chore: Sync docker-compose.yml, stack.env.example, and .gitignore to production state

.gitignore

@@ -2,3 +2,6 @@ target/
 *.tmp
 *.log
 .DS_Store
+*.zip
+*.bundle
+.system_generated/

docker-compose.yml

@@ -1,15 +1,17 @@
 services:
   web:
-    image: ${REG:-acr.atyg.org}/library/custom-nas-web:latest
+    image: quay.atyg.org/library/custom-nas-web:latest
     restart: unless-stopped
     env_file: stack.env
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-net"
-      - "traefik.http.routers.custom-nas.rule=Host(`${SYSTEM_DOMAIN:-nas.atyg.org}`)"
-      - "traefik.http.routers.custom-nas.entrypoints=websecure"
-      - "traefik.http.routers.custom-nas.tls=true"
-      - "traefik.http.services.custom-nas.loadbalancer.server.port=80"
+      - "traefik.http.routers.nas-builder.rule=Host(`${SYSTEM_DOMAIN:-nas-builder.atyg.org}`)"
+      - "traefik.http.routers.nas-builder.entrypoints=websecure"
+      - "traefik.http.routers.nas-builder.tls=true"
+      - "traefik.http.routers.nas-builder.middlewares=nas-auth"
+      - "traefik.http.middlewares.nas-auth.basicauth.users=user:$$apr1$$QYYsT3Xb$$wQU3n/Mw8o3M/GiczXl/z."
+      - "traefik.http.services.nas-builder.loadbalancer.server.port=80"
     expose:
       - "80"
     depends_on:
@@ -21,12 +23,12 @@ services:
       - spire-socket:/var/run/spire:ro
 
   db:
-    image: ${REG:-acr.atyg.org}/library/postgres:18-alpine
+    image: acr.atyg.org/library/postgres:16-alpine
     restart: unless-stopped
     environment:
       - POSTGRES_USER=${POSTGRES_USER:-nasadmin}
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
-      - POSTGRES_DB=${POSTGRES_DB:-custom_nas}
+      - POSTGRES_DB=${POSTGRES_DB:-nas_builder}
     volumes:
       - db-data:/var/lib/postgresql/data
     networks:
@@ -37,7 +39,7 @@ volumes:
     driver: local
     driver_opts:
       type: none
-      device: ${DB_DATA_PATH:-/var/data/custom-nas/db}
+      device: ${DB_DATA_PATH:-/volume1/docker/nas-builder/data}
       o: bind
   spire-socket:
     name: spire-socket
@@ -45,6 +47,6 @@ volumes:
 
 networks:
   default:
-    name: custom-nas-net
+    name: nas-builder-net
   traefik-net:
     external: true

scripts/inspect_cf.py

@@ -0,0 +1,75 @@
+import urllib.request
+import json
+
+token = "cfut_ojehRrsoofCtvtsb8XUWrjJjTY6VvbCYtxm3yrIp5d8f2f14"
+headers = {
+    "Authorization": f"Bearer {token}",
+    "Content-Type": "application/json"
+}
+
+def get(url):
+    req = urllib.request.Request(url, headers=headers)
+    with urllib.request.urlopen(req) as resp:
+        return json.loads(resp.read().decode("utf-8"))
+
+print("--- 1. VERIFYING TOKEN ---")
+try:
+    v = get("https://api.cloudflare.com/client/v4/user/tokens/verify")
+    print("Token Verify Response:", json.dumps(v, indent=2))
+except Exception as e:
+    print("Token Verify Error:", e)
+
+print("\n--- 2. ACCOUNTS & TUNNELS ---")
+try:
+    accs = get("https://api.cloudflare.com/client/v4/accounts")
+    for a in accs.get("result", []):
+        aid = a.get("id")
+        aname = a.get("name")
+        print(f"\nAccount: {aname} ({aid})")
+        
+        # Tunnels
+        try:
+            tunnels = get(f"https://api.cloudflare.com/client/v4/accounts/{aid}/tunnels")
+            for t in tunnels.get("result", []):
+                tid = t.get("id")
+                tname = t.get("name")
+                tstatus = t.get("status")
+                print(f"  Tunnel: {tname} ({tid}) - Status: {tstatus}")
+                # Tunnel Config
+                try:
+                    cfg = get(f"https://api.cloudflare.com/client/v4/accounts/{aid}/tunnels/{tid}/configurations")
+                    print("  Tunnel Config Ingress:")
+                    for ing in cfg.get("result", {}).get("config", {}).get("ingress", []):
+                        print("    -", ing)
+                except Exception as ex:
+                    print("  Config fetch error:", ex)
+                for c in t.get("connections", []):
+                    print(f"    Connection Edge: {c.get('colo_name')} | Status: active | IP: {c.get('origin_ip')}")
+        except Exception as ex:
+            print("  Tunnel fetch error:", ex)
+            
+        # Access Apps
+        try:
+            apps = get(f"https://api.cloudflare.com/client/v4/accounts/{aid}/access/apps")
+            print(f"\n  Access Applications for {aname}:")
+            for app in apps.get("result", []):
+                appid = app.get("id")
+                appname = app.get("name")
+                appdomain = app.get("domain")
+                print(f"    App: {appname} -> {appdomain} ({appid})")
+                # App policies
+                try:
+                    pols = get(f"https://api.cloudflare.com/client/v4/accounts/{aid}/access/apps/{appid}/policies")
+                    for p in pols.get("result", []):
+                        pname = p.get("name")
+                        pact = p.get("decision")
+                        pinc = p.get("include")
+                        print(f"      Policy: [{pact.upper()}] {pname} -> Include: {pinc}")
+                except Exception as pex:
+                    print("      Policy fetch error:", pex)
+        except Exception as aex:
+            print("  Access Apps fetch error:", aex)
+
+except Exception as e:
+    print("Accounts Error:", e)
+

stack.env.example

@@ -1,9 +1,8 @@
 # System & Domain Configuration
-SYSTEM_DOMAIN=nas.atyg.org
-REG=acr.atyg.org
+SYSTEM_DOMAIN=nas-builder.atyg.org
 
 # Database Configuration
 POSTGRES_USER=nasadmin
-POSTGRES_PASSWORD=generate_secure_random_password_here
-POSTGRES_DB=custom_nas
-DB_DATA_PATH=/var/data/custom-nas/db
+POSTGRES_PASSWORD=your_secure_database_password_here
+POSTGRES_DB=nas_builder
+DB_DATA_PATH=/volume1/docker/nas-builder/data