docker-compose.cloud.yaml

x-common-cloud: &cloud
  #todo:
  #  image: vikunja/vikunja
  #  container_name: todo
  #  <<: *common
  #  environment:
  #    <<: *env-vars
  #    VIKUNJA_DATABASE_HOST: postgres
  #    VIKUNJA_DATABASE_PASSWORD: ${DATABASE_PASSWORD}
  #    VIKUNJA_DATABASE_TYPE: postgres
  #    VIKUNJA_DATABASE_USER: ${DATABASE_USERNAME}
  #    VIKUNJA_DATABASE_DATABASE: ${TODO_DATABASE}
  #    VIKUNJA_SERVICE_JWTSECRET: ${JWT_SECRET}
  #    VIKUNJA_SERVICE_TIMEZONE: ${TIMEZONE}
  #    VIKUNJA_SERVICE_PUBLICURL: https://todo.${DOMAIN}
  #    VIKUNJA_METRICS_ENABLED: true
  #    VIKUNJA_LOG_LEVEL: WARNING
  #    VIKUNJA_LOG_STANDARD: stdout
  #    VIKUNJA_LOG_EVENTS: stdout
  #    VIKUNJA_LOG_EVENTSLEVEL: ERROR
  #    VIKUNJA_LOG_DATABASE: true
  #    VIKUNJA_LOG_DATABASELEVEL: WARNING
  #    VIKUNJA_LOG_MAIL: stdout
  #    VIKUNJA_LOG_MAILLEVEL: WARNING
  #    VIKUNJA_CORS_ENABLE: true
  #    VIKUNJA_CORS_ORIGINS: "https://todo.${DOMAIN}"
  #    VIKUNJA_KEYVALUE_TYPE: redis
  #    VIKUNJA_REDIS_ENABLED: true
  #    VIKUNJA_REDIS_HOST: redis:6379
  #    VIKUNJA_REDIS_PASSWORD: ${REDIS_PASSWORD}
  #    VIKUNJA_REDIS_DB: 0
  #    VIKUNJA_AUTH_LOCAL_ENABLED: false
  #    VIKUNJA_AUTH_OPENID_ENABLED: true
  #    VIKUNJA_AUTH_OPENID_REDIRECTURL: "https://todo.${DOMAIN}/auth/openid"
  #  volumes:
  #    - config-vikunja-conf:/etc/vikunja
  #    - config-vikunja:/app/vikunja/files
  #  depends_on:
  #    - postgres
  #  labels:
  #    traefik.http.routers.todo.rule: Host(`todo.${DOMAIN}`) && $RESTRICTED
  #    traefik.http.routers.todo.entryPoints: websecure
  #    traefik.http.routers.todo.tls: true
  #    traefik.http.routers.todo.tls.certResolver: letsencrypt

  sync:
    container_name: sync
    image: ghcr.io/linuxserver/syncthing
    hostname: sync.${DOMAIN}
    <<: *common
    volumes:
      - config-syncthing:/config
      - sync:/Sync
    ports:
      - ${IP}:22000:22000/tcp
      - ${IP}:22000:22000/udp
      - ${IP}:21027:21027/udp
      - ${IPV6}:22000:22000/tcp
      - ${IPV6}:22000:22000/udp
      - ${IPV6}:21027:21027/udp
    healthcheck:
      test: nc -z 127.0.0.1 8384 || exit 1
      <<: *healthcheck
    labels:
      traefik.http.routers.sync.rule: Host(`sync.${DOMAIN}`) && $RESTRICTED
      traefik.http.routers.sync.entryPoints: websecure
      traefik.http.services.sync.loadbalancer.server.port: 8384
      traefik.http.routers.sync.tls: true
      traefik.http.routers.sync.tls.certResolver: letsencrypt

  vaultwarden:
    image: vaultwarden/server
    container_name: vault
    <<: *common
    environment:
      <<: *env-vars
      DOMAIN: "https://vault.${DOMAIN}"
      ADMIN_TOKEN: ${VAULTWARDEN_TOKEN}
      WEBSOCKET_ENABLED: true
      ROCKET_PORT: 8800
      SMTP_PORT: 587
      SMTP_SECURITY: starttls
      SMTP_HOST: ${SMTP_HOST}
      SMTP_FROM: vault@${DOMAIN}
      SMTP_FROM_NAME: Vaultwarden
      SMTP_USERNAME: ${SMTP_USER}
      SMTP_PASSWORD: ${SMTP_PASS}
      DATABASE_URL: postgresql://${DATABASE_USERNAME}:${DATABASE_PASSWORD}@postgres:5432/vaultwarden
    volumes:
      - config-vaultwarden:/data
    depends_on:
      - postgres
    labels:
      traefik.http.routers.vaultwarden.rule: Host(`vault.${DOMAIN}`) && $RESTRICTED
      traefik.http.services.vaultwarden.loadbalancer.server.port: 8800
      traefik.http.routers.vaultwarden.entryPoints: websecure
      traefik.http.routers.vaultwarden.tls: true
      traefik.http.routers.vaultwarden.tls.certResolver: letsencrypt

  rss:
    image: freshrss/freshrss
    container_name: rss
    restart: unless-stopped
    volumes:
      - config-freshrss:/var/www/FreshRSS/data
      - config-freshrss-extensions:/var/www/FreshRSS/extensions
    <<: *logging
    network_mode: "service:vpn"
    depends_on:
      - vpn
    security_opt:
      - no-new-privileges=true
    environment:
      <<: *env-vars
      DB_HOST: postgres:5432
      DB_BASE: freshrss
      DB_PASSWORD: ${DATABASE_PASSWORD}
      DB_USER: ${DATABASE_USERNAME}
      TRUSTED_PROXY: "172.0.0.0/8"
      CRON_MIN: '13,43'
    labels:
      traefik.enable: false

  wiki:
    image: outlinewiki/outline
    container_name: wiki
    env_file: ${CONFIG_DIR}/outline/config.env
    <<: *common
    depends_on:
      - postgres
      - valkey
      - minio
    healthcheck:
      test: ["CMD-SHELL", "timeout 5s bash -c ':> /dev/tcp/127.0.0.1/3000' || exit 1"]
      <<: *healthcheck
    labels:
      traefik.http.routers.outline.rule: Host(`wiki.${DOMAIN}`) && $RESTRICTED
      traefik.http.services.outline.loadbalancer.server.port: 3000
      traefik.http.routers.outline.entryPoints: websecure
      traefik.http.routers.outline.tls: true
      traefik.http.routers.outline.tls.certResolver: letsencrypt

  home:
    image: ghcr.io/linuxserver/homeassistant
    container_name: home
    restart: unless-stopped
    dns:
      - 192.168.1.1
    <<: *logging
    depends_on:
      - mosquitto
      - matter
    environment:
      <<: *env-vars
      DOCKER_MODS: "linuxserver/mods:homeassistant-hacs|linuxserver/mods:universal-package-install"
      INSTALL_PACKAGES: "openldap-clients|curl"
    network_mode: host
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:8123/manifest.json",
        ]
      <<: *healthcheck
    volumes:
      - config-home-assistant:/config
      - /etc/localtime:/etc/localtime:ro
    security_opt:
      - no-new-privileges=true
    labels:
      traefik.enable: false

  frigate:
    container_name: frigate
    image: ghcr.io/blakeblackshear/frigate:stable
    shm_size: 128mb
    <<: *common
    depends_on:
      mosquitto:
        condition: service_healthy
    devices:
      - /dev/dri/renderD128 # for hwaccel
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - config-frigate:/config
      - media-camera:/media/frigate
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS 'http://localhost:5000/api/' | grep -q -i 'alive and healthy' || exit 1",
        ]
      <<: *healthcheck
    deploy:
      resources:
        limits:
          cpus: '4'
    environment:
      <<: *env-vars
      LIBVA_DRIVER_NAME: radeonsi
      FRIGATE_RTSP_PASSWORD: "password"
      FRIGATE_MQTT_USERNAME: ${FRIGATE_MQTT_USERNAME}
      FRIGATE_MQTT_PASSWORD: ${FRIGATE_MQTT_PASSWORD}
      FRIGATE_REOLINK_USERNAME: ${FRIGATE_REOLINK_USERNAME}
      FRIGATE_REOLINK_PASSWORD: ${FRIGATE_REOLINK_PASSWORD}
      FRIGATE_REOLINK_IP: ${FRIGATE_REOLINK_IP}
    ports:
      - ${IP}:5000:5000 # unathenticated access
      - ${IP}:8554:8554 # RTSP feeds
      - ${IPV6}:5000:5000 # unathenticated access
      - ${IPV6}:8554:8554 # RTSP feeds
    labels:
      traefik.http.routers.frigate.rule: Host(`frigate.${DOMAIN}`) && $RESTRICTED
      traefik.http.services.frigate.loadbalancer.server.port: 8971
      traefik.http.routers.frigate.entryPoints: websecure
      traefik.http.routers.frigate.tls: true
      traefik.http.routers.frigate.tls.certResolver: letsencrypt
      traefik.http.routers.frigate.middlewares: auth@file

  grimoire:
    image: goniszewski/grimoire
    container_name: bookmarks
    <<: *common
    environment:
      <<: *env-vars
      PORT: 5173
      PUBLIC_HTTPS_ONLY: true
      PUBLIC_ORIGIN: "https://bookmarks.${DOMAIN}"
      PUBLIC_SIGNUP_DISABLED: true
    volumes:
      - config-bookmarks:/app/data/
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://localhost:5173/api/health || exit 1
      interval: 30s
      timeout: 10s
      retries: 3
    labels:
      traefik.http.routers.bookmarks.rule: Host(`bookmarks.${DOMAIN}`) && $RESTRICTED
      traefik.http.services.bookmarks.loadbalancer.server.port: 5173
      traefik.http.routers.bookmarks.entryPoints: websecure
      traefik.http.routers.bookmarks.tls: true
      traefik.http.routers.bookmarks.tls.certResolver: letsencrypt
      traefik.http.routers.bookmarks.middlewares: auth@file

  git:
    image: gitea/gitea:latest-rootless
    container_name: git
    <<: *common
    user: ${PUID}:${PGID}
    environment:
      <<: *env-vars
      GITEA__service__DISABLE_REGISTRATION: true
      GITEA__service__PROVIDER_CONFIG: redis://${REDIS_PASSWORD}@valkey:6379
      GITEA__service__PROVIDER: redis
      GITEA__queue__TYPE: redis
      GITEA__queue__CONN_STR: redis://${REDIS_PASSWORD}@valkey:6379
      GITEA__cache__ENABLED: true
      GITEA__cache__ADAPTER: redis
      GITEA__cache__HOST: redis://${REDIS_PASSWORD}@valkey:6379
      GITEA__database__PATH: /var/lib/gitea/data/gitea.db
      GITEA__database__DB_TYPE: postgres
      GITEA__database__HOST: postgres:5432
      GITEA__database__NAME: gitea
      GITEA__database__USER: ${DATABASE_USERNAME}
      GITEA__database__PASSWD: ${DATABASE_PASSWORD}
      GITEA__database__SCHEMA: ""
      GITEA__database__SSL_MODE: disable
      GITEA__database__LOG_SQL: false
      GITEA__storage__STORAGE_TYPE: minio
      GITEA__storage__MINIO_ENDPOINT: minio:9000
      GITEA__storage__MINIO_ACCESS_KEY_ID: ${GIT_MINIO_ACCESS_KEY}
      GITEA__storage__MINIO_SECRET_ACCESS_KEY: ${GIT_MINIO_SECRET_KEY}
      GITEA__storage__MINIO_LOCATION: local
      GITEA__storage__MINIO_USE_SSL: false
    healthcheck:
      # checks availability of Gitea's front-end with curl
      test: ["CMD", "curl", "-f", "localhost:3000"]
      <<: *healthcheck
    depends_on:
      - postgres
      - valkey
      - minio
      - auth
    volumes:
      - config-git-data:/var/lib/gitea
      - config-git:/etc/gitea
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    labels:
      traefik.http.routers.git.rule: Host(`git.${DOMAIN}`) && $RESTRICTED
      traefik.http.services.git.loadbalancer.server.port: 3000
      traefik.http.routers.git.entryPoints: websecure
      traefik.http.routers.git.tls: true
      traefik.http.routers.git.tls.certResolver: letsencrypt

  runner:
    image: gitea/act_runner
    container_name: runner
    <<: *common
    depends_on:
      git:
        condition: service_healthy 
        restart: true
    environment:
      <<: *env-vars
      CONFIG_FILE: /config.yaml
      GITEA_INSTANCE_URL: https://git.${DOMAIN}/
      GITEA_RUNNER_REGISTRATION_TOKEN: ${REGISTRATION_TOKEN}
      GITEA_RUNNER_NAME: git-default
    ports:
      - ${IP}:8765:8765
    deploy:
      resources:
        limits:
          memory: 16G
          cpus: 8
    volumes:
      - ${CONFIG_DIR}/git/runner/config.yaml:/config.yaml
      - config-git-runner-data:/data
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      traefik.enable: false

  renovate:
    image: renovate/renovate
    container_name: renovate
    <<: *common
    entrypoint: bash
    stdin_open: true
    tty: true
    environment:
      <<: *env-vars
      LOG_LEVEL: debug
      GITHUB_COM_TOKEN: ${GITHUB_TOKEN}
    volumes:
      - ${CONFIG_DIR}/git/renovate/config.js:/usr/src/app/config.js
    labels:
      traefik.enable: false
      ofelia.enabled: true
      ofelia.job-exec.renovate.schedule: "@every 12h"
      ofelia.job-exec.renovate.command: "/usr/local/sbin/renovate-entrypoint.sh renovate"

  cron:
    image: mcuadros/ofelia
    container_name: cron
    <<: *common
    command: daemon --docker
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    labels:
      traefik.enable: false

  youtrack:
    container_name: youtrack
    image: jetbrains/youtrack:2025.1.71685
    <<: *common
    volumes:
      - config-youtrack:/opt/youtrack/conf
      - config-youtrack-data:/opt/youtrack/data
      - config-youtrack-logs:/opt/youtrack/logs
    labels:
      traefik.http.routers.youtrack.rule: Host(`youtrack.${DOMAIN}`) && $RESTRICTED
      traefik.http.services.youtrack.loadbalancer.server.port: 8080
      traefik.http.routers.youtrack.entryPoints: websecure
      traefik.http.routers.youtrack.tls: true
      traefik.http.routers.youtrack.tls.certResolver: letsencrypt

  immich-public-proxy:
    image: alangrainger/immich-public-proxy:latest
    container_name: photo-proxy
    <<: *common
    environment:
      <<: *env-vars
      #IMMICH_URL: https://photos.${DOMAIN}
      IMMICH_URL: http://photos:8080
    depends_on:
      - immich
    healthcheck:
      test: wget -q --spider http://localhost:3000/share/healthcheck || exit 1
      start_period: 10s
      timeout: 5s
    labels:
      traefik.http.routers.photo-proxy.rule: Host(`photos.${DOMAIN}`) && PathPrefix(`/share`)
      traefik.http.services.photo-proxy.loadbalancer.server.port: 3000
      traefik.http.routers.photo-proxy.entryPoints: websecure
      traefik.http.routers.photo-proxy.tls: true
      traefik.http.routers.photo-proxy.tls.certResolver: letsencrypt