Merge branch 'master' into onlyoffice

overlay network
2020-07-30 11:51:01 -04:00 · 2020-04-29 17:18:03 -04:00 · 2020-04-16 08:42:28 -04:00 · 2020-04-15 17:39:40 -04:00 · 2020-04-15 17:36:05 -04:00 · 2020-04-15 17:06:11 -04:00
81 changed files with 718 additions and 1855 deletions
@@ -17,8 +17,8 @@ include:
 docker_build:
  stage: test
  script:
    - apk add bash
    - apk add docker-compose
-    - bash scripts/subinstallers/gen_prod_env.sh "$MISTBORN_DEFAULT_PASSWORD"
+    - scripts/subinstallers/gen_prod_env.sh "$MISTBORN_DEFAULT_PASSWORD"
    - cp compose/production/traefik/traefik.toml.template compose/production/traefik/traefik.toml
    - docker-compose -f base.yml build
@@ -1,12 +1,6 @@
 # Mistborn
 A secure platform for easily standing up and managing your own cloud services: including firewall, ad-blocking, and multi-factor Wireguard VPN access
 ![Mistborn Wireguard](https://gitlab.com/cyber5k/public/-/raw/master/graphics/home.mistborn_wireguard_.png)*Wireguard Management in Mistborn*
 As featured in [Linux Magazine](https://www.linux-magazine.com/Issues/2020/240/Mistborn/(language)/eng-US) (Linux Pro Magazine in North America) in November 2020
 ![Mistborn Featured in Linux Magazine](https://gitlab.com/cyber5k/public/-/raw/master/graphics/linux-magazine-cover-nov-2020.jpg "Mistborn featured in Linux Magazine November 2020")
 # Table of Contents
 [[_TOC_]]
@@ -26,8 +20,6 @@ Ideal for teams who:
 - want to limit or stop data collecting services
 - want to prevent being detected/blocked for using a proxy or VPN service
 See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/Mistborn-Network-Security) wiki page to see the network scan results for Mistborn.
 Mistborn depends on these core open source technologies:
 - [Docker](https://www.docker.com/why-docker): containerization
 - [Wireguard](https://www.wireguard.com): secure VPN access
@@ -39,7 +31,6 @@ These tools are not vital to Mistborn itself but are integrated to enhance secur
 - [Pi-hole](https://pi-hole.net): A DNS server for network-wide ad blocking, etc
 - [DNScrypt](https://www.dnscrypt.org): prevents DNS spoofing via cryptographic signatures to verify that responses originate from the chosen DNS resolver and haven't been tampered
 - [Traefik](https://docs.traefik.io): A modern, efficient reverse-proxy
 - [Wazuh](https://wazuh.com/): Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance.
 Within Mistborn is a panel to enable and manage these free extra services (off by default), locally hosted in Docker containers:
 - [Home Assistant](https://www.home-assistant.io): Open source home automation that puts local control and privacy first
@@ -51,20 +42,13 @@ Within Mistborn is a panel to enable and manage these free extra services (off b
 - [Jellyfin](https://jellyfin.org): The Free Media Software System.
 - [Tor](https://www.torproject.org): The Onion Router. One tool in the arsenal of online security and privacy.
 - [Jitsi](https://jitsi.org): Multi-platform open-source video conferencing
 - [Guacamole](https://guacamole.apache.org): A clientless remote desktop gateway that supports standard protocols like VNC, RDP, and SSH.
 - [RaspAP](https://raspap.com/): The easiest, full-featured wireless router setup for Debian-based devices. Period. (Mistborn integration in alpha testing).
 # Quickstart
 Tested Operating Systems (in order of thoroughness):
 - Ubuntu 20.04 LTS
 - Ubuntu 18.04 LTS
 - Debian 10 (Buster)
- Raspberry Pi OS (formerly Raspbian) Buster
+- Raspbian Buster
 **Note:** Install operating system updates and restart. Raspberry Pi OS particularly needs to be restarted after kernel updates (kernel modules for the currently running kernel may be missing).
 Tested Browsers:
 - Firefox
 The default tests are run on DigitalOcean Droplets: 2GB RAM, 1 CPU, 50GB hard disk.
@@ -72,23 +56,22 @@ The Mistborn docker images exist for these architectures:
 | Mistborn Docker Images (hub.docker.com)        | Architectures       |
 |------------------------------------------------|---------------------|
-| mistborn (django, celery{worker,beat})         | amd64, arm64, arm/v7 |
+| mistborn (django, celery{worker,beat}, flower) | amd64, arm64, armv7 |
-| dnscrypt-proxy                                 | amd64, arm64, arm/v7 |
+| dnscrypt-proxy                                 | amd64, arm64, armv7 |
 Recommended System Specifications:
 | Use Case               | Description                                                                   | RAM   | Hard Disk |
 |------------------------|-------------------------------------------------------------------------------|-------|-----------|
-| Bare bones             | Wireguard, Pihole (no Cockpit, no extra services)                             | 2 GB  | 15 GB     |
+| Bare bones             | Wireguard, Pihole (no Cockpit, no extra services)                             | 1 GB  | 15 GB     |
-| Default                | Bare bones + Cockpit                                                          | 2 GB+ | 15 GB     |
+| Default                | Bare bones + Cockpit                                                          | 2 GB  | 15 GB     |
-| Low-resource services  | Default + Bitwarden, Tor, Syncthing                                           | 4 GB  | 20 GB     |
+| Low-resource services  | Default + Bitwarden, Tor, Syncthing                                           | 3 GB  | 20 GB     |
-| High-resource services | Default + Jitsi, Nextcloud, Jellyfin, Rocket.Chat, Home Assistant, OnlyOffice | 6 GB+ | 25 GB+    |
+| High-resource services | Default + Jitsi, Nextcloud, Jellyfin, Rocket.Chat, Home Assistant, OnlyOffice | 4 GB+ | 25 GB+    |
 | SIEM                   | Default + Wazuh + Extras                                                      | 16 GB+ | 100 GB+   |
 Starting from base installation
 ```
 git clone https://gitlab.com/cyber5k/mistborn.git
-sudo -E bash ./mistborn/scripts/install.sh
+sudo bash ./mistborn/scripts/install.sh
 ```
 Get default admin Wireguard profile
@@ -109,20 +92,6 @@ Mistborn protects your data in a variety of ways:
 - The Mistborn firewall blocks unsolicited incoming internet packets
 - Pi-hole running on Mistborn blocks outgoing internet requests to configurable blocked domains (ads, malicious/phishing domains, etc.) 
 See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/Mistborn-Network-Security) wiki page to see more network diagrams and the network scan results for Mistborn.
 # Security Information & Event Management (SIEM)
 ![Mistborn Security Center](https://gitlab.com/cyber5k/public/-/raw/master/graphics/home.mistborn_soc.png)
 The Mistborn Security Operations Center provides SIEM services with Wazuh. The Wazuh Manager requires an Open Distro for Elasticsearch backend. When the Mistborn host has >8 GB RAM the provided Elasticsearch backend can be used. Just click "Start Wazuh" on the `Security Center` page and enjoy your Enterprise-grade SIEM. Wazuh agents can be installed on just about any OS and all Wazuh agent traffic is communicated over the Wireguard connections. Instructions for adding endpoint agents can be found within Wazuh itself.
 ![Mistborn Security Center: Wazuh Modules](https://gitlab.com/cyber5k/public/-/raw/master/graphics/wazuh_modules.png)
 The Wazuh Kibana plugin leverages the power of Elasticsearch:
 ![Mistborn Security Center: Wazuh Dashboard](https://gitlab.com/cyber5k/public/-/raw/master/graphics/wazuh_se_dashboard.png)
 # Coppercloud
 Pihole provides a way to block outgoing DNS requests for given lists of blocked domains. Coppercloud provides a way to block outgoing network calls of all types to given lists of IP addresses (IPv4 only for now). This is especially useful for blocking outgoing telemetry (data and state sharing) to owners of software running on all of your devices.
@@ -137,33 +106,19 @@ We were getting frustrated at being forced to choose between being connected to
 *Netflix blocking my connections that it sees coming from a DigitalOcean droplet*
-In Mistborn, Gateways are upstream from the VPN server so connections to third-party services (e.g. Netflix, Hulu, etc.) will appear to be coming from the public IP address of the Gateway. I setup a Gateway at home (Raspberry Pi with `wireguard` and `openresolv` installed) and with our Mistborn on DigitalOcean, all Wireguard profiles created with this Gateway will appear to be coming from my house and are not blocked. No port-forwarding required (assuming Mistborn is publicly accessible).
+In Mistborn, Gateways are upstream from the VPN server so connections to third-party services (e.g. Netflix, Hulu, etc.) will appear to be coming from the public IP address of the Gateway. I setup a Gateway at home (Mistborn on DigitalOcean) then all Wireguard profiles created with this Gateway will appear to be coming from my house and are not blocked. No port-forwarding required (assuming Mistborn is publicly accessible).
 ![Mistborn Gateway Diagram](https://gitlab.com/cyber5k/public/-/raw/master/graphics/gateway_network.png)
 The Gateway adds an extra network hop. DNS is still resolved in Mistborn so pihole is still blocking ads.
 # Remote Desktop
 Remote desktops enable multiple users to share desktop resources and data. Remote desktops also enable groups to prevent sensitive data from ever entering an endpoint devices such as a smartphone. For reference, some United States Government regulations require controls to protect Controlled Unclassified Information (CUI) that are not feasible to implement on all endpoint devices and remote desktops prevent the data from entering the device (see NIST SP 800-171 3.1.19, CMMC AC.3.022).
 Mistborn enables remote desktop access via the Apache Guacamole extra service, which supports VNC, RDP, SSH, and other protocols. 
 ![Guacamole Recent Connections](https://gitlab.com/cyber5k/public/-/raw/master/graphics/guacamole_connections.png)
 Guacamole implements its own users and groups access controls to manage access to individual desktops. All Mistborn users must be authenticated with Mistborn (via Wireguard only or MFA) to access the Guacamole interface.
 # Client to client communication
 By default direct communication between network clients is blocked. Mistborn clients can all talk to Mistborn and communicate via shared services (Jitsi, Nextcloud, etc). Direct client to client communication can be enabled via the "client-to-client" toggle.
 ![System Settings](https://gitlab.com/cyber5k/public/-/raw/master/graphics/system_settings_dropdown.png)
 # Installation
-Mistborn is regularly tested on Ubuntu 20.04 LTS (DigitalOcean droplet with 2 GB RAM). It has also been successfully used on Debian Buster and Raspbian Buster systems (though not regularly tested). Make sure to install OS updates and restart before installing Mistborn (Wireguard installs differently on recent kernels).
+Mistborn is regularly tested on Ubuntu 18.04 LTS (DigitalOcean droplet with 2 GB RAM). It has also been successfully used on Debian Buster and Raspbian Buster systems (though not regularly tested). Additionally tested on Ubuntu 20.04 LTS.
 Clone the git repository and run the install script:
 ```
 git clone https://gitlab.com/cyber5k/mistborn.git
-sudo -E bash ./mistborn/scripts/install.sh
+sudo bash ./mistborn/scripts/install.sh
 ```
 Running `install.sh` will do the following:
@@ -174,8 +129,8 @@ Running `install.sh` will do the following:
 - install Docker
 - install OpenSSH
 - install Wireguard
- install Cockpit (optional)
+- install Cockpit
- create a `cockpit` system user (if Cockpit is installed)
+- create a `cockpit` system user
 - configure unattended-upgrades
 - generate a self-signed TLS certificate/key (WebRTC functionality requires TLS)
 - create and populate traefik.toml
@@ -197,7 +152,7 @@ See the environment variables needed in `./scripts/noninteractive/.install_bareb
 This will perform a noninteractive install with the default environment variables set in `.install_barebones`.
 ```
 git clone https://gitlab.com/cyber5k/mistborn.git
-sudo -E bash -c "source ./mistborn/scripts/noninteractive/.install_barebones && ./mistborn/scripts/install.sh"
+sudo bash -c "source ./mistborn/scripts/noninteractive/.install_barebones && ./mistborn/scripts/install.sh"
 ```
 # Post-Installation
@@ -278,10 +233,8 @@ Internet access is blocked via iptables until authentication is completed for an
 ![Mistborn Multi Factor Authentication - Token Prompt](https://gitlab.com/cyber5k/public/-/raw/master/graphics/mfa_token_enter.png)*Mistborn Multi Factor Authentication - Token Prompt*
-### MFA Mistborn Service Access - Fixed on 4 December 2020
+### MFA Mistborn Service Access
-Mistborn service access is blocked via traefik until Mistborn authentication is complete. You will not be able to access the web pages for pihole, cockpit, or any extra services until authentication is complete for an MFA profile. Attempting to visit one of these pages will produce a "Mistborn: Not authorized" HTTP 403. Click "Sign Out" to re-block access until authentication completes again.
+Mistborn service access is blocked via traefik until Mistborn authentication is complete. You will not be able to access the web pages for pihole, cockpit, or any extra services until authentication is complete for an MFA profile. Attempting to visit one of these pages will redirect you to [http://home.mistborn](http://home.mistborn) where you must complete the authentication process. Click "Sign Out" to re-block access until authentication completes again.
 ![Mistborn Multi Factor Authentication - Not Authorized](https://gitlab.com/cyber5k/public/-/raw/master/graphics/mfa_not_authorized.png)*Mistborn Multi Factor Authentication - Not Authorized (Login Incomplete)*
 ### Notes
 - **Sessions**: Traefik checks the authenticated sessions on the server side to determine whether to allow access to the Mistborn service web pages. If an open session exists for your Mistborn IP address then access will be granted. You may close all sessions by clicking "Sign Out" on the Mistborn home page. Expired sessions are regularly cleaned by the Mistborn system (celery periodic task).
@@ -302,9 +255,6 @@ Mistborn uses the following domains (that can be reached by all Wireguard client
 | Syncthing | syncthing.mistborn | Off |
 | OnlyOffice | onlyoffice.mistborn | Off |
 | Jitsi | jitsi.mistborn | Off |
 | Guacamole | guac.mistborn | Off |
 | RaspAP | raspap.mistborn | Off |
 | Wazuh | wazuh.mistborn | Off |
 # Default Credentials
 These are the default credentials to use in the services you choose to use:
@@ -313,12 +263,7 @@ These are the default credentials to use in the services you choose to use:
 | ------- | -------- | -------- |
 | Pihole |  | {{default mistborn password}} |
 | Cockpit | cockpit | {{default mistborn password}} |
 | Wazuh | mistborn | {{default mistborn password}} |
 | Nextcloud | mistborn | {{default mistborn password}} |
 | Guacamole | mistborn | {{default mistborn password }} |
 | RaspAP | mistborn | {{default mistborn password}} |
 You can find the credentials sent to the Docker containers in: `/opt/mistborn/.envs/.production/`
 # Gateway Setup
 Mistborn will generate the Wireguard configuration script for the Gateway. From a base Ubuntu/Debian/Raspbian operating system the following packages are recommended to be installed beforehand:
@@ -363,11 +308,11 @@ But wait, there's more! You can:
 | Jitsi Meet     | [Jitsi Meet](https://play.google.com/store/apps/details?id=org.jitsi.meet)                         | [Jitsi Meet](https://apps.apple.com/us/app/jitsi-meet/id1165103905)                |
 | Bitwarden      | [Bitwarden](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden)                     | [Bitwarden](https://apps.apple.com/us/app/bitwarden-password-manager/id1137397744) |
 | Jellyfin       | [Jellyfin](https://play.google.com/store/apps/details?id=org.jellyfin.mobile)                      | [Jellyfin](https://apps.apple.com/us/app/jellyfin-mobile/id1480192618)             |
-| Home Assistant | [Home Assistant](https://play.google.com/store/apps/details?id=io.homeassistant.companion.android) | [Home Assistant](https://apps.apple.com/us/app/home-assistant/id1099568401)                                                                                   |
+| Home Assistant | [Home Assistant](https://play.google.com/store/apps/details?id=io.homeassistant.companion.android) |                                                                                    |
 | Rocket.Chat    | [Rocket.Chat](https://play.google.com/store/apps/details?id=chat.rocket.android)                   | [Rocket.Chat](https://apps.apple.com/us/app/rocket-chat/id1148741252)              |
 ## TLS Certificate
-Some apps require TLS (HTTPS). All traffic to Mistborn domains already occurs over Wireguard but to keep apps running, a TLS certificate exists for Mistborn and can be imported into your device's trusted credentials in the security settings. This certificate is checked every day and will be re-generated when expiration is less than 30 days away.
+Some apps require TLS (HTTPS). All traffic to Mistborn domains already occurs over Wireguard but to keep apps running, a TLS certificate exists for Mistborn and can be imported into your device's trusted credentials in the security settings.
 The TLS certificate can be found here:
 ```
@@ -396,48 +341,17 @@ If Mistborn is installed via SSH then an iptables rule is added allowing externa
 SSH is permitted from any device connected to Mistborn by Wireguard.
-Password authentication in enabled. Fail2ban blocks IPs with excessive failed login attempts.
+Password authentication in enabled. Mistborn disables password authentication for root. Fail2ban blocks IPs with excessive failed login attempts.
 You can SSH using the Mistborn domain when connected by Wireguard:
 ```
 ssh user@home.mistborn
 ```
 ## How do I change the upstream DNSCrypt servers?
 The upstream servers used by dnscrypt-proxy are set in:  
 `base.yml`:
 ```
 services:
 ...
  dnscrypt-proxy:
  ...
    environment:
    ...
      - DNSCRYPT_SERVER_NAMES=[...]
 ```
 The available options are here: https://download.dnscrypt.info/dnscrypt-resolvers/v2/public-resolvers.md
 # Troubleshooting
 Once you're connected to Wireguard you should see .mistborn domains and the internet should work as expected. Be sure to use http (http://home.mistborn). Wireguard is the encrypted channel so there's usually no need to bother with TLS certs (WebRTC functionality and some mobile apps require TLS so it is available). Here are some things to check if you have issues:
 Check if you can ping an external IP address:
 ```
 ping 1.1.1.1
 ```
 Check if you can resolve local DNS queries:
 ```
 dig home.mistborn
 ```
 Check if you can resolve external DNS queries:
 ```
 dig cyber5k.com
 ```
 See if any docker containers are stopped:
 ```
 sudo docker container ls -a
@@ -464,9 +378,6 @@ The `dev/` folder contains a script for completing a hard reset: destroying and
 sudo ./dev/rebuild.sh
 ```
 ## Troubleshooting Wireguard
 Ensure that your public IP address in your client profile (e.g. `Endpoint = <Mistborn public IP address>:<random port>`) is actually publicly available (not in 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) if you are attempting to access Mistborn across the internet.
 ## Troubleshooting Extra Services
 Each extra service has its own systemd process which can be monitored:
 ```
@@ -476,12 +387,9 @@ sudo journalctl -xfu Mistborn-syncthing
 sudo journalctl -xfu Mistborn-jellyfin
 sudo journalctl -xfu Mistborn-nextcloud
 sudo journalctl -xfu Mistborn-jitsi
 sudo journalctl -xfu Mistborn-guacamole
 sudo journalctl -xfu Mistborn-rocketchat
 sudo journalctl -xfu Mistborn-onlyoffice
 sudo journalctl -xfu Mistborn-tor
 sudo journalctl -xfu Mistborn-raspap
 sudo journalctl -xfu Mistborn-wazuh
 ```
 ## Troubleshooting Docker
@@ -518,9 +426,6 @@ Run updates and restart before installing Mistborn (`sudo apt-get update && sudo
 These are some notes regarding the technical design and implementations of Mistborn. Feel free to contact me for additional details.
 ## Attack Surface
 See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/Mistborn-Network-Security) wiki entry.
 - **Wireguard**: Wireguard is the only way in to Mistborn. When new Wireguard profiles are generated they are attached to a random UDP port. Wireguard does not respond to unauthenticated traffic. External probes on the active Wireguard listening ports are not logged and do not appear on the Metrics page.
 - **SSH**: If Mistborn is installed over SSH (most common) then an iptables rule is added allowing future SSH connections from the same source IP address. All other external SSH is blocked. Internal SSH (over the Wireguard tunnels) is allowed. Password authentication is allowed. The SSH key for the `mistborn` user is only accepted from internal source IP addresses. Fail2ban is also installed.
 - **Traefik**: Iptables closes web ports (TCP 80 and 443) from external access and additonally all web interfaces are behind the Traefik reverse-proxy. All web requests (e.g. home.mistborn) must be resolved by Mistborn DNS (Pihole/dnsmasq) and originate from a Wireguard tunnel.
@@ -529,34 +434,29 @@ See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/
 ## Firewall
 - **IPtables**: Iptables rules and chains are manipulated directly. If UFW is present it is disabled. IPtables-persistent is used to save a simple set of secure default rules (most importantly setting the INPUT and FORWARD policies to DROP and allowing ESTABLISHED and RELATED traffic) that will be effective immediately upon system startup. Additional rules and chains are created by Docker on startup. Mistborn also creates some iptables chains during installation that are saved in the persistent rules. Mistborn iptables chains and rules are designed to work with Docker's with logic that is easy to follow. A power cycle will always result in a working state.
 - **PostUp/PostDown**: Wireguard configuration files on Mistborn include PostUp and PostDown directives that set routes and iptables rules for each Wireguard client individually.
- **Wireguard**: There is a one-to-one mapping between each Wireguard client and server instance listening on Mistborn. By default Wireguard clients cannot talk directly to each other but can use shared services and resources on Mistborn (e.g. Syncthing, Nextcloud, Jitisi, etc). Toggling the "client-to-client" option will enable direct client-to-client communication.
+- **Wireguard**: There is a one-to-one mapping between each Wireguard client and server instance listening on Mistborn. By design Wireguard clients cannot talk directly to each other but can use shared services and resources on Mistborn (e.g. Syncthing, Nextcloud, Jitisi, etc.)
 - **Metrics**: In addition to the iptables INPUT policy set to DROP, an iptables chain exists that logs the packet meta data before dropping it. Mistborn redirects packets that will be dropped to this chain instead. A summary of the data about these dropped packets (unsolicited network traffic) can be found on the Metrics page.
 - **Coppercloud**: Coppercloud works by populating ipsets with the ipset module in iptables to DROP (blacklist) or ACCEPT (whitelist) a given set of IP addresses. Upon system startup a celery task will compile the IP addresses, create the ipsets, and iptables rules.
 ## Additonal Notes
 - Interface names are not hardcoded anywhere in Mistborn. Two commands that are used in different circumstances to determine the default network interface and the interface that would route a public IP address are: `ip -o -4 route show to default` and `ip -o -4 route get 1.1.1.1`.
 - The "Update" button will pull updated Docker images for mistborn, postgresql, redis, pihole, and dnscrypt. Those services will then be restarted.
- The generated TLS certificate has an RSA modulus of 4096 bits, is signed with SHA-256, and is good for 397 days. The certificate is checked daily and will regenerate when expiration is within 30 days.
+- The generated TLS certificate has an RSA modulus of 4096 bits, is signed with SHA-256, and is good for 10 years. The nanny at Apple has decided to restrict the kinds of certificates iOS users may choose to manually trust and so you may have issues with TLS on an Apple device for now.
 - Outbound UDP on port 53 is blocked. All DNS requests should be handled by the dnscrypt_proxy service and if any client, service, etc. tries to circumvent that it is blocked.
 - Unattended upgrades are set to automatically install operating system security updates.
 - Ownership of mistborn files is set to the system mistborn user and access to environment variables is disabled for users other than the owner.
-# Roadmap (not necessarily in order)
+# Roadmap
 Many features and refinements are in the works at various stages including:
- Plugins for Extra Services (enabling third-party development)
+- Option to upload metrics information to Cyber5K to refine each Mistborn instance's firewall
- Plugin repository
+- Option to email default admin Wireguard config file
- IPv6 support
+- Adding more extra services (e.g. Gitlab, Game Servers, etc.)
 - Cyber5K marketplace to share Gateway access (to fixed IP addresses or domains, and for a fixed amount of time)
 - Mistborn managing wireless interfaces for local access points (stripped down RaspAP)
 - Optional periodic backup of local Mistborn config files and credentials to Cyber5K
 - Internal network scan tool and feedback
 - Anomaly detection in network traffic
 # Featured In
 - [Linux Magazine](https://www.linux-magazine.com/Issues/2020/240/Mistborn/(language)/eng-US) November 2020 (featuring Mistborn version from early May 2020)
 - [Awesome Open Source](https://www.youtube.com/watch?v=hekP0_crotw) July 2020 (featuring Mistborn version from early July 2020)
 # Follow
 You can find recent bugfixes, functional additions, some extra documentation and more at the Cyber5K Patreon page: [https://www.patreon.com/cyber5k](https://www.patreon.com/cyber5k)
 # Contact
 Contact me at [steven@cyber5k.com](mailto:steven@cyber5k.com)
@@ -565,5 +465,4 @@ Contact me at [steven@cyber5k.com](mailto:steven@cyber5k.com)
 Please consider supporting the project via:
 - [Paypal.me](https://paypal.me/cyber5k)
 - [Buy me a drink](https://www.buymeacoffee.com/cyber5k)
 - [Patreon](https://www.patreon.com/cyber5k)
@@ -12,18 +12,9 @@ services:
    depends_on:
      - postgres
      - redis
    ports:
      - "10.2.3.1:5000:5000/tcp" # auth access
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.django-http.rule=Host(`home.mistborn`)"
+      - "traefik.port=5000"
      - "traefik.http.routers.django-http.entrypoints=web"
      - "traefik.http.routers.django-http.middlewares=mistborn_headers@file"
      - "traefik.http.routers.django-https.rule=Host(`home.mistborn`)"
      - "traefik.http.routers.django-https.entrypoints=websecure"
      - "traefik.http.routers.django-https.middlewares=mistborn_headers@file"
      - "traefik.http.routers.django-https.tls.certresolver=basic"
      - "traefik.http.services.django-service.loadbalancer.server.port=5000"
    env_file:
      - ./.envs/.production/.django
      - ./.envs/.production/.postgres
@@ -47,41 +38,20 @@ services:
    restart: unless-stopped
  traefik:
-    #build:
+    build:
-    #  context: .
+      context: .
-    #  dockerfile: ./compose/production/traefik/Dockerfile
+      dockerfile: ./compose/production/traefik/Dockerfile
-    #image: mistborn_production_traefik
+    image: mistborn_production_traefik
    image: traefik:v2.2
    container_name: mistborn_production_traefik
    depends_on:
      - django
    volumes:
-      #- production_traefik:/etc/traefik/acme
+      - production_traefik:/etc/traefik/acme
      - ./compose/production/traefik/dynamic.toml:/dynamic.toml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ../mistborn_volumes/base/tls:/tls:ro
+      - ../mistborn_volumes/base/tls:/tls
-    network_mode: host
+    ports:
-      #ports:
+      - "0.0.0.0:80:80/tcp"
-    #  - "0.0.0.0:80:80/tcp"
+      - "0.0.0.0:443:443/tcp"
    #  - "0.0.0.0:443:443/tcp"
    #  #- "0.0.0.0:8080:8080/tcp" # dashboard
    command:
      ## API settings
      #- --api.insecure=true
      #- --api.dashboard=true
      #- --api.debug=true
      ## Logs
      - --log.level=ERROR
      ## Providers
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.file.filename=/dynamic.toml
      #- --providers.docker.network=default
      ## Entrypoints
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      ## Certificates
      #- --serversTransport.insecureSkipVerify=true
    restart: unless-stopped
  redis:
@@ -145,36 +115,27 @@ services:
    restart: unless-stopped
-  #flower:
+  flower:
-  #  image: "cyber5k/mistborn:${MISTBORN_TAG}"
+    image: "cyber5k/mistborn:${MISTBORN_TAG}"
-  #  container_name: mistborn_production_flower
+    container_name: mistborn_production_flower
-  #  env_file:
+    env_file:
-  #    - ./.envs/.production/.django
+      - ./.envs/.production/.django
-  #    - ./.envs/.production/.postgres
+      - ./.envs/.production/.postgres
-  #  ports:
+    ports:
-  #    - "5555:5555/tcp"
+      - "5555:5555/tcp"
-  #  command: /start-flower
+    command: /start-flower
-  #  restart: unless-stopped
+    restart: unless-stopped
  pihole:
   container_name: mistborn_production_pihole
-   image: pihole/pihole:v5.7
+   image: pihole/pihole:latest
   env_file:
-     - ./.envs/.production/.pihole
+     - /opt/mistborn_volumes/base/base.txt
   ports:
     - "${MISTBORN_DNS_BIND_IP}:53:53/tcp"
     - "${MISTBORN_DNS_BIND_IP}:53:53/udp"
   labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pihole-http.rule=Host(`pihole.mistborn`)"
      - "traefik.http.routers.pihole-http.entrypoints=web"
      - "traefik.http.routers.pihole-http.middlewares=mistborn_auth@file,add-pihole-admin"
      - "traefik.http.routers.pihole-https.rule=Host(`pihole.mistborn`)"
      - "traefik.http.routers.pihole-https.entrypoints=websecure"
      - "traefik.http.routers.pihole-https.middlewares=mistborn_auth@file,add-pihole-admin"
      - "traefik.http.routers.pihole-https.tls.certresolver=basic"
      - "traefik.http.middlewares.add-pihole-admin.addPrefix.prefix=/admin"
      - "traefik.http.services.pihole-service.loadbalancer.server.port=80"
   environment:
     - ServerIP=10.2.0.3
     - DNS1='10.2.0.2#5054' # docs say port 5054, was 54; use network_mode: host to see which port is used
@@ -183,6 +144,8 @@ services:
     - DNSMASQ_LISTENING=all
   #  TZ: 'America/New York'
   # Volumes store your data between container upgrades
   env_file:
     - ./.envs/.production/.pihole
   volumes:
     - ../mistborn_volumes/base/pihole/etc-pihole:/etc/pihole/
     - ../mistborn_volumes/base/pihole/etc-dnsmasqd:/etc/dnsmasq.d/
@@ -7,7 +7,7 @@ RUN apk update \
 EXPOSE 9150
-ADD ./torrc /etc/tor/torrc
+ADD ./compose/production/tor/torrc /etc/tor/torrc
 USER tor
 CMD /usr/bin/tor -f /etc/tor/torrc
@@ -1,5 +1,5 @@
-FROM traefik:v2.2
+FROM traefik:alpine
 RUN mkdir -p /etc/traefik/acme
 RUN touch /etc/traefik/acme/acme.json
 RUN chmod 600 /etc/traefik/acme/acme.json
-#COPY ./compose/production/traefik/dynamic.toml /etc/traefik
+COPY ./compose/production/traefik/traefik.toml /etc/traefik
@@ -1,31 +0,0 @@
 [tls.stores]
  [tls.stores.default]
    [tls.stores.default.defaultCertificate]
      certFile = "/tls/cert.crt"
      keyFile = "/tls/cert.key"
 [tls.options]
  [tls.options.default]
    minVersion = "VersionTLS12"
 [http.services]
  [http.services.cockpit.loadBalancer]
    [[http.services.cockpit.loadBalancer.servers]]
      url = "http://10.2.3.1:9090"
 [http.routers]
  [http.routers.cockpit]
    rule = "Host(`cockpit.mistborn`)"
    service = "cockpit"
    entrypoints = ["web", "websecure"]
    middlewares = ["mistborn_auth"]
 [http.middlewares]
  [http.middlewares.mistborn_auth.forwardAuth]
    address = "http://10.2.3.1:5000/auth/"
    trustForwardHeader = true
    [http.middlewares.mistborn_auth.forwardAuth.tls]
      insecureSkipVerify = true
  [http.middlewares.mistborn_headers.headers]
    hostsProxyHeaders = ['X-CSRFToken']
@@ -0,0 +1,257 @@
 #debug = true
 logLevel = "ERROR" #DEBUG, INFO, WARN, ERROR, FATAL, PANIC
 InsecureSkipVerify = true 
 defaultEntryPoints = ["http", "https"]
 #defaultEntryPoints = ["http"]
 # Entrypoints, http and https
 [entryPoints]
  # http should be redirected to https
  [entryPoints.http]
  address = ":80"
    #[entryPoints.http.redirect]
    #entryPoint = "https"
  # https is the default
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
    [entryPoints.https.tls.defaultCertificate]
      certFile = "/tls/cert.crt"
      keyFile = "/tls/cert.key"
 ## Enable ACME (Let's Encrypt): automatic SSL
 #[acme]
 ## Email address used for registration
 #email = "steven@cyber5k.com"
 #storage = "/etc/traefik/acme/acme.json"
 #entryPoint = "https"
 #onDemand = false
 #OnHostRule = true
 #  # Use a HTTP-01 acme challenge rather than TLS-SNI-01 challenge
 #  [acme.httpChallenge]
 #  entryPoint = "http"
 [file]
 [backends]
  [backends.django]
    [backends.django.servers.server1]
      url = "http://django:5000"
  [backends.pihole]
    [backends.pihole.servers.server1]
      url = "http://pihole:80"
  [backends.homeassistant]
    [backends.homeassistant.servers.server1]
      url = "http://homeassistant:8123"
  [backends.syncthing]
    [backends.syncthing.servers.server1]
      url = "http://syncthing:8384"
  [backends.rocketchat]
    [backends.rocketchat.servers.server1]
      url = "http://rocketchat:3000"
  [backends.nextcloud]
    [backends.nextcloud.servers.server1]
      url = "http://nextcloud:80"
  [backends.onlyoffice]
    [backends.onlyoffice.servers.server1]
      url = "http://onlyoffice-community-server:80"
  [backends.bitwarden]
    [backends.bitwarden.servers.server1]
      url = "http://bitwarden:80"
  [backends.jellyfin]
    [backends.jellyfin.servers.server1]
      url = "http://jellyfin:8096"
  [backends.jitsi]
    [backends.jitsi.servers.server1]
      url = "http://jitsi-web:80"
  [backends.raspap]
    [backends.raspap.servers.server1]
      url = "http://raspap:80"
  [backends.cockpit]
    [backends.cockpit.servers.server1]
      url = "http://10.2.3.1:9090"
 [frontends]
  [frontends.django]
    backend = "django"
    passHostHeader = true
    [frontends.django.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.django.routes.dr1]
      #rule = "Host:mistborn.cyber5k.com"
      rule = "Host:home.mistborn"
  [frontends.pihole]
    backend = "pihole"
    passHostHeader = true
    [frontends.pihole.auth]
      [frontends.pihole.auth.forward]
        address = "https://home.mistborn/auth/"
        trustForwardHeader = false
        [frontends.pihole.auth.forward.tls]
          insecureSkipVerify = true
    [frontends.pihole.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.pihole.routes.dr1]
      rule = "Host:pihole.mistborn"
  [frontends.homeassistant]
    backend = "homeassistant"
    passHostHeader = true
    [frontends.homeassistant.auth]
      [frontends.homeassistant.auth.forward]
        address = "https://home.mistborn/auth/"
        trustForwardHeader = false
        [frontends.homeassistant.auth.forward.tls]
          insecureSkipVerify = true
    [frontends.homeassistant.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.homeassistant.routes.dr1]
      rule = "Host:homeassistant.mistborn"
  [frontends.syncthing]
    backend = "syncthing"
    passHostHeader = true
    [frontends.syncthing.auth]
      [frontends.syncthing.auth.forward]
        address = "https://home.mistborn/auth/"
        trustForwardHeader = false
        [frontends.syncthing.auth.forward.tls]
          insecureSkipVerify = true
    [frontends.syncthing.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.syncthing.routes.dr1]
      rule = "Host:syncthing.mistborn"
  [frontends.rocketchat]
    backend = "rocketchat"
    passHostHeader = true
    [frontends.rocketchat.auth]
      [frontends.rocketchat.auth.forward]
        address = "https://home.mistborn/auth/"
        trustForwardHeader = false
        [frontends.rocketchat.auth.forward.tls]
          insecureSkipVerify = true
    [frontends.rocketchat.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.rocketchat.routes.dr1]
      rule = "Host:chat.mistborn"
  [frontends.nextcloud]
    backend = "nextcloud"
    passHostHeader = true
    [frontends.nextcloud.auth]
      [frontends.nextcloud.auth.forward]
        address = "https://home.mistborn/auth/"
        trustForwardHeader = false
        [frontends.nextcloud.auth.forward.tls]
          insecureSkipVerify = true
    [frontends.nextcloud.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.nextcloud.routes.dr1]
      rule = "Host:nextcloud.mistborn"
  [frontends.onlyoffice]
    backend = "onlyoffice"
    passHostHeader = true
    [frontends.onlyoffice.auth]
      [frontends.onlyoffice.auth.forward]
        address = "https://home.mistborn/auth/"
        trustForwardHeader = false
        [frontends.onlyoffice.auth.forward.tls]
          insecureSkipVerify = true
    [frontends.onlyoffice.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.onlyoffice.routes.dr1]
      rule = "Host:onlyoffice.mistborn"
  [frontends.bitwarden]
    backend = "bitwarden"
    passHostHeader = true
    [frontends.bitwarden.auth]
      [frontends.bitwarden.auth.forward]
        address = "https://home.mistborn/auth/"
        trustForwardHeader = false
        [frontends.bitwarden.auth.forward.tls]
          insecureSkipVerify = true
    [frontends.bitwarden.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.bitwarden.routes.dr1]
      rule = "Host:bitwarden.mistborn"
  [frontends.jellyfin]
    backend = "jellyfin"
    passHostHeader = true
    [frontends.jellyfin.auth]
      [frontends.jellyfin.auth.forward]
        address = "https://home.mistborn/auth/"
        trustForwardHeader = false
        [frontends.jellyfin.auth.forward.tls]
          insecureSkipVerify = true
    [frontends.jellyfin.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.jellyfin.routes.dr1]
      rule = "Host:jellyfin.mistborn"
  [frontends.jitsi]
    backend = "jitsi"
    passHostHeader = true
    [frontends.jitsi.auth]
      [frontends.jitsi.auth.forward]
        address = "https://home.mistborn/auth/"
        trustForwardHeader = false
        [frontends.jitsi.auth.forward.tls]
          insecureSkipVerify = true
    [frontends.jitsi.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.jitsi.routes.dr1]
      rule = "Host:jitsi.mistborn"
  [frontends.raspap]
    backend = "raspap"
    passHostHeader = true
    [frontends.raspap.auth]
      [frontends.raspap.auth.forward]
        address = "https://home.mistborn/auth/"
        trustForwardHeader = false
        [frontends.raspap.auth.forward.tls]
          insecureSkipVerify = true
    [frontends.raspap.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.raspap.routes.dr1]
      rule = "Host:raspap.mistborn"
  [frontends.cockpit]
    backend = "cockpit"
    passHostHeader = true
    [frontends.cockpit.auth]
      [frontends.cockpit.auth.forward]
        address = "https://home.mistborn/auth/"
        trustForwardHeader = false
        [frontends.cockpit.auth.forward.tls]
          insecureSkipVerify = true
    [frontends.cockpit.headers]
      HostsProxyHeaders = ['X-CSRFToken']
    [frontends.cockpit.routes.dr1]
      rule = "Host:cockpit.mistborn"
 ## Connection to docker host system (docker.sock)
 #[docker]
 #endpoint = "unix:///var/run/docker.sock"
 #domain = "localhost"
 #watch = true
 ## This will hide all docker containers that don't have explicitly  
 ## set label to "enable"
 #exposedbydefault = false
@@ -10,16 +10,9 @@ services:
      - ../../mistborn_volumes/extra/bitwarden:/data
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.bitwarden-http.rule=Host(`bitwarden.mistborn`)"
+      - "traefik.port=80"
      - "traefik.http.routers.bitwarden-http.entrypoints=web"
      - "traefik.http.routers.bitwarden-http.middlewares=mistborn_auth@file"
      - "traefik.http.routers.bitwarden-https.rule=Host(`bitwarden.mistborn`)"
      - "traefik.http.routers.bitwarden-https.entrypoints=websecure"
      - "traefik.http.routers.bitwarden-https.middlewares=mistborn_auth@file"
      - "traefik.http.routers.bitwarden-https.tls.certresolver=basic"
      - "traefik.http.services.bitwarden-service.loadbalancer.server.port=80"
    ports:
-      - "${MISTBORN_BIND_IP}:3012:3012/tcp"
+      - 3012:3012/tcp
    restart: unless-stopped
 networks:
@@ -1,30 +0,0 @@
 version: '3.7'
 services:
  elasticsearch:
    image: amazon/opendistro-for-elasticsearch:1.12.0
    hostname: elasticsearch
    restart: unless-stopped
    ports:
      - "${MISTBORN_BIND_IP}:9200:9200"
    environment:
      - discovery.type=single-node
      - cluster.name=mistborn-cluster
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - bootstrap.memory_lock=true
    volumes:
      - ../../mistborn_volumes/extra/elasticsearch/init/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
 networks:
  default:
    external:
      name: mistborn_default
@@ -1,72 +0,0 @@
 version: '3'
 # services
 services:
  # guacd
  guacd:
    container_name: mistborn_production_guacd
    image: guacamole/guacd
    networks:
      guacnetwork:
    restart: unless-stopped
    volumes:
    - ../../mistborn_volumes/extra/guacamole/drive:/drive:rw
    - ../../mistborn_volumes/extra/guacamole/record:/record:rw
  # postgres
  guac_postgres:
    container_name: mistborn_production_guac_postgres
    env_file:
    - ../.envs/.production/.guacamole
    environment:
      PGDATA: /var/lib/postgresql/data/guacamole
    image: postgres
    networks:
      guacnetwork:
    restart: unless-stopped
    volumes:
    - ../../mistborn_volumes/extra/guacamole/init:/docker-entrypoint-initdb.d:ro
    - ../../mistborn_volumes/extra/guacamole/data:/var/lib/postgresql/data:rw
  # guacamole
  guacamole:
    container_name: mistborn_production_guacamole
    labels:
    - "traefik.enable=true"
    - "traefik.http.routers.guacamole-http.rule=Host(`guac.mistborn`)"
    - "traefik.http.routers.guacamole-http.entrypoints=web"
    - "traefik.http.routers.guacamole-http.middlewares=mistborn_auth@file,add-guacamole"
    - "traefik.http.routers.guacamole-https.rule=Host(`guac.mistborn`)"
    - "traefik.http.routers.guacamole-https.entrypoints=websecure"
    - "traefik.http.routers.guacamole-https.middlewares=mistborn_auth@file,add-guacamole"
    - "traefik.http.routers.guacamole-https.tls.certresolver=basic"
    - "traefik.http.middlewares.add-guacamole.addPrefix.prefix=/guacamole"
    - "traefik.http.services.guacamole-service.loadbalancer.server.port=8080"
    depends_on:
    - guacd
    - guac_postgres
    environment:
      GUACD_HOSTNAME: guacd
      GUACD_PORT: 4822
      #GUACAMOLE_HOME: /config
    env_file:
    - ../.envs/.production/.guacamole
    image: guacamole/guacamole
    links:
    - guacd
    networks:
      guacnetwork:
    #ports:
 ## enable next line if not using nginx
 ##    - 8080:8080/tcp # Guacamole is on :8080/guacamole, not /.
 ## enable next line when using nginx
    #- 8080/tcp
    restart: unless-stopped
 # networks
 # create a network 'guacnetwork' in mode 'bridged'
 networks:
  guacnetwork:
    driver: bridge
@@ -10,14 +10,7 @@ services:
      - TZ=America/New_York
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.homeassistant-http.rule=Host(`homeassistant.mistborn`)"
+      - "traefik.port=8123"
      - "traefik.http.routers.homeassistant-http.entrypoints=web"
      - "traefik.http.routers.homeassistant-http.middlewares=mistborn_auth@file"
      - "traefik.http.routers.homeassistant-https.rule=Host(`homeassistant.mistborn`)"
      - "traefik.http.routers.homeassistant-https.entrypoints=websecure"
      - "traefik.http.routers.homeassistant-https.middlewares=mistborn_auth@file"
      - "traefik.http.routers.homeassistant-https.tls.certresolver=basic"
      - "traefik.http.services.homeassistant-service.loadbalancer.server.port=8123"
    restart: unless-stopped 
 networks:
@@ -14,14 +14,7 @@ services:
      - ../../mistborn_volumes/extra/nextcloud:/media:ro
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.jellyfin-http.rule=Host(`jellyfin.mistborn`)"
+      - "traefik.port=8096"
      - "traefik.http.routers.jellyfin-http.entrypoints=web"
      - "traefik.http.routers.jellyfin-http.middlewares=mistborn_auth@file"
      - "traefik.http.routers.jellyfin-https.rule=Host(`jellyfin.mistborn`)"
      - "traefik.http.routers.jellyfin-https.entrypoints=websecure"
      - "traefik.http.routers.jellyfin-https.middlewares=mistborn_auth@file"
      - "traefik.http.routers.jellyfin-https.tls.certresolver=basic"
      - "traefik.http.services.jellyfin-service.loadbalancer.server.port=8096"
    restart: unless-stopped
 networks:
@@ -3,131 +3,67 @@ version: '3'
 services:
    # Frontend
    jitsi-web:
-        image: jitsi/web:latest
+        image: jitsi/web
        restart: unless-stopped
        #ports:
            #- '${HTTP_PORT}:80'
            #- '${HTTPS_PORT}:443'
        labels:
            - "traefik.enable=true"
-            - "traefik.http.routers.jitsi-http.rule=Host(`jitsi.mistborn`)"
+            - "traefik.port=${HTTP_PORT}"
            - "traefik.http.routers.jitsi-http.entrypoints=web"
            - "traefik.http.routers.jitsi-http.middlewares=mistborn_auth@file"
            - "traefik.http.routers.jitsi-https.rule=Host(`jitsi.mistborn`)"
            - "traefik.http.routers.jitsi-https.entrypoints=websecure"
            - "traefik.http.routers.jitsi-https.middlewares=mistborn_auth@file"
            - "traefik.http.routers.jitsi-https.tls.certresolver=basic"
            - "traefik.http.services.jitsi-service.loadbalancer.server.port=${HTTP_PORT}"
        volumes:
-            - ${CONFIG}/web:/config:Z
+            - ${CONFIG}/web:/config
-            - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts:Z
+            - ${CONFIG}/web/letsencrypt:/etc/letsencrypt
            - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts
        env_file:
            - ../.envs/.production/.jitsi
        environment:
            - ENABLE_AUTH
            - ENABLE_GUESTS
            - ENABLE_LETSENCRYPT
            - ENABLE_HTTP_REDIRECT
-            - ENABLE_XMPP_WEBSOCKET
+            - ENABLE_TRANSCRIPTIONS
            - DISABLE_HTTPS
            - JICOFO_AUTH_USER
            - LETSENCRYPT_DOMAIN
            - LETSENCRYPT_EMAIL
            - LETSENCRYPT_USE_STAGING
            - PUBLIC_URL
-            - TZ
+            - XMPP_DOMAIN
            - AMPLITUDE_ID
            - ANALYTICS_SCRIPT_URLS
            - ANALYTICS_WHITELISTED_EVENTS
            - BRIDGE_CHANNEL
            - BRANDING_DATA_URL
            - CALLSTATS_CUSTOM_SCRIPT_URL
            - CALLSTATS_ID
            - CALLSTATS_SECRET
            - CHROME_EXTENSION_BANNER_JSON
            - CONFCODE_URL
            - CONFIG_EXTERNAL_CONNECT
            - DEPLOYMENTINFO_ENVIRONMENT
            - DEPLOYMENTINFO_ENVIRONMENT_TYPE
            - DEPLOYMENTINFO_USERREGION
            - DIALIN_NUMBERS_URL
            - DIALOUT_AUTH_URL
            - DIALOUT_CODES_URL
            - DROPBOX_APPKEY
            - DROPBOX_REDIRECT_URI
            - ENABLE_AUDIO_PROCESSING
            - ENABLE_AUTH
            - ENABLE_CALENDAR
            - ENABLE_FILE_RECORDING_SERVICE
            - ENABLE_FILE_RECORDING_SERVICE_SHARING
            - ENABLE_GUESTS
            - ENABLE_IPV6
            - ENABLE_LIPSYNC
            - ENABLE_NO_AUDIO_DETECTION
            - ENABLE_P2P
            - ENABLE_PREJOIN_PAGE
            - ENABLE_RECORDING
            - ENABLE_REMB
            - ENABLE_REQUIRE_DISPLAY_NAME
            - ENABLE_SIMULCAST
            - ENABLE_STATS_ID
            - ENABLE_STEREO
            - ENABLE_SUBDOMAINS
            - ENABLE_TALK_WHILE_MUTED
            - ENABLE_TCC
            - ENABLE_TRANSCRIPTIONS
            - ETHERPAD_PUBLIC_URL
            - ETHERPAD_URL_BASE
            - GOOGLE_ANALYTICS_ID
            - GOOGLE_API_APP_CLIENT_ID
            - INVITE_SERVICE_URL
            - JICOFO_AUTH_USER
            - MATOMO_ENDPOINT
            - MATOMO_SITE_ID
            - MICROSOFT_API_APP_CLIENT_ID
            - NGINX_RESOLVER
            - NGINX_WORKER_PROCESSES
            - NGINX_WORKER_CONNECTIONS
            - PEOPLE_SEARCH_URL
            - RESOLUTION
            - RESOLUTION_MIN
            - RESOLUTION_WIDTH
            - RESOLUTION_WIDTH_MIN
            - START_AUDIO_ONLY
            - START_AUDIO_MUTED
            - START_BITRATE
            - START_VIDEO_MUTED
            - TESTING_CAP_SCREENSHARE_BITRATE
            - TESTING_OCTO_PROBABILITY
            - XMPP_AUTH_DOMAIN
            - XMPP_BOSH_URL_BASE
            - XMPP_DOMAIN
            - XMPP_GUEST_DOMAIN
            - XMPP_MUC_DOMAIN
            - XMPP_RECORDER_DOMAIN
-            - TOKEN_AUTH_URL
+            - ETHERPAD_URL_BASE
            - TZ
            - JIBRI_BREWERY_MUC
            - JIBRI_PENDING_TIMEOUT
            - JIBRI_XMPP_USER
            - JIBRI_XMPP_PASSWORD
            - JIBRI_RECORDER_USER
            - JIBRI_RECORDER_PASSWORD
            - ENABLE_RECORDING
        networks:
            default:
            meet.jitsi:
                aliases:
                    - ${XMPP_DOMAIN}
        restart: unless-stopped 
    # XMPP server
    jitsi-prosody:
-        image: jitsi/prosody:latest
+        image: jitsi/prosody
        restart: unless-stopped
        expose:
            - '5222'
            - '5347'
            - '5280'
        volumes:
-            - ${CONFIG}/prosody/config:/config:Z
+            - ${CONFIG}/prosody:/config
            - ${CONFIG}/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
        env_file:
            - ../.envs/.production/.jitsi
        environment:
            - AUTH_TYPE
            - ENABLE_AUTH
            - ENABLE_GUESTS
            - ENABLE_LOBBY
            - ENABLE_XMPP_WEBSOCKET
            - GLOBAL_MODULES
            - GLOBAL_CONFIG
            - LDAP_URL
@@ -152,7 +88,6 @@ services:
            - XMPP_MUC_MODULES
            - XMPP_INTERNAL_MUC_MODULES
            - XMPP_RECORDER_DOMAIN
            - XMPP_CROSS_DOMAIN
            - JICOFO_COMPONENT_SECRET
            - JICOFO_AUTH_USER
            - JICOFO_AUTH_PASSWORD
@@ -173,28 +108,25 @@ services:
            - JWT_AUTH_TYPE
            - JWT_TOKEN_AUTH_MODULE
            - LOG_LEVEL
            - PUBLIC_URL
            - TZ
        networks:
            meet.jitsi:
                aliases:
                    - ${XMPP_SERVER}
        restart: unless-stopped 
    # Focus component
    jitsi-jicofo:
-        image: jitsi/jicofo:latest
+        image: jitsi/jicofo
        restart: unless-stopped
        volumes:
-            - ${CONFIG}/jicofo:/config:Z
+            - ${CONFIG}/jicofo:/config
        env_file:
            - ../.envs/.production/.jitsi
        environment:
            - AUTH_TYPE
            - ENABLE_AUTH
            - XMPP_DOMAIN
            - XMPP_AUTH_DOMAIN
            - XMPP_INTERNAL_MUC_DOMAIN
            - XMPP_MUC_DOMAIN
            - XMPP_SERVER
            - JICOFO_COMPONENT_SECRET
            - JICOFO_AUTH_USER
@@ -202,7 +134,6 @@ services:
            - JICOFO_RESERVATION_REST_BASE_URL
            - JVB_BREWERY_MUC
            - JIGASI_BREWERY_MUC
            - JIGASI_SIP_URI
            - JIBRI_BREWERY_MUC
            - JIBRI_PENDING_TIMEOUT
            - TZ
@@ -210,16 +141,16 @@ services:
            - jitsi-prosody
        networks:
            meet.jitsi:
        restart: unless-stopped 
    # Video bridge
    jitsi-jvb:
-        image: jitsi/jvb:latest
+        image: jitsi/jvb
        restart: unless-stopped
        ports:
-            - "${MISTBORN_BIND_IP}:${JVB_PORT}:${JVB_PORT}/udp"
+            - '${JVB_PORT}:${JVB_PORT}/udp'
-            - "${MISTBORN_BIND_IP}:${JVB_TCP_PORT}:${JVB_TCP_PORT}"
+            - '${JVB_TCP_PORT}:${JVB_TCP_PORT}'
        volumes:
-            - ${CONFIG}/jvb:/config:Z
+            - ${CONFIG}/jvb:/config
        env_file:
            - ../.envs/.production/.jitsi
        environment:
@@ -233,19 +164,14 @@ services:
            - JVB_PORT
            - JVB_TCP_HARVESTER_DISABLED
            - JVB_TCP_PORT
            - JVB_TCP_MAPPED_PORT
            - JVB_STUN_SERVERS
            - JVB_ENABLE_APIS
            - JVB_WS_DOMAIN
            - JVB_WS_SERVER_ID
            - PUBLIC_URL
            - TZ
        depends_on:
            - jitsi-prosody
        networks:
            meet.jitsi:
-                aliases:
+        restart: unless-stopped 
                    - jvb.meet.jitsi
 # Custom network so all services can communicate using a FQDN
 networks:
@@ -9,14 +9,7 @@ services:
      - ../.envs/.production/.nextcloud
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.nextcloud-http.rule=Host(`nextcloud.mistborn`)"
+      - "traefik.port=80"
      - "traefik.http.routers.nextcloud-http.entrypoints=web"
      - "traefik.http.routers.nextcloud-http.middlewares=mistborn_auth@file"
      - "traefik.http.routers.nextcloud-https.rule=Host(`nextcloud.mistborn`)"
      - "traefik.http.routers.nextcloud-https.entrypoints=websecure"
      - "traefik.http.routers.nextcloud-https.middlewares=mistborn_auth@file"
      - "traefik.http.routers.nextcloud-https.tls.certresolver=basic"
      - "traefik.http.services.nextcloud-service.loadbalancer.server.port=80"
    volumes:
      - ../../mistborn_volumes/extra/nextcloud:/var/www/html
    environment:
@@ -1,27 +1,102 @@
 version: '3'
 services:
-  onlyoffice:
+  onlyoffice-mysql-server:
-    container_name: mistborn_production_onlyoffice
+    container_name: mistborn_onlyoffice_mysql_server
    image: mysql:5.7.21
    environment:
      - MYSQL_ROOT_PASSWORD=my-secret-pw
    volumes:
      - ../../mistborn_volumes/extra/onlyoffice/mysql-conf:/etc/mysql/conf.d
      - ../../mistborn_volumes/extra/onlyoffice/mysql-entrypoint:/docker-entrypoint-initdb.d
      - ../../mistborn_volumes/extra/onlyoffice/mysql-data:/var/lib/mysql
    networks:
      onlyoffice_net:
        ipv4_address: 10.2.2.2
    restart: unless-stopped
  onlyoffice-document-server:
    container_name: mistborn_onlyoffice_document_server
    image: onlyoffice/documentserver:latest
    volumes:
-      - ../../mistborn_volumes/extra/onlyoffice/logs:/var/log/onlyoffice
+      - ../../mistborn_volumes/extra/onlyoffice/documentserver-data:/var/www/onlyoffice/Data
-      - ../../mistborn_volumes/extra/onlyoffice/cache:/var/lib/onlyoffice
+      - ../../mistborn_volumes/extra/onlyoffice/documentserver-logs:/var/log/onlyoffice
    env_file:
      - ../.envs/.production/.onlyoffice
    ports:
      - "80:80/tcp"
    networks:
      onlyoffice_net:
        ipv4_address: 10.2.2.3
    restart: unless-stopped 
  #onlyoffice-mail-server:
  #  container_name: mistborn_onlyoffice_mail_server
  #  privileged: true
  #  image: onlyoffice/mailserver:latest
  #  volumes:
  #    - ../../mistborn_volumes/extra/onlyoffice/mailserver-data:/var/vmail
  #    - ../../mistborn_volumes/extra/onlyoffice/mailserver-certs:/etc/pki/tls/mailserver
  #    - ../../mistborn_volumes/extra/onlyoffice/mailserver-logs:/var/log
  #    - ../../mistborn_volumes/extra/onlyoffice/mailserver-mysql:/var/lib/mysql
  #  hostname: mistborn
  #  networks:
  #    onlyoffice_net:
  #      ipv4_address: 10.2.2.4
  #  ports:
  #    - "25:25/tcp"
  #    - "143:143/tcp"
  #    - "587:587/tcp"
  #  restart: unless-stopped 
  onlyoffice-community-server:
    container_name: mistborn_onlyoffice_community_server
    image: onlyoffice/communityserver:latest
    environment:
      - DOCUMENT_SERVER_PORT_80_TCP_ADDR=mistborn_onlyoffice_document_server
  #    - MAIL_SERVER_DB_HOST=mistborn_onlyoffice_mail_server
      - ONLYOFFICE_CORE_MACHINEKEY=core_secret
      - MYSQL_SERVER_ROOT_PASSWORD=my-secret-pw
      - MYSQL_SERVER_DB_NAME=onlyoffice 
      - MYSQL_SERVER_HOST=mistborn_onlyoffice_mysql_server 
      - MYSQL_SERVER_USER=onlyoffice_user
      - MYSQL_SERVER_PASS=onlyoffice_pass 
  #    - MAIL_SERVER_API_PORT=8081
  #    - MAIL_SERVER_API_HOST=onlyoffice-mail-server
  #    - MAIL_SERVER_DB_HOST=onlyoffice-mysql-server
  #    - MAIL_SERVER_DB_PORT=3306
  #    - MAIL_SERVER_DB_NAME=onlyoffice_mailserver
  #    - MAIL_SERVER_DB_USER=onlyoffice_mailserver_user
  #    - MAIL_SERVER_DB_PASS=onlyoffice_mailserver_user_pass
    depends_on:
      - onlyoffice-mysql-server
      - onlyoffice-document-server 
  #    - onlyoffice-mail-server 
    volumes:
      - ../../mistborn_volumes/extra/onlyoffice/communityserver-data:/var/www/onlyoffice/Data
      - ../../mistborn_volumes/extra/onlyoffice/communityserver-mysql:/var/lib/mysql
      - ../../mistborn_volumes/extra/onlyoffice/communityserver-logs:/var/log/onlyoffice
      - ../../mistborn_volumes/extra/onlyoffice/documentserver-data:/var/www/onlyoffice/DocumentServerData
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.onlyoffice-http.rule=Host(`onlyoffice.mistborn`)"
+      - "traefik.port=80"
-      - "traefik.http.routers.onlyoffice-http.entrypoints=web"
+    networks:
-      - "traefik.http.routers.onlyoffice-http.middlewares=mistborn_auth@file"
+      default:
-      - "traefik.http.routers.onlyoffice-https.rule=Host(`onlyoffice.mistborn`)"
+      onlyoffice_net:
-      - "traefik.http.routers.onlyoffice-https.entrypoints=websecure"
+        ipv4_address: 10.2.2.5
-      - "traefik.http.routers.onlyoffice-https.middlewares=mistborn_auth@file"
+    ports:
-      - "traefik.http.routers.onlyoffice-https.tls.certresolver=basic"
+      #- "10.2.2.5:80:80/tcp"
-      - "traefik.http.services.onlyoffice-service.loadbalancer.server.port=80"
+      - "5222:5222/tcp"
    restart: unless-stopped 
 networks:
  default:
    external:
      name: mistborn_default
  onlyoffice_net:
    driver: overlay
    ipam:
      config:
        - subnet: 10.2.2.0/24
@@ -2,30 +2,20 @@ version: '3'
 services:
  raspap:
-    image: "cyber5k/raspap:${MISTBORN_TAG}"
+    build:
      context: ..
      dockerfile: ./compose/production/raspap/Dockerfile
    #user: root
    image: mistborn_production_raspap
    container_name: mistborn_production_raspap
    #network_mode: host
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.raspap-http.rule=Host(`raspap.mistborn`)"
+      - "traefik.port=80"
      - "traefik.http.routers.raspap-http.entrypoints=web"
      - "traefik.http.routers.raspap-http.middlewares=mistborn_auth@file"
      - "traefik.http.routers.raspap-https.rule=Host(`raspap.mistborn`)"
      - "traefik.http.routers.raspap-https.entrypoints=websecure"
      - "traefik.http.routers.raspap-https.middlewares=mistborn_auth@file"
      - "traefik.http.routers.raspap-https.tls.certresolver=basic"
      - "traefik.http.services.raspap-service.loadbalancer.server.port=80"
    env_file:
-      - ../.envs/.production/.raspap
+      - ../.envs/.production/.pihole
-    cap_add:
+    command: /start
      #- NET_ADMIN
      - SYS_ADMIN
      #- CAP_FOWNER
    privileged: true
    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - ../../mistborn_volumes/extra/raspap/etc-raspap:/etc/raspap
    #command: /start
    restart: unless-stopped
 networks:
  default:
@@ -17,14 +17,7 @@ services:
      - Accounts_UseDNSDomainCheck=False
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.chat-http.rule=Host(`chat.mistborn`)"
+      - "traefik.port=3000"
      - "traefik.http.routers.chat-http.entrypoints=web"
      - "traefik.http.routers.chat-http.middlewares=mistborn_auth@file"
      - "traefik.http.routers.chat-https.rule=Host(`chat.mistborn`)"
      - "traefik.http.routers.chat-https.entrypoints=websecure"
      - "traefik.http.routers.chat-https.middlewares=mistborn_auth@file"
      - "traefik.http.routers.chat-https.tls.certresolver=basic"
      - "traefik.http.services.chat-service.loadbalancer.server.port=3000"
    depends_on:
      - mongo
    #ports:
@@ -35,8 +28,8 @@ services:
    container_name: mistborn_production_rocketchat_mongo
    restart: unless-stopped
    volumes:
-     - ../../mistborn_volumes/extra/rocketchat/data/db:/data/db
+     - ../volumes/extra/rocketchat/data/db:/data/db
-     - ../../mistborn_volumes/extra/rocketchat/data/dump:/dump
+     - ../volumes/extra/rocketchat/data/dump:/dump
    command: mongod --smallfiles --oplogSize 128 --replSet rs0 --storageEngine=mmapv1
  # this container's job is just run the command to initialize the replica set.
@@ -61,10 +54,10 @@ services:
    depends_on:
      - rocketchat
    volumes:
-      - ../../mistborn_volumes/extra/rocketchat/hubot/scripts:/home/hubot/scripts
+      - ../volumes/extra/rocketchat/hubot/scripts:/home/hubot/scripts
  # this is used to expose the hubot port for notifications on the host on port 3001, e.g. for hubot-jenkins-notifier
    ports:
-      - "${MISTBORN_BIND_IP}:3001:8080/tcp"
+      - 3001:8080/tcp
 networks:
  default:
@@ -1,72 +0,0 @@
 version: '3'
 services:
  scirius:
    container_name: mistborn_production_scirius
    image: "cyber5k/scirius:${MISTBORN_TAG}"
    #environment:
    #  - SECRET_KEY: <SECRET KEY>
    env_file:
      - ../.envs/.production/.wazuh
      - ../.envs/.production/.scirius
    volumes:
      - /var/log/suricata:/logs
      - /etc/suricata/rules:/etc/suricata/rules
      - ../../mistborn_volumes/extra/scirius/static:/static
      - ../../mistborn_volumes/extra/scirius/data:/data
      - /var/run:/var/run:ro
      - /var/run/suricata/suricata-command.socket:/var/run/suricata/suricata-command.socket:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.scirius-http.rule=Host(`scirius.mistborn`)"
      - "traefik.http.routers.scirius-http.entrypoints=web"
      - "traefik.http.routers.scirius-http.middlewares=mistborn_auth@file"
      - "traefik.http.routers.scirius-https.rule=Host(`scirius.mistborn`)"
      - "traefik.http.routers.scirius-https.entrypoints=websecure"
      - "traefik.http.routers.scirius-https.middlewares=mistborn_auth@file"
      - "traefik.http.routers.scirius-https.tls.certresolver=basic"
      - "traefik.http.services.scirius-service.loadbalancer.server.port=8000"
    restart: unless-stopped 
 #   filebeat:
 #     image: docker.elastic.co/beats/filebeat:${ELASTIC_VERSION:-7.9.1}
 #     # https://github.com/docker/swarmkit/issues/1951
 #     hostname: "{{.Node.Hostname}}-filebeat"
 #     # Need to override user so we can access the log files, and docker.sock
 #     user: root
 #     configs:
 #       - source: fb_config
 #         target: /usr/share/filebeat/filebeat.yml
 #     volumes:
 #       - filebeat:/usr/share/filebeat/data
 #       - /var/run/docker.sock:/var/run/docker.sock
 #       # This is needed for filebeat to load container log path as specified in filebeat.yml
 #       - /var/lib/docker/containers/:/var/lib/docker/containers/:ro
 #       # # This is needed for filebeat to load jenkins build log path as specified in filebeat.yml
 #       # - /var/lib/docker/volumes/jenkins_home/_data/jobs/:/var/lib/docker/volumes/jenkins_home/_data/jobs/:ro
 #       # This is needed for filebeat to load logs for system and auth modules
 #       - /var/log/:/var/log/:ro
 #       # This is needed for filebeat to load logs for auditd module. you might have to install audit system
 #       # on ubuntu first (sudo apt-get install -y auditd audispd-plugins)
 #       - /var/log/audit/:/var/log/audit/:ro
 #     environment:
 #       - ELASTICSEARCH_HOST=${ELASTICSEARCH_HOST}
 #       - KIBANA_HOST=${KIBANA_HOST}
 #       - ELASTICSEARCH_USERNAME=${ELASTICSEARCH_USERNAME}
 #       - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD}
 #     # disable strict permission checks
 #     command: ["--strict.perms=false"]
 # volumes:
 #   filebeat:
 networks:
  default:
    external:
      name: mistborn_default
 # configs:
 #   fb_config:
 #     file: /opt/mistborn_volumes/scirius/init/filebeat.docker.yml
@@ -15,18 +15,11 @@ services:
      - ../../mistborn_volumes/extra/syncthing/data2:/data2
    ports:
      #- 8384:8384
-      - "${MISTBORN_BIND_IP}:22000:22000/tcp" # listening port
+      - 22000:22000/tcp # listening port
-      - "${MISTBORN_BIND_IP}:21027:21027/udp" # protocol discovery
+      - 21027:21027/udp # protocol discovery
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.mistborn`)"
+      - "traefik.port=8384"
      - "traefik.http.routers.syncthing-http.entrypoints=web"
      - "traefik.http.routers.syncthing-http.middlewares=mistborn_auth@file"
      - "traefik.http.routers.syncthing-https.rule=Host(`syncthing.mistborn`)"
      - "traefik.http.routers.syncthing-https.entrypoints=websecure"
      - "traefik.http.routers.syncthing-https.middlewares=mistborn_auth@file"
      - "traefik.http.routers.syncthing-https.tls.certresolver=basic"
      - "traefik.http.services.syncthing-service.loadbalancer.server.port=8384"
    restart: unless-stopped
 networks:
@@ -3,12 +3,12 @@ version: '3'
 services:
  tor-client:
    build:
-      context: ../compose/production/tor
+      context: ..
-      dockerfile: ./Dockerfile
+      dockerfile: ./compose/production/tor/Dockerfile
    image: mistborn_production_tor
    container_name: mistborn_production_tor
    ports:
-      - "${MISTBORN_BIND_IP}:9150:9150/tcp"
+      - 9150:9150/tcp
 networks:
  default:
@@ -1,70 +0,0 @@
 # Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
 version: '3.7'
 services:
  wazuh:
    image: wazuh/wazuh-odfe:4.1.2
    hostname: wazuh-manager
    restart: unless-stopped
    ports:
      - "${MISTBORN_BIND_IP}:1514:1514"
      - "${MISTBORN_BIND_IP}:1515:1515"
      - "${MISTBORN_BIND_IP}:514:514/udp"
      - "${MISTBORN_BIND_IP}:55000:55000"
    environment:
      - FILEBEAT_SSL_VERIFICATION_MODE=none
    env_file:
      - ../.envs/.production/.wazuh
    volumes:
      - ossec_api_configuration:/var/ossec/api/configuration
      - ossec_etc:/var/ossec/etc
      - ossec_logs:/var/ossec/logs
      - ossec_queue:/var/ossec/queue
      - ossec_var_multigroups:/var/ossec/var/multigroups
      - ossec_integrations:/var/ossec/integrations
      - ossec_active_response:/var/ossec/active-response/bin
      - ossec_agentless:/var/ossec/agentless
      - ossec_wodles:/var/ossec/wodles
      - filebeat_etc:/etc/filebeat
      - filebeat_var:/var/lib/filebeat
  wazuh-kibana:
    image: wazuh/wazuh-kibana-odfe:4.1.2
    hostname: wazuh-kibana
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.wazuhk-http.rule=Host(`wazuh.mistborn`)"
      - "traefik.http.routers.wazuhk-http.entrypoints=web"
      - "traefik.http.routers.wazuhk-http.middlewares=mistborn_auth@file"
      - "traefik.http.routers.wazuhk-https.rule=Host(`wazuh.mistborn`)"
      - "traefik.http.routers.wazuhk-https.entrypoints=websecure"
      - "traefik.http.routers.wazuhk-https.middlewares=mistborn_auth@file"
      - "traefik.http.routers.wazuhk-https.tls.certresolver=basic"
      - "traefik.http.services.wazuhk-service.loadbalancer.server.port=5601"
    #ports:
    #  - "${MISTBORN_BIND_IP}:5601:5601"
    environment:
      - SERVER_SSL_ENABLED=false
      - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/opendistroforelasticsearch.example.org.cert
      - SERVER_SSL_KEY=/usr/share/kibana/config/opendistroforelasticsearch.example.org.key
    env_file:
      - ../.envs/.production/.wazuh
 volumes:
  ossec_api_configuration:
  ossec_etc:
  ossec_logs:
  ossec_queue:
  ossec_var_multigroups:
  ossec_integrations:
  ossec_active_response:
  ossec_agentless:
  ossec_wodles:
  filebeat_etc:
  filebeat_var:
 networks:
  default:
    external:
      name: mistborn_default
@@ -1,3 +0,0 @@
 {
    "shutdown-timeout": 60 
 }
@@ -1,116 +1,61 @@
 # shellcheck disable=SC2034
 # Security
 #
 # Set these to strong passwords to avoid intruders from impersonating a service account
 # The service(s) won't start unless these are specified
 # Running ./gen-passwords.sh will update .env with strong passwords
 # You may skip the Jigasi and Jibri passwords if you are not using those
 # DO NOT reuse passwords
 #
 # XMPP component password for Jicofo
 JICOFO_COMPONENT_SECRET=
 # XMPP password for Jicofo client connections
 JICOFO_AUTH_PASSWORD=
 # XMPP password for JVB client connections
 JVB_AUTH_PASSWORD=
 # XMPP password for Jigasi MUC client connections
 JIGASI_XMPP_PASSWORD=
 # XMPP recorder password for Jibri client connections
 JIBRI_RECORDER_PASSWORD=
 # XMPP password for Jibri client connections
 JIBRI_XMPP_PASSWORD=
 #
 # Basic configuration options
 #
-# Directory where all configuration will be stored
+# Directory where all configuration will be stored.
 #CONFIG=~/.jitsi-meet-cfg
 CONFIG=../.envs/.production/.jitsi-cfg
-# Exposed HTTP port
+# Exposed HTTP port.
 HTTP_PORT=80
-# Exposed HTTPS port
+# Exposed HTTPS port.
-HTTPS_PORT=443
+HTTPS_PORT=8443
-# System time zone
+# System time zone.
-TZ=UTC
+TZ=Europe/Amsterdam
-# Public URL for the web service (required)
+# Public URL for the web service.
-PUBLIC_URL=https://jitsi.mistborn
+#PUBLIC_URL=https://meet.example.com
-# IP address of the Docker host
+# IP address of the Docker host. See the "Running on a LAN environment" section
-# See the "Running behind NAT or on a LAN environment" section in the Handbook:
+# in the README.
 # https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#running-behind-nat-or-on-a-lan-environment
 #DOCKER_HOST_ADDRESS=192.168.1.1
 DOCKER_HOST_ADDRESS=10.2.3.1
 # Control whether the lobby feature should be enabled or not
 #ENABLE_LOBBY=1
 # Show a prejoin page before entering a conference
 #ENABLE_PREJOIN_PAGE=0
 #
 # Let's Encrypt configuration
 #
-# Enable Let's Encrypt certificate generation
+# Enable Let's Encrypt certificate generation.
 #ENABLE_LETSENCRYPT=1
-# Domain for which to generate the certificate
+# Domain for which to generate the certificate.
 #LETSENCRYPT_DOMAIN=meet.example.com
-# E-Mail for receiving important account notifications (mandatory)
+# E-Mail for receiving important account notifications (mandatory).
 #LETSENCRYPT_EMAIL=alice@atlanta.net
 # Use the staging server (for avoiding rate limits while testing)
 #LETSENCRYPT_USE_STAGING=1
 #
 # Etherpad integration (for document sharing)
 #
-# Set etherpad-lite URL in docker local network (uncomment to enable)
+# Set etherpad-lite URL (uncomment to enable).
 #ETHERPAD_URL_BASE=http://etherpad.meet.jitsi:9001
 # Set etherpad-lite public URL (uncomment to enable)
 #ETHERPAD_PUBLIC_URL=https://etherpad.my.domain
 # Name your etherpad instance!
 ETHERPAD_TITLE="Video Chat"
 # The default text of a pad
 ETHERPAD_DEFAULT_PAD_TEXT="Welcome to Web Chat!\n\n"
 # Name of the skin for etherpad
 ETHERPAD_SKIN_NAME="colibris"
 # Skin variants for etherpad
 ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background full-width-editor"
 #
 # Basic Jigasi configuration options (needed for SIP gateway support)
 #
-# SIP URI for incoming / outgoing calls
+# SIP URI for incoming / outgoing calls.
 #JIGASI_SIP_URI=test@sip2sip.info
 # Password for the specified SIP account as a clear text
 #JIGASI_SIP_PASSWORD=passw0rd
-# SIP server (use the SIP account domain if in doubt)
+# SIP server (use the SIP account domain if in doubt).
 #JIGASI_SIP_SERVER=sip2sip.info
 # SIP server port
@@ -120,13 +65,13 @@ ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background
 #JIGASI_SIP_TRANSPORT=UDP
 #
-# Authentication configuration (see handbook for details)
+# Authentication configuration (see README for details)
 #
-# Enable authentication
+# Enable authentication.
 #ENABLE_AUTH=1
-# Enable guest access
+# Enable guest access.
 #ENABLE_GUESTS=1
 # Select authentication type: internal, jwt or ldap
@@ -135,38 +80,38 @@ ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background
 # JWT authentication
 #
-# Application identifier
+# Application identifier.
 #JWT_APP_ID=my_jitsi_app_id
-# Application secret known only to your token
+# Application secret known only to your token.
 #JWT_APP_SECRET=my_jitsi_app_secret
-# (Optional) Set asap_accepted_issuers as a comma separated list
+# (Optional) Set asap_accepted_issuers as a comma separated list.
 #JWT_ACCEPTED_ISSUERS=my_web_client,my_app_client
-# (Optional) Set asap_accepted_audiences as a comma separated list
+# (Optional) Set asap_accepted_audiences as a comma separated list.
 #JWT_ACCEPTED_AUDIENCES=my_server1,my_server2
 # LDAP authentication (for more information see the Cyrus SASL saslauthd.conf man page)
 #
-# LDAP url for connection
+# LDAP url for connection.
 #LDAP_URL=ldaps://ldap.domain.com/
 # LDAP base DN. Can be empty
 #LDAP_BASE=DC=example,DC=domain,DC=com
-# LDAP user DN. Do not specify this parameter for the anonymous bind
+# LDAP user DN. Do not specify this parameter for the anonymous bind.
 #LDAP_BINDDN=CN=binduser,OU=users,DC=example,DC=domain,DC=com
-# LDAP user password. Do not specify this parameter for the anonymous bind
+# LDAP user password. Do not specify this parameter for the anonymous bind.
 #LDAP_BINDPW=LdapUserPassw0rd
 # LDAP filter. Tokens example:
-# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail
+# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail.
-# %s - %s is replaced by the complete service string
+# %s - %s is replaced by the complete service string.
-# %r - %r is replaced by the complete realm string
+# %r - %r is replaced by the complete realm string.
 #LDAP_FILTER=(sAMAccountName=%u)
 # LDAP authentication method
@@ -178,16 +123,16 @@ ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background
 # LDAP TLS using
 #LDAP_USE_TLS=1
-# List of SSL/TLS ciphers to allow
+# List of SSL/TLS ciphers to allow.
 #LDAP_TLS_CIPHERS=SECURE256:SECURE128:!AES-128-CBC:!ARCFOUR-128:!CAMELLIA-128-CBC:!3DES-CBC:!CAMELLIA-128-CBC
 # Require and verify server certificate
 #LDAP_TLS_CHECK_PEER=1
-# Path to CA cert file. Used when server certificate verify is enabled
+# Path to CA cert file. Used when server sertificate verify is enabled.
 #LDAP_TLS_CACERT_FILE=/etc/ssl/certs/ca-certificates.crt
-# Path to CA certs directory. Used when server certificate verify is enabled
+# Path to CA certs directory. Used when server sertificate verify is enabled.
 #LDAP_TLS_CACERT_DIR=/etc/ssl/certs
 # Wether to use starttls, implies LDAPv3 and requires ldap:// instead of ldaps://
@@ -198,7 +143,7 @@ ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background
 # Advanced configuration options (you generally don't need to change these)
 #
-# Internal XMPP domain
+# Internal XMPP domain.
 XMPP_DOMAIN=meet.jitsi
 # Internal XMPP server
@@ -207,22 +152,18 @@ XMPP_SERVER=xmpp.meet.jitsi
 # Internal XMPP server URL
 XMPP_BOSH_URL_BASE=http://xmpp.meet.jitsi:5280
-# Internal XMPP domain for authenticated services
+# Internal XMPP domain for authenticated services.
 XMPP_AUTH_DOMAIN=auth.meet.jitsi
-# XMPP domain for the MUC
+# XMPP domain for the MUC.
 XMPP_MUC_DOMAIN=muc.meet.jitsi
-# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools
+# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools.
 XMPP_INTERNAL_MUC_DOMAIN=internal-muc.meet.jitsi
-# XMPP domain for unauthenticated users
+# XMPP domain for unauthenticated users.
 XMPP_GUEST_DOMAIN=guest.meet.jitsi
 # Comma separated list of domains for cross domain policy or "true" to allow all
 # The PUBLIC_URL is always allowed
 #XMPP_CROSS_DOMAIN=true
 # Custom Prosody modules for XMPP_DOMAIN (comma separated)
 XMPP_MODULES=
@@ -232,14 +173,17 @@ XMPP_MUC_MODULES=
 # Custom Prosody modules for internal MUC component (comma separated)
 XMPP_INTERNAL_MUC_MODULES=
-# MUC for the JVB pool
+# MUC for the JVB pool.
 JVB_BREWERY_MUC=jvbbrewery
-# XMPP user for JVB client connections
+# XMPP user for JVB client connections.
 JVB_AUTH_USER=jvb
-# STUN servers used to discover the server's public IP
+# XMPP password for JVB client connections.
-JVB_STUN_SERVERS=meet-jit-si-turnrelay.jitsi.net:443
+JVB_AUTH_PASSWORD=passw0rd
 # STUN servers used to discover the server's public IP.
 JVB_STUN_SERVERS=stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302
 # Media port for the Jitsi Videobridge
 JVB_PORT=10000
@@ -247,32 +191,36 @@ JVB_PORT=10000
 # TCP Fallback for Jitsi Videobridge for when UDP isn't available
 JVB_TCP_HARVESTER_DISABLED=true
 JVB_TCP_PORT=4443
 JVB_TCP_MAPPED_PORT=4443
-# A comma separated list of APIs to enable when the JVB is started [default: none]
+# A comma separated list of APIs to enable when the JVB is started. The default is none.
 # See https://github.com/jitsi/jitsi-videobridge/blob/master/doc/rest.md for more information
 #JVB_ENABLE_APIS=rest,colibri
-# XMPP user for Jicofo client connections.
+# XMPP component password for Jicofo.
-# NOTE: this option doesn't currently work due to a bug
+JICOFO_COMPONENT_SECRET=s3cr37
 # XMPP user for Jicofo client connections. NOTE: this option doesn't currently work due to a bug.
 JICOFO_AUTH_USER=focus
 # XMPP password for Jicofo client connections.
 JICOFO_AUTH_PASSWORD=passw0rd
 # Base URL of Jicofo's reservation REST API
 #JICOFO_RESERVATION_REST_BASE_URL=http://reservation.example.com
-# Enable Jicofo's health check REST API (http://<jicofo_base_url>:8888/about/health)
+# XMPP user for Jigasi MUC client connections.
 #JICOFO_ENABLE_HEALTH_CHECKS=true
 # XMPP user for Jigasi MUC client connections
 JIGASI_XMPP_USER=jigasi
-# MUC name for the Jigasi pool
+# XMPP password for Jigasi MUC client connections.
 JIGASI_XMPP_PASSWORD=passw0rd
 # MUC name for the Jigasi pool.
 JIGASI_BREWERY_MUC=jigasibrewery
-# Minimum port for media used by Jigasi
+# Minimum port for media used by Jigasi.
 JIGASI_PORT_MIN=20000
-# Maximum port for media used by Jigasi
+# Maximum port for media used by Jigasi.
 JIGASI_PORT_MAX=20050
 # Enable SDES srtp
@@ -287,21 +235,20 @@ JIGASI_PORT_MAX=20050
 # Health-check interval
 #JIGASI_HEALTH_CHECK_INTERVAL=300000
 #
-# Enable Jigasi transcription
+# Enable Jigasi transcription.
 #ENABLE_TRANSCRIPTIONS=1
-# Jigasi will record audio when transcriber is on [default: false]
+# Jigasi will recordord an audio when transcriber is on. Default false.
 #JIGASI_TRANSCRIBER_RECORD_AUDIO=true
-# Jigasi will send transcribed text to the chat when transcriber is on [default: false]
+# Jigasi will send transcribed text to the chat when transcriber is on. Default false.
 #JIGASI_TRANSCRIBER_SEND_TXT=true
-# Jigasi will post an url to the chat with transcription file [default: false]
+# Jigasi post to the chat an url with transcription file. Default false.
 #JIGASI_TRANSCRIBER_ADVERTISE_URL=true
 # Credentials for connect to Cloud Google API from Jigasi
-# Please read https://cloud.google.com/text-to-speech/docs/quickstart-protocol
+# Please read https://cloud.google.com/text-to-speech/docs/quickstart-protocol section "Before you begin" from 1 to 5 paragraph.
 # section "Before you begin" paragraph 1 to 5
 # Copy the values from the json to the related env vars
 #GC_PROJECT_ID=
 #GC_PRIVATE_KEY_ID=
@@ -316,19 +263,25 @@ JIGASI_PORT_MAX=20050
 # XMPP domain for the jibri recorder
 XMPP_RECORDER_DOMAIN=recorder.meet.jitsi
-# XMPP recorder user for Jibri client connections
+# XMPP recorder user for Jibri client connections.
 JIBRI_RECORDER_USER=recorder
-# Directory for recordings inside Jibri container
+# XMPP recorder password for Jibri client connections.
 JIBRI_RECORDER_PASSWORD=passw0rd
 # Directory for recordings inside Jibri container.
 JIBRI_RECORDING_DIR=/config/recordings
-# The finalizing script. Will run after recording is complete
+# The finalizing script. Will run after recording is complete.
 JIBRI_FINALIZE_RECORDING_SCRIPT_PATH=/config/finalize.sh
-# XMPP user for Jibri client connections
+# XMPP user for Jibri client connections.
 JIBRI_XMPP_USER=jibri
-# MUC name for the Jibri pool
+# XMPP password for Jibri client connections.
 JIBRI_XMPP_PASSWORD=passw0rd
 # MUC name for the Jibri pool.
 JIBRI_BREWERY_MUC=jibribrewery
 # MUC connection timeout
@@ -341,26 +294,14 @@ JIBRI_PENDING_TIMEOUT=90
 # So if there are any prefixes in the jid (like jitsi meet, which
 # has its participants join a muc at conference.xmpp_domain) then
 # list that prefix here so it can be stripped out to generate
-# the call url correctly
+# the call url correctly.
 JIBRI_STRIP_DOMAIN_JID=muc
-# Directory for logs inside Jibri container
+# Directory for logs inside Jibri container.
 JIBRI_LOGS_DIR=/config/logs
-# Disable HTTPS: handle TLS connections outside of this setup
+# Disable HTTPS. This can be useful if TLS connections are going to be handled outside of this setup.
 DISABLE_HTTPS=1
-# Redirect HTTP traffic to HTTPS
+# Redirects HTTP traffic to HTTPS. Only works with the standard HTTPS port (443).
 # Necessary for Let's Encrypt, relies on standard HTTPS port (443)
 #ENABLE_HTTP_REDIRECT=1
 # Enable IPv6
 # Provides means to disable IPv6 in environments that don't support it (get with the times, people!)
 #ENABLE_IPV6=1
 # Container restart policy
 # Defaults to unless-stopped
 RESTART_POLICY=unless-stopped
 # Authenticate using external service or just focus external auth window if there is one already.
 # TOKEN_AUTH_URL=https://auth.meet.example.com/{room}
@@ -1,35 +0,0 @@
 #!/bin/bash
 set -e
 SERVICE="$1"
 export MISTBORN_HOME=/opt/mistborn
 export SERVICE_ENV_INSTALLER="${MISTBORN_HOME}/scripts/subinstallers/extra/${SERVICE}.sh"
 export SERVICE_ENV_FILE="${MISTBORN_HOME}/.envs/.production/.${SERVICE}"
 # read in global variables
 set -a
 source ${MISTBORN_HOME}/.env
 source ${MISTBORN_HOME}/.envs/.production/.django
 source ${MISTBORN_HOME}/.envs/.production/.postgres
 source ${MISTBORN_HOME}/.envs/.production/.pihole
 set +a
 if [[ -f "${SERVICE_ENV_INSTALLER}" ]]; then
    if [[ -f "${SERVICE_ENV_FILE}" ]]; then
        echo "Environment file already exists."
    else
        # create env file for service
        echo "Creating environment file"
        source $SERVICE_ENV_INSTALLER $SERVICE_ENV_FILE
        chown mistborn:mistborn $SERVICE_ENV_FILE
        chmod 600 $SERVICE_ENV_FILE
    fi
 else
    echo "No subinstaller found."
 fi
@@ -1,32 +1,16 @@
 #!/bin/bash
 #### ENV file
 VAR_FILE=/opt/mistborn/.env
 # load env variables
 source /opt/mistborn/scripts/subinstallers/platform.sh
 # setup env file
 echo "" | sudo tee ${VAR_FILE}
 sudo chown mistborn:mistborn ${VAR_FILE}
 sudo chmod 600 ${VAR_FILE}
 # MISTBORN_DNS_BIND_IP
 MISTBORN_DNS_BIND_IP="10.2.3.1"
 #if [ "$DISTRO" == "ubuntu" ] && [ "$VERSION_ID" == "20.04" ]; then
 #    MISTBORN_DNS_BIND_IP="10.2.3.1"
 #fi
-echo "MISTBORN_DNS_BIND_IP=${MISTBORN_DNS_BIND_IP}" | sudo tee -a ${VAR_FILE}
+echo "MISTBORN_DNS_BIND_IP=${MISTBORN_DNS_BIND_IP}" | sudo tee ${VAR_FILE}
-
+sudo chown mistborn:mistborn ${VAR_FILE}
 # MISTBORN_BIND_IP
 echo "MISTBORN_BIND_IP=10.2.3.1" | sudo tee -a ${VAR_FILE}
 # MISTBORN_TAG
 GIT_BRANCH=$(git -C /opt/mistborn symbolic-ref --short HEAD || echo "master")
 MISTBORN_TAG="latest"
@@ -35,30 +19,3 @@ if [ "$GIT_BRANCH" != "master" ]; then
 fi
 echo "MISTBORN_TAG=$MISTBORN_TAG" | sudo tee -a ${VAR_FILE}
 #### SERVICE files
 # copy current service files to systemd (overwriting as needed)
 sudo cp /opt/mistborn/scripts/services/Mistborn* /etc/systemd/system/
 # set script user and owner
 sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=$USER/"
 #sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/ root:root / $USER:$USER /"
 # reload in case the iface is not immediately set
 sudo systemctl daemon-reload
 #### install and base services
 iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}' | tr -d '[:space:]')
 ## cannot be empty
 while [[ -z "$iface" ]]; do
    sleep 2
    iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}' | tr -d '[:space:]')
 done
 # default interface
 sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"
 echo "DIFACE=${iface}" | sudo tee -a ${VAR_FILE}
 sudo systemctl daemon-reload
@@ -59,28 +59,19 @@ echo -e "| |  | | \__ \ |_| |_) | (_) | |  | | | |"
 echo -e "|_|  |_|_|___/\__|_.__/ \___/|_|  |_| |_|"
 echo -e ""
-sudo rm -rf /opt/mistborn 2>/dev/null || true
+# INPUT default admin password
-
+if [ -z "${MISTBORN_DEFAULT_PASSWORD}" ]; then
-# clone to /opt and change directory
+    read -p "(Mistborn) Set default admin password: " -s MISTBORN_DEFAULT_PASSWORD
-echo "Cloning $GIT_BRANCH branch from mistborn repo"
+    echo
-sudo git clone https://gitlab.com/cyber5k/mistborn.git -b $GIT_BRANCH /opt/mistborn
+else
-sudo chown -R $USER:$USER /opt/mistborn
+    echo "MISTBORN_DEFAULT_PASSWORD is already set"
-pushd .
+fi
 cd /opt/mistborn
 git submodule update --init --recursive
 # Check updates
 echo "Checking updates"
 source ./scripts/subinstallers/check_updates.sh
 # MISTBORN_DEFAULT_PASSWORD
 source ./scripts/subinstallers/passwd.sh
 # Install Cockpit?
 if [ -z "${MISTBORN_INSTALL_COCKPIT}" ]; then
-    read -p "Install Cockpit (a somewhat resource-heavy system management graphical user interface -- NOT RECOMMENDED on Raspberry Pi)? [y/N]: " MISTBORN_INSTALL_COCKPIT
+    read -p "Install Cockpit (a somewhat resource-heavy system management graphical user interface)? [Y/n]: " MISTBORN_INSTALL_COCKPIT
    echo
-    MISTBORN_INSTALL_COCKPIT=${MISTBORN_INSTALL_COCKPIT:-N}
+    MISTBORN_INSTALL_COCKPIT=${MISTBORN_INSTALL_COCKPIT:-Y}
 fi
 # SSH keys
@@ -94,7 +85,18 @@ else
    echo "SSH key exists for $USER"
 fi
-# initial load update package list during check_updates.sh
+sudo rm -rf /opt/mistborn 2>/dev/null || true
 # clone to /opt and change directory
 echo "Cloning $GIT_BRANCH branch from mistborn repo"
 sudo git clone https://gitlab.com/cyber5k/mistborn.git -b $GIT_BRANCH /opt/mistborn
 sudo chown -R $USER:$USER /opt/mistborn
 pushd .
 cd /opt/mistborn
 git submodule update --init --recursive
 # initial load update package list
 sudo apt-get update
 # install figlet
 sudo -E apt-get install -y figlet
@@ -115,10 +117,10 @@ fi
 # SSH Server
 sudo -E apt-get install -y openssh-server
-#sudo sed -i 's/#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
+sudo sed -i 's/#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
-#sudo sed -i 's/PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
+sudo sed -i 's/PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
-#sudo sed -i 's/#PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
+sudo sed -i 's/#PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
-#sudo sed -i 's/PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
+sudo sed -i 's/PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
 sudo sed -i 's/#Port.*/Port 22/' /etc/ssh/sshd_config
 sudo sed -i 's/Port.*/Port 22/' /etc/ssh/sshd_config
 sudo systemctl enable ssh
@@ -130,11 +132,8 @@ sudo -E apt-get install -y dnsutils fail2ban
 # Install kernel headers
 if [ "$DISTRO" == "ubuntu" ] || [ "$DISTRO" == "debian" ]; then
    sudo -E apt install -y linux-headers-$(uname -r)
-elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+elif [ "$DISTRO" == "raspbian" ]; then
    sudo -E apt install -y raspberrypi-kernel-headers
 else
    echo "Unsupported OS: $DISTRO"
    exit 1
 fi
 # Wireugard
@@ -164,6 +163,8 @@ sudo pip3 install -e ./modules/mistborn-cli
 # Mistborn
 # final setup vars
 iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
 figlet "Mistborn default NIC: $iface"
 #IPV4_PUBLIC=$(ip -o -4 route show default | egrep -o 'dev [^ ]*' | awk '{print $2}' | xargs ip -4 addr show | grep 'inet ' | awk '{print $2}' | grep -o "^[0-9.]*"  | tr -cd '\11\12\15\40-\176' | head -1) # tail -1 to get last
 IPV4_PUBLIC="10.2.3.1"
@@ -184,13 +185,18 @@ sudo systemctl restart unattended-upgrades
 # setup Mistborn services
 # install and start base services
 # default interface
 sudo cp ./scripts/services/Mistborn* /etc/systemd/system/
 sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=$USER/"
 #sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/ root:root / $USER:$USER /"
 sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"
 #if [ "$DISTRO" == "debian" ] || [ "$DISTRO" == "raspbian" ]; then
 #    # remove systemd-resolved lines
 #    sudo sed -i '/.*systemd-resolved/d' /etc/systemd/system/Mistborn-base.service
 #fi
 sudo cp ./scripts/services/Mistborn-setup.service /etc/systemd/system/
 # setup local volumes for pihole
 sudo mkdir -p ../mistborn_volumes/
 sudo chown -R root:root ../mistborn_volumes/
@@ -199,12 +205,12 @@ sudo mkdir -p ../mistborn_volumes/base/pihole/etc-dnsmasqd
 sudo mkdir -p ../mistborn_volumes/extra
 # Traefik final setup (cockpit)
-#cp ./compose/production/traefik/traefikv2.toml.template ./compose/production/traefik/traefik.toml
+cp ./compose/production/traefik/traefik.toml.template ./compose/production/traefik/traefik.toml
 # setup tls certs 
 source ./scripts/subinstallers/openssl.sh
-#sudo rm -rf ../mistborn_volumes/base/tls
+sudo rm -rf ../mistborn_volumes/base/tls
-#sudo mv ./tls ../mistborn_volumes/base/
+sudo mv ./tls ../mistborn_volumes/base/
 # enable and run setup to generate .env
 sudo systemctl enable Mistborn-setup.service
@@ -214,17 +220,6 @@ sudo systemctl start Mistborn-setup.service
 sudo docker-compose -f base.yml pull || true
 sudo docker-compose -f base.yml build
 ## disable systemd-resolved stub listener (creates symbolic link to /etc/resolv.conf)
 if [ -f /etc/systemd/resolved.conf ]; then
    sudo sed -i 's/#DNSStubListener.*/DNSStubListener=no/' /etc/systemd/resolved.conf
    sudo sed -i 's/DNSStubListener.*/DNSStubListener=no/' /etc/systemd/resolved.conf
 fi
 ## delete symlink if exists
 if [ -L /etc/resolv.conf ]; then
    sudo rm /etc/resolv.conf
 fi
 ## disable other DNS services
 sudo systemctl stop systemd-resolved 2>/dev/null || true
 sudo systemctl disable systemd-resolved 2>/dev/null || true
@@ -246,7 +241,6 @@ sudo resolvconf -u 1>/dev/null 2>&1
 echo "backup up original volumes folder"
 sudo mkdir -p ../mistborn_backup
 sudo chmod 700 ../mistborn_backup
 sudo tar -czf ../mistborn_backup/mistborn_volumes_backup.tar.gz ../mistborn_volumes 1>/dev/null 2>&1
 # clean docker
@@ -1,9 +0,0 @@
 #!/bin/bash 
 set -e
 export DEBIAN_FRONTEND=noninteractive
 sudo systemctl stop Mistborn-base
 sudo systemctl restart Mistborn-setup
 sudo systemctl restart Mistborn-base
@@ -1,23 +1,15 @@
 [Unit]
 Description=Mistborn Base
 Requires=docker.service
 Requires=netfilter-persistent.service
 After=docker.service
 After=netfilter-persistent.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
 EnvironmentFile=/opt/mistborn/.env
 # stop all containers joined to mistborn_default network
 ExecStartPre=-/usr/bin/bash -c "docker container stop $(docker network inspect mistborn_default | grep Name | tail -n +2 | cut -d':' -f2 | tr -d ',\"') 2>/dev/null"
 # bring down the base service
 ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml down
 ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml build
@@ -2,24 +2,22 @@
 Description=Mistborn Bitwarden Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml down
+ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/bitwarden.yml down
 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 3012 -j MISTBORN_LOG_DROP
 # Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml up --build
+ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/bitwarden.yml up --build
 # Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml down
+ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/bitwarden.yml down
 # Post stop
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 3012 -j MISTBORN_LOG_DROP
 [Install]
-WantedBy=Mistborn-base.service
+WantedBy=multi-user.target
@@ -1,22 +0,0 @@
 [Unit]
 Description=Mistborn Elasticsearch Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
 ExecStartPre=/usr/sbin/sysctl -w vm.max_map_count=262144
 ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
 # Start container when unit is started
 ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml up --build
 # Stop container when unit is stopped
 ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
 [Install]
 WantedBy=Mistborn-base.service
@@ -1,23 +0,0 @@
 [Unit]
 Description=Mistborn Guacamole
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
 ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml down
 # Start container when unit is started
 ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml up --build
 # Stop container when unit is stopped
 ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml down
 # Post stop
 [Install]
 WantedBy=Mistborn-base.service
@@ -2,22 +2,20 @@
 Description=Mistborn Home Assistant 
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml down
+ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/homeassistant.yml down
 # Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml up --build
+ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/homeassistant.yml up --build
 # Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml down
+ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/homeassistant.yml down
 # Post stop
 [Install]
-WantedBy=Mistborn-base.service
+WantedBy=multi-user.target
@@ -2,22 +2,20 @@
 Description=Mistborn Jellyfin Service
 Requires=Mistborn-nextcloud.service
 After=Mistborn-nextcloud.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml down
+ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jellyfin.yml down
 # Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml up --build
+ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jellyfin.yml up --build
 # Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml down
+ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jellyfin.yml down
 # Post stop
 [Install]
-WantedBy=Mistborn-base.service
+WantedBy=multi-user.target
@@ -2,26 +2,26 @@
 Description=Mistborn Jitsi Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 EnvironmentFile=/opt/mistborn/.envs/.production/.jitsi
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
+ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
 ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi /opt/mistborn/scripts/services/jitsi/iptables_up.sh
 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
 # Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml up --build
+ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jitsi-meet.yml up --build
 # Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
+ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
 # Post stop
-ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi /opt/mistborn/scripts/services/jitsi/iptables_down.sh
+ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
 [Install]
-WantedBy=Mistborn-base.service
+WantedBy=multi-user.target
@@ -2,22 +2,20 @@
 Description=Mistborn Nextcloud Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
-RestartSec=15
+User=www-data
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml down
+ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/nextcloud.yml down
 # Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml up --build
+ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/nextcloud.yml up --build
 # Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml down
+ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/nextcloud.yml down
 # Post stop
 [Install]
-WantedBy=Mistborn-base.service
+WantedBy=multi-user.target
@@ -2,22 +2,29 @@
 Description=Mistborn OnlyOffice Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
+ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
 ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml build
 #ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 25 -j MISTBORN_LOG_DROP
 #ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 143 -j MISTBORN_LOG_DROP
 #ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 587 -j MISTBORN_LOG_DROP
 ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 5222 -j MISTBORN_LOG_DROP
 # Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml up --build
+ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml up
 # Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
+ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
 # Post stop
 #ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 25 -j MISTBORN_LOG_DROP
 #ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 143 -j MISTBORN_LOG_DROP
 #ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 587 -j MISTBORN_LOG_DROP
 ExecStopPost=/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 5222 -j MISTBORN_LOG_DROP
 [Install]
-WantedBy=Mistborn-base.service
+WantedBy=multi-user.target
@@ -1,25 +0,0 @@
 [Unit]
 Description=Mistborn RaspAP Service 
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 8095 -j MISTBORN_LOG_DROP
 #ExecStartPre=/bin/bash /opt/mistborn_volumes/extra/raspap/etc-raspap/hostapd/servicestart.sh --interface uap0 --seconds 3
 # Shutdown container (if running) when unit is stopped
 ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml down
 # Start container when unit is started
 ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml up --build
 # Stop container when unit is stopped
 ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml down
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 8095 -j MISTBORN_LOG_DROP
 # Post stop
 [Install]
 WantedBy=Mistborn-base.service
@@ -2,24 +2,22 @@
 Description=Mistborn Rocket Chat Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml down
+ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/rocketchat.yml down
 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 3001 -j MISTBORN_LOG_DROP
 # Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml up --build
+ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/rocketchat.yml up --build
 # Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml down
+ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/rocketchat.yml down
 # Post stop
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 3001 -j MISTBORN_LOG_DROP
 [Install]
-WantedBy=Mistborn-base.service
+WantedBy=multi-user.target
@@ -1,27 +0,0 @@
 [Unit]
 Description=Mistborn Scirius Service
 Requires=Mistborn-wazuh.service
 After=Mistborn-wazuh.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
 ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml down
 # Start container when unit is started
 ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml up --build
 # Suricata
 ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius /opt/mistborn/scripts/services/scirius/suricata_start.sh
 # Stop container when unit is stopped
 ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml down
 # Post stop
 ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius /opt/mistborn/scripts/services/scirius/suricata_stop.sh
 [Install]
 WantedBy=Mistborn-base.service
@@ -4,7 +4,6 @@ Before=Mistborn-base.service
 [Service]
 Type=oneshot
 User=mistborn
 ExecStart=/opt/mistborn/scripts/env/setup.sh
 [Install]
@@ -2,26 +2,24 @@
 Description=Mistborn Syncthing Service
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml down
+ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/syncthing.yml down
 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p udp --dport 21027 -j MISTBORN_LOG_DROP
 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 22000 -j MISTBORN_LOG_DROP
 # Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml up --build
+ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/syncthing.yml up --build
 # Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml down
+ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/syncthing.yml down
 # Post stop
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p udp --dport 21027 -j MISTBORN_LOG_DROP
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 22000 -j MISTBORN_LOG_DROP
 [Install]
-WantedBy=Mistborn-base.service
+WantedBy=multi-user.target
@@ -2,24 +2,22 @@
 Description=Mistborn Tor Service 
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
-ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml down
+ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/tor.yml down
 ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 9150 -j MISTBORN_LOG_DROP
 # Start container when unit is started
-ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml up --build
+ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/tor.yml up --build
 # Stop container when unit is stopped
-ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml down
+ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/tor.yml down
 # Post stop
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 9150 -j MISTBORN_LOG_DROP
 [Install]
-WantedBy=Mistborn-base.service
+WantedBy=multi-user.target
@@ -1,25 +0,0 @@
 [Unit]
 Description=Mistborn Wazuh Service
 Requires=Mistborn-elasticsearch.service
 After=Mistborn-elasticsearch.service
 PartOf=Mistborn-base.service
 [Service]
 Restart=always
 RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
 ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
 # Start container when unit is started
 ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml up --build
 # Agent install
 ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent.sh
 ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_start.sh
 # Stop container when unit is stopped
 ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
 ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_stop.sh
 [Install]
 WantedBy=Mistborn-base.service
@@ -1,17 +0,0 @@
 ---
 # This is the internal user database
 # The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
 _meta:
  type: "internalusers"
  config_version: 2
 # Define your internal users here
 mistborn:
  hash: "__MISTBORN_HASH__"
  reserved: true
  backend_roles:
  - "admin"
  description: "Mistborn user"
@@ -1,16 +0,0 @@
 #!/bin/bash
 set -e
 if [[ -f "/opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml" ]]; then
    echo "internal_users.yml exists. Proceeding."
    exit 0
 fi
 mkdir -p /opt/mistborn_volumes/extra/elasticsearch/init/ >/dev/null 2>&1
 chmod -R +x /opt/mistborn_volumes/extra/elasticsearch/init/
 cp /opt/mistborn/scripts/services/elasticsearch/files/internal_users.yml /opt/mistborn_volumes/extra/elasticsearch/init/
 ELASTICSEARCH_MISTBORN_HASHED=$(docker run --rm amazon/opendistro-for-elasticsearch:1.12.0 bash /usr/share/elasticsearch/plugins/opendistro_security/tools/hash.sh -p ${MISTBORN_DEFAULT_PASSWORD} | tr -d '\n')
 sed -i "s|__MISTBORN_HASH__|${ELASTICSEARCH_MISTBORN_HASHED}|" /opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml
@@ -1,21 +0,0 @@
 #!/bin/bash
 if [[ -f "/opt/mistborn_volumes/extra/guacamole/init/initdb.sql" ]]; then
    echo "initdb.sql exists. Proceeding."
    exit 0
 fi
 mkdir -p /opt/mistborn_volumes/extra/guacamole/init/ >/dev/null 2>&1
 chmod -R +x /opt/mistborn_volumes/extra/guacamole/init/
 docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --postgres > /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
 # grab values in initdb.sql to replace
 HEXSTRINGS=($(egrep -o [0-9a-fA-F]{64} /opt/mistborn_volumes/extra/guacamole/init/initdb.sql))
 # reset default password in init.db
 SALT=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice('0123456789ABCDEF') for x in range(64)]))")
 GUAC_PASSWORD_HASHED=$(echo -n "${MISTBORN_DEFAULT_PASSWORD}${SALT}" | sha256sum | awk '{print $1}' | tr a-z A-Z)
 sed -i "s/${HEXSTRINGS[1]}/$SALT/" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
 sed -i "s/${HEXSTRINGS[0]}/$GUAC_PASSWORD_HASHED/" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
 sed -i "s/guacadmin/mistborn/g" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
@@ -1,4 +0,0 @@
 #!/bin/bash
 iptables -w -D DOCKER-USER -i $DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
 iptables -w -D DOCKER-USER -i $DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
@@ -1,4 +0,0 @@
 #!/bin/bash
 iptables -w -I DOCKER-USER -i $DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
 iptables -w -I DOCKER-USER -i $DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
@@ -0,0 +1,21 @@
 [Unit]
 Description=Mistborn RaspAP Service 
 Requires=Mistborn-base.service
 After=Mistborn-base.service
 [Service]
 Restart=always
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
 ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/raspap.yml down
 # Start container when unit is started
 ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/raspap.yml up --build
 # Stop container when unit is stopped
 ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/raspap.yml down
 # Post stop
 [Install]
 WantedBy=multi-user.target
@@ -0,0 +1,4 @@
 #!/bin/bash
 # install on gateway
 sudo apt-get install -y hostapd vnstat
@@ -1,6 +0,0 @@
 <agent_config>
    <localfile>
        <log_format>json</log_format>
        <location>/var/log/suricata/eve.json</location>
    </localfile>
 </agent_config>
@@ -1,62 +0,0 @@
 filebeat.modules:
 - module: suricata 
  eve:
    enabled: true
    var.paths: ["/var/log/suricata/eve.json"]
 # - module: system
 #   syslog:
 #     enabled: true
 #   auth:
 #     enabled: true
 # - module: auditd
 #   log:
 #     # - Does not look like Auditd is supported in Alpine linux: https://github.com/linuxkit/linuxkit/issues/52
 #     # - CentOS does not need us to install the audit system, it ships as standard. If you are using Ubuntu, though,
 #     # this is probably something you would want to install. (sudo apt-get install -y auditd audispd-plugins)
 #     enabled: true
 #filebeat.inputs:
 #- type: container
 #  enabled: true
 #  paths:
 #    -/var/lib/docker/containers/*/*.log
 #  stream: all # can be all, stdout or stderr
 #========================== Filebeat autodiscover ==============================
 # See this URL on how to run Apache2 Filebeat module: # https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html
 filebeat.autodiscover:
  providers:
    - type: docker
      # https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover-hints.html
      # This URL alos contains instructions on multi-line logs
      hints.enabled: true
 #================================ Processors ===================================
 processors:
 #- add_cloud_metadata: ~
 - add_docker_metadata: ~
 - add_locale:
    format: offset
 - add_host_metadata:
    netinfo.enabled: true
 #========================== Elasticsearch output ===============================
 output.elasticsearch:
  hosts: ["${ELASTICSEARCH_HOST}:9200"]
  username: ${ELASTICSEARCH_USERNAME}
  password: ${ELASTICSEARCH_PASSWORD}
 #============================== Dashboards =====================================
 setup.dashboards:
  enabled: true
 #============================== Kibana =========================================
 setup.kibana:
  host: "${KIBANA_HOST}:80"
  username: ${ELASTICSEARCH_USERNAME}
  password: ${ELASTICSEARCH_PASSWORD}
 #============================== Xpack Monitoring ===============================
 xpack.monitoring:
  enabled: true
  elasticsearch:
@@ -1,101 +0,0 @@
 #!/bin/bash
 set -e
 # detect if suricata is installed
 if [[ $(dpkg-query -W -f='${Status}' suricata 2>/dev/null | grep -c "ok installed") -eq 1 ]]; then
    echo "Suricata Installed"
    exit 0
 fi
 source /opt/mistborn/scripts/subinstallers/platform.sh
 # minimal dependencies
 sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
                libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
                make libmagic-dev libjansson-dev
 ## recommended dependencies
 #sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
 #                libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
 #                libcap-ng-dev libcap-ng0 make libmagic-dev         \
 #                libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \
 #                python-yaml rustc cargo
 # iptables/nftables integration
 sudo -E apt-get -y install libnetfilter-queue-dev libnetfilter-queue1  \
                libnetfilter-log-dev libnetfilter-log1      \
                libnfnetlink-dev libnfnetlink0
 if [ "$DISTRO" == "ubuntu" ]; then
    echo "Installing Suricata Ubuntu PPA"
    sudo -E add-apt-repository -y ppa:oisf/suricata-stable
    sudo -E apt-get update
    sudo -E apt-get install -y suricata
 elif [ "$DISTRO" == "debian" ]; then
    # retrieve version codename
    source /etc/os-release
    echo "deb http://http.debian.net/debian $VERSION_CODENAME-backports main" | \
        sudo -E tee /etc/apt/sources.list.d/backports.list
    sudo -E apt-get update
    sudo -E apt-get install -y suricata -t ${VERSION_CODENAME}-backports
 else
    echo "Basic Suricata installation"
    sudo -E apt-get install -y suricata
 fi
 # # iptables
 # sudo iptables -A INPUT -j NFQUEUE
 # sudo iptables -I FORWARD -j NFQUEUE
 # sudo iptables -I OUTPUT -j NFQUEUE
 # # rsyslog to create /var/log/suricata.log
 # sudo cp ./scripts/conf/20-suricata.conf /etc/rsyslog.d/
 # sudo chown root:root /etc/rsyslog.d/20-suricata.conf
 # sudo systemctl restart rsyslog
 IFACE=$(ip -o -4 route show to default | awk 'NR==1{print $5}')
 sudo sed -i "s/eth0/${IFACE}/g" /etc/suricata/suricata.yaml
 sudo sed -i "s/eth0/${IFACE}/g" /etc/default/suricata
 systemctl restart suricata
 # wait for service to be listening
 while ! nc -z 10.2.3.1 55000; do
    WAIT_TIME=10
    echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
    sleep ${WAIT_TIME}
 done
 # set working directory to mistborn for docker-compose
 pushd .
 cd /opt/mistborn
 # ensure group exists
 sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -g suricata -q 2>/dev/null
 # add this host to group
 WAZUH_ID=$(sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/manage_agents -l | egrep ^\ *ID | grep $(hostname) | awk '{print $2}' | tr -d ',')
 sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -i ${WAZUH_ID} -g suricata -q
 # write agent.conf
 sudo docker-compose -f extra/wazuh.yml exec -T wazuh bash -c "cat > /var/ossec/etc/shared/suricata/agent.conf << EOF
 <agent_config>
    <localfile>
        <log_format>json</log_format>
        <location>/var/log/suricata/eve.json</location>
    </localfile>
 </agent_config>
 EOF
 "
 # restart manager
 sudo docker-compose -f extra/wazuh.yml restart wazuh
 popd
 mkdir -p /opt/mistborn_volumes/extra/scirius/init/ >/dev/null 2>&1
 chmod -R +x /opt/mistborn_volumes/extra/scirius/init/
 cp /opt/mistborn/scripts/services/scirius/files/filebeat.docker.yml /opt/mistborn_volumes/extra/scirius/init/
@@ -1,117 +0,0 @@
 #!/usr/bin/python3
 """
 Copyright(C) 2014-2020, Stamus Networks
 Written by Eric Leblond <eleblond@stamus-networks.com>
 This file is part of Scirius.
 Scirius is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 3 of the License, or
 (at your option) any later version.
 Scirius is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with Scirius.  If not, see <http://www.gnu.org/licenses/>.
 """
 import pyinotify
 import argparse
 import subprocess
 import logging
 import os
 have_daemon = True
 try:
    import daemon
    import daemon.pidfile as pidlockfile
 except:
    logging.warning("No daemon support available, install python-daemon if feature is needed")
    have_daemon = False
 RELOAD_FILE = "scirius.reload"
 parser = argparse.ArgumentParser(description='Suricata reloader')
 parser.add_argument('-r', '--reload', default=False, action="store_true", help="If set reload Suricata instead of restarting")
 parser.add_argument('-p', '--path', default='/etc/suricata/rules', help='Directory to monitor for scirius.reload file')
 parser.add_argument('-l', '--log', default=None, help='File to log output to (default to stdout)')
 parser.add_argument('-v', '--verbose', default=False, action="count", help="Show verbose output, use multiple times increase verbosity")
 if have_daemon:
    parser.add_argument('-D', '--daemon', default=False, action="store_true", help="Run as unix daemon")
    parser.add_argument('-P', '--pidfile', default='/var/run/suri-reloader.pid', help='PID file for suri-reloader')
 args = parser.parse_args()
 if args.verbose >= 3:
    loglevel=logging.DEBUG
 elif args.verbose >= 2:
    loglevel=logging.INFO
 elif args.verbose >= 1:
    loglevel=logging.WARNING
 else:
    loglevel=logging.ERROR
 def SuriReload(reload = False):
    if reload:
        if subprocess.call(['service', 'suricata', 'reload']):
            logging.error("Unable to reload suricata")
        else:
            logging.info("Reloaded suricata")
    else:
        if subprocess.call(['service', 'suricata', 'restart']):
            logging.error("Unable to restart suricata")
        else:
            logging.info("Restarted suricata")
 class EventHandler(pyinotify.ProcessEvent):
    def process_IN_CLOSE_WRITE(self, event):
        if not RELOAD_FILE in event.pathname:
            return
        SuriReload(self.reload)
        os.unlink(event.pathname)
    def set_mode(self, mode):
        if mode == "reload":
            self.reload = True
        else:
            self.reload = False
 def setup_logging(args):
    if args.log:
        logging.basicConfig(filename=args.log,
                            format='%(asctime)s %(name)-12s %(levelname)-8s %(message)s',
                            level=loglevel)
    else:
        logging.basicConfig(level=loglevel)
 def main_task(args):
    setup_logging(args)
    reload_file = os.path.join(args.path, RELOAD_FILE)
    if os.path.isfile(reload_file):
        SuriReload(args.reload)
        os.unlink(reload_file)
    handler = EventHandler()
    if args.reload:
        handler.set_mode("reload")
    else:
        handler.set_mode("restart")
    wm = pyinotify.WatchManager()  # Watch Manager
    mask = pyinotify.IN_CLOSE_WRITE
    notifier = pyinotify.Notifier(wm, handler)
    wdd = wm.add_watch(args.path, mask, rec=True)
    logging.info("Starting filesystem monitoring")
    notifier.loop()
 if have_daemon and args.daemon:
    pidfile = pidlockfile.TimeoutPIDLockFile(args.pidfile)
    with daemon.DaemonContext(pidfile=pidfile):
        main_task(args)
 else:
    main_task(args)
@@ -1,7 +0,0 @@
 #!/bin/bash
 systemctl start suricata
 systemctl enable suricata
 apt-get install -y python-pyinotify
 python /opt/mistborn/scripts/services/scirius/suri_reloader -p /etc/suricata/rules &
@@ -1,6 +0,0 @@
 #!/bin/bash
 systemctl stop suricata
 systemctl disable suricata
 kill $(pgrep -f suri_reloader) 2>/dev/null
@@ -1,30 +0,0 @@
 #!/bin/bash
 # detect if already installed
 if dpkg -s wazuh-agent &> /dev/null; then
    echo "Wazuh agent already installed"
    exit 0
 fi
 # install curl
 echo "install curl"
 sudo -E apt-get install -y curl
 # prepare repo
 echo "Adding Wazuh Repository"
 curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo -E apt-key add -
 echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | sudo -E tee /etc/apt/sources.list.d/wazuh.list
 apt-get update
 # wait for service to be listening
 while ! nc -z 10.2.3.1 55000; do
    WAIT_TIME=10
    echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
    sleep ${WAIT_TIME}
 done
 # install
 echo "Installing Wazuh agent"
 WAZUH_MANAGER="10.2.3.1" apt-get install wazuh-agent
@@ -1,4 +0,0 @@
 #!/bin/bash
 systemctl start wazuh-agent
 systemctl enable wazuh-agent
@@ -1,4 +0,0 @@
 #!/bin/bash
 systemctl stop wazuh-agent
 systemctl disable wazuh-agent
@@ -1,10 +0,0 @@
 #!/bin/bash
 sudo apt-get update
 UPDATES=$(sudo apt-get dist-upgrade -s --quiet=2 | grep ^Inst | wc -l)
 if [[ "$UPDATES" -ne "0" ]]; then
    echo "Please run updates and reboot before installing Mistborn: sudo apt-get update && sudo apt-get -y dist-upgrade"
    exit 1;
 fi
@@ -10,17 +10,18 @@ elif [ "$DISTRO" == "debian" ]; then
    && echo "buster-backports already in sources" \
    || echo 'deb http://deb.debian.org/debian buster-backports main' | sudo tee -a /etc/apt/sources.list.d/backports.list
-elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+
 elif [ "$DISTRO" == "raspbian" ]; then
    echo "Raspbian repos contain cockpit"
 fi
 sudo -E apt-get install -y cockpit
-if [ $(sudo apt-cache show cockpit-docker > /dev/null 2>&1) ]; then
+if $(sudo apt-cache show cockpit-docker > /dev/null 2>&1) ; then
    # no longer supported upstream in Ubuntu 20.04
    sudo -E apt-get install -y cockpit-docker
 elif [ $(sudo apt-cache show cockpit-podman > /dev/null 2>&1) ]; then
    sudo -E apt-get install -y cockpit-podman
 fi
 sudo cp ./scripts/conf/cockpit.conf /etc/cockpit/cockpit.conf
@@ -16,8 +16,5 @@ fi
 # set docker-compose path used in Mistborn
 if [ ! -f /usr/local/bin/docker-compose ]; then
-    sudo -E ln -s $(which docker-compose) /usr/local/bin/docker-compose
+    sudo ln -s $(which docker-compose) /usr/local/bin/docker-compose
 fi
 # daemon.json
 #source ./scripts/subinstallers/docker_daemon.sh
@@ -1,7 +0,0 @@
 #!/bin/bash
 # daemon.json
 if [ ! -f /etc/docker/daemon.json ]; then
    sudo -E cp ./scripts/conf/docker-daemon.json /etc/docker/daemon.json
    sudo -E systemctl restart docker
 fi
@@ -15,7 +15,7 @@ if [ "$DISTRO" == "ubuntu" ]; then
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
 elif [ "$DISTRO" == "debian" ]; then
    curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
-elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+elif [ "$DISTRO" == "raspbian" ]; then
    curl -fsSL https://download.docker.com/linux/$(. /etc/os-release; echo "$ID")/gpg | sudo apt-key add -
 fi
@@ -31,7 +31,7 @@ elif [ "$DISTRO" == "debian" ]; then
   "deb https://download.docker.com/linux/debian \
   $(lsb_release -cs) \
   stable"
-elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+elif [ "$DISTRO" == "raspbian" ]; then
    echo "deb [arch=armhf] https://download.docker.com/linux/$(. /etc/os-release; echo "$ID") \
     $(lsb_release -cs) stable" | \
    sudo tee /etc/apt/sources.list.d/docker.list
@@ -43,7 +43,7 @@ sudo apt-get update
 if [ "$DISTRO" == "ubuntu" ] || [ "$DISTRO" == "debian" ]; then
    sudo -E apt-get install -y docker-ce docker-ce-cli containerd.io
-elif [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+elif [ "$DISTRO" == "raspbian" ]; then
    sudo -E apt install -y --no-install-recommends \
    docker-ce \
    cgroupfs-mount
@@ -59,11 +59,10 @@ echo "Installing Docker Compose"
 #    sudo chmod +x /usr/local/bin/docker-compose
 #elif [ "$DISTRO" == "raspbian" ]; then
 # Install required packages
-#sudo -E apt install -y python-backports.ssl-match-hostname
+sudo -E apt install -y python-backports.ssl-match-hostname
 # Install Docker Compose from pip
 # This might take a while
-# cryptography >=3.4 requires rust to compile, and no rust compiler is readily available for ARM
+sudo pip3 install docker-compose
 sudo pip3 install cryptography==3.3.2 docker-compose
 #fi
@@ -1,7 +0,0 @@
 #!/bin/bash
 # generate bitwarden .env files
 BITWARDEN_PROD_FILE="$1"
 echo "WEBSOCKET_ENABLED=true" > $BITWARDEN_PROD_FILE
 echo "SIGNUPS_ALLOWED=true" >> $BITWARDEN_PROD_FILE
 chmod 600 $BITWARDEN_PROD_FILE
@@ -1,6 +0,0 @@
 #!/bin/bash
 # Elasticsearch
 ELASTICSEARCH_PROD_FILE="$1"
 echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $ELASTICSEARCH_PROD_FILE
 chmod 600 $ELASTICSEARCH_PROD_FILE
@@ -1,14 +0,0 @@
 #!/bin/bash
 # Guacamole
 GUAC_PROD_FILE="$1"
 GUAC_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
 echo "POSTGRES_HOST=guac_postgres" > $GUAC_PROD_FILE
 echo "POSTGRES_HOSTNAME=guac_postgres" > $GUAC_PROD_FILE
 echo "POSTGRES_PORT=5432" >> $GUAC_PROD_FILE
 echo "POSTGRES_DB=guacamole_db" >> $GUAC_PROD_FILE
 echo "POSTGRES_DATABASE=guacamole_db" >> $GUAC_PROD_FILE
 echo "POSTGRES_USER=guac_user" >> $GUAC_PROD_FILE
 echo "POSTGRES_PASSWORD=$GUAC_PASSWORD" >> $GUAC_PROD_FILE
 echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $GUAC_PROD_FILE
 chmod 600 $GUAC_PROD_FILE
@@ -1,13 +0,0 @@
 #!/bin/bash
 # JITSI
 JITSI_PROD_FILE="$1"
 cp ${MISTBORN_HOME}/scripts/conf/jitsi.env $JITSI_PROD_FILE
 mkdir -p ${MISTBORN_HOME}/.envs/.production/.jitsi-cfg/{web/letsencrypt,transcripts,prosody,jicofo,jvb}
 sed -i "s/JICOFO_COMPONENT_SECRET.*/JICOFO_COMPONENT_SECRET=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
 sed -i "s/JICOFO_AUTH_PASSWORD.*/JICOFO_AUTH_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
 sed -i "s/JVB_AUTH_PASSWORD.*/JVB_AUTH_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
 sed -i "s/JIGASI_XMPP_PASSWORD.*/JIGASI_XMPP_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
 sed -i "s/JIBRI_RECORDER_PASSWORD.*/JIBRI_RECORDER_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
 sed -i "s/JIBRI_XMPP_PASSWORD.*/JIBRI_XMPP_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
 chmod 600 $JITSI_PROD_FILE
@@ -1,10 +0,0 @@
 #!/bin/bash
 # generate nextcloud .env files
 NEXTCLOUD_PROD_FILE="$1"
 #NEXTCLOUD_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
 NEXTCLOUD_PASSWORD="${MISTBORN_DEFAULT_PASSWORD}"
 echo "NEXTCLOUD_ADMIN_USER=mistborn" > $NEXTCLOUD_PROD_FILE
 echo "NEXTCLOUD_ADMIN_PASSWORD=$NEXTCLOUD_PASSWORD" >> $NEXTCLOUD_PROD_FILE
 echo "NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.mistborn" >> $NEXTCLOUD_PROD_FILE
 chmod 600 $NEXTCLOUD_PROD_FILE
@@ -1,8 +0,0 @@
 #!/bin/bash
 # generate onlyoffice .env files
 ONLYOFFICE_PROD_FILE="$1"
 JWT_SECRET="${MISTBORN_DEFAULT_PASSWORD}"
 echo "JWT_ENABLED=true" > $ONLYOFFICE_PROD_FILE
 echo "JWT_SECRET=$JWT_SECRET" >> $ONLYOFFICE_PROD_FILE
 chmod 600 $ONLYOFFICE_PROD_FILE
@@ -1,6 +0,0 @@
 #!/bin/bash
 # RaspAP
 RASPAP_PROD_FILE="$1"
 echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" > $RASPAP_PROD_FILE
 chmod 600 $RASPAP_PROD_FILE
@@ -1,15 +0,0 @@
 #!/bin/bash
 # generate rocketchat .env files
 ROCKETCHAT_PROD_FILE="$1"
 #ROCKETCHAT_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
 ROCKETCHAT_PASSWORD="${MISTBORN_DEFAULT_PASSWORD}"
 echo "ROCKETCHAT_USER=bot" > $ROCKETCHAT_PROD_FILE
 echo "ROCKETCHAT_ROOM=GENERAL" >> $ROCKETCHAT_PROD_FILE
 echo "BOT_NAME=bot" >> $ROCKETCHAT_PROD_FILE
 echo "ROCKETCHAT_PASSWORD=$ROCKETCHAT_PASSWORD" >> $ROCKETCHAT_PROD_FILE
 # docker environment
 echo "MISTBORN_BIND_IP=${MISTBORN_BIND_IP}" >> $ROCKETCHAT_PROD_FILE
 chmod 600 $ROCKETCHAT_PROD_FILE
@@ -1,16 +0,0 @@
 #!/bin/bash
 # Scirius
 SCIRIUS_PROD_FILE="$1"
 SCIRIUS_SECRET_KEY=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(50)]))")
 echo "SECRET_KEY=$SCIRIUS_SECRET_KEY" > $SCIRIUS_PROD_FILE
 echo "ALLOWED_HOSTS=scirius.mistborn" >> $SCIRIUS_PROD_FILE
 echo "DJANGO_SUPERUSER_USERNAME=mistborn" >> $SCIRIUS_PROD_FILE
 echo "DJANGO_SUPERUSER_EMAIL=mistborn@email.mistborn" >> $SCIRIUS_PROD_FILE
 echo "ELASTICSEARCH_HOST=10.2.3.1" >> $SCIRIUS_PROD_FILE
 echo "KIBANA_HOST=wazuh.mistborn" >> $SCIRIUS_PROD_FILE
 echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $SCIRIUS_PROD_FILE
 chmod 600 $SCIRIUS_PROD_FILE
@@ -1,92 +0,0 @@
 #!/bin/bash
 # Wazuh
 WAZUH_PROD_FILE="$1"
 echo "ELASTIC_USERNAME=mistborn" > $WAZUH_PROD_FILE
 echo "ELASTIC_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
 echo "ELASTICSEARCH_USERNAME=mistborn" >> $WAZUH_PROD_FILE
 echo "ELASTICSEARCH_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
 # kibana odfe
 # kibana-odfe/config/wazuh_app_config.sh
 # https://wazuh
 echo "WAZUH_API_URL=https://10.2.3.1" >> $WAZUH_PROD_FILE
 echo "API_PORT=55000" >> $WAZUH_PROD_FILE
 echo "API_USERNAME=wazuh-wui" >> $WAZUH_PROD_FILE
 #API_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
 API_PASSWORD_PYTHON=$(cat << EOF
 import secrets
 import random
 import string
 random_pass = ([secrets.choice("@$!*?-"),
                           secrets.choice(string.digits),
                           secrets.choice(string.ascii_lowercase),
                           secrets.choice(string.ascii_uppercase),
                           ]
                          + [secrets.choice(string.ascii_lowercase
                                           + string.ascii_uppercase
                                           + "@$!*?-"
                                           + string.digits) for i in range(12)])
 random.shuffle(random_pass)
 random_pass = ''.join(random_pass)
 print(random_pass)
 EOF
 )
 API_PASSWORD=$(python3 -c "${API_PASSWORD_PYTHON}")
 echo "API_PASSWORD=${API_PASSWORD}" >> $WAZUH_PROD_FILE
 # kibana-odfe/config/entrypoint.sh:
 # https://elasticsearch:9200
 echo "ELASTICSEARCH_URL=https://10.2.3.1:9200" >> $WAZUH_PROD_FILE
 cat >> ${WAZUH_PROD_FILE}<< EOF
 PATTERN="wazuh-alerts-*"
 CHECKS_PATTERN=true
 CHECKS_TEMPLATE=true
 CHECKS_API=true
 CHECKS_SETUP=true
 EXTENSIONS_PCI=true
 EXTENSIONS_GDPR=true
 EXTENSIONS_HIPAA=true
 EXTENSIONS_NIST=true
 EXTENSIONS_TSC=true
 EXTENSIONS_AUDIT=true
 EXTENSIONS_OSCAP=false
 EXTENSIONS_CISCAT=false
 EXTENSIONS_AWS=false
 EXTENSIONS_GCP=false
 EXTENSIONS_VIRUSTOTAL=true
 EXTENSIONS_OSQUERY=true
 EXTENSIONS_DOCKER=true
 APP_TIMEOUT=20000
 API_SELECTOR=true
 IP_SELECTOR=true
 IP_IGNORE="[]"
 WAZUH_MONITORING_ENABLED=true
 WAZUH_MONITORING_FREQUENCY=900
 WAZUH_MONITORING_SHARDS=2
 WAZUH_MONITORING_REPLICAS=0
 ADMIN_PRIVILEGES=true
 EOF
 echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
 chmod 600 $WAZUH_PROD_FILE
@@ -1,10 +1,9 @@
-#!/bin/bash
+#!/bin/sh
 figlet "Mistborn: Container Credentials"
 # generate production .env file for Django
 mkdir -p ./.envs/.production
 chmod 700 ./.envs
 DJANGO_PROD_FILE="./.envs/.production/.django"
 DJANGO_SECRET_KEY=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(50)]))")
 #CELERY_FLOWER_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
@@ -23,7 +22,6 @@ echo "#SENTRY_DNS=" >> $DJANGO_PROD_FILE
 echo "MISTBORN_INSTALL_COCKPIT=$MISTBORN_INSTALL_COCKPIT" >> $DJANGO_PROD_FILE
 echo "MISTBORN_PORTAL_IP=10.2.3.1" >> $DJANGO_PROD_FILE
 echo "MISTBORN_PORTAL_PORT=5000" >> $DJANGO_PROD_FILE
 chmod 600 $DJANGO_PROD_FILE
 # generate production .env file for postgresql
 POSTGRES_PROD_FILE="./.envs/.production/.postgres"
@@ -33,7 +31,6 @@ echo "POSTGRES_PORT=5432" >> $POSTGRES_PROD_FILE
 echo "POSTGRES_DB=mistborn" >> $POSTGRES_PROD_FILE
 echo "POSTGRES_USER=prod" >> $POSTGRES_PROD_FILE
 echo "POSTGRES_PASSWORD=$POSTGRES_PASSWORD" >> $POSTGRES_PROD_FILE
 chmod 600 $POSTGRES_PROD_FILE
 # generate production .env file for pihole
@@ -42,4 +39,36 @@ PIHOLE_PROD_FILE="./.envs/.production/.pihole"
 WEBPASSWORD="$1"
 echo "TZ=\"America/New York\"" > $PIHOLE_PROD_FILE
 echo "WEBPASSWORD=$WEBPASSWORD" >> $PIHOLE_PROD_FILE
-chmod 600 $PIHOLE_PROD_FILE
+
 # generate rocketchat .env files
 ROCKETCHAT_PROD_FILE="./.envs/.production/.rocketchat"
 #ROCKETCHAT_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
 ROCKETCHAT_PASSWORD="$1"
 echo "ROCKETCHAT_USER=bot" > $ROCKETCHAT_PROD_FILE
 echo "ROCKETCHAT_ROOM=GENERAL" >> $ROCKETCHAT_PROD_FILE
 echo "BOT_NAME=bot" >> $ROCKETCHAT_PROD_FILE
 echo "ROCKETCHAT_PASSWORD=$ROCKETCHAT_PASSWORD" >> $ROCKETCHAT_PROD_FILE
 # generate nextcloud .env files
 NEXTCLOUD_PROD_FILE="./.envs/.production/.nextcloud"
 #NEXTCLOUD_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
 NEXTCLOUD_PASSWORD="$1"
 echo "NEXTCLOUD_ADMIN_USER=mistborn" > $NEXTCLOUD_PROD_FILE
 echo "NEXTCLOUD_ADMIN_PASSWORD=$NEXTCLOUD_PASSWORD" >> $NEXTCLOUD_PROD_FILE
 echo "NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.mistborn" >> $NEXTCLOUD_PROD_FILE
 # generate onlyoffice .env files
 ONLYOFFICE_PROD_FILE="./.envs/.production/.onlyoffice"
 JWT_SECRET="$1"
 echo "JWT_ENABLED=true" > $ONLYOFFICE_PROD_FILE
 echo "JWT_SECRET=$JWT_SECRET" >> $ONLYOFFICE_PROD_FILE
 # generate bitwarden .env files
 BITWARDEN_PROD_FILE="./.envs/.production/.bitwarden"
 echo "WEBSOCKET_ENABLED=true" > $BITWARDEN_PROD_FILE
 echo "SIGNUPS_ALLOWED=true" >> $BITWARDEN_PROD_FILE
 # JITSI
 JITSI_PROD_FILE="./.envs/.production/.jitsi"
 cp ./scripts/conf/jitsi.env $JITSI_PROD_FILE
 mkdir -p ./.envs/.production/.jitsi-cfg/{web/letsencrypt,transcripts,prosody,jicofo,jvb}
@@ -6,7 +6,7 @@ figlet "Mistborn: Configuring Firewall"
 echo "stop iptables wrappers"
 if [ "$DISTRO" == "ubuntu" ]; then
-    echo "Disabling UFW"
+    # Disable UFW
    sudo systemctl stop ufw || true
    sudo systemctl disable ufw || true
 fi
@@ -113,11 +113,6 @@ fi
 # IP forwarding
 sudo sed -i 's/.*net.ipv4.ip_forward.*/net.ipv4.ip_forward=1/' /etc/sysctl.conf
 # VM Overcommit Memory
 sudo grep -i "vm.overcommit_memory" /etc/sysctl.conf && sudo sed -i 's/.*vm.overcommit_memory.*/vm.overcommit_memory=1/' /etc/sysctl.conf || echo "vm.overcommit_memory=1" | sudo tee -a /etc/sysctl.conf
 # Force re-read of sysctl.conf
 sudo sysctl -p /etc/sysctl.conf
 # rsyslog to create /var/log/iptables.log
@@ -1,6 +1,6 @@
 #!/bin/bash
-KEY_FOLDER="/opt/mistborn_volumes/base/tls/"
+KEY_FOLDER="./tls/"
 CRT_FILE="cert.crt"
 KEY_FILE="cert.key"
@@ -11,15 +11,11 @@ KEY_PATH="$KEY_FOLDER/$KEY_FILE"
 sudo -E apt-get install -y openssl
 # make folder
-sudo -E mkdir -p $KEY_FOLDER
+mkdir -p $KEY_FOLDER
 # clean old crt and key
 sudo -E rm -f ${KEY_FOLDER}/*
 # generate crt and key
-sudo -E openssl req -x509 -sha256 -nodes -days 397 -newkey rsa:4096 -keyout $KEY_PATH -out $CRT_PATH -addext "subjectAltName=DNS:*.mistborn,DNS:home.mistborn,DNS:jitsi.mistborn,DNS:bitwarden.mistborn,DNS:chat.mistborn,DNS:homeassistant.mistborn,DNS:jellyfin.mistborn,DNS:syncthing.mistborn,DNS:nextcloud.mistborn,DNS:onlyoffice.mistborn" -addext extendedKeyUsage=serverAuth -subj "/C=US/ST=New York/L=New York/O=cyber5k/OU=mistborn/CN=*.mistborn/emailAddress=mistborn@localhost"
+openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:4096 -keyout $KEY_PATH -out $CRT_PATH -subj "/C=US/ST=New York/L=New York/O=cyber5k/OU=mistborn/CN=*.mistborn/emailAddress=mistborn@localhost"
 # set permissions
 sudo -E chown -R mistborn:mistborn ${KEY_FOLDER}
 chmod 644 $CRT_PATH
 chmod 600 $KEY_PATH
@@ -1,22 +0,0 @@
 #!/bin/bash
 # INPUT default admin password
 while [ -z "${MISTBORN_DEFAULT_PASSWORD}" ]; do
    echo
    echo "(Mistborn) The default admin password may only container alphanumeric characters and _"
    read -p "(Mistborn) Set default admin password: " -s MISTBORN_DEFAULT_PASSWORD
    echo
    if [[ ${MISTBORN_DEFAULT_PASSWORD} =~ ^[A-Za-z0-9_]+$ ]]; then
    # it matches
        echo "(Mistborn) Password is accepted"
    else
        unset MISTBORN_DEFAULT_PASSWORD
        echo "(Mistborn) Try again"
    fi
 done
 echo
 echo "MISTBORN_DEFAULT_PASSWORD is set"
 echo
@@ -9,19 +9,18 @@ if ! $(sudo apt-cache show wireguard > /dev/null 2>&1) ; then
    echo "Adding Wireguard PPAs"
    # Wireguard
-    if [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+    if [ "$DISTRO" == "raspbian" ]; then
        echo "Adding Wireguard repo keys"
        sudo -E apt-get install -y dirmngr
-        sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 8B48AD6246925553
+        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 8B48AD6246925553
-        sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 7638D0442B90D010
+        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7638D0442B90D010
-        sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 04EE7237B7D453EC
+        sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC
        sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 648ACFD622F3D138 
    fi
    if [ "$DISTRO" == "ubuntu" ]; then
        # Ubuntu	
        sudo add-apt-repository -y ppa:wireguard/wireguard
-    elif [ "$DISTRO" == "debian" ] || [ "$DISTRO" == "raspbian" ] || [ "$DISTRO" == "raspios" ]; then
+    elif [ "$DISTRO" == "debian" ] || [ "$DISTRO" == "raspbian" ]; then
        # Debian
        sudo bash -c 'echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable.list'
        sudo bash -c "printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' > /etc/apt/preferences.d/limit-unstable"
@@ -10,21 +10,19 @@ sudo git -C /opt/mistborn submodule update --init --recursive
 # ensure mistborn-cli is installed
 sudo pip3 install -e /opt/mistborn/modules/mistborn-cli
 # handle updates to Mistborn systemd scripts
 iface=$(ip -o -4 route show to default | egrep -o 'dev [^ ]*' | awk 'NR==1{print $2}')
 sudo cp /opt/mistborn/scripts/services/Mistborn* /etc/systemd/system/
 sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/User=root/User=mistborn/"
 sudo find /etc/systemd/system/ -type f -name 'Mistborn*' | xargs sudo sed -i "s/DIFACE/$iface/"
 # handle updates to traefik
-#sudo cp /opt/mistborn/compose/production/traefik/traefik.toml.template /opt/mistborn/compose/production/traefik/traefik.toml
+sudo cp /opt/mistborn/compose/production/traefik/traefik.toml.template /opt/mistborn/compose/production/traefik/traefik.toml
 sudo systemctl daemon-reload
 sudo systemctl enable Mistborn-setup.service
 sudo systemctl restart Mistborn-setup.service
 sudo mistborn-cli pullbuild
 sudo docker container prune -f
 sudo docker image prune -f
 # RESTART
 sudo systemctl stop Mistborn-base
 # docker daemon
 #source ./scripts/subinstallers/docker_daemon.sh
 sudo systemctl restart Mistborn-setup
 sudo systemctl restart Mistborn-base
@@ -1,51 +0,0 @@
 #!/bin/bash
 set -e
 MISTBORN_HOME="/opt/mistborn"
 SERVICES="$1"
 shift
 IFS=','
 read -ra SERVICES_ARRAY <<< "${SERVICES}"
 for SERVICE in "${SERVICES_ARRAY[@]}"; do
    MISTBORN_SERVICE_FILE=${MISTBORN_HOME}/.envs/.production/.${SERVICE}
    MISTBORN_SERVICE_INIT=${MISTBORN_HOME}/scripts/services/${SERVICE}/init.sh
    # check and create file if needed
    ${MISTBORN_HOME}/scripts/env/check_env_file.sh ${SERVICE}
    # read in variables
    set -a
    source ${MISTBORN_HOME}/.env
    if [[ -f "${MISTBORN_SERVICE_FILE}" ]]; then
        echo "Loading service variables"
        source ${MISTBORN_SERVICE_FILE}
    else
        echo "No service variables to load. Proceeding."
    fi
    set +a
    # init script
    if [[ -f "${MISTBORN_SERVICE_INIT}" ]]; then
        echo "Running init script"
        ${MISTBORN_SERVICE_INIT}
    else
        echo "No init script. Proceeding."
    fi
 done
 # ensure base is up and listening
 echo "Checking that Mistborn-base has finished starting up..."
 while ! nc -z 10.2.3.1 5000; do
    WAIT_TIME=$((5 + $RANDOM % 15))
    echo "Waiting ${WAIT_TIME} seconds for Mistborn-base..."
    sleep ${WAIT_TIME}
 done
 echo "Mistborn-base is running"
 exec "$@"
Author	SHA1	Message	Date
Steven Foerster	d2c0c22e6f	Merge branch 'master' into onlyoffice	2020-07-30 11:51:01 -04:00
Steven Foerster	61b0b43143	Merge branch 'master' into onlyoffice	2020-04-29 17:18:03 -04:00
Steven Foerster	c069380c08	overlay network	2020-04-16 08:42:28 -04:00
Steven Foerster	b5b0098839	ports open on host network	2020-04-15 17:39:40 -04:00
Steven Foerster	f795c1adba	host network	2020-04-15 17:36:05 -04:00
Steven Foerster	65ba62be28	onlyoffice ip address	2020-04-15 17:06:11 -04:00
Steven Foerster	20f9a8cc47	Merge branch 'master' into onlyoffice	2020-04-15 15:41:56 -04:00
Steven Foerster	2deb58b4f5	Merge branch 'master' into onlyoffice	2020-03-19 09:36:58 -04:00
Steven Foerster	3466d8e874	fixed network address space	2020-03-11 19:02:07 -04:00
Steven Foerster	2d6a33610b	tweaks	2020-03-11 17:11:07 -04:00
Steven Foerster	30a225cdc0	depends on	2020-03-11 16:35:57 -04:00
Steven Foerster	2bd302f051	depends on	2020-03-11 13:36:59 -04:00
Steven Foerster	ec2a978351	default network	2020-03-11 13:34:42 -04:00
Steven Foerster	2ef003bac9	mysql server	2020-03-11 13:33:34 -04:00
Steven Foerster	6eeb624829	latest community server image	2020-03-11 12:50:08 -04:00
Steven Foerster	54150a64d1	onlyoffice mail server and community server	2020-03-11 12:36:06 -04:00