Bring 15 stale entries in line with current private configs

Several of these had drifted so far they were unrecognizable (Nextcloud
was a bare minio stub, Ollama was missing the ollama service entirely,
Immich was missing 2 of 4 services). Also removed a real, exposed
Authentik OAuth client_id/secret that was sitting in Paperless-NGX's
entry (confirmed stale/rotated already, but shouldn't have been public
regardless) and stripped internal Caddy CA trust details from every
file per the same rule applied to nocodb/dashy etc.

Docker/Actual/docker-compose.yaml

@@ -3,16 +3,17 @@ services:
     image: actualbudget/actual-server:latest
     container_name: actual
     ports:
-      - 5006:5006
+      - ${HTTP_PORT}:5006
     environment:
-      - PUID=PUID
-      - PGID=PGID
-      - TZ=timezone
-      # Uncomment any of the lines below to set configuration options.
-      # - ACTUAL_HTTPS_KEY=/data/selfhost.key
-      # - ACTUAL_HTTPS_CERT=/data/selfhost.crt
-      # See all options and more details at https://actualbudget.github.io/docs/Installing/Configuration
-      # !! If you are not using any of these options, remove the 'environment:' tag entirely.
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
     volumes:
-      - /path/to/actual-data:/data
+      - /path/to/actual/actual-data:/data
     restart: unless-stopped
+    networks:
+      - actual-net
+
+networks:
+  actual-net:
+    external: true

Docker/Authentik/docker-compose.yaml

@@ -1,75 +1,108 @@
----
-
 services:
   postgresql:
+    env_file:
+      - .env
+    container_name: authentik-postgres
+    environment:
+      POSTGRES_DB: ${PG_DB}
+      POSTGRES_PASSWORD: ${PG_PASS}
+      POSTGRES_USER: ${PG_USER}
+    command: >
+      postgres
+      -c max_connections=400
+      -c shared_buffers=256MB
+      -c work_mem=8MB
+      -c maintenance_work_mem=128MB
+      -c effective_cache_size=1GB
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+        - CMD-SHELL
+        - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
     image: docker.io/library/postgres:16-alpine
     restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 5s
     volumes:
       - /path/to/authentik/database:/var/lib/postgresql/data
-    environment:
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
-      POSTGRES_USER: ${PG_USER:-authentik}
-      POSTGRES_DB: ${PG_DB:-authentik}
-    env_file:
-      - .env
+    networks:
+      - authentik-net
+
   redis:
-    image: docker.io/library/redis:alpine
-    command: --save 60 1 --loglevel warning
+    image: redis:7-alpine
+    container_name: authentik-redis
     restart: unless-stopped
+    command: redis-server --appendonly yes
     healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      start_period: 20s
-      interval: 30s
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
       retries: 5
-      timeout: 3s
     volumes:
       - /path/to/authentik/redis:/data
+    networks:
+      - authentik-net
+
   server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2}
-    restart: unless-stopped
     command: server
-    environment:
-      AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-    volumes:
-      - /path/to/authentik/media:/media
-      - /path/to/authentik/custom-templates:/templates
+    container_name: authentik-server
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
     env_file:
       - .env
-    ports:
-      - "${HTTP_PORT}:9000"
-      - "${HTTPS_PORT}:9443"
-    depends_on:
-      - postgresql
-      - redis
-  worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2}
-    restart: unless-stopped
-    command: worker
     environment:
-      AUTHENTIK_REDIS__HOST: redis
       AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
       AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_URL: ${AUTHENTIK_URL}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.3}
+    ports:
+      - ${COMPOSE_PORT_HTTP}:9000
+    restart: unless-stopped
+    shm_size: 512mb
+    volumes:
+      - /path/to/authentik/data:/data
+      - /path/to/authentik/custom-templates:/templates
+    networks:
+      - authentik-net
+
+  worker:
+    command: worker
+    container_name: authentik-worker
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_URL: ${AUTHENTIK_URL}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.3}
+    restart: unless-stopped
+    shm_size: 512mb
     user: root
     volumes:
-      - /path/to/authentik/var/run/docker.sock:/var/run/docker.sock
-      - /path/to/authentik/media:/media
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /path/to/authentik/data:/data
       - /path/to/authentik/certs:/certs
       - /path/to/authentik/custom-templates:/templates
-    env_file:
-      - .env
-    depends_on:
-      - postgresql
-      - redis
+    networks:
+      - authentik-net
 
+networks:
+  authentik-net:
+    external: true

Docker/Bookstack/docker-compose.yaml

@@ -1,7 +1,7 @@
 ---
 services:
   bookstack:
-    image: lscr.io/linuxserver/bookstack
+    image: lscr.io/linuxserver/bookstack:latest
     container_name: bookstack
     environment:
       - PUID=${PUID}
@@ -20,19 +20,44 @@ services:
       - ${HTTP_PORT}:80
     restart: unless-stopped
     depends_on:
-      - bookstack_db
+      bookstack_db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:80/ || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - bookstack-net
 
   bookstack_db:
-    image: lscr.io/linuxserver/mariadb
+    image: lscr.io/linuxserver/mariadb:latest
     container_name: bookstack_db
     environment:
       - PUID=${PUID}
       - PGID=${PGID}
       - TZ=${TZ}
-      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
-      - MYSQL_DATABASE=${MYSQL_DATABASE}
-      - MYSQL_USER=${MYSQL_USER}
-      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
+      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
+      - MYSQL_DATABASE=${DB_DATABASE}
+      - MYSQL_USER=${DB_USER}
+      - MYSQL_PASSWORD=${DB_PASSWORD}
     volumes:
       - /path/to/bookstack/bookstack_db_data:/config
     restart: unless-stopped
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "mysqladmin ping -h localhost -u${DB_USER} -p${DB_PASSWORD} || exit 1",
+        ]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+    networks:
+      - bookstack-net
+
+networks:
+  bookstack-net:
+    external: true

Docker/Calibre-Web/docker-compose.yaml

@@ -1,15 +1,21 @@
-version: '3'
 services:
-  calibre-web:
-    image: lscr.io/linuxserver/calibre-web:latest
-    container_name: calibre-web
+  calibre-web-automated:
+    image: crocodilestick/calibre-web-automated:latest
+    container_name: calibre-web-automated
     environment:
-      - PUID=PUID
-      - PGID=PGID
-      - TZ=timezone
+      - TZ=${TZ}
+      - DOCKER_MODS=linuxserver/mods:universal-calibre
     volumes:
       - /path/to/calibre-web:/config
-      - /path/to/books:/books
+      - /path/to/media/calibre:/calibre-library
+      - /path/to/calibre-web/ingest:/cwa-book-ingest
+      # This is an ingest dir, NOT a library one. Anything added here will be automatically added to your library according to the settings you have configured in CWA Settings page. All files placed here are REMOVED AFTER PROCESSING
     ports:
-      - 8083:8083
+      - ${HTTP_PORT}:8083
     restart: unless-stopped
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Calibre/docker-compose.yaml

@@ -1,18 +1,25 @@
-version: '3'
 services:
   calibre:
     image: lscr.io/linuxserver/calibre:latest
     container_name: calibre
+    security_opt:
+      - seccomp:unconfined #optional
     environment:
-      - PUID=PUID
-      - PGID=PGID
-      - TZ=timezone
-      - CUSTOM_USER=user
-      - PASSWORD=password
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
     volumes:
       - /path/to/calibre:/config
       - /path/to/books:/books
     ports:
-      - 8080:8080
-      - 8081:8081
+      - ${HTTP_PORT}:8080 # Calibre desktop gui.
     restart: unless-stopped
+    networks:
+      - media-net
+      - notif-net
+
+networks:
+  media-net:
+    external: true
+  notif-net:
+    external: true

Docker/CloudCommander/docker-compose.yaml

@@ -1,10 +1,27 @@
 services:
   cloudcmd:
-    image: coderaiser/cloudcmd
-    container_name: cloudcmd
+    image: coderaiser/cloudcmd:latest
+    container_name: cloudcommander
     ports:
-      - 8000:8000
+      - ${HTTP_PORT}:8000
     volumes:
       - ~:/root
       - /:/mnt/fs
+    user: "1000:1000"
     restart: unless-stopped
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "curl -fsS http://localhost:8000 | grep -qi cloudcmd || exit 1",
+        ]
+      interval: 20s
+      timeout: 5s
+      retries: 5
+      start_period: 25s
+    networks:
+      - cloudcommander-net
+
+networks:
+  cloudcommander-net:
+    external: true

Docker/Home-Assistant/docker-compose.yaml

@@ -1,7 +1,7 @@
 services:
   homeassistant:
     container_name: home-assistant
-    image: "ghcr.io/home-assistant/home-assistant:stable"
+    image: ghcr.io/home-assistant/home-assistant:stable
     volumes:
       - /path/to/home-assistant/config:/config
       - /etc/localtime:/etc/localtime:ro
@@ -11,23 +11,46 @@ services:
       - TZ=${TZ}
     restart: unless-stopped
     ports:
-      - ${HTTP_PORT}:8123
+      - "${HTTP_PORT}:8123"
     depends_on:
-      - homeassistant-db
+      homeassistant-db:
+        condition: service_healthy
     privileged: true
+    healthcheck:
+      test: [
+          "CMD-SHELL",
+          "curl -fsS -o /dev/null -w '%{http_code}' http://127.0.0.1:8123/api/
+          | grep -q 401",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+      start_period: 90s
+    networks:
+      - home-assistant-net
 
   homeassistant-db:
-    image: docker.io/postgres:16.3
     container_name: homeassistant-db
+    image: postgres:latest
     restart: unless-stopped
     environment:
       - POSTGRES_USER=${POSTGRES_USER}
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
       - POSTGRES_DB=${POSTGRES_DB}
-      # ensure the database gets created correctly
-      # https://github.com/matrix-org/synapse/blob/master/docs/postgres.md#set-up-database
-      - POSTGRES_INITDB_ARGS=--encoding=UTF-8
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --locale=en_US.UTF-8
     volumes:
-      - /path/to/home-assistant/schemas:/var/lib/postgresql/data
+      - /path/to/home-assistant/schemas:/var/lib/postgresql
     security_opt:
       - no-new-privileges:true
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+    networks:
+      - home-assistant-net
+
+networks:
+  home-assistant-net:
+    external: true

Docker/IT-Tools/docker-compose.yaml

@@ -1,7 +1,19 @@
 services:
   it-tools:
-    image: 'corentinth/it-tools:latest'  
-    ports:
-      - '${HTTP_PORT}:80'  
+    image: corentinth/it-tools:latest
     restart: unless-stopped
     container_name: it-tools
+    ports:
+      - ${HTTP_PORT}:80
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost/ > /dev/null || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    networks:
+      - it-tools-net
+
+networks:
+  it-tools-net:
+    external: true

Docker/Immich/docker-compose.yaml

@@ -6,37 +6,21 @@ services:
       - PGID=${PGID}
       - TZ=${TZ}
     image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
-    command: [ "start.sh", "immich" ]
     volumes:
-      - /path/to/upload:/usr/src/app/upload
+      - /path/to/immich/data:/data
+      - /path/to/immich/upload:/usr/src/app/upload
+      - /path/to/external-library-1:/path/to/external-library-1:ro
+      - /path/to/external-library-2:/path/to/external-library-2:ro
     env_file:
       - .env
     ports:
-      - ${HTTP_PORT}:3001
+      - ${HTTP_PORT}:2283
     depends_on:
       - redis
       - database
-    restart: always
-
-  immich-microservices:
-    container_name: immich_microservices
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ} 
-    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
-    extends:
-      file: hwaccel.yml
-      service: hwaccel
-    command: [ "start.sh", "microservices" ]
-    volumes:
-      - /path/to/upload:/usr/src/app/upload
-    env_file:
-      - .env
-    depends_on:
-      - redis
-      - database
-    restart: always
+    restart: unless-stopped
+    networks:
+      - immich-net
 
   immich-machine-learning:
     container_name: immich_machine_learning
@@ -49,20 +33,26 @@ services:
       - /path/to/immich/model-cache:/cache
     env_file:
       - .env
-    restart: always
+    restart: unless-stopped
+    networks:
+      - immich-net
 
   redis:
     container_name: immich_redis
+    image: redis:6.2-alpine
     environment:
       - PUID=${PUID}
       - PGID=${PGID}
       - TZ=${TZ}
-    image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3
-    restart: always
+    volumes:
+      - /path/to/immich/redis:/data
+    restart: unless-stopped
+    networks:
+      - immich-net
 
   database:
     container_name: immich_postgres
-    image: registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
     env_file:
       - .env
     environment:
@@ -72,8 +62,14 @@ services:
       - POSTGRES_PASSWORD=${DB_PASSWORD}
       - POSTGRES_USER=${DB_USERNAME}
       - POSTGRES_DB=${DB_DATABASE_NAME}
+      - POSTGRES_INITDB_ARGS='--data-checksums'
     volumes:
       - /path/to/immich/pgdata:/var/lib/postgresql/data
-    restart: always
+    shm_size: 128mb
+    restart: unless-stopped
+    networks:
+      - immich-net
 
-## there is a known issue with Traefik: see here https://github.com/immich-app/immich/discussions/437#discussioncomment-3609797
+networks:
+  immich-net:
+    external: true

Docker/Joplin/docker-compose.yaml

@@ -1,16 +1,24 @@
 services:
   joplin-db:
-    image: postgres:15
+    image: postgres:latest
     container_name: joplin-db
     volumes:
-      - /path/to/data:/var/lib/postgresql/data
+      - /path/to/joplin:/var/lib/postgresql
     ports:
-      - 5432:5432
+      - "${POSTGRES_PORT}:5432"
     restart: unless-stopped
     environment:
-      - POSTGRES_PASSWORD=db_password
-      - POSTGRES_USER=db_user
-      - POSTGRES_DB=joplin
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_DB=${POSTGRES_DB}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 15s
+    networks:
+      - joplin-net
 
   joplin:
     image: joplin/server:latest
@@ -18,22 +26,31 @@ services:
     depends_on:
       - joplin-db
     ports:
-      - 22300:22300
+      - "${HTTP_PORT}:22300"
     restart: unless-stopped
     environment:
-      - APP_PORT=22300
-      - APP_BASE_URL=https://subdomain.websiteurl.com
+      - APP_PORT=${HTTP_PORT}
+      - APP_BASE_URL=${APP_BASE_URL}
       - DB_CLIENT=pg
-      - POSTGRES_PASSWORD=db_password
-      - POSTGRES_DATABASE=joplin
-      - POSTGRES_USER=db_user
-      - POSTGRES_PORT=5432
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DATABASE=${POSTGRES_DB}
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PORT=${POSTGRES_PORT}
       - POSTGRES_HOST=joplin-db
       - MAILER_ENABLED=1
-      - MAILER_HOST=smtp.gmail.com
-      - MAILER_PORT=465
-      - MAILER_SECURE=1
-      - MAILER_AUTH_USER=[email protected]
-      - MAILER_AUTH_PASSWORD=Y0urP@ssw0rd
-      - MAILER_NOREPLY_NAME=Joplin
-      - MAILER_NOREPLY_EMAIL=[email protected]
+      - MAILER_HOST=${MAILER_HOST}
+      - MAILER_PORT=${MAILER_PORT}
+      - MAILER_SECURITY=${MAILER_SECURITY}
+      - MAILER_AUTH_USER=${MAILER_AUTH_USER}
+      - MAILER_AUTH_PASSWORD=${MAILER_AUTH_PASSWORD}
+      - MAILER_NOREPLY_NAME=${MAILER_NOREPLY_NAME}
+      - MAILER_NOREPLY_EMAIL=${MAILER_NOREPLY_EMAIL}
+      - APP_ADMIN_EMAIL=${APP_ADMIN_EMAIL}
+      - APP_ADMIN_PASSWORD=${APP_ADMIN_PASSWORD}
+      - APP_ADMIN_NAME=${APP_ADMIN_NAME}
+    networks:
+      - joplin-net
+
+networks:
+  joplin-net:
+    external: true

Docker/Nextcloud/docker-compose.yaml

@@ -1,14 +1,82 @@
+name: nextcloud
 services:
-  minio:
-    image: minio/minio
-    container_name: minio
-    ports:
-      - ${HTTP_PORT}:9000
-      - ${HTTP_PORT1}:9001
+  db:
+    image: lscr.io/linuxserver/mariadb:latest
+    container_name: nextcloud_db
     volumes:
-      - /path/to/minio:/data
+      - /path/to/nextcloud/data/db:/var/lib/mysql
+      - /path/to/nextcloud/data/db-config:/config
     environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
-    command: server --console-address ":9001" /data
-    restart: always
+      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
+      - MYSQL_DATABASE=${MYSQL_DATABASE}
+      - MYSQL_USER=${MYSQL_USER}
+      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
+      - TZ=${TZ}
+    restart: unless-stopped
+    networks:
+      - nextcloud-net
+
+  redis:
+    image: redis:alpine
+    container_name: nextcloud_redis
+    environment:
+      - "TZ"
+    volumes:
+      - /path/to/nextcloud/data/redis:/data
+    restart: unless-stopped
+    networks:
+      - nextcloud-net
+
+  # Main Nextcloud container (custom image with SMB + cert trust)
+  nextcloud:
+    build:
+      context: ./nextcloud
+      dockerfile: Dockerfile
+    container_name: nextcloud
+    depends_on:
+      - db
+      - redis
+    volumes:
+      - /path/to/nextcloud/html:/var/www/html
+      - /path/to/nextcloud/html/data:/var/www/html/data
+      - /path/to/nextcloud/html/config:/var/www/html/config
+      - /path/to/nextcloud/html/custom_apps:/var/www/html/custom_apps
+      - /path/to/nextcloud/html/themes:/var/www/html/themes
+    env_file:
+      - ".env"
+    environment:
+      - "TZ"
+      - "DB_TYPE=mysql"
+      - "DB_HOST=db"
+      - "DB_NAME=${MYSQL_DATABASE}"
+      - "DB_USER=${MYSQL_USER}"
+      - "DB_PASSWORD=${MYSQL_PASSWORD}"
+    restart: unless-stopped
+    networks:
+      - nextcloud-net
+      - caddy-net
+
+  euro-office:
+    build:
+      context: ./euro-office
+      dockerfile: Dockerfile
+    container_name: nextcloud_euro-office
+    restart: unless-stopped
+    ports:
+      - "8080:80"
+    environment:
+      - JWT_ENABLED=true
+      - JWT_SECRET=${ONLYOFFICE_JWT_SECRET}
+    volumes:
+      - /path/to/nextcloud/euro-office/data:/var/lib/euro-office/documentserver
+      - /path/to/nextcloud/euro-office/logs:/var/log/euro-office/documentserver
+      - /path/to/nextcloud/euro-office/config:/etc/euro-office/documentserver
+    networks:
+      - nextcloud-net
+      - caddy-net
+
+networks:
+  nextcloud-net:
+    external: true
+  caddy-net:
+    external: true

Docker/Ollama/docker-compose.yaml

@@ -1,14 +1,44 @@
 services:
-  open-webui:
-    image: ghcr.io/open-webui/open-webui:ollama 
-    container_name: open-webui
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
-    ports:
-      - ${HTTP_PORT}:8080
+  ollama:
+    # Uncomment below for GPU support
+    # deploy:
+    #   resources:
+    #     reservations:
+    #       devices:
+    #         - driver: nvidia
+    #           count: 1
+    #           capabilities:
+    #             - gpu
     volumes:
-      - /path/to/open-webui/ollama:/root/.ollama
-      - /path/to/open-webui/app:/app/backend/data
+      - /path/to/ollama:/root/.ollama
+    # Uncomment below to expose Ollama API outside the container stack
+    ports:
+      - "${HTTP_PORT2}:11434"
+    container_name: ollama
+    pull_policy: always
+    tty: true
     restart: unless-stopped
+    image: ollama/ollama:latest
+    networks:
+      - openai-net
+
+  open-webui:
+    image: ghcr.io/open-webui/open-webui:latest
+    container_name: open-webui
+    volumes:
+      - /path/to/open-webui:/app/backend/data
+    depends_on:
+      - ollama
+    ports:
+      - "${HTTP_PORT}:8080"
+    environment:
+      - "OLLAMA_BASE_URL=http://ollama:11434"
+    extra_hosts:
+      - host.docker.internal:host-gateway
+    restart: unless-stopped
+    networks:
+      - openai-net
+
+networks:
+  openai-net:
+    external: true

Docker/Paperless-NGX/docker-compose.yaml

@@ -1,14 +1,16 @@
 services:
   broker:
-    image: docker.io/library/redis:latest
+    image: docker.io/library/redis:7
+    container_name: paperless-redis
     restart: unless-stopped
     volumes:
       - /path/to/paperless/redisdata:/data
     networks:
-      paperless:
+      - paperless-net
 
   db:
-    image: docker.io/library/postgres:latest
+    image: docker.io/library/postgres:15
+    container_name: paperless-postgres
     restart: unless-stopped
     volumes:
       - /path/to/paperless/pgdata:/var/lib/postgresql/data
@@ -17,10 +19,11 @@ services:
       POSTGRES_USER: ${POSTGRES_USER}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
     networks:
-      paperless:
+      - paperless-net
 
   webserver:
     image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    container_name: paperless
     restart: unless-stopped
     depends_on:
       - db
@@ -28,7 +31,7 @@ services:
       - gotenberg
       - tika
     ports:
-      - "8005:8000"
+      - "${HTTP_PORT}:8000"
     volumes:
       - /path/to/paperless/data:/usr/src/paperless/data
       - /path/to/paperless/media:/usr/src/paperless/media
@@ -45,16 +48,13 @@ services:
       PAPERLESS_URL: ${PAPERLESS_URL}
       PAPERLESS_ADMIN_USER: ${PAPERLESS_ADMIN_USER}
       PAPERLESS_ADMIN_PASSWORD: ${PAPERLESS_ADMIN_PASSWORD}
-      PAPERLESS_APPS: "allauth.socialaccount.providers.openid_connect"
-      # Find out how to configure Authentik: https://youtu.be/enwFWELCYJo
-      PAPERLESS_SOCIALACCOUNT_PROVIDERS: '{"openid_connect": {"APPS": [{"provider_id": "authentik","name": "Authentik SSO","client_id": "0gGOZHjx1iJAlh5wN8m1b7uZKwWnPaClGJNKhQDV","secret": "oqskOOlJ1TJzedWZR9WmcVKmxn1HFqGIroi6oiB5xh03qCofuyIDh2DDaf8OnlTybOMiBQkz9rLNO17s4Bx1aG8aGIErp1n6ly0WwQJOk38Tbq3ctOyZGFagEvysp6o2","settings": { "server_url": "https://authentik.local.thesabear.net/application/o/paperless/.well-known/openid-configuration"}}]}}'
     networks:
-      paperless:
+      - paperless-net
 
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:latest
+    image: docker.io/gotenberg/gotenberg:7.10
+    container_name: paperless-gotenberg
     restart: unless-stopped
-
     # The gotenberg chromium route is used to convert .eml files. We do not
     # want to allow external content like tracking pixels or even javascript.
     command:
@@ -62,14 +62,15 @@ services:
       - "--chromium-disable-javascript=true"
       - "--chromium-allow-list=file:///tmp/.*"
     networks:
-      paperless:
+      - paperless-net
 
   tika:
-    image: ghcr.io/paperless-ngx/tika:latest
+    image: docker.io/apache/tika:latest
+    container_name: paperless-tika
     restart: unless-stopped
     networks:
-      paperless:
+      - paperless-net
 
 networks:
-  paperless:
+  paperless-net:
     external: true

Docker/Speedtest-Tracker/docker-compose.yaml

@@ -3,17 +3,22 @@ services:
     container_name: speedtest-tracker
     image: lscr.io/linuxserver/speedtest-tracker:latest
     ports:
-      - "80:80"
-      - "443:443"
+      - "${HTTPS_PORT}:443"
     environment:
-      - PUID=PUID
-      - PGID=PGID
-      - TZ=timezone
-      - APP_KEY=${APP_KEY} # Application key for Laravel framework security. Generate a App Key here - https://speedtest-tracker.dev
-      - APP_URL=${APP_URL} # Public URL where the Speedtest Tracker will be accessible.
-      - DB_CONNECTION=sqlite # Uses SQLite as the database.
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - APP_KEY=${APP_KEY}
+      - APP_URL=${APP_URL}
+      - DB_CONNECTION=sqlite
       - SPEEDTEST_SCHEDULE="0 */3 * * *" # Cron schedule, runs every 3 hours.
-      - DISPLAY_TIMEZONE=${DISPLAY_TIMEZONE} # Sets the timezone for displaying data in the UI.
+      - DISPLAY_TIMEZONE=${DISPLAY_TIMEZONE}
     volumes:
-      - /path/to/speedtest-tracker/data:/config # Mounts the directory for persistent data.
+      - /path/to/speedtest-tracker/data:/config
     restart: unless-stopped
+    networks:
+      - speedtest-net
+
+networks:
+  speedtest-net:
+    external: true

Docker/Vaultwarden/docker-compose.yaml

@@ -1,15 +1,22 @@
 services:
-  bitwarden:
+  vaultwarden:
     image: vaultwarden/server:latest
     container_name: vaultwarden
     restart: always
     ports:
-      - 80:80
+      - ${HTTP_PORT}:80
     volumes:
-      - /path/to/bw-data:/data
+      - /path/to/vaultwarden/bw-data:/data
     environment:
-      - PUID=PUID
-      - PGID=PGID
-      - TZ=timezone
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - ICON_CACHE_TTL=0
       - WEBSOCKET_ENABLED='true' # Required to use websockets
       - SIGNUPS_ALLOWED='true' # set to false to disable signups
+    networks:
+      - vaultwarden-net
+
+networks:
+  vaultwarden-net:
+    external: true