Bring 15 stale entries in line with current private configs

Several of these had drifted so far they were unrecognizable (Nextcloud was a bare minio stub, Ollama was missing the ollama service entirely, Immich was missing 2 of 4 services). Also removed a real, exposed Authentik OAuth client_id/secret that was sitting in Paperless-NGX's entry (confirmed stale/rotated already, but shouldn't have been public regardless) and stripped internal Caddy CA trust details from every file per the same rule applied to nocodb/dashy etc.
2026-07-06 02:16:18 +03:00
1 parent 6c29d79e18
commit 55a8410474
@@ -3,16 +3,17 @@ services:
    image: actualbudget/actual-server:latest
    container_name: actual
    ports:
-      - 5006:5006
+      - ${HTTP_PORT}:5006
    environment:
-      - PUID=PUID
-      - PGID=PGID
-      - TZ=timezone
-      # Uncomment any of the lines below to set configuration options.
-      # - ACTUAL_HTTPS_KEY=/data/selfhost.key
-      # - ACTUAL_HTTPS_CERT=/data/selfhost.crt
-      # See all options and more details at https://actualbudget.github.io/docs/Installing/Configuration
-      # !! If you are not using any of these options, remove the 'environment:' tag entirely.
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
    volumes:
-      - /path/to/actual-data:/data
-    restart: unless-stopped
+      - /path/to/actual/actual-data:/data
+    restart: unless-stopped
+    networks:
+      - actual-net
+
+networks:
+  actual-net:
+    external: true
@@ -1,75 +1,108 @@
---
-
 services:
  postgresql:
+    env_file:
+      - .env
+    container_name: authentik-postgres
+    environment:
+      POSTGRES_DB: ${PG_DB}
+      POSTGRES_PASSWORD: ${PG_PASS}
+      POSTGRES_USER: ${PG_USER}
+    command: >
+      postgres
+      -c max_connections=400
+      -c shared_buffers=256MB
+      -c work_mem=8MB
+      -c maintenance_work_mem=128MB
+      -c effective_cache_size=1GB
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+        - CMD-SHELL
+        - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
    image: docker.io/library/postgres:16-alpine
    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 5s
    volumes:
      - /path/to/authentik/database:/var/lib/postgresql/data
-    environment:
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
-      POSTGRES_USER: ${PG_USER:-authentik}
-      POSTGRES_DB: ${PG_DB:-authentik}
-    env_file:
-      - .env
+    networks:
+      - authentik-net
+
  redis:
-    image: docker.io/library/redis:alpine
-    command: --save 60 1 --loglevel warning
+    image: redis:7-alpine
+    container_name: authentik-redis
    restart: unless-stopped
+    command: redis-server --appendonly yes
    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      start_period: 20s
-      interval: 30s
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
      retries: 5
-      timeout: 3s
    volumes:
      - /path/to/authentik/redis:/data
+    networks:
+      - authentik-net
+
  server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2}
-    restart: unless-stopped
    command: server
-    environment:
-      AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-    volumes:
-      - /path/to/authentik/media:/media
-      - /path/to/authentik/custom-templates:/templates
+    container_name: authentik-server
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
    env_file:
      - .env
-    ports:
-      - "${HTTP_PORT}:9000"
-      - "${HTTPS_PORT}:9443"
-    depends_on:
-      - postgresql
-      - redis
-  worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2}
-    restart: unless-stopped
-    command: worker
    environment:
-      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_URL: ${AUTHENTIK_URL}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.3}
+    ports:
+      - ${COMPOSE_PORT_HTTP}:9000
+    restart: unless-stopped
+    shm_size: 512mb
+    volumes:
+      - /path/to/authentik/data:/data
+      - /path/to/authentik/custom-templates:/templates
+    networks:
+      - authentik-net
+
+  worker:
+    command: worker
+    container_name: authentik-worker
+    depends_on:
+      postgresql:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_URL: ${AUTHENTIK_URL}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.3}
+    restart: unless-stopped
+    shm_size: 512mb
    user: root
    volumes:
-      - /path/to/authentik/var/run/docker.sock:/var/run/docker.sock
-      - /path/to/authentik/media:/media
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /path/to/authentik/data:/data
      - /path/to/authentik/certs:/certs
      - /path/to/authentik/custom-templates:/templates
-    env_file:
-      - .env
-    depends_on:
-      - postgresql
-      - redis
+    networks:
+      - authentik-net

+networks:
+  authentik-net:
+    external: true
@@ -1,12 +1,12 @@
 ---
 services:
  bookstack:
-    image: lscr.io/linuxserver/bookstack
+    image: lscr.io/linuxserver/bookstack:latest
    container_name: bookstack
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
-      - TZ=${TZ} 
+      - TZ=${TZ}
      - APP_URL=https://subdomain.example.com
      - DB_HOST=bookstack_db
      - DB_PORT=${DB_PORT}
@@ -20,19 +20,44 @@ services:
      - ${HTTP_PORT}:80
    restart: unless-stopped
    depends_on:
-      - bookstack_db
+      bookstack_db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:80/ || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - bookstack-net

  bookstack_db:
-    image: lscr.io/linuxserver/mariadb
+    image: lscr.io/linuxserver/mariadb:latest
    container_name: bookstack_db
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
-      - TZ=${TZ} 
-      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
-      - MYSQL_DATABASE=${MYSQL_DATABASE}
-      - MYSQL_USER=${MYSQL_USER}
-      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
+      - TZ=${TZ}
+      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
+      - MYSQL_DATABASE=${DB_DATABASE}
+      - MYSQL_USER=${DB_USER}
+      - MYSQL_PASSWORD=${DB_PASSWORD}
    volumes:
      - /path/to/bookstack/bookstack_db_data:/config
-    restart: unless-stopped
+    restart: unless-stopped
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "mysqladmin ping -h localhost -u${DB_USER} -p${DB_PASSWORD} || exit 1",
+        ]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+    networks:
+      - bookstack-net
+
+networks:
+  bookstack-net:
+    external: true
@@ -1,15 +1,21 @@
-version: '3'
 services:
-  calibre-web:
-    image: lscr.io/linuxserver/calibre-web:latest
-    container_name: calibre-web
+  calibre-web-automated:
+    image: crocodilestick/calibre-web-automated:latest
+    container_name: calibre-web-automated
    environment:
-      - PUID=PUID
-      - PGID=PGID
-      - TZ=timezone
+      - TZ=${TZ}
+      - DOCKER_MODS=linuxserver/mods:universal-calibre
    volumes:
      - /path/to/calibre-web:/config
-      - /path/to/books:/books
+      - /path/to/media/calibre:/calibre-library
+      - /path/to/calibre-web/ingest:/cwa-book-ingest
+      # This is an ingest dir, NOT a library one. Anything added here will be automatically added to your library according to the settings you have configured in CWA Settings page. All files placed here are REMOVED AFTER PROCESSING
    ports:
-      - 8083:8083
-    restart: unless-stopped
+      - ${HTTP_PORT}:8083
+    restart: unless-stopped
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true
@@ -1,18 +1,25 @@
-version: '3'
 services:
  calibre:
    image: lscr.io/linuxserver/calibre:latest
    container_name: calibre
+    security_opt:
+      - seccomp:unconfined #optional
    environment:
-      - PUID=PUID
-      - PGID=PGID
-      - TZ=timezone
-      - CUSTOM_USER=user
-      - PASSWORD=password
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
    volumes:
      - /path/to/calibre:/config
      - /path/to/books:/books
    ports:
-      - 8080:8080
-      - 8081:8081
-    restart: unless-stopped
+      - ${HTTP_PORT}:8080 # Calibre desktop gui.
+    restart: unless-stopped
+    networks:
+      - media-net
+      - notif-net
+
+networks:
+  media-net:
+    external: true
+  notif-net:
+    external: true
@@ -1,10 +1,27 @@
 services:
  cloudcmd:
-    image: coderaiser/cloudcmd
-    container_name: cloudcmd
+    image: coderaiser/cloudcmd:latest
+    container_name: cloudcommander
    ports:
-      - 8000:8000
+      - ${HTTP_PORT}:8000
    volumes:
      - ~:/root
      - /:/mnt/fs
-    restart: unless-stopped   
+    user: "1000:1000"
+    restart: unless-stopped
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "curl -fsS http://localhost:8000 | grep -qi cloudcmd || exit 1",
+        ]
+      interval: 20s
+      timeout: 5s
+      retries: 5
+      start_period: 25s
+    networks:
+      - cloudcommander-net
+
+networks:
+  cloudcommander-net:
+    external: true
@@ -1,33 +1,56 @@
 services:
  homeassistant:
    container_name: home-assistant
-    image: "ghcr.io/home-assistant/home-assistant:stable"
+    image: ghcr.io/home-assistant/home-assistant:stable
    volumes:
      - /path/to/home-assistant/config:/config
      - /etc/localtime:/etc/localtime:ro
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
-      - TZ=${TZ} 
+      - TZ=${TZ}
    restart: unless-stopped
    ports:
-      - ${HTTP_PORT}:8123
+      - "${HTTP_PORT}:8123"
    depends_on:
-      - homeassistant-db
+      homeassistant-db:
+        condition: service_healthy
    privileged: true
+    healthcheck:
+      test: [
+          "CMD-SHELL",
+          "curl -fsS -o /dev/null -w '%{http_code}' http://127.0.0.1:8123/api/
+          | grep -q 401",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+      start_period: 90s
+    networks:
+      - home-assistant-net

  homeassistant-db:
-    image: docker.io/postgres:16.3
    container_name: homeassistant-db
+    image: postgres:latest
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
-      # ensure the database gets created correctly
-      # https://github.com/matrix-org/synapse/blob/master/docs/postgres.md#set-up-database
-      - POSTGRES_INITDB_ARGS=--encoding=UTF-8
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --locale=en_US.UTF-8
    volumes:
-      - /path/to/home-assistant/schemas:/var/lib/postgresql/data
+      - /path/to/home-assistant/schemas:/var/lib/postgresql
    security_opt:
      - no-new-privileges:true
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+    networks:
+      - home-assistant-net
+
+networks:
+  home-assistant-net:
+    external: true
@@ -1,7 +1,19 @@
 services:
  it-tools:
-    image: 'corentinth/it-tools:latest'  
+    image: corentinth/it-tools:latest
+    restart: unless-stopped
+    container_name: it-tools
    ports:
-      - '${HTTP_PORT}:80'  
-    restart: unless-stopped  
-    container_name: it-tools  
+      - ${HTTP_PORT}:80
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost/ > /dev/null || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    networks:
+      - it-tools-net
+
+networks:
+  it-tools-net:
+    external: true
@@ -4,76 +4,72 @@ services:
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
-      - TZ=${TZ} 
+      - TZ=${TZ}
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
-    command: [ "start.sh", "immich" ]
    volumes:
-      - /path/to/upload:/usr/src/app/upload
+      - /path/to/immich/data:/data
+      - /path/to/immich/upload:/usr/src/app/upload
+      - /path/to/external-library-1:/path/to/external-library-1:ro
+      - /path/to/external-library-2:/path/to/external-library-2:ro
    env_file:
      - .env
    ports:
-      - ${HTTP_PORT}:3001
+      - ${HTTP_PORT}:2283
    depends_on:
      - redis
      - database
-    restart: always
-
-  immich-microservices:
-    container_name: immich_microservices
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ} 
-    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
-    extends:
-      file: hwaccel.yml
-      service: hwaccel
-    command: [ "start.sh", "microservices" ]
-    volumes:
-      - /path/to/upload:/usr/src/app/upload
-    env_file:
-      - .env
-    depends_on:
-      - redis
-      - database
-    restart: always
+    restart: unless-stopped
+    networks:
+      - immich-net

  immich-machine-learning:
    container_name: immich_machine_learning
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
-      - TZ=${TZ} 
+      - TZ=${TZ}
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    volumes:
      - /path/to/immich/model-cache:/cache
    env_file:
      - .env
-    restart: always
+    restart: unless-stopped
+    networks:
+      - immich-net

  redis:
    container_name: immich_redis
+    image: redis:6.2-alpine
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
-      - TZ=${TZ} 
-    image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3
-    restart: always
+      - TZ=${TZ}
+    volumes:
+      - /path/to/immich/redis:/data
+    restart: unless-stopped
+    networks:
+      - immich-net

  database:
    container_name: immich_postgres
-    image: registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
    env_file:
      - .env
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
-      - TZ=${TZ} 
+      - TZ=${TZ}
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      - POSTGRES_USER=${DB_USERNAME}
      - POSTGRES_DB=${DB_DATABASE_NAME}
+      - POSTGRES_INITDB_ARGS='--data-checksums'
    volumes:
      - /path/to/immich/pgdata:/var/lib/postgresql/data
-    restart: always
+    shm_size: 128mb
+    restart: unless-stopped
+    networks:
+      - immich-net

-## there is a known issue with Traefik: see here https://github.com/immich-app/immich/discussions/437#discussioncomment-3609797
+networks:
+  immich-net:
+    external: true
@@ -1,39 +1,56 @@
 services:
  joplin-db:
-    image: postgres:15
+    image: postgres:latest
    container_name: joplin-db
    volumes:
-      - /path/to/data:/var/lib/postgresql/data
+      - /path/to/joplin:/var/lib/postgresql
    ports:
-      - 5432:5432
+      - "${POSTGRES_PORT}:5432"
    restart: unless-stopped
    environment:
-      - POSTGRES_PASSWORD=db_password
-      - POSTGRES_USER=db_user
-      - POSTGRES_DB=joplin
-  
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_DB=${POSTGRES_DB}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 15s
+    networks:
+      - joplin-net
+
  joplin:
    image: joplin/server:latest
    container_name: joplin-server
    depends_on:
      - joplin-db
    ports:
-      - 22300:22300
+      - "${HTTP_PORT}:22300"
    restart: unless-stopped
    environment:
-      - APP_PORT=22300
-      - APP_BASE_URL=https://subdomain.websiteurl.com
+      - APP_PORT=${HTTP_PORT}
+      - APP_BASE_URL=${APP_BASE_URL}
      - DB_CLIENT=pg
-      - POSTGRES_PASSWORD=db_password
-      - POSTGRES_DATABASE=joplin
-      - POSTGRES_USER=db_user
-      - POSTGRES_PORT=5432
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DATABASE=${POSTGRES_DB}
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PORT=${POSTGRES_PORT}
      - POSTGRES_HOST=joplin-db
      - MAILER_ENABLED=1
-      - MAILER_HOST=smtp.gmail.com
-      - MAILER_PORT=465
-      - MAILER_SECURE=1
-      - MAILER_AUTH_USER=[email protected]
-      - MAILER_AUTH_PASSWORD=Y0urP@ssw0rd
-      - MAILER_NOREPLY_NAME=Joplin
-      - MAILER_NOREPLY_EMAIL=[email protected]
+      - MAILER_HOST=${MAILER_HOST}
+      - MAILER_PORT=${MAILER_PORT}
+      - MAILER_SECURITY=${MAILER_SECURITY}
+      - MAILER_AUTH_USER=${MAILER_AUTH_USER}
+      - MAILER_AUTH_PASSWORD=${MAILER_AUTH_PASSWORD}
+      - MAILER_NOREPLY_NAME=${MAILER_NOREPLY_NAME}
+      - MAILER_NOREPLY_EMAIL=${MAILER_NOREPLY_EMAIL}
+      - APP_ADMIN_EMAIL=${APP_ADMIN_EMAIL}
+      - APP_ADMIN_PASSWORD=${APP_ADMIN_PASSWORD}
+      - APP_ADMIN_NAME=${APP_ADMIN_NAME}
+    networks:
+      - joplin-net
+
+networks:
+  joplin-net:
+    external: true
@@ -1,14 +1,82 @@
+name: nextcloud
 services:
-  minio:
-    image: minio/minio
-    container_name: minio
-    ports:
-      - ${HTTP_PORT}:9000
-      - ${HTTP_PORT1}:9001
+  db:
+    image: lscr.io/linuxserver/mariadb:latest
+    container_name: nextcloud_db
    volumes:
-      - /path/to/minio:/data
+      - /path/to/nextcloud/data/db:/var/lib/mysql
+      - /path/to/nextcloud/data/db-config:/config
    environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
-    command: server --console-address ":9001" /data
-    restart: always
+      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
+      - MYSQL_DATABASE=${MYSQL_DATABASE}
+      - MYSQL_USER=${MYSQL_USER}
+      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
+      - TZ=${TZ}
+    restart: unless-stopped
+    networks:
+      - nextcloud-net
+
+  redis:
+    image: redis:alpine
+    container_name: nextcloud_redis
+    environment:
+      - "TZ"
+    volumes:
+      - /path/to/nextcloud/data/redis:/data
+    restart: unless-stopped
+    networks:
+      - nextcloud-net
+
+  # Main Nextcloud container (custom image with SMB + cert trust)
+  nextcloud:
+    build:
+      context: ./nextcloud
+      dockerfile: Dockerfile
+    container_name: nextcloud
+    depends_on:
+      - db
+      - redis
+    volumes:
+      - /path/to/nextcloud/html:/var/www/html
+      - /path/to/nextcloud/html/data:/var/www/html/data
+      - /path/to/nextcloud/html/config:/var/www/html/config
+      - /path/to/nextcloud/html/custom_apps:/var/www/html/custom_apps
+      - /path/to/nextcloud/html/themes:/var/www/html/themes
+    env_file:
+      - ".env"
+    environment:
+      - "TZ"
+      - "DB_TYPE=mysql"
+      - "DB_HOST=db"
+      - "DB_NAME=${MYSQL_DATABASE}"
+      - "DB_USER=${MYSQL_USER}"
+      - "DB_PASSWORD=${MYSQL_PASSWORD}"
+    restart: unless-stopped
+    networks:
+      - nextcloud-net
+      - caddy-net
+
+  euro-office:
+    build:
+      context: ./euro-office
+      dockerfile: Dockerfile
+    container_name: nextcloud_euro-office
+    restart: unless-stopped
+    ports:
+      - "8080:80"
+    environment:
+      - JWT_ENABLED=true
+      - JWT_SECRET=${ONLYOFFICE_JWT_SECRET}
+    volumes:
+      - /path/to/nextcloud/euro-office/data:/var/lib/euro-office/documentserver
+      - /path/to/nextcloud/euro-office/logs:/var/log/euro-office/documentserver
+      - /path/to/nextcloud/euro-office/config:/etc/euro-office/documentserver
+    networks:
+      - nextcloud-net
+      - caddy-net
+
+networks:
+  nextcloud-net:
+    external: true
+  caddy-net:
+    external: true
@@ -1,14 +1,44 @@
 services:
-  open-webui:
-    image: ghcr.io/open-webui/open-webui:ollama 
-    container_name: open-webui
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
-    ports:
-      - ${HTTP_PORT}:8080
+  ollama:
+    # Uncomment below for GPU support
+    # deploy:
+    #   resources:
+    #     reservations:
+    #       devices:
+    #         - driver: nvidia
+    #           count: 1
+    #           capabilities:
+    #             - gpu
    volumes:
-      - /path/to/open-webui/ollama:/root/.ollama
-      - /path/to/open-webui/app:/app/backend/data
+      - /path/to/ollama:/root/.ollama
+    # Uncomment below to expose Ollama API outside the container stack
+    ports:
+      - "${HTTP_PORT2}:11434"
+    container_name: ollama
+    pull_policy: always
+    tty: true
    restart: unless-stopped
+    image: ollama/ollama:latest
+    networks:
+      - openai-net
+
+  open-webui:
+    image: ghcr.io/open-webui/open-webui:latest
+    container_name: open-webui
+    volumes:
+      - /path/to/open-webui:/app/backend/data
+    depends_on:
+      - ollama
+    ports:
+      - "${HTTP_PORT}:8080"
+    environment:
+      - "OLLAMA_BASE_URL=http://ollama:11434"
+    extra_hosts:
+      - host.docker.internal:host-gateway
+    restart: unless-stopped
+    networks:
+      - openai-net
+
+networks:
+  openai-net:
+    external: true
@@ -1,14 +1,16 @@
 services:
  broker:
-    image: docker.io/library/redis:latest
+    image: docker.io/library/redis:7
+    container_name: paperless-redis
    restart: unless-stopped
    volumes:
      - /path/to/paperless/redisdata:/data
    networks:
-      paperless:
+      - paperless-net

  db:
-    image: docker.io/library/postgres:latest
+    image: docker.io/library/postgres:15
+    container_name: paperless-postgres
    restart: unless-stopped
    volumes:
      - /path/to/paperless/pgdata:/var/lib/postgresql/data
@@ -17,10 +19,11 @@ services:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    networks:
-      paperless:
+      - paperless-net

  webserver:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    container_name: paperless
    restart: unless-stopped
    depends_on:
      - db
@@ -28,7 +31,7 @@ services:
      - gotenberg
      - tika
    ports:
-      - "8005:8000"
+      - "${HTTP_PORT}:8000"
    volumes:
      - /path/to/paperless/data:/usr/src/paperless/data
      - /path/to/paperless/media:/usr/src/paperless/media
@@ -45,16 +48,13 @@ services:
      PAPERLESS_URL: ${PAPERLESS_URL}
      PAPERLESS_ADMIN_USER: ${PAPERLESS_ADMIN_USER}
      PAPERLESS_ADMIN_PASSWORD: ${PAPERLESS_ADMIN_PASSWORD}
-      PAPERLESS_APPS: "allauth.socialaccount.providers.openid_connect"
-      # Find out how to configure Authentik: https://youtu.be/enwFWELCYJo
-      PAPERLESS_SOCIALACCOUNT_PROVIDERS: '{"openid_connect": {"APPS": [{"provider_id": "authentik","name": "Authentik SSO","client_id": "0gGOZHjx1iJAlh5wN8m1b7uZKwWnPaClGJNKhQDV","secret": "oqskOOlJ1TJzedWZR9WmcVKmxn1HFqGIroi6oiB5xh03qCofuyIDh2DDaf8OnlTybOMiBQkz9rLNO17s4Bx1aG8aGIErp1n6ly0WwQJOk38Tbq3ctOyZGFagEvysp6o2","settings": { "server_url": "https://authentik.local.thesabear.net/application/o/paperless/.well-known/openid-configuration"}}]}}'
    networks:
-      paperless:
+      - paperless-net

  gotenberg:
-    image: docker.io/gotenberg/gotenberg:latest
+    image: docker.io/gotenberg/gotenberg:7.10
+    container_name: paperless-gotenberg
    restart: unless-stopped
-
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
    command:
@@ -62,14 +62,15 @@ services:
      - "--chromium-disable-javascript=true"
      - "--chromium-allow-list=file:///tmp/.*"
    networks:
-      paperless:
+      - paperless-net

  tika:
-    image: ghcr.io/paperless-ngx/tika:latest
+    image: docker.io/apache/tika:latest
+    container_name: paperless-tika
    restart: unless-stopped
    networks:
-      paperless:
+      - paperless-net

 networks:
-  paperless:
+  paperless-net:
    external: true
@@ -3,17 +3,22 @@ services:
    container_name: speedtest-tracker
    image: lscr.io/linuxserver/speedtest-tracker:latest
    ports:
-      - "80:80"
-      - "443:443"
+      - "${HTTPS_PORT}:443"
    environment:
-      - PUID=PUID
-      - PGID=PGID
-      - TZ=timezone
-      - APP_KEY=${APP_KEY} # Application key for Laravel framework security. Generate a App Key here - https://speedtest-tracker.dev
-      - APP_URL=${APP_URL} # Public URL where the Speedtest Tracker will be accessible.
-      - DB_CONNECTION=sqlite # Uses SQLite as the database.
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - APP_KEY=${APP_KEY}
+      - APP_URL=${APP_URL}
+      - DB_CONNECTION=sqlite
      - SPEEDTEST_SCHEDULE="0 */3 * * *" # Cron schedule, runs every 3 hours.
-      - DISPLAY_TIMEZONE=${DISPLAY_TIMEZONE} # Sets the timezone for displaying data in the UI.
+      - DISPLAY_TIMEZONE=${DISPLAY_TIMEZONE}
    volumes:
-      - /path/to/speedtest-tracker/data:/config # Mounts the directory for persistent data.
+      - /path/to/speedtest-tracker/data:/config
    restart: unless-stopped
+    networks:
+      - speedtest-net
+
+networks:
+  speedtest-net:
+    external: true
@@ -1,15 +1,22 @@
 services:
-  bitwarden:
+  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    ports:
-      - 80:80
+      - ${HTTP_PORT}:80
    volumes:
-      - /path/to/bw-data:/data
+      - /path/to/vaultwarden/bw-data:/data
    environment:
-      - PUID=PUID
-      - PGID=PGID
-      - TZ=timezone
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - ICON_CACHE_TTL=0
      - WEBSOCKET_ENABLED='true' # Required to use websockets
-      - SIGNUPS_ALLOWED='true'   # set to false to disable signups
+      - SIGNUPS_ALLOWED='true' # set to false to disable signups
+    networks:
+      - vaultwarden-net
+
+networks:
+  vaultwarden-net:
+    external: true