iac/docker/arm/docker-compose.yml at aa9587ed9546b56b23bf3c698a8ccba071b40e03 · Mafyuh/iac · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/compose-spec/compose-spec/master/schema/compose-spec.json
services:
  gotify:
    image: ghcr.io/gotify/server:2.8.0
    container_name: gotify
    ports:
      - 9008:80
    volumes:
      - /docker/appdata/gotify:/app/data
    restart: unless-stopped
    environment:
      - TZ=America/New_York
      - GOTIFY_DEFAULTUSER_NAME=$GOTIFY_DEFAULTUSER_NAME
      - GOTIFY_DEFAULTUSER_PASS=$GOTIFY_DEFAULTUSER_PASS
    networks:
      - gitea_main

  nginx-proxy-manager:
    image: jc21/nginx-proxy-manager:2.13.7
    container_name: nginx-proxy-manager
    ports:
      - 80:80
      - 81:81
      - 443:443
    volumes:
      - /docker/appdata/nginx/data:/data
      - /docker/appdata/nginx/letsencrypt:/etc/letsencrypt
    restart: unless-stopped
    networks:
      - gitea_main

  fail2ban:
    image: crazymax/fail2ban:1.1.0
    container_name: fail2ban
    network_mode: "host"
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - "/docker/appdata/fail2ban/data:/data"
      - "/var/log/auth.log:/var/log/auth.log:ro"
      - "/docker/appdata/nginx/data/logs/:/log/npm/:ro"
      - "/docker/appdata/fail2ban/f2b-logs:/f2b-logs:rw"
    environment:
      - TZ=America/New_York
      - F2B_LOG_TARGET=/f2b-logs/fail2ban.log
      - F2B_LOG_LEVEL=INFO
      - F2B_DB_PURGE_AGE=1d
      - F2B_MAX_RETRY=3
      - SSMTP_HOST=$SSMTP_HOST
      - SSMTP_PORT=587
      - SSMTP_HOSTNAME=$SSMTP_HOSTNAME
      - SSMTP_USER=$SSMTP_USER
      - SSMTP_PASSWORD=$SSMTP_PASSWORD
      - SSMTP_TLS=YES
      - DATABASE_URL=postgresql://user:password@host[:port]/database_name
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "10"
    restart: unless-stopped

  linkstack:
    image: linkstackorg/linkstack@sha256:d9c4e1fd521e1ae78e796ac549b4d3e6371665775761d6c712aec8ac3bd9c5bc
    container_name: linkstack
    ports:
      - 8005:80
      - 8006:443
    volumes:
      - linkstack:/htdocs
    environment:
      - HTTP_SERVER_NAME=$HTTP_SERVER_NAME
      - HTTPS_SERVER_NAME=$HTTP_SERVER_NAME
      - SERVER_ADMIN=$SERVER_ADMIN
    restart: unless-stopped
    networks:
      - gitea_main
  n8n:
    image: ghcr.io/n8n-io/n8n:2.7.3
    container_name: n8n
    ports:
      - 5678:5678
    volumes:
      - n8n_data:/home/node/.n8n
    environment:
      - GENERIC_TIMEZONE=America/New_York
      - TZ=America/New_York
      - WEBHOOK_URL=$WEBHOOK_URL
    restart: unless-stopped
    networks:
      - gitea_main

  vaultwarden:
    image: ghcr.io/dani-garcia/vaultwarden:1.35.3
    container_name: vaultwarden
    volumes:
      - /home/mafyuh/vw-data/:/data
    environment:
      - DOMAIN=$VWDOMAIN
      - SIGNUPS_ALLOWED=true
      - SSO_ENABLED=true
      - SSO_AUTHORITY=https://auth.mafyuh.io/application/o/vaultwarden/
      - SSO_SCOPES="openid email profile offline_access"
      - SSO_ONLY=true
      - SSO_AUTH_ONLY_NOT_SESSION=true
      - SSO_CLIENT_ID=e17019c548f26f15e483b74b2b0a95e8900a03bb
      - SSO_CLIENT_SECRET=$SSO_CLIENT_SECRET
      - SMTP_HOST=smtp.protonmail.ch
      - SMTP_FROM=noreply@mafyuh.dev
      - SMTP_FROM_NAME=Vaultwarden
      - SMTP_USERNAME=noreply@mafyuh.dev
      - SMTP_PASSWORD=$SMTP_PASSWORD
      - SMTP_TIMEOUT=15
      - SMTP_SECURITY=starttls
      - SMTP_PORT=587
      - DATABASE_URL=$DATABASE_URL
    restart: unless-stopped
    networks:
      gitea_main:
        ipv4_address: 172.25.0.25

  postgres:
    image: postgres:18
    container_name: postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: vaultwarden
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: vaultwarden
    volumes:
      - postgres_data:/var/lib/postgresql
    ports:
      - 5432:5432
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - gitea_main

networks:
  gitea_main:
    external: true

volumes:
  linkstack:
  n8n_data:
  postgres_data: