feat: update homepage allowed hosts to home subdomain

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "miyouqian/upstream"]
+	path = miyouqian/upstream
+	url = https://github.com/Marchen-orz/MiyoQian.git
+	branch = master

adguardhome/compose.yaml

@@ -21,6 +21,8 @@ services:
         reservations:
           cpus: "0.2"
           memory: 128M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

backrest/compose.yaml

@@ -20,6 +20,16 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    cap_add:
+      - CHOWN
+      - DAC_OVERRIDE
+      - DAC_READ_SEARCH
+      - FOWNER
+      - FSETID
+    # Root keeps only the capabilities restic needs to read and restore
+    # files owned by other users.
+    cap_drop:
+      - ALL
     deploy:
       resources:
         limits:
@@ -28,6 +38,8 @@ services:
         reservations:
           cpus: "1.0"
           memory: 512M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

capture.sh

@@ -68,6 +68,8 @@ docker_args=(
 	run
 	--rm
 	--network "container:$CONTAINER"
+	--cap-drop ALL
+	--security-opt no-new-privileges:true
 	--cap-add NET_RAW
 	--cap-add NET_ADMIN
 )

dclint.sh

@@ -4,12 +4,24 @@ set -euo pipefail
 SCRIPT_DIR="$(dirname -- "$(readlink -f -- "${BASH_SOURCE[0]}")")"
 STACKS_DIR="${STACKS_DIR:-$SCRIPT_DIR}"
 docker_args=(--rm -v "$STACKS_DIR:/app")
-dclint_args=(. -r)
+dclint_args=()
 
 if [[ -t 1 ]]; then
 	docker_args+=(-t)
 fi
 
+# Scan immediate stack directories without recursing into their subdirectories.
+shopt -s nullglob
+for stack_dir in "$STACKS_DIR"/*/; do
+	stack_dir="${stack_dir%/}"
+	dclint_args+=("/app/${stack_dir##*/}")
+done
+
+if ((${#dclint_args[@]} == 0)); then
+	printf 'No stack directories found in %s\n' "$STACKS_DIR" >&2
+	exit 1
+fi
+
 case "${1:-}" in
 "")
 	;;

ddns-go/compose.yaml

@@ -15,3 +15,5 @@ services:
         reservations:
           cpus: "0.1"
           memory: 16M
+    security_opt:
+      - no-new-privileges:true

gitea/compose.yaml

@@ -18,6 +18,8 @@ services:
         limits:
           cpus: "1.0"
           memory: 512M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

homeassistant/compose.yaml

@@ -19,4 +19,6 @@ services:
         reservations:
           cpus: "0.2"
           memory: 512M
+    security_opt:
+      - no-new-privileges:true
     stop_grace_period: 60s

homepage/compose.yaml

@@ -0,0 +1,34 @@
+name: homepage
+services:
+  homepage:
+    image: ghcr.io/gethomepage/homepage:v2.7.0
+    container_name: homepage
+    volumes:
+      - /srv/data/homepage:/app/config
+      # - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      HOMEPAGE_ALLOWED_HOSTS: home.linkwu.de
+      PUID: "1000"
+      PGID: "1000"
+    networks:
+      - proxy
+    restart: unless-stopped
+    cap_add:
+      - CHOWN
+      - SETGID
+      - SETUID
+    cap_drop:
+      - ALL
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 1G
+        reservations:
+          cpus: "0.1"
+          memory: 64M
+    security_opt:
+      - no-new-privileges:true
+networks:
+  proxy:
+    external: true

immich/compose.yaml

@@ -33,6 +33,8 @@ services:
           memory: 512M
     devices:
       - /dev/dri:/dev/dri
+    security_opt:
+      - no-new-privileges:true
   immich-machine-learning:
     image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
     container_name: immich-machine-learning
@@ -43,11 +45,15 @@ services:
     restart: unless-stopped
     healthcheck:
       disable: false
+    cap_drop:
+      - ALL
     deploy:
       resources:
         limits:
           cpus: "2.0"
           memory: 4G
+    security_opt:
+      - no-new-privileges:true
   database:
     image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
     container_name: immich-postgres
@@ -71,6 +77,8 @@ services:
         reservations:
           cpus: "0.2"
           memory: 128M
+    security_opt:
+      - no-new-privileges:true
     shm_size: 128mb
   redis:
     image: docker.io/valkey/valkey:9@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d
@@ -78,6 +86,13 @@ services:
     restart: unless-stopped
     healthcheck:
       test: redis-cli ping || exit 1
+    cap_add:
+      - CHOWN
+      - SETGID
+      - SETUID
+    # The official image starts as root and drops to the valkey user.
+    cap_drop:
+      - ALL
     deploy:
       resources:
         limits:
@@ -86,6 +101,8 @@ services:
         reservations:
           cpus: "0.1"
           memory: 64M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

immich/example.env

@@ -10,7 +10,7 @@ DB_DATA_LOCATION=/srv/fast/immich/postgres
 TZ=Asia/Shanghai
 
 # The Immich version to use. You can pin this to a specific version like "v2.1.0"
-IMMICH_VERSION=v3.3.3
+IMMICH_VERSION=v3.3.5
 
 # Connection secret for postgres. You should change it to a random password
 # Please use only the characters `A-Za-z0-9`, without special characters or spaces

miyouqian/compose.yaml

@@ -0,0 +1,34 @@
+name: miyouqian
+services:
+  miyouqian:
+    build:
+      context: ./upstream
+      dockerfile: docker/Dockerfile
+    container_name: miyouqian
+    volumes:
+      - /srv/data/miyouqian:/app/state
+    environment:
+      TZ: Asia/Shanghai
+    networks:
+      - proxy
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 256M
+        reservations:
+          cpus: "0.1"
+          memory: 64M
+    init: true
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    tmpfs:
+      - /tmp
+
+networks:
+  proxy:
+    external: true

nginx/compose.yaml

@@ -1,7 +1,7 @@
 name: nginx
 services:
   nginx:
-    image: nginx:1-alpine
+    image: nginx:1.31.7-alpine
     container_name: nginx
     volumes:
       - /srv/data/nginx/templates:/etc/nginx/templates:ro
@@ -9,7 +9,7 @@ services:
     environment:
       BASE_DOMAIN: ${BASE_DOMAIN}
       EO_ORIGIN_TOKEN: ${EO_ORIGIN_TOKEN}
-      NGINX_ENVSUBST_FILTER: '^(BASE_DOMAIN|EO_ORIGIN_TOKEN)$'
+      NGINX_ENVSUBST_FILTER: "^(BASE_DOMAIN|EO_ORIGIN_TOKEN)$"
       NGINX_ENVSUBST_OUTPUT_DIR: /etc/nginx
     ports:
       - "192.168.10.101:80:80"
@@ -32,6 +32,8 @@ services:
         reservations:
           cpus: "0.05"
           memory: 16M
+    security_opt:
+      - no-new-privileges:true
   acme-sh:
     image: neilpang/acme.sh:3.1.4
     container_name: acme.sh
@@ -52,6 +54,8 @@ services:
         reservations:
           cpus: "0.05"
           memory: 16M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     name: proxy

openlist/compose.yaml

@@ -1,7 +1,7 @@
 name: openlist
 services:
   openlist:
-    image: openlistteam/openlist:v4.2.6
+    image: openlistteam/openlist:v4.2.7
     container_name: openlist
     volumes:
       - /srv/data/openlist:/opt/openlist/data
@@ -14,6 +14,8 @@ services:
       - proxy
     restart: unless-stopped
     user: 1000:1000
+    cap_drop:
+      - ALL
     deploy:
       resources:
         limits:
@@ -22,6 +24,8 @@ services:
         reservations:
           cpus: "0.2"
           memory: 64M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

qbittorrent/compose.yaml

@@ -24,6 +24,8 @@ services:
         limits:
           cpus: "1.0"
           memory: 2G
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

samba/compose.yaml

@@ -21,3 +21,5 @@ services:
         reservations:
           cpus: "0.2"
           memory: 128M
+    security_opt:
+      - no-new-privileges:true