traefik: trust cloudflared forwarded headers on tunnel entrypoint

- Replaced stale /usr/local/bin/tangle-deploy (no (require 'ob-shell))
  with correct repo version — was writing crowdsecLapiKey: nil every 5min
- Added chmod +x to tangle-deploy.sh so git pull doesn't strip exec bit
- Added oidc-rewrite-proxy.py and oidc-proxy.service as tangle targets
- Documented Gitea OIDC discovery rewrite fix
- Added systemd unit detection to tangle-deploy restart logic
- Updated changelog

audiomuse.yaml

@@ -26,9 +26,9 @@ services:
       - traefik.enable=true
       - traefik.http.routers.audiomuse.service=audiomuse
       - traefik.http.routers.audiomuse.rule=Host(`audiomuse.${CLOUDFLARE_DNS_ZONE:?err}`)
-      - traefik.http.routers.audiomuse.entrypoints=tunnel
+      - traefik.http.routers.audiomuse.entrypoints=tunnel,web,secureweb
       - traefik.http.routers.audiomuse.middlewares=authentik-forwardauth@file,security-headers@file
-      - traefik.http.services.audiomuse.loadbalancer.server.scheme=http
+      - traefik.http.services.audiomuse.loadbalancer.server.port=8000
       - traefik.http.services.audiomuse.loadbalancer.server.port=8000
 
   audiomuse-worker:

tangle-deploy.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # tangle-deploy — Tangle infrastructure.org and restart affected services
-GITEA_URL='http://amr:tangle-deploy-2026@10.10.10.201:3001/amr/infrastructure.git'
+GITEA_URL='ssh://git@git.gharbeia.net:2222/amr/infrastructure.git'
 REPO_DIR="${1:-/docker/compose/infrastructure}"
 ORG_FILE="${REPO_DIR}/infrastructure.org"
 if [ -z "${1:-}" ]; then
@@ -17,13 +17,14 @@ fi
 echo "=== Tangling $ORG_FILE ==="
 emacs --batch -Q --load /usr/share/emacs/28.2/lisp/org/org-loaddefs.el \
   --eval "(require 'org)" \
-  --eval "(org-babel-tangle-file \"$ORG_FILE\")" 2>&1
+  --eval "(require 'ob-shell)" \
+  --eval '(let ((org-confirm-babel-evaluate nil)) (org-babel-tangle-file "'"$ORG_FILE"'"))' 2>&1
 echo "=== Restarting services ==="
 cd /docker/compose
-if [ -f /docker/compose/traefik-static.yaml ] || \
-   [ -f /docker/compose/traefik-internal.yaml ] || \
-   [ -f /docker/compose/traefik-internal-noauth.yaml ] || \
-   [ -f /docker/compose/traefik-dynamic.yaml ]; then
+if [ -f /docker/appdata/traefik/traefik.yaml ] || \
+   [ -f /docker/appdata/traefik/internal.yaml ] || \
+   [ -f /docker/appdata/traefik/internal-noauth.yaml ] || \
+   [ -f /docker/appdata/traefik/dynamic.yaml ]; then
   echo 'Traefik config changed -- restarting...'
   docker compose up -d traefik
 fi

tubearchivist.yaml

@@ -0,0 +1,63 @@
+services:
+  tubearchivist:
+    image: bbilly1/tubearchivist:latest
+    container_name: tubearchivist
+    restart: unless-stopped
+    depends_on:
+      gluetun:
+        condition: service_healthy
+        restart: true
+    network_mode: service:gluetun
+    volumes:
+      - ${FOLDER_FOR_MORE:?err}/media/youtube:/youtube
+      - ${FOLDER_FOR_DATA:?err}/tubearchivist/cache:/cache
+    environment:
+      - TZ=${TIMEZONE:?err}
+      - TA_USERNAME=${TA_USERNAME:?err}
+      - TA_PASSWORD=${TA_PASSWORD:?err}
+      - ES_URL=http://tubearchivist-es:9200
+      - REDIS_CON=redis://tubearchivist-redis:6379
+      - TA_HOST=https://tubearchivist.gharbeia.net
+      - ELASTIC_PASSWORD=tubearchivist
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.tubearchivist.service=tubearchivist
+      - traefik.http.routers.tubearchivist.rule=Host(`tubearchivist.${CLOUDFLARE_DNS_ZONE:?err}`)
+      - traefik.http.routers.tubearchivist.entrypoints=tunnel
+      - traefik.http.routers.tubearchivist.middlewares=authentik-forwardauth@file,security-headers@file,traefik-bouncer@file
+      - traefik.http.services.tubearchivist.loadbalancer.server.scheme=http
+      - traefik.http.services.tubearchivist.loadbalancer.server.port=8000
+
+  tubearchivist-es:
+    image: docker.elastic.co/elasticsearch/elasticsearch:8.17.0
+    container_name: tubearchivist-es
+    restart: unless-stopped
+    networks:
+      - networking
+    environment:
+      - discovery.type=single-node
+      - ES_JAVA_OPTS=-Xms512m -Xmx512m
+      - xpack.security.enabled=false
+      - path.repo=/usr/share/elasticsearch/data/snapshot
+    volumes:
+      - ${FOLDER_FOR_DATA:?err}/tubearchivist/es:/usr/share/elasticsearch/data
+    healthcheck:
+      test: curl -s http://localhost:9200/_cluster/health | grep -vq '"status":"red"'
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  tubearchivist-redis:
+    image: redis:7-alpine
+    container_name: tubearchivist-redis
+    restart: unless-stopped
+    networks:
+      - networking
+    command: --save 60 1 --loglevel warning
+    volumes:
+      - ${FOLDER_FOR_DATA:?err}/tubearchivist/redis:/data
+    healthcheck:
+      test: redis-cli ping | grep PONG
+      interval: 30s
+      timeout: 10s
+      retries: 3

tubearchivist_fixed.yaml

@@ -0,0 +1,65 @@
+services:
+  tubearchivist:
+    image: bbilly1/tubearchivist:latest
+    container_name: tubearchivist
+    restart: unless-stopped
+    depends_on:
+      gluetun:
+        condition: service_healthy
+        restart: true
+    network_mode: service:gluetun
+    volumes:
+      - ${FOLDER_FOR_MORE:?err}/media/youtube:/youtube
+      - ${FOLDER_FOR_DATA:?err}/tubearchivist/cache:/cache
+    environment:
+      - TZ=${TIMEZONE:?err}
+      - TA_USERNAME=${TA_USERNAME:?err}
+      - TA_PASSWORD=${TA_PASSWORD:?err}
+      - ES_URL=http://tubearchivist-es:9200
+      - REDIS_CON=redis://tubearchivist-redis:6379
+      - TA_HOST=https://tubearchivist.gharbeia.net
+      - ELASTIC_PASSWORD=tubearchivist
+      - HOST_UID=${PUID:?err}
+      - HOST_GID=${PGID:?err}
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.tubearchivist.service=tubearchivist
+      - traefik.http.routers.tubearchivist.rule=Host(`tubearchivist.${CLOUDFLARE_DNS_ZONE:?err}`)
+      - traefik.http.routers.tubearchivist.entrypoints=tunnel
+      - traefik.http.routers.tubearchivist.middlewares=authentik-forwardauth@file,security-headers@file,traefik-bouncer@file
+      - traefik.http.services.tubearchivist.loadbalancer.server.scheme=http
+      - traefik.http.services.tubearchivist.loadbalancer.server.port=8000
+
+  tubearchivist-es:
+    image: docker.elastic.co/elasticsearch/elasticsearch:8.17.0
+    container_name: tubearchivist-es
+    restart: unless-stopped
+    networks:
+      - networking
+    environment:
+      - discovery.type=single-node
+      - ES_JAVA_OPTS=-Xms512m -Xmx512m
+      - xpack.security.enabled=false
+      - path.repo=/usr/share/elasticsearch/data/snapshot
+    volumes:
+      - ${FOLDER_FOR_DATA:?err}/tubearchivist/es:/usr/share/elasticsearch/data
+    healthcheck:
+      test: curl -s http://localhost:9200/_cluster/health | grep -vq '"status":"red"'
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  tubearchivist-redis:
+    image: redis:7-alpine
+    container_name: tubearchivist-redis
+    restart: unless-stopped
+    networks:
+      - networking
+    command: --save 60 1 --loglevel warning
+    volumes:
+      - ${FOLDER_FOR_DATA:?err}/tubearchivist/redis:/data
+    healthcheck:
+      test: redis-cli ping | grep PONG
+      interval: 30s
+      timeout: 10s
+      retries: 3