From b1807247e73c6c34b30a1b9cbac09b9c90440f40 Mon Sep 17 00:00:00 2001 From: thesabear Date: Tue, 25 Aug 2026 11:12:20 +0300 Subject: [PATCH] stacks: add nextcloud Dockerfiles, fix a broken kodi compose edit Adds the two Dockerfiles nextcloud's compose build: contexts were already referencing but never had (custom smbclient support for the main container, a documentserver base for euro-office) - both had their real internal-CA-trust mechanism replaced with a comment explaining what's there and why, per the standing rule against publishing that detail. Also fixes a compose bug: kodi-ma-bridge's `environment:` key had been dropped, leaving KEY=value pairs nested under `env_file:` (which expects file paths, not inline vars) - would have made docker-compose try to open a file literally named `TZ=${TZ}`. Rest of this commit is manual cleanup (comment tidying, dropped personal media-library volume mounts, a couple of .env comment trims). --- stacks/identity-and-security/wazuh/docker-compose.yaml | 5 ++--- stacks/media/kodi/docker-compose.yaml | 4 ++-- stacks/media/tinymediamanager/docker-compose.yaml | 3 --- stacks/platform/gitea/.env | 2 -- stacks/platform/grafana-stack/.env | 2 -- stacks/platform/kestra/.env | 2 -- stacks/productivity/firefly-iii/docker-compose.yaml | 4 ++-- stacks/productivity/joplin/.env | 2 +- stacks/productivity/nextcloud/euro-office/Dockerfile | 4 ++++ stacks/productivity/nextcloud/nextcloud/Dockerfile | 10 ++++++++++ 10 files changed, 21 insertions(+), 17 deletions(-) create mode 100644 stacks/productivity/nextcloud/euro-office/Dockerfile create mode 100644 stacks/productivity/nextcloud/nextcloud/Dockerfile diff --git a/stacks/identity-and-security/wazuh/docker-compose.yaml b/stacks/identity-and-security/wazuh/docker-compose.yaml index 9e43764..57586f5 100644 --- a/stacks/identity-and-security/wazuh/docker-compose.yaml +++ b/stacks/identity-and-security/wazuh/docker-compose.yaml @@ -1,5 +1,4 @@ name: single-node -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: image: wazuh/wazuh-manager:4.14.6 @@ -18,7 +17,7 @@ services: - "514:514/udp" - "55000:55000" env_file: - - .env.secrets # INDEXER_PASSWORD, API_PASSWORD — never committed + - .env.secrets environment: - TZ=${TZ} - INDEXER_URL=https://wazuh.indexer:9200 @@ -78,7 +77,7 @@ services: ports: - 443:5601 env_file: - - .env.secrets # INDEXER_PASSWORD, DASHBOARD_PASSWORD, API_PASSWORD — never committed + - .env.secrets environment: - TZ=${TZ} - INDEXER_USERNAME=admin diff --git a/stacks/media/kodi/docker-compose.yaml b/stacks/media/kodi/docker-compose.yaml index c7ed6b7..4144212 100644 --- a/stacks/media/kodi/docker-compose.yaml +++ b/stacks/media/kodi/docker-compose.yaml @@ -3,7 +3,7 @@ services: image: mariadb:latest container_name: kodi-mariadb env_file: - - .env.secrets # MYSQL_ROOT_PASSWORD, MYSQL_PASSWORD — never committed + - .env.secrets environment: - PUID=${PUID} - PGID=${PGID} @@ -39,7 +39,7 @@ services: - ./requirements.txt:/app/requirements.txt:ro command: sh -c "pip install --no-cache-dir -r requirements.txt && python bridge.py" env_file: - - .env.secrets # KODI_PASSWORD, MA_API_TOKEN — never committed + - .env.secrets environment: - TZ=${TZ} - MA_BASE_URL=${MA_BASE_URL} diff --git a/stacks/media/tinymediamanager/docker-compose.yaml b/stacks/media/tinymediamanager/docker-compose.yaml index 758a922..fc22610 100644 --- a/stacks/media/tinymediamanager/docker-compose.yaml +++ b/stacks/media/tinymediamanager/docker-compose.yaml @@ -12,10 +12,7 @@ services: - /path/to/tinymediamanager/data:/data - /path/to/tinymediamanager/config/launcher-extra.yml:/app/launcher-extra.yml - /path/to/media/movies:/media/movies - - /path/to/media/moviesetsartwork:/media/moviesetsartwork - /path/to/media/tv:/media/tv shows - - /path/to/media/documentaries:/media/documentaries - - /path/to/media/stand-up comedy:/media/stand-up comedy restart: unless-stopped networks: - media-net diff --git a/stacks/platform/gitea/.env b/stacks/platform/gitea/.env index 4261311..d4031d0 100644 --- a/stacks/platform/gitea/.env +++ b/stacks/platform/gitea/.env @@ -7,8 +7,6 @@ TZ=Etc/UTC HTTP_PORT=3000 SSH_PORT=22 -# Postgres (shared creds, separate DBs/instances) -# POSTGRES_PASSWORD — see .env.secrets (Vault) POSTGRES_USER=gitea POSTGRES_DB=gitea diff --git a/stacks/platform/grafana-stack/.env b/stacks/platform/grafana-stack/.env index a6b544b..0ddddb0 100644 --- a/stacks/platform/grafana-stack/.env +++ b/stacks/platform/grafana-stack/.env @@ -8,7 +8,5 @@ HTTP_PORT_grafana=3693 HTTP_PORT_loki=3100 GF_AUTH_GENERIC_OAUTH_CLIENT_ID=example-oauth-client-id -# GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET — see .env.secrets (Vault) AUTHENTIK_URL=https://authentik.caddy.example.com GRAFANA_URL=https://grafana.local.example.com -# GRAFANA_ADMIN_PASSWORD — see .env.secrets (Vault) diff --git a/stacks/platform/kestra/.env b/stacks/platform/kestra/.env index 198e763..f628cb0 100644 --- a/stacks/platform/kestra/.env +++ b/stacks/platform/kestra/.env @@ -4,7 +4,5 @@ HTTP_PORT=8080 # Basic-auth login USERNAME=admin@example.com -# Postgres Creds -# POSTGRES_PASSWORD — see .env.secrets (Vault) POSTGRES_USER=kestra POSTGRES_DB=kestra diff --git a/stacks/productivity/firefly-iii/docker-compose.yaml b/stacks/productivity/firefly-iii/docker-compose.yaml index c0fbf04..5a1b396 100644 --- a/stacks/productivity/firefly-iii/docker-compose.yaml +++ b/stacks/productivity/firefly-iii/docker-compose.yaml @@ -6,7 +6,7 @@ services: depends_on: - mariadb env_file: - - .env.secrets # APP_KEY, DB_PASSWORD — never committed + - .env.secrets environment: - DB_CONNECTION=mysql - DB_HOST=mariadb @@ -30,7 +30,7 @@ services: container_name: fireflyiii_db restart: unless-stopped env_file: - - .env.secrets # MYSQL_PASSWORD, MYSQL_ROOT_PASSWORD — never committed + - .env.secrets environment: - PUID=${PUID} - PGID=${PGID} diff --git a/stacks/productivity/joplin/.env b/stacks/productivity/joplin/.env index 0c7790b..138ac27 100644 --- a/stacks/productivity/joplin/.env +++ b/stacks/productivity/joplin/.env @@ -6,7 +6,7 @@ POSTGRES_PORT=5432 TZ=Etc/UTC # User Credentials -APP_BASE_URL=https://notes.example.com +APP_BASE_URL=https://joplin.example.com # Admin account seed (only read on a fresh first-ever boot, e.g. after a full recreate) APP_ADMIN_EMAIL=admin@example.com diff --git a/stacks/productivity/nextcloud/euro-office/Dockerfile b/stacks/productivity/nextcloud/euro-office/Dockerfile new file mode 100644 index 0000000..9b32c7b --- /dev/null +++ b/stacks/productivity/nextcloud/euro-office/Dockerfile @@ -0,0 +1,4 @@ +FROM ghcr.io/euro-office/documentserver:latest + +# Internal-zone apps trust the fleet's own internal CA here (cert copied in, +# then update-ca-certificates run) — the actual cert and paths are kept private. diff --git a/stacks/productivity/nextcloud/nextcloud/Dockerfile b/stacks/productivity/nextcloud/nextcloud/Dockerfile new file mode 100644 index 0000000..af83feb --- /dev/null +++ b/stacks/productivity/nextcloud/nextcloud/Dockerfile @@ -0,0 +1,10 @@ +FROM nextcloud:latest + +RUN apt-get update && \ + apt-get install -y ca-certificates smbclient libsmbclient-dev && \ + pecl install smbclient && \ + docker-php-ext-enable smbclient && \ + rm -rf /var/lib/apt/lists/* + +# Internal-zone apps trust the fleet's own internal CA here (cert copied in, +# then update-ca-certificates run) — the actual cert and paths are kept private.