ginnoir
57cd6ed270
Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media, foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev). Each app stack joins a shared external `edge` network for Caddy and keeps its DB/cache co-located (no shared backing services). All named volumes convert to tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry -> /storage1/labdata (ZFS). Gitea repos+LFS split to ZFS. Move Vault into the management plane (portainer-compose.yml) and add the shared `edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl. Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live monolith is unchanged. Live cutover (Phase B) is next.
105 lines
3.7 KiB
YAML
105 lines
3.7 KiB
YAML
# Management plane: portainer, vault, github-runner, watchtower.
|
|
# These manage / underpin the application stacks rather than being part of them,
|
|
# so they are deployed by raw `docker compose` (NOT a Portainer-managed stack) —
|
|
# Portainer cannot manage the stack that contains Portainer itself.
|
|
#
|
|
# This file owns the shared infrastructure networks:
|
|
# - edge : the single reverse-proxy network. Caddy + every service it
|
|
# proxies join this. Replaces caddy's old per-stack network
|
|
# membership. App stacks reference it as external.
|
|
# - portainer_proxy : legacy net for caddy -> portainer. Kept until the monolith
|
|
# is fully dismantled, then dropped (portainer is on edge too).
|
|
#
|
|
# Vault lives here (moved out of the dev stack): it is estate-wide secrets infra,
|
|
# must boot before the app stacks, and should not reseal when a dev tool changes.
|
|
# Vault data is the /config/vault bind mount — moving the service definition here
|
|
# does not touch any data. Re-unseal after (apply-compose.ps1 -VaultUnseal).
|
|
#
|
|
# Fresh-install order:
|
|
# docker compose -f portainer-compose.yml up -d # networks + mgmt plane first
|
|
# (then create the Portainer git stacks for proxy + each app domain)
|
|
|
|
services:
|
|
portainer:
|
|
container_name: portainer
|
|
image: portainer/portainer-ce:latest
|
|
restart: unless-stopped
|
|
networks:
|
|
- portainer_proxy
|
|
- edge
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- /config/portainer:/data
|
|
ports:
|
|
- "9100:9000"
|
|
labels:
|
|
- "com.centurylabs.watchtower.enable=false"
|
|
|
|
# ============================================================
|
|
# VAULT (estate-wide secret management)
|
|
# One-time setup after first start:
|
|
# docker exec -it vault vault operator init
|
|
# vault operator unseal (3x with unseal keys)
|
|
# Unseal keys + root token live in .env (they are the one secret Vault
|
|
# itself cannot hold). Re-unseal after a restart with:
|
|
# powershell -File apply-compose.ps1 -VaultUnseal
|
|
# ============================================================
|
|
vault:
|
|
container_name: vault
|
|
image: hashicorp/vault:latest
|
|
restart: unless-stopped
|
|
networks:
|
|
- edge
|
|
cap_add:
|
|
- IPC_LOCK
|
|
environment:
|
|
- VAULT_ADDR=http://0.0.0.0:8200
|
|
volumes:
|
|
- /config/vault/config:/vault/config:ro
|
|
- /config/vault/data:/vault/data
|
|
- /config/vault/logs:/vault/logs
|
|
command: vault server -config=/vault/config/vault.hcl
|
|
ports:
|
|
- "8200:8200"
|
|
labels:
|
|
- "com.centurylabs.watchtower.enable=false"
|
|
|
|
github-runner:
|
|
container_name: github_runner
|
|
image: myoung34/github-runner:latest
|
|
restart: unless-stopped
|
|
environment:
|
|
- ACCESS_TOKEN=${GITHUB_RUNNER_ACCESS_TOKEN}
|
|
- REPO_URL=https://github.com/ginnoir/homelabstack
|
|
- RUNNER_NAME=valhalla
|
|
- RUNNER_LABELS=self-hosted,Linux,x64
|
|
- RUNNER_SCOPE=repo
|
|
- DOCKER_GROUP_GID=1001
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- /home/ginnoir/valhalla-lab:/valhalla-lab
|
|
- /config/caddy:/config/caddy
|
|
labels:
|
|
- "com.centurylabs.watchtower.enable=false"
|
|
|
|
watchtower:
|
|
container_name: watchtower
|
|
image: containrrr/watchtower:latest
|
|
restart: unless-stopped
|
|
environment:
|
|
- DOCKER_API_VERSION=1.40
|
|
- WATCHTOWER_NOTIFICATION_SKIP_TITLE=true
|
|
- WATCHTOWER_NOTIFICATION_URL=ntfy://ntfy.ginnoir.com/watchtower?title=WatchtowerUpdates
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
labels:
|
|
- "com.centurylabs.watchtower.enable=false"
|
|
|
|
networks:
|
|
edge:
|
|
name: edge
|
|
driver: bridge
|
|
portainer_proxy:
|
|
name: portainer_proxy
|
|
driver: bridge
|