Restructure compose mirror: stacks/ grouped by purpose, not by host

Replaces rocky-docker-lxc/, caddy-vm/, monitoring-vm/, and automation/
with a single stacks/ tree grouped by function (identity-and-security,
platform, media, productivity, dev-tools) - 55 stacks total, every one
a real directory in the private repos today.

Resolves all outstanding drift: adds Wazuh (previously entirely
missing), Firefly III and Postiz (never mirrored), the internal-zone
Caddy instance and the Cron Scheduler's separate NocoDB instance
(both previously conflated with their counterparts under one shared
folder); renames Calibre-Web to calibre-web-automated and splits
Kodi-MariaDB into kodi + mariadb-latest to match what the private
repos actually run now; drops the decommissioned NetBox stack.

Also removes automation/iac/old-content/ and
automation/ansible/old-playbooks/ in the same pass - both folders
were entirely stale content describing a superseded architecture
(GitLab instead of Gitea, HAProxy+mTLS SSO instead of the current
Caddy+Authentik setup), now replaced by docs/iac-pipeline.md.

stacks/media/audiobookshelf/docker-compose.yaml

@@ -0,0 +1,27 @@
+services:
+  audiobookshelf:
+    image: ghcr.io/advplyr/audiobookshelf:latest
+    container_name: audiobookshelf
+    user: "${PUID}:${PGID}"
+    environment:
+      - TZ=${TZ}
+    ports:
+      - ${HTTP_PORT}:80
+    volumes:
+      - /path/to/audiobookshelf/config:/config
+      - /path/to/audiobookshelf/metadata:/metadata
+      - /path/to/data/media/audiobooks:/audiobooks
+      - /path/to/data/media/podcasts:/podcasts
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:80/ || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - audiobookshelf-net
+
+networks:
+  audiobookshelf-net:
+    external: true

stacks/media/bazarr/docker-compose.yaml

@@ -0,0 +1,27 @@
+services:
+  bazarr:
+    image: lscr.io/linuxserver/bazarr:latest
+    container_name: bazarr
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+    ports:
+      - ${HTTP_PORT}:6767
+    volumes:
+      - /path/to/bazarr:/config
+      - /path/to/media:/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:6767/ || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/beets/docker-compose.yaml

@@ -0,0 +1,28 @@
+services:
+  beets:
+    image: linuxserver/beets:2.8.0-ls323
+    container_name: beets
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - /path/to/beets:/config
+      - /path/to/media/music:/music
+      - /path/to/media/music_untagged:/music_untagged
+      - /path/to/torrents/beets:/downloads
+    ports:
+      - ${HTTP_PORT}:8337
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8337/ || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/calibre-web-automated/docker-compose.yaml

@@ -0,0 +1,23 @@
+services:
+  calibre-web-automated:
+    image: crocodilestick/calibre-web-automated:latest
+    container_name: calibre-web-automated
+    environment:
+      - TZ=${TZ}
+      - DOCKER_MODS=linuxserver/mods:universal-calibre
+    volumes:
+      - /path/to/calibre-web/config:/config
+      - /path/to/media/calibre:/calibre-library
+      - /path/to/calibre-web/ingest:/cwa-book-ingest
+      # This is an ingest dir, NOT a library one. Anything added here is
+      # automatically added to the library per CWA's own settings, and
+      # removed after processing.
+    ports:
+      - ${HTTP_PORT}:8083
+    restart: unless-stopped
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/calibre/docker-compose.yaml

@@ -0,0 +1,25 @@
+services:
+  calibre:
+    image: lscr.io/linuxserver/calibre:latest
+    container_name: calibre
+    security_opt:
+      - seccomp:unconfined #optional
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - /path/to/calibre:/config
+      - /path/to/books:/books
+    ports:
+      - ${HTTP_PORT}:8080 # Calibre desktop gui.
+    restart: unless-stopped
+    networks:
+      - media-net
+      - notif-net
+
+networks:
+  media-net:
+    external: true
+  notif-net:
+    external: true

stacks/media/emby/docker-compose.yaml

@@ -0,0 +1,19 @@
+services:
+  emby:
+    image: emby/embyserver:latest
+    container_name: emby
+    environment:
+      - TZ=${TZ}
+    volumes:
+      - /path/to/emby:/config
+      - /path/to/media:/data
+      - /path/to/transcodes/emby:/transcode
+    ports:
+      - ${HTTP_PORT}:8096
+    restart: unless-stopped
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/immich/docker-compose.yaml

@@ -0,0 +1,75 @@
+services:
+  immich-server:
+    container_name: immich_server
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    volumes:
+      - /path/to/immich/data:/data
+      - /path/to/immich/upload:/usr/src/app/upload
+      - /path/to/external-library-1:/path/to/external-library-1:ro
+      - /path/to/external-library-2:/path/to/external-library-2:ro
+    env_file:
+      - .env
+    ports:
+      - ${HTTP_PORT}:2283
+    depends_on:
+      - redis
+      - database
+    restart: unless-stopped
+    networks:
+      - immich-net
+
+  immich-machine-learning:
+    container_name: immich_machine_learning
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
+    volumes:
+      - /path/to/immich/model-cache:/cache
+    env_file:
+      - .env
+    restart: unless-stopped
+    networks:
+      - immich-net
+
+  redis:
+    container_name: immich_redis
+    image: redis:6.2-alpine
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - /path/to/immich/redis:/data
+    restart: unless-stopped
+    networks:
+      - immich-net
+
+  database:
+    container_name: immich_postgres
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
+    env_file:
+      - .env
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - POSTGRES_PASSWORD=${DB_PASSWORD}
+      - POSTGRES_USER=${DB_USERNAME}
+      - POSTGRES_DB=${DB_DATABASE_NAME}
+      - POSTGRES_INITDB_ARGS='--data-checksums'
+    volumes:
+      - /path/to/immich/pgdata:/var/lib/postgresql/data
+    shm_size: 128mb
+    restart: unless-stopped
+    networks:
+      - immich-net
+
+networks:
+  immich-net:
+    external: true

stacks/media/jellyfin/docker-compose.yaml

@@ -0,0 +1,32 @@
+services:
+  jellyfin:
+    image: jellyfin/jellyfin:latest
+    container_name: jellyfin
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - /path/to/jellyfin/config:/config
+      - /path/to/jellyfin/cache:/cache
+      - /path/to/media:/data
+      - /path/to/transcodes/jellyfin:/transcodes
+    ports:
+      - ${HTTP_PORT}:8096
+    restart: unless-stopped
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "curl -fsS http://localhost:8096/health | grep -q Healthy",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/kodi/docker-compose.yaml

@@ -0,0 +1,56 @@
+services:
+  mariadb:
+    image: mariadb:latest
+    container_name: kodi-mariadb
+    env_file:
+      - .env.secrets   # MYSQL_ROOT_PASSWORD, MYSQL_PASSWORD — never committed
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - MYSQL_USER=${MYSQL_USER}
+    volumes:
+      - /path/to/kodi-mariadb:/config
+    ports:
+      - ${HTTP_PORT}:3306
+    restart: unless-stopped
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "mysqladmin ping -h 127.0.0.1 -u root -p$$MYSQL_ROOT_PASSWORD --silent",
+        ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - media-net
+
+  # A small custom bridge service, not an off-the-shelf image - polls Kodi's
+  # own API and keeps a separate media-library tool's watch-state in sync.
+  kodi-ma-bridge:
+    image: python:3.13-slim
+    container_name: kodi-ma-bridge
+    restart: unless-stopped
+    working_dir: /app
+    volumes:
+      - ./bridge.py:/app/bridge.py:ro
+      - ./requirements.txt:/app/requirements.txt:ro
+    command: sh -c "pip install --no-cache-dir -r requirements.txt && python bridge.py"
+    env_file:
+      - .env.secrets   # KODI_PASSWORD, MA_API_TOKEN — never committed
+    environment:
+      - TZ=${TZ}
+      - MA_BASE_URL=${MA_BASE_URL}
+      - KODI_USER=${KODI_USER}
+      - KODI_INSTANCES=${KODI_INSTANCES}
+      - POLL_INTERVAL_SECONDS=${POLL_INTERVAL_SECONDS}
+      - REFILL_THRESHOLD=${REFILL_THRESHOLD}
+      - REFILL_COUNT=${REFILL_COUNT}
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/lidarr/docker-compose.yaml

@@ -0,0 +1,23 @@
+services:
+  lidarr:
+    image: ghcr.io/linuxserver/lidarr:latest
+    container_name: lidarr
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+      - DOCKER_MODS=ghcr.io/gilbn/theme.park:lidarr
+      - TP_ADDON=lidarr-alt-calendar
+    ports:
+      - ${HTTP_PORT}:8686
+    volumes:
+      - /path/to/lidarr:/config
+      - /path/to/media:/data
+    restart: unless-stopped
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/music-assistant/docker-compose.yaml

@@ -0,0 +1,27 @@
+services:
+  music-assistant-server:
+    image: ghcr.io/music-assistant/server:latest
+    container_name: music-assistant
+    restart: unless-stopped
+    volumes:
+      - /path/to/music-assistant-server/data:/data/
+      - /path/to/data/media/music:/music:ro
+    ports:
+      - "${PORT1}:8095"
+      - "${PORT2}:3483"
+      - "${PORT3}:5353/udp"
+      - "${PORT4}:21064/tcp"
+      - "${PORT5}:21064/udp"
+    environment:
+      - LOG_LEVEL=info
+    cap_add:
+      - SYS_ADMIN
+      - DAC_READ_SEARCH
+    security_opt:
+      - apparmor:unconfined
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/prowlarr/docker-compose.yaml

@@ -0,0 +1,27 @@
+services:
+  prowlarr:
+    container_name: prowlarr
+    image: lscr.io/linuxserver/prowlarr:latest
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+    ports:
+      - ${HTTP_PORT}:9696
+    volumes:
+      - /path/to/prowlarr:/config
+      - /path/to/media:/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:9696 || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/qbittorrent/docker-compose.yaml

@@ -0,0 +1,30 @@
+services:
+  qbittorrent:
+    image: ghcr.io/hotio/qbittorrent:release-5.1.4
+    container_name: qbittorrent
+    privileged: true
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+    volumes:
+      - /path/to/qbittorrent:/config
+      - /path/to/media/torrents:/data/torrents
+    ports:
+      - ${HTTP_PORT}:8080
+      - ${HTTP_PORT1}:8999
+      - ${HTTP_PORT1}:8999/udp
+    restart: always
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:8080 || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/radarr/docker-compose.yaml

@@ -0,0 +1,31 @@
+services:
+  radarr:
+    image: ghcr.io/linuxserver/radarr:latest
+    container_name: radarr
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+      - DOCKER_MODS=ghcr.io/gilbn/theme.park:radarr
+      - TP_THEME=dark
+      - TP_ADDON=radarr-4k-logo
+      - TP_ADDON=radarr-alt-calendar
+    ports:
+      - ${HTTP_PORT}:7878
+    volumes:
+      - /path/to/radarr:/config
+      - /path/to/media:/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:7878 || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/seerr/docker-compose.yaml

@@ -0,0 +1,27 @@
+services:
+  seerr:
+    image: ghcr.io/seerr-team/seerr:latest
+    init: true
+    container_name: seerr
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - LOG_LEVEL=debug
+    ports:
+      - ${HTTP_PORT}:5055
+    volumes:
+      - /path/to/seerr:/app/config
+    healthcheck:
+      test: wget --no-verbose --tries=1 --spider http://localhost:5055/api/v1/status || exit 1
+      start_period: 20s
+      timeout: 3s
+      interval: 15s
+      retries: 3
+    restart: unless-stopped
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/sonarr/docker-compose.yaml

@@ -0,0 +1,30 @@
+services:
+  sonarr:
+    image: ghcr.io/linuxserver/sonarr:latest
+    container_name: sonarr
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+      - DOCKER_MODS=ghcr.io/gilbn/theme.park:sonarr
+      - TP_THEME=dark
+      - TP_ADDON=sonarr-4k-logo
+    ports:
+      - ${HTTP_PORT}:8989
+    volumes:
+      - /path/to/sonarr:/config
+      - /path/to/media:/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:8989 || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/tdarr/docker-compose.yaml

@@ -0,0 +1,38 @@
+services:
+  tdarr:
+    container_name: tdarr
+    image: ghcr.io/haveagitgat/tdarr:2.82.01
+    restart: unless-stopped
+    ports:
+      - ${HTTP_PORT}:8265
+      - ${HTTP_PORT1}:8266
+      - ${HTTP_PORT2}:8267
+      - ${HTTP_PORT3}:8268
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - UMASK=${UMASK}
+      - serverIP=${serverIP}
+      - serverPort=${serverPort}
+      - webUIPort=${webUIPort}
+      - internalNode=${internalNode}
+      - nodeName=${nodeName}
+    volumes:
+      - /path/to/tdarr/server:/app/server
+      - /path/to/tdarr/configs:/app/configs
+      - /path/to/tdarr/logs:/app/logs
+      - /path/to/media:/media
+      - /path/to/transcodes/transcodes_tdarr:/temp
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://127.0.0.1:8265 || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true

stacks/media/tinymediamanager/docker-compose.yaml

@@ -0,0 +1,25 @@
+services:
+  tinymediamanager:
+    image: tinymediamanager/tinymediamanager:latest
+    container_name: tinymediamanager
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    ports:
+      - ${HTTP_PORT}:4000
+    volumes:
+      - /path/to/tinymediamanager/data:/data
+      - /path/to/tinymediamanager/config/launcher-extra.yml:/app/launcher-extra.yml
+      - /path/to/media/movies:/media/movies
+      - /path/to/media/moviesetsartwork:/media/moviesetsartwork
+      - /path/to/media/tv:/media/tv shows
+      - /path/to/media/documentaries:/media/documentaries
+      - /path/to/media/stand-up comedy:/media/stand-up comedy
+    restart: unless-stopped
+    networks:
+      - media-net
+
+networks:
+  media-net:
+    external: true