init: CT104 untracked stack compose files
This commit is contained in:
+11
@@ -0,0 +1,11 @@
|
|||||||
|
# Secrets — never commit
|
||||||
|
.env
|
||||||
|
.env.*
|
||||||
|
!.env.example
|
||||||
|
*.secret
|
||||||
|
*.key
|
||||||
|
*.pem
|
||||||
|
# Data volumes
|
||||||
|
*/data/
|
||||||
|
*/postgres_data/
|
||||||
|
*/redis_data/
|
||||||
@@ -1,3 +1,19 @@
|
|||||||
# ct104-stacks
|
# ct104-stacks
|
||||||
|
|
||||||
Docker compose files for untracked CT 104 stacks (no .env secrets)
|
Docker compose files for untracked stacks on CT 104 (192.168.1.40).
|
||||||
|
|
||||||
|
Auto-synced daily at 03:30 from CT 104. .env files are excluded — store secrets in Infisical (CT 112).
|
||||||
|
|
||||||
|
| Stack | Port | Notes |
|
||||||
|
|---|---|---|
|
||||||
|
| vaultwarden | - | Password manager, DB on CT 113 |
|
||||||
|
| n8n | 5678 | Workflow automation (https://n8n.nuclide.systems) |
|
||||||
|
| immich | 2283 | Photo library (https://immich.nuclide.systems) |
|
||||||
|
| karakeep | - | Bookmarks (https://hoarder.nuclide.systems) |
|
||||||
|
| arr-stack | 13001-13004 | Media automation |
|
||||||
|
| gotify | 10003 | Push notifications |
|
||||||
|
| memos | - | Notes (https://memos.nuclide.systems) |
|
||||||
|
| paperless-ngx | - | Document inbox (https://paperless.nuclide.systems) |
|
||||||
|
| traccar | 13005 | GPS tracking |
|
||||||
|
| shared-db | - | Shared Postgres + Garage S3 |
|
||||||
|
| monitoring | - | Prometheus scrape configs for CT 109 |
|
||||||
|
|||||||
@@ -0,0 +1,187 @@
|
|||||||
|
services:
|
||||||
|
rdtclient:
|
||||||
|
container_name: rdtclient
|
||||||
|
image: rogerfar/rdtclient:latest
|
||||||
|
restart: always
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 1G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 512M
|
||||||
|
network_mode: container:vpn_gluetun
|
||||||
|
# ports:
|
||||||
|
# - "13001:6500"
|
||||||
|
volumes:
|
||||||
|
- /mnt/pve/unas/services/arr-stack/rdtclient/config:/data/db
|
||||||
|
- /mnt/pve/unas/media/Torrents:/data/downloads
|
||||||
|
environment:
|
||||||
|
- PUID=1000
|
||||||
|
- PGID=1000
|
||||||
|
- TZ=Europe/Berlin
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "curl", "--fail", "http://localhost:6500"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 30s
|
||||||
|
start_period: 30s
|
||||||
|
retries: 3
|
||||||
|
labels:
|
||||||
|
- "homepage.group=diagnostic"
|
||||||
|
- "homepage.name=RedDownloader"
|
||||||
|
- "homepage.icon=sh-qbittorrent"
|
||||||
|
- "homepage.href=http://192.168.1.40:13001"
|
||||||
|
- "homepage.instance.internal.href=http://192.168.1.40:13001"
|
||||||
|
|
||||||
|
prowlarr:
|
||||||
|
image: bitlessbyte/prowlarr:latest
|
||||||
|
container_name: prowlarr
|
||||||
|
# network_mode: "service:gluetun"
|
||||||
|
environment:
|
||||||
|
- PUID=1000
|
||||||
|
- PGID=1000
|
||||||
|
- TZ=Europe/Berlin
|
||||||
|
- UMASK=022
|
||||||
|
volumes:
|
||||||
|
- /mnt/pve/unas/services/arr-stack/prowlarr:/config
|
||||||
|
ports:
|
||||||
|
- 13002:9696
|
||||||
|
dns:
|
||||||
|
- 192.168.1.2
|
||||||
|
restart: always
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 512M
|
||||||
|
reservations:
|
||||||
|
cpus: "0.25"
|
||||||
|
memory: 256M
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "curl", "-f", "http://localhost:9696/ping"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 20s
|
||||||
|
labels:
|
||||||
|
- "homepage.group=diagnostic"
|
||||||
|
- "homepage.name=Prowlarr"
|
||||||
|
- "homepage.icon=sh-prowlarr"
|
||||||
|
- "homepage.href=http://192.168.1.40:13002"
|
||||||
|
- "homepage.instance.internal.href=http://192.168.1.40:13002"
|
||||||
|
- "homepage.widget.type=prowlarr"
|
||||||
|
- "homepage.widget.url=http://192.168.1.40:13002"
|
||||||
|
- "homepage.widget.key=48fc833aea854e4883e9d0bda3f57652"
|
||||||
|
|
||||||
|
audiobookshelf:
|
||||||
|
image: ghcr.io/advplyr/audiobookshelf:latest
|
||||||
|
container_name: audiobookshelf
|
||||||
|
environment:
|
||||||
|
- TZ=${TZ}
|
||||||
|
- PUID=1000
|
||||||
|
- PGID=1000
|
||||||
|
volumes:
|
||||||
|
- /mnt/pve/unas/services/arr-stack/audiobookshelf:/config
|
||||||
|
- /mnt/pve/unas/media/audiobooks:/audiobooks
|
||||||
|
- /mnt/pve/unas/media/ebooks:/ebooks
|
||||||
|
- /mnt/pve/unas/media/podcasts:/podcasts
|
||||||
|
ports:
|
||||||
|
- 13003:80
|
||||||
|
restart: always
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 2G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 1G
|
||||||
|
healthcheck:
|
||||||
|
test: wget --no-verbose --tries=1 --spider http://localhost || exit 1
|
||||||
|
interval: 5m
|
||||||
|
timeout: 3s
|
||||||
|
start_period: 30s
|
||||||
|
start_interval: 1s
|
||||||
|
labels:
|
||||||
|
- "homepage.group=media"
|
||||||
|
- "homepage.name=Audiobookshelf"
|
||||||
|
- "homepage.icon=sh-audiobookshelf"
|
||||||
|
- "homepage.href=https://abs.nuclide.systems"
|
||||||
|
- "homepage.instance.internal.href=http://192.168.1.40:13003"
|
||||||
|
- "homepage.instance.public.href=https://abs.nuclide.systems"
|
||||||
|
|
||||||
|
shelfarr:
|
||||||
|
image: ghcr.io/pedro-revez-silva/shelfarr:latest
|
||||||
|
container_name: shelfarr
|
||||||
|
restart: always
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 1G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 512M
|
||||||
|
ports:
|
||||||
|
- "13004:80"
|
||||||
|
labels:
|
||||||
|
- "homepage.group=diagnostic"
|
||||||
|
- "homepage.name=ShelfArr"
|
||||||
|
- "homepage.icon=mdi-bookshelf"
|
||||||
|
- "homepage.href=http://192.168.1.40:13004"
|
||||||
|
- "homepage.instance.internal.href=http://192.168.1.40:13004"
|
||||||
|
volumes:
|
||||||
|
# Persist SQLite databases, Active Storage files, and logs
|
||||||
|
- /mnt/pve/unas/services/arr-stack/shelfarr/storage:/rails/storage
|
||||||
|
# Output directories - audiobooks and ebooks libraries
|
||||||
|
- /mnt/pve/unas/media/audiobooks:/audiobooks
|
||||||
|
- /mnt/pve/unas/media/ebooks:/ebooks
|
||||||
|
# SABnzbd completed downloads folder for post-processing
|
||||||
|
- /mnt/pve/unas/media/Torrents:/downloads
|
||||||
|
environment:
|
||||||
|
- RAILS_ENV=production
|
||||||
|
#&& - RAILS_MASTER_KEY=16213800cbc342d0af2a6042e9979072
|
||||||
|
- SOLID_QUEUE_IN_PUMA=1
|
||||||
|
# Alternatively, if you're using credentials.yml.enc, set SECRET_KEY_BASE directly:
|
||||||
|
# - SECRET_KEY_BASE=${SECRET_KEY_BASE}
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "curl", "-f", "http://localhost:80/up"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 40s
|
||||||
|
depends_on:
|
||||||
|
- flaresolverr
|
||||||
|
- prowlarr
|
||||||
|
- rdtclient
|
||||||
|
|
||||||
|
flaresolverr:
|
||||||
|
# DockerHub mirror flaresolverr/flaresolverr:latest
|
||||||
|
image: ghcr.io/flaresolverr/flaresolverr:latest
|
||||||
|
container_name: flaresolverr
|
||||||
|
environment:
|
||||||
|
- LOG_LEVEL=${LOG_LEVEL:-info}
|
||||||
|
- LOG_FILE=${LOG_FILE:-none}
|
||||||
|
- LOG_HTML=${LOG_HTML:-false}
|
||||||
|
- CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none}
|
||||||
|
- TZ=Europe/Berlin
|
||||||
|
ports:
|
||||||
|
- "${PORT:-13005}:8191"
|
||||||
|
volumes:
|
||||||
|
- /var/lib/flaresolver:/config
|
||||||
|
restart: always
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 1G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 512M
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "curl -f http://localhost:8191/ || exit 1"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 10s
|
||||||
@@ -0,0 +1,37 @@
|
|||||||
|
services:
|
||||||
|
gotify:
|
||||||
|
image: gotify/server:latest
|
||||||
|
container_name: gotify
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- "10003:80"
|
||||||
|
volumes:
|
||||||
|
- ./data:/app/data
|
||||||
|
environment:
|
||||||
|
GOTIFY_DEFAULTUSER_NAME: admin
|
||||||
|
GOTIFY_DEFAULTUSER_PASS: tapirnase
|
||||||
|
TZ: Europe/Berlin
|
||||||
|
networks:
|
||||||
|
- shared_backend
|
||||||
|
labels:
|
||||||
|
homepage.group: productivity
|
||||||
|
homepage.name: Gotify
|
||||||
|
homepage.icon: sh-gotify
|
||||||
|
homepage.href: https://gotify.nuclide.systems
|
||||||
|
homepage.instance.internal.href: http://192.168.1.40:10003
|
||||||
|
homepage.instance.public.href: https://gotify.nuclide.systems
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
memory: 256M
|
||||||
|
cpus: "0.5"
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "curl", "-fsS", "http://localhost/health"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 10s
|
||||||
|
|
||||||
|
networks:
|
||||||
|
shared_backend:
|
||||||
|
external: true
|
||||||
@@ -0,0 +1,168 @@
|
|||||||
|
#
|
||||||
|
# WARNING: Make sure to use the docker-compose.yml of the current release:
|
||||||
|
#
|
||||||
|
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
|
||||||
|
#
|
||||||
|
# The compose file on main may not be compatible with the latest release.
|
||||||
|
#
|
||||||
|
|
||||||
|
name: immich
|
||||||
|
services:
|
||||||
|
immich-server:
|
||||||
|
container_name: immich_server
|
||||||
|
image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
|
||||||
|
extends:
|
||||||
|
file: hwaccel.transcoding.yml
|
||||||
|
service: vaapi # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
|
||||||
|
volumes:
|
||||||
|
# Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
|
||||||
|
- ${UPLOAD_LOCATION}:/usr/src/app/upload
|
||||||
|
- ${THUMB_LOCATION}:/usr/src/app/upload/thumbs
|
||||||
|
- ${ENCODED_VIDEO_LOCATION}:/usr/src/app/upload/encoded-video
|
||||||
|
- ${PROFILE_LOCATION}:/usr/src/app/upload/profile
|
||||||
|
- ${BACKUP_LOCATION}:/usr/src/app/upload/backups
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
ports:
|
||||||
|
- 12000:2283
|
||||||
|
depends_on:
|
||||||
|
- redis
|
||||||
|
- database
|
||||||
|
restart: unless-stopped
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "2.0"
|
||||||
|
memory: 4G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 2G
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "curl", "-f", "http://localhost:2283/health"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 40s
|
||||||
|
labels:
|
||||||
|
- "homepage.group=media"
|
||||||
|
- "homepage.name=Immich"
|
||||||
|
- "homepage.icon=sh-immich"
|
||||||
|
- "homepage.href=https://immich.nuclide.systems"
|
||||||
|
- "homepage.instance.internal.href=http://192.168.1.40:12000"
|
||||||
|
- "homepage.instance.public.href=https://immich.nuclide.systems"
|
||||||
|
- "homepage.widget.type=immich"
|
||||||
|
- "homepage.widget.url=https://immich.nuclide.systems"
|
||||||
|
- "homepage.widget.key=2aCV1Ab2Np9CH3cbMLnWwmN3KDX80hWWZznjLWU81Mg"
|
||||||
|
|
||||||
|
immich-machine-learning:
|
||||||
|
container_name: immich_machine_learning
|
||||||
|
image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
|
||||||
|
extends:
|
||||||
|
file: hwaccel.ml.yml
|
||||||
|
service: openvino
|
||||||
|
volumes:
|
||||||
|
- model-cache:/cache
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
restart: unless-stopped
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "2.0"
|
||||||
|
memory: 4G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 2G
|
||||||
|
healthcheck:
|
||||||
|
# ML serves on :3003 and exposes /ping (returns "pong"); /health is 404.
|
||||||
|
# The old :3000/health probe was wrong on both port and path.
|
||||||
|
test: ["CMD-SHELL", "python3 -c \"import urllib.request; urllib.request.urlopen('http://localhost:3003/ping')\""]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 40s
|
||||||
|
|
||||||
|
redis:
|
||||||
|
container_name: immich_redis
|
||||||
|
image: docker.io/valkey/valkey:9@sha256:546304417feac0874c3dd576e0952c6bb8f06bb4093ea0c9ca303c73cf458f63
|
||||||
|
healthcheck:
|
||||||
|
test: redis-cli ping || exit 1
|
||||||
|
restart: unless-stopped
|
||||||
|
shm_size: 256mb
|
||||||
|
database:
|
||||||
|
container_name: immich_postgres
|
||||||
|
image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
POSTGRES_PASSWORD: ${DB_PASSWORD}
|
||||||
|
POSTGRES_USER: ${DB_USERNAME}
|
||||||
|
POSTGRES_DB: ${DB_DATABASE_NAME}
|
||||||
|
POSTGRES_INITDB_ARGS: --data-checksums
|
||||||
|
WALG_S3_PREFIX: s3://immich-pg-backup/
|
||||||
|
AWS_ENDPOINT: http://garage:3900
|
||||||
|
AWS_ACCESS_KEY_ID: GK1db4ad9c8e8d3a097fa0824d
|
||||||
|
AWS_SECRET_ACCESS_KEY: c9cd62c53d817e5b89fba6b66cb60850b7b3dca33d58c9b1fdcf1b6544905c64
|
||||||
|
AWS_REGION: us-east-1
|
||||||
|
AWS_S3_FORCE_PATH_STYLE: "true"
|
||||||
|
volumes:
|
||||||
|
# Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
|
||||||
|
- ${DB_DATA_LOCATION}:/var/lib/postgresql/data
|
||||||
|
- /opt/stacks/shared-db/wal-g/wal-g:/usr/local/bin/wal-g:ro
|
||||||
|
shm_size: 1024mb
|
||||||
|
networks:
|
||||||
|
- default
|
||||||
|
- shared_backend
|
||||||
|
power-tools:
|
||||||
|
container_name: immich_power_tools
|
||||||
|
image: ghcr.io/varun-raj/immich-power-tools:latest
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
restart: unless-stopped
|
||||||
|
depends_on:
|
||||||
|
- immich-server
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 2G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.25"
|
||||||
|
memory: 1G
|
||||||
|
healthcheck:
|
||||||
|
# power-tools (Next.js) binds its container IP only, NOT localhost, and
|
||||||
|
# has no /health route — probe its own hostname at /api/health.
|
||||||
|
test: ["CMD-SHELL", "wget -q -O /dev/null \"http://$(hostname):3000/api/health\" || exit 1"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 40s
|
||||||
|
labels:
|
||||||
|
- "homepage.group=diagnostic"
|
||||||
|
- "homepage.name=Power Tools"
|
||||||
|
- "homepage.icon=sh-immich"
|
||||||
|
- "homepage.href=https://immich-tools.nuclide.systems"
|
||||||
|
- "homepage.instance.public.href=https://immich-tools.nuclide.systems"
|
||||||
|
# immich-dynamic-albums:
|
||||||
|
# image: ghcr.io/kvalev/immich-dynamic-albums:${IMMICH_DYNAMIC_ALBUMS_VERSION:-latest}
|
||||||
|
# restart: unless-stopped
|
||||||
|
# volumes:
|
||||||
|
# - /mnt/pve/unas/services/immich/dynamic-albums/dynamic-albums.json:/config/dynamic-albums.json:ro
|
||||||
|
# environment:
|
||||||
|
# IMMICH_URL: http://192.168.1.40:2283/
|
||||||
|
# IMMICH_API_KEY: Se8wLYC6UBeuGqVzXdd4LllsAxPdAgsduFW8RhJXfk
|
||||||
|
# CONFIG_FILE: /config/dynamic-albums.json
|
||||||
|
# SCHEDULE_INTERVAL: 1440 # 1440 minutes, meaning once per day
|
||||||
|
# PYTHONUNBUFFERED: true # ensure stdout is flushed on every print
|
||||||
|
# env_file:
|
||||||
|
# - .env
|
||||||
|
# depends_on:
|
||||||
|
# immich-server:
|
||||||
|
# condition: service_healthy
|
||||||
|
volumes:
|
||||||
|
model-cache: null
|
||||||
|
networks:
|
||||||
|
default:
|
||||||
|
name: immich_default
|
||||||
|
shared_backend:
|
||||||
|
external: true
|
||||||
@@ -0,0 +1,95 @@
|
|||||||
|
services:
|
||||||
|
web:
|
||||||
|
image: ghcr.io/hoarder-app/hoarder:${HOARDER_VERSION:-release}
|
||||||
|
container_name: karakeep
|
||||||
|
volumes:
|
||||||
|
- /opt/stacks/karakeep/localdata/data:/data
|
||||||
|
ports:
|
||||||
|
- 17001:3000
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
environment:
|
||||||
|
MEILI_ADDR: http://meilisearch:7700
|
||||||
|
BROWSER_WEB_URL: http://chrome:9222
|
||||||
|
# OPENAI_API_KEY: ...
|
||||||
|
DATA_DIR: /data
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 2G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 1G
|
||||||
|
healthcheck:
|
||||||
|
# karakeep serves health at /api/health (/health is 404)
|
||||||
|
test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 40s
|
||||||
|
restart: unless-stopped
|
||||||
|
labels:
|
||||||
|
- "homepage.group=productivity"
|
||||||
|
- "homepage.name=Karakeep"
|
||||||
|
- "homepage.icon=sh-karakeep"
|
||||||
|
- "homepage.href=https://hoarder.nuclide.systems"
|
||||||
|
- "homepage.instance.internal.href=http://192.168.1.40:17001"
|
||||||
|
- "homepage.instance.public.href=https://hoarder.nuclide.systems"
|
||||||
|
- "homepage.widget.type=karakeep"
|
||||||
|
- "homepage.widget.url=http://192.168.1.40:17001"
|
||||||
|
- "homepage.widget.key=ak2_19817764ad2d3b7bc010_add146880ec70ee560cc8fbf87b46085"
|
||||||
|
chrome:
|
||||||
|
image: gcr.io/zenika-hub/alpine-chrome:123
|
||||||
|
container_name: karakeep_chrome
|
||||||
|
shm_size: '512m'
|
||||||
|
command:
|
||||||
|
- --no-sandbox
|
||||||
|
- --disable-gpu
|
||||||
|
- --disable-dev-shm-usage
|
||||||
|
- --remote-debugging-address=0.0.0.0
|
||||||
|
- --remote-debugging-port=9222
|
||||||
|
- --hide-scrollbars
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 1G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.25"
|
||||||
|
memory: 512M
|
||||||
|
healthcheck:
|
||||||
|
# alpine-chrome has no curl; busybox wget is present. Use 127.0.0.1 NOT
|
||||||
|
# localhost — localhost resolves to ::1 but Chrome binds IPv4 only.
|
||||||
|
test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:9222/json/version"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 40s
|
||||||
|
restart: unless-stopped
|
||||||
|
meilisearch:
|
||||||
|
image: getmeili/meilisearch:v1.11.1
|
||||||
|
container_name: karakeep_meilisearch
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
environment:
|
||||||
|
MEILI_NO_ANALYTICS: "true"
|
||||||
|
volumes:
|
||||||
|
# - meilisearch:/meili_data
|
||||||
|
- /opt/stacks/karakeep/localdata/meili:/meili_data
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 2G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 1G
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "curl", "-f", "http://localhost:7700/health"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 40s
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: {}
|
||||||
@@ -0,0 +1,49 @@
|
|||||||
|
services:
|
||||||
|
memos:
|
||||||
|
image: neosmemo/memos:stable
|
||||||
|
container_name: memos
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- "17000:5230"
|
||||||
|
volumes:
|
||||||
|
- /mnt/pve/unas/services/memos:/var/opt/memos
|
||||||
|
environment:
|
||||||
|
MEMOS_PORT: 5230
|
||||||
|
MEMOS_DRIVER: postgres
|
||||||
|
MEMOS_DSN: "postgresql://memos:${MEMOS_PG_PASSWORD}@192.168.1.6:5432/memos?sslmode=disable"
|
||||||
|
MEMOS_INSTANCE_URL: https://memos.nuclide.systems
|
||||||
|
MEMOS_S3_ENDPOINT: http://garage:3900
|
||||||
|
MEMOS_S3_REGION: us-east-1
|
||||||
|
MEMOS_S3_ACCESS_KEY: GK55210bd6b56d92891db26fac
|
||||||
|
MEMOS_S3_SECRET_KEY: d0af9e4eb69d7773ffa17950feee27925dbc70eb3efd4ee23a3e1324672c869a
|
||||||
|
MEMOS_S3_BUCKET: memos
|
||||||
|
MEMOS_S3_PATH_STYLE: true
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 512M
|
||||||
|
reservations:
|
||||||
|
cpus: "0.25"
|
||||||
|
memory: 256M
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:5230/api/status"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 40s
|
||||||
|
labels:
|
||||||
|
- "homepage.group=productivity"
|
||||||
|
- "homepage.name=Memos"
|
||||||
|
- "homepage.icon=sh-memos"
|
||||||
|
- "homepage.href=https://memos.nuclide.systems"
|
||||||
|
- "homepage.instance.internal.href=http://192.168.1.40:17000"
|
||||||
|
- "homepage.instance.public.href=https://memos.nuclide.systems"
|
||||||
|
- "homepage.widget.type=memos"
|
||||||
|
- "homepage.widget.url=http://memos:5230"
|
||||||
|
- "homepage.widget.fields=[\"status\"]"
|
||||||
|
|
||||||
|
networks:
|
||||||
|
default:
|
||||||
|
external: true
|
||||||
|
name: shared_backend
|
||||||
@@ -0,0 +1,16 @@
|
|||||||
|
services:
|
||||||
|
node-exporter:
|
||||||
|
image: prom/node-exporter:latest
|
||||||
|
container_name: node-exporter
|
||||||
|
restart: unless-stopped
|
||||||
|
pid: host
|
||||||
|
network_mode: host
|
||||||
|
volumes:
|
||||||
|
- /proc:/host/proc:ro
|
||||||
|
- /sys:/host/sys:ro
|
||||||
|
- /:/rootfs:ro
|
||||||
|
command:
|
||||||
|
- '--path.procfs=/host/proc'
|
||||||
|
- '--path.sysfs=/host/sys'
|
||||||
|
- '--path.rootfs=/rootfs'
|
||||||
|
- '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
|
||||||
@@ -0,0 +1,66 @@
|
|||||||
|
services:
|
||||||
|
n8n:
|
||||||
|
image: n8nio/n8n:2.20.11 # pinned 2026-05-19 — unpinned :latest drifted 2.7→2.20.11 and broke the OIDC hooks.js
|
||||||
|
environment:
|
||||||
|
- N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}
|
||||||
|
- N8N_PORT=5678
|
||||||
|
- N8N_PROTOCOL=https
|
||||||
|
- NODE_ENV=production
|
||||||
|
- WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/
|
||||||
|
- DB_TYPE=postgresdb
|
||||||
|
- DB_POSTGRESDB_HOST=192.168.1.6
|
||||||
|
- DB_POSTGRESDB_PORT=5432
|
||||||
|
- DB_POSTGRESDB_DATABASE=n8n
|
||||||
|
- DB_POSTGRESDB_USER=n8n
|
||||||
|
- DB_POSTGRESDB_PASSWORD
|
||||||
|
- N8N_DIAGNOSTICS_ENABLED=false
|
||||||
|
- N8N_PERSONALIZATION_ENABLED=false
|
||||||
|
- N8N_ENCRYPTION_KEY
|
||||||
|
- N8N_USER_MANAGEMENT_JWT_SECRET
|
||||||
|
- N8N_SECURE_COOKIE=false
|
||||||
|
# Trust proxy for rate limiting (fixes X-Forwarded-For header issue)
|
||||||
|
- N8N_TRUST_PROXY=true
|
||||||
|
# OIDC bolt-on re-enabled 2026-05-19: paths patched for 2.20.11 pnpm layout
|
||||||
|
- EXTERNAL_HOOK_FILES=/home/node/hooks.js
|
||||||
|
- OIDC_ISSUER_URL=https://id.nuclide.systems
|
||||||
|
- OIDC_CLIENT_ID=33135ad4-a3ed-45d3-938f-639abd2b9663
|
||||||
|
- OIDC_CLIENT_SECRET=aYtWoZ5Wrqxs7kwyI1is1rLY0UATJaW391-3bzNALv0
|
||||||
|
- OIDC_REDIRECT_URI=https://n8n.nuclide.systems/auth/oidc/callback
|
||||||
|
- EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js
|
||||||
|
- N8N_ADDITIONAL_NON_UI_ROUTES=auth
|
||||||
|
- EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js
|
||||||
|
env_file: .env
|
||||||
|
hostname: n8n
|
||||||
|
container_name: n8n
|
||||||
|
restart: unless-stopped
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 2G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 1G
|
||||||
|
ports:
|
||||||
|
- 16000:5678
|
||||||
|
healthcheck:
|
||||||
|
test: ['CMD-SHELL', 'wget --spider -q http://n8n:5678/healthz || exit 1']
|
||||||
|
interval: 5s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 10
|
||||||
|
volumes:
|
||||||
|
- /opt/stacks/n8n/data:/home/node/.n8n
|
||||||
|
- ./hooks.js:/home/node/hooks.js:ro
|
||||||
|
labels:
|
||||||
|
- "homepage.group=productivity"
|
||||||
|
- "homepage.name=n8n"
|
||||||
|
- "homepage.icon=sh-n8n"
|
||||||
|
- "homepage.href=https://n8n.nuclide.systems"
|
||||||
|
- "homepage.instance.internal.href=http://192.168.1.40:16000"
|
||||||
|
- "homepage.instance.public.href=https://n8n.nuclide.systems"
|
||||||
|
- "homepage.widget.type=n8n"
|
||||||
|
- "homepage.widget.url=http://n8n:5678"
|
||||||
|
networks:
|
||||||
|
default:
|
||||||
|
external: true
|
||||||
|
name: shared_backend
|
||||||
@@ -0,0 +1,116 @@
|
|||||||
|
# Docker Compose file for running paperless from the docker container registry.
|
||||||
|
# This file contains everything paperless needs to run.
|
||||||
|
# Paperless supports amd64, arm and arm64 hardware.
|
||||||
|
#
|
||||||
|
# All compose files of paperless configure paperless in the following way:
|
||||||
|
#
|
||||||
|
# - Paperless is (re)started on system boot, if it was running before shutdown.
|
||||||
|
# - Docker volumes for storing data are managed by Docker.
|
||||||
|
# - Folders for importing and exporting files are created in the same directory
|
||||||
|
# as this file and mounted to the correct folders inside the container.
|
||||||
|
# - Paperless listens on port 8000.
|
||||||
|
#
|
||||||
|
# In addition to that, this Docker Compose file adds the following optional
|
||||||
|
# configurations:
|
||||||
|
#
|
||||||
|
# - Instead of SQLite (default), PostgreSQL is used as the database server.
|
||||||
|
# - Apache Tika and Gotenberg servers are started with paperless and paperless
|
||||||
|
# is configured to use these services. These provide support for consuming
|
||||||
|
# Office documents (Word, Excel, Power Point and their LibreOffice counter-
|
||||||
|
# parts.
|
||||||
|
#
|
||||||
|
# To install and update paperless with this file, do the following:
|
||||||
|
#
|
||||||
|
# - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
|
||||||
|
# and '.env' into a folder.
|
||||||
|
# - Run 'docker compose pull'.
|
||||||
|
# - Run 'docker compose run --rm webserver createsuperuser' to create a user.
|
||||||
|
# - Run 'docker compose up -d'.
|
||||||
|
#
|
||||||
|
# For more extensive installation and update instructions, refer to the
|
||||||
|
# documentation.
|
||||||
|
|
||||||
|
services:
|
||||||
|
broker:
|
||||||
|
image: docker.io/library/redis:7
|
||||||
|
restart: unless-stopped
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 256M
|
||||||
|
reservations:
|
||||||
|
cpus: "0.25"
|
||||||
|
memory: 128M
|
||||||
|
volumes:
|
||||||
|
- redisdata:/data
|
||||||
|
webserver:
|
||||||
|
image: ghcr.io/paperless-ngx/paperless-ngx:latest
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- "15003:8000" # internal LAN access only (not proxied externally)
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "2.0"
|
||||||
|
memory: 2G
|
||||||
|
reservations:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 1G
|
||||||
|
labels:
|
||||||
|
- "homepage.group=productivity"
|
||||||
|
- "homepage.name=Paperless-ngx"
|
||||||
|
- "homepage.icon=sh-paperless-ngx"
|
||||||
|
- "homepage.href=https://paperless.nuclide.systems"
|
||||||
|
- "homepage.instance.internal.href=http://192.168.1.40:15003"
|
||||||
|
- "homepage.instance.public.href=https://paperless.nuclide.systems"
|
||||||
|
- "homepage.widget.type=paperlessngx"
|
||||||
|
- "homepage.widget.url=http://paperless-ngx-webserver-1:8000"
|
||||||
|
volumes:
|
||||||
|
- data:/usr/src/paperless/data
|
||||||
|
- /mnt/pve/unas/media/documents/public/paperless-ngx/library:/usr/src/paperless/media
|
||||||
|
- /mnt/pve/unas/media/documents/public/paperless-ngx/export:/usr/src/paperless/export
|
||||||
|
- /mnt/pve/unas/media/documents/public/paperless-ngx/consume:/usr/src/paperless/consume
|
||||||
|
env_file: .env
|
||||||
|
environment:
|
||||||
|
PAPERLESS_REDIS: redis://broker:6379
|
||||||
|
PAPERLESS_DBHOST: 192.168.1.6
|
||||||
|
PAPERLESS_TIKA_ENABLED: 1
|
||||||
|
PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
|
||||||
|
PAPERLESS_TIKA_ENDPOINT: http://tika:9998
|
||||||
|
gotenberg:
|
||||||
|
image: docker.io/gotenberg/gotenberg:8.7
|
||||||
|
restart: unless-stopped
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 1G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 512M
|
||||||
|
# The gotenberg chromium route is used to convert .eml files. We do not
|
||||||
|
# want to allow external content like tracking pixels or even javascript.
|
||||||
|
command:
|
||||||
|
- gotenberg
|
||||||
|
- --chromium-disable-javascript=true
|
||||||
|
- --chromium-allow-list=file:///tmp/.*
|
||||||
|
tika:
|
||||||
|
image: docker.io/apache/tika:latest
|
||||||
|
restart: unless-stopped
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 1G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 512M
|
||||||
|
volumes:
|
||||||
|
data: null
|
||||||
|
media: null
|
||||||
|
redisdata: null
|
||||||
|
networks:
|
||||||
|
default:
|
||||||
|
name: shared_backend
|
||||||
|
external: true
|
||||||
@@ -0,0 +1,52 @@
|
|||||||
|
services:
|
||||||
|
garage:
|
||||||
|
image: dxflrs/garage:v1.0.0
|
||||||
|
container_name: garage
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- "10004:3900"
|
||||||
|
- "127.0.0.1:10005:3901"
|
||||||
|
volumes:
|
||||||
|
- /opt/stacks/shared-db/garage/data:/var/lib/garage/data
|
||||||
|
- /opt/stacks/shared-db/garage/meta:/var/lib/garage/meta
|
||||||
|
- ./garage.toml:/etc/garage.toml:ro
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 512M
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 256M
|
||||||
|
|
||||||
|
pgadmin:
|
||||||
|
image: dpage/pgadmin4:latest
|
||||||
|
container_name: pgadmin
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- "127.0.0.1:20010:80"
|
||||||
|
environment:
|
||||||
|
PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL}
|
||||||
|
PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD}
|
||||||
|
PGADMIN_CONFIG_SERVER_MODE: "False"
|
||||||
|
volumes:
|
||||||
|
- pgadmin-data:/var/lib/pgadmin
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 256M
|
||||||
|
reservations:
|
||||||
|
cpus: "0.25"
|
||||||
|
memory: 128M
|
||||||
|
labels:
|
||||||
|
- "homepage.name=pgAdmin"
|
||||||
|
- "homepage.icon=sh-pgadmin"
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
pgadmin-data:
|
||||||
|
|
||||||
|
networks:
|
||||||
|
default:
|
||||||
|
external: true
|
||||||
|
name: shared_backend
|
||||||
@@ -0,0 +1,43 @@
|
|||||||
|
name: traccar
|
||||||
|
services:
|
||||||
|
traccar:
|
||||||
|
container_name: traccar
|
||||||
|
hostname: traccar
|
||||||
|
restart: unless-stopped
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 1G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 512M
|
||||||
|
labels:
|
||||||
|
- "homepage.group=diagnostic"
|
||||||
|
- "homepage.name=Traccar"
|
||||||
|
- "homepage.icon=sh-traccar"
|
||||||
|
- "homepage.href=https://traccar.nuclide.systems"
|
||||||
|
- "homepage.instance.internal.href=http://192.168.1.40:15000"
|
||||||
|
- "homepage.instance.public.href=https://traccar.nuclide.systems"
|
||||||
|
- "homepage.widget.type=traccar"
|
||||||
|
- "homepage.widget.url=http://traccar:8082"
|
||||||
|
ports:
|
||||||
|
- 15000:8082
|
||||||
|
#"watch" protocol, https://www.traccar.org/identify-protocol/
|
||||||
|
- 15001:5093
|
||||||
|
- 15001:5093/udp
|
||||||
|
# - 5000-5150:5000-5150
|
||||||
|
# - 5000-5150:5000-5150/udp
|
||||||
|
volumes:
|
||||||
|
- /mnt/pve/unas/services/traccar/logs:/opt/traccar/logs:rw
|
||||||
|
- /mnt/pve/unas/services/traccar/traccar.xml:/opt/traccar/conf/traccar.xml:ro
|
||||||
|
- /opt/stacks/traccar/data:/opt/traccar/data:rw
|
||||||
|
image: traccar/traccar:latest
|
||||||
|
environment:
|
||||||
|
- PUID=997
|
||||||
|
- PGID=988
|
||||||
|
networks:
|
||||||
|
default:
|
||||||
|
external: true
|
||||||
|
name: shared_backend
|
||||||
|
|
||||||
@@ -0,0 +1,46 @@
|
|||||||
|
services:
|
||||||
|
vaultwarden:
|
||||||
|
image: vaultwarden/server:latest
|
||||||
|
container_name: vaultwarden
|
||||||
|
restart: unless-stopped
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: "1.0"
|
||||||
|
memory: 1G
|
||||||
|
reservations:
|
||||||
|
cpus: "0.5"
|
||||||
|
memory: 512M
|
||||||
|
labels:
|
||||||
|
- "homepage.group=infrastructure"
|
||||||
|
- "homepage.name=Vaultwarden"
|
||||||
|
- "homepage.icon=sh-vaultwarden"
|
||||||
|
- "homepage.href=https://vault.nuclide.systems"
|
||||||
|
- "homepage.instance.internal.href=http://192.168.1.40:11001"
|
||||||
|
- "homepage.instance.public.href=https://vault.nuclide.systems"
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
environment:
|
||||||
|
DOMAIN: https://vault.nuclide.systems # required when using a reverse proxy; your domain; vaultwarden needs to know it's https to work properly with attachments
|
||||||
|
SIGNUPS_ALLOWED: false # Deactivate this with "false" after you have created your account so that no strangers can register
|
||||||
|
SIGNUPS_DOMAINS_WHITELIST: nucli.de
|
||||||
|
# ADMIN_TOKEN: CGYk2Iu/6Ff8jrNNwZ87L7B9kFK6fkQsQ+iJKavBkFMCFOuJMBu8o9wCmbeAcp4m
|
||||||
|
TZ: Europe/Berlin
|
||||||
|
# SIGNUPS_VERIFY: false
|
||||||
|
PUSH_ENABLED: true
|
||||||
|
PUSH_INSTALLATION_ID: c723bd64-a7a8-40cb-9aee-b2da0091507c
|
||||||
|
PUSH_INSTALLATION_KEY: ll4hLKpPmDiEJaPx6RwD
|
||||||
|
PUSH_RELAY_URI: https://api.bitwarden.eu
|
||||||
|
PUSH_IDENTITY_URI: https://identity.bitwarden.eu
|
||||||
|
DATABASE_URL: postgresql://vaultwarden:${VW_PG_PASSWORD}@192.168.1.6:5432/vaultwarden
|
||||||
|
volumes:
|
||||||
|
- /opt/stacks/vaultwarden/data:/data # attachments, rsa_key.pem, config.json
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
- /etc/timezone:/etc/timezone:ro
|
||||||
|
ports:
|
||||||
|
- 11001:80 # you can replace the 11001 with your preferred port
|
||||||
|
networks:
|
||||||
|
default:
|
||||||
|
external: true
|
||||||
|
name: shared_backend
|
||||||
|
|
||||||
Reference in New Issue
Block a user