Add sanitized compose files for 21 rocky-docker stacks missing from the mirror

audiobookshelf, bazarr, beets, dashy, dockhand, docker-socket-proxy,
emby, ghost (+umami), jellyfin, kodi-mariadb, kopia, lidarr,
music-assistant, prowlarr, qbittorrent, radarr, seerr, sonarr, tdarr,
tinymediamanager, trilium — these run in the fleet today but had no
public entry at all. Same sanitization convention as the rest of the
repo (paths -> /path/to/..., secrets left as bare ${VAR} refs, no CA
trust details).

Docker/Audiobookshelf/docker-compose.yaml

@@ -0,0 +1,27 @@
+services:
+  audiobookshelf:
+    image: ghcr.io/advplyr/audiobookshelf:latest
+    container_name: audiobookshelf
+    user: "${PUID}:${PGID}"
+    environment:
+      - TZ=${TZ}
+    ports:
+      - ${HTTP_PORT}:80
+    volumes:
+      - /path/to/audiobookshelf/config:/config
+      - /path/to/audiobookshelf/metadata:/metadata
+      - /path/to/data/media/audiobooks:/audiobooks
+      - /path/to/data/media/podcasts:/podcasts
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:80/ || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - audiobookshelf-net
+
+networks:
+  audiobookshelf-net:
+    external: true

Docker/Bazarr/docker-compose.yaml

@@ -0,0 +1,27 @@
+services:
+  bazarr:
+    image: lscr.io/linuxserver/bazarr:latest
+    container_name: bazarr
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+    ports:
+      - ${HTTP_PORT}:6767
+    volumes:
+      - /path/to/bazarr:/config
+      - /path/to/media:/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:6767/ || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Beets/docker-compose.yaml

@@ -0,0 +1,28 @@
+services:
+  beets:
+    image: linuxserver/beets:2.8.0-ls323
+    container_name: beets
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - /path/to/beets:/config
+      - /path/to/media/music:/music
+      - /path/to/media/music_untagged:/music_untagged
+      - /path/to/torrents/beets:/downloads
+    ports:
+      - ${HTTP_PORT}:8337
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8337/ || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Dashy/docker-compose.yaml

@@ -0,0 +1,40 @@
+services:
+  dashy:
+    image: lissy93/dashy
+    container_name: dashy
+    volumes:
+      # Conf file
+      - /path/to/dashy/conf.yml:/app/user-data/conf.yml
+      # Icons folder
+      - /path/to/dashy/public/assets:/app/user-data/item-icons/
+      # Pages, one by one
+      - /path/to/dashy/control-plane.yml:/app/user-data/control-plane.yml
+      - /path/to/dashy/observability.yml:/app/user-data/observability.yml
+      - /path/to/dashy/media.yml:/app/user-data/media.yml
+      - /path/to/dashy/automation.yml:/app/user-data/automation.yml
+      - /path/to/dashy/dev-platform-tools.yml:/app/user-data/dev-platform-tools.yml
+      - /path/to/dashy/identity-security.yml:/app/user-data/identity-security.yml
+      - /path/to/dashy/data-knowledge.yml:/app/user-data/data-knowledge.yml
+      - /path/to/dashy/personal-apps.yml:/app/user-data/personal-apps.yml
+    ports:
+      - ${HTTP_PORT}:8080
+    environment:
+      - NODE_ENV=production
+      - PUID=${PUID}
+      - PGID=${PGID}
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "node", "/app/services/healthcheck"]
+      interval: 1m30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    networks:
+      - media-net
+      - caddy-net
+
+networks:
+  media-net:
+    external: true
+  caddy-net:
+    external: true

Docker/Docker-Socket-Proxy/docker-compose.yaml

@@ -0,0 +1,23 @@
+services:
+  socket-proxy:
+    image: tecnativa/docker-socket-proxy
+    container_name: socket-proxy
+    restart: always
+    environment:
+      - CONTAINERS=1
+      - IMAGES=0
+      - NETWORKS=0
+      - VOLUMES=0
+      - EVENTS=0
+      - POST=0
+      - DELETE=0
+      - INFO=1
+      - EXEC=0
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - docker-proxy-net
+
+networks:
+  docker-proxy-net:
+    external: true

Docker/Dockhand/docker-compose.yaml

@@ -0,0 +1,49 @@
+services:
+  socket-proxy:
+    image: tecnativa/docker-socket-proxy
+    container_name: dockhand-socket-proxy
+    restart: always
+    environment:
+      # Required for Dockhand core functionality
+      - CONTAINERS=1
+      - IMAGES=1
+      - NETWORKS=1
+      - VOLUMES=1
+      - EVENTS=1
+      - POST=1
+      - DELETE=1
+      # Required for dashboard host info and disk usage
+      - INFO=1
+      - SYSTEM=1
+      # Required for vulnerability scanning
+      - ALLOW_START=1
+      - ALLOW_STOP=1
+      - ALLOW_RESTARTS=1
+      # Optional: enable for terminal access
+      - EXEC=1
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - dockhand-net
+
+  dockhand:
+    image: fnsys/dockhand:latest
+    container_name: dockhand
+    restart: always
+    depends_on:
+      - socket-proxy
+    environment:
+      - PUID=1000
+      - PGID=1000
+    group_add:
+      - "996"
+    ports:
+      - ${HTTP_PORT}:3000
+    volumes:
+      - /path/to/dockhand/dockhand_data:/app/data
+    networks:
+      - dockhand-net
+
+networks:
+  dockhand-net:
+    external: true

Docker/Emby/docker-compose.yaml

@@ -0,0 +1,19 @@
+services:
+  emby:
+    image: emby/embyserver:latest
+    container_name: emby
+    environment:
+      - TZ=${TZ}
+    volumes:
+      - /path/to/emby:/config
+      - /path/to/media:/data
+      - /path/to/transcodes/emby:/transcode
+    ports:
+      - ${HTTP_PORT}:8096
+    restart: unless-stopped
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Ghost/docker-compose.yaml

@@ -0,0 +1,82 @@
+services:
+  ghost:
+    image: ghost:latest
+    container_name: ghost_blog
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT}:2368"
+    depends_on:
+      - ghost_db
+    environment:
+      NODE_ENV: production
+      TZ: ${TZ}
+      # Ghost URL
+      url: ${GHOST_URL}
+      # SMTP
+      mail__transport: ${SMTP_TRANSPORT}
+      mail__options__host: ${SMTP_HOST}
+      mail__options__port: ${SMTP_PORT}
+      mail__options__secure: "false"
+      mail__options__auth__user: ${SMTP_USER}
+      mail__options__auth__pass: ${SMTP_PASSWORD}
+      # Database
+      database__client: mysql
+      database__connection__host: ${DB_HOST}
+      database__connection__user: ${DB_USER}
+      database__connection__password: ${DB_PASSWORD}
+      database__connection__database: ${DB_NAME}
+    volumes:
+      - /path/to/ghost/content:/var/lib/ghost/content
+    networks:
+      - blog-net
+
+  ghost_db:
+    image: mysql:8
+    container_name: ghost_mysql
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
+      MYSQL_DATABASE: ${DB_NAME}
+      MYSQL_USER: ${DB_USER}
+      MYSQL_PASSWORD: ${DB_PASSWORD}
+    volumes:
+      - /path/to/ghost/db_data:/var/lib/mysql
+      - /path/to/ghost/init:/docker-entrypoint-initdb.d:ro
+    networks:
+      - blog-net
+
+  umami:
+    image: ghcr.io/umami-software/umami:postgresql-latest
+    container_name: umami_analytics
+    restart: unless-stopped
+    ports:
+      - "${UMAMI_PORT}:3000"
+    depends_on:
+      - umami-db
+    environment:
+      TZ: ${TZ}
+      DATABASE_URL: postgresql://${UMAMI_DB_USER}:${UMAMI_DB_PASSWORD}@umami-db:5432/${UMAMI_DB_NAME}
+      DATABASE_TYPE: postgresql
+      APP_SECRET: ${UMAMI_APP_SECRET}
+      IGNORE_IP: ${UMAMI_IGNORE_IP}
+    networks:
+      - blog-net
+
+  umami-db:
+    image: postgres:15-alpine
+    container_name: umami_postgres
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+      POSTGRES_DB: ${UMAMI_DB_NAME}
+      POSTGRES_USER: ${UMAMI_DB_USER}
+      POSTGRES_PASSWORD: ${UMAMI_DB_PASSWORD}
+    volumes:
+      - /path/to/umami/db_data:/var/lib/postgresql/data
+    networks:
+      - blog-net
+
+networks:
+  blog-net:
+    external: true

Docker/Jellyfin/docker-compose.yaml

@@ -0,0 +1,32 @@
+services:
+  jellyfin:
+    image: jellyfin/jellyfin:latest
+    container_name: jellyfin
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - /path/to/jellyfin/config:/config
+      - /path/to/jellyfin/cache:/cache
+      - /path/to/media:/data
+      - /path/to/transcodes/jellyfin:/transcodes
+    ports:
+      - ${HTTP_PORT}:8096
+    restart: unless-stopped
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "curl -fsS http://localhost:8096/health | grep -q Healthy",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Kodi-MariaDB/docker-compose.yaml

@@ -0,0 +1,32 @@
+services:
+  mariadb:
+    image: lscr.io/linuxserver/mariadb:latest
+    container_name: kodi-mariadb
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
+      - MYSQL_USER=${MYSQL_USER}
+      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
+    volumes:
+      - /path/to/kodi-mariadb:/config
+    ports:
+      - ${HTTP_PORT}:3306
+    restart: unless-stopped
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "mysqladmin ping -h 127.0.0.1 -u root -p${MYSQL_ROOT_PASSWORD} --silent",
+        ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Kopia/docker-compose.yaml

@@ -0,0 +1,34 @@
+services:
+  kopia:
+    image: kopia/kopia:latest
+    container_name: kopia
+    restart: unless-stopped
+    user: "0:0"
+    hostname: "docker-host"
+    ports:
+      - "${HTTP_PORT}:51515"
+    command:
+      - server
+      - start
+      - --address=0.0.0.0:51515
+      - --tls-cert-file=/tls/kopia.crt
+      - --tls-key-file=/tls/kopia.key
+      - --server-username=${USERNAME}
+      - --server-password=${SECRET_PASSWORD}
+      - --disable-csrf-token-checks
+    environment:
+      TZ: ${TZ}
+      KOPIA_PASSWORD: ${SECRET_PASSWORD}
+    volumes:
+      - /path/to/backup-drive/kopia-repo:/repository # External drive for repository
+      - /path/to/backup-drive/kopia-cache:/cache
+      - /path/to/backup-drive/kopia-config:/app/config
+      - /path/to/backup-drive/kopia-tls:/tls:ro
+      - /path/to/docker-volumes:/apps:ro # Read-only access to docker volumes
+      - /path/to/docker-volumes:/restore
+    networks:
+      - kopia-net
+
+networks:
+  kopia-net:
+    external: true

Docker/Lidarr/docker-compose.yaml

@@ -0,0 +1,23 @@
+services:
+  lidarr:
+    image: ghcr.io/linuxserver/lidarr:latest
+    container_name: lidarr
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+      - DOCKER_MODS=ghcr.io/gilbn/theme.park:lidarr
+      - TP_ADDON=lidarr-alt-calendar
+    ports:
+      - ${HTTP_PORT}:8686
+    volumes:
+      - /path/to/lidarr:/config
+      - /path/to/media:/data
+    restart: unless-stopped
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Music-Assistant/docker-compose.yaml

@@ -0,0 +1,27 @@
+services:
+  music-assistant-server:
+    image: ghcr.io/music-assistant/server:latest
+    container_name: music-assistant
+    restart: unless-stopped
+    volumes:
+      - /path/to/music-assistant-server/data:/data/
+      - /path/to/data/media/music:/music:ro
+    ports:
+      - "${PORT1}:8095"
+      - "${PORT2}:3483"
+      - "${PORT3}:5353/udp"
+      - "${PORT4}:21064/tcp"
+      - "${PORT5}:21064/udp"
+    environment:
+      - LOG_LEVEL=info
+    cap_add:
+      - SYS_ADMIN
+      - DAC_READ_SEARCH
+    security_opt:
+      - apparmor:unconfined
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Prowlarr/docker-compose.yaml

@@ -0,0 +1,27 @@
+services:
+  prowlarr:
+    container_name: prowlarr
+    image: lscr.io/linuxserver/prowlarr:latest
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+    ports:
+      - ${HTTP_PORT}:9696
+    volumes:
+      - /path/to/prowlarr:/config
+      - /path/to/media:/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:9696 || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Radarr/docker-compose.yaml

@@ -0,0 +1,31 @@
+services:
+  radarr:
+    image: ghcr.io/linuxserver/radarr:latest
+    container_name: radarr
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+      - DOCKER_MODS=ghcr.io/gilbn/theme.park:radarr
+      - TP_THEME=dark
+      - TP_ADDON=radarr-4k-logo
+      - TP_ADDON=radarr-alt-calendar
+    ports:
+      - ${HTTP_PORT}:7878
+    volumes:
+      - /path/to/radarr:/config
+      - /path/to/media:/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:7878 || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Seerr/docker-compose.yaml

@@ -0,0 +1,27 @@
+services:
+  seerr:
+    image: ghcr.io/seerr-team/seerr:latest
+    init: true
+    container_name: seerr
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - LOG_LEVEL=debug
+    ports:
+      - ${HTTP_PORT}:5055
+    volumes:
+      - /path/to/seerr:/app/config
+    healthcheck:
+      test: wget --no-verbose --tries=1 --spider http://localhost:5055/api/v1/status || exit 1
+      start_period: 20s
+      timeout: 3s
+      interval: 15s
+      retries: 3
+    restart: unless-stopped
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Sonarr/docker-compose.yaml

@@ -0,0 +1,30 @@
+services:
+  sonarr:
+    image: ghcr.io/linuxserver/sonarr:latest
+    container_name: sonarr
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+      - DOCKER_MODS=ghcr.io/gilbn/theme.park:sonarr
+      - TP_THEME=dark
+      - TP_ADDON=sonarr-4k-logo
+    ports:
+      - ${HTTP_PORT}:8989
+    volumes:
+      - /path/to/sonarr:/config
+      - /path/to/media:/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:8989 || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Tdarr/docker-compose.yaml

@@ -0,0 +1,38 @@
+services:
+  tdarr:
+    container_name: tdarr
+    image: ghcr.io/haveagitgat/tdarr:2.82.01
+    restart: unless-stopped
+    ports:
+      - ${HTTP_PORT}:8265
+      - ${HTTP_PORT1}:8266
+      - ${HTTP_PORT2}:8267
+      - ${HTTP_PORT3}:8268
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+      - serverIP=${serverIP}
+      - serverPort=${serverPort}
+      - webUIPort=${webUIPort}
+      - internalNode=${internalNode}
+      - nodeName=${nodeName}
+    volumes:
+      - /path/to/tdarr/server:/app/server
+      - /path/to/tdarr/configs:/app/configs
+      - /path/to/tdarr/logs:/app/logs
+      - /path/to/media:/media
+      - /path/to/transcodes/transcodes_tdarr:/temp
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://127.0.0.1:8265 || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/TinyMediaManager/docker-compose.yaml

@@ -0,0 +1,25 @@
+services:
+  tinymediamanager:
+    image: tinymediamanager/tinymediamanager:latest
+    container_name: tinymediamanager
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    ports:
+      - ${HTTP_PORT}:4000
+    volumes:
+      - /path/to/tinymediamanager/data:/data
+      - /path/to/tinymediamanager/config/launcher-extra.yml:/app/launcher-extra.yml
+      - /path/to/media/movies:/media/movies
+      - /path/to/media/moviesetsartwork:/media/moviesetsartwork
+      - /path/to/media/tv:/media/tv shows
+      - /path/to/media/documentaries:/media/documentaries
+      - /path/to/media/stand-up comedy:/media/stand-up comedy
+    restart: unless-stopped
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

Docker/Trilium/docker-compose.yaml

@@ -0,0 +1,20 @@
+services: 
+  trilium-sync:
+    image: triliumnext/trilium:latest
+    container_name: trilium-sync
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - TRILIUM_SYNC_SERVER=true
+    volumes:
+      - /path/to/trilium-sync:/home/node/trilium-data
+    ports:
+      - ${HTTP_PORT}:8080
+    restart: unless-stopped
+    networks:
+      - trillium-net   
+
+networks:
+  trillium-net:
+    external: true

Docker/qBittorrent/docker-compose.yaml

@@ -0,0 +1,30 @@
+services:
+  qbittorrent:
+    image: ghcr.io/hotio/qbittorrent:release-5.1.4
+    container_name: qbittorrent
+    privileged: true
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+    volumes:
+      - /path/to/qbittorrent:/config
+      - /path/to/media/torrents:/data/torrents
+    ports:
+      - ${HTTP_PORT}:8080
+      - ${HTTP_PORT1}:8999
+      - ${HTTP_PORT1}:8999/udp
+    restart: always
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:8080 || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true