Productivity Stack
GitLab, Vaultwarden, FreshRSS, Linkwarden, and Prosody.
Services
| Service | Port | Description |
|---|---|---|
| gitlab | 8929:80, 2222:22 | Git repository |
| vaultwarden | 4743:80 | Password manager |
| freshrss | 8054:80 | RSS reader |
| linkwarden | 3030:3000 | Bookmark manager |
| prosody | 5222, 5269, 5280, 5281 | XMPP server |
GitLab
Initial Setup
GitLab runs migrations on first start - takes 15-20 minutes. Be patient.
Get Root Password
docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password
NGINX Proxy Manager
Create HTTPS proxy for git.rishighan.com pointing to 192.168.1.75:8929
GitLab recommends SSL, so use HTTPS.
Vaultwarden
NGINX Proxy Manager
Create HTTPS proxy for vault.rishighan.com pointing to 192.168.1.75:4743
Admin Panel
Access at https://vault.rishighan.com/admin with the ADMIN_TOKEN from stack.env
FreshRSS
NGINX Proxy Manager
Create HTTPS proxy for rss.rishighan.com pointing to 192.168.1.75:8054
Import Feeds
- Copy
feeds.opmlto/mnt/user/appdata/freshrss/ - In FreshRSS: Settings → Import/Export → Import OPML
- Enable
af_readabilityextension to bypass paywalls
The OPML contains curated feeds for Gaming, Tech, Politics, Weather, and World News - free from paywalled bullshit.
Linkwarden
NGINX Proxy Manager
Create HTTPS proxy for links.rishighan.com pointing to 192.168.1.75:3030
Prosody
Self-hosted XMPP server for rishighan.com. Image: prosodyim/prosody:13.0.
Ports
| Port | Purpose |
|---|---|
| 5222 | Client-to-server (c2s) |
| 5269 | Server-to-server / federation (s2s) |
| 5280 | HTTP file uploads (proxied via NPM) |
| 5281 | HTTPS/BOSH (direct) |
Both 5222 and 5269 must be forwarded on the UDM Pro to Flook (192.168.1.75).
File uploads: NPM proxies xmpp.rishighan.com → 192.168.1.75:5280.
TLS Cert
Issued manually via certbot DNS challenge covering rishighan.com and xmpp.rishighan.com.
Certs stored at ./certs/privkey.pem and ./certs/fullchain.pem (copied from appdata archive, not symlinked).
Cert expires: 2026-05-24. Renew before then:
certbot certonly --manual --preferred-challenges dns \
--config-dir /mnt/user/appdata/prosody/certs \
--work-dir /mnt/user/appdata/prosody/certs/work \
--logs-dir /mnt/user/appdata/prosody/certs/logs \
-d rishighan.com -d xmpp.rishighan.com
# Copy new certs (increment N to match new archive version):
cp /mnt/user/appdata/prosody/certs/archive/xmpp.rishighan.com/privkeyN.pem \
/mnt/user/flook-stacks/stacks/productivity/certs/privkey.pem
cp /mnt/user/appdata/prosody/certs/archive/xmpp.rishighan.com/fullchainN.pem \
/mnt/user/flook-stacks/stacks/productivity/certs/fullchain.pem
chmod 644 /mnt/user/flook-stacks/stacks/productivity/certs/*.pem
docker restart prosody
DNS Records (GoDaddy)
| Type | Service | Protocol | Name | Value | Port |
|---|---|---|---|---|---|
| SRV | _xmpp-client |
_tcp |
@ |
xmpp.rishighan.com |
5222 |
| SRV | _xmpp-server |
_tcp |
@ |
xmpp.rishighan.com |
5269 |
| A | — | — | xmpp |
Flook's public IP | — |
User Management
docker exec -it prosody prosodyctl adduser user@rishighan.com
docker exec -it prosody prosodyctl passwd user@rishighan.com
docker exec -it prosody prosodyctl deluser user@rishighan.com
Data Directory Permissions
The ./data directory must be owned by UID 999:
chown -R 999:999 /mnt/user/flook-stacks/stacks/productivity/data