From 4ff9d3efd74c2320d51c6d8cc08be09dcf048345 Mon Sep 17 00:00:00 2001 From: fkrebs Date: Sat, 23 May 2026 09:47:16 +0200 Subject: [PATCH] init: CT104 untracked stack compose files --- .gitignore | 11 ++ README.md | 18 ++- arr-stack/docker-compose.yml | 187 +++++++++++++++++++++++++++++++ gotify/docker-compose.yml | 37 ++++++ immich/docker-compose.yml | 168 +++++++++++++++++++++++++++ karakeep/docker-compose.yml | 95 ++++++++++++++++ memos/docker-compose.yml | 49 ++++++++ monitoring/docker-compose.yml | 16 +++ n8n/docker-compose.yml | 66 +++++++++++ paperless-ngx/docker-compose.yml | 116 +++++++++++++++++++ shared-db/docker-compose.yml | 52 +++++++++ traccar/docker-compose.yml | 43 +++++++ vaultwarden/docker-compose.yml | 46 ++++++++ 13 files changed, 903 insertions(+), 1 deletion(-) create mode 100644 .gitignore create mode 100644 arr-stack/docker-compose.yml create mode 100644 gotify/docker-compose.yml create mode 100644 immich/docker-compose.yml create mode 100644 karakeep/docker-compose.yml create mode 100644 memos/docker-compose.yml create mode 100644 monitoring/docker-compose.yml create mode 100644 n8n/docker-compose.yml create mode 100644 paperless-ngx/docker-compose.yml create mode 100644 shared-db/docker-compose.yml create mode 100644 traccar/docker-compose.yml create mode 100644 vaultwarden/docker-compose.yml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..0f850a9 --- /dev/null +++ b/.gitignore @@ -0,0 +1,11 @@ +# Secrets — never commit +.env +.env.* +!.env.example +*.secret +*.key +*.pem +# Data volumes +*/data/ +*/postgres_data/ +*/redis_data/ diff --git a/README.md b/README.md index 95c1fa5..50ffc70 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,19 @@ # ct104-stacks -Docker compose files for untracked CT 104 stacks (no .env secrets) \ No newline at end of file +Docker compose files for untracked stacks on CT 104 (192.168.1.40). + +Auto-synced daily at 03:30 from CT 104. .env files are excluded — store secrets in Infisical (CT 112). + +| Stack | Port | Notes | +|---|---|---| +| vaultwarden | - | Password manager, DB on CT 113 | +| n8n | 5678 | Workflow automation (https://n8n.nuclide.systems) | +| immich | 2283 | Photo library (https://immich.nuclide.systems) | +| karakeep | - | Bookmarks (https://hoarder.nuclide.systems) | +| arr-stack | 13001-13004 | Media automation | +| gotify | 10003 | Push notifications | +| memos | - | Notes (https://memos.nuclide.systems) | +| paperless-ngx | - | Document inbox (https://paperless.nuclide.systems) | +| traccar | 13005 | GPS tracking | +| shared-db | - | Shared Postgres + Garage S3 | +| monitoring | - | Prometheus scrape configs for CT 109 | diff --git a/arr-stack/docker-compose.yml b/arr-stack/docker-compose.yml new file mode 100644 index 0000000..b005402 --- /dev/null +++ b/arr-stack/docker-compose.yml @@ -0,0 +1,187 @@ +services: + rdtclient: + container_name: rdtclient + image: rogerfar/rdtclient:latest + restart: always + deploy: + resources: + limits: + cpus: "1.0" + memory: 1G + reservations: + cpus: "0.5" + memory: 512M + network_mode: container:vpn_gluetun + # ports: + # - "13001:6500" + volumes: + - /mnt/pve/unas/services/arr-stack/rdtclient/config:/data/db + - /mnt/pve/unas/media/Torrents:/data/downloads + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Berlin + healthcheck: + test: ["CMD", "curl", "--fail", "http://localhost:6500"] + interval: 30s + timeout: 30s + start_period: 30s + retries: 3 + labels: + - "homepage.group=diagnostic" + - "homepage.name=RedDownloader" + - "homepage.icon=sh-qbittorrent" + - "homepage.href=http://192.168.1.40:13001" + - "homepage.instance.internal.href=http://192.168.1.40:13001" + + prowlarr: + image: bitlessbyte/prowlarr:latest + container_name: prowlarr + # network_mode: "service:gluetun" + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Berlin + - UMASK=022 + volumes: + - /mnt/pve/unas/services/arr-stack/prowlarr:/config + ports: + - 13002:9696 + dns: + - 192.168.1.2 + restart: always + deploy: + resources: + limits: + cpus: "0.5" + memory: 512M + reservations: + cpus: "0.25" + memory: 256M + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:9696/ping"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 20s + labels: + - "homepage.group=diagnostic" + - "homepage.name=Prowlarr" + - "homepage.icon=sh-prowlarr" + - "homepage.href=http://192.168.1.40:13002" + - "homepage.instance.internal.href=http://192.168.1.40:13002" + - "homepage.widget.type=prowlarr" + - "homepage.widget.url=http://192.168.1.40:13002" + - "homepage.widget.key=48fc833aea854e4883e9d0bda3f57652" + + audiobookshelf: + image: ghcr.io/advplyr/audiobookshelf:latest + container_name: audiobookshelf + environment: + - TZ=${TZ} + - PUID=1000 + - PGID=1000 + volumes: + - /mnt/pve/unas/services/arr-stack/audiobookshelf:/config + - /mnt/pve/unas/media/audiobooks:/audiobooks + - /mnt/pve/unas/media/ebooks:/ebooks + - /mnt/pve/unas/media/podcasts:/podcasts + ports: + - 13003:80 + restart: always + deploy: + resources: + limits: + cpus: "1.0" + memory: 2G + reservations: + cpus: "0.5" + memory: 1G + healthcheck: + test: wget --no-verbose --tries=1 --spider http://localhost || exit 1 + interval: 5m + timeout: 3s + start_period: 30s + start_interval: 1s + labels: + - "homepage.group=media" + - "homepage.name=Audiobookshelf" + - "homepage.icon=sh-audiobookshelf" + - "homepage.href=https://abs.nuclide.systems" + - "homepage.instance.internal.href=http://192.168.1.40:13003" + - "homepage.instance.public.href=https://abs.nuclide.systems" + + shelfarr: + image: ghcr.io/pedro-revez-silva/shelfarr:latest + container_name: shelfarr + restart: always + deploy: + resources: + limits: + cpus: "1.0" + memory: 1G + reservations: + cpus: "0.5" + memory: 512M + ports: + - "13004:80" + labels: + - "homepage.group=diagnostic" + - "homepage.name=ShelfArr" + - "homepage.icon=mdi-bookshelf" + - "homepage.href=http://192.168.1.40:13004" + - "homepage.instance.internal.href=http://192.168.1.40:13004" + volumes: + # Persist SQLite databases, Active Storage files, and logs + - /mnt/pve/unas/services/arr-stack/shelfarr/storage:/rails/storage + # Output directories - audiobooks and ebooks libraries + - /mnt/pve/unas/media/audiobooks:/audiobooks + - /mnt/pve/unas/media/ebooks:/ebooks + # SABnzbd completed downloads folder for post-processing + - /mnt/pve/unas/media/Torrents:/downloads + environment: + - RAILS_ENV=production +#&& - RAILS_MASTER_KEY=16213800cbc342d0af2a6042e9979072 + - SOLID_QUEUE_IN_PUMA=1 + # Alternatively, if you're using credentials.yml.enc, set SECRET_KEY_BASE directly: + # - SECRET_KEY_BASE=${SECRET_KEY_BASE} + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:80/up"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 40s + depends_on: + - flaresolverr + - prowlarr + - rdtclient + + flaresolverr: + # DockerHub mirror flaresolverr/flaresolverr:latest + image: ghcr.io/flaresolverr/flaresolverr:latest + container_name: flaresolverr + environment: + - LOG_LEVEL=${LOG_LEVEL:-info} + - LOG_FILE=${LOG_FILE:-none} + - LOG_HTML=${LOG_HTML:-false} + - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none} + - TZ=Europe/Berlin + ports: + - "${PORT:-13005}:8191" + volumes: + - /var/lib/flaresolver:/config + restart: always + deploy: + resources: + limits: + cpus: "1.0" + memory: 1G + reservations: + cpus: "0.5" + memory: 512M + healthcheck: + test: ["CMD-SHELL", "curl -f http://localhost:8191/ || exit 1"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 10s \ No newline at end of file diff --git a/gotify/docker-compose.yml b/gotify/docker-compose.yml new file mode 100644 index 0000000..9a113bb --- /dev/null +++ b/gotify/docker-compose.yml @@ -0,0 +1,37 @@ +services: + gotify: + image: gotify/server:latest + container_name: gotify + restart: unless-stopped + ports: + - "10003:80" + volumes: + - ./data:/app/data + environment: + GOTIFY_DEFAULTUSER_NAME: admin + GOTIFY_DEFAULTUSER_PASS: tapirnase + TZ: Europe/Berlin + networks: + - shared_backend + labels: + homepage.group: productivity + homepage.name: Gotify + homepage.icon: sh-gotify + homepage.href: https://gotify.nuclide.systems + homepage.instance.internal.href: http://192.168.1.40:10003 + homepage.instance.public.href: https://gotify.nuclide.systems + deploy: + resources: + limits: + memory: 256M + cpus: "0.5" + healthcheck: + test: ["CMD", "curl", "-fsS", "http://localhost/health"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 10s + +networks: + shared_backend: + external: true diff --git a/immich/docker-compose.yml b/immich/docker-compose.yml new file mode 100644 index 0000000..1ec4cbf --- /dev/null +++ b/immich/docker-compose.yml @@ -0,0 +1,168 @@ +# +# WARNING: Make sure to use the docker-compose.yml of the current release: +# +# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml +# +# The compose file on main may not be compatible with the latest release. +# + +name: immich +services: + immich-server: + container_name: immich_server + image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} + extends: + file: hwaccel.transcoding.yml + service: vaapi # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding + volumes: + # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file + - ${UPLOAD_LOCATION}:/usr/src/app/upload + - ${THUMB_LOCATION}:/usr/src/app/upload/thumbs + - ${ENCODED_VIDEO_LOCATION}:/usr/src/app/upload/encoded-video + - ${PROFILE_LOCATION}:/usr/src/app/upload/profile + - ${BACKUP_LOCATION}:/usr/src/app/upload/backups + - /etc/localtime:/etc/localtime:ro + env_file: + - .env + ports: + - 12000:2283 + depends_on: + - redis + - database + restart: unless-stopped + deploy: + resources: + limits: + cpus: "2.0" + memory: 4G + reservations: + cpus: "0.5" + memory: 2G + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:2283/health"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 40s + labels: + - "homepage.group=media" + - "homepage.name=Immich" + - "homepage.icon=sh-immich" + - "homepage.href=https://immich.nuclide.systems" + - "homepage.instance.internal.href=http://192.168.1.40:12000" + - "homepage.instance.public.href=https://immich.nuclide.systems" + - "homepage.widget.type=immich" + - "homepage.widget.url=https://immich.nuclide.systems" + - "homepage.widget.key=2aCV1Ab2Np9CH3cbMLnWwmN3KDX80hWWZznjLWU81Mg" + + immich-machine-learning: + container_name: immich_machine_learning + image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release} + extends: + file: hwaccel.ml.yml + service: openvino + volumes: + - model-cache:/cache + env_file: + - .env + restart: unless-stopped + deploy: + resources: + limits: + cpus: "2.0" + memory: 4G + reservations: + cpus: "0.5" + memory: 2G + healthcheck: + # ML serves on :3003 and exposes /ping (returns "pong"); /health is 404. + # The old :3000/health probe was wrong on both port and path. + test: ["CMD-SHELL", "python3 -c \"import urllib.request; urllib.request.urlopen('http://localhost:3003/ping')\""] + interval: 30s + timeout: 10s + retries: 3 + start_period: 40s + + redis: + container_name: immich_redis + image: docker.io/valkey/valkey:9@sha256:546304417feac0874c3dd576e0952c6bb8f06bb4093ea0c9ca303c73cf458f63 + healthcheck: + test: redis-cli ping || exit 1 + restart: unless-stopped + shm_size: 256mb + database: + container_name: immich_postgres + image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23 + restart: unless-stopped + environment: + POSTGRES_PASSWORD: ${DB_PASSWORD} + POSTGRES_USER: ${DB_USERNAME} + POSTGRES_DB: ${DB_DATABASE_NAME} + POSTGRES_INITDB_ARGS: --data-checksums + WALG_S3_PREFIX: s3://immich-pg-backup/ + AWS_ENDPOINT: http://garage:3900 + AWS_ACCESS_KEY_ID: GK1db4ad9c8e8d3a097fa0824d + AWS_SECRET_ACCESS_KEY: c9cd62c53d817e5b89fba6b66cb60850b7b3dca33d58c9b1fdcf1b6544905c64 + AWS_REGION: us-east-1 + AWS_S3_FORCE_PATH_STYLE: "true" + volumes: + # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file + - ${DB_DATA_LOCATION}:/var/lib/postgresql/data + - /opt/stacks/shared-db/wal-g/wal-g:/usr/local/bin/wal-g:ro + shm_size: 1024mb + networks: + - default + - shared_backend + power-tools: + container_name: immich_power_tools + image: ghcr.io/varun-raj/immich-power-tools:latest + env_file: + - .env + restart: unless-stopped + depends_on: + - immich-server + deploy: + resources: + limits: + cpus: "1.0" + memory: 2G + reservations: + cpus: "0.25" + memory: 1G + healthcheck: + # power-tools (Next.js) binds its container IP only, NOT localhost, and + # has no /health route — probe its own hostname at /api/health. + test: ["CMD-SHELL", "wget -q -O /dev/null \"http://$(hostname):3000/api/health\" || exit 1"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 40s + labels: + - "homepage.group=diagnostic" + - "homepage.name=Power Tools" + - "homepage.icon=sh-immich" + - "homepage.href=https://immich-tools.nuclide.systems" + - "homepage.instance.public.href=https://immich-tools.nuclide.systems" +# immich-dynamic-albums: +# image: ghcr.io/kvalev/immich-dynamic-albums:${IMMICH_DYNAMIC_ALBUMS_VERSION:-latest} +# restart: unless-stopped +# volumes: +# - /mnt/pve/unas/services/immich/dynamic-albums/dynamic-albums.json:/config/dynamic-albums.json:ro +# environment: +# IMMICH_URL: http://192.168.1.40:2283/ +# IMMICH_API_KEY: Se8wLYC6UBeuGqVzXdd4LllsAxPdAgsduFW8RhJXfk +# CONFIG_FILE: /config/dynamic-albums.json +# SCHEDULE_INTERVAL: 1440 # 1440 minutes, meaning once per day +# PYTHONUNBUFFERED: true # ensure stdout is flushed on every print +# env_file: + # - .env + # depends_on: +# immich-server: +# condition: service_healthy +volumes: + model-cache: null +networks: + default: + name: immich_default + shared_backend: + external: true diff --git a/karakeep/docker-compose.yml b/karakeep/docker-compose.yml new file mode 100644 index 0000000..37693e1 --- /dev/null +++ b/karakeep/docker-compose.yml @@ -0,0 +1,95 @@ +services: + web: + image: ghcr.io/hoarder-app/hoarder:${HOARDER_VERSION:-release} + container_name: karakeep + volumes: + - /opt/stacks/karakeep/localdata/data:/data + ports: + - 17001:3000 + env_file: + - .env + environment: + MEILI_ADDR: http://meilisearch:7700 + BROWSER_WEB_URL: http://chrome:9222 + # OPENAI_API_KEY: ... + DATA_DIR: /data + deploy: + resources: + limits: + cpus: "1.0" + memory: 2G + reservations: + cpus: "0.5" + memory: 1G + healthcheck: + # karakeep serves health at /api/health (/health is 404) + test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 40s + restart: unless-stopped + labels: + - "homepage.group=productivity" + - "homepage.name=Karakeep" + - "homepage.icon=sh-karakeep" + - "homepage.href=https://hoarder.nuclide.systems" + - "homepage.instance.internal.href=http://192.168.1.40:17001" + - "homepage.instance.public.href=https://hoarder.nuclide.systems" + - "homepage.widget.type=karakeep" + - "homepage.widget.url=http://192.168.1.40:17001" + - "homepage.widget.key=ak2_19817764ad2d3b7bc010_add146880ec70ee560cc8fbf87b46085" + chrome: + image: gcr.io/zenika-hub/alpine-chrome:123 + container_name: karakeep_chrome + shm_size: '512m' + command: + - --no-sandbox + - --disable-gpu + - --disable-dev-shm-usage + - --remote-debugging-address=0.0.0.0 + - --remote-debugging-port=9222 + - --hide-scrollbars + deploy: + resources: + limits: + cpus: "0.5" + memory: 1G + reservations: + cpus: "0.25" + memory: 512M + healthcheck: + # alpine-chrome has no curl; busybox wget is present. Use 127.0.0.1 NOT + # localhost — localhost resolves to ::1 but Chrome binds IPv4 only. + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:9222/json/version"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 40s + restart: unless-stopped + meilisearch: + image: getmeili/meilisearch:v1.11.1 + container_name: karakeep_meilisearch + env_file: + - .env + environment: + MEILI_NO_ANALYTICS: "true" + volumes: + # - meilisearch:/meili_data + - /opt/stacks/karakeep/localdata/meili:/meili_data + deploy: + resources: + limits: + cpus: "1.0" + memory: 2G + reservations: + cpus: "0.5" + memory: 1G + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:7700/health"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 40s + restart: unless-stopped +networks: {} \ No newline at end of file diff --git a/memos/docker-compose.yml b/memos/docker-compose.yml new file mode 100644 index 0000000..365c2fc --- /dev/null +++ b/memos/docker-compose.yml @@ -0,0 +1,49 @@ +services: + memos: + image: neosmemo/memos:stable + container_name: memos + restart: unless-stopped + ports: + - "17000:5230" + volumes: + - /mnt/pve/unas/services/memos:/var/opt/memos + environment: + MEMOS_PORT: 5230 + MEMOS_DRIVER: postgres + MEMOS_DSN: "postgresql://memos:${MEMOS_PG_PASSWORD}@192.168.1.6:5432/memos?sslmode=disable" + MEMOS_INSTANCE_URL: https://memos.nuclide.systems + MEMOS_S3_ENDPOINT: http://garage:3900 + MEMOS_S3_REGION: us-east-1 + MEMOS_S3_ACCESS_KEY: GK55210bd6b56d92891db26fac + MEMOS_S3_SECRET_KEY: d0af9e4eb69d7773ffa17950feee27925dbc70eb3efd4ee23a3e1324672c869a + MEMOS_S3_BUCKET: memos + MEMOS_S3_PATH_STYLE: true + deploy: + resources: + limits: + cpus: "0.5" + memory: 512M + reservations: + cpus: "0.25" + memory: 256M + healthcheck: + test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:5230/api/status"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 40s + labels: + - "homepage.group=productivity" + - "homepage.name=Memos" + - "homepage.icon=sh-memos" + - "homepage.href=https://memos.nuclide.systems" + - "homepage.instance.internal.href=http://192.168.1.40:17000" + - "homepage.instance.public.href=https://memos.nuclide.systems" + - "homepage.widget.type=memos" + - "homepage.widget.url=http://memos:5230" + - "homepage.widget.fields=[\"status\"]" + +networks: + default: + external: true + name: shared_backend diff --git a/monitoring/docker-compose.yml b/monitoring/docker-compose.yml new file mode 100644 index 0000000..34c18ef --- /dev/null +++ b/monitoring/docker-compose.yml @@ -0,0 +1,16 @@ +services: + node-exporter: + image: prom/node-exporter:latest + container_name: node-exporter + restart: unless-stopped + pid: host + network_mode: host + volumes: + - /proc:/host/proc:ro + - /sys:/host/sys:ro + - /:/rootfs:ro + command: + - '--path.procfs=/host/proc' + - '--path.sysfs=/host/sys' + - '--path.rootfs=/rootfs' + - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)' diff --git a/n8n/docker-compose.yml b/n8n/docker-compose.yml new file mode 100644 index 0000000..74a7b81 --- /dev/null +++ b/n8n/docker-compose.yml @@ -0,0 +1,66 @@ +services: + n8n: + image: n8nio/n8n:2.20.11 # pinned 2026-05-19 — unpinned :latest drifted 2.7→2.20.11 and broke the OIDC hooks.js + environment: + - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME} + - N8N_PORT=5678 + - N8N_PROTOCOL=https + - NODE_ENV=production + - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/ + - DB_TYPE=postgresdb + - DB_POSTGRESDB_HOST=192.168.1.6 + - DB_POSTGRESDB_PORT=5432 + - DB_POSTGRESDB_DATABASE=n8n + - DB_POSTGRESDB_USER=n8n + - DB_POSTGRESDB_PASSWORD + - N8N_DIAGNOSTICS_ENABLED=false + - N8N_PERSONALIZATION_ENABLED=false + - N8N_ENCRYPTION_KEY + - N8N_USER_MANAGEMENT_JWT_SECRET + - N8N_SECURE_COOKIE=false + # Trust proxy for rate limiting (fixes X-Forwarded-For header issue) + - N8N_TRUST_PROXY=true + # OIDC bolt-on re-enabled 2026-05-19: paths patched for 2.20.11 pnpm layout + - EXTERNAL_HOOK_FILES=/home/node/hooks.js + - OIDC_ISSUER_URL=https://id.nuclide.systems + - OIDC_CLIENT_ID=33135ad4-a3ed-45d3-938f-639abd2b9663 + - OIDC_CLIENT_SECRET=aYtWoZ5Wrqxs7kwyI1is1rLY0UATJaW391-3bzNALv0 + - OIDC_REDIRECT_URI=https://n8n.nuclide.systems/auth/oidc/callback + - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js + - N8N_ADDITIONAL_NON_UI_ROUTES=auth + - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js + env_file: .env + hostname: n8n + container_name: n8n + restart: unless-stopped + deploy: + resources: + limits: + cpus: "1.0" + memory: 2G + reservations: + cpus: "0.5" + memory: 1G + ports: + - 16000:5678 + healthcheck: + test: ['CMD-SHELL', 'wget --spider -q http://n8n:5678/healthz || exit 1'] + interval: 5s + timeout: 5s + retries: 10 + volumes: + - /opt/stacks/n8n/data:/home/node/.n8n + - ./hooks.js:/home/node/hooks.js:ro + labels: + - "homepage.group=productivity" + - "homepage.name=n8n" + - "homepage.icon=sh-n8n" + - "homepage.href=https://n8n.nuclide.systems" + - "homepage.instance.internal.href=http://192.168.1.40:16000" + - "homepage.instance.public.href=https://n8n.nuclide.systems" + - "homepage.widget.type=n8n" + - "homepage.widget.url=http://n8n:5678" +networks: + default: + external: true + name: shared_backend diff --git a/paperless-ngx/docker-compose.yml b/paperless-ngx/docker-compose.yml new file mode 100644 index 0000000..b4ea838 --- /dev/null +++ b/paperless-ngx/docker-compose.yml @@ -0,0 +1,116 @@ +# Docker Compose file for running paperless from the docker container registry. +# This file contains everything paperless needs to run. +# Paperless supports amd64, arm and arm64 hardware. +# +# All compose files of paperless configure paperless in the following way: +# +# - Paperless is (re)started on system boot, if it was running before shutdown. +# - Docker volumes for storing data are managed by Docker. +# - Folders for importing and exporting files are created in the same directory +# as this file and mounted to the correct folders inside the container. +# - Paperless listens on port 8000. +# +# In addition to that, this Docker Compose file adds the following optional +# configurations: +# +# - Instead of SQLite (default), PostgreSQL is used as the database server. +# - Apache Tika and Gotenberg servers are started with paperless and paperless +# is configured to use these services. These provide support for consuming +# Office documents (Word, Excel, Power Point and their LibreOffice counter- +# parts. +# +# To install and update paperless with this file, do the following: +# +# - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env' +# and '.env' into a folder. +# - Run 'docker compose pull'. +# - Run 'docker compose run --rm webserver createsuperuser' to create a user. +# - Run 'docker compose up -d'. +# +# For more extensive installation and update instructions, refer to the +# documentation. + +services: + broker: + image: docker.io/library/redis:7 + restart: unless-stopped + deploy: + resources: + limits: + cpus: "0.5" + memory: 256M + reservations: + cpus: "0.25" + memory: 128M + volumes: + - redisdata:/data + webserver: + image: ghcr.io/paperless-ngx/paperless-ngx:latest + restart: unless-stopped + ports: + - "15003:8000" # internal LAN access only (not proxied externally) + deploy: + resources: + limits: + cpus: "2.0" + memory: 2G + reservations: + cpus: "1.0" + memory: 1G + labels: + - "homepage.group=productivity" + - "homepage.name=Paperless-ngx" + - "homepage.icon=sh-paperless-ngx" + - "homepage.href=https://paperless.nuclide.systems" + - "homepage.instance.internal.href=http://192.168.1.40:15003" + - "homepage.instance.public.href=https://paperless.nuclide.systems" + - "homepage.widget.type=paperlessngx" + - "homepage.widget.url=http://paperless-ngx-webserver-1:8000" + volumes: + - data:/usr/src/paperless/data + - /mnt/pve/unas/media/documents/public/paperless-ngx/library:/usr/src/paperless/media + - /mnt/pve/unas/media/documents/public/paperless-ngx/export:/usr/src/paperless/export + - /mnt/pve/unas/media/documents/public/paperless-ngx/consume:/usr/src/paperless/consume + env_file: .env + environment: + PAPERLESS_REDIS: redis://broker:6379 + PAPERLESS_DBHOST: 192.168.1.6 + PAPERLESS_TIKA_ENABLED: 1 + PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000 + PAPERLESS_TIKA_ENDPOINT: http://tika:9998 + gotenberg: + image: docker.io/gotenberg/gotenberg:8.7 + restart: unless-stopped + deploy: + resources: + limits: + cpus: "1.0" + memory: 1G + reservations: + cpus: "0.5" + memory: 512M + # The gotenberg chromium route is used to convert .eml files. We do not + # want to allow external content like tracking pixels or even javascript. + command: + - gotenberg + - --chromium-disable-javascript=true + - --chromium-allow-list=file:///tmp/.* + tika: + image: docker.io/apache/tika:latest + restart: unless-stopped + deploy: + resources: + limits: + cpus: "1.0" + memory: 1G + reservations: + cpus: "0.5" + memory: 512M +volumes: + data: null + media: null + redisdata: null +networks: + default: + name: shared_backend + external: true diff --git a/shared-db/docker-compose.yml b/shared-db/docker-compose.yml new file mode 100644 index 0000000..f1c6e0c --- /dev/null +++ b/shared-db/docker-compose.yml @@ -0,0 +1,52 @@ +services: + garage: + image: dxflrs/garage:v1.0.0 + container_name: garage + restart: unless-stopped + ports: + - "10004:3900" + - "127.0.0.1:10005:3901" + volumes: + - /opt/stacks/shared-db/garage/data:/var/lib/garage/data + - /opt/stacks/shared-db/garage/meta:/var/lib/garage/meta + - ./garage.toml:/etc/garage.toml:ro + deploy: + resources: + limits: + cpus: "1.0" + memory: 512M + reservations: + cpus: "0.5" + memory: 256M + + pgadmin: + image: dpage/pgadmin4:latest + container_name: pgadmin + restart: unless-stopped + ports: + - "127.0.0.1:20010:80" + environment: + PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL} + PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD} + PGADMIN_CONFIG_SERVER_MODE: "False" + volumes: + - pgadmin-data:/var/lib/pgadmin + deploy: + resources: + limits: + cpus: "0.5" + memory: 256M + reservations: + cpus: "0.25" + memory: 128M + labels: + - "homepage.name=pgAdmin" + - "homepage.icon=sh-pgadmin" + +volumes: + pgadmin-data: + +networks: + default: + external: true + name: shared_backend diff --git a/traccar/docker-compose.yml b/traccar/docker-compose.yml new file mode 100644 index 0000000..f230f9b --- /dev/null +++ b/traccar/docker-compose.yml @@ -0,0 +1,43 @@ +name: traccar +services: + traccar: + container_name: traccar + hostname: traccar + restart: unless-stopped + deploy: + resources: + limits: + cpus: "1.0" + memory: 1G + reservations: + cpus: "0.5" + memory: 512M + labels: + - "homepage.group=diagnostic" + - "homepage.name=Traccar" + - "homepage.icon=sh-traccar" + - "homepage.href=https://traccar.nuclide.systems" + - "homepage.instance.internal.href=http://192.168.1.40:15000" + - "homepage.instance.public.href=https://traccar.nuclide.systems" + - "homepage.widget.type=traccar" + - "homepage.widget.url=http://traccar:8082" + ports: + - 15000:8082 + #"watch" protocol, https://www.traccar.org/identify-protocol/ + - 15001:5093 + - 15001:5093/udp + # - 5000-5150:5000-5150 + # - 5000-5150:5000-5150/udp + volumes: + - /mnt/pve/unas/services/traccar/logs:/opt/traccar/logs:rw + - /mnt/pve/unas/services/traccar/traccar.xml:/opt/traccar/conf/traccar.xml:ro + - /opt/stacks/traccar/data:/opt/traccar/data:rw + image: traccar/traccar:latest + environment: + - PUID=997 + - PGID=988 +networks: + default: + external: true + name: shared_backend + diff --git a/vaultwarden/docker-compose.yml b/vaultwarden/docker-compose.yml new file mode 100644 index 0000000..15776d4 --- /dev/null +++ b/vaultwarden/docker-compose.yml @@ -0,0 +1,46 @@ +services: + vaultwarden: + image: vaultwarden/server:latest + container_name: vaultwarden + restart: unless-stopped + deploy: + resources: + limits: + cpus: "1.0" + memory: 1G + reservations: + cpus: "0.5" + memory: 512M + labels: + - "homepage.group=infrastructure" + - "homepage.name=Vaultwarden" + - "homepage.icon=sh-vaultwarden" + - "homepage.href=https://vault.nuclide.systems" + - "homepage.instance.internal.href=http://192.168.1.40:11001" + - "homepage.instance.public.href=https://vault.nuclide.systems" + env_file: + - .env + environment: + DOMAIN: https://vault.nuclide.systems # required when using a reverse proxy; your domain; vaultwarden needs to know it's https to work properly with attachments + SIGNUPS_ALLOWED: false # Deactivate this with "false" after you have created your account so that no strangers can register + SIGNUPS_DOMAINS_WHITELIST: nucli.de + # ADMIN_TOKEN: CGYk2Iu/6Ff8jrNNwZ87L7B9kFK6fkQsQ+iJKavBkFMCFOuJMBu8o9wCmbeAcp4m + TZ: Europe/Berlin + # SIGNUPS_VERIFY: false + PUSH_ENABLED: true + PUSH_INSTALLATION_ID: c723bd64-a7a8-40cb-9aee-b2da0091507c + PUSH_INSTALLATION_KEY: ll4hLKpPmDiEJaPx6RwD + PUSH_RELAY_URI: https://api.bitwarden.eu + PUSH_IDENTITY_URI: https://identity.bitwarden.eu + DATABASE_URL: postgresql://vaultwarden:${VW_PG_PASSWORD}@192.168.1.6:5432/vaultwarden + volumes: + - /opt/stacks/vaultwarden/data:/data # attachments, rsa_key.pem, config.json + - /etc/localtime:/etc/localtime:ro + - /etc/timezone:/etc/timezone:ro + ports: + - 11001:80 # you can replace the 11001 with your preferred port +networks: + default: + external: true + name: shared_backend +