ginnoir
7aa95fa00a
Every service now reads stack.env via env_file with container-exact var
names — no ${VAR} parse-time interpolation, no Portainer UI env vars
(except stacks/dev, kept on UI-env interpolation as documented exception).
- media: drop PUID/PGID/TZ env lines (env_file covers); resolve ${ROOT}
- foundry: secrets via env_file; FOUNDRY_PATCH_URLS -> CONTAINER_PATCH_URLS
- monitoring: HOMARR_SECRET_ENCRYPTION_KEY -> SECRET_ENCRYPTION_KEY
- notify: FRESHRSS_USER composed in stack.env; TZ via env_file
- owncloud: container-exact OWNCLOUD_*/MYSQL_* keys; runtime $$ healthcheck
- resume/famapp: composites (DATABASE_URL etc.) written out in stack.env
- authentik: container-exact keys; image tag pinned in compose
- notes: couchdb creds via env_file
- remote: gains stack.env (no secrets; convention completeness)
- CLAUDE.md: env convention, valhalla-lab registration-only note, correct
on-host Portainer working-copy path (/config/portainer/compose/<id>)
Validated with docker compose config on valhalla for all 15 stacks.
45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
# proxy stack — Caddy reverse proxy / TLS terminator.
|
|
#
|
|
# Caddy is the single ingress for the whole estate. It joins only the shared
|
|
# `edge` network (owned by the management plane); every service it proxies also
|
|
# joins `edge`, so `reverse_proxy <service>:<port>` resolves by container name.
|
|
# This replaces Caddy's old membership in 11 separate per-stack networks.
|
|
#
|
|
# The Caddyfile itself is unchanged — upstreams are service names that resolve
|
|
# over edge. It is bind-mounted from /config/caddy/Caddyfile and hot-reloaded
|
|
# by the GitHub Actions runner on push (deploy.yml).
|
|
#
|
|
# serfriz/caddy-cloudflare-ddns bundles caddy-dns/cloudflare (DNS-01 ACME),
|
|
# caddy-cloudflare-ip (real client IPs behind CF), caddy-dynamicdns.
|
|
|
|
services:
|
|
caddy:
|
|
container_name: caddy
|
|
image: serfriz/caddy-cloudflare-ddns:latest
|
|
restart: unless-stopped
|
|
networks:
|
|
- edge
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
env_file:
|
|
- stack.env
|
|
volumes:
|
|
- /config/caddy/Caddyfile:/etc/caddy/Caddyfile
|
|
- /config/caddy/site:/srv
|
|
- /config/caddy/data:/data
|
|
- /config/caddy/config:/config
|
|
- /storage1/Books:/srv/Books
|
|
# Pokémon ROM-hack library (box art + guides + spreadsheets), served
|
|
# read-only and LAN-only by the romhacks-files.ginnoir.com site so the
|
|
# Obsidian catalog notes can embed art and link guides.
|
|
- /storage1/labdata/romhacks/library:/srv/romhacks:ro
|
|
# ROM files are exposed only through romhacks-files.ginnoir.com/_roms/*
|
|
# and that site imports internal_only in the Caddyfile.
|
|
- /storage1/Emulation/roms:/srv/roms:ro
|
|
|
|
networks:
|
|
edge:
|
|
name: edge
|
|
external: true
|