▍Все контейнеры в docker-compose.yml¶
Подготовительный этап¶
Создадим структуру директорий:
Зададим переменные с нашими директориями:
/srv/docker/.env
DIR_CONF=/srv/docker/conf
DIR_BUILD=/srv/docker/build
DIR_DATA=/srv/data
DIR_WWW=/srv/www
DIR_LOGS=/srv/logs
Docker-compose.yml¶
Устанавливаем вторую версию Docker compose
$ sudo curl -SL https://github.com/docker/compose/releases/download/v2.15.1/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
$ sudo chmod +x /usr/local/bin/docker-compose
$ sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
$ docker-compose -v
Docker Compose version v2.15.1
/srv/docker/docker-compose.yml
# Пропишем версию
version: "3.9"
# Перечислим сервисы
services:
authelia:
image: authelia/authelia
container_name: authelia
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- $DIR_CONF/authelia:/config
environment:
- TZ=Europe/Moscow
labels:
- 'traefik.enable=true'
- 'traefik.http.routers.authelia.rule=Host(`authelia.example.ru`)'
- 'traefik.http.routers.authelia.entrypoints=https'
- 'traefik.http.routers.authelia.tls=true'
- 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://authelia.example.ru/'
- 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
- 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email'
- 'traefik.http.middlewares.authelia-basic.forwardauth.address=http://authelia:9091/api/verify?auth=basic'
- 'traefik.http.middlewares.authelia-basic.forwardauth.trustForwardHeader=true'
- 'traefik.http.middlewares.authelia-basic.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email'
traefik:
image: traefik:latest
container_name: traefik
deploy:
replicas: 1
restart_policy:
condition: on-failure
security_opt:
- no-new-privileges:true
ports:
- 192.168.0.111:80:80
- 192.168.0.111:443:443/tcp
- 192.168.0.111:443:443/udp
depends_on:
- authelia
environment:
- SELECTEL_API_TOKEN=EfRBHW6kKKDJfAd3ynSf7GEPZSesuXUJd
volumes:
- /etc/localtime:/etc/localtime:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
- $DIR_CONF/traefik/traefik.yml:/traefik.yml:ro
- $DIR_CONF/traefik/acme.json:/acme.json
- $DIR_CONF/traefik/custom/:/custom/:ro
labels:
- "traefik.enable=true"
- "traefik.http.routers.traefik.entrypoints=http"
- "traefik.http.routers.traefik.rule=Host(`traefik.example.ru`)"
- "traefik.http.middlewares.traefik-auth.basicauth.users=traefik:$$apr1$$2Zn1nUu4$$pkolhgkp1KRDht2do7N/1." # echo $(htpasswd -nb traefik passw0rd) | sed -e s/\\$/\\$\\$/g
- "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
- "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
- "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
- "traefik.http.routers.traefik-secure.entrypoints=https"
- "traefik.http.routers.traefik-secure.rule=Host(`traefik.example.ru`)"
- "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
- "traefik.http.routers.traefik-secure.tls=true"
- "traefik.http.routers.traefik-secure.tls.certresolver=selectel"
- "traefik.http.routers.traefik-secure.tls.domains[0].main=example.ru"
- "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.example.ru"
- "traefik.http.middlewares.WhitelistHome.ipwhitelist.sourcerange=172.18.0.0/24, 192.168.0.0/16, 172.20.0.0/24"
- "[email protected]"
### SITES
mysql:
image: mariadb:10.8
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: mysql
healthcheck:
test: ["CMD", "mysqladmin", "ping", "-S", "/var/lib/mysql/mysqld.sock", "--silent"]
interval: 5s
timeout: 5s
retries: 10
ports:
- "3306:3306"
volumes:
- $DIR_CONF/50-server.cnf:/etc/mysql/mariadb.conf.d/50-server.cnf
- $DIR_DATA/mysql:/var/lib/mysql
- /etc/localtime:/etc/localtime:ro
phpmyadmin:
image: phpmyadmin/phpmyadmin
container_name: phpmyadmin
environment:
- PMA_ARBITRARY=0
- PMA_HOSTS=mysql
- UPLOAD_LIMIT=100M
- HIDE_PHP_VERSION=true
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- $DIR_CONF/phpmyadmin/session:/sessions
- /etc/localtime:/etc/localtime:ro
labels:
- "traefik.enable=true"
- "traefik.http.routers.pma.tls=true"
- "traefik.http.routers.pma.rule=Host(`pma.example.ru`)"
- "traefik.http.routers.pma.middlewares=WhitelistHome"
- "traefik.http.services.pma.loadbalancer.server.port=80"
- "com.centurylinklabs.watchtower.enable=true"
nginx:
image: nginx:latest
container_name: nginx
deploy:
replicas: 1
restart_policy:
condition: on-failure
ports:
- "192.168.0.200:80:80"
volumes:
- $DIR_WWW:/www
- $DIR_CONF/nginx/misc:/etc/nginx/misc
- $DIR_CONF/nginx/nginx.conf:/etc/nginx/nginx.conf
- $DIR_CONF/nginx/conf.d:/etc/nginx/conf.d
- $DIR_CONF/nginx/sites-available:/etc/nginx/sites-available
- $DIR_CONF/nginx/sites-enabled:/etc/nginx/sites-enabled
- $DIR_LOGS/nginx:/var/log/nginx
- /etc/localtime:/etc/localtime:ro
depends_on:
- php56
- php7
labels:
- "traefik.enable=true"
- "traefik.http.routers.nginx.rule=Host(`example.ru`, `site.example.ru`)"
- "traefik.http.routers.nginx.entrypoints=https"
- "t[email protected]"
- "traefik.http.routers.nginx.tls=true"
- "traefik.http.services.nginx.loadbalancer.server.port=80"
- "com.centurylinklabs.watchtower.enable=true"
php56:
image: daffin/php5.6-fpm
build: $DIR_BUILD/php56
container_name: php56
restart: always
volumes:
- $DIR_WWW/site.example.ru:/www/site.example.ru
- $DIR_CONF/php-fpm/www.conf:/usr/local/etc/php-fpm.d/www.conf
- $DIR_LOGS/php-fpm/php56:/var/log/php
- /etc/localtime:/etc/localtime:ro
php7:
image: daffin/php7.3-fpm
build: $DIR_BUILD/php73
container_name: php7
restart: always
volumes:
- $DIR_WWW/example.ru:/www/example.ru
- $DIR_LOGS/php-fpm/php7:/var/log/php
- /etc/localtime:/etc/localtime:ro
api:
image: daffin/api.example.ru # node16-alpine
container_name: api
deploy:
replicas: 1
restart_policy:
condition: on-failure
labels:
- "traefik.enable=true"
- "traefik.http.routers.api.rule=Host(`api.example.ru`)"
- "traefik.http.routers.api.entrypoints=https"
- "traefik.http.routers.api.tls=true"
- "traefik.http.routers.api.middlewares=api,WhitelistHome"
- "traefik.http.middlewares.api.headers.accesscontrolalloworiginlist=https://test.example.ru,https://api.example.ru"
- "traefik.http.middlewares.api.headers.accesscontrolallowmethods=POST"
- "traefik.http.middlewares.api.headers.accesscontrolmaxage=100"
- "traefik.http.middlewares.api.headers.addvaryheader=true"
- "traefik.http.services.api.loadbalancer.server.port=3001"
- "com.centurylinklabs.watchtower.enable=true"
redis:
image: redis:5.0-alpine
container_name: redis
deploy:
replicas: 1
restart_policy:
condition: on-failure
command: redis-server --appendonly yes
healthcheck:
test: ["CMD", "redis-cli", "ping"]
volumes:
- $DIR_DATA/redis:/data
- /etc/localtime:/etc/localtime:ro
ports:
- "6379:6379"
trilium:
image: zadam/trilium:0.45-latest
container_name: trilium
deploy:
replicas: 1
restart_policy:
condition: on-failure
environment:
- TRILIUM_DATA_DIR=/data
volumes:
- $DIR_DATA/trilium:/data
labels:
- "traefik.enable=true"
- "traefik.http.routers.trilium.rule=Host(`notes.example.ru`)"
- "traefik.http.routers.trilium.entrypoints=https"
- "traefik.http.routers.trilium.tls=true"
- "[email protected]"
- "traefik.http.services.trilium.loadbalancer.server.port=8080"
- "com.centurylinklabs.watchtower.enable=true"
### DEVELOPMENT
codeserver:
image: codercom/code-server
container_name: codeserver
deploy:
replicas: 1
restart_policy:
condition: on-failure
command: --auth none --disable-telemetry
volumes:
- $DIR_CONF/codeserver/coder:/home/coder
- /etc/localtime:/etc/localtime:ro
labels:
- "traefik.enable=true"
- "traefik.http.routers.codeserver.tls=true"
- "traefik.http.routers.codeserver.rule=Host(`codeserver.example.ru`)"
- "traefik.http.routers.codeserver.middlewares=WhitelistHome,[email protected]"
- "traefik.http.services.codeserver.loadbalancer.server.port=8080"
- "com.centurylinklabs.watchtower.enable=true"
gitlab:
image: gitlab/gitlab-ce:latest
container_name: gitlab
deploy:
replicas: 1
restart_policy:
condition: on-failure
environment:
GITLAB_OMNIBUS_CONFIG: |
external_url 'https://gitlab.example.ru'
nginx['listen_port'] = 80
nginx['listen_https'] = false
nginx['proxy_set_headers'] = {
"X-Forwarded-Proto" => "https",
"X-Forwarded-Ssl" => "on"
}
gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp.mail.ru"
gitlab_rails['smtp_port'] = 465
gitlab_rails['smtp_user_name'] = "[email protected]"
gitlab_rails['smtp_password'] = "PASSWORD"
gitlab_rails['smtp_domain'] = "mail.ru"
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_enable_starttls_auto'] = false
gitlab_rails['smtp_tls'] = true
gitlab_rails['smtp_openssl_verify_mode'] = 'peer'
gitlab_rails['gitlab_email_from'] = '[email protected]'
gitlab_rails['gitlab_email_reply_to'] = '[email protected]'
ports:
- "2222:22"
shm_size: '256m'
volumes:
- $DIR_CONF/gitlab:/etc/gitlab
- $DIR_DATA/gitlab:/var/opt/gitlab
- /etc/localtime:/etc/localtime:ro
labels:
- "traefik.enable=true"
- "traefik.http.routers.gitlab.tls=true"
- "traefik.http.routers.gitlab.rule=Host(`gitlab.example.ru`)"
- "traefik.http.routers.gitlab.middlewares=WhitelistHome"
- "traefik.http.services.gitlab.loadbalancer.server.port=80"
- "com.centurylinklabs.watchtower.enable=true"
gitlab-runner:
image: 'gitlab/gitlab-runner:latest'
container_name: gitlab-runner
deploy:
replicas: 1
restart_policy:
condition: on-failure
links:
- gitlab
volumes:
- $DIR_CONF/gitlab-runner:/etc/gitlab-runner
- /var/run/docker.sock:/var/run/docker.sock
- /etc/localtime:/etc/localtime:ro
labels:
- "com.centurylinklabs.watchtower.enable=true"
### LOCAL ARCHIVE
archivebox:
image: archivebox/archivebox
container_name: archivebox
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- $DIR_DATA/archivebox:/data
environment:
- ALLOWED_HOSTS=*
- MEDIA_MAX_SIZE=750m
labels:
- "traefik.enable=true"
- "traefik.http.routers.archivebox.tls=true"
- "traefik.http.routers.archivebox.rule=Host(`archive.example.ru`)"
- "traefik.http.routers.archivebox.middlewares=WhitelistHome,[email protected]"
- "traefik.http.services.archivebox.loadbalancer.server.port=8000"
- "com.centurylinklabs.watchtower.enable=true"
archivebox-cron:
image: archivebox/archivebox
deploy:
replicas: 1
restart_policy:
condition: on-failure
command: schedule --foreground --every=hour --depth=1 https://getpocket.com/users/LOGIN/feed/all
volumes:
- $DIR_DATA/archivebox:/data
environment:
- USE_COLOR=True
- SHOW_PROGRESS=False
ytdl_material:
image: tzahi12345/youtubedl-material:latest
container_name: ytdl_material
deploy:
replicas: 1
restart_policy:
condition: on-failure
environment:
- ALLOW_CONFIG_MUTATIONS=true
- ytdl_use_local_db=true
- write_ytdl_config=true
volumes:
- $DIR_CONF/ytdl/appdata:/app/appdata
- $DIR_MEDIA/YOUTUBE:/app/video
- $DIR_CONF/ytdl/subscriptions:/app/subscriptions
- $DIR_CONF/ytdl/users:/app/users
labels:
- "traefik.enable=true"
- "traefik.http.routers.ytdl.rule=Host(`ytdl.example.ru`)"
- "traefik.http.routers.ytdl.entrypoints=https"
- "traefik.http.routers.ytdl.tls=true"
- "traefik.http.routers.ytdl.middlewares=WhitelistHome,[email protected]"
- "traefik.http.services.ytdl.loadbalancer.server.port=17442"
- "com.centurylinklabs.watchtower.enable=true"
kiwix:
image: kiwix/kiwix-serve
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: kiwix
volumes:
- $DIR_BIGDATA/wikipedia:/data
command:
wikipedia_ru_all_maxi_2022-12.zim
labels:
- "traefik.enable=true"
- "traefik.http.routers.kiwix.tls=true"
- "traefik.http.routers.kiwix.rule=Host(`wikipedia.example.ru`)"
- "traefik.http.routers.kiwix.middlewares=WhitelistHome"
- "traefik.http.services.kiwix.loadbalancer.server.port=8080"
calibre:
image: linuxserver/calibre:latest
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: calibre
volumes:
- $DIR_CONF/calibre:/config
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Moscow
labels:
- "traefik.enable=true"
- "traefik.http.routers.calibre.tls=true"
- "traefik.http.routers.calibre.rule=Host(`calibre.example.ru`)"
- "traefik.http.routers.calibre.middlewares=WhitelistHome"
- "traefik.http.services.calibre.loadbalancer.server.port=8081" # port=8080 web-gui xrdp
aptmirror:
image: daffin/apt-mirror
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: aptmirror
volumes:
- $DIR_DATA/apt-mirror:/apt-mirror
labels:
- "traefik.enable=true"
- "traefik.http.routers.aptmirror.tls=true"
- "traefik.http.routers.aptmirror.rule=Host(`mirror.example.ru`)"
- "traefik.http.routers.aptmirror.middlewares=WhitelistHome"
- "traefik.http.services.aptmirror.loadbalancer.server.port=80"
### MEDIA & GAMES
nextcloud:
image: nextcloud:latest
container_name: nextcloud
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- /etc/localtime:/etc/localtime:ro
- $DIR_WWW/nextcloud.example.ru:/var/www/html
- $DIR_DATA/nextcloud:/data
depends_on:
- mysql
- redis
environment:
REDIS_HOST: redis
MYSQL_HOST: mysql:3306
MYSQL_DATABASE: nextcloud
MYSQL_USER: nextcloud
MYSQL_PASSWORD: PASSWORD
TRUSTED_PROXIES: traefik
NEXTCLOUD_TRUSTED_DOMAINS: nextcloud.example.ru
NEXTCLOUD_DATA_DIR: /data
SMTP_HOST: smtp.mail.ru
SMTP_SECURE: tls
SMTP_PORT: 587
SMTP_NAME: [email protected]
SMTP_PASSWORD: PASSWORD
MAIL_FROM_ADDRESS: [email protected]
labels:
- "traefik.enable=true"
- "traefik.http.routers.nextcloud.middlewares=nextcloud,nextcloud_redirect"
- "traefik.http.routers.nextcloud.tls=true"
- "traefik.http.routers.nextcloud.rule=Host(`nextcloud.example.ru`)"
- "traefik.http.routers.nex[email protected],nextcloud_redirect"
- "traefik.http.middlewares.nextcloud.headers.customFrameOptionsValue=ALLOW-FROM https://nextcloud.example.ru"
- "traefik.http.middlewares.nextcloud.headers.contentSecurityPolicy=frame-ancestors 'self' nextcloud.example.ru *.example.ru"
- "traefik.http.middlewares.nextcloud_redirect.redirectregex.permanent=true"
- "traefik.http.middlewares.nextcloud_redirect.redirectregex.regex=https://(.*)/.well-known/(card|cal)dav"
- "traefik.http.middlewares.nextcloud_redirect.redirectregex.replacement=https://$${1}/remote.php/dav/"
photoprism:
image: photoprism/photoprism:latest
container_name: photoprism
deploy:
replicas: 1
restart_policy:
condition: on-failure
depends_on:
- mysql
security_opt:
- seccomp:unconfined
- apparmor:unconfined
environment:
PHOTOPRISM_ADMIN_PASSWORD: "" # INITIAL PASSWORD FOR "admin" USER, MINIMUM 8 CHARACTERS
PHOTOPRISM_AUTH_MODE: "public" # authentication mode (public, password)
PHOTOPRISM_SITE_URL: "https://photoprism.example.ru/" # public server URL incl http:// or https:// and /path, :port is optional
PHOTOPRISM_ORIGINALS_LIMIT: 5000 # file size limit for originals in MB (increase for high-res video)
PHOTOPRISM_HTTP_COMPRESSION: "gzip" # improves transfer speed and bandwidth utilization (none or gzip)
PHOTOPRISM_LOG_LEVEL: "info" # log level: trace, debug, info, warning, error, fatal, or panic
PHOTOPRISM_READONLY: "false" # do not modify originals directory (reduced functionality)
PHOTOPRISM_EXPERIMENTAL: "false" # enables experimental features
PHOTOPRISM_DISABLE_CHOWN: "false" # disables updating storage permissions via chmod and chown on startup
PHOTOPRISM_DISABLE_WEBDAV: "false" # disables built-in WebDAV server
PHOTOPRISM_DISABLE_SETTINGS: "false" # disables settings UI and API
PHOTOPRISM_DISABLE_TENSORFLOW: "true" # disables all features depending on TensorFlow
PHOTOPRISM_DISABLE_FACES: "true" # disables face detection and recognition (requires TensorFlow)
PHOTOPRISM_DISABLE_CLASSIFICATION: "true" # disables image classification (requires TensorFlow)
PHOTOPRISM_DISABLE_RAW: "false" # disables indexing and conversion of RAW files
PHOTOPRISM_RAW_PRESETS: "false" # enables applying user presets when converting RAW files (reduces performance)
PHOTOPRISM_JPEG_QUALITY: 85 # a higher value increases the quality and file size of JPEG images and thumbnails (25-100)
PHOTOPRISM_DETECT_NSFW: "false" # automatically flags photos as private that MAY be offensive (requires TensorFlow)
PHOTOPRISM_UPLOAD_NSFW: "true" # allows uploads that MAY be offensive (no effect without TensorFlow)
PHOTOPRISM_DATABASE_DRIVER: "mysql" # use MariaDB 10.5+ or MySQL 8+ instead of SQLite for improved performance
PHOTOPRISM_DATABASE_SERVER: "mysql:3306" # MariaDB or MySQL database server (hostname:port)
PHOTOPRISM_DATABASE_NAME: "photoprism" # MariaDB or MySQL database schema name
PHOTOPRISM_DATABASE_USER: "photoprism" # MariaDB or MySQL database user name
PHOTOPRISM_DATABASE_PASSWORD: "PASSWORD" # MariaDB or MySQL database user password
PHOTOPRISM_SITE_CAPTION: "AI-Powered Photos App"
PHOTOPRISM_SITE_DESCRIPTION: "" # meta site description
PHOTOPRISM_SITE_AUTHOR: "" # meta site author
PHOTOPRISM_DEFAULT_LOCALE: "ru"
working_dir: "/photoprism" # do not change or remove
volumes:
- "$DIR_DATA/FOTO:/photoprism/originals" # Original media files (DO NOT REMOVE)
- "$DIR_DATA/PHONE:/photoprism/originals/phone:ro"
- "$DIR_CONF/photoprism/storage:/photoprism/storage" # *Writable* storage folder for cache, database, and sidecar files (DO NOT REMOVE)
labels:
- "traefik.enable=true"
- "traefik.http.routers.photoprism.rule=Host(`photoprism.example.ru`)"
- "traefik.http.routers.photoprism.entrypoints=https"
- "traefik.http.routers.photoprism.tls=true"
- "traefik.http.routers.photoprism.middlewares=WhitelistHome,[email protected]"
- "traefik.http.services.photoprism.loadbalancer.server.port=2342"
- "com.centurylinklabs.watchtower.enable=true"
jellyfin:
image: jellyfin/jellyfin
container_name: jellyfin
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- $DIR_CONF/jellyfin/config:/config
- $DIR_MEDIA/ФИЛЬМЫ:/data/movies:ro
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Moscow
labels:
- "traefik.enable=true"
- "traefik.http.routers.jellyfin.rule=Host(`jellyfin.example.ru`)"
- "traefik.http.routers.jellyfin.entrypoints=https"
- "traefik.http.routers.jellyfin.tls=true"
- "traefik.http.services.jellyfin.loadbalancer.server.port=8096"
- "traefik.http.routers.jellyfin.middlewares=WhitelistHome,[email protected]"
- "com.centurylinklabs.watchtower.enable=true"
rutorrent:
image: linuxserver/rutorrent
container_name: rutorrent
deploy:
replicas: 1
restart_policy:
condition: on-failure
environment:
- PUID=1000
- PGID=1000
ports:
- 51413:51413
- 6881:6881/udp
volumes:
- $DIR_CONF/rutorrent:/config
- $DIR_MEDIA/TORRENTS:/downloads
labels:
- "traefik.enable=true"
- "traefik.http.routers.rutorrent.rule=Host(`torrents.example.ru`)"
- "traefik.http.routers.rutorrent.entrypoints=https"
- "traefik.http.routers.rutorrent.tls=true"
- "traefik.http.routers.rutorrent.middlewares=WhitelistHome"
- "com.centurylinklabs.watchtower.enable=true"
ps3netsrv:
image: daffin/ps3netsrv
build: $DIR_BUILD/ps3netsrv
container_name: ps3netsrv
deploy:
replicas: 1
restart_policy:
condition: on-failure
ports:
- 38008:38008
volumes:
- $DIR_DATA/PS3ISO:/games
environment:
- TZ=Europe/Moscow
- USER_ID=1000
- GROUP_ID=888
minecraft:
image: daffin/minecraft
build: $DIR_BUILD/maincraft
container_name: minecraft
deploy:
replicas: 1
restart_policy:
condition: on-failure
ports:
- 25565:25565
- 25565:25565/udp
volumes:
- $DIR_DATA/minecraft:/data
- /etc/localtime:/etc/localtime:ro
### UTILS
heimdall:
image: linuxserver/heimdall:latest
container_name: heimdall
deploy:
replicas: 1
restart_policy:
condition: on-failure
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Moscow
volumes:
- $DIR_CONF/heimdall:/config
labels:
- "traefik.enable=true"
- "traefik.http.routers.heimdall.rule=Host(`heimdall.example.ru`)"
- "traefik.http.routers.heimdall.entrypoints=https"
- "traefik.http.routers.heimdall.tls=true"
- "traefik.http.routers.heimdall.middlewares=WhitelistHome,[email protected]"
- "com.centurylinklabs.watchtower.enable=true"
vault:
image: vault
container_name: vault
deploy:
replicas: 1
restart_policy:
condition: on-failure
command: vault server -config=/vault/config/vault.json
environment:
- VAULT_ADDR=http://0.0.0.0:8200
- VAULT_API_ADDR=http://0.0.0.0:8200
- VAULT_ADDRESS=http://0.0.0.0:8200
volumes:
- $DIR_CONF/vault:/vault
- $DIR_CONF/vault/file:/vault/file
cap_add:
- IPC_LOCK
labels:
- "traefik.enable=true"
- "traefik.http.routers.vault.rule=Host(`vault.example.ru`)"
- "traefik.http.routers.vault.entrypoints=https"
- "traefik.http.routers.vault.tls=true"
- "traefik.http.routers.vault.middlewares=WhitelistHome"
- "traefik.http.services.vault.loadbalancer.server.port=8200"
- "com.centurylinklabs.watchtower.enable=true"
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
deploy:
replicas: 1
restart_policy:
condition: on-failure
environment:
- WEBSOCKET_ENABLED=true # Enable WebSocket notifications.
- SIGNUPS_ALLOWED=false
volumes:
- $DIR_CONF/vaultwarden:/data
labels:
- "traefik.enable=true"
- "traefik.http.routers.vaultwarden.tls=true"
- "traefik[email protected]"
- "traefik.http.routers.vaultwarden.rule=Host(`vaultwarden.example.ru`)"
portainer:
image: portainer/portainer-ce
container_name: portainer
deploy:
replicas: 1
restart_policy:
condition: on-failure
security_opt:
- no-new-privileges:true
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- $DIR_CONF/portainer/data:/data
- $DIR_CONF/portainer/shared:/shared
- /etc/localtime:/etc/localtime:ro
environment:
- TZ=Europe/Moscow
labels:
- "traefik.enable=true"
- "traefik.http.routers.portainer.tls=true"
- "traefik.http.routers.portainer.rule=Host(`portainer.example.ru`)"
- "traefik.http.routers.portainer.middlewares=WhitelistHome,[email protected]"
- "traefik.http.services.portainer.loadbalancer.server.port=9000"
- "com.centurylinklabs.watchtower.enable=true"
pihole:
image: pihole/pihole:latest
container_name: pihole
deploy:
replicas: 1
restart_policy:
condition: on-failure
ports:
- "192.168.0.111:53:53/udp"
- "192.168.0.111:53:53/tcp"
environment:
- TZ=Europe/Moscow
- WEBPASSWORD=PASSWORD
- VIRTUAL_HOST=pihole.example.ru
volumes:
- $DIR_CONF/pihole/conf:/etc/pihole
- $DIR_CONF/pihole/dnsmasq.d:/etc/dnsmasq.d
labels:
- "traefik.enable=true"
- "traefik.http.routers.pihole.entrypoints=http"
- "traefik.http.routers.pihole.rule=Host(`pihole.example.ru`)"
- "traefik.http.middlewares.pihole-https-redirect.redirectscheme.scheme=https"
- "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
- "traefik.http.routers.pihole-secure.middlewares=WhitelistHome"
- "traefik.http.routers.pihole.middlewares=pihole-https-redirect"
- "traefik.http.routers.pihole-secure.entrypoints=https"
- "traefik.http.routers.pihole-secure.rule=Host(`pihole.example.ru`)"
- "traefik.http.routers.pihole-secure.tls=true"
- "traefik.http.routers.pihole-secure.service=pihole"
- "traefik.http.services.pihole.loadbalancer.server.port=80"
- "com.centurylinklabs.watchtower.enable=true"
watchtower:
image: containrrr/watchtower
container_name: watchtower
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /etc/timezone:/etc/timezone:ro
environment:
- WATCHTOWER_CLEANUP=true
- WATCHTOWER_LABEL_ENABLE=true
- WATCHTOWER_INCLUDE_RESTARTING=true
labels:
- "com.centurylinklabs.watchtower.enable=true"
ocs:
image: ocsinventory/ocsinventory-docker-image:latest
container_name: ocs
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- /etc/localtime:/etc/localtime:ro
environment:
OCS_DB_SERVER: mysql
OCS_DB_USER: ocs
OCS_DB_PASS: PASSWORD
OCS_DB_NAME: ocsweb
depends_on:
- mysql
labels:
- "traefik.enable=true"
- "traefik.http.routers.ocs.tls=true"
- "traefik.http.routers.ocs.rule=Host(`ocs.example.ru`)"
- "traefik.http.routers.ocs.middlewares=WhitelistHome"
- "traefik.http.services.ocs.loadbalancer.server.port=80"
- "com.centurylinklabs.watchtower.enable=true"
registry:
image: registry:latest
container_name: registry
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- $DIR_DATA/registry:/var/lib/registry
- $DIR_CONF/registry/auth:/auth
- /etc/localtime:/etc/localtime:ro
environment:
REGISTRY_AUTH: htpasswd
REGISTRY_AUTH_HTPASSWD_REALM: Registry
REGISTRY_AUTH_HTPASSWD_PATH: /auth/registry.password
labels:
- "traefik.enable=true"
- "traefik.http.routers.registry.rule=Host(`registry.example.ru`)"
- "traefik.http.routers.registry.entrypoints=https"
- "traefik.http.routers.registry.tls=true"
- "traefik.http.services.registry.loadbalancer.server.port=5000"
- "com.centurylinklabs.watchtower.enable=true"
### HA
mosquitto:
image: eclipse-mosquitto
container_name: mosquitto
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- $DIR_CONF/mosquitto:/mosquitto
zigbee2mqtt:
image: koenkk/zigbee2mqtt
container_name: zigbee2mqtt
deploy:
replicas: 1
restart_policy:
condition: on-failure
depends_on:
- mosquitto
environment:
- TZ=Europe/Moscow
volumes:
- $DIR_CONF/zigbee2mqtt:/app/data
- /run/udev:/run/udev:ro
devices:
- /dev/serial/by-id/usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_b8e81ef55b29ec119d78757840c9ce8d-if00-port0:/dev/ttyACM0
labels:
- "traefik.enable=true"
- "traefik.http.routers.zigbee2mqtt.rule=Host(`zigbee.example.ru`)"
- "traefik.http.routers.zigbee2mqtt.entrypoints=https"
- "traefik.http.routers.zigbee2mqtt.tls=true"
- "traefik.http.routers.zigbee2mqtt.middlewares=WhitelistHome"
- "traefik.http.services.zigbee2mqtt.loadbalancer.server.port=80"
- "com.centurylinklabs.watchtower.enable=true"
homeassistant:
image: homeassistant/home-assistant:latest
container_name: homeassistant
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- $DIR_CONF/homeassistant:/config
labels:
- "traefik.enable=true"
- "traefik.http.routers.homeassistant.tls=true"
- "traefik.http.routers.homeassistant.rule=Host(`homeassistant.example.ru`)"
- "traefik.h[email protected]"
- "traefik.http.services.homeassistant.loadbalancer.server.port=8123"
### LOGS & MONITORING
uptimekuma:
image: louislam/uptime-kuma:latest
container_name: uptimekuma
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- $DIR_CONF/uptimekuma:/app/data
labels:
- "traefik.enable=true"
- "traefik.http.routers.uptime.tls=true"
- "traefik.http.routers.uptime.rule=Host(`uptime.example.ru`)"
- "traefik.http.routers.uptime.middlewares=WhitelistHome"
- "traefik.http.services.uptime.loadbalancer.server.port=3001"
- "com.centurylinklabs.watchtower.enable=true"
mysql-logs:
image: mariadb:10.8
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: mysql-logs
volumes:
- $DIR_DATA/mysql-logs:/var/lib/mysql
- /etc/localtime:/etc/localtime:ro
environment:
- MYSQL_ROOT_PASSWORD=PASSWORD
- MYSQL_PASSWORD=PASSWORD
- MYSQL_USER=zabbix
- MYSQL_DATABASE=zabbix
zabbix-web-nginx-mysql:
image: zabbix/zabbix-web-nginx-mysql:latest
container_name: zabbix-web
deploy:
replicas: 1
restart_policy:
condition: on-failure
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8080/"]
interval: 10s
timeout: 5s
retries: 3
start_period: 30s
environment:
DB_SERVER_HOST: mysql-logs
MYSQL_DATABASE: zabbix
MYSQL_USER: zabbix
MYSQL_PASSWORD: PASSWORD
depends_on:
- mysql-logs
volumes:
- /etc/localtime:/etc/localtime:ro
labels:
- "traefik.enable=true"
- "traefik.http.routers.zabbix.tls=true"
- "traefik.http.routers.zabbix.rule=Host(`zabbix.example.ru`)"
- "traefik.http.routers.zabbix.middlewares=WhitelistHome"
- "traefik.http.services.zabbix.loadbalancer.server.port=8080"
zabbix-java-gateway:
image: zabbix/zabbix-java-gateway:latest
container_name: zabbix-gateway
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- /etc/localtime:/etc/localtime:ro
zabbix-server-mysql:
image: zabbix/zabbix-server-mysql:latest
container_name: zabbix-server
deploy:
replicas: 1
restart_policy:
condition: on-failure
depends_on:
- zabbix-java-gateway
- mysql-logs
environment:
DB_SERVER_HOST: mysql-logs
MYSQL_DATABASE: zabbix
MYSQL_USER: zabbix
MYSQL_PASSWORD: PASSWORD
ZBX_JAVAGATEWAY: zabbix-java-gateway
volumes:
- /etc/localtime:/etc/localtime:ro
grafana:
image: grafana/grafana-oss:latest
container_name: grafana
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- $DIR_DATA/grafana:/var/lib/grafana
labels:
- "traefik.enable=true"
- "traefik.http.routers.grafana.rule=Host(`grafana.example.ru`)"
- "traefik.http.routers.grafana.entrypoints=https"
- "traefik.http.routers.grafana.tls=true"
- "traefik.http.services.grafana.loadbalancer.server.port=3000"
- "traefik.http.routers.grafana.middlewares=WhitelistHome"
- "com.centurylinklabs.watchtower.enable=true"
influxdb:
image: influxdb:1.8
container_name: influxdb
deploy:
replicas: 1
restart_policy:
condition: on-failure
volumes:
- $DIR_DATA/influxdb:/var/lib/influxdb
environment:
- INFLUXDB_DB=telegraf
- INFLUXDB_ADMIN_ENABLED=true
- INFLUXDB_ADMIN_USER=admin
- INFLUXDB_ADMIN_PASSWORD=a4Q9PuLppX88qxzi
- INFLUXDB_USER=telegraf
labels:
- "com.centurylinklabs.watchtower.enable=true"
node:
image: prom/node-exporter
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: node
ports:
- "9100:9100"
volumes:
- /proc:/host/proc:ro
- /sys:/host/sys:ro
- /:/rootfs:ro
- /:/host:ro,rslave
command:
- '--path.rootfs=/host'
- '--path.procfs=/host/proc'
- '--path.sysfs=/host/sys'
- --collector.filesystem.ignored-mount-points
- "^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)"
cadvisor:
image: gcr.io/cadvisor/cadvisor
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: cadvisor
devices:
- "/dev/kmsg:/dev/kmsg"
ports:
- "8080:8080"
volumes:
- /:/rootfs:ro
- /var/run:/var/run:rw
- /sys:/sys:ro
- /var/lib/docker/:/var/lib/docker:ro
- /dev/disk/:/dev/disk:ro
filebeat:
image: elastic/filebeat:8.4.3
container_name: filebeat
deploy:
replicas: 1
restart_policy:
condition: on-failure
entrypoint: "filebeat -e -strict.perms=false"
volumes:
- $DIR_CONF/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml
prometheus:
image: prom/prometheus
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: prometheus
command:
- '--config.file=/etc/prometheus/prometheus.yml'
- '--storage.tsdb.path=/prometheus'
- '--web.console.libraries=/usr/share/prometheus/console_libraries'
- '--web.console.templates=/usr/share/prometheus/consoles'
depends_on:
- cadvisor
volumes:
- $DIR_CONF/prometheus:/etc/prometheus
- $DIR_DATA/prometheus:/prometheus
labels:
- "com.centurylinklabs.watchtower.enable=true"
alertmanager:
image: prom/alertmanager
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: alertmanager
command:
- '--config.file=/etc/alertmanager/alertmanager.yml'
- '--storage.path=/alertmanager'
ports:
- "9093:9093"
volumes:
- $DIR_CONF/alertmanager:/etc/alertmanager
fluentd:
image: fluent/fluentd
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: fluentd
volumes:
- $DIR_CONF/fluentd:/fluentd/etc
links:
- "elasticsearch"
elasticsearch:
image: elasticsearch:8.4.3
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: elasticsearch
hostname: 'elasticsearch'
environment:
- discovery.type=single-node
- ELASTIC_PASSWORD=PASSWORD
- xpack.license.self_generated.type=basic
- path.data=/usr/share/elasticsearch/data
- bootstrap.memory_lock=true
- "ES_JAVA_OPTS=-Xms512m -Xmx512m"
volumes:
- $DIR_DATA/elasticsearch:/usr/share/elasticsearch/data
kibana:
image: kibana:8.4.3
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: kibana
depends_on:
- elasticsearch
environment:
- ELASTICSEARCH_HOSTS=http://elasticsearch:9200
- SERVER_NAME=kibana
- PATH_DATA=/usr/share/kibana/data
volumes:
- $DIR_CONF/kibana/kibana.yml:/usr/share/kibana/config/kibana.yml
- $DIR_DATA/kibana:/usr/share/kibana/data
links:
- "elasticsearch"
labels:
- "traefik.enable=true"
- "traefik.http.routers.kibana.tls=true"
- "traefik.http.routers.kibana.rule=Host(`kibana.example.ru`)"
- "traefik.http.routers.kibana.middlewares=WhitelistHome"
- "traefik.http.services.kibana.loadbalancer.server.port=5601"
logstash:
image: logstash:8.4.3
container_name: logstash
deploy:
replicas: 1
restart_policy:
condition: on-failure
environment:
- NODE_NAME=logstash
- xpack.monitoring.enabled=false
volumes:
- $DIR_CONF/logstash/pipeline:/usr/share/logstash/pipeline
links:
- elasticsearch
depends_on:
- elasticsearch
elastalert:
image: jertel/elastalert2
deploy:
replicas: 1
restart_policy:
condition: on-failure
container_name: elastalert
depends_on:
- elasticsearch
volumes:
- $DIR_CONF/elastalert/elastalert.yaml:/opt/elastalert/config.yaml
- $DIR_CONF/elastalert/rules:/opt/elastalert/rules
- $DIR_CONF/elastalert/smtp.yaml:/opt/elastalert/smtp_auth_file.yml
### BACKUPS
minio:
image: quay.io/minio/minio
container_name: minio
deploy:
replicas: 1
restart_policy:
condition: on-failure
command: server /data --address ":9000" --console-address ":9001"
environment:
MINIO_ROOT_USER: minio
MINIO_ROOT_PASSWORD: DMxXvdYz4o8QDq
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
interval: 30s
timeout: 20s
retries: 3
volumes:
- $DIR_BACKUP/minio:/data
labels:
- "traefik.enable=true"
- "traefik.http.routers.minio.rule=Host(`minio.example.ru`)"
- "traefik.http.routers.minio.entrypoints=https"
- "traefik.http.routers.minio.tls=true"
- "traefik.http.routers.minio.middlewares=WhitelistHome"
- "traefik.http.services.minio.loadbalancer.server.port=9001"
- "com.centurylinklabs.watchtower.enable=true"
duplicati:
image: linuxserver/duplicati:latest
container_name: duplicati
deploy:
replicas: 1
restart_policy:
condition: on-failure
environment:
- PUID=0
- PGID=0
- TZ=Europe/Moscow
volumes:
- $DIR_CONF/duplicati:/config
- $DIR_BACKUP/DUPLICATI:/backups
- /srv:/source
labels:
- "traefik.enable=true"
- "traefik.http.routers.duplicati.rule=Host(`duplicati.example.ru`)"
- "traefik.http.routers.duplicati.entrypoints=https"
- "traefik.http.routers.duplicati.tls=true"
- "traefik.http.services.duplicati.loadbalancer.server.port=8200"
- "traefik.http.routers.duplicati.middlewares=WhitelistHome,[email protected]"
- "com.centurylinklabs.watchtower.enable=true"
networks:
default:
driver: bridge
driver_opts:
com.docker.network.enable_ipv6: "false"