Restructure compose mirror: stacks/ grouped by purpose, not by host

Replaces rocky-docker-lxc/, caddy-vm/, monitoring-vm/, and automation/ with a single stacks/ tree grouped by function (identity-and-security, platform, media, productivity, dev-tools) - 55 stacks total, every one a real directory in the private repos today. Resolves all outstanding drift: adds Wazuh (previously entirely missing), Firefly III and Postiz (never mirrored), the internal-zone Caddy instance and the Cron Scheduler's separate NocoDB instance (both previously conflated with their counterparts under one shared folder); renames Calibre-Web to calibre-web-automated and splits Kodi-MariaDB into kodi + mariadb-latest to match what the private repos actually run now; drops the decommissioned NetBox stack. Also removes automation/iac/old-content/ and automation/ansible/old-playbooks/ in the same pass - both folders were entirely stale content describing a superseded architecture (GitLab instead of Gitea, HAProxy+mTLS SSO instead of the current Caddy+Authentik setup), now replaced by docs/iac-pipeline.md.
2026-08-22 07:44:11 +03:00
1 parent 20f39f3b6d
commit bebcd714af
@@ -0,0 +1,19 @@
+services:
+  actual_server:
+    image: actualbudget/actual-server:latest
+    container_name: actual
+    ports:
+      - ${HTTP_PORT}:5006
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    volumes:
+      - /path/to/actual/actual-data:/data
+    restart: unless-stopped
+    networks:
+      - actual-net
+
+networks:
+  actual-net:
+    external: true
@@ -0,0 +1,63 @@
+---
+services:
+  bookstack:
+    image: lscr.io/linuxserver/bookstack:latest
+    container_name: bookstack
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - APP_URL=https://subdomain.example.com
+      - DB_HOST=bookstack_db
+      - DB_PORT=${DB_PORT}
+      - DB_USER=${DB_USER}
+      - DB_PASS=${DB_PASS}
+      - DB_DATABASE=${DB_DATABASE}
+      - APP_DEFAULT_DARK_MODE=true
+    volumes:
+      - /path/to/bookstack/bookstack_app_data:/config
+    ports:
+      - ${HTTP_PORT}:80
+    restart: unless-stopped
+    depends_on:
+      bookstack_db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:80/ || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - bookstack-net
+
+  bookstack_db:
+    image: lscr.io/linuxserver/mariadb:latest
+    container_name: bookstack_db
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
+      - MYSQL_DATABASE=${DB_DATABASE}
+      - MYSQL_USER=${DB_USER}
+      - MYSQL_PASSWORD=${DB_PASSWORD}
+    volumes:
+      - /path/to/bookstack/bookstack_db_data:/config
+    restart: unless-stopped
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "mysqladmin ping -h localhost -u${DB_USER} -p${DB_PASSWORD} || exit 1",
+        ]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+    networks:
+      - bookstack-net
+
+networks:
+  bookstack-net:
+    external: true
@@ -0,0 +1,49 @@
+services:
+  fireflyiii:
+    image: fireflyiii/core:latest
+    container_name: fireflyiii_app
+    restart: unless-stopped
+    depends_on:
+      - mariadb
+    env_file:
+      - .env.secrets   # APP_KEY, DB_PASSWORD — never committed
+    environment:
+      - DB_CONNECTION=mysql
+      - DB_HOST=mariadb
+      - DB_PORT=3306
+      - DB_DATABASE=fireflyiii
+      - DB_USERNAME=fireflyuser
+      - TZ=${TZ}
+      - TRUSTED_PROXIES=**
+      - APP_ENV=production
+      - AUTHENTICATION_GUARD=${AUTHENTICATION_GUARD}
+      - AUTHENTICATION_GUARD_HEADER=${AUTHENTICATION_GUARD_HEADER}
+    volumes:
+      - /path/to/fireflyiii/firefly_iii_upload:/var/www/html/storage/upload
+    ports:
+      - "${HTTP_PORT}:8080"
+    networks:
+      - firefly-net
+
+  mariadb:
+    image: mariadb:latest
+    container_name: fireflyiii_db
+    restart: unless-stopped
+    env_file:
+      - .env.secrets   # MYSQL_PASSWORD, MYSQL_ROOT_PASSWORD — never committed
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - MYSQL_DATABASE=fireflyiii
+      - MYSQL_USER=fireflyuser
+    volumes:
+      - /path/to/fireflyiii/firefly_iii_db:/config
+    ports:
+      - "${DB_PORT}:3306"
+    networks:
+      - firefly-net
+
+networks:
+  firefly-net:
+    external: true
@@ -0,0 +1,82 @@
+services:
+  ghost:
+    image: ghost:latest
+    container_name: ghost_blog
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT}:2368"
+    depends_on:
+      - ghost_db
+    environment:
+      NODE_ENV: production
+      TZ: ${TZ}
+      # Ghost URL
+      url: ${GHOST_URL}
+      # SMTP
+      mail__transport: ${SMTP_TRANSPORT}
+      mail__options__host: ${SMTP_HOST}
+      mail__options__port: ${SMTP_PORT}
+      mail__options__secure: "false"
+      mail__options__auth__user: ${SMTP_USER}
+      mail__options__auth__pass: ${SMTP_PASSWORD}
+      # Database
+      database__client: mysql
+      database__connection__host: ${DB_HOST}
+      database__connection__user: ${DB_USER}
+      database__connection__password: ${DB_PASSWORD}
+      database__connection__database: ${DB_NAME}
+    volumes:
+      - /path/to/ghost/content:/var/lib/ghost/content
+    networks:
+      - blog-net
+
+  ghost_db:
+    image: mysql:8
+    container_name: ghost_mysql
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
+      MYSQL_DATABASE: ${DB_NAME}
+      MYSQL_USER: ${DB_USER}
+      MYSQL_PASSWORD: ${DB_PASSWORD}
+    volumes:
+      - /path/to/ghost/db_data:/var/lib/mysql
+      - /path/to/ghost/init:/docker-entrypoint-initdb.d:ro
+    networks:
+      - blog-net
+
+  umami:
+    image: ghcr.io/umami-software/umami:postgresql-latest
+    container_name: umami_analytics
+    restart: unless-stopped
+    ports:
+      - "${UMAMI_PORT}:3000"
+    depends_on:
+      - umami-db
+    environment:
+      TZ: ${TZ}
+      DATABASE_URL: postgresql://${UMAMI_DB_USER}:${UMAMI_DB_PASSWORD}@umami-db:5432/${UMAMI_DB_NAME}
+      DATABASE_TYPE: postgresql
+      APP_SECRET: ${UMAMI_APP_SECRET}
+      IGNORE_IP: ${UMAMI_IGNORE_IP}
+    networks:
+      - blog-net
+
+  umami-db:
+    image: postgres:15-alpine
+    container_name: umami_postgres
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+      POSTGRES_DB: ${UMAMI_DB_NAME}
+      POSTGRES_USER: ${UMAMI_DB_USER}
+      POSTGRES_PASSWORD: ${UMAMI_DB_PASSWORD}
+    volumes:
+      - /path/to/umami/db_data:/var/lib/postgresql/data
+    networks:
+      - blog-net
+
+networks:
+  blog-net:
+    external: true
@@ -0,0 +1,56 @@
+services:
+  homeassistant:
+    container_name: home-assistant
+    image: ghcr.io/home-assistant/home-assistant:stable
+    volumes:
+      - /path/to/home-assistant/config:/config
+      - /etc/localtime:/etc/localtime:ro
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT}:8123"
+    depends_on:
+      homeassistant-db:
+        condition: service_healthy
+    privileged: true
+    healthcheck:
+      test: [
+          "CMD-SHELL",
+          "curl -fsS -o /dev/null -w '%{http_code}' http://127.0.0.1:8123/api/
+          | grep -q 401",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+      start_period: 90s
+    networks:
+      - home-assistant-net
+
+  homeassistant-db:
+    container_name: homeassistant-db
+    image: postgres:latest
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --locale=en_US.UTF-8
+    volumes:
+      - /path/to/home-assistant/schemas:/var/lib/postgresql
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+    networks:
+      - home-assistant-net
+
+networks:
+  home-assistant-net:
+    external: true
@@ -0,0 +1,56 @@
+services:
+  joplin-db:
+    image: postgres:latest
+    container_name: joplin-db
+    volumes:
+      - /path/to/joplin:/var/lib/postgresql
+    ports:
+      - "${POSTGRES_PORT}:5432"
+    restart: unless-stopped
+    environment:
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_DB=${POSTGRES_DB}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 15s
+    networks:
+      - joplin-net
+
+  joplin:
+    image: joplin/server:latest
+    container_name: joplin-server
+    depends_on:
+      - joplin-db
+    ports:
+      - "${HTTP_PORT}:22300"
+    restart: unless-stopped
+    environment:
+      - APP_PORT=${HTTP_PORT}
+      - APP_BASE_URL=${APP_BASE_URL}
+      - DB_CLIENT=pg
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DATABASE=${POSTGRES_DB}
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PORT=${POSTGRES_PORT}
+      - POSTGRES_HOST=joplin-db
+      - MAILER_ENABLED=1
+      - MAILER_HOST=${MAILER_HOST}
+      - MAILER_PORT=${MAILER_PORT}
+      - MAILER_SECURITY=${MAILER_SECURITY}
+      - MAILER_AUTH_USER=${MAILER_AUTH_USER}
+      - MAILER_AUTH_PASSWORD=${MAILER_AUTH_PASSWORD}
+      - MAILER_NOREPLY_NAME=${MAILER_NOREPLY_NAME}
+      - MAILER_NOREPLY_EMAIL=${MAILER_NOREPLY_EMAIL}
+      - APP_ADMIN_EMAIL=${APP_ADMIN_EMAIL}
+      - APP_ADMIN_PASSWORD=${APP_ADMIN_PASSWORD}
+      - APP_ADMIN_NAME=${APP_ADMIN_NAME}
+    networks:
+      - joplin-net
+
+networks:
+  joplin-net:
+    external: true
@@ -0,0 +1,64 @@
+services:
+  n8n:
+    image: n8nio/n8n:latest
+    container_name: n8n
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - GENERIC_TIMEZONE=${TZ}
+      - N8N_HOST=${N8N_HOST}
+      - N8N_PORT=${N8N_PORT}
+      - N8N_PROTOCOL=https
+      - DB_TYPE=postgresdb
+      - DB_POSTGRESDB_HOST=postgres
+      - DB_POSTGRESDB_PORT=5432
+      - DB_POSTGRESDB_DATABASE=n8n
+      - DB_POSTGRESDB_USER=n8n
+      - DB_POSTGRESDB_PASSWORD=${N8N_POSTGRES_PASSWORD}
+      - N8N_BASIC_AUTH_ACTIVE=true
+      - N8N_BASIC_AUTH_USER=${N8N_USER}
+      - N8N_BASIC_AUTH_PASSWORD=${N8N_BASIC_AUTH_PASSWORD}
+      - WEBHOOK_URL=https://${N8N_HOST}
+      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
+    volumes:
+      - /path/to/n8n/data:/home/node/
+    ports:
+      - ${N8N_PORT}:5678
+    depends_on:
+      - postgres
+    networks:
+      - n8n-net
+
+  postgres:
+    image: postgres:latest
+    container_name: n8n-postgres
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      POSTGRES_USER: n8n
+      POSTGRES_PASSWORD: ${N8N_POSTGRES_PASSWORD}
+      POSTGRES_DB: n8n
+    volumes:
+      - /path/to/n8n/postgres_data:/var/lib/postgresql
+    ports:
+      - "127.0.0.1:${POSTGRES_PORT}:5432"
+    networks:
+      - n8n-net
+
+  adminer:
+    image: adminer:latest
+    container_name: adminer
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:${ADMINER_PORT}:8080"
+    networks:
+      - n8n-net
+
+networks:
+  n8n-net:
+    external: true
@@ -0,0 +1,82 @@
+name: nextcloud
+services:
+  db:
+    image: lscr.io/linuxserver/mariadb:latest
+    container_name: nextcloud_db
+    volumes:
+      - /path/to/nextcloud/data/db:/var/lib/mysql
+      - /path/to/nextcloud/data/db-config:/config
+    environment:
+      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
+      - MYSQL_DATABASE=${MYSQL_DATABASE}
+      - MYSQL_USER=${MYSQL_USER}
+      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
+      - TZ=${TZ}
+    restart: unless-stopped
+    networks:
+      - nextcloud-net
+
+  redis:
+    image: redis:alpine
+    container_name: nextcloud_redis
+    environment:
+      - "TZ"
+    volumes:
+      - /path/to/nextcloud/data/redis:/data
+    restart: unless-stopped
+    networks:
+      - nextcloud-net
+
+  # Main Nextcloud container (custom image with SMB + cert trust)
+  nextcloud:
+    build:
+      context: ./nextcloud
+      dockerfile: Dockerfile
+    container_name: nextcloud
+    depends_on:
+      - db
+      - redis
+    volumes:
+      - /path/to/nextcloud/html:/var/www/html
+      - /path/to/nextcloud/html/data:/var/www/html/data
+      - /path/to/nextcloud/html/config:/var/www/html/config
+      - /path/to/nextcloud/html/custom_apps:/var/www/html/custom_apps
+      - /path/to/nextcloud/html/themes:/var/www/html/themes
+    env_file:
+      - ".env"
+    environment:
+      - "TZ"
+      - "DB_TYPE=mysql"
+      - "DB_HOST=db"
+      - "DB_NAME=${MYSQL_DATABASE}"
+      - "DB_USER=${MYSQL_USER}"
+      - "DB_PASSWORD=${MYSQL_PASSWORD}"
+    restart: unless-stopped
+    networks:
+      - nextcloud-net
+      - caddy-net
+
+  euro-office:
+    build:
+      context: ./euro-office
+      dockerfile: Dockerfile
+    container_name: nextcloud_euro-office
+    restart: unless-stopped
+    ports:
+      - "8080:80"
+    environment:
+      - JWT_ENABLED=true
+      - JWT_SECRET=${ONLYOFFICE_JWT_SECRET}
+    volumes:
+      - /path/to/nextcloud/euro-office/data:/var/lib/euro-office/documentserver
+      - /path/to/nextcloud/euro-office/logs:/var/log/euro-office/documentserver
+      - /path/to/nextcloud/euro-office/config:/etc/euro-office/documentserver
+    networks:
+      - nextcloud-net
+      - caddy-net
+
+networks:
+  nextcloud-net:
+    external: true
+  caddy-net:
+    external: true
@@ -0,0 +1,41 @@
+services:
+  nocodb:
+    image: nocodb/nocodb:latest
+    container_name: nocodb-content
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT}:8080"
+    depends_on:
+      nocodb_db:
+        condition: service_healthy
+    env_file:
+      - .env.secrets   # NC_DB, NC_AUTH_JWT_SECRET — never committed
+    volumes:
+      - /path/to/nocodb-content/nc_data:/usr/app/data
+    networks:
+      - nocodb-content-net
+
+  nocodb_db:
+    image: postgres:18-alpine
+    container_name: nocodb-content-postgres
+    restart: unless-stopped
+    env_file:
+      - .env.secrets   # POSTGRES_PASSWORD — never committed
+    environment:
+      TZ: ${TZ}
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+    volumes:
+      - /path/to/nocodb-content/db_data:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+    networks:
+      - nocodb-content-net
+
+networks:
+  nocodb-content-net:
+    external: true
@@ -0,0 +1,76 @@
+services:
+  broker:
+    image: docker.io/library/redis:7
+    container_name: paperless-redis
+    restart: unless-stopped
+    volumes:
+      - /path/to/paperless/redisdata:/data
+    networks:
+      - paperless-net
+
+  db:
+    image: docker.io/library/postgres:15
+    container_name: paperless-postgres
+    restart: unless-stopped
+    volumes:
+      - /path/to/paperless/pgdata:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    networks:
+      - paperless-net
+
+  webserver:
+    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    container_name: paperless
+    restart: unless-stopped
+    depends_on:
+      - db
+      - broker
+      - gotenberg
+      - tika
+    ports:
+      - "${HTTP_PORT}:8000"
+    volumes:
+      - /path/to/paperless/data:/usr/src/paperless/data
+      - /path/to/paperless/media:/usr/src/paperless/media
+      - /path/to/paperless/export:/usr/src/paperless/export
+      - /path/to/paperless/consume:/usr/src/paperless/consume
+    env_file: .env
+    environment:
+      PAPERLESS_REDIS: redis://broker:6379
+      PAPERLESS_DBHOST: db
+      PAPERLESS_DBPASS: ${PAPERLESS_DBPASS}
+      PAPERLESS_TIKA_ENABLED: 1
+      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
+      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
+      PAPERLESS_URL: ${PAPERLESS_URL}
+      PAPERLESS_ADMIN_USER: ${PAPERLESS_ADMIN_USER}
+      PAPERLESS_ADMIN_PASSWORD: ${PAPERLESS_ADMIN_PASSWORD}
+    networks:
+      - paperless-net
+
+  gotenberg:
+    image: docker.io/gotenberg/gotenberg:7.10
+    container_name: paperless-gotenberg
+    restart: unless-stopped
+    # The gotenberg chromium route is used to convert .eml files. We do not
+    # want to allow external content like tracking pixels or even javascript.
+    command:
+      - "gotenberg"
+      - "--chromium-disable-javascript=true"
+      - "--chromium-allow-list=file:///tmp/.*"
+    networks:
+      - paperless-net
+
+  tika:
+    image: docker.io/apache/tika:latest
+    container_name: paperless-tika
+    restart: unless-stopped
+    networks:
+      - paperless-net
+
+networks:
+  paperless-net:
+    external: true
@@ -0,0 +1,157 @@
+services:
+  postiz:
+    image: ghcr.io/gitroomhq/postiz-app:latest
+    container_name: postiz
+    restart: unless-stopped
+    env_file:
+      - .env.secrets   # JWT_SECRET, DATABASE_URL, social-platform client IDs/secrets — never committed
+    environment:
+      TZ: ${TZ}
+      MAIN_URL: ${MAIN_URL}
+      FRONTEND_URL: ${FRONTEND_URL}
+      NEXT_PUBLIC_BACKEND_URL: ${NEXT_PUBLIC_BACKEND_URL}
+      BACKEND_INTERNAL_URL: ${BACKEND_INTERNAL_URL}
+      REDIS_URL: redis://postiz-redis:6379
+      TEMPORAL_ADDRESS: temporal:7233
+      IS_GENERAL: "true"
+      DISABLE_REGISTRATION: ${DISABLE_REGISTRATION}
+      STORAGE_PROVIDER: ${STORAGE_PROVIDER}
+      UPLOAD_DIRECTORY: ${UPLOAD_DIRECTORY}
+      NEXT_PUBLIC_UPLOAD_DIRECTORY: ${UPLOAD_DIRECTORY}
+      MASTODON_URL: ${MASTODON_URL}
+    volumes:
+      - /path/to/postiz/config:/config/
+      - /path/to/postiz/uploads:/uploads/
+    ports:
+      - "${HTTP_PORT}:5000"
+    depends_on:
+      postiz-postgres:
+        condition: service_healthy
+      postiz-redis:
+        condition: service_healthy
+    networks:
+      - postiz-net
+
+  postiz-postgres:
+    image: postgres:18-alpine
+    container_name: postiz-postgres
+    restart: unless-stopped
+    env_file:
+      - .env.secrets   # POSTGRES_PASSWORD — never committed
+    environment:
+      TZ: ${TZ}
+      POSTGRES_USER: ${POSTIZ_POSTGRES_USER}
+      POSTGRES_DB: ${POSTIZ_POSTGRES_DB}
+    volumes:
+      - /path/to/postiz/postgres_data:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTIZ_POSTGRES_USER} -d ${POSTIZ_POSTGRES_DB}"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+    networks:
+      - postiz-net
+
+  postiz-redis:
+    image: valkey/valkey:9.0-alpine
+    container_name: postiz-redis
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "valkey-cli ping"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+    volumes:
+      - /path/to/postiz/redis_data:/data
+    networks:
+      - postiz-net
+
+  # Temporal stack: required since Postiz v2.12.0 for all background jobs
+  # (scheduled posting, OAuth token refresh, email digests) — not optional,
+  # a real surprise in this app's actual deployment footprint.
+  temporal-elasticsearch:
+    image: elasticsearch:7.17.27
+    container_name: postiz-temporal-elasticsearch
+    restart: unless-stopped
+    environment:
+      - cluster.routing.allocation.disk.threshold_enabled=true
+      - cluster.routing.allocation.disk.watermark.low=512mb
+      - cluster.routing.allocation.disk.watermark.high=256mb
+      - cluster.routing.allocation.disk.watermark.flood_stage=128mb
+      - discovery.type=single-node
+      - ES_JAVA_OPTS=-Xms256m -Xmx256m
+      - xpack.security.enabled=false
+    volumes:
+      - /path/to/postiz/temporal_elasticsearch_data:/usr/share/elasticsearch/data
+    networks:
+      - postiz-net
+
+  temporal-postgres:
+    image: postgres:18-alpine
+    container_name: postiz-temporal-postgres
+    restart: unless-stopped
+    env_file:
+      - .env.secrets.temporal-postgres   # POSTGRES_PASSWORD — never committed; separate file, avoids a collision with postiz-postgres
+    environment:
+      TZ: ${TZ}
+      POSTGRES_USER: ${TEMPORAL_POSTGRES_USER}
+    volumes:
+      - /path/to/postiz/temporal_postgres_data:/var/lib/postgresql
+    networks:
+      - postiz-net
+
+  temporal:
+    image: temporalio/auto-setup:1.28.1
+    container_name: postiz-temporal
+    restart: unless-stopped
+    depends_on:
+      - temporal-postgres
+      - temporal-elasticsearch
+    env_file:
+      - .env.secrets   # POSTGRES_PWD — never committed
+    environment:
+      - DB=postgres12
+      - DB_PORT=5432
+      - POSTGRES_USER=${TEMPORAL_POSTGRES_USER}
+      - POSTGRES_SEEDS=temporal-postgres
+      - DYNAMIC_CONFIG_FILE_PATH=config/dynamicconfig/development-sql.yaml
+      - ENABLE_ES=true
+      - ES_SEEDS=temporal-elasticsearch
+      - ES_VERSION=v7
+      - TEMPORAL_NAMESPACE=default
+    ports:
+      - "127.0.0.1:${TEMPORAL_PORT}:7233"   # gRPC control plane, unauthenticated by default — localhost-only
+    volumes:
+      - ./dynamicconfig:/etc/temporal/config/dynamicconfig
+    networks:
+      - postiz-net
+
+  temporal-admin-tools:
+    image: temporalio/admin-tools:1.28.1-tctl-1.18.4-cli-1.4.1
+    container_name: postiz-temporal-admin-tools
+    restart: unless-stopped
+    environment:
+      - TEMPORAL_ADDRESS=temporal:7233
+      - TEMPORAL_CLI_ADDRESS=temporal:7233
+    depends_on:
+      - temporal
+    stdin_open: true
+    tty: true
+    networks:
+      - postiz-net
+
+  temporal-ui:
+    image: temporalio/ui:2.34.0
+    container_name: postiz-temporal-ui
+    restart: unless-stopped
+    environment:
+      - TEMPORAL_ADDRESS=temporal:7233
+      - TEMPORAL_CORS_ORIGINS=http://127.0.0.1:${TEMPORAL_UI_PORT}
+    ports:
+      - "127.0.0.1:${TEMPORAL_UI_PORT}:8080"   # unauthenticated by default — localhost-only, SSH-tunnel to debug
+    networks:
+      - postiz-net
+
+networks:
+  postiz-net:
+    external: true
@@ -0,0 +1,20 @@
+services: 
+  trilium-sync:
+    image: triliumnext/trilium:latest
+    container_name: trilium-sync
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - TRILIUM_SYNC_SERVER=true
+    volumes:
+      - /path/to/trilium-sync:/home/node/trilium-data
+    ports:
+      - ${HTTP_PORT}:8080
+    restart: unless-stopped
+    networks:
+      - trillium-net   
+
+networks:
+  trillium-net:
+    external: true