Huge update. Reorganized folders. Added post-install logic. Have to do testing to check if everything works.
This commit is contained in:
Raphaël Numbus
@@ -1,76 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
container_name = "frigate";
|
||||
compose-dir = "docker-compose/frigate";
|
||||
config-dir = "/mnt/config-storage/docker-data/frigate";
|
||||
data-dir = "/mnt/data-storage/docker-data/frigate";
|
||||
in
|
||||
|
||||
{
|
||||
config = {
|
||||
environment.etc."${compose-dir}/compose.yaml".text =
|
||||
/*
|
||||
yaml
|
||||
*/
|
||||
''
|
||||
services:
|
||||
frigate:
|
||||
image: ghcr.io/blakeblackshear/frigate:stable
|
||||
container_name: frigate
|
||||
shm_size: "512MB"
|
||||
networks:
|
||||
hass_frontend:
|
||||
hass_backend:
|
||||
volumes:
|
||||
- ${config-dir}/config:/config
|
||||
- ${data-dir}/clips:/media/frigate/clips
|
||||
- ${data-dir}/recordings:/media/frigate/recordings
|
||||
- ${data-dir}/exports:/media/frigate/exports
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
- type: tmpfs
|
||||
target: /tmp/cache
|
||||
tmpfs:
|
||||
size: 2000000000
|
||||
environment:
|
||||
FRIGATE_MQTT_USER: $FRIGATE_MQTT_USER
|
||||
FRIGATE_MQTT_PASSWORD: $FRIGATE_MQTT_PASSWORD
|
||||
# --- frigate devices --- #
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.http.services.frigate.loadbalancer.server.port=8971
|
||||
- traefik.http.services.frigate.loadbalancer.server.scheme=http
|
||||
- traefik.http.routers.frigate-https.entrypoints=websecure
|
||||
- traefik.http.routers.frigate-https.rule=Host(`cctv.$DOMAIN_NAME`)
|
||||
- traefik.http.routers.frigate-https.tls=true
|
||||
- traefik.http.routers.frigate-https.tls.certresolver=cloudflare
|
||||
restart: unless-stopped
|
||||
|
||||
networks:
|
||||
hass_backend:
|
||||
external: true
|
||||
hass_frontend:
|
||||
external: true
|
||||
'';
|
||||
|
||||
systemd.services.frigate = {
|
||||
description = "Docker container : ${container_name}";
|
||||
after = [ "network.target" "docker.service" "docker.socket" "traefik.service" ];
|
||||
requires = [ "docker.service" ];
|
||||
wantedBy = ["multi-user.target"];
|
||||
path = [ pkgs.docker ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
# Pull the latest image before running
|
||||
ExecStartPre = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml pull";
|
||||
# Bring the service up
|
||||
ExecStart = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml up --remove-orphans";
|
||||
# Take it down gracefully
|
||||
ExecStop = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml down";
|
||||
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,92 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
container_name = "gitea";
|
||||
compose-dir = "docker-compose/gitea";
|
||||
config-dir = "/mnt/config-storage/docker-data/gitea";
|
||||
in
|
||||
|
||||
{
|
||||
config = {
|
||||
environment.etc."${compose-dir}/compose.yaml".text =
|
||||
/*DB_NAM
|
||||
yaml
|
||||
*/
|
||||
''
|
||||
services:
|
||||
gitea:
|
||||
image: gitea/gitea:latest
|
||||
container_name: gitea
|
||||
networks:
|
||||
gitea_frontend:
|
||||
gitea_backend:
|
||||
volumes:
|
||||
- ${config_dir}/data:/data
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
environment:
|
||||
- USER_UID=1000
|
||||
- USER_GID=1000
|
||||
- GITEA__database__DB_TYPE=postgres
|
||||
- GITEA__database__HOST=$POSTGRES_HOST:$POSTGRES_PORT
|
||||
- GITEA__database__NAME=$DB_NAME
|
||||
- GITEA__database__USER=$DB_USERNAME
|
||||
- GITEA__database__PASSWD=$DB_PASSWORD
|
||||
- GITEA__server__SSH_PORT=2424
|
||||
- GITEA__server__ROOT_URL=gitea.$DOMAIN_NAME
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.http.services.gitea.loadbalancer.server.port=3000
|
||||
- traefik.http.services.gitea.loadbalancer.server.scheme=http
|
||||
- traefik.http.routers.gitea-https.entrypoints=websecure
|
||||
- traefik.http.routers.gitea-https.rule=Host(`gitea.$DOMAIN_NAME`)
|
||||
- traefik.http.routers.gitea-https.tls=true
|
||||
- traefik.http.routers.gitea-https.tls.certresolver=cloudflare
|
||||
depends_on:
|
||||
- gitea-database
|
||||
restart: unless-stopped
|
||||
|
||||
gitea-database:
|
||||
image: docker.io/library/postgres:17.5
|
||||
container_name: gitea-database
|
||||
environment:
|
||||
- POSTGRES_USER=$DB_USERNAME
|
||||
- POSTGRES_PASSWORD=$DB_PASSWORD
|
||||
- POSTGRES_DB=$DB_NAME
|
||||
networks:
|
||||
gitea_backend:
|
||||
volumes:
|
||||
- gitea-database:/var/lib/postgresql/data
|
||||
restart: unless-stopped
|
||||
|
||||
volumes:
|
||||
gitea-database:
|
||||
|
||||
networks:
|
||||
gitea_frontend:
|
||||
external: true
|
||||
gitea_backend:
|
||||
external: true
|
||||
'';
|
||||
|
||||
systemd.services.gitea = {
|
||||
description = "Docker container : ${container_name}";
|
||||
after = [ "network.target" "docker.service" "docker.socket" "traefik.service" ];
|
||||
requires = [ "docker.service" ];
|
||||
wantedBy = ["multi-user.target"];
|
||||
path = [ pkgs.docker ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
# Pull the latest image before running
|
||||
ExecStartPre = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml pull";
|
||||
# Bring the service up
|
||||
ExecStart = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml up --remove-orphans";
|
||||
# Take it down gracefully
|
||||
ExecStop = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml down";
|
||||
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,75 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
container_name = "home-assistant";
|
||||
compose-dir = "docker-compose/hass";
|
||||
config-dir = "/mnt/config-storage/docker-data/hass";
|
||||
in
|
||||
|
||||
{
|
||||
config = {
|
||||
environment.etc."${compose-dir}/compose.yaml".text =
|
||||
/*
|
||||
yaml
|
||||
*/
|
||||
''
|
||||
services:
|
||||
home-assistant:
|
||||
image: ghcr.io/home-assistant/home-assistant:latest
|
||||
container_name: home-assistant
|
||||
networks:
|
||||
hass_frontend:
|
||||
hass_backend:
|
||||
volumes:
|
||||
- ${config-dir}/config:/config
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
- /run/dbus:/run/dbus:ro
|
||||
# --- hass devices --- #
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.http.services.home-assistant.loadbalancer.server.port=8123
|
||||
- traefik.http.services.home-assistant.loadbalancer.server.scheme=http
|
||||
- traefik.http.routers.home-assistant-https.entrypoints=websecure
|
||||
- traefik.http.routers.home-assistant-https.rule=Host(`hass.$DOMAIN_NAME`)
|
||||
- traefik.http.routers.home-assistant-https.tls=true
|
||||
- traefik.http.routers.home-assistant-https.tls.certresolver=cloudflare
|
||||
restart: unless-stopped
|
||||
|
||||
frigate-mqtt:
|
||||
image: eclipse-mosquitto
|
||||
container_name: frigate-mqtt
|
||||
user: 1000:1000
|
||||
networks:
|
||||
hass_backend:
|
||||
volumes:
|
||||
- ${config-dir}/mqtt:/mosquitto
|
||||
restart: unless-stopped
|
||||
|
||||
networks:
|
||||
hass_backend:
|
||||
external: true
|
||||
hass_frontend:
|
||||
external: true
|
||||
'';
|
||||
|
||||
systemd.services.hass = {
|
||||
description = "Docker container : ${container_name}";
|
||||
after = [ "network.target" "docker.service" "docker.socket" "traefik.service" ];
|
||||
requires = [ "docker.service" ];
|
||||
wantedBy = ["multi-user.target"];
|
||||
path = [ pkgs.docker ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
# Pull the latest image before running
|
||||
ExecStartPre = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml pull";
|
||||
# Bring the service up
|
||||
ExecStart = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml up --remove-orphans";
|
||||
# Take it down gracefully
|
||||
ExecStop = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml down";
|
||||
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,111 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
container_name = "immich";
|
||||
compose-dir = "docker-compose/immich";
|
||||
config-dir = "/mnt/config-storage/docker-data/immich";
|
||||
in
|
||||
|
||||
{
|
||||
config = {
|
||||
environment.etc."${compose-dir}/compose.yaml".text =
|
||||
/*
|
||||
yaml
|
||||
*/
|
||||
''
|
||||
services:
|
||||
immich-server:
|
||||
image: ghcr.io/immich-app/immich-server:$IMMICH_VERSION
|
||||
container_name: immich-server
|
||||
networks:
|
||||
immich_frontend:
|
||||
immich_backend:
|
||||
volumes:
|
||||
- $UPLOAD_LOCATION:/data
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
# --- immich devices --- #
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.http.services.immich.loadbalancer.server.port=2283
|
||||
- traefik.http.services.immich.loadbalancer.server.scheme=http
|
||||
- traefik.http.routers.immich-https.entrypoints=websecure
|
||||
- traefik.http.routers.immich-https.rule=Host(`immich.$DOMAIN_NAME`)
|
||||
- traefik.http.routers.immich-https.tls=true
|
||||
- traefik.http.routers.immich-https.tls.certresolver=cloudflare
|
||||
env_file:
|
||||
- .env
|
||||
depends_on:
|
||||
- immich-redis
|
||||
- immich-database
|
||||
restart: always
|
||||
healthcheck:
|
||||
disable: false
|
||||
|
||||
immich-machine-learning:
|
||||
container_name: immich-machine-learning
|
||||
image: ghcr.io/immich-app/immich-machine-learning:$IMMICH_VERSION
|
||||
networks:
|
||||
immich_backend:
|
||||
volumes:
|
||||
- ${config-dir}/models:/cache
|
||||
env_file:
|
||||
- .env
|
||||
restart: always
|
||||
healthcheck:
|
||||
disable: false
|
||||
|
||||
immich-redis:
|
||||
container_name: immich-redis
|
||||
image: docker.io/valkey/valkey:8-bookworm@sha256:a137a2b60aca1a75130022d6bb96af423fefae4eb55faf395732db3544803280
|
||||
networks:
|
||||
immich_backend:
|
||||
healthcheck:
|
||||
test: redis-cli ping || exit 1
|
||||
restart: always
|
||||
|
||||
immich-database:
|
||||
container_name: immich-database
|
||||
image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:32324a2f41df5de9efe1af166b7008c3f55646f8d0e00d9550c16c9822366b4a
|
||||
networks:
|
||||
immich_backend:
|
||||
shm_size: 128mb
|
||||
volumes:
|
||||
# Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
|
||||
- $DB_DATA_LOCATION:/var/lib/postgresql/data
|
||||
environment:
|
||||
POSTGRES_PASSWORD: $DB_PASSWORD
|
||||
POSTGRES_USER: $DB_USERNAME
|
||||
POSTGRES_DB: $DB_DATABASE_NAME
|
||||
POSTGRES_INITDB_ARGS: '--data-checksums'
|
||||
restart: always
|
||||
healthcheck:
|
||||
disable: false
|
||||
|
||||
networks:
|
||||
immich_backend:
|
||||
external: true
|
||||
immich_frontend:
|
||||
external: true
|
||||
'';
|
||||
|
||||
systemd.services.immich = {
|
||||
description = "Docker container : ${container_name}";
|
||||
after = [ "network.target" "docker.service" "docker.socket" "traefik.service" ];
|
||||
requires = [ "docker.service" ];
|
||||
wantedBy = ["multi-user.target"];
|
||||
path = [ pkgs.docker ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
# Pull the latest image before running
|
||||
ExecStartPre = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml pull";
|
||||
# Bring the service up
|
||||
ExecStart = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml up --remove-orphans";
|
||||
# Take it down gracefully
|
||||
ExecStop = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml down";
|
||||
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,55 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
container_name = "it-tools";
|
||||
compose-dir = "docker-compose/it-tools";
|
||||
in
|
||||
|
||||
{
|
||||
config = {
|
||||
environment.etc."${compose-dir}/compose.yaml".text =
|
||||
/*
|
||||
yaml
|
||||
*/
|
||||
''
|
||||
services:
|
||||
it-tools:
|
||||
container_name: it-tools
|
||||
image: corentinth/it-tools
|
||||
networks:
|
||||
it-tools:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.http.services.it-tools.loadbalancer.server.port=80
|
||||
- traefik.http.services.it-tools.loadbalancer.server.scheme=http
|
||||
- traefik.http.routers.it-tools-https.entrypoints=websecure
|
||||
- traefik.http.routers.it-tools-https.rule=Host(`it-tools.$DOMAIN_NAME`)
|
||||
- traefik.http.routers.it-tools-https.tls=true
|
||||
- traefik.http.routers.it-tools-https.tls.certresolver=cloudflare
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
it-tools:
|
||||
external: true
|
||||
'';
|
||||
|
||||
systemd.services.it-tools = {
|
||||
description = "Docker container : ${container_name}";
|
||||
after = [ "network.target" "docker.service" "docker.socket" "traefik.service" ];
|
||||
requires = [ "docker.service" ];
|
||||
wantedBy = ["multi-user.target"];
|
||||
path = [ pkgs.docker ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
# Pull the latest image before running
|
||||
ExecStartPre = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml pull";
|
||||
# Bring the service up
|
||||
ExecStart = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml up --remove-orphans";
|
||||
# Take it down gracefully
|
||||
ExecStop = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml down";
|
||||
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,78 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
container_name = "nextcloud";
|
||||
compose-dir = "docker-compose/nextcloud";
|
||||
data-dir = "/mnt/data-storage/docker-data/nextcloud";
|
||||
in
|
||||
|
||||
{
|
||||
config = {
|
||||
environment.etc."${compose-dir}/compose.yaml".text =
|
||||
/*
|
||||
yaml
|
||||
*/
|
||||
''
|
||||
services:
|
||||
nextcloud-aio-mastercontainer:
|
||||
image: nextcloud/all-in-one:latest
|
||||
container_name: nextcloud-aio-mastercontainer
|
||||
networks:
|
||||
nextcloud-aio:
|
||||
volumes:
|
||||
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
environment:
|
||||
APACHE_PORT: 11000
|
||||
NEXTCLOUD_TRUSTED_DOMAINS: nextcloud.$DOMAIN_NAME nextcloud-aio.$DOMAIN_NAME
|
||||
TRUSTED_PROXIES: 172.16.1.253
|
||||
APACHE_IP_BINDING: 127.0.0.1
|
||||
NEXTCLOUD_DATADIR: ${data-dir}
|
||||
NEXTCLOUD_ENABLE_DRI_DEVICE: $NEXTCLOUD_ENABLE_DRI_DEVICE
|
||||
NEXTCLOUD_UPLOAD_LIMIT: 16G
|
||||
NEXTCLOUD_MAX_TIME: 3600
|
||||
NEXTCLOUD_MEMORY_LIMIT: 2048M
|
||||
SKIP_DOMAIN_VALIDATION: true
|
||||
NEXTCLOUD_ADDITIONAL_APKS: imagemagick
|
||||
NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080
|
||||
- traefik.http.services.nextcloud-aio.loadbalancer.server.scheme=https
|
||||
- traefik.http.routers.nextcloud-aio-https.entrypoints=websecure
|
||||
- traefik.http.routers.nextcloud-aio-https.rule=Host(`nextcloud-aio.$DOMAIN_NAME`)
|
||||
- traefik.http.routers.nextcloud-aio-https.tls=true
|
||||
- traefik.http.routers.nextcloud-aio-https.tls.certresolver=cloudflare
|
||||
init: true
|
||||
restart: always
|
||||
|
||||
networks:
|
||||
nextcloud-aio:
|
||||
external: true
|
||||
|
||||
volumes:
|
||||
nextcloud_aio_mastercontainer:
|
||||
name: nextcloud_aio_mastercontainer
|
||||
'';
|
||||
|
||||
systemd.services.nextcloud = {
|
||||
description = "Docker container : ${container_name}";
|
||||
after = [ "network.target" "docker.service" "docker.socket" "traefik.service" ];
|
||||
requires = [ "docker.service" ];
|
||||
wantedBy = ["multi-user.target"];
|
||||
path = [ pkgs.docker ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
# Pull the latest image before running
|
||||
ExecStartPre = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml pull";
|
||||
# Bring the service up
|
||||
ExecStart = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml up --remove-orphans";
|
||||
# Take it down gracefully
|
||||
ExecStop = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml down";
|
||||
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,107 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
container_name = "passbolt";
|
||||
compose-dir = "docker-compose/passbolt";
|
||||
in
|
||||
|
||||
{
|
||||
config = {
|
||||
environment.etc."${compose-dir}/compose.yaml".text =
|
||||
/*
|
||||
yaml
|
||||
*/
|
||||
''
|
||||
services:
|
||||
passbolt:
|
||||
image: passbolt/passbolt:latest-ce-non-root
|
||||
container_name: passbolt
|
||||
networks:
|
||||
passbolt_frontend:
|
||||
passbolt_backend:
|
||||
volumes:
|
||||
- passbolt-gpg:/etc/passbolt/gpg
|
||||
- passbolt-jwt:/etc/passbolt/jwt
|
||||
environment:
|
||||
APP_DEFAULT_TIMEZONE: $TZ
|
||||
APP_FULL_BASE_URL: https://passbolt.$DOMAIN_NAME
|
||||
DATASOURCES_DEFAULT_HOST: "passbolt-database"
|
||||
DATASOURCES_DEFAULT_USERNAME: $PASSBOLT_MYSQL_USER
|
||||
DATASOURCES_DEFAULT_PASSWORD: $PASSBOLT_MYSQL_PASSWORD
|
||||
DATASOURCES_DEFAULT_DATABASE: $PASSBOLT_MYSQL_DATABASE
|
||||
EMAIL_DEFAULT_FROM_NAME: "Passbolt"
|
||||
EMAIL_TRANSPORT_DEFAULT_HOST: $SENDER_EMAIL_DOMAIN
|
||||
EMAIL_TRANSPORT_DEFAULT_PORT: $SENDER_EMAIL_PORT
|
||||
EMAIL_TRANSPORT_DEFAULT_USERNAME: $SENDER_EMAIL_ADDRESS
|
||||
EMAIL_TRANSPORT_DEFAULT_PASSWORD: $SENDER_EMAIL_ADDRESS_PASSWORD
|
||||
EMAIL_TRANSPORT_DEFAULT_TLS: true
|
||||
EMAIL_DEFAULT_FROM: $EMAIL_ADDRESS
|
||||
PASSBOLT_SSL_FORCE: true
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.http.services.passbolt.loadbalancer.server.port=4433
|
||||
- traefik.http.services.passbolt.loadbalancer.server.scheme=https
|
||||
- traefik.http.routers.passbolt-https.entrypoints=websecure
|
||||
- traefik.http.routers.passbolt-https.rule=Host(`passbolt.$DOMAIN_NAME`)
|
||||
- traefik.http.routers.passbolt-https.tls=true
|
||||
- traefik.http.routers.passbolt-https.tls.certresolver=cloudflare
|
||||
command:
|
||||
[
|
||||
"/usr/bin/wait-for.sh",
|
||||
"-t",
|
||||
"0",
|
||||
"passbolt-database:3306",
|
||||
"--",
|
||||
"/docker-entrypoint.sh",
|
||||
]
|
||||
depends_on:
|
||||
- passbolt-database
|
||||
restart: unless-stopped
|
||||
|
||||
passbolt-database:
|
||||
image: mariadb:11.3
|
||||
container_name: passbolt-database
|
||||
networks:
|
||||
passbolt_backend:
|
||||
volumes:
|
||||
- passbolt-database:/var/lib/mysql
|
||||
environment:
|
||||
MYSQL_RANDOM_ROOT_PASSWORD: "true"
|
||||
MYSQL_DATABASE: $PASSBOLT_MYSQL_DATABASE
|
||||
MYSQL_USER: $PASSBOLT_MYSQL_USER
|
||||
MYSQL_PASSWORD: $PASSBOLT_MYSQL_PASSWORD
|
||||
restart: unless-stopped
|
||||
|
||||
networks:
|
||||
passbolt_backend:
|
||||
external: true
|
||||
passbolt_frontend:
|
||||
external: true
|
||||
|
||||
volumes:
|
||||
passbolt-database:
|
||||
passbolt-gpg:
|
||||
passbolt-jwt:
|
||||
'';
|
||||
|
||||
systemd.services.passbolt = {
|
||||
description = "Docker container : ${container_name}";
|
||||
after = [ "network.target" "docker.service" "docker.socket" "traefik.service" ];
|
||||
requires = [ "docker.service" ];
|
||||
wantedBy = ["multi-user.target"];
|
||||
path = [ pkgs.docker ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
# Pull the latest image before running
|
||||
ExecStartPre = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml pull";
|
||||
# Bring the service up
|
||||
ExecStart = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml up --remove-orphans";
|
||||
# Take it down gracefully
|
||||
ExecStop = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml down";
|
||||
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,85 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
container_name = "pihole";
|
||||
compose-dir = "docker-compose/pihole";
|
||||
config-dir = "/mnt/config-storage/docker-data/pihole";
|
||||
in
|
||||
|
||||
{
|
||||
config = {
|
||||
environment.etc."${compose-dir}/compose.yaml".text =
|
||||
/*
|
||||
yaml
|
||||
*/
|
||||
''
|
||||
services:
|
||||
pihole:
|
||||
image: pihole/pihole:latest
|
||||
container_name: pihole
|
||||
networks:
|
||||
pihole:
|
||||
ports:
|
||||
# DNS Ports
|
||||
- "53:53/tcp"
|
||||
- "53:53/udp"
|
||||
environment:
|
||||
TZ: $TZ
|
||||
FTLCONF_webserver_api_password: $FTLCONF_webserver_api_password
|
||||
FTLCONF_dns_listeningMode: all
|
||||
FTLCONF_dns_revServers: true,$HOME_ROUTER_SUBNET,$HOME_ROUTER_IP,home
|
||||
FTLCONF_dns_domain_name: home
|
||||
FTLCONF_dns_domain_local: true
|
||||
FTLCONF_dns_hosts: |
|
||||
$HOME_SERVER_IP dns.$DOMAIN_NAME
|
||||
$HOME_SERVER_IP reverse.$DOMAIN_NAME
|
||||
$HOME_SERVER_IP nextcloud.$DOMAIN_NAME
|
||||
$HOME_SERVER_IP nextcloud-aio.$DOMAIN_NAME
|
||||
$HOME_SERVER_IP hass.$DOMAIN_NAME
|
||||
$HOME_SERVER_IP passbolt.$DOMAIN_NAME
|
||||
FTLCONF_dhcp_active: false
|
||||
FTLCONF_dns_upstreams: 9.9.9.11;149.112.112.11
|
||||
PIHOLE_UID: 1000
|
||||
PIHOLE_GID: 1000
|
||||
volumes:
|
||||
- ${config-dir}/config:/etc/pihole
|
||||
cap_add:
|
||||
- SYS_TIME
|
||||
- SYS_NICE
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.http.services.pihole.loadbalancer.server.port=443
|
||||
- traefik.http.services.pihole.loadbalancer.server.scheme=https
|
||||
- traefik.http.routers.pihole-https.entrypoints=websecure
|
||||
- traefik.http.routers.pihole-https.rule=Host(`dns.$DOMAIN_NAME`)
|
||||
- traefik.http.routers.pihole-https.tls=true
|
||||
- traefik.http.routers.pihole-https.tls.certresolver=cloudflare
|
||||
restart: unless-stopped
|
||||
|
||||
networks:
|
||||
pihole:
|
||||
external: true
|
||||
'';
|
||||
|
||||
systemd.services.pihole = {
|
||||
description = "Docker container : ${container_name}";
|
||||
after = [ "network.target" "docker.service" "docker.socket" "traefik.service" ];
|
||||
requires = [ "docker.service" ];
|
||||
wantedBy = ["multi-user.target"];
|
||||
path = [ pkgs.docker ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
# Pull the latest image before running
|
||||
ExecStartPre = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml pull";
|
||||
# Bring the service up
|
||||
ExecStart = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml up --remove-orphans";
|
||||
# Take it down gracefully
|
||||
ExecStop = "${pkgs.docker}/bin/docker compose -f /etc/${compose-dir}/compose.yaml down";
|
||||
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
persistence true
|
||||
persistence_location /mosquitto/data/
|
||||
log_dest file /mosquitto/log/mosquitto.log
|
||||
listener 1883
|
||||
|
||||
## Authentication ##
|
||||
allow_anonymous false
|
||||
password_file /mosquitto/config/password.txt
|
||||
@@ -1,20 +0,0 @@
|
||||
http:
|
||||
middlewares:
|
||||
passbolt:
|
||||
headers:
|
||||
FrameDeny: true
|
||||
AccessControlAllowMethods: 'GET,OPTIONS,PUT'
|
||||
AccessControlAllowOriginList:
|
||||
- origin-list-or-null
|
||||
AccessControlMaxAge: 100
|
||||
AddVaryHeader: true
|
||||
BrowserXssFilter: true
|
||||
ContentTypeNosniff: true
|
||||
ForceSTSHeader: true
|
||||
STSIncludeSubdomains: true
|
||||
STSPreload: true
|
||||
ContentSecurityPolicy: default-src 'self' 'unsafe-inline'
|
||||
CustomFrameOptionsValue: SAMEORIGIN
|
||||
ReferrerPolicy: same-origin
|
||||
PermissionsPolicy: vibrate 'self'
|
||||
STSSeconds: 315360000
|
||||
@@ -1,41 +0,0 @@
|
||||
http:
|
||||
routers:
|
||||
nextcloud:
|
||||
rule: "Host(`nextcloud.${DOMAIN_NAME}`)"
|
||||
entrypoints:
|
||||
- "websecure"
|
||||
service: nextcloud
|
||||
middlewares:
|
||||
- nextcloud-chain
|
||||
tls:
|
||||
certresolver: "cloudflare"
|
||||
|
||||
services:
|
||||
nextcloud:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://nextcloud-aio-apache:11000"
|
||||
|
||||
middlewares:
|
||||
nextcloud-secure-headers:
|
||||
headers:
|
||||
hostsProxyHeaders:
|
||||
- "X-Forwarded-Host"
|
||||
referrerPolicy: "same-origin"
|
||||
BrowserXssFilter: true
|
||||
ContentTypeNosniff: true
|
||||
ForceSTSHeader: true
|
||||
STSIncludeSubdomains: true
|
||||
STSPreload: true
|
||||
STSSeconds: 315360000
|
||||
|
||||
https-redirect:
|
||||
redirectscheme:
|
||||
scheme: https
|
||||
|
||||
nextcloud-chain:
|
||||
chain:
|
||||
middlewares:
|
||||
# - ... (e.g. rate limiting middleware)
|
||||
- https-redirect
|
||||
- nextcloud-secure-headers
|
||||
@@ -1,12 +0,0 @@
|
||||
tls:
|
||||
options:
|
||||
default:
|
||||
minVersion: VersionTLS12
|
||||
sniStrict: true
|
||||
curvePreferences:
|
||||
- CurveP521
|
||||
- CurveP384
|
||||
cipherSuites:
|
||||
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
@@ -1,54 +0,0 @@
|
||||
global:
|
||||
checkNewVersion: false
|
||||
sendAnonymousUsage: false
|
||||
|
||||
# - level: [TRACE, DEBUG, INFO, WARN, ERROR, FATAL]
|
||||
log:
|
||||
level: ERROR
|
||||
|
||||
accesslog: {}
|
||||
|
||||
api:
|
||||
dashboard: true
|
||||
insecure: true
|
||||
|
||||
entryPoints:
|
||||
web:
|
||||
address: :80
|
||||
http:
|
||||
redirections:
|
||||
entryPoint:
|
||||
to: websecure
|
||||
scheme: https
|
||||
websecure:
|
||||
address: :443
|
||||
forwardedHeaders:
|
||||
trustedIPs:
|
||||
# Local IPs
|
||||
- "127.0.0.1/32"
|
||||
- "10.0.0.0/8"
|
||||
- "192.168.0.0/16"
|
||||
- "172.16.0.0/12"
|
||||
|
||||
certificatesResolvers:
|
||||
cloudflare:
|
||||
acme:
|
||||
email: ${EMAIL_ADDRESS}
|
||||
storage: /var/traefik/certs/cloudflare-acme.json
|
||||
caServer: "https://acme-v02.api.letsencrypt.org/directory"
|
||||
dnsChallenge:
|
||||
provider: cloudflare
|
||||
resolvers:
|
||||
- "1.1.1.1:53"
|
||||
- "9.9.9.9:53"
|
||||
|
||||
serversTransport:
|
||||
insecureSkipVerify: true
|
||||
|
||||
providers:
|
||||
docker:
|
||||
exposedByDefault: false
|
||||
network: nextcloud-aio, passbolt_frontend, pihole, hass_frontend, immich_frontend
|
||||
file:
|
||||
directory: "/etc/traefik/conf/"
|
||||
watch: true
|
||||
Reference in New Issue
Block a user