Self-Hosted on Sysadmin Tales

How to set up the Cially Dashboard for Discord

Mon, 19 May 2025 21:46:40 -0400

How to set up the Cially Dashboard for Discord

Cially is a dashboard for Discord that shows you interesting statistics regarding your server, or multiple servers.

I’m going to show you how to get it set up on your own system using Docker.

Note

This guide does assume some familiarity with Docker and Docker Compose, as well as Linux in general.

1. Setting up an application

Cially takes the form of a Discord bot. In order for your bot to join a server you have to create an application for it in your Discord developer account portal.

Go to the Discord Developer Portal and create a new application. You can call it whatever you wish, I called mine “Cially.”
Under “Installation”, set “Install Link” to “None”, and uncheck “User Install”.
Under “Bot”:
- Enable all three sliders under “Privileged Gateway Intents.”
- Uncheck “Public Bot”. (Unless you would like other people to be able to add your bot to their servers, too.) If you get an error with this step, make sure you completed ‘set Install Link to None in step 2.’
- Click the “Reset” button to get your bot token. Save this in a text editor, we’ll need it when setting up the bot on our server. This will only be shown once, so if you lose it, you’ll have to reset it again. I keep this in my password manager vault to make sure I don’t lose it.
Under “Oauth2”:
- Copy the Client ID from the Oauth2 screen and save it with the bot token you copied earlier.
- Give the bot the following Oauth2 scopes: (Source)
  - bot
  - applications.commands
- At the bottom of the screen it will give you a URL. Paste that into your browser, and it should prompt you to join the bot to one of your servers.

2. Setting up Cially in Docker

This is a relatively complicated docker compose file. The project provides one, but I chose to take it and make some changes so it would work behind my Traefik reverse proxy.

Either one works, but if you’d like to use my compose file, this is it:

networks:
  traefik:
    external: true

services:
  cially:
    image: ghcr.io/skellgreco/cially-bot:${CIALLY_DOCKER_TAG:-latest}
    container_name: ${CIALLY_CONTAINER_NAME:-cially}
    restart: ${CIALLY_RESTART:-unless-stopped}
    mem_limit: ${CIALLY_MEM_LIMIT:-200g}
    env_file:
      - .env
    networks:
      - traefik
    volumes:
      - ./config:/config
      - /etc/localtime:/etc/localtime:ro
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ}
      - TOKEN=${CIALLY_BOT_TOKEN}
      - CLIENT_ID=${CIALLY_BOT_CLIENT_ID}
      - API_URL=http://cially:3001
      - DEBUGGING=${CIALLY_BOT_DEBUGGING:-FALSE}
      - POCKETBASE_URL=http://pocketbase:8090
      - GUILD_COLLECTION=guilds
      - MESSAGE_COLLECTION=messages
      - INVITE_COLLECTION=invites
      - MEMBER_LEAVES_COLLECTION=member_leaves
      - MEMBER_JOINS_COLLECTION=member_joins
      - PORT=3001
    depends_on:
      - pocketbase
      - cially-web
    labels:
      - com.centurylinklabs.watchtower.enable=${CIALLY_WATCHTOWER_ENABLED:-true}
      - autoheal=${CIALLY_AUTOHEAL_ENABLED:-true}

  cially-web:
    image: ghcr.io/skellgreco/cially-web:latest
    container_name: cially-web
    restart: unless-stopped
    environment:
      # Runtime environment variables
      - NEXT_PUBLIC_BOT_API_URL=http://cially:3001
      - POCKETBASE_URL=http://pocketbase:8090
      - MESSAGE_COLLECTION=messages
      - INVITE_COLLECTION=invites
      - MEMBER_LEAVES_COLLECTION=member_leaves
      - MEMBER_JOINS_COLLECTION=member_joins
      - GUILDS_COLLECTION=guilds
    env_file:
      - .env
    depends_on:
      - pocketbase
    labels:
      - joyride.host.name=${CIALLY_HOST_NAME:-cially}.${HOST_DOMAIN}
      - traefik.enable=${CIALLY_TRAEFIK_ENABLED:-true}
      - traefik.http.routers.cially.entrypoints=websecure
      - traefik.http.routers.cially.rule=Host(`${CIALLY_HOST_NAME:-cially}.${HOST_DOMAIN}`)
      - traefik.http.services.cially.loadbalancer.server.port=3000
      - com.centurylinklabs.watchtower.enable=${CIALLY_WATCHTOWER_ENABLED:-true}
      - autoheal=${CIALLY_AUTOHEAL_ENABLED:-true}
    networks:
      - traefik

  # Need to expose this via Traefik as well since the user needs to log into Pocketbase and configure it.
  pocketbase:
    image: ghcr.io/keksiqc/pocketbase:0.26.6
    container_name: cially-pocketbase
    restart: unless-stopped
    env_file:
      - .env
    volumes:
      - ./pocketbase-data:/pb/pb_data
    networks:
      - traefik
    labels:
      - joyride.host.name=${CIALLY_POCKETBASE_HOST_NAME:-cially-pb}.${HOST_DOMAIN}
      - traefik.enable=${CIALLY_TRAEFIK_ENABLED:-true}
      - traefik.http.routers.cially-pb.entrypoints=websecure
      - traefik.http.routers.cially-pb.rule=Host(`${CIALLY_POCKETBASE_HOST_NAME:-cially-pb}.${HOST_DOMAIN}`)
      - traefik.http.services.cially-pb.loadbalancer.server.port=8090
      - com.centurylinklabs.watchtower.enable=${CIALLY_WATCHTOWER_ENABLED:-true}
      - autoheal=${CIALLY_AUTOHEAL_ENABLED:-true}

Like I said, this is a doozy, and unusually, it’s not as simple as docker compose up and it works. There’s one or two extra steps required.

Log into your server and create a new folder for Cially.

sudo mkdir -p /apps/cially
sudo chown -R $USER:$USER /apps/cially && cd /apps/cially
Now, create a .env file in this directory: vim .env or nano .env
Add the following two environment variables, replacing them with your Client ID and token where appropriate:
```
CIALLY_BOT_TOKEN=<BOT_TOKEN_GOES_HERE>
CIALLY_BOT_CLIENT_ID=<CLIENT_ID_GOES_HERE>
```
Save and exit the file.
Create your docker compose file, either using mine from above, or the one from the project’s GitHub.

Note

Keep in mind if you use my compose file - I am not exposing any ports because everything is being routed through Traefik. If you want to expose them, you’ll have to re-add the ports key.

Run docker compose up -d.
Now, we need to import the collections provided by the Cially team into Pocketbase, which is one of the containers that the compose file is spinning up. But first, we need to log into Pocketbase and create a user account. To do so:
- Run docker logs <pocketbase-container-name>
- In the standard output for that container, you will see an http://0.0.0.0 URL. Copy and paste it into your browser, and replace 0.0.0.0 with the IP address of your server or your fully qualified domain name, if you’re using a reverse proxy.
- Set up a user account for Pocketbase when prompted.
- Once you’ve logged into Pocketbase, navigate to Settings, and then Import Collections.
- You’ll need to paste the content from the JSON file that’s provided for this purpose.
Once you’ve done so, I recommend giving everything a restart just to be on the safe side. docker compose up -d --force-recreate
At this point, you should be able to navigate to the IP address of your server on port 3000, or to your fully qualified domain name and see the Cially dashboard. It will take a few minutes for your server to become available as Cially collects data.

Dawarich - A Google Location History Alternative

Wed, 14 May 2025 19:13:45 -0400

Note

2025/05/24 - edited to fix some mistakes I caught later in my docker compose.

Continuing on the theme of moving all of my stuff out of other people’s cloud and into mine - I was recently made aware of Dawarich while listening to the Linux Unplugged podcast.

This is touted as an alternative to Google’s Location History feature, which is something that I use frequently. I need it to account for my time at work, so it’s fairly important that I have a solution like this.

I chose to set this up on one of my VPS machines at Linode rather than running it in my house. The logic behind this being that a datacenter is most likely going to have more reliable power than I do at my house.

That said, I don’t think I’m going to be going through the work of making this truly highly-available - it’s just not worth the headache when I’m the only user.

Installation

As always, I set this up using their provided Docker image.

Dawarich can do either an HTTP or MQTT backend. I already have a webserver on this VPS, so I’ll be using HTTP.

I highly recommend setting up valid HTTPS certificates for this. I’m using free certificates from LetsEncrypt. The Traefik reverse proxy I’m using has an ACME client built right in, which is very handy.

The compose file for this app is quite the doozy. The project provides one, but I made some of my own changes, and added labels for Traefik.

networks:
  traefik:
    external: true

services:
  dawarich:
    image: freikin/dawarich:${DAWARICH_DOCKER_TAG:-latest}
    container_name: ${DAWARICH_CONTAINER_NAME:-dawarich}
    restart: ${DAWARICH_RESTART:-unless-stopped}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./etc/dawarich/storage:/var/app/storage
    networks:
      - traefik
    stdin_open: true
    tty: true
    entrypoint: web-entrypoint.sh
    command: ["bin/rails", "server", "-p", "3000", "-b", "::"]
    environment:
      - RAILS_ENV=production
      - REDIS_URL=redis://dawarich_redis:6379/0
      - DATABASE_HOST=dawarich_db
      - DATABASE_PORT=5432
      - DATABASE_USERNAME=${DAWARICH_POSTGRES_USER:-postgres}
      - DATABASE_PASSWORD=${DAWARICH_POSTGRES_PW:-password}
      - DATABASE_NAME=dawarich_production
      - MIN_MINUTES_SPENT_IN_CITY=${DAWARICH_MIN_MINS:-30}
      - APPLICATION_HOSTS=localhost,::1,127.0.0.1,${DAWARICH_HOST_NAME:-dawarich}.${HOST_DOMAIN}
      - TIME_ZONE=${TZ}
      - APPLICATION_PROTOCOL=http
      # Can be either km or mi
      - DISTANCE_UNIT=${DAWARICH_DISTANCE_UNIT:-mi}
      - PROMETHEUS_EXPORTER_ENABLED=false
      - PROMETHEUS_EXPORTER_HOST=0.0.0.0
      - PROMETHEUS_EXPORTER_PORT=9394
      - SECRET_KEY_BASE=${DAWARICH_SECRET_KEY_BASE:-1234567890}
      - RAILS_LOG_TO_STDOUT="true"
      # SMTP settings
      - SMTP_SERVER=${DAWARICH_SMTP_SERVER}
      - SMTP_PORT=${DAWARICH_SMTP_PORT}
      - SMTP_USERNAME=${DAWARICH_SMTP_USERNAME}
      - SMTP_PASSWORD=${DAWARICH_SMTP_PASSWORD}
      - SMTP_FROM=${DAWARICH_SMTP_FROM}
      - SMTP_DOMAIN=${DAWARICH_SMTP_DOMAIN}
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "5"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget -qO - http://127.0.0.1:3000/api/v1/health | grep -q '\"status\"\\s*:\\s*\"ok\"'",
        ]
      interval: 10s
      retries: 30
      start_period: 30s
      timeout: 10s
    depends_on:
      dawarich_db:
        condition: service_healthy
        restart: true
      dawarich_redis:
        condition: service_healthy
        restart: true
    deploy:
      resources:
        limits:
          cpus: "0.50" # Limit CPU usage to 50% of one core
          memory: "4G" # Limit memory usage to 2GB
    labels:
      - joyride.host.name=${DAWARICH_HOST_NAME:-dawarich}.${HOST_DOMAIN}
      - traefik.enable=${DAWARICH_TRAEFIK_ENABLED:-true}
      - traefik.http.routers.dawarich.entrypoints=websecure
      - traefik.http.routers.dawarich.rule=Host(`${DAWARICH_HOST_NAME:-dawarich}.${HOST_DOMAIN}`)
      # - traefik.http.services.dawarich.loadbalancer.server.scheme=https # enable if the service wants to connect over https
      - traefik.http.services.dawarich.loadbalancer.server.port=3000
      - com.centurylinklabs.watchtower.enable=${DAWARICH_WATCHTOWER_ENABLED:-true}
      - autoheal=${DAWARICH_AUTOHEAL_ENABLED:-true}

  dawarich_sidekiq:
    image: freikin/dawarich:${DAWARICH_DOCKER_TAG:-latest}
    container_name: dawarich_sidekiq
    volumes:
      - ./etc/dawarich/public:/var/app/public
      - ./etc/dawarich/watched:/var/app/tmp/imports/watched
      - ./etc/dawarich/storage:/var/app/storage
    networks:
      - traefik
    stdin_open: true
    tty: true
    entrypoint: sidekiq-entrypoint.sh
    command: ["bundle", "exec", "sidekiq"]
    restart: on-failure
    environment:
      - RAILS_ENV=production
      - REDIS_URL=redis://dawarich_redis:6379/0
      - DATABASE_HOST=dawarich_db
      - DATABASE_PORT=5432
      - DATABASE_USERNAME=${DAWARICH_POSTGRES_USER:-postgres}
      - DATABASE_PASSWORD=${DAWARICH_POSTGRES_PW:-password}
      - DATABASE_NAME=dawarich_production
      - APPLICATION_HOSTS=localhost,::1,127.0.0.1,${DAWARICH_HOST_NAME:-dawarich}.${HOST_DOMAIN}
      - BACKGROUND_PROCESSING_CONCURRENCY=10
      - APPLICATION_PROTOCOL=http
      - DISTANCE_UNIT=km
      - PROMETHEUS_EXPORTER_ENABLED=false
      - PROMETHEUS_EXPORTER_HOST=dawarich
      - PROMETHEUS_EXPORTER_PORT=9394
      - SECRET_KEY_BASE=${DAWARICH_SECRET_KEY_BASE:-1234567890}
      - RAILS_LOG_TO_STDOUT="true"
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "5"
    healthcheck:
      test:
        ["CMD-SHELL", "bundle exec sidekiqmon processes | grep $${HOSTNAME}"]
      interval: 10s
      retries: 30
      start_period: 30s
      timeout: 10s
    depends_on:
      dawarich_db:
        condition: service_healthy
        restart: true
      dawarich_redis:
        condition: service_healthy
        restart: true
      dawarich:
        condition: service_healthy
        restart: true
    deploy:
      resources:
        limits:
          cpus: "0.50" # Limit CPU usage to 50% of one core
          memory: "4G" # Limit memory usage to 2GB

  dawarich_redis:
    image: redis:7.4-alpine
    container_name: dawarich_redis
    command: redis-server
    networks:
      - traefik
    volumes:
      - ./etc/dawarich/redis:/var/shared/redis
    restart: always
    healthcheck:
      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
      interval: 10s
      retries: 5
      start_period: 30s
      timeout: 10s

  dawarich_db:
    image: postgis/postgis:17-3.5-alpine
    shm_size: 1G
    container_name: dawarich_db
    volumes:
      - ./etc/dawarich/db:/var/lib/postgresql/data
    networks:
      - traefik
    environment:
      - POSTGRES_USER=${DAWARICH_POSTGRES_USER:-postgres}
      - POSTGRES_PASSWORD=${DAWARICH_POSTGRES_PW:-password}
      - POSTGRES_DB=dawarich_production
    restart: always
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "postgres"]
      interval: 10s
      retries: 5
      start_period: 30s
      timeout: 10s

And here are the environment variables that I have set.

DAWARICH_SMTP_SERVER=mail.mydomain.net
DAWARICH_SMTP_PORT=465
DAWARICH_SMTP_USERNAME=no-reply@mydomain.net
DAWARICH_SMTP_PASSWORD=<your password here>
DAWARICH_SMTP_FROM=no-reply@mydomain.net
DAWARICH_SMTP_DOMAIN=mydomain.net
DAWARICH_HOST_NAME=trips
DAWARICH_POSTGRES_PW=changeme
HOST_DOMAIN=mydomain.net
DAWARICH_SECRET_KEY_BASE=changeme # you can generate this with openssl rand -hex 32

Configuration

Most of the configuration is done for you already via the provided environment variables.

I will also note here that while I’ve included the settings for SMTP - I have yet to actually get it working.

From what I understand, SMTP support is relatively new to this application, so it could be either me being hamfisted, or an actual bug. I have not sorted that out yet.

But it’s not critical, so I chose to leave it there and move on.

The default username and password are demo@dawarich.app and password. Obviously we’ll need to change this… but this is more complicated than you might expect, as I’ll get to in a moment.

Nitpicks

User management in the Dawarich web UI is extremely basic, almost to the point of being useless. The only thing you can do is create a new, unprivileged user.

If you want to create a new admin account and get rid of the default one, you’ll have to drop into the Ruby console for that.

This is detailed on their website, but it’s not ideal.

Fixes

To create a new admin user

First, create a new user from the web interface.

Then do the following steps on the command line:

# Shell into the container
docker exec -it dawarich_app /bin/sh
# Enter the Ruby console
bin/rails console

# Promote your user to admin
User.find_by(email: 'user@example.com').update(admin: true)
# Exit the ruby console.
exit

If you’d like to delete the default admin user (and I recommend that you do) enter this command before exiting the Ruby console:

User.find_by(email: 'demo@dawarich.app').destroy

Using Dawarich with OwnTracks

Using Dawarich with OwnTracks is quite straightforward.

Get API URL

Log into the Dawarich web interface.
Click on your email address in the top right hand side of the page and go to Account.
From there you can copy the API URL example they’ve provided for OwnTracks.

Configuring the app

Install the app on your smartphone from your app store of choice (I like using F-Droid whenever possible) and then go into Preferences
In Preferences, click on Connection
Change the Mode to HTTP
Enter the URL into the provided field.
You do not need to set a username and password under Credentials - the URL you copied earlier contains the needed API key for authentication.

Replacing Pocket Casts

Mon, 05 May 2025 08:53:26 -0400

Replacing Pocket Casts

Overview

I’ve been a user of Pocket Casts for a long time now. There’s nothing wrong with it, and in fact it’s been a fantastic experience the entire time I’ve used it.

However, I’ve been trying to move whatever I can to open-source, self-hosted projects, and this was one that I’d wanted to take a crack at for quite a while.

Here were my requirements for a podcast manager:

Self-hosted and open-source.
The ability to listen on either mobile or desktop, and pick up from where I left off in either location.

I went through a few iterations of this, and I’m still not quite happy with the result, but let me go over the projects that I tried out, and the issues I ran into with them.

PinePods

PinePods is a newer project, built mostly with Rust and Python.

I tried this one first because it had a pretty web interface, a companion Android app, and support for sync through Gpodder compatible servers like Opodsync or the NextCloud GpodderSync app..

Installation was fairly straightforward, and I chose to integrate it with my existing Authentik instance for OIDC sign on.

All of that worked great - until I installed the mobile app and realized that OIDC is not yet supported. I assume that this is the reason that I was not seeing my progress synced between the mobile app and the web interface.

Next I tried using AntennaPod for the mobile app, with GpodderSync on NextCloud as the backend.

Somehow enabling GpodderSync in PinePods wiped out all of my existing podcast subscriptions. Thankfully I had them all backed up in an OPML file still, so it was just a matter of re-importing the file again.

However, none of the podcasts I had added to PinePods ever showed up in GpodderSync on NextCloud. However, adding a podcast via AntennaPod worked fine.

Supposedly there is a large update to sync coming to PinePods in the next few days, but I chose to move on and try out something else.

PodFetch

PodFetch is another podcast manager. This one comes with its own built-in Gpodder sync mechanism that just needs to be enabled via an environment variable.

The good:

I actually think PodFetch has the nicer UI of the two.

The bad:

I found the documentation for this project severely lacking and often found myself digging through GitHub issues to try and figure out how to configure certain things correctly.

Once again, OIDC is essentially a non-starter unless you’re not planning on ever using a mobile app.

Also, make sure that the user you try to connect AntennaPod with is not an administrator, or it will just fail. I had to enable additional logging in PodFetch to figure that out.

Once I finally figured out that headache, I discovered that sync is essentially broken. Listening to a podcast on either end and then forcing a full sync in AntennaPod does not change either side. I’m not sure what’s going on here, but this was the nail in the coffin. I was no longer interested in spending more time trying to get this working.

NextPod

Next, I tried out NextPod. This is the companion app to GpodderSync.

It is extremely basic and missing what I’d consider basic features like skip forward and back buttons, but at the very least - the synchronization of listen state works reliably.

For the moment I’ve settled on this setup:

GpodderSync for the backend, which keeps track of my subscriptions and listen state
NextPod for listening on desktop
AntennaPod for listening on mobile

It does essentially everything that was on my laundry list, but I’m not particularly happy with NextPod as my desktop solution. It works, but it lacks even the most basic management features, and the playback UI is, as I said, barebones.

If anyone else has any suggestions I’d like to hear about them. I’ll check out the updated PinePods when the sync updates drops, but for the moment I’ll leave this as it is.

Update: I was just made aware of RePod which looks much more functional than NextPod.