homelab/compose-files
0
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Remove env_file dependencies from media and maintenance stacks - inline all non-secret values directly in compose files
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse Source
This commit is contained in:
admin
2026-06-21 22:34:45 -07:00
parent a651848f48
commit b84fae335d
2 changed files with 407 additions and 322 deletions
Download Patch File Download Diff File Expand all files Collapse all files
maintenance.yaml
+89
View File
@@ -0,0 +1,89 @@
services:
cronicle:
volumes:
- /var/run/docker.sock:/var/run/docker.sock:rw
- /volume1/docker/cronicle/data:/opt/cronicle/data:rw
- /volume1/docker/cronicle/logs:/opt/cronicle/logs:rw
- /volume1/docker/cronicle/plugins:/opt/cronicle/plugins:rw
- /volume1/docker/cronicle/app:/opt/cronicle/app:rw
- /volume1/docker/cronicle/ssh_keys:/opt/cronicle/ssh_keys:rw
# - /volume1/docker/cronicle/conf:/opt/cronicle/conf:rw
hostname: schedule
ports:
- 3012:3012
# container_name: cronicle
image: bluet/cronicle-docker:latest
environment:
- CRONICLE_base_app_url=https://schedule.bryanmail.net
# - CRONICLE_VERSION 0.9.59
- CRONICLE_WebServer__http_port=3012
- CRONICLE_WebServer__https_port=443
- CRONICLE_web_socket_use_hostnames=1
- CRONICLE_server_comm_use_hostnames=1
- CRONICLE_web_direct_connect=0
- CRONICLE_custom_live_log_socket_url=schedule.bryanmail.net
# - CRONICLE_socket_io_transports=polling
networks:
traefik_backend:
aliases:
- schedule
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.cron.rule=Host(`schedule.bryanmail.net`)
- traefik.http.routers.cron.tls=true
- traefik.http.routers.cron.tls.certresolver=letsencrypt
- traefik.http.routers.cron.entrypoints=websecure
- traefik.http.services.cron.loadbalancer.server.port=3012
- traefik.swarm.network=traefik_backend
- traefik.http.routers.cron.middlewares=forwardAuth-authentik@file, crowdsec@file
- traefik.http.routers.cron-ip.rule=Host(`schedule.bryanmail.net`) && ClientIP(`10.0.0.0/8`)
- traefik.http.routers.cron-ip.tls=true
- traefik.http.routers.cron-ip.tls.certresolver=letsencrypt
- traefik.http.routers.cron-ip.entrypoints=websecure
resources:
limits:
cpus: '2' # Limit to 0.5 CPU core
memory: 512M
uptime-kuma:
image: louislam/uptime-kuma:2
hostname: uptime-kuma
# ports:
# - "3001:3001" # This maps the container port "3001" to the host port "3001"
volumes:
- /volume1/docker/uptime-kuma/data:/app/data # Configuring persistent storage
- /var/run/docker.sock:/var/run/docker.sock:ro
environment:
- TZ=PST # Set the timezone (change to your preferred local timezone so monitoring times are the same)
- UMASK=0022 # Set your file permissions manually
networks:
- traefik_backend # add your own custom network config
- postgresql_db-backend
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3001"]
interval: 30s
retries: 3
start_period: 10s
timeout: 5s
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.uptime.rule=Host(`uptime.bryanmail.net`)
- traefik.http.routers.uptime.tls=true
- traefik.http.routers.uptime.tls.certresolver=letsencrypt
- traefik.http.routers.uptime.entrypoints=websecure
- traefik.http.services.uptime.loadbalancer.server.port=3001
- traefik.http.services.uptime.loadbalancer.server.scheme=http
- traefik.swarm.network=traefik_backend
- traefik.http.routers.uptime.middlewares=forwardAuth-authentik@file, crowdsec@file
networks:
postgresql_db-backend:
external: true
traefik_backend:
external: true
media.yaml
+318 -322
View File
@@ -1,322 +1,318 @@
services: services:
Plex-Media-Server-GPU: Plex-Media-Server-GPU:
env_file: hostname: plex
- media.env cap_add:
hostname: plex - SYS_MODULE
cap_add: entrypoint:
- SYS_MODULE - "/init"
entrypoint: # - /bin/bash #turn on for DB maintenance
- "/init" # command: -c "sleep infinity" #turn on for DB maintenance
# - /bin/bash #turn on for DB maintenance environment:
# command: -c "sleep infinity" #turn on for DB maintenance - "PUID=0" #1027
environment: - "PGID=0" #100
- "PUID=${PLEX_PUID}" #1027 - "VERSION=latest"
- "PGID=${PLEX_PGID}" #100 - "ADVERTISE_IP=https://plex.bryanmail.net:443/"
- "VERSION=latest" networks:
- "ADVERTISE_IP=${ADVERTISE_IP}" - traefik_backend
networks: # ports:
- traefik_backend # Plex External Ports
# ports: # - target: 32400
# Plex External Ports # published: 32401
# - target: 32400 # protocol: tcp
# published: 32401 # mode: host
# protocol: tcp # - "1900/udp"
# mode: host # - "3005/tcp"
# - "1900/udp" # - "32400/tcp"
# - "3005/tcp" # - "32410/udp"
# - "32400/tcp" # - "32412/udp"
# - "32410/udp" # - "32413/udp"
# - "32412/udp" # - "32414/udp"
# - "32413/udp" # - "32469/tcp"
# - "32414/udp" # - "5353/udp"
# - "32469/tcp" # - "8324/tcp"
# - "5353/udp" image: "linuxserver/plex:latest"
# - "8324/tcp" # restart: "always"
image: "linuxserver/plex:latest" # logging:
# restart: "always" # driver: "db"
# logging: # options: {}
# driver: "db" # network_mode: "host"
# options: {} # restart: "always"
# network_mode: "host" # stdin_open: true
# restart: "always" # tty: true
# stdin_open: true volumes:
# tty: true # - /volume1/Podcasts:/volume1/Podcasts
volumes: - /volume1/TV Shows:/volume1/TV
# - /volume1/Podcasts:/volume1/Podcasts - /volume1/Movies:/volume1/Movies
- /volume1/TV Shows:/volume1/TV # - /volume1/Music:/volume1/Music
- /volume1/Movies:/volume1/Movies - /volume1/docker/Plex Media Server:/config
# - /volume1/Music:/volume1/Music - /volume1/Plex-Backups:/Plex-Backups
- /volume1/docker/Plex Media Server:/config - /dev/dri:/dev/dri
- /volume1/Plex-Backups:/Plex-Backups - type: tmpfs
- /dev/dri:/dev/dri target: /dev/shm
- type: tmpfs tmpfs:
target: /dev/shm size: 400000000000
tmpfs: healthcheck:
size: 400000000000 test: curl -fsS http://localhost:32400/identity > /dev/null || exit 1
healthcheck: start_period: 900s
test: curl -fsS http://localhost:32400/identity > /dev/null || exit 1 timeout: 10s
start_period: 900s interval: 5s
timeout: 10s # retries: 3
interval: 5s deploy:
# retries: 3 labels:
deploy: - traefik.enable=true
labels: - traefik.http.routers.plex.rule=Host(`plex.bryanmail.net`)
- traefik.enable=true - traefik.http.routers.plex.tls=true
- traefik.http.routers.plex.rule=Host(`${PLEX_HOST}`) - traefik.http.routers.plex.tls.certresolver=letsencrypt
- traefik.http.routers.plex.tls=true - traefik.http.routers.plex.entrypoints=websecure
- traefik.http.routers.plex.tls.certresolver=letsencrypt - traefik.http.services.plex.loadbalancer.server.port=32400
- traefik.http.routers.plex.entrypoints=websecure - traefik.http.services.plex.loadbalancer.server.scheme=https
- traefik.http.services.plex.loadbalancer.server.port=32400 # - traefik.http.routers.plex.middlewares=forward-header
- traefik.http.services.plex.loadbalancer.server.scheme=https # - traefik.http.middlewares.forward-header.forwardauth.trustForwardHeader=true
# - traefik.http.routers.plex.middlewares=forward-header - traefik.http.routers.plex.middlewares=crowdsec@file
# - traefik.http.middlewares.forward-header.forwardauth.trustForwardHeader=true - traefik.swarm.network=traefik_backend
- traefik.http.routers.plex.middlewares=crowdsec@file - autoheal=true
- traefik.swarm.network=traefik_backend resources:
- autoheal=true limits:
resources: cpus: '8'
limits: memory: 4G
cpus: '8' placement:
memory: 4G constraints:
placement: - node.labels.block != databases
constraints:
- node.labels.block != databases Radarr:
entrypoint:
Radarr: - "/init"
entrypoint: environment:
- "/init" - "PUID=0" #1027
environment: - "PGID=0" #100
- "PUID=${PLEX_PUID}" #1027 - "TZ=PST"
- "PGID=${PLEX_PGID}" #100 image: "linuxserver/radarr:latest"
- "TZ=PST" # restart: "always"
image: "linuxserver/radarr:latest" hostname: movies
# restart: "always" networks:
hostname: movies - traefik_backend
networks: - postgresql_db-backend
- traefik_backend # ports:
- postgresql_db-backend # - target: 7878
# ports: # published: 7878
# - target: 7878 # protocol: tcp
# published: 7878 # mode: bridge
# protocol: tcp # - target: 8787
# mode: bridge # published: 8787
# - target: 8787 # protocol: tcp
# published: 8787 # mode: bridge
# protocol: tcp # expose:
# mode: bridge # - "7878" # This exposes port 5432 internally.
# expose: stdin_open: true
# - "7878" # This exposes port 5432 internally. tty: true
stdin_open: true volumes:
tty: true - /volume1/docker/Radarr/config:/config
volumes: - /volume1/Box Office/incomplete:/incomplete
- /volume1/docker/Radarr/config:/config - /volume1/Box Office/Drop off:/dropoff
- /volume1/Box Office/incomplete:/incomplete - /volume1/Movies:/movies
- /volume1/Box Office/Drop off:/dropoff healthcheck:
- /volume1/Movies:/movies test: curl -fSs http://127.0.0.1:7878 > /dev/null || exit 1
healthcheck: start_period: 90s
test: curl -fSs http://127.0.0.1:7878 > /dev/null || exit 1 timeout: 5s
start_period: 90s interval: 5s
timeout: 5s retries: 3
interval: 5s deploy:
retries: 3 # endpoint_mode: dnsrr
deploy: labels:
# endpoint_mode: dnsrr - traefik.enable=true
labels: - traefik.http.routers.radarr.rule=Host(`movies.bryanmail.net`)
- traefik.enable=true - traefik.http.routers.radarr.tls=true
- traefik.http.routers.radarr.rule=Host(`${RADARR_HOST}`) - traefik.http.routers.radarr.tls.certresolver=letsencrypt
- traefik.http.routers.radarr.tls=true - traefik.http.routers.radarr.entrypoints=websecure
- traefik.http.routers.radarr.tls.certresolver=letsencrypt - traefik.http.services.movies.loadbalancer.server.port=7878
- traefik.http.routers.radarr.entrypoints=websecure # - traefik.http.services.movies.loadbalancer.server.scheme=https
- traefik.http.services.movies.loadbalancer.server.port=7878 - traefik.swarm.network=traefik_backend
# - traefik.http.services.movies.loadbalancer.server.scheme=https - traefik.http.routers.radarr.middlewares=forwardAuth-authentik@file, crowdsec@file
- traefik.swarm.network=traefik_backend - autoheal=true
- traefik.http.routers.radarr.middlewares=forwardAuth-authentik@file, crowdsec@file resources:
- autoheal=true limits:
resources: cpus: '2'
limits: memory: 512M
cpus: '2'
memory: 512M Sonarr:
entrypoint:
Sonarr: - "/init"
entrypoint: environment:
- "/init" - "TZ=PST"
environment: - "PUID=0" #1027
- "TZ=PST" - "PGID=0" #100
- "PUID=${PLEX_PUID}" #1027 image: "linuxserver/sonarr:latest"
- "PGID=${PLEX_PGID}" #100 hostname: tv
image: "linuxserver/sonarr:latest" networks:
hostname: tv - traefik_backend
networks: - postgresql_db-backend
- traefik_backend # ports:
- postgresql_db-backend # - target: 8989
# ports: # published: 8989
# - target: 8989 # protocol: tcp
# published: 8989 # mode: overlay
# protocol: tcp # - target: 9898
# mode: overlay # published: 9898
# - target: 9898 # protocol: tcp
# published: 9898 # mode: bridge
# protocol: tcp # expose:
# mode: bridge # - "8989" # This exposes port 8989 internally.
# expose: volumes:
# - "8989" # This exposes port 8989 internally. - /volume1/Box Office/incomplete:/incomplete
volumes: - /volume1/Box Office/Drop off:/dropoff
- /volume1/Box Office/incomplete:/incomplete - /volume1/TV Shows:/tv
- /volume1/Box Office/Drop off:/dropoff - /volume1/docker/Sonarr/config:/config
- /volume1/TV Shows:/tv healthcheck:
- /volume1/docker/Sonarr/config:/config test: curl -fSs http://127.0.0.1:8989 || exit 1
healthcheck: start_period: 90s
test: curl -fSs http://127.0.0.1:8989 || exit 1 timeout: 5s
start_period: 90s interval: 5s
timeout: 5s retries: 3
interval: 5s deploy:
retries: 3 labels:
deploy: - traefik.enable=true
labels: - traefik.http.routers.sonarr.rule=Host(`tv.bryanmail.net`)
- traefik.enable=true - traefik.http.routers.sonarr.tls=true
- traefik.http.routers.sonarr.rule=Host(`${SONARR_HOST}`) - traefik.http.routers.sonarr.tls.certresolver=letsencrypt
- traefik.http.routers.sonarr.tls=true - traefik.http.routers.sonarr.entrypoints=websecure
- traefik.http.routers.sonarr.tls.certresolver=letsencrypt - traefik.http.services.tv.loadbalancer.server.port=8989
- traefik.http.routers.sonarr.entrypoints=websecure # - traefik.http.services.tv.loadbalancer.server.scheme=https
- traefik.http.services.tv.loadbalancer.server.port=8989 - traefik.swarm.network=traefik_backend
# - traefik.http.services.tv.loadbalancer.server.scheme=https - traefik.http.routers.sonarr.middlewares=forwardAuth-authentik@file, crowdsec@file
- traefik.swarm.network=traefik_backend - autoheal=true
- traefik.http.routers.sonarr.middlewares=forwardAuth-authentik@file, crowdsec@file resources:
- autoheal=true limits:
resources: cpus: '2' # Limit to 0.5 CPU core
limits: memory: 512M
cpus: '2' # Limit to 0.5 CPU core
memory: 512M TicketBox:
cap_add:
TicketBox: - NET_ADMIN
env_file: environment:
- media.env - "ENABLE_PRIVOXY=no"
cap_add: - "STRICT_PORT_FORWARD=yes"
- NET_ADMIN - "PGID=0"
environment: - "PUID=0"
- "ENABLE_PRIVOXY=no" - "UMASK=000"
- "STRICT_PORT_FORWARD=yes" - "DEBUG=false"
- "PGID=0" - "NAME_SERVERS=1.1.1.1"
- "PUID=0" - "LAN_NETWORK=192.168.0.0/16,10.0.0.0/8,127.0.0.1/32"
- "UMASK=000" - "VPN_PROV=custom"
- "DEBUG=false" - "VPN_ENABLED=yes"
- "NAME_SERVERS=1.1.1.1" - "DELUGE_ENABLE_WEBUI_PASSWORD=no"
- "LAN_NETWORK=${LAN_NETWORK}" image: "binhex/arch-delugevpn:latest"
- "VPN_PROV=custom" hostname: ticketbox
- "VPN_ENABLED=yes" networks:
- "DELUGE_ENABLE_WEBUI_PASSWORD=no" - traefik_backend
image: "binhex/arch-delugevpn:latest" # ports:
hostname: ticketbox # - target: 58846
networks: # published: 58846
- traefik_backend # protocol: tcp
# ports: # mode: host
# - target: 58846 # - target: 58946
# published: 58846 # published: 58946
# protocol: tcp # protocol: tcp
# mode: host # mode: host
# - target: 58946 # - target: 58946
# published: 58946 # published: 58946
# protocol: tcp # protocol: udp
# mode: host # mode: host
# - target: 58946 # - target: 8112
# published: 58946 # published: 8112
# protocol: udp # protocol: tcp
# mode: host # mode: host
# - target: 8112 # - target: 8118
# published: 8112 # published: 8118
# protocol: tcp # protocol: tcp
# mode: host # mode: host
# - target: 8118 # stdin_open: true
# published: 8118 # tty: true
# protocol: tcp volumes:
# mode: host - /volume1/Box Office/Pick up:/pickup
# stdin_open: true - /volume1/docker/Deluge/config:/config
# tty: true - /volume1/Box Office/incomplete:/incomplete
volumes: - /volume1/Box Office/Drop off:/dropoff
- /volume1/Box Office/Pick up:/pickup - /dev/net/tun:/dev/net/tun
- /volume1/docker/Deluge/config:/config healthcheck:
- /volume1/Box Office/incomplete:/incomplete test: curl -fSs http://127.0.0.1:8112 || exit 1
- /volume1/Box Office/Drop off:/dropoff start_period: 120s
- /dev/net/tun:/dev/net/tun timeout: 5s
healthcheck: interval: 5s
test: curl -fSs http://127.0.0.1:8112 || exit 1 retries: 3
start_period: 120s deploy:
timeout: 5s labels:
interval: 5s - traefik.enable=true
retries: 3 - traefik.http.routers.ticketbox.rule=Host(`ticketbox.bryanmail.net`)
deploy: - traefik.http.routers.ticketbox.tls=true
labels: - traefik.http.routers.ticketbox.tls.certresolver=letsencrypt
- traefik.enable=true - traefik.http.routers.ticketbox.entrypoints=websecure
- traefik.http.routers.ticketbox.rule=Host(`${TICKETBOX_HOST}`) - traefik.http.services.ticketbox.loadbalancer.server.port=8112
- traefik.http.routers.ticketbox.tls=true # - traefik.http.services.ticketbox.loadbalancer.server.scheme=https
- traefik.http.routers.ticketbox.tls.certresolver=letsencrypt - traefik.swarm.network=traefik_backend
- traefik.http.routers.ticketbox.entrypoints=websecure - traefik.http.routers.ticketbox.middlewares=forwardAuth-authentik@file, crowdsec@file
- traefik.http.services.ticketbox.loadbalancer.server.port=8112 - autoheal=true
# - traefik.http.services.ticketbox.loadbalancer.server.scheme=https resources:
- traefik.swarm.network=traefik_backend limits:
- traefik.http.routers.ticketbox.middlewares=forwardAuth-authentik@file, crowdsec@file cpus: '2'
- autoheal=true memory: 1G
resources:
limits: Jackett:
cpus: '2' entrypoint:
memory: 1G - "/init"
environment:
Jackett: - "TZ=PST"
entrypoint: - "PUID=0" #1027
- "/init" - "PGID=0" #100
environment: image: "linuxserver/jackett:latest"
- "TZ=PST" hostname: jackett
- "PUID=${PLEX_PUID}" #1027 # restart: "always"
- "PGID=${PLEX_PGID}" #100 networks:
image: "linuxserver/jackett:latest" - traefik_backend
hostname: jackett # ports:
# restart: "always" # - target: 9117
networks: # published: 9117
- traefik_backend # protocol: tcp
# ports: # mode: ingress
# - target: 9117 stdin_open: true
# published: 9117 tty: true
# protocol: tcp volumes:
# mode: ingress - /volume1/docker/Jackett/config:/config
stdin_open: true - /volume1/docker/Jackett/downloads:/downloads
tty: true # healthcheck:
volumes: # test: curl -fSs http://127.0.0.1:9117
- /volume1/docker/Jackett/config:/config # timeout: 5s
- /volume1/docker/Jackett/downloads:/downloads # interval: 5s
# healthcheck: # retries: 3
# test: curl -fSs http://127.0.0.1:9117 deploy:
# timeout: 5s endpoint_mode: dnsrr
# interval: 5s labels:
# retries: 3 - traefik.enable=true
deploy: # - traefik.frontend.passHostHeader=true
endpoint_mode: dnsrr - traefik.http.routers.jackett-ip.rule=Host(`jackett.bryanmail.net`) && ClientIP(`10.0.1.0/16`)
labels: - traefik.http.routers.jackett-auth.rule=Host(`jackett.bryanmail.net`)
- traefik.enable=true - traefik.http.routers.jackett-ip.tls=true
# - traefik.frontend.passHostHeader=true - traefik.http.routers.jackett-auth.tls=true
- traefik.http.routers.jackett-ip.rule=Host(`${JACKETT_HOST}`) && ClientIP(`10.0.1.0/16`) - traefik.http.routers.jackett-ip.tls.certresolver=letsencrypt
- traefik.http.routers.jackett-auth.rule=Host(`${JACKETT_HOST}`) - traefik.http.routers.jackett-auth.tls.certresolver=letsencrypt
- traefik.http.routers.jackett-ip.tls=true - traefik.http.routers.jackett-ip.entrypoints=websecure
- traefik.http.routers.jackett-auth.tls=true - traefik.http.routers.jackett-auth.entrypoints=websecure
- traefik.http.routers.jackett-ip.tls.certresolver=letsencrypt - traefik.http.services.jackett.loadbalancer.server.port=9117
- traefik.http.routers.jackett-auth.tls.certresolver=letsencrypt # - traefik.http.services.jackett.loadbalancer.server.scheme=https
- traefik.http.routers.jackett-ip.entrypoints=websecure - traefik.swarm.network=traefik_backend
- traefik.http.routers.jackett-auth.entrypoints=websecure # - traefik.http.middlewares.jackett-socket.headers.customrequestheaders.X-Forwarded-Proto=https
- traefik.http.services.jackett.loadbalancer.server.port=9117 - traefik.http.routers.jackett-auth.middlewares=forwardAuth-authentik@file, crowdsec@file
# - traefik.http.services.jackett.loadbalancer.server.scheme=https - autoheal=true
- traefik.swarm.network=traefik_backend placement:
# - traefik.http.middlewares.jackett-socket.headers.customrequestheaders.X-Forwarded-Proto=https constraints: [node.role == manager]
- traefik.http.routers.jackett-auth.middlewares=forwardAuth-authentik@file, crowdsec@file resources:
- autoheal=true limits:
placement: cpus: '0.5'
constraints: [node.role == manager] memory: 512M
resources:
limits: networks:
cpus: '0.5' postgresql_db-backend:
memory: 512M external: true
traefik_backend:
networks: external: true
postgresql_db-backend: host:
external: true external: true
traefik_backend:
external: true
host:
external: true