1238 lines
47 KiB
YAML
1238 lines
47 KiB
YAML
# ---
|
|
|
|
|
|
docker_swarm_addr: 100.96.172.77
|
|
docker_swarm_interface: wt0
|
|
pip_install_packages:
|
|
- docker
|
|
# #* NETBIRD
|
|
|
|
# netbird_setup_key: F234BD1F-385B-4BEA-8234-608CCB1062ED
|
|
# netbird_register: true
|
|
|
|
# #* TLS
|
|
|
|
# node_exporter_tls_server_config:
|
|
# cert_file: /etc/node_exporter/tls.cert
|
|
# key_file: /etc/node_exporter/tls.key
|
|
|
|
|
|
node_exporter_tls_server_config:
|
|
cert_file: /etc/node_exporter/tls.cert
|
|
key_file: /etc/node_exporter/tls.key
|
|
|
|
# #* NODE_EXPORTER
|
|
|
|
# # node_exporter_basic_auth_users:
|
|
# # randomuser: examplepassword
|
|
# node_exporter_web_listen_address: "{{ host_private_address }}:9100"
|
|
|
|
|
|
|
|
# ########
|
|
# # USER #
|
|
# ########
|
|
|
|
# management_user_list:
|
|
# - name: stephane
|
|
# shell: '/bin/bash'
|
|
# authorized_keys:
|
|
# - key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClVS1uxDfwS6OusQ4qgcZ6hBc8YRBE8MyXu0sUfGN7S3itjI3W2ixD18v80el8dVQVR12jCY0ueavgoV1cHrfGWkFoLKi+QrA4MuSNUChj0NBbyLTmdwPvne8LRv3ttCbRSJ/6bIEveX8y/7kGn/R1NDFlfE6b5R8ersBUKCQM6YxblAkv/XH8cJlQXhr1nLhVOl/ae+Q/pTCbgioB8qrmGEuMvOLmavcFf7IJbJcSgeiXSOnyIRl2n64X6lbRK+MRZ61pF6vAOXA+Ixyt/fAbO7sjqU0+cEhU5Br5/VcqG4Bc5nhWimtXIHPry3aLV5PtN6K9/i3eA5F6Jpa82JzmUMEbWSBIga02yIw9GjRyAI6ccH/kJGuB6QN5/YwGHpOF2f0FGiEAbUz41mLngN3SsXL1pdV2hT3x56/GIcGe6p/f1cytwVCyOaE7W87B05w5JYb1sSFj6QuGW0rHWfnHT5SY87Mk/H8VgZPaPbm+hSjLIQRAmUYQR+Rub1o9bXE= stephane"
|
|
# exclusive: yes
|
|
# sudo:
|
|
# hosts: ALL
|
|
# as: ALL
|
|
# commands: ALL
|
|
# nopasswd: ALL
|
|
|
|
|
|
# #######
|
|
# # APT #
|
|
# #######
|
|
|
|
# apt_repositories_sources:
|
|
# - deb http://mirrors.online.net/ubuntu focal main restricted
|
|
# - deb http://mirrors.online.net/ubuntu focal-updates main restricted
|
|
# - deb http://mirrors.online.net/ubuntu focal universe
|
|
# - deb http://mirrors.online.net/ubuntu focal-updates universe
|
|
# - deb http://mirrors.online.net/ubuntu focal multiverse
|
|
# - deb http://mirrors.online.net/ubuntu focal-updates multiverse
|
|
# - deb http://mirrors.online.net/ubuntu focal-backports main restricted universe multiverse
|
|
# - deb http://security.ubuntu.com/ubuntu focal-security main restricted
|
|
# - deb http://security.ubuntu.com/ubuntu focal-security universe
|
|
# - deb http://security.ubuntu.com/ubuntu focal-security multiverse
|
|
|
|
# apt_packages:
|
|
# - name: openssh-server
|
|
# - name: proxychains
|
|
|
|
# ############
|
|
# # ALERTING #
|
|
# ############
|
|
|
|
# alerts_cron:
|
|
# - name: storage
|
|
# weekday: 0
|
|
# minute: 0
|
|
# hour: 15
|
|
# user: root
|
|
# job: "/usr/local/scripts/alerts.sh storage >/dev/null 2>&1"
|
|
# cron_file: alerts
|
|
# - name: load
|
|
# weekday: "*"
|
|
# minute: "*/5"
|
|
# hour: "*"
|
|
# user: root
|
|
# job: "/usr/local/scripts/alerts.sh load >/dev/null 2>&1"
|
|
# cron_file: alerts
|
|
# - name: cpu
|
|
# weekday: "*"
|
|
# minute: "*/5"
|
|
# hour: "*"
|
|
# user: root
|
|
# job: "/usr/local/scripts/alerts.sh cpu >/dev/null 2>&1"
|
|
# cron_file: alerts
|
|
# - name: ping
|
|
# weekday: "*"
|
|
# minute: "*"
|
|
# hour: 12
|
|
# user: root
|
|
# job: "/usr/local/scripts/alerts.sh ping >/dev/null 2>&1"
|
|
# cron_file: alerts
|
|
# - name: ssl
|
|
# weekday: "*"
|
|
# minute: 0
|
|
# hour: 15
|
|
# user: root
|
|
# job: "/usr/local/scripts/alerts.sh ssl >/dev/null 2>&1"
|
|
# cron_file: alerts
|
|
# - name: storage
|
|
# weekday: 0
|
|
# minute: 0
|
|
# hour: 15
|
|
# user: root
|
|
# job: "/usr/local/scripts/alerts.sh storage >/dev/null 2>&1"
|
|
# cron_file: alerts
|
|
# - name: backup_git
|
|
# weekday: "*"
|
|
# minute: 0
|
|
# hour: 18
|
|
# user: root
|
|
# job: "/usr/local/scripts/alerts.sh backup_git >/dev/null 2>&1"
|
|
# cron_file: alerts
|
|
# - name: backup_vault
|
|
# weekday: "*"
|
|
# minute: 0
|
|
# hour: 20
|
|
# user: root
|
|
# job: "/usr/local/scripts/alerts.sh backup_vault >/dev/null 2>&1"
|
|
# cron_file: alerts
|
|
|
|
# alerts_storage: scaleway
|
|
# alerts_load: scaleway
|
|
# alerts_ping: ovh
|
|
# alerts_health: scaleway
|
|
# alerts_backup_gitea: scaleway
|
|
# alerts_backup_vault: scaleway
|
|
# alerts_cpu: scaleway
|
|
# alerts_ssl: scaleway
|
|
|
|
# ##############
|
|
# # LOG ROTATE #
|
|
# ##############
|
|
|
|
# logrotate_scripts:
|
|
# - name: backup
|
|
# paths:
|
|
# - /opt/dockerapps/backup/*.zip
|
|
# - /opt/dockerapps/vaultwarden/backup/*.tar.xz.gpg
|
|
# options:
|
|
# - daily
|
|
# - rotate 4
|
|
# - compress
|
|
# - missingok
|
|
# - notifempty
|
|
# - create 0644 root root
|
|
# - name: dockerapps-git
|
|
# path: /opt/dockerapps/logs/homeserver/git*.log
|
|
# options:
|
|
# - rotate 12
|
|
# - monthly
|
|
# - compress
|
|
# - missingok
|
|
# - delaycompress
|
|
# scripts:
|
|
# postrotate: docker-compose restart gitea
|
|
# - name: dockerapps-grafa
|
|
# path: /opt/dockerapps/logs/homeserver/grafa*.log
|
|
# options:
|
|
# - rotate 12
|
|
# - monthly
|
|
# - compress
|
|
# - missingok
|
|
# - delaycompress
|
|
# scripts:
|
|
# postrotate: docker-compose restart grafana
|
|
# - name: dockerapps-traef
|
|
# path: /opt/dockerapps/logs/homeserver/traef*.log
|
|
# options:
|
|
# - rotate 12
|
|
# - monthly
|
|
# - compress
|
|
# - missingok
|
|
# - delaycompress
|
|
# scripts:
|
|
# postrotate: docker-compose restart traefik
|
|
# - name: dockerapps-vault
|
|
# path: /opt/dockerapps/logs/homeserver/vault*.log
|
|
# options:
|
|
# - rotate 12
|
|
# - monthly
|
|
# - compress
|
|
# - missingok
|
|
# - delaycompress
|
|
# scripts:
|
|
# postrotate: docker-compose restart vault
|
|
# # name: restart gitea
|
|
# # script: docker-compose restart gitea
|
|
# # - postrotate: docker-compose restart vaultwarden
|
|
# # - postrotate: docker-compose restart grafana
|
|
# - name: dockerapps-backup
|
|
# paths:
|
|
# - /opt/dockerapps/backup/gitea-dump-*.zip.1.gz
|
|
# - /opt/dockerapps/vaultwarden/backup/*gpg.1.gz
|
|
# options:
|
|
# - rotate 6
|
|
# - monthly
|
|
# - compress
|
|
# - missingok
|
|
# - delaycompress
|
|
|
|
|
|
# ##########
|
|
# # CHISEL #
|
|
# ##########
|
|
|
|
# # SHOULD BE IN [server] GROUP
|
|
# chisel_server: true
|
|
# chisel_basic_auth: "{{ chisel_client_auth_username }}:{{ chisel_client_auth_password }}"
|
|
# chisel_service_name: chisel-server
|
|
# chisel_config_name: chisel-server
|
|
# chisel_proxychains_conf:
|
|
# # chisel enable socks5, reverse and basic auth
|
|
# - path: "/etc/chisel/{{ chisel_config_name }}.conf"
|
|
# regexp: "^SOCK5=--socks5"
|
|
# state: present
|
|
# line: "SOCK5=--socks5"
|
|
# - path: "/etc/chisel/{{ chisel_config_name }}.conf"
|
|
# regexp: "^PID=--reverse"
|
|
# state: present
|
|
# line: "PID=--reverse"
|
|
# - path: "/etc/chisel/{{ chisel_config_name }}.conf"
|
|
# regexp: "^AUTH=--auth {{ chisel_basic_auth }}"
|
|
# state: present
|
|
# line: "AUTH=--auth {{ chisel_basic_auth }}"
|
|
# - path: "/etc/chisel/{{ chisel_config_name }}.conf"
|
|
# regexp: "^HOST=--host {{ chisel_server_host }}"
|
|
# state: present
|
|
# line: "HOST=--host {{ chisel_server_host }}"
|
|
# # proxychains replace socks4 to socks5
|
|
# - path: "/etc/proxychains.conf"
|
|
# regexp: "^socks4 127.0.0.1 9050"
|
|
# state: "absent"
|
|
# - path: "/etc/proxychains.conf"
|
|
# regexp: "^socks5 {{ chisel_server_host }} 1080"
|
|
# state: present
|
|
# line: "socks5 {{ chisel_server_host }} 1080"
|
|
|
|
|
|
|
|
|
|
# ##################
|
|
# # DOCKER-COMPOSE #
|
|
# ##################
|
|
|
|
# dockerapp_tree_volumes:
|
|
# # ALERT
|
|
# - alertmanager
|
|
# - alertmanager/cache
|
|
# - alertmanager/config
|
|
# #ARA
|
|
# - ara
|
|
# #BLACKBOX
|
|
# - blackbox
|
|
# - blackbox/config
|
|
# #GIT
|
|
# - gitea
|
|
# - gitea/gitea
|
|
# - gitea/db
|
|
# - gitea/runner
|
|
# #GRAF
|
|
# - grafana
|
|
# - grafana/etc
|
|
# - grafana/lib
|
|
# #HOMARR
|
|
# - homarr
|
|
# - homarr/configs
|
|
# - homarr/icons
|
|
# #HOME
|
|
# - homepage
|
|
# - homepage/homepage
|
|
# - homepage/icons
|
|
# #MEALIE
|
|
# - mealie
|
|
# #PORT
|
|
# - portainer
|
|
# #PROM
|
|
# - prometheus
|
|
# - prometheus/prometheus
|
|
# - prometheus/prometheus_data
|
|
# #REGISTRY
|
|
# - registry
|
|
# - registry/data
|
|
# #SEMA
|
|
# - semaphore
|
|
# #TRAF
|
|
# - traefik2
|
|
# - traefik2/acme
|
|
# - traefik2/rules
|
|
# #VAULT
|
|
# - vaultwarden
|
|
# #WIRE
|
|
# - wireguard
|
|
# - wireguard/config
|
|
# - wireguard/lib
|
|
# - wireguard/lib/modules
|
|
|
|
# dockerapp_tree_base_dir:
|
|
# - "/opt/"
|
|
# dockerapp_service: dockerapps
|
|
# docker_install_compose: false
|
|
# pip_executable: pip3
|
|
# pip_install_packages:
|
|
# - docker-compose
|
|
|
|
# dockerapp_compose:
|
|
# version: "3.9"
|
|
# ######### IMPORTANT #############
|
|
# # This is my main docker-compose file with most of the apps. I run docker on other systems with smaller stacks (web and synology).
|
|
# # You can copy-paste services from one docker-compose file in this repo to another to add other apps.
|
|
|
|
# # 90+ Open source docker stacks
|
|
# #https://github.com/ethibox/awesome-stacks
|
|
|
|
# #FROM
|
|
# #https://github.com/htpcBeginner/docker-traefik/blob/master/docker-compose-t2.yml
|
|
|
|
# ########################### SYSTEM DESCRIPTION
|
|
# # DOCKER-COMPOSE FOR HOME/MEDIA SERVER
|
|
# # PROXMOX HOST: Dual Intel Xeon 5420, 16 GB RAM, 240 GB SSD, and 2 TB HDD
|
|
# # VM: 6 CORES, 12 GB RAM, Ubuntu 20.04, and Docker
|
|
# # 32 GB for /, 64 GB for /var/lib/docker and transcoding, and 1.5 TB for non-critical data and rclone cache.
|
|
# # Google Drive mounted using Rclone Docker for media and Proxmox backups
|
|
|
|
# ########################### NETWORKS
|
|
# # There is no need to create any networks outside this docker-compose file.
|
|
# # You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please.
|
|
# # Docker Compose version 3.5 or higher required to define networks this way.
|
|
# networks:
|
|
# t2_proxy:
|
|
# name: t2_proxy
|
|
# driver: bridge
|
|
# ipam:
|
|
# config:
|
|
# - subnet: 192.168.90.0/24
|
|
# default:
|
|
# driver: bridge
|
|
# socket_proxy:
|
|
# name: socket_proxy
|
|
# driver: bridge
|
|
# ipam:
|
|
# config:
|
|
# - subnet: 192.168.91.0/24
|
|
# ########################### EXTENSION FIELDS
|
|
# # Helps eliminate repetition of sections
|
|
# # More Info on how to use this: https://github.com/htpcBeginner/docker-traefik/pull/228
|
|
|
|
# # # Common environment values
|
|
# # x-environment: &default-tz-puid-pgid
|
|
# # TZ: Europe/Paris
|
|
# # PUID: 1000
|
|
# # PGID: 1000
|
|
|
|
# # # Proxy Network and Security
|
|
# # x-network-and-security: &network-and-security
|
|
# # networks:
|
|
# # - t2_proxy
|
|
# # security_opt:
|
|
# # - no-new-privileges:true
|
|
|
|
# # # Keys common to some of the services in basic-services.txt
|
|
# # x-common-keys-core: &common-keys-core
|
|
# # <<: *network-and-security
|
|
# # restart: always
|
|
# # # profiles:
|
|
# # # - basic
|
|
|
|
# # # Keys common to some of the dependent services/apps
|
|
# # x-common-keys-apps: &common-keys-apps
|
|
# # <<: *network-and-security
|
|
# # restart: unless-stopped
|
|
# # # profiles:
|
|
# # # - apps
|
|
|
|
# # # Keys common to some of the services in media-services.txt
|
|
# # x-common-keys-media: &common-keys-media
|
|
# # <<: *network-and-security
|
|
# # restart: "no"
|
|
# # # profiles:
|
|
# # # - media
|
|
# ########################### SERVICES
|
|
# services:
|
|
# ############################# FRONTENDS
|
|
|
|
# # Traefik 2 - Reverse Proxy
|
|
# # Touch (create empty files) traefik.log and acme/acme.json. Set acme.json permissions to 600.
|
|
# # touch $DOCKERDIR/traefik2/acme/acme.json
|
|
# # chmod 600 $DOCKERDIR/traefik2/acme/acme.json
|
|
# # touch $DOCKERDIR/logs/homeserver/traefik.log # customize this
|
|
|
|
# #### LETSENCRYPT CHALLENGE ######
|
|
# # https://doc.traefik.io/traefik/user-guides/docker-compose/acme-http/
|
|
# # Add new https services/fqdn
|
|
# # uncomment acme.caserver line and remove/traefik2/acme/letsencrypt/acme.json file
|
|
# # Down all containers and up all (docker-compose down/up -d), wait for news cert/key on acme.json
|
|
# # At this moment, cert/key are staging, you need to comment acme.caserver line and remove acme.json file then restart traefik
|
|
# traefik:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true
|
|
# container_name: traefik
|
|
# image: traefik:latest
|
|
# command: # CLI arguments
|
|
# - --global.checkNewVersion=true
|
|
# - --global.sendAnonymousUsage=true
|
|
# - --entryPoints.http.address=:80/tcp
|
|
# - --entryPoints.https.address=:443/tcp
|
|
# - --entryPoints.wireguard.address=:443/udp
|
|
# - --api=true
|
|
# - --api.dashboard=true
|
|
# - --log=true
|
|
# - --log.level=DEBUG # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
|
|
# - --accessLog=true
|
|
# - --accessLog.filePath=/traefik.log
|
|
# - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines
|
|
# - --providers.docker=true
|
|
# - --providers.docker.endpoint=tcp://socket-proxy:2375
|
|
# - --providers.docker.exposedByDefault=false
|
|
# - --providers.docker.network=t2_proxy
|
|
# - --providers.docker.swarmMode=false
|
|
# - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory
|
|
# - --providers.file.watch=true # Only works on top level files in the rules folder
|
|
# - --metrics.prometheus=true
|
|
# - --metrics.prometheus.buckets=0.1,0.3,1.2,5.0
|
|
# - --metrics.prometheus.addEntryPointsLabels=true
|
|
# - --metrics.prometheus.addrouterslabels=true
|
|
# - --metrics.prometheus.addServicesLabels=true
|
|
# - --metrics.prometheus.manualrouting=true
|
|
# - --certificatesresolvers.letsencrypt-resolver.acme.tlschallenge=true
|
|
# # - --certificatesresolvers.letsencrypt-resolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
|
|
# - --certificatesresolvers.letsencrypt-resolver.acme.email=stephane.gratiasquiquandon@gmail.com
|
|
# - --certificatesresolvers.letsencrypt-resolver.acme.storage=/letsencrypt/acme.json
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.254 # You can specify a static IP
|
|
# # Should connect to the docker socket
|
|
# socket_proxy:
|
|
# ipv4_address: 192.168.91.3
|
|
# environment:
|
|
# TZ: Europe/Paris
|
|
# PUID: 1000
|
|
# PGID: 1000
|
|
# ports:
|
|
# - target: 80
|
|
# published: 80
|
|
# protocol: tcp
|
|
# mode: host
|
|
# - target: 443
|
|
# published: 443
|
|
# protocol: tcp
|
|
# mode: host
|
|
# - target: 443
|
|
# published: 443
|
|
# protocol: udp
|
|
# mode: host
|
|
# volumes:
|
|
# - ./traefik2/rules/homeserver:/rules # file provider directory
|
|
# - ./traefik2/acme/letsencrypt:/letsencrypt
|
|
# #- ./traefik2/acme/acme.json:/acme.json # cert location - you must touch this file and change permissions to 600
|
|
# - ./logs/homeserver/traefik.log:/traefik.log # for fail2ban - make sure to touch file before starting container
|
|
# - /etc/timezone:/etc/timezone:ro
|
|
# - /etc/localtime:/etc/localtime:ro
|
|
# labels:
|
|
# - "traefik.enable=true"
|
|
# # HTTP-to-HTTPS Redirect
|
|
# - "traefik.http.routers.http-catchall.entrypoints=http"
|
|
# - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
|
|
# - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
|
|
# - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
|
|
# - "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
|
|
# # HTTP Routers
|
|
# - "traefik.http.routers.traefik-rtr.entrypoints=https"
|
|
# - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.jingoh.fr`)"
|
|
# ## Services - API
|
|
# - "traefik.http.routers.traefik-rtr.service=api@internal"
|
|
# - "traefik.http.routers.traefik-rtr.tls=true"
|
|
# ## MONITORING
|
|
# - traefik.http.routers.prometheus.entrypoints=https
|
|
# - traefik.http.routers.prometheus.rule=Host(`traefik.jingoh.fr`) && PathPrefix(`/metrics`)
|
|
# - traefik.http.routers.prometheus.service=prometheus@internal
|
|
# - traefik.http.routers.prometheus.middlewares=traefik-basic
|
|
# ## Middlewares
|
|
# # echo $(htpasswd -nB user) | sed -e s/\\$/\\$\\$/g
|
|
# ## Middlewares
|
|
# - "traefik.http.routers.traefik-rtr.middlewares=traefik-basic"
|
|
# - "traefik.http.middlewares.traefik-basic.basicauth.users=jingohtraf:$$2y$$05$$JO8mJnOV2PARzEcVj.Grp.H.JbkWYneAIjgMt7c0.5NTyBNDkRIiW"
|
|
# #- "traefik.http.middlewares.traefik-rtr-ratelimit.ratelimit.average=10"
|
|
# # - "traefik.http.middlewares.traefik-rtr-ratelimit.ratelimit.burst=10"
|
|
# # - "traefik.http.middlewares.traefik-rtr-ratelimit.ratelimit.period=1"
|
|
# # - "traefik.http.routers.traefik-rtr-ratelimit.middlewares=traefik-rtr-ratelimit@docker"
|
|
# ## TLS
|
|
# - "traefik.http.routers.traefik-rtr.tls.certresolver=letsencrypt-resolver"
|
|
# - "traefik.http.routers.prometheus.tls.certresolver=letsencrypt-resolver"
|
|
# # Docker Socket Proxy - Security Enchanced Proxy for Docker Socket
|
|
# socket-proxy:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# container_name: socket-proxy
|
|
# image: tecnativa/docker-socket-proxy:latest
|
|
# networks:
|
|
# socket_proxy:
|
|
# ipv4_address: 192.168.91.254 # You can specify a static IP
|
|
# volumes:
|
|
# - "/var/run/docker.sock:/var/run/docker.sock"
|
|
# environment:
|
|
# - LOG_LEVEL=info # debug,info,notice,warning,err,crit,alert,emerg
|
|
# ## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.).
|
|
# # 0 to revoke access.
|
|
# # 1 to grant access.
|
|
# ## Granted by Default
|
|
# - EVENTS=1
|
|
# - PING=1
|
|
# - VERSION=1
|
|
# ## Revoked by Default
|
|
# # Security critical
|
|
# - AUTH=0
|
|
# - SECRETS=0
|
|
# - POST=0 # Watchtower
|
|
# # Not always needed
|
|
# - BUILD=0
|
|
# - COMMIT=0
|
|
# - CONFIGS=0
|
|
# - CONTAINERS=1 # Traefik, portainer, etc.
|
|
# - DISTRIBUTION=0
|
|
# - EXEC=0
|
|
# - IMAGES=1 # Portainer
|
|
# - INFO=1 # Portainer
|
|
# - NETWORKS=1 # Portainer
|
|
# - NODES=0
|
|
# - PLUGINS=0
|
|
# - SERVICES=1 # Portainer
|
|
# - SESSION=0
|
|
# - SWARM=0
|
|
# - SYSTEM=0
|
|
# - TASKS=1 # Portainer
|
|
# - VOLUMES=1 # Portainer
|
|
|
|
# # Dozzle - Real-time Docker Log Viewer
|
|
# dozzle:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: amir20/dozzle:latest
|
|
# container_name: dozzle
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.169
|
|
# # Should connect to the docker engine socket to collect logs
|
|
# socket_proxy:
|
|
# ipv4_address: 192.168.91.2
|
|
# environment:
|
|
# TZ: Europe/Paris
|
|
# PUID: 1000
|
|
# PGID: 1000
|
|
# DOZZLE_LEVEL: info
|
|
# #DOZZLE_TAILSIZE: 300
|
|
# DOZZLE_FILTER: "status=running"
|
|
# DOCKER_HOST: tcp://socket-proxy:2375
|
|
# #DOZZLE_ADDR: ":8181"
|
|
# volumes:
|
|
# - /etc/timezone:/etc/timezone:ro
|
|
# - /etc/localtime:/etc/localtime:ro
|
|
# labels:
|
|
# - "traefik.enable=true"
|
|
# ## HTTP Routers
|
|
# - "traefik.http.routers.dozzle-rtr-http.entrypoints=http"
|
|
# - "traefik.http.routers.dozzle-rtr-http.rule=Host(`dozzle.jingoh.fr`)"
|
|
# - "traefik.http.routers.dozzle-rtr-http.middlewares=redirect-to-https"
|
|
# ## HTTPS Routers
|
|
# - "traefik.http.routers.dozzle-rtr.entrypoints=https"
|
|
# - "traefik.http.routers.dozzle-rtr.rule=Host(`dozzle.jingoh.fr`)"
|
|
# ## Services
|
|
# - "traefik.http.routers.dozzle-rtr.service=dozzle-svc"
|
|
# - "traefik.http.services.dozzle-svc.loadbalancer.server.port=8080"
|
|
# ## Middlewares
|
|
# - "traefik.http.routers.dozzle-rtr.middlewares=dozzle-basic"
|
|
# - "traefik.http.middlewares.dozzle-basic.basicauth.users=jingohdoz:$$2y$$05$$e5x192gFu6uBevLcZNNU9eEWnekh3p.F8cffX19EBTLMwBQoqHcwW"
|
|
# ## TLS
|
|
# - "traefik.http.routers.dozzle-rtr.tls.certresolver=letsencrypt-resolver"
|
|
|
|
# # conf file in/gitea/gitea/gitea/conf/app.ini
|
|
# # [metrics]
|
|
# # [log]
|
|
# gitea:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: gitea/gitea:latest
|
|
# container_name: gitea
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.170
|
|
# environment:
|
|
# TZ: Europe/Paris
|
|
# PUID: 1000
|
|
# PGID: 1000
|
|
# GITEA__database__DB_TYPE: postgres
|
|
# GITEA__database__HOST: gitea-db:5432
|
|
# GITEA__server__DOMAIN: gitea.jingoh.fr
|
|
# GITEA__server__ROOT_URL: https://gitea.jingoh.fr
|
|
# GITEA__server__HTTP_PORT: 3000
|
|
# GITEA__server__START_SSH_SERVER: "true"
|
|
# GITEA__server__SSH_PORT: 443
|
|
# GITEA__server__SSH_LISTEN_PORT: 2222
|
|
# GITEA__server__SSH_DOMAIN: gitea.jingoh.fr
|
|
# GITEA__repository__USE_COMPAT_SSH_URI: "false"
|
|
# GITEA__database__NAME: gitea
|
|
# GITEA__database__USER: root
|
|
# GITEA__database__PASSWD: uu~Y8aic
|
|
# volumes:
|
|
# - ./logs/homeserver/gitea.log:/data/gitea/log/gitea.log
|
|
# - ./gitea/gitea:/data
|
|
# - /etc/timezone:/etc/timezone:ro
|
|
# - /etc/localtime:/etc/localtime:ro
|
|
# labels:
|
|
# - "traefik.enable=true"
|
|
# ## HTTP Routers
|
|
# - "traefik.http.routers.gitea-rtr-http.entrypoints=http"
|
|
# - "traefik.http.routers.gitea-rtr-http.rule=Host(`gitea.jingoh.fr`)"
|
|
# - "traefik.http.routers.gitea-rtr-http.middlewares=redirect-to-https"
|
|
# ## HTTPS Routers
|
|
# - "traefik.http.routers.gitea-rtr.entrypoints=https"
|
|
# - "traefik.http.routers.gitea-rtr.rule=Host(`gitea.jingoh.fr`)"
|
|
# ## Middlewares
|
|
# # git push doesn't work with basicauth
|
|
# #- "traefik.http.routers.gitea-rtr.middlewares=gitea-basic"
|
|
# #- "traefik.http.middlewares.gitea-basic.basicauth.users=jingohgit:$$2y$$05$$iBHOV.3zFZFTp4kRqD7.I.hQ/Rx3qeHoUjq/3KztwzyU8t1BIK/ne"
|
|
# ## Services
|
|
# - "traefik.http.routers.gitea-rtr.service=gitea-svc"
|
|
# - "traefik.http.services.gitea-svc.loadbalancer.server.port=3000"
|
|
# ## SSH
|
|
# - "traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)"
|
|
# - "traefik.tcp.routers.gitea-ssh.entrypoints=https"
|
|
# - "traefik.tcp.routers.gitea-ssh.service=gitea-ssh-svc"
|
|
# - "traefik.tcp.services.gitea-ssh-svc.loadbalancer.server.port=2222"
|
|
# ## TLS
|
|
# - "traefik.http.routers.gitea-rtr.tls.certresolver=letsencrypt-resolver"
|
|
|
|
# gitea-db:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: postgres:14
|
|
# container_name: gitea-db
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.171
|
|
# environment:
|
|
# TZ: Europe/Paris
|
|
# PUID: 1000
|
|
# PGID: 1000
|
|
# POSTGRES_USER: root
|
|
# POSTGRES_PASSWORD: uu~Y8aic
|
|
# POSTGRES_DB: gitea
|
|
# volumes:
|
|
# - ./gitea/gitea-db:/var/lib/postgresql/data
|
|
# - /etc/timezone:/etc/timezone:ro
|
|
# - /etc/localtime:/etc/localtime:ro
|
|
# labels:
|
|
# - traefik.enable=false
|
|
|
|
# #https://github.com/ngoduykhanh/wireguard-ui/blob/master/docker-compose.yaml -> wireguard-ui
|
|
# wireguard:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: lscr.io/linuxserver/wireguard:latest
|
|
# container_name: wireguard
|
|
# cap_add:
|
|
# - NET_ADMIN
|
|
# - SYS_MODULE
|
|
# environment:
|
|
# TZ: Europe/Paris
|
|
# PUID: 1000
|
|
# PGID: 1000
|
|
# SERVERURL: 163.172.84.28 #optional
|
|
# SERVERPORT: 443 #optional
|
|
# PEERS: 2 #optional
|
|
# PEERDNS: auto #optional
|
|
# INTERNAL_SUBNET: 10.13.13.0 #optional
|
|
# ALLOWEDIPS: 0.0.0.0/0 #optional
|
|
# LOG_CONFS: "true" #optional
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.173
|
|
# volumes:
|
|
# - ./wireguard/config:/config
|
|
# - ./wireguard/lib/modules:/lib/modules
|
|
# - /etc/timezone:/etc/timezone:ro
|
|
# - /etc/localtime:/etc/localtime:ro
|
|
# sysctls:
|
|
# - net.ipv4.conf.all.src_valid_mark=1
|
|
# labels:
|
|
# - "traefik.enable=true"
|
|
# ## UDP Routers
|
|
# - "traefik.udp.routers.wireguard-rtr.entrypoints=wireguard"
|
|
# - "traefik.udp.services.wireguard.loadbalancer.server.port=51820"
|
|
# depends_on:
|
|
# - traefik
|
|
|
|
# # # Grafana - Graphical data visualization
|
|
# ## Reset password command-line -> grafana-cli $username reset-admin-password $password
|
|
# ## Enable log file with rotate (/etc/grafana/grafana.ini)
|
|
# grafana:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: grafana/grafana:latest
|
|
# container_name: grafana
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.175
|
|
# # ports:
|
|
# # - "$GRAFANA_PORT:3000"
|
|
# user: root
|
|
# volumes:
|
|
# - ./grafana/lib:/var/lib/grafana
|
|
# - ./logs/homeserver/grafana.log:/var/log/grafana/grafana.log
|
|
# environment:
|
|
# TZ: Europe/Paris
|
|
# PUID: 1000
|
|
# PGID: 1000
|
|
# GF_INSTALL_PLUGINS: "grafana-clock-panel,grafana-simple-json-datasource,grafana-worldmap-panel,grafana-piechart-panel"
|
|
# labels:
|
|
# - "traefik.enable=true"
|
|
# ## HTTP Routers
|
|
# - "traefik.http.routers.grafana-rtr-http.entrypoints=http"
|
|
# - "traefik.http.routers.grafana-rtr-http.rule=Host(`grafana.jingoh.fr`)"
|
|
# - "traefik.http.routers.grafana-rtr-http.middlewares=redirect-to-https"
|
|
# ## HTTPS Routers
|
|
# - "traefik.http.routers.grafana-rtr.entrypoints=https"
|
|
# - "traefik.http.routers.grafana-rtr.rule=Host(`grafana.jingoh.fr`)"
|
|
# ## Services
|
|
# - "traefik.http.routers.grafana-rtr.service=grafana-svc"
|
|
# - "traefik.http.services.grafana-svc.loadbalancer.server.port=3000"
|
|
# ## TLS
|
|
# - "traefik.http.routers.grafana-rtr.tls.certresolver=letsencrypt-resolver"
|
|
# ## Middlewares
|
|
# - "traefik.http.routers.grafana-rtr.middlewares=grafana-basic"
|
|
# - "traefik.http.middlewares.grafana-basic.basicauth.users=jingohgraf:$$2y$$05$$DMxSbnKhLv0zW2qYzMpkj.idi88EsFsIdgKoYPzFpxo9ErDHLYCAi"
|
|
# # NEEDED IF CONFLICTS BETWEEN BASICAUTH AND APP LOGIN PAGE
|
|
# - "traefik.http.middlewares.grafana-basic.basicauth.removeheader=true"
|
|
|
|
# prometheus:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: prom/prometheus:latest
|
|
# container_name: prometheus
|
|
# user: root
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.176
|
|
# volumes:
|
|
# - ./prometheus/prometheus:/etc/prometheus/
|
|
# - ./prometheus/prometheus_data:/prometheus
|
|
# command:
|
|
# - '--config.file=/etc/prometheus/prometheus.yml'
|
|
# - '--storage.tsdb.path=/prometheus'
|
|
# - '--web.console.libraries=/usr/share/prometheus/console_libraries'
|
|
# - '--web.console.templates=/usr/share/prometheus/consoles'
|
|
# labels:
|
|
# - "traefik.enable=true"
|
|
# ## HTTP Routers
|
|
# - "traefik.http.routers.prometheus-rtr-http.entrypoints=http"
|
|
# - "traefik.http.routers.prometheus-rtr-http.rule=Host(`prometheus.jingoh.fr`)"
|
|
# - "traefik.http.routers.prometheus-rtr-http.middlewares=redirect-to-https"
|
|
# # HTTPS
|
|
# - "traefik.http.routers.prometheus-rtr.entrypoints=https"
|
|
# - "traefik.http.routers.prometheus-rtr.rule=Host(`prometheus.jingoh.fr`)"
|
|
# - "traefik.http.routers.prometheus-rtr.service=prometheus-svc"
|
|
# - "traefik.http.services.prometheus-svc.loadbalancer.server.port=9090"
|
|
# - "traefik.docker.network=t2_proxy"
|
|
# ## Middlewares
|
|
# - "traefik.http.routers.prometheus-rtr.middlewares=prometheus-basic"
|
|
# - "traefik.http.middlewares.prometheus-basic.basicauth.users=jingohprom:$$2y$$05$$7cf/zuj8lI4Gt9K3xfWEKu.hKwzi1lxsjImgvSc9tHZ0QqHOxagH."
|
|
# ## TLS
|
|
# - "traefik.http.routers.prometheus-rtr.tls.certresolver=letsencrypt-resolver"
|
|
|
|
# # https://pieterhollander.nl/post/bitwarden/
|
|
# # https://github.com/dani-garcia/vaultwarden/blob/main/.env.template
|
|
# # https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples
|
|
# vaultwarden:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: vaultwarden/server:latest
|
|
# container_name: vault
|
|
# environment:
|
|
# TZ: Europe/Paris
|
|
# PUID: 1000
|
|
# PGID: 1000
|
|
# WEBSOCKET_ENABLED: 1
|
|
# ROCKET_PORT: 80
|
|
# DOMAIN: https://vault.jingoh.fr
|
|
# ADMIN_TOKEN: BwI1E5Sqb6clUpsAfXdlkMnQuzwTh7pFPpqK6V8RII/CuBqgbNhj325ynL40dfjs
|
|
# LOG_FILE: /var/log/vaultwarden.log
|
|
# SIGNUPS_ALLOWED: "false"
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.177
|
|
# volumes:
|
|
# - ./vaultwarden:/data
|
|
# - ./logs/homeserver/vaultwarden.log:/var/log/vaultwarden.log
|
|
# labels:
|
|
# - traefik.enable=true
|
|
# ## HTTP Routers
|
|
# - "traefik.http.routers.bitwarden-rtr-http.entrypoints=http"
|
|
# - "traefik.http.routers.bitwarden-rtr-http.rule=Host(`bitwarden.jingoh.fr`)"
|
|
# - "traefik.http.routers.bitwarden-rtr-http.middlewares=redirect-to-https"
|
|
# ## HTTPS Routers
|
|
# - traefik.docker.network=t2_proxy
|
|
# - traefik.http.routers.bitwarden-rtr.entrypoints=https
|
|
# - traefik.http.routers.bitwarden-rtr.rule=Host(`vault.jingoh.fr`)
|
|
# - traefik.http.routers.bitwarden-rtr.tls=true
|
|
# - traefik.http.routers.bitwarden-rtr.service=bitwarden-svc
|
|
# - traefik.http.services.bitwarden-svc.loadbalancer.server.port=80
|
|
# - traefik.http.routers.bitwarden-websocket-rtr.entrypoints=https
|
|
# - traefik.http.routers.bitwarden-websocket-rtr.rule=Host(`vault.jingoh.fr`) && Path(`/notifications/hub`)
|
|
# - traefik.http.routers.bitwarden-websocket-rtr.service=bitwarden-websocket-svc
|
|
# - traefik.http.services.bitwarden-websocket-svc.loadbalancer.server.port=3012
|
|
# ## TLS
|
|
# - "traefik.http.routers.bitwarden-rtr.tls.certresolver=letsencrypt-resolver"
|
|
# - "traefik.http.routers.bitwarden-websocket-rtr.tls.certresolver=letsencrypt-resolver"
|
|
|
|
# homepage:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: ghcr.io/gethomepage/homepage:latest
|
|
# container_name: homepage
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.178
|
|
# volumes:
|
|
# - ./homepage/homepage:/app/config
|
|
# - ./homepage/icons:/app/public/icons
|
|
# - "/var/run/docker.sock:/var/run/docker.sock"
|
|
# labels:
|
|
# - traefik.enable=true
|
|
# ## HTTP Routers
|
|
# - "traefik.http.routers.homepage-rtr-http.entrypoints=http"
|
|
# - "traefik.http.routers.homepage-rtr-http.rule=Host(`homepage.jingoh.fr`)"
|
|
# - "traefik.http.routers.homepage-rtr-http.middlewares=redirect-to-https"
|
|
# ## HTTPS Routers
|
|
# - traefik.docker.network=t2_proxy
|
|
# - traefik.http.routers.homepage-rtr.entrypoints=https
|
|
# - traefik.http.routers.homepage-rtr.rule=Host(`homepage.jingoh.fr`)
|
|
# - traefik.http.routers.homepage-rtr.tls=true
|
|
# - traefik.http.routers.homepage-rtr.service=homepage-svc
|
|
# - traefik.http.services.homepage-svc.loadbalancer.server.port=3000
|
|
# ## TLS
|
|
# - "traefik.http.routers.homepage-rtr.tls.certresolver=letsencrypt-resolver"
|
|
|
|
# registry:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: registry:2
|
|
# container_name: registry
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.179
|
|
# environment:
|
|
# REGISTRY_STORAGE_DELETE_ENABLED: 'true'
|
|
# volumes:
|
|
# - ./registry/data:/var/lib/registry
|
|
|
|
# registry-ui:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: joxit/docker-registry-ui:latest
|
|
# expose:
|
|
# - 80
|
|
# environment:
|
|
# - DELETE_IMAGES=true
|
|
# - NGINX_PROXY_PASS_URL=http://registry:5000
|
|
# - SINGLE_REGISTRY=true
|
|
# - REGISTRY_TITLE= 🧱 Jingoh Container Registry 🧱
|
|
# container_name: registry-ui
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.180
|
|
# depends_on:
|
|
# - registry
|
|
# labels:
|
|
# - traefik.enable=true
|
|
# ## HTTP Routers
|
|
# - traefik.http.routers.registry-rtr-http.entrypoints=http
|
|
# - traefik.http.routers.registry-rtr-http.rule=Host(`registry.jingoh.fr`)
|
|
# - traefik.http.routers.registry-rtr-http.middlewares=redirect-to-https
|
|
# ## HTTPS Routers
|
|
# - traefik.docker.network=t2_proxy
|
|
# - traefik.http.routers.registry-rtr.entrypoints=https
|
|
# - traefik.http.routers.registry-rtr.rule=Host(`registry.jingoh.fr`)
|
|
# - traefik.http.routers.registry-rtr.tls=true
|
|
# - traefik.http.routers.registry-rtr.service=registry-svc
|
|
# - traefik.http.services.registry-svc.loadbalancer.server.port=80
|
|
# ## TLS
|
|
# - traefik.http.routers.registry-rtr.tls.certresolver=letsencrypt-resolver
|
|
# ## Middlewares
|
|
# - "traefik.http.routers.registry-rtr.middlewares=registry-basic"
|
|
# - "traefik.http.middlewares.registry-basic.basicauth.users=jingohdocker:$$2y$$05$$dEBjltxSmPyUuQG3ewQXSu8ez97J8562/XhoDw6AoLbmc3ZQTKg4C"
|
|
|
|
# alert:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: binwiederhier/ntfy:latest
|
|
# container_name: alert
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.181
|
|
# volumes:
|
|
# - ./alertmanager/config/alertmanager.yml:/etc/ntfy/server.yml
|
|
# - ./alertmanager/cache/:/var/cache/ntfy/
|
|
# command: serve
|
|
# expose:
|
|
# - 80
|
|
# labels:
|
|
# - traefik.enable=true
|
|
# ## HTTP Routers
|
|
# - traefik.http.routers.alertmanager-rtr-http.entrypoints=http
|
|
# - traefik.http.routers.alertmanager-rtr-http.rule=Host(`alert.jingoh.fr`)
|
|
# - traefik.http.routers.alertmanager-rtr-http.middlewares=redirect-to-https
|
|
# ## HTTPS Routers
|
|
# - traefik.docker.network=t2_proxy
|
|
# - traefik.http.routers.alertmanager-rtr.entrypoints=https
|
|
# - traefik.http.routers.alertmanager-rtr.rule=Host(`alert.jingoh.fr`)
|
|
# - traefik.http.routers.alertmanager-rtr.tls=true
|
|
# - traefik.http.routers.alertmanager-rtr.service=alertmanager-svc
|
|
# - traefik.http.services.alertmanager-svc.loadbalancer.server.port=80
|
|
# ## TLS
|
|
# - traefik.http.routers.alertmanager-rtr.tls.certresolver=letsencrypt-resolver
|
|
# ## Middlewares
|
|
# - "traefik.http.routers.alertmanager-rtr.middlewares=alertmanager-basic"
|
|
# - "traefik.http.middlewares.alertmanager-basic.basicauth.users=jingohalert:$$2y$$05$$dEBjltxSmPyUuQG3ewQXSu8ez97J8562/XhoDw6AoLbmc3ZQTKg4C"
|
|
|
|
# exporter:
|
|
# image: prom/node-exporter:latest
|
|
# container_name: exporter
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# user: root
|
|
# volumes:
|
|
# - /:/host:ro
|
|
# command:
|
|
# - '--path.procfs=/host/proc'
|
|
# - '--path.rootfs=/rootfs'
|
|
# - '--path.sysfs=/host/sys'
|
|
# - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.183
|
|
# labels:
|
|
# - traefik.enable=true
|
|
# ## HTTP Routers
|
|
# - traefik.http.routers.exporter-rtr-http.entrypoints=http
|
|
# - traefik.http.routers.exporter-rtr-http.rule=Host(`exporter.jingoh.fr`)
|
|
# - traefik.http.routers.exporter-rtr-http.middlewares=redirect-to-https
|
|
# ## HTTPS Routers
|
|
# - traefik.docker.network=t2_proxy
|
|
# - traefik.http.routers.exporter-rtr.entrypoints=https
|
|
# - traefik.http.routers.exporter-rtr.rule=Host(`exporter.jingoh.fr`)
|
|
# - traefik.http.routers.exporter-rtr.tls=true
|
|
# - traefik.http.routers.exporter-rtr.service=exporter-svc
|
|
# - traefik.http.services.exporter-svc.loadbalancer.server.port=9100
|
|
# ## TLS
|
|
# - traefik.http.routers.exporter-rtr.tls.certresolver=letsencrypt-resolver
|
|
# ## Middlewares
|
|
# - "traefik.http.routers.exporter-rtr.middlewares=exporter-basic"
|
|
# - "traefik.http.middlewares.exporter-basic.basicauth.users=jingohblack:$$2y$$05$$Y8dT7mF46c0aSOyDb7Jq9.TisInl3dzuWSSwkXM08r1Q331HQ/b.C"
|
|
|
|
# ara-ui:
|
|
# image: recordsansible/ara-api:latest
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# environment:
|
|
# - ARA_ALLOWED_HOSTS=["ara.jingoh.fr", "localhost"]
|
|
# - ARA_DATABASE_ENGINE=django.db.backends.postgresql
|
|
# - ARA_DATABASE_HOST=ara-db
|
|
# - ARA_DATABASE_NAME=ara
|
|
# - ARA_DATABASE_PASSWORD=ara
|
|
# - ARA_DATABASE_USER=ara
|
|
# - ARA_DATABASE_PORT=5432
|
|
# container_name: ara-ui
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.184
|
|
# labels:
|
|
# - traefik.enable=true
|
|
# ## HTTP Routers
|
|
# - traefik.http.routers.ansible-rtr-http.entrypoints=http
|
|
# - traefik.http.routers.ansible-rtr-http.rule=Host(`ara.jingoh.fr`)
|
|
# - traefik.http.routers.ansible-rtr-http.middlewares=redirect-to-https
|
|
# ## HTTPS Routers
|
|
# - traefik.docker.network=t2_proxy
|
|
# - traefik.http.routers.ansible-rtr.entrypoints=https
|
|
# - traefik.http.routers.ansible-rtr.rule=Host(`ara.jingoh.fr`)
|
|
# - traefik.http.routers.ansible-rtr.tls=true
|
|
# - traefik.http.routers.ansible-rtr.service=ansible-svc
|
|
# - traefik.http.services.ansible-svc.loadbalancer.server.port=8000
|
|
# ## TLS
|
|
# - traefik.http.routers.ansible-rtr.tls.certresolver=letsencrypt-resolver
|
|
# ## Middlewares
|
|
# - "traefik.http.routers.ansible-rtr.middlewares=ansible-basic"
|
|
# - "traefik.http.middlewares.ansible-basic.basicauth.users=jingohblack:$$2y$$05$$Y8dT7mF46c0aSOyDb7Jq9.TisInl3dzuWSSwkXM08r1Q331HQ/b.C"
|
|
# - "traefik.http.middlewares.ansible-basic.basicauth.removeheader=true"
|
|
|
|
# ara-db:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# image: postgres:14
|
|
# container_name: ara-db
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.185
|
|
# environment:
|
|
# TZ: Europe/Paris
|
|
# PUID: 1000
|
|
# PGID: 1000
|
|
# POSTGRES_USER: ara
|
|
# POSTGRES_PASSWORD: ara
|
|
# POSTGRES_DB: ara
|
|
# volumes:
|
|
# - ./ara:/var/lib/postgresql/data
|
|
# - /etc/timezone:/etc/timezone:ro
|
|
# - /etc/localtime:/etc/localtime:ro
|
|
# labels:
|
|
# - traefik.enable=false
|
|
|
|
|
|
|
|
# semaphore-db:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# container_name: semaphore-db
|
|
# image: postgres:14
|
|
# hostname: postgres
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.186
|
|
# volumes:
|
|
# - ./semaphore/semaphore-db:/var/lib/postgresql/data
|
|
# environment:
|
|
# POSTGRES_USER: semaphore
|
|
# POSTGRES_PASSWORD: uu~Y8aic
|
|
# POSTGRES_DB: semaphore
|
|
# labels:
|
|
# - traefik.enable=false
|
|
|
|
# semaphore:
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# expose:
|
|
# - 3000
|
|
# container_name: semaphore
|
|
# image: semaphoreui/semaphore:latest
|
|
# user: "${UID}:${GID}"
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.187
|
|
# environment:
|
|
# - SEMAPHORE_DB_USER=semaphore
|
|
# - SEMAPHORE_DB_PASS=uu~Y8aic
|
|
# - SEMAPHORE_DB_HOST=semaphore-db
|
|
# - SEMAPHORE_DB_PORT=5432
|
|
# - SEMAPHORE_DB_DIALECT=postgres
|
|
# - SEMAPHORE_DB=semaphore
|
|
# - SEMAPHORE_PLAYBOOK_PATH=/tmp/semaphore/
|
|
# - SEMAPHORE_ADMIN_PASSWORD=uu~Y8aic
|
|
# - SEMAPHORE_ADMIN_NAME=admin
|
|
# - SEMAPHORE_ADMIN_EMAIL=admin@localhost
|
|
# - SEMAPHORE_ADMIN=admin
|
|
# - SEMAPHORE_ACCESS_KEY_ENCRYPTION=ShbKLtVWr5yB/G1WO3DOEU5Il0JBlcN//4mpErpSwpQ= # add to your access key encryption !
|
|
# - ANSIBLE_HOST_KEY_CHECKING=false # (optional) change to true if you want to enable host key checking
|
|
# volumes:
|
|
# - ./semaphore/inventory/:/inventory:ro
|
|
# - ./semaphore/authorized-keys/:/authorized-keys:ro
|
|
# - ./semaphore/config/:/etc/semaphore:rw
|
|
# depends_on:
|
|
# - semaphore-db
|
|
# labels:
|
|
# - traefik.enable=true
|
|
# ## HTTP Routers
|
|
# - traefik.http.routers.semaphore-rtr-http.entrypoints=http
|
|
# - traefik.http.routers.semaphore-rtr-http.rule=Host(`semaphore.jingoh.fr`)
|
|
# - traefik.http.routers.semaphore-rtr-http.middlewares=redirect-to-https
|
|
# ## HTTPS Routers
|
|
# - traefik.docker.network=t2_proxy
|
|
# - traefik.http.routers.semaphore-rtr.entrypoints=https
|
|
# - traefik.http.routers.semaphore-rtr.rule=Host(`semaphore.jingoh.fr`)
|
|
# - traefik.http.routers.semaphore-rtr.tls=true
|
|
# - traefik.http.routers.semaphore-rtr.service=semaphore-svc
|
|
# - traefik.http.services.semaphore-svc.loadbalancer.server.port=3000
|
|
# # ## WEBSOCKET
|
|
# # - traefik.http.routers.semaphore-websocket-rtr.entrypoints=https
|
|
# # - traefik.http.routers.semaphore-websocket-rtr.rule=Host(`semaphore.jingoh.fr`) && Path(`/api/ws`)
|
|
# # - traefik.http.routers.semaphore-websocket-rtr.service=semaphore-websocket-svc
|
|
# # - traefik.http.services.semaphore-websocket-svc.loadbalancer.server.port=3000
|
|
# ## TLS
|
|
# - traefik.http.routers.semaphore-rtr.tls.certresolver=letsencrypt-resolver
|
|
# # ## Middlewares
|
|
# # - "traefik.http.routers.semaphore-rtr.middlewares=semaphore-basic"
|
|
# # - "traefik.http.middlewares.semaphore-basic.basicauth.users=jingohblack:$$2y$$05$$Y8dT7mF46c0aSOyDb7Jq9.TisInl3dzuWSSwkXM08r1Q331HQ/b.C"
|
|
# # - "traefik.http.middlewares.semaphore-basic.basicauth.removeheader=true"
|
|
|
|
# # qBittorrent - Torrent downloader
|
|
# # Needs trailing / if using PathPrefixStrip
|
|
# # qbittorrent:
|
|
# # <<: *common-keys-apps # See EXTENSION FIELDS at the top
|
|
# # image: lscr.io/linuxserver/qbittorrent:latest
|
|
# # container_name: qbittorrent
|
|
# # networks:
|
|
# # t2_proxy:
|
|
# # ipv4_address: 192.168.90.174
|
|
# # volumes:
|
|
# # - ./qbittorrent:/config
|
|
# # - ./downloads:/downloads
|
|
# # environment:
|
|
# # # TZ: Europe/Paris
|
|
# # PUID: 1000
|
|
# # PGID: 1000
|
|
# # # UMASK_SET: 002
|
|
# # labels:
|
|
# # - "traefik.enable=true"
|
|
# # ## HTTP Routers
|
|
# # - "traefik.http.routers.qbittorrent-rtr.entrypoints=https"
|
|
# # - "traefik.http.routers.qbittorrent-rtr.rule=Host(`qbit.jingoh.fr`)"
|
|
# # ## Middlewares
|
|
# # - "traefik.http.routers.qbittorrent-rtr.middlewares=test-auth"
|
|
# # ## Services
|
|
# # - "traefik.http.routers.qbittorrent-rtr.service=qbittorrent-svc"
|
|
# # - "traefik.http.services.qbittorrent-svc.loadbalancer.server.port=8168"
|
|
# # # Anti ddos
|
|
# # - "traefik.http.middlewares.qbittorrent-rtr-ratelimit.ratelimit.average=10"
|
|
# # - "traefik.http.middlewares.qbittorrent-rtr-ratelimit.ratelimit.burst=10"
|
|
# # - "traefik.http.middlewares.qbittorrent-rtr-ratelimit.ratelimit.period=1"
|
|
# # - "traefik.http.routers.qbittorrent-rtr-ratelimit.middlewares=qbittorrent-rtr-ratelimit@docker"
|
|
|
|
# # docker run -p 9925:80 -v ./mealie:/app/data/ hkotel/mealie:latest
|
|
|
|
# mealie:
|
|
# container_name: mealie
|
|
# image: hkotel/mealie:latest
|
|
# user: "${UID}:${GID}"
|
|
# environment:
|
|
# - DEFAULT_EMAIL=stephane.gratiasquiquandon@gmail.com
|
|
# - DEFAULT_GROUP=manger
|
|
# - BASE_URL=mealie.jingoh.fr
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.188
|
|
# volumes:
|
|
# - ./mealie/:/app/data/
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true # See EXTENSION FIELDS at the top
|
|
# labels:
|
|
# - traefik.enable=true
|
|
# ## HTTPS Routers
|
|
# - traefik.docker.network=t2_proxy
|
|
# - traefik.http.routers.mealie-rtr.entrypoints=https
|
|
# - traefik.http.routers.mealie-rtr.rule=Host(`mealie.jingoh.fr`)
|
|
# - traefik.http.routers.mealie-rtr.tls=true
|
|
# - traefik.http.routers.mealie-rtr.service=mealie-svc
|
|
# - traefik.http.services.mealie-svc.loadbalancer.server.port=80
|
|
# ## TLS
|
|
# - traefik.http.routers.mealie-rtr.tls.certresolver=letsencrypt-resolver
|
|
|
|
# # homarr:
|
|
# # container_name: homarr
|
|
# # image: ghcr.io/ajnart/homarr:latest
|
|
# # restart: unless-stopped
|
|
# # networks:
|
|
# # t2_proxy:
|
|
# # ipv4_address: 192.168.90.189
|
|
# # volumes:
|
|
# # - ./homarr/configs:/app/data/configs
|
|
# # - ./homarr/icons:/app/public/icons
|
|
# # labels:
|
|
# # - traefik.enable=true
|
|
# # ## HTTPS Routers
|
|
# # - traefik.docker.network=t2_proxy
|
|
# # - traefik.http.routers.homarr-rtr.entrypoints=https
|
|
# # - traefik.http.routers.homarr-rtr.rule=Host(`homarr.jingoh.fr`)
|
|
# # - traefik.http.routers.homarr-rtr.tls=true
|
|
# # - traefik.http.routers.homarr-rtr.service=homarr-svc
|
|
# # - traefik.http.services.homarr-svc.loadbalancer.server.port=7575
|
|
# # ## TLS
|
|
# # - traefik.http.routers.homarr-rtr.tls.certresolver=letsencrypt-resolver
|
|
# # ## Middleware IP whitelist
|
|
# # - traefik.http.middlewares.dashboard-ipwhitelist.ipwhitelist.sourcerange=192.168.91.1/32
|
|
# # - traefik.http.routers.homarr-rtr.middlewares=dashboard-ipwhitelist
|
|
|
|
# portainer:
|
|
# container_name: portainer
|
|
# image: portainer/portainer-ce:latest
|
|
# restart: always
|
|
# security_opt:
|
|
# - no-new-privileges:true
|
|
# networks:
|
|
# t2_proxy:
|
|
# ipv4_address: 192.168.90.190
|
|
# volumes:
|
|
# - /etc/localtime:/etc/localtime:ro
|
|
# - /var/run/docker.sock:/var/run/docker.sock:ro
|
|
# - ./portainer/:/data/
|
|
# labels:
|
|
# - traefik.enable=true
|
|
# ## HTTPS Routers
|
|
# - traefik.docker.network=t2_proxy
|
|
# - traefik.http.routers.portainer-rtr.entrypoints=https
|
|
# - traefik.http.routers.portainer-rtr.rule=Host(`docker.jingoh.fr`)
|
|
# - traefik.http.routers.portainer-rtr.tls=true
|
|
# - traefik.http.routers.portainer-rtr.service=portainer-svc
|
|
# - traefik.http.services.portainer-svc.loadbalancer.server.port=9000
|
|
# ## TLS
|
|
# - traefik.http.routers.homarr-rtr.tls.certresolver=letsencrypt-resolver
|
|
# ## Middleware IP whitelist
|
|
# # - traefik.http.middlewares.dashboard-ipwhitelist.ipwhitelist.sourcerange=192.168.91.1/32
|
|
# # - traefik.http.routers.homarr-rtr.middlewares=dashboard-ipwhitelist |