homelab/compose-files
0
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Remove env_file dependencies from media and maintenance stacks - inline all non-secret values directly in compose files
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse Source
This commit is contained in:
admin
2026-06-21 22:34:45 -07:00
parent a651848f48
commit b84fae335d
2 changed files with 407 additions and 322 deletions
Download Patch File Download Diff File Expand all files Collapse all files
maintenance.yaml
+89
View File
@@ -0,0 +1,89 @@
services:
cronicle:
volumes:
- /var/run/docker.sock:/var/run/docker.sock:rw
- /volume1/docker/cronicle/data:/opt/cronicle/data:rw
- /volume1/docker/cronicle/logs:/opt/cronicle/logs:rw
- /volume1/docker/cronicle/plugins:/opt/cronicle/plugins:rw
- /volume1/docker/cronicle/app:/opt/cronicle/app:rw
- /volume1/docker/cronicle/ssh_keys:/opt/cronicle/ssh_keys:rw
# - /volume1/docker/cronicle/conf:/opt/cronicle/conf:rw
hostname: schedule
ports:
- 3012:3012
# container_name: cronicle
image: bluet/cronicle-docker:latest
environment:
- CRONICLE_base_app_url=https://schedule.bryanmail.net
# - CRONICLE_VERSION 0.9.59
- CRONICLE_WebServer__http_port=3012
- CRONICLE_WebServer__https_port=443
- CRONICLE_web_socket_use_hostnames=1
- CRONICLE_server_comm_use_hostnames=1
- CRONICLE_web_direct_connect=0
- CRONICLE_custom_live_log_socket_url=schedule.bryanmail.net
# - CRONICLE_socket_io_transports=polling
networks:
traefik_backend:
aliases:
- schedule
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.cron.rule=Host(`schedule.bryanmail.net`)
- traefik.http.routers.cron.tls=true
- traefik.http.routers.cron.tls.certresolver=letsencrypt
- traefik.http.routers.cron.entrypoints=websecure
- traefik.http.services.cron.loadbalancer.server.port=3012
- traefik.swarm.network=traefik_backend
- traefik.http.routers.cron.middlewares=forwardAuth-authentik@file, crowdsec@file
- traefik.http.routers.cron-ip.rule=Host(`schedule.bryanmail.net`) && ClientIP(`10.0.0.0/8`)
- traefik.http.routers.cron-ip.tls=true
- traefik.http.routers.cron-ip.tls.certresolver=letsencrypt
- traefik.http.routers.cron-ip.entrypoints=websecure
resources:
limits:
cpus: '2' # Limit to 0.5 CPU core
memory: 512M
uptime-kuma:
image: louislam/uptime-kuma:2
hostname: uptime-kuma
# ports:
# - "3001:3001" # This maps the container port "3001" to the host port "3001"
volumes:
- /volume1/docker/uptime-kuma/data:/app/data # Configuring persistent storage
- /var/run/docker.sock:/var/run/docker.sock:ro
environment:
- TZ=PST # Set the timezone (change to your preferred local timezone so monitoring times are the same)
- UMASK=0022 # Set your file permissions manually
networks:
- traefik_backend # add your own custom network config
- postgresql_db-backend
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3001"]
interval: 30s
retries: 3
start_period: 10s
timeout: 5s
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.uptime.rule=Host(`uptime.bryanmail.net`)
- traefik.http.routers.uptime.tls=true
- traefik.http.routers.uptime.tls.certresolver=letsencrypt
- traefik.http.routers.uptime.entrypoints=websecure
- traefik.http.services.uptime.loadbalancer.server.port=3001
- traefik.http.services.uptime.loadbalancer.server.scheme=http
- traefik.swarm.network=traefik_backend
- traefik.http.routers.uptime.middlewares=forwardAuth-authentik@file, crowdsec@file
networks:
postgresql_db-backend:
external: true
traefik_backend:
external: true
media.yaml
+318 -322
View File
@@ -1,322 +1,318 @@
services:
Plex-Media-Server-GPU:
env_file:
- media.env
hostname: plex
cap_add:
- SYS_MODULE
entrypoint:
- "/init"
# - /bin/bash #turn on for DB maintenance
# command: -c "sleep infinity" #turn on for DB maintenance
environment:
- "PUID=${PLEX_PUID}" #1027
- "PGID=${PLEX_PGID}" #100
- "VERSION=latest"
- "ADVERTISE_IP=${ADVERTISE_IP}"
networks:
- traefik_backend
# ports:
# Plex External Ports
# - target: 32400
# published: 32401
# protocol: tcp
# mode: host
# - "1900/udp"
# - "3005/tcp"
# - "32400/tcp"
# - "32410/udp"
# - "32412/udp"
# - "32413/udp"
# - "32414/udp"
# - "32469/tcp"
# - "5353/udp"
# - "8324/tcp"
image: "linuxserver/plex:latest"
# restart: "always"
# logging:
# driver: "db"
# options: {}
# network_mode: "host"
# restart: "always"
# stdin_open: true
# tty: true
volumes:
# - /volume1/Podcasts:/volume1/Podcasts
- /volume1/TV Shows:/volume1/TV
- /volume1/Movies:/volume1/Movies
# - /volume1/Music:/volume1/Music
- /volume1/docker/Plex Media Server:/config
- /volume1/Plex-Backups:/Plex-Backups
- /dev/dri:/dev/dri
- type: tmpfs
target: /dev/shm
tmpfs:
size: 400000000000
healthcheck:
test: curl -fsS http://localhost:32400/identity > /dev/null || exit 1
start_period: 900s
timeout: 10s
interval: 5s
# retries: 3
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.plex.rule=Host(`${PLEX_HOST}`)
- traefik.http.routers.plex.tls=true
- traefik.http.routers.plex.tls.certresolver=letsencrypt
- traefik.http.routers.plex.entrypoints=websecure
- traefik.http.services.plex.loadbalancer.server.port=32400
- traefik.http.services.plex.loadbalancer.server.scheme=https
# - traefik.http.routers.plex.middlewares=forward-header
# - traefik.http.middlewares.forward-header.forwardauth.trustForwardHeader=true
- traefik.http.routers.plex.middlewares=crowdsec@file
- traefik.swarm.network=traefik_backend
- autoheal=true
resources:
limits:
cpus: '8'
memory: 4G
placement:
constraints:
- node.labels.block != databases
Radarr:
entrypoint:
- "/init"
environment:
- "PUID=${PLEX_PUID}" #1027
- "PGID=${PLEX_PGID}" #100
- "TZ=PST"
image: "linuxserver/radarr:latest"
# restart: "always"
hostname: movies
networks:
- traefik_backend
- postgresql_db-backend
# ports:
# - target: 7878
# published: 7878
# protocol: tcp
# mode: bridge
# - target: 8787
# published: 8787
# protocol: tcp
# mode: bridge
# expose:
# - "7878" # This exposes port 5432 internally.
stdin_open: true
tty: true
volumes:
- /volume1/docker/Radarr/config:/config
- /volume1/Box Office/incomplete:/incomplete
- /volume1/Box Office/Drop off:/dropoff
- /volume1/Movies:/movies
healthcheck:
test: curl -fSs http://127.0.0.1:7878 > /dev/null || exit 1
start_period: 90s
timeout: 5s
interval: 5s
retries: 3
deploy:
# endpoint_mode: dnsrr
labels:
- traefik.enable=true
- traefik.http.routers.radarr.rule=Host(`${RADARR_HOST}`)
- traefik.http.routers.radarr.tls=true
- traefik.http.routers.radarr.tls.certresolver=letsencrypt
- traefik.http.routers.radarr.entrypoints=websecure
- traefik.http.services.movies.loadbalancer.server.port=7878
# - traefik.http.services.movies.loadbalancer.server.scheme=https
- traefik.swarm.network=traefik_backend
- traefik.http.routers.radarr.middlewares=forwardAuth-authentik@file, crowdsec@file
- autoheal=true
resources:
limits:
cpus: '2'
memory: 512M
Sonarr:
entrypoint:
- "/init"
environment:
- "TZ=PST"
- "PUID=${PLEX_PUID}" #1027
- "PGID=${PLEX_PGID}" #100
image: "linuxserver/sonarr:latest"
hostname: tv
networks:
- traefik_backend
- postgresql_db-backend
# ports:
# - target: 8989
# published: 8989
# protocol: tcp
# mode: overlay
# - target: 9898
# published: 9898
# protocol: tcp
# mode: bridge
# expose:
# - "8989" # This exposes port 8989 internally.
volumes:
- /volume1/Box Office/incomplete:/incomplete
- /volume1/Box Office/Drop off:/dropoff
- /volume1/TV Shows:/tv
- /volume1/docker/Sonarr/config:/config
healthcheck:
test: curl -fSs http://127.0.0.1:8989 || exit 1
start_period: 90s
timeout: 5s
interval: 5s
retries: 3
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.sonarr.rule=Host(`${SONARR_HOST}`)
- traefik.http.routers.sonarr.tls=true
- traefik.http.routers.sonarr.tls.certresolver=letsencrypt
- traefik.http.routers.sonarr.entrypoints=websecure
- traefik.http.services.tv.loadbalancer.server.port=8989
# - traefik.http.services.tv.loadbalancer.server.scheme=https
- traefik.swarm.network=traefik_backend
- traefik.http.routers.sonarr.middlewares=forwardAuth-authentik@file, crowdsec@file
- autoheal=true
resources:
limits:
cpus: '2' # Limit to 0.5 CPU core
memory: 512M
TicketBox:
env_file:
- media.env
cap_add:
- NET_ADMIN
environment:
- "ENABLE_PRIVOXY=no"
- "STRICT_PORT_FORWARD=yes"
- "PGID=0"
- "PUID=0"
- "UMASK=000"
- "DEBUG=false"
- "NAME_SERVERS=1.1.1.1"
- "LAN_NETWORK=${LAN_NETWORK}"
- "VPN_PROV=custom"
- "VPN_ENABLED=yes"
- "DELUGE_ENABLE_WEBUI_PASSWORD=no"
image: "binhex/arch-delugevpn:latest"
hostname: ticketbox
networks:
- traefik_backend
# ports:
# - target: 58846
# published: 58846
# protocol: tcp
# mode: host
# - target: 58946
# published: 58946
# protocol: tcp
# mode: host
# - target: 58946
# published: 58946
# protocol: udp
# mode: host
# - target: 8112
# published: 8112
# protocol: tcp
# mode: host
# - target: 8118
# published: 8118
# protocol: tcp
# mode: host
# stdin_open: true
# tty: true
volumes:
- /volume1/Box Office/Pick up:/pickup
- /volume1/docker/Deluge/config:/config
- /volume1/Box Office/incomplete:/incomplete
- /volume1/Box Office/Drop off:/dropoff
- /dev/net/tun:/dev/net/tun
healthcheck:
test: curl -fSs http://127.0.0.1:8112 || exit 1
start_period: 120s
timeout: 5s
interval: 5s
retries: 3
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.ticketbox.rule=Host(`${TICKETBOX_HOST}`)
- traefik.http.routers.ticketbox.tls=true
- traefik.http.routers.ticketbox.tls.certresolver=letsencrypt
- traefik.http.routers.ticketbox.entrypoints=websecure
- traefik.http.services.ticketbox.loadbalancer.server.port=8112
# - traefik.http.services.ticketbox.loadbalancer.server.scheme=https
- traefik.swarm.network=traefik_backend
- traefik.http.routers.ticketbox.middlewares=forwardAuth-authentik@file, crowdsec@file
- autoheal=true
resources:
limits:
cpus: '2'
memory: 1G
Jackett:
entrypoint:
- "/init"
environment:
- "TZ=PST"
- "PUID=${PLEX_PUID}" #1027
- "PGID=${PLEX_PGID}" #100
image: "linuxserver/jackett:latest"
hostname: jackett
# restart: "always"
networks:
- traefik_backend
# ports:
# - target: 9117
# published: 9117
# protocol: tcp
# mode: ingress
stdin_open: true
tty: true
volumes:
- /volume1/docker/Jackett/config:/config
- /volume1/docker/Jackett/downloads:/downloads
# healthcheck:
# test: curl -fSs http://127.0.0.1:9117
# timeout: 5s
# interval: 5s
# retries: 3
deploy:
endpoint_mode: dnsrr
labels:
- traefik.enable=true
# - traefik.frontend.passHostHeader=true
- traefik.http.routers.jackett-ip.rule=Host(`${JACKETT_HOST}`) && ClientIP(`10.0.1.0/16`)
- traefik.http.routers.jackett-auth.rule=Host(`${JACKETT_HOST}`)
- traefik.http.routers.jackett-ip.tls=true
- traefik.http.routers.jackett-auth.tls=true
- traefik.http.routers.jackett-ip.tls.certresolver=letsencrypt
- traefik.http.routers.jackett-auth.tls.certresolver=letsencrypt
- traefik.http.routers.jackett-ip.entrypoints=websecure
- traefik.http.routers.jackett-auth.entrypoints=websecure
- traefik.http.services.jackett.loadbalancer.server.port=9117
# - traefik.http.services.jackett.loadbalancer.server.scheme=https
- traefik.swarm.network=traefik_backend
# - traefik.http.middlewares.jackett-socket.headers.customrequestheaders.X-Forwarded-Proto=https
- traefik.http.routers.jackett-auth.middlewares=forwardAuth-authentik@file, crowdsec@file
- autoheal=true
placement:
constraints: [node.role == manager]
resources:
limits:
cpus: '0.5'
memory: 512M
networks:
postgresql_db-backend:
external: true
traefik_backend:
external: true
host:
external: true
services:
Plex-Media-Server-GPU:
hostname: plex
cap_add:
- SYS_MODULE
entrypoint:
- "/init"
# - /bin/bash #turn on for DB maintenance
# command: -c "sleep infinity" #turn on for DB maintenance
environment:
- "PUID=0" #1027
- "PGID=0" #100
- "VERSION=latest"
- "ADVERTISE_IP=https://plex.bryanmail.net:443/"
networks:
- traefik_backend
# ports:
# Plex External Ports
# - target: 32400
# published: 32401
# protocol: tcp
# mode: host
# - "1900/udp"
# - "3005/tcp"
# - "32400/tcp"
# - "32410/udp"
# - "32412/udp"
# - "32413/udp"
# - "32414/udp"
# - "32469/tcp"
# - "5353/udp"
# - "8324/tcp"
image: "linuxserver/plex:latest"
# restart: "always"
# logging:
# driver: "db"
# options: {}
# network_mode: "host"
# restart: "always"
# stdin_open: true
# tty: true
volumes:
# - /volume1/Podcasts:/volume1/Podcasts
- /volume1/TV Shows:/volume1/TV
- /volume1/Movies:/volume1/Movies
# - /volume1/Music:/volume1/Music
- /volume1/docker/Plex Media Server:/config
- /volume1/Plex-Backups:/Plex-Backups
- /dev/dri:/dev/dri
- type: tmpfs
target: /dev/shm
tmpfs:
size: 400000000000
healthcheck:
test: curl -fsS http://localhost:32400/identity > /dev/null || exit 1
start_period: 900s
timeout: 10s
interval: 5s
# retries: 3
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.plex.rule=Host(`plex.bryanmail.net`)
- traefik.http.routers.plex.tls=true
- traefik.http.routers.plex.tls.certresolver=letsencrypt
- traefik.http.routers.plex.entrypoints=websecure
- traefik.http.services.plex.loadbalancer.server.port=32400
- traefik.http.services.plex.loadbalancer.server.scheme=https
# - traefik.http.routers.plex.middlewares=forward-header
# - traefik.http.middlewares.forward-header.forwardauth.trustForwardHeader=true
- traefik.http.routers.plex.middlewares=crowdsec@file
- traefik.swarm.network=traefik_backend
- autoheal=true
resources:
limits:
cpus: '8'
memory: 4G
placement:
constraints:
- node.labels.block != databases
Radarr:
entrypoint:
- "/init"
environment:
- "PUID=0" #1027
- "PGID=0" #100
- "TZ=PST"
image: "linuxserver/radarr:latest"
# restart: "always"
hostname: movies
networks:
- traefik_backend
- postgresql_db-backend
# ports:
# - target: 7878
# published: 7878
# protocol: tcp
# mode: bridge
# - target: 8787
# published: 8787
# protocol: tcp
# mode: bridge
# expose:
# - "7878" # This exposes port 5432 internally.
stdin_open: true
tty: true
volumes:
- /volume1/docker/Radarr/config:/config
- /volume1/Box Office/incomplete:/incomplete
- /volume1/Box Office/Drop off:/dropoff
- /volume1/Movies:/movies
healthcheck:
test: curl -fSs http://127.0.0.1:7878 > /dev/null || exit 1
start_period: 90s
timeout: 5s
interval: 5s
retries: 3
deploy:
# endpoint_mode: dnsrr
labels:
- traefik.enable=true
- traefik.http.routers.radarr.rule=Host(`movies.bryanmail.net`)
- traefik.http.routers.radarr.tls=true
- traefik.http.routers.radarr.tls.certresolver=letsencrypt
- traefik.http.routers.radarr.entrypoints=websecure
- traefik.http.services.movies.loadbalancer.server.port=7878
# - traefik.http.services.movies.loadbalancer.server.scheme=https
- traefik.swarm.network=traefik_backend
- traefik.http.routers.radarr.middlewares=forwardAuth-authentik@file, crowdsec@file
- autoheal=true
resources:
limits:
cpus: '2'
memory: 512M
Sonarr:
entrypoint:
- "/init"
environment:
- "TZ=PST"
- "PUID=0" #1027
- "PGID=0" #100
image: "linuxserver/sonarr:latest"
hostname: tv
networks:
- traefik_backend
- postgresql_db-backend
# ports:
# - target: 8989
# published: 8989
# protocol: tcp
# mode: overlay
# - target: 9898
# published: 9898
# protocol: tcp
# mode: bridge
# expose:
# - "8989" # This exposes port 8989 internally.
volumes:
- /volume1/Box Office/incomplete:/incomplete
- /volume1/Box Office/Drop off:/dropoff
- /volume1/TV Shows:/tv
- /volume1/docker/Sonarr/config:/config
healthcheck:
test: curl -fSs http://127.0.0.1:8989 || exit 1
start_period: 90s
timeout: 5s
interval: 5s
retries: 3
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.sonarr.rule=Host(`tv.bryanmail.net`)
- traefik.http.routers.sonarr.tls=true
- traefik.http.routers.sonarr.tls.certresolver=letsencrypt
- traefik.http.routers.sonarr.entrypoints=websecure
- traefik.http.services.tv.loadbalancer.server.port=8989
# - traefik.http.services.tv.loadbalancer.server.scheme=https
- traefik.swarm.network=traefik_backend
- traefik.http.routers.sonarr.middlewares=forwardAuth-authentik@file, crowdsec@file
- autoheal=true
resources:
limits:
cpus: '2' # Limit to 0.5 CPU core
memory: 512M
TicketBox:
cap_add:
- NET_ADMIN
environment:
- "ENABLE_PRIVOXY=no"
- "STRICT_PORT_FORWARD=yes"
- "PGID=0"
- "PUID=0"
- "UMASK=000"
- "DEBUG=false"
- "NAME_SERVERS=1.1.1.1"
- "LAN_NETWORK=192.168.0.0/16,10.0.0.0/8,127.0.0.1/32"
- "VPN_PROV=custom"
- "VPN_ENABLED=yes"
- "DELUGE_ENABLE_WEBUI_PASSWORD=no"
image: "binhex/arch-delugevpn:latest"
hostname: ticketbox
networks:
- traefik_backend
# ports:
# - target: 58846
# published: 58846
# protocol: tcp
# mode: host
# - target: 58946
# published: 58946
# protocol: tcp
# mode: host
# - target: 58946
# published: 58946
# protocol: udp
# mode: host
# - target: 8112
# published: 8112
# protocol: tcp
# mode: host
# - target: 8118
# published: 8118
# protocol: tcp
# mode: host
# stdin_open: true
# tty: true
volumes:
- /volume1/Box Office/Pick up:/pickup
- /volume1/docker/Deluge/config:/config
- /volume1/Box Office/incomplete:/incomplete
- /volume1/Box Office/Drop off:/dropoff
- /dev/net/tun:/dev/net/tun
healthcheck:
test: curl -fSs http://127.0.0.1:8112 || exit 1
start_period: 120s
timeout: 5s
interval: 5s
retries: 3
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.ticketbox.rule=Host(`ticketbox.bryanmail.net`)
- traefik.http.routers.ticketbox.tls=true
- traefik.http.routers.ticketbox.tls.certresolver=letsencrypt
- traefik.http.routers.ticketbox.entrypoints=websecure
- traefik.http.services.ticketbox.loadbalancer.server.port=8112
# - traefik.http.services.ticketbox.loadbalancer.server.scheme=https
- traefik.swarm.network=traefik_backend
- traefik.http.routers.ticketbox.middlewares=forwardAuth-authentik@file, crowdsec@file
- autoheal=true
resources:
limits:
cpus: '2'
memory: 1G
Jackett:
entrypoint:
- "/init"
environment:
- "TZ=PST"
- "PUID=0" #1027
- "PGID=0" #100
image: "linuxserver/jackett:latest"
hostname: jackett
# restart: "always"
networks:
- traefik_backend
# ports:
# - target: 9117
# published: 9117
# protocol: tcp
# mode: ingress
stdin_open: true
tty: true
volumes:
- /volume1/docker/Jackett/config:/config
- /volume1/docker/Jackett/downloads:/downloads
# healthcheck:
# test: curl -fSs http://127.0.0.1:9117
# timeout: 5s
# interval: 5s
# retries: 3
deploy:
endpoint_mode: dnsrr
labels:
- traefik.enable=true
# - traefik.frontend.passHostHeader=true
- traefik.http.routers.jackett-ip.rule=Host(`jackett.bryanmail.net`) && ClientIP(`10.0.1.0/16`)
- traefik.http.routers.jackett-auth.rule=Host(`jackett.bryanmail.net`)
- traefik.http.routers.jackett-ip.tls=true
- traefik.http.routers.jackett-auth.tls=true
- traefik.http.routers.jackett-ip.tls.certresolver=letsencrypt
- traefik.http.routers.jackett-auth.tls.certresolver=letsencrypt
- traefik.http.routers.jackett-ip.entrypoints=websecure
- traefik.http.routers.jackett-auth.entrypoints=websecure
- traefik.http.services.jackett.loadbalancer.server.port=9117
# - traefik.http.services.jackett.loadbalancer.server.scheme=https
- traefik.swarm.network=traefik_backend
# - traefik.http.middlewares.jackett-socket.headers.customrequestheaders.X-Forwarded-Proto=https
- traefik.http.routers.jackett-auth.middlewares=forwardAuth-authentik@file, crowdsec@file
- autoheal=true
placement:
constraints: [node.role == manager]
resources:
limits:
cpus: '0.5'
memory: 512M
networks:
postgresql_db-backend:
external: true
traefik_backend:
external: true
host:
external: true