homelabarr.yml

# HomelabARR GHCR Production Deployment
#
# REQUIRED before deploying:
#   ./secrets/      — run scripts/init-secrets.sh to bootstrap secret files
#   CORS_ORIGIN     — your public domain (e.g., https://homelabarr.example.com)
#
# OPTIONAL (defaults shown):
#   CLI_BRIDGE_HOST_PATH  — path to your HomelabARR CLI installation (default: /opt/homelabarr)
#   FRONTEND_PORT         — host port for the dashboard (default: 8084)
#
# Usage:
#   docker compose -f homelabarr.yml up -d

secrets:
  jwt_key_current:
    file: ${JWT_SECRET_FILE:-./secrets/jwt_key_current}
  jwt_key_previous:
    file: ${JWT_KEY_PREVIOUS_FILE:-./secrets/jwt_key_previous}
  default_admin_password:
    file: ${DEFAULT_ADMIN_PASSWORD_FILE:-./secrets/default_admin_password}
  alert_webhook_secret:
    file: ${ALERT_WEBHOOK_SECRET_FILE:-./secrets/alert_webhook_secret}
  sqlcipher_key:
    file: ${SQLCIPHER_KEY_FILE:-./secrets/sqlcipher_key}

services:
  # Auto-updates: this compose does not opt in to Watchtower by default.
  # If you run Watchtower in opt-in (LABEL_ENABLE=true) mode and want
  # auto-pulls on this stack, add to each service:
  #   labels:
  #     - com.centurylinklabs.watchtower.enable=true
  # We recommend opt-in mode plus signature verification (see SECURITY.md).

  # Docker socket proxy — allow-listed API access only, no EXEC/BUILD
  socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest@sha256:a1740f01925d07c4ed6e73ea21ec798cff28e0a811b3c1672617b95eee76d79c
    container_name: homelabarr-socket-proxy
    restart: unless-stopped
    environment:
      - LOG_LEVEL=warning
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - VOLUMES=1
      - INFO=1
      - VERSION=1
      - PING=1
      - EVENTS=1
      - POST=1
      - ALLOW_START=1
      - ALLOW_STOP=1
      - ALLOW_RESTARTS=1
      - BUILD=0
      - COMMIT=0
      - CONFIGS=0
      - EXEC=0
      - GRPC=0
      - PLUGINS=0
      - SECRETS=0
      - SESSION=0
      - SWARM=0
      - SYSTEM=0
      - NODES=0
      - SERVICES=0
      - TASKS=0
      - DISTRIBUTION=0
    privileged: false
    read_only: true
    tmpfs:
      - /run
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - homelabarr-internal
    pids_limit: 64
    mem_limit: 64m
    cpus: 0.25
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:2375/_ping"]
      interval: 30s
      timeout: 5s
      retries: 3

  frontend:
    image: ghcr.io/imogenlabs/homelabarr-frontend:latest
    container_name: homelabarr-frontend
    restart: unless-stopped
    user: "101:101"
    environment:
      - BACKEND_URL=http://backend:8092
      - LOG_LEVEL=${LOG_LEVEL:-warn}
    ports:
      - "${FRONTEND_PORT:-8084}:8080"
    networks:
      - homelabarr
    cap_drop:
      - ALL
    security_opt:
      - apparmor=homelabarr-frontend
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /var/cache/nginx:rw,noexec,nosuid,nodev,size=32m
      - /var/run:rw,noexec,nosuid,nodev,size=2m
      - /etc/nginx/conf.d:rw,noexec,nosuid,nodev,size=1m
      - /tmp:rw,noexec,nosuid,nodev,size=8m
    pids_limit: 128
    mem_limit: 128m
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    depends_on:
      - backend

  backend:
    image: ghcr.io/imogenlabs/homelabarr-backend:latest
    container_name: homelabarr-backend
    restart: unless-stopped
    user: "1001:1001"
    environment:
      - NODE_ENV=production
      - PORT=8092
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - CORS_ORIGIN=${CORS_ORIGIN:?CORS_ORIGIN must be set to your public domain}
      - DOCKER_HOST=tcp://socket-proxy:2375
      - CLI_BRIDGE_PATH=/homelabarr
      - CLI_INTEGRATION_ENABLED=true
      - AUTH_ENABLED=${AUTH_ENABLED:-true}
      - SECRET_ROOT=/run/secrets
      - ACCESS_TOKEN_TTL=${ACCESS_TOKEN_TTL:-15m}
      - REFRESH_TOKEN_TTL=${REFRESH_TOKEN_TTL:-14d}
      # BIND_ADDRESS is intentionally 0.0.0.0 — binds inside the container's
      # network namespace only. Reachable from host only via Docker bridge.
      # Do NOT use network_mode: host with this binding.
      - BIND_ADDRESS=0.0.0.0
      - ALERT_WEBHOOK_URL=${ALERT_WEBHOOK_URL:-}
      - ALERT_EVENTS=${ALERT_EVENTS:-login.locked,audit.chain.broken,session.refresh.fail}
      - AUDIT_STRICT=${AUDIT_STRICT:-0}
    volumes:
      - ${CLI_BRIDGE_HOST_PATH:-/opt/homelabarr}:/homelabarr:ro
      - homelabarr-data:/app/data
      - homelabarr-config:/app/server/config
      - homelabarr-activity:/app/server/activity-data
    networks:
      - homelabarr
      - homelabarr-internal
    cap_drop:
      - ALL
    security_opt:
      - apparmor=homelabarr-backend
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=64m
      - /run:rw,noexec,nosuid,nodev,size=8m
    pids_limit: 256
    mem_limit: 768m
    cpus: 1.5
    secrets:
      - jwt_key_current
      - jwt_key_previous
      - default_admin_password
      - alert_webhook_secret
      - sqlcipher_key
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8092/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    depends_on:
      socket-proxy:
        condition: service_healthy

networks:
  homelabarr:
    name: homelabarr
    driver: bridge
  homelabarr-internal:
    name: homelabarr-internal
    driver: bridge
    internal: true

volumes:
  homelabarr-data:
    name: homelabarr-data
    driver: local
  homelabarr-config:
    name: homelabarr-config
    driver: local
  homelabarr-activity:
    name: homelabarr-activity
    driver: local