diff --git a/compose.yml b/compose.yml deleted file mode 100644 index 707386d..0000000 --- a/compose.yml +++ /dev/null @@ -1,145 +0,0 @@ ---- -# version: "3.2.3" -networks: - wg: - driver: bridge - hs: - driver: bridge - - -services: - # @NOTE https://oneuptime.com/blog/post/2026-03-18-use-podman-containers-wireguard-vpn/view - wgclient: - image: lscr.io/linuxserver/wireguard:latest - container_name: wgclient - cap_add: - # - SYS_MODULE - - NET_ADMIN - restart: unless-stopped - volumes: - # - /lib/modules:/lib/modules:ro - - ~/.config/wireguard:/config/wg-confs:Z - networks: - - wg - ports: - - 51820:51820/udp - environment: - TZ: Etc/UTC - PUID: 1000 - GUID: 1000 - sysctls: - - net.ipv4.conf.all.src_valid_mark=1 - - net.ipv6.conf.all.src_valid_mark=1 - - net.ipv6.ip_forward=1data - - net.ipv4.ip_forward=1 - labels: - glance.name: Wireguard - glance.id: wireguard - glance.icon: "si:wireguard" - glance.description: VPN client connection - - # @NOTE https://tailscale.com/docs/features/containers/docker - # @NOTE https://tailscale.com/blog/docker-tailscale-guide - tailclient: - image: tailscale/tailscale:latest - container_name: tailclient - cap_add: - # - SYS_MODULE - - NET_ADMIN - restart: unless-stopped - devices: - - /dev/net/tun:/dev/net/tun - volumes: - # - /lib/modules:/lib/modules:ro - - ~/.cvols/tailscale:/var/lib/tailscale - - ~/.config/tailscale:/config:Z - networks: - - hs - hostname: nirvana - # env_file: [tailclient/prod.env] - environment: - TS_AUTHKEY: ${TS_AUTHKEY:?Provide authentication key}?ephemeral=false - TS_SERVE_CONFIG: /config/${TS_SERVE_CONFIG_BASENAME:?Provide a basename for the Tailscale Serve configuration file}.json - TS_EXTRA_ARGS: "--advertise-tags=tag:container" - TS_STATE_DIR: "/var/lib/tailscale" - - # @TODO make subsequent containers have 'network_mode' attrbute set to value 'service:wgclient'/'service:tailclient' - # OR make subsequent containers have 'networks' attribute set to list value with 'container:wgclient'/'contaner:tailclient' item - - revproxy0: - image: caddy:latest - restart: unless-stopped - cap_add: - - NET_ADMIN - volumes: - - ~/.caddy:/etc/caddy - - ~/srv:/srv - - ~/.local/share/caddy:/usr/share/caddy - - ~/.cvols/caddy:/data - - ~/.config/caddy:/config - networks: - - "container:wgclient" - dns: - - ${WG_INTFACE_ADDR:?Enter Wireguard client container's interface address} - # env_file: [wg0-dns.env] - depends_on: - - wgclient - labels: - glance.name: Caddy - glance.id: caddy - glance.icon: "si:caddy" - glance.description: HTTPS reverse proxy server - - glance: - container_name: glance - image: glanceapp/glance - restart: unless-stopped - volumes: - # @NOTE https://github.com/glanceapp/glance/blob/main/docs/configuration.md#configuring-glance - - ~/.config/glance:/app/config # @NOTE internal container server port is changed via 'glance.yml' config file; default is 8080 - - ~/.local/share/glance:/app/assets - - /etc/localtime:/etc/localtime:ro - # Optionally, also mount docker socket if you want to use the docker containers widget - - /var/run/docker.sock:/var/run/docker.sock:ro - networks: - - "container:tailclient" - # env_file: [hs.env,glance/prod.env] - depends_on: - - tailclient - labels: - glance.name: Self - glance.icon: "si:glance" - glance.url: "${HS_URL_SCHEME:?Enter Headscale URL scheme for server}://${HS_DOMAIN:?Enter Headscale domain}" - glance.description: Dashboard - -# @NOTE https://github.com/glanceapp/glance/blob/main/docs/configuration.md#docker-containers -# @TODO apply labels to each container that allows it to show up in Glance dashboard - - stash: - image: stashapp/stash:latest - container_name: stash - restart: unless-stopped - volumes: - - /etc/localtime:/etc/localtime:ro - - ~/.config/stash:/root/.stash - - ~/.xxx/media:/data - - ~/.local/share/stash/metadata:/metadata - - ~/.local/share/stash/cache:/cache - - ~/.local/share/stash/blobs:/blobs - - ~/.xxx/stash:/generated - logging: - driver: "json-file" - options: - max-file: "10" - max-size: "2m" - networks: - - "container:tailclient" - depends_on: - - tailclient - environment: - STASH_PORT: "9999" - labels: - glance.name: Stash - glance.icon: "si:stash" - glance.url: "${HS_URL_SCHEME:?Enter Headscale URL scheme for server}://${HS_DOMAIN:?Enter Headscale domain}" - glance.description: NSFW media streaming service and gallery diff --git a/dependent/compose.yml b/dependent/compose.yml new file mode 100644 index 0000000..80f9dc5 --- /dev/null +++ b/dependent/compose.yml @@ -0,0 +1,406 @@ +--- +# version: "3.2.3" +networks: + wg: + driver: bridge + hs: + driver: bridge +volumes: + caddy-data: + caddy-share: + certbot-lib: + tailscale-lib: + redis-data: + mysql-lib: +secrets: + headscale.key: + file: ~/.podsecrets/headscale.key + root-mysql.pass: + file: ~/.podsecrets/root-mysql.pass + user-mysql.pass: + file: ~/.podsecrets/user-mysql.pass + email.pass: + file: ~/.podsecrets/email.pass + redis.pass: + file: ~/.podsecrets/redis.pass + +services: + # @NOTE https://oneuptime.com/blog/post/2026-03-18-use-podman-containers-wireguard-vpn/view + # @NOTE https://www.procustodibus.com/blog/2022/10/wireguard-in-podman/ + wgclient: + image: lscr.io/linuxserver/wireguard:latest + container_name: wgclient + cap_add: + - SYS_MODULE + - NET_ADMIN + # - NET_RAW + restart: unless-stopped + volumes: + - /etc/localtime:/etc/localtime:ro + - /lib/modules:/lib/modules:ro + - ~/.wg/containerized:/config/wg-confs:Z + networks: + - wg + hostname: wgnet + ports: + - 51820:51820/udp + sysctls: + - net.ipv4.ip_forward=1 + - net.ipv4.conf.all.src_valid_mark=1 + - net.ipv6.conf.all.forwarding=1 + - net.ipv6.conf.all.src_valid_mark=1 + env_file: + - ~/.all.env + labels: + glance.name: Wireguard + glance.id: wireguard + glance.icon: "si:wireguard" + glance.description: VPN client connection + + # @NOTE https://tailscale.com/docs/features/containers/docker + # @NOTE https://tailscale.com/blog/docker-tailscale-guide + tailclient: + image: tailscale/tailscale:latest + container_name: tailclient + cap_add: + - SYS_MODULE + - NET_ADMIN + restart: unless-stopped + devices: + - /dev/net/tun:/dev/net/tun + volumes: + - /etc/localtime:/etc/localtime:ro + - /lib/modules:/lib/modules:ro + - "tailscale-lib:/var/lib/tailscale" + - ~/.config/tailscale:/config:Z + networks: + - hs + hostname: tailnet + env_file: + - ~/.all.env + - ~/.tailscale.env + environment: + TS_AUTHKEY_FILE: /run/secrets/headscale.key + TS_SERVE_CONFIG: /config/${TS_SERVE_CONFIG_BASENAME:?Provide a basename for the Tailscale Serve configuration file}.json + TS_EXTRA_ARGS: "--advertise-tags=tag:container" + TS_STATE_DIR: /var/lib/tailscale + secrets: + - headscale.key + + # @TODO make subsequent containers have 'network_mode' attrbute set to value 'service:wgclient'/'service:tailclient' + # OR make subsequent containers have 'networks' attribute set to list value with 'container:wgclient'/'contaner:tailclient' item + + # @NOTE https://hub.docker.com/_/caddy/ + # @NOTE https://blog.genxnotes.com/en/tech/how-to-move-the-hugo-public-folder-outside-the-project-root/ + # @NOTE https://www.turtlestoffel.com/My-Quartz-Configuration#explorer-component-with-custom-content-folder + revproxy0: + image: caddy:latest + container_name: revproxy0 + cap_add: + - NET_ADMIN + restart: unless-stopped + expose: + - 80 + - 443 + - 443/udp + volumes: + - /etc/localtime:/etc/localtime:ro + - ~/.config/caddy:/etc/caddy:Z + - ~/srv/${SERVER_FQDN}:/srv/${SERVER_FQDN}:z + - ~/srv/acme.${SERVER_FQDN}:/srv/acme.${SERVER_FQDN}:ro,z + - ~/srv/notes.${SERVER_FQDN}:/srv/notes.${SERVER_FQDN}:z + - ~/srv/blog.${SERVER_FQDN}:/srv/blog.${SERVER_FQDN}:z + - ~/srv/${NEXTCLOUD_SUBDOMAIN}.${SERVER_FQDN}:/srv/${NEXTCLOUD_SUBDOMAIN}.${SERVER_FQDN}:ro,z + - "caddy-share:/usr/share/caddy" + - "caddy-data:/data:z" + - ~/.caddy:/config:Z + networks: + - "container:wgclient" + depends_on: + - wgclient + env_file: + - ~/.all.env + - ~/.nextcloud.env + labels: + glance.name: Caddy + glance.id: caddy + glance.icon: "si:caddy" + glance.url: "${SERVER_FQDN_SCHEME}://${SERVER_FQDN}" + glance.description: HTTPS reverse proxy server + + # @NOTE https://github.com/nbraun1/certbot + sslcerts: + image: nbraun1/certbot + container_name: sslcerts + restart: on-failure + volumes: + - /etc/localtime:/etc/localtime:ro + - ~/.config/letsencrypt:/etc/letsencrypt:z + - "certbot-lib:/var/lib/letsencrypt" + - ~/srv/acme.${SERVER_FQDN}:/srv/acme.${SERVER_FQDN}:z + networks: + - "container:wgclient" + depends_on: + - revproxy0 + - wgclient + env_file: + - ~/.all.env + - ~/.certbot.env + environment: + EMAIL: ${CERTBOT_EMAIL:?Provide an email for certificate process} + DOMAINS: ${CERTBOT_CHALLENGED_DOMAINS:-"${SERVER_FQDN},*.${SERVER_FQDN}"} + AUTHENTICATOR: ${CERTBOT_AUTHENTICATOR:?Specify preferred challenge} + WEBROOT_PATH: ${SERVER_WEBROOT_PATH:?Specify the web root of webserver or main web root of reverse proxy server} + ISSUANCE_TIMEOUT: 300 + CRON: ${CERTBOT_CRON:Provide CRON expression for renewal purposes} + # entrypoint: ["certonly"] + + cache0: + image: redis:trixie + container_name: cache0 + restart: unless-stopped + expose: + - 6379 + volumes: + - /etc/localtime:/etc/localtime:ro + - "redis-data:/data:z" + - ~/.config/redis:/etc/redis:Z + networks: + - "container:wgclient" + depends_on: + - wgclient + env_file: + - ~/.all.env + entrypoint: ["redis-server", "--save 60 1", "--loglevel warning", "/etc/redis/redis.conf"] + labels: + glance.name: Redis + glance.id: redis + glance.icon: "si:redis" + glance.description: "Data structure cache and document/vector query server" + + # @NOTE https://hub.docker.com/_/mysql + db0: + image: mysql:lts + container_name: db0 + restart: unless-stopped + expose: + - 3306 + volumes: + - /etc/localtime:/etc/localtime:ro + # @TODO use Ansible to adjust/edit configuration below + # @NOTE https://dev.mysql.com/doc/refman/8.0/en/using-encrypted-connections.html + - ~/.config/mysql/sql.cnf:/etc/my.cnf:Z + - mysql-lib:/var/lib/mysql + networks: + - "container:wgclient" + depends_on: + - wgclient + env_file: + - ~/.all.env + - ~/.mysql.env + environment: + MYSQL_ROOT_PASSWORD_FILE: /run/secrets/root-mysql.pass + MYSQL_USER: ${MYSQL_DB_USER:-admin} + # @TODO create secret for the below, or leave it to Ansible + # @NOTE https://github.com/docker-library/docs/blob/master/nextcloud/README.md#docker-secrets + MYSQL_PASSWORD_FILE: /run/secrets/user-mysql.pass + MYSQL_DATABASE: ${MYSQL_DB_NAME:-testdb} + secrets: + - "root-mysql.pass" + - "user-mysql.pass" + labels: + glance.name: MySQL + glance.id: mysql + glance.icon: "si:mysql" + glance.description: Database management server + + # @NOTE https://hub.docker.com/_/nextcloud + cloud: + image: nextcloud:stable-fpm + container_name: cloud + restart: unless-stopped + expose: + - 9000 + volumes: + - /etc/localtime:/etc/localtime:ro + - ~/srv/${NEXTCLOUD_SUBDOMAIN}.${SERVER_FQDN}:/var/www/html:z + networks: + - "container:wgclient" + depends_on: + - cache0 + - db0 + - revproxy0 + - wgclient + env_file: + - ~/.all.env + - ~/.email.env + - ~/.mysql.env + - ~/.nextcloud.env + environment: + REDIS_HOST: cache0 + REDIS_HOST_PASSWORD_FILE: /run/secrets/redis.pass + MYSQL_HOST: "${MYSQL_DB_HOST:?Enter the container name, hostname or public FQDN of your DBMS}:3306" + MYSQL_DATABASE: ${NEXTCLOUD_DB_NAME:-nextcloud} + MYSQL_USER: ${MYSQL_DB_USER:-admin} + MYSQL_PASSWORD_FILE: /run/secrets/user-mysql.pass + SMTP_HOST: ${EMAIL_SMTP_HOST:?Enter an SMTP host for sending adminstrative emails} + SMTP_PORT: ${EMAIL_SMTP_PORT:-465} + SMTP_SECURE: ${EMAIL_SMTP_SECURE:-ssl} + SMTP_AUTHTYPE: ${EMAIL_SMTP_AUTHTYPE:-LOGIN} + SMTP_NAME: ${EMAIL_SMTP_USERNAME:?Enter the email handle for loggng in to email server} + SMTP_PASSWORD_FILE: /run/secrets/email.pass + MAIL_FROM_ADDRESS: ${EMAIL_SMTP_USER_ALIAS:-admin} + MAIL_DOMAIN: ${EMAIL_SMTP_EMAIL_ALIAS:?Enter the hostname or public FQDN of your email handle} + # @NOTE https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/reverse_proxy_configuration.html + APACHE_DISABLE_REWRITE_IP: ${NEXTCLOUD_APACHE_DISABLE_REWRITE_IP:-1} + TRUSTED_PROXIES: ${NEXTCLOUD_TRUSTED_PROXIES:?Enter space-separated list of trusted proxy addresses} + NEXTCLOUD_TRUSTED_DOMAINS: ${NEXTCLOUD_SUBDOMAIN}.${SERVER_FQDN} + # OVERWRITEHOST: ${NEXTCLOUD_HOST_REWRITE:?Enter the hostname or public FQDN for this server} + OVERWRITECLIURL: ${NEXTCLOUD_URL_REWRITE:?Enter the hostname or public FQDN with correspondent prefixd URL scheme for this server} + OVERWRITEPROTOCOL: ${NEXTCLOUD_PROTOCOL_REWRITE:?Enter the URL scheme protocol preferred} + secrets: + - "user-mysql.pass" + - email.pass + - redis.pass + labels: + glance.name: Nextcloud + glance.id: nextcloud + glance.icon: "si:nextcloud" + glance.url: "${SERVER_FQDN_SCHEME}://${NEXTCLOUD_SUBDOMAIN}.${SERVER_FQDN}" + glance.description: "WebDAV/CardDAV/CalDAV cloud server" + + # @NOTE https://docs.gitea.com/installation/install-with-docker-rootless + # @NOTE https://oneuptime.com/blog/post/2026-03-18-run-gitea-podman-container/view + # @NOTE https://docs.gitea.com/administration/reverse-proxies + # @NOTE https://docs.gitea.com/administration/config-cheat-sheet + forge: + image: docker.gitea.com/gitea:1.26.4 + container_name: forge + restart: unless-stopped + volumes: + - /etc/timezone:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + - ~/.config/gitea:/data:z + expose: + - 3000 + - ${GITEA_SSH_PORT:-2222} + networks: + - "container:wgclient" + depends_on: + - db0 + - revproxy0 + - wgclient + env_file: + - ~/.all.env + - ~/.email.env + - ~/.mysql.env + - ~/.gitea.env + environment: + GITEA_DEFAULT_RUN_USER: ${GITEA_MODE:-dev} + GITEA_DEFAULT_APP_NAME: ${GITEA_NAME:?Enter a name or title for Gitea website} + GITEA_server_PROTOCOL: http + GITEA_server_DOMAIN: ${GITEA_SUBDOMAIN}.${SERVER_FQDN} + # @NOTE https://gist.github.com/erik-toth/087262f19941da9bf4c2ce449fe98a47 + GITEA_server_SSH_PORT: ${GITEA_SSH_PORT:-2222} + GITEA_server_SSH_EXPOSE_ANONYMOUS: "false" + GITEA_server_START_SSH_SERVER: "false" + GITEA_server_LANDING_PAGE: ${GITEA_LANDING:-explore} + GITEA_admin_DEFAULT_EMAIL_NOTIFICATIONS: onmention + GITEA_security_REVERSE_PROXY_TRUSTED_PROXIES: ${GITEA_TRUSTED_PROXIES:?Enter comma-separated list of trusted proxy addresses} + GITEA_security_PASSWORD_COMPLEXITY: lower,upper,digit,spec + GITEA_security_PASSWORD_CHECK_PWN: "true" + GITEA_service_REGISTER_EMAIL_CONFIRM: "true" + GITEA_service_DISABLE_REGISTRATION: ${GITEA_PROHIBIT_REGISTRATION:-true} + GITEA_service_DEFAULT_KEEP_EMAIL_PRIVATE: "true" + GITEA_service_ENABLE_NOTIFY_MAIL: "true" + GITEA_picture_REPOSITORY_AVATAR_FALLBACK: image + GITEA_picture_REPOSITORY_AVATAR_FALLBACK_IMAGE: img/repo_default.svg + GITEA_log_MODE: file + GITEA_log_ENABLE_SSH_LOG: "true" + GITEA_mailer_ENABLED: "true" + GITEA_mailer_PROTOCOL: ${EMAIL_SEND_PROTOCOL:-smtp}s + GITEA_mailer_SMTP_ADDR: ${EMAIL_SMTP_HOST:?Enter an SMTP host for sending adminstrative emails} + GITEA_mailer_SMTP_PORT: ${EMAIL_SMTP_PORT:-465} + GITEA_mailer_USER: ${EMAIL_SMTP_USERNAME:?Enter the email handle for loggng in to email server} + GITEA_mailer_PASSWD_FILE: /run/secrets/email.pass + GITEA_mailer_FROM: ${EMAIL_SMTP_USER_ALIAS:-admin}@${EMAIL_SMTP_EMAIL_ALIAS:?Enter the hostname or public FQDN of your email handle} + GITEA_database_DB_TYPE: ${GITEA_DB_TYPE:-mysql} + GITEA_database_HOST: "${MYSQL_DB_HOST:?Enter the container name, hostname or public FQDN of your DBMS}:3306" + GITEA_database_NAME: ${GITEA_DB_NAME:-gitea} + GITEA_database_USER: ${MYSQL_DB_USER:-admin} + GITEA_database_PASSWD_FILE: /run/secrets/user-mysql.pass + GITEA_repository_DEFAULT_BRANCH: main + GITEA_repository_DEFAULT_PRIVATE: private + GITEA_repository_ORG_MAX_CREATION_LIMIT: 75 + GITEA_repository_ENABLE_PUSH_CREATE_USER: "true" + GITEA_repository_DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH: "true" + GITEA_repository.issue_MAX_PINNED: 6 + GITEA_federation_ENABLED: "true" + secrets: + - "user-mysql.pass" + - email.pass + labels: + glance.name: Gitea + glance.id: gitea + glance.icon: "si:gitea" + glance.url: "${SERVER_FQDN_SCHEME}://${GITEA_SUBDOMAIN}.${SERVER_FQDN}" + glance.description: Git version control forge server + + glance: + image: glanceapp/glance + container_name: glance + restart: unless-stopped + expose: + - 8181 + volumes: + - /etc/localtime:/etc/localtime:ro + # Optionally, also mount docker socket if you want to use the docker containers widget + - /var/run/docker.sock:/var/run/docker.sock:ro + # @NOTE https://github.com/glanceapp/glance/blob/main/docs/configuration.md#configuring-glance + - ~/.config/glance:/app/config:Z # @NOTE internal container server port is changed via 'glance.yml' config file; default is 8080 + - ~/.local/glance:/app/assets:Z + networks: + - "container:tailclient" + depends_on: + - tailclient + # @NOTE https://github.com/glanceapp/glance/blob/main/docs/configuration.md#environment-variables + environment: + PORT: ${GLANCE_PORT:-8181} + labels: + glance.name: Self + glance.id: self + glance.icon: "si:glance" + glance.url: "${SERVER_MAGICDN_SCHEME}://${SERVER_MAGICDN}" + glance.description: Dashboard + +# @NOTE https://github.com/glanceapp/glance/blob/main/docs/configuration.md#docker-containers +# @TODO apply labels to each container that allows it to show up in Glance dashboard + +# @NOTE The following is a list of additional public-facing container services to add +# - https://opengist.io/, https://opengist.io/docs/installation/docker.html +# - https://shlink.io/, https://shlink.io/documentation/install-docker-image/ +# - https://www.funkwhale.audio/, https://docs.funkwhale.audio/administrator/installation/docker.html +# - https://join-lemmy.org/, https://join-lemmy.org/docs/administration/install_docker.html +# - https://joinbookwyrm.com/, https://docs.joinbookwyrm.com/install-prod.html +# - https://misskey-hub.net/en/, https://misskey-hub.net/en/docs/for-admin/install/guides/docker/ +# - https://hub.docker.com/r/instantlinux/proftpd +# - https://prosody.im/, https://prosody.im/download/ +# - https://element-hq.github.io/synapse/latest/setup/installation.html +# - https://www.inspircd.org/, https://hub.docker.com/r/inspircd/inspircd-docker +# - https://hub.docker.com/r/dnomd343/syncplay +# - https://hub.docker.com/r/p3terx/aria2-pro +# - https://github.com/SurgeDM/Surge#5-server-mode-with-docker-compose + +# @NOTE The following is a list of additional private container services to add +# - https://tasktrove.io/, https://docs.tasktrove.io/installation#option-2-docker-compose +# - https://github.com/dohsimpson/HabitTrove, https://github.com/dohsimpson/HabitTrove#docker-deployment +# - https://grocy.info/, https://hub.docker.com/r/linuxserver/grocy +# - https://mealie.io/, https://docs.mealie.io/documentation/getting-started/installation/installation-checklist/#step-3-customizing-the-docker-composeyaml-files +# - https://actualbudget.org/, https://actualbudget.org/docs/install/docker +# - https://sugoi.gitbook.io/lanraragi, https://sugoi.gitbook.io/lanraragi/installing-lanraragi/docker +# - https://komga.org/, https://komga.org/docs/installation/docker +# - https://github.com/janeczku/calibre-web, https://hub.docker.com/r/linuxserver/calibre-web +# - https://immich.app/, https://docs.immich.app/install/docker-compose +# - https://papra.app/en/, https://docs.papra.app/self-hosting/using-docker-compose/ +# - https://stashapp.cc/, https://docs.stashapp.cc/installation/docker/ +# - https://jellyfin.org/, https://jellyfin.org/docs/general/installation/container