Restructure compose mirror: stacks/ grouped by purpose, not by host
Replaces rocky-docker-lxc/, caddy-vm/, monitoring-vm/, and automation/ with a single stacks/ tree grouped by function (identity-and-security, platform, media, productivity, dev-tools) - 55 stacks total, every one a real directory in the private repos today. Resolves all outstanding drift: adds Wazuh (previously entirely missing), Firefly III and Postiz (never mirrored), the internal-zone Caddy instance and the Cron Scheduler's separate NocoDB instance (both previously conflated with their counterparts under one shared folder); renames Calibre-Web to calibre-web-automated and splits Kodi-MariaDB into kodi + mariadb-latest to match what the private repos actually run now; drops the decommissioned NetBox stack. Also removes automation/iac/old-content/ and automation/ansible/old-playbooks/ in the same pass - both folders were entirely stale content describing a superseded architecture (GitLab instead of Gitea, HAProxy+mTLS SSO instead of the current Caddy+Authentik setup), now replaced by docs/iac-pipeline.md.
This commit is contained in:
155 files changed
+500
-3519
No files matched your search
@@ -0,0 +1,27 @@
|
||||
services:
|
||||
cloudcmd:
|
||||
image: coderaiser/cloudcmd:latest
|
||||
container_name: cloudcommander
|
||||
ports:
|
||||
- ${HTTP_PORT}:8000
|
||||
volumes:
|
||||
- ~:/root
|
||||
- /:/mnt/fs
|
||||
user: "1000:1000"
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test:
|
||||
[
|
||||
"CMD-SHELL",
|
||||
"curl -fsS http://localhost:8000 | grep -qi cloudcmd || exit 1",
|
||||
]
|
||||
interval: 20s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 25s
|
||||
networks:
|
||||
- cloudcommander-net
|
||||
|
||||
networks:
|
||||
cloudcommander-net:
|
||||
external: true
|
||||
@@ -0,0 +1,19 @@
|
||||
services:
|
||||
it-tools:
|
||||
image: corentinth/it-tools:latest
|
||||
restart: unless-stopped
|
||||
container_name: it-tools
|
||||
ports:
|
||||
- ${HTTP_PORT}:80
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "curl -fsS http://localhost/ > /dev/null || exit 1"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
networks:
|
||||
- it-tools-net
|
||||
|
||||
networks:
|
||||
it-tools-net:
|
||||
external: true
|
||||
@@ -0,0 +1,44 @@
|
||||
services:
|
||||
ollama:
|
||||
# Uncomment below for GPU support
|
||||
# deploy:
|
||||
# resources:
|
||||
# reservations:
|
||||
# devices:
|
||||
# - driver: nvidia
|
||||
# count: 1
|
||||
# capabilities:
|
||||
# - gpu
|
||||
volumes:
|
||||
- /path/to/ollama:/root/.ollama
|
||||
# Uncomment below to expose Ollama API outside the container stack
|
||||
ports:
|
||||
- "${HTTP_PORT2}:11434"
|
||||
container_name: ollama
|
||||
pull_policy: always
|
||||
tty: true
|
||||
restart: unless-stopped
|
||||
image: ollama/ollama:latest
|
||||
networks:
|
||||
- openai-net
|
||||
|
||||
open-webui:
|
||||
image: ghcr.io/open-webui/open-webui:latest
|
||||
container_name: open-webui
|
||||
volumes:
|
||||
- /path/to/open-webui:/app/backend/data
|
||||
depends_on:
|
||||
- ollama
|
||||
ports:
|
||||
- "${HTTP_PORT}:8080"
|
||||
environment:
|
||||
- "OLLAMA_BASE_URL=http://ollama:11434"
|
||||
extra_hosts:
|
||||
- host.docker.internal:host-gateway
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- openai-net
|
||||
|
||||
networks:
|
||||
openai-net:
|
||||
external: true
|
||||
@@ -0,0 +1,108 @@
|
||||
services:
|
||||
postgresql:
|
||||
env_file:
|
||||
- .env
|
||||
container_name: authentik-postgres
|
||||
environment:
|
||||
POSTGRES_DB: ${PG_DB}
|
||||
POSTGRES_PASSWORD: ${PG_PASS}
|
||||
POSTGRES_USER: ${PG_USER}
|
||||
command: >
|
||||
postgres
|
||||
-c max_connections=400
|
||||
-c shared_buffers=256MB
|
||||
-c work_mem=8MB
|
||||
-c maintenance_work_mem=128MB
|
||||
-c effective_cache_size=1GB
|
||||
healthcheck:
|
||||
interval: 30s
|
||||
retries: 5
|
||||
start_period: 20s
|
||||
test:
|
||||
- CMD-SHELL
|
||||
- pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
|
||||
timeout: 5s
|
||||
image: docker.io/library/postgres:16-alpine
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- /path/to/authentik/database:/var/lib/postgresql/data
|
||||
networks:
|
||||
- authentik-net
|
||||
|
||||
redis:
|
||||
image: redis:7-alpine
|
||||
container_name: authentik-redis
|
||||
restart: unless-stopped
|
||||
command: redis-server --appendonly yes
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
volumes:
|
||||
- /path/to/authentik/redis:/data
|
||||
networks:
|
||||
- authentik-net
|
||||
|
||||
server:
|
||||
command: server
|
||||
container_name: authentik-server
|
||||
depends_on:
|
||||
postgresql:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
env_file:
|
||||
- .env
|
||||
environment:
|
||||
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
|
||||
AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
|
||||
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
|
||||
AUTHENTIK_REDIS__HOST: redis
|
||||
AUTHENTIK_URL: ${AUTHENTIK_URL}
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.3}
|
||||
ports:
|
||||
- ${COMPOSE_PORT_HTTP}:9000
|
||||
restart: unless-stopped
|
||||
shm_size: 512mb
|
||||
volumes:
|
||||
- /path/to/authentik/data:/data
|
||||
- /path/to/authentik/custom-templates:/templates
|
||||
networks:
|
||||
- authentik-net
|
||||
|
||||
worker:
|
||||
command: worker
|
||||
container_name: authentik-worker
|
||||
depends_on:
|
||||
postgresql:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
env_file:
|
||||
- .env
|
||||
environment:
|
||||
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
|
||||
AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
|
||||
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
|
||||
AUTHENTIK_REDIS__HOST: redis
|
||||
AUTHENTIK_URL: ${AUTHENTIK_URL}
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.5.3}
|
||||
restart: unless-stopped
|
||||
shm_size: 512mb
|
||||
user: root
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- /path/to/authentik/data:/data
|
||||
- /path/to/authentik/certs:/certs
|
||||
- /path/to/authentik/custom-templates:/templates
|
||||
networks:
|
||||
- authentik-net
|
||||
|
||||
networks:
|
||||
authentik-net:
|
||||
external: true
|
||||
@@ -0,0 +1,22 @@
|
||||
services:
|
||||
vaultwarden:
|
||||
image: vaultwarden/server:latest
|
||||
container_name: vaultwarden
|
||||
restart: always
|
||||
ports:
|
||||
- ${HTTP_PORT}:80
|
||||
volumes:
|
||||
- /path/to/vaultwarden/bw-data:/data
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- ICON_CACHE_TTL=0
|
||||
- WEBSOCKET_ENABLED='true' # Required to use websockets
|
||||
- SIGNUPS_ALLOWED='true' # set to false to disable signups
|
||||
networks:
|
||||
- vaultwarden-net
|
||||
|
||||
networks:
|
||||
vaultwarden-net:
|
||||
external: true
|
||||
@@ -0,0 +1,106 @@
|
||||
name: single-node
|
||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
services:
|
||||
wazuh.manager:
|
||||
image: wazuh/wazuh-manager:4.14.6
|
||||
hostname: wazuh.manager
|
||||
restart: always
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 655360
|
||||
hard: 655360
|
||||
ports:
|
||||
- "1514:1514"
|
||||
- "1515:1515"
|
||||
- "514:514/udp"
|
||||
- "55000:55000"
|
||||
env_file:
|
||||
- .env.secrets # INDEXER_PASSWORD, API_PASSWORD — never committed
|
||||
environment:
|
||||
- TZ=${TZ}
|
||||
- INDEXER_URL=https://wazuh.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=full
|
||||
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
|
||||
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
|
||||
- SSL_KEY=/etc/ssl/filebeat.key
|
||||
- API_USERNAME=wazuh-wui
|
||||
volumes:
|
||||
- /path/to/wazuh/manager/api_configuration:/var/ossec/api/configuration
|
||||
- /path/to/wazuh/manager/etc:/var/ossec/etc
|
||||
- /path/to/wazuh/manager/logs:/var/ossec/logs
|
||||
- /path/to/wazuh/manager/queue:/var/ossec/queue
|
||||
- /path/to/wazuh/manager/var_multigroups:/var/ossec/var/multigroups
|
||||
- /path/to/wazuh/manager/integrations:/var/ossec/integrations
|
||||
- /path/to/wazuh/manager/active_response:/var/ossec/active-response/bin
|
||||
- /path/to/wazuh/manager/agentless:/var/ossec/agentless
|
||||
- /path/to/wazuh/manager/wodles:/var/ossec/wodles
|
||||
- /path/to/wazuh/manager/filebeat_etc:/etc/filebeat
|
||||
- /path/to/wazuh/manager/filebeat_var:/var/lib/filebeat
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
|
||||
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh.indexer:
|
||||
image: wazuh/wazuh-indexer:4.14.6
|
||||
hostname: wazuh.indexer
|
||||
restart: always
|
||||
ports:
|
||||
- "9200:9200"
|
||||
environment:
|
||||
- TZ=${TZ}
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
volumes:
|
||||
- /path/to/wazuh/indexer/data:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:4.14.6
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
ports:
|
||||
- 443:5601
|
||||
env_file:
|
||||
- .env.secrets # INDEXER_PASSWORD, DASHBOARD_PASSWORD, API_PASSWORD — never committed
|
||||
environment:
|
||||
- TZ=${TZ}
|
||||
- INDEXER_USERNAME=admin
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
- DASHBOARD_USERNAME=kibanaserver
|
||||
- API_USERNAME=wazuh-wui
|
||||
entrypoint:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
sed "s/__API_USERNAME__/$$API_USERNAME/;s/__API_PASSWORD__/$$API_PASSWORD/" /wazuh-config-mount/wazuh.yml.tpl > /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
|
||||
exec /entrypoint.sh
|
||||
volumes:
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
|
||||
- ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
|
||||
- ./config/wazuh_dashboard/wazuh.yml.tpl:/wazuh-config-mount/wazuh.yml.tpl:ro
|
||||
- /path/to/wazuh/dashboard/config:/usr/share/wazuh-dashboard/data/wazuh/config
|
||||
- /path/to/wazuh/dashboard/custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
depends_on:
|
||||
- wazuh.indexer
|
||||
links:
|
||||
- wazuh.indexer:wazuh.indexer
|
||||
- wazuh.manager:wazuh.manager
|
||||
@@ -0,0 +1,27 @@
|
||||
services:
|
||||
audiobookshelf:
|
||||
image: ghcr.io/advplyr/audiobookshelf:latest
|
||||
container_name: audiobookshelf
|
||||
user: "${PUID}:${PGID}"
|
||||
environment:
|
||||
- TZ=${TZ}
|
||||
ports:
|
||||
- ${HTTP_PORT}:80
|
||||
volumes:
|
||||
- /path/to/audiobookshelf/config:/config
|
||||
- /path/to/audiobookshelf/metadata:/metadata
|
||||
- /path/to/data/media/audiobooks:/audiobooks
|
||||
- /path/to/data/media/podcasts:/podcasts
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://localhost:80/ || exit 1"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 20s
|
||||
networks:
|
||||
- audiobookshelf-net
|
||||
|
||||
networks:
|
||||
audiobookshelf-net:
|
||||
external: true
|
||||
@@ -0,0 +1,27 @@
|
||||
services:
|
||||
bazarr:
|
||||
image: lscr.io/linuxserver/bazarr:latest
|
||||
container_name: bazarr
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- UMASK=${UMASK}
|
||||
ports:
|
||||
- ${HTTP_PORT}:6767
|
||||
volumes:
|
||||
- /path/to/bazarr:/config
|
||||
- /path/to/media:/data
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:6767/ || exit 1"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 20s
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,28 @@
|
||||
services:
|
||||
beets:
|
||||
image: linuxserver/beets:2.8.0-ls323
|
||||
container_name: beets
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
volumes:
|
||||
- /path/to/beets:/config
|
||||
- /path/to/media/music:/music
|
||||
- /path/to/media/music_untagged:/music_untagged
|
||||
- /path/to/torrents/beets:/downloads
|
||||
ports:
|
||||
- ${HTTP_PORT}:8337
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8337/ || exit 1"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 20s
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,23 @@
|
||||
services:
|
||||
calibre-web-automated:
|
||||
image: crocodilestick/calibre-web-automated:latest
|
||||
container_name: calibre-web-automated
|
||||
environment:
|
||||
- TZ=${TZ}
|
||||
- DOCKER_MODS=linuxserver/mods:universal-calibre
|
||||
volumes:
|
||||
- /path/to/calibre-web/config:/config
|
||||
- /path/to/media/calibre:/calibre-library
|
||||
- /path/to/calibre-web/ingest:/cwa-book-ingest
|
||||
# This is an ingest dir, NOT a library one. Anything added here is
|
||||
# automatically added to the library per CWA's own settings, and
|
||||
# removed after processing.
|
||||
ports:
|
||||
- ${HTTP_PORT}:8083
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,25 @@
|
||||
services:
|
||||
calibre:
|
||||
image: lscr.io/linuxserver/calibre:latest
|
||||
container_name: calibre
|
||||
security_opt:
|
||||
- seccomp:unconfined #optional
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
volumes:
|
||||
- /path/to/calibre:/config
|
||||
- /path/to/books:/books
|
||||
ports:
|
||||
- ${HTTP_PORT}:8080 # Calibre desktop gui.
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- media-net
|
||||
- notif-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
notif-net:
|
||||
external: true
|
||||
@@ -0,0 +1,19 @@
|
||||
services:
|
||||
emby:
|
||||
image: emby/embyserver:latest
|
||||
container_name: emby
|
||||
environment:
|
||||
- TZ=${TZ}
|
||||
volumes:
|
||||
- /path/to/emby:/config
|
||||
- /path/to/media:/data
|
||||
- /path/to/transcodes/emby:/transcode
|
||||
ports:
|
||||
- ${HTTP_PORT}:8096
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,75 @@
|
||||
services:
|
||||
immich-server:
|
||||
container_name: immich_server
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
|
||||
volumes:
|
||||
- /path/to/immich/data:/data
|
||||
- /path/to/immich/upload:/usr/src/app/upload
|
||||
- /path/to/external-library-1:/path/to/external-library-1:ro
|
||||
- /path/to/external-library-2:/path/to/external-library-2:ro
|
||||
env_file:
|
||||
- .env
|
||||
ports:
|
||||
- ${HTTP_PORT}:2283
|
||||
depends_on:
|
||||
- redis
|
||||
- database
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- immich-net
|
||||
|
||||
immich-machine-learning:
|
||||
container_name: immich_machine_learning
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
|
||||
volumes:
|
||||
- /path/to/immich/model-cache:/cache
|
||||
env_file:
|
||||
- .env
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- immich-net
|
||||
|
||||
redis:
|
||||
container_name: immich_redis
|
||||
image: redis:6.2-alpine
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
volumes:
|
||||
- /path/to/immich/redis:/data
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- immich-net
|
||||
|
||||
database:
|
||||
container_name: immich_postgres
|
||||
image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
|
||||
env_file:
|
||||
- .env
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- POSTGRES_PASSWORD=${DB_PASSWORD}
|
||||
- POSTGRES_USER=${DB_USERNAME}
|
||||
- POSTGRES_DB=${DB_DATABASE_NAME}
|
||||
- POSTGRES_INITDB_ARGS='--data-checksums'
|
||||
volumes:
|
||||
- /path/to/immich/pgdata:/var/lib/postgresql/data
|
||||
shm_size: 128mb
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- immich-net
|
||||
|
||||
networks:
|
||||
immich-net:
|
||||
external: true
|
||||
@@ -0,0 +1,32 @@
|
||||
services:
|
||||
jellyfin:
|
||||
image: jellyfin/jellyfin:latest
|
||||
container_name: jellyfin
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
volumes:
|
||||
- /path/to/jellyfin/config:/config
|
||||
- /path/to/jellyfin/cache:/cache
|
||||
- /path/to/media:/data
|
||||
- /path/to/transcodes/jellyfin:/transcodes
|
||||
ports:
|
||||
- ${HTTP_PORT}:8096
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test:
|
||||
[
|
||||
"CMD-SHELL",
|
||||
"curl -fsS http://localhost:8096/health | grep -q Healthy",
|
||||
]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 5
|
||||
start_period: 60s
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,56 @@
|
||||
services:
|
||||
mariadb:
|
||||
image: mariadb:latest
|
||||
container_name: kodi-mariadb
|
||||
env_file:
|
||||
- .env.secrets # MYSQL_ROOT_PASSWORD, MYSQL_PASSWORD — never committed
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- MYSQL_USER=${MYSQL_USER}
|
||||
volumes:
|
||||
- /path/to/kodi-mariadb:/config
|
||||
ports:
|
||||
- ${HTTP_PORT}:3306
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test:
|
||||
[
|
||||
"CMD-SHELL",
|
||||
"mysqladmin ping -h 127.0.0.1 -u root -p$$MYSQL_ROOT_PASSWORD --silent",
|
||||
]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 30s
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
# A small custom bridge service, not an off-the-shelf image - polls Kodi's
|
||||
# own API and keeps a separate media-library tool's watch-state in sync.
|
||||
kodi-ma-bridge:
|
||||
image: python:3.13-slim
|
||||
container_name: kodi-ma-bridge
|
||||
restart: unless-stopped
|
||||
working_dir: /app
|
||||
volumes:
|
||||
- ./bridge.py:/app/bridge.py:ro
|
||||
- ./requirements.txt:/app/requirements.txt:ro
|
||||
command: sh -c "pip install --no-cache-dir -r requirements.txt && python bridge.py"
|
||||
env_file:
|
||||
- .env.secrets # KODI_PASSWORD, MA_API_TOKEN — never committed
|
||||
environment:
|
||||
- TZ=${TZ}
|
||||
- MA_BASE_URL=${MA_BASE_URL}
|
||||
- KODI_USER=${KODI_USER}
|
||||
- KODI_INSTANCES=${KODI_INSTANCES}
|
||||
- POLL_INTERVAL_SECONDS=${POLL_INTERVAL_SECONDS}
|
||||
- REFILL_THRESHOLD=${REFILL_THRESHOLD}
|
||||
- REFILL_COUNT=${REFILL_COUNT}
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,23 @@
|
||||
services:
|
||||
lidarr:
|
||||
image: ghcr.io/linuxserver/lidarr:latest
|
||||
container_name: lidarr
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- UMASK=${UMASK}
|
||||
- DOCKER_MODS=ghcr.io/gilbn/theme.park:lidarr
|
||||
- TP_ADDON=lidarr-alt-calendar
|
||||
ports:
|
||||
- ${HTTP_PORT}:8686
|
||||
volumes:
|
||||
- /path/to/lidarr:/config
|
||||
- /path/to/media:/data
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,27 @@
|
||||
services:
|
||||
music-assistant-server:
|
||||
image: ghcr.io/music-assistant/server:latest
|
||||
container_name: music-assistant
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- /path/to/music-assistant-server/data:/data/
|
||||
- /path/to/data/media/music:/music:ro
|
||||
ports:
|
||||
- "${PORT1}:8095"
|
||||
- "${PORT2}:3483"
|
||||
- "${PORT3}:5353/udp"
|
||||
- "${PORT4}:21064/tcp"
|
||||
- "${PORT5}:21064/udp"
|
||||
environment:
|
||||
- LOG_LEVEL=info
|
||||
cap_add:
|
||||
- SYS_ADMIN
|
||||
- DAC_READ_SEARCH
|
||||
security_opt:
|
||||
- apparmor:unconfined
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,27 @@
|
||||
services:
|
||||
prowlarr:
|
||||
container_name: prowlarr
|
||||
image: lscr.io/linuxserver/prowlarr:latest
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- UMASK=${UMASK}
|
||||
ports:
|
||||
- ${HTTP_PORT}:9696
|
||||
volumes:
|
||||
- /path/to/prowlarr:/config
|
||||
- /path/to/media:/data
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "curl -f http://localhost:9696 || exit 1"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 20s
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,30 @@
|
||||
services:
|
||||
qbittorrent:
|
||||
image: ghcr.io/hotio/qbittorrent:release-5.1.4
|
||||
container_name: qbittorrent
|
||||
privileged: true
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- UMASK=${UMASK}
|
||||
volumes:
|
||||
- /path/to/qbittorrent:/config
|
||||
- /path/to/media/torrents:/data/torrents
|
||||
ports:
|
||||
- ${HTTP_PORT}:8080
|
||||
- ${HTTP_PORT1}:8999
|
||||
- ${HTTP_PORT1}:8999/udp
|
||||
restart: always
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "curl -f http://localhost:8080 || exit 1"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 30s
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,31 @@
|
||||
services:
|
||||
radarr:
|
||||
image: ghcr.io/linuxserver/radarr:latest
|
||||
container_name: radarr
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- UMASK=${UMASK}
|
||||
- DOCKER_MODS=ghcr.io/gilbn/theme.park:radarr
|
||||
- TP_THEME=dark
|
||||
- TP_ADDON=radarr-4k-logo
|
||||
- TP_ADDON=radarr-alt-calendar
|
||||
ports:
|
||||
- ${HTTP_PORT}:7878
|
||||
volumes:
|
||||
- /path/to/radarr:/config
|
||||
- /path/to/media:/data
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "curl -f http://localhost:7878 || exit 1"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 30s
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,27 @@
|
||||
services:
|
||||
seerr:
|
||||
image: ghcr.io/seerr-team/seerr:latest
|
||||
init: true
|
||||
container_name: seerr
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- LOG_LEVEL=debug
|
||||
ports:
|
||||
- ${HTTP_PORT}:5055
|
||||
volumes:
|
||||
- /path/to/seerr:/app/config
|
||||
healthcheck:
|
||||
test: wget --no-verbose --tries=1 --spider http://localhost:5055/api/v1/status || exit 1
|
||||
start_period: 20s
|
||||
timeout: 3s
|
||||
interval: 15s
|
||||
retries: 3
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,30 @@
|
||||
services:
|
||||
sonarr:
|
||||
image: ghcr.io/linuxserver/sonarr:latest
|
||||
container_name: sonarr
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- UMASK=${UMASK}
|
||||
- DOCKER_MODS=ghcr.io/gilbn/theme.park:sonarr
|
||||
- TP_THEME=dark
|
||||
- TP_ADDON=sonarr-4k-logo
|
||||
ports:
|
||||
- ${HTTP_PORT}:8989
|
||||
volumes:
|
||||
- /path/to/sonarr:/config
|
||||
- /path/to/media:/data
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "curl -f http://localhost:8989 || exit 1"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 30s
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,38 @@
|
||||
services:
|
||||
tdarr:
|
||||
container_name: tdarr
|
||||
image: ghcr.io/haveagitgat/tdarr:2.82.01
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- ${HTTP_PORT}:8265
|
||||
- ${HTTP_PORT1}:8266
|
||||
- ${HTTP_PORT2}:8267
|
||||
- ${HTTP_PORT3}:8268
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- UMASK=${UMASK}
|
||||
- serverIP=${serverIP}
|
||||
- serverPort=${serverPort}
|
||||
- webUIPort=${webUIPort}
|
||||
- internalNode=${internalNode}
|
||||
- nodeName=${nodeName}
|
||||
volumes:
|
||||
- /path/to/tdarr/server:/app/server
|
||||
- /path/to/tdarr/configs:/app/configs
|
||||
- /path/to/tdarr/logs:/app/logs
|
||||
- /path/to/media:/media
|
||||
- /path/to/transcodes/transcodes_tdarr:/temp
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "curl -f http://127.0.0.1:8265 || exit 1"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 20s
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,25 @@
|
||||
services:
|
||||
tinymediamanager:
|
||||
image: tinymediamanager/tinymediamanager:latest
|
||||
container_name: tinymediamanager
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
ports:
|
||||
- ${HTTP_PORT}:4000
|
||||
volumes:
|
||||
- /path/to/tinymediamanager/data:/data
|
||||
- /path/to/tinymediamanager/config/launcher-extra.yml:/app/launcher-extra.yml
|
||||
- /path/to/media/movies:/media/movies
|
||||
- /path/to/media/moviesetsartwork:/media/moviesetsartwork
|
||||
- /path/to/media/tv:/media/tv shows
|
||||
- /path/to/media/documentaries:/media/documentaries
|
||||
- /path/to/media/stand-up comedy:/media/stand-up comedy
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- media-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
@@ -0,0 +1,19 @@
|
||||
services:
|
||||
caddy:
|
||||
image: caddy:latest
|
||||
container_name: caddy-internal
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${HTTPS_PORT}:443"
|
||||
volumes:
|
||||
- ./Caddyfile:/etc/caddy/Caddyfile
|
||||
- /path/to/caddy-internal/caddy_data:/data
|
||||
- /path/to/caddy-internal/caddy_config:/config
|
||||
- /path/to/caddy-internal/logs:/var/log/caddy
|
||||
- ./certs/pki_int_ca.crt:/etc/caddy/certs/pki_int_ca.crt:ro
|
||||
networks:
|
||||
- caddy-net
|
||||
|
||||
networks:
|
||||
caddy-net:
|
||||
external: true
|
||||
@@ -0,0 +1,18 @@
|
||||
services:
|
||||
caddy:
|
||||
image: caddy:latest
|
||||
container_name: caddy
|
||||
restart: always
|
||||
ports:
|
||||
- "${HTTPS_PORT}:443"
|
||||
volumes:
|
||||
- ./Caddyfile:/etc/caddy/Caddyfile
|
||||
- /path/to/caddy/caddy_data:/data
|
||||
- /path/to/caddy/caddy_config:/config
|
||||
- /etc/caddy/certs:/etc/caddy/certs
|
||||
networks:
|
||||
- caddy-net
|
||||
|
||||
networks:
|
||||
caddy-net:
|
||||
external: true
|
||||
@@ -0,0 +1,40 @@
|
||||
services:
|
||||
dashy:
|
||||
image: lissy93/dashy
|
||||
container_name: dashy
|
||||
volumes:
|
||||
# Conf file
|
||||
- /path/to/dashy/conf.yml:/app/user-data/conf.yml
|
||||
# Icons folder
|
||||
- /path/to/dashy/public/assets:/app/user-data/item-icons/
|
||||
# Pages, one by one
|
||||
- /path/to/dashy/control-plane.yml:/app/user-data/control-plane.yml
|
||||
- /path/to/dashy/observability.yml:/app/user-data/observability.yml
|
||||
- /path/to/dashy/media.yml:/app/user-data/media.yml
|
||||
- /path/to/dashy/automation.yml:/app/user-data/automation.yml
|
||||
- /path/to/dashy/dev-platform-tools.yml:/app/user-data/dev-platform-tools.yml
|
||||
- /path/to/dashy/identity-security.yml:/app/user-data/identity-security.yml
|
||||
- /path/to/dashy/data-knowledge.yml:/app/user-data/data-knowledge.yml
|
||||
- /path/to/dashy/personal-apps.yml:/app/user-data/personal-apps.yml
|
||||
ports:
|
||||
- ${HTTP_PORT}:8080
|
||||
environment:
|
||||
- NODE_ENV=production
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD", "node", "/app/services/healthcheck"]
|
||||
interval: 1m30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 40s
|
||||
networks:
|
||||
- media-net
|
||||
- caddy-net
|
||||
|
||||
networks:
|
||||
media-net:
|
||||
external: true
|
||||
caddy-net:
|
||||
external: true
|
||||
@@ -0,0 +1,9 @@
|
||||
services:
|
||||
docker-socket-proxy-mirror:
|
||||
container_name: docker-socket-proxy-mirror
|
||||
image: tecnativa/docker-socket-proxy
|
||||
restart: "no"
|
||||
# No docker.sock mounted deliberately - this container never actually
|
||||
# proxies anything, it only exists as a self-hosted-registry mirror
|
||||
# build target. Real consumers mount their own socket with their own
|
||||
# distinct permission sets.
|
||||
@@ -0,0 +1,23 @@
|
||||
services:
|
||||
socket-proxy:
|
||||
image: tecnativa/docker-socket-proxy
|
||||
container_name: socket-proxy
|
||||
restart: always
|
||||
environment:
|
||||
- CONTAINERS=1
|
||||
- IMAGES=0
|
||||
- NETWORKS=0
|
||||
- VOLUMES=0
|
||||
- EVENTS=0
|
||||
- POST=0
|
||||
- DELETE=0
|
||||
- INFO=1
|
||||
- EXEC=0
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
networks:
|
||||
- docker-proxy-net
|
||||
|
||||
networks:
|
||||
docker-proxy-net:
|
||||
external: true
|
||||
@@ -0,0 +1,49 @@
|
||||
services:
|
||||
socket-proxy:
|
||||
image: tecnativa/docker-socket-proxy
|
||||
container_name: dockhand-socket-proxy
|
||||
restart: always
|
||||
environment:
|
||||
# Required for Dockhand core functionality
|
||||
- CONTAINERS=1
|
||||
- IMAGES=1
|
||||
- NETWORKS=1
|
||||
- VOLUMES=1
|
||||
- EVENTS=1
|
||||
- POST=1
|
||||
- DELETE=1
|
||||
# Required for dashboard host info and disk usage
|
||||
- INFO=1
|
||||
- SYSTEM=1
|
||||
# Required for vulnerability scanning
|
||||
- ALLOW_START=1
|
||||
- ALLOW_STOP=1
|
||||
- ALLOW_RESTARTS=1
|
||||
# Optional: enable for terminal access
|
||||
- EXEC=1
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
networks:
|
||||
- dockhand-net
|
||||
|
||||
dockhand:
|
||||
image: fnsys/dockhand:latest
|
||||
container_name: dockhand
|
||||
restart: always
|
||||
depends_on:
|
||||
- socket-proxy
|
||||
environment:
|
||||
- PUID=1000
|
||||
- PGID=1000
|
||||
group_add:
|
||||
- "996"
|
||||
ports:
|
||||
- ${HTTP_PORT}:3000
|
||||
volumes:
|
||||
- /path/to/dockhand/dockhand_data:/app/data
|
||||
networks:
|
||||
- dockhand-net
|
||||
|
||||
networks:
|
||||
dockhand-net:
|
||||
external: true
|
||||
@@ -0,0 +1,48 @@
|
||||
services:
|
||||
gitea:
|
||||
image: gitea/gitea:latest
|
||||
container_name: gitea
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- GITEA__database__DB_TYPE=postgres
|
||||
- GITEA__database__HOST=gitea-db
|
||||
- GITEA__database__PORT=5432
|
||||
- GITEA__database__NAME=${POSTGRES_DB}
|
||||
- GITEA__database__USER=${POSTGRES_USER}
|
||||
- GITEA__database__PASSWD=${POSTGRES_PASSWORD}
|
||||
- ROOT_URL=${GITEA_ROOT_URL}
|
||||
- DOMAIN=${GITEA_DOMAIN}
|
||||
- GITEA__migrations__ALLOW_LOCALNETWORKS=true
|
||||
restart: always
|
||||
volumes:
|
||||
- /path/to/gitea:/data
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
ports:
|
||||
- "${HTTP_PORT}:3000"
|
||||
- "${SSH_PORT}:22"
|
||||
depends_on:
|
||||
- gitea-db
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
networks:
|
||||
- gitea-net
|
||||
|
||||
gitea-db:
|
||||
image: postgres:latest
|
||||
container_name: gitea-db
|
||||
restart: always
|
||||
environment:
|
||||
- POSTGRES_USER=${POSTGRES_USER}
|
||||
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
||||
- POSTGRES_DB=${POSTGRES_DB}
|
||||
volumes:
|
||||
- /path/to/gitea/postgres:/var/lib/postgresql
|
||||
networks:
|
||||
- gitea-net
|
||||
|
||||
networks:
|
||||
gitea-net:
|
||||
external: true
|
||||
@@ -0,0 +1,63 @@
|
||||
services:
|
||||
loki:
|
||||
image: grafana/loki:latest
|
||||
container_name: loki
|
||||
user: root
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${HTTP_PORT_loki}:3100"
|
||||
volumes:
|
||||
- /path/to/monitoring-data/loki:/tmp/loki
|
||||
- /path/to/monitoring/config/loki-config.yaml:/etc/loki/loki-config.yaml:ro
|
||||
command: -config.file=/etc/loki/loki-config.yaml
|
||||
networks:
|
||||
- monitoring-net
|
||||
|
||||
prometheus:
|
||||
image: prom/prometheus:latest
|
||||
container_name: prometheus
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${HTTP_PORT_prometheus}:9090"
|
||||
volumes:
|
||||
- /path/to/monitoring-data/prometheus:/prometheus
|
||||
- /path/to/monitoring/config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
|
||||
command:
|
||||
- '--config.file=/etc/prometheus/prometheus.yml'
|
||||
- '--web.enable-remote-write-receiver'
|
||||
- '--storage.tsdb.retention.size=900GB'
|
||||
networks:
|
||||
- monitoring-net
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:latest
|
||||
container_name: grafana
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${HTTP_PORT_grafana}:3000"
|
||||
env_file: .env
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
|
||||
- GF_SERVER_ROOT_URL=${GRAFANA_URL}
|
||||
- GF_AUTH_GENERIC_OAUTH_ENABLED=true
|
||||
- GF_AUTH_GENERIC_OAUTH_NAME=authentik
|
||||
- GF_AUTH_GENERIC_OAUTH_CLIENT_ID=${GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
|
||||
- GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=${GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
|
||||
- GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
|
||||
- GF_AUTH_GENERIC_OAUTH_AUTH_URL=${AUTHENTIK_URL}/application/o/authorize/
|
||||
- GF_AUTH_GENERIC_OAUTH_TOKEN_URL=${AUTHENTIK_URL}/application/o/token/
|
||||
- GF_AUTH_GENERIC_OAUTH_API_URL=${AUTHENTIK_URL}/application/o/userinfo/
|
||||
- GF_AUTH_GENERIC_OAUTH_LOGIN_ATTRIBUTE_PATH=preferred_username
|
||||
- GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'authentik Admins') && 'Admin'
|
||||
- GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_STRICT=false
|
||||
- GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
|
||||
- GF_AUTH_SIGNOUT_REDIRECT_URL=${AUTHENTIK_URL}/application/o/grafana/end-session/
|
||||
- GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP=true
|
||||
volumes:
|
||||
- /path/to/monitoring/grafana:/var/lib/grafana
|
||||
networks:
|
||||
- monitoring-net
|
||||
|
||||
networks:
|
||||
monitoring-net:
|
||||
external: true
|
||||
@@ -0,0 +1,19 @@
|
||||
services:
|
||||
hawser:
|
||||
image: ghcr.io/finsys/hawser:latest
|
||||
container_name: hawser
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${HTTP_PORT}:2376"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- /path/to/hawser/hawser_stacks:/data/stacks
|
||||
environment:
|
||||
- TOKEN=${TOKEN}
|
||||
- TZ=${TZ}
|
||||
networks:
|
||||
- hawser-net
|
||||
|
||||
networks:
|
||||
hawser-net:
|
||||
external: true
|
||||
@@ -0,0 +1,75 @@
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:18
|
||||
container_name: kestra-postgres
|
||||
volumes:
|
||||
- /path/to/kestra/postgres-data:/var/lib/postgresql
|
||||
environment:
|
||||
POSTGRES_DB: ${POSTGRES_DB}
|
||||
POSTGRES_USER: ${POSTGRES_USER}
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 10
|
||||
networks:
|
||||
- kestra-net
|
||||
|
||||
kestra:
|
||||
image: kestra/kestra:latest
|
||||
container_name: kestra
|
||||
pull_policy: always
|
||||
# Kestra, by default, has a termination grace period of 5m. We need to wait a little more to be sure no active tasks are running.
|
||||
stop_grace_period: 6m
|
||||
# Note that this setup with a root user is intended for development purpose.
|
||||
# Our base image runs without root, but the Docker Compose implementation needs root to access the Docker socket
|
||||
user: "root"
|
||||
restart: unless-stopped
|
||||
command: server standalone
|
||||
volumes:
|
||||
- /path/to/kestra/kestra-data:/app/storage
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- /tmp/kestra-wd:/tmp/kestra-wd
|
||||
# Mounted read-only so Kestra flows can drive the ansible repo directly
|
||||
- /path/to/repos/ansible:/opt/repos/ansible:ro
|
||||
- /path/to/ansible-venv:/home/user/ansible-venv:ro
|
||||
- /path/to/ssh-keys:/home/user/.ssh:ro
|
||||
environment:
|
||||
KESTRA_CONFIGURATION: |
|
||||
datasources:
|
||||
postgres:
|
||||
url: jdbc:postgresql://postgres:5432/kestra
|
||||
driverClassName: org.postgresql.Driver
|
||||
username: ${POSTGRES_USER}
|
||||
password: ${POSTGRES_PASSWORD}
|
||||
kestra:
|
||||
server:
|
||||
basic-auth:
|
||||
username: ${USERNAME}
|
||||
password: ${PASSWORD}
|
||||
repository:
|
||||
type: postgres
|
||||
storage:
|
||||
type: local
|
||||
local:
|
||||
base-path: "/app/storage"
|
||||
queue:
|
||||
type: postgres
|
||||
tasks:
|
||||
tmp-dir:
|
||||
path: /tmp/kestra-wd/tmp
|
||||
url: http://localhost:8080/
|
||||
ports:
|
||||
- "${HTTP_PORT}:8080"
|
||||
- "8081:8081"
|
||||
depends_on:
|
||||
postgres:
|
||||
condition: service_started
|
||||
networks:
|
||||
- kestra-net
|
||||
|
||||
networks:
|
||||
kestra-net:
|
||||
external: true
|
||||
@@ -0,0 +1,34 @@
|
||||
services:
|
||||
kopia:
|
||||
image: kopia/kopia:latest
|
||||
container_name: kopia
|
||||
restart: unless-stopped
|
||||
user: "0:0"
|
||||
hostname: "docker-host"
|
||||
ports:
|
||||
- "${HTTP_PORT}:51515"
|
||||
command:
|
||||
- server
|
||||
- start
|
||||
- --address=0.0.0.0:51515
|
||||
- --tls-cert-file=/tls/kopia.crt
|
||||
- --tls-key-file=/tls/kopia.key
|
||||
- --server-username=${USERNAME}
|
||||
- --server-password=${SECRET_PASSWORD}
|
||||
- --disable-csrf-token-checks
|
||||
environment:
|
||||
TZ: ${TZ}
|
||||
KOPIA_PASSWORD: ${SECRET_PASSWORD}
|
||||
volumes:
|
||||
- /path/to/backup-drive/kopia-repo:/repository # External drive for repository
|
||||
- /path/to/backup-drive/kopia-cache:/cache
|
||||
- /path/to/backup-drive/kopia-config:/app/config
|
||||
- /path/to/backup-drive/kopia-tls:/tls:ro
|
||||
- /path/to/docker-volumes:/apps:ro # Read-only access to docker volumes
|
||||
- /path/to/docker-volumes:/restore
|
||||
networks:
|
||||
- kopia-net
|
||||
|
||||
networks:
|
||||
kopia-net:
|
||||
external: true
|
||||
@@ -0,0 +1,16 @@
|
||||
services:
|
||||
mariadb-latest:
|
||||
container_name: mariadb-latest
|
||||
image: mariadb:latest
|
||||
restart: "no"
|
||||
environment:
|
||||
# No real data lives here - this is a thin self-hosted-registry mirror
|
||||
# build target, not a running database. Random root password since
|
||||
# the base image needs some root-auth setting to initialize at all.
|
||||
- MYSQL_RANDOM_ROOT_PASSWORD=true
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "mariadb-admin ping -h 127.0.0.1 -u root || exit 1"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 15s
|
||||
@@ -0,0 +1,19 @@
|
||||
services:
|
||||
mosquitto:
|
||||
image: eclipse-mosquitto:latest
|
||||
container_name: mosquitto
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${HTTP_PORT}:1883"
|
||||
volumes:
|
||||
- /path/to/mosquitto/config/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
|
||||
- /path/to/mosquitto/config/passwords:/mosquitto/config/passwords:ro
|
||||
- /path/to/mosquitto/config/acl:/mosquitto/config/acl:ro
|
||||
- /path/to/mosquitto/data:/mosquitto/data
|
||||
- /path/to/mosquitto/log:/mosquitto/log
|
||||
networks:
|
||||
- notifier-net
|
||||
|
||||
networks:
|
||||
notifier-net:
|
||||
external: true
|
||||
@@ -0,0 +1,15 @@
|
||||
services:
|
||||
mysql-8:
|
||||
container_name: mysql-8
|
||||
image: mysql:8
|
||||
restart: "no"
|
||||
environment:
|
||||
# No real data lives here - a thin self-hosted-registry mirror build
|
||||
# target, not a running database.
|
||||
- MYSQL_RANDOM_ROOT_PASSWORD=yes
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 || exit 1"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 20s
|
||||
@@ -0,0 +1,42 @@
|
||||
services:
|
||||
nocodb:
|
||||
image: nocodb/nocodb:latest
|
||||
container_name: nocodb
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${HTTP_PORT}:8080"
|
||||
depends_on:
|
||||
nocodb_db:
|
||||
condition: service_healthy
|
||||
environment:
|
||||
TZ: ${TZ}
|
||||
NC_DB: pg://nocodb_db:5432?u=${POSTGRES_USER}&p=${POSTGRES_PASSWORD}&d=${POSTGRES_DB}
|
||||
NC_AUTH_JWT_SECRET: ${JWT_SECRET}
|
||||
volumes:
|
||||
- /path/to/nocodb/nc_data:/usr/app/data
|
||||
networks:
|
||||
- nocodb-net
|
||||
|
||||
nocodb_db:
|
||||
image: postgres:16-alpine
|
||||
container_name: nocodb_postgres
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
TZ: ${TZ}
|
||||
POSTGRES_DB: ${POSTGRES_DB}
|
||||
POSTGRES_USER: ${POSTGRES_USER}
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
volumes:
|
||||
- /path/to/nocodb/db_data:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 20s
|
||||
networks:
|
||||
- nocodb-net
|
||||
|
||||
networks:
|
||||
nocodb-net:
|
||||
external: true
|
||||
@@ -0,0 +1,19 @@
|
||||
services:
|
||||
nodered:
|
||||
image: nodered/node-red:latest
|
||||
container_name: nodered
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- TZ=${TZ}
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
ports:
|
||||
- "${HTTP_PORT}:1880"
|
||||
volumes:
|
||||
- /path/to/nodered_data:/data
|
||||
networks:
|
||||
- notifier-net
|
||||
|
||||
networks:
|
||||
notifier-net:
|
||||
external: true
|
||||
@@ -0,0 +1,17 @@
|
||||
services:
|
||||
postgres-18-alpine:
|
||||
container_name: postgres-18-alpine
|
||||
image: postgres:18-alpine
|
||||
restart: "no"
|
||||
environment:
|
||||
# No real data lives here - a thin self-hosted-registry mirror build
|
||||
# target so other stacks can pull the result. trust auth is fine
|
||||
# since nothing reaches it but the health check below - Postgres
|
||||
# refuses to start at all without some password/auth method set.
|
||||
- POSTGRES_HOST_AUTH_METHOD=trust
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U postgres"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 10s
|
||||
@@ -0,0 +1,24 @@
|
||||
services:
|
||||
speedtest-tracker:
|
||||
container_name: speedtest-tracker
|
||||
image: lscr.io/linuxserver/speedtest-tracker:latest
|
||||
ports:
|
||||
- "${HTTPS_PORT}:443"
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- APP_KEY=${APP_KEY}
|
||||
- APP_URL=${APP_URL}
|
||||
- DB_CONNECTION=sqlite
|
||||
- SPEEDTEST_SCHEDULE="0 */3 * * *" # Cron schedule, runs every 3 hours.
|
||||
- DISPLAY_TIMEZONE=${DISPLAY_TIMEZONE}
|
||||
volumes:
|
||||
- /path/to/speedtest-tracker/data:/config
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- speedtest-net
|
||||
|
||||
networks:
|
||||
speedtest-net:
|
||||
external: true
|
||||
@@ -0,0 +1,11 @@
|
||||
services:
|
||||
valkey-9.0-alpine:
|
||||
container_name: valkey-9.0-alpine
|
||||
image: valkey/valkey:9.0-alpine
|
||||
restart: "no"
|
||||
healthcheck:
|
||||
test: ["CMD", "valkey-cli", "ping"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 10s
|
||||
@@ -0,0 +1,19 @@
|
||||
services:
|
||||
actual_server:
|
||||
image: actualbudget/actual-server:latest
|
||||
container_name: actual
|
||||
ports:
|
||||
- ${HTTP_PORT}:5006
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
volumes:
|
||||
- /path/to/actual/actual-data:/data
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- actual-net
|
||||
|
||||
networks:
|
||||
actual-net:
|
||||
external: true
|
||||
@@ -0,0 +1,63 @@
|
||||
---
|
||||
services:
|
||||
bookstack:
|
||||
image: lscr.io/linuxserver/bookstack:latest
|
||||
container_name: bookstack
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- APP_URL=https://subdomain.example.com
|
||||
- DB_HOST=bookstack_db
|
||||
- DB_PORT=${DB_PORT}
|
||||
- DB_USER=${DB_USER}
|
||||
- DB_PASS=${DB_PASS}
|
||||
- DB_DATABASE=${DB_DATABASE}
|
||||
- APP_DEFAULT_DARK_MODE=true
|
||||
volumes:
|
||||
- /path/to/bookstack/bookstack_app_data:/config
|
||||
ports:
|
||||
- ${HTTP_PORT}:80
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
bookstack_db:
|
||||
condition: service_healthy
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:80/ || exit 1"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 30s
|
||||
networks:
|
||||
- bookstack-net
|
||||
|
||||
bookstack_db:
|
||||
image: lscr.io/linuxserver/mariadb:latest
|
||||
container_name: bookstack_db
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
|
||||
- MYSQL_DATABASE=${DB_DATABASE}
|
||||
- MYSQL_USER=${DB_USER}
|
||||
- MYSQL_PASSWORD=${DB_PASSWORD}
|
||||
volumes:
|
||||
- /path/to/bookstack/bookstack_db_data:/config
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test:
|
||||
[
|
||||
"CMD-SHELL",
|
||||
"mysqladmin ping -h localhost -u${DB_USER} -p${DB_PASSWORD} || exit 1",
|
||||
]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 20s
|
||||
networks:
|
||||
- bookstack-net
|
||||
|
||||
networks:
|
||||
bookstack-net:
|
||||
external: true
|
||||
@@ -0,0 +1,49 @@
|
||||
services:
|
||||
fireflyiii:
|
||||
image: fireflyiii/core:latest
|
||||
container_name: fireflyiii_app
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- mariadb
|
||||
env_file:
|
||||
- .env.secrets # APP_KEY, DB_PASSWORD — never committed
|
||||
environment:
|
||||
- DB_CONNECTION=mysql
|
||||
- DB_HOST=mariadb
|
||||
- DB_PORT=3306
|
||||
- DB_DATABASE=fireflyiii
|
||||
- DB_USERNAME=fireflyuser
|
||||
- TZ=${TZ}
|
||||
- TRUSTED_PROXIES=**
|
||||
- APP_ENV=production
|
||||
- AUTHENTICATION_GUARD=${AUTHENTICATION_GUARD}
|
||||
- AUTHENTICATION_GUARD_HEADER=${AUTHENTICATION_GUARD_HEADER}
|
||||
volumes:
|
||||
- /path/to/fireflyiii/firefly_iii_upload:/var/www/html/storage/upload
|
||||
ports:
|
||||
- "${HTTP_PORT}:8080"
|
||||
networks:
|
||||
- firefly-net
|
||||
|
||||
mariadb:
|
||||
image: mariadb:latest
|
||||
container_name: fireflyiii_db
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- .env.secrets # MYSQL_PASSWORD, MYSQL_ROOT_PASSWORD — never committed
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- MYSQL_DATABASE=fireflyiii
|
||||
- MYSQL_USER=fireflyuser
|
||||
volumes:
|
||||
- /path/to/fireflyiii/firefly_iii_db:/config
|
||||
ports:
|
||||
- "${DB_PORT}:3306"
|
||||
networks:
|
||||
- firefly-net
|
||||
|
||||
networks:
|
||||
firefly-net:
|
||||
external: true
|
||||
@@ -0,0 +1,82 @@
|
||||
services:
|
||||
ghost:
|
||||
image: ghost:latest
|
||||
container_name: ghost_blog
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${HTTP_PORT}:2368"
|
||||
depends_on:
|
||||
- ghost_db
|
||||
environment:
|
||||
NODE_ENV: production
|
||||
TZ: ${TZ}
|
||||
# Ghost URL
|
||||
url: ${GHOST_URL}
|
||||
# SMTP
|
||||
mail__transport: ${SMTP_TRANSPORT}
|
||||
mail__options__host: ${SMTP_HOST}
|
||||
mail__options__port: ${SMTP_PORT}
|
||||
mail__options__secure: "false"
|
||||
mail__options__auth__user: ${SMTP_USER}
|
||||
mail__options__auth__pass: ${SMTP_PASSWORD}
|
||||
# Database
|
||||
database__client: mysql
|
||||
database__connection__host: ${DB_HOST}
|
||||
database__connection__user: ${DB_USER}
|
||||
database__connection__password: ${DB_PASSWORD}
|
||||
database__connection__database: ${DB_NAME}
|
||||
volumes:
|
||||
- /path/to/ghost/content:/var/lib/ghost/content
|
||||
networks:
|
||||
- blog-net
|
||||
|
||||
ghost_db:
|
||||
image: mysql:8
|
||||
container_name: ghost_mysql
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
TZ: ${TZ}
|
||||
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
|
||||
MYSQL_DATABASE: ${DB_NAME}
|
||||
MYSQL_USER: ${DB_USER}
|
||||
MYSQL_PASSWORD: ${DB_PASSWORD}
|
||||
volumes:
|
||||
- /path/to/ghost/db_data:/var/lib/mysql
|
||||
- /path/to/ghost/init:/docker-entrypoint-initdb.d:ro
|
||||
networks:
|
||||
- blog-net
|
||||
|
||||
umami:
|
||||
image: ghcr.io/umami-software/umami:postgresql-latest
|
||||
container_name: umami_analytics
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${UMAMI_PORT}:3000"
|
||||
depends_on:
|
||||
- umami-db
|
||||
environment:
|
||||
TZ: ${TZ}
|
||||
DATABASE_URL: postgresql://${UMAMI_DB_USER}:${UMAMI_DB_PASSWORD}@umami-db:5432/${UMAMI_DB_NAME}
|
||||
DATABASE_TYPE: postgresql
|
||||
APP_SECRET: ${UMAMI_APP_SECRET}
|
||||
IGNORE_IP: ${UMAMI_IGNORE_IP}
|
||||
networks:
|
||||
- blog-net
|
||||
|
||||
umami-db:
|
||||
image: postgres:15-alpine
|
||||
container_name: umami_postgres
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
TZ: ${TZ}
|
||||
POSTGRES_DB: ${UMAMI_DB_NAME}
|
||||
POSTGRES_USER: ${UMAMI_DB_USER}
|
||||
POSTGRES_PASSWORD: ${UMAMI_DB_PASSWORD}
|
||||
volumes:
|
||||
- /path/to/umami/db_data:/var/lib/postgresql/data
|
||||
networks:
|
||||
- blog-net
|
||||
|
||||
networks:
|
||||
blog-net:
|
||||
external: true
|
||||
@@ -0,0 +1,56 @@
|
||||
services:
|
||||
homeassistant:
|
||||
container_name: home-assistant
|
||||
image: ghcr.io/home-assistant/home-assistant:stable
|
||||
volumes:
|
||||
- /path/to/home-assistant/config:/config
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${HTTP_PORT}:8123"
|
||||
depends_on:
|
||||
homeassistant-db:
|
||||
condition: service_healthy
|
||||
privileged: true
|
||||
healthcheck:
|
||||
test: [
|
||||
"CMD-SHELL",
|
||||
"curl -fsS -o /dev/null -w '%{http_code}' http://127.0.0.1:8123/api/
|
||||
| grep -q 401",
|
||||
]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 10
|
||||
start_period: 90s
|
||||
networks:
|
||||
- home-assistant-net
|
||||
|
||||
homeassistant-db:
|
||||
container_name: homeassistant-db
|
||||
image: postgres:latest
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- POSTGRES_USER=${POSTGRES_USER}
|
||||
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
||||
- POSTGRES_DB=${POSTGRES_DB}
|
||||
- POSTGRES_INITDB_ARGS=--encoding=UTF-8 --locale=en_US.UTF-8
|
||||
volumes:
|
||||
- /path/to/home-assistant/schemas:/var/lib/postgresql
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 10s
|
||||
networks:
|
||||
- home-assistant-net
|
||||
|
||||
networks:
|
||||
home-assistant-net:
|
||||
external: true
|
||||
@@ -0,0 +1,56 @@
|
||||
services:
|
||||
joplin-db:
|
||||
image: postgres:latest
|
||||
container_name: joplin-db
|
||||
volumes:
|
||||
- /path/to/joplin:/var/lib/postgresql
|
||||
ports:
|
||||
- "${POSTGRES_PORT}:5432"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
||||
- POSTGRES_USER=${POSTGRES_USER}
|
||||
- POSTGRES_DB=${POSTGRES_DB}
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 15s
|
||||
networks:
|
||||
- joplin-net
|
||||
|
||||
joplin:
|
||||
image: joplin/server:latest
|
||||
container_name: joplin-server
|
||||
depends_on:
|
||||
- joplin-db
|
||||
ports:
|
||||
- "${HTTP_PORT}:22300"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- APP_PORT=${HTTP_PORT}
|
||||
- APP_BASE_URL=${APP_BASE_URL}
|
||||
- DB_CLIENT=pg
|
||||
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
||||
- POSTGRES_DATABASE=${POSTGRES_DB}
|
||||
- POSTGRES_USER=${POSTGRES_USER}
|
||||
- POSTGRES_PORT=${POSTGRES_PORT}
|
||||
- POSTGRES_HOST=joplin-db
|
||||
- MAILER_ENABLED=1
|
||||
- MAILER_HOST=${MAILER_HOST}
|
||||
- MAILER_PORT=${MAILER_PORT}
|
||||
- MAILER_SECURITY=${MAILER_SECURITY}
|
||||
- MAILER_AUTH_USER=${MAILER_AUTH_USER}
|
||||
- MAILER_AUTH_PASSWORD=${MAILER_AUTH_PASSWORD}
|
||||
- MAILER_NOREPLY_NAME=${MAILER_NOREPLY_NAME}
|
||||
- MAILER_NOREPLY_EMAIL=${MAILER_NOREPLY_EMAIL}
|
||||
- APP_ADMIN_EMAIL=${APP_ADMIN_EMAIL}
|
||||
- APP_ADMIN_PASSWORD=${APP_ADMIN_PASSWORD}
|
||||
- APP_ADMIN_NAME=${APP_ADMIN_NAME}
|
||||
networks:
|
||||
- joplin-net
|
||||
|
||||
networks:
|
||||
joplin-net:
|
||||
external: true
|
||||
@@ -0,0 +1,64 @@
|
||||
services:
|
||||
n8n:
|
||||
image: n8nio/n8n:latest
|
||||
container_name: n8n
|
||||
restart: unless-stopped
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- GENERIC_TIMEZONE=${TZ}
|
||||
- N8N_HOST=${N8N_HOST}
|
||||
- N8N_PORT=${N8N_PORT}
|
||||
- N8N_PROTOCOL=https
|
||||
- DB_TYPE=postgresdb
|
||||
- DB_POSTGRESDB_HOST=postgres
|
||||
- DB_POSTGRESDB_PORT=5432
|
||||
- DB_POSTGRESDB_DATABASE=n8n
|
||||
- DB_POSTGRESDB_USER=n8n
|
||||
- DB_POSTGRESDB_PASSWORD=${N8N_POSTGRES_PASSWORD}
|
||||
- N8N_BASIC_AUTH_ACTIVE=true
|
||||
- N8N_BASIC_AUTH_USER=${N8N_USER}
|
||||
- N8N_BASIC_AUTH_PASSWORD=${N8N_BASIC_AUTH_PASSWORD}
|
||||
- WEBHOOK_URL=https://${N8N_HOST}
|
||||
- N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
|
||||
volumes:
|
||||
- /path/to/n8n/data:/home/node/
|
||||
ports:
|
||||
- ${N8N_PORT}:5678
|
||||
depends_on:
|
||||
- postgres
|
||||
networks:
|
||||
- n8n-net
|
||||
|
||||
postgres:
|
||||
image: postgres:latest
|
||||
container_name: n8n-postgres
|
||||
restart: unless-stopped
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
environment:
|
||||
POSTGRES_USER: n8n
|
||||
POSTGRES_PASSWORD: ${N8N_POSTGRES_PASSWORD}
|
||||
POSTGRES_DB: n8n
|
||||
volumes:
|
||||
- /path/to/n8n/postgres_data:/var/lib/postgresql
|
||||
ports:
|
||||
- "127.0.0.1:${POSTGRES_PORT}:5432"
|
||||
networks:
|
||||
- n8n-net
|
||||
|
||||
adminer:
|
||||
image: adminer:latest
|
||||
container_name: adminer
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "127.0.0.1:${ADMINER_PORT}:8080"
|
||||
networks:
|
||||
- n8n-net
|
||||
|
||||
networks:
|
||||
n8n-net:
|
||||
external: true
|
||||
@@ -0,0 +1,82 @@
|
||||
name: nextcloud
|
||||
services:
|
||||
db:
|
||||
image: lscr.io/linuxserver/mariadb:latest
|
||||
container_name: nextcloud_db
|
||||
volumes:
|
||||
- /path/to/nextcloud/data/db:/var/lib/mysql
|
||||
- /path/to/nextcloud/data/db-config:/config
|
||||
environment:
|
||||
- MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
|
||||
- MYSQL_DATABASE=${MYSQL_DATABASE}
|
||||
- MYSQL_USER=${MYSQL_USER}
|
||||
- MYSQL_PASSWORD=${MYSQL_PASSWORD}
|
||||
- TZ=${TZ}
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- nextcloud-net
|
||||
|
||||
redis:
|
||||
image: redis:alpine
|
||||
container_name: nextcloud_redis
|
||||
environment:
|
||||
- "TZ"
|
||||
volumes:
|
||||
- /path/to/nextcloud/data/redis:/data
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- nextcloud-net
|
||||
|
||||
# Main Nextcloud container (custom image with SMB + cert trust)
|
||||
nextcloud:
|
||||
build:
|
||||
context: ./nextcloud
|
||||
dockerfile: Dockerfile
|
||||
container_name: nextcloud
|
||||
depends_on:
|
||||
- db
|
||||
- redis
|
||||
volumes:
|
||||
- /path/to/nextcloud/html:/var/www/html
|
||||
- /path/to/nextcloud/html/data:/var/www/html/data
|
||||
- /path/to/nextcloud/html/config:/var/www/html/config
|
||||
- /path/to/nextcloud/html/custom_apps:/var/www/html/custom_apps
|
||||
- /path/to/nextcloud/html/themes:/var/www/html/themes
|
||||
env_file:
|
||||
- ".env"
|
||||
environment:
|
||||
- "TZ"
|
||||
- "DB_TYPE=mysql"
|
||||
- "DB_HOST=db"
|
||||
- "DB_NAME=${MYSQL_DATABASE}"
|
||||
- "DB_USER=${MYSQL_USER}"
|
||||
- "DB_PASSWORD=${MYSQL_PASSWORD}"
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- nextcloud-net
|
||||
- caddy-net
|
||||
|
||||
euro-office:
|
||||
build:
|
||||
context: ./euro-office
|
||||
dockerfile: Dockerfile
|
||||
container_name: nextcloud_euro-office
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "8080:80"
|
||||
environment:
|
||||
- JWT_ENABLED=true
|
||||
- JWT_SECRET=${ONLYOFFICE_JWT_SECRET}
|
||||
volumes:
|
||||
- /path/to/nextcloud/euro-office/data:/var/lib/euro-office/documentserver
|
||||
- /path/to/nextcloud/euro-office/logs:/var/log/euro-office/documentserver
|
||||
- /path/to/nextcloud/euro-office/config:/etc/euro-office/documentserver
|
||||
networks:
|
||||
- nextcloud-net
|
||||
- caddy-net
|
||||
|
||||
networks:
|
||||
nextcloud-net:
|
||||
external: true
|
||||
caddy-net:
|
||||
external: true
|
||||
@@ -0,0 +1,41 @@
|
||||
services:
|
||||
nocodb:
|
||||
image: nocodb/nocodb:latest
|
||||
container_name: nocodb-content
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${HTTP_PORT}:8080"
|
||||
depends_on:
|
||||
nocodb_db:
|
||||
condition: service_healthy
|
||||
env_file:
|
||||
- .env.secrets # NC_DB, NC_AUTH_JWT_SECRET — never committed
|
||||
volumes:
|
||||
- /path/to/nocodb-content/nc_data:/usr/app/data
|
||||
networks:
|
||||
- nocodb-content-net
|
||||
|
||||
nocodb_db:
|
||||
image: postgres:18-alpine
|
||||
container_name: nocodb-content-postgres
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- .env.secrets # POSTGRES_PASSWORD — never committed
|
||||
environment:
|
||||
TZ: ${TZ}
|
||||
POSTGRES_DB: ${POSTGRES_DB}
|
||||
POSTGRES_USER: ${POSTGRES_USER}
|
||||
volumes:
|
||||
- /path/to/nocodb-content/db_data:/var/lib/postgresql
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 20s
|
||||
networks:
|
||||
- nocodb-content-net
|
||||
|
||||
networks:
|
||||
nocodb-content-net:
|
||||
external: true
|
||||
@@ -0,0 +1,76 @@
|
||||
services:
|
||||
broker:
|
||||
image: docker.io/library/redis:7
|
||||
container_name: paperless-redis
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- /path/to/paperless/redisdata:/data
|
||||
networks:
|
||||
- paperless-net
|
||||
|
||||
db:
|
||||
image: docker.io/library/postgres:15
|
||||
container_name: paperless-postgres
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- /path/to/paperless/pgdata:/var/lib/postgresql/data
|
||||
environment:
|
||||
POSTGRES_DB: ${POSTGRES_DB}
|
||||
POSTGRES_USER: ${POSTGRES_USER}
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
networks:
|
||||
- paperless-net
|
||||
|
||||
webserver:
|
||||
image: ghcr.io/paperless-ngx/paperless-ngx:latest
|
||||
container_name: paperless
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- db
|
||||
- broker
|
||||
- gotenberg
|
||||
- tika
|
||||
ports:
|
||||
- "${HTTP_PORT}:8000"
|
||||
volumes:
|
||||
- /path/to/paperless/data:/usr/src/paperless/data
|
||||
- /path/to/paperless/media:/usr/src/paperless/media
|
||||
- /path/to/paperless/export:/usr/src/paperless/export
|
||||
- /path/to/paperless/consume:/usr/src/paperless/consume
|
||||
env_file: .env
|
||||
environment:
|
||||
PAPERLESS_REDIS: redis://broker:6379
|
||||
PAPERLESS_DBHOST: db
|
||||
PAPERLESS_DBPASS: ${PAPERLESS_DBPASS}
|
||||
PAPERLESS_TIKA_ENABLED: 1
|
||||
PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
|
||||
PAPERLESS_TIKA_ENDPOINT: http://tika:9998
|
||||
PAPERLESS_URL: ${PAPERLESS_URL}
|
||||
PAPERLESS_ADMIN_USER: ${PAPERLESS_ADMIN_USER}
|
||||
PAPERLESS_ADMIN_PASSWORD: ${PAPERLESS_ADMIN_PASSWORD}
|
||||
networks:
|
||||
- paperless-net
|
||||
|
||||
gotenberg:
|
||||
image: docker.io/gotenberg/gotenberg:7.10
|
||||
container_name: paperless-gotenberg
|
||||
restart: unless-stopped
|
||||
# The gotenberg chromium route is used to convert .eml files. We do not
|
||||
# want to allow external content like tracking pixels or even javascript.
|
||||
command:
|
||||
- "gotenberg"
|
||||
- "--chromium-disable-javascript=true"
|
||||
- "--chromium-allow-list=file:///tmp/.*"
|
||||
networks:
|
||||
- paperless-net
|
||||
|
||||
tika:
|
||||
image: docker.io/apache/tika:latest
|
||||
container_name: paperless-tika
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- paperless-net
|
||||
|
||||
networks:
|
||||
paperless-net:
|
||||
external: true
|
||||
@@ -0,0 +1,157 @@
|
||||
services:
|
||||
postiz:
|
||||
image: ghcr.io/gitroomhq/postiz-app:latest
|
||||
container_name: postiz
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- .env.secrets # JWT_SECRET, DATABASE_URL, social-platform client IDs/secrets — never committed
|
||||
environment:
|
||||
TZ: ${TZ}
|
||||
MAIN_URL: ${MAIN_URL}
|
||||
FRONTEND_URL: ${FRONTEND_URL}
|
||||
NEXT_PUBLIC_BACKEND_URL: ${NEXT_PUBLIC_BACKEND_URL}
|
||||
BACKEND_INTERNAL_URL: ${BACKEND_INTERNAL_URL}
|
||||
REDIS_URL: redis://postiz-redis:6379
|
||||
TEMPORAL_ADDRESS: temporal:7233
|
||||
IS_GENERAL: "true"
|
||||
DISABLE_REGISTRATION: ${DISABLE_REGISTRATION}
|
||||
STORAGE_PROVIDER: ${STORAGE_PROVIDER}
|
||||
UPLOAD_DIRECTORY: ${UPLOAD_DIRECTORY}
|
||||
NEXT_PUBLIC_UPLOAD_DIRECTORY: ${UPLOAD_DIRECTORY}
|
||||
MASTODON_URL: ${MASTODON_URL}
|
||||
volumes:
|
||||
- /path/to/postiz/config:/config/
|
||||
- /path/to/postiz/uploads:/uploads/
|
||||
ports:
|
||||
- "${HTTP_PORT}:5000"
|
||||
depends_on:
|
||||
postiz-postgres:
|
||||
condition: service_healthy
|
||||
postiz-redis:
|
||||
condition: service_healthy
|
||||
networks:
|
||||
- postiz-net
|
||||
|
||||
postiz-postgres:
|
||||
image: postgres:18-alpine
|
||||
container_name: postiz-postgres
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- .env.secrets # POSTGRES_PASSWORD — never committed
|
||||
environment:
|
||||
TZ: ${TZ}
|
||||
POSTGRES_USER: ${POSTIZ_POSTGRES_USER}
|
||||
POSTGRES_DB: ${POSTIZ_POSTGRES_DB}
|
||||
volumes:
|
||||
- /path/to/postiz/postgres_data:/var/lib/postgresql
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U ${POSTIZ_POSTGRES_USER} -d ${POSTIZ_POSTGRES_DB}"]
|
||||
interval: 10s
|
||||
timeout: 3s
|
||||
retries: 3
|
||||
networks:
|
||||
- postiz-net
|
||||
|
||||
postiz-redis:
|
||||
image: valkey/valkey:9.0-alpine
|
||||
container_name: postiz-redis
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "valkey-cli ping"]
|
||||
interval: 10s
|
||||
timeout: 3s
|
||||
retries: 3
|
||||
volumes:
|
||||
- /path/to/postiz/redis_data:/data
|
||||
networks:
|
||||
- postiz-net
|
||||
|
||||
# Temporal stack: required since Postiz v2.12.0 for all background jobs
|
||||
# (scheduled posting, OAuth token refresh, email digests) — not optional,
|
||||
# a real surprise in this app's actual deployment footprint.
|
||||
temporal-elasticsearch:
|
||||
image: elasticsearch:7.17.27
|
||||
container_name: postiz-temporal-elasticsearch
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- cluster.routing.allocation.disk.threshold_enabled=true
|
||||
- cluster.routing.allocation.disk.watermark.low=512mb
|
||||
- cluster.routing.allocation.disk.watermark.high=256mb
|
||||
- cluster.routing.allocation.disk.watermark.flood_stage=128mb
|
||||
- discovery.type=single-node
|
||||
- ES_JAVA_OPTS=-Xms256m -Xmx256m
|
||||
- xpack.security.enabled=false
|
||||
volumes:
|
||||
- /path/to/postiz/temporal_elasticsearch_data:/usr/share/elasticsearch/data
|
||||
networks:
|
||||
- postiz-net
|
||||
|
||||
temporal-postgres:
|
||||
image: postgres:18-alpine
|
||||
container_name: postiz-temporal-postgres
|
||||
restart: unless-stopped
|
||||
env_file:
|
||||
- .env.secrets.temporal-postgres # POSTGRES_PASSWORD — never committed; separate file, avoids a collision with postiz-postgres
|
||||
environment:
|
||||
TZ: ${TZ}
|
||||
POSTGRES_USER: ${TEMPORAL_POSTGRES_USER}
|
||||
volumes:
|
||||
- /path/to/postiz/temporal_postgres_data:/var/lib/postgresql
|
||||
networks:
|
||||
- postiz-net
|
||||
|
||||
temporal:
|
||||
image: temporalio/auto-setup:1.28.1
|
||||
container_name: postiz-temporal
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- temporal-postgres
|
||||
- temporal-elasticsearch
|
||||
env_file:
|
||||
- .env.secrets # POSTGRES_PWD — never committed
|
||||
environment:
|
||||
- DB=postgres12
|
||||
- DB_PORT=5432
|
||||
- POSTGRES_USER=${TEMPORAL_POSTGRES_USER}
|
||||
- POSTGRES_SEEDS=temporal-postgres
|
||||
- DYNAMIC_CONFIG_FILE_PATH=config/dynamicconfig/development-sql.yaml
|
||||
- ENABLE_ES=true
|
||||
- ES_SEEDS=temporal-elasticsearch
|
||||
- ES_VERSION=v7
|
||||
- TEMPORAL_NAMESPACE=default
|
||||
ports:
|
||||
- "127.0.0.1:${TEMPORAL_PORT}:7233" # gRPC control plane, unauthenticated by default — localhost-only
|
||||
volumes:
|
||||
- ./dynamicconfig:/etc/temporal/config/dynamicconfig
|
||||
networks:
|
||||
- postiz-net
|
||||
|
||||
temporal-admin-tools:
|
||||
image: temporalio/admin-tools:1.28.1-tctl-1.18.4-cli-1.4.1
|
||||
container_name: postiz-temporal-admin-tools
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- TEMPORAL_ADDRESS=temporal:7233
|
||||
- TEMPORAL_CLI_ADDRESS=temporal:7233
|
||||
depends_on:
|
||||
- temporal
|
||||
stdin_open: true
|
||||
tty: true
|
||||
networks:
|
||||
- postiz-net
|
||||
|
||||
temporal-ui:
|
||||
image: temporalio/ui:2.34.0
|
||||
container_name: postiz-temporal-ui
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- TEMPORAL_ADDRESS=temporal:7233
|
||||
- TEMPORAL_CORS_ORIGINS=http://127.0.0.1:${TEMPORAL_UI_PORT}
|
||||
ports:
|
||||
- "127.0.0.1:${TEMPORAL_UI_PORT}:8080" # unauthenticated by default — localhost-only, SSH-tunnel to debug
|
||||
networks:
|
||||
- postiz-net
|
||||
|
||||
networks:
|
||||
postiz-net:
|
||||
external: true
|
||||
@@ -0,0 +1,20 @@
|
||||
services:
|
||||
trilium-sync:
|
||||
image: triliumnext/trilium:latest
|
||||
container_name: trilium-sync
|
||||
environment:
|
||||
- PUID=${PUID}
|
||||
- PGID=${PGID}
|
||||
- TZ=${TZ}
|
||||
- TRILIUM_SYNC_SERVER=true
|
||||
volumes:
|
||||
- /path/to/trilium-sync:/home/node/trilium-data
|
||||
ports:
|
||||
- ${HTTP_PORT}:8080
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- trillium-net
|
||||
|
||||
networks:
|
||||
trillium-net:
|
||||
external: true
|
||||
Reference in new issue
Block a user