ConfigLMM 0.2.0 → 0.4.0

data/Plugins/Apps/Odoo/Odoo.conf.erb

@@ -1,29 +1,46 @@
 
 upstream odoo {
-    server 127.0.0.1:8069;
+    <% if config['Server'] %>
+        server <%= config['Server'] %>;
+    <% else %>
+        server 127.0.0.1:8069;
+    <% end %>
 }
 
 server {
 
-    <% if !config['TLS'] %>
-        listen       <%= config['Port'] %>;
-        listen  [::]:<%= config['Port'] %>;
-    <% else %>
-        listen       <%= config['Port'] %> ssl;
-        listen  [::]:<%= config['Port'] %> ssl;
+    <% if config['NginxVersion'] >= 1.25 %>
+        <% if !config['TLS'] %>
+            listen       <%= config['Port'] %>;
+            listen  [::]:<%= config['Port'] %>;
+        <% else %>
+            listen       <%= config['Port'] %> ssl;
+            listen  [::]:<%= config['Port'] %> ssl;
+
+            include config-lmm/ssl.conf;
+        <% end %>
         http2 on;
-        include config/ssl.conf;
+        http3 on;
+        quic_retry on;
+        add_header Alt-Svc 'h3=":443"; ma=86400';
+    <% else %>
+        <% if !config['TLS'] %>
+            listen       <%= config['Port'] %>;
+            listen  [::]:<%= config['Port'] %>;
+        <% else %>
+            listen       <%= config['Port'] %> ssl http2;
+            listen  [::]:<%= config['Port'] %> ssl http2;
+
+            include config-lmm/ssl.conf;
+        <% end %>
     <% end %>
 
     server_name <%= config['Domain'] %>;
 
-    root        /usr/share/nginx/html;
-    index       index.html index.htm;
     access_log  /var/log/nginx/odoo.access.log;
     error_log   /var/log/nginx/odoo.error.log;
 
-    include config/private.conf;
-    include config/errors.conf;
+    include config-lmm/errors.conf;
 
     location / {
         proxy_pass  http://odoo;
@@ -31,7 +48,7 @@ server {
         proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
         proxy_redirect off;
 
-        include config/proxy.conf;
+        include config-lmm/proxy.conf;
     }
 
     # cache some static data in memory for 60mins

data/Plugins/Apps/Odoo/Odoo.container

@@ -0,0 +1,18 @@
+
+[Unit]
+Description=Odoo container
+After=local-fs.target
+
+[Container]
+Image=docker.io/odoo:latest
+EnvironmentFile=/var/lib/odoo/.config/containers/systemd/Odoo.env
+Network=slirp4netns:allow_host_loopback=true
+PublishPort=0.0.0.0:8069:8069
+UserNS=keep-id:uid=101,gid=101
+Volume=/var/lib/odoo/config:/etc/odoo
+Volume=/var/lib/odoo/data:/var/lib/odoo
+Volume=/var/lib/odoo/addons:/mnt/extra-addons
+AutoUpdate=registry
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/Odoo/Odoo.lmm.rb

@@ -3,6 +3,9 @@ module ConfigLMM
     module LMM
         class Odoo < Framework::NginxApp
 
+            USER = 'odoo'
+            HOME_DIR = '/var/lib/odoo'
+
             def actionOdooBuild(id, target, state, context, options)
                 writeNginxConfig(__dir__, 'Odoo', id, target, state, context, options)
             end
@@ -12,12 +15,69 @@ module ConfigLMM
             end
 
             def actionOdooDeploy(id, target, activeState, context, options)
-                if !target['Location'] || target['Location'] == '@me'
-                    deployNginxConfig(id, target, activeState, context, options)
+                target['Database'] ||= {}
+                if target['Location'] && target['Location'] != '@me'
+                    uri = Addressable::URI.parse(target['Location'])
+                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
+
+                    self.class.sshStart(uri) do |ssh|
+
+                        if !target.key?('Proxy') || target['Proxy'] != 'only'
+                            dbPassword = self.configurePostgreSQL(target['Database'], ssh)
+                            distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
+                            Framework::LinuxApp.configurePodmanServiceOverSSH(USER, HOME_DIR, 'Odoo', distroInfo, ssh)
+                            self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'mkdir -p ~/config'")
+                            self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'mkdir -p ~/data'")
+                            self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'mkdir -p ~/addons'")
+
+                            path = Framework::LinuxApp::SYSTEMD_CONTAINERS_PATH.gsub('~', HOME_DIR)
+                            dbHost = '10.0.2.2'
+                            dbHost = target['Database']['HostName'] if target['Database']['HostName']
+
+                            self.class.sshExec!(ssh, " echo 'HOST=#{dbHost}' > #{path}/Odoo.env")
+                            self.class.sshExec!(ssh, " echo 'USER=#{USER}' >> #{path}/Odoo.env")
+                            self.class.sshExec!(ssh, " echo 'PASSWORD=#{dbPassword}' >> #{path}/Odoo.env")
+                            self.class.sshExec!(ssh, "chown #{USER}:#{USER} #{path}/Odoo.env")
+                            self.class.sshExec!(ssh, "chmod 600 #{path}/Odoo.env")
+
+                            ssh.scp.upload!(__dir__ + '/Odoo.container', path)
+                            ssh.scp.upload!(__dir__ + '/odoo.conf', HOME_DIR + '/config/')
+                            self.class.sshExec!(ssh, "chown #{USER}:#{USER} #{HOME_DIR}/config/odoo.conf")
+                            self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ daemon-reload")
+                            self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ start Odoo")
+                        end
+
+                        if !target.key?('Proxy') || target['Proxy'] == true || target['Proxy'] == 'only'
+                            raise Framework::PluginProcessError.new('Domain field must be set!') unless target['Domain']
+
+                            Framework::LinuxApp.ensurePackages([NGINX_PACKAGE], ssh)
+                            Framework::LinuxApp.ensureServiceAutoStartOverSSH(NGINX_PACKAGE, ssh)
+                            self.class.prepareNginxConfig(target, ssh)
+                            self.writeNginxConfig(__dir__, 'Odoo', id, target, state, context, options)
+                            self.deployNginxConfig(id, target, activeState, context, options)
+                            Framework::LinuxApp.startServiceOverSSH(NGINX_PACKAGE, ssh)
+                        end
+
+                        Framework::LinuxApp.firewallAddPortOverSSH('8069/tcp', uri)
+                    end
+                else
+                    if !target.key?('Proxy') || target['Proxy'] == true || target['Proxy'] == 'only'
+                        deployNginxConfig(id, target, activeState, context, options)
+                    end
                     activeState['Location'] = '@me'
                 end
             end
 
+            def configurePostgreSQL(settings, ssh)
+                user = USER
+                password = SecureRandom.alphanumeric(20)
+                PostgreSQL.executeRemotely(settings, ssh) do |ssh|
+                    self.class.sshExec!(ssh, "su --login #{PostgreSQL::USER_NAME} --command 'createuser --createdb #{user}'", true)
+                    PostgreSQL.executeSQL("ALTER USER #{user} WITH PASSWORD '#{password}'", nil, ssh)
+                end
+                password
+            end
+
         end
     end
 end

data/Plugins/Apps/Odoo/odoo.conf

@@ -0,0 +1,37 @@
+[options]
+addons_path = /mnt/extra-addons
+data_dir = /var/lib/odoo
+; admin_passwd = admin
+; csv_internal_sep = ,
+; db_maxconn = 64
+; db_name = False
+; db_template = template1
+; dbfilter = .*
+; debug_mode = False
+; email_from = False
+; limit_memory_hard = 2684354560
+; limit_memory_soft = 2147483648
+; limit_request = 8192
+; limit_time_cpu = 60
+; limit_time_real = 120
+list_db = False
+; log_db = False
+; log_handler = [':INFO']
+; log_level = info
+; logfile = None
+; longpolling_port = 8072
+; max_cron_threads = 2
+; osv_memory_age_limit = 1.0
+; osv_memory_count_limit = False
+; smtp_password = False
+; smtp_port = 25
+; smtp_server = localhost
+; smtp_ssl = False
+; smtp_user = False
+; workers = 0
+; xmlrpc = True
+; xmlrpc_interface =
+; xmlrpc_port = 8069
+; xmlrpcs = True
+; xmlrpcs_interface =
+; xmlrpcs_port = 8071

data/Plugins/Apps/OpenVidu/Ingress.container

@@ -0,0 +1,18 @@
+
+[Unit]
+Description=LiveKit Ingress container
+After=local-fs.target
+
+[Container]
+Image=docker.io/livekit/ingress:latest
+EnvironmentFile=/var/lib/openvidu/.config/containers/systemd/OpenVidu.env
+Network=slirp4netns:allow_host_loopback=true
+PublishPort=127.0.0.1:1935:1935
+PublishPort=127.0.0.1:8085:8085
+PublishPort=127.0.0.1:7895:7895/udp
+UserNS=keep-id:uid=1000,gid=1000
+Volume=/var/lib/openvidu/ingress.yaml:/etc/ingress.yaml
+AutoUpdate=registry
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/OpenVidu/OpenVidu.conf.erb

@@ -0,0 +1,34 @@
+
+server {
+    <% if config['NginxVersion'] >= 1.25 %>
+        listen 443 ssl;
+        listen [::]:443 ssl;
+        http2 on;
+        http3 on;
+        quic_retry on;
+        add_header Alt-Svc 'h3=":443"; ma=86400';
+    <% else %>
+        listen 443 ssl http2;
+        listen [::]:443 ssl http2;
+    <% end %>
+
+    include config-lmm/ssl.conf;
+
+    server_name <%= config['Domain'] %>;
+
+    <% if config['CertName'] %>
+        ssl_certificate "/etc/letsencrypt/live/<%= config['CertName'] %>/fullchain.pem";
+        ssl_certificate_key "/etc/letsencrypt/live/<%= config['CertName'] %>/privkey.pem";
+        ssl_trusted_certificate "/etc/letsencrypt/live/<%= config['CertName'] %>/chain.pem";
+    <% end %>
+
+    access_log  /var/log/nginx/openvidu.access.log;
+    error_log   /var/log/nginx/openvidu.error.log;
+
+    # Proxy site
+    location / {
+        proxy_pass http://127.0.0.1:7880;
+        include config-lmm/proxy.conf;
+    }
+
+}

data/Plugins/Apps/OpenVidu/OpenVidu.container

@@ -0,0 +1,16 @@
+
+[Unit]
+Description=OpenVidu container
+After=local-fs.target
+
+[Container]
+Image=docker.io/openvidu/openvidu-server:main
+Exec=--config /etc/livekit.yaml --bind=$BindIP
+EnvironmentFile=/var/lib/openvidu/.config/containers/systemd/OpenVidu.env
+Network=host
+UserNS=keep-id:uid=1000,gid=1000
+Volume=/var/lib/openvidu/livekit.yaml:/etc/livekit.yaml
+AutoUpdate=registry
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/OpenVidu/OpenVidu.lmm.rb

@@ -0,0 +1,90 @@
+
+module ConfigLMM
+    module LMM
+        class OpenVidu < Framework::NginxApp
+
+            USER = 'openvidu'
+            HOME_DIR = '/var/lib/openvidu'
+            HOST_IP = '10.0.2.2'
+
+            def actionOpenViduDeploy(id, target, activeState, context, options)
+                raise Framework::PluginProcessError.new('Domain field must be set!') unless target['Domain']
+                raise Framework::PluginProcessError.new('CallDomain field must be set!') unless target['CallDomain']
+
+                if target['Location'] && target['Location'] != '@me'
+                    uri = Addressable::URI.parse(target['Location'])
+                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
+
+                    self.class.sshStart(uri) do |ssh|
+
+                        distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
+                        Framework::LinuxApp.configurePodmanServiceOverSSH(USER, HOME_DIR, 'OpenVidu', distroInfo, ssh)
+
+                        secretKey = SecureRandom.alphanumeric(40)
+                        bindIp = target['BindIP']
+                        bindIp = '127.0.0.1' unless bindIp
+
+                        path = Framework::LinuxApp::SYSTEMD_CONTAINERS_PATH.gsub('~', HOME_DIR)
+                        self.class.exec("echo 'INGRESS_CONFIG_FILE=/etc/ingress.yaml' > #{path}/OpenVidu.env", ssh)
+                        self.class.exec("echo 'LIVEKIT_URL=wss://#{target['Domain']}' >> #{path}/OpenVidu.env", ssh)
+                        self.class.exec("echo 'LIVEKIT_API_KEY=Main' >> #{path}/OpenVidu.env", ssh)
+                        self.class.exec("echo 'LIVEKIT_API_SECRET=#{secretKey}' >> #{path}/OpenVidu.env", ssh)
+                        self.class.exec("echo 'CALL_PRIVATE_ACCESS=true' >> #{path}/OpenVidu.env", ssh)
+                        self.class.exec("echo 'CALL_USER=guest' >> #{path}/OpenVidu.env", ssh)
+                        callSecret = SecureRandom.alphanumeric(20)
+                        prompt.say("OpenVidu Call guest password: #{callSecret}", :color => :magenta)
+                        self.class.exec("echo 'CALL_SECRET=#{callSecret}' >> #{path}/OpenVidu.env", ssh)
+                        self.class.exec("echo 'CALL_ADMIN_USER=admin' >> #{path}/OpenVidu.env", ssh)
+                        callAdminSecret = SecureRandom.alphanumeric(20)
+                        prompt.say("OpenVidu Call admin password: #{callAdminSecret}", :color => :magenta)
+                        self.class.exec("echo 'CALL_ADMIN_SECRET=#{callAdminSecret}' >> #{path}/OpenVidu.env", ssh)
+
+                        ssh.scp.upload!(__dir__ + '/livekit.yaml', HOME_DIR)
+                        ssh.scp.upload!(__dir__ + '/ingress.yaml', HOME_DIR)
+
+                        self.class.exec("sed -i 's|$SECRET|#{secretKey}|'  #{HOME_DIR}/livekit.yaml", ssh)
+
+                        if target['Valkey']
+                            self.class.exec("sed -i 's|10.0.2.2|#{target['Valkey']['Host']}|'  #{HOME_DIR}/ingress.yaml", ssh) if target['Valkey']['Host']
+                        end
+                        if ENV['VALKEY_PASSWORD']
+                            self.class.exec("sed -i 's|password:|password: #{ENV['VALKEY_PASSWORD']}|'  #{HOME_DIR}/ingress.yaml", ssh)
+                        end
+
+                        self.class.exec("chown #{USER}:#{USER} #{path}/OpenVidu.env #{HOME_DIR}/livekit.yaml #{HOME_DIR}/ingress.yaml", ssh)
+                        self.class.exec("chmod 600 #{path}/OpenVidu.env #{HOME_DIR}/livekit.yaml #{HOME_DIR}/ingress.yaml", ssh)
+
+                        ssh.scp.upload!(__dir__ + '/OpenVidu.container', path)
+                        ssh.scp.upload!(__dir__ + '/OpenViduCall.container', path)
+                        ssh.scp.upload!(__dir__ + '/Ingress.container', path)
+
+                        self.class.exec("sed -i 's|$BindIP|#{bindIp}|'  #{path}/OpenVidu.container", ssh)
+
+                        Framework::LinuxApp.firewallAddPortOverSSH('7881/tcp', ssh)
+                        Framework::LinuxApp.firewallAddPortOverSSH('7900-7999/udp', ssh)
+                        Framework::LinuxApp.firewallAddPortOverSSH('45000-55000/udp', ssh)
+
+                        self.class.exec("systemctl --user --machine=#{USER}@ daemon-reload", ssh)
+                        self.class.exec("systemctl --user --machine=#{USER}@ restart OpenVidu", ssh)
+                        self.class.exec("systemctl --user --machine=#{USER}@ restart OpenViduCall", ssh)
+                        self.class.exec("systemctl --user --machine=#{USER}@ restart Ingress", ssh)
+
+                        Framework::LinuxApp.ensurePackages([NGINX_PACKAGE], ssh)
+                        Framework::LinuxApp.ensureServiceAutoStartOverSSH(NGINX_PACKAGE, ssh)
+                        self.class.prepareNginxConfig(target, ssh)
+                        target['CallDomain'] = Addressable::IDNA.to_ascii(target['CallDomain'])
+                        self.writeNginxConfig(__dir__, 'OpenVidu', id, target, state, context, options)
+                        self.writeNginxConfig(__dir__, 'OpenViduCall', id, target, state, context, options)
+                        self.deployNginxConfig(id, target, activeState, context, options)
+                        Framework::LinuxApp.startServiceOverSSH(NGINX_PACKAGE, ssh)
+
+                    end
+                else
+                    # TODO
+                end
+            end
+
+        end
+    end
+end
+

data/Plugins/Apps/OpenVidu/OpenViduCall.conf.erb

@@ -0,0 +1,35 @@
+
+server {
+    <% if config['NginxVersion'] >= 1.25 %>
+        listen 443 ssl;
+        listen [::]:443 ssl;
+        http2 on;
+        http3 on;
+        quic_retry on;
+        add_header Alt-Svc 'h3=":443"; ma=86400';
+    <% else %>
+        listen 443 ssl http2;
+        listen [::]:443 ssl http2;
+    <% end %>
+
+    include config-lmm/ssl.conf;
+
+    server_name <%= config['CallDomain'] %>;
+
+    <% if config['CallCertName'] %>
+        ssl_certificate "/etc/letsencrypt/live/<%= config['CallCertName'] %>/fullchain.pem";
+        ssl_certificate_key "/etc/letsencrypt/live/<%= config['CallCertName'] %>/privkey.pem";
+        ssl_trusted_certificate "/etc/letsencrypt/live/<%= config['CallCertName'] %>/chain.pem";
+    <% end %>
+
+    access_log  /var/log/nginx/openvidu-call.access.log;
+    error_log   /var/log/nginx/openvidu-call.error.log;
+
+    # Proxy site
+    location / {
+        proxy_pass http://127.0.0.1:6080;
+        include config-lmm/proxy.conf;
+    }
+
+}
+

data/Plugins/Apps/OpenVidu/OpenViduCall.container

@@ -0,0 +1,15 @@
+
+
+[Unit]
+Description=OpenVidu Call container
+After=local-fs.target
+
+[Container]
+Image=docker.io/openvidu/openvidu-call:main
+EnvironmentFile=/var/lib/openvidu/.config/containers/systemd/OpenVidu.env
+PublishPort=127.0.0.1:6080:6080
+UserNS=keep-id:uid=1000,gid=1000
+AutoUpdate=registry
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/OpenVidu/ingress.yaml

@@ -0,0 +1,10 @@
+redis:
+    address: 10.0.2.2:6379
+    username: ""
+    password:
+
+cpu_cost:
+    rtmp_cpu_cost: 2
+    whip_cpu_cost: 2
+    whip_bypass_transcoding_cpu_cost: 0.1
+    url_cpu_cost: 2

data/Plugins/Apps/OpenVidu/livekit.yaml

@@ -0,0 +1,13 @@
+keys:
+    Main: $SECRET
+
+rtc:
+    tcp_port: 7881
+    port_range_start: 7900
+    port_range_end: 7999
+
+turn:
+    enabled: true
+    udp_port: 3478
+    relay_range_start: 45000
+    relay_range_end: 55000

data/Plugins/Apps/PHP-FPM/PHP-FPM.lmm.rb

@@ -0,0 +1,95 @@
+
+module ConfigLMM
+    module LMM
+        class PHP_FPM < Framework::LinuxApp
+
+            PHPFPM_PACKAGE = 'PHP-FPM'
+            PHPFPM_SERVICE = 'php-fpm'
+
+            def self.writeConfig(name, target, distroInfo, configLines)
+                target['PHP-FPM'] ||= {}
+
+                configLines << "[#{name}]\n"
+                configLines << "user = #{target['User']}\n"
+                configLines << "group = #{target['User']}\n"
+                if target['Listen']
+                    configLines << "listen = #{target['Listen']}\n"
+                else
+                    configLines << "listen = /run/php-fpm/#{name}.sock\n"
+                    configLines << "listen.owner = #{target['User']}\n"
+                    group = 'http'
+                    group = 'nginx' if distroInfo['Name'] == 'openSUSE Leap'
+                    configLines << "listen.group = #{group}\n"
+                end
+                configLines << "pm = dynamic\n"
+                configLines << "pm.max_children = 5\n"
+                configLines << "pm.min_spare_servers = 1\n"
+                configLines << "pm.max_spare_servers = 3\n"
+                configLines << "pm.start_servers = 2\n"
+                configLines << "access.log = /var/log/php/$pool.access.log\n"
+                if target['PHP-FPM']['chdir']
+                    configLines << "chdir = #{target['PHP-FPM']['chdir']}\n"
+                else
+                    configLines << "chdir = #{self.webappsDir(distroInfo)}$pool\n"
+                end
+                configLines << "php_admin_value[error_log] = /var/log/php/$pool.errors.log\n"
+                configLines << "php_admin_flag[log_errors] = on\n"
+                configLines << "php_admin_value[memory_limit] = 1G\n"
+                configLines << "php_admin_value[mail.log] = /var/log/php/$pool.mail.log\n"
+            end
+
+            def self.phpConfig(distroInfo)
+                if distroInfo['Name'] == 'openSUSE Leap'
+                    '/etc/php8/fpm/php.ini'
+                else
+                    '/etc/php/php.ini'
+                end
+            end
+
+            def self.peclInstallOverSSH(name, ssh)
+                self.sshExec!(ssh, "printf \"\\n\" | pecl install #{name}", true)
+            end
+
+            def self.enableExtensionOverSSH(name, distroInfo, ssh)
+                phpFile = self.phpConfig(distroInfo)
+                if self.remoteFileContains?(phpFile, "extension=#{name}", ssh)
+                    self.sshExec!(ssh, "sed -i 's|^;extension=#{name}|extension=#{name}|' #{phpFile}")
+                else
+                    self.sshExec!(ssh, "sed -i 's|extension=zip|extension=zip\\nextension=#{name}|' #{phpFile}")
+                end
+            end
+
+            def self.configFileDir(distroInfo)
+                if distroInfo['Name'] == 'openSUSE Leap'
+                    '/etc/php8/fpm/'
+                else
+                    '/etc/php/'
+                end
+            end
+
+            def self.configDir(distroInfo)
+                if distroInfo['Name'] == 'openSUSE Leap'
+                    '/etc/php8/fpm/php-fpm.d/'
+                else
+                    '/etc/php/php-fpm.d/'
+                end
+            end
+
+            def self.webappsDir(distroInfo)
+                if distroInfo['Name'] == 'openSUSE Leap'
+                    '/srv/www/htdocs/'
+                else
+                    '/usr/share/webapps/'
+                end
+            end
+
+            def self.fixConfigFileOverSSH(distroInfo, ssh)
+                dir = self.configFileDir(distroInfo)
+                if !self.remoteFilePresent?(dir + 'php-fpm.conf', ssh)
+                    self.sshExec!(ssh, "cp #{dir}php-fpm.conf.default #{dir}php-fpm.conf")
+                end
+            end
+
+        end
+    end
+end

data/Plugins/Apps/Peppermint/Peppermint.conf.erb

@@ -0,0 +1,60 @@
+
+server {
+
+    <% if !config['TLS'] %>
+        listen       <%= config['Port'] %>;
+        listen  [::]:<%= config['Port'] %>;
+    <% else %>
+        <% if config['NginxVersion'] >= 1.25 %>
+            listen <%= config['Port'] %> ssl;
+            listen [::]:<%= config['Port'] %> ssl;
+            http2 on;
+            http3 on;
+            quic_retry on;
+            add_header Alt-Svc 'h3=":<%= config['Port'] %>"; ma=86400';
+        <% else %>
+            listen <%= config['Port'] %> ssl http2;
+            listen [::]:<%= config['Port'] %> ssl http2;
+        <% end %>
+
+        include config-lmm/ssl.conf;
+    <% end %>
+
+    server_name <%= config['Domain'] %>;
+
+    access_log  /var/log/nginx/peppermint.access.log;
+    error_log   /var/log/nginx/peppermint.error.log;
+
+    include config-lmm/errors.conf;
+    include config-lmm/security.conf;
+
+    client_max_body_size 10M;
+
+    location / {
+        <% if config['Server'] %>
+            proxy_pass <%= config['Server'] %>;
+        <% else %>
+            proxy_pass http://127.0.0.1:13000;
+        <% end %>
+
+        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+
+        include config-lmm/proxy.conf;
+        proxy_redirect off;
+        proxy_read_timeout 5m;
+    }
+
+    location /api/ {
+        <% if config['Server'] %>
+            proxy_pass <%= config['Server'] %>;
+        <% else %>
+            proxy_pass http://127.0.0.1:15003/;
+        <% end %>
+
+        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+
+        include config-lmm/proxy.conf;
+        proxy_redirect off;
+        proxy_read_timeout 5m;
+    }
+}

data/Plugins/Apps/Peppermint/Peppermint.container

@@ -0,0 +1,15 @@
+
+[Unit]
+Description=Peppermint Ticket Management container
+After=local-fs.target
+
+[Container]
+Image=docker.io/pepperlabs/peppermint:latest
+EnvironmentFile=/var/lib/peppermint/.config/containers/systemd/Peppermint.env
+Network=slirp4netns:allow_host_loopback=true
+PublishPort=127.0.0.1:13000:3000
+PublishPort=127.0.0.1:15003:5003
+AutoUpdate=registry
+
+[Install]
+WantedBy=multi-user.target default.target