ginnoir
57cd6ed270
Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media, foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev). Each app stack joins a shared external `edge` network for Caddy and keeps its DB/cache co-located (no shared backing services). All named volumes convert to tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry -> /storage1/labdata (ZFS). Gitea repos+LFS split to ZFS. Move Vault into the management plane (portainer-compose.yml) and add the shared `edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl. Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live monolith is unchanged. Live cutover (Phase B) is next.
91 lines
2.9 KiB
YAML
91 lines
2.9 KiB
YAML
# famapp stack — family app + its Postgres and MinIO (plant/container images).
|
|
#
|
|
# Volume -> bind-mount conversions:
|
|
# db data -> /config/famapp/postgres (SSD; DB)
|
|
# minio data -> /storage1/labdata/famapp/minio (ZFS; uploaded images)
|
|
# Only famapp joins edge (fam.ginnoir.com); db + minio stay private.
|
|
# famapp reaches Authentik (OIDC) and ntfy over their public URLs through Caddy,
|
|
# so there is no cross-stack container dependency.
|
|
|
|
services:
|
|
famapp:
|
|
container_name: famapp
|
|
image: ${FAMAPP_IMAGE:-ghcr.io/ginnoir/famapp:latest}
|
|
pull_policy: ${FAMAPP_PULL_POLICY:-always}
|
|
restart: unless-stopped
|
|
networks: [famapp, edge]
|
|
environment:
|
|
NODE_ENV: production
|
|
AUTH_URL: ${AUTH_URL}
|
|
DATABASE_URL: postgres://${FAMAPP_DB_USER}:${FAMAPP_DB_PASSWORD}@famapp-db:5432/${FAMAPP_DB_NAME}
|
|
AUTH_SECRET: ${FAMAPP_AUTH_SECRET}
|
|
AUTH_OIDC_ISSUER: ${AUTH_OIDC_ISSUER}
|
|
AUTH_OIDC_CLIENT_ID: ${AUTH_OIDC_CLIENT_ID}
|
|
AUTH_OIDC_CLIENT_SECRET: ${AUTH_OIDC_CLIENT_SECRET}
|
|
VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
|
|
VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
|
|
VAPID_SUBJECT: ${VAPID_SUBJECT}
|
|
NTFY_URL: ${NTFY_URL:-}
|
|
NTFY_TOPIC: ${NTFY_TOPIC:-}
|
|
LOG_LEVEL: ${LOG_LEVEL:-info}
|
|
RUN_MIGRATIONS: ${RUN_MIGRATIONS:-true}
|
|
MINIO_ENDPOINT: http://famapp-minio:9000
|
|
MINIO_ROOT_USER: ${famapp_MINIO_ROOT_USER}
|
|
MINIO_ROOT_PASSWORD: ${famapp_MINIO_ROOT_PASSWORD}
|
|
MINIO_BUCKET: ${famapp_MINIO_BUCKET}
|
|
OPENPLANTBOOK_CLIENT_ID: ${famapp_OPENPLANTBOOK_CLIENT_ID}
|
|
OPENPLANTBOOK_CLIENT_SECRET: ${famapp_OPENPLANTBOOK_CLIENT_SECRET}
|
|
ports:
|
|
- "3010:3000"
|
|
depends_on:
|
|
famapp-db:
|
|
condition: service_healthy
|
|
famapp-minio:
|
|
condition: service_healthy
|
|
|
|
famapp-db:
|
|
container_name: postgres_famapp
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
networks: [famapp]
|
|
environment:
|
|
POSTGRES_USER: ${FAMAPP_DB_USER}
|
|
POSTGRES_PASSWORD: ${FAMAPP_DB_PASSWORD}
|
|
POSTGRES_DB: ${FAMAPP_DB_NAME}
|
|
volumes:
|
|
- /config/famapp/postgres:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${FAMAPP_DB_USER} -d ${FAMAPP_DB_NAME}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
famapp-minio:
|
|
container_name: minio_famapp
|
|
image: minio/minio:latest
|
|
command: server /data --console-address ":9003"
|
|
restart: unless-stopped
|
|
networks: [famapp]
|
|
environment:
|
|
MINIO_ROOT_USER: ${famapp_MINIO_ROOT_USER}
|
|
MINIO_ROOT_PASSWORD: ${famapp_MINIO_ROOT_PASSWORD}
|
|
volumes:
|
|
- /storage1/labdata/famapp/minio:/data
|
|
ports:
|
|
- "9002:9000"
|
|
- "9003:9003"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live || exit 1"]
|
|
interval: 30s
|
|
timeout: 20s
|
|
retries: 3
|
|
start_period: 30s
|
|
|
|
networks:
|
|
famapp:
|
|
name: famapp
|
|
driver: bridge
|
|
edge:
|
|
name: edge
|
|
external: true
|