Switch to dockhand envs (#1)

Co-authored-by: ulfrxdev <r.rafal.r9@gmail.com>
Co-committed-by: ulfrxdev <r.rafal.r9@gmail.com>

stacks/authentik/.env

@@ -1,3 +0,0 @@
-AUTHENTIK_DOMAIN=auth.ulfrx.dev
-PG_DB=authentik
-PG_USER=authentikx

stacks/authentik/docker-compose.yml

@@ -3,8 +3,6 @@ services:
     image: postgres@sha256:035b9ab53cfa147d7202b61f5f7782b939ae815b7d6bc81c96b7b42ff1fca950
     container_name: authentik-db
     restart: unless-stopped
-    env_file:
-      - .env
     environment:
       POSTGRES_DB: ${PG_DB}
       POSTGRES_USER: ${PG_USER}

stacks/dockhand/.env

@@ -1 +0,0 @@
-DOCKHAND_DOMAIN=dockhand.ulfrx.dev

stacks/dockhand/docker-compose.yaml

@@ -3,8 +3,6 @@ services:
     image: fnsys/dockhand@sha256:546e7ab26146a64fe93f5f421d3f73914f495a84bfdb87bc3ff3a199388f44a2
     container_name: dockhand
     restart: unless-stopped
-      env_file:
-        - .env
     environment:
       - ENCRYPTION_KEY_PATH=/run/secrets/encryption_key
       - DISABLE_LOCAL_LOGIN=true

stacks/gitea/.env

@@ -1 +0,0 @@
-GITEA_DOMAIN=git.ulfrx.dev

stacks/gitea/docker-compose.yaml

@@ -6,8 +6,6 @@ services:
     depends_on:
       db:
         condition: service_healthy
-    env_file:
-      - .env
     environment:
       - GITEA__database__DB_TYPE=postgres
       - GITEA__database__HOST=db:5432

stacks/homepage/.env

@@ -1 +0,0 @@
-HOMEPAGE_DOMAIN=ulfrx.dev

stacks/homepage/docker-compose.yaml

@@ -3,8 +3,6 @@ services:
     image: ghcr.io/gethomepage/homepage:v1.10.1@sha256:4815be05c8abf3503272b7ff1ac40c5f7364602a1ed807b0fc5a4cf69df0b15b
     container_name: homepage
     restart: unless-stopped
-    env_file:
-      - .env
     environment:
      - HOMEPAGE_ALLOWED_HOSTS=${HOMEPAGE_DOMAIN}
     networks:

stacks/proxy/.env

@@ -1 +0,0 @@
-ACME_EMAIL=magnate-wayward6k@icloud.com

stacks/proxy/docker-compose.yaml

@@ -1,17 +1,19 @@
 services:
   tunnel:
     image: cloudflare/cloudflared:2026.2.0@sha256:09b8ae19c02e44c075361a64094e6216421672705647b0e8d4ce8d1d8feea7ac
+    container_name: tunnel
     restart: unless-stopped
     command: tunnel --no-autoupdate run
     environment:
       - TUNNEL_TOKEN_FILE=/run/secrets/tunnel_token
     networks:
-      - homelab_proxy
+      - proxy
     secrets:
       - tunnel_token
 
   traefik:
     image: traefik:v3.6.8@sha256:daf5df7f7b96cd34a1a499a275cb93c8dbc4ce58d49f98911e0583ba41cc4351
+    container_name: traefik
     restart: unless-stopped
     command:
       - --providers.docker=true
@@ -23,15 +25,13 @@ services:
       - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
       - --certificatesresolvers.le.acme.dnschallenge=true
       - --certificatesresolvers.le.acme.dnschallenge.provider=cloudflare
-    env_file:
-      - .env
     environment:
       - CF_DNS_API_TOKEN_FILE=/run/secrets/cf_api_token
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - letsencrypt:/letsencrypt
     networks:
-      - homelab_proxy
+      - proxy
       - homelab_apps
     secrets:
       - cf_api_token
@@ -41,13 +41,13 @@ volumes:
     driver: local
 
 networks:
-  homelab_proxy:
+  proxy:
-    external: true
+    internal: true
   homelab_apps:
     external: true
 
 secrets:
   tunnel_token:
-    file: ./secrets/tunnel_token.txt
+    file: /opt/stacks/proxy/secrets/tunnel_token.txt
   cf_api_token:
-    file: ./secrets/cf_api_token.txt
+    file: /opt/stacks/proxy/secrets/cf_api_token.txt