mirror of
https://github.com/furyhawk/cloudy.git
synced 2026-05-20 07:01:04 +00:00
Compare commits
54 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 furyhawk
|
e458e92573 | ||
|
furyhawk
|
7b2bb828af | ||
|
furyhawk
|
2e8408fb11 | ||
|
furyhawk
|
d407fcbe1a | ||
|
furyhawk
|
8df524c9d5 | ||
|
furyhawk
|
bf693e7236 | ||
|
furyhawk
|
b4d5b540c3 | ||
|
furyhawk
|
5ec576bebf | ||
|
furyhawk
|
e547ae4667 | ||
|
furyhawk
|
0b164d534c | ||
|
furyhawk
|
2a8bfd86d0 | ||
|
furyhawk
|
f4b8809853 | ||
|
furyhawk
|
24265ed8f6 | ||
|
furyhawk
|
5284bcd5e6 | ||
|
furyhawk
|
4e696a8fee | ||
|
furyhawk
|
5d893eafb4 | ||
|
furyhawk
|
8f1d81e650 | ||
|
furyhawk
|
16d137ff59 | ||
|
furyhawk
|
743d5a898c | ||
|
furyhawk
|
0b9dfc3b3c | ||
|
furyhawk
|
95850da1b4 | ||
|
furyhawk
|
39df4583d3 | ||
|
furyhawk
|
83a36ad4f2 | ||
|
furyhawk
|
a17d0cd2e2 | ||
|
furyhawk
|
458fe871f4 | ||
|
furyhawk
|
1e59b91a0e | ||
|
furyhawk
|
4c79bccd85 | ||
|
furyhawk
|
ff31f5c064 | ||
|
furyhawk
|
0360e165f4 | ||
|
furyhawk
|
a36f9aebd5 | ||
|
furyhawk
|
7ed3d9ad64 | ||
|
furyhawk
|
69059e51df | ||
|
furyhawk
|
7013e9b26b | ||
|
furyhawk
|
daba05d362 | ||
|
furyhawk
|
c24f5bf91d | ||
|
furyhawk
|
be341414f9 | ||
|
furyhawk
|
c4ec0ad966 | ||
|
furyhawk
|
3876bd145c | ||
|
furyhawk
|
5342ed08b3 | ||
|
furyhawk
|
09934995cb | ||
|
furyhawk
|
568f9a83f5 | ||
|
furyhawk
|
3e510c8733 | ||
|
furyhawk
|
c08306ecc2 | ||
|
furyhawk
|
8da24cf80a | ||
|
furyhawk
|
374d07f979 | ||
|
furyhawk
|
5e17ef2ea9 | ||
|
furyhawk
|
7645dd739e | ||
|
furyhawk
|
656548d4b0 | ||
|
furyhawk
|
5d7a350afe | ||
|
furyhawk
|
2e3099476e | ||
|
furyhawk
|
a05c289aff | ||
|
furyhawk
|
347b9b9d76 | ||
|
furyhawk
|
0b06931427 | ||
|
furyhawk
|
afa53aa747 |
Submodule
+1
Submodule LibreChat added at 026961f719
+2
-3
@@ -31,7 +31,7 @@ services:
|
||||
- pgadmin:/var/lib/pgadmin
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- postgres
|
||||
- postgres_db
|
||||
expose:
|
||||
- 8080
|
||||
networks:
|
||||
@@ -181,7 +181,7 @@ services:
|
||||
- pgadmin_data:/var/lib/pgadmin
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- postgres
|
||||
- postgres_db
|
||||
expose:
|
||||
- 80
|
||||
networks:
|
||||
@@ -198,7 +198,6 @@ services:
|
||||
privatebin:
|
||||
image: privatebin/nginx-fpm-alpine:latest
|
||||
read_only: true
|
||||
user: "1000:1000"
|
||||
volumes:
|
||||
- privatebin_data:/srv/data # data volume for pastes allows pastes
|
||||
# to persist after container stop or restart
|
||||
|
||||
@@ -33,7 +33,7 @@ services:
|
||||
- "traefik.http.routers.api_server.service=api_server_service"
|
||||
- "traefik.http.services.api_server_service.loadbalancer.server.port=8000"
|
||||
|
||||
postgres:
|
||||
postgres_db:
|
||||
image: postgres
|
||||
environment:
|
||||
POSTGRES_DB: ${POSTGRES_DB}
|
||||
|
||||
@@ -46,6 +46,7 @@ certificatesResolvers:
|
||||
email: "furyx@hotmail.com"
|
||||
storage: /etc/traefik/acme/acme.json
|
||||
# https://docs.traefik.io/master/https/acme/#httpchallenge
|
||||
tlsChallenge: {}
|
||||
httpChallenge:
|
||||
entryPoint: web
|
||||
|
||||
@@ -178,7 +179,7 @@ http:
|
||||
# https://doc.traefik.io/traefik/middlewares/http/headers/#hostsproxyheaders
|
||||
# https://docs.djangoproject.com/en/dev/ref/csrf/#ajax
|
||||
headers:
|
||||
hostsProxyHeaders: ["X-CSRFToken"]
|
||||
hostsProxyHeaders: ["X-CSRF-Token"]
|
||||
sslheader:
|
||||
# https://docs.traefik.io/master/middlewares/headers/
|
||||
headers:
|
||||
|
||||
Submodule
+1
Submodule emqx-docker added at 554e4b1872
@@ -13,4 +13,49 @@ down: pull
|
||||
pull:
|
||||
@echo "Pulling the project..."
|
||||
git pull
|
||||
git submodule update --init --recursive
|
||||
|
||||
deploy-core: pull
|
||||
{ \
|
||||
echo "Deploying the core stack..." ;\
|
||||
set -a ;\
|
||||
. ./swarm/.env ;\
|
||||
set +a ;\
|
||||
docker stack deploy --compose-file ./swarm/core.yml core ;\
|
||||
}
|
||||
|
||||
deploy-services: pull
|
||||
{ \
|
||||
echo "Deploying the services stack..." ;\
|
||||
set -a ;\
|
||||
. ./swarm/.env ;\
|
||||
set +a ;\
|
||||
docker stack deploy --compose-file ./swarm/services.yml services ;\
|
||||
}
|
||||
|
||||
deploy-apps: pull
|
||||
{ \
|
||||
echo "Deploying the apps stack..." ;\
|
||||
set -a ;\
|
||||
. ./swarm/.env ;\
|
||||
set +a ;\
|
||||
docker stack deploy --compose-file ./swarm/apps.yml apps ;\
|
||||
}
|
||||
|
||||
deploy-ghost: pull
|
||||
{ \
|
||||
echo "Deploying the ghost stack..." ;\
|
||||
set -a ;\
|
||||
. ./swarm/.env ;\
|
||||
set +a ;\
|
||||
docker stack deploy --compose-file ./swarm/ghost.yml ghost ;\
|
||||
}
|
||||
|
||||
deploy-thelounge: pull
|
||||
{ \
|
||||
echo "Deploying the thelounge stack..." ;\
|
||||
set -a ;\
|
||||
. ./swarm/.env ;\
|
||||
set +a ;\
|
||||
docker stack deploy --compose-file ./swarm/thelounge.yml thelounge ;\
|
||||
}
|
||||
# git submodule update --init --recursive
|
||||
@@ -0,0 +1,336 @@
|
||||
x-environment: &app-environment
|
||||
DOMAINNAME: "${DOMAINNAME:-furyhawk.lol}"
|
||||
STREAMLIT_FIN_SERVER_PORT: "8501"
|
||||
GROQ_API_KEY: "${GROQ_API_KEY}"
|
||||
BAI_LOCATION: ""
|
||||
STREAMLIT_BAI_SERVER_PORT: "8502"
|
||||
|
||||
volumes:
|
||||
bai_cache: {}
|
||||
ghost_content: {}
|
||||
ghost_mysql: {}
|
||||
jellyfin_config: {}
|
||||
jellyfin_cache: {}
|
||||
pgadmin: {}
|
||||
pgadmin_data: {}
|
||||
privatebin_data: {}
|
||||
thelounge_data: {}
|
||||
|
||||
services:
|
||||
|
||||
adminer:
|
||||
image: adminer
|
||||
environment:
|
||||
PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL}
|
||||
PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD}
|
||||
PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
PYTHONPATH: "/pgadmin4"
|
||||
TZ: Asia/Singapore
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
volumes:
|
||||
- pgadmin:/var/lib/pgadmin
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- postgres_db
|
||||
expose:
|
||||
- 8080
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.adminer.entrypoints=web-secure"
|
||||
- "traefik.http.routers.adminer.rule=Host(`adminer.${DOMAINNAME}`) || Host(`dbadmin.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.adminer.middlewares=csrf@file"
|
||||
- "traefik.http.routers.adminer.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.adminer.service=adminer_app"
|
||||
- "traefik.http.services.adminer_app.loadbalancer.server.port=8080"
|
||||
|
||||
cheatsheets_app:
|
||||
image: furyhawk/cheatsheets:${CHEATSHEETSTAG:-latest}
|
||||
restart: unless-stopped
|
||||
expose:
|
||||
- 80
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.cheatsheets.entrypoints=web-secure"
|
||||
- "traefik.http.routers.cheatsheets.rule=Host(`cheat.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.cheatsheets.middlewares=csrf@file"
|
||||
- "traefik.http.routers.cheatsheets.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.cheatsheets.service=cheatsheets_app"
|
||||
- "traefik.http.services.cheatsheets_app.loadbalancer.server.port=80"
|
||||
|
||||
ghost-db:
|
||||
image: mysql:8
|
||||
security_opt:
|
||||
- seccomp:unconfined
|
||||
restart: always
|
||||
command: --mysql-native-password=ON
|
||||
environment:
|
||||
MYSQL_ROOT_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
volumes:
|
||||
- ghost_mysql:/var/lib/mysql
|
||||
expose:
|
||||
- 3306
|
||||
networks:
|
||||
- net
|
||||
|
||||
ghost-server:
|
||||
image: ghost
|
||||
cap_add:
|
||||
- CAP_SYS_NICE
|
||||
security_opt:
|
||||
- seccomp:unconfined
|
||||
restart: always
|
||||
depends_on:
|
||||
- ghost-db
|
||||
environment:
|
||||
url: https://ghost.${DOMAINNAME}
|
||||
database__client: mysql
|
||||
database__connection__host: ghost-db
|
||||
database__connection__user: root
|
||||
database__connection__password: ${POSTGRES_PASSWORD}
|
||||
database__connection__database: ghost
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
volumes:
|
||||
- ghost_content:/var/lib/ghost/content
|
||||
expose:
|
||||
- 2368
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.ghost.entrypoints=web-secure"
|
||||
- "traefik.http.routers.ghost.rule=Host(`ghost.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.ghost.middlewares=csrf@file"
|
||||
- "traefik.http.routers.ghost.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.ghost.service=ghost_app"
|
||||
- "traefik.http.services.ghost_app.loadbalancer.server.port=2368"
|
||||
|
||||
heynote_app:
|
||||
image: furyhawk/heynote:${HEYNOTETAG:-latest}
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
NODE_ENV: production
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
expose:
|
||||
- 5173
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.heynote.entrypoints=web-secure"
|
||||
- "traefik.http.routers.heynote.rule=HostRegexp(`note[0-9]{0,2}.${DOMAINNAME}`) || Host(`pad.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.heynote.middlewares=csrf@file"
|
||||
- "traefik.http.routers.heynote.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.heynote.service=heynote_app"
|
||||
- "traefik.http.services.heynote_app.loadbalancer.server.port=5173"
|
||||
|
||||
jellyfin:
|
||||
image: jellyfin/jellyfin
|
||||
user: 1000:1000
|
||||
volumes:
|
||||
- jellyfin_config:/config
|
||||
- jellyfin_cache:/cache
|
||||
- type: bind
|
||||
source: ~/media
|
||||
target: /media
|
||||
read_only: false
|
||||
restart: 'unless-stopped'
|
||||
# Optional - alternative address used for autodiscovery
|
||||
environment:
|
||||
- DOMAINNAME=${DOMAINNAME}
|
||||
- JELLYFIN_PublishedServerUrl=https://media.${DOMAINNAME}
|
||||
expose:
|
||||
- 8096
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.jellyfin.entrypoints=web-secure"
|
||||
- "traefik.http.routers.jellyfin.rule=Host(`media.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.jellyfin.middlewares=csrf@file"
|
||||
- "traefik.http.routers.jellyfin.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.jellyfin.service=jellyfin_app"
|
||||
- "traefik.http.services.jellyfin_app.loadbalancer.server.port=8096"
|
||||
|
||||
meshtastic_web:
|
||||
image: ghcr.io/meshtastic/web
|
||||
restart: unless-stopped
|
||||
expose:
|
||||
- 8080
|
||||
- 8443
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.meshtastic.entrypoints=web-secure"
|
||||
- "traefik.http.routers.meshtastic.rule=Host(`mesh.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.meshtastic.middlewares=csrf@file"
|
||||
- "traefik.http.routers.meshtastic.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.meshtastic.service=meshtastic_app"
|
||||
- "traefik.http.services.meshtastic_app.loadbalancer.server.port=8080"
|
||||
|
||||
pgadmin:
|
||||
image: dpage/pgadmin4
|
||||
environment:
|
||||
PGADMIN_DEFAULT_EMAIL: "${PGADMIN_DEFAULT_EMAIL}"
|
||||
PGADMIN_DEFAULT_PASSWORD: "${PGADMIN_DEFAULT_PASSWORD}"
|
||||
volumes:
|
||||
- pgadmin_data:/var/lib/pgadmin
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- postgres_db
|
||||
expose:
|
||||
- 80
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.pgadmin.entrypoints=web-secure"
|
||||
- "traefik.http.routers.pgadmin.rule=Host(`pgadmin.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.pgadmin.middlewares=csrf@file"
|
||||
- "traefik.http.routers.pgadmin.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.pgadmin.service=pgadmin_app"
|
||||
- "traefik.http.services.pgadmin_app.loadbalancer.server.port=80"
|
||||
|
||||
privatebin:
|
||||
image: privatebin/nginx-fpm-alpine:latest
|
||||
read_only: true
|
||||
user: "1000:1000"
|
||||
volumes:
|
||||
- privatebin_data:/srv/data # data volume for pastes allows pastes
|
||||
# to persist after container stop or restart
|
||||
- "~/config/conf.php:/srv/cfg/conf.php:ro" # second volume for custom configuration file
|
||||
expose:
|
||||
- 8080
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.privatebin.entrypoints=web-secure"
|
||||
- "traefik.http.routers.privatebin.rule=Host(`bin.${DOMAINNAME}`) || Host(`paste.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.privatebin.middlewares=csrf@file"
|
||||
- "traefik.http.routers.privatebin.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.privatebin.service=privatebin_app"
|
||||
- "traefik.http.services.privatebin_app.loadbalancer.server.port=8080"
|
||||
|
||||
redlib:
|
||||
# disable container temporarily
|
||||
profiles:
|
||||
- donotstart
|
||||
image: quay.io/redlib/redlib:latest-arm
|
||||
restart: unless-stopped
|
||||
user: nobody
|
||||
read_only: true
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
# - seccomp=seccomp-redlib.json
|
||||
cap_drop:
|
||||
- ALL
|
||||
env_file: .env
|
||||
healthcheck:
|
||||
test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://127.0.0.1:3080/settings"]
|
||||
interval: 5m
|
||||
timeout: 3s
|
||||
expose:
|
||||
- 3080 # Specify `127.0.0.1:8080:3080` instead if using a reverse proxy
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.redlib.entrypoints=web-secure"
|
||||
- "traefik.http.routers.redlib.rule=Host(`redlib.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.redlib.middlewares=csrf@file"
|
||||
- "traefik.http.routers.redlib.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.redlib.service=redlib_app"
|
||||
- "traefik.http.services.redlib_app.loadbalancer.server.port=3080"
|
||||
|
||||
thelounge:
|
||||
image: ghcr.io/thelounge/thelounge:latest
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- thelounge_data:/var/opt/thelounge # bind lounge config from the host's file system
|
||||
expose:
|
||||
- 9000
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.thelounge.entrypoints=web-secure"
|
||||
- "traefik.http.routers.thelounge.rule=Host(`irc.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.thelounge.middlewares=csrf@file"
|
||||
- "traefik.http.routers.thelounge.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.thelounge.service=thelounge_app"
|
||||
- "traefik.http.services.thelounge_app.loadbalancer.server.port=9000"
|
||||
|
||||
streamlit-bai:
|
||||
environment:
|
||||
<<: *app-environment
|
||||
image: furyhawk/beyondallinfo:latest
|
||||
restart: unless-stopped
|
||||
command: streamlit run --server.port=$STREAMLIT_BAI_SERVER_PORT --server.address=0.0.0.0 --server.baseUrlPath=$BAI_LOCATION src/app.py
|
||||
volumes:
|
||||
- bai_cache:/app/cache
|
||||
expose:
|
||||
- ${STREAMLIT_BAI_SERVER_PORT}
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.streamlit-bai.entrypoints=web-secure"
|
||||
- "traefik.http.routers.streamlit-bai.rule=Host(`bai.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.streamlit-bai.middlewares=csrf@file"
|
||||
- "traefik.http.routers.streamlit-bai.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.streamlit-bai.service=streamlit_bai_app"
|
||||
- "traefik.http.services.streamlit_bai_app.loadbalancer.server.port=${STREAMLIT_BAI_SERVER_PORT}"
|
||||
|
||||
streamlit-fin:
|
||||
environment:
|
||||
<<: *app-environment
|
||||
image: furyhawk/llama3toolsfin:main
|
||||
restart: unless-stopped
|
||||
expose:
|
||||
- ${STREAMLIT_FIN_SERVER_PORT}
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.streamlit-fin.entrypoints=web-secure"
|
||||
- "traefik.http.routers.streamlit-fin.rule=Host(`fin.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.streamlit-fin.middlewares=csrf@file"
|
||||
- "traefik.http.routers.streamlit-fin.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.streamlit-fin.service=streamlit_fin_app"
|
||||
- "traefik.http.services.streamlit_fin_app.loadbalancer.server.port=${STREAMLIT_FIN_SERVER_PORT}"
|
||||
|
||||
site_server:
|
||||
image: nginx:alpine
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- ~/site:/usr/share/nginx/html:ro
|
||||
expose:
|
||||
- 80
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.site_server.entrypoints=web-secure"
|
||||
- "traefik.http.routers.site_server.rule=Host(`${DOMAINNAME}`) || Host(`www.${DOMAINNAME}`) || Host(`info.${DOMAINNAME}`) || Host(`124c41.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.site_server.middlewares=csrf@file, no-www@file"
|
||||
- "traefik.http.routers.site_server.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.site_server.service=site_server_app"
|
||||
- "traefik.http.services.site_server_app.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.resume_router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.resume_router.rule=Host(`resume.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.resume_router.middlewares=csrf@file, redirect-resume@file"
|
||||
- "traefik.http.routers.resume_router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.resume_router.service=resume_server"
|
||||
- "traefik.http.services.resume_server.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.blog_router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.blog_router.rule=Host(`blog.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.blog_router.middlewares=redirect-blog@file"
|
||||
- "traefik.http.routers.blog_router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.blog_router.service=blog_server"
|
||||
- "traefik.http.services.blog_server.loadbalancer.server.port=80"
|
||||
+231
@@ -0,0 +1,231 @@
|
||||
x-environment: &app-environment
|
||||
DOMAIN: "${DOMAIN:-furyhawk.lol}"
|
||||
STREAMLIT_FIN_SERVER_PORT: 8501
|
||||
BAI_LOCATION: ""
|
||||
STREAMLIT_BAI_SERVER_PORT: 8502
|
||||
GROQ_API_KEY: "${GROQ_API_KEY}"
|
||||
|
||||
volumes:
|
||||
# bai_cache: {}
|
||||
jellyfin_config: {}
|
||||
# jellyfin_cache: {}
|
||||
# adminer_data: {}
|
||||
# privatebin_data: {}
|
||||
|
||||
networks:
|
||||
traefik-public:
|
||||
external: true
|
||||
|
||||
services:
|
||||
|
||||
adminer:
|
||||
image: adminer
|
||||
environment:
|
||||
PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL}
|
||||
PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD}
|
||||
PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
PYTHONPATH: "/pgadmin4"
|
||||
TZ: Asia/Singapore
|
||||
DOMAIN: ${DOMAIN}
|
||||
volumes:
|
||||
- /var/data/adminer_data:/var/lib/pgadmin
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- postgres_db
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
# placement:
|
||||
# constraints:
|
||||
# - node.labels.adminer.pgadmin == true
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.adminer.entrypoints=https
|
||||
- traefik.http.routers.adminer.rule=Host(`adminer.${DOMAIN}`) || Host(`dbadmin.${DOMAIN}`)
|
||||
- traefik.http.routers.adminer.tls.certresolver=le
|
||||
- traefik.http.routers.adminer.service=adminer_app
|
||||
- traefik.http.services.adminer_app.loadbalancer.server.port=8080
|
||||
|
||||
cheatsheets_app:
|
||||
image: furyhawk/cheatsheets:${CHEATSHEETSTAG:-latest}
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.cheatsheets.entrypoints=https
|
||||
- traefik.http.routers.cheatsheets.rule=Host(`cheat.${DOMAIN}`)
|
||||
- traefik.http.routers.cheatsheets.tls.certresolver=le
|
||||
- traefik.http.routers.cheatsheets.service=cheatsheets_app
|
||||
- traefik.http.services.cheatsheets_app.loadbalancer.server.port=80
|
||||
|
||||
heynote_app:
|
||||
image: furyhawk/heynote:${HEYNOTETAG:-latest}
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
NODE_ENV: production
|
||||
DOMAIN: ${DOMAIN}
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.heynote.entrypoints=https
|
||||
- traefik.http.routers.heynote.rule=HostRegexp(`note[0-9]{0,2}.${DOMAIN}`) || Host(`pad.${DOMAIN}`)
|
||||
- traefik.http.routers.heynote.tls.certresolver=le
|
||||
- traefik.http.routers.heynote.service=heynote_app
|
||||
- traefik.http.services.heynote_app.loadbalancer.server.port=5173
|
||||
|
||||
jellyfin:
|
||||
image: jellyfin/jellyfin
|
||||
restart: 'unless-stopped'
|
||||
environment:
|
||||
- DOMAIN=${DOMAIN}
|
||||
- JELLYFIN_PublishedServerUrl=https://media.${DOMAIN}
|
||||
volumes:
|
||||
- jellyfin_config:/config
|
||||
- /var/data/jellyfin_cache:/cache
|
||||
- type: bind
|
||||
source: ~/media
|
||||
target: /media
|
||||
read_only: false
|
||||
# Optional - alternative address used for autodiscovery
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.jellyfin.jellyfin_config == true
|
||||
# - node.labels.jellyfin.jellyfin_cache == true
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.jellyfin.entrypoints=https
|
||||
- traefik.http.routers.jellyfin.rule=Host(`media.${DOMAIN}`)
|
||||
- traefik.http.routers.jellyfin.tls.certresolver=le
|
||||
- traefik.http.routers.jellyfin.service=jellyfin_app
|
||||
- traefik.http.services.jellyfin_app.loadbalancer.server.port=8096
|
||||
|
||||
meshtastic_web:
|
||||
image: ghcr.io/meshtastic/web
|
||||
restart: unless-stopped
|
||||
expose:
|
||||
- 8080
|
||||
- 8443
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.meshtastic.entrypoints=https
|
||||
- traefik.http.routers.meshtastic.rule=Host(`mesh.${DOMAIN}`)
|
||||
- traefik.http.routers.meshtastic.tls.certresolver=le
|
||||
- traefik.http.routers.meshtastic.service=meshtastic_app
|
||||
- traefik.http.services.meshtastic_app.loadbalancer.server.port=8080
|
||||
|
||||
privatebin:
|
||||
image: privatebin/nginx-fpm-alpine:latest
|
||||
read_only: true
|
||||
volumes:
|
||||
- /var/data/privatebin_data:/srv/data # data volume for pastes allows pastes
|
||||
# to persist after container stop or restart
|
||||
- "/var/data/config/conf.php:/srv/cfg/conf.php:ro" # second volume for custom configuration file
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
# placement:
|
||||
# constraints:
|
||||
# - node.labels.privatebin.privatebin_data == true
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.privatebin.entrypoints=https
|
||||
- traefik.http.routers.privatebin.rule=Host(`bin.${DOMAIN}`) || Host(`paste.${DOMAIN}`)
|
||||
- traefik.http.routers.privatebin.tls.certresolver=le
|
||||
- traefik.http.routers.privatebin.service=privatebin_app
|
||||
- traefik.http.services.privatebin_app.loadbalancer.server.port=8080
|
||||
|
||||
streamlit-bai:
|
||||
environment:
|
||||
<<: *app-environment
|
||||
image: furyhawk/beyondallinfo:latest
|
||||
restart: unless-stopped
|
||||
command: streamlit run --server.port=$STREAMLIT_BAI_SERVER_PORT --server.address=0.0.0.0 --server.baseUrlPath=$BAI_LOCATION src/app.py
|
||||
volumes:
|
||||
- /var/data/bai_cache:/app/cache
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.streamlit-bai.entrypoints=https
|
||||
- traefik.http.routers.streamlit-bai.rule=Host(`bai.${DOMAIN}`)
|
||||
- traefik.http.routers.streamlit-bai.tls.certresolver=le
|
||||
- traefik.http.routers.streamlit-bai.service=streamlit_bai_app
|
||||
- traefik.http.services.streamlit_bai_app.loadbalancer.server.port=${STREAMLIT_BAI_SERVER_PORT}
|
||||
|
||||
streamlit-fin:
|
||||
environment:
|
||||
<<: *app-environment
|
||||
image: furyhawk/llama3toolsfin:main
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.streamlit-fin.entrypoints=https
|
||||
- traefik.http.routers.streamlit-fin.rule=Host(`fin.${DOMAIN}`)
|
||||
- traefik.http.routers.streamlit-fin.tls.certresolver=le
|
||||
- traefik.http.routers.streamlit-fin.service=streamlit_fin_app
|
||||
- traefik.http.services.streamlit_fin_app.loadbalancer.server.port=${STREAMLIT_FIN_SERVER_PORT}
|
||||
|
||||
site_server:
|
||||
image: nginx:alpine
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- /var/data/site:/usr/share/nginx/html:ro
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
# placement:
|
||||
# constraints:
|
||||
# - node.labels.site.site_server == true
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.site_server.entrypoints=https
|
||||
- traefik.http.routers.site_server.rule=Host(`${DOMAIN}`) || Host(`www.${DOMAIN}`) || Host(`info.${DOMAIN}`) || Host(`124c41.${DOMAIN}`)
|
||||
- traefik.http.routers.site_server.middlewares=no-www
|
||||
- traefik.http.routers.site_server.tls.certresolver=le
|
||||
- traefik.http.routers.site_server.service=site_server_app
|
||||
- traefik.http.services.site_server_app.loadbalancer.server.port=80
|
||||
- "traefik.http.routers.resume_router.entrypoints=https"
|
||||
- "traefik.http.routers.resume_router.rule=Host(`resume.${DOMAIN}`)"
|
||||
- "traefik.http.routers.resume_router.middlewares=redirect-resume"
|
||||
- "traefik.http.routers.resume_router.tls.certresolver=le"
|
||||
- "traefik.http.routers.resume_router.service=resume_server"
|
||||
- "traefik.http.services.resume_server.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.blog_router.entrypoints=https"
|
||||
- "traefik.http.routers.blog_router.rule=Host(`blog.${DOMAIN}`)"
|
||||
- "traefik.http.routers.blog_router.middlewares=redirect-blog"
|
||||
- "traefik.http.routers.blog_router.tls.certresolver=le"
|
||||
- "traefik.http.routers.blog_router.service=blog_server"
|
||||
- "traefik.http.services.blog_server.loadbalancer.server.port=80"
|
||||
+136
@@ -0,0 +1,136 @@
|
||||
services:
|
||||
|
||||
traefik:
|
||||
# Use the latest v3.0.x Traefik image available
|
||||
image: traefik:latest
|
||||
ports:
|
||||
- target: 80
|
||||
published: 80
|
||||
mode: host
|
||||
- target: 443
|
||||
published: 443
|
||||
mode: host
|
||||
- target: 1883
|
||||
published: 1883
|
||||
mode: host
|
||||
- target: 5432
|
||||
published: 5432
|
||||
mode: host
|
||||
- target: 8083
|
||||
published: 8083
|
||||
mode: host
|
||||
- target: 8084
|
||||
published: 8084
|
||||
mode: host
|
||||
# - target: 8883
|
||||
# published: 8883
|
||||
# mode: host
|
||||
# - "8083:8083"
|
||||
# - "8084:8084"
|
||||
# - "7687:7687"
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
# Make the traefik service run only on the node with this label
|
||||
# as the node with it has the volume for the certificates
|
||||
- node.labels.traefik-public.traefik-public-certificates == true
|
||||
labels:
|
||||
# Enable Traefik for this service, to make it available in the public network
|
||||
- traefik.enable=true
|
||||
# Use the traefik-public network (declared below)
|
||||
- traefik.docker.network=traefik-public
|
||||
# Use the custom label "traefik.constraint-label=traefik-public"
|
||||
# This public Traefik will only use services with this label
|
||||
# That way you can add other internal Traefik instances per stack if needed
|
||||
- traefik.constraint-label=traefik-public
|
||||
# admin-auth middleware with HTTP Basic auth
|
||||
# Using the environment variables USERNAME and HASHED_PASSWORD
|
||||
- traefik.http.middlewares.admin-auth.basicauth.users=${USERNAME?Variable not set}:${HASHED_PASSWORD?Variable not set}
|
||||
- traefik.http.middlewares.csrf.headers.hostsProxyHeaders=["X-CSRF-Token"]
|
||||
- traefik.http.middlewares.no-www.redirectregex.regex=^https://www.(.*)$$
|
||||
- traefik.http.middlewares.no-www.redirectregex.replacement=https://$$1
|
||||
- traefik.http.middlewares.no-www.redirectregex.permanent=true
|
||||
- traefik.http.middlewares.sslheader.headers.sslProxyHeaders.X-Forwarded-Proto="https,wss"
|
||||
- traefik.http.middlewares.sslheader.headers.sslRedirect=true
|
||||
- traefik.http.middlewares.redirect-resume.redirectregex.regex=^https://resume.${DOMAIN?Variable not set}/(.*)
|
||||
- traefik.http.middlewares.redirect-resume.redirectregex.replacement=https://info.${DOMAIN?Variable not set}/resume/$$1
|
||||
- traefik.http.middlewares.redirect-resume.redirectregex.permanent=true
|
||||
- traefik.http.middlewares.redirect-blog.redirectregex.regex=^https://blog.${DOMAIN?Variable not set}/(.*)
|
||||
- traefik.http.middlewares.redirect-blog.redirectregex.replacement=https://furyhawk.github.io/124c41/$$1
|
||||
- traefik.http.middlewares.redirect-blog.redirectregex.permanent=true
|
||||
- traefik.http.middlewares.rate-limit.ratelimit.average=384
|
||||
- traefik.http.middlewares.rate-limit.ratelimit.burst=128
|
||||
- traefik.http.middlewares.rate-limit.ratelimit.period=10s
|
||||
- treafik.http.middlewares.neo4j_strip.stripprefix.prefixes=/neo4j
|
||||
# traefik-https the actual router using HTTPS
|
||||
- traefik.http.routers.traefik-public-https.rule=Host(`dashboard.${DOMAIN?Variable not set}`)
|
||||
- traefik.http.routers.traefik-public-https.entrypoints=https
|
||||
- traefik.http.routers.traefik-public-https.tls=true
|
||||
# Use the special Traefik service api@internal with the web UI/Dashboard
|
||||
- traefik.http.routers.traefik-public-https.service=api@internal
|
||||
# Use the "le" (Let's Encrypt) resolver created below
|
||||
- traefik.http.routers.traefik-public-https.tls.certresolver=le
|
||||
# Enable HTTP Basic auth, using the middleware created above
|
||||
- traefik.http.routers.traefik-public-https.middlewares=admin-auth
|
||||
# Define the port inside of the Docker service to use
|
||||
- traefik.http.services.traefik-public.loadbalancer.server.port=8080
|
||||
volumes:
|
||||
# Add Docker as a mounted volume, so that Traefik can read the labels of other services
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
# Mount the volume to store the certificates
|
||||
- traefik-public-certificates:/certificates
|
||||
command:
|
||||
# Enable Docker in Traefik, so that it reads labels from Docker services
|
||||
- --providers.docker
|
||||
# Add a constraint to only use services with the label "traefik.constraint-label=traefik-public"
|
||||
- --providers.docker.constraints=Label(`traefik.constraint-label`, `traefik-public`)
|
||||
# Do not expose all Docker services, only the ones explicitly exposed
|
||||
- --providers.docker.exposedbydefault=false
|
||||
- --providers.docker.endpoint=unix:///var/run/docker.sock
|
||||
# Enable Docker Swarm mode
|
||||
- --providers.swarm.exposedbydefault=false
|
||||
- --providers.swarm.endpoint=unix:///var/run/docker.sock
|
||||
# Create an entrypoint "http" listening on port 80
|
||||
- --entrypoints.http.address=:80
|
||||
# Create an entrypoint "https" listening on port 443
|
||||
- --entrypoints.https.address=:443
|
||||
# Redirect HTTP to HTTPS
|
||||
- --entrypoints.http.http.redirections.entrypoint.to=https
|
||||
- --entrypoints.http.http.redirections.entrypoint.scheme=https
|
||||
- --entrypoints.http.http.redirections.entrypoint.permanent=true
|
||||
# Create an entrypoint "postgres-socket" listening on port 5432
|
||||
- --entrypoints.postgres-socket.address=:5432
|
||||
# Others entrypoints can be created, like a TCP entrypoint
|
||||
- --entrypoints.mqtt.address=:1883
|
||||
- --entrypoints.web-socket.address=:8083
|
||||
- --entrypoints.web-socket-secure.address=:8084
|
||||
- --entrypoints.bolt-socket.address=:7687
|
||||
# Create the certificate resolver "le" for Let's Encrypt, uses the environment variable EMAIL
|
||||
- --certificatesresolvers.le.acme.email=${EMAIL?Variable not set}
|
||||
# Store the Let's Encrypt certificates in the mounted volume
|
||||
- --certificatesresolvers.le.acme.storage=/certificates/acme.json
|
||||
# Use the TLS Challenge for Let's Encrypt
|
||||
- --certificatesresolvers.le.acme.tlschallenge=true
|
||||
# Enable the access log, with HTTP requests
|
||||
- --accesslog=true
|
||||
# Enable the Traefik log, for configurations and errors
|
||||
- --log=true
|
||||
- --log.level=INFO
|
||||
# Enable the Dashboard and API
|
||||
- --api=true
|
||||
networks:
|
||||
# Use the public network created to be shared between Traefik and
|
||||
# any other service that needs to be publicly available with HTTPS
|
||||
- traefik-public
|
||||
|
||||
volumes:
|
||||
# Create a volume to store the certificates, there is a constraint to make sure
|
||||
# Traefik is always deployed to the same Docker node with the same volume containing
|
||||
# the HTTPS certificates
|
||||
traefik-public-certificates:
|
||||
|
||||
networks:
|
||||
# Use the previously created public network "traefik-public", shared with other
|
||||
# services that need to be publicly available via this Traefik
|
||||
traefik-public:
|
||||
external: true
|
||||
@@ -0,0 +1,839 @@
|
||||
networks:
|
||||
default:
|
||||
external: true
|
||||
name: ${NETWORK:-web}
|
||||
net:
|
||||
external: true
|
||||
name: ${NETWORK:-web}
|
||||
|
||||
x-environment: &default-environment
|
||||
LOG_LEVEL: "INFO"
|
||||
ACME_PATH: "./acme.json"
|
||||
NETWORK: "${NETWORK:-web}"
|
||||
DOMAINNAME: "${DOMAINNAME:-furyhawk.lol}"
|
||||
TZ: "${TZ:-Asia/Singapore}"
|
||||
FIN_LOCATION: ""
|
||||
STREAMLIT_FIN_SERVER_PORT: "8501"
|
||||
GROQ_API_KEY: "${GROQ_API_KEY}"
|
||||
BAI_LOCATION: ""
|
||||
STREAMLIT_BAI_SERVER_PORT: "8502"
|
||||
|
||||
volumes:
|
||||
bai_cache: {}
|
||||
ghost_content: {}
|
||||
ghost_mysql: {}
|
||||
jellyfin_config: {}
|
||||
jellyfin_cache: {}
|
||||
pgadmin: {}
|
||||
pgadmin_data: {}
|
||||
privatebin_data: {}
|
||||
thelounge_data: {}
|
||||
minio_data: {}
|
||||
neo4j_data: {}
|
||||
neo4j_logs: {}
|
||||
postgres_data: {}
|
||||
logs: {}
|
||||
production_traefik: {}
|
||||
portainer_data: {}
|
||||
data-node:
|
||||
pgdata2:
|
||||
libre-images:
|
||||
libre-logs:
|
||||
meili_data:
|
||||
vol-emqx-data1:
|
||||
name: foo-emqx-data1
|
||||
external: true
|
||||
|
||||
services:
|
||||
|
||||
portainer:
|
||||
image: portainer/portainer-ce:sts
|
||||
command: -H unix:///var/run/docker.sock
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
environment:
|
||||
<<: *default-environment
|
||||
restart: always
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- portainer_data:/data
|
||||
expose:
|
||||
- 8000
|
||||
- 9000
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.portainer.entrypoints=web-secure"
|
||||
- "traefik.http.routers.portainer.rule=Host(`portainer.${DOMAINNAME}`) || Host(`port.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.portainer.middlewares=csrf@file"
|
||||
- "traefik.http.routers.portainer.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.portainer.service=portainer_service"
|
||||
- "traefik.http.services.portainer_service.loadbalancer.server.port=9000"
|
||||
|
||||
traefik:
|
||||
environment:
|
||||
<<: *default-environment
|
||||
build:
|
||||
context: .
|
||||
dockerfile: ./traefik/Dockerfile
|
||||
image: traefik_production
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
restart: always
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- node.role == manager
|
||||
volumes:
|
||||
- logs:/logs
|
||||
- production_traefik:/etc/traefik/acme:z
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway"
|
||||
ports:
|
||||
- target: 80
|
||||
published: 80
|
||||
protocol: tcp
|
||||
mode: host
|
||||
- target: 443
|
||||
published: 443
|
||||
protocol: tcp
|
||||
mode: host
|
||||
- "7687:7687"
|
||||
- "8083:8083"
|
||||
- "8084:8084"
|
||||
- "8883:8883"
|
||||
- "5432:5432"
|
||||
# - "8080:8080"
|
||||
# - "1883:1883"
|
||||
# - 18083:18083
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.traefik.entrypoints=web-secure"
|
||||
- "traefik.http.routers.traefik.rule=Host(`dashboard.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.traefik.middlewares=auth@file"
|
||||
- "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.traefik.service=api@internal"
|
||||
|
||||
api_server:
|
||||
image: furyhawk/listen:latest
|
||||
restart: always
|
||||
depends_on:
|
||||
- postgres_db
|
||||
environment:
|
||||
DATABASE__HOSTNAME: ${DATABASE__HOSTNAME}
|
||||
DATABASE__USERNAME: ${POSTGRES_USER}
|
||||
DATABASE__PASSWORD: ${POSTGRES_PASSWORD}
|
||||
DATABASE__PORT: ${DATABASE__PORT}
|
||||
DATABASE__DB: ${DATABASE__DB}
|
||||
SECURITY__JWT_SECRET_KEY: ${SECURITY__JWT_SECRET_KEY}
|
||||
SECURITY__BACKEND_CORS_ORIGINS: ${SECURITY__BACKEND_CORS_ORIGINS}
|
||||
SECURITY__ALLOWED_HOSTS: ${SECURITY__ALLOWED_HOSTS}
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
ports:
|
||||
- "8000:8000"
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.api_server.entrypoints=web-secure"
|
||||
- "traefik.http.routers.api_server.rule=Host(`api.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.api_server.middlewares=csrf@file, rate-limit@file"
|
||||
- "traefik.http.routers.api_server.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.api_server.service=api_server_service"
|
||||
- "traefik.http.services.api_server_service.loadbalancer.server.port=8000"
|
||||
|
||||
postgres_db:
|
||||
image: postgres
|
||||
environment:
|
||||
POSTGRES_DB: ${POSTGRES_DB}
|
||||
POSTGRES_USER: ${POSTGRES_USER}
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
PGDATA: "/var/lib/postgresql/data"
|
||||
LANG: en_US.utf8
|
||||
TZ: Asia/Singapore
|
||||
# DOMAINNAME: ${DOMAINNAME}
|
||||
command: ["postgres", "-c", "log_connections=on"]
|
||||
volumes:
|
||||
- postgres_data:/var/lib/postgresql/data
|
||||
# - ./config/postgresql.conf:/etc/postgresql.conf
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 10
|
||||
# ports:
|
||||
# - "5432:5432"
|
||||
expose:
|
||||
- 5432
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.tcp.routers.postgres.entrypoints=postgres-socket"
|
||||
- "traefik.tcp.routers.postgres.rule=HostSNI(`*`)"
|
||||
- "traefik.tcp.routers.postgres.service=postgres_service"
|
||||
- "traefik.tcp.services.postgres_service.loadbalancer.server.port=5432"
|
||||
# - "traefik.tcp.middlewares.test-inflightconn.inflightconn.amount=10"
|
||||
# - "traefik.tcp.routers.postgres.rule=HostSNIRegexp(`^.+\\.furyhawk\\.lol$`)"
|
||||
# - "traefik.tcp.routers.postgres.tls=true"
|
||||
# - "traefik.tcp.routers.postgres.tls.certresolver=letsencrypt"
|
||||
# - "traefik.tcp.routers.postgres.middlewares=test-inflightconn"
|
||||
# - "traefik.http.routers.postgres.entrypoints=web-secure"
|
||||
# - "traefik.http.routers.postgres.rule=Host(`db.${DOMAINNAME}`)"
|
||||
# - "traefik.http.routers.postgres.middlewares=rate-limit@file, csrf@file"
|
||||
# - "traefik.http.routers.postgres.tls.certresolver=letsencrypt"
|
||||
# - "traefik.http.routers.postgres.service=postgres_service"
|
||||
# - "traefik.http.services.postgres_service.loadbalancer.server.port=5432"
|
||||
|
||||
osrm-backend:
|
||||
environment:
|
||||
# OSRM manager setup
|
||||
- OSRM_ALGORITHM=mld
|
||||
- OSRM_THREADS=2
|
||||
- OSRM_PORT=${OSRM_PORT:-5000}
|
||||
- OSRM_PROFILE=/opt/car.lua
|
||||
- OSRM_MAP_NAME=${OSRM_MAP_NAME}
|
||||
- OSRM_GEOFABRIK_PATH=${OSRM_GEOFABRIK_PATH}
|
||||
# Notify OSRM Manager to restart without stopping container
|
||||
- OSRM_NOTIFY_FILEPATH=/data/osrm_notify.txt
|
||||
- DOMAINNAME=${DOMAINNAME}
|
||||
image: furyhawk/osrm-backend:${OSRM_VERSION:-latest}
|
||||
restart: unless-stopped
|
||||
expose:
|
||||
- ${OSRM_PORT:-5000}
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.osrm-backend.entrypoints=web-secure"
|
||||
- "traefik.http.routers.osrm-backend.rule=Host(`osrm.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.osrm-backend.middlewares=csrf@file"
|
||||
- "traefik.http.routers.osrm-backend.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.osrm-backend.service=osrm_backend_service"
|
||||
- "traefik.http.services.osrm_backend_service.loadbalancer.server.port=${OSRM_PORT:-5000}"
|
||||
|
||||
minio-common:
|
||||
image: minio/minio:latest
|
||||
environment:
|
||||
MINIO_ROOT_USER: "${MINIO_ROOT_USER:-minioadmin}"
|
||||
MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD:-minioadmin}"
|
||||
MINIO_OPTS: "--console-address :9001"
|
||||
MINIO_SERVER_URL: https://minio.${DOMAINNAME}
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
# user: "1000:1000"
|
||||
restart: unless-stopped
|
||||
command: server /data --address :9000 --console-address :9001
|
||||
healthcheck:
|
||||
test: ["CMD", "mc", "ready", "local"]
|
||||
interval: 60s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
volumes:
|
||||
- minio_data:/data
|
||||
expose:
|
||||
- 9000
|
||||
- 9001
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.minio-router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.minio-router.rule=Host(`drive.${DOMAINNAME}`) || Host(`storage.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.minio-router.middlewares=csrf@file"
|
||||
- "traefik.http.routers.minio-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.minio-router.service=minio_common_service"
|
||||
- "traefik.http.services.minio_common_service.loadbalancer.server.port=9001"
|
||||
- "traefik.http.routers.minio-api-router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.minio-api-router.rule=Host(`minio.${DOMAINNAME}`) || Host(`s3.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.minio-api-router.middlewares=csrf@file"
|
||||
- "traefik.http.routers.minio-api-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.minio-api-router.service=minio_api_service"
|
||||
- "traefik.http.services.minio_api_service.loadbalancer.server.port=9000"
|
||||
|
||||
neo4j_server:
|
||||
# Docker image to be used
|
||||
image: ${NEO4J_DOCKER_IMAGE:-neo4j:latest}
|
||||
restart: unless-stopped
|
||||
# Environment variables
|
||||
environment:
|
||||
NEO4J_AUTH: neo4j/${NEO4J_PASSWORD:-12345678}
|
||||
NEO4J_dbms.default_listen_address: "0.0.0.0"
|
||||
NEO4J_dbms.default_advertised_address: "neo4j.${DOMAINNAME}"
|
||||
NEO4J_dbms.connector.bolt.advertised_address: ":443"
|
||||
NEO4J_PLUGINS: '["apoc"]'
|
||||
NEO4J_dbms_security_procedures_unrestricted: "apoc.*"
|
||||
NEO4J_dbms_security_procedures_allowlist: "apoc.*"
|
||||
NEO4J_server_memory_pagecache_size: 512M
|
||||
NEO4J_server_memory_heap_max__size: 2G
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
user: "1000:1000"
|
||||
depends_on:
|
||||
- traefik
|
||||
volumes:
|
||||
- neo4j_data:/data
|
||||
- neo4j_logs:/logs
|
||||
# Expose ports
|
||||
expose:
|
||||
- 7474
|
||||
- 7687
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.neo4j-router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.neo4j-router.rule=Host(`neo4j.${DOMAINNAME}`) && PathPrefix(`/neo4j`)||PathPrefix(`/browser`)"
|
||||
- "traefik.http.routers.neo4j-router.middlewares=csrf@file, neo4j_strip@file"
|
||||
- "traefik.http.routers.neo4j-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.neo4j-router.service=neo4j_browser"
|
||||
- "traefik.http.services.neo4j_browser.loadbalancer.server.port=7474"
|
||||
- "traefik.http.routers.neo4j-bolt-router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.neo4j-bolt-router.rule=Host(`neo4j.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.neo4j-bolt-router.middlewares=csrf@file"
|
||||
- "traefik.http.routers.neo4j-bolt-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.neo4j-bolt-router.service=neo4j_bolt"
|
||||
- "traefik.http.services.neo4j_bolt.loadbalancer.server.port=7687"
|
||||
- "traefik.tcp.routers.neo4j-bolt-router.entrypoints=bolt-socket"
|
||||
- "traefik.tcp.routers.neo4j-bolt-router.rule=HostSNIRegexp(`^.+\\.furyhawk\\.lol$$`)"
|
||||
- "traefik.tcp.routers.neo4j-bolt-router.tls=true"
|
||||
- "traefik.tcp.routers.neo4j-bolt-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.tcp.routers.neo4j-bolt-router.service=neo4j_bolt"
|
||||
- "traefik.tcp.services.neo4j_bolt.loadbalancer.server.port=7687"
|
||||
|
||||
syncthing:
|
||||
image: syncthing/syncthing
|
||||
environment:
|
||||
- PUID=1000
|
||||
- PGID=1000
|
||||
- DOMAINNAME=${DOMAINNAME}
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- ~/st-sync:/var/syncthing
|
||||
ports:
|
||||
- "8384:8384" # Web UI
|
||||
- "22000:22000/tcp" # TCP file transfers
|
||||
- "22000:22000/udp" # QUIC file transfers
|
||||
- "21027:21027/udp" # Receive local discovery broadcasts
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.syncthing.entrypoints=web-secure"
|
||||
- "traefik.http.routers.syncthing.rule=Host(`sync.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.syncthing.middlewares=csrf@file"
|
||||
- "traefik.http.routers.syncthing.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.syncthing.service=syncthing_service"
|
||||
- "traefik.http.services.syncthing_service.loadbalancer.server.port=8384"
|
||||
|
||||
dozzle:
|
||||
image: amir20/dozzle:latest
|
||||
restart: always
|
||||
environment:
|
||||
- DOMAINNAME=${DOMAINNAME}
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
expose:
|
||||
- 8080
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dozzle.entrypoints=web-secure"
|
||||
- "traefik.http.routers.dozzle.rule=Host(`log.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.dozzle.middlewares=auth@file, csrf@file"
|
||||
- "traefik.http.routers.dozzle.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.dozzle.service=dozzle_service"
|
||||
- "traefik.http.services.dozzle_service.loadbalancer.server.port=8080"
|
||||
|
||||
# WhoAmI - For Testing and Troubleshooting
|
||||
whoami:
|
||||
image: traefik/whoami
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.whoami-rtr.entrypoints=web-secure"
|
||||
- "traefik.http.routers.whoami-rtr.rule=Host(`whoami.$DOMAINNAME`)"
|
||||
- "traefik.http.routers.whoami-rtr.middlewares=csrf@file"
|
||||
- "traefik.http.routers.whoami-rtr.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.whoami-rtr.service=whoami-svc"
|
||||
- "traefik.http.services.whoami-svc.loadbalancer.server.port=80"
|
||||
|
||||
# kestra:
|
||||
# image: kestra/kestra:latest-full
|
||||
# container_name: kestra
|
||||
# # pull_policy: always
|
||||
# # Note that this is meant for development only. Refer to the documentation for production deployments of Kestra which runs without a root user.
|
||||
# user: "root"
|
||||
# command: server standalone --worker-thread=128
|
||||
# environment:
|
||||
# KESTRA_CONFIGURATION: |
|
||||
# datasources:
|
||||
# postgres:
|
||||
# url: jdbc:postgresql://postgres:5432/kestra
|
||||
# driverClassName: org.postgresql.Driver
|
||||
# username: ${POSTGRES_USER}
|
||||
# password: ${POSTGRES_PASSWORD}
|
||||
# kestra:
|
||||
# server:
|
||||
# basic-auth:
|
||||
# enabled: true
|
||||
# username: ${EMAIL_FROM} # it must be a valid email address
|
||||
# password: ${EMAIL_PASSWORD}
|
||||
# repository:
|
||||
# type: postgres
|
||||
# storage:
|
||||
# type: local
|
||||
# local:
|
||||
# base-path: "/app/storage"
|
||||
# queue:
|
||||
# type: postgres
|
||||
# tasks:
|
||||
# tmp-dir:
|
||||
# path: /tmp/kestra-wd/tmp
|
||||
# url: http://kestra.${DOMAINNAME}/
|
||||
# volumes:
|
||||
# - kestra_data:/app/storage
|
||||
# - /var/run/docker.sock:/var/run/docker.sock
|
||||
# # - /tmp/kestra-wd:/tmp/kestra-wd
|
||||
# depends_on:
|
||||
# - postgres
|
||||
# expose:
|
||||
# - "8080"
|
||||
# - "8081"
|
||||
# networks:
|
||||
# - net
|
||||
|
||||
adminer:
|
||||
image: adminer
|
||||
environment:
|
||||
PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL}
|
||||
PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD}
|
||||
PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
PYTHONPATH: "/pgadmin4"
|
||||
TZ: Asia/Singapore
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
volumes:
|
||||
- pgadmin:/var/lib/pgadmin
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- postgres_db
|
||||
expose:
|
||||
- 8080
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.adminer.entrypoints=web-secure"
|
||||
- "traefik.http.routers.adminer.rule=Host(`adminer.${DOMAINNAME}`) || Host(`dbadmin.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.adminer.middlewares=csrf@file"
|
||||
- "traefik.http.routers.adminer.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.adminer.service=adminer_app"
|
||||
- "traefik.http.services.adminer_app.loadbalancer.server.port=8080"
|
||||
|
||||
cheatsheets_app:
|
||||
image: furyhawk/cheatsheets:${CHEATSHEETSTAG:-latest}
|
||||
restart: unless-stopped
|
||||
expose:
|
||||
- 80
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.cheatsheets.entrypoints=web-secure"
|
||||
- "traefik.http.routers.cheatsheets.rule=Host(`cheat.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.cheatsheets.middlewares=csrf@file"
|
||||
- "traefik.http.routers.cheatsheets.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.cheatsheets.service=cheatsheets_app"
|
||||
- "traefik.http.services.cheatsheets_app.loadbalancer.server.port=80"
|
||||
|
||||
ghost-db:
|
||||
image: mysql:8
|
||||
security_opt:
|
||||
- seccomp:unconfined
|
||||
restart: always
|
||||
command: --mysql-native-password=ON
|
||||
environment:
|
||||
MYSQL_ROOT_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
volumes:
|
||||
- ghost_mysql:/var/lib/mysql
|
||||
expose:
|
||||
- 3306
|
||||
networks:
|
||||
- net
|
||||
|
||||
ghost-server:
|
||||
image: ghost
|
||||
cap_add:
|
||||
- CAP_SYS_NICE
|
||||
security_opt:
|
||||
- seccomp:unconfined
|
||||
restart: always
|
||||
depends_on:
|
||||
- ghost-db
|
||||
environment:
|
||||
url: https://ghost.${DOMAINNAME}
|
||||
database__client: mysql
|
||||
database__connection__host: ghost-db
|
||||
database__connection__user: root
|
||||
database__connection__password: ${POSTGRES_PASSWORD}
|
||||
database__connection__database: ghost
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
volumes:
|
||||
- ghost_content:/var/lib/ghost/content
|
||||
expose:
|
||||
- 2368
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.ghost.entrypoints=web-secure"
|
||||
- "traefik.http.routers.ghost.rule=Host(`ghost.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.ghost.middlewares=csrf@file"
|
||||
- "traefik.http.routers.ghost.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.ghost.service=ghost_app"
|
||||
- "traefik.http.services.ghost_app.loadbalancer.server.port=2368"
|
||||
|
||||
heynote_app:
|
||||
image: furyhawk/heynote:${HEYNOTETAG:-latest}
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
NODE_ENV: production
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
expose:
|
||||
- 5173
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.heynote.entrypoints=web-secure"
|
||||
- "traefik.http.routers.heynote.rule=HostRegexp(`note[0-9]{0,2}.${DOMAINNAME}`) || Host(`pad.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.heynote.middlewares=csrf@file"
|
||||
- "traefik.http.routers.heynote.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.heynote.service=heynote_app"
|
||||
- "traefik.http.services.heynote_app.loadbalancer.server.port=5173"
|
||||
|
||||
jellyfin:
|
||||
image: jellyfin/jellyfin
|
||||
user: 1000:1000
|
||||
volumes:
|
||||
- jellyfin_config:/config
|
||||
- jellyfin_cache:/cache
|
||||
- type: bind
|
||||
source: ~/media
|
||||
target: /media
|
||||
read_only: false
|
||||
restart: 'unless-stopped'
|
||||
# Optional - alternative address used for autodiscovery
|
||||
environment:
|
||||
- DOMAINNAME=${DOMAINNAME}
|
||||
- JELLYFIN_PublishedServerUrl=https://media.${DOMAINNAME}
|
||||
expose:
|
||||
- 8096
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.jellyfin.entrypoints=web-secure"
|
||||
- "traefik.http.routers.jellyfin.rule=Host(`media.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.jellyfin.middlewares=csrf@file"
|
||||
- "traefik.http.routers.jellyfin.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.jellyfin.service=jellyfin_app"
|
||||
- "traefik.http.services.jellyfin_app.loadbalancer.server.port=8096"
|
||||
|
||||
meshtastic_web:
|
||||
image: ghcr.io/meshtastic/web
|
||||
restart: unless-stopped
|
||||
expose:
|
||||
- 8080
|
||||
- 8443
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.meshtastic.entrypoints=web-secure"
|
||||
- "traefik.http.routers.meshtastic.rule=Host(`mesh.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.meshtastic.middlewares=csrf@file"
|
||||
- "traefik.http.routers.meshtastic.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.meshtastic.service=meshtastic_app"
|
||||
- "traefik.http.services.meshtastic_app.loadbalancer.server.port=8080"
|
||||
|
||||
pgadmin:
|
||||
image: dpage/pgadmin4
|
||||
environment:
|
||||
PGADMIN_DEFAULT_EMAIL: "${PGADMIN_DEFAULT_EMAIL}"
|
||||
PGADMIN_DEFAULT_PASSWORD: "${PGADMIN_DEFAULT_PASSWORD}"
|
||||
volumes:
|
||||
- pgadmin_data:/var/lib/pgadmin
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- postgres_db
|
||||
expose:
|
||||
- 80
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.pgadmin.entrypoints=web-secure"
|
||||
- "traefik.http.routers.pgadmin.rule=Host(`pgadmin.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.pgadmin.middlewares=csrf@file"
|
||||
- "traefik.http.routers.pgadmin.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.pgadmin.service=pgadmin_app"
|
||||
- "traefik.http.services.pgadmin_app.loadbalancer.server.port=80"
|
||||
|
||||
privatebin:
|
||||
image: privatebin/nginx-fpm-alpine:latest
|
||||
read_only: true
|
||||
user: "1000:1000"
|
||||
volumes:
|
||||
- privatebin_data:/srv/data # data volume for pastes allows pastes
|
||||
# to persist after container stop or restart
|
||||
- "~/config/conf.php:/srv/cfg/conf.php:ro" # second volume for custom configuration file
|
||||
expose:
|
||||
- 8080
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.privatebin.entrypoints=web-secure"
|
||||
- "traefik.http.routers.privatebin.rule=Host(`bin.${DOMAINNAME}`) || Host(`paste.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.privatebin.middlewares=csrf@file"
|
||||
- "traefik.http.routers.privatebin.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.privatebin.service=privatebin_app"
|
||||
- "traefik.http.services.privatebin_app.loadbalancer.server.port=8080"
|
||||
|
||||
thelounge:
|
||||
image: ghcr.io/thelounge/thelounge:latest
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- thelounge_data:/var/opt/thelounge # bind lounge config from the host's file system
|
||||
expose:
|
||||
- 9000
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.thelounge.entrypoints=web-secure"
|
||||
- "traefik.http.routers.thelounge.rule=Host(`irc.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.thelounge.middlewares=csrf@file"
|
||||
- "traefik.http.routers.thelounge.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.thelounge.service=thelounge_app"
|
||||
- "traefik.http.services.thelounge_app.loadbalancer.server.port=9000"
|
||||
|
||||
streamlit-bai:
|
||||
environment:
|
||||
<<: *default-environment
|
||||
image: furyhawk/beyondallinfo:latest
|
||||
restart: unless-stopped
|
||||
command: streamlit run --server.port=$STREAMLIT_BAI_SERVER_PORT --server.address=0.0.0.0 --server.baseUrlPath=$BAI_LOCATION src/app.py
|
||||
volumes:
|
||||
- bai_cache:/app/cache
|
||||
expose:
|
||||
- ${STREAMLIT_BAI_SERVER_PORT}
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.streamlit-bai.entrypoints=web-secure"
|
||||
- "traefik.http.routers.streamlit-bai.rule=Host(`bai.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.streamlit-bai.middlewares=csrf@file"
|
||||
- "traefik.http.routers.streamlit-bai.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.streamlit-bai.service=streamlit_bai_app"
|
||||
- "traefik.http.services.streamlit_bai_app.loadbalancer.server.port=${STREAMLIT_BAI_SERVER_PORT}"
|
||||
|
||||
streamlit-fin:
|
||||
environment:
|
||||
<<: *default-environment
|
||||
image: furyhawk/llama3toolsfin:main
|
||||
restart: unless-stopped
|
||||
expose:
|
||||
- ${STREAMLIT_FIN_SERVER_PORT}
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.streamlit-fin.entrypoints=web-secure"
|
||||
- "traefik.http.routers.streamlit-fin.rule=Host(`fin.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.streamlit-fin.middlewares=csrf@file"
|
||||
- "traefik.http.routers.streamlit-fin.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.streamlit-fin.service=streamlit_fin_app"
|
||||
- "traefik.http.services.streamlit_fin_app.loadbalancer.server.port=${STREAMLIT_FIN_SERVER_PORT}"
|
||||
|
||||
site_server:
|
||||
image: nginx:alpine
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- ~/site:/usr/share/nginx/html:ro
|
||||
expose:
|
||||
- 80
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.site_server.entrypoints=web-secure"
|
||||
- "traefik.http.routers.site_server.rule=Host(`${DOMAINNAME}`) || Host(`www.${DOMAINNAME}`) || Host(`info.${DOMAINNAME}`) || Host(`124c41.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.site_server.middlewares=csrf@file, no-www@file"
|
||||
- "traefik.http.routers.site_server.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.site_server.service=site_server_app"
|
||||
- "traefik.http.services.site_server_app.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.resume_router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.resume_router.rule=Host(`resume.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.resume_router.middlewares=csrf@file, redirect-resume@file"
|
||||
- "traefik.http.routers.resume_router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.resume_router.service=resume_server"
|
||||
- "traefik.http.services.resume_server.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.blog_router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.blog_router.rule=Host(`blog.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.blog_router.middlewares=redirect-blog@file"
|
||||
- "traefik.http.routers.blog_router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.blog_router.service=blog_server"
|
||||
- "traefik.http.services.blog_server.loadbalancer.server.port=80"
|
||||
|
||||
emqx1:
|
||||
image: emqx:latest
|
||||
# environment:
|
||||
# - "EMQX_NODE_NAME=emqx@node1.emqx.io"
|
||||
# - "EMQX_CLUSTER__DISCOVERY_STRATEGY=static"
|
||||
# - "EMQX_CLUSTER__STATIC__SEEDS=[emqx@node1.emqx.io,emqx@node2.emqx.io]"
|
||||
healthcheck:
|
||||
test: ["CMD", "/opt/emqx/bin/emqx", "ctl", "status"]
|
||||
interval: 60s
|
||||
timeout: 25s
|
||||
retries: 5
|
||||
networks:
|
||||
net:
|
||||
# emqx-bridge:
|
||||
# aliases:
|
||||
# - node1.emqx.io
|
||||
ports:
|
||||
- "1883:1883"
|
||||
# - 8083:8083
|
||||
# - 8084:8084
|
||||
# - 8883:8883
|
||||
# - 18083:18083
|
||||
volumes:
|
||||
- vol-emqx-data1:/opt/emqx/data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.emqx1.entrypoints=web-secure"
|
||||
- "traefik.http.routers.emqx1.rule=Host(`mqtt.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.emqx1.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.emqx1.service=emqx-dashboard"
|
||||
- "traefik.http.services.emqx-dashboard.loadbalancer.server.port=18083"
|
||||
|
||||
# emqx2:
|
||||
# image: emqx:latest
|
||||
# container_name: emqx2
|
||||
# environment:
|
||||
# - "EMQX_NODE_NAME=emqx@node2.emqx.io"
|
||||
# - "EMQX_CLUSTER__DISCOVERY_STRATEGY=static"
|
||||
# - "EMQX_CLUSTER__STATIC__SEEDS=[emqx@node1.emqx.io,emqx@node2.emqx.io]"
|
||||
# healthcheck:
|
||||
# test: ["CMD", "/opt/emqx/bin/emqx", "ctl", "status"]
|
||||
# interval: 60s
|
||||
# timeout: 25s
|
||||
# retries: 5
|
||||
# networks:
|
||||
# net:
|
||||
# emqx-bridge:
|
||||
# aliases:
|
||||
# - node2.emqx.io
|
||||
# volumes:
|
||||
# - vol-emqx-data2:/opt/emqx/data
|
||||
|
||||
mqttx-web:
|
||||
image: emqx/mqttx-web:latest
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.mqttx-web.entrypoints=web-secure"
|
||||
- "traefik.http.routers.mqttx-web.rule=Host(`mqttx.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.mqttx-web.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.mqttx-web.service=mqttx-web-service"
|
||||
- "traefik.http.services.mqttx-web-service.loadbalancer.server.port=80"
|
||||
|
||||
librechat_api:
|
||||
ports:
|
||||
- "${PORT:-3080}:${PORT:-3080}"
|
||||
depends_on:
|
||||
- mongodb
|
||||
- rag_api
|
||||
image: ghcr.io/danny-avila/librechat-dev:latest
|
||||
restart: always
|
||||
user: "${UID}:${GID}"
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway"
|
||||
environment:
|
||||
- HOST=0.0.0.0
|
||||
- MONGO_URI=mongodb://mongodb:27017/LibreChat
|
||||
- MEILI_HOST=http://meilisearch:7700
|
||||
- RAG_PORT=${RAG_PORT:-8000}
|
||||
- RAG_API_URL=http://rag_api:${RAG_PORT:-8000}
|
||||
- DOMAINNAME=${DOMAINNAME}
|
||||
volumes:
|
||||
- type: bind
|
||||
source: ~/config/.env
|
||||
target: /app/.env
|
||||
- libre-images:/app/client/public/images
|
||||
- libre-logs:/app/api/logs
|
||||
- type: bind
|
||||
source: ./config/librechat.yaml
|
||||
target: /app/librechat.yaml
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.librechat.entrypoints=web-secure"
|
||||
- "traefik.http.routers.librechat.rule=Host(`chat.${DOMAINNAME}`) || Host(`bot.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.librechat.middlewares=csrf@file"
|
||||
- "traefik.http.routers.librechat.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.librechat.service=librechat_app"
|
||||
- "traefik.http.services.librechat_app.loadbalancer.server.port=${PORT:-3080}"
|
||||
mongodb:
|
||||
image: mongo
|
||||
restart: always
|
||||
user: "${UID}:${GID}"
|
||||
volumes:
|
||||
- data-node:/data/db
|
||||
command: mongod --noauth
|
||||
meilisearch:
|
||||
image: getmeili/meilisearch:v1.7.3
|
||||
restart: always
|
||||
user: "${UID}:${GID}"
|
||||
environment:
|
||||
- MEILI_HOST=http://meilisearch:7700
|
||||
- MEILI_NO_ANALYTICS=true
|
||||
volumes:
|
||||
- meili_data:/meili_data
|
||||
vectordb:
|
||||
image: ankane/pgvector:latest
|
||||
environment:
|
||||
POSTGRES_DB: mydatabase
|
||||
POSTGRES_USER: myuser
|
||||
POSTGRES_PASSWORD: mypassword
|
||||
restart: always
|
||||
volumes:
|
||||
- pgdata2:/var/lib/postgresql/data
|
||||
rag_api:
|
||||
image: ghcr.io/danny-avila/librechat-rag-api-dev:latest
|
||||
environment:
|
||||
POSTGRES_DB: mydatabase
|
||||
POSTGRES_USER: myuser
|
||||
POSTGRES_PASSWORD: mypassword
|
||||
DB_HOST: vectordb
|
||||
RAG_PORT: ${RAG_PORT:-8000}
|
||||
restart: always
|
||||
depends_on:
|
||||
- vectordb
|
||||
env_file:
|
||||
- .env
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,81 @@
|
||||
services:
|
||||
emqx1:
|
||||
image: emqx:latest
|
||||
healthcheck:
|
||||
test: ["CMD", "/opt/emqx/bin/emqx", "ctl", "status"]
|
||||
interval: 60s
|
||||
timeout: 25s
|
||||
retries: 5
|
||||
volumes:
|
||||
- emqx-data1:/opt/emqx/data
|
||||
networks:
|
||||
- traefik-public
|
||||
# ports:
|
||||
# - target: 1883
|
||||
# published: 1883
|
||||
# mode: host
|
||||
# - "1883:1883"
|
||||
# - 8083:8083
|
||||
# - 8084:8084
|
||||
# - 8883:8883
|
||||
# - 18083:18083
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.emqx1.emqx-data1 == true
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.tcp.routers.emqx1-tcp-mqtt.entrypoints=mqtt
|
||||
- traefik.tcp.routers.emqx1-tcp-mqtt.rule=HostSNI(`*`)
|
||||
- traefik.tcp.routers.emqx1-tcp-mqtt.service=emqx1-tcp-mqtt
|
||||
- traefik.tcp.services.emqx1-tcp-mqtt.loadbalancer.server.port=1883
|
||||
- traefik.tcp.routers.emqx1-tcp-ws.entrypoints=web-socket
|
||||
- traefik.tcp.routers.emqx1-tcp-ws.rule=HostSNI(`*`)
|
||||
- traefik.tcp.routers.emqx1-tcp-ws.service=emqx1-tcp-ws
|
||||
- traefik.tcp.services.emqx1-tcp-ws.loadbalancer.server.port=8083
|
||||
- traefik.tcp.routers.emqx1-tcp-wss.entrypoints=web-socket-secure
|
||||
- traefik.tcp.routers.emqx1-tcp-wss.rule=HostSNIRegexp(`^.+\\.${DOMAIN}$$`)
|
||||
- traefik.tcp.routers.emqx1-tcp-wss.tls.certresolver=le
|
||||
- traefik.tcp.routers.emqx1-tcp-wss.service=emqx1-tcp-wss
|
||||
- traefik.tcp.services.emqx1-tcp-wss.loadbalancer.server.port=8084
|
||||
- traefik.http.routers.emqx1.entrypoints=https
|
||||
- traefik.http.routers.emqx1.rule=Host(`mqtt.${DOMAIN}`)
|
||||
- traefik.http.routers.emqx1.tls.certresolver=le
|
||||
- traefik.http.routers.emqx1.service=emqx-dashboard
|
||||
- traefik.http.services.emqx-dashboard.loadbalancer.server.port=18083
|
||||
- traefik.http.routers.emqx1-web.entrypoints=web-socket
|
||||
- traefik.http.routers.emqx1-web.rule=Host(`broker.${DOMAIN}`) || Host(`mqtt.${DOMAIN}`) || Host(`mqttx.${DOMAIN}`)
|
||||
- traefik.http.routers.emqx1-web.tls.certresolver=le
|
||||
- traefik.http.routers.emqx1-web.service=emqx1-web
|
||||
- traefik.http.services.emqx1-web.loadbalancer.server.port=8083
|
||||
- traefik.http.routers.emqx1-wss.entrypoints=web-socket-secure
|
||||
- traefik.http.routers.emqx1-wss.rule=Host(`broker.${DOMAIN}`) || Host(`mqtt.${DOMAIN}`) || Host(`mqttx.${DOMAIN}`)
|
||||
- traefik.http.routers.emqx1-wss.tls.certresolver=le
|
||||
- traefik.http.routers.emqx1-wss.service=emqx1-wss
|
||||
- traefik.http.services.emqx1-wss.loadbalancer.server.port=8084
|
||||
|
||||
mqttx-web:
|
||||
image: emqx/mqttx-web:latest
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.mqttx-web.entrypoints=https
|
||||
- traefik.http.routers.mqttx-web.rule=Host(`mqttx.${DOMAIN}`)
|
||||
- traefik.http.routers.mqttx-web.tls.certresolver=le
|
||||
- traefik.http.routers.mqttx-web.service=mqttx-web-service
|
||||
- traefik.http.services.mqttx-web-service.loadbalancer.server.port=80
|
||||
|
||||
networks:
|
||||
traefik-public:
|
||||
external: true
|
||||
|
||||
volumes:
|
||||
emqx-data1:
|
||||
driver: local
|
||||
@@ -0,0 +1,57 @@
|
||||
networks:
|
||||
ghost:
|
||||
driver: overlay
|
||||
attachable: true
|
||||
traefik-public:
|
||||
external: true
|
||||
|
||||
services:
|
||||
ghost-db:
|
||||
image: mysql:8
|
||||
security_opt:
|
||||
- seccomp:unconfined
|
||||
restart: always
|
||||
command: --mysql-native-password=ON
|
||||
environment:
|
||||
MYSQL_ROOT_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
volumes:
|
||||
- /var/data/ghost_mysql:/var/lib/mysql
|
||||
expose:
|
||||
- 3306
|
||||
networks:
|
||||
- ghost
|
||||
|
||||
ghost-server:
|
||||
image: ghost
|
||||
cap_add:
|
||||
- CAP_SYS_NICE
|
||||
security_opt:
|
||||
- seccomp:unconfined
|
||||
restart: always
|
||||
depends_on:
|
||||
- ghost-db
|
||||
environment:
|
||||
url: https://ghost.${DOMAIN}
|
||||
database__client: mysql
|
||||
database__connection__host: ghost-db
|
||||
database__connection__user: root
|
||||
database__connection__password: ${POSTGRES_PASSWORD}
|
||||
database__connection__database: ghost
|
||||
DOMAIN: ${DOMAIN}
|
||||
volumes:
|
||||
- /var/data/ghost_content:/var/lib/ghost/content
|
||||
expose:
|
||||
- 2368
|
||||
networks:
|
||||
- ghost
|
||||
- traefik-public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.ghost.entrypoints=https
|
||||
- traefik.http.routers.ghost.rule=Host(`ghost.${DOMAIN}`)
|
||||
- traefik.http.routers.ghost.tls.certresolver=le
|
||||
- traefik.http.routers.ghost.service=ghost_app
|
||||
- traefik.http.services.ghost_app.loadbalancer.server.port=2368
|
||||
@@ -0,0 +1,119 @@
|
||||
# Do not edit this file directly. Use a ‘docker-compose.override.yaml’ file if you can.
|
||||
# Refer to `docker-compose.override.yaml.example’ for some sample configurations.
|
||||
|
||||
volumes:
|
||||
mongodb-data-node:
|
||||
pgdata2:
|
||||
libre-images:
|
||||
libre-logs:
|
||||
meili_data:
|
||||
|
||||
networks:
|
||||
net:
|
||||
driver: overlay
|
||||
attachable: true
|
||||
traefik-public:
|
||||
external: true
|
||||
|
||||
services:
|
||||
librechat_api:
|
||||
depends_on:
|
||||
- mongodb
|
||||
- rag_api
|
||||
image: ghcr.io/danny-avila/librechat-dev:latest
|
||||
restart: always
|
||||
user: "${UID}:${GID}"
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway"
|
||||
environment:
|
||||
- HOST=0.0.0.0
|
||||
- MONGO_URI=mongodb://mongodb:27017/LibreChat
|
||||
- MEILI_HOST=http://meilisearch:7700
|
||||
- RAG_PORT=${RAG_PORT:-8000}
|
||||
- RAG_API_URL=http://rag_api:${RAG_PORT:-8000}
|
||||
- DOMAIN=${DOMAIN}
|
||||
volumes:
|
||||
- type: bind
|
||||
source: ~/config/.env
|
||||
target: /app/.env
|
||||
- libre-images:/app/client/public/images
|
||||
- libre-logs:/app/api/logs
|
||||
- type: bind
|
||||
source: ~/config/librechat.yaml
|
||||
target: /app/librechat.yaml
|
||||
networks:
|
||||
- net
|
||||
- traefik-public
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.librechat.libre-images == true
|
||||
- node.labels.librechat.libre-logs == true
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.librechat.entrypoints=https
|
||||
- traefik.http.routers.librechat.rule=Host(`chat.${DOMAIN}`) || Host(`bot.${DOMAIN}`)
|
||||
- traefik.http.routers.librechat.tls.certresolver=le
|
||||
- traefik.http.routers.librechat.service=librechat_app
|
||||
- traefik.http.services.librechat_app.loadbalancer.server.port=${PORT}
|
||||
mongodb:
|
||||
image: mongo
|
||||
restart: always
|
||||
user: "${UID}:${GID}"
|
||||
command: mongod --noauth
|
||||
volumes:
|
||||
- mongodb-data-node:/data/db
|
||||
networks:
|
||||
- net
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.librechat.mongodb-data-node == true
|
||||
meilisearch:
|
||||
image: getmeili/meilisearch:v1.7.3
|
||||
restart: always
|
||||
user: "${UID}:${GID}"
|
||||
environment:
|
||||
- MEILI_HOST=http://meilisearch:7700
|
||||
- MEILI_NO_ANALYTICS=true
|
||||
volumes:
|
||||
- meili_data:/meili_data
|
||||
networks:
|
||||
- net
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.librechat.meili_data == true
|
||||
vectordb:
|
||||
image: ankane/pgvector:latest
|
||||
environment:
|
||||
POSTGRES_DB: mydatabase
|
||||
POSTGRES_USER: myuser
|
||||
POSTGRES_PASSWORD: mypassword
|
||||
restart: always
|
||||
volumes:
|
||||
- pgdata2:/var/lib/postgresql/data
|
||||
networks:
|
||||
- net
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.librechat.pgdata2 == true
|
||||
rag_api:
|
||||
image: ghcr.io/danny-avila/librechat-rag-api-dev:latest
|
||||
environment:
|
||||
POSTGRES_DB: mydatabase
|
||||
POSTGRES_USER: myuser
|
||||
POSTGRES_PASSWORD: mypassword
|
||||
DB_HOST: vectordb
|
||||
RAG_PORT: ${RAG_PORT:-8000}
|
||||
restart: always
|
||||
depends_on:
|
||||
- vectordb
|
||||
env_file:
|
||||
- .env
|
||||
networks:
|
||||
- net
|
||||
|
||||
@@ -0,0 +1,48 @@
|
||||
services:
|
||||
agent:
|
||||
image: portainer/agent
|
||||
environment:
|
||||
AGENT_CLUSTER_ADDR: tasks.agent
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- /var/lib/docker/volumes:/var/lib/docker/volumes
|
||||
networks:
|
||||
- agent-network
|
||||
deploy:
|
||||
mode: global
|
||||
placement:
|
||||
constraints:
|
||||
- node.platform.os == linux
|
||||
|
||||
portainer:
|
||||
image: portainer/portainer-ce
|
||||
command: -H tcp://tasks.agent:9001 --tlsskipverify
|
||||
volumes:
|
||||
- portainer-data:/data
|
||||
networks:
|
||||
- agent-network
|
||||
- traefik-public
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- node.role == manager
|
||||
- node.labels.portainer.portainer-data == true
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.portainer-https.rule=Host(`port.${DOMAIN?Variable not set}`) || Host(`portainer.${DOMAIN?Variable not set}`)
|
||||
- traefik.http.routers.portainer-https.entrypoints=https
|
||||
- traefik.http.routers.portainer-https.tls=true
|
||||
- traefik.http.routers.portainer-https.tls.certresolver=le
|
||||
- traefik.http.routers.portainer-https.service=portainer_service
|
||||
- traefik.http.services.portainer_service.loadbalancer.server.port=9000
|
||||
|
||||
networks:
|
||||
agent-network:
|
||||
attachable: true
|
||||
traefik-public:
|
||||
external: true
|
||||
|
||||
volumes:
|
||||
portainer-data:
|
||||
@@ -0,0 +1,253 @@
|
||||
volumes:
|
||||
minio_data: {}
|
||||
neo4j_data: {}
|
||||
neo4j_logs: {}
|
||||
postgres_data: {}
|
||||
|
||||
services:
|
||||
api_server:
|
||||
image: furyhawk/listen:latest
|
||||
restart: always
|
||||
depends_on:
|
||||
- postgres_db
|
||||
environment:
|
||||
DATABASE__HOSTNAME: ${DATABASE__HOSTNAME}
|
||||
DATABASE__USERNAME: ${POSTGRES_USER}
|
||||
DATABASE__PASSWORD: ${POSTGRES_PASSWORD}
|
||||
DATABASE__PORT: ${DATABASE__PORT}
|
||||
DATABASE__DB: ${DATABASE__DB}
|
||||
SECURITY__JWT_SECRET_KEY: ${SECURITY__JWT_SECRET_KEY}
|
||||
SECURITY__BACKEND_CORS_ORIGINS: ${SECURITY__BACKEND_CORS_ORIGINS}
|
||||
SECURITY__ALLOWED_HOSTS: ${SECURITY__ALLOWED_HOSTS}
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
ports:
|
||||
- "8000:8000"
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.api_server.entrypoints=web-secure"
|
||||
- "traefik.http.routers.api_server.rule=Host(`api.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.api_server.middlewares=csrf@file, rate-limit@file"
|
||||
- "traefik.http.routers.api_server.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.api_server.service=api_server_service"
|
||||
- "traefik.http.services.api_server_service.loadbalancer.server.port=8000"
|
||||
|
||||
postgres_db:
|
||||
image: postgres
|
||||
environment:
|
||||
POSTGRES_DB: ${POSTGRES_DB}
|
||||
POSTGRES_USER: ${POSTGRES_USER}
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
PGDATA: "/var/lib/postgresql/data"
|
||||
LANG: en_US.utf8
|
||||
TZ: Asia/Singapore
|
||||
# DOMAINNAME: ${DOMAINNAME}
|
||||
command: ["postgres", "-c", "log_connections=on"]
|
||||
volumes:
|
||||
- postgres_data:/var/lib/postgresql/data
|
||||
# - ./config/postgresql.conf:/etc/postgresql.conf
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 10
|
||||
# ports:
|
||||
# - "5432:5432"
|
||||
expose:
|
||||
- 5432
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.tcp.routers.postgres.entrypoints=postgres-socket"
|
||||
- "traefik.tcp.routers.postgres.rule=HostSNI(`*`)"
|
||||
- "traefik.tcp.routers.postgres.service=postgres_service"
|
||||
- "traefik.tcp.services.postgres_service.loadbalancer.server.port=5432"
|
||||
# - "traefik.tcp.middlewares.test-inflightconn.inflightconn.amount=10"
|
||||
# - "traefik.tcp.routers.postgres.rule=HostSNIRegexp(`^.+\\.furyhawk\\.lol$`)"
|
||||
# - "traefik.tcp.routers.postgres.tls=true"
|
||||
# - "traefik.tcp.routers.postgres.tls.certresolver=letsencrypt"
|
||||
# - "traefik.tcp.routers.postgres.middlewares=test-inflightconn"
|
||||
# - "traefik.http.routers.postgres.entrypoints=web-secure"
|
||||
# - "traefik.http.routers.postgres.rule=Host(`db.${DOMAINNAME}`)"
|
||||
# - "traefik.http.routers.postgres.middlewares=rate-limit@file, csrf@file"
|
||||
# - "traefik.http.routers.postgres.tls.certresolver=letsencrypt"
|
||||
# - "traefik.http.routers.postgres.service=postgres_service"
|
||||
# - "traefik.http.services.postgres_service.loadbalancer.server.port=5432"
|
||||
|
||||
osrm-backend:
|
||||
environment:
|
||||
# OSRM manager setup
|
||||
- OSRM_ALGORITHM=mld
|
||||
- OSRM_THREADS=2
|
||||
- OSRM_PORT=${OSRM_PORT:-5000}
|
||||
- OSRM_PROFILE=/opt/car.lua
|
||||
- OSRM_MAP_NAME=${OSRM_MAP_NAME}
|
||||
- OSRM_GEOFABRIK_PATH=${OSRM_GEOFABRIK_PATH}
|
||||
# Notify OSRM Manager to restart without stopping container
|
||||
- OSRM_NOTIFY_FILEPATH=/data/osrm_notify.txt
|
||||
- DOMAINNAME=${DOMAINNAME}
|
||||
image: furyhawk/osrm-backend:${OSRM_VERSION:-latest}
|
||||
restart: unless-stopped
|
||||
expose:
|
||||
- ${OSRM_PORT:-5000}
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.osrm-backend.entrypoints=web-secure"
|
||||
- "traefik.http.routers.osrm-backend.rule=Host(`osrm.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.osrm-backend.middlewares=csrf@file"
|
||||
- "traefik.http.routers.osrm-backend.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.osrm-backend.service=osrm_backend_service"
|
||||
- "traefik.http.services.osrm_backend_service.loadbalancer.server.port=${OSRM_PORT:-5000}"
|
||||
|
||||
minio-common:
|
||||
image: minio/minio:latest
|
||||
environment:
|
||||
MINIO_ROOT_USER: "${MINIO_ROOT_USER:-minioadmin}"
|
||||
MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD:-minioadmin}"
|
||||
MINIO_OPTS: "--console-address :9001"
|
||||
MINIO_SERVER_URL: https://minio.${DOMAINNAME}
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
# user: "1000:1000"
|
||||
restart: unless-stopped
|
||||
command: server /data --address :9000 --console-address :9001
|
||||
healthcheck:
|
||||
test: ["CMD", "mc", "ready", "local"]
|
||||
interval: 60s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
volumes:
|
||||
- minio_data:/data
|
||||
expose:
|
||||
- 9000
|
||||
- 9001
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.minio-router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.minio-router.rule=Host(`drive.${DOMAINNAME}`) || Host(`storage.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.minio-router.middlewares=csrf@file"
|
||||
- "traefik.http.routers.minio-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.minio-router.service=minio_common_service"
|
||||
- "traefik.http.services.minio_common_service.loadbalancer.server.port=9001"
|
||||
- "traefik.http.routers.minio-api-router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.minio-api-router.rule=Host(`minio.${DOMAINNAME}`) || Host(`s3.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.minio-api-router.middlewares=csrf@file"
|
||||
- "traefik.http.routers.minio-api-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.minio-api-router.service=minio_api_service"
|
||||
- "traefik.http.services.minio_api_service.loadbalancer.server.port=9000"
|
||||
|
||||
neo4j_server:
|
||||
# Docker image to be used
|
||||
image: ${NEO4J_DOCKER_IMAGE:-neo4j:latest}
|
||||
restart: unless-stopped
|
||||
# Environment variables
|
||||
environment:
|
||||
NEO4J_AUTH: neo4j/${NEO4J_PASSWORD:-12345678}
|
||||
NEO4J_dbms.default_listen_address: "0.0.0.0"
|
||||
NEO4J_dbms.default_advertised_address: "neo4j.${DOMAINNAME}"
|
||||
NEO4J_dbms.connector.bolt.advertised_address: ":443"
|
||||
NEO4J_PLUGINS: '["apoc"]'
|
||||
NEO4J_dbms_security_procedures_unrestricted: "apoc.*"
|
||||
NEO4J_dbms_security_procedures_allowlist: "apoc.*"
|
||||
NEO4J_server_memory_pagecache_size: 512M
|
||||
NEO4J_server_memory_heap_max__size: 2G
|
||||
DOMAINNAME: ${DOMAINNAME}
|
||||
user: "1000:1000"
|
||||
depends_on:
|
||||
- traefik
|
||||
volumes:
|
||||
- neo4j_data:/data
|
||||
- neo4j_logs:/logs
|
||||
# Expose ports
|
||||
expose:
|
||||
- 7474
|
||||
- 7687
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.neo4j-router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.neo4j-router.rule=Host(`neo4j.${DOMAINNAME}`) && PathPrefix(`/neo4j`)||PathPrefix(`/browser`)"
|
||||
- "traefik.http.routers.neo4j-router.middlewares=csrf@file, neo4j_strip@file"
|
||||
- "traefik.http.routers.neo4j-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.neo4j-router.service=neo4j_browser"
|
||||
- "traefik.http.services.neo4j_browser.loadbalancer.server.port=7474"
|
||||
- "traefik.http.routers.neo4j-bolt-router.entrypoints=web-secure"
|
||||
- "traefik.http.routers.neo4j-bolt-router.rule=Host(`neo4j.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.neo4j-bolt-router.middlewares=csrf@file"
|
||||
- "traefik.http.routers.neo4j-bolt-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.neo4j-bolt-router.service=neo4j_bolt"
|
||||
- "traefik.http.services.neo4j_bolt.loadbalancer.server.port=7687"
|
||||
- "traefik.tcp.routers.neo4j-bolt-router.entrypoints=bolt-socket"
|
||||
- "traefik.tcp.routers.neo4j-bolt-router.rule=HostSNIRegexp(`^.+\\.furyhawk\\.lol$`)"
|
||||
- "traefik.tcp.routers.neo4j-bolt-router.tls=true"
|
||||
- "traefik.tcp.routers.neo4j-bolt-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.tcp.routers.neo4j-bolt-router.service=neo4j_bolt"
|
||||
- "traefik.tcp.services.neo4j_bolt.loadbalancer.server.port=7687"
|
||||
|
||||
syncthing:
|
||||
image: syncthing/syncthing
|
||||
environment:
|
||||
- PUID=1000
|
||||
- PGID=1000
|
||||
- DOMAINNAME=${DOMAINNAME}
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- ~/st-sync:/var/syncthing
|
||||
ports:
|
||||
- "8384:8384" # Web UI
|
||||
- "22000:22000/tcp" # TCP file transfers
|
||||
- "22000:22000/udp" # QUIC file transfers
|
||||
- "21027:21027/udp" # Receive local discovery broadcasts
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.syncthing.entrypoints=web-secure"
|
||||
- "traefik.http.routers.syncthing.rule=Host(`sync.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.syncthing.middlewares=csrf@file"
|
||||
- "traefik.http.routers.syncthing.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.syncthing.service=syncthing_service"
|
||||
- "traefik.http.services.syncthing_service.loadbalancer.server.port=8384"
|
||||
|
||||
dozzle:
|
||||
image: amir20/dozzle:latest
|
||||
restart: always
|
||||
environment:
|
||||
- DOMAINNAME=${DOMAINNAME}
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
expose:
|
||||
- 8080
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dozzle.entrypoints=web-secure"
|
||||
- "traefik.http.routers.dozzle.rule=Host(`log.${DOMAINNAME}`)"
|
||||
- "traefik.http.routers.dozzle.middlewares=auth@file, csrf@file"
|
||||
- "traefik.http.routers.dozzle.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.dozzle.service=dozzle_service"
|
||||
- "traefik.http.services.dozzle_service.loadbalancer.server.port=8080"
|
||||
|
||||
# WhoAmI - For Testing and Troubleshooting
|
||||
whoami:
|
||||
image: traefik/whoami
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- net
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.whoami-rtr.entrypoints=web-secure"
|
||||
- "traefik.http.routers.whoami-rtr.rule=Host(`whoami.$DOMAINNAME`)"
|
||||
- "traefik.http.routers.whoami-rtr.middlewares=csrf@file"
|
||||
- "traefik.http.routers.whoami-rtr.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.whoami-rtr.service=whoami-svc"
|
||||
- "traefik.http.services.whoami-svc.loadbalancer.server.port=80"
|
||||
@@ -0,0 +1,185 @@
|
||||
services:
|
||||
|
||||
api_server:
|
||||
image: furyhawk/listen:v0.1.13
|
||||
restart: always
|
||||
depends_on:
|
||||
- postgres_db
|
||||
environment:
|
||||
DATABASE__HOSTNAME: ${DATABASE__HOSTNAME}
|
||||
DATABASE__USERNAME: ${POSTGRES_USER}
|
||||
DATABASE__PASSWORD: ${POSTGRES_PASSWORD}
|
||||
DATABASE__PORT: ${DATABASE__PORT}
|
||||
DATABASE__DB: ${DATABASE__DB}
|
||||
SECURITY__JWT_SECRET_KEY: ${SECURITY__JWT_SECRET_KEY}
|
||||
SECURITY__BACKEND_CORS_ORIGINS: ${SECURITY__BACKEND_CORS_ORIGINS}
|
||||
SECURITY__ALLOWED_HOSTS: ${SECURITY__ALLOWED_HOSTS}
|
||||
DOMAIN: ${DOMAIN}
|
||||
networks:
|
||||
- net
|
||||
- traefik-public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.api_server.entrypoints=https
|
||||
- traefik.http.routers.api_server.rule=Host(`api.${DOMAIN}`)
|
||||
- traefik.http.routers.api_server.tls.certresolver=le
|
||||
- traefik.http.routers.api_server.service=api_server_service
|
||||
- traefik.http.services.api_server_service.loadbalancer.server.port=8000
|
||||
|
||||
dozzle:
|
||||
image: amir20/dozzle:latest
|
||||
restart: always
|
||||
environment:
|
||||
- DOMAIN=${DOMAIN}
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- node.role == manager
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.dozzle.entrypoints=https
|
||||
- traefik.http.routers.dozzle.rule=Host(`log.${DOMAIN}`)
|
||||
- traefik.http.routers.dozzle.middlewares=admin-auth
|
||||
- traefik.http.routers.dozzle.tls.certresolver=le
|
||||
- traefik.http.routers.dozzle.service=dozzle_service
|
||||
- traefik.http.services.dozzle_service.loadbalancer.server.port=8080
|
||||
|
||||
minio-common:
|
||||
image: minio/minio:latest
|
||||
environment:
|
||||
MINIO_ROOT_USER: "${MINIO_ROOT_USER:-minioadmin}"
|
||||
MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD:-minioadmin}"
|
||||
MINIO_OPTS: "--console-address :9001"
|
||||
MINIO_SERVER_URL: https://minio.${DOMAIN}
|
||||
DOMAIN: ${DOMAIN}
|
||||
restart: unless-stopped
|
||||
command: server /data --address :9000 --console-address :9001
|
||||
healthcheck:
|
||||
test: ["CMD", "mc", "ready", "local"]
|
||||
interval: 60s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
volumes:
|
||||
- /var/data/minio_data:/data
|
||||
expose:
|
||||
- 9000
|
||||
- 9001
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.minio-router.entrypoints=https
|
||||
- traefik.http.routers.minio-router.rule=Host(`drive.${DOMAIN}`) || Host(`storage.${DOMAIN}`)
|
||||
- traefik.http.routers.minio-router.tls.certresolver=le
|
||||
- traefik.http.routers.minio-router.service=minio_common_service
|
||||
- traefik.http.services.minio_common_service.loadbalancer.server.port=9001
|
||||
- traefik.http.routers.minio-api-router.entrypoints=https
|
||||
- traefik.http.routers.minio-api-router.rule=Host(`minio.${DOMAIN}`) || Host(`s3.${DOMAIN}`)
|
||||
- traefik.http.routers.minio-api-router.tls.certresolver=le
|
||||
- traefik.http.routers.minio-api-router.service=minio_api_service
|
||||
- traefik.http.services.minio_api_service.loadbalancer.server.port=9000
|
||||
|
||||
osrm-backend:
|
||||
environment:
|
||||
# OSRM manager setup
|
||||
- OSRM_ALGORITHM=mld
|
||||
- OSRM_THREADS=2
|
||||
- OSRM_PORT=${OSRM_PORT:-5000}
|
||||
- OSRM_PROFILE=/opt/car.lua
|
||||
- OSRM_MAP_NAME=${OSRM_MAP_NAME}
|
||||
- OSRM_GEOFABRIK_PATH=${OSRM_GEOFABRIK_PATH}
|
||||
# Notify OSRM Manager to restart without stopping container
|
||||
- OSRM_NOTIFY_FILEPATH=/data/osrm_notify.txt
|
||||
- DOMAIN=${DOMAIN}
|
||||
image: furyhawk/osrm-backend:${OSRM_VERSION:-latest}
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.osrm-backend.entrypoints=https
|
||||
- traefik.http.routers.osrm-backend.rule=Host(`osrm.${DOMAIN}`)
|
||||
- traefik.http.routers.osrm-backend.middlewares=rate-limit
|
||||
- traefik.http.routers.osrm-backend.tls.certresolver=le
|
||||
- traefik.http.routers.osrm-backend.service=osrm_backend_service
|
||||
- traefik.http.services.osrm_backend_service.loadbalancer.server.port=${OSRM_PORT:-5000}
|
||||
|
||||
postgres_db:
|
||||
image: postgres
|
||||
environment:
|
||||
POSTGRES_DB: ${POSTGRES_DB}
|
||||
POSTGRES_USER: ${POSTGRES_USER}
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
PGDATA: "/var/lib/postgresql/data"
|
||||
LANG: en_US.utf8
|
||||
TZ: Asia/Singapore
|
||||
command: ["postgres", "-c", "log_connections=on"]
|
||||
volumes:
|
||||
- postgres_data:/var/lib/postgresql/data
|
||||
# - ./config/postgresql.conf:/etc/postgresql.conf
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 10
|
||||
networks:
|
||||
- net
|
||||
- traefik-public
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.postgres.postgres_data == true
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.tcp.routers.postgres.entrypoints=postgres-socket
|
||||
- traefik.tcp.routers.postgres.rule=HostSNI(`*`)
|
||||
- traefik.tcp.routers.postgres.service=postgres_service
|
||||
- traefik.tcp.services.postgres_service.loadbalancer.server.port=5432
|
||||
|
||||
# WhoAmI - For Testing and Troubleshooting
|
||||
whoami:
|
||||
image: traefik/whoami
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.whoami-rtr.entrypoints=https
|
||||
- traefik.http.routers.whoami-rtr.rule=Host(`whoami.$DOMAIN`)
|
||||
- traefik.http.routers.whoami-rtr.tls.certresolver=le
|
||||
- traefik.http.routers.whoami-rtr.service=whoami-svc
|
||||
- traefik.http.services.whoami-svc.loadbalancer.server.port=80
|
||||
|
||||
volumes:
|
||||
# minio_data: {}
|
||||
# neo4j_data: {}
|
||||
# neo4j_logs: {}
|
||||
postgres_data: {}
|
||||
networks:
|
||||
net:
|
||||
driver: overlay
|
||||
attachable: true
|
||||
traefik-public:
|
||||
external: true
|
||||
@@ -0,0 +1,96 @@
|
||||
services:
|
||||
app:
|
||||
image: swarmpit/swarmpit:latest
|
||||
environment:
|
||||
- SWARMPIT_DB=http://db:5984
|
||||
- SWARMPIT_INFLUXDB=http://influxdb:8086
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
networks:
|
||||
- net
|
||||
- traefik-public
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 1024M
|
||||
reservations:
|
||||
cpus: '0.25'
|
||||
memory: 512M
|
||||
placement:
|
||||
constraints:
|
||||
- node.role == manager
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.swarmpit-https.rule=Host(`swarmpit.${DOMAIN?Variable not set}`)
|
||||
- traefik.http.routers.swarmpit-https.entrypoints=https
|
||||
- traefik.http.routers.swarmpit-https.tls=true
|
||||
- traefik.http.routers.swarmpit-https.tls.certresolver=le
|
||||
- traefik.http.services.swarmpit.loadbalancer.server.port=8080
|
||||
|
||||
db:
|
||||
image: couchdb:2.3
|
||||
volumes:
|
||||
- db-data:/opt/couchdb/data
|
||||
networks:
|
||||
- net
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.30'
|
||||
memory: 512M
|
||||
reservations:
|
||||
cpus: '0.15'
|
||||
memory: 256M
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.swarmpit.db-data == true
|
||||
influxdb:
|
||||
image: influxdb:1.7
|
||||
volumes:
|
||||
- influx-data:/var/lib/influxdb
|
||||
networks:
|
||||
- net
|
||||
deploy:
|
||||
resources:
|
||||
reservations:
|
||||
cpus: '0.3'
|
||||
memory: 128M
|
||||
limits:
|
||||
cpus: '0.6'
|
||||
memory: 512M
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.swarmpit.influx-data == true
|
||||
agent:
|
||||
image: swarmpit/agent:latest
|
||||
environment:
|
||||
- DOCKER_API_VERSION=1.35
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
networks:
|
||||
- net
|
||||
deploy:
|
||||
mode: global
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.10'
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: '0.05'
|
||||
memory: 32M
|
||||
|
||||
networks:
|
||||
net:
|
||||
driver: overlay
|
||||
attachable: true
|
||||
traefik-public:
|
||||
external: true
|
||||
|
||||
volumes:
|
||||
db-data:
|
||||
driver: local
|
||||
influx-data:
|
||||
driver: local
|
||||
@@ -0,0 +1,222 @@
|
||||
networks:
|
||||
net:
|
||||
driver: overlay
|
||||
attachable: true
|
||||
traefik-public:
|
||||
external: true
|
||||
|
||||
volumes:
|
||||
prometheus: {}
|
||||
grafana: {}
|
||||
alertmanager: {}
|
||||
|
||||
configs:
|
||||
dockerd_config:
|
||||
file: ./dockerd-exporter/Caddyfile
|
||||
node_rules:
|
||||
file: ./prometheus/rules/swarm_node.rules.yml
|
||||
task_rules:
|
||||
file: ./prometheus/rules/swarm_task.rules.yml
|
||||
|
||||
services:
|
||||
dockerd-exporter:
|
||||
image: stefanprodan/caddy
|
||||
networks:
|
||||
- net
|
||||
environment:
|
||||
- DOCKER_GWBRIDGE_IP=172.18.0.1
|
||||
configs:
|
||||
- source: dockerd_config
|
||||
target: /etc/caddy/Caddyfile
|
||||
deploy:
|
||||
mode: global
|
||||
resources:
|
||||
limits:
|
||||
memory: 128M
|
||||
reservations:
|
||||
memory: 64M
|
||||
|
||||
cadvisor:
|
||||
image: gcr.io/cadvisor/cadvisor
|
||||
networks:
|
||||
- net
|
||||
command: -logtostderr -docker_only
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- /:/rootfs:ro
|
||||
- /var/run:/var/run
|
||||
- /sys:/sys:ro
|
||||
- /var/lib/docker/:/var/lib/docker:ro
|
||||
deploy:
|
||||
mode: global
|
||||
resources:
|
||||
limits:
|
||||
memory: 128M
|
||||
reservations:
|
||||
memory: 64M
|
||||
|
||||
grafana:
|
||||
image: stefanprodan/swarmprom-grafana:5.3.4
|
||||
networks:
|
||||
- default
|
||||
- net
|
||||
- traefik-public
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_USER=${ADMIN_USER:-admin}
|
||||
- GF_SECURITY_ADMIN_PASSWORD=${ADMIN_PASSWORD:-admin}
|
||||
- GF_USERS_ALLOW_SIGN_UP=false
|
||||
#- GF_SERVER_ROOT_URL=${GF_SERVER_ROOT_URL:-localhost}
|
||||
#- GF_SMTP_ENABLED=${GF_SMTP_ENABLED:-false}
|
||||
#- GF_SMTP_FROM_ADDRESS=${GF_SMTP_FROM_ADDRESS:-grafana@test.com}
|
||||
#- GF_SMTP_FROM_NAME=${GF_SMTP_FROM_NAME:-Grafana}
|
||||
#- GF_SMTP_HOST=${GF_SMTP_HOST:-smtp:25}
|
||||
#- GF_SMTP_USER=${GF_SMTP_USER}
|
||||
#- GF_SMTP_PASSWORD=${GF_SMTP_PASSWORD}
|
||||
volumes:
|
||||
- grafana:/var/lib/grafana
|
||||
deploy:
|
||||
mode: replicated
|
||||
replicas: 1
|
||||
placement:
|
||||
constraints:
|
||||
- node.role == manager
|
||||
resources:
|
||||
limits:
|
||||
memory: 128M
|
||||
reservations:
|
||||
memory: 64M
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.swarmprom-grafana-https.rule=Host(`grafana.${DOMAIN?Variable not set}`)
|
||||
- traefik.http.routers.swarmprom-grafana-https.entrypoints=https
|
||||
- traefik.http.routers.swarmprom-grafana-https.tls=true
|
||||
- traefik.http.routers.swarmprom-grafana-https.tls.certresolver=le
|
||||
- traefik.http.services.swarmprom-grafana.loadbalancer.server.port=3000
|
||||
|
||||
alertmanager:
|
||||
image: stefanprodan/swarmprom-alertmanager:v0.14.0
|
||||
networks:
|
||||
- default
|
||||
- net
|
||||
- traefik-public
|
||||
environment:
|
||||
- SLACK_URL=${SLACK_URL:-https://hooks.slack.com/services/TOKEN}
|
||||
- SLACK_CHANNEL=${SLACK_CHANNEL:-general}
|
||||
- SLACK_USER=${SLACK_USER:-alertmanager}
|
||||
command:
|
||||
- '--config.file=/etc/alertmanager/alertmanager.yml'
|
||||
- '--storage.path=/alertmanager'
|
||||
volumes:
|
||||
- alertmanager:/alertmanager
|
||||
deploy:
|
||||
mode: replicated
|
||||
replicas: 1
|
||||
placement:
|
||||
constraints:
|
||||
- node.role == manager
|
||||
resources:
|
||||
limits:
|
||||
memory: 128M
|
||||
reservations:
|
||||
memory: 64M
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.swarmprom-alertmanager-https.rule=Host(`alertmanager.${DOMAIN?Variable not set}`)
|
||||
- traefik.http.routers.swarmprom-alertmanager-https.entrypoints=https
|
||||
- traefik.http.routers.swarmprom-alertmanager-https.tls=true
|
||||
- traefik.http.routers.swarmprom-alertmanager-https.tls.certresolver=le
|
||||
- traefik.http.services.swarmprom-alertmanager.loadbalancer.server.port=9093
|
||||
- traefik.http.middlewares.swarmprom-alertmanager-auth.basicauth.users=${ADMIN_USER?Variable not set}:${HASHED_PASSWORD?Variable not set}
|
||||
- traefik.http.routers.swarmprom-alertmanager-https.middlewares=swarmprom-alertmanager-auth
|
||||
|
||||
unsee:
|
||||
image: cloudflare/unsee:v0.8.0
|
||||
networks:
|
||||
- default
|
||||
- net
|
||||
- traefik-public
|
||||
environment:
|
||||
- "ALERTMANAGER_URIS=default:http://alertmanager:9093"
|
||||
deploy:
|
||||
mode: replicated
|
||||
replicas: 1
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.swarmprom-unsee-https.rule=Host(`unsee.${DOMAIN?Variable not set}`)
|
||||
- traefik.http.routers.swarmprom-unsee-https.entrypoints=https
|
||||
- traefik.http.routers.swarmprom-unsee-https.tls=true
|
||||
- traefik.http.routers.swarmprom-unsee-https.tls.certresolver=le
|
||||
- traefik.http.services.swarmprom-unsee.loadbalancer.server.port=8080
|
||||
- traefik.http.middlewares.swarmprom-unsee-auth.basicauth.users=${ADMIN_USER?Variable not set}:${HASHED_PASSWORD?Variable not set}
|
||||
- traefik.http.routers.swarmprom-unsee-https.middlewares=swarmprom-unsee-auth
|
||||
|
||||
node-exporter:
|
||||
image: stefanprodan/swarmprom-node-exporter:v0.16.0
|
||||
networks:
|
||||
- net
|
||||
environment:
|
||||
- NODE_ID={{.Node.ID}}
|
||||
volumes:
|
||||
- /proc:/host/proc:ro
|
||||
- /sys:/host/sys:ro
|
||||
- /:/rootfs:ro
|
||||
- /etc/hostname:/etc/nodename
|
||||
command:
|
||||
- '--path.sysfs=/host/sys'
|
||||
- '--path.procfs=/host/proc'
|
||||
- '--collector.textfile.directory=/etc/node-exporter/'
|
||||
- '--collector.filesystem.ignored-mount-points=^/(sys|proc|dev|host|etc)($$|/)'
|
||||
- '--no-collector.ipvs'
|
||||
deploy:
|
||||
mode: global
|
||||
resources:
|
||||
limits:
|
||||
memory: 128M
|
||||
reservations:
|
||||
memory: 64M
|
||||
|
||||
prometheus:
|
||||
image: stefanprodan/swarmprom-prometheus:v2.5.0
|
||||
networks:
|
||||
- default
|
||||
- net
|
||||
- traefik-public
|
||||
command:
|
||||
- '--config.file=/etc/prometheus/prometheus.yml'
|
||||
- '--storage.tsdb.path=/prometheus'
|
||||
- '--storage.tsdb.retention=${PROMETHEUS_RETENTION:-24h}'
|
||||
volumes:
|
||||
- prometheus:/prometheus
|
||||
configs:
|
||||
- source: node_rules
|
||||
target: /etc/prometheus/swarm_node.rules.yml
|
||||
- source: task_rules
|
||||
target: /etc/prometheus/swarm_task.rules.yml
|
||||
deploy:
|
||||
mode: replicated
|
||||
replicas: 1
|
||||
placement:
|
||||
constraints:
|
||||
- node.role == manager
|
||||
resources:
|
||||
limits:
|
||||
memory: 2048M
|
||||
reservations:
|
||||
memory: 128M
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.swarmprom-prometheus-https.rule=Host(`prometheus.${DOMAIN?Variable not set}`)
|
||||
- traefik.http.routers.swarmprom-prometheus-https.entrypoints=https
|
||||
- traefik.http.routers.swarmprom-prometheus-https.tls=true
|
||||
- traefik.http.routers.swarmprom-prometheus-https.tls.certresolver=le
|
||||
- traefik.http.services.swarmprom-prometheus.loadbalancer.server.port=9090
|
||||
- traefik.http.middlewares.swarmprom-prometheus-auth.basicauth.users=${ADMIN_USER?Variable not set}:${HASHED_PASSWORD?Variable not set}
|
||||
- traefik.http.routers.swarmprom-prometheus-https.middlewares=swarmprom-prometheus-auth
|
||||
@@ -0,0 +1,27 @@
|
||||
services:
|
||||
thelounge:
|
||||
image: thelounge/thelounge:latest
|
||||
volumes:
|
||||
- thelounge-data:/var/opt/thelounge
|
||||
networks:
|
||||
- traefik-public
|
||||
deploy:
|
||||
# placement:
|
||||
# constraints:
|
||||
# - node.labels.thelounge.thelounge-data == true
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=traefik-public
|
||||
- traefik.constraint-label=traefik-public
|
||||
- traefik.http.routers.thelounge-https.rule=Host(`irc.${DOMAIN?Variable not set}`)
|
||||
- traefik.http.routers.thelounge-https.entrypoints=https
|
||||
- traefik.http.routers.thelounge-https.tls=true
|
||||
- traefik.http.routers.thelounge-https.tls.certresolver=le
|
||||
- traefik.http.services.thelounge.loadbalancer.server.port=9000
|
||||
|
||||
networks:
|
||||
traefik-public:
|
||||
external: true
|
||||
|
||||
volumes:
|
||||
thelounge-data:
|
||||
Reference in New Issue
Block a user