748 lines
22 KiB
YAML
748 lines
22 KiB
YAML
# =============================================================================
|
|
# Torrent Stack - Docker Compose
|
|
# =============================================================================
|
|
|
|
networks:
|
|
caddy_net:
|
|
external: true
|
|
tdarr-net:
|
|
driver: bridge
|
|
default:
|
|
name: portainer_network
|
|
|
|
volumes:
|
|
#caddy_config:
|
|
#caddy_data:
|
|
# external: true
|
|
myspeed:
|
|
external: true
|
|
portainer_data:
|
|
name: portainer_data
|
|
|
|
# =============================================================================
|
|
# Key ordering per service:
|
|
# image → container_name → env_file → networks/network_mode
|
|
# → depends_on → cap_add → ports → volumes → environment
|
|
# → labels → healthcheck → security_opt → mem_limit → cpus
|
|
# → devices → restart
|
|
# =============================================================================
|
|
|
|
services:
|
|
# ---------------------------------------------------------------------------
|
|
# VPN & Download
|
|
# ---------------------------------------------------------------------------
|
|
|
|
gluetun:
|
|
image: qmcgaw/gluetun:latest
|
|
container_name: gluetun
|
|
env_file:
|
|
- .env
|
|
- ./env/.gluetun.env
|
|
cap_add:
|
|
- NET_ADMIN
|
|
ports:
|
|
- 8888:8000/tcp
|
|
- ${QBITTORRENT_PORT}:${QBITTORRENT_PORT}
|
|
- ${PROWLARR_PORT}:${PROWLARR_PORT}
|
|
- ${SONARR_PORT}:${SONARR_PORT}
|
|
- ${RADARR_PORT}:${RADARR_PORT}
|
|
- ${LIDARR_PORT}:${LIDARR_PORT}
|
|
volumes:
|
|
- ./gluetun-data:/tmp/gluetun:rw
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- VPN_SERVICE_PROVIDER=protonvpn
|
|
- VPN_TYPE=wireguard
|
|
- HTTP_CONTROL_SERVER=ON
|
|
- WIREGUARD_MTU=1280
|
|
- VPN_PORT_FORWARDING=on
|
|
- VPN_PORT_FORWARDING_PROVIDER=protonvpn
|
|
- SERVER_COUNTRIES=Netherlands
|
|
- NETWORK_LOCAL_ADDRESSES=192.168.50.0/24,172.16.0.0/12
|
|
- FIREWALL_OUTBOUND_SUBNETS=192.168.50.0/24
|
|
- TZ=${TIMEZONE}
|
|
- DNS_UPSTREAM_RESOLVER_TYPE=doh
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget --spider -q http://1.1.1.1 || exit 1"]
|
|
interval: 30s
|
|
timeout: 15s
|
|
retries: 3
|
|
start_period: 1m
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
restart: always
|
|
|
|
qbittorrent:
|
|
image: lscr.io/linuxserver/qbittorrent:latest
|
|
container_name: qbittorrent
|
|
network_mode: "container:gluetun"
|
|
depends_on:
|
|
gluetun:
|
|
condition: service_healthy
|
|
volumes:
|
|
- ./qbittorrent:/config
|
|
- ${DISK1}:${DISK1}
|
|
- ${DISK2}:${DISK2}
|
|
- ./gluetun-data:/tmp/gluetun
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- PUID=${HOST_PUID:-1000}
|
|
- PGID=${HOST_PGID:-1000}
|
|
- TZ=${TIMEZONE}
|
|
- WEBUI_PORT=${QBITTORRENT_PORT}
|
|
labels:
|
|
- "autoheal=true"
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"curl -sf http://localhost:${QBITTORRENT_PORT}/api/v2/app/version || exit 1",
|
|
]
|
|
interval: 1m
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 30s
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 512m
|
|
cpus: 2.0
|
|
restart: unless-stopped
|
|
|
|
port-updater:
|
|
image: curlimages/curl:latest
|
|
container_name: port-updater
|
|
network_mode: "container:gluetun"
|
|
depends_on:
|
|
gluetun:
|
|
condition: service_healthy
|
|
volumes:
|
|
- ./gluetun-data:/tmp/gluetun:ro
|
|
entrypoint: ["/bin/sh", "-c"]
|
|
command:
|
|
- |
|
|
trap 'exit 0' SIGTERM;
|
|
while true; do
|
|
while [ ! -s /tmp/gluetun/forwarded_port ]; do
|
|
echo "Waiting for Gluetun to provide a port..."
|
|
sleep 5
|
|
done
|
|
|
|
read -r PORT_VAL < /tmp/gluetun/forwarded_port;
|
|
CLEAN_PORT=$$(echo "$$PORT_VAL" | tr -d '\r\n ');
|
|
|
|
if [ -n "$$CLEAN_PORT" ]; then
|
|
echo "Updating qBit to port: $$CLEAN_PORT";
|
|
sleep 10;
|
|
curl -s -X POST -d "json={\"listen_port\":$$CLEAN_PORT}" http://localhost:${QBITTORRENT_PORT}/api/v2/app/setPreferences;
|
|
sleep 3600 & wait $$!;
|
|
else
|
|
sleep 10
|
|
fi
|
|
done
|
|
labels:
|
|
- "autoheal=true"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -sf https://1.1.1.1 || exit 1"]
|
|
interval: 1m
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 30s
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
mem_limit: 64m
|
|
cpus: 0.25
|
|
restart: unless-stopped
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# *arr Stack
|
|
# ---------------------------------------------------------------------------
|
|
|
|
prowlarr:
|
|
image: lscr.io/linuxserver/prowlarr:latest
|
|
container_name: prowlarr
|
|
network_mode: "container:gluetun"
|
|
depends_on:
|
|
gluetun:
|
|
condition: service_healthy
|
|
volumes:
|
|
- ./prowlarr:/config
|
|
- ./notify.sh:/notify.sh:ro
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- PUID=${HOST_PUID:-1000}
|
|
- PGID=${HOST_PGID:-1000}
|
|
- TZ=${TIMEZONE}
|
|
labels:
|
|
- "autoheal=true"
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"curl -sf http://localhost:${PROWLARR_PORT}/ping || exit 1",
|
|
]
|
|
interval: 1m
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 30s
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
restart: unless-stopped
|
|
|
|
sonarr:
|
|
image: lscr.io/linuxserver/sonarr:latest
|
|
container_name: sonarr
|
|
network_mode: "container:gluetun"
|
|
depends_on:
|
|
gluetun:
|
|
condition: service_healthy
|
|
volumes:
|
|
- /var/lib/sonarr:/config
|
|
- ${DISK1}:${DISK1}
|
|
- ${DISK2}:${DISK2}
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- PUID=${HOST_PUID:-1000}
|
|
- PGID=${HOST_PGID:-1000}
|
|
- TZ=${TIMEZONE}
|
|
labels:
|
|
- "autoheal=true"
|
|
healthcheck:
|
|
test:
|
|
["CMD-SHELL", "curl -sf http://localhost:${SONARR_PORT}/ping || exit 1"]
|
|
interval: 1m
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
restart: unless-stopped
|
|
|
|
radarr:
|
|
image: lscr.io/linuxserver/radarr:latest
|
|
container_name: radarr
|
|
network_mode: "container:gluetun"
|
|
depends_on:
|
|
gluetun:
|
|
condition: service_healthy
|
|
volumes:
|
|
- /var/lib/radarr:/config
|
|
- ${DISK1}:${DISK1}
|
|
- ${DISK2}:${DISK2}
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- PUID=${HOST_PUID:-1000}
|
|
- PGID=${HOST_PGID:-1000}
|
|
- TZ=${TIMEZONE}
|
|
labels:
|
|
- "autoheal=true"
|
|
healthcheck:
|
|
test:
|
|
["CMD-SHELL", "curl -sf http://localhost:${RADARR_PORT}/ping || exit 1"]
|
|
interval: 1m
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 30s
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
restart: unless-stopped
|
|
|
|
lidarr:
|
|
image: lscr.io/linuxserver/lidarr:latest
|
|
container_name: lidarr
|
|
network_mode: "container:gluetun"
|
|
depends_on:
|
|
gluetun:
|
|
condition: service_healthy
|
|
volumes:
|
|
- ./lidarr:/music
|
|
- /var/lib/lidarr:/config
|
|
- ${DISK1}:${DISK1}
|
|
- ${DISK2}:${DISK2}
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- PUID=${HOST_PUID:-1000}
|
|
- PGID=${HOST_PGID:-1000}
|
|
- TZ=${TIMEZONE}
|
|
labels:
|
|
- "autoheal=true"
|
|
healthcheck:
|
|
test:
|
|
["CMD-SHELL", "curl -sf http://localhost:${LIDARR_PORT}/ping || exit 1"]
|
|
interval: 1m
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 30s
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
restart: unless-stopped
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Media
|
|
# ---------------------------------------------------------------------------
|
|
|
|
tautulli:
|
|
image: ghcr.io/tautulli/tautulli
|
|
container_name: tautulli
|
|
networks:
|
|
- caddy_net
|
|
ports:
|
|
- ${TAUTULLI_PORT}:${TAUTULLI_PORT}
|
|
volumes:
|
|
- ./tautulli:/config
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- PUID=${HOST_PUID:-1000}
|
|
- PGID=${HOST_PGID:-1000}
|
|
- TZ=${TIMEZONE}
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
restart: unless-stopped
|
|
|
|
tdarr:
|
|
image: haveagitgat/tdarr:latest
|
|
container_name: tdarr
|
|
networks:
|
|
- tdarr-net
|
|
ports:
|
|
- ${TDARR_PORT}:${TDARR_PORT}
|
|
- ${TDARR_NODE_PORT}:${TDARR_NODE_PORT}
|
|
volumes:
|
|
- ./tdarr/server:/app/server
|
|
- ./tdarr/configs:/app/configs
|
|
- ./tdarr/temp:/temp
|
|
- ${DISK1}:${DISK1}
|
|
- ${DISK2}:${DISK2}
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- TZ=${TIMEZONE}
|
|
- PUID=${HOST_PUID:-1000}
|
|
- PGID=${HOST_PGID:-1000}
|
|
- UMASK_SET=002
|
|
- serverIP=0.0.0.0
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 512m
|
|
cpus: 2.0
|
|
restart: unless-stopped
|
|
|
|
tdarr-node:
|
|
image: haveagitgat/tdarr_node:latest
|
|
container_name: tdarr-node
|
|
networks:
|
|
- tdarr-net
|
|
volumes:
|
|
- ./tdarr/configs:/app/configs
|
|
- ./tdarr/logs:/app/logs
|
|
- ./tdarr/temp:/temp
|
|
- ${DISK1}:${DISK1}
|
|
- ${DISK2}:${DISK2}
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- TZ=${TIMEZONE}
|
|
- PUID=${HOST_PUID:-1000}
|
|
- PGID=${HOST_PGID:-1000}
|
|
- nodeID=${TDARR_NODE_ID}
|
|
- nodeIP=0.0.0.0
|
|
- serverIP=tdarr
|
|
- serverPort=${TDARR_NODE_PORT}
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 2g
|
|
cpus: 4.0
|
|
devices:
|
|
- /dev/dri:/dev/dri
|
|
restart: unless-stopped
|
|
|
|
seerr:
|
|
image: ghcr.io/seerr-team/seerr:latest
|
|
container_name: seerr
|
|
networks:
|
|
- caddy_net
|
|
ports:
|
|
- ${SEERR_PORT}:${SEERR_PORT}
|
|
volumes:
|
|
- ./seerr:/app/config
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- LOG_LEVEL=info
|
|
- TZ=${TIMEZONE}
|
|
- PUID=${HOST_PUID:-1000}
|
|
- PGID=${HOST_PGID:-1000}
|
|
labels:
|
|
- "autoheal=true"
|
|
init: true
|
|
working_dir: "/app"
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"wget -qO- http://127.0.0.1:${SEERR_PORT}/api/v1/status || exit 1",
|
|
]
|
|
interval: 1m
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
restart: unless-stopped
|
|
|
|
# Anubis anti-bot proxy for Seerr (uncomment to enable):
|
|
#seerr-anubis:
|
|
# image: ghcr.io/techarohq/anubis:latest
|
|
# container_name: seerr-anubis
|
|
# networks:
|
|
# - caddy_net
|
|
# environment:
|
|
# - BIND=:55055
|
|
# - TARGET=http://seerr:${SEERR_PORT}
|
|
# security_opt:
|
|
# - no-new-privileges:true
|
|
# mem_limit: 128m
|
|
# cpus: 0.5
|
|
# restart: unless-stopped
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Monitoring
|
|
# ---------------------------------------------------------------------------
|
|
|
|
homepage:
|
|
image: ghcr.io/gethomepage/homepage:latest
|
|
container_name: homepage
|
|
env_file:
|
|
- .env
|
|
- ./env/.homepage.env
|
|
networks:
|
|
- caddy_net
|
|
ports:
|
|
- ${HOMEPAGE_PORT}:${HOMEPAGE_PORT}
|
|
volumes:
|
|
- ./homepage:/app/config
|
|
- ./homepage/images:/app/public/images
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- ./gluetun-data:/tmp/gluetun:ro
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- "HOMEPAGE_ALLOWED_HOSTS=gethomepage.dev,${LOCAL_IPV4}:${HOMEPAGE_PORT},${SERVER_NAME}:${HOMEPAGE_PORT},${SERVER_NAME}.${TAILNET_NAME}:${HOMEPAGE_PORT}"
|
|
- "HOMEPAGE_VAR_DISK1=${DISK1}"
|
|
- "HOMEPAGE_VAR_DISK2=${DISK2}"
|
|
- "HOMEPAGE_VAR_DISK3=${DISK3}"
|
|
- "HOMEPAGE_VAR_WEB_PROTOCOL=${WEB_PROTOCOL}"
|
|
- "HOMEPAGE_VAR_LOCAL_IPV4=${LOCAL_IPV4}"
|
|
- "HOMEPAGE_VAR_SERVER_NAME=${SERVER_NAME}"
|
|
- "HOMEPAGE_VAR_PLEX_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${PLEX_PORT}"
|
|
- "HOMEPAGE_VAR_QBITTORRENT_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${QBITTORRENT_PORT}"
|
|
- "HOMEPAGE_VAR_PROWLARR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${PROWLARR_PORT}"
|
|
- "HOMEPAGE_VAR_SONARR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${SONARR_PORT}"
|
|
- "HOMEPAGE_VAR_RADARR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${RADARR_PORT}"
|
|
- "HOMEPAGE_VAR_LIDARR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${LIDARR_PORT}"
|
|
- "HOMEPAGE_VAR_TAUTULLI_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${TAUTULLI_PORT}"
|
|
- "HOMEPAGE_VAR_TDARR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${TDARR_PORT}"
|
|
- "HOMEPAGE_VAR_HOMEPAGE_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${HOMEPAGE_PORT}"
|
|
- "HOMEPAGE_VAR_GLANCES_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${GLANCES_PORT}"
|
|
- "HOMEPAGE_VAR_SEERR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${SEERR_PORT}"
|
|
- "HOMEPAGE_VAR_MYSPEED_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${MYSPEED_PORT}"
|
|
- "HOMEPAGE_VAR_ODYSSEUS_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${ODYSSEUS_PORT}"
|
|
- "HOMEPAGE_VAR_PIHOLE_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${PIHOLE_PORT}"
|
|
- "HOMEPAGE_VAR_PORTAINER_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${PORTAINER_PORT}"
|
|
- "HOMEPAGE_VAR_SCRUTINY_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${SCRUTINY_PORT}"
|
|
- "HOMEPAGE_VAR_KARAKEEP_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${KARAKEEP_PORT}"
|
|
- "HOMEPAGE_VAR_PLEX_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${PLEX_PORT}"
|
|
- "HOMEPAGE_VAR_QBITTORRENT_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${QBITTORRENT_PORT}"
|
|
- "HOMEPAGE_VAR_PROWLARR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${PROWLARR_PORT}"
|
|
- "HOMEPAGE_VAR_SONARR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${SONARR_PORT}"
|
|
- "HOMEPAGE_VAR_RADARR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${RADARR_PORT}"
|
|
- "HOMEPAGE_VAR_LIDARR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${LIDARR_PORT}"
|
|
- "HOMEPAGE_VAR_TAUTULLI_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${TAUTULLI_PORT}"
|
|
- "HOMEPAGE_VAR_TDARR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${TDARR_PORT}"
|
|
- "HOMEPAGE_VAR_HOMEPAGE_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${HOMEPAGE_PORT}"
|
|
- "HOMEPAGE_VAR_GLANCES_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${GLANCES_PORT}"
|
|
- "HOMEPAGE_VAR_SEERR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${SEERR_PORT}"
|
|
- "HOMEPAGE_VAR_MYSPEED_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${MYSPEED_PORT}"
|
|
- "HOMEPAGE_VAR_ODYSSEUS_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${ODYSSEUS_PORT}"
|
|
- "HOMEPAGE_VAR_PIHOLE_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${PIHOLE_PORT}"
|
|
- "HOMEPAGE_VAR_PORTAINER_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${PORTAINER_PORT}"
|
|
- "HOMEPAGE_VAR_SCRUTINY_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${SCRUTINY_PORT}"
|
|
- "HOMEPAGE_VAR_KARAKEEP_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${KARAKEEP_PORT}"
|
|
- TZ=${TIMEZONE}
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
restart: unless-stopped
|
|
|
|
# glances:
|
|
# image: nicolargo/glances:latest-full
|
|
# container_name: glances
|
|
# network_mode: host
|
|
# volumes:
|
|
# - /etc/os-release:/etc/os-release:ro
|
|
# - /:/host:ro
|
|
# #- /etc/localtime:/etc/localtime:ro
|
|
# #- /etc/timezone:/etc/timezone:ro
|
|
# environment:
|
|
# - "GLANCES_OPT=-w --password ${GLANCES_PASSWORD}"
|
|
# - PUID=${HOST_PUID:-1000}
|
|
# - PGID=${HOST_PGID:-1000}
|
|
# - TZ=${TIMEZONE}
|
|
# healthcheck:
|
|
# test:
|
|
# ["CMD", "curl", "-f", "http://localhost:${GLANCES_PORT}/api/4/status"]
|
|
# interval: 1m
|
|
# timeout: 10s
|
|
# retries: 3
|
|
# start_period: 60s
|
|
# security_opt:
|
|
# - no-new-privileges:true
|
|
# mem_limit: 256m
|
|
# cpus: 1.0
|
|
# devices:
|
|
# - /dev/dri:/dev/dri
|
|
# restart: unless-stopped
|
|
# # Uncomment to protect Glances WebUI by a login/password (add --password to GLANCES_OPT)
|
|
# secrets:
|
|
# - source: glances_password
|
|
# target: /root/.config/glances/<login>.pwd
|
|
# secrets:
|
|
# glances_password:
|
|
# file: ./secrets/glances_password
|
|
|
|
autoheal:
|
|
image: willfarrell/autoheal:latest
|
|
container_name: autoheal
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- AUTOHEAL_CONTAINER_LABEL=all
|
|
- AUTOHEAL_INTERVAL=30
|
|
- AUTOHEAL_START_PERIOD=60
|
|
- TZ=${TIMEZONE}
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
read_only: true
|
|
mem_limit: 64m
|
|
cpus: 0.25
|
|
restart: unless-stopped
|
|
|
|
myspeed:
|
|
image: germannewsmaker/myspeed
|
|
container_name: myspeed
|
|
ports:
|
|
- ${MYSPEED_PORT}:${MYSPEED_PORT}/tcp
|
|
volumes:
|
|
- myspeed:/myspeed/data
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- TZ=${TIMEZONE}
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
restart: unless-stopped
|
|
|
|
scrutiny:
|
|
image: ghcr.io/analogj/scrutiny:nightly-omnibus
|
|
container_name: scrutiny
|
|
cap_add:
|
|
- SYS_RAWIO
|
|
ports:
|
|
- ${SCRUTINY_PORT}:8080
|
|
- ${SCRUTINY_ADMIN_PORT}:8086
|
|
volumes:
|
|
- /run/udev:/run/udev:ro
|
|
- ./scrutiny/config:/opt/scrutiny/config
|
|
- ./scrutiny/influxdb:/opt/scrutiny/influxdb
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- TZ=${TIMEZONE}
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 512m
|
|
cpus: 1.0
|
|
devices:
|
|
- /dev/nvme0n1
|
|
- /dev/sda
|
|
restart: unless-stopped
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Infrastructure
|
|
# ---------------------------------------------------------------------------
|
|
|
|
pihole:
|
|
image: pihole/pihole:latest
|
|
container_name: pihole
|
|
cap_add:
|
|
- NET_ADMIN # Allows managing network interfaces & sockets
|
|
- NET_BIND_SERVICE # Allows non-root users to bind to ports < 1024 (port 53 & 123)
|
|
- SYS_TIME # Resolves the NTP system time warning
|
|
network_mode: host
|
|
ports:
|
|
- 53:53/tcp
|
|
- 53:53/udp
|
|
- 67:67/udp
|
|
- ${PIHOLE_PORT}:${PIHOLE_PORT}/tcp
|
|
volumes:
|
|
- ./etc-pihole:/etc/pihole
|
|
- ./etc-dnsmasq.d:/etc/dnsmasq.d
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- TZ=${TIMEZONE}
|
|
- FTLCONF_misc_etc_dnsmasq_d=true
|
|
# security_opt:
|
|
# - no-new-privileges:true
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
restart: unless-stopped
|
|
|
|
cloudflared:
|
|
image: cloudflare/cloudflared:latest
|
|
container_name: cloudflared
|
|
env_file:
|
|
- ./env/.cloudflared.env
|
|
command: tunnel --no-autoupdate run # --token ${CLOUDFLARED_KEY}
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
read_only: true
|
|
mem_limit: 128m
|
|
cpus: 0.5
|
|
restart: always
|
|
|
|
portainer:
|
|
image: portainer/portainer-ce:lts
|
|
container_name: portainer
|
|
ports:
|
|
- ${PORTAINER_PORT}:${PORTAINER_PORT}
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- portainer_data:/data
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- TZ=${TIMEZONE}
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
restart: unless-stopped
|
|
|
|
caddy:
|
|
image: caddy:latest
|
|
container_name: caddy
|
|
networks:
|
|
- caddy_net
|
|
ports:
|
|
- 80:80
|
|
- 443:443
|
|
volumes:
|
|
- ./caddy/Caddyfile:/etc/caddy/Caddyfile
|
|
- ./caddy/site:/srv
|
|
- ./caddy/caddy_data:/data
|
|
- ./caddy/caddy_config:/config
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- TZ=${TIMEZONE}
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 128m
|
|
cpus: 0.5
|
|
restart: unless-stopped
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Karakeep
|
|
# ---------------------------------------------------------------------------
|
|
|
|
karakeep:
|
|
image: ghcr.io/karakeep-app/karakeep:${KARAKEEP_VERSION:-release}
|
|
container_name: karakeep
|
|
env_file:
|
|
- ./env/.karakeep.env
|
|
ports:
|
|
- ${KARAKEEP_PORT}:3000 # must be 3000 as per the dev
|
|
volumes:
|
|
- ./karakeep-data:/data
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- MEILI_ADDR=http://meilisearch:${MEILI_PORT}
|
|
- BROWSER_WEB_URL=http://chrome:${KARAKEEP_CHROME_PORT}
|
|
- DATA_DIR=/data
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 512m
|
|
cpus: 2.0
|
|
restart: unless-stopped
|
|
|
|
chrome:
|
|
image: gcr.io/zenika-hub/alpine-chrome:124
|
|
container_name: karakeep-chromebrowser
|
|
command:
|
|
- --no-sandbox
|
|
- --disable-gpu
|
|
- --disable-dev-shm-usage
|
|
- --remote-debugging-address=0.0.0.0
|
|
- --remote-debugging-port=${KARAKEEP_CHROME_PORT}
|
|
- --hide-scrollbars
|
|
- --disable-blink-features=AutomationControlled
|
|
- --window-size=1440,900
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 512m
|
|
cpus: 1.0
|
|
restart: unless-stopped
|
|
|
|
meilisearch:
|
|
image: getmeili/meilisearch:v1.41.0
|
|
container_name: karakeep-meilisearch
|
|
env_file:
|
|
- .env
|
|
volumes:
|
|
- ./meilisearch:/meili_data
|
|
#- /etc/localtime:/etc/localtime:ro
|
|
#- /etc/timezone:/etc/timezone:ro
|
|
environment:
|
|
- MEILI_NO_ANALYTICS=true
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
mem_limit: 512m
|
|
cpus: 1.0
|
|
restart: unless-stopped
|