fix: pocketid encryption key inline, photon image layout, glances py 3.14

- Pocket-ID: ENCRYPTION_KEY contains $ — Komodo .env interpolation
  eats it. Inline with $$ YAML escape (value already in git history
  from master.yaml; rotate later).
- photon: image dropped uv; use image default CMD, strip stale PATH/JAVA.
- glances: PYTHON_VERSION must be 3.14 to match image venv.

.idea/.gitignore

@@ -0,0 +1,8 @@
+# Default ignored files
+/shelf/
+/workspace.xml
+# Editor-based HTTP Client requests
+/httpRequests/
+# Datasource local storage ignored files
+/dataSources/
+/dataSources.local.xml

.idea/codeStyles/codeStyleConfig.xml

@@ -0,0 +1,5 @@
+<component name="ProjectCodeStyleConfiguration">
+  <state>
+    <option name="PREFERRED_PROJECT_CODE_STYLE" value="Default" />
+  </state>
+</component>

.idea/compose-files.iml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="CIDR_MODULE" version="4">
+  <component name="NewModuleRootManager" inherit-compiler-output="true">
+    <exclude-output />
+    <content url="file://$MODULE_DIR$" />
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+  </component>
+</module>

.idea/developer-tools.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="DeveloperToolsToolWindowSettingsV1" lastSelectedContentNodeId="uuid-generator" pluginVersion="7.1.0">
+    <developerToolsConfigurations />
+  </component>
+</project>

.idea/google-java-format.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="GoogleJavaFormatSettings">
+    <option name="enabled" value="false" />
+  </component>
+</project>

.idea/misc.xml

@@ -0,0 +1,5 @@
+<project version="4">
+  <component name="ProjectRootManager" version="2" languageLevel="JDK_11" project-jdk-name="JDK 11" project-jdk-type="JavaSDK">
+    <output url="file://$PROJECT_DIR$/out" />
+  </component>
+</project>

.idea/modules.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectModuleManager">
+    <modules>
+      <module fileurl="file://$PROJECT_DIR$/.idea/compose-files.iml" filepath="$PROJECT_DIR$/.idea/compose-files.iml" />
+    </modules>
+  </component>
+</project>

.idea/vcs.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="VcsDirectoryMappings">
+    <mapping directory="" vcs="Git" />
+  </component>
+</project>

.junie/memory/language.json

@@ -0,0 +1 @@
+[]

.junie/memory/memory.version

@@ -0,0 +1 @@
+3.0

.mcp.json

@@ -0,0 +1,15 @@
+{
+  "mcpServers": {
+    "komodo": {
+      "type": "http",
+      "url": "https://komodo-mcp.arnoutvw.nl"
+    },
+    "unraid-mcp": {
+      "type": "http",
+      "url": "http://192.168.10.144:8043/mcp",
+      "headers": {
+        "Authorization": "Bearer f359c9dbb97d44d98278e0a69e81190706225a4ab7b947ee149b4be470c40763"
+      }
+    }
+  }
+}

automation/compose.yaml

@@ -744,58 +744,23 @@ services:
 
   photon:
 
-    command:
-      - "uv"
-      - "run"
-      - "-m"
-      - "src.process_manager"
-
     container_name: "photon"
 
-    entrypoint:
-      - "/bin/sh"
-      - "entrypoint.sh"
-
     environment:
-      - "HOST_OS=Unraid"
-      - "HOST_HOSTNAME=Atlas"
-      - "HOST_CONTAINERNAME=photon"
       - "UPDATE_STRATEGY=SEQUENTIAL"
       - "UPDATE_INTERVAL=720h"
       - "TZ=Europe/Berlin"
-      - "PATH=/opt/java/openjdk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-      - "JAVA_HOME=/opt/java/openjdk"
-      - "LANG=en_US.UTF-8"
-      - "LANGUAGE=en_US:en"
-      - "LC_ALL=en_US.UTF-8"
-      - "JAVA_VERSION=jdk-21.0.9+10"
-
-    hostname: "df06e527b77c"
 
     image: "rtuszik/photon-docker:latest"
 
     ipc: "private"
 
-    labels:
-      net.unraid.docker.icon: "https://photon.komoot.io/static/img/photon_logo.png"
-      net.unraid.docker.managed: "dockerman"
-      net.unraid.docker.webui: "http://[IP]:[PORT:2322]/"
-      org.opencontainers.image.description: "Unofficial docker image for the Photon Geocoder"
-      org.opencontainers.image.documentation: "https://github.com/rtuszik/photon-docker#readme"
-      org.opencontainers.image.ref.name: "ubuntu"
-      org.opencontainers.image.source: "https://github.com/rtuszik/photon-docker"
-      org.opencontainers.image.title: "photon-docker"
-      org.opencontainers.image.url: "https://github.com/rtuszik/photon-docker"
-      org.opencontainers.image.version: "24.04"
-
     logging:
       driver: "json-file"
       options:
         max-file: "1"
         max-size: "50m"
 
-    mac_address: "ee:2c:d1:6a:b5:c0"
-
     network_mode: "bridge"
 
     ports:

monitoring/compose.yaml

@@ -71,7 +71,7 @@ services:
     environment:
       - "GLANCES_OPT=-w -C /config/glances.conf"
       - "TZ=Europe/Berlin"
-      - "PYTHON_VERSION=3.12"
+      - "PYTHON_VERSION=3.14"
     expose:
       - "61208/tcp"
       - "61209/tcp"

pangolin/crowdsec-home-allowlist.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Sync CrowdSec allowlist "home_ddns" with the current A record of thuis.arnoutvw.nl.
+# Install: /usr/local/bin/crowdsec-home-allowlist.sh (chmod 755) on pangolin.arnoutvw.nl
+# Cron:    echo "*/5 * * * * root /usr/local/bin/crowdsec-home-allowlist.sh" > /etc/cron.d/crowdsec-home-allowlist
+set -euo pipefail
+HOST=thuis.arnoutvw.nl
+LIST=home_ddns
+CS="docker exec crowdsec cscli"
+
+want=$(dig +short A "$HOST" @1.1.1.1 | grep -E '^[0-9.]+$' | sort -u || true)
+if [ -z "$want" ]; then
+  logger -t crowdsec-home-allowlist "no A record for $HOST, keeping current allowlist"
+  exit 0
+fi
+have=$($CS allowlists inspect "$LIST" -o json \
+  | python3 -c 'import sys,json; [print(i["value"]) for i in (json.load(sys.stdin).get("items") or [])]' | sort -u)
+
+for ip in $want; do
+  if ! grep -qxF "$ip" <<<"$have"; then
+    $CS allowlists add "$LIST" "$ip" -d "$HOST" >/dev/null
+    logger -t crowdsec-home-allowlist "added $ip"
+  fi
+done
+for ip in $have; do
+  if ! grep -qxF "$ip" <<<"$want"; then
+    $CS allowlists remove "$LIST" "$ip" >/dev/null
+    logger -t crowdsec-home-allowlist "removed $ip"
+  fi
+done