ginnoir
57cd6ed270
Add stacks/<domain>/ compose + env for the 11 target stacks (proxy, media, foundry, owncloud, resume, famapp, authentik, notify, monitoring, remote, dev). Each app stack joins a shared external `edge` network for Caddy and keeps its DB/cache co-located (no shared backing services). All named volumes convert to tiered bind mounts: DBs/configs -> /config (SSD), blobs/repos/registry -> /storage1/labdata (ZFS). Gitea repos+LFS split to ZFS. Move Vault into the management plane (portainer-compose.yml) and add the shared `edge` network there. apply-compose.ps1 -Portainer now also pushes vault.hcl. Additive only: root docker-compose.yml/.env/Caddyfile untouched, so the live monolith is unchanged. Live cutover (Phase B) is next.
83 lines
2.5 KiB
YAML
83 lines
2.5 KiB
YAML
# notify stack — ntfy push, FreshRSS reader, and the Vigilant RSS watcher.
|
|
#
|
|
# Volume -> bind-mount conversion:
|
|
# vigilant cache -> /config/vigilant/cache (SSD; regenerable)
|
|
# ntfy + freshrss are proxied (ntfy.ginnoir.com, freshrss.ginnoir.com). Vigilant
|
|
# only needs egress to post to ntfy's public URL; all three join edge.
|
|
|
|
services:
|
|
ntfy:
|
|
image: binwiederhier/ntfy:latest
|
|
container_name: ntfy
|
|
command:
|
|
- serve
|
|
restart: unless-stopped
|
|
networks: [edge]
|
|
environment:
|
|
- TZ=${TZ}
|
|
- NTFY_DEFAULT_HOST=https://ntfy.ginnoir.com
|
|
- NTFY_BASE_URL=https://ntfy.ginnoir.com
|
|
- NTFY_CACHE_FILE=/var/lib/ntfy/cache.db
|
|
- NTFY_AUTH_FILE=/var/lib/ntfy/auth.db
|
|
- NTFY_AUTH_DEFAULT_ACCESS=read-write
|
|
- NTFY_BEHIND_PROXY=true
|
|
- NTFY_ATTACHMENT_CACHE_DIR=/var/lib/ntfy/attachments
|
|
- NTFY_ENABLE_LOGIN=true
|
|
user: 1000:1000
|
|
volumes:
|
|
- /config/ntfy/var/cache/ntfy:/var/cache/ntfy
|
|
- /config/ntfy/etc/ntfy:/etc/ntfy
|
|
- /config/ntfy/var/lib/ntfy:/var/lib/ntfy
|
|
ports:
|
|
- "8000:80"
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo '\"healthy\"\\s*:\\s*true' || exit 1",
|
|
]
|
|
interval: 60s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 40s
|
|
|
|
freshrss:
|
|
image: freshrss/freshrss:latest
|
|
container_name: freshrss
|
|
hostname: freshrss
|
|
restart: unless-stopped
|
|
networks: [edge]
|
|
logging:
|
|
options:
|
|
max-size: 10m
|
|
volumes:
|
|
- /config/freshrss/data:/var/www/FreshRSS/data
|
|
- /config/freshrss/extensions:/var/www/FreshRSS/extensions
|
|
ports:
|
|
- "9999:80"
|
|
environment:
|
|
- CRON_MIN=3,33
|
|
- TRUSTED_PROXY=172.16.0.1/12 192.168.0.1/16
|
|
- FRESHRSS_INSTALL=--default-user ginnoir --api-enabled --base-url https://freshrss.ginnoir.com
|
|
- FRESHRSS_USER=--api-password ${FRESHRSS_API_PASSWORD} --email ${FRESHRSS_EMAIL} --password ${FRESHRSS_PASSWORD} --user ginnoir
|
|
|
|
vigilant:
|
|
container_name: vigilant
|
|
image: ghcr.io/verifiedjoseph/vigilant:latest
|
|
restart: unless-stopped
|
|
networks: [edge]
|
|
environment:
|
|
- VIGILANT_NOTIFICATION_SERVICE=ntfy
|
|
- VIGILANT_NOTIFICATION_NTFY_URL=https://ntfy.ginnoir.com/
|
|
- VIGILANT_NOTIFICATION_NTFY_TOPIC=RSS
|
|
volumes:
|
|
- /config/vigilant/feeds.yaml:/app/feeds.yaml
|
|
- /config/vigilant/cache:/app/cache
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
networks:
|
|
edge:
|
|
name: edge
|
|
external: true
|