From 5d3187181dd2469bfa695f757602c7feed3643ee Mon Sep 17 00:00:00 2001 From: fkrebs Date: Thu, 28 May 2026 03:15:11 +0200 Subject: [PATCH] auto: sync 2026-05-28 --- karakeep/docker-compose.yml | 78 +++++++++++++++++------------- n8n/docker-compose.yml | 88 ++++++++++++++++++---------------- vaultwarden/docker-compose.yml | 2 +- 3 files changed, 93 insertions(+), 75 deletions(-) diff --git a/karakeep/docker-compose.yml b/karakeep/docker-compose.yml index a75e2b1..108c25a 100644 --- a/karakeep/docker-compose.yml +++ b/karakeep/docker-compose.yml @@ -3,9 +3,9 @@ services: image: ghcr.io/hoarder-app/hoarder:${HOARDER_VERSION:-release} container_name: karakeep volumes: - - /opt/stacks/karakeep/localdata/data:/data + - /opt/stacks/karakeep/localdata/data:/data ports: - - 17001:3000 + - 17001:3000 environment: HOARDER_VERSION: ${HOARDER_VERSION} NEXTAUTH_SECRET: ${NEXTAUTH_SECRET} @@ -30,52 +30,61 @@ services: deploy: resources: limits: - cpus: "1.0" + cpus: '1.0' memory: 2G reservations: - cpus: "0.5" + cpus: '0.5' memory: 1G healthcheck: - # karakeep serves health at /api/health (/health is 404) - test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"] + test: + - CMD + - curl + - -f + - http://localhost:3000/api/health interval: 30s timeout: 10s retries: 3 start_period: 40s + networks: + - default restart: unless-stopped labels: - - "homepage.group=productivity" - - "homepage.name=Karakeep" - - "homepage.icon=sh-karakeep" - - "homepage.href=https://hoarder.nuclide.systems" - - "homepage.instance.internal.href=http://192.168.1.40:17001" - - "homepage.instance.public.href=https://hoarder.nuclide.systems" - - "homepage.widget.type=karakeep" - - "homepage.widget.url=http://192.168.1.40:17001" - - "homepage.widget.key=ak2_19817764ad2d3b7bc010_add146880ec70ee560cc8fbf87b46085" + - homepage.group=productivity + - homepage.name=Karakeep + - homepage.icon=sh-karakeep + - homepage.href=https://hoarder.nuclide.systems + - homepage.instance.internal.href=http://192.168.1.40:17001 + - homepage.instance.public.href=https://hoarder.nuclide.systems + - homepage.widget.type=karakeep + - homepage.widget.url=http://192.168.1.40:17001 + - homepage.widget.key=ak2_19817764ad2d3b7bc010_add146880ec70ee560cc8fbf87b46085 chrome: image: gcr.io/zenika-hub/alpine-chrome:123 container_name: karakeep_chrome - shm_size: '512m' + shm_size: 512m command: - - --no-sandbox - - --disable-gpu - - --disable-dev-shm-usage - - --remote-debugging-address=0.0.0.0 - - --remote-debugging-port=9222 - - --hide-scrollbars + - --no-sandbox + - --disable-gpu + - --disable-dev-shm-usage + - --remote-debugging-address=0.0.0.0 + - --remote-debugging-port=9222 + - --hide-scrollbars deploy: resources: limits: - cpus: "0.5" + cpus: '0.5' memory: 1G reservations: - cpus: "0.25" + cpus: '0.25' memory: 512M healthcheck: - # alpine-chrome has no curl; busybox wget is present. Use 127.0.0.1 NOT - # localhost — localhost resolves to ::1 but Chrome binds IPv4 only. - test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:9222/json/version"] + test: + - CMD + - wget + - -q + - -O + - /dev/null + - http://127.0.0.1:9222/json/version interval: 30s timeout: 10s retries: 3 @@ -86,20 +95,23 @@ services: container_name: karakeep_meilisearch environment: MEILI_MASTER_KEY: ${MEILI_MASTER_KEY} - MEILI_NO_ANALYTICS: "true" + MEILI_NO_ANALYTICS: 'true' volumes: - # - meilisearch:/meili_data - - /opt/stacks/karakeep/localdata/meili:/meili_data + - /opt/stacks/karakeep/localdata/meili:/meili_data deploy: resources: limits: - cpus: "1.0" + cpus: '1.0' memory: 2G reservations: - cpus: "0.5" + cpus: '0.5' memory: 1G healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:7700/health"] + test: + - CMD + - curl + - -f + - http://localhost:7700/health interval: 30s timeout: 10s retries: 3 diff --git a/n8n/docker-compose.yml b/n8n/docker-compose.yml index 618443f..48f4669 100644 --- a/n8n/docker-compose.yml +++ b/n8n/docker-compose.yml @@ -1,65 +1,71 @@ services: n8n: - image: n8nio/n8n:2.20.11 # pinned 2026-05-19 — unpinned :latest drifted 2.7→2.20.11 and broke the OIDC hooks.js + image: n8nio/n8n:2.20.11 environment: - - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME} - - N8N_PORT=5678 - - N8N_PROTOCOL=https - - NODE_ENV=production - - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/ - - DB_TYPE=postgresdb - - DB_POSTGRESDB_HOST=192.168.1.6 - - DB_POSTGRESDB_PORT=5432 - - DB_POSTGRESDB_DATABASE=n8n - - DB_POSTGRESDB_USER=n8n - - DB_POSTGRESDB_PASSWORD=${DB_POSTGRESDB_PASSWORD} - - N8N_DIAGNOSTICS_ENABLED=false - - N8N_PERSONALIZATION_ENABLED=false - - N8N_ENCRYPTION_KEY - - N8N_USER_MANAGEMENT_JWT_SECRET - - N8N_SECURE_COOKIE=false - # Trust proxy for rate limiting (fixes X-Forwarded-For header issue) - - N8N_TRUST_PROXY=true - # OIDC bolt-on re-enabled 2026-05-19: paths patched for 2.20.11 pnpm layout - - EXTERNAL_HOOK_FILES=/home/node/hooks.js - - OIDC_ISSUER_URL=https://id.nuclide.systems - - OIDC_CLIENT_ID=33135ad4-a3ed-45d3-938f-639abd2b9663 - - OIDC_CLIENT_SECRET=aYtWoZ5Wrqxs7kwyI1is1rLY0UATJaW391-3bzNALv0 - - OIDC_REDIRECT_URI=https://n8n.nuclide.systems/auth/oidc/callback - - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js - - N8N_ADDITIONAL_NON_UI_ROUTES=auth - - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js + - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME} + - N8N_PORT=5678 + - N8N_PROTOCOL=https + - NODE_ENV=production + - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/ + - DB_TYPE=postgresdb + - DB_POSTGRESDB_HOST=192.168.1.6 + - DB_POSTGRESDB_PORT=5432 + - DB_POSTGRESDB_DATABASE=n8n + - DB_POSTGRESDB_USER=n8n + - DB_POSTGRESDB_PASSWORD=${DB_POSTGRESDB_PASSWORD} + - N8N_DIAGNOSTICS_ENABLED=false + - N8N_PERSONALIZATION_ENABLED=false + - N8N_ENCRYPTION_KEY + - N8N_USER_MANAGEMENT_JWT_SECRET + - N8N_SECURE_COOKIE=false + - N8N_TRUST_PROXY=true + - EXTERNAL_HOOK_FILES=/home/node/hooks.js + - OIDC_ISSUER_URL=https://id.nuclide.systems + - OIDC_CLIENT_ID=33135ad4-a3ed-45d3-938f-639abd2b9663 + - OIDC_CLIENT_SECRET=aYtWoZ5Wrqxs7kwyI1is1rLY0UATJaW391-3bzNALv0 + - OIDC_REDIRECT_URI=https://n8n.nuclide.systems/auth/oidc/callback + - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js + - N8N_ADDITIONAL_NON_UI_ROUTES=auth + - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js hostname: n8n container_name: n8n restart: unless-stopped deploy: resources: limits: - cpus: "1.0" + cpus: '1.0' memory: 2G reservations: - cpus: "0.5" + cpus: '0.5' memory: 1G ports: - 16000:5678 healthcheck: - test: ['CMD-SHELL', 'wget --spider -q http://n8n:5678/healthz || exit 1'] + test: + - CMD-SHELL + - wget --spider -q http://n8n:5678/healthz || exit 1 interval: 5s timeout: 5s retries: 10 volumes: - - /opt/stacks/n8n/data:/home/node/.n8n - - /opt/stacks/n8n/hooks.js:/home/node/hooks.js:ro + - /opt/stacks/n8n/data:/home/node/.n8n + - /opt/stacks/n8n/hooks.js:/home/node/hooks.js:ro labels: - - "homepage.group=productivity" - - "homepage.name=n8n" - - "homepage.icon=sh-n8n" - - "homepage.href=https://n8n.nuclide.systems" - - "homepage.instance.internal.href=http://192.168.1.40:16000" - - "homepage.instance.public.href=https://n8n.nuclide.systems" - - "homepage.widget.type=n8n" - - "homepage.widget.url=http://n8n:5678" + - homepage.group=productivity + - homepage.name=n8n + - homepage.icon=sh-n8n + - homepage.href=https://n8n.nuclide.systems + - homepage.instance.internal.href=http://192.168.1.40:16000 + - homepage.instance.public.href=https://n8n.nuclide.systems + - homepage.widget.type=n8n + - homepage.widget.url=http://n8n:5678 + networks: + - default + - ai-internal networks: default: external: true name: shared_backend + ai-internal: + external: true + name: ai-internal diff --git a/vaultwarden/docker-compose.yml b/vaultwarden/docker-compose.yml index 388fa8b..ec68f4a 100644 --- a/vaultwarden/docker-compose.yml +++ b/vaultwarden/docker-compose.yml @@ -33,7 +33,7 @@ services: PUSH_IDENTITY_URI: https://identity.bitwarden.eu DATABASE_URL: postgresql://vaultwarden:${VW_PG_PASSWORD}@192.168.1.6:5432/vaultwarden volumes: - - /opt/stacks/vaultwarden/data:/data # attachments, rsa_key.pem, config.json + - /mnt/pve/unas/services/vaultwarden:/data # attachments, rsa_key.pem, config.json - /etc/localtime:/etc/localtime:ro - /etc/timezone:/etc/timezone:ro ports: