general update oon docker config

docker-compose.yml

@@ -40,9 +40,12 @@ include:
     env_file: ${MEDIA_PATH}/.env
 
   - path:
+      - ${SERVICE_PATH}/freshrss/freshrss.yml
       - ${SERVICE_PATH}/gitea/gitea.yml
       - ${SERVICE_PATH}/home-assistant/home-assistant.yml
+      - ${SERVICE_PATH}/home-assistant/ha-addon/ha-ewelink-addon.yml
       - ${SERVICE_PATH}/it-tools/it-tools.yml
+      - ${SERVICE_PATH}/jupyter-notebook/jupyter-notebook.yml
       - ${SERVICE_PATH}/mealie/mealie.yml
       - ${SERVICE_PATH}/paperless-ngx/paperless-ngx.yml
       - ${SERVICE_PATH}/shlink/shlink.yml
@@ -52,17 +55,19 @@ include:
     env_file: ${SERVICE_PATH}/.env
 
 networks:
-  private:
+  ip4net:
     driver: bridge
-    name: private
-    ipam:
-      config:
-        - subnet: 10.5.0.0/16
-          gateway: 10.5.0.1
-  public:
-    driver: bridge
-    name: public
+    name: ip4net
     ipam:
       config:
         - subnet: 10.6.0.0/16
-          gateway: 10.6.0.1
+  ip6net:
+    driver: bridge
+    name: ip6net
+    enable_ipv6: true
+    ipam:
+      driver: default
+      # config: 
+      #   # - subnet: "2a04:ee41:86:9397::/64"
+      #   - subnet: "2001:db8:2:/64"
+      #   - gateway: "2001:db8:2::1"

project/db/adminer/adminer.yml

@@ -7,6 +7,8 @@ services:
     container_name: adminer
     ports:
       - 8085:8080
+    networks: 
+      - ip4net
     labels:
       # Watchtower
       - "com.centurylinklabs.watchtower.enable=true"

project/db/lldap/lldap.yml

@@ -18,6 +18,9 @@ services:
       # - "6360:6360"
       # For the web front-end
       - "17170:17170"
+    networks: 
+      - ip6net
+      - ip4net
     volumes:
       - "${DB_PATH}/lldap/data:/data"
     environment:
@@ -43,4 +46,4 @@ services:
       - "traefik.http.services.lldap-service.loadbalancer.server.port=17170"
       - "traefik.http.services.lldap-service.loadbalancer.server.scheme=http"
       # middlewares
-      - "traefik.http.routers.lldap.middlewares=crowdsec-bouncer@file"
+      # - "traefik.http.routers.lldap.middlewares=crowdsec-bouncer@file"

project/db/mariadb/mariadb.yml

@@ -6,6 +6,8 @@ services:
     image: mariadb:latest
     container_name: mariadb
     command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
+    networks: 
+      - ip4net
     environment:
       MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
     volumes:

project/db/pgadmin/pgadmin.yml

@@ -10,6 +10,8 @@ services:
     image: dpage/pgadmin4:latest
     ports:
       - 8082:80
+    networks: 
+      - ip4net
     secrets: [pgadmin_default_password]
     volumes:
       - ${DB_PATH}/pgadmin/data:/var/lib/pgadmin

project/db/postgres/postgres.yml

@@ -10,6 +10,9 @@ services:
     image: postgres:latest
     ports:
       - 5432:5432
+    networks: 
+      - ip4net
+      - ip6net
     secrets: [postgres_default_password]
     environment:
       POSTGRES_PASSWORD_FILE: /run/secrets/postgres_default_password
@@ -32,6 +35,9 @@ services:
     image: tensorchord/pgvecto-rs:pg16-v0.2.1-alpha.2
     ports:
       - 5433:5432
+    networks: 
+      - ip4net
+      - ip6net
     secrets: [postgres_default_password]
     environment:
       POSTGRES_PASSWORD_FILE: /run/secrets/postgres_default_password

project/db/redis/redis.yml

@@ -5,6 +5,9 @@ services:
       service: default
     container_name: redis
     image: redis:latest
+    networks: 
+      - ip4net
+      - ip6net
     volumes:
       - ${DB_PATH}/redis/data:/data
     labels:

project/infrastructure/authelia/authelia.yml

@@ -16,6 +16,8 @@ services:
     image: authelia/authelia:latest
     ports:
       - 9959:9959 # metrics prometheus
+    networks: 
+      - ip6net
     expose:
       - 9091
     secrets: [JWT_SECRET, SESSION_SECRET, STORAGE_PASSWORD, STORAGE_ENCRYPTION_KEY]
@@ -40,4 +42,4 @@ services:
       - 'traefik.http.routers.authelia.service=authelia-svc'
       - 'traefik.http.services.authelia-svc.loadbalancer.server.port=9091'
       # Middleware
-      - "traefik.http.routers.authelia.middlewares=crowdsec-bouncer@file"
+      #- "traefik.http.routers.authelia.middlewares=crowdsec-bouncer@file"

project/infrastructure/crowdsec/crowdsec.yml

@@ -6,11 +6,16 @@ services:
     container_name: crowdsec
     image: crowdsecurity/crowdsec:latest
     environment:
-      COLLECTIONS: "crowdsecurity/traefik crowdsecurity/http-cve"
+      COLLECTIONS: crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules crowdsecurity/http-cve
+      CROWDSEC_BOUNCER_API_KEY: ${CROWDSEC_API_KEY}
+      CUSTOM_HOSTNAME: crowdsec
     expose:
       - 8080
     ports:
       - 6060:6060
+    networks: 
+      - ip4net
+      - ip6net
     volumes:
       - ${INFRA_PATH}/crowdsec/data:/var/lib/crowdsec/data
       - ${INFRA_PATH}/crowdsec/config:/etc/crowdsec
@@ -19,21 +24,3 @@ services:
     labels:
       # Watchtower
       - "com.centurylinklabs.watchtower.enable=true"
-
-  crowdsec-traefik-bouncer:
-    extends:
-      file: ${TEMPLATES_PATH}
-      service: default
-    image: fbonalair/traefik-crowdsec-bouncer:latest
-    container_name: bouncer-traefik
-    environment:
-      CROWDSEC_BOUNCER_API_KEY: ${CROWDSEC_API_KEY}
-      CROWDSEC_AGENT_HOST: crowdsec:8080
-      GIN_MODE: release
-    expose:
-      - 8080
-    depends_on:
-      - crowdsec
-    labels:
-      # Watchtower
-      - "com.centurylinklabs.watchtower.enable=true"

project/infrastructure/homepage/homepage.yml

@@ -7,6 +7,8 @@ services:
     container_name: homepage
     ports:
       - 3030:3000
+    networks: 
+      - ip4net
     environment:
       HOMEPAGE_VAR_LOCAL_DOMAIN: ${LOCAL_DOMAIN}
       HOMEPAGE_VAR_PUBLIC_DOMAIN: ${PUBLIC_DOMAIN}

project/infrastructure/speedtest/speedtest.yml

@@ -18,6 +18,8 @@ services:
       #WEBPORT: 80
     ports:
       - "4001:80" # webport mapping (host:container)
+    networks: 
+      - ip4net
     labels:
       # Watchtower
       - "com.centurylinklabs.watchtower.enable=true"

project/infrastructure/syncthing/syncthing.yml

@@ -12,6 +12,9 @@ services:
       - 22000:22000/tcp # TCP file transfers
       - 22000:22000/udp # QUIC file transfers
       - 21027:21027/udp # Receive local discovery broadcasts
+    networks: 
+      - ip4net
+      - ip6net
     labels:
       # Watchtower
       - "com.centurylinklabs.watchtower.enable=true"

project/infrastructure/traefik/traefik.yml

@@ -9,16 +9,22 @@ services:
       - "80:80"
       - "443:443"
       - "8079:8080"
+    networks:
+      - ip6net
+      - ip4net
     environment:
       TRAEFIK_LOCAL_DOMAIN: ${LOCAL_DOMAIN}
       TRAEFIK_PUBLIC_DOMAIN: ${PUBLIC_DOMAIN}
       TRAEFIK_AUTH_PUBLIC_DOMAIN: auth.${PUBLIC_DOMAIN}
+      TRAEFIK_CROWDSEC_API_KEY: ${CROWDSEC_API_KEY}
     volumes:
       - "/var/log/crowdsec/:/var/log/crowdsec/"
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "${INFRA_PATH}/traefik/letsencrypt:/letsencrypt"
       - "${INFRA_PATH}/traefik/config:/etc/traefik"
       - "${INFRA_PATH}/traefik/certs:/etc/certs"
+      - "${INFRA_PATH}/traefik/html/ban.html:/ban.html"
+      - "${INFRA_PATH}/traefik/html/captcha.html:/captcha.html"
     labels:
       # Watchtower
       - "com.centurylinklabs.watchtower.enable=true"
@@ -35,6 +41,8 @@ services:
       service: default
     image: traefik/whoami:latest
     container_name: "traefik-whoami"
+    networks: 
+      - ip4net
     labels:
       # Watchtower
       - "com.centurylinklabs.watchtower.enable=true"

project/infrastructure/uptime-kuma/uptime-kuma.yml

@@ -1,14 +1,24 @@
 services:
   uptime-kuma:
-    extends:
-      file: ${TEMPLATES_PATH}
-      service: default
+    # not using the template because ncsd is not configured to support changing PUID/PGID
+    # https://github.com/louislam/uptime-kuma/issues/4743
+    # extends:
+    #   file: ${TEMPLATES_PATH}
+    #   service: default
     image: louislam/uptime-kuma:latest
     container_name: uptime-kuma
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges=true
+    environment:
+      TZ: ${TZ}
     volumes:
       - ${INFRA_PATH}/uptime-kuma/config:/app/data
     ports:
       - 5001:3001
+    networks:
+      - ip4net
+      - ip6net
     labels:
       # Watchtower
       - "com.centurylinklabs.watchtower.enable=true"

project/infrastructure/watchtower/watchtower.yml

@@ -16,6 +16,8 @@ services:
       - WATCHTOWER_HTTP_API_PERIODIC_POLLS=true
     ports:
       - 7999:8080
+    networks:
+      - ip4net
     volumes:
       # - ${INFRA_PATH}/watchtower/config:/config.json
       - /var/run/docker.sock:/var/run/docker.sock

project/media/audiobookshelf/audiobookshelf.yml

@@ -7,6 +7,8 @@ services:
     container_name: audiobookshelf
     ports:
       - 13378:80
+    networks:
+      - ip6net
     volumes:
       # - ${AUDIOBOOKSHELF_EXTERNAL_PATH}/audiobooks:/audiobooks
       # - ${AUDIOBOOKSHELF_EXTERNAL_PATH}/podcasts:/podcasts
@@ -23,4 +25,4 @@ services:
       - "traefik.http.routers.audiobookshelf.tls.certresolver=myresolver"
       - 'traefik.http.routers.audiobookshelf.tls=true'
       # Middlewares
-      - "traefik.http.routers.audiobookshelf.middlewares=crowdsec-bouncer@file"
+      # - "traefik.http.routers.audiobookshelf.middlewares=crowdsec-bouncer@file"

project/media/immich/immich.yml

@@ -5,7 +5,6 @@ services:
       service: default
     container_name: immich_server
     image: ghcr.io/immich-app/immich-server:release
-    command: [ "start.sh", "immich" ]
     environment:
       DB_PASSWORD: ${IMMICH_DB_PASSWORD}
       DB_HOSTNAME: postgres-with-pg-vector
@@ -18,6 +17,8 @@ services:
       - /etc/localtime:/etc/localtime:ro
     ports:
       - 2283:3001
+    networks:
+      - ip6net
     labels:
       # Watchtower
       - "com.centurylinklabs.watchtower.enable=true"
@@ -28,7 +29,7 @@ services:
       - "traefik.http.routers.immich-server.tls.certresolver=myresolver"
       - 'traefik.http.routers.immich-server.tls=true'
       # Middlewares
-      - "traefik.http.routers.immich-server.middlewares=crowdsec-bouncer@file"
+      # - "traefik.http.routers.immich-server.middlewares=crowdsec-bouncer@file"
 
   immich-microservices:
     extends:
@@ -43,6 +44,8 @@ services:
       DB_USERNAME: immich
       DB_DATABASE_NAME: immich
       REDIS_HOSTNAME: redis
+    networks:
+      - ip6net
     volumes:
       - ${IMMICH_EXTERNAL_PATH}:/usr/src/app/external
       - ${MEDIA_PATH}/immich/data/library:/usr/src/app/upload

project/media/prowlarr/prowlarr.yml

@@ -7,6 +7,8 @@ services:
     container_name: prowlarr
     ports:
       - 2004:9696
+    networks:
+      - ip4net
     volumes:
       - ${MEDIA_PATH}/prowlarr/config:/config
     labels:

project/media/qbittorrent/qbittorrent.yml

@@ -9,6 +9,8 @@ services:
       - 2002:2002
       - 6881:6881
       - 6881:6881/udp
+    networks:
+      - ip4net
     environment:
       - WEBUI_PORT=2002
       - TORRENTING_PORT=6881

project/media/readarr/readarr.yml

@@ -7,6 +7,8 @@ services:
     container_name: readarr
     ports:
       - 2003:8787
+    networks:
+      - ip4net
     volumes:
       - ${MEDIA_PATH}/readarr/config:/config
       - ${MEDIA_PATH}/data:/data

project/monitoring/dozzle/dozzle.yml

@@ -7,6 +7,8 @@ services:
     image: amir20/dozzle:latest
     ports:
       - 8083:8080
+    networks: 
+      - ip4net
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
     labels:

project/monitoring/grafana/grafana.yml

@@ -7,6 +7,8 @@ services:
     image: grafana/grafana-oss:latest
     ports:
       - 8090:3000
+    networks:
+      - ip4net
     volumes:
       - ${MONITORING_PATH}/grafana/data:/var/lib/grafana
     labels:

project/monitoring/prometheus/prometheus.yml

@@ -7,6 +7,8 @@ services:
     image: prom/prometheus:latest
     ports:
       - 9090:9090
+    networks:
+      - ip4net
     volumes:
       - ${MONITORING_PATH}/prometheus/config:/etc/prometheus
     labels:

project/service/freshrss/freshrss.yml

@@ -0,0 +1,28 @@
+services:
+  freshrss:
+    extends:
+      file: ${TEMPLATES_PATH}
+      service: default
+    image: freshrss/freshrss:latest
+    container_name: freshrss
+    ports:
+      - 4014:80
+    networks:
+      - ip4net
+    volumes:
+      - ${SERVICE_PATH}/freshrss/data:/var/www/FreshRSS/data
+      - ${SERVICE_PATH}/freshrss/extensions:/var/www/FreshRSS/extensions
+    environment:
+      CRON_MIN: '3,33'
+      TRUSTED_PROXY: 172.16.0.1/12 192.168.0.1/16
+    labels:
+      # Watchtower
+      - "com.centurylinklabs.watchtower.enable=true"
+      # Traefik
+      - "traefik.enable=true"
+      - "traefik.http.routers.freshrss.rule=Host(`rss.${LOCAL_DOMAIN}`)"
+      - "traefik.http.routers.freshrss.entrypoints=https"
+      - "traefik.http.routers.freshrss.tls=true"
+      #- "traefik.http.routers.freshrss.tls.certresolver=myresolver"
+      # Middlewares
+      #- "traefik.http.routers.freshrss.middlewares=crowdsec-bouncer@file"

project/service/gitea/gitea.yml

@@ -32,6 +32,8 @@ services:
       - /etc/localtime:/etc/localtime:ro
     ports:
       - 2001:22
+    networks:
+      - ip6net
     expose:
       - 4002
     labels:
@@ -45,6 +47,5 @@ services:
       - "traefik.http.routers.gitea.tls=true"
       - "traefik.http.routers.gitea.service=gitea-service"
       - "traefik.http.services.gitea-service.loadbalancer.server.port=4002"
-
       # Middlewares
-      - "traefik.http.routers.gitea.middlewares=crowdsec-bouncer@file"
+      # - "traefik.http.routers.gitea.middlewares=crowdsec-bouncer@file"

project/service/home-assistant/home-assistant.yml

@@ -5,6 +5,8 @@ services:
       service: default
     image: ghcr.io/home-assistant/home-assistant:stable
     container_name: home-assistant
+    networks:
+      - ip4net
     ports:
       - 4012:8123  
     volumes:

project/service/it-tools/it-tools.yml

@@ -7,6 +7,8 @@ services:
     container_name: it-tools
     ports:
       - '4007:80'
+    networks:
+      - ip4net
     labels:
       # Watchtower
       - "com.centurylinklabs.watchtower.enable=true"

project/service/jupyter-notebook/jupyter-notebook.yml

@@ -0,0 +1,21 @@
+services:
+  jupyter:
+    extends:
+      file: ${TEMPLATES_PATH}
+      service: default
+    image: quay.io/jupyter/base-notebook:latest
+    container_name: jupyter
+    volumes:
+      - ${SERVICE_PATH}/jupyter-notebook/data:/home/jovyan/work
+    ports:
+      - 4013:8888 # Web UI
+    networks:
+      - ip4net
+    labels:
+      # Watchtower
+      - "com.centurylinklabs.watchtower.enable=true"
+      # Traefik
+      - "traefik.enable=true"
+      - "traefik.http.routers.jupyter.rule=Host(`jupyter.${LOCAL_DOMAIN}`)"
+      - "traefik.http.routers.jupyter.entrypoints=https"
+      - "traefik.http.routers.jupyter.tls=true"

project/service/mealie/mealie.yml

@@ -7,6 +7,8 @@ services:
     container_name: mealie
     ports:
       - "4006:9000"
+    networks:
+      - ip6net
     volumes:
       - ${SERVICE_PATH}/mealie/data:/app/data/
     environment:
@@ -41,4 +43,4 @@ services:
       - "traefik.http.routers.mealie.tls.certresolver=myresolver"
       - "traefik.http.routers.mealie.tls=true"
       # Middlewares
-      - "traefik.http.routers.mealie.middlewares=crowdsec-bouncer@file"
+      # - "traefik.http.routers.mealie.middlewares=crowdsec-bouncer@file"

project/service/paperless-ngx/paperless-ngx.yml

@@ -7,6 +7,8 @@ services:
     container_name: paperless-ngx
     ports:
       - "4009:8000"
+    networks:
+      - ip4net
     volumes:
       - ${EXTERNAL_STORAGE}/paperless-ngx/data:/usr/src/paperless/data
       - ${EXTERNAL_STORAGE}/paperless-ngx/media:/usr/src/paperless/media

project/service/shlink/shlink.yml

@@ -7,6 +7,8 @@ services:
     container_name: shlink-backend
     ports:
       - '4004:8080'
+    networks:
+      - ip6net
     volumes:
       - ${SERVICE_PATH}/shlink/data:/usr/share/tesseract-ocr/4.00/tessdata #Required for extra OCR languages
       - ${SERVICE_PATH}/shlink/config:/configs
@@ -41,6 +43,8 @@ services:
     container_name: shlink-frontend
     ports:
       - '4005:8080'
+    networks: 
+      - ip6net
     environment:
       SHLINK_SERVER_URL: https://shlink.${PUBLIC_DOMAIN}
       SHLINK_SERVER_API_KEY: ${SHLINK_SERVER_API_KEY}

project/service/sponsorblock/sponsorblock.yml

@@ -5,5 +5,7 @@ services:
       service: default
     image: ghcr.io/dmunozv04/isponsorblocktv
     container_name: sponsorblock
+    networks:
+      - ip4net
     volumes:
     - ${SERVICE_PATH}/sponsorblock/data:/app/data

project/service/stirling-pdf/stirling-pdf.yml

@@ -7,10 +7,12 @@ services:
     container_name: stirling-pdf
     ports:
       - '4003:8080'
+    networks:
+      - ip6net
     volumes:
       - ${SERVICE_PATH}/stirling-pdf/data:/usr/share/tesseract-ocr/4.00/tessdata #Required for extra OCR languages
       - ${SERVICE_PATH}/stirling-pdf/config:/configs
-#      - /location/of/customFiles:/customFiles/
+    #  - /location/of/customFiles:/customFiles/
     labels:
       # Watchtower
       - "com.centurylinklabs.watchtower.enable=true"
@@ -21,4 +23,5 @@ services:
       - "traefik.http.routers.stirling-pdf.tls.certresolver=myresolver"
       - "traefik.http.routers.stirling-pdf.tls=true"
       # Middlewares
-      - "traefik.http.routers.stirling-pdf.middlewares=crowdsec-bouncer@file,authelia@file"
+      # - "traefik.http.routers.stirling-pdf.middlewares=crowdsec-bouncer@file, authelia@file"
+      - "traefik.http.routers.stirling-pdf.middlewares=authelia@file"

project/service/vikunja/vikunja.yml

@@ -17,6 +17,8 @@ services:
       VIKUNJA_DATABASE_DATABASE: vikunja
       VIKUNJA_SERVICE_JWTSECRET: /run/secrets/vikunja_jwt_secret
       VIKUNJA_SERVICE_PUBLICURL: https://vikunja.${PUBLIC_DOMAIN}
+    networks:
+      - ip6net
     volumes: 
       - ${SERVICE_PATH}/vikunja/data:/app/vikunja/files
       - ${SERVICE_PATH}/vikunja/config:/etc/vikunja
@@ -30,4 +32,4 @@ services:
       - "traefik.http.routers.vikunja.tls.certresolver=myresolver"
       - 'traefik.http.routers.vikunja.tls=true'
       # Middlewares
-      - "traefik.http.routers.vikunja.middlewares=crowdsec-bouncer@file"
+      # - "traefik.http.routers.vikunja.middlewares=crowdsec-bouncer@file"