forust/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Wiki Activity

Merge branch 'main' of ssh://gitssh.forust.xyz:2221/forust/homelab into feat/tailscale

Browse Source
This commit is contained in:
mr-forust
2026-01-01 01:45:57 +01:00
parent db0f0f7bb6 4fe3d660f1
commit c048efd569
20 changed files with 175 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+6
View File
@@ -12,6 +12,7 @@ sync.ffs_lock
# Volumes and data directories
gitea/gitea-db/
gitea/gitea-data/*
gitea/*runner/*
n8n/n8n-data/*
n8n/n8n-node-data/*
adguardhome/data/*
@@ -22,6 +23,7 @@ uptime-kuma/data/
termix/termix-data/*
cfddns/config.json
checkmk/checkmk/*
downtify/Downtify_downloads
# Steaming services files
streaming/jellyfin/*
@@ -39,6 +41,9 @@ homepages/forust_files/assets/images/team/*
# Traefik files
traefik/letsencrypt/acme.json
traefik/logs/*
# SSL Certificates
adguardhome/certs/*
traefik/certs/*
# Monitoring
@@ -81,3 +86,4 @@ replacements.txt
# Temp files
edu_master/temp/
temp/*
adguardhome/compose.yaml
+15 -9
View File
@@ -3,48 +3,54 @@ services:
image: adguard/adguardhome:latest
container_name: adguardhome
restart: unless-stopped
environment:
- TZ=${TZ}
ports:
- "53:53/tcp"
- "53:53/udp"
- "853:853/tcp" # DNS over TLS
# - "67:67/udp" # DHCP
# - "68:68/tcp" # DHCP
# - "3000:3000/tcp"
volumes:
- ./data/work:/opt/adguardhome/work
- ./data/conf:/opt/adguardhome/conf
- ./certs:/certs:ro
networks:
- traefik-proxy
- proxy
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
- "traefik.http.services.adguard.loadbalancer.server.port=3000"
# Prod Router
- "traefik.http.routers.adguard.rule=Host(`adguard.forust.xyz`)"
- "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
- "traefik.http.routers.adguard.entrypoints=websecure"
- "traefik.http.routers.adguard.middlewares=security-headers@file"
- "traefik.http.routers.adguard.service=adguard"
- "traefik.http.routers.adguard.tls=true"
- "traefik.http.services.adguard.loadbalancer.server.port=3000"
# Local Router
- "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`adguard.internal`)"
- "traefik.http.routers.adguard-local.rule=Host(`dns.workstation.internal`) || Host(`adguard.internal`) || Host(`adguard.workstation.internal`)"
- "traefik.http.routers.adguard-local.entrypoints=websecure"
- "traefik.http.routers.adguard-local.middlewares=security-headers@file"
- "traefik.http.routers.adguard-local.service=adguard"
- "traefik.http.routers.adguard-local.tls=true"
# Dev Router
- "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`)"
- "traefik.http.routers.adguard-dev.rule=Host(`dns.gigaforust.internal`) || Host(`adguard.gigaforust.internal`)"
- "traefik.http.routers.adguard-dev.entrypoints=websecure"
- "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
- "traefik.http.routers.adguard-dev.service=adguard"
- "traefik.http.routers.adguard-dev.tls=true"
# DoH
- "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
- "traefik.http.routers.dns.entrypoints=websecure"
- "traefik.http.routers.dns.service=adguard"
- "traefik.http.routers.dns.tls.certresolver=letsencrypt"
- glance.name=adguard
- glance.url=https://adguard.forust.xyz/
- glance.description=AdGuard Home is a network-wide software for blocking ads.
networks:
traefik-proxy:
proxy:
external: true
authentik/compose.yaml
+3 -3
View File
@@ -40,7 +40,7 @@ services:
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Services
# - "traefik.http.services.authentik-server.loadbalancer.server.port=9443"
- "traefik.http.services.authentik-server.loadbalancer.server.port=9000"
@@ -69,7 +69,7 @@ services:
- ./media:/media
- ./custom-templates:/templates
networks:
- traefik-proxy
- proxy
- authentik
depends_on:
postgresql:
@@ -102,5 +102,5 @@ volumes:
driver: local
networks:
authentik:
traefik-proxy:
proxy:
external: true
dockmon/compose.yaml
+3 -3
View File
@@ -16,10 +16,10 @@ services:
timeout: 10s
retries: 3
networks:
- traefik-proxy
- proxy
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Prod Router
- "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
@@ -50,5 +50,5 @@ services:
- glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
networks:
traefik-proxy:
proxy:
external: true
downtify/compose.yaml
+39
View File
@@ -0,0 +1,39 @@
services:
downtify:
container_name: downtify
image: ghcr.io/henriquesebastiao/downtify:latest
# ports:
# - '7077:8000'
labels:
- traefik.enable=true
- traefik.http.services.downtify.loadbalancer.server.port=8000
# Prod Router
- traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)
- traefik.http.routers.downtify.entrypoints=websecure
- traefik.http.routers.downtify.middlewares=security-chain@file
- traefik.http.routers.downtify.service=downtify
- traefik.http.routers.downtify.tls=true
# Local Router
- traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`) || Host(`downtify.internal`)
- traefik.http.routers.downtify-local.entrypoints=websecure
- traefik.http.routers.downtify-local.middlewares=security-headers@file
- traefik.http.routers.downtify-local.service=downtify
- traefik.http.routers.downtify-local.tls=true
# Dev Router
- traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)
- traefik.http.routers.downtify-dev.entrypoints=websecure
- traefik.http.routers.downtify-dev.middlewares=security-chain@file
- traefik.http.routers.downtify-dev.service=downtify
- traefik.http.routers.downtify-dev.tls=true
networks:
- proxy
volumes:
- ./Downtify_downloads:/downloads
networks:
proxy:
external: true
gitea/.env.example
+5 -1
View File
@@ -1,3 +1,7 @@
GITEA_POSTGRES_USER=
GITEA_POSTGRES_PASSWORD=
GITEA_POSTGRES_DB=gitea
GITEA_POSTGRES_DB=gitea
BASIC-RUNNER_TOKEN=
GITEA_SMTP_PASS=
MAILER_ADDR=
SERVICE_EMAIL=email.used.by.services@domain.tld
gitea/compose.yaml
+35 -3
View File
@@ -13,18 +13,28 @@ services:
- GITEA__database__NAME=gitea
#Server
- GITEA__server__ROOT_URL=https://gitea.forust.xyz
- GITEA__server__SSH_DOMAIN=gitssh.forust.xyz
- GITEA__server__SSH_PORT=2221
# Mailer
- GITEA__mailer__ENABLED=true
- GITEA__mailer__FROM=${SERVICE_EMAIL}
- GITEA__mailer__SMTP_ADDR=${MAILER_ADDR}:465
- GITEA__mailer__USER=${SERVICE_EMAIL}
- GITEA__mailer__PASSWD=${GITEA_SMTP_PASS}
- GITEA__mailer__PROTOCOL=SMTP
- GITEA__service__REGISTER_EMAIL_CONFIRM=true
- GITEA__service__ENABLE_NOTIFY_MAIL=true
restart: always
networks:
- gitea-db
- traefik-proxy
- proxy
volumes:
- ./gitea-data:/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Prod Router
- "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
@@ -47,11 +57,33 @@ services:
- "traefik.http.routers.gitea-dev.middlewares=security-headers@file"
- "traefik.http.routers.gitea-dev.service=gitea"
- "traefik.http.routers.gitea-dev.tls=true"
- "traefik.tcp.routers.gitea.entrypoints=ssh"
- "traefik.tcp.routers.gitea.rule=HostSNI(`*`)"
- "traefik.tcp.services.gitea.loadbalancer.server.port=22"
ports:
- "2221:22"
depends_on:
- db
runner:
image: gitea/act_runner:0.2.11
container_name: gitea-runner
restart: always
depends_on:
- server
env_file:
- .env
networks:
- gitea-db
environment:
- GITEA_INSTANCE_URL=http://server:3000
- GITEA_RUNNER_REGISTRATION_TOKEN=${BASIC-RUNNER_TOKEN}
- GITEA_RUNNER_NAME=basic-runner
- GITEA_RUNNER_LABELS=docker:docker://node:20-bookworm,ubuntu-latest:docker://node:20-bookworm
volumes:
- ./gitea-runner:/data
- /var/run/docker.sock:/var/run/docker.sock
db:
image: docker.io/library/postgres:14
restart: always
@@ -67,5 +99,5 @@ services:
networks:
gitea-db:
external: false
traefik-proxy:
proxy:
external: true
glance/compose.yaml
+3 -3
View File
@@ -11,7 +11,7 @@ services:
env_file: .env
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Prod Router
- "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
@@ -31,10 +31,10 @@ services:
- "traefik.http.routers.glance-dev.middlewares=security-chain@file"
- "traefik.http.routers.glance-dev.tls=true"
networks:
- traefik-proxy
- proxy
dns:
- 1.1.1.1
- 8.8.8.8
networks:
traefik-proxy:
proxy:
external: true
homepages/compose.yaml
+6 -6
View File
@@ -9,10 +9,10 @@ services:
volumes:
- ./forust_files:/usr/share/nginx/html
networks:
- traefik-proxy
- proxy
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Services
- "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
@@ -48,11 +48,11 @@ services:
volumes:
- ./xdfnx_files:/usr/share/nginx/html
networks:
- traefik-proxy
- proxy
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Services
- "traefik.http.services.xdfnx-homepage.loadbalancer.server.port=80"
@@ -78,5 +78,5 @@ services:
- "traefik.http.routers.xdfnx-dev.tls=true"
networks:
traefik-proxy:
proxy:
external: true
homepages/xdfnx_files/favicon.ico
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 42 KiB

metube/compose.yaml
+3 -3
View File
@@ -14,7 +14,7 @@ services:
- ./MeTube_downloads:/downloads
labels:
- traefik.enable=true
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Prod Router
- "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)"
@@ -39,7 +39,7 @@ services:
- "traefik.http.routers.metube-dev.tls=true"
networks:
- traefik-proxy
- proxy
networks:
traefik-proxy:
proxy:
external: true
n8n/compose.yaml
+3 -3
View File
@@ -23,11 +23,11 @@ services:
- 1.1.1.1
- 8.8.8.8
networks:
- traefik-proxy
- proxy
- n8n
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Prod Router
- "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)"
@@ -58,5 +58,5 @@ services:
networks:
n8n:
external: false
traefik-proxy:
proxy:
external: true
nextcloud/compose.yaml
+4 -4
View File
@@ -9,7 +9,7 @@ services:
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- nextcloud-aio
- traefik-proxy # Optional: Connects the mastercontainer to the traefik-proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
- proxy # Optional: Connects the mastercontainer to the proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
# ports:
# - 8081:80 # may be removed if under reverse-proxy
# - 8443:8443
@@ -17,7 +17,7 @@ services:
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# AIO Services configuration
- "traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080"
@@ -55,7 +55,7 @@ services:
AIO_DISABLE_BACKUP_SECTION: false
APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
APACHE_IP_BINDING: 0.0.0.0 # Configure when going with reverse-proxy https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
APACHE_ADDITIONAL_NETWORK: traefik-proxy # (Optional) Connect the apache container to an additional docker network. When going with reverse-proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
APACHE_ADDITIONAL_NETWORK: proxy # (Optional) Connect the apache container to an additional docker network. When going with reverse-proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # Backup retention See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
COLLABORA_SECCOMP_DISABLED: false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
FULLTEXTSEARCH_JAVA_OPTIONS: "-Xms1024M -Xmx1024M" # adjust fulltextsearch java options. https://github.com/nextcloud/all-in-one#how-to-adjust-the-fulltextsearch-java-options
@@ -75,7 +75,7 @@ services:
# WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. For macos it needs to be '/var/run/docker.sock'
networks:
traefik-proxy:
proxy:
external: true
nextcloud-aio:
driver: bridge
penpot/compose.yaml
+3 -3
View File
@@ -50,7 +50,7 @@ x-secret-key: &penpot-secret-key
networks:
penpot:
traefik-proxy:
proxy:
external: true
volumes:
@@ -98,11 +98,11 @@ services:
networks:
- penpot
- traefik-proxy
- proxy
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Prod Router
- "traefik.http.routers.penpot.rule=Host(`penpot.forust.xyz`)"
portainer/compose.yaml
+3 -3
View File
@@ -10,10 +10,10 @@ services:
- 9443:9443
# - 8000:8000 # Remove if you do not intend to use Edge Agents
networks:
- traefik-proxy
- proxy
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Prod Router
- "traefik.http.routers.portainer.rule=Host(`portainer.forust.xyz`)"
@@ -50,5 +50,5 @@ volumes:
networks:
default:
name: portainer_network
traefik-proxy:
proxy:
external: true
termix/compose.yaml
+3 -3
View File
@@ -11,7 +11,7 @@ services:
PORT: "8080"
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Prod Router
- "traefik.http.routers.termix.rule=Host(`termix.forust.xyz`)"
@@ -35,10 +35,10 @@ services:
- "traefik.http.routers.termix-dev.service=termix"
- "traefik.http.routers.termix-dev.tls=true"
networks:
- traefik-proxy
- proxy
networks:
traefik-proxy:
proxy:
external: true
volumes:
traefik/compose.yaml
+15 -18
View File
@@ -11,7 +11,7 @@ services:
# Providers
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--providers.docker.network=traefik-proxy"
- "--providers.docker.network=proxy"
- "--providers.file.directory=/etc/traefik/dynamic"
- "--providers.file.watch=true"
@@ -19,30 +19,27 @@ services:
- "--entryPoints.web.address=:80"
- "--entryPoints.websecure.address=:443"
- "--entryPoints.websecure.http.tls=true"
- "--entryPoints.web.http.redirections.entryPoint.to=websecure"
- "--entryPoints.web.http.redirections.entryPoint.scheme=https"
- "--entryPoints.ssh.address=:2221"
# Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD
# - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
# - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
# Let's Encrypt
- "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
- "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
# # STAGING
# - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
# - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
# - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
# Cloudflare
- "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
# Logging
- "--log.level=INFO"
- "--log.filePath=/var/log/traefik/traefik.log"
- "--accesslog=true"
- "--accesslog.filepath=/var/log/traefik/access.log"
# # Logging
# - "--log.level=INFO"
# - "--log.filePath=/var/log/traefik/traefik.log"
# - "--accesslog=true"
# - "--accesslog.filepath=/var/log/traefik/access.log"
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Prod Router (Dash)
- "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
@@ -78,14 +75,14 @@ services:
- ./dynamic:/etc/traefik/dynamic:ro
- ./certs:/certs:ro
- ./logs:/var/log/traefik
# - ./traefik/letsencrypt:/letsencrypt
- ./letsencrypt:/letsencrypt
networks:
- traefik-proxy
- proxy
environment:
- TZ=Europe/Bratislava
networks:
traefik-proxy:
proxy:
external: true
traefik/dynamic/middlewares.yml
-28
View File
@@ -1,33 +1,5 @@
http:
middlewares:
# HTTPS Redirect
redirect-https:
redirectScheme:
scheme: https
permanent: true
# Metube Basic Auth
metube-auth:
basicAuth:
users:
- "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
realm: "MeTube Access"
# Basic Auth Traefik Dashboard
auth:
basicAuth:
users:
- "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
realm: "Traefik Dashboard"
# Basic Auth Dockmon
dockmon-auth:
basicAuth:
users:
- "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
realm: "Dockmon Access"
# Cloudflare IP Whitelist
cloudflare-ipwhitelist:
ipWhiteList:
traefik/dynamic/redirect.yml
+23
View File
@@ -0,0 +1,23 @@
http:
middlewares:
redirect-https:
redirectScheme:
scheme: https
permanent: true
routers:
acme-challenge-exempt:
rule: "PathPrefix(`/.well-known/acme-challenge`)"
entryPoints:
- web
service: noop@internal
priority: 100
http-catchall:
rule: "HostRegexp(`{host:.+}`)"
entryPoints:
- web
middlewares:
- redirect-https
service: noop@internal
priority: 1
uptime-kuma/compose.yaml
+3 -3
View File
@@ -10,7 +10,7 @@ services:
# - "3001:3001"
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik-proxy"
- "traefik.docker.network=proxy"
# Prod Router
- "traefik.http.routers.uptime-kuma.rule=Host(`uptime.forust.xyz`)"
@@ -28,7 +28,7 @@ services:
- "traefik.http.routers.uptime-kuma-dev.entrypoints=websecure"
- "traefik.http.routers.uptime-kuma-dev.tls=true"
networks:
- traefik-proxy
- proxy
networks:
traefik-proxy:
proxy:
external: true