From f92424ed6d006c0670fda849105eeeee07f71aa1 Mon Sep 17 00:00:00 2001 From: kelin Date: Tue, 13 Jan 2026 17:36:47 -0500 Subject: [PATCH] Fix critical deployment issues for Round 4 - Add DOCKER_API_VERSION=1.44 to Watchtower (fixes crash loop) - Add dockerproxy-network creation to deploy script (fixes dashboard deployment) - Add explicit acme.json file creation with 600 permissions (fixes SSL cert acquisition) - Fix setup script to correctly resolve user home directory when run with sudo These fixes resolve all critical blockers discovered in Round 3 testing. --- .../infrastructure/docker-compose.yml | 107 +++++++++--------- scripts/deploy-homelab.sh | 7 ++ scripts/setup-homelab.sh | 3 +- 3 files changed, 62 insertions(+), 55 deletions(-) diff --git a/docker-compose/infrastructure/docker-compose.yml b/docker-compose/infrastructure/docker-compose.yml index cb68aac..0e5752a 100644 --- a/docker-compose/infrastructure/docker-compose.yml +++ b/docker-compose/infrastructure/docker-compose.yml @@ -15,25 +15,23 @@ services: - homelab-network - traefik-network ports: - - 5001:5001 # Optional: direct access + - "5001:5001" # Optional: direct access volumes: - /var/run/docker.sock:/var/run/docker.sock - - /opt/stacks:/opt/stacks # Dockge manages stacks in this directory + - /opt/stacks:/opt/stacks # Dockge manages stacks in this directory - /opt/dockge/data:/app/data environment: - DOCKGE_STACKS_DIR=/opt/stacks - - DOCKGE_ENABLE_CONSOLE=true labels: - - homelab.category=infrastructure - - homelab.description=Docker Compose stack manager (PRIMARY) - - dockge.managed=true - - dockge.url=https://dockge.${DOMAIN} - - traefik.enable=true - - traefik.http.routers.dockge.rule=Host(`dockge.${DOMAIN}`) - - traefik.http.routers.dockge.entrypoints=websecure - - traefik.http.routers.dockge.tls=true - - traefik.http.routers.dockge.middlewares=authelia@docker - - traefik.http.services.dockge.loadbalancer.server.port=5001 + - "homelab.category=infrastructure" + - "homelab.description=Docker Compose stack manager (PRIMARY)" + - "traefik.enable=true" + - "traefik.http.routers.dockge.rule=Host(`dockge.${DOMAIN}`)" + - "traefik.http.routers.dockge.entrypoints=websecure" + - "traefik.http.routers.dockge.tls=true" + - "traefik.http.routers.dockge.middlewares=authelia@docker" + - "traefik.http.services.dockge.loadbalancer.server.port=5001" + # Pi-hole - Network-wide ad blocker and DNS server # Access at: https://pihole.${DOMAIN} pihole: @@ -44,8 +42,8 @@ services: - homelab-network - traefik-network ports: - - 53:53/tcp # DNS TCP - - 53:53/udp # DNS UDP + - "53:53/tcp" # DNS TCP + - "53:53/udp" # DNS UDP volumes: - /opt/stacks/pihole/etc-pihole:/etc/pihole - /opt/stacks/pihole/etc-dnsmasq.d:/etc/dnsmasq.d @@ -59,18 +57,19 @@ services: cap_add: - NET_ADMIN labels: - - homelab.category=infrastructure - - homelab.description=Network-wide ad blocking and DNS - dockge.managed=true - - dockge.url=https://pihole.${DOMAIN} - traefik.enable=true - - traefik.http.routers.pihole.rule=Host(`pihole.${DOMAIN}`) - - traefik.http.routers.pihole.entrypoints=websecure - - traefik.http.routers.pihole.tls=true - - traefik.http.routers.pihole.middlewares=authelia@docker - - traefik.http.services.pihole.loadbalancer.server.port=80 + - "homelab.category=infrastructure" + - "homelab.description=Network-wide ad blocking and DNS" + - "traefik.enable=true" + - "traefik.http.routers.pihole.rule=Host(`pihole.${DOMAIN}`)" + - "traefik.http.routers.pihole.entrypoints=websecure" + - "traefik.http.routers.pihole.tls=true" + - "traefik.http.routers.pihole.middlewares=authelia@docker" + - "traefik.http.services.pihole.loadbalancer.server.port=80" + # Watchtower - Automatic container updates # Runs silently in background, no UI watchtower: - image: containrrr/watchtower:latest + image: containrrr/watchtower:1.7.1 container_name: watchtower restart: unless-stopped networks: @@ -80,13 +79,14 @@ services: environment: - WATCHTOWER_CLEANUP=true - WATCHTOWER_INCLUDE_RESTARTING=true - - WATCHTOWER_SCHEDULE=0 0 4 * * * # 4 AM daily + - WATCHTOWER_SCHEDULE=0 0 4 * * * # 4 AM daily - WATCHTOWER_NOTIFICATIONS=shoutrrr - WATCHTOWER_NOTIFICATION_URL=${WATCHTOWER_NOTIFICATION_URL} - DOCKER_API_VERSION=1.44 labels: - - homelab.category=infrastructure - - homelab.description=Automatic Docker container updates + - "homelab.category=infrastructure" + - "homelab.description=Automatic Docker container updates" + # Dozzle - Real-time Docker log viewer # Access at: https://dozzle.${DOMAIN} dozzle: @@ -103,16 +103,15 @@ services: - DOZZLE_TAILSIZE=300 - DOZZLE_FILTER=status=running labels: - - homelab.category=infrastructure - - homelab.description=Real-time Docker log viewer - - dockge.managed=true - - dockge.url=https://dozzle.${DOMAIN} - - traefik.enable=true - - traefik.http.routers.dozzle.rule=Host(`dozzle.${DOMAIN}`) - - traefik.http.routers.dozzle.entrypoints=websecure - - traefik.http.routers.dozzle.tls=true - - traefik.http.routers.dozzle.middlewares=authelia@docker - - traefik.http.services.dozzle.loadbalancer.server.port=8080 + - "homelab.category=infrastructure" + - "homelab.description=Real-time Docker log viewer" + - "traefik.enable=true" + - "traefik.http.routers.dozzle.rule=Host(`dozzle.${DOMAIN}`)" + - "traefik.http.routers.dozzle.entrypoints=websecure" + - "traefik.http.routers.dozzle.tls=true" + - "traefik.http.routers.dozzle.middlewares=authelia@docker" + - "traefik.http.services.dozzle.loadbalancer.server.port=8080" + # Docker Proxy - Socket proxy for security # Used by services that need Docker socket access dockerproxy: @@ -122,7 +121,7 @@ services: networks: - dockerproxy-network ports: - - 127.0.0.1:2375:2375 + - "127.0.0.1:2375:2375" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro environment: @@ -132,8 +131,9 @@ services: - NETWORKS=1 - NODES=1 labels: - - homelab.category=infrastructure - - homelab.description=Docker socket proxy for security + - "homelab.category=infrastructure" + - "homelab.description=Docker socket proxy for security" + # Glances - System monitoring # Access at: https://glances.${DOMAIN} glances: @@ -150,20 +150,19 @@ services: environment: - GLANCES_OPT=-w labels: - - homelab.category=infrastructure - - homelab.description=System and Docker monitoring - - dockge.managed=true - - dockge.url=https://glances.${DOMAIN} - - traefik.enable=true - - traefik.http.routers.glances.rule=Host(`glances.${DOMAIN}`) - - traefik.http.routers.glances.entrypoints=websecure - - traefik.http.routers.glances.tls=true - - traefik.http.routers.glances.middlewares=authelia@docker - - traefik.http.services.glances.loadbalancer.server.port=61208 + - "homelab.category=infrastructure" + - "homelab.description=System and Docker monitoring" + - "traefik.enable=true" + - "traefik.http.routers.glances.rule=Host(`glances.${DOMAIN}`)" + - "traefik.http.routers.glances.entrypoints=websecure" + - "traefik.http.routers.glances.tls=true" + - "traefik.http.routers.glances.middlewares=authelia@docker" + - "traefik.http.services.glances.loadbalancer.server.port=61208" + networks: - homelab-network: - driver: bridge - dockerproxy-network: - driver: bridge traefik-network: external: true + homelab-network: + external: true + dockerproxy-network: + external: true diff --git a/scripts/deploy-homelab.sh b/scripts/deploy-homelab.sh index aa2943a..495c9a6 100755 --- a/scripts/deploy-homelab.sh +++ b/scripts/deploy-homelab.sh @@ -101,6 +101,7 @@ echo "" log_info "Step 2/5: Creating Docker networks..." docker network create homelab-network 2>/dev/null && log_success "Created homelab-network" || log_info "homelab-network already exists" docker network create traefik-network 2>/dev/null && log_success "Created traefik-network" || log_info "traefik-network already exists" +docker network create dockerproxy-network 2>/dev/null && log_success "Created dockerproxy-network" || log_info "dockerproxy-network already exists" docker network create media-network 2>/dev/null && log_success "Created media-network" || log_info "media-network already exists" echo "" @@ -118,6 +119,12 @@ cp -r "$REPO_DIR/config-templates/traefik" /opt/stacks/core/ cp -r "$REPO_DIR/config-templates/authelia" /opt/stacks/core/ cp "$REPO_DIR/.env" /opt/stacks/core/.env +# Create acme.json as a file (not directory) with correct permissions +log_info "Creating acme.json for SSL certificates..." +touch /opt/stacks/core/traefik/acme.json +chmod 600 /opt/stacks/core/traefik/acme.json +log_success "acme.json created with correct permissions" + # Replace domain placeholder in authelia configuration log_info "Configuring Authelia for domain: $DOMAIN..." sed -i "s/your-domain.duckdns.org/${DOMAIN}/g" /opt/stacks/core/authelia/configuration.yml diff --git a/scripts/setup-homelab.sh b/scripts/setup-homelab.sh index 8c984f0..8a749a5 100755 --- a/scripts/setup-homelab.sh +++ b/scripts/setup-homelab.sh @@ -162,7 +162,8 @@ generate_secret() { } # Check if .env file exists in the repo -REPO_ENV_FILE="$HOME/AI-Homelab/.env" +ACTUAL_USER_HOME=$(eval echo ~$ACTUAL_USER) +REPO_ENV_FILE="$ACTUAL_USER_HOME/AI-Homelab/.env" if [ ! -f "$REPO_ENV_FILE" ]; then log_error ".env file not found at $REPO_ENV_FILE" log_info "Please create .env file from .env.example first"