- Add Authentik service stack to infrastructure.yml
- Includes Authentik server, worker, PostgreSQL database, and Redis
- Alternative SSO with web UI for user management
- Access at authentik.${DOMAIN}
- Protected by Authelia SSO (comment out to use standalone)
- Fix Uptime Kuma duplicate listing
- Remove from utilities.yml
- Keep only in monitoring.yml where it belongs
- Add Traefik labels and SSO protection to monitoring instance
- Enable SSO on Jellyseerr by default
- Changed from bypass to protected (security-first approach)
- Users can comment out SSO if needed for public access
- Update SSO toggling documentation
- Emphasize commenting out (not removing) middleware line
- Add docker command examples for running from outside stack folder
- Show both "cd to directory" and "full path" methods
- Add examples for starting and stopping services multiple ways
- Enhance security-first methodology
- Update copilot instructions to default SSO to enabled
- Only Plex and Jellyfin bypass SSO by default
- All other services start secured, expose gradually
- Emphasize commenting (not removing) for easier re-enable
- Update services-reference.md
- Add Authentik to infrastructure section (12 services)
- Move Uptime Kuma to monitoring section (8 services)
- Remove from utilities (now 6 services)
- Update Jellyseerr SSO status from ✗ to ✓
- Improve Authentik documentation with deployment guidance
- Add Authentik environment variables to .env.example
- AUTHENTIK_SECRET_KEY, DB credentials
- Generation instructions included
All changes align with security-first principle: start secure, expose services only when ready for deployment.
Co-authored-by: kelinfoxy <67766943+kelinfoxy@users.noreply.github.com>
156 lines
4.9 KiB
YAML
156 lines
4.9 KiB
YAML
# Backup and Utility Services
|
|
# Place in /opt/stacks/utilities/docker-compose.yml
|
|
|
|
services:
|
|
# Backrest - Backup solution for restic
|
|
# Access at: https://backrest.${DOMAIN}
|
|
backrest:
|
|
image: garethgeorge/backrest:latest
|
|
container_name: backrest
|
|
restart: unless-stopped
|
|
networks:
|
|
- homelab-network
|
|
- traefik-network
|
|
volumes:
|
|
- /opt/stacks/backrest/data:/data
|
|
- /opt/stacks/backrest/config:/config
|
|
- /opt/stacks:/opt/stacks:ro # Backup source
|
|
- /mnt:/mnt:ro # Backup additional drives
|
|
- backrest-cache:/cache
|
|
environment:
|
|
- BACKREST_DATA=/data
|
|
- BACKREST_CONFIG=/config/config.json
|
|
- TZ=${TZ}
|
|
labels:
|
|
- "homelab.category=utilities"
|
|
- "homelab.description=Backup management with restic"
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.backrest.rule=Host(`backrest.${DOMAIN}`)"
|
|
- "traefik.http.routers.backrest.entrypoints=websecure"
|
|
- "traefik.http.routers.backrest.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.backrest.middlewares=authelia@docker"
|
|
- "traefik.http.services.backrest.loadbalancer.server.port=9898"
|
|
|
|
# Duplicati - Backup solution
|
|
# Access at: https://duplicati.${DOMAIN}
|
|
duplicati:
|
|
image: lscr.io/linuxserver/duplicati:latest
|
|
container_name: duplicati
|
|
restart: unless-stopped
|
|
networks:
|
|
- homelab-network
|
|
- traefik-network
|
|
volumes:
|
|
- /opt/stacks/duplicati/config:/config
|
|
- /opt/stacks:/source/stacks:ro
|
|
- /mnt:/source/mnt:ro
|
|
- /mnt/backups:/backups
|
|
environment:
|
|
- PUID=${PUID:-1000}
|
|
- PGID=${PGID:-1000}
|
|
- TZ=${TZ}
|
|
labels:
|
|
- "homelab.category=utilities"
|
|
- "homelab.description=Backup software with encryption"
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.duplicati.rule=Host(`duplicati.${DOMAIN}`)"
|
|
- "traefik.http.routers.duplicati.entrypoints=websecure"
|
|
- "traefik.http.routers.duplicati.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.duplicati.middlewares=authelia@docker"
|
|
- "traefik.http.services.duplicati.loadbalancer.server.port=8200"
|
|
|
|
# Code Server - VS Code in browser
|
|
# Access at: https://code.${DOMAIN}
|
|
code-server:
|
|
image: lscr.io/linuxserver/code-server:latest
|
|
container_name: code-server
|
|
restart: unless-stopped
|
|
networks:
|
|
- homelab-network
|
|
- traefik-network
|
|
volumes:
|
|
- /opt/stacks/code-server/config:/config
|
|
- /opt/stacks:/opt/stacks # Access to all stacks
|
|
- /mnt:/mnt:ro # Read-only access to data
|
|
environment:
|
|
- PUID=${PUID:-1000}
|
|
- PGID=${PGID:-1000}
|
|
- TZ=${TZ}
|
|
- PASSWORD=${CODE_SERVER_PASSWORD}
|
|
- SUDO_PASSWORD=${CODE_SERVER_SUDO_PASSWORD}
|
|
labels:
|
|
- "homelab.category=utilities"
|
|
- "homelab.description=VS Code in browser"
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.code-server.rule=Host(`code.${DOMAIN}`)"
|
|
- "traefik.http.routers.code-server.entrypoints=websecure"
|
|
- "traefik.http.routers.code-server.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.code-server.middlewares=authelia@docker"
|
|
- "traefik.http.services.code-server.loadbalancer.server.port=8443"
|
|
|
|
# Form.io - Form builder (if needed)
|
|
# Access at: https://forms.${DOMAIN}
|
|
formio:
|
|
image: formio/formio:latest
|
|
container_name: formio
|
|
restart: unless-stopped
|
|
networks:
|
|
- homelab-network
|
|
- traefik-network
|
|
- formio-network
|
|
environment:
|
|
- MONGO_URL=mongodb://formio-mongo:27017/formio
|
|
- JWT_SECRET=${FORMIO_JWT_SECRET}
|
|
- DB_SECRET=${FORMIO_DB_SECRET}
|
|
depends_on:
|
|
- formio-mongo
|
|
labels:
|
|
- "homelab.category=utilities"
|
|
- "homelab.description=Form builder platform"
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.formio.rule=Host(`forms.${DOMAIN}`)"
|
|
- "traefik.http.routers.formio.entrypoints=websecure"
|
|
- "traefik.http.routers.formio.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.formio.middlewares=authelia@docker"
|
|
- "traefik.http.services.formio.loadbalancer.server.port=3000"
|
|
|
|
formio-mongo:
|
|
image: mongo:6
|
|
container_name: formio-mongo
|
|
restart: unless-stopped
|
|
networks:
|
|
- formio-network
|
|
volumes:
|
|
- formio-mongo-data:/data/db
|
|
labels:
|
|
- "homelab.category=utilities"
|
|
- "homelab.description=Form.io database"
|
|
|
|
# Authelia Redis - Session storage for Authelia
|
|
# No web UI - backend service
|
|
authelia-redis:
|
|
image: redis:alpine
|
|
container_name: authelia-redis
|
|
restart: unless-stopped
|
|
networks:
|
|
- homelab-network
|
|
volumes:
|
|
- authelia-redis-data:/data
|
|
command: redis-server --save 60 1 --loglevel warning
|
|
labels:
|
|
- "homelab.category=utilities"
|
|
- "homelab.description=Session storage for Authelia"
|
|
|
|
volumes:
|
|
backrest-cache:
|
|
formio-mongo-data:
|
|
authelia-redis-data:
|
|
|
|
networks:
|
|
homelab-network:
|
|
external: true
|
|
traefik-network:
|
|
external: true
|
|
formio-network:
|
|
driver: bridge
|