docker-compose.yml

---
# yaml-language-server: $schema=https://raw.githubusercontent.com/compose-spec/compose-spec/master/schema/compose-spec.json
services:
  caddy:
    image: ghcr.io/homeall/caddy-reverse-proxy-cloudflare:2026.08.11
    container_name: caddy
    ports:
      - 80:80
      - 443:443
      - 443:443/udp
      - 127.0.0.1:2019:2019
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /docker/appdata/caddy/data:/data
      - /docker/appdata/caddy/config:/config
      - ./config/Caddyfile:/etc/caddy/Caddyfile:ro
      - /docker/appdata/caddy/logs:/var/log/
    environment:
      - TZ=America/New_York
      - CLOUDFLARE_API_TOKEN=$CLOUDFLARE_API_TOKEN
      - CADDY_DOCKER_CADDYFILE_PATH=/etc/caddy/generated
    restart: unless-stopped
    networks:
      - racknerd
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"

  fail2ban:
    image: ghcr.io/crazy-max/fail2ban:1.1.0
    container_name: fail2ban-caddy
    network_mode: "host"
    privileged: true
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - "/docker/appdata/fail2ban-caddy/data:/data"
      - "/var/log/auth.log:/var/log/auth.log:ro"
      - "/docker/appdata/caddy/logs:/log/caddy:ro"
      - "/docker/appdata/fail2ban-caddy/f2b-logs:/f2b-logs:rw"
      - "./config/fail2ban-jail.conf:/data/jail.d/caddy.conf:ro"
      - "./config/fail2ban-action-iptables.conf:/data/action.d/iptables-custom.conf:ro"
      - "./config/caddy-auth.conf:/data/filter.d/caddy-auth.conf:ro"
      - "./config/caddy-botsearch.conf:/data/filter.d/caddy-botsearch.conf:ro"
      - "./config/caddy-limit.conf:/data/filter.d/caddy-limit.conf:ro"
    environment:
      - TZ=America/New_York
      - F2B_LOG_TARGET=/f2b-logs/fail2ban.log
      - F2B_LOG_LEVEL=INFO
      - F2B_DB_PURGE_AGE=1d
      - F2B_MAX_RETRY=3
      - SSMTP_HOST=$SSMTP_HOST
      - SSMTP_PORT=587
      - SSMTP_HOSTNAME=$SSMTP_HOSTNAME
      - SSMTP_USER=$SSMTP_USER
      - SSMTP_PASSWORD=$SSMTP_PASSWORD
      - SSMTP_TLS=YES
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "10"
    restart: unless-stopped
    depends_on:
      - caddy

  postgres:
    image: mirror.gcr.io/postgres:18.6
    container_name: postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: vaultwarden
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: vaultwarden
    volumes:
      - postgres_data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - racknerd

  databasus:
    image: mirror.gcr.io/databasus/databasus:v3.51.0
    container_name: databasus
    volumes:
      - databasus_data:/databasus-data
    restart: unless-stopped
    networks:
      - racknerd
    labels:
      caddy: $DATABASUS_HOSTNAME
      caddy.reverse_proxy: "{{upstreams 4005}}"

  forgejo:
    image: data.forgejo.org/forgejo/forgejo:16.0.2
    container_name: forgejo
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=postgres:5432
      - GITEA__database__NAME=forgejo
      - GITEA__database__USER=vaultwarden
      - GITEA__database__PASSWD=$POSTGRES_PASSWORD
      - GITEA__openid__ENABLE_OPENID_SIGNIN=false
      - GITEA__oauth2_client__ENABLE_AUTO_REGISTRATION=true
      - GITEA__oauth2_client__USERNAME=preferred_username
      - GITEA__oauth2_client__UPDATE_AVATAR=true
      - GITEA__oauth2_client__OPENID_CONNECT_SCOPES=openid email profile
      - GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=true
      - GITEA__service__DISABLE_REGISTRATION=false
    restart: always
    networks:
      - racknerd
    volumes:
      - forgejo_data:/data
      - /etc/localtime:/etc/localtime:ro
    depends_on:
      postgres:
        condition: service_healthy
    labels:
      caddy: git.mafyuh.io
      caddy.reverse_proxy: "{{upstreams 3000}}"

networks:
  racknerd:
    external: true

volumes:
  postgres_data:
  databasus_data:
  forgejo_data: