Restructure compose mirror: stacks/ grouped by purpose, not by host

Replaces rocky-docker-lxc/, caddy-vm/, monitoring-vm/, and automation/ with a single stacks/ tree grouped by function (identity-and-security, platform, media, productivity, dev-tools) - 55 stacks total, every one a real directory in the private repos today. Resolves all outstanding drift: adds Wazuh (previously entirely missing), Firefly III and Postiz (never mirrored), the internal-zone Caddy instance and the Cron Scheduler's separate NocoDB instance (both previously conflated with their counterparts under one shared folder); renames Calibre-Web to calibre-web-automated and splits Kodi-MariaDB into kodi + mariadb-latest to match what the private repos actually run now; drops the decommissioned NetBox stack. Also removes automation/iac/old-content/ and automation/ansible/old-playbooks/ in the same pass - both folders were entirely stale content describing a superseded architecture (GitLab instead of Gitea, HAProxy+mTLS SSO instead of the current Caddy+Authentik setup), now replaced by docs/iac-pipeline.md.
2026-08-22 07:44:11 +03:00
1 parent 20f39f3b6d
commit bebcd714af
@@ -0,0 +1,19 @@
+services:
+  caddy:
+    image: caddy:latest
+    container_name: caddy-internal
+    restart: unless-stopped
+    ports:
+      - "${HTTPS_PORT}:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+      - /path/to/caddy-internal/caddy_data:/data
+      - /path/to/caddy-internal/caddy_config:/config
+      - /path/to/caddy-internal/logs:/var/log/caddy
+      - ./certs/pki_int_ca.crt:/etc/caddy/certs/pki_int_ca.crt:ro
+    networks:
+      - caddy-net
+
+networks:
+  caddy-net:
+    external: true
@@ -0,0 +1,18 @@
+services:
+  caddy:
+    image: caddy:latest
+    container_name: caddy
+    restart: always
+    ports:
+      - "${HTTPS_PORT}:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+      - /path/to/caddy/caddy_data:/data
+      - /path/to/caddy/caddy_config:/config
+      - /etc/caddy/certs:/etc/caddy/certs
+    networks:
+      - caddy-net
+
+networks:
+  caddy-net:
+    external: true
@@ -0,0 +1,40 @@
+services:
+  dashy:
+    image: lissy93/dashy
+    container_name: dashy
+    volumes:
+      # Conf file
+      - /path/to/dashy/conf.yml:/app/user-data/conf.yml
+      # Icons folder
+      - /path/to/dashy/public/assets:/app/user-data/item-icons/
+      # Pages, one by one
+      - /path/to/dashy/control-plane.yml:/app/user-data/control-plane.yml
+      - /path/to/dashy/observability.yml:/app/user-data/observability.yml
+      - /path/to/dashy/media.yml:/app/user-data/media.yml
+      - /path/to/dashy/automation.yml:/app/user-data/automation.yml
+      - /path/to/dashy/dev-platform-tools.yml:/app/user-data/dev-platform-tools.yml
+      - /path/to/dashy/identity-security.yml:/app/user-data/identity-security.yml
+      - /path/to/dashy/data-knowledge.yml:/app/user-data/data-knowledge.yml
+      - /path/to/dashy/personal-apps.yml:/app/user-data/personal-apps.yml
+    ports:
+      - ${HTTP_PORT}:8080
+    environment:
+      - NODE_ENV=production
+      - PUID=${PUID}
+      - PGID=${PGID}
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "node", "/app/services/healthcheck"]
+      interval: 1m30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    networks:
+      - media-net
+      - caddy-net
+
+networks:
+  media-net:
+    external: true
+  caddy-net:
+    external: true
@@ -0,0 +1,9 @@
+services:
+  docker-socket-proxy-mirror:
+    container_name: docker-socket-proxy-mirror
+    image: tecnativa/docker-socket-proxy
+    restart: "no"
+    # No docker.sock mounted deliberately - this container never actually
+    # proxies anything, it only exists as a self-hosted-registry mirror
+    # build target. Real consumers mount their own socket with their own
+    # distinct permission sets.
@@ -0,0 +1,23 @@
+services:
+  socket-proxy:
+    image: tecnativa/docker-socket-proxy
+    container_name: socket-proxy
+    restart: always
+    environment:
+      - CONTAINERS=1
+      - IMAGES=0
+      - NETWORKS=0
+      - VOLUMES=0
+      - EVENTS=0
+      - POST=0
+      - DELETE=0
+      - INFO=1
+      - EXEC=0
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - docker-proxy-net
+
+networks:
+  docker-proxy-net:
+    external: true
@@ -0,0 +1,49 @@
+services:
+  socket-proxy:
+    image: tecnativa/docker-socket-proxy
+    container_name: dockhand-socket-proxy
+    restart: always
+    environment:
+      # Required for Dockhand core functionality
+      - CONTAINERS=1
+      - IMAGES=1
+      - NETWORKS=1
+      - VOLUMES=1
+      - EVENTS=1
+      - POST=1
+      - DELETE=1
+      # Required for dashboard host info and disk usage
+      - INFO=1
+      - SYSTEM=1
+      # Required for vulnerability scanning
+      - ALLOW_START=1
+      - ALLOW_STOP=1
+      - ALLOW_RESTARTS=1
+      # Optional: enable for terminal access
+      - EXEC=1
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - dockhand-net
+
+  dockhand:
+    image: fnsys/dockhand:latest
+    container_name: dockhand
+    restart: always
+    depends_on:
+      - socket-proxy
+    environment:
+      - PUID=1000
+      - PGID=1000
+    group_add:
+      - "996"
+    ports:
+      - ${HTTP_PORT}:3000
+    volumes:
+      - /path/to/dockhand/dockhand_data:/app/data
+    networks:
+      - dockhand-net
+
+networks:
+  dockhand-net:
+    external: true
@@ -0,0 +1,48 @@
+services:
+  gitea:
+    image: gitea/gitea:latest
+    container_name: gitea
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - GITEA__database__DB_TYPE=postgres
+      - GITEA__database__HOST=gitea-db
+      - GITEA__database__PORT=5432
+      - GITEA__database__NAME=${POSTGRES_DB}
+      - GITEA__database__USER=${POSTGRES_USER}
+      - GITEA__database__PASSWD=${POSTGRES_PASSWORD}
+      - ROOT_URL=${GITEA_ROOT_URL}
+      - DOMAIN=${GITEA_DOMAIN}
+      - GITEA__migrations__ALLOW_LOCALNETWORKS=true
+    restart: always
+    volumes:
+      - /path/to/gitea:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "${HTTP_PORT}:3000"
+      - "${SSH_PORT}:22"
+    depends_on:
+      - gitea-db
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - gitea-net
+
+  gitea-db:
+    image: postgres:latest
+    container_name: gitea-db
+    restart: always
+    environment:
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
+    volumes:
+      - /path/to/gitea/postgres:/var/lib/postgresql
+    networks:
+      - gitea-net
+
+networks:
+  gitea-net:
+    external: true
@@ -0,0 +1,63 @@
+services:
+  loki:
+    image: grafana/loki:latest
+    container_name: loki
+    user: root
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT_loki}:3100"
+    volumes:
+      - /path/to/monitoring-data/loki:/tmp/loki
+      - /path/to/monitoring/config/loki-config.yaml:/etc/loki/loki-config.yaml:ro
+    command: -config.file=/etc/loki/loki-config.yaml
+    networks:
+      - monitoring-net
+
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: prometheus
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT_prometheus}:9090"
+    volumes:
+      - /path/to/monitoring-data/prometheus:/prometheus
+      - /path/to/monitoring/config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--web.enable-remote-write-receiver'
+      - '--storage.tsdb.retention.size=900GB'
+    networks:
+      - monitoring-net
+
+  grafana:
+    image: grafana/grafana:latest
+    container_name: grafana
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT_grafana}:3000"
+    env_file: .env
+    environment:
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
+      - GF_SERVER_ROOT_URL=${GRAFANA_URL}
+      - GF_AUTH_GENERIC_OAUTH_ENABLED=true
+      - GF_AUTH_GENERIC_OAUTH_NAME=authentik
+      - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=${GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
+      - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=${GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
+      - GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
+      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=${AUTHENTIK_URL}/application/o/authorize/
+      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=${AUTHENTIK_URL}/application/o/token/
+      - GF_AUTH_GENERIC_OAUTH_API_URL=${AUTHENTIK_URL}/application/o/userinfo/
+      - GF_AUTH_GENERIC_OAUTH_LOGIN_ATTRIBUTE_PATH=preferred_username
+      - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'authentik Admins') && 'Admin'
+      - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_STRICT=false
+      - GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
+      - GF_AUTH_SIGNOUT_REDIRECT_URL=${AUTHENTIK_URL}/application/o/grafana/end-session/
+      - GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP=true
+    volumes:
+      - /path/to/monitoring/grafana:/var/lib/grafana
+    networks:
+      - monitoring-net
+
+networks:
+  monitoring-net:
+    external: true
@@ -0,0 +1,19 @@
+services:
+  hawser:
+    image: ghcr.io/finsys/hawser:latest
+    container_name: hawser
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT}:2376"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /path/to/hawser/hawser_stacks:/data/stacks
+    environment:
+      - TOKEN=${TOKEN}
+      - TZ=${TZ}
+    networks:
+      - hawser-net
+
+networks:
+  hawser-net:
+    external: true
@@ -0,0 +1,75 @@
+services:
+  postgres:
+    image: postgres:18
+    container_name: kestra-postgres
+    volumes:
+      - /path/to/kestra/postgres-data:/var/lib/postgresql
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+    networks:
+      - kestra-net
+
+  kestra:
+    image: kestra/kestra:latest
+    container_name: kestra
+    pull_policy: always
+    # Kestra, by default, has a termination grace period of 5m. We need to wait a little more to be sure no active tasks are running.
+    stop_grace_period: 6m
+    # Note that this setup with a root user is intended for development purpose.
+    # Our base image runs without root, but the Docker Compose implementation needs root to access the Docker socket
+    user: "root"
+    restart: unless-stopped
+    command: server standalone
+    volumes:
+      - /path/to/kestra/kestra-data:/app/storage
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /tmp/kestra-wd:/tmp/kestra-wd
+      # Mounted read-only so Kestra flows can drive the ansible repo directly
+      - /path/to/repos/ansible:/opt/repos/ansible:ro
+      - /path/to/ansible-venv:/home/user/ansible-venv:ro
+      - /path/to/ssh-keys:/home/user/.ssh:ro
+    environment:
+      KESTRA_CONFIGURATION: |
+        datasources:
+          postgres:
+            url: jdbc:postgresql://postgres:5432/kestra
+            driverClassName: org.postgresql.Driver
+            username: ${POSTGRES_USER}
+            password: ${POSTGRES_PASSWORD}
+        kestra:
+          server:
+            basic-auth:
+              username: ${USERNAME}
+              password: ${PASSWORD}
+          repository:
+            type: postgres
+          storage:
+            type: local
+            local:
+              base-path: "/app/storage"
+          queue:
+            type: postgres
+          tasks:
+            tmp-dir:
+              path: /tmp/kestra-wd/tmp
+          url: http://localhost:8080/
+    ports:
+      - "${HTTP_PORT}:8080"
+      - "8081:8081"
+    depends_on:
+      postgres:
+        condition: service_started
+    networks:
+      - kestra-net
+
+networks:
+  kestra-net:
+    external: true
@@ -0,0 +1,34 @@
+services:
+  kopia:
+    image: kopia/kopia:latest
+    container_name: kopia
+    restart: unless-stopped
+    user: "0:0"
+    hostname: "docker-host"
+    ports:
+      - "${HTTP_PORT}:51515"
+    command:
+      - server
+      - start
+      - --address=0.0.0.0:51515
+      - --tls-cert-file=/tls/kopia.crt
+      - --tls-key-file=/tls/kopia.key
+      - --server-username=${USERNAME}
+      - --server-password=${SECRET_PASSWORD}
+      - --disable-csrf-token-checks
+    environment:
+      TZ: ${TZ}
+      KOPIA_PASSWORD: ${SECRET_PASSWORD}
+    volumes:
+      - /path/to/backup-drive/kopia-repo:/repository # External drive for repository
+      - /path/to/backup-drive/kopia-cache:/cache
+      - /path/to/backup-drive/kopia-config:/app/config
+      - /path/to/backup-drive/kopia-tls:/tls:ro
+      - /path/to/docker-volumes:/apps:ro # Read-only access to docker volumes
+      - /path/to/docker-volumes:/restore
+    networks:
+      - kopia-net
+
+networks:
+  kopia-net:
+    external: true
@@ -0,0 +1,16 @@
+services:
+  mariadb-latest:
+    container_name: mariadb-latest
+    image: mariadb:latest
+    restart: "no"
+    environment:
+      # No real data lives here - this is a thin self-hosted-registry mirror
+      # build target, not a running database. Random root password since
+      # the base image needs some root-auth setting to initialize at all.
+      - MYSQL_RANDOM_ROOT_PASSWORD=true
+    healthcheck:
+      test: ["CMD-SHELL", "mariadb-admin ping -h 127.0.0.1 -u root || exit 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 15s
@@ -0,0 +1,19 @@
+services:
+  mosquitto:
+    image: eclipse-mosquitto:latest
+    container_name: mosquitto
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT}:1883"
+    volumes:
+      - /path/to/mosquitto/config/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
+      - /path/to/mosquitto/config/passwords:/mosquitto/config/passwords:ro
+      - /path/to/mosquitto/config/acl:/mosquitto/config/acl:ro
+      - /path/to/mosquitto/data:/mosquitto/data
+      - /path/to/mosquitto/log:/mosquitto/log
+    networks:
+      - notifier-net
+
+networks:
+  notifier-net:
+    external: true
@@ -0,0 +1,15 @@
+services:
+  mysql-8:
+    container_name: mysql-8
+    image: mysql:8
+    restart: "no"
+    environment:
+      # No real data lives here - a thin self-hosted-registry mirror build
+      # target, not a running database.
+      - MYSQL_RANDOM_ROOT_PASSWORD=yes
+    healthcheck:
+      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 || exit 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
@@ -0,0 +1,42 @@
+services:
+  nocodb:
+    image: nocodb/nocodb:latest
+    container_name: nocodb
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT}:8080"
+    depends_on:
+      nocodb_db:
+        condition: service_healthy
+    environment:
+      TZ: ${TZ}
+      NC_DB: pg://nocodb_db:5432?u=${POSTGRES_USER}&p=${POSTGRES_PASSWORD}&d=${POSTGRES_DB}
+      NC_AUTH_JWT_SECRET: ${JWT_SECRET}
+    volumes:
+      - /path/to/nocodb/nc_data:/usr/app/data
+    networks:
+      - nocodb-net
+
+  nocodb_db:
+    image: postgres:16-alpine
+    container_name: nocodb_postgres
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - /path/to/nocodb/db_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+    networks:
+      - nocodb-net
+
+networks:
+  nocodb-net:
+    external: true
@@ -0,0 +1,19 @@
+services:
+  nodered:
+    image: nodered/node-red:latest
+    container_name: nodered
+    restart: unless-stopped
+    environment:
+      - TZ=${TZ}
+      - PUID=${PUID}
+      - PGID=${PGID}
+    ports:
+      - "${HTTP_PORT}:1880"
+    volumes:
+      - /path/to/nodered_data:/data
+    networks:
+      - notifier-net
+
+networks:
+  notifier-net:
+    external: true
@@ -0,0 +1,17 @@
+services:
+  postgres-18-alpine:
+    container_name: postgres-18-alpine
+    image: postgres:18-alpine
+    restart: "no"
+    environment:
+      # No real data lives here - a thin self-hosted-registry mirror build
+      # target so other stacks can pull the result. trust auth is fine
+      # since nothing reaches it but the health check below - Postgres
+      # refuses to start at all without some password/auth method set.
+      - POSTGRES_HOST_AUTH_METHOD=trust
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
@@ -0,0 +1,24 @@
+services:
+  speedtest-tracker:
+    container_name: speedtest-tracker
+    image: lscr.io/linuxserver/speedtest-tracker:latest
+    ports:
+      - "${HTTPS_PORT}:443"
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - APP_KEY=${APP_KEY}
+      - APP_URL=${APP_URL}
+      - DB_CONNECTION=sqlite
+      - SPEEDTEST_SCHEDULE="0 */3 * * *" # Cron schedule, runs every 3 hours.
+      - DISPLAY_TIMEZONE=${DISPLAY_TIMEZONE}
+    volumes:
+      - /path/to/speedtest-tracker/data:/config
+    restart: unless-stopped
+    networks:
+      - speedtest-net
+
+networks:
+  speedtest-net:
+    external: true
@@ -0,0 +1,11 @@
+services:
+  valkey-9.0-alpine:
+    container_name: valkey-9.0-alpine
+    image: valkey/valkey:9.0-alpine
+    restart: "no"
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 10s