init: CT104 untracked stack compose files

2026-05-23 09:47:16 +02:00
parent a98f0e7201
commit 4ff9d3efd7
13 changed files with 903 additions and 1 deletions
@@ -0,0 +1,11 @@
+# Secrets — never commit
+.env
+.env.*
+!.env.example
+*.secret
+*.key
+*.pem
+# Data volumes
+*/data/
+*/postgres_data/
+*/redis_data/
@@ -1,3 +1,19 @@
 # ct104-stacks

-Docker compose files for untracked CT 104 stacks (no .env secrets)
+Docker compose files for untracked stacks on CT 104 (192.168.1.40).
+
+Auto-synced daily at 03:30 from CT 104. .env files are excluded — store secrets in Infisical (CT 112).
+
+| Stack | Port | Notes |
+|---|---|---|
+| vaultwarden | - | Password manager, DB on CT 113 |
+| n8n | 5678 | Workflow automation (https://n8n.nuclide.systems) |
+| immich | 2283 | Photo library (https://immich.nuclide.systems) |
+| karakeep | - | Bookmarks (https://hoarder.nuclide.systems) |
+| arr-stack | 13001-13004 | Media automation |
+| gotify | 10003 | Push notifications |
+| memos | - | Notes (https://memos.nuclide.systems) |
+| paperless-ngx | - | Document inbox (https://paperless.nuclide.systems) |
+| traccar | 13005 | GPS tracking |
+| shared-db | - | Shared Postgres + Garage S3 |
+| monitoring | - | Prometheus scrape configs for CT 109 |
@@ -0,0 +1,187 @@
+services:
+  rdtclient:
+    container_name: rdtclient
+    image: rogerfar/rdtclient:latest
+    restart: always
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 1G
+        reservations:
+          cpus: "0.5"
+          memory: 512M
+    network_mode: container:vpn_gluetun
+    # ports:
+    #   - "13001:6500"
+    volumes:
+      - /mnt/pve/unas/services/arr-stack/rdtclient/config:/data/db
+      - /mnt/pve/unas/media/Torrents:/data/downloads
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "http://localhost:6500"]
+      interval: 30s
+      timeout: 30s
+      start_period: 30s
+      retries: 3
+    labels:
+      - "homepage.group=diagnostic"
+      - "homepage.name=RedDownloader"
+      - "homepage.icon=sh-qbittorrent"
+      - "homepage.href=http://192.168.1.40:13001"
+      - "homepage.instance.internal.href=http://192.168.1.40:13001"
+
+  prowlarr:
+    image: bitlessbyte/prowlarr:latest
+    container_name: prowlarr
+    # network_mode: "service:gluetun"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+      - UMASK=022
+    volumes:
+      - /mnt/pve/unas/services/arr-stack/prowlarr:/config
+    ports:
+      - 13002:9696
+    dns:
+      - 192.168.1.2
+    restart: always
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 512M
+        reservations:
+          cpus: "0.25"
+          memory: 256M
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:9696/ping"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    labels:
+      - "homepage.group=diagnostic"
+      - "homepage.name=Prowlarr"
+      - "homepage.icon=sh-prowlarr"
+      - "homepage.href=http://192.168.1.40:13002"
+      - "homepage.instance.internal.href=http://192.168.1.40:13002"
+      - "homepage.widget.type=prowlarr"
+      - "homepage.widget.url=http://192.168.1.40:13002"
+      - "homepage.widget.key=48fc833aea854e4883e9d0bda3f57652"
+
+  audiobookshelf:
+    image: ghcr.io/advplyr/audiobookshelf:latest
+    container_name: audiobookshelf
+    environment:
+      - TZ=${TZ}
+      - PUID=1000
+      - PGID=1000
+    volumes:
+      - /mnt/pve/unas/services/arr-stack/audiobookshelf:/config
+      - /mnt/pve/unas/media/audiobooks:/audiobooks
+      - /mnt/pve/unas/media/ebooks:/ebooks
+      - /mnt/pve/unas/media/podcasts:/podcasts
+    ports:
+      - 13003:80
+    restart: always
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 2G
+        reservations:
+          cpus: "0.5"
+          memory: 1G
+    healthcheck:
+      test: wget --no-verbose --tries=1 --spider http://localhost || exit 1
+      interval: 5m
+      timeout: 3s
+      start_period: 30s
+      start_interval: 1s
+    labels:
+      - "homepage.group=media"
+      - "homepage.name=Audiobookshelf"
+      - "homepage.icon=sh-audiobookshelf"
+      - "homepage.href=https://abs.nuclide.systems"
+      - "homepage.instance.internal.href=http://192.168.1.40:13003"
+      - "homepage.instance.public.href=https://abs.nuclide.systems"
+    
+  shelfarr:
+    image: ghcr.io/pedro-revez-silva/shelfarr:latest
+    container_name: shelfarr
+    restart: always
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 1G
+        reservations:
+          cpus: "0.5"
+          memory: 512M
+    ports:
+      - "13004:80"
+    labels:
+      - "homepage.group=diagnostic"
+      - "homepage.name=ShelfArr"
+      - "homepage.icon=mdi-bookshelf"
+      - "homepage.href=http://192.168.1.40:13004"
+      - "homepage.instance.internal.href=http://192.168.1.40:13004"
+    volumes:
+      # Persist SQLite databases, Active Storage files, and logs
+      - /mnt/pve/unas/services/arr-stack/shelfarr/storage:/rails/storage
+      # Output directories - audiobooks and ebooks libraries
+      - /mnt/pve/unas/media/audiobooks:/audiobooks
+      - /mnt/pve/unas/media/ebooks:/ebooks
+      # SABnzbd completed downloads folder for post-processing
+      - /mnt/pve/unas/media/Torrents:/downloads
+    environment:
+      - RAILS_ENV=production
+#&&      - RAILS_MASTER_KEY=16213800cbc342d0af2a6042e9979072
+      - SOLID_QUEUE_IN_PUMA=1
+      # Alternatively, if you're using credentials.yml.enc, set SECRET_KEY_BASE directly:
+      # - SECRET_KEY_BASE=${SECRET_KEY_BASE}
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:80/up"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    depends_on:
+      - flaresolverr
+      - prowlarr
+      - rdtclient
+
+  flaresolverr:
+    # DockerHub mirror flaresolverr/flaresolverr:latest
+    image: ghcr.io/flaresolverr/flaresolverr:latest
+    container_name: flaresolverr
+    environment:
+      - LOG_LEVEL=${LOG_LEVEL:-info}
+      - LOG_FILE=${LOG_FILE:-none}
+      - LOG_HTML=${LOG_HTML:-false}
+      - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none}
+      - TZ=Europe/Berlin
+    ports:
+      - "${PORT:-13005}:8191"
+    volumes:
+      - /var/lib/flaresolver:/config
+    restart: always
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 1G
+        reservations:
+          cpus: "0.5"
+          memory: 512M
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:8191/ || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
@@ -0,0 +1,37 @@
+services:
+  gotify:
+    image: gotify/server:latest
+    container_name: gotify
+    restart: unless-stopped
+    ports:
+      - "10003:80"
+    volumes:
+      - ./data:/app/data
+    environment:
+      GOTIFY_DEFAULTUSER_NAME: admin
+      GOTIFY_DEFAULTUSER_PASS: tapirnase
+      TZ: Europe/Berlin
+    networks:
+      - shared_backend
+    labels:
+      homepage.group: productivity
+      homepage.name: Gotify
+      homepage.icon: sh-gotify
+      homepage.href: https://gotify.nuclide.systems
+      homepage.instance.internal.href: http://192.168.1.40:10003
+      homepage.instance.public.href: https://gotify.nuclide.systems
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+          cpus: "0.5"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+networks:
+  shared_backend:
+    external: true
@@ -0,0 +1,168 @@
+#
+# WARNING: Make sure to use the docker-compose.yml of the current release:
+#
+# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+#
+# The compose file on main may not be compatible with the latest release.
+#
+
+name: immich
+services:
+  immich-server:
+    container_name: immich_server
+    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    extends:
+      file: hwaccel.transcoding.yml
+      service: vaapi # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
+    volumes:
+      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
+      - ${UPLOAD_LOCATION}:/usr/src/app/upload
+      - ${THUMB_LOCATION}:/usr/src/app/upload/thumbs
+      - ${ENCODED_VIDEO_LOCATION}:/usr/src/app/upload/encoded-video
+      - ${PROFILE_LOCATION}:/usr/src/app/upload/profile
+      - ${BACKUP_LOCATION}:/usr/src/app/upload/backups
+      - /etc/localtime:/etc/localtime:ro
+    env_file:
+      - .env
+    ports:
+      - 12000:2283
+    depends_on:
+      - redis
+      - database
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "2.0"
+          memory: 4G
+        reservations:
+          cpus: "0.5"
+          memory: 2G
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:2283/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      - "homepage.group=media"
+      - "homepage.name=Immich"
+      - "homepage.icon=sh-immich"
+      - "homepage.href=https://immich.nuclide.systems"
+      - "homepage.instance.internal.href=http://192.168.1.40:12000"
+      - "homepage.instance.public.href=https://immich.nuclide.systems"
+      - "homepage.widget.type=immich"
+      - "homepage.widget.url=https://immich.nuclide.systems"
+      - "homepage.widget.key=2aCV1Ab2Np9CH3cbMLnWwmN3KDX80hWWZznjLWU81Mg"
+
+  immich-machine-learning:
+    container_name: immich_machine_learning
+    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
+    extends:
+      file: hwaccel.ml.yml
+      service: openvino
+    volumes:
+      - model-cache:/cache
+    env_file:
+      - .env
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "2.0"
+          memory: 4G
+        reservations:
+          cpus: "0.5"
+          memory: 2G
+    healthcheck:
+      # ML serves on :3003 and exposes /ping (returns "pong"); /health is 404.
+      # The old :3000/health probe was wrong on both port and path.
+      test: ["CMD-SHELL", "python3 -c \"import urllib.request; urllib.request.urlopen('http://localhost:3003/ping')\""]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+  redis:
+    container_name: immich_redis
+    image: docker.io/valkey/valkey:9@sha256:546304417feac0874c3dd576e0952c6bb8f06bb4093ea0c9ca303c73cf458f63
+    healthcheck:
+      test: redis-cli ping || exit 1
+    restart: unless-stopped
+    shm_size: 256mb
+  database:
+    container_name: immich_postgres
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
+    restart: unless-stopped
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_USER: ${DB_USERNAME}
+      POSTGRES_DB: ${DB_DATABASE_NAME}
+      POSTGRES_INITDB_ARGS: --data-checksums
+      WALG_S3_PREFIX: s3://immich-pg-backup/
+      AWS_ENDPOINT: http://garage:3900
+      AWS_ACCESS_KEY_ID: GK1db4ad9c8e8d3a097fa0824d
+      AWS_SECRET_ACCESS_KEY: c9cd62c53d817e5b89fba6b66cb60850b7b3dca33d58c9b1fdcf1b6544905c64
+      AWS_REGION: us-east-1
+      AWS_S3_FORCE_PATH_STYLE: "true"
+    volumes:
+      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
+      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
+      - /opt/stacks/shared-db/wal-g/wal-g:/usr/local/bin/wal-g:ro
+    shm_size: 1024mb
+    networks:
+      - default
+      - shared_backend
+  power-tools:
+    container_name: immich_power_tools
+    image: ghcr.io/varun-raj/immich-power-tools:latest
+    env_file:
+      - .env
+    restart: unless-stopped
+    depends_on:
+      - immich-server
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 2G
+        reservations:
+          cpus: "0.25"
+          memory: 1G
+    healthcheck:
+      # power-tools (Next.js) binds its container IP only, NOT localhost, and
+      # has no /health route — probe its own hostname at /api/health.
+      test: ["CMD-SHELL", "wget -q -O /dev/null \"http://$(hostname):3000/api/health\" || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      - "homepage.group=diagnostic"
+      - "homepage.name=Power Tools"
+      - "homepage.icon=sh-immich"
+      - "homepage.href=https://immich-tools.nuclide.systems"
+      - "homepage.instance.public.href=https://immich-tools.nuclide.systems"
+#  immich-dynamic-albums:
+#    image: ghcr.io/kvalev/immich-dynamic-albums:${IMMICH_DYNAMIC_ALBUMS_VERSION:-latest}
+#    restart: unless-stopped
+#    volumes:
+#      - /mnt/pve/unas/services/immich/dynamic-albums/dynamic-albums.json:/config/dynamic-albums.json:ro
+#    environment:
+#      IMMICH_URL: http://192.168.1.40:2283/
+#      IMMICH_API_KEY: Se8wLYC6UBeuGqVzXdd4LllsAxPdAgsduFW8RhJXfk
+#      CONFIG_FILE: /config/dynamic-albums.json
+#      SCHEDULE_INTERVAL: 1440 # 1440 minutes, meaning once per day
+#      PYTHONUNBUFFERED: true # ensure stdout is flushed on every print
+#    env_file:
+ #     - .env
+ #   depends_on:
+#      immich-server:
+#        condition: service_healthy
+volumes:
+  model-cache: null
+networks:
+  default:
+    name: immich_default
+  shared_backend:
+    external: true
@@ -0,0 +1,95 @@
+services:
+  web:
+    image: ghcr.io/hoarder-app/hoarder:${HOARDER_VERSION:-release}
+    container_name: karakeep
+    volumes:
+      - /opt/stacks/karakeep/localdata/data:/data
+    ports:
+      - 17001:3000
+    env_file:
+      - .env
+    environment:
+      MEILI_ADDR: http://meilisearch:7700
+      BROWSER_WEB_URL: http://chrome:9222
+      # OPENAI_API_KEY: ...
+      DATA_DIR: /data
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 2G
+        reservations:
+          cpus: "0.5"
+          memory: 1G
+    healthcheck:
+      # karakeep serves health at /api/health (/health is 404)
+      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    restart: unless-stopped
+    labels:
+      - "homepage.group=productivity"
+      - "homepage.name=Karakeep"
+      - "homepage.icon=sh-karakeep"
+      - "homepage.href=https://hoarder.nuclide.systems"
+      - "homepage.instance.internal.href=http://192.168.1.40:17001"
+      - "homepage.instance.public.href=https://hoarder.nuclide.systems"
+      - "homepage.widget.type=karakeep"
+      - "homepage.widget.url=http://192.168.1.40:17001"
+      - "homepage.widget.key=ak2_19817764ad2d3b7bc010_add146880ec70ee560cc8fbf87b46085"
+  chrome:
+    image: gcr.io/zenika-hub/alpine-chrome:123
+    container_name: karakeep_chrome
+    shm_size: '512m'
+    command:
+      - --no-sandbox
+      - --disable-gpu
+      - --disable-dev-shm-usage
+      - --remote-debugging-address=0.0.0.0
+      - --remote-debugging-port=9222
+      - --hide-scrollbars
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 1G
+        reservations:
+          cpus: "0.25"
+          memory: 512M
+    healthcheck:
+      # alpine-chrome has no curl; busybox wget is present. Use 127.0.0.1 NOT
+      # localhost — localhost resolves to ::1 but Chrome binds IPv4 only.
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:9222/json/version"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    restart: unless-stopped
+  meilisearch:
+    image: getmeili/meilisearch:v1.11.1
+    container_name: karakeep_meilisearch
+    env_file:
+      - .env
+    environment:
+      MEILI_NO_ANALYTICS: "true"
+    volumes:
+      #      - meilisearch:/meili_data
+      - /opt/stacks/karakeep/localdata/meili:/meili_data
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 2G
+        reservations:
+          cpus: "0.5"
+          memory: 1G
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:7700/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    restart: unless-stopped
+networks: {}
@@ -0,0 +1,49 @@
+services:
+  memos:
+    image: neosmemo/memos:stable
+    container_name: memos
+    restart: unless-stopped
+    ports:
+      - "17000:5230"
+    volumes:
+      - /mnt/pve/unas/services/memos:/var/opt/memos
+    environment:
+      MEMOS_PORT: 5230
+      MEMOS_DRIVER: postgres
+      MEMOS_DSN: "postgresql://memos:${MEMOS_PG_PASSWORD}@192.168.1.6:5432/memos?sslmode=disable"
+      MEMOS_INSTANCE_URL: https://memos.nuclide.systems
+      MEMOS_S3_ENDPOINT: http://garage:3900
+      MEMOS_S3_REGION: us-east-1
+      MEMOS_S3_ACCESS_KEY: GK55210bd6b56d92891db26fac
+      MEMOS_S3_SECRET_KEY: d0af9e4eb69d7773ffa17950feee27925dbc70eb3efd4ee23a3e1324672c869a
+      MEMOS_S3_BUCKET: memos
+      MEMOS_S3_PATH_STYLE: true
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 512M
+        reservations:
+          cpus: "0.25"
+          memory: 256M
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:5230/api/status"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      - "homepage.group=productivity"
+      - "homepage.name=Memos"
+      - "homepage.icon=sh-memos"
+      - "homepage.href=https://memos.nuclide.systems"
+      - "homepage.instance.internal.href=http://192.168.1.40:17000"
+      - "homepage.instance.public.href=https://memos.nuclide.systems"
+      - "homepage.widget.type=memos"
+      - "homepage.widget.url=http://memos:5230"
+      - "homepage.widget.fields=[\"status\"]"
+
+networks:
+  default:
+    external: true
+    name: shared_backend
@@ -0,0 +1,16 @@
+services:
+  node-exporter:
+    image: prom/node-exporter:latest
+    container_name: node-exporter
+    restart: unless-stopped
+    pid: host
+    network_mode: host
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/rootfs:ro
+    command:
+      - '--path.procfs=/host/proc'
+      - '--path.sysfs=/host/sys'
+      - '--path.rootfs=/rootfs'
+      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
@@ -0,0 +1,66 @@
+services:
+  n8n:
+    image: n8nio/n8n:2.20.11  # pinned 2026-05-19 — unpinned :latest drifted 2.7→2.20.11 and broke the OIDC hooks.js
+    environment:
+        - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}
+        - N8N_PORT=5678
+        - N8N_PROTOCOL=https  
+        - NODE_ENV=production
+        - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/
+        - DB_TYPE=postgresdb
+        - DB_POSTGRESDB_HOST=192.168.1.6
+        - DB_POSTGRESDB_PORT=5432
+        - DB_POSTGRESDB_DATABASE=n8n
+        - DB_POSTGRESDB_USER=n8n
+        - DB_POSTGRESDB_PASSWORD
+        - N8N_DIAGNOSTICS_ENABLED=false
+        - N8N_PERSONALIZATION_ENABLED=false
+        - N8N_ENCRYPTION_KEY
+        - N8N_USER_MANAGEMENT_JWT_SECRET
+        - N8N_SECURE_COOKIE=false
+        # Trust proxy for rate limiting (fixes X-Forwarded-For header issue)
+        - N8N_TRUST_PROXY=true
+        # OIDC bolt-on re-enabled 2026-05-19: paths patched for 2.20.11 pnpm layout
+        - EXTERNAL_HOOK_FILES=/home/node/hooks.js
+        - OIDC_ISSUER_URL=https://id.nuclide.systems
+        - OIDC_CLIENT_ID=33135ad4-a3ed-45d3-938f-639abd2b9663
+        - OIDC_CLIENT_SECRET=aYtWoZ5Wrqxs7kwyI1is1rLY0UATJaW391-3bzNALv0
+        - OIDC_REDIRECT_URI=https://n8n.nuclide.systems/auth/oidc/callback
+        - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js
+        - N8N_ADDITIONAL_NON_UI_ROUTES=auth
+        - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js
+    env_file: .env
+    hostname: n8n
+    container_name: n8n
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 2G
+        reservations:
+          cpus: "0.5"
+          memory: 1G
+    ports:
+    - 16000:5678
+    healthcheck:
+      test: ['CMD-SHELL', 'wget --spider -q http://n8n:5678/healthz || exit 1']
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    volumes:
+      - /opt/stacks/n8n/data:/home/node/.n8n
+      - ./hooks.js:/home/node/hooks.js:ro
+    labels:
+      - "homepage.group=productivity"
+      - "homepage.name=n8n"
+      - "homepage.icon=sh-n8n"
+      - "homepage.href=https://n8n.nuclide.systems"
+      - "homepage.instance.internal.href=http://192.168.1.40:16000"
+      - "homepage.instance.public.href=https://n8n.nuclide.systems"
+      - "homepage.widget.type=n8n"
+      - "homepage.widget.url=http://n8n:5678"
+networks:
+  default:
+    external: true
+    name: shared_backend
@@ -0,0 +1,116 @@
+# Docker Compose file for running paperless from the docker container registry.
+# This file contains everything paperless needs to run.
+# Paperless supports amd64, arm and arm64 hardware.
+#
+# All compose files of paperless configure paperless in the following way:
+#
+# - Paperless is (re)started on system boot, if it was running before shutdown.
+# - Docker volumes for storing data are managed by Docker.
+# - Folders for importing and exporting files are created in the same directory
+#   as this file and mounted to the correct folders inside the container.
+# - Paperless listens on port 8000.
+#
+# In addition to that, this Docker Compose file adds the following optional
+# configurations:
+#
+# - Instead of SQLite (default), PostgreSQL is used as the database server.
+# - Apache Tika and Gotenberg servers are started with paperless and paperless
+#   is configured to use these services. These provide support for consuming
+#   Office documents (Word, Excel, Power Point and their LibreOffice counter-
+#   parts.
+#
+# To install and update paperless with this file, do the following:
+#
+# - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
+#   and '.env' into a folder.
+# - Run 'docker compose pull'.
+# - Run 'docker compose run --rm webserver createsuperuser' to create a user.
+# - Run 'docker compose up -d'.
+#
+# For more extensive installation and update instructions, refer to the
+# documentation.
+
+services:
+  broker:
+    image: docker.io/library/redis:7
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 256M
+        reservations:
+          cpus: "0.25"
+          memory: 128M
+    volumes:
+      - redisdata:/data
+  webserver:
+    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    restart: unless-stopped
+    ports:
+      - "15003:8000"   # internal LAN access only (not proxied externally)
+    deploy:
+      resources:
+        limits:
+          cpus: "2.0"
+          memory: 2G
+        reservations:
+          cpus: "1.0"
+          memory: 1G
+    labels:
+      - "homepage.group=productivity"
+      - "homepage.name=Paperless-ngx"
+      - "homepage.icon=sh-paperless-ngx"
+      - "homepage.href=https://paperless.nuclide.systems"
+      - "homepage.instance.internal.href=http://192.168.1.40:15003"
+      - "homepage.instance.public.href=https://paperless.nuclide.systems"
+      - "homepage.widget.type=paperlessngx"
+      - "homepage.widget.url=http://paperless-ngx-webserver-1:8000"
+    volumes:
+      - data:/usr/src/paperless/data
+      - /mnt/pve/unas/media/documents/public/paperless-ngx/library:/usr/src/paperless/media
+      - /mnt/pve/unas/media/documents/public/paperless-ngx/export:/usr/src/paperless/export
+      - /mnt/pve/unas/media/documents/public/paperless-ngx/consume:/usr/src/paperless/consume
+    env_file: .env
+    environment:
+      PAPERLESS_REDIS: redis://broker:6379
+      PAPERLESS_DBHOST: 192.168.1.6
+      PAPERLESS_TIKA_ENABLED: 1
+      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
+      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
+  gotenberg:
+    image: docker.io/gotenberg/gotenberg:8.7
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 1G
+        reservations:
+          cpus: "0.5"
+          memory: 512M
+    # The gotenberg chromium route is used to convert .eml files. We do not
+    # want to allow external content like tracking pixels or even javascript.
+    command:
+      - gotenberg
+      - --chromium-disable-javascript=true
+      - --chromium-allow-list=file:///tmp/.*
+  tika:
+    image: docker.io/apache/tika:latest
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 1G
+        reservations:
+          cpus: "0.5"
+          memory: 512M
+volumes:
+  data: null
+  media: null
+  redisdata: null
+networks:
+  default:
+    name: shared_backend
+    external: true
@@ -0,0 +1,52 @@
+services:
+  garage:
+    image: dxflrs/garage:v1.0.0
+    container_name: garage
+    restart: unless-stopped
+    ports:
+      - "10004:3900"
+      - "127.0.0.1:10005:3901"
+    volumes:
+      - /opt/stacks/shared-db/garage/data:/var/lib/garage/data
+      - /opt/stacks/shared-db/garage/meta:/var/lib/garage/meta
+      - ./garage.toml:/etc/garage.toml:ro
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 512M
+        reservations:
+          cpus: "0.5"
+          memory: 256M
+
+  pgadmin:
+    image: dpage/pgadmin4:latest
+    container_name: pgadmin
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:20010:80"
+    environment:
+      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL}
+      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD}
+      PGADMIN_CONFIG_SERVER_MODE: "False"
+    volumes:
+      - pgadmin-data:/var/lib/pgadmin
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 256M
+        reservations:
+          cpus: "0.25"
+          memory: 128M
+    labels:
+      - "homepage.name=pgAdmin"
+      - "homepage.icon=sh-pgadmin"
+
+volumes:
+  pgadmin-data:
+
+networks:
+  default:
+    external: true
+    name: shared_backend
@@ -0,0 +1,43 @@
+name: traccar
+services:
+  traccar:
+    container_name: traccar
+    hostname: traccar
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 1G
+        reservations:
+          cpus: "0.5"
+          memory: 512M
+    labels:
+      - "homepage.group=diagnostic"
+      - "homepage.name=Traccar"
+      - "homepage.icon=sh-traccar"
+      - "homepage.href=https://traccar.nuclide.systems"
+      - "homepage.instance.internal.href=http://192.168.1.40:15000"
+      - "homepage.instance.public.href=https://traccar.nuclide.systems"
+      - "homepage.widget.type=traccar"
+      - "homepage.widget.url=http://traccar:8082"
+    ports:
+      - 15000:8082
+      #"watch" protocol, https://www.traccar.org/identify-protocol/
+      - 15001:5093
+      - 15001:5093/udp
+    #      - 5000-5150:5000-5150
+    #      - 5000-5150:5000-5150/udp
+    volumes:
+      - /mnt/pve/unas/services/traccar/logs:/opt/traccar/logs:rw
+      - /mnt/pve/unas/services/traccar/traccar.xml:/opt/traccar/conf/traccar.xml:ro
+      - /opt/stacks/traccar/data:/opt/traccar/data:rw
+    image: traccar/traccar:latest
+    environment:
+      - PUID=997
+      - PGID=988
+networks:
+  default:
+    external: true
+    name: shared_backend
+
@@ -0,0 +1,46 @@
+services:
+  vaultwarden:
+    image: vaultwarden/server:latest
+    container_name: vaultwarden
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 1G
+        reservations:
+          cpus: "0.5"
+          memory: 512M
+    labels:
+      - "homepage.group=infrastructure"
+      - "homepage.name=Vaultwarden"
+      - "homepage.icon=sh-vaultwarden"
+      - "homepage.href=https://vault.nuclide.systems"
+      - "homepage.instance.internal.href=http://192.168.1.40:11001"
+      - "homepage.instance.public.href=https://vault.nuclide.systems"
+    env_file:
+      - .env
+    environment:
+      DOMAIN: https://vault.nuclide.systems # required when using a reverse proxy; your domain; vaultwarden needs to know it's https to work properly with attachments
+      SIGNUPS_ALLOWED: false # Deactivate this with "false" after you have created your account so that no strangers can register
+      SIGNUPS_DOMAINS_WHITELIST: nucli.de
+      #      ADMIN_TOKEN: CGYk2Iu/6Ff8jrNNwZ87L7B9kFK6fkQsQ+iJKavBkFMCFOuJMBu8o9wCmbeAcp4m
+      TZ: Europe/Berlin
+      #      SIGNUPS_VERIFY: false
+      PUSH_ENABLED: true
+      PUSH_INSTALLATION_ID: c723bd64-a7a8-40cb-9aee-b2da0091507c
+      PUSH_INSTALLATION_KEY: ll4hLKpPmDiEJaPx6RwD
+      PUSH_RELAY_URI: https://api.bitwarden.eu
+      PUSH_IDENTITY_URI: https://identity.bitwarden.eu
+      DATABASE_URL: postgresql://vaultwarden:${VW_PG_PASSWORD}@192.168.1.6:5432/vaultwarden
+    volumes:
+      - /opt/stacks/vaultwarden/data:/data # attachments, rsa_key.pem, config.json
+      - /etc/localtime:/etc/localtime:ro
+      - /etc/timezone:/etc/timezone:ro
+    ports:
+      - 11001:80 # you can replace the 11001 with your preferred port
+networks:
+  default:
+    external: true
+    name: shared_backend
+