9cc0e93c79
- Add SERVER_HOSTNAME env var for Sablier group naming - Update default hostname from 'jarvis' to 'debian' for generic repo compatibility - Add restart policy documentation to all docker-compose files - Add Sablier labels to lazy-loaded services (jellyfin, dozzle, glances, code-server, homarr, dokuwiki) - Update sablier.yml template to use debian- prefixes - Enhance deploy script to auto-detect hostname and update configurations - Ensure all YAML files remain syntactically valid
231 lines
7.3 KiB
YAML
231 lines
7.3 KiB
YAML
# Infrastructure Services
|
|
# Core services that other services depend on
|
|
# Place in /opt/stacks/infrastructure/docker-compose.yml
|
|
# NOTE: Traefik, Authelia, DuckDNS, and Gluetun have their own separate stacks
|
|
# See /opt/stacks/traefik/, /opt/stacks/authelia/, etc.
|
|
|
|
# RESTART POLICY GUIDE:
|
|
# - unless-stopped: Core infrastructure services that should always run
|
|
# - no: Services with Sablier lazy loading (start on-demand)
|
|
# - See individual service comments for specific reasoning
|
|
|
|
# Service Access URLs:
|
|
# - Portainer: https://portainer.${DOMAIN}
|
|
# - Pi-hole: https://pihole.${DOMAIN}
|
|
# - Dozzle: https://dozzle.${DOMAIN}
|
|
# - Glances: https://glances.${DOMAIN}
|
|
# - Netdata: https://netdata.${DOMAIN}
|
|
|
|
services:
|
|
dockerproxy:
|
|
# Docker socket proxy for security - provides safe Docker API access, must always run
|
|
image: tecnativa/docker-socket-proxy:latest
|
|
container_name: dockerproxy
|
|
privileged: true
|
|
restart: unless-stopped
|
|
ports:
|
|
- 2375:2375
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
environment:
|
|
- CONTAINERS=1
|
|
- SERVICES=1
|
|
- TASKS=1
|
|
- NETWORKS=1
|
|
- NODES=1
|
|
labels:
|
|
- homelab.category=infrastructure
|
|
- homelab.description=Docker socket proxy for security
|
|
|
|
# Pi-hole - Network-wide ad blocker and DNS server
|
|
# Access at: https://pihole.${DOMAIN}
|
|
# DNS service must always run for network-wide ad blocking
|
|
pihole:
|
|
image: pihole/pihole:2024.01.0
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.25'
|
|
memory: 128M
|
|
pids: 256
|
|
reservations:
|
|
cpus: '0.10'
|
|
memory: 64M
|
|
container_name: pihole
|
|
restart: unless-stopped
|
|
networks:
|
|
- homelab-network
|
|
- traefik-network
|
|
ports:
|
|
- "53:53/tcp" # DNS TCP
|
|
- "53:53/udp" # DNS UDP
|
|
volumes:
|
|
- ./pihole/etc-pihole:/etc/pihole
|
|
- ./pihole/etc-dnsmasq.d:/etc/dnsmasq.d
|
|
environment:
|
|
- TZ=${TZ:-America/New_York}
|
|
- WEBPASSWORD=${PIHOLE_PASSWORD:-changeme}
|
|
- FTLCONF_LOCAL_IPV4=${SERVER_IP}
|
|
dns:
|
|
- 127.0.0.1
|
|
- 1.1.1.1
|
|
cap_add:
|
|
- NET_ADMIN
|
|
labels:
|
|
- "homelab.category=infrastructure"
|
|
- "homelab.description=Network-wide ad blocking and DNS"
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.pihole.rule=Host(`pihole.${DOMAIN}`)"
|
|
- "traefik.http.routers.pihole.entrypoints=websecure"
|
|
- "traefik.http.routers.pihole.tls=true"
|
|
- "traefik.http.routers.pihole.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.pihole.middlewares=authelia@docker"
|
|
- "traefik.http.services.pihole.loadbalancer.server.port=80"
|
|
- "x-dockge.url=https://pihole.${DOMAIN}"
|
|
|
|
# Watchtower - Automatic container updates
|
|
# Monitors and updates Docker containers to latest versions
|
|
# Runs daily at 4 AM
|
|
watchtower:
|
|
image: containrrr/watchtower:latest
|
|
container_name: watchtower
|
|
restart: unless-stopped
|
|
networks:
|
|
- homelab-network
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
environment:
|
|
- DOCKER_API_VERSION=1.52
|
|
- WATCHTOWER_CLEANUP=true
|
|
- WATCHTOWER_INCLUDE_RESTARTING=true
|
|
- WATCHTOWER_SCHEDULE=0 0 4 * * * # 4 AM daily
|
|
- WATCHTOWER_NOTIFICATIONS=shoutrrr
|
|
- WATCHTOWER_NOTIFICATION_URL=${WATCHTOWER_NOTIFICATION_URL:-}
|
|
labels:
|
|
- "homelab.category=infrastructure"
|
|
- "homelab.description=Automatic Docker container updates"
|
|
|
|
# Dozzle - Real-time Docker log viewer
|
|
# Access at: https://dozzle.${DOMAIN}
|
|
# Uses Sablier lazy loading - starts on-demand, stops after 30min inactivity
|
|
dozzle:
|
|
image: amir20/dozzle:latest
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.50'
|
|
memory: 256M
|
|
pids: 512
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 128M
|
|
container_name: dozzle
|
|
restart: no
|
|
networks:
|
|
- homelab-network
|
|
- traefik-network
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
environment:
|
|
- DOZZLE_LEVEL=info
|
|
- DOZZLE_TAILSIZE=300
|
|
- DOZZLE_FILTER=status=running
|
|
labels:
|
|
- "homelab.category=infrastructure"
|
|
- "homelab.description=Real-time Docker log viewer"
|
|
- "sablier.enable=true"
|
|
- "sablier.group=${SERVER_HOSTNAME:-debian}-dozzle"
|
|
- "sablier.start-on-demand=true"
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.dozzle.rule=Host(`dozzle.${DOMAIN}`)"
|
|
- "traefik.http.routers.dozzle.entrypoints=websecure"
|
|
- "traefik.http.routers.dozzle.tls=true"
|
|
- "traefik.http.routers.dozzle.middlewares=authelia@docker"
|
|
- "traefik.http.services.dozzle.loadbalancer.server.port=8080"
|
|
|
|
# Glances - System monitoring
|
|
# Access at: https://glances.${DOMAIN}
|
|
# Uses Sablier lazy loading - starts on-demand, stops after 30min inactivity
|
|
glances:
|
|
image: nicolargo/glances:latest-full
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.50'
|
|
memory: 256M
|
|
pids: 512
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 128M
|
|
container_name: glances
|
|
restart: no
|
|
networks:
|
|
- homelab-network
|
|
- traefik-network
|
|
pid: host
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- ./glances/config:/glances/conf
|
|
environment:
|
|
- GLANCES_OPT=-w
|
|
labels:
|
|
- "homelab.category=infrastructure"
|
|
- "homelab.description=System and Docker monitoring"
|
|
- "sablier.enable=true"
|
|
- "sablier.group=${SERVER_HOSTNAME:-debian}-glances"
|
|
- "sablier.start-on-demand=true"
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.glances.rule=Host(`glances.${DOMAIN}`)"
|
|
- "traefik.http.routers.glances.entrypoints=websecure"
|
|
- "traefik.http.routers.glances.tls=true"
|
|
- "traefik.http.routers.glances.middlewares=authelia@docker"
|
|
- "traefik.http.services.glances.loadbalancer.server.port=61208"
|
|
|
|
# Code Server - VS Code in browser
|
|
# Access at: https://code.${DOMAIN}
|
|
# Uses Sablier lazy loading - starts on-demand, stops after 30min inactivity
|
|
code-server:
|
|
image: lscr.io/linuxserver/code-server:latest
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '1.5'
|
|
memory: 1G
|
|
pids: 2048
|
|
reservations:
|
|
cpus: '0.75'
|
|
memory: 512M
|
|
container_name: code-server
|
|
restart: no
|
|
networks:
|
|
- homelab-network
|
|
- traefik-network
|
|
volumes:
|
|
- ./code-server/config:/config
|
|
- /opt/stacks:/opt/stacks # Access to all stacks
|
|
- /mnt:/mnt:ro # Read-only access to data
|
|
environment:
|
|
- PUID=${PUID:-1000}
|
|
- PGID=${PGID:-1000}
|
|
- TZ=${TZ}
|
|
- PASSWORD=${CODE_SERVER_PASSWORD}
|
|
- SUDO_PASSWORD=${CODE_SERVER_SUDO_PASSWORD}
|
|
labels:
|
|
- "homelab.category=infrastructure"
|
|
- "homelab.description=VS Code in browser"
|
|
- "sablier.enable=true"
|
|
- "sablier.group=${SERVER_HOSTNAME:-debian}-code-server"
|
|
- "sablier.start-on-demand=true"
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.code-server.rule=Host(`code.${DOMAIN}`)"
|
|
- "traefik.http.routers.code-server.entrypoints=websecure"
|
|
- "traefik.http.routers.code-server.tls.certresolver=letsencrypt"
|
|
- "traefik.http.routers.code-server.middlewares=authelia@docker"
|
|
- "traefik.http.services.code-server.loadbalancer.server.port=8443"
|
|
|
|
networks:
|
|
homelab-network:
|
|
external: true
|
|
traefik-network:
|
|
external: true
|