From 17acafe6dbd395970034adc8e780023d6f2775f0 Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Tue, 28 Oct 2025 14:40:58 +0000
Subject: [PATCH 01/15] DCUSR: add all dcusr services

---
 jobs/socs/dcusr-bookstack.hcl    | 189 ++++++++++++++++++++++++
 jobs/socs/dcusr-dev.hcl          | 124 ++++++++++++++++
 jobs/socs/dcusr-grafana.hcl      |  59 ++++++++
 jobs/socs/dcusr-hi-events.hcl    | 149 +++++++++++++++++++
 jobs/socs/dcusr-invoiceninja.hcl | 238 +++++++++++++++++++++++++++++++
 jobs/socs/dcusr-openproject.hcl  |  79 ++++++++++
 jobs/socs/dcusr-rocketchat.hcl   | 126 ++++++++++++++++
 7 files changed, 964 insertions(+)
 create mode 100644 jobs/socs/dcusr-bookstack.hcl
 create mode 100644 jobs/socs/dcusr-dev.hcl
 create mode 100644 jobs/socs/dcusr-grafana.hcl
 create mode 100644 jobs/socs/dcusr-hi-events.hcl
 create mode 100644 jobs/socs/dcusr-invoiceninja.hcl
 create mode 100644 jobs/socs/dcusr-openproject.hcl
 create mode 100644 jobs/socs/dcusr-rocketchat.hcl

diff --git a/jobs/socs/dcusr-bookstack.hcl b/jobs/socs/dcusr-bookstack.hcl
new file mode 100644
index 0000000..6bd9fdf
--- /dev/null
+++ b/jobs/socs/dcusr-bookstack.hcl
@@ -0,0 +1,189 @@
+job "dcusr-bookstack" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "wiki.solarracing.ie"
+  }
+
+  group "bookstack" {
+    count = 1
+
+    network {
+      port "http" {
+        to = 80
+      }
+
+      port "db" {
+        to = 3306
+      }
+
+      port "redis" {
+        to = 6379
+      }
+    }
+
+    service {
+      name = "bookstack"
+      port = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.dcusr-bookstack.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.dcusr-bookstack.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-bookstack.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "bookstack" {
+      driver = "docker"
+
+      config {
+        image = "lscr.io/linuxserver/bookstack:latest"
+        ports = ["http"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/config",
+        ]
+      }
+
+      template {
+        destination = "local.env"
+        env         = true
+        data        = <<EOH
+PUID = "1000"
+PGID = "1000"
+TZ   = "Europe/Dublin"
+
+APP_URL=https://{{ env "NOMAD_META_domain" }}
+APP_KEY={{ key "socs/dcusr/bookstack/app/key" }}
+APP_AUTO_LANG_PUBLIC=false
+
+DB_HOST={{ env "NOMAD_HOST_IP_db" }}
+DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
+DB_USERNAME={{ key "socs/dcusr/bookstack/db/user" }}
+DB_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
+DB_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
+
+MAIL_DRIVER=smtp
+MAIL_HOST={{ key "socs/dcusr/bookstack/smtp/host" }}
+MAIL_PORT=587
+MAIL_ENCRYPTION=tls
+MAIL_USERNAME={{ key "socs/dcusr/bookstack/smtp/user" }}
+MAIL_PASSWORD={{ key "socs/dcusr/bookstack/smtp/password" }}
+MAIL_FROM={{ key "socs/dcusr/bookstack/smtp/user" }}
+MAIL_FROM_NAME={{ key "socs/dcusr/bookstack/smtp/name" }}
+
+REDIS_SERVERS={{ env "NOMAD_ADDR_redis" }}
+
+QUEUE_CONNECTION=redis
+CACHE_DRIVER=redis
+SESSION_DRIVER=redis
+EOH
+      }
+
+      resources {
+        cpu    = 500
+        memory = 1024
+      }
+    }
+
+    task "mariadb" {
+      driver = "docker"
+
+      config {
+        image = "mariadb:10.11"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/mysql",
+        ]
+      }
+
+      template {
+        destination = "local/.env"
+        env         = true
+        data        = <<EOH
+MYSQL_ROOT_PASSWORD={{ key "socs/dcusr/bookstack/db/root/password" }}
+MYSQL_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
+MYSQL_USER={{ key "socs/dcusr/bookstack/db/user" }}
+MYSQL_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
+EOH
+      }
+
+      resources {
+        cpu    = 500
+        memory = 1024
+      }
+    }
+
+    task "redis" {
+      driver = "docker"
+
+      config {
+        image = "redis:7-alpine"
+        ports = ["redis"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/data",
+        ]
+      }
+
+      resources {
+        cpu    = 200
+        memory = 256
+      }
+    }
+
+    task "queue-worker" {
+      driver = "docker"
+
+      config {
+        image   = "lscr.io/linuxserver/bookstack:latest"
+        command = "php"
+        args    = ["/app/www/artisan", "queue:work", "--sleep=3", "--tries=3", "--timeout=60"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/config",
+        ]
+      }
+
+      template {
+        destination = "local/.env"
+        env         = true
+        data        = <<EOH
+PUID = "1000"
+PGID = "1000"
+TZ   = "Europe/Dublin"
+
+APP_URL=https://{{ env "NOMAD_META_domain" }}
+APP_KEY={{ key "socs/dcusr/bookstack/app/key" }}
+
+DB_HOST={{ env "NOMAD_HOST_IP_db" }}
+DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
+DB_USERNAME={{ key "socs/dcusr/bookstack/db/user" }}
+DB_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
+DB_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
+
+MAIL_DRIVER=smtp
+MAIL_HOST={{ key "socs/dcusr/bookstack/smtp/host" }}
+MAIL_PORT=587
+MAIL_ENCRYPTION=tls
+MAIL_USERNAME={{ key "socs/dcusr/bookstack/smtp/user" }}
+MAIL_PASSWORD={{ key "socs/dcusr/bookstack/smtp/password" }}
+MAIL_FROM={{ key "socs/dcusr/bookstack/smtp/user" }}
+MAIL_FROM_NAME={{ key "socs/dcusr/bookstack/smtp/name" }}
+
+REDIS_SERVERS={{ env "NOMAD_ADDR_redis" }}
+
+QUEUE_CONNECTION=redis
+EOH
+      }
+
+      resources {
+        cpu    = 300
+        memory = 512
+      }
+    }
+  }
+}
diff --git a/jobs/socs/dcusr-dev.hcl b/jobs/socs/dcusr-dev.hcl
new file mode 100644
index 0000000..f8a3ba8
--- /dev/null
+++ b/jobs/socs/dcusr-dev.hcl
@@ -0,0 +1,124 @@
+job "dcusr-dev" {
+  datacenters = ["aperture"]
+  type = "service"
+
+  meta {
+    domain = "solarracing.ie"
+  }
+
+  group "dcusr-dev" {
+    count = 1
+
+    network {
+      port "http" {
+        to = 3000
+      }
+      port "db" {
+        to = 5432
+      }
+    }
+
+    service {
+      name = "dcusr-dev"
+      port = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.dcusr-dev.rule=Host(`solarracing.ie`) || Host(`www.solarracing.ie`)",
+        "traefik.http.routers.dcusr-dev.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-dev.tls.certresolver=lets-encrypt",
+        "traefik.http.middlewares.nextauth-headers.headers.sslProxyHeaders.X-Forwarded-Proto=https",
+        "traefik.http.middlewares.nextauth-headers.headers.customRequestHeaders.X-Forwarded-Host=solarracing.ie",
+        "traefik.http.routers.dcusr-dev.middlewares=nextauth-headers@consulcatalog",
+
+      ]
+    }
+
+    task "nextjs-website" {
+      driver = "docker"
+
+      config {
+        image = "ghcr.io/dcu-solar-racing/website:main"
+        ports = ["http"]
+        force_pull = true
+
+        auth {
+          username = "${DOCKER_USER}"
+          password = "${DOCKER_PASS}"
+        }
+      }
+      template {
+        destination = "secrets/secret.env"
+        env         = true
+        data        = <<EOH
+DOCKER_USER={{ key "dcusr/ghcr/username" }}
+DOCKER_PASS={{ key "dcusr/ghcr/password" }}
+
+NEXT_PUBLIC_SITE_URL=https://{{ env "NOMAD_META_domain" }}
+
+AUTH_URL=https://{{ env "NOMAD_META_domain" }}
+AUTH_TRUST_HOST=true
+AUTH_SECRET={{ key "socs/dcusr-dev/auth/secret" }}
+
+NEXTAUTH_URL=https://{{ env "NOMAD_META_domain" }}
+NEXTAUTH_SECRET={{ key "socs/dcusr-dev/auth/secret" }}
+
+PREVIEW_SECRET={{ key "socs/dcusr-dev/preview/secret" }}
+
+SEED_ADMIN_EMAIL={{ key "socs/dcusr-dev/seed/email" }}
+SEED_ADMIN_PASSWORD={{ key "socs/dcusr-dev/seed/password" }}
+
+DATABASE_URL=postgresql://{{ key "socs/dcusr-dev/db/user" | urlquery }}:{{ key "socs/dcusr-dev/db/password" | urlquery }}@{{ env "NOMAD_ADDR_db" }}/{{ key "socs/dcusr-dev/db/name" | urlquery }}?schema=public
+
+MINIO_ENDPOINT={{ key "socs/dcusr-dev/minio/url" }}
+MINIO_PORT={{ key "socs/dcusr-dev/minio/port" }}
+MINIO_ACCESS_KEY="{{ key "socs/dcusr-dev/minio/access/key" }}"
+MINIO_SECRET_KEY="{{ key "socs/dcusr-dev/minio/secret/key" }}"
+MINIO_BUCKET={{ key "socs/dcusr-dev/minio/bucket" }}
+MINIO_USE_SSL=true
+MINIO_PUBLIC_BASE_URL={{ key "socs/dcusr-dev/minio/base/url" }}
+MINIO_FORCE_PATH_STYLE=true
+MINIO_PUBLIC_URL={{ key "socs/dcusr-dev/minio/public/url" }}
+MINIO_REGION=ie-redbrick
+
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=465
+SMTP_USER={{ key "socs/dcusr-dev/smtp/user" }}
+SMTP_PASS={{ key "socs/dcusr-dev/smtp/password" }}
+MAIL_FROM={{ key "socs/dcusr-dev/mail/from" }}
+MAIL_TO={{ key "socs/dcusr-dev/mail/to" }}
+SMTP_SECURE=true
+SMTP_REJECT=true
+
+MAIL_BRAND="DCU Solar Racing"
+MAIL_PRIMARY="#22c55e"
+
+PLAUSIBLE_BASE_URL={{ key "socs/dcusr-dev/plausible/url" }}
+EOH
+      }
+    }
+
+    task "postgres" {
+      driver = "docker"
+
+      config {
+        image = "postgres:17-alpine"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/dcusr-dev/db:/var/lib/postgresql/data",
+        ]
+      }
+
+      template {
+        destination = "local/.env"
+        env         = true
+        data        = <<EOH
+POSTGRES_DB={{ key "socs/dcusr-dev/db/name" }}
+POSTGRES_USER={{ key "socs/dcusr-dev/db/user" }}
+POSTGRES_PASSWORD={{ key "socs/dcusr-dev/db/password" }}
+EOH
+      }
+    }
+  }
+}
diff --git a/jobs/socs/dcusr-grafana.hcl b/jobs/socs/dcusr-grafana.hcl
new file mode 100644
index 0000000..d2e1210
--- /dev/null
+++ b/jobs/socs/dcusr-grafana.hcl
@@ -0,0 +1,59 @@
+job "dcusr-grafana" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "dashboard.solarracing.ie"
+  }
+
+  group "grafana" {
+    network {
+      port "http" {
+        to = 3000
+      }
+    }
+
+    service {
+      name = "grafana"
+      port = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.port=${NOMAD_PORT_http}",
+        "traefik.http.routers.grafana.entrypoints=web,websecure",
+        "traefik.http.routers.grafana.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.grafana.tls=true",
+        "traefik.http.routers.grafana.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "grafana" {
+      driver = "docker"
+
+      config {
+        image = "grafana/grafana"
+        ports = ["http"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}/data:/var/lib/grafana",
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}/plugins:/var/lib/grafana/plugins"
+        ]
+      }
+
+      template {
+        data        = <<EOH
+GF_PLUGINS_PREINSTALL=grafana-clock-panel
+GF_USERS_ALLOW_SIGN_UP=false
+EOH
+        destination = "local/.env"
+        env         = true
+      }
+
+      resources {
+        cpu    = 1000
+        memory = 1000
+      }
+    }
+  }
+}
+
diff --git a/jobs/socs/dcusr-hi-events.hcl b/jobs/socs/dcusr-hi-events.hcl
new file mode 100644
index 0000000..9934b0d
--- /dev/null
+++ b/jobs/socs/dcusr-hi-events.hcl
@@ -0,0 +1,149 @@
+job "dcusr-hi-events" {
+  datacenters = ["aperture"]
+
+  type = "service"
+
+  meta {
+    domain = "tickets.solarracing.ie"
+  }
+
+  group "web" {
+    network {
+      port "http" {
+        to = 80
+      }
+
+      port "db" {
+        to = 5432
+      }
+
+      port "redis" {
+        to = 6379
+      }
+    }
+
+    task "frontend" {
+      driver = "docker"
+
+      config {
+        image = "daveearley/hi.events-all-in-one"
+        ports = ["http"]
+      }
+
+      service {
+        name = "frontend"
+        port = "http"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.port=${NOMAD_PORT_http}",
+          "traefik.http.routers.hievents-frontend.entrypoints=web,websecure",
+          "traefik.http.routers.hievents-frontend.rule=Host(`${NOMAD_META_domain}`)",
+          "traefik.http.routers.hievents-frontend.tls=true",
+          "traefik.http.routers.hievents-frontend.tls.certresolver=lets-encrypt",
+        ]
+      }
+
+      resources {
+        memory = 3000
+        cores  = 1
+      }
+
+      template {
+        data        = <<EOH
+# Frontend
+VITE_FRONTEND_URL="https://{{ env "NOMAD_META_domain" }}"
+VITE_API_URL_CLIENT="https://{{ env "NOMAD_META_domain" }}/api"
+VITE_API_URL_SERVER="https://{{ env "NOMAD_META_domain" }}/api"
+VITE_STRIPE_PUBLISHABLE_KEY=
+
+# Backend
+LOG_CHANNEL=stderr
+QUEUE_CONNECTION=redis
+
+# Mail
+MAIL_MAILER=smtp
+MAIL_HOST=smtp.gmail.com
+MAIL_PORT=587
+MAIL_ENCRYPTION=tls
+MAIL_PASSWORD={{ key "hi-events/mail/password" }}
+MAIL_USERNAME={{ key "hi-events/mail/username" }}
+MAIL_FROM_ADDRESS={{ key "hi-events/mail/username" }}
+MAIL_FROM_NAME="DCU Solar Racing"
+
+# App configs
+APP_KEY={{ key "hi-events/app/key" }}
+JWT_SECRET={{key "hi-events/app/jwt" }}
+APP_CDN_URL="https://{{ env "NOMAD_META_domain" }}/storage"
+APP_FRONTEND_URL="https://{{ env "NOMAD_META_domain" }}"
+APP_DISABLE_REGISTRATION=true
+APP_SAAS_MODE_ENABLED=ture
+
+# Filesystem
+FILESYSTEM_PUBLIC_DISK=public
+FILESYSTEM_PRIVATE_DISK=local
+
+# Stripe
+STRIPE_PUBLIC_KEY=
+STRIPE_SECRET_KEY=
+
+# Database
+DB_CONNECTION=pgsql
+DB_HOST={{ env "NOMAD_IP_db" }}
+DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
+DB_DATABASE={{ key "hi-events/db/name" }}
+DB_USERNAME={{ key "hi-events/db/user" }}
+DB_PASSWORD={{ key "hi-events/db/password" }}
+
+# Redis
+REDIS_HOST={{ env "NOMAD_IP_redis" }}
+REDIS_USER={{ key "hi-events/redis/user" }}
+REDIS_PASSWORD=
+REDIS_PORT={{ env "NOMAD_HOST_PORT_redis" }}
+EOH
+        destination = "local/.env"
+        env         = true
+      }
+    }
+
+    task "db" {
+      driver = "docker"
+
+      config {
+        image = "postgres:16-alpine"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/hi-events-all-in-one/db:/var/lib/postgresql/data",
+        ]
+      }
+
+      template {
+        data        = <<EOH
+POSTGRES_DB={{ key "hi-events/db/name" }}
+POSTGRES_USER={{ key "hi-events/db/user" }}
+POSTGRES_PASSWORD={{ key "hi-events/db/password" }}
+EOH
+        destination = "local/db.env"
+        env         = true
+      }
+    }
+
+    task "redis" {
+      driver = "docker"
+
+      config {
+        image = "redis:latest"
+        ports = ["redis"]
+      }
+
+      template {
+        data        = <<EOH
+REDIS_USER={{ key "hi-events/redis/user" }}
+EOH
+        destination = "local/redis.env"
+        env         = true
+      }
+    }
+  }
+}
diff --git a/jobs/socs/dcusr-invoiceninja.hcl b/jobs/socs/dcusr-invoiceninja.hcl
new file mode 100644
index 0000000..a09cd30
--- /dev/null
+++ b/jobs/socs/dcusr-invoiceninja.hcl
@@ -0,0 +1,238 @@
+job "dcusr-invoiceninja" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "invoices.solarracing.ie"
+  }
+
+  group "ninja" {
+    count = 1
+
+    network {
+      port "web" { 
+        to = 80 
+      }
+      port "fpm" { 
+        to = 9000 
+      }
+      port "db" { 
+        to = 3306 
+      }
+      port "redis" { 
+        to = 6379 
+      }
+    }
+
+    restart {
+      attempts = 20
+      delay    = "10s"
+      interval = "10m"
+      mode     = "delay"
+    }
+
+    service {
+      name = "invoiceninja"
+      port = "web"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.port=${NOMAD_PORT_web}",
+        "traefik.http.routers.dcusr-invoiceninja.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-invoiceninja.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.dcusr-invoiceninja.tls=true",
+        "traefik.http.routers.dcusr-invoiceninja.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "app" {
+      driver = "docker"
+
+      config {
+        image  = "invoiceninja/invoiceninja-debian:latest"
+        ports  = ["fpm"]
+
+        volumes = [
+          "local/.env:/var/www/html/.env",
+          "/storage/nomad/${NOMAD_JOB_NAME}/public:/var/www/html/public",
+          "/storage/nomad/${NOMAD_JOB_NAME}/storage:/var/www/html/storage",
+          "local/99-mysql-client-no-tls.cnf:/etc/mysql/conf.d/99-mysql-client-no-tls.cnf:ro",
+
+        ]
+      }
+
+      resources {
+        cpu    = 4000
+        memory = 8192
+      }
+
+      template {
+        destination = "local/.env"
+        env         = true
+        data = <<EOH
+IS_DOCKER=true
+NINJA_ENVIRONMENT=selfhost
+APP_NAME="DCU Solar Racing invoicing"
+APP_ENV=production
+APP_DEBUG=true
+APP_URL=https://{{ env "NOMAD_META_domain" }}
+REQUIRE_HTTPS=true
+TRUSTED_PROXIES=*
+APP_KEY={{ key "dcusr/invoice/app/key" }}
+PHANTOMJS_PDF_GENERATION=false
+
+FILESYSTEM_DISK=debian_docker
+
+# pdf
+PDF_GENERATOR=snappdf
+
+# database (like compose)
+DB_CONNECTION=mysql
+DB_HOST={{ env "NOMAD_IP_db" }}
+DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
+DB_DATABASE={{ key "dcusr/invoice/db/name" }}
+DB_USERNAME={{ key "dcusr/invoice/db/user" }}
+DB_PASSWORD={{ key "dcusr/invoice/db/password" }}
+DB_STRICT=false
+
+REDIS_HOST={{ env "NOMAD_IP_redis" }}
+REDIS_PORT={{ env "NOMAD_HOST_PORT_redis" }}
+CACHE_DRIVER=redis
+SESSION_DRIVER=redis
+QUEUE_CONNECTION=redis
+
+INTERNAL_QUEUE_ENABLED=true
+
+MAIL_MAILER=smtp
+MAIL_HOST={{ key "dcusr/invoice/smtp/host" }}
+MAIL_PORT={{ key "dcusr/invoice/smtp/port" }}
+MAIL_USERNAME={{ key "dcusr/invoice/smtp/username" }}
+MAIL_PASSWORD="{{ key "dcusr/invoice/smtp/password" }}"
+MAIL_ENCRYPTION={{ key "dcusr/invoice/smtp/encryption" }}
+MAIL_FROM_ADDRESS={{ key "dcusr/invoice/smtp/from_address" }}
+MAIL_FROM_NAME="{{ key "dcusr/invoice/smtp/from_name" }}"
+EOH
+      }
+
+       template {
+        destination = "local/99-mysql-client-no-tls.cnf"
+        data = <<EOH
+[client]
+loose-skip-ssl
+loose-ssl-verify-server-cert=OFF
+loose-ssl-mode=DISABLED
+
+[mysql]
+loose-skip-ssl
+loose-ssl-verify-server-cert=OFF
+loose-ssl-mode=DISABLED
+EOH
+  }
+    }
+
+    task "nginx" {
+      driver = "docker"
+
+      config {
+        image = "nginx:alpine"
+        ports = ["web"]
+        volumes = [
+          "local/nginx:/etc/nginx/conf.d:ro",
+          "/storage/nomad/${NOMAD_JOB_NAME}/public:/var/www/html/public",
+          "/storage/nomad/${NOMAD_JOB_NAME}/storage:/var/www/html/storage",
+      ]
+    }
+
+      template {
+        destination = "local/nginx/invoiceninja.conf"
+        data = <<EOH
+server {
+    listen 80;
+    server_name _;
+    root /var/www/html/public;
+    index index.php index.html;
+    client_max_body_size 100M;
+
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    location ~ \.php(?:$|/) {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
+        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_index index.php;
+        fastcgi_read_timeout 300;
+        fastcgi_pass {{ env "NOMAD_ADDR_fpm" }};
+    }
+
+    location ~* \.(jpg|jpeg|gif|png|css|js|ico|svg|woff|woff2|ttf)$ {
+        expires max;
+        log_not_found off;
+    }
+}
+EOH
+    }
+  }
+
+    task "mysql" {
+      driver = "docker"
+
+      config {
+        image = "mysql:8"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/mysql:/var/lib/mysql",
+          "local/zz-no-tls.cnf:/etc/mysql/conf.d/zz-no-tls.cnf:ro",
+      ]
+    }
+
+    resources {
+      cpu    = 500
+      memory = 1024
+    }
+
+    template {
+      destination = "local/mysql.env"
+      env         = true
+      data = <<EOH
+MYSQL_DATABASE={{ key "dcusr/invoice/db/name" }}
+MYSQL_USER={{ key "dcusr/invoice/db/user" }}
+MYSQL_PASSWORD={{ key "dcusr/invoice/db/password" }}
+MYSQL_ROOT_PASSWORD={{ key "dcusr/invoice/db/root_password" }}
+EOH
+  }
+
+    template {
+      destination = "local/zz-no-tls.cnf"
+      data = <<EOH
+[mysqld]
+require_secure_transport=OFF
+tls_version=
+admin_tls_version=
+EOH
+  }
+}
+
+
+    task "redis" {
+      driver = "docker"
+
+      config {
+        image = "redis:alpine"
+        ports = ["redis"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/redis:/data",
+        ]
+      }
+
+      resources {
+        cpu    = 150
+        memory = 128
+      }
+    }
+  }
+}
+
diff --git a/jobs/socs/dcusr-openproject.hcl b/jobs/socs/dcusr-openproject.hcl
new file mode 100644
index 0000000..9646a25
--- /dev/null
+++ b/jobs/socs/dcusr-openproject.hcl
@@ -0,0 +1,79 @@
+job "dcusr-openproject" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "projects.solarracing.ie"
+  }
+
+  group "openproject" {
+    count = 1
+
+    network {
+      port "http" { 
+        to = 80 
+      }
+    }
+
+    restart {
+      attempts = 20
+      delay    = "10s"
+      interval = "10m"
+      mode     = "delay"
+    }
+
+    service {
+      name     = "openproject"
+      port     = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.port=${NOMAD_PORT_http}",
+        "traefik.http.routers.dcusr-openproject.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-openproject.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.dcusr-openproject.tls=true",
+        "traefik.http.routers.dcusr-openproject.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "openproject-aio" {
+      driver = "docker"
+
+      config {
+        image = "openproject/openproject:16"
+        ports = ["http"]
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/pgdata:/var/openproject/pgdata",
+          "/storage/nomad/${NOMAD_JOB_NAME}/assets:/var/openproject/assets",
+        ]
+      }
+
+      template {
+        destination = "local/app.env"
+        env         = true
+        data = <<EOH
+OPENPROJECT_HOST__NAME={{ env "NOMAD_META_domain" }}
+OPENPROJECT_HTTPS=true
+
+OPENPROJECT_SECRET_KEY_BASE={{ key "dcusr/openproject/secret_key_base" }}
+
+EMAIL_DELIVERY_METHOD=smtp
+SMTP_ADDRESS={{ key "dcusr/openproject/smtp/address" }}
+SMTP_PORT={{ key "dcusr/openproject/smtp/port" }}
+SMTP_DOMAIN={{ key "dcusr/openproject/smtp/domain" }}
+SMTP_AUTHENTICATION={{ key "dcusr/openproject/smtp/auth" }}
+SMTP_USER_NAME={{ key "dcusr/openproject/smtp/username" }}
+SMTP_PASSWORD={{ key "dcusr/openproject/smtp/password" }}
+SMTP_ENABLE_STARTTLS_AUTO=true
+
+EOH
+      }
+
+      resources {
+        cpu    = 1500
+        memory = 8192
+      }
+    }
+  }
+}
+
diff --git a/jobs/socs/dcusr-rocketchat.hcl b/jobs/socs/dcusr-rocketchat.hcl
new file mode 100644
index 0000000..fb37c29
--- /dev/null
+++ b/jobs/socs/dcusr-rocketchat.hcl
@@ -0,0 +1,126 @@
+job "dcusr-rocketchat" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain       = "chat.solarracing.ie"
+    jitsi_domain = "meet.solarracing.ie"
+  }
+
+  group "rocketchat" {
+    count = 1
+
+    network {
+      port "http" {
+        to = 3000
+      }
+      port "db" {
+        to = 27017
+      }
+    }
+
+    restart {
+      attempts = 20
+      delay    = "10s"
+      interval = "10m"
+      mode     = "delay"
+    }
+
+    service {
+      name = "rocketchat"
+      port = "http"
+      tags = [
+        "traefik.enable=true",
+        "traefik.port=${NOMAD_PORT_http}",
+        "traefik.http.routers.dcusr-rocketchat.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.dcusr-rocketchat.tls=true",
+        "traefik.http.routers.dcusr-rocketchat.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-rocketchat.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "init-mongo-perms" {
+      driver = "docker"
+      lifecycle {
+        hook = "prestart"
+      }
+      restart {
+        attempts = 0
+      }
+
+      config {
+        image   = "alpine:3"
+        command = "sh"
+        args    = ["-lc", "mkdir -p /data && chown -R 1001:1001 /data && chmod -R u+rwX,g+rwX /data"]
+        volumes = ["/storage/nomad/${NOMAD_JOB_NAME}/mongodb:/data"]
+      }
+
+      resources {
+        cpu = 50
+        memory = 64
+      }
+    }
+
+    task "mongodb" {
+      driver = "docker"
+
+      config {
+        image = "docker.io/bitnamilegacy/mongodb:8.0.13"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/mongodb:/bitnami/mongodb"
+        ]
+      }
+
+      template {
+        destination = "local/mongo.env"
+        env         = true
+        data = <<EOH
+MONGODB_REPLICA_SET_MODE=primary
+MONGODB_REPLICA_SET_NAME=rs0
+MONGODB_PORT_NUMBER=27017
+MONGODB_INITIAL_PRIMARY_HOST=127.0.0.1
+MONGODB_INITIAL_PRIMARY_PORT_NUMBER=27017
+MONGODB_ADVERTISED_HOSTNAME=localhost
+MONGODB_ENABLE_JOURNAL=true
+ALLOW_EMPTY_PASSWORD=yes
+EOH
+      }
+
+      resources {
+        cpu    = 1000
+        memory = 2048
+      }
+    }
+
+      task "rocketchat" {
+        driver = "docker"
+
+        config {
+          image = "registry.rocket.chat/rocketchat/rocket.chat:latest"
+          ports = ["http"]
+        }
+
+        template {
+          destination = "local/app.env"
+          env         = true
+          data = <<EOH
+MONGO_URL=mongodb://{{ env "NOMAD_ADDR_db" }}/rocketchat?replicaSet=rs0&directConnection=true&serverSelectionTimeoutMS=60000&connectTimeoutMS=30000
+MONGO_OPLOG_URL=mongodb://{{ env "NOMAD_ADDR_db" }}/local?replicaSet=rs0&directConnection=true
+
+ROOT_URL=https://{{ env "NOMAD_META_domain" }}
+PORT=3000
+DEPLOY_METHOD=docker
+
+WEB_PROCESS_COUNT=1
+EOH
+        }
+
+      resources {
+        cpu    = 1000
+        memory = 2048
+      }
+    }
+  }
+}

From 4fe554324f633fe2af585db2c3b405cbe8ac8bab Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Tue, 28 Oct 2025 14:44:19 +0000
Subject: [PATCH 02/15] remove jitsi meta domain

---
 jobs/socs/dcusr-rocketchat.hcl | 1 -
 1 file changed, 1 deletion(-)

diff --git a/jobs/socs/dcusr-rocketchat.hcl b/jobs/socs/dcusr-rocketchat.hcl
index fb37c29..7421dcd 100644
--- a/jobs/socs/dcusr-rocketchat.hcl
+++ b/jobs/socs/dcusr-rocketchat.hcl
@@ -4,7 +4,6 @@ job "dcusr-rocketchat" {
 
   meta {
     domain       = "chat.solarracing.ie"
-    jitsi_domain = "meet.solarracing.ie"
   }
 
   group "rocketchat" {

From 4224ff47b088e382d1fcdddd32fadefe94c5cf95 Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Tue, 28 Oct 2025 15:10:25 +0000
Subject: [PATCH 03/15] move dcusr jobs to a seperate dir

---
 jobs/socs/dcusr/dcusr-bookstack.hcl          | 189 +++++++++++++++
 jobs/socs/dcusr/dcusr-dev.hcl                | 124 ++++++++++
 jobs/socs/dcusr/dcusr-grafana.hcl            |  59 +++++
 jobs/socs/dcusr/dcusr-hi-events.hcl          | 149 ++++++++++++
 jobs/socs/dcusr/dcusr-invoiceninja.hcl       | 238 +++++++++++++++++++
 jobs/socs/dcusr/dcusr-listmonk.hcl           | 107 +++++++++
 jobs/socs/dcusr/dcusr-openproject-backup.hcl | 133 +++++++++++
 jobs/socs/dcusr/dcusr-openproject.hcl        |  79 ++++++
 jobs/socs/dcusr/dcusr-outline-backup.hcl     |  50 ++++
 jobs/socs/dcusr/dcusr-outline.hcl            | 148 ++++++++++++
 jobs/socs/dcusr/dcusr-rocketchat.hcl         | 125 ++++++++++
 11 files changed, 1401 insertions(+)
 create mode 100644 jobs/socs/dcusr/dcusr-bookstack.hcl
 create mode 100644 jobs/socs/dcusr/dcusr-dev.hcl
 create mode 100644 jobs/socs/dcusr/dcusr-grafana.hcl
 create mode 100644 jobs/socs/dcusr/dcusr-hi-events.hcl
 create mode 100644 jobs/socs/dcusr/dcusr-invoiceninja.hcl
 create mode 100644 jobs/socs/dcusr/dcusr-listmonk.hcl
 create mode 100644 jobs/socs/dcusr/dcusr-openproject-backup.hcl
 create mode 100644 jobs/socs/dcusr/dcusr-openproject.hcl
 create mode 100644 jobs/socs/dcusr/dcusr-outline-backup.hcl
 create mode 100644 jobs/socs/dcusr/dcusr-outline.hcl
 create mode 100644 jobs/socs/dcusr/dcusr-rocketchat.hcl

diff --git a/jobs/socs/dcusr/dcusr-bookstack.hcl b/jobs/socs/dcusr/dcusr-bookstack.hcl
new file mode 100644
index 0000000..6bd9fdf
--- /dev/null
+++ b/jobs/socs/dcusr/dcusr-bookstack.hcl
@@ -0,0 +1,189 @@
+job "dcusr-bookstack" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "wiki.solarracing.ie"
+  }
+
+  group "bookstack" {
+    count = 1
+
+    network {
+      port "http" {
+        to = 80
+      }
+
+      port "db" {
+        to = 3306
+      }
+
+      port "redis" {
+        to = 6379
+      }
+    }
+
+    service {
+      name = "bookstack"
+      port = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.dcusr-bookstack.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.dcusr-bookstack.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-bookstack.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "bookstack" {
+      driver = "docker"
+
+      config {
+        image = "lscr.io/linuxserver/bookstack:latest"
+        ports = ["http"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/config",
+        ]
+      }
+
+      template {
+        destination = "local.env"
+        env         = true
+        data        = <<EOH
+PUID = "1000"
+PGID = "1000"
+TZ   = "Europe/Dublin"
+
+APP_URL=https://{{ env "NOMAD_META_domain" }}
+APP_KEY={{ key "socs/dcusr/bookstack/app/key" }}
+APP_AUTO_LANG_PUBLIC=false
+
+DB_HOST={{ env "NOMAD_HOST_IP_db" }}
+DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
+DB_USERNAME={{ key "socs/dcusr/bookstack/db/user" }}
+DB_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
+DB_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
+
+MAIL_DRIVER=smtp
+MAIL_HOST={{ key "socs/dcusr/bookstack/smtp/host" }}
+MAIL_PORT=587
+MAIL_ENCRYPTION=tls
+MAIL_USERNAME={{ key "socs/dcusr/bookstack/smtp/user" }}
+MAIL_PASSWORD={{ key "socs/dcusr/bookstack/smtp/password" }}
+MAIL_FROM={{ key "socs/dcusr/bookstack/smtp/user" }}
+MAIL_FROM_NAME={{ key "socs/dcusr/bookstack/smtp/name" }}
+
+REDIS_SERVERS={{ env "NOMAD_ADDR_redis" }}
+
+QUEUE_CONNECTION=redis
+CACHE_DRIVER=redis
+SESSION_DRIVER=redis
+EOH
+      }
+
+      resources {
+        cpu    = 500
+        memory = 1024
+      }
+    }
+
+    task "mariadb" {
+      driver = "docker"
+
+      config {
+        image = "mariadb:10.11"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/mysql",
+        ]
+      }
+
+      template {
+        destination = "local/.env"
+        env         = true
+        data        = <<EOH
+MYSQL_ROOT_PASSWORD={{ key "socs/dcusr/bookstack/db/root/password" }}
+MYSQL_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
+MYSQL_USER={{ key "socs/dcusr/bookstack/db/user" }}
+MYSQL_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
+EOH
+      }
+
+      resources {
+        cpu    = 500
+        memory = 1024
+      }
+    }
+
+    task "redis" {
+      driver = "docker"
+
+      config {
+        image = "redis:7-alpine"
+        ports = ["redis"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/data",
+        ]
+      }
+
+      resources {
+        cpu    = 200
+        memory = 256
+      }
+    }
+
+    task "queue-worker" {
+      driver = "docker"
+
+      config {
+        image   = "lscr.io/linuxserver/bookstack:latest"
+        command = "php"
+        args    = ["/app/www/artisan", "queue:work", "--sleep=3", "--tries=3", "--timeout=60"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/config",
+        ]
+      }
+
+      template {
+        destination = "local/.env"
+        env         = true
+        data        = <<EOH
+PUID = "1000"
+PGID = "1000"
+TZ   = "Europe/Dublin"
+
+APP_URL=https://{{ env "NOMAD_META_domain" }}
+APP_KEY={{ key "socs/dcusr/bookstack/app/key" }}
+
+DB_HOST={{ env "NOMAD_HOST_IP_db" }}
+DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
+DB_USERNAME={{ key "socs/dcusr/bookstack/db/user" }}
+DB_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
+DB_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
+
+MAIL_DRIVER=smtp
+MAIL_HOST={{ key "socs/dcusr/bookstack/smtp/host" }}
+MAIL_PORT=587
+MAIL_ENCRYPTION=tls
+MAIL_USERNAME={{ key "socs/dcusr/bookstack/smtp/user" }}
+MAIL_PASSWORD={{ key "socs/dcusr/bookstack/smtp/password" }}
+MAIL_FROM={{ key "socs/dcusr/bookstack/smtp/user" }}
+MAIL_FROM_NAME={{ key "socs/dcusr/bookstack/smtp/name" }}
+
+REDIS_SERVERS={{ env "NOMAD_ADDR_redis" }}
+
+QUEUE_CONNECTION=redis
+EOH
+      }
+
+      resources {
+        cpu    = 300
+        memory = 512
+      }
+    }
+  }
+}
diff --git a/jobs/socs/dcusr/dcusr-dev.hcl b/jobs/socs/dcusr/dcusr-dev.hcl
new file mode 100644
index 0000000..f8a3ba8
--- /dev/null
+++ b/jobs/socs/dcusr/dcusr-dev.hcl
@@ -0,0 +1,124 @@
+job "dcusr-dev" {
+  datacenters = ["aperture"]
+  type = "service"
+
+  meta {
+    domain = "solarracing.ie"
+  }
+
+  group "dcusr-dev" {
+    count = 1
+
+    network {
+      port "http" {
+        to = 3000
+      }
+      port "db" {
+        to = 5432
+      }
+    }
+
+    service {
+      name = "dcusr-dev"
+      port = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.dcusr-dev.rule=Host(`solarracing.ie`) || Host(`www.solarracing.ie`)",
+        "traefik.http.routers.dcusr-dev.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-dev.tls.certresolver=lets-encrypt",
+        "traefik.http.middlewares.nextauth-headers.headers.sslProxyHeaders.X-Forwarded-Proto=https",
+        "traefik.http.middlewares.nextauth-headers.headers.customRequestHeaders.X-Forwarded-Host=solarracing.ie",
+        "traefik.http.routers.dcusr-dev.middlewares=nextauth-headers@consulcatalog",
+
+      ]
+    }
+
+    task "nextjs-website" {
+      driver = "docker"
+
+      config {
+        image = "ghcr.io/dcu-solar-racing/website:main"
+        ports = ["http"]
+        force_pull = true
+
+        auth {
+          username = "${DOCKER_USER}"
+          password = "${DOCKER_PASS}"
+        }
+      }
+      template {
+        destination = "secrets/secret.env"
+        env         = true
+        data        = <<EOH
+DOCKER_USER={{ key "dcusr/ghcr/username" }}
+DOCKER_PASS={{ key "dcusr/ghcr/password" }}
+
+NEXT_PUBLIC_SITE_URL=https://{{ env "NOMAD_META_domain" }}
+
+AUTH_URL=https://{{ env "NOMAD_META_domain" }}
+AUTH_TRUST_HOST=true
+AUTH_SECRET={{ key "socs/dcusr-dev/auth/secret" }}
+
+NEXTAUTH_URL=https://{{ env "NOMAD_META_domain" }}
+NEXTAUTH_SECRET={{ key "socs/dcusr-dev/auth/secret" }}
+
+PREVIEW_SECRET={{ key "socs/dcusr-dev/preview/secret" }}
+
+SEED_ADMIN_EMAIL={{ key "socs/dcusr-dev/seed/email" }}
+SEED_ADMIN_PASSWORD={{ key "socs/dcusr-dev/seed/password" }}
+
+DATABASE_URL=postgresql://{{ key "socs/dcusr-dev/db/user" | urlquery }}:{{ key "socs/dcusr-dev/db/password" | urlquery }}@{{ env "NOMAD_ADDR_db" }}/{{ key "socs/dcusr-dev/db/name" | urlquery }}?schema=public
+
+MINIO_ENDPOINT={{ key "socs/dcusr-dev/minio/url" }}
+MINIO_PORT={{ key "socs/dcusr-dev/minio/port" }}
+MINIO_ACCESS_KEY="{{ key "socs/dcusr-dev/minio/access/key" }}"
+MINIO_SECRET_KEY="{{ key "socs/dcusr-dev/minio/secret/key" }}"
+MINIO_BUCKET={{ key "socs/dcusr-dev/minio/bucket" }}
+MINIO_USE_SSL=true
+MINIO_PUBLIC_BASE_URL={{ key "socs/dcusr-dev/minio/base/url" }}
+MINIO_FORCE_PATH_STYLE=true
+MINIO_PUBLIC_URL={{ key "socs/dcusr-dev/minio/public/url" }}
+MINIO_REGION=ie-redbrick
+
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=465
+SMTP_USER={{ key "socs/dcusr-dev/smtp/user" }}
+SMTP_PASS={{ key "socs/dcusr-dev/smtp/password" }}
+MAIL_FROM={{ key "socs/dcusr-dev/mail/from" }}
+MAIL_TO={{ key "socs/dcusr-dev/mail/to" }}
+SMTP_SECURE=true
+SMTP_REJECT=true
+
+MAIL_BRAND="DCU Solar Racing"
+MAIL_PRIMARY="#22c55e"
+
+PLAUSIBLE_BASE_URL={{ key "socs/dcusr-dev/plausible/url" }}
+EOH
+      }
+    }
+
+    task "postgres" {
+      driver = "docker"
+
+      config {
+        image = "postgres:17-alpine"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/dcusr-dev/db:/var/lib/postgresql/data",
+        ]
+      }
+
+      template {
+        destination = "local/.env"
+        env         = true
+        data        = <<EOH
+POSTGRES_DB={{ key "socs/dcusr-dev/db/name" }}
+POSTGRES_USER={{ key "socs/dcusr-dev/db/user" }}
+POSTGRES_PASSWORD={{ key "socs/dcusr-dev/db/password" }}
+EOH
+      }
+    }
+  }
+}
diff --git a/jobs/socs/dcusr/dcusr-grafana.hcl b/jobs/socs/dcusr/dcusr-grafana.hcl
new file mode 100644
index 0000000..d2e1210
--- /dev/null
+++ b/jobs/socs/dcusr/dcusr-grafana.hcl
@@ -0,0 +1,59 @@
+job "dcusr-grafana" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "dashboard.solarracing.ie"
+  }
+
+  group "grafana" {
+    network {
+      port "http" {
+        to = 3000
+      }
+    }
+
+    service {
+      name = "grafana"
+      port = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.port=${NOMAD_PORT_http}",
+        "traefik.http.routers.grafana.entrypoints=web,websecure",
+        "traefik.http.routers.grafana.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.grafana.tls=true",
+        "traefik.http.routers.grafana.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "grafana" {
+      driver = "docker"
+
+      config {
+        image = "grafana/grafana"
+        ports = ["http"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}/data:/var/lib/grafana",
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}/plugins:/var/lib/grafana/plugins"
+        ]
+      }
+
+      template {
+        data        = <<EOH
+GF_PLUGINS_PREINSTALL=grafana-clock-panel
+GF_USERS_ALLOW_SIGN_UP=false
+EOH
+        destination = "local/.env"
+        env         = true
+      }
+
+      resources {
+        cpu    = 1000
+        memory = 1000
+      }
+    }
+  }
+}
+
diff --git a/jobs/socs/dcusr/dcusr-hi-events.hcl b/jobs/socs/dcusr/dcusr-hi-events.hcl
new file mode 100644
index 0000000..9934b0d
--- /dev/null
+++ b/jobs/socs/dcusr/dcusr-hi-events.hcl
@@ -0,0 +1,149 @@
+job "dcusr-hi-events" {
+  datacenters = ["aperture"]
+
+  type = "service"
+
+  meta {
+    domain = "tickets.solarracing.ie"
+  }
+
+  group "web" {
+    network {
+      port "http" {
+        to = 80
+      }
+
+      port "db" {
+        to = 5432
+      }
+
+      port "redis" {
+        to = 6379
+      }
+    }
+
+    task "frontend" {
+      driver = "docker"
+
+      config {
+        image = "daveearley/hi.events-all-in-one"
+        ports = ["http"]
+      }
+
+      service {
+        name = "frontend"
+        port = "http"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.port=${NOMAD_PORT_http}",
+          "traefik.http.routers.hievents-frontend.entrypoints=web,websecure",
+          "traefik.http.routers.hievents-frontend.rule=Host(`${NOMAD_META_domain}`)",
+          "traefik.http.routers.hievents-frontend.tls=true",
+          "traefik.http.routers.hievents-frontend.tls.certresolver=lets-encrypt",
+        ]
+      }
+
+      resources {
+        memory = 3000
+        cores  = 1
+      }
+
+      template {
+        data        = <<EOH
+# Frontend
+VITE_FRONTEND_URL="https://{{ env "NOMAD_META_domain" }}"
+VITE_API_URL_CLIENT="https://{{ env "NOMAD_META_domain" }}/api"
+VITE_API_URL_SERVER="https://{{ env "NOMAD_META_domain" }}/api"
+VITE_STRIPE_PUBLISHABLE_KEY=
+
+# Backend
+LOG_CHANNEL=stderr
+QUEUE_CONNECTION=redis
+
+# Mail
+MAIL_MAILER=smtp
+MAIL_HOST=smtp.gmail.com
+MAIL_PORT=587
+MAIL_ENCRYPTION=tls
+MAIL_PASSWORD={{ key "hi-events/mail/password" }}
+MAIL_USERNAME={{ key "hi-events/mail/username" }}
+MAIL_FROM_ADDRESS={{ key "hi-events/mail/username" }}
+MAIL_FROM_NAME="DCU Solar Racing"
+
+# App configs
+APP_KEY={{ key "hi-events/app/key" }}
+JWT_SECRET={{key "hi-events/app/jwt" }}
+APP_CDN_URL="https://{{ env "NOMAD_META_domain" }}/storage"
+APP_FRONTEND_URL="https://{{ env "NOMAD_META_domain" }}"
+APP_DISABLE_REGISTRATION=true
+APP_SAAS_MODE_ENABLED=ture
+
+# Filesystem
+FILESYSTEM_PUBLIC_DISK=public
+FILESYSTEM_PRIVATE_DISK=local
+
+# Stripe
+STRIPE_PUBLIC_KEY=
+STRIPE_SECRET_KEY=
+
+# Database
+DB_CONNECTION=pgsql
+DB_HOST={{ env "NOMAD_IP_db" }}
+DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
+DB_DATABASE={{ key "hi-events/db/name" }}
+DB_USERNAME={{ key "hi-events/db/user" }}
+DB_PASSWORD={{ key "hi-events/db/password" }}
+
+# Redis
+REDIS_HOST={{ env "NOMAD_IP_redis" }}
+REDIS_USER={{ key "hi-events/redis/user" }}
+REDIS_PASSWORD=
+REDIS_PORT={{ env "NOMAD_HOST_PORT_redis" }}
+EOH
+        destination = "local/.env"
+        env         = true
+      }
+    }
+
+    task "db" {
+      driver = "docker"
+
+      config {
+        image = "postgres:16-alpine"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/hi-events-all-in-one/db:/var/lib/postgresql/data",
+        ]
+      }
+
+      template {
+        data        = <<EOH
+POSTGRES_DB={{ key "hi-events/db/name" }}
+POSTGRES_USER={{ key "hi-events/db/user" }}
+POSTGRES_PASSWORD={{ key "hi-events/db/password" }}
+EOH
+        destination = "local/db.env"
+        env         = true
+      }
+    }
+
+    task "redis" {
+      driver = "docker"
+
+      config {
+        image = "redis:latest"
+        ports = ["redis"]
+      }
+
+      template {
+        data        = <<EOH
+REDIS_USER={{ key "hi-events/redis/user" }}
+EOH
+        destination = "local/redis.env"
+        env         = true
+      }
+    }
+  }
+}
diff --git a/jobs/socs/dcusr/dcusr-invoiceninja.hcl b/jobs/socs/dcusr/dcusr-invoiceninja.hcl
new file mode 100644
index 0000000..a09cd30
--- /dev/null
+++ b/jobs/socs/dcusr/dcusr-invoiceninja.hcl
@@ -0,0 +1,238 @@
+job "dcusr-invoiceninja" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "invoices.solarracing.ie"
+  }
+
+  group "ninja" {
+    count = 1
+
+    network {
+      port "web" { 
+        to = 80 
+      }
+      port "fpm" { 
+        to = 9000 
+      }
+      port "db" { 
+        to = 3306 
+      }
+      port "redis" { 
+        to = 6379 
+      }
+    }
+
+    restart {
+      attempts = 20
+      delay    = "10s"
+      interval = "10m"
+      mode     = "delay"
+    }
+
+    service {
+      name = "invoiceninja"
+      port = "web"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.port=${NOMAD_PORT_web}",
+        "traefik.http.routers.dcusr-invoiceninja.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-invoiceninja.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.dcusr-invoiceninja.tls=true",
+        "traefik.http.routers.dcusr-invoiceninja.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "app" {
+      driver = "docker"
+
+      config {
+        image  = "invoiceninja/invoiceninja-debian:latest"
+        ports  = ["fpm"]
+
+        volumes = [
+          "local/.env:/var/www/html/.env",
+          "/storage/nomad/${NOMAD_JOB_NAME}/public:/var/www/html/public",
+          "/storage/nomad/${NOMAD_JOB_NAME}/storage:/var/www/html/storage",
+          "local/99-mysql-client-no-tls.cnf:/etc/mysql/conf.d/99-mysql-client-no-tls.cnf:ro",
+
+        ]
+      }
+
+      resources {
+        cpu    = 4000
+        memory = 8192
+      }
+
+      template {
+        destination = "local/.env"
+        env         = true
+        data = <<EOH
+IS_DOCKER=true
+NINJA_ENVIRONMENT=selfhost
+APP_NAME="DCU Solar Racing invoicing"
+APP_ENV=production
+APP_DEBUG=true
+APP_URL=https://{{ env "NOMAD_META_domain" }}
+REQUIRE_HTTPS=true
+TRUSTED_PROXIES=*
+APP_KEY={{ key "dcusr/invoice/app/key" }}
+PHANTOMJS_PDF_GENERATION=false
+
+FILESYSTEM_DISK=debian_docker
+
+# pdf
+PDF_GENERATOR=snappdf
+
+# database (like compose)
+DB_CONNECTION=mysql
+DB_HOST={{ env "NOMAD_IP_db" }}
+DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
+DB_DATABASE={{ key "dcusr/invoice/db/name" }}
+DB_USERNAME={{ key "dcusr/invoice/db/user" }}
+DB_PASSWORD={{ key "dcusr/invoice/db/password" }}
+DB_STRICT=false
+
+REDIS_HOST={{ env "NOMAD_IP_redis" }}
+REDIS_PORT={{ env "NOMAD_HOST_PORT_redis" }}
+CACHE_DRIVER=redis
+SESSION_DRIVER=redis
+QUEUE_CONNECTION=redis
+
+INTERNAL_QUEUE_ENABLED=true
+
+MAIL_MAILER=smtp
+MAIL_HOST={{ key "dcusr/invoice/smtp/host" }}
+MAIL_PORT={{ key "dcusr/invoice/smtp/port" }}
+MAIL_USERNAME={{ key "dcusr/invoice/smtp/username" }}
+MAIL_PASSWORD="{{ key "dcusr/invoice/smtp/password" }}"
+MAIL_ENCRYPTION={{ key "dcusr/invoice/smtp/encryption" }}
+MAIL_FROM_ADDRESS={{ key "dcusr/invoice/smtp/from_address" }}
+MAIL_FROM_NAME="{{ key "dcusr/invoice/smtp/from_name" }}"
+EOH
+      }
+
+       template {
+        destination = "local/99-mysql-client-no-tls.cnf"
+        data = <<EOH
+[client]
+loose-skip-ssl
+loose-ssl-verify-server-cert=OFF
+loose-ssl-mode=DISABLED
+
+[mysql]
+loose-skip-ssl
+loose-ssl-verify-server-cert=OFF
+loose-ssl-mode=DISABLED
+EOH
+  }
+    }
+
+    task "nginx" {
+      driver = "docker"
+
+      config {
+        image = "nginx:alpine"
+        ports = ["web"]
+        volumes = [
+          "local/nginx:/etc/nginx/conf.d:ro",
+          "/storage/nomad/${NOMAD_JOB_NAME}/public:/var/www/html/public",
+          "/storage/nomad/${NOMAD_JOB_NAME}/storage:/var/www/html/storage",
+      ]
+    }
+
+      template {
+        destination = "local/nginx/invoiceninja.conf"
+        data = <<EOH
+server {
+    listen 80;
+    server_name _;
+    root /var/www/html/public;
+    index index.php index.html;
+    client_max_body_size 100M;
+
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    location ~ \.php(?:$|/) {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
+        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_index index.php;
+        fastcgi_read_timeout 300;
+        fastcgi_pass {{ env "NOMAD_ADDR_fpm" }};
+    }
+
+    location ~* \.(jpg|jpeg|gif|png|css|js|ico|svg|woff|woff2|ttf)$ {
+        expires max;
+        log_not_found off;
+    }
+}
+EOH
+    }
+  }
+
+    task "mysql" {
+      driver = "docker"
+
+      config {
+        image = "mysql:8"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/mysql:/var/lib/mysql",
+          "local/zz-no-tls.cnf:/etc/mysql/conf.d/zz-no-tls.cnf:ro",
+      ]
+    }
+
+    resources {
+      cpu    = 500
+      memory = 1024
+    }
+
+    template {
+      destination = "local/mysql.env"
+      env         = true
+      data = <<EOH
+MYSQL_DATABASE={{ key "dcusr/invoice/db/name" }}
+MYSQL_USER={{ key "dcusr/invoice/db/user" }}
+MYSQL_PASSWORD={{ key "dcusr/invoice/db/password" }}
+MYSQL_ROOT_PASSWORD={{ key "dcusr/invoice/db/root_password" }}
+EOH
+  }
+
+    template {
+      destination = "local/zz-no-tls.cnf"
+      data = <<EOH
+[mysqld]
+require_secure_transport=OFF
+tls_version=
+admin_tls_version=
+EOH
+  }
+}
+
+
+    task "redis" {
+      driver = "docker"
+
+      config {
+        image = "redis:alpine"
+        ports = ["redis"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/redis:/data",
+        ]
+      }
+
+      resources {
+        cpu    = 150
+        memory = 128
+      }
+    }
+  }
+}
+
diff --git a/jobs/socs/dcusr/dcusr-listmonk.hcl b/jobs/socs/dcusr/dcusr-listmonk.hcl
new file mode 100644
index 0000000..7a5b48a
--- /dev/null
+++ b/jobs/socs/dcusr/dcusr-listmonk.hcl
@@ -0,0 +1,107 @@
+job "dcusr-listmonk" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "lists.solarracing.ie"
+  }
+
+  group "listmonk" {
+    network {
+      port "http" {
+      }
+
+      port "db" {
+        to = 5432
+      }
+    }
+
+    service {
+      name = "listmonk"
+      port = "http"
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "10s"
+        timeout  = "2s"
+      }
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.port=${NOMAD_PORT_http}",
+        "traefik.http.routers.dcusr-listmonk.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-listmonk.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.dcusr-listmonk.tls=true",
+        "traefik.http.routers.dcusr-listmonk.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "app" {
+      driver = "docker"
+
+      config {
+        image = "listmonk/listmonk:latest"
+        ports = ["http"]
+
+        entrypoint = ["./listmonk", "--static-dir=/listmonk/static"]
+
+        volumes = [
+          "/storage/nomad/dcusr-listmonk/static:/listmonk/static",
+          "/storage/nomad/dcusr-listmonk/postgres/:/var/lib/postgresql/data",
+          "local/config.toml:/listmonk/config.toml"
+        ]
+      }
+
+      resources {
+        cpu    = 1000
+        memory = 500
+      }
+
+      template {
+        data        = <<EOH
+[app]
+address = "0.0.0.0:{{ env "NOMAD_PORT_http" }}"
+admin_username = "{{ key "dcusr/listmonk/admin/username" }}"
+admin_password = "{{ key "dcusr/listmonk/admin/password" }}"
+
+# Database.
+[db]
+host = "{{ env "NOMAD_HOST_IP_db" }}"
+port = {{ env "NOMAD_HOST_PORT_db" }}
+user = "{{ key "dcusr/listmonk/db/username" }}"
+password = "{{ key "dcusr/listmonk/db/password" }}"
+database = "{{ key "dcusr/listmonk/db/name" }}"
+ssl_mode = "disable"
+max_open = 25
+max_idle = 25
+max_lifetime = "300s"
+EOH
+        destination = "local/config.toml"
+      }
+    }
+
+    task "listmonk-db" {
+      driver = "docker"
+
+      config {
+        image = "postgres:17-alpine"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/dcusr-listmonk/postgres:/var/lib/postgresql/data"
+        ]
+      }
+
+      template {
+        data        = <<EOH
+POSTGRES_DB       = "{{ key "dcusr/listmonk/db/name" }}"
+POSTGRES_USER     = "{{ key "dcusr/listmonk/db/username" }}"
+POSTGRES_PASSWORD = "{{ key "dcusr/listmonk/db/password" }}"
+EOH
+        destination = "local/db.env"
+        env         = true
+      }
+    }
+  }
+}
diff --git a/jobs/socs/dcusr/dcusr-openproject-backup.hcl b/jobs/socs/dcusr/dcusr-openproject-backup.hcl
new file mode 100644
index 0000000..b7af4b7
--- /dev/null
+++ b/jobs/socs/dcusr/dcusr-openproject-backup.hcl
@@ -0,0 +1,133 @@
+job "dcusr-openproject-backup" {
+  datacenters = ["aperture"]
+  type        = "batch"
+
+  periodic {
+    crons            = ["0 */3 * * * *"]
+    prohibit_overlap = true
+  }
+
+  group "db-backup" {
+    task "openproject-backup" {
+      driver = "raw_exec"
+
+      config {
+        command = "/bin/bash"
+        args    = ["local/script.sh"]
+      }
+
+      template {
+        destination = "local/script.sh"
+        data        = <<EOH
+#!/bin/bash
+set -e
+
+BACKUP_BASE="/storage/backups/nomad/openproject/dcusr"
+mkdir -p "${BACKUP_BASE}"
+
+job_name=$(echo ${NOMAD_JOB_NAME} | cut -d "/" -f 1)
+timestamp="$(TZ=Europe/Dublin date '+%Y-%m-%d_%H-%M-%S')"
+outfile="${BACKUP_BASE}/openproject-${timestamp}.zip"
+
+if [ -z "${OPENPROJECT_DOMAIN}" ] || [ -z "${OPENPROJECT_API_KEY}" ] || [ -z "${OPENPROJECT_BACKUP_TOKEN}" ]; then
+  echo "Missing required Consul keys (OPENPROJECT_DOMAIN / OPENPROJECT_API_KEY / OPENPROJECT_BACKUP_TOKEN)."
+  exit 1
+fi
+
+curl -s -X POST -u "apikey:${OPENPROJECT_API_KEY}" \
+  "https://${OPENPROJECT_DOMAIN}/api/v3/backups" \
+  -H 'content-type: application/json' \
+  --data-raw "{\"backupToken\":\"${OPENPROJECT_BACKUP_TOKEN}\",\"attachments\":true}" \
+  > /tmp/op_backup_response.json || {
+    echo "Failed to POST backup creation"
+    exit 1
+  }
+
+status_path="$(jq -r ._links.job_status.href < /tmp/op_backup_response.json 2>/dev/null || true)"
+if [ -z "${status_path}" ] || [ "${status_path}" = "null" ]; then
+  echo "Could not obtain job_status link from API response"
+  cat /tmp/op_backup_response.json || true
+  exit 1
+fi
+
+status_url="https://${OPENPROJECT_DOMAIN}${status_path}"
+
+while true; do
+  curl -s -u "apikey:${OPENPROJECT_API_KEY}" "${status_url}" > /tmp/op_status.json || {
+    echo "Failed to fetch status from ${status_url}"
+    sleep 5
+    continue
+  }
+
+  status="$(jq -r .status < /tmp/op_status.json 2>/dev/null || true)"
+  if [ "${status}" = "success" ]; then
+    echo "Backup ready for download"
+    break
+  fi
+
+  if [ "${status}" = "failed" ] || [ "${status}" = "error" ]; then
+    echo "Backup job failed (status=${status})"
+    cat /tmp/op_status.json || true
+    if [ -n "${DISCORD_WEBHOOK}" ]; then
+      curl -s -H "Content-Type: application/json" -d \
+        "{\"content\": \"<@&585512338728419341> \`OpenProject\` backup for **${job_name}** has **FAILED**. Status: ${status}. Date: $(TZ=Europe/Dublin date)\"}" \
+        "${DISCORD_WEBHOOK}" || true
+    fi
+    exit 2
+  fi
+
+  echo "waiting for backup generation (current status=${status})"
+  sleep 5
+done
+
+download_path="$(jq -r .payload.download < /tmp/op_status.json 2>/dev/null || true)"
+if [ -z "${download_path}" ] || [ "${download_path}" = "null" ]; then
+  echo "No download path found in status payload"
+  exit 1
+fi
+
+download_url="https://${OPENPROJECT_DOMAIN}${download_path}"
+
+curl -s -u "apikey:${OPENPROJECT_API_KEY}" -L "${download_url}" -o "${outfile}" || {
+  echo "Failed to download backup to ${outfile}"
+  [ -f "${outfile}" ] && rm -f "${outfile}"
+  exit 1
+}
+
+if [ -s "${outfile}" ]; then
+  echo "Backup successful: ${outfile}"
+else
+  echo "Downloaded file is empty or missing: ${outfile}"
+  rm -f "${outfile}" || true
+  if [ -n "${DISCORD_WEBHOOK}" ]; then
+    curl -s -H "Content-Type: application/json" -d \
+      "{\"content\": \"<@&585512338728419341> \`OpenProject\` backup for **${job_name}** has just **FAILED** (empty file). File: ${outfile} Date: $(TZ=Europe/Dublin date)\"}" \
+      "${DISCORD_WEBHOOK}" || true
+  fi
+  exit 1
+fi
+
+find "${BACKUP_BASE}" -name 'openproject-*.zip' -ctime +3 -exec rm {} \; || true
+
+exit 0
+EOH
+      }
+
+      template {
+        destination = "local/consul_env"
+        env         = true
+        data        = <<EOH
+OPENPROJECT_DOMAIN={{ key "dcusr/openproject/domain" }}
+OPENPROJECT_API_KEY={{ key "dcusr/openproject/api/key" }}
+OPENPROJECT_BACKUP_TOKEN={{ key "dcusr/openproject/backup/token" }}
+DISCORD_WEBHOOK={{ key "dcusr/postgres/webhook/discord" }}
+EOH
+      }
+
+      resources {
+        cpu    = 200
+        memory = 256
+      }
+    }
+  }
+}
diff --git a/jobs/socs/dcusr/dcusr-openproject.hcl b/jobs/socs/dcusr/dcusr-openproject.hcl
new file mode 100644
index 0000000..9646a25
--- /dev/null
+++ b/jobs/socs/dcusr/dcusr-openproject.hcl
@@ -0,0 +1,79 @@
+job "dcusr-openproject" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "projects.solarracing.ie"
+  }
+
+  group "openproject" {
+    count = 1
+
+    network {
+      port "http" { 
+        to = 80 
+      }
+    }
+
+    restart {
+      attempts = 20
+      delay    = "10s"
+      interval = "10m"
+      mode     = "delay"
+    }
+
+    service {
+      name     = "openproject"
+      port     = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.port=${NOMAD_PORT_http}",
+        "traefik.http.routers.dcusr-openproject.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-openproject.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.dcusr-openproject.tls=true",
+        "traefik.http.routers.dcusr-openproject.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "openproject-aio" {
+      driver = "docker"
+
+      config {
+        image = "openproject/openproject:16"
+        ports = ["http"]
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/pgdata:/var/openproject/pgdata",
+          "/storage/nomad/${NOMAD_JOB_NAME}/assets:/var/openproject/assets",
+        ]
+      }
+
+      template {
+        destination = "local/app.env"
+        env         = true
+        data = <<EOH
+OPENPROJECT_HOST__NAME={{ env "NOMAD_META_domain" }}
+OPENPROJECT_HTTPS=true
+
+OPENPROJECT_SECRET_KEY_BASE={{ key "dcusr/openproject/secret_key_base" }}
+
+EMAIL_DELIVERY_METHOD=smtp
+SMTP_ADDRESS={{ key "dcusr/openproject/smtp/address" }}
+SMTP_PORT={{ key "dcusr/openproject/smtp/port" }}
+SMTP_DOMAIN={{ key "dcusr/openproject/smtp/domain" }}
+SMTP_AUTHENTICATION={{ key "dcusr/openproject/smtp/auth" }}
+SMTP_USER_NAME={{ key "dcusr/openproject/smtp/username" }}
+SMTP_PASSWORD={{ key "dcusr/openproject/smtp/password" }}
+SMTP_ENABLE_STARTTLS_AUTO=true
+
+EOH
+      }
+
+      resources {
+        cpu    = 1500
+        memory = 8192
+      }
+    }
+  }
+}
+
diff --git a/jobs/socs/dcusr/dcusr-outline-backup.hcl b/jobs/socs/dcusr/dcusr-outline-backup.hcl
new file mode 100644
index 0000000..903c549
--- /dev/null
+++ b/jobs/socs/dcusr/dcusr-outline-backup.hcl
@@ -0,0 +1,50 @@
+job "dcusr-outline-backup" {
+  datacenters = ["aperture"]
+  type        = "batch"
+
+  periodic {
+    crons            = ["0 */3 * * * *"]
+    prohibit_overlap = true
+  }
+
+  group "db-backup" {
+    task "postgres-backup" {
+      driver = "raw_exec"
+
+      config {
+        command = "/bin/bash"
+        args    = ["local/script.sh"]
+      }
+
+      template {
+        data        = <<EOH
+#!/bin/bash
+
+file=/storage/backups/nomad/postgres/dcusr/outline/postgresql-outline-$(date +%Y-%m-%d_%H-%M-%S).sql
+
+mkdir -p /storage/backups/nomad/postgres/dcusr/outline
+
+alloc_id=$(nomad job status dcusr-outline | grep running | tail -n 1 | cut -d " " -f 1)
+
+job_name=$(echo ${NOMAD_JOB_NAME} | cut -d "/" -f 1)
+
+nomad alloc exec -task outline-db $alloc_id pg_dumpall -U {{ key "outline/db/username" }} > "${file}"
+
+find /storage/backups/nomad/postgres/dcusr/outline/postgresql-outline* -ctime +3 -exec rm {} \; || true
+
+if [ -s "$file" ]; then # check if file exists and is not empty
+  echo "Backup successful"
+  exit 0
+else
+  rm $file
+  curl -H "Content-Type: application/json" -d \
+  '{"content": "<@&585512338728419341> `PostgreSQL` backup for **'"${job_name}"'** has just **FAILED**\nFile name: `'"$file"'`\nDate: `'"$(TZ=Europe/Dublin date)"'`\nTurn off this script with `nomad job stop '"${job_name}"'` \n\n## Remember to restart this backup job when fixed!!!"}' \
+  {{ key "postgres/webhook/discord" }}
+fi
+EOH
+        destination = "local/script.sh"
+      }
+    }
+  }
+}
+
diff --git a/jobs/socs/dcusr/dcusr-outline.hcl b/jobs/socs/dcusr/dcusr-outline.hcl
new file mode 100644
index 0000000..5cf438e
--- /dev/null
+++ b/jobs/socs/dcusr/dcusr-outline.hcl
@@ -0,0 +1,148 @@
+job "dcusr-outline" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "outline.solarracing.ie"
+  }
+
+  group "outline" {
+    network {
+      # mode = "bridge"
+      port "http" {
+        static = 3000
+        to     = 3000
+      }
+
+      port "db" {
+        to = 5432
+      }
+
+      port "redis" {
+        to = 6379
+      }
+    }
+
+    service {
+      name = "outline"
+      port = "http"
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "10s"
+        timeout  = "2s"
+      }
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.port=${NOMAD_PORT_http}",
+        "traefik.http.routers.dcusr-outline.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-outline.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.dcusr-outline.tls=true",
+        "traefik.http.routers.dcusr-outline.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "app" {
+      driver = "docker"
+
+      config {
+        image = "docker.getoutline.com/outlinewiki/outline:latest"
+        ports = ["http"]
+
+        volumes = [
+          "/storage/nomad/outline/data:/var/lib/outline/data"
+        ]
+      }
+
+      resources {
+        cpu    = 1000
+        memory = 500
+      }
+
+      template {
+        data        = <<EOH
+NODE_ENV=production
+
+SECRET_KEY={{ key "outline/secret/key" }}
+UTILS_SECRET={{ key "outline/secret/utils" }}
+
+DATABASE_URL=postgres://{{ key "outline/db/username" }}:{{ key "outline/db/password" }}@{{ env "NOMAD_ADDR_db" }}/{{ key "outline/db/name" }}
+DATABASE_CONNECTION_POOL_MIN=
+DATABASE_CONNECTION_POOL_MAX=
+# Uncomment this to disable SSL for connecting to Postgres
+PGSSLMODE=disable
+
+REDIS_URL=redis://{{ env "NOMAD_ADDR_redis" }}
+
+URL=https://{{ env "NOMAD_META_domain" }}
+PORT=3000
+COLLABORATION_URL=https://{{ env "NOMAD_META_domain" }}
+
+FILE_STORAGE=local
+FILE_STORAGE_LOCAL_ROOT_DIR=/var/lib/outline/data
+
+# Maximum allowed size for the uploaded attachment.
+FILE_STORAGE_UPLOAD_MAX_SIZE=262144000
+
+GOOGLE_CLIENT_ID     = "{{ key "outline/google/client/id" }}"
+GOOGLE_CLIENT_SECRET = "{{ key "outline/google/client/secret" }}"
+
+FORCE_HTTPS = false
+
+ENABLE_UPDATES = true
+
+WEB_CONCURRENCY = 1
+
+DEBUG = http
+
+# error, warn, info, http, verbose, debug and silly
+LOG_LEVEL=info
+
+SMTP_HOST       = "{{ key "outline/smtp/host" }}"
+SMTP_PORT       = "{{ key "outline/smtp/port" }}"
+SMTP_USERNAME   = "{{ key "outline/smtp/username" }}"
+SMTP_PASSWORD   = "{{ key "outline/smtp/password" }}"
+SMTP_FROM_EMAIL = "{{ key "outline/smtp/from" }}"
+
+DEFAULT_LANGUAGE=en_US
+EOH
+        destination = "local/.env"
+        env         = true
+      }
+    }
+
+    task "outline-redis" {
+      driver = "docker"
+
+      config {
+        image = "redis:latest"
+        ports = ["redis"]
+      }
+    }
+
+    task "outline-db" {
+      driver = "docker"
+
+      config {
+        image = "postgres:16-alpine"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/outline/postgres:/var/lib/postgresql/data"
+        ]
+      }
+
+      template {
+        data        = <<EOH
+POSTGRES_DB       = "{{ key "outline/db/name" }}"
+POSTGRES_USER     = "{{ key "outline/db/username" }}"
+POSTGRES_PASSWORD = "{{ key "outline/db/password" }}"
+EOH
+        destination = "local/db.env"
+        env         = true
+      }
+    }
+  }
+}
diff --git a/jobs/socs/dcusr/dcusr-rocketchat.hcl b/jobs/socs/dcusr/dcusr-rocketchat.hcl
new file mode 100644
index 0000000..7421dcd
--- /dev/null
+++ b/jobs/socs/dcusr/dcusr-rocketchat.hcl
@@ -0,0 +1,125 @@
+job "dcusr-rocketchat" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain       = "chat.solarracing.ie"
+  }
+
+  group "rocketchat" {
+    count = 1
+
+    network {
+      port "http" {
+        to = 3000
+      }
+      port "db" {
+        to = 27017
+      }
+    }
+
+    restart {
+      attempts = 20
+      delay    = "10s"
+      interval = "10m"
+      mode     = "delay"
+    }
+
+    service {
+      name = "rocketchat"
+      port = "http"
+      tags = [
+        "traefik.enable=true",
+        "traefik.port=${NOMAD_PORT_http}",
+        "traefik.http.routers.dcusr-rocketchat.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.dcusr-rocketchat.tls=true",
+        "traefik.http.routers.dcusr-rocketchat.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-rocketchat.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "init-mongo-perms" {
+      driver = "docker"
+      lifecycle {
+        hook = "prestart"
+      }
+      restart {
+        attempts = 0
+      }
+
+      config {
+        image   = "alpine:3"
+        command = "sh"
+        args    = ["-lc", "mkdir -p /data && chown -R 1001:1001 /data && chmod -R u+rwX,g+rwX /data"]
+        volumes = ["/storage/nomad/${NOMAD_JOB_NAME}/mongodb:/data"]
+      }
+
+      resources {
+        cpu = 50
+        memory = 64
+      }
+    }
+
+    task "mongodb" {
+      driver = "docker"
+
+      config {
+        image = "docker.io/bitnamilegacy/mongodb:8.0.13"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/mongodb:/bitnami/mongodb"
+        ]
+      }
+
+      template {
+        destination = "local/mongo.env"
+        env         = true
+        data = <<EOH
+MONGODB_REPLICA_SET_MODE=primary
+MONGODB_REPLICA_SET_NAME=rs0
+MONGODB_PORT_NUMBER=27017
+MONGODB_INITIAL_PRIMARY_HOST=127.0.0.1
+MONGODB_INITIAL_PRIMARY_PORT_NUMBER=27017
+MONGODB_ADVERTISED_HOSTNAME=localhost
+MONGODB_ENABLE_JOURNAL=true
+ALLOW_EMPTY_PASSWORD=yes
+EOH
+      }
+
+      resources {
+        cpu    = 1000
+        memory = 2048
+      }
+    }
+
+      task "rocketchat" {
+        driver = "docker"
+
+        config {
+          image = "registry.rocket.chat/rocketchat/rocket.chat:latest"
+          ports = ["http"]
+        }
+
+        template {
+          destination = "local/app.env"
+          env         = true
+          data = <<EOH
+MONGO_URL=mongodb://{{ env "NOMAD_ADDR_db" }}/rocketchat?replicaSet=rs0&directConnection=true&serverSelectionTimeoutMS=60000&connectTimeoutMS=30000
+MONGO_OPLOG_URL=mongodb://{{ env "NOMAD_ADDR_db" }}/local?replicaSet=rs0&directConnection=true
+
+ROOT_URL=https://{{ env "NOMAD_META_domain" }}
+PORT=3000
+DEPLOY_METHOD=docker
+
+WEB_PROCESS_COUNT=1
+EOH
+        }
+
+      resources {
+        cpu    = 1000
+        memory = 2048
+      }
+    }
+  }
+}

From e2b8b004f19e07a00d6aecdbc04f66a0bfcc7505 Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Tue, 28 Oct 2025 15:13:13 +0000
Subject: [PATCH 04/15] remove the old files

---
 jobs/socs/dcusr-bookstack.hcl      | 189 -----------------------
 jobs/socs/dcusr-dev.hcl            | 124 ---------------
 jobs/socs/dcusr-grafana.hcl        |  59 -------
 jobs/socs/dcusr-hi-events.hcl      | 149 ------------------
 jobs/socs/dcusr-invoiceninja.hcl   | 238 -----------------------------
 jobs/socs/dcusr-listmonk.hcl       | 105 -------------
 jobs/socs/dcusr-openproject.hcl    |  79 ----------
 jobs/socs/dcusr-outline-backup.hcl |  50 ------
 jobs/socs/dcusr-outline.hcl        | 148 ------------------
 jobs/socs/dcusr-pretix.hcl         | 137 -----------------
 jobs/socs/dcusr-rocketchat.hcl     | 125 ---------------
 jobs/socs/dcusr.hcl                |  65 --------
 jobs/socs/dcusr/dcusr-listmonk.hcl |   2 -
 13 files changed, 1470 deletions(-)
 delete mode 100644 jobs/socs/dcusr-bookstack.hcl
 delete mode 100644 jobs/socs/dcusr-dev.hcl
 delete mode 100644 jobs/socs/dcusr-grafana.hcl
 delete mode 100644 jobs/socs/dcusr-hi-events.hcl
 delete mode 100644 jobs/socs/dcusr-invoiceninja.hcl
 delete mode 100644 jobs/socs/dcusr-listmonk.hcl
 delete mode 100644 jobs/socs/dcusr-openproject.hcl
 delete mode 100644 jobs/socs/dcusr-outline-backup.hcl
 delete mode 100644 jobs/socs/dcusr-outline.hcl
 delete mode 100644 jobs/socs/dcusr-pretix.hcl
 delete mode 100644 jobs/socs/dcusr-rocketchat.hcl
 delete mode 100644 jobs/socs/dcusr.hcl

diff --git a/jobs/socs/dcusr-bookstack.hcl b/jobs/socs/dcusr-bookstack.hcl
deleted file mode 100644
index 6bd9fdf..0000000
--- a/jobs/socs/dcusr-bookstack.hcl
+++ /dev/null
@@ -1,189 +0,0 @@
-job "dcusr-bookstack" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  meta {
-    domain = "wiki.solarracing.ie"
-  }
-
-  group "bookstack" {
-    count = 1
-
-    network {
-      port "http" {
-        to = 80
-      }
-
-      port "db" {
-        to = 3306
-      }
-
-      port "redis" {
-        to = 6379
-      }
-    }
-
-    service {
-      name = "bookstack"
-      port = "http"
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.http.routers.dcusr-bookstack.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.dcusr-bookstack.entrypoints=web,websecure",
-        "traefik.http.routers.dcusr-bookstack.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "bookstack" {
-      driver = "docker"
-
-      config {
-        image = "lscr.io/linuxserver/bookstack:latest"
-        ports = ["http"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/config",
-        ]
-      }
-
-      template {
-        destination = "local.env"
-        env         = true
-        data        = <<EOH
-PUID = "1000"
-PGID = "1000"
-TZ   = "Europe/Dublin"
-
-APP_URL=https://{{ env "NOMAD_META_domain" }}
-APP_KEY={{ key "socs/dcusr/bookstack/app/key" }}
-APP_AUTO_LANG_PUBLIC=false
-
-DB_HOST={{ env "NOMAD_HOST_IP_db" }}
-DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
-DB_USERNAME={{ key "socs/dcusr/bookstack/db/user" }}
-DB_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
-DB_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
-
-MAIL_DRIVER=smtp
-MAIL_HOST={{ key "socs/dcusr/bookstack/smtp/host" }}
-MAIL_PORT=587
-MAIL_ENCRYPTION=tls
-MAIL_USERNAME={{ key "socs/dcusr/bookstack/smtp/user" }}
-MAIL_PASSWORD={{ key "socs/dcusr/bookstack/smtp/password" }}
-MAIL_FROM={{ key "socs/dcusr/bookstack/smtp/user" }}
-MAIL_FROM_NAME={{ key "socs/dcusr/bookstack/smtp/name" }}
-
-REDIS_SERVERS={{ env "NOMAD_ADDR_redis" }}
-
-QUEUE_CONNECTION=redis
-CACHE_DRIVER=redis
-SESSION_DRIVER=redis
-EOH
-      }
-
-      resources {
-        cpu    = 500
-        memory = 1024
-      }
-    }
-
-    task "mariadb" {
-      driver = "docker"
-
-      config {
-        image = "mariadb:10.11"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/mysql",
-        ]
-      }
-
-      template {
-        destination = "local/.env"
-        env         = true
-        data        = <<EOH
-MYSQL_ROOT_PASSWORD={{ key "socs/dcusr/bookstack/db/root/password" }}
-MYSQL_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
-MYSQL_USER={{ key "socs/dcusr/bookstack/db/user" }}
-MYSQL_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
-EOH
-      }
-
-      resources {
-        cpu    = 500
-        memory = 1024
-      }
-    }
-
-    task "redis" {
-      driver = "docker"
-
-      config {
-        image = "redis:7-alpine"
-        ports = ["redis"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/data",
-        ]
-      }
-
-      resources {
-        cpu    = 200
-        memory = 256
-      }
-    }
-
-    task "queue-worker" {
-      driver = "docker"
-
-      config {
-        image   = "lscr.io/linuxserver/bookstack:latest"
-        command = "php"
-        args    = ["/app/www/artisan", "queue:work", "--sleep=3", "--tries=3", "--timeout=60"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/config",
-        ]
-      }
-
-      template {
-        destination = "local/.env"
-        env         = true
-        data        = <<EOH
-PUID = "1000"
-PGID = "1000"
-TZ   = "Europe/Dublin"
-
-APP_URL=https://{{ env "NOMAD_META_domain" }}
-APP_KEY={{ key "socs/dcusr/bookstack/app/key" }}
-
-DB_HOST={{ env "NOMAD_HOST_IP_db" }}
-DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
-DB_USERNAME={{ key "socs/dcusr/bookstack/db/user" }}
-DB_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
-DB_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
-
-MAIL_DRIVER=smtp
-MAIL_HOST={{ key "socs/dcusr/bookstack/smtp/host" }}
-MAIL_PORT=587
-MAIL_ENCRYPTION=tls
-MAIL_USERNAME={{ key "socs/dcusr/bookstack/smtp/user" }}
-MAIL_PASSWORD={{ key "socs/dcusr/bookstack/smtp/password" }}
-MAIL_FROM={{ key "socs/dcusr/bookstack/smtp/user" }}
-MAIL_FROM_NAME={{ key "socs/dcusr/bookstack/smtp/name" }}
-
-REDIS_SERVERS={{ env "NOMAD_ADDR_redis" }}
-
-QUEUE_CONNECTION=redis
-EOH
-      }
-
-      resources {
-        cpu    = 300
-        memory = 512
-      }
-    }
-  }
-}
diff --git a/jobs/socs/dcusr-dev.hcl b/jobs/socs/dcusr-dev.hcl
deleted file mode 100644
index f8a3ba8..0000000
--- a/jobs/socs/dcusr-dev.hcl
+++ /dev/null
@@ -1,124 +0,0 @@
-job "dcusr-dev" {
-  datacenters = ["aperture"]
-  type = "service"
-
-  meta {
-    domain = "solarracing.ie"
-  }
-
-  group "dcusr-dev" {
-    count = 1
-
-    network {
-      port "http" {
-        to = 3000
-      }
-      port "db" {
-        to = 5432
-      }
-    }
-
-    service {
-      name = "dcusr-dev"
-      port = "http"
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.http.routers.dcusr-dev.rule=Host(`solarracing.ie`) || Host(`www.solarracing.ie`)",
-        "traefik.http.routers.dcusr-dev.entrypoints=web,websecure",
-        "traefik.http.routers.dcusr-dev.tls.certresolver=lets-encrypt",
-        "traefik.http.middlewares.nextauth-headers.headers.sslProxyHeaders.X-Forwarded-Proto=https",
-        "traefik.http.middlewares.nextauth-headers.headers.customRequestHeaders.X-Forwarded-Host=solarracing.ie",
-        "traefik.http.routers.dcusr-dev.middlewares=nextauth-headers@consulcatalog",
-
-      ]
-    }
-
-    task "nextjs-website" {
-      driver = "docker"
-
-      config {
-        image = "ghcr.io/dcu-solar-racing/website:main"
-        ports = ["http"]
-        force_pull = true
-
-        auth {
-          username = "${DOCKER_USER}"
-          password = "${DOCKER_PASS}"
-        }
-      }
-      template {
-        destination = "secrets/secret.env"
-        env         = true
-        data        = <<EOH
-DOCKER_USER={{ key "dcusr/ghcr/username" }}
-DOCKER_PASS={{ key "dcusr/ghcr/password" }}
-
-NEXT_PUBLIC_SITE_URL=https://{{ env "NOMAD_META_domain" }}
-
-AUTH_URL=https://{{ env "NOMAD_META_domain" }}
-AUTH_TRUST_HOST=true
-AUTH_SECRET={{ key "socs/dcusr-dev/auth/secret" }}
-
-NEXTAUTH_URL=https://{{ env "NOMAD_META_domain" }}
-NEXTAUTH_SECRET={{ key "socs/dcusr-dev/auth/secret" }}
-
-PREVIEW_SECRET={{ key "socs/dcusr-dev/preview/secret" }}
-
-SEED_ADMIN_EMAIL={{ key "socs/dcusr-dev/seed/email" }}
-SEED_ADMIN_PASSWORD={{ key "socs/dcusr-dev/seed/password" }}
-
-DATABASE_URL=postgresql://{{ key "socs/dcusr-dev/db/user" | urlquery }}:{{ key "socs/dcusr-dev/db/password" | urlquery }}@{{ env "NOMAD_ADDR_db" }}/{{ key "socs/dcusr-dev/db/name" | urlquery }}?schema=public
-
-MINIO_ENDPOINT={{ key "socs/dcusr-dev/minio/url" }}
-MINIO_PORT={{ key "socs/dcusr-dev/minio/port" }}
-MINIO_ACCESS_KEY="{{ key "socs/dcusr-dev/minio/access/key" }}"
-MINIO_SECRET_KEY="{{ key "socs/dcusr-dev/minio/secret/key" }}"
-MINIO_BUCKET={{ key "socs/dcusr-dev/minio/bucket" }}
-MINIO_USE_SSL=true
-MINIO_PUBLIC_BASE_URL={{ key "socs/dcusr-dev/minio/base/url" }}
-MINIO_FORCE_PATH_STYLE=true
-MINIO_PUBLIC_URL={{ key "socs/dcusr-dev/minio/public/url" }}
-MINIO_REGION=ie-redbrick
-
-SMTP_HOST=smtp.gmail.com
-SMTP_PORT=465
-SMTP_USER={{ key "socs/dcusr-dev/smtp/user" }}
-SMTP_PASS={{ key "socs/dcusr-dev/smtp/password" }}
-MAIL_FROM={{ key "socs/dcusr-dev/mail/from" }}
-MAIL_TO={{ key "socs/dcusr-dev/mail/to" }}
-SMTP_SECURE=true
-SMTP_REJECT=true
-
-MAIL_BRAND="DCU Solar Racing"
-MAIL_PRIMARY="#22c55e"
-
-PLAUSIBLE_BASE_URL={{ key "socs/dcusr-dev/plausible/url" }}
-EOH
-      }
-    }
-
-    task "postgres" {
-      driver = "docker"
-
-      config {
-        image = "postgres:17-alpine"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/dcusr-dev/db:/var/lib/postgresql/data",
-        ]
-      }
-
-      template {
-        destination = "local/.env"
-        env         = true
-        data        = <<EOH
-POSTGRES_DB={{ key "socs/dcusr-dev/db/name" }}
-POSTGRES_USER={{ key "socs/dcusr-dev/db/user" }}
-POSTGRES_PASSWORD={{ key "socs/dcusr-dev/db/password" }}
-EOH
-      }
-    }
-  }
-}
diff --git a/jobs/socs/dcusr-grafana.hcl b/jobs/socs/dcusr-grafana.hcl
deleted file mode 100644
index d2e1210..0000000
--- a/jobs/socs/dcusr-grafana.hcl
+++ /dev/null
@@ -1,59 +0,0 @@
-job "dcusr-grafana" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  meta {
-    domain = "dashboard.solarracing.ie"
-  }
-
-  group "grafana" {
-    network {
-      port "http" {
-        to = 3000
-      }
-    }
-
-    service {
-      name = "grafana"
-      port = "http"
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.port=${NOMAD_PORT_http}",
-        "traefik.http.routers.grafana.entrypoints=web,websecure",
-        "traefik.http.routers.grafana.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.grafana.tls=true",
-        "traefik.http.routers.grafana.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "grafana" {
-      driver = "docker"
-
-      config {
-        image = "grafana/grafana"
-        ports = ["http"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}/data:/var/lib/grafana",
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}/plugins:/var/lib/grafana/plugins"
-        ]
-      }
-
-      template {
-        data        = <<EOH
-GF_PLUGINS_PREINSTALL=grafana-clock-panel
-GF_USERS_ALLOW_SIGN_UP=false
-EOH
-        destination = "local/.env"
-        env         = true
-      }
-
-      resources {
-        cpu    = 1000
-        memory = 1000
-      }
-    }
-  }
-}
-
diff --git a/jobs/socs/dcusr-hi-events.hcl b/jobs/socs/dcusr-hi-events.hcl
deleted file mode 100644
index 9934b0d..0000000
--- a/jobs/socs/dcusr-hi-events.hcl
+++ /dev/null
@@ -1,149 +0,0 @@
-job "dcusr-hi-events" {
-  datacenters = ["aperture"]
-
-  type = "service"
-
-  meta {
-    domain = "tickets.solarracing.ie"
-  }
-
-  group "web" {
-    network {
-      port "http" {
-        to = 80
-      }
-
-      port "db" {
-        to = 5432
-      }
-
-      port "redis" {
-        to = 6379
-      }
-    }
-
-    task "frontend" {
-      driver = "docker"
-
-      config {
-        image = "daveearley/hi.events-all-in-one"
-        ports = ["http"]
-      }
-
-      service {
-        name = "frontend"
-        port = "http"
-
-        tags = [
-          "traefik.enable=true",
-          "traefik.port=${NOMAD_PORT_http}",
-          "traefik.http.routers.hievents-frontend.entrypoints=web,websecure",
-          "traefik.http.routers.hievents-frontend.rule=Host(`${NOMAD_META_domain}`)",
-          "traefik.http.routers.hievents-frontend.tls=true",
-          "traefik.http.routers.hievents-frontend.tls.certresolver=lets-encrypt",
-        ]
-      }
-
-      resources {
-        memory = 3000
-        cores  = 1
-      }
-
-      template {
-        data        = <<EOH
-# Frontend
-VITE_FRONTEND_URL="https://{{ env "NOMAD_META_domain" }}"
-VITE_API_URL_CLIENT="https://{{ env "NOMAD_META_domain" }}/api"
-VITE_API_URL_SERVER="https://{{ env "NOMAD_META_domain" }}/api"
-VITE_STRIPE_PUBLISHABLE_KEY=
-
-# Backend
-LOG_CHANNEL=stderr
-QUEUE_CONNECTION=redis
-
-# Mail
-MAIL_MAILER=smtp
-MAIL_HOST=smtp.gmail.com
-MAIL_PORT=587
-MAIL_ENCRYPTION=tls
-MAIL_PASSWORD={{ key "hi-events/mail/password" }}
-MAIL_USERNAME={{ key "hi-events/mail/username" }}
-MAIL_FROM_ADDRESS={{ key "hi-events/mail/username" }}
-MAIL_FROM_NAME="DCU Solar Racing"
-
-# App configs
-APP_KEY={{ key "hi-events/app/key" }}
-JWT_SECRET={{key "hi-events/app/jwt" }}
-APP_CDN_URL="https://{{ env "NOMAD_META_domain" }}/storage"
-APP_FRONTEND_URL="https://{{ env "NOMAD_META_domain" }}"
-APP_DISABLE_REGISTRATION=true
-APP_SAAS_MODE_ENABLED=ture
-
-# Filesystem
-FILESYSTEM_PUBLIC_DISK=public
-FILESYSTEM_PRIVATE_DISK=local
-
-# Stripe
-STRIPE_PUBLIC_KEY=
-STRIPE_SECRET_KEY=
-
-# Database
-DB_CONNECTION=pgsql
-DB_HOST={{ env "NOMAD_IP_db" }}
-DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
-DB_DATABASE={{ key "hi-events/db/name" }}
-DB_USERNAME={{ key "hi-events/db/user" }}
-DB_PASSWORD={{ key "hi-events/db/password" }}
-
-# Redis
-REDIS_HOST={{ env "NOMAD_IP_redis" }}
-REDIS_USER={{ key "hi-events/redis/user" }}
-REDIS_PASSWORD=
-REDIS_PORT={{ env "NOMAD_HOST_PORT_redis" }}
-EOH
-        destination = "local/.env"
-        env         = true
-      }
-    }
-
-    task "db" {
-      driver = "docker"
-
-      config {
-        image = "postgres:16-alpine"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/hi-events-all-in-one/db:/var/lib/postgresql/data",
-        ]
-      }
-
-      template {
-        data        = <<EOH
-POSTGRES_DB={{ key "hi-events/db/name" }}
-POSTGRES_USER={{ key "hi-events/db/user" }}
-POSTGRES_PASSWORD={{ key "hi-events/db/password" }}
-EOH
-        destination = "local/db.env"
-        env         = true
-      }
-    }
-
-    task "redis" {
-      driver = "docker"
-
-      config {
-        image = "redis:latest"
-        ports = ["redis"]
-      }
-
-      template {
-        data        = <<EOH
-REDIS_USER={{ key "hi-events/redis/user" }}
-EOH
-        destination = "local/redis.env"
-        env         = true
-      }
-    }
-  }
-}
diff --git a/jobs/socs/dcusr-invoiceninja.hcl b/jobs/socs/dcusr-invoiceninja.hcl
deleted file mode 100644
index a09cd30..0000000
--- a/jobs/socs/dcusr-invoiceninja.hcl
+++ /dev/null
@@ -1,238 +0,0 @@
-job "dcusr-invoiceninja" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  meta {
-    domain = "invoices.solarracing.ie"
-  }
-
-  group "ninja" {
-    count = 1
-
-    network {
-      port "web" { 
-        to = 80 
-      }
-      port "fpm" { 
-        to = 9000 
-      }
-      port "db" { 
-        to = 3306 
-      }
-      port "redis" { 
-        to = 6379 
-      }
-    }
-
-    restart {
-      attempts = 20
-      delay    = "10s"
-      interval = "10m"
-      mode     = "delay"
-    }
-
-    service {
-      name = "invoiceninja"
-      port = "web"
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.port=${NOMAD_PORT_web}",
-        "traefik.http.routers.dcusr-invoiceninja.entrypoints=web,websecure",
-        "traefik.http.routers.dcusr-invoiceninja.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.dcusr-invoiceninja.tls=true",
-        "traefik.http.routers.dcusr-invoiceninja.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "app" {
-      driver = "docker"
-
-      config {
-        image  = "invoiceninja/invoiceninja-debian:latest"
-        ports  = ["fpm"]
-
-        volumes = [
-          "local/.env:/var/www/html/.env",
-          "/storage/nomad/${NOMAD_JOB_NAME}/public:/var/www/html/public",
-          "/storage/nomad/${NOMAD_JOB_NAME}/storage:/var/www/html/storage",
-          "local/99-mysql-client-no-tls.cnf:/etc/mysql/conf.d/99-mysql-client-no-tls.cnf:ro",
-
-        ]
-      }
-
-      resources {
-        cpu    = 4000
-        memory = 8192
-      }
-
-      template {
-        destination = "local/.env"
-        env         = true
-        data = <<EOH
-IS_DOCKER=true
-NINJA_ENVIRONMENT=selfhost
-APP_NAME="DCU Solar Racing invoicing"
-APP_ENV=production
-APP_DEBUG=true
-APP_URL=https://{{ env "NOMAD_META_domain" }}
-REQUIRE_HTTPS=true
-TRUSTED_PROXIES=*
-APP_KEY={{ key "dcusr/invoice/app/key" }}
-PHANTOMJS_PDF_GENERATION=false
-
-FILESYSTEM_DISK=debian_docker
-
-# pdf
-PDF_GENERATOR=snappdf
-
-# database (like compose)
-DB_CONNECTION=mysql
-DB_HOST={{ env "NOMAD_IP_db" }}
-DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
-DB_DATABASE={{ key "dcusr/invoice/db/name" }}
-DB_USERNAME={{ key "dcusr/invoice/db/user" }}
-DB_PASSWORD={{ key "dcusr/invoice/db/password" }}
-DB_STRICT=false
-
-REDIS_HOST={{ env "NOMAD_IP_redis" }}
-REDIS_PORT={{ env "NOMAD_HOST_PORT_redis" }}
-CACHE_DRIVER=redis
-SESSION_DRIVER=redis
-QUEUE_CONNECTION=redis
-
-INTERNAL_QUEUE_ENABLED=true
-
-MAIL_MAILER=smtp
-MAIL_HOST={{ key "dcusr/invoice/smtp/host" }}
-MAIL_PORT={{ key "dcusr/invoice/smtp/port" }}
-MAIL_USERNAME={{ key "dcusr/invoice/smtp/username" }}
-MAIL_PASSWORD="{{ key "dcusr/invoice/smtp/password" }}"
-MAIL_ENCRYPTION={{ key "dcusr/invoice/smtp/encryption" }}
-MAIL_FROM_ADDRESS={{ key "dcusr/invoice/smtp/from_address" }}
-MAIL_FROM_NAME="{{ key "dcusr/invoice/smtp/from_name" }}"
-EOH
-      }
-
-       template {
-        destination = "local/99-mysql-client-no-tls.cnf"
-        data = <<EOH
-[client]
-loose-skip-ssl
-loose-ssl-verify-server-cert=OFF
-loose-ssl-mode=DISABLED
-
-[mysql]
-loose-skip-ssl
-loose-ssl-verify-server-cert=OFF
-loose-ssl-mode=DISABLED
-EOH
-  }
-    }
-
-    task "nginx" {
-      driver = "docker"
-
-      config {
-        image = "nginx:alpine"
-        ports = ["web"]
-        volumes = [
-          "local/nginx:/etc/nginx/conf.d:ro",
-          "/storage/nomad/${NOMAD_JOB_NAME}/public:/var/www/html/public",
-          "/storage/nomad/${NOMAD_JOB_NAME}/storage:/var/www/html/storage",
-      ]
-    }
-
-      template {
-        destination = "local/nginx/invoiceninja.conf"
-        data = <<EOH
-server {
-    listen 80;
-    server_name _;
-    root /var/www/html/public;
-    index index.php index.html;
-    client_max_body_size 100M;
-
-    location / {
-        try_files $uri $uri/ /index.php?$query_string;
-    }
-
-    location ~ \.php(?:$|/) {
-        include fastcgi_params;
-        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
-        fastcgi_param PATH_INFO $fastcgi_path_info;
-        fastcgi_index index.php;
-        fastcgi_read_timeout 300;
-        fastcgi_pass {{ env "NOMAD_ADDR_fpm" }};
-    }
-
-    location ~* \.(jpg|jpeg|gif|png|css|js|ico|svg|woff|woff2|ttf)$ {
-        expires max;
-        log_not_found off;
-    }
-}
-EOH
-    }
-  }
-
-    task "mysql" {
-      driver = "docker"
-
-      config {
-        image = "mysql:8"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/mysql:/var/lib/mysql",
-          "local/zz-no-tls.cnf:/etc/mysql/conf.d/zz-no-tls.cnf:ro",
-      ]
-    }
-
-    resources {
-      cpu    = 500
-      memory = 1024
-    }
-
-    template {
-      destination = "local/mysql.env"
-      env         = true
-      data = <<EOH
-MYSQL_DATABASE={{ key "dcusr/invoice/db/name" }}
-MYSQL_USER={{ key "dcusr/invoice/db/user" }}
-MYSQL_PASSWORD={{ key "dcusr/invoice/db/password" }}
-MYSQL_ROOT_PASSWORD={{ key "dcusr/invoice/db/root_password" }}
-EOH
-  }
-
-    template {
-      destination = "local/zz-no-tls.cnf"
-      data = <<EOH
-[mysqld]
-require_secure_transport=OFF
-tls_version=
-admin_tls_version=
-EOH
-  }
-}
-
-
-    task "redis" {
-      driver = "docker"
-
-      config {
-        image = "redis:alpine"
-        ports = ["redis"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/redis:/data",
-        ]
-      }
-
-      resources {
-        cpu    = 150
-        memory = 128
-      }
-    }
-  }
-}
-
diff --git a/jobs/socs/dcusr-listmonk.hcl b/jobs/socs/dcusr-listmonk.hcl
deleted file mode 100644
index 3f9ea7b..0000000
--- a/jobs/socs/dcusr-listmonk.hcl
+++ /dev/null
@@ -1,105 +0,0 @@
-job "dcusr-listmonk" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  meta {
-    domain = "lists.solarracing.ie"
-  }
-
-  group "listmonk" {
-    network {
-      port "http" {
-      }
-
-      port "db" {
-        to = 5432
-      }
-    }
-
-    service {
-      name = "listmonk"
-      port = "http"
-
-      check {
-        type     = "http"
-        path     = "/"
-        interval = "10s"
-        timeout  = "2s"
-      }
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.port=${NOMAD_PORT_http}",
-        "traefik.http.routers.dcusr-listmonk.entrypoints=web,websecure",
-        "traefik.http.routers.dcusr-listmonk.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.dcusr-listmonk.tls=true",
-        "traefik.http.routers.dcusr-listmonk.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "app" {
-      driver = "docker"
-
-      config {
-        image = "listmonk/listmonk:latest"
-        ports = ["http"]
-
-        entrypoint = ["./listmonk", "--static-dir=/listmonk/static"]
-
-        volumes = [
-          "/storage/nomad/dcusr-listmonk/static:/listmonk/static",
-          "/storage/nomad/dcusr-listmonk/postgres/:/var/lib/postgresql/data",
-          "local/config.toml:/listmonk/config.toml"
-        ]
-      }
-
-      resources {
-        cpu    = 1000
-        memory = 500
-      }
-
-      template {
-        data        = <<EOH
-[app]
-address = "0.0.0.0:{{ env "NOMAD_PORT_http" }}"
-
-# Database.
-[db]
-host = "{{ env "NOMAD_HOST_IP_db" }}"
-port = {{ env "NOMAD_HOST_PORT_db" }}
-user = "{{ key "dcusr/listmonk/db/username" }}"
-password = "{{ key "dcusr/listmonk/db/password" }}"
-database = "{{ key "dcusr/listmonk/db/name" }}"
-ssl_mode = "disable"
-max_open = 25
-max_idle = 25
-max_lifetime = "300s"
-EOH
-        destination = "local/config.toml"
-      }
-    }
-
-    task "listmonk-db" {
-      driver = "docker"
-
-      config {
-        image = "postgres:17-alpine"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/dcusr-listmonk/postgres:/var/lib/postgresql/data"
-        ]
-      }
-
-      template {
-        data        = <<EOH
-POSTGRES_DB       = "{{ key "dcusr/listmonk/db/name" }}"
-POSTGRES_USER     = "{{ key "dcusr/listmonk/db/username" }}"
-POSTGRES_PASSWORD = "{{ key "dcusr/listmonk/db/password" }}"
-EOH
-        destination = "local/db.env"
-        env         = true
-      }
-    }
-  }
-}
diff --git a/jobs/socs/dcusr-openproject.hcl b/jobs/socs/dcusr-openproject.hcl
deleted file mode 100644
index 9646a25..0000000
--- a/jobs/socs/dcusr-openproject.hcl
+++ /dev/null
@@ -1,79 +0,0 @@
-job "dcusr-openproject" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  meta {
-    domain = "projects.solarracing.ie"
-  }
-
-  group "openproject" {
-    count = 1
-
-    network {
-      port "http" { 
-        to = 80 
-      }
-    }
-
-    restart {
-      attempts = 20
-      delay    = "10s"
-      interval = "10m"
-      mode     = "delay"
-    }
-
-    service {
-      name     = "openproject"
-      port     = "http"
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.port=${NOMAD_PORT_http}",
-        "traefik.http.routers.dcusr-openproject.entrypoints=web,websecure",
-        "traefik.http.routers.dcusr-openproject.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.dcusr-openproject.tls=true",
-        "traefik.http.routers.dcusr-openproject.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "openproject-aio" {
-      driver = "docker"
-
-      config {
-        image = "openproject/openproject:16"
-        ports = ["http"]
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/pgdata:/var/openproject/pgdata",
-          "/storage/nomad/${NOMAD_JOB_NAME}/assets:/var/openproject/assets",
-        ]
-      }
-
-      template {
-        destination = "local/app.env"
-        env         = true
-        data = <<EOH
-OPENPROJECT_HOST__NAME={{ env "NOMAD_META_domain" }}
-OPENPROJECT_HTTPS=true
-
-OPENPROJECT_SECRET_KEY_BASE={{ key "dcusr/openproject/secret_key_base" }}
-
-EMAIL_DELIVERY_METHOD=smtp
-SMTP_ADDRESS={{ key "dcusr/openproject/smtp/address" }}
-SMTP_PORT={{ key "dcusr/openproject/smtp/port" }}
-SMTP_DOMAIN={{ key "dcusr/openproject/smtp/domain" }}
-SMTP_AUTHENTICATION={{ key "dcusr/openproject/smtp/auth" }}
-SMTP_USER_NAME={{ key "dcusr/openproject/smtp/username" }}
-SMTP_PASSWORD={{ key "dcusr/openproject/smtp/password" }}
-SMTP_ENABLE_STARTTLS_AUTO=true
-
-EOH
-      }
-
-      resources {
-        cpu    = 1500
-        memory = 8192
-      }
-    }
-  }
-}
-
diff --git a/jobs/socs/dcusr-outline-backup.hcl b/jobs/socs/dcusr-outline-backup.hcl
deleted file mode 100644
index 903c549..0000000
--- a/jobs/socs/dcusr-outline-backup.hcl
+++ /dev/null
@@ -1,50 +0,0 @@
-job "dcusr-outline-backup" {
-  datacenters = ["aperture"]
-  type        = "batch"
-
-  periodic {
-    crons            = ["0 */3 * * * *"]
-    prohibit_overlap = true
-  }
-
-  group "db-backup" {
-    task "postgres-backup" {
-      driver = "raw_exec"
-
-      config {
-        command = "/bin/bash"
-        args    = ["local/script.sh"]
-      }
-
-      template {
-        data        = <<EOH
-#!/bin/bash
-
-file=/storage/backups/nomad/postgres/dcusr/outline/postgresql-outline-$(date +%Y-%m-%d_%H-%M-%S).sql
-
-mkdir -p /storage/backups/nomad/postgres/dcusr/outline
-
-alloc_id=$(nomad job status dcusr-outline | grep running | tail -n 1 | cut -d " " -f 1)
-
-job_name=$(echo ${NOMAD_JOB_NAME} | cut -d "/" -f 1)
-
-nomad alloc exec -task outline-db $alloc_id pg_dumpall -U {{ key "outline/db/username" }} > "${file}"
-
-find /storage/backups/nomad/postgres/dcusr/outline/postgresql-outline* -ctime +3 -exec rm {} \; || true
-
-if [ -s "$file" ]; then # check if file exists and is not empty
-  echo "Backup successful"
-  exit 0
-else
-  rm $file
-  curl -H "Content-Type: application/json" -d \
-  '{"content": "<@&585512338728419341> `PostgreSQL` backup for **'"${job_name}"'** has just **FAILED**\nFile name: `'"$file"'`\nDate: `'"$(TZ=Europe/Dublin date)"'`\nTurn off this script with `nomad job stop '"${job_name}"'` \n\n## Remember to restart this backup job when fixed!!!"}' \
-  {{ key "postgres/webhook/discord" }}
-fi
-EOH
-        destination = "local/script.sh"
-      }
-    }
-  }
-}
-
diff --git a/jobs/socs/dcusr-outline.hcl b/jobs/socs/dcusr-outline.hcl
deleted file mode 100644
index 5cf438e..0000000
--- a/jobs/socs/dcusr-outline.hcl
+++ /dev/null
@@ -1,148 +0,0 @@
-job "dcusr-outline" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  meta {
-    domain = "outline.solarracing.ie"
-  }
-
-  group "outline" {
-    network {
-      # mode = "bridge"
-      port "http" {
-        static = 3000
-        to     = 3000
-      }
-
-      port "db" {
-        to = 5432
-      }
-
-      port "redis" {
-        to = 6379
-      }
-    }
-
-    service {
-      name = "outline"
-      port = "http"
-
-      check {
-        type     = "http"
-        path     = "/"
-        interval = "10s"
-        timeout  = "2s"
-      }
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.port=${NOMAD_PORT_http}",
-        "traefik.http.routers.dcusr-outline.entrypoints=web,websecure",
-        "traefik.http.routers.dcusr-outline.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.dcusr-outline.tls=true",
-        "traefik.http.routers.dcusr-outline.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "app" {
-      driver = "docker"
-
-      config {
-        image = "docker.getoutline.com/outlinewiki/outline:latest"
-        ports = ["http"]
-
-        volumes = [
-          "/storage/nomad/outline/data:/var/lib/outline/data"
-        ]
-      }
-
-      resources {
-        cpu    = 1000
-        memory = 500
-      }
-
-      template {
-        data        = <<EOH
-NODE_ENV=production
-
-SECRET_KEY={{ key "outline/secret/key" }}
-UTILS_SECRET={{ key "outline/secret/utils" }}
-
-DATABASE_URL=postgres://{{ key "outline/db/username" }}:{{ key "outline/db/password" }}@{{ env "NOMAD_ADDR_db" }}/{{ key "outline/db/name" }}
-DATABASE_CONNECTION_POOL_MIN=
-DATABASE_CONNECTION_POOL_MAX=
-# Uncomment this to disable SSL for connecting to Postgres
-PGSSLMODE=disable
-
-REDIS_URL=redis://{{ env "NOMAD_ADDR_redis" }}
-
-URL=https://{{ env "NOMAD_META_domain" }}
-PORT=3000
-COLLABORATION_URL=https://{{ env "NOMAD_META_domain" }}
-
-FILE_STORAGE=local
-FILE_STORAGE_LOCAL_ROOT_DIR=/var/lib/outline/data
-
-# Maximum allowed size for the uploaded attachment.
-FILE_STORAGE_UPLOAD_MAX_SIZE=262144000
-
-GOOGLE_CLIENT_ID     = "{{ key "outline/google/client/id" }}"
-GOOGLE_CLIENT_SECRET = "{{ key "outline/google/client/secret" }}"
-
-FORCE_HTTPS = false
-
-ENABLE_UPDATES = true
-
-WEB_CONCURRENCY = 1
-
-DEBUG = http
-
-# error, warn, info, http, verbose, debug and silly
-LOG_LEVEL=info
-
-SMTP_HOST       = "{{ key "outline/smtp/host" }}"
-SMTP_PORT       = "{{ key "outline/smtp/port" }}"
-SMTP_USERNAME   = "{{ key "outline/smtp/username" }}"
-SMTP_PASSWORD   = "{{ key "outline/smtp/password" }}"
-SMTP_FROM_EMAIL = "{{ key "outline/smtp/from" }}"
-
-DEFAULT_LANGUAGE=en_US
-EOH
-        destination = "local/.env"
-        env         = true
-      }
-    }
-
-    task "outline-redis" {
-      driver = "docker"
-
-      config {
-        image = "redis:latest"
-        ports = ["redis"]
-      }
-    }
-
-    task "outline-db" {
-      driver = "docker"
-
-      config {
-        image = "postgres:16-alpine"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/outline/postgres:/var/lib/postgresql/data"
-        ]
-      }
-
-      template {
-        data        = <<EOH
-POSTGRES_DB       = "{{ key "outline/db/name" }}"
-POSTGRES_USER     = "{{ key "outline/db/username" }}"
-POSTGRES_PASSWORD = "{{ key "outline/db/password" }}"
-EOH
-        destination = "local/db.env"
-        env         = true
-      }
-    }
-  }
-}
diff --git a/jobs/socs/dcusr-pretix.hcl b/jobs/socs/dcusr-pretix.hcl
deleted file mode 100644
index 0186a0a..0000000
--- a/jobs/socs/dcusr-pretix.hcl
+++ /dev/null
@@ -1,137 +0,0 @@
-job "dcusr-pretix" {
-  datacenters = ["aperture"]
-
-  type = "service"
-
-  meta {
-    domain = "tickets.solarracing.ie"
-  }
-
-  group "web" {
-    network {
-      # mode = "bridge"
-      port "http" {
-        to = 80
-      }
-
-      port "db" {
-        to = 5432
-      }
-
-      port "redis" {
-        to = 6379
-      }
-    }
-
-    service {
-      name = "pretix-web"
-      port = "http"
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.port=${NOMAD_PORT_http}",
-        "traefik.http.routers.pretix.entrypoints=web,websecure",
-        "traefik.http.routers.pretix.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.pretix.tls=true",
-        "traefik.http.routers.pretix.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "pretix" {
-      driver = "docker"
-
-      config {
-        image = "pretix/standalone:stable"
-        ports = ["http"]
-
-        volumes = [
-          "local/pretix.cfg:/etc/pretix/pretix.cfg",
-          "/storage/nomad/pretix/data:/data",
-          "/etc/timezone:/etc/timezone:ro",
-        ]
-
-      }
-
-      resources {
-        memory = 5000
-        cores  = 1
-      }
-      env {
-        NUM_WORKERS = 1
-      }
-
-      template {
-        data        = <<EOH
-[pretix]
-instance_name=DCU Solar Racing
-url=https://{{ env "NOMAD_META_domain" }}
-currency=EUR
-datadir=/data
-registration=off
-
-[locale]
-timezone=Europe/Dublin
-
-[database]
-backend=postgresql
-name={{ key "pretix/db/name" }}
-user={{ key "pretix/db/user" }}
-password={{ key "pretix/db/password" }}
-host={{ env "NOMAD_IP_db" }}
-port={{ env "NOMAD_HOST_PORT_db" }}
-
-[mail]
-from={{ key "pretix/mail/from" }}
-host={{ key "pretix/mail/host" }}
-user={{ key "pretix/mail/user" }}
-password={{ key "pretix/mail/password" }}
-port=587
-tls=on
-ssl=off
-
-[redis]
-location=redis://{{ env "NOMAD_ADDR_redis" }}/0
-sessions=true
-
-[celery]
-backend=redis://{{ env "NOMAD_ADDR_redis" }}/1
-broker=redis://{{ env "NOMAD_ADDR_redis" }}/2
-worker_prefetch_multiplier = 0
-EOH
-        destination = "local/pretix.cfg"
-      }
-    }
-
-
-    task "pretix-db" {
-      driver = "docker"
-
-      config {
-        image = "postgres:16-alpine"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/pretix/db:/var/lib/postgresql/data",
-        ]
-      }
-
-      template {
-        data        = <<EOH
-POSTGRES_USER={{ key "pretix/db/user" }}
-POSTGRES_PASSWORD={{ key "pretix/db/password" }}
-EOH
-        destination = "local/db.env"
-        env         = true
-      }
-    }
-
-    task "redis" {
-      driver = "docker"
-
-      config {
-        image = "redis:latest"
-        ports = ["redis"]
-      }
-    }
-  }
-}
diff --git a/jobs/socs/dcusr-rocketchat.hcl b/jobs/socs/dcusr-rocketchat.hcl
deleted file mode 100644
index 7421dcd..0000000
--- a/jobs/socs/dcusr-rocketchat.hcl
+++ /dev/null
@@ -1,125 +0,0 @@
-job "dcusr-rocketchat" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  meta {
-    domain       = "chat.solarracing.ie"
-  }
-
-  group "rocketchat" {
-    count = 1
-
-    network {
-      port "http" {
-        to = 3000
-      }
-      port "db" {
-        to = 27017
-      }
-    }
-
-    restart {
-      attempts = 20
-      delay    = "10s"
-      interval = "10m"
-      mode     = "delay"
-    }
-
-    service {
-      name = "rocketchat"
-      port = "http"
-      tags = [
-        "traefik.enable=true",
-        "traefik.port=${NOMAD_PORT_http}",
-        "traefik.http.routers.dcusr-rocketchat.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.dcusr-rocketchat.tls=true",
-        "traefik.http.routers.dcusr-rocketchat.entrypoints=web,websecure",
-        "traefik.http.routers.dcusr-rocketchat.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "init-mongo-perms" {
-      driver = "docker"
-      lifecycle {
-        hook = "prestart"
-      }
-      restart {
-        attempts = 0
-      }
-
-      config {
-        image   = "alpine:3"
-        command = "sh"
-        args    = ["-lc", "mkdir -p /data && chown -R 1001:1001 /data && chmod -R u+rwX,g+rwX /data"]
-        volumes = ["/storage/nomad/${NOMAD_JOB_NAME}/mongodb:/data"]
-      }
-
-      resources {
-        cpu = 50
-        memory = 64
-      }
-    }
-
-    task "mongodb" {
-      driver = "docker"
-
-      config {
-        image = "docker.io/bitnamilegacy/mongodb:8.0.13"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/mongodb:/bitnami/mongodb"
-        ]
-      }
-
-      template {
-        destination = "local/mongo.env"
-        env         = true
-        data = <<EOH
-MONGODB_REPLICA_SET_MODE=primary
-MONGODB_REPLICA_SET_NAME=rs0
-MONGODB_PORT_NUMBER=27017
-MONGODB_INITIAL_PRIMARY_HOST=127.0.0.1
-MONGODB_INITIAL_PRIMARY_PORT_NUMBER=27017
-MONGODB_ADVERTISED_HOSTNAME=localhost
-MONGODB_ENABLE_JOURNAL=true
-ALLOW_EMPTY_PASSWORD=yes
-EOH
-      }
-
-      resources {
-        cpu    = 1000
-        memory = 2048
-      }
-    }
-
-      task "rocketchat" {
-        driver = "docker"
-
-        config {
-          image = "registry.rocket.chat/rocketchat/rocket.chat:latest"
-          ports = ["http"]
-        }
-
-        template {
-          destination = "local/app.env"
-          env         = true
-          data = <<EOH
-MONGO_URL=mongodb://{{ env "NOMAD_ADDR_db" }}/rocketchat?replicaSet=rs0&directConnection=true&serverSelectionTimeoutMS=60000&connectTimeoutMS=30000
-MONGO_OPLOG_URL=mongodb://{{ env "NOMAD_ADDR_db" }}/local?replicaSet=rs0&directConnection=true
-
-ROOT_URL=https://{{ env "NOMAD_META_domain" }}
-PORT=3000
-DEPLOY_METHOD=docker
-
-WEB_PROCESS_COUNT=1
-EOH
-        }
-
-      resources {
-        cpu    = 1000
-        memory = 2048
-      }
-    }
-  }
-}
diff --git a/jobs/socs/dcusr.hcl b/jobs/socs/dcusr.hcl
deleted file mode 100644
index 75b23be..0000000
--- a/jobs/socs/dcusr.hcl
+++ /dev/null
@@ -1,65 +0,0 @@
-job "dcusr" {
-  datacenters = ["aperture"]
-
-  type = "service"
-
-  group "dcusr" {
-    count = 1
-
-    network {
-      port "http" {
-        to = 3000
-      }
-    }
-
-    service {
-      name = "dcusr"
-      port = "http"
-
-      check {
-        type = "http"
-        path = "/"
-        interval = "10s"
-        timeout = "2s"
-      }
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.http.routers.dcusr.rule=Host(`solarracing.rb.dcu.ie`) || Host(`solarracing.ie`) || Host(`www.solarracing.ie`)",
-        "traefik.http.routers.dcusr.entrypoints=web,websecure",
-        "traefik.http.routers.dcusr.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "nextjs-website" {
-      driver = "docker"
-
-      config {
-        image = "ghcr.io/dcu-solar-racing/nextjs-website:main"
-        ports = ["http"]
-        force_pull = true
-        auth {
-          username = "${DOCKER_USER}"
-          password = "${DOCKER_PASS}"
-        }
-      }
-      template {
-        destination = "secrets/secret.env"
-        env         = true
-        change_mode = "restart"
-        data        = <<EOH
-DOCKER_USER={{ key "dcusr/ghcr/username" }}
-DOCKER_PASS={{ key "dcusr/ghcr/password" }}
-TO_EMAIL={{ key "dcusr/nodemailer/to" }}
-EMAIL={{ key "dcusr/nodemailer/from" }}
-EMAIL_PASS={{ key "dcusr/nodemailer/password" }}
-LISTMONK_ENDPOINT={{ key "dcusr/listmonk/endpoint" }}
-LISTMONK_USERNAME={{ key "dcusr/listmonk/username" }}
-LISTMONK_PASSWORD={{ key "dcusr/listmonk/password" }}
-LISTMONK_LIST_IDS={{ key "dcusr/listmonk/list/id" }}
-RECAPTCHA_SECRET_KEY={{ key "dcusr/recaptcha/secret/key" }}
-EOH
-      }
-    }
-  }
-}
diff --git a/jobs/socs/dcusr/dcusr-listmonk.hcl b/jobs/socs/dcusr/dcusr-listmonk.hcl
index 7a5b48a..3f9ea7b 100644
--- a/jobs/socs/dcusr/dcusr-listmonk.hcl
+++ b/jobs/socs/dcusr/dcusr-listmonk.hcl
@@ -62,8 +62,6 @@ job "dcusr-listmonk" {
         data        = <<EOH
 [app]
 address = "0.0.0.0:{{ env "NOMAD_PORT_http" }}"
-admin_username = "{{ key "dcusr/listmonk/admin/username" }}"
-admin_password = "{{ key "dcusr/listmonk/admin/password" }}"
 
 # Database.
 [db]

From 042863335b6db3c344127d1f6006e039096fde78 Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Tue, 28 Oct 2025 15:18:04 +0000
Subject: [PATCH 05/15] housekeeping

---
 jobs/socs/dcusr/dcusr-hi-events.hcl          |  3 +--
 jobs/socs/dcusr/dcusr-rocketchat.hcl         |  2 +-
 jobs/socs/dcusr/{dcusr-dev.hcl => dcusr.hcl} | 10 +++++-----
 3 files changed, 7 insertions(+), 8 deletions(-)
 rename jobs/socs/dcusr/{dcusr-dev.hcl => dcusr.hcl} (96%)

diff --git a/jobs/socs/dcusr/dcusr-hi-events.hcl b/jobs/socs/dcusr/dcusr-hi-events.hcl
index 9934b0d..5eaf430 100644
--- a/jobs/socs/dcusr/dcusr-hi-events.hcl
+++ b/jobs/socs/dcusr/dcusr-hi-events.hcl
@@ -1,7 +1,6 @@
 job "dcusr-hi-events" {
   datacenters = ["aperture"]
-
-  type = "service"
+  type        = "service"
 
   meta {
     domain = "tickets.solarracing.ie"
diff --git a/jobs/socs/dcusr/dcusr-rocketchat.hcl b/jobs/socs/dcusr/dcusr-rocketchat.hcl
index 7421dcd..5f3f80e 100644
--- a/jobs/socs/dcusr/dcusr-rocketchat.hcl
+++ b/jobs/socs/dcusr/dcusr-rocketchat.hcl
@@ -3,7 +3,7 @@ job "dcusr-rocketchat" {
   type        = "service"
 
   meta {
-    domain       = "chat.solarracing.ie"
+    domain = "chat.solarracing.ie"
   }
 
   group "rocketchat" {
diff --git a/jobs/socs/dcusr/dcusr-dev.hcl b/jobs/socs/dcusr/dcusr.hcl
similarity index 96%
rename from jobs/socs/dcusr/dcusr-dev.hcl
rename to jobs/socs/dcusr/dcusr.hcl
index f8a3ba8..e22ac58 100644
--- a/jobs/socs/dcusr/dcusr-dev.hcl
+++ b/jobs/socs/dcusr/dcusr.hcl
@@ -1,12 +1,12 @@
-job "dcusr-dev" {
+job "dcusr" {
   datacenters = ["aperture"]
-  type = "service"
+  type        = "service"
 
   meta {
     domain = "solarracing.ie"
   }
 
-  group "dcusr-dev" {
+  group "dcusr" {
     count = 1
 
     network {
@@ -19,7 +19,7 @@ job "dcusr-dev" {
     }
 
     service {
-      name = "dcusr-dev"
+      name = "dcusr"
       port = "http"
 
       tags = [
@@ -48,7 +48,7 @@ job "dcusr-dev" {
         }
       }
       template {
-        destination = "secrets/secret.env"
+        destination = "local/.env"
         env         = true
         data        = <<EOH
 DOCKER_USER={{ key "dcusr/ghcr/username" }}

From 029ec1d4867737ee8c08de715c077b17c007050d Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Thu, 22 Jan 2026 14:07:46 +0000
Subject: [PATCH 06/15] dcusr website: add recaptcha secrets

---
 jobs/socs/dcusr/dcusr.hcl | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/jobs/socs/dcusr/dcusr.hcl b/jobs/socs/dcusr/dcusr.hcl
index e22ac58..01c7d2c 100644
--- a/jobs/socs/dcusr/dcusr.hcl
+++ b/jobs/socs/dcusr/dcusr.hcl
@@ -94,6 +94,9 @@ MAIL_BRAND="DCU Solar Racing"
 MAIL_PRIMARY="#22c55e"
 
 PLAUSIBLE_BASE_URL={{ key "socs/dcusr-dev/plausible/url" }}
+
+NEXT_PUBLIC_RECAPTCHA_SITE_KEY={{ key "socs/dcusr/captcha/site/key"}}
+RECAPTCHA_SECRET={{ key "socs/dcusr/captcha/secret/key" }}
 EOH
       }
     }

From 7f797210589983fa1f6cce6242d107581f1bc308 Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Thu, 22 Jan 2026 18:54:44 +0000
Subject: [PATCH 07/15] openproject: upgrade to v17

---
 jobs/socs/dcusr/dcusr-openproject.hcl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/jobs/socs/dcusr/dcusr-openproject.hcl b/jobs/socs/dcusr/dcusr-openproject.hcl
index 9646a25..1a522af 100644
--- a/jobs/socs/dcusr/dcusr-openproject.hcl
+++ b/jobs/socs/dcusr/dcusr-openproject.hcl
@@ -40,7 +40,7 @@ job "dcusr-openproject" {
       driver = "docker"
 
       config {
-        image = "openproject/openproject:16"
+        image = "openproject/openproject:17"
         ports = ["http"]
         volumes = [
           "/storage/nomad/${NOMAD_JOB_NAME}/pgdata:/var/openproject/pgdata",

From 5fa6bd9dc0f82b14c657241eb895723dd9b67fb9 Mon Sep 17 00:00:00 2001
From: wizzdom <dom@wizzdom.xyz>
Date: Fri, 23 Jan 2026 01:48:53 +0000
Subject: [PATCH 08/15] listmonk: idempotent install, use env over toml, clean
 db config

---
 jobs/socs/dcusr/dcusr-listmonk.hcl | 123 +++++++++++++++++++++++------
 1 file changed, 98 insertions(+), 25 deletions(-)

diff --git a/jobs/socs/dcusr/dcusr-listmonk.hcl b/jobs/socs/dcusr/dcusr-listmonk.hcl
index 3f9ea7b..ad42e5a 100644
--- a/jobs/socs/dcusr/dcusr-listmonk.hcl
+++ b/jobs/socs/dcusr/dcusr-listmonk.hcl
@@ -10,14 +10,18 @@ job "dcusr-listmonk" {
     network {
       port "http" {
       }
+    }
 
-      port "db" {
-        to = 5432
-      }
+    update {
+      max_parallel     = 1
+      health_check     = "checks"
+      min_healthy_time = "10s"
+      healthy_deadline = "5m"
     }
 
+
     service {
-      name = "listmonk"
+      name = "dcusr-listmonk"
       port = "http"
 
       check {
@@ -44,12 +48,11 @@ job "dcusr-listmonk" {
         image = "listmonk/listmonk:latest"
         ports = ["http"]
 
-        entrypoint = ["./listmonk", "--static-dir=/listmonk/static"]
+        command = "sh"
+        args    = ["-c", "./listmonk --install --idempotent --yes --config '' && ./listmonk --upgrade --yes --config '' && ./listmonk --config ''"] # empty config so envvars are used instead
 
         volumes = [
-          "/storage/nomad/dcusr-listmonk/static:/listmonk/static",
-          "/storage/nomad/dcusr-listmonk/postgres/:/var/lib/postgresql/data",
-          "local/config.toml:/listmonk/config.toml"
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}/uploads:/uploads",
         ]
       }
 
@@ -59,35 +62,105 @@ job "dcusr-listmonk" {
       }
 
       template {
+        destination = "local/.env"
+        env         = true
         data        = <<EOH
-[app]
-address = "0.0.0.0:{{ env "NOMAD_PORT_http" }}"
-
-# Database.
-[db]
-host = "{{ env "NOMAD_HOST_IP_db" }}"
-port = {{ env "NOMAD_HOST_PORT_db" }}
-user = "{{ key "dcusr/listmonk/db/username" }}"
-password = "{{ key "dcusr/listmonk/db/password" }}"
-database = "{{ key "dcusr/listmonk/db/name" }}"
-ssl_mode = "disable"
-max_open = 25
-max_idle = 25
-max_lifetime = "300s"
+LISTMONK_app__address     = 0.0.0.0:{{ env "NOMAD_PORT_http" }}
+LISTMONK_app__public_url  = {{ env "NOMAD_META_domain" }}
+
+LISTMONK_db__user         = {{ key "dcusr/listmonk/db/username" }}
+LISTMONK_db__password     = {{ key "dcusr/listmonk/db/password" }}
+LISTMONK_db__database     = {{ key "dcusr/listmonk/db/name" }}
+{{- range service "dcusr-listmonk-db" }}
+LISTMONK_db__host         = {{ .Address }}
+LISTMONK_db__port         = {{ .Port }}
+{{- end }}
+LISTMONK_db__ssl_mode     = disable
+LISTMONK_db__max_open     = 25
+LISTMONK_db__max_idle     = 25
+LISTMONK_db__max_lifetime = 300s
+TZ                        = Etc/UTC
+LISTMONK_ADMIN_USER       = {{ key "dcusr/listmonk/admin/username" }}
+LISTMONK_ADMIN_PASSWORD   = {{ key "dcusr/listmonk/admin/password" }}
 EOH
-        destination = "local/config.toml"
       }
     }
 
-    task "listmonk-db" {
+    task "wait-for-db" {
       driver = "docker"
 
+      lifecycle {
+        hook    = "prestart"
+        sidecar = false
+      }
+
+      config {
+        image   = "postgres:17-alpine"
+        command = "sh"
+        args = [
+          "-c",
+          "while ! pg_isready -h ${DB_HOST} -p ${DB_PORT} -U ${DB_USER}; do echo 'Waiting for DB...'; sleep 1; done; echo 'DB is ready!'"
+        ]
+      }
+
+      template {
+        destination = "local/wait.env"
+        env         = true
+        data        = <<EOH
+{{- range service "dcusr-listmonk-db" }}
+DB_HOST={{ .Address }}
+DB_PORT={{ .Port }}
+{{- end }}
+DB_USER={{ key "dcusr/listmonk/db/username" }}
+EOH
+      }
+
+      resources {
+        memory = 128
+      }
+    }
+
+  }
+  group "database" {
+    count = 1
+
+    network {
+      port "db" {
+        to = 5432
+      }
+    }
+
+    update {
+      max_parallel = 0 # don't update this group automatically
+      auto_revert  = false
+    }
+
+    task "postgres" {
+      driver         = "docker"
+      kill_signal    = "SIGTERM" # SIGTERM instead of SIGKILL so database can shutdown safely
+      kill_timeout   = "30s"
+      shutdown_delay = "5s"
+
+      service {
+        name = "dcusr-listmonk-db"
+        port = "db"
+
+        check {
+          type     = "script"
+          name     = "postgres-ready"
+          command  = "/bin/sh"
+          args     = ["-c", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+          interval = "10s"
+          timeout  = "2s"
+        }
+      }
+
       config {
         image = "postgres:17-alpine"
         ports = ["db"]
 
         volumes = [
-          "/storage/nomad/dcusr-listmonk/postgres:/var/lib/postgresql/data"
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/postgresql/data"
         ]
       }
 

From d6fe339c3eb21d42ec762cd7fadc3ec73fe59a40 Mon Sep 17 00:00:00 2001
From: wizzdom <dom@wizzdom.xyz>
Date: Fri, 23 Jan 2026 02:17:54 +0000
Subject: [PATCH 09/15] hievents: add healtchecks, cplit up db

---
 jobs/socs/dcusr/dcusr-hi-events.hcl | 159 +++++++++++++++++++++-------
 1 file changed, 120 insertions(+), 39 deletions(-)

diff --git a/jobs/socs/dcusr/dcusr-hi-events.hcl b/jobs/socs/dcusr/dcusr-hi-events.hcl
index 5eaf430..6e4f360 100644
--- a/jobs/socs/dcusr/dcusr-hi-events.hcl
+++ b/jobs/socs/dcusr/dcusr-hi-events.hcl
@@ -12,15 +12,39 @@ job "dcusr-hi-events" {
         to = 80
       }
 
-      port "db" {
-        to = 5432
-      }
-
       port "redis" {
         to = 6379
       }
     }
 
+    update {
+      max_parallel     = 1
+      health_check     = "checks"
+      min_healthy_time = "10s"
+      healthy_deadline = "5m"
+    }
+
+    service {
+      name = "dcusr-hievents-frontend"
+      port = "http"
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "10s"
+        timeout  = "2s"
+      }
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.port=${NOMAD_PORT_http}",
+        "traefik.http.routers.hievents-frontend.entrypoints=web,websecure",
+        "traefik.http.routers.hievents-frontend.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.hievents-frontend.tls=true",
+        "traefik.http.routers.hievents-frontend.tls.certresolver=lets-encrypt",
+      ]
+    }
+
     task "frontend" {
       driver = "docker"
 
@@ -29,26 +53,14 @@ job "dcusr-hi-events" {
         ports = ["http"]
       }
 
-      service {
-        name = "frontend"
-        port = "http"
-
-        tags = [
-          "traefik.enable=true",
-          "traefik.port=${NOMAD_PORT_http}",
-          "traefik.http.routers.hievents-frontend.entrypoints=web,websecure",
-          "traefik.http.routers.hievents-frontend.rule=Host(`${NOMAD_META_domain}`)",
-          "traefik.http.routers.hievents-frontend.tls=true",
-          "traefik.http.routers.hievents-frontend.tls.certresolver=lets-encrypt",
-        ]
-      }
-
       resources {
         memory = 3000
         cores  = 1
       }
 
       template {
+        destination = "local/.env"
+        env         = true
         data        = <<EOH
 # Frontend
 VITE_FRONTEND_URL="https://{{ env "NOMAD_META_domain" }}"
@@ -88,8 +100,10 @@ STRIPE_SECRET_KEY=
 
 # Database
 DB_CONNECTION=pgsql
-DB_HOST={{ env "NOMAD_IP_db" }}
-DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
+{{ range service "dcusr-hi-events-db" }}
+DB_HOST={{ .Address }}
+DB_PORT={{ .Port }}
+{{ end }}
 DB_DATABASE={{ key "hi-events/db/name" }}
 DB_USERNAME={{ key "hi-events/db/user" }}
 DB_PASSWORD={{ key "hi-events/db/password" }}
@@ -100,48 +114,115 @@ REDIS_USER={{ key "hi-events/redis/user" }}
 REDIS_PASSWORD=
 REDIS_PORT={{ env "NOMAD_HOST_PORT_redis" }}
 EOH
-        destination = "local/.env"
-        env         = true
       }
     }
 
-    task "db" {
+    task "redis" {
       driver = "docker"
 
+      lifecycle {
+        hook    = "prestart"
+        sidecar = true
+      }
+
       config {
-        image = "postgres:16-alpine"
-        ports = ["db"]
+        image = "redis:latest"
+        ports = ["redis"]
+      }
 
-        volumes = [
-          "/storage/nomad/hi-events-all-in-one/db:/var/lib/postgresql/data",
+      template {
+        data        = "REDIS_USER={{ key \"hi-events/redis/user\" }}"
+        destination = "local/redis.env"
+        env         = true
+      }
+    }
+
+    task "wait-for-db" {
+      driver = "docker"
+
+      lifecycle {
+        hook    = "prestart"
+        sidecar = false
+      }
+
+      config {
+        image   = "postgres:17-alpine"
+        command = "sh"
+        args = [
+          "-c",
+          "while ! pg_isready -h ${DB_HOST} -p ${DB_PORT} -U ${DB_USER}; do echo 'Waiting for DB...'; sleep 1; done; echo 'DB is ready!'"
         ]
       }
 
       template {
+        destination = "local/wait.env"
+        env         = true
         data        = <<EOH
-POSTGRES_DB={{ key "hi-events/db/name" }}
-POSTGRES_USER={{ key "hi-events/db/user" }}
-POSTGRES_PASSWORD={{ key "hi-events/db/password" }}
+{{- range service "dcusr-listmonk-db" }}
+DB_HOST={{ .Address }}
+DB_PORT={{ .Port }}
+{{- end }}
+DB_USER={{ key "hi-events/db/user" }}
 EOH
-        destination = "local/db.env"
-        env         = true
+      }
+
+      resources {
+        memory = 128
       }
     }
+  }
 
-    task "redis" {
-      driver = "docker"
+  group "database" {
+    count = 1
+
+    network {
+      port "db" {
+        to = 5432
+      }
+    }
+
+    update {
+      max_parallel = 0 # don't update this group automatically
+      auto_revert  = false
+    }
+
+    task "db" {
+      driver         = "docker"
+      kill_signal    = "SIGTERM" # SIGTERM instead of SIGKILL so database can shutdown safely
+      kill_timeout   = "30s"
+      shutdown_delay = "5s"
+
+      service {
+        name = "dcusr-hi-events-db"
+        port = "db"
+
+        check {
+          type     = "script"
+          name     = "postgres-ready"
+          command  = "/bin/sh"
+          args     = ["-c", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+          interval = "10s"
+          timeout  = "2s"
+        }
+      }
 
       config {
-        image = "redis:latest"
-        ports = ["redis"]
+        image = "postgres:16-alpine"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/hi-events-all-in-one/db:/var/lib/postgresql/data",
+        ]
       }
 
       template {
+        destination = "local/db.env"
+        env         = true
         data        = <<EOH
-REDIS_USER={{ key "hi-events/redis/user" }}
+POSTGRES_DB={{ key "hi-events/db/name" }}
+POSTGRES_USER={{ key "hi-events/db/user" }}
+POSTGRES_PASSWORD={{ key "hi-events/db/password" }}
 EOH
-        destination = "local/redis.env"
-        env         = true
       }
     }
   }

From d976a05f5be9cd77b3850bb5f842de14807cadeb Mon Sep 17 00:00:00 2001
From: wizzdom <dom@wizzdom.xyz>
Date: Fri, 23 Jan 2026 14:35:55 +0000
Subject: [PATCH 10/15] dcusr-site: separate db, add health checks, lifecycle,
 prefixes

---
 jobs/socs/dcusr/dcusr.hcl | 106 +++++++++++++++++++++++++++++++++-----
 1 file changed, 93 insertions(+), 13 deletions(-)

diff --git a/jobs/socs/dcusr/dcusr.hcl b/jobs/socs/dcusr/dcusr.hcl
index 01c7d2c..05f94c9 100644
--- a/jobs/socs/dcusr/dcusr.hcl
+++ b/jobs/socs/dcusr/dcusr.hcl
@@ -1,4 +1,4 @@
-job "dcusr" {
+job "dcusr-dev" {
   datacenters = ["aperture"]
   type        = "service"
 
@@ -6,30 +6,43 @@ job "dcusr" {
     domain = "solarracing.ie"
   }
 
-  group "dcusr" {
+  group "web" {
     count = 1
 
     network {
       port "http" {
         to = 3000
       }
-      port "db" {
-        to = 5432
-      }
     }
 
+    update {
+      max_parallel     = 1
+      health_check     = "checks"
+      min_healthy_time = "10s"
+      healthy_deadline = "5m"
+    }
+
+
     service {
       name = "dcusr"
       port = "http"
 
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "30s"
+        timeout  = "2s"
+      }
+
+
       tags = [
         "traefik.enable=true",
         "traefik.http.routers.dcusr-dev.rule=Host(`solarracing.ie`) || Host(`www.solarracing.ie`)",
         "traefik.http.routers.dcusr-dev.entrypoints=web,websecure",
         "traefik.http.routers.dcusr-dev.tls.certresolver=lets-encrypt",
-        "traefik.http.middlewares.nextauth-headers.headers.sslProxyHeaders.X-Forwarded-Proto=https",
-        "traefik.http.middlewares.nextauth-headers.headers.customRequestHeaders.X-Forwarded-Host=solarracing.ie",
-        "traefik.http.routers.dcusr-dev.middlewares=nextauth-headers@consulcatalog",
+        "traefik.http.routers.dcusr-dev.middlewares=dcusr-nextauth-headers",
+        "traefik.http.middlewares.dcusr-nextauth-headers.headers.sslProxyHeaders.X-Forwarded-Proto=https",
+        "traefik.http.middlewares.dcusr-nextauth-headers.headers.customRequestHeaders.X-Forwarded-Host=solarracing.ie",
 
       ]
     }
@@ -38,8 +51,8 @@ job "dcusr" {
       driver = "docker"
 
       config {
-        image = "ghcr.io/dcu-solar-racing/website:main"
-        ports = ["http"]
+        image      = "ghcr.io/dcu-solar-racing/website:main"
+        ports      = ["http"]
         force_pull = true
 
         auth {
@@ -68,7 +81,7 @@ PREVIEW_SECRET={{ key "socs/dcusr-dev/preview/secret" }}
 SEED_ADMIN_EMAIL={{ key "socs/dcusr-dev/seed/email" }}
 SEED_ADMIN_PASSWORD={{ key "socs/dcusr-dev/seed/password" }}
 
-DATABASE_URL=postgresql://{{ key "socs/dcusr-dev/db/user" | urlquery }}:{{ key "socs/dcusr-dev/db/password" | urlquery }}@{{ env "NOMAD_ADDR_db" }}/{{ key "socs/dcusr-dev/db/name" | urlquery }}?schema=public
+DATABASE_URL=postgresql://{{ key "socs/dcusr-dev/db/user" | urlquery }}:{{ key "socs/dcusr-dev/db/password" | urlquery }}@{{ range service "dcusr-dev-db" }}{{ .Address }}:{{ .Port }}{{ end }}/{{ key "socs/dcusr-dev/db/name" | urlquery }}?schema=public
 
 MINIO_ENDPOINT={{ key "socs/dcusr-dev/minio/url" }}
 MINIO_PORT={{ key "socs/dcusr-dev/minio/port" }}
@@ -101,15 +114,82 @@ EOH
       }
     }
 
-    task "postgres" {
+    task "wait-for-db" {
       driver = "docker"
 
+      lifecycle {
+        hook    = "prestart"
+        sidecar = false
+      }
+
+      config {
+        image   = "postgres:17-alpine"
+        command = "sh"
+        args = [
+          "-c",
+          "while ! pg_isready -h ${DB_HOST} -p ${DB_PORT} -U ${DB_USER}; do echo 'Waiting for DB...'; sleep 1; done; echo 'DB is ready!'"
+        ]
+      }
+
+      template {
+        destination = "local/wait.env"
+        env         = true
+        data        = <<EOH
+{{ range service "dcusr-dev-db" }}
+DB_HOST={{ .Address }}
+DB_PORT={{ .Port }}
+{{ end }}
+DB_USER={{ key "socs/dcusr-dev/db/user" }}
+EOH
+      }
+
+      resources {
+        memory = 128
+      }
+    }
+  }
+
+  group "database" {
+    count = 1
+
+    network {
+      port "db" {
+        to = 5432
+      }
+    }
+
+    update {
+      max_parallel = 0 # don't update this group automatically
+      auto_revert  = false
+    }
+
+    task "db" {
+      driver         = "docker"
+      kill_signal    = "SIGTERM" # SIGTERM instead of SIGKILL so database can shutdown safely
+      kill_timeout   = "30s"
+      shutdown_delay = "5s"
+
+      service {
+        name = "dcusr-dev-db"
+        port = "db"
+
+        check {
+          type     = "script"
+          name     = "postgres-ready"
+          command  = "/bin/sh"
+          args     = ["-c", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+          interval = "10s"
+          timeout  = "2s"
+        }
+      }
+
+
       config {
         image = "postgres:17-alpine"
         ports = ["db"]
 
         volumes = [
-          "/storage/nomad/dcusr-dev/db:/var/lib/postgresql/data",
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/postgresql/data",
         ]
       }
 

From 22400c34d4ae7c8a768b462ce1c5cf598ecd9868 Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Tue, 3 Feb 2026 17:28:46 +0000
Subject: [PATCH 11/15] dcusr: remove unused jobs

---
 jobs/socs/dcusr/dcusr-bookstack.hcl    | 189 --------------------
 jobs/socs/dcusr/dcusr-hi-events.hcl    | 229 ------------------------
 jobs/socs/dcusr/dcusr-invoiceninja.hcl | 238 -------------------------
 jobs/socs/dcusr/dcusr-rocketchat.hcl   | 125 -------------
 4 files changed, 781 deletions(-)
 delete mode 100644 jobs/socs/dcusr/dcusr-bookstack.hcl
 delete mode 100644 jobs/socs/dcusr/dcusr-hi-events.hcl
 delete mode 100644 jobs/socs/dcusr/dcusr-invoiceninja.hcl
 delete mode 100644 jobs/socs/dcusr/dcusr-rocketchat.hcl

diff --git a/jobs/socs/dcusr/dcusr-bookstack.hcl b/jobs/socs/dcusr/dcusr-bookstack.hcl
deleted file mode 100644
index 6bd9fdf..0000000
--- a/jobs/socs/dcusr/dcusr-bookstack.hcl
+++ /dev/null
@@ -1,189 +0,0 @@
-job "dcusr-bookstack" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  meta {
-    domain = "wiki.solarracing.ie"
-  }
-
-  group "bookstack" {
-    count = 1
-
-    network {
-      port "http" {
-        to = 80
-      }
-
-      port "db" {
-        to = 3306
-      }
-
-      port "redis" {
-        to = 6379
-      }
-    }
-
-    service {
-      name = "bookstack"
-      port = "http"
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.http.routers.dcusr-bookstack.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.dcusr-bookstack.entrypoints=web,websecure",
-        "traefik.http.routers.dcusr-bookstack.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "bookstack" {
-      driver = "docker"
-
-      config {
-        image = "lscr.io/linuxserver/bookstack:latest"
-        ports = ["http"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/config",
-        ]
-      }
-
-      template {
-        destination = "local.env"
-        env         = true
-        data        = <<EOH
-PUID = "1000"
-PGID = "1000"
-TZ   = "Europe/Dublin"
-
-APP_URL=https://{{ env "NOMAD_META_domain" }}
-APP_KEY={{ key "socs/dcusr/bookstack/app/key" }}
-APP_AUTO_LANG_PUBLIC=false
-
-DB_HOST={{ env "NOMAD_HOST_IP_db" }}
-DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
-DB_USERNAME={{ key "socs/dcusr/bookstack/db/user" }}
-DB_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
-DB_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
-
-MAIL_DRIVER=smtp
-MAIL_HOST={{ key "socs/dcusr/bookstack/smtp/host" }}
-MAIL_PORT=587
-MAIL_ENCRYPTION=tls
-MAIL_USERNAME={{ key "socs/dcusr/bookstack/smtp/user" }}
-MAIL_PASSWORD={{ key "socs/dcusr/bookstack/smtp/password" }}
-MAIL_FROM={{ key "socs/dcusr/bookstack/smtp/user" }}
-MAIL_FROM_NAME={{ key "socs/dcusr/bookstack/smtp/name" }}
-
-REDIS_SERVERS={{ env "NOMAD_ADDR_redis" }}
-
-QUEUE_CONNECTION=redis
-CACHE_DRIVER=redis
-SESSION_DRIVER=redis
-EOH
-      }
-
-      resources {
-        cpu    = 500
-        memory = 1024
-      }
-    }
-
-    task "mariadb" {
-      driver = "docker"
-
-      config {
-        image = "mariadb:10.11"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/mysql",
-        ]
-      }
-
-      template {
-        destination = "local/.env"
-        env         = true
-        data        = <<EOH
-MYSQL_ROOT_PASSWORD={{ key "socs/dcusr/bookstack/db/root/password" }}
-MYSQL_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
-MYSQL_USER={{ key "socs/dcusr/bookstack/db/user" }}
-MYSQL_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
-EOH
-      }
-
-      resources {
-        cpu    = 500
-        memory = 1024
-      }
-    }
-
-    task "redis" {
-      driver = "docker"
-
-      config {
-        image = "redis:7-alpine"
-        ports = ["redis"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/data",
-        ]
-      }
-
-      resources {
-        cpu    = 200
-        memory = 256
-      }
-    }
-
-    task "queue-worker" {
-      driver = "docker"
-
-      config {
-        image   = "lscr.io/linuxserver/bookstack:latest"
-        command = "php"
-        args    = ["/app/www/artisan", "queue:work", "--sleep=3", "--tries=3", "--timeout=60"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/config",
-        ]
-      }
-
-      template {
-        destination = "local/.env"
-        env         = true
-        data        = <<EOH
-PUID = "1000"
-PGID = "1000"
-TZ   = "Europe/Dublin"
-
-APP_URL=https://{{ env "NOMAD_META_domain" }}
-APP_KEY={{ key "socs/dcusr/bookstack/app/key" }}
-
-DB_HOST={{ env "NOMAD_HOST_IP_db" }}
-DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
-DB_USERNAME={{ key "socs/dcusr/bookstack/db/user" }}
-DB_PASSWORD={{ key "socs/dcusr/bookstack/db/password" }}
-DB_DATABASE={{ key "socs/dcusr/bookstack/db/name" }}
-
-MAIL_DRIVER=smtp
-MAIL_HOST={{ key "socs/dcusr/bookstack/smtp/host" }}
-MAIL_PORT=587
-MAIL_ENCRYPTION=tls
-MAIL_USERNAME={{ key "socs/dcusr/bookstack/smtp/user" }}
-MAIL_PASSWORD={{ key "socs/dcusr/bookstack/smtp/password" }}
-MAIL_FROM={{ key "socs/dcusr/bookstack/smtp/user" }}
-MAIL_FROM_NAME={{ key "socs/dcusr/bookstack/smtp/name" }}
-
-REDIS_SERVERS={{ env "NOMAD_ADDR_redis" }}
-
-QUEUE_CONNECTION=redis
-EOH
-      }
-
-      resources {
-        cpu    = 300
-        memory = 512
-      }
-    }
-  }
-}
diff --git a/jobs/socs/dcusr/dcusr-hi-events.hcl b/jobs/socs/dcusr/dcusr-hi-events.hcl
deleted file mode 100644
index 6e4f360..0000000
--- a/jobs/socs/dcusr/dcusr-hi-events.hcl
+++ /dev/null
@@ -1,229 +0,0 @@
-job "dcusr-hi-events" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  meta {
-    domain = "tickets.solarracing.ie"
-  }
-
-  group "web" {
-    network {
-      port "http" {
-        to = 80
-      }
-
-      port "redis" {
-        to = 6379
-      }
-    }
-
-    update {
-      max_parallel     = 1
-      health_check     = "checks"
-      min_healthy_time = "10s"
-      healthy_deadline = "5m"
-    }
-
-    service {
-      name = "dcusr-hievents-frontend"
-      port = "http"
-
-      check {
-        type     = "http"
-        path     = "/"
-        interval = "10s"
-        timeout  = "2s"
-      }
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.port=${NOMAD_PORT_http}",
-        "traefik.http.routers.hievents-frontend.entrypoints=web,websecure",
-        "traefik.http.routers.hievents-frontend.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.hievents-frontend.tls=true",
-        "traefik.http.routers.hievents-frontend.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "frontend" {
-      driver = "docker"
-
-      config {
-        image = "daveearley/hi.events-all-in-one"
-        ports = ["http"]
-      }
-
-      resources {
-        memory = 3000
-        cores  = 1
-      }
-
-      template {
-        destination = "local/.env"
-        env         = true
-        data        = <<EOH
-# Frontend
-VITE_FRONTEND_URL="https://{{ env "NOMAD_META_domain" }}"
-VITE_API_URL_CLIENT="https://{{ env "NOMAD_META_domain" }}/api"
-VITE_API_URL_SERVER="https://{{ env "NOMAD_META_domain" }}/api"
-VITE_STRIPE_PUBLISHABLE_KEY=
-
-# Backend
-LOG_CHANNEL=stderr
-QUEUE_CONNECTION=redis
-
-# Mail
-MAIL_MAILER=smtp
-MAIL_HOST=smtp.gmail.com
-MAIL_PORT=587
-MAIL_ENCRYPTION=tls
-MAIL_PASSWORD={{ key "hi-events/mail/password" }}
-MAIL_USERNAME={{ key "hi-events/mail/username" }}
-MAIL_FROM_ADDRESS={{ key "hi-events/mail/username" }}
-MAIL_FROM_NAME="DCU Solar Racing"
-
-# App configs
-APP_KEY={{ key "hi-events/app/key" }}
-JWT_SECRET={{key "hi-events/app/jwt" }}
-APP_CDN_URL="https://{{ env "NOMAD_META_domain" }}/storage"
-APP_FRONTEND_URL="https://{{ env "NOMAD_META_domain" }}"
-APP_DISABLE_REGISTRATION=true
-APP_SAAS_MODE_ENABLED=ture
-
-# Filesystem
-FILESYSTEM_PUBLIC_DISK=public
-FILESYSTEM_PRIVATE_DISK=local
-
-# Stripe
-STRIPE_PUBLIC_KEY=
-STRIPE_SECRET_KEY=
-
-# Database
-DB_CONNECTION=pgsql
-{{ range service "dcusr-hi-events-db" }}
-DB_HOST={{ .Address }}
-DB_PORT={{ .Port }}
-{{ end }}
-DB_DATABASE={{ key "hi-events/db/name" }}
-DB_USERNAME={{ key "hi-events/db/user" }}
-DB_PASSWORD={{ key "hi-events/db/password" }}
-
-# Redis
-REDIS_HOST={{ env "NOMAD_IP_redis" }}
-REDIS_USER={{ key "hi-events/redis/user" }}
-REDIS_PASSWORD=
-REDIS_PORT={{ env "NOMAD_HOST_PORT_redis" }}
-EOH
-      }
-    }
-
-    task "redis" {
-      driver = "docker"
-
-      lifecycle {
-        hook    = "prestart"
-        sidecar = true
-      }
-
-      config {
-        image = "redis:latest"
-        ports = ["redis"]
-      }
-
-      template {
-        data        = "REDIS_USER={{ key \"hi-events/redis/user\" }}"
-        destination = "local/redis.env"
-        env         = true
-      }
-    }
-
-    task "wait-for-db" {
-      driver = "docker"
-
-      lifecycle {
-        hook    = "prestart"
-        sidecar = false
-      }
-
-      config {
-        image   = "postgres:17-alpine"
-        command = "sh"
-        args = [
-          "-c",
-          "while ! pg_isready -h ${DB_HOST} -p ${DB_PORT} -U ${DB_USER}; do echo 'Waiting for DB...'; sleep 1; done; echo 'DB is ready!'"
-        ]
-      }
-
-      template {
-        destination = "local/wait.env"
-        env         = true
-        data        = <<EOH
-{{- range service "dcusr-listmonk-db" }}
-DB_HOST={{ .Address }}
-DB_PORT={{ .Port }}
-{{- end }}
-DB_USER={{ key "hi-events/db/user" }}
-EOH
-      }
-
-      resources {
-        memory = 128
-      }
-    }
-  }
-
-  group "database" {
-    count = 1
-
-    network {
-      port "db" {
-        to = 5432
-      }
-    }
-
-    update {
-      max_parallel = 0 # don't update this group automatically
-      auto_revert  = false
-    }
-
-    task "db" {
-      driver         = "docker"
-      kill_signal    = "SIGTERM" # SIGTERM instead of SIGKILL so database can shutdown safely
-      kill_timeout   = "30s"
-      shutdown_delay = "5s"
-
-      service {
-        name = "dcusr-hi-events-db"
-        port = "db"
-
-        check {
-          type     = "script"
-          name     = "postgres-ready"
-          command  = "/bin/sh"
-          args     = ["-c", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
-          interval = "10s"
-          timeout  = "2s"
-        }
-      }
-
-      config {
-        image = "postgres:16-alpine"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/hi-events-all-in-one/db:/var/lib/postgresql/data",
-        ]
-      }
-
-      template {
-        destination = "local/db.env"
-        env         = true
-        data        = <<EOH
-POSTGRES_DB={{ key "hi-events/db/name" }}
-POSTGRES_USER={{ key "hi-events/db/user" }}
-POSTGRES_PASSWORD={{ key "hi-events/db/password" }}
-EOH
-      }
-    }
-  }
-}
diff --git a/jobs/socs/dcusr/dcusr-invoiceninja.hcl b/jobs/socs/dcusr/dcusr-invoiceninja.hcl
deleted file mode 100644
index a09cd30..0000000
--- a/jobs/socs/dcusr/dcusr-invoiceninja.hcl
+++ /dev/null
@@ -1,238 +0,0 @@
-job "dcusr-invoiceninja" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  meta {
-    domain = "invoices.solarracing.ie"
-  }
-
-  group "ninja" {
-    count = 1
-
-    network {
-      port "web" { 
-        to = 80 
-      }
-      port "fpm" { 
-        to = 9000 
-      }
-      port "db" { 
-        to = 3306 
-      }
-      port "redis" { 
-        to = 6379 
-      }
-    }
-
-    restart {
-      attempts = 20
-      delay    = "10s"
-      interval = "10m"
-      mode     = "delay"
-    }
-
-    service {
-      name = "invoiceninja"
-      port = "web"
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.port=${NOMAD_PORT_web}",
-        "traefik.http.routers.dcusr-invoiceninja.entrypoints=web,websecure",
-        "traefik.http.routers.dcusr-invoiceninja.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.dcusr-invoiceninja.tls=true",
-        "traefik.http.routers.dcusr-invoiceninja.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "app" {
-      driver = "docker"
-
-      config {
-        image  = "invoiceninja/invoiceninja-debian:latest"
-        ports  = ["fpm"]
-
-        volumes = [
-          "local/.env:/var/www/html/.env",
-          "/storage/nomad/${NOMAD_JOB_NAME}/public:/var/www/html/public",
-          "/storage/nomad/${NOMAD_JOB_NAME}/storage:/var/www/html/storage",
-          "local/99-mysql-client-no-tls.cnf:/etc/mysql/conf.d/99-mysql-client-no-tls.cnf:ro",
-
-        ]
-      }
-
-      resources {
-        cpu    = 4000
-        memory = 8192
-      }
-
-      template {
-        destination = "local/.env"
-        env         = true
-        data = <<EOH
-IS_DOCKER=true
-NINJA_ENVIRONMENT=selfhost
-APP_NAME="DCU Solar Racing invoicing"
-APP_ENV=production
-APP_DEBUG=true
-APP_URL=https://{{ env "NOMAD_META_domain" }}
-REQUIRE_HTTPS=true
-TRUSTED_PROXIES=*
-APP_KEY={{ key "dcusr/invoice/app/key" }}
-PHANTOMJS_PDF_GENERATION=false
-
-FILESYSTEM_DISK=debian_docker
-
-# pdf
-PDF_GENERATOR=snappdf
-
-# database (like compose)
-DB_CONNECTION=mysql
-DB_HOST={{ env "NOMAD_IP_db" }}
-DB_PORT={{ env "NOMAD_HOST_PORT_db" }}
-DB_DATABASE={{ key "dcusr/invoice/db/name" }}
-DB_USERNAME={{ key "dcusr/invoice/db/user" }}
-DB_PASSWORD={{ key "dcusr/invoice/db/password" }}
-DB_STRICT=false
-
-REDIS_HOST={{ env "NOMAD_IP_redis" }}
-REDIS_PORT={{ env "NOMAD_HOST_PORT_redis" }}
-CACHE_DRIVER=redis
-SESSION_DRIVER=redis
-QUEUE_CONNECTION=redis
-
-INTERNAL_QUEUE_ENABLED=true
-
-MAIL_MAILER=smtp
-MAIL_HOST={{ key "dcusr/invoice/smtp/host" }}
-MAIL_PORT={{ key "dcusr/invoice/smtp/port" }}
-MAIL_USERNAME={{ key "dcusr/invoice/smtp/username" }}
-MAIL_PASSWORD="{{ key "dcusr/invoice/smtp/password" }}"
-MAIL_ENCRYPTION={{ key "dcusr/invoice/smtp/encryption" }}
-MAIL_FROM_ADDRESS={{ key "dcusr/invoice/smtp/from_address" }}
-MAIL_FROM_NAME="{{ key "dcusr/invoice/smtp/from_name" }}"
-EOH
-      }
-
-       template {
-        destination = "local/99-mysql-client-no-tls.cnf"
-        data = <<EOH
-[client]
-loose-skip-ssl
-loose-ssl-verify-server-cert=OFF
-loose-ssl-mode=DISABLED
-
-[mysql]
-loose-skip-ssl
-loose-ssl-verify-server-cert=OFF
-loose-ssl-mode=DISABLED
-EOH
-  }
-    }
-
-    task "nginx" {
-      driver = "docker"
-
-      config {
-        image = "nginx:alpine"
-        ports = ["web"]
-        volumes = [
-          "local/nginx:/etc/nginx/conf.d:ro",
-          "/storage/nomad/${NOMAD_JOB_NAME}/public:/var/www/html/public",
-          "/storage/nomad/${NOMAD_JOB_NAME}/storage:/var/www/html/storage",
-      ]
-    }
-
-      template {
-        destination = "local/nginx/invoiceninja.conf"
-        data = <<EOH
-server {
-    listen 80;
-    server_name _;
-    root /var/www/html/public;
-    index index.php index.html;
-    client_max_body_size 100M;
-
-    location / {
-        try_files $uri $uri/ /index.php?$query_string;
-    }
-
-    location ~ \.php(?:$|/) {
-        include fastcgi_params;
-        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
-        fastcgi_param PATH_INFO $fastcgi_path_info;
-        fastcgi_index index.php;
-        fastcgi_read_timeout 300;
-        fastcgi_pass {{ env "NOMAD_ADDR_fpm" }};
-    }
-
-    location ~* \.(jpg|jpeg|gif|png|css|js|ico|svg|woff|woff2|ttf)$ {
-        expires max;
-        log_not_found off;
-    }
-}
-EOH
-    }
-  }
-
-    task "mysql" {
-      driver = "docker"
-
-      config {
-        image = "mysql:8"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/mysql:/var/lib/mysql",
-          "local/zz-no-tls.cnf:/etc/mysql/conf.d/zz-no-tls.cnf:ro",
-      ]
-    }
-
-    resources {
-      cpu    = 500
-      memory = 1024
-    }
-
-    template {
-      destination = "local/mysql.env"
-      env         = true
-      data = <<EOH
-MYSQL_DATABASE={{ key "dcusr/invoice/db/name" }}
-MYSQL_USER={{ key "dcusr/invoice/db/user" }}
-MYSQL_PASSWORD={{ key "dcusr/invoice/db/password" }}
-MYSQL_ROOT_PASSWORD={{ key "dcusr/invoice/db/root_password" }}
-EOH
-  }
-
-    template {
-      destination = "local/zz-no-tls.cnf"
-      data = <<EOH
-[mysqld]
-require_secure_transport=OFF
-tls_version=
-admin_tls_version=
-EOH
-  }
-}
-
-
-    task "redis" {
-      driver = "docker"
-
-      config {
-        image = "redis:alpine"
-        ports = ["redis"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/redis:/data",
-        ]
-      }
-
-      resources {
-        cpu    = 150
-        memory = 128
-      }
-    }
-  }
-}
-
diff --git a/jobs/socs/dcusr/dcusr-rocketchat.hcl b/jobs/socs/dcusr/dcusr-rocketchat.hcl
deleted file mode 100644
index 5f3f80e..0000000
--- a/jobs/socs/dcusr/dcusr-rocketchat.hcl
+++ /dev/null
@@ -1,125 +0,0 @@
-job "dcusr-rocketchat" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  meta {
-    domain = "chat.solarracing.ie"
-  }
-
-  group "rocketchat" {
-    count = 1
-
-    network {
-      port "http" {
-        to = 3000
-      }
-      port "db" {
-        to = 27017
-      }
-    }
-
-    restart {
-      attempts = 20
-      delay    = "10s"
-      interval = "10m"
-      mode     = "delay"
-    }
-
-    service {
-      name = "rocketchat"
-      port = "http"
-      tags = [
-        "traefik.enable=true",
-        "traefik.port=${NOMAD_PORT_http}",
-        "traefik.http.routers.dcusr-rocketchat.rule=Host(`${NOMAD_META_domain}`)",
-        "traefik.http.routers.dcusr-rocketchat.tls=true",
-        "traefik.http.routers.dcusr-rocketchat.entrypoints=web,websecure",
-        "traefik.http.routers.dcusr-rocketchat.tls.certresolver=lets-encrypt",
-      ]
-    }
-
-    task "init-mongo-perms" {
-      driver = "docker"
-      lifecycle {
-        hook = "prestart"
-      }
-      restart {
-        attempts = 0
-      }
-
-      config {
-        image   = "alpine:3"
-        command = "sh"
-        args    = ["-lc", "mkdir -p /data && chown -R 1001:1001 /data && chmod -R u+rwX,g+rwX /data"]
-        volumes = ["/storage/nomad/${NOMAD_JOB_NAME}/mongodb:/data"]
-      }
-
-      resources {
-        cpu = 50
-        memory = 64
-      }
-    }
-
-    task "mongodb" {
-      driver = "docker"
-
-      config {
-        image = "docker.io/bitnamilegacy/mongodb:8.0.13"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/mongodb:/bitnami/mongodb"
-        ]
-      }
-
-      template {
-        destination = "local/mongo.env"
-        env         = true
-        data = <<EOH
-MONGODB_REPLICA_SET_MODE=primary
-MONGODB_REPLICA_SET_NAME=rs0
-MONGODB_PORT_NUMBER=27017
-MONGODB_INITIAL_PRIMARY_HOST=127.0.0.1
-MONGODB_INITIAL_PRIMARY_PORT_NUMBER=27017
-MONGODB_ADVERTISED_HOSTNAME=localhost
-MONGODB_ENABLE_JOURNAL=true
-ALLOW_EMPTY_PASSWORD=yes
-EOH
-      }
-
-      resources {
-        cpu    = 1000
-        memory = 2048
-      }
-    }
-
-      task "rocketchat" {
-        driver = "docker"
-
-        config {
-          image = "registry.rocket.chat/rocketchat/rocket.chat:latest"
-          ports = ["http"]
-        }
-
-        template {
-          destination = "local/app.env"
-          env         = true
-          data = <<EOH
-MONGO_URL=mongodb://{{ env "NOMAD_ADDR_db" }}/rocketchat?replicaSet=rs0&directConnection=true&serverSelectionTimeoutMS=60000&connectTimeoutMS=30000
-MONGO_OPLOG_URL=mongodb://{{ env "NOMAD_ADDR_db" }}/local?replicaSet=rs0&directConnection=true
-
-ROOT_URL=https://{{ env "NOMAD_META_domain" }}
-PORT=3000
-DEPLOY_METHOD=docker
-
-WEB_PROCESS_COUNT=1
-EOH
-        }
-
-      resources {
-        cpu    = 1000
-        memory = 2048
-      }
-    }
-  }
-}

From dfee6338c0ea8aec076528483acf2773bc1ced6a Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Fri, 20 Feb 2026 21:10:46 +0000
Subject: [PATCH 12/15] dcusr outline: dont use static ports

---
 jobs/socs/dcusr/dcusr-outline.hcl | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/jobs/socs/dcusr/dcusr-outline.hcl b/jobs/socs/dcusr/dcusr-outline.hcl
index 5cf438e..89d9f67 100644
--- a/jobs/socs/dcusr/dcusr-outline.hcl
+++ b/jobs/socs/dcusr/dcusr-outline.hcl
@@ -10,8 +10,7 @@ job "dcusr-outline" {
     network {
       # mode = "bridge"
       port "http" {
-        static = 3000
-        to     = 3000
+        to = 3000
       }
 
       port "db" {

From 94fdebf19c11eb9792ffd00a591d4999b54567f0 Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Sat, 21 Mar 2026 04:28:46 +0000
Subject: [PATCH 13/15] fix dcusr website failing to start after any restart
 causing the site to 404

---
 jobs/socs/dcusr/dcusr.hcl | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/jobs/socs/dcusr/dcusr.hcl b/jobs/socs/dcusr/dcusr.hcl
index 05f94c9..04774dc 100644
--- a/jobs/socs/dcusr/dcusr.hcl
+++ b/jobs/socs/dcusr/dcusr.hcl
@@ -3,7 +3,8 @@ job "dcusr-dev" {
   type        = "service"
 
   meta {
-    domain = "solarracing.ie"
+    domain  = "solarracing.ie"
+    domain2 = "www.solarracing.ie"
   }
 
   group "web" {
@@ -37,12 +38,9 @@ job "dcusr-dev" {
 
       tags = [
         "traefik.enable=true",
-        "traefik.http.routers.dcusr-dev.rule=Host(`solarracing.ie`) || Host(`www.solarracing.ie`)",
+        "traefik.http.routers.dcusr-dev.rule=Host(`${NOMAD_META_domain}`) || Host(`${NOMAD_META_domain2}`)",
         "traefik.http.routers.dcusr-dev.entrypoints=web,websecure",
         "traefik.http.routers.dcusr-dev.tls.certresolver=lets-encrypt",
-        "traefik.http.routers.dcusr-dev.middlewares=dcusr-nextauth-headers",
-        "traefik.http.middlewares.dcusr-nextauth-headers.headers.sslProxyHeaders.X-Forwarded-Proto=https",
-        "traefik.http.middlewares.dcusr-nextauth-headers.headers.customRequestHeaders.X-Forwarded-Host=solarracing.ie",
 
       ]
     }
@@ -81,7 +79,9 @@ PREVIEW_SECRET={{ key "socs/dcusr-dev/preview/secret" }}
 SEED_ADMIN_EMAIL={{ key "socs/dcusr-dev/seed/email" }}
 SEED_ADMIN_PASSWORD={{ key "socs/dcusr-dev/seed/password" }}
 
-DATABASE_URL=postgresql://{{ key "socs/dcusr-dev/db/user" | urlquery }}:{{ key "socs/dcusr-dev/db/password" | urlquery }}@{{ range service "dcusr-dev-db" }}{{ .Address }}:{{ .Port }}{{ end }}/{{ key "socs/dcusr-dev/db/name" | urlquery }}?schema=public
+{{ range service "dcusr-dev-db"  -}}
+DATABASE_URL=postgresql://{{ key "socs/dcusr-dev/db/user" | urlquery }}:{{ key "socs/dcusr-dev/db/password" | urlquery }}@{{ .Address }}:{{ .Port }}/{{ key "socs/dcusr-dev/db/name" | urlquery }}?schema=public
+{{- end }}
 
 MINIO_ENDPOINT={{ key "socs/dcusr-dev/minio/url" }}
 MINIO_PORT={{ key "socs/dcusr-dev/minio/port" }}
@@ -121,30 +121,30 @@ EOH
         hook    = "prestart"
         sidecar = false
       }
-
       config {
-        image   = "postgres:17-alpine"
+        image   = "alpine:3.19"
         command = "sh"
         args = [
           "-c",
-          "while ! pg_isready -h ${DB_HOST} -p ${DB_PORT} -U ${DB_USER}; do echo 'Waiting for DB...'; sleep 1; done; echo 'DB is ready!'"
+          "while ! nc -z \"$DB_HOST\" \"$DB_PORT\"; do echo 'Waiting for Postgres...'; sleep 1; done; echo 'DB is ready!'"
         ]
       }
 
       template {
-        destination = "local/wait.env"
+        destination = "local/.env"
         env         = true
+        change_mode = "restart"
         data        = <<EOH
-{{ range service "dcusr-dev-db" }}
+{{- range service "dcusr-dev-db" }}
 DB_HOST={{ .Address }}
 DB_PORT={{ .Port }}
-{{ end }}
-DB_USER={{ key "socs/dcusr-dev/db/user" }}
+{{- end }}
 EOH
       }
 
       resources {
-        memory = 128
+        cpu    = 50
+        memory = 64
       }
     }
   }

From 82e75debd61d7e1e2888605e21aef7adb074e235 Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Thu, 18 Jun 2026 14:17:48 +0100
Subject: [PATCH 14/15] dcusr: update openproject job

---
 jobs/socs/dcusr/dcusr-openproject.hcl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/jobs/socs/dcusr/dcusr-openproject.hcl b/jobs/socs/dcusr/dcusr-openproject.hcl
index 1a522af..364596f 100644
--- a/jobs/socs/dcusr/dcusr-openproject.hcl
+++ b/jobs/socs/dcusr/dcusr-openproject.hcl
@@ -32,7 +32,6 @@ job "dcusr-openproject" {
         "traefik.http.routers.dcusr-openproject.entrypoints=web,websecure",
         "traefik.http.routers.dcusr-openproject.rule=Host(`${NOMAD_META_domain}`)",
         "traefik.http.routers.dcusr-openproject.tls=true",
-        "traefik.http.routers.dcusr-openproject.tls.certresolver=lets-encrypt",
       ]
     }
 
@@ -56,6 +55,7 @@ OPENPROJECT_HOST__NAME={{ env "NOMAD_META_domain" }}
 OPENPROJECT_HTTPS=true
 
 OPENPROJECT_SECRET_KEY_BASE={{ key "dcusr/openproject/secret_key_base" }}
+SECRET_KEY_BASE={{ key "dcusr/openproject/secret_key_base" }}
 
 EMAIL_DELIVERY_METHOD=smtp
 SMTP_ADDRESS={{ key "dcusr/openproject/smtp/address" }}

From 661973ecc11fa87ccb34f34dbe1d238abe6d4141 Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Thu, 18 Jun 2026 14:49:01 +0100
Subject: [PATCH 15/15] dcusr: add pitwall job

---
 jobs/socs/dcusr/pitwall.hcl | 69 +++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 jobs/socs/dcusr/pitwall.hcl

diff --git a/jobs/socs/dcusr/pitwall.hcl b/jobs/socs/dcusr/pitwall.hcl
new file mode 100644
index 0000000..2b77f84
--- /dev/null
+++ b/jobs/socs/dcusr/pitwall.hcl
@@ -0,0 +1,69 @@
+job "pitwall" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "pitwall.solarracing.ie"
+  }
+
+  group "pitwall" {
+    count          = 1
+    shutdown_delay = "5s"
+
+    network {
+      port "http" {
+        to = 8080
+      }
+    }
+
+    service {
+      name = "pitwall"
+      port = "http"
+
+      check {
+        type     = "http"
+        path     = "/healthz"
+        interval = "10s"
+        timeout  = "2s"
+      }
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.pitwall.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.pitwall.entrypoints=web,websecure",
+        "traefik.http.routers.dcusr-dev.tls=true",
+      ]
+    }
+
+    task "pitwall-dashboard" {
+      driver = "docker"
+
+      config {
+        image      = "ghcr.io/dcu-solar-racing/solarcar-ecs-pit-dashboard:latest"
+        ports      = ["http"]
+        force_pull = true
+
+        auth {
+          username = "${DOCKER_USER}"
+          password = "${DOCKER_PASS}"
+        }
+      }
+
+      template {
+        destination = "secrets/secret.env"
+        env         = true
+        change_mode = "restart"
+        data        = <<EOH
+DOCKER_USER={{ key "dcusr/ghcr/username" }}
+DOCKER_PASS={{ key "dcusr/ghcr/password" }}
+EOH
+      }
+
+      resources {
+        cpu    = 100
+        memory = 64
+      }
+    }
+  }
+}
+