ginnoir
51acb44322
Deploy to valhalla / deploy (push) Has been cancelled
Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.
92 lines
2.7 KiB
YAML
92 lines
2.7 KiB
YAML
# notify stack — ntfy push, FreshRSS reader, and the Vigilant RSS watcher.
|
|
#
|
|
# Volume -> bind-mount conversion:
|
|
# vigilant cache -> /config/vigilant/cache (SSD; regenerable)
|
|
# ntfy + freshrss are proxied (ntfy.ginnoir.com, freshrss.ginnoir.com). Vigilant
|
|
# only needs egress to post to ntfy's public URL; all three join edge.
|
|
|
|
services:
|
|
ntfy:
|
|
image: binwiederhier/ntfy:latest
|
|
container_name: ntfy
|
|
command:
|
|
- serve
|
|
restart: unless-stopped
|
|
networks: [edge]
|
|
env_file:
|
|
- stack.env
|
|
environment:
|
|
- NTFY_DEFAULT_HOST=https://ntfy.ginnoir.com
|
|
- NTFY_BASE_URL=https://ntfy.ginnoir.com
|
|
- NTFY_CACHE_FILE=/var/lib/ntfy/cache.db
|
|
- NTFY_AUTH_FILE=/var/lib/ntfy/auth.db
|
|
- NTFY_AUTH_DEFAULT_ACCESS=read-write
|
|
- NTFY_BEHIND_PROXY=true
|
|
- NTFY_ATTACHMENT_CACHE_DIR=/var/lib/ntfy/attachments
|
|
- NTFY_ENABLE_LOGIN=true
|
|
user: 1000:1000
|
|
volumes:
|
|
- /config/ntfy/var/cache/ntfy:/var/cache/ntfy
|
|
- /config/ntfy/etc/ntfy:/etc/ntfy
|
|
- /config/ntfy/var/lib/ntfy:/var/lib/ntfy
|
|
ports:
|
|
- "8000:80"
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo '\"healthy\"\\s*:\\s*true' || exit 1",
|
|
]
|
|
interval: 60s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 40s
|
|
|
|
freshrss:
|
|
image: freshrss/freshrss:latest
|
|
container_name: freshrss
|
|
hostname: freshrss
|
|
restart: unless-stopped
|
|
networks: [edge]
|
|
logging:
|
|
options:
|
|
max-size: 10m
|
|
volumes:
|
|
- /config/freshrss/data:/var/www/FreshRSS/data
|
|
- /config/freshrss/extensions:/var/www/FreshRSS/extensions
|
|
ports:
|
|
- "9999:80"
|
|
env_file:
|
|
- stack.env
|
|
environment:
|
|
- CRON_MIN=3,33
|
|
- TRUSTED_PROXY=172.16.0.1/12 192.168.0.1/16
|
|
- FRESHRSS_INSTALL=--default-user ginnoir --api-enabled --base-url https://freshrss.ginnoir.com
|
|
- OIDC_ENABLED=1
|
|
- OIDC_PROVIDER_METADATA_URL=https://auth.ginnoir.com/application/o/freshrss/.well-known/openid-configuration
|
|
- OIDC_REMOTE_USER_CLAIM=preferred_username
|
|
- OIDC_SCOPES=openid profile email
|
|
- OIDC_X_FORWARDED_HEADERS=X-Forwarded-Host X-Forwarded-Proto
|
|
|
|
vigilant:
|
|
container_name: vigilant
|
|
image: ghcr.io/verifiedjoseph/vigilant:latest
|
|
restart: unless-stopped
|
|
networks: [edge]
|
|
env_file:
|
|
- stack.env
|
|
environment:
|
|
- VIGILANT_NOTIFICATION_SERVICE=ntfy
|
|
- VIGILANT_NOTIFICATION_NTFY_URL=https://ntfy.ginnoir.com/
|
|
- VIGILANT_NOTIFICATION_NTFY_TOPIC=RSS
|
|
volumes:
|
|
- /config/vigilant/feeds.yaml:/app/feeds.yaml
|
|
- /config/vigilant/cache:/app/cache
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
networks:
|
|
edge:
|
|
name: edge
|
|
external: true
|