccc39c2937f03c",
+    "zh:cd14357e520e0f09fb25badfb4f2ee37d7741afdc3ed47c7bcf54c1683772543",
+    "zh:e05e025f4bb95138c3c8a75c636e97cd7cfd2fc1525b0c8bd097db8c5f02df6e",
  ]
 }

 provider "registry.terraform.io/hashicorp/random" {
-  version = "3.6.0"
+  version = "3.5.1"
  hashes = [
-    "h1:R5Ucn26riKIEijcsiOMBR3uOAjuOMfI1x7XvH4P6B1w=",
-    "zh:03360ed3ecd31e8c5dac9c95fe0858be50f3e9a0d0c654b5e504109c2159287d",
-    "zh:1c67ac51254ba2a2bb53a25e8ae7e4d076103483f55f39b426ec55e47d1fe211",
-    "zh:24a17bba7f6d679538ff51b3a2f378cedadede97af8a1db7dad4fd8d6d50f829",
-    "zh:30ffb297ffd1633175d6545d37c2217e2cef9545a6e03946e514c59c0859b77d",
-    "zh:454ce4b3dbc73e6775f2f6605d45cee6e16c3872a2e66a2c97993d6e5cbd7055",
+    "h1:VSnd9ZIPyfKHOObuQCaKfnjIHRtR7qTw19Rz8tJxm+k=",
+    "zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64",
+    "zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d",
+    "zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831",
+    "zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3",
+    "zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:91df0a9fab329aff2ff4cf26797592eb7a3a90b4a0c04d64ce186654e0cc6e17",
-    "zh:aa57384b85622a9f7bfb5d4512ca88e61f22a9cea9f30febaa4c98c68ff0dc21",
-    "zh:c4a3e329ba786ffb6f2b694e1fd41d413a7010f3a53c20b432325a94fa71e839",
-    "zh:e2699bc9116447f96c53d55f2a00570f982e6f9935038c3810603572693712d0",
-    "zh:e747c0fd5d7684e5bfad8aa0ca441903f15ae7a98a737ff6aca24ba223207e2c",
-    "zh:f1ca75f417ce490368f047b63ec09fd003711ae48487fba90b4aba2ccf71920e",
+    "zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b",
+    "zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2",
+    "zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865",
+    "zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03",
+    "zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602",
+    "zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014",
  ]
 }
--- a/10
+++ b/10
@ -87,16 +87,6 @@ apply:
 		-auto-approve \
 		-var "nomad_secret_id=$(shell jq -r .SecretID nomad_bootstrap.json)" \

-.PHONY: refresh
-refresh:
-	@terraform refresh \
-		-var "nomad_secret_id=$(shell jq -r .SecretID nomad_bootstrap.json)" \
-
-.PHONY: destroy
-destroy:
-	@terraform destroy \
-		-var "nomad_secret_id=$(shell jq -r .SecretID nomad_bootstrap.json)" \
-
 .PHONY: clean
 clean:
 	env VIRTUAL_ENV=$(VENV) $(VENV)/bin/ansible-playbook -vv \
--- a/ansible_playbooks/ansible_hosts.yml
+++ b/ansible_playbooks/ansible_hosts.yml
@ -1,72 +1,65 @@
 ---
 all:
-  hosts:
-    n1.thefij:
-      nomad_node_class: ingress
-      nomad_reserved_memory: 1024
-      # nomad_meta:
-      #   hw_transcode.device: /dev/dri
-      #   hw_transcode.type: intel
-      nfs_mounts:
-        - src: 10.50.250.2:/srv/volumes
-          path: /srv/volumes/moxy
-          opts: proto=tcp,rw
-      nomad_unique_host_volumes:
-        - name: mysql-data
-          path: /srv/volumes/mysql
-          owner: "999"
-          group: "100"
-          mode: "0755"
-          read_only: false
-        - name: postgres-data
-          path: /srv/volumes/postgres
-          owner: "999"
-          group: "999"
-          mode: "0755"
-          read_only: false
-    n2.thefij:
-      nomad_node_class: ingress
-      nomad_reserved_memory: 1024
-      nfs_mounts:
-        - src: 10.50.250.2:/srv/volumes
-          path: /srv/volumes/moxy
-          opts: proto=tcp,rw
-      nomad_unique_host_volumes:
-        - name: nextcloud-data
-          path: /srv/volumes/nextcloud
-          owner: "root"
-          group: "bin"
-          mode: "0755"
-          read_only: false
-    pi4:
-      nomad_node_class: ingress
-      nomad_reserved_memory: 512
-      nomad_meta:
-        hw_transcode.device: /dev/video11
-        hw_transcode.type: raspberry
-    qnomad.thefij:
-      ansible_host: 192.168.2.234
-      nomad_reserved_memory: 1024
-      # This VM uses a non-standard interface
-      nomad_network_interface: ens3
-
-nomad_instances:
-  vars:
-    nomad_network_interface: eth0
  children:
-    nomad_servers: {}
-    nomad_clients: {}
-nomad_servers:
-  hosts:
-    nonopi.thefij:
-      ansible_host: 192.168.2.170
-    n1.thefij: {}
-    n2.thefij: {}
-    pi4: {}
-    qnomad.thefij: {}
-nomad_clients:
-  hosts:
-    n1.thefij: {}
-    n2.thefij: {}
-    pi4: {}
-    qnomad.thefij: {}
+    servers:
+      hosts:
+        n1.thefij:
+          nomad_node_role: both
+          nomad_reserved_memory: 1024
+          # nomad_meta:
+          #   hw_transcode.device: /dev/dri
+          #   hw_transcode.type: intel
+          nfs_mounts:
+            - src: 10.50.250.2:/srv/volumes
+              path: /srv/volumes/moxy
+              opts: proto=tcp,rw
+          nomad_unique_host_volumes:
+            - name: mysql-data
+              path: /srv/volumes/mysql
+              owner: "999"
+              group: "100"
+              mode: "0755"
+              read_only: false
+            - name: postgres-data
+              path: /srv/volumes/postgres
+              owner: "999"
+              group: "999"
+              mode: "0755"
+              read_only: false
+        n2.thefij:
+          nomad_node_role: both
+          nomad_node_class: ingress
+          nomad_reserved_memory: 1024
+          nfs_mounts:
+            - src: 10.50.250.2:/srv/volumes
+              path: /srv/volumes/moxy
+              opts: proto=tcp,rw
+          nomad_unique_host_volumes:
+            - name: nextcloud-data
+              path: /srv/volumes/nextcloud
+              owner: "root"
+              group: "bin"
+              mode: "0755"
+              read_only: false
+            - name: sonarr-data
+              path: /srv/volumes/sonarr
+              owner: "root"
+              group: "bin"
+              mode: "0755"
+              read_only: false
+            - name: certs
+              path: /srv/volumes/certs
+              mode: "0755"
+              owner: root
+              group: bin
+              read_only: false
+        pi4:
+          nomad_node_role: both
+          nomad_reserved_memory: 512
+          nomad_meta:
+            hw_transcode.device: /dev/video11
+            hw_transcode.type: raspberry
+
+    nomad_instances:
+      children:
+        servers: {}
--- a/ansible_playbooks/nomad_wesher_restart.yml
+++ b/ansible_playbooks/nomad_wesher_restart.yml
@ -14,14 +14,8 @@
        state: restarted
      become: true

-    - name: Start Docker
-      systemd:
-        name: docker
-        state: started
-      become: true
-
    - name: Start Nomad
      systemd:
        name: nomad
-        state: started
+        state: stopped
      become: true
--- a/ansible_playbooks/recover-nomad.yaml
+++ b/ansible_playbooks/recover-nomad.yaml
@ -1,6 +1,6 @@
 ---
 - name: Recover Nomad
-  hosts: nomad_servers
+  hosts: nomad_instances
  any_errors_fatal: true

  tasks:
--- a/ansible_playbooks/setup-cluster.yml
+++ b/ansible_playbooks/setup-cluster.yml
@ -14,7 +14,7 @@
        line: "nameserver {{ non_nomad_dns }}"

 - name: Install Docker
-  hosts: nomad_clients
+  hosts: nomad_instances
  become: true
  vars:
    docker_architecture_map:
@ -44,7 +44,7 @@
 #         state: present

 - name: Create NFS mounts
-  hosts: nomad_clients
+  hosts: nomad_instances
  become: true
  vars:
    shared_nfs_mounts:
@ -112,15 +112,9 @@
      - name: nzbget-config
        path: /srv/volumes/nas-container/nzbget
        read_only: false
-      - name: sonarr-config
-        path: /srv/volumes/nas-container/sonarr
-        read_only: false
      - name: lidarr-config
        path: /srv/volumes/nas-container/lidarr
        read_only: false
-      - name: radarr-config
-        path: /srv/volumes/nas-container/radarr
-        read_only: false
      - name: bazarr-config
        path: /srv/volumes/nas-container/bazarr
        read_only: false
@ -137,10 +131,9 @@
  roles:
    - name: ansible-nomad
      vars:
-        nomad_version: "1.7.6-1"
+        nomad_version: "1.7.1-1"
        nomad_install_upgrade: true
        nomad_allow_purge_config: true
-        nomad_node_role: "{% if 'nomad_clients' in group_names %}{% if 'nomad_servers' in group_names %}both{% else %}client{% endif %}{% else %}server{% endif %}"

        # Where nomad gets installed to
        nomad_bin_dir: /usr/bin
@ -194,8 +187,7 @@
        nomad_bind_address: 0.0.0.0

        # Default interface for binding tasks
-        # This is now set at the inventory level
-        # nomad_network_interface: eth0
+        nomad_network_interface: eth0

        # Create networks for binding task ports
        nomad_host_networks:
@ -214,7 +206,7 @@
            enabled: true

 - name: Bootstrap Nomad ACLs and scheduler
-  hosts: nomad_servers
+  hosts: nomad_instances

  tasks:
    - name: Start Nomad
@ -244,7 +236,6 @@
      run_once: true
      ignore_errors: true
      register: bootstrap_result
-      changed_when: bootstrap_result is succeeded

    - name: Save bootstrap result
      copy:
@ -276,15 +267,13 @@
          - list
      environment:
        NOMAD_TOKEN: "{{ read_secretid.stdout }}"
-      register: policies
      run_once: true
-      changed_when: false
+      register: policies

    - name: Copy policy
      copy:
        src: ../acls/nomad-anon-policy.hcl
        dest: /tmp/anonymous.policy.hcl
-      delegate_to: "{{ play_hosts[0] }}"
      run_once: true
      register: anon_policy

@ -304,18 +293,6 @@
      delegate_to: "{{ play_hosts[0] }}"
      run_once: true

-    - name: Read scheduler config
-      command:
-        argv:
-          - nomad
-          - operator
-          - scheduler
-          - get-config
-          - -json
-      run_once: true
-      register: scheduler_config
-      changed_when: false
-
    - name: Enable service scheduler preemption
      command:
        argv:
@ -323,24 +300,12 @@
          - operator
          - scheduler
          - set-config
+          - -preempt-system-scheduler=true
          - -preempt-service-scheduler=true
      environment:
        NOMAD_TOKEN: "{{ read_secretid.stdout }}"
+      delegate_to: "{{ play_hosts[0] }}"
      run_once: true
-      when: (scheduler_config.stdout | from_json)["SchedulerConfig"]["PreemptionConfig"]["ServiceSchedulerEnabled"] is false
-
-    - name: Enable system scheduler preemption
-      command:
-        argv:
-          - nomad
-          - operator
-          - scheduler
-          - set-config
-          - -preempt-system-scheduler=true
-      environment:
-        NOMAD_TOKEN: "{{ read_secretid.stdout }}"
-      run_once: true
-      when: (scheduler_config.stdout | from_json)["SchedulerConfig"]["PreemptionConfig"]["SystemSchedulerEnabled"] is false

    # - name: Set up Nomad backend and roles in Vault
    #   community.general.terraform:
--- a/ansible_playbooks/vars/nomad_vars.sample.yml
+++ b/ansible_playbooks/vars/nomad_vars.sample.yml
@ -9,6 +9,8 @@ nomad/jobs/authelia:
  db_user: VALUE
  email_sender: VALUE
  jwt_secret: VALUE
+  lldap_admin_password: VALUE
+  lldap_admin_user: VALUE
  oidc_clients: VALUE
  oidc_hmac_secret: VALUE
  oidc_issuer_certificate_chain: VALUE
@ -90,6 +92,9 @@ nomad/jobs/immich:
  db_name: VALUE
  db_pass: VALUE
  db_user: VALUE
+nomad/jobs/ipdvr/radarr:
+  db_pass: VALUE
+  db_user: VALUE
 nomad/jobs/lego:
  acme_email: VALUE
  domain_lego_dns: VALUE
@ -99,6 +104,9 @@ nomad/jobs/lidarr:
  db_pass: VALUE
  db_user: VALUE
 nomad/jobs/lldap:
+  admin_email: VALUE
+  admin_password: VALUE
+  admin_user: VALUE
  db_name: VALUE
  db_pass: VALUE
  db_user: VALUE
@ -119,32 +127,21 @@ nomad/jobs/photoprism:
 nomad/jobs/postgres-server:
  superuser: VALUE
  superuser_pass: VALUE
-nomad/jobs/radarr:
-  db_name: VALUE
-  db_pass: VALUE
-  db_user: VALUE
 nomad/jobs/redis-authelia:
  allowed_psks: VALUE
 nomad/jobs/redis-blocky:
  allowed_psks: VALUE
 nomad/jobs/rediscommander:
  redis_stunnel_psk: VALUE
-nomad/jobs/sonarr:
-  db_name: VALUE
-  db_pass: VALUE
-  db_user: VALUE
 nomad/jobs/traefik:
-  external: VALUE
+  acme_email: VALUE
+  domain_lego_dns: VALUE
  usersfile: VALUE
 nomad/jobs/unifi-traffic-route-ips:
  unifi_password: VALUE
  unifi_username: VALUE
 nomad/oidc:
  secret: VALUE
-secrets/ldap:
-  admin_email: VALUE
-  admin_password: VALUE
-  admin_user: VALUE
 secrets/mysql:
  mysql_root_password: VALUE
 secrets/postgres:
--- a/backups/backup.nomad
+++ b/backups/backup.nomad
@ -62,8 +62,6 @@ job "backup%{ if batch_node != null }-oneoff-${batch_node}%{ endif }" {
    task "backup" {
      driver = "docker"

-      shutdown_delay = "5m"
-
      volume_mount {
        volume = "all-volumes"
        destination = "/data"
@ -71,7 +69,7 @@ job "backup%{ if batch_node != null }-oneoff-${batch_node}%{ endif }" {
      }

      config {
-        image = "iamthefij/resticscheduler:0.4.0"
+        image = "iamthefij/resticscheduler:0.3.1"
        ports = ["metrics"]
        args = [
          %{ if batch_node != null ~}
@ -87,21 +85,6 @@ job "backup%{ if batch_node != null }-oneoff-${batch_node}%{ endif }" {
        ]
      }

-      action "unlockenv" {
-        command = "sh"
-        args = ["-c", "/bin/resticscheduler -once -unlock all $${NOMAD_TASK_DIR}/node-jobs.hcl"]
-      }
-
-      action "unlocktmpl" {
-        command = "/bin/resticscheduler"
-        args = ["-once", "-unlock", "all", "{{ env 'NOMAD_TASK_DIR' }}/node-jobs.hcl"]
-      }
-
-      action "unlockhc" {
-        command = "/bin/resticscheduler"
-        args = ["-once", "-unlock", "all", "/local/node-jobs.hcl"]
-      }
-
      env = {
        RCLONE_CHECKERS = "2"
        RCLONE_TRANSFERS = "2"
@ -156,7 +139,7 @@ ${file("${module_path}/${job_file}")}

 # Dummy job to keep task healthy on node without any stateful services
 job "Dummy" {
-  schedule = "@daily"
+  schedule = "0 0 1 1 0"

  config {
    repo = "/local/dummy-repo"
@ -190,8 +173,8 @@ job "Dummy" {
      }

      config {
-        image = "iamthefij/stunnel:latest"
-        args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
+        image = "alpine:3.17"
+        args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
      }

      resources {
@ -199,6 +182,15 @@ job "Dummy" {
        memory = 100
      }

+      template {
+        data = <<EOF
+set -e
+apk add stunnel
+exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
+        EOF
+        destination = "$${NOMAD_TASK_DIR}/start.sh"
+      }
+
      template {
        data = <<EOF
 syslog = no
--- a/backups/jobs/radarr.hcl
+++ b/backups/jobs/radarr.hcl
@ -1,64 +0,0 @@
-job "radarr" {
-  schedule = "@daily"
-
-  config {
-    repo = "s3://backups-minio.agnosticfront.thefij:8443/nomad/radarr"
-    passphrase = env("BACKUP_PASSPHRASE")
-
-    options {
-      InsecureTls = true
-    }
-  }
-
-  task "Backup main database" {
-    postgres "Backup database" {
-      hostname       = env("POSTGRES_HOST")
-      port           = env("POSTGRES_PORT")
-      username       = env("POSTGRES_USER")
-      password       = env("POSTGRES_PASSWORD")
-      database       = "radarr"
-      no_tablespaces = true
-      dump_to        = "/data/nas-container/radarr/Backups/dump-radarr.sql"
-    }
-  }
-
-  task "Backup logs database" {
-    postgres "Backup database" {
-      hostname       = env("POSTGRES_HOST")
-      port           = env("POSTGRES_PORT")
-      username       = env("POSTGRES_USER")
-      password       = env("POSTGRES_PASSWORD")
-      database       = "radarr-logs"
-      no_tablespaces = true
-      dump_to        = "/data/nas-container/radarr/Backups/dump-radarr-logs.sql"
-    }
-  }
-
-  backup {
-    paths = ["/data/nas-container/radarr"]
-
-    backup_opts {
-      Exclude = [
-        "radarr_backup_*.zip",
-        "/data/nas-container/radarr/MediaCover",
-        "/data/nas-container/radarr/logs",
-      ]
-      Host = "nomad"
-    }
-
-    restore_opts {
-      Host = ["nomad"]
-      # Because path is absolute
-      Target = "/"
-    }
-  }
-
-  forget {
-    KeepLast = 2
-    KeepDaily = 30
-    KeepWeekly = 8
-    KeepMonthly = 6
-    KeepYearly = 2
-    Prune = true
-  }
-}
--- a/backups/jobs/sonarr.hcl
+++ b/backups/jobs/sonarr.hcl
@ -11,37 +11,25 @@ job "sonarr" {
  }

  task "Backup main database" {
-    postgres "Backup database" {
-      hostname       = env("POSTGRES_HOST")
-      port           = env("POSTGRES_PORT")
-      username       = env("POSTGRES_USER")
-      password       = env("POSTGRES_PASSWORD")
-      database       = "sonarr"
-      no_tablespaces = true
-      dump_to        = "/data/nas-container/sonarr/Backups/dump-sonarr.sql"
+    sqlite "Backup database" {
+      path = "/data/sonarr/sonarr.db"
+      dump_to = "/data/sonarr/Backups/sonarr.db.bak"
    }
  }

  task "Backup logs database" {
-    postgres "Backup database" {
-      hostname       = env("POSTGRES_HOST")
-      port           = env("POSTGRES_PORT")
-      username       = env("POSTGRES_USER")
-      password       = env("POSTGRES_PASSWORD")
-      database       = "sonarr-logs"
-      no_tablespaces = true
-      dump_to        = "/data/nas-container/sonarr/Backups/dump-sonarr-logs.sql"
+    sqlite "Backup database" {
+      path = "/data/sonarr/logs.db"
+      dump_to = "/data/sonarr/Backups/logs.db.bak"
    }
  }

  backup {
-    paths = ["/data/nas-container/sonarr"]
+    paths = ["/data/sonarr"]

    backup_opts {
      Exclude = [
        "sonarr_backup_*.zip",
-        "/data/nas-container/sonarr/MediaCover",
-        "/data/nas-container/sonarr/logs",
        "*.db",
        "*.db-shm",
        "*.db-wal",
--- a/core/.terraform.lock.hcl
+++ b/core/.terraform.lock.hcl
@ -2,39 +2,39 @@
 # Manual edits may be lost in future updates.

 provider "registry.terraform.io/hashicorp/nomad" {
-  version = "2.1.1"
+  version = "2.0.0"
  hashes = [
-    "h1:liQBgBXfQEYmwpoGZUfSsu0U0t/nhvuRZbMhaMz7wcQ=",
-    "zh:28bc6922e8a21334568410760150d9d413d7b190d60b5f0b4aab2f4ef52efeeb",
-    "zh:2d4283740e92ce1403875486cd5ff2c8acf9df28c190873ab4d769ce37db10c1",
-    "zh:457e16d70075eae714a7df249d3ba42c2176f19b6750650152c56f33959028d9",
-    "zh:49ee88371e355c00971eefee6b5001392431b47b3e760a5c649dda76f59fb8fa",
-    "zh:614ad3bf07155ed8a5ced41dafb09042afbd1868490a379654b3e970def8e33d",
-    "zh:75be7199d76987e7549e1f27439922973d1bf27353b44a593bfbbc2e3b9f698f",
+    "h1:lIHIxA6ZmfyTGL3J9YIddhxlfit4ipSS09BLxkwo6L0=",
+    "zh:09b897d64db293f9a904a4a0849b11ec1e3fff5c638f734d82ae36d8dc044b72",
+    "zh:435cc106799290f64078ec24b6c59cb32b33784d609088638ed32c6d12121199",
+    "zh:7073444bd064e8c4ec115ca7d9d7f030cc56795c0a83c27f6668bba519e6849a",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:888e14a24410d56b37212fbea373a3e0401d0ff8f8e4f4dd00ba8b29de9fed39",
-    "zh:aa261925e8b152636a0886b3a2149864707632d836e98a88dacea6cfb6302082",
-    "zh:ac10cefb4064b3bb63d4b0379624a416a45acf778eac0004466f726ead686196",
-    "zh:b1a3c8b4d5b2dc9b510eac5e9e02665582862c24eb819ab74f44d3d880246d4f",
-    "zh:c552e2fe5670b6d3ad9a5faf78e3a27197eeedbe2b13928d2c491fa509bc47c7",
+    "zh:79d238c35d650d2d83a439716182da63f3b2767e72e4cbd0b69cb13d9b1aebfc",
+    "zh:7ef5f49344278fe0bbc5447424e6aa5425ff1821d010d944a444d7fa2c751acf",
+    "zh:92179091638c8ba03feef371c4361a790190f9955caea1fa59de2055c701a251",
+    "zh:a8a34398851761368eb8e7c171f24e55efa6e9fdbb5c455f6dec34dc17f631bc",
+    "zh:b38fd5338625ebace5a4a94cea1a28b11bd91995d834e318f47587cfaf6ec599",
+    "zh:b71b273a2aca7ad5f1e07c767b25b5a888881ba9ca93b30044ccc39c2937f03c",
+    "zh:cd14357e520e0f09fb25badfb4f2ee37d7741afdc3ed47c7bcf54c1683772543",
+    "zh:e05e025f4bb95138c3c8a75c636e97cd7cfd2fc1525b0c8bd097db8c5f02df6e",
  ]
 }

 provider "registry.terraform.io/hashicorp/random" {
-  version = "3.6.0"
+  version = "3.5.1"
  hashes = [
-    "h1:R5Ucn26riKIEijcsiOMBR3uOAjuOMfI1x7XvH4P6B1w=",
-    "zh:03360ed3ecd31e8c5dac9c95fe0858be50f3e9a0d0c654b5e504109c2159287d",
-    "zh:1c67ac51254ba2a2bb53a25e8ae7e4d076103483f55f39b426ec55e47d1fe211",
-    "zh:24a17bba7f6d679538ff51b3a2f378cedadede97af8a1db7dad4fd8d6d50f829",
-    "zh:30ffb297ffd1633175d6545d37c2217e2cef9545a6e03946e514c59c0859b77d",
-    "zh:454ce4b3dbc73e6775f2f6605d45cee6e16c3872a2e66a2c97993d6e5cbd7055",
+    "h1:VSnd9ZIPyfKHOObuQCaKfnjIHRtR7qTw19Rz8tJxm+k=",
+    "zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64",
+    "zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d",
+    "zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831",
+    "zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3",
+    "zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:91df0a9fab329aff2ff4cf26797592eb7a3a90b4a0c04d64ce186654e0cc6e17",
-    "zh:aa57384b85622a9f7bfb5d4512ca88e61f22a9cea9f30febaa4c98c68ff0dc21",
-    "zh:c4a3e329ba786ffb6f2b694e1fd41d413a7010f3a53c20b432325a94fa71e839",
-    "zh:e2699bc9116447f96c53d55f2a00570f982e6f9935038c3810603572693712d0",
-    "zh:e747c0fd5d7684e5bfad8aa0ca441903f15ae7a98a737ff6aca24ba223207e2c",
-    "zh:f1ca75f417ce490368f047b63ec09fd003711ae48487fba90b4aba2ccf71920e",
+    "zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b",
+    "zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2",
+    "zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865",
+    "zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03",
+    "zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602",
+    "zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014",
  ]
 }
--- a/core/acme.tf
+++ b/core/acme.tf
@ -0,0 +1,44 @@
+module "acme" {
+  source = "../services/service"
+
+  name  = "acme"
+  image = "caddy:2.7.4"
+  args  = ["caddy", "--config", "$${NOMAD_TASK_DIR}/Caddyfile", "run"]
+
+  ingress      = true
+  service_port = 80
+  use_wesher   = var.use_wesher
+
+  templates = [
+    {
+      data        = <<EOF
+{
+  local_certs
+  debug
+  storage file_system {{ env "NOMAD_ALLOC_DIR" }}/data
+}
+
+:80, :443 {
+  tls internal
+
+  reverse_proxy "/chain" http://localhost:2019 {
+    header_up Host {upstream_hostport}
+    rewrite /pki/ca/local/certificates
+  }
+
+  @denied not remote_ip private_ranges
+  error @denied "Who dis?" 401
+
+  acme_server
+}
+      EOF
+      dest        = "Caddyfile"
+      mount       = false
+      change_mode = "script"
+      change_script = {
+        command = "caddy"
+        args    = ["reload", "--config", "$${NOMAD_TASK_DIR}/Caddyfle"]
+      }
+    },
+  ]
+}
--- a/core/authelia.tf
+++ b/core/authelia.tf
@ -49,7 +49,7 @@ module "authelia" {
      mount = false
    },
    {
-      data        = "{{ with nomadVar \"secrets/ldap\" }}{{ .admin_password }}{{ end }}"
+      data        = "{{ with nomadVar \"nomad/jobs/authelia\" }}{{ .lldap_admin_password }}{{ end }}"
      dest_prefix = "$${NOMAD_SECRETS_DIR}"
      dest        = "ldap_password.txt"
      mount       = false
@ -105,43 +105,6 @@ module "authelia" {
  ]
 }

-resource "nomad_acl_policy" "authelia" {
-  name        = "authelia"
-  description = "Give access to shared authelia variables"
-  rules_hcl   = <<EOH
-namespace "default" {
-  variables {
-    path "authelia/*" {
-      capabilities = ["read"]
-    }
-  }
-}
-EOH
-
-  job_acl {
-    job_id = module.authelia.job_id
-  }
-}
-
-# Give access to ldap secrets
-resource "nomad_acl_policy" "authelia_ldap_secrets" {
-  name        = "authelia-secrets-ldap"
-  description = "Give access to LDAP secrets"
-  rules_hcl   = <<EOH
-namespace "default" {
-  variables {
-    path "secrets/ldap" {
-      capabilities = ["read"]
-    }
-  }
-}
-EOH
-
-  job_acl {
-    job_id = module.authelia.job_id
-  }
-}
-
 resource "nomad_acl_auth_method" "nomad_authelia" {
  name           = "authelia"
  type           = "OIDC"
--- a/core/authelia.yml
+++ b/core/authelia.yml
@ -89,8 +89,8 @@ authentication_backend:
    groups_filter: (member={dn})

    ## The username and password of the admin user.
-    {{ with nomadVar "secrets/ldap" }}
-    user: uid={{ .admin_user }},ou=people,{{ with nomadVar "nomad/jobs" }}{{ .ldap_base_dn }}{{ end }}
+    {{ with nomadVar "nomad/jobs/authelia" }}
+    user: uid={{ .lldap_admin_user }},ou=people,{{ with nomadVar "nomad/jobs" }}{{ .ldap_base_dn }}{{ end }}
    {{ end }}
    # password set using secrets file
    # password: <secret>
@ -151,10 +151,6 @@ access_control:
      networks: 192.168.5.0/24

  rules:
-    {{ range nomadVarList "authelia/access_control/service_rules" }}{{ with nomadVar .Path }}
-    - domain: '{{ .name }}.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}'
-{{ .rule.Value | indent 6 }}
-    {{ end }}{{ end }}
    ## Rules applied to everyone
    - domain: '*.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}'
      networks:
--- a/core/blocky/blocky.nomad
+++ b/core/blocky/blocky.nomad
@ -32,9 +32,7 @@ job "blocky" {

      dns {
        # Set expclicit DNS servers because tasks, by default, use this task
-        servers = [
-          "192.168.2.1",
-        ]
+        servers = ["1.1.1.1", "1.0.0.1"]
      }
    }

@ -76,8 +74,8 @@ job "blocky" {

      resources {
        cpu = 50
-        memory = 75
-        memory_max = 150
+        memory = 50
+        memory_max = 100
      }

      template {
@ -118,9 +116,9 @@ job "blocky" {
      }

      config {
-        image = "iamthefij/stunnel:latest"
-        args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
+        image = "alpine:3.17"
        ports = ["tls"]
+        args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
      }

      resources {
@ -128,27 +126,36 @@ job "blocky" {
        memory = 100
      }

+      template {
+        data = <<EOF
+set -e
+apk add stunnel
+exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
+        EOF
+        destination = "$${NOMAD_TASK_DIR}/start.sh"
+      }
+
      template {
        data = <<EOF
 syslog = no
 foreground = yes
 delay = yes

-{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-tls" -}}
 [mysql_client]
 client = yes
 accept = 127.0.0.1:3306
+{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-tls" -}}
 connect = {{ .Address }}:{{ .Port }}
-PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/mysql_stunnel_psk.txt
 {{- end }}
+PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/mysql_stunnel_psk.txt

-{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "redis-blocky" -}}
 [redis_client]
 client = yes
 accept = 127.0.0.1:6379
+{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "redis-blocky" -}}
 connect = {{ .Address }}:{{ .Port }}
-PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/stunnel_psk.txt
 {{- end }}
+PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/stunnel_psk.txt
        EOF
        destination = "$${NOMAD_TASK_DIR}/stunnel.conf"
      }
--- a/core/blocky/config.yml
+++ b/core/blocky/config.yml
@ -5,24 +5,12 @@ ports:
 bootstrapDns:
  - upstream: 1.1.1.1
  - upstream: 1.0.0.1
-  - upstream: 9.9.9.9
-  - upstream: 149.112.112.112
-

 upstreams:
  groups:
    default:
-      - https://dns.quad9.net/dns-query
-      - tcp-tls:dns.quad9.net
-      - https://one.one.one.one/dns-query
-      - tcp-tls:one.one.one.one
-    cloudflare:
      - 1.1.1.1
      - 1.0.0.1
-      - 2606:4700:4700::1111
-      - 2606:4700:4700::1001
-      - https://one.one.one.one/dns-query
-      - tcp-tls:one.one.one.one
    quad9:
      - 9.9.9.9
      - 149.112.112.112
@ -30,13 +18,6 @@ upstreams:
      - 2620:fe::9
      - https://dns.quad9.net/dns-query
      - tcp-tls:dns.quad9.net
-    quad9-secured:
-      - 9.9.9.11
-      - 149.112.112.11
-      - 2620:fe::11
-      - 2620:fe::fe:11
-      - https://dns11.quad9.net/dns-query
-      - tcp-tls:dns11.quad9.net
    quad9-unsecured:
      - 9.9.9.10
      - 149.112.112.10
@ -72,7 +53,7 @@ blocking:
      - http://sysctl.org/cameleon/hosts
      - https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
      - https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
-      # - https://hosts-file.net/ad_servers.txt
+      - https://hosts-file.net/ad_servers.txt
    smarttv:
      - https://perflyst.github.io/PiHoleBlocklist/SmartTV.txt
      # - https://perflyst.github.io/PiHoleBlocklist/regex.list
--- a/core/grafana.nomad
+++ b/core/grafana.nomad
@ -40,8 +40,8 @@ job "grafana" {
      }

      config {
-        image = "iamthefij/stunnel:latest"
-        args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
+        image = "alpine:3.17"
+        args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
      }

      resources {
@ -49,6 +49,15 @@ job "grafana" {
        memory = 100
      }

+      template {
+        data = <<EOF
+set -e
+apk add stunnel
+exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
+        EOF
+        destination = "$${NOMAD_TASK_DIR}/start.sh"
+      }
+
      template {
        data = <<EOF
 syslog = no
@ -133,7 +142,7 @@ SELECT 'NOOP';
      driver = "docker"

      config {
-        image = "grafana/grafana:10.0.10"
+        image = "grafana/grafana:9.4.2"
        args = ["--config", "$${NOMAD_ALLOC_DIR}/config/grafana.ini"]
        ports = ["web"]
      }
--- a/core/grafana/grafana.ini
+++ b/core/grafana/grafana.ini
@ -270,10 +270,6 @@ api_url = https://authelia.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{
 login_attribute_path = preferred_username
 groups_attribute_path = groups
 name_attribute_path = name
-# Role attribute path is not working
-role_attribute_path = contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'grafana-admin') && 'Admin' || contains(groups[*], 'grafana-editor') && 'Editor' || contains(groups[*], 'developer') && 'Editor'
-allow_assign_grafana_admin = true
-skip_org_role_sync = true
 use_pkce = true

 ;team_ids =
--- a/core/grafana/provisioning/dashboards/default/traefik.json
+++ b/core/grafana/provisioning/dashboards/default/traefik.json
@ -0,0 +1,783 @@
+{
+  "__inputs": [
+    {
+      "name": "DS_PROMETHEUS",
+      "label": "Prometheus",
+      "description": "",
+      "type": "datasource",
+      "pluginId": "prometheus",
+      "pluginName": "Prometheus"
+    }
+  ],
+  "__requires": [
+    {
+      "type": "grafana",
+      "id": "grafana",
+      "name": "Grafana",
+      "version": "7.5.5"
+    },
+    {
+      "type": "panel",
+      "id": "graph",
+      "name": "Graph",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "piechart",
+      "name": "Pie chart v2",
+      "version": ""
+    },
+    {
+      "type": "datasource",
+      "id": "prometheus",
+      "name": "Prometheus",
+      "version": "1.0.0"
+    },
+    {
+      "type": "panel",
+      "id": "singlestat",
+      "name": "Singlestat",
+      "version": ""
+    }
+  ],
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": "-- Grafana --",
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "description": "Traefik dashboard prometheus",
+  "editable": true,
+  "gnetId": 4475,
+  "graphTooltip": 0,
+  "id": null,
+  "iteration": 1620932097756,
+  "links": [],
+  "panels": [
+    {
+      "datasource": null,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 10,
+      "title": "$backend stats",
+      "type": "row"
+    },
+    {
+      "cacheTimeout": null,
+      "datasource": "${DS_PROMETHEUS}",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "decimals": 0,
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 0,
+        "y": 1
+      },
+      "id": 2,
+      "interval": null,
+      "links": [],
+      "maxDataPoints": 3,
+      "options": {
+        "displayLabels": [],
+        "legend": {
+          "calcs": [],
+          "displayMode": "table",
+          "placement": "right",
+          "values": [
+            "value",
+            "percent"
+          ]
+        },
+        "pieType": "pie",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "text": {}
+      },
+      "targets": [
+        {
+          "exemplar": true,
+          "expr": "traefik_service_requests_total{service=\"$service\"}",
+          "format": "time_series",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "{{method}} : {{code}}",
+          "refId": "A"
+        }
+      ],
+      "title": "$service return code",
+      "type": "piechart"
+    },
+    {
+      "cacheTimeout": null,
+      "colorBackground": false,
+      "colorValue": false,
+      "colors": [
+        "#299c46",
+        "rgba(237, 129, 40, 0.89)",
+        "#d44a3a"
+      ],
+      "datasource": "${DS_PROMETHEUS}",
+      "fieldConfig": {
+        "defaults": {},
+        "overrides": []
+      },
+      "format": "ms",
+      "gauge": {
+        "maxValue": 100,
+        "minValue": 0,
+        "show": false,
+        "thresholdLabels": false,
+        "thresholdMarkers": true
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 12,
+        "y": 1
+      },
+      "id": 4,
+      "interval": null,
+      "links": [],
+      "mappingType": 1,
+      "mappingTypes": [
+        {
+          "name": "value to text",
+          "value": 1
+        },
+        {
+          "name": "range to text",
+          "value": 2
+        }
+      ],
+      "maxDataPoints": 100,
+      "nullPointMode": "connected",
+      "nullText": null,
+      "postfix": "",
+      "postfixFontSize": "50%",
+      "prefix": "",
+      "prefixFontSize": "50%",
+      "rangeMaps": [
+        {
+          "from": "null",
+          "text": "N/A",
+          "to": "null"
+        }
+      ],
+      "sparkline": {
+        "fillColor": "rgba(31, 118, 189, 0.18)",
+        "full": false,
+        "lineColor": "rgb(31, 120, 193)",
+        "show": true
+      },
+      "tableColumn": "",
+      "targets": [
+        {
+          "exemplar": true,
+          "expr": "sum(traefik_service_request_duration_seconds_sum{service=\"$service\"}) / sum(traefik_service_requests_total{service=\"$service\"}) * 1000",
+          "format": "time_series",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "",
+          "refId": "A"
+        }
+      ],
+      "thresholds": "",
+      "title": "$service response time",
+      "type": "singlestat",
+      "valueFontSize": "80%",
+      "valueMaps": [
+        {
+          "op": "=",
+          "text": "N/A",
+          "value": "null"
+        }
+      ],
+      "valueName": "avg"
+    },
+    {
+      "aliasColors": {},
+      "bars": true,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMETHEUS}",
+      "fieldConfig": {
+        "defaults": {},
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 7,
+        "w": 24,
+        "x": 0,
+        "y": 8
+      },
+      "hiddenSeries": false,
+      "id": 3,
+      "legend": {
+        "alignAsTable": true,
+        "avg": true,
+        "current": false,
+        "max": true,
+        "min": true,
+        "rightSide": true,
+        "show": true,
+        "total": false,
+        "values": true
+      },
+      "lines": false,
+      "linewidth": 1,
+      "links": [],
+      "nullPointMode": "null",
+      "options": {
+        "alertThreshold": true
+      },
+      "percentage": false,
+      "pluginVersion": "7.5.5",
+      "pointradius": 5,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": false,
+      "steppedLine": false,
+      "targets": [
+        {
+          "exemplar": true,
+          "expr": "sum(rate(traefik_service_requests_total{service=\"$service\"}[5m]))",
+          "format": "time_series",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "Total requests $service",
+          "refId": "A"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Total requests over 5min $service",
+      "tooltip": {
+        "shared": true,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "time",
+        "name": null,
+        "show": true,
+        "values": []
+      },
+      "yaxes": [
+        {
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        },
+        {
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "collapsed": false,
+      "datasource": null,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 15
+      },
+      "id": 12,
+      "panels": [],
+      "title": "Global stats",
+      "type": "row"
+    },
+    {
+      "aliasColors": {},
+      "bars": true,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMETHEUS}",
+      "fieldConfig": {
+        "defaults": {},
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 0,
+        "y": 16
+      },
+      "hiddenSeries": false,
+      "id": 5,
+      "legend": {
+        "alignAsTable": true,
+        "avg": false,
+        "current": true,
+        "max": true,
+        "min": true,
+        "rightSide": true,
+        "show": true,
+        "total": false,
+        "values": true
+      },
+      "lines": false,
+      "linewidth": 1,
+      "links": [],
+      "nullPointMode": "null",
+      "options": {
+        "alertThreshold": true
+      },
+      "percentage": false,
+      "pluginVersion": "7.5.5",
+      "pointradius": 5,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": true,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "rate(traefik_entrypoint_requests_total{entrypoint=~\"$entrypoint\",code=\"200\"}[5m])",
+          "format": "time_series",
+          "intervalFactor": 2,
+          "legendFormat": "{{method}} : {{code}}",
+          "refId": "A"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Status code 200 over 5min",
+      "tooltip": {
+        "shared": true,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "time",
+        "name": null,
+        "show": true,
+        "values": []
+      },
+      "yaxes": [
+        {
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        },
+        {
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "aliasColors": {},
+      "bars": true,
+      "dashLength": 10,
+      "dashes": false,
+      "datasource": "${DS_PROMETHEUS}",
+      "fieldConfig": {
+        "defaults": {},
+        "overrides": []
+      },
+      "fill": 1,
+      "fillGradient": 0,
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 12,
+        "y": 16
+      },
+      "hiddenSeries": false,
+      "id": 6,
+      "legend": {
+        "alignAsTable": true,
+        "avg": false,
+        "current": true,
+        "max": true,
+        "min": true,
+        "rightSide": true,
+        "show": true,
+        "total": false,
+        "values": true
+      },
+      "lines": false,
+      "linewidth": 1,
+      "links": [],
+      "nullPointMode": "null",
+      "options": {
+        "alertThreshold": true
+      },
+      "percentage": false,
+      "pluginVersion": "7.5.5",
+      "pointradius": 5,
+      "points": false,
+      "renderer": "flot",
+      "seriesOverrides": [],
+      "spaceLength": 10,
+      "stack": true,
+      "steppedLine": false,
+      "targets": [
+        {
+          "expr": "rate(traefik_entrypoint_requests_total{entrypoint=~\"$entrypoint\",code!=\"200\"}[5m])",
+          "format": "time_series",
+          "intervalFactor": 2,
+          "legendFormat": "{{ method }} : {{code}}",
+          "refId": "A"
+        }
+      ],
+      "thresholds": [],
+      "timeFrom": null,
+      "timeRegions": [],
+      "timeShift": null,
+      "title": "Others status code over 5min",
+      "tooltip": {
+        "shared": true,
+        "sort": 0,
+        "value_type": "individual"
+      },
+      "type": "graph",
+      "xaxis": {
+        "buckets": null,
+        "mode": "time",
+        "name": null,
+        "show": true,
+        "values": []
+      },
+      "yaxes": [
+        {
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        },
+        {
+          "format": "short",
+          "label": null,
+          "logBase": 1,
+          "max": null,
+          "min": null,
+          "show": true
+        }
+      ],
+      "yaxis": {
+        "align": false,
+        "alignLevel": null
+      }
+    },
+    {
+      "cacheTimeout": null,
+      "datasource": "${DS_PROMETHEUS}",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "decimals": 0,
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 0,
+        "y": 23
+      },
+      "id": 7,
+      "interval": null,
+      "links": [],
+      "maxDataPoints": 3,
+      "options": {
+        "displayLabels": [],
+        "legend": {
+          "calcs": [],
+          "displayMode": "table",
+          "placement": "right",
+          "values": [
+            "value"
+          ]
+        },
+        "pieType": "pie",
+        "reduceOptions": {
+          "calcs": [
+            "sum"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "text": {}
+      },
+      "targets": [
+        {
+          "exemplar": true,
+          "expr": "sum(rate(traefik_service_requests_total[5m])) by (service) ",
+          "format": "time_series",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "{{ service }}",
+          "refId": "A"
+        }
+      ],
+      "title": "Requests by service",
+      "type": "piechart"
+    },
+    {
+      "cacheTimeout": null,
+      "datasource": "${DS_PROMETHEUS}",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "decimals": 0,
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 12,
+        "y": 23
+      },
+      "id": 8,
+      "interval": null,
+      "links": [],
+      "maxDataPoints": 3,
+      "options": {
+        "displayLabels": [],
+        "legend": {
+          "calcs": [],
+          "displayMode": "table",
+          "placement": "right",
+          "values": [
+            "value"
+          ]
+        },
+        "pieType": "pie",
+        "reduceOptions": {
+          "calcs": [
+            "sum"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "text": {}
+      },
+      "targets": [
+        {
+          "exemplar": true,
+          "expr": "sum(rate(traefik_entrypoint_requests_total{entrypoint =~ \"$entrypoint\"}[5m])) by (entrypoint) ",
+          "format": "time_series",
+          "interval": "",
+          "intervalFactor": 2,
+          "legendFormat": "{{ entrypoint }}",
+          "refId": "A"
+        }
+      ],
+      "title": "Requests by protocol",
+      "type": "piechart"
+    }
+  ],
+  "schemaVersion": 27,
+  "style": "dark",
+  "tags": [
+    "traefik",
+    "prometheus"
+  ],
+  "templating": {
+    "list": [
+      {
+        "allValue": null,
+        "current": {},
+        "datasource": "${DS_PROMETHEUS}",
+        "definition": "label_values(service)",
+        "description": null,
+        "error": null,
+        "hide": 0,
+        "includeAll": false,
+        "label": null,
+        "multi": false,
+        "name": "service",
+        "options": [],
+        "query": {
+          "query": "label_values(service)",
+          "refId": "StandardVariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "tagValuesQuery": "",
+        "tags": [],
+        "tagsQuery": "",
+        "type": "query",
+        "useTags": false
+      },
+      {
+        "allValue": null,
+        "current": {},
+        "datasource": "${DS_PROMETHEUS}",
+        "definition": "",
+        "description": null,
+        "error": null,
+        "hide": 0,
+        "includeAll": true,
+        "label": null,
+        "multi": true,
+        "name": "entrypoint",
+        "options": [],
+        "query": {
+          "query": "label_values(entrypoint)",
+          "refId": "Prometheus-entrypoint-Variable-Query"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "tagValuesQuery": "",
+        "tags": [],
+        "tagsQuery": "",
+        "type": "query",
+        "useTags": false
+      }
+    ]
+  },
+  "time": {
+    "from": "now-1h",
+    "to": "now"
+  },
+  "timepicker": {
+    "refresh_intervals": [
+      "5s",
+      "10s",
+      "30s",
+      "1m",
+      "5m",
+      "15m",
+      "30m",
+      "1h",
+      "2h",
+      "1d"
+    ],
+    "time_options": [
+      "5m",
+      "15m",
+      "1h",
+      "6h",
+      "12h",
+      "24h",
+      "2d",
+      "7d",
+      "30d"
+    ]
+  },
+  "timezone": "",
+  "title": "Traefik",
+  "uid": "qPdAviJmz",
+  "version": 10
+}
--- a/core/lego.nomad
+++ b/core/lego.nomad
@ -3,8 +3,8 @@ variable "lego_version" {
  type = string
 }

-variable "nomad_var_dirsync_version" {
-  default = "0.0.2"
+variable "nomad_version" {
+  default = "1.7.2"
  type = string
 }

@ -19,52 +19,58 @@ job "lego" {

  group "main" {

-    network {
-      dns {
-        servers = ["1.1.1.1", "1.0.0.1"]
-      }
+    volume "certs" {
+      type = "host"
+      read_only = true
+      source = "certs"
    }

    task "main" {
-      driver = "exec"
+      driver = "docker"

      config {
-        # image = "alpine:3"
-        command = "/bin/bash"
+        image = "ubuntu:latest"
+        command = "sh"
        args = ["${NOMAD_TASK_DIR}/start.sh"]
      }

+      volume_mount {
+        volume = "certs"
+        destination = "/root/.lego"
+        read_only = true
+      }
+
      artifact {
        source = "https://github.com/go-acme/lego/releases/download/v${var.lego_version}/lego_v${var.lego_version}_linux_${attr.cpu.arch}.tar.gz"
      }

      artifact {
-        source = "https://git.iamthefij.com/iamthefij/nomad-var-dirsync/releases/download/v${var.nomad_var_dirsync_version}/nomad-var-dirsync-linux-${attr.cpu.arch}.tar.gz"
+        source = "https://releases.hashicorp.com/nomad/${var.nomad_version}/nomad_${var.nomad_version}_linux_${attr.cpu.arch}.zip"
      }

      template {
        data = <<EOH
 #! /bin/sh
-set -ex

-cd ${NOMAD_TASK_DIR}
+ls -l ${NOMAD_TASK_DIR}

-echo "Read certs from nomad vars"
-${NOMAD_TASK_DIR}/nomad-var-dirsync-linux-{{ env "attr.cpu.arch" }} -root-var=secrets/certs read .
-
-action=run
-if [ -f /.lego/certificates/_.thefij.rocks.crt ]; then
-    action=renew
+arg=run
+if [ -f /root/.lego/certificates/_.thefij.rocks.crt ]; then
+    arg=renew
 fi

-echo "Attempt to $action certificates"
 ${NOMAD_TASK_DIR}/lego \
+    --server=https://acme-staging-v02.api.letsencrypt.org/directory \
    --accept-tos --pem \
    --email=iamthefij@gmail.com \
-    --domains="*.thefij.rocks" \
+    --domains="*.iamthefij.com" \
    --dns="cloudflare" \
-    $action \
-    --$action-hook="${NOMAD_TASK_DIR}/nomad-var-dirsync-linux-{{ env "attr.cpu.arch" }} -root-var=secrets/certs write .lego" \
+    $arg
+
+# chmod +x ${NOMAD_TASK_DIR}/nomad
+
+# ${NOMAD_TASK_DIR}/nomad var list
+sleep 1000
 EOH
        destination = "${NOMAD_TASK_DIR}/start.sh"
      }
@ -87,11 +93,6 @@ CF_ZONE_API_TOKEN={{ .domain_lego_dns }}
      identity {
        env = true
      }
-
-      resources {
-        cpu = 50
-        memory = 100
-      }
    }
  }
 }
--- a/core/lego.tf
+++ b/core/lego.tf
@ -11,9 +11,6 @@ namespace "default" {
    path "secrets/certs/*" {
      capabilities = ["write", "read"]
    }
-    path "secrets/certs" {
-      capabilities = ["write", "read"]
-    }
  }
 }
 EOH
--- a/core/loki-config.yml
+++ b/core/loki-config.yml
@ -3,27 +3,31 @@ auth_enabled: false
 server:
  http_listen_port: 3100

-common:
-  ring:
-    instance_addr: 127.0.0.1
-    kvstore:
-      store: inmemory
-  replication_factor: 1
-  path_prefix: /tmp/loki
+ingester:
+  lifecycler:
+    address: 127.0.0.1
+    ring:
+      kvstore:
+        store: inmemory
+      replication_factor: 1
+    final_sleep: 0s
+  chunk_idle_period: 5m
+  chunk_retain_period: 30s
+  max_transfer_retries: 0

 schema_config:
  configs:
-    - from: 2020-05-15
-      store: boltdb-shipper
+    - from: 2018-04-15
+      store: boltdb
      object_store: filesystem
      schema: v11
      index:
        prefix: index_
-        period: 24h
+        period: 168h

 storage_config:
-  boltdb_shipper:
-    active_index_directory: {{ env "NOMAD_TASK_DIR" }}/index
+  boltdb:
+    directory: {{ env "NOMAD_TASK_DIR" }}/index

  filesystem:
    directory: {{ env "NOMAD_TASK_DIR" }}/chunks
@ -34,8 +38,8 @@ limits_config:
  reject_old_samples_max_age: 168h

 chunk_store_config:
-  max_look_back_period: 168h
+  max_look_back_period: 0s

 table_manager:
-  retention_deletes_enabled: true
-  retention_period: 168h
+  retention_deletes_enabled: false
+  retention_period: 0s
--- a/core/loki.tf
+++ b/core/loki.tf
@ -3,17 +3,15 @@ module "loki" {
  detach = false

  name  = "loki"
-  image = "grafana/loki:2.8.7"
+  image = "grafana/loki:2.2.1"
  args  = ["--config.file=$${NOMAD_TASK_DIR}/loki-config.yml"]

  service_port = 3100
  ingress      = true
  use_wesher   = var.use_wesher
-  service_check = {
-    path = "/ready"
-  }

  sticky_disk = true
+  # healthcheck  = "/ready"
  templates = [
    {
      data  = file("${path.module}/loki-config.yml")
--- a/core/nomad-client-stalker.nomad
+++ b/core/nomad-client-stalker.nomad
@ -24,8 +24,7 @@ job "nomad-client-stalker" {

      resources {
        cpu = 10
-        memory = 15
-        memory_max = 30
+        memory = 10
      }
    }
  }
--- a/core/syslogng.nomad
+++ b/core/syslogng.nomad
@ -27,7 +27,9 @@ job "syslogng" {
      driver = "docker"

      meta = {
+        "diun.sort_tags" = "semver"
        "diun.watch_repo" = true
+        "diun.include_tags" = "^[0-9]+\\.[0-9]+\\.[0-9]+$"
      }

      config {
--- a/core/traefik/.terraform.lock.hcl
+++ b/core/traefik/.terraform.lock.hcl
@ -2,20 +2,20 @@
 # Manual edits may be lost in future updates.

 provider "registry.terraform.io/hashicorp/nomad" {
-  version = "2.1.0"
+  version = "1.4.17"
  hashes = [
-    "h1:ek0L7fA+4R1/BXhbutSRqlQPzSZ5aY/I2YfVehuYeEU=",
-    "zh:39ba4d4fc9557d4d2c1e4bf866cf63973359b73e908cce237c54384512bdb454",
-    "zh:40d2b66e3f3675e6b88000c145977c1d5288510c76b702c6c131d9168546c605",
-    "zh:40fbe575d85a083f96d4703c6b7334e9fc3e08e4f1d441de2b9513215184ebcc",
-    "zh:42ce6db79e2f94557fae516ee3f22e5271f0b556638eb45d5fbad02c99fc7af3",
-    "zh:4acf63dfb92f879b3767529e75764fef68886521b7effa13dd0323c38133ce88",
-    "zh:72cf35a13c2fb542cd3c8528826e2390db9b8f6f79ccb41532e009ad140a3269",
+    "h1:iPylWr144mqXvM8NBVMTm+MS6JRhqIihlpJG91GYDyA=",
+    "zh:146f97eacd9a0c78b357a6cfd2cb12765d4b18e9660a75500ee3e748c6eba41a",
+    "zh:2eb89a6e5cee9aea03a96ea9f141096fe3baf219b2700ce30229d2d882f5015f",
+    "zh:3d0f971f79b615c1014c75e2f99f34bd4b4da542ca9f31d5ea7fadc4e9de39c1",
+    "zh:46099a750c752ce05aa14d663a86478a5ad66d95aff3d69367f1d3628aac7792",
+    "zh:71e56006b013dcfe1e4e059b2b07148b44fcd79351ae2c357e0d97e27ae0d916",
+    "zh:74febd25d776688f0558178c2f5a0e6818bbf4cdaa2e160d7049da04103940f0",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:8b8bcc136c05916234cb0c3bcc3d48fda7ca551a091ad8461ea4ab16fb6960a3",
-    "zh:8e1c2f924eae88afe7ac83775f000ae8fd71a04e06228edf7eddce4df2421169",
-    "zh:abc6e725531fc06a8e02e84946aaabc3453ecafbc1b7a442ea175db14fd9c86a",
-    "zh:b735fcd1fb20971df3e92f81bb6d73eef845dcc9d3d98e908faa3f40013f0f69",
-    "zh:ce59797282505d872903789db8f092861036da6ec3e73f6507dac725458a5ec9",
+    "zh:af18c064a5f0dd5422d6771939274841f635b619ab392c73d5bf9720945fdb85",
+    "zh:c133d7a862079da9f06e301c530eacbd70e9288fa2276ec0704df907270ee328",
+    "zh:c894cf98d239b9f5a4b7cde9f5c836face0b5b93099048ee817b0380ea439c65",
+    "zh:c918642870f0cafdbe4d7dd07c909701fc3ddb47cac8357bdcde1327bf78c11d",
+    "zh:f8f5655099a57b4b9c0018a2d49133771e24c7ff8262efb1ceb140fd224aa9b6",
  ]
 }
--- a/core/traefik/traefik.nomad
+++ b/core/traefik/traefik.nomad
@ -20,7 +20,7 @@ job "traefik" {
  }

  group "traefik" {
-    count = 2
+    count = 1

    network  {
      port "web" {
@ -39,13 +39,12 @@ job "traefik" {
        static = 2222
      }

-      port "metrics" {}
-
      dns {
        servers = [
          "192.168.2.101",
          "192.168.2.102",
          "192.168.2.30",
+          "192.168.2.170",
        ]
      }
    }
@ -55,42 +54,45 @@ job "traefik" {
      sticky = true
    }

+    volume "certs" {
+      type = "host"
+      read_only = true
+      source = "certs"
+    }
+
+    service {
+      name = "traefik"
+      provider = "nomad"
+      port = "web"
+
+      check {
+        type = "http"
+        path = "/ping"
+        port = "web"
+        interval = "10s"
+        timeout = "2s"
+      }
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.traefik.entryPoints=websecure",
+        "traefik.http.routers.traefik.service=api@internal",
+      ]
+    }
+
    task "traefik" {
      driver = "docker"

-      service {
-        name = "traefik"
-        provider = "nomad"
-        port = "web"
-
-        check {
-          type = "http"
-          path = "/ping"
-          interval = "10s"
-          timeout = "2s"
-        }
-
-        tags = [
-          "traefik.enable=true",
-          "traefik.http.routers.traefik.entryPoints=websecure",
-          "traefik.http.routers.traefik.service=api@internal",
-        ]
-      }
-
-      service {
-        name = "traefik-metrics"
-        provider = "nomad"
-        port = "metrics"
-
-        tags = [
-          "prometheus.scrape",
-        ]
+      meta = {
+        "diun.sort_tags" = "semver"
+        "diun.watch_repo" = true
+        "diun.include_tags" = "^[0-9]+\\.[0-9]+$"
      }

      config {
-        image = "traefik:2.10"
+        image = "traefik:2.9"

-        ports = ["web", "websecure", "syslog", "gitssh", "metrics"]
+        ports = ["web", "websecure"]
        network_mode = "host"

        mount {
@ -104,12 +106,12 @@ job "traefik" {
          target = "/etc/traefik/usersfile"
          source = "secrets/usersfile"
        }
+      }

-        mount {
-          type = "bind"
-          target = "/etc/traefik/certs"
-          source = "secrets/certs"
-        }
+      volume_mount {
+        volume = "certs"
+        destination = "/etc/traefik/certs"
+        read_only = true
      }

      template {
@ -132,9 +134,12 @@ job "traefik" {
  [entryPoints.websecure]
    address = ":443"
    [entryPoints.websecure.http.tls]
+      certResolver = "letsEncrypt"
+      [[entryPoints.websecure.http.tls.domains]]
+        main = "*.<< with nomadVar "nomad/jobs" >><< .base_hostname >><< end >>"

  [entryPoints.metrics]
-    address = ":<< env "NOMAD_PORT_metrics" >>"
+    address = ":8989"

  [entryPoints.syslogtcp]
    address = ":514"
@ -164,9 +169,31 @@ job "traefik" {
  exposedByDefault = false
  defaultRule = "Host(`{{normalize .Name}}.<< with nomadVar "nomad/jobs" >><< .base_hostname >><< end >>`)"
  [providers.nomad.endpoint]
-  address = "http://127.0.0.1:4646"
+  address = "http://<< env "attr.unique.network.ip-address" >>:4646"
+
+<< if nomadVarExists "nomad/jobs/traefik" ->>
+[certificatesResolvers.letsEncrypt.acme]
+  email = "<< with nomadVar "nomad/jobs/traefik" >><< .acme_email >><< end >>"
+  # Store in /local because /secrets doesn't persist with ephemeral disk
+  storage = "/local/acme.json"
+  [certificatesResolvers.letsEncrypt.acme.dnsChallenge]
+    provider = "cloudflare"
+    resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
+    delayBeforeCheck = 0
+<<- end >>
        EOH
-        destination = "${NOMAD_TASK_DIR}/config/traefik.toml"
+        destination = "local/config/traefik.toml"
+      }
+
+      template {
+        data = <<EOH
+{{ with nomadVar "nomad/jobs/traefik" -}}
+CF_DNS_API_TOKEN={{ .domain_lego_dns }}
+CF_ZONE_API_TOKEN={{ .domain_lego_dns }}
+{{- end }}
+        EOH
+        destination = "secrets/cloudflare.env"
+        env = true
      }

      template {
@ -177,39 +204,23 @@ job "traefik" {
      entryPoints = ["websecure"]
      service = "nomad"
      rule = "Host(`nomad.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}`)"
-
-    {{ with nomadVar "nomad/jobs/traefik" }}{{ with .external }}{{ with .Value | parseYAML -}}
-    {{ range $service, $url := . }}
-    [http.routers.{{ $service }}]
+    [http.routers.hass]
      entryPoints = ["websecure"]
-      service = "{{ $service }}"
-      rule = "Host(`{{ $service }}.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}`)"
-    {{ end }}
-    {{- end }}{{ end }}{{ end }}
+      service = "hass"
+      rule = "Host(`hass.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}`)"

  [http.services]
    [http.services.nomad]
      [http.services.nomad.loadBalancer]
        [[http.services.nomad.loadBalancer.servers]]
          url = "http://127.0.0.1:4646"
-
-    {{ with nomadVar "nomad/jobs/traefik" }}{{ with .external }}{{ with .Value | parseYAML -}}
-    {{ range $service, $url := . }}
-    [http.services.{{ $service }}]
-      [http.services.{{ $service }}.loadBalancer]
-        [[http.services.{{ $service }}.loadBalancer.servers]]
-          url = "{{ $url }}"
-    {{ end }}
-    {{- end }}{{ end }}{{ end }}
+    [http.services.hass]
+      [http.services.hass.loadBalancer]
+        [[http.services.hass.loadBalancer.servers]]
+          url = "http://192.168.3.65:8123"
        EOH
-        destination = "${NOMAD_TASK_DIR}/config/conf/route-hashi.toml"
+        destination = "local/config/conf/route-hashi.toml"
        change_mode = "noop"
-        splay = "1m"
-
-        wait {
-          min = "10s"
-          max = "20s"
-        }
      }

      template {
@ -245,29 +256,7 @@ job "traefik" {
      {{ end -}}
 {{- end }}
        EOH
-        destination = "${NOMAD_TASK_DIR}/config/conf/route-syslog-ng.toml"
-        change_mode = "noop"
-        splay = "1m"
-
-        wait {
-          min = "10s"
-          max = "20s"
-        }
-      }
-
-      template {
-        data = <<EOF
-{{- with nomadVar "secrets/certs/_lego/certificates/__thefij_rocks_crt" }}{{ .contents }}{{ end -}}"
-EOF
-        destination = "${NOMAD_SECRETS_DIR}/certs/_.thefij.rocks.crt"
-        change_mode = "noop"
-      }
-
-      template {
-        data = <<EOF
-{{- with nomadVar "secrets/certs/_lego/certificates/__thefij_rocks_key" }}{{ .contents }}{{ end -}}"
-EOF
-        destination = "${NOMAD_SECRETS_DIR}/certs/_.thefij.rocks.key"
+        destination = "local/config/conf/route-syslog-ng.toml"
        change_mode = "noop"
      }

@ -277,7 +266,7 @@ EOF
  certFile = "/etc/traefik/certs/_.thefij.rocks.crt"
  keyFile = "/etc/traefik/certs/_.thefij.rocks.key"
        EOH
-        destination = "${NOMAD_TASK_DIR}/config/conf/dynamic-tls.toml"
+        destination = "local/config/conf/static-tls.toml"
        change_mode = "noop"
      }

@ -291,7 +280,7 @@ EOF
 {{- end }}
 {{- end }}
        EOH
-        destination = "${NOMAD_TASK_DIR}/config/conf/middlewares.toml"
+        destination = "local/config/conf/middlewares.toml"
        change_mode = "noop"
      }

@ -301,7 +290,7 @@ EOF
 {{ .usersfile }}
 {{- end }}
        EOH
-        destination = "${NOMAD_SECRETS_DIR}/usersfile"
+        destination = "secrets/usersfile"
        change_mode = "noop"
      }

--- a/core/traefik/traefik.tf
+++ b/core/traefik/traefik.tf
@ -1,23 +1,3 @@
 resource "nomad_job" "traefik" {
  jobspec = file("${path.module}/traefik.nomad")
 }
-
-resource "nomad_acl_policy" "treafik_secrets_certs_read" {
-  name        = "traefik-secrets-certs-read"
-  description = "Read certs to secrets store"
-  rules_hcl   = <<EOH
-namespace "default" {
-  variables {
-    path "secrets/certs/*" {
-      capabilities = ["read"]
-    }
-    path "secrets/certs" {
-      capabilities = ["read"]
-    }
-  }
-}
-EOH
-  job_acl {
-    job_id = resource.nomad_job.traefik.id
-  }
-}
--- a/databases/lldap.nomad
+++ b/databases/lldap.nomad
@ -70,12 +70,10 @@ job "lldap" {
        data = <<EOH
 ldap_base_dn = "{{ with nomadVar "nomad/jobs" }}{{ .ldap_base_dn }}{{ end }}"

-{{ with nomadVar "secrets/ldap" -}}
+{{ with nomadVar "nomad/jobs/lldap" -}}
 ldap_user_dn = "{{ .admin_user }}"
 ldap_user_email = "{{ .admin_email }}"
-{{ end -}}

-{{ with nomadVar "nomad/jobs/lldap" -}}
 [smtp_options]
 from = "{{ .smtp_from }}"
 reply_to = "{{ .smtp_reply_to }}"
@ -111,7 +109,7 @@ user = "{{ .user }}"
      }

      template {
-        data = "{{ with nomadVar \"secrets/ldap\" }}{{ .admin_password }}{{ end }}"
+        data = "{{ with nomadVar \"nomad/jobs/lldap\" }}{{ .admin_password }}{{ end }}"
        destination = "$${NOMAD_SECRETS_DIR}/user_pass.txt"
        change_mode = "restart"
      }
@ -195,9 +193,9 @@ SELECT 'NOOP';
      }

      config {
-        image = "iamthefij/stunnel:latest"
-        args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
+        image = "alpine:3.17"
        ports = ["tls"]
+        args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
      }

      resources {
@ -205,6 +203,15 @@ SELECT 'NOOP';
        memory = 100
      }

+      template {
+        data = <<EOF
+set -e
+apk add stunnel
+exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
+        EOF
+        destination = "$${NOMAD_TASK_DIR}/start.sh"
+      }
+
      template {
        data = <<EOF
 syslog = no
@ -215,7 +222,7 @@ delay = yes
 accept = {{ env "NOMAD_PORT_tls" }}
 connect = 127.0.0.1:{{ env "NOMAD_PORT_ldap" }}
 ciphers = PSK
-PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/stunnel_psk.txt
+PSKsecrets = {{ env "NOMAD_TASK_DIR" }}/stunnel_psk.txt

 [mysql_client]
 client = yes
@ -234,7 +241,7 @@ PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/mysql_stunnel_psk.txt
 {{ with nomadVar .Path }}{{ .psk }}{{ end }}
 {{ end -}}
 EOF
-        destination = "$${NOMAD_SECRETS_DIR}/stunnel_psk.txt"
+        destination = "$${NOMAD_TASK_DIR}/stunnel_psk.txt"
      }

      template {
--- a/databases/lldap.tf
+++ b/databases/lldap.tf
@ -9,42 +9,6 @@ resource "nomad_job" "lldap" {
  detach = false
 }

-# Give access to ldap secrets
-resource "nomad_acl_policy" "lldap_ldap_secrets" {
-  name        = "lldap-secrets-ldap"
-  description = "Give access to LDAP secrets"
-  rules_hcl   = <<EOH
-namespace "default" {
-  variables {
-    path "secrets/ldap/*" {
-      capabilities = ["read"]
-    }
-    path "secrets/ldap" {
-      capabilities = ["read"]
-    }
-  }
-}
-EOH
-
-  job_acl {
-    # job_id = resource.nomad_job.lldap.id
-    job_id = "lldap"
-  }
-}
-
-# Create self-scoped psk so that config is valid at first start
-resource "random_password" "lldap_ldap_psk" {
-  length           = 32
-  override_special = "!@#%&*-_="
-}
-
-resource "nomad_variable" "lldap_ldap_psk" {
-  path = "secrets/ldap/allowed_psks/ldap"
-  items = {
-    psk = "lldap:${resource.random_password.lldap_ldap_psk.result}"
-  }
-}
-
 # Give access to smtp secrets
 resource "nomad_acl_policy" "lldap_smtp_secrets" {
  name        = "lldap-secrets-smtp"
@ -60,7 +24,6 @@ namespace "default" {
 EOH

  job_acl {
-    # job_id = resource.nomad_job.lldap.id
    job_id = "lldap"
    group  = "lldap"
    task   = "lldap"
@ -82,7 +45,6 @@ namespace "default" {
 EOH

  job_acl {
-    # job_id = resource.nomad_job.lldap.id
    job_id = "lldap"
    group  = "lldap"
    task   = "bootstrap"
@ -115,9 +77,27 @@ namespace "default" {
 EOH

  job_acl {
-    # job_id = resource.nomad_job.lldap.id
    job_id = "lldap"
    group  = "lldap"
    task   = "stunnel"
  }
 }
+
+# Give access to all ldap secrets
+resource "nomad_acl_policy" "secrets_ldap" {
+  name        = "secrets-ldap"
+  description = "Give access to Postgres secrets"
+  rules_hcl   = <<EOH
+namespace "default" {
+  variables {
+    path "secrets/ldap/*" {
+      capabilities = ["read"]
+    }
+  }
+}
+EOH
+
+  job_acl {
+    job_id = resource.nomad_job.lldap.id
+  }
+}
--- a/databases/main.tf
+++ b/databases/main.tf
@ -0,0 +1,62 @@
+resource "nomad_job" "mysql-server" {
+  jobspec = file("${path.module}/mysql.nomad")
+
+  # Block until deployed as there are servics dependent on this one
+  detach = false
+}
+
+resource "nomad_acl_policy" "secrets_mysql" {
+  name        = "secrets-mysql"
+  description = "Give access to MySQL secrets"
+  rules_hcl   = <<EOH
+namespace "default" {
+  variables {
+    path "secrets/mysql/*" {
+      capabilities = ["read"]
+    }
+  }
+}
+EOH
+
+  job_acl {
+    job_id = resource.nomad_job.mysql-server.id
+  }
+}
+
+resource "nomad_job" "postgres-server" {
+  jobspec = file("${path.module}/postgres.nomad")
+
+  # Block until deployed as there are servics dependent on this one
+  detach = false
+}
+
+resource "nomad_acl_policy" "secrets_postgres" {
+  name        = "secrets-postgres"
+  description = "Give access to Postgres secrets"
+  rules_hcl   = <<EOH
+namespace "default" {
+  variables {
+    path "secrets/postgres/*" {
+      capabilities = ["read"]
+    }
+  }
+}
+EOH
+
+  job_acl {
+    job_id = resource.nomad_job.postgres-server.id
+  }
+}
+
+resource "nomad_job" "redis" {
+  for_each = toset(["blocky", "authelia"])
+
+  jobspec = templatefile("${path.module}/redis.nomad",
+    {
+      name = each.key,
+    }
+  )
+
+  # Block until deployed as there are servics dependent on this one
+  detach = false
+}
--- a/databases/mysql.nomad
+++ b/databases/mysql.nomad
@ -81,9 +81,9 @@ MYSQL_ROOT_PASSWORD={{ .mysql_root_password }}
      driver = "docker"

      config {
-        image = "iamthefij/stunnel:latest"
-        args = ["${NOMAD_TASK_DIR}/stunnel.conf"]
+        image = "alpine:3.17"
        ports = ["tls"]
+        args = ["/bin/sh", "${NOMAD_TASK_DIR}/start.sh"]
      }

      resources {
@ -91,6 +91,15 @@ MYSQL_ROOT_PASSWORD={{ .mysql_root_password }}
        memory = 100
      }

+      template {
+        data = <<EOF
+set -e
+apk add stunnel
+exec stunnel ${NOMAD_TASK_DIR}/stunnel.conf
+        EOF
+        destination = "${NOMAD_TASK_DIR}/start.sh"
+      }
+
      template {
        data = <<EOF
 syslog = no
--- a/databases/mysql.tf
+++ b/databases/mysql.tf
@ -1,41 +0,0 @@
-resource "nomad_job" "mysql-server" {
-  jobspec = file("${path.module}/mysql.nomad")
-
-  # Block until deployed as there are servics dependent on this one
-  detach = false
-}
-
-resource "nomad_acl_policy" "secrets_mysql" {
-  name        = "secrets-mysql"
-  description = "Give access to MySQL secrets"
-  rules_hcl   = <<EOH
-namespace "default" {
-  variables {
-    path "secrets/mysql" {
-      capabilities = ["read"]
-    }
-    path "secrets/mysql/*" {
-      capabilities = ["read"]
-    }
-  }
-}
-EOH
-
-  job_acl {
-    # job_id = resource.nomad_job.mysql-server.id
-    job_id = "mysql-server"
-  }
-}
-
-# Create self-scoped psk so that config is valid at first start
-resource "random_password" "mysql_mysql_psk" {
-  length           = 32
-  override_special = "!@#%&*-_="
-}
-
-resource "nomad_variable" "mysql_mysql_psk" {
-  path = "secrets/mysql/allowed_psks/mysql"
-  items = {
-    psk = "mysql:${resource.random_password.mysql_mysql_psk.result}"
-  }
-}
--- a/databases/postgres.nomad
+++ b/databases/postgres.nomad
@ -73,8 +73,7 @@ POSTGRES_PASSWORD={{ .superuser_pass }}

      resources {
        cpu = 500
-        memory = 700
-        memory_max = 1200
+        memory = 500
      }
    }

@ -82,9 +81,9 @@ POSTGRES_PASSWORD={{ .superuser_pass }}
      driver = "docker"

      config {
-        image = "iamthefij/stunnel:latest"
-        args = ["${NOMAD_TASK_DIR}/stunnel.conf"]
+        image = "alpine:3.17"
        ports = ["tls"]
+        args = ["/bin/sh", "${NOMAD_TASK_DIR}/start.sh"]
      }

      resources {
@ -92,6 +91,15 @@ POSTGRES_PASSWORD={{ .superuser_pass }}
        memory = 100
      }

+      template {
+        data = <<EOF
+set -e
+apk add stunnel
+exec stunnel ${NOMAD_TASK_DIR}/stunnel.conf
+        EOF
+        destination = "${NOMAD_TASK_DIR}/start.sh"
+      }
+
      template {
        data = <<EOF
 syslog = no
--- a/databases/postgres.tf
+++ b/databases/postgres.tf
@ -1,41 +0,0 @@
-resource "nomad_job" "postgres-server" {
-  jobspec = file("${path.module}/postgres.nomad")
-
-  # Block until deployed as there are servics dependent on this one
-  detach = false
-}
-
-resource "nomad_acl_policy" "secrets_postgres" {
-  name        = "secrets-postgres"
-  description = "Give access to Postgres secrets"
-  rules_hcl   = <<EOH
-namespace "default" {
-  variables {
-    path "secrets/postgres" {
-      capabilities = ["read"]
-    }
-    path "secrets/postgres/*" {
-      capabilities = ["read"]
-    }
-  }
-}
-EOH
-
-  job_acl {
-    # job_id = resource.nomad_job.postgres-server.id
-    job_id = "postgres-server"
-  }
-}
-
-# Create self-scoped psk so that config is valid at first start
-resource "random_password" "postgres_postgres_psk" {
-  length           = 32
-  override_special = "!@#%&*-_="
-}
-
-resource "nomad_variable" "postgres_postgres_psk" {
-  path = "secrets/postgres/allowed_psks/postgres"
-  items = {
-    psk = "postgres:${resource.random_password.postgres_postgres_psk.result}"
-  }
-}
--- a/databases/redis.nomad
+++ b/databases/redis.nomad
@ -35,7 +35,7 @@ job "redis-${name}" {

      resources {
        cpu = 100
-        memory = 64
+        memory = 128
        memory_max = 512
      }
    }
@ -44,14 +44,23 @@ job "redis-${name}" {
      driver = "docker"

      config {
-        image = "iamthefij/stunnel:latest"
-        args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
+        image = "alpine:3.17"
        ports = ["tls"]
+        args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
      }

      resources {
-        cpu = 50
-        memory = 15
+        cpu = 100
+        memory = 100
+      }
+
+      template {
+        data = <<EOF
+set -e
+apk add stunnel
+exec stunnel $${NOMAD_TASK_DIR}/stunnel.conf
+        EOF
+        destination = "$${NOMAD_TASK_DIR}/start.sh"
      }

      template {
--- a/databases/redis.tf
+++ b/databases/redis.tf
@ -1,12 +0,0 @@
-resource "nomad_job" "redis" {
-  for_each = toset(["blocky", "authelia"])
-
-  jobspec = templatefile("${path.module}/redis.nomad",
-    {
-      name = each.key,
-    }
-  )
-
-  # Block until deployed as there are servics dependent on this one
-  detach = false
-}
--- a/services/.terraform.lock.hcl
+++ b/services/.terraform.lock.hcl
@ -2,39 +2,39 @@
 # Manual edits may be lost in future updates.

 provider "registry.terraform.io/hashicorp/nomad" {
-  version = "2.1.1"
+  version = "2.0.0"
  hashes = [
-    "h1:liQBgBXfQEYmwpoGZUfSsu0U0t/nhvuRZbMhaMz7wcQ=",
-    "zh:28bc6922e8a21334568410760150d9d413d7b190d60b5f0b4aab2f4ef52efeeb",
-    "zh:2d4283740e92ce1403875486cd5ff2c8acf9df28c190873ab4d769ce37db10c1",
-    "zh:457e16d70075eae714a7df249d3ba42c2176f19b6750650152c56f33959028d9",
-    "zh:49ee88371e355c00971eefee6b5001392431b47b3e760a5c649dda76f59fb8fa",
-    "zh:614ad3bf07155ed8a5ced41dafb09042afbd1868490a379654b3e970def8e33d",
-    "zh:75be7199d76987e7549e1f27439922973d1bf27353b44a593bfbbc2e3b9f698f",
+    "h1:lIHIxA6ZmfyTGL3J9YIddhxlfit4ipSS09BLxkwo6L0=",
+    "zh:09b897d64db293f9a904a4a0849b11ec1e3fff5c638f734d82ae36d8dc044b72",
+    "zh:435cc106799290f64078ec24b6c59cb32b33784d609088638ed32c6d12121199",
+    "zh:7073444bd064e8c4ec115ca7d9d7f030cc56795c0a83c27f6668bba519e6849a",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:888e14a24410d56b37212fbea373a3e0401d0ff8f8e4f4dd00ba8b29de9fed39",
-    "zh:aa261925e8b152636a0886b3a2149864707632d836e98a88dacea6cfb6302082",
-    "zh:ac10cefb4064b3bb63d4b0379624a416a45acf778eac0004466f726ead686196",
-    "zh:b1a3c8b4d5b2dc9b510eac5e9e02665582862c24eb819ab74f44d3d880246d4f",
-    "zh:c552e2fe5670b6d3ad9a5faf78e3a27197eeedbe2b13928d2c491fa509bc47c7",
+    "zh:79d238c35d650d2d83a439716182da63f3b2767e72e4cbd0b69cb13d9b1aebfc",
+    "zh:7ef5f49344278fe0bbc5447424e6aa5425ff1821d010d944a444d7fa2c751acf",
+    "zh:92179091638c8ba03feef371c4361a790190f9955caea1fa59de2055c701a251",
+    "zh:a8a34398851761368eb8e7c171f24e55efa6e9fdbb5c455f6dec34dc17f631bc",
+    "zh:b38fd5338625ebace5a4a94cea1a28b11bd91995d834e318f47587cfaf6ec599",
+    "zh:b71b273a2aca7ad5f1e07c767b25b5a888881ba9ca93b30044ccc39c2937f03c",
+    "zh:cd14357e520e0f09fb25badfb4f2ee37d7741afdc3ed47c7bcf54c1683772543",
+    "zh:e05e025f4bb95138c3c8a75c636e97cd7cfd2fc1525b0c8bd097db8c5f02df6e",
  ]
 }

 provider "registry.terraform.io/hashicorp/random" {
-  version = "3.6.0"
+  version = "3.5.1"
  hashes = [
-    "h1:R5Ucn26riKIEijcsiOMBR3uOAjuOMfI1x7XvH4P6B1w=",
-    "zh:03360ed3ecd31e8c5dac9c95fe0858be50f3e9a0d0c654b5e504109c2159287d",
-    "zh:1c67ac51254ba2a2bb53a25e8ae7e4d076103483f55f39b426ec55e47d1fe211",
-    "zh:24a17bba7f6d679538ff51b3a2f378cedadede97af8a1db7dad4fd8d6d50f829",
-    "zh:30ffb297ffd1633175d6545d37c2217e2cef9545a6e03946e514c59c0859b77d",
-    "zh:454ce4b3dbc73e6775f2f6605d45cee6e16c3872a2e66a2c97993d6e5cbd7055",
+    "h1:VSnd9ZIPyfKHOObuQCaKfnjIHRtR7qTw19Rz8tJxm+k=",
+    "zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64",
+    "zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d",
+    "zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831",
+    "zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3",
+    "zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:91df0a9fab329aff2ff4cf26797592eb7a3a90b4a0c04d64ce186654e0cc6e17",
-    "zh:aa57384b85622a9f7bfb5d4512ca88e61f22a9cea9f30febaa4c98c68ff0dc21",
-    "zh:c4a3e329ba786ffb6f2b694e1fd41d413a7010f3a53c20b432325a94fa71e839",
-    "zh:e2699bc9116447f96c53d55f2a00570f982e6f9935038c3810603572693712d0",
-    "zh:e747c0fd5d7684e5bfad8aa0ca441903f15ae7a98a737ff6aca24ba223207e2c",
-    "zh:f1ca75f417ce490368f047b63ec09fd003711ae48487fba90b4aba2ccf71920e",
+    "zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b",
+    "zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2",
+    "zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865",
+    "zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03",
+    "zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602",
+    "zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014",
  ]
 }
--- a/services/bazarr.tf
+++ b/services/bazarr.tf
@ -0,0 +1,58 @@
+module "bazarr" {
+  source = "./service"
+
+  name  = "bazarr"
+  image = "lscr.io/linuxserver/bazarr:1.2.4"
+
+  resources = {
+    cpu    = 150
+    memory = 400
+  }
+
+  ingress      = true
+  service_port = 6767
+  use_wesher   = var.use_wesher
+
+  use_postgres = true
+  postgres_bootstrap = {
+    enabled = true
+  }
+
+  env = {
+    PGID = 100
+    PUID = 1001
+    TZ   = "America/Los_Angeles"
+  }
+
+  host_volumes = [
+    {
+      name      = "bazarr-config"
+      dest      = "/config"
+      read_only = false
+    },
+    {
+      name      = "media-write"
+      dest      = "/media"
+      read_only = false
+    },
+  ]
+
+  templates = [
+    {
+      data        = <<EOF
+      {{ with nomadVar "nomad/jobs/bazarr" -}}
+      POSTGRES_ENABLED=True
+      POSTGRES_HOST=127.0.0.1
+      POSTGRES_PORT=5432
+      POSTGRES_DATABASE={{ .db_name }}
+      POSTGRES_USERNAME={{ .db_user }}
+      POSTGRES_PASSWORD={{ .db_pass }}
+      {{- end }}
+      EOF
+      dest_prefix = "$${NOMAD_SECRETS_DIR}/"
+      dest        = "env"
+      env         = true
+      mount       = false
+    },
+  ]
+}
--- a/services/diun.tf
+++ b/services/diun.tf
@ -2,7 +2,7 @@ module "diun" {
  source = "./service"

  name  = "diun"
-  image = "crazymax/diun:4.27"
+  image = "crazymax/diun:4.26"
  args  = ["serve", "--log-level=debug"]

  sticky_disk = true
@ -16,13 +16,10 @@ module "diun" {
    DIUN_DEFAULTS_INCLUDETAGS           = "^\\d+(\\.\\d+){0,2}$"

    # Nomad API
-    NOMAD_ADDR                    = "unix:///secrets/api.sock"
-    DIUN_PROVIDERS_NOMAD          = true
-    DIUN_PROVIDERS_NOMAD_SECRETID = "$${NOMAD_TOKEN}"
-  }
-
-  task_identity = {
-    env = true
+    # TODO: Use socket in $NOMAD_SECRETS_DIR/api.sock when we can assign workload ACLs with Terraform to
+    # allow read access. Will need to update template to allow passing token by env
+    NOMAD_ADDR           = "http://$${attr.unique.network.ip-address}:4646/"
+    DIUN_PROVIDERS_NOMAD = true
  }

  templates = [
@ -39,16 +36,3 @@ module "diun" {
    },
  ]
 }
-
-resource "nomad_acl_policy" "diun_query_jobs" {
-  name        = "diun-query-jobs"
-  description = "Allow diun to query jobs"
-  rules_hcl   = <<EOH
-namespace "default" {
-  capabilities = ["list-jobs", "read-job"]
-}
-EOH
-  job_acl {
-    job_id = module.diun.job_id
-  }
-}
--- a/services/gitea.tf
+++ b/services/gitea.tf
@ -17,16 +17,12 @@ module "gitea" {

  ingress      = true
  service_port = 3000
-  use_wesher   = var.use_wesher
  ports = [
    {
      name = "ssh"
      to   = 22
    }
  ]
-  service_check = {
-    path = "/api/healthz"
-  }

  custom_services = [
    {
--- a/services/languagetool.tf
+++ b/services/languagetool.tf
@ -1,25 +0,0 @@
-module "languagetool" {
-  source = "./service"
-
-  name         = "languagetool"
-  image        = "ghcr.io/erikvl87/docker-languagetool/languagetool:4.8"
-  ingress      = true
-  service_port = 8010
-  use_wesher   = var.use_wesher
-
-  env = {
-    Java_Xmx = "512m"
-  }
-
-  service_check = {
-    path = "/v2/healthcheck"
-  }
-
-  # Possibility to use a volume over nfs to host n-gram datasets
-  # https://github.com/Erikvl87/docker-languagetool/pkgs/container/docker-languagetool%2Flanguagetool#using-n-gram-datasets
-
-  resources = {
-    cpu    = 100
-    memory = 512
-  }
-}
--- a/services/lidarr.tf
+++ b/services/lidarr.tf
@ -40,4 +40,9 @@ module "lidarr" {
    cpu    = 500
    memory = 1500
  }
+
+  stunnel_resources = {
+    cpu    = 100
+    memory = 100
+  }
 }
--- a/services/minitor-config.yml
+++ b/services/minitor-config.yml
@ -21,6 +21,15 @@ monitors:
      - '/app/scripts/curl_ok.sh'
      - 'https://grafana.thefij.rocks'

+  - name: Plex
+    command:
+      - 'curl'
+      - '--silent'
+      - '--show-error'
+      - '-o'
+      - '/dev/null'
+      - 'http://192.168.2.10:32400'
+
  - name: NZBget
    command:
      - '/app/scripts/curl_ok.sh'
@ -36,11 +45,6 @@ monitors:
      - '/app/scripts/curl_ok.sh'
      - 'https://lidarr.thefij.rocks'

-  - name: Radarr
-    command:
-      - '/app/scripts/curl_ok.sh'
-      - 'https://radarr.thefij.rocks'
-
  - name: Authelia
    command:
      - '/app/scripts/curl_ok.sh'
@ -51,20 +55,6 @@ monitors:
      - '/app/scripts/curl_ok.sh'
      - 'https://photoprism.thefij.rocks'

-  - name: Prometheus
-    command:
-      - '/app/scripts/curl_ok.sh'
-      - 'https://prometheus.thefij.rocks'
-
-  - name: Plex
-    command:
-      - 'curl'
-      - '--silent'
-      - '--show-error'
-      - '-o'
-      - '/dev/null'
-      - 'http://192.168.2.10:32400'
-
 alerts:
  log:
    command:
--- a/services/minitor.tf
+++ b/services/minitor.tf
@ -1,13 +1,12 @@
 module "minitor" {
  source = "./service"

-  name          = "minitor"
-  image         = "iamthefij/minitor-go:1.4.1"
-  args          = ["-metrics", "-config=$${NOMAD_TASK_DIR}/config.yml"]
-  service_port  = 8080
-  service_check = null
-  use_wesher    = var.use_wesher
-  prometheus    = true
+  name         = "minitor"
+  image        = "iamthefij/minitor-go:1.4.1"
+  args         = ["-metrics", "-config=$${NOMAD_TASK_DIR}/config.yml"]
+  service_port = 8080
+  use_wesher   = var.use_wesher
+  prometheus   = true

  env = {
    TZ = "America/Los_Angeles",
--- a/services/nomad-fixers.nomad
+++ b/services/nomad-fixers.nomad
@ -7,7 +7,8 @@ job "fixers" {
    prohibit_overlap = true
  }

-  group "orphaned_services" {
+  group "main" {
+
    task "orphaned_services" {
      driver = "docker"

@ -24,15 +25,8 @@ job "fixers" {
      identity {
        env = true
      }
-
-      resources {
-        cpu = 50
-        memory = 100
-      }
    }
-  }

-  group "missing_services" {
    task "missing_services" {
      driver = "docker"

@ -49,11 +43,6 @@ job "fixers" {
      identity {
        env = true
      }
-
-      resources {
-        cpu = 50
-        memory = 100
-      }
    }
  }
 }
--- a/services/photoprism.tf
+++ b/services/photoprism.tf
@ -2,24 +2,27 @@ module "photoprism_module" {
  source = "./service"

  name               = "photoprism"
-  image              = "photoprism/photoprism:231128"
+  image              = "photoprism/photoprism:221118-jammy"
  image_pull_timeout = "10m"
  # constraints = [{
  #   attribute = "$${meta.hw_transcode.type}"
  #   # operator = "is_set"
  #   value = "raspberry"
  # }]
-  priority = 60

  # docker_devices = [{
  #   host_path      = "$${meta.hw_transcode.device}"
  #   container_path = "$${meta.hw_transcode.device}"
  # }]
  resources = {
-    cpu        = 1500
-    memory     = 2200
+    cpu        = 2000
+    memory     = 2500
    memory_max = 4000
  }
+  stunnel_resources = {
+    cpu    = 100
+    memory = 100
+  }
  sticky_disk = true
  host_volumes = [
    {
--- a/services/radarr.tf
+++ b/services/radarr.tf
@ -1,59 +0,0 @@
-module "radarr" {
-  source = "./service"
-
-  name  = "radarr"
-  image = "lscr.io/linuxserver/radarr:5.2.6"
-
-  ingress      = true
-  service_port = 7878
-  use_wesher   = var.use_wesher
-  ingress_middlewares = [
-    "authelia@nomad"
-  ]
-
-  use_postgres = true
-  postgres_bootstrap = {
-    enabled = true
-    databases = [
-      "radarr",
-      "radarr-logs",
-    ]
-  }
-
-  env = {
-    PGID = 100
-    PUID = 1001
-    TZ   = "America/Los_Angeles"
-  }
-
-  host_volumes = [
-    {
-      name      = "radarr-config"
-      dest      = "/config"
-      read_only = false
-    },
-    {
-      name      = "media-write"
-      dest      = "/media"
-      read_only = false
-    },
-  ]
-
-  resources = {
-    cpu        = 500
-    memory     = 500
-    memory_max = 700
-  }
-}
-
-resource "nomad_variable" "authelia_service_rules_radarr" {
-  path = "authelia/access_control/service_rules/radarr"
-  items = {
-    name = "radarr"
-    rule = <<EOH
-policy: bypass
-resources:
-  - '^/api([/?].*)?$'
-    EOH
-  }
-}
--- a/services/service/main.tf
+++ b/services/service/main.tf
@ -8,7 +8,6 @@ resource "nomad_job" "service" {
    args               = var.args
    env                = var.env
    task_meta          = var.task_meta
-    task_identity      = var.task_identity
    group_meta         = var.group_meta
    job_meta           = var.job_meta
    constraints        = var.constraints
@ -16,7 +15,6 @@ resource "nomad_job" "service" {

    service_port        = var.service_port
    service_port_static = var.service_port_static
-    service_check       = var.service_check
    ports               = var.ports
    sticky_disk         = var.sticky_disk
    resources           = var.resources
@ -61,7 +59,7 @@ namespace "default" {
 EOH

  job_acl {
-    job_id = resource.nomad_job.service.id
+    job_id = var.name
    group  = var.name
    task   = "mysql-bootstrap"
  }
@ -99,7 +97,7 @@ namespace "default" {
 EOH

  job_acl {
-    job_id = resource.nomad_job.service.id
+    job_id = var.name
    group  = var.name
    task   = "stunnel"
  }
@ -121,7 +119,7 @@ namespace "default" {
 EOH

  job_acl {
-    job_id = resource.nomad_job.service.id
+    job_id = var.name
    group  = var.name
    task   = "postgres-bootstrap"
  }
@ -159,7 +157,7 @@ namespace "default" {
 EOH

  job_acl {
-    job_id = resource.nomad_job.service.id
+    job_id = var.name
    group  = var.name
    task   = "stunnel"
  }
@ -197,7 +195,7 @@ namespace "default" {
 EOH

  job_acl {
-    job_id = resource.nomad_job.service.id
+    job_id = var.name
    group  = var.name
    task   = "stunnel"
  }
@ -219,7 +217,7 @@ namespace "default" {
 EOH

  job_acl {
-    job_id = resource.nomad_job.service.id
+    job_id = var.name
    group  = var.name
    task   = var.name
  }
--- a/services/service/output.tf
+++ b/services/service/output.tf
@ -1,3 +0,0 @@
-output "job_id" {
-  value = resource.nomad_job.service.id
-}
--- a/services/service/service_template.nomad
+++ b/services/service/service_template.nomad
@ -73,7 +73,43 @@ job "${name}" {
      source = "${host_volume.name}"
    }
    %{~ endfor ~}
+    %{~ if service_port != null }
+    service {
+      name = "${replace(name, "_", "-")}"
+      provider = "nomad"
+      port = "main"

+      tags = [
+        %{~ if prometheus == true ~}
+        "prometheus.scrape",
+        %{~ endif ~}
+        %{~ if ingress ~}
+        "traefik.enable=true",
+        "traefik.http.routers.${name}.entryPoints=websecure",
+        %{~ if try(ingress_rule, null) != null ~}
+        "traefik.http.routers.${name}.rule=${ingress_rule}",
+        %{~ endif ~}
+        %{~ for middleware in ingress_middlewares ~}
+        "traefik.http.routers.${name}.middlewares=${middleware}",
+        %{~ endfor ~}
+        %{~ endif ~}
+        %{~ for tag in service_tags ~}
+        "${tag}",
+        %{~ endfor ~}
+      ]
+    }
+    %{~ endif ~}
+
+    %{~ for custom_service in custom_services ~}
+    service {
+      name     = "${custom_service.name}"
+      provider = "nomad"
+      port     = "${custom_service.port}"
+
+      tags = ${jsonencode(custom_service.tags)}
+    }
+
+    %{~ endfor ~}
    task "${name}" {
      driver = "docker"
      %{~ if length(task_meta) > 0 }
@ -83,63 +119,7 @@ job "${name}" {
        %{ endfor ~}
      }
      %{~ endif ~}
-      %{~ if service_port != null }
-      service {
-        name = "${replace(name, "_", "-")}"
-        provider = "nomad"
-        port = "main"

-        tags = [
-          %{~ if prometheus == true ~}
-          "prometheus.scrape",
-          %{~ endif ~}
-          %{~ if ingress ~}
-          "traefik.enable=true",
-          "traefik.http.routers.${name}.entryPoints=websecure",
-          %{~ if try(ingress_rule, null) != null ~}
-          "traefik.http.routers.${name}.rule=${ingress_rule}",
-          %{~ endif ~}
-          %{~ for middleware in ingress_middlewares ~}
-          "traefik.http.routers.${name}.middlewares=${middleware}",
-          %{~ endfor ~}
-          %{~ endif ~}
-          %{~ for tag in service_tags ~}
-          "${tag}",
-          %{~ endfor ~}
-        ]
-
-        %{~ if service_check != null ~}
-        check {
-          %{~ if service_check.name != "" ~}
-          name = "${service_check.name}"
-          %{~ endif ~}
-          %{~ if service_check.name != "" ~}
-          port = "${service_check.port}"
-          %{~ endif ~}
-          type = "${service_check.type}"
-          path = "${service_check.path}"
-          interval = "${service_check.interval}"
-          timeout = "${service_check.timeout}"
-
-          check_restart {
-            limit = 5
-            grace = "90s"
-          }
-        }
-        %{~ endif ~}
-      }
-
-      %{~ endif ~}
-      %{~ for custom_service in custom_services ~}
-      service {
-        name     = "${custom_service.name}"
-        provider = "nomad"
-        port     = "${custom_service.port}"
-
-        tags = ${jsonencode(custom_service.tags)}
-      }
-
-      %{~ endfor ~}
      config {
        image = "${image}"
        %{~if image_pull_timeout != null ~}
@ -225,12 +205,6 @@ EOF
        %{~ endif ~}
      }
      %{~ endif ~}
-      %{~ if task_identity != null }
-      identity {
-        env = ${task_identity.env}
-        file = ${task_identity.file}
-      }
-      %{~ endif ~}
    }
    %{~ if mysql_bootstrap != null }
    task "mysql-bootstrap" {
@ -380,8 +354,8 @@ $$;
      }

      config {
-        image = "iamthefij/stunnel:latest"
-        args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
+        image = "alpine:3.17"
+        args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
      }

      resources {
@ -392,6 +366,15 @@ $$;
        %{~ endif ~}
      }

+      template {
+        data = <<EOF
+set -e
+apk add stunnel
+exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
+        EOF
+        destination = "$${NOMAD_TASK_DIR}/start.sh"
+      }
+
      template {
        data = <<EOF
 syslog = no
--- a/services/service/vars.tf
+++ b/services/service/vars.tf
@ -21,6 +21,7 @@ variable "priority" {
  description = "Scheduler priority of the service"
 }

+
 variable "image" {
  type        = string
  description = "Image that should be run"
@ -38,15 +39,6 @@ variable "task_meta" {
  description = "Meta attributes to attach to the task"
 }

-variable "task_identity" {
-  description = "Task workload identity"
-  type = object({
-    env  = optional(bool, false)
-    file = optional(bool, false)
-  })
-  default = null
-}
-
 variable "group_meta" {
  type        = map(string)
  default     = {}
@ -118,7 +110,7 @@ variable "stunnel_resources" {

  default = {
    cpu        = 50
-    memory     = 15
+    memory     = 50
    memory_max = null
  }

@ -276,17 +268,3 @@ variable "use_wesher" {
  description = "Indicates whether or not services should expose themselves on the wesher network"
  default     = true
 }
-
-variable "service_check" {
-  description = "Health check for main ingress service"
-  type = object({
-    name     = optional(string, "")
-    port     = optional(string, "")
-    path     = optional(string, "/")
-    interval = optional(string, "30s")
-    timeout  = optional(string, "2s")
-    type     = optional(string, "http")
-  })
-
-  default = {}
-}
--- a/services/sonarr.tf
+++ b/services/sonarr.tf
@ -2,25 +2,11 @@ module "sonarr" {
  source = "./service"

  name  = "sonarr"
-  image = "lscr.io/linuxserver/sonarr:4.0.2"
-
-  priority = 55
+  image = "lscr.io/linuxserver/sonarr:3.0.10"

  ingress      = true
  service_port = 8989
  use_wesher   = var.use_wesher
-  ingress_middlewares = [
-    "authelia@nomad"
-  ]
-
-  use_postgres = true
-  postgres_bootstrap = {
-    enabled = true
-    databases = [
-      "sonarr",
-      "sonarr-logs",
-    ]
-  }

  env = {
    PGID = 100
@ -30,7 +16,7 @@ module "sonarr" {

  host_volumes = [
    {
-      name      = "sonarr-config"
+      name      = "sonarr-data"
      dest      = "/config"
      read_only = false
    },
@ -47,15 +33,3 @@ module "sonarr" {
    memory_max = 700
  }
 }
-
-resource "nomad_variable" "authelia_service_rules_sonarr" {
-  path = "authelia/access_control/service_rules/sonarr"
-  items = {
-    name = "sonarr"
-    rule = <<EOH
-policy: bypass
-resources:
-  - '^/api([/?].*)?$'
-    EOH
-  }
-}
--- a/services/unifi-traffic-route-ips.nomad
+++ b/services/unifi-traffic-route-ips.nomad
@ -13,7 +13,7 @@ job "unifi-traffic-route-ips" {
      driver = "docker"

      config {
-        image = "iamthefij/unifi-traffic-routes:0.0.2"
+        image = "iamthefij/unifi-traffic-routes:0.0.1"
      }

      env = {