Add Docker compose templates and configurations

docker-templates/core/docker-compose.yml

@@ -0,0 +1,107 @@
+# Core Infrastructure Services
+# RESTART POLICY GUIDE:
+# - unless-stopped: Core infrastructure services that should always run
+# - no: Services with Sablier lazy loading (start on-demand)
+# - See individual service comments for specific reasoning
+
+services:
+  
+  duckdns:
+    # Dynamic DNS service - must always run to maintain domain resolution
+    image: lscr.io/linuxserver/duckdns:latest
+    container_name: duckdns
+    restart: unless-stopped
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - SUBDOMAINS=${DUCKDNS_SUBDOMAINS}
+      - TOKEN=${DUCKDNS_TOKEN}
+    volumes:
+      - ./duckdns/config:/config
+    networks:
+      - traefik-network
+    labels:
+      - com.getarcaneapp.arcane.icon=https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/duckdns.svg
+  
+  traefik:
+    # Reverse proxy and SSL termination - core routing service, must always run
+    image: traefik:v3
+    container_name: traefik
+    restart: unless-stopped
+    command: ['--configFile=/config/traefik.yml']
+    environment:
+      - DUCKDNS_TOKEN=${DUCKDNS_TOKEN}
+    ports:
+      - 80:80
+      - 443:443
+      - 8080:8080
+    volumes:
+      - ./traefik/config:/config
+      - ./traefik/letsencrypt:/letsencrypt
+      - ./traefik/dynamic:/dynamic
+      - ./traefik/logs:/logs
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - traefik-network
+      - homelab-network
+    labels:
+      - com.getarcaneapp.arcane.icon=https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/traefik.svg
+      - 'homelab.category=core'
+      - 'homelab.description=Reverse proxy and SSL termination'
+      - 'traefik.enable=true'
+      - 'traefik.http.routers.traefik.rule=Host(`traefik.kelinreij.duckdns.org`)'
+      - 'traefik.http.routers.traefik.entrypoints=websecure'
+      - 'traefik.http.routers.traefik.tls.certresolver=letsencrypt'
+      - 'traefik.http.routers.traefik.middlewares=authelia@docker'
+      - 'traefik.http.services.traefik.loadbalancer.server.port=8080'
+
+  authelia:
+    # Single sign-on authentication service - must always run for user authentication
+    image: authelia/authelia:latest
+    container_name: authelia
+    restart: unless-stopped
+    environment:
+      - TZ=${TZ}
+    ports:
+      - '9091:9091'
+    volumes:
+      - ./authelia/config:/config
+      - ./authelia/secrets:/secrets
+    networks:
+      - traefik-network
+      - homelab-network
+    labels:
+      - com.getarcaneapp.arcane.icon=https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/authelia.svg
+      - 'homelab.category=core'
+      - 'homelab.description=Single sign-on authentication'
+      - 'traefik.enable=true'
+      - 'traefik.http.routers.authelia.rule=Host(`auth.kelinreij.duckdns.org`)'
+      - 'traefik.http.routers.authelia.entrypoints=websecure'
+      - 'traefik.http.routers.authelia.tls.certresolver=letsencrypt'
+      - 'traefik.http.routers.authelia.service=authelia'
+      - 'traefik.http.services.authelia.loadbalancer.server.port=9091'
+      - 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.kelinreij.duckdns.org/'
+      - 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=X-Secret'
+      - 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
+
+networks:
+  traefik-network:
+    external: true
+  homelab-network:
+    external: true
+
+x-dockge:
+  urls:
+    - https://auth.kelinreij.duckdns.org
+    - http://192.168.4.4:9091
+    - https://traefik.kelinreij.duckdns.org
+    - http://192.168.4.4:8080
+
+x-arcane:
+  icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/traefik.svg
+  urls:
+    - https://auth.kelinreij.duckdns.org
+    - http://192.168.4.4:9091
+    - https://traefik.kelinreij.duckdns.org
+    - http://192.168.4.4:8080