build

__swarm/authentik/stack.env

@@ -3,7 +3,7 @@ PG_USER=authentik
 PG_DB=authentik
 AUTHENTIK_SECRET_KEY=ZKkVCxj8kKj5ZklvzxKG2IgYQOftDoLPRjc57yomr1qzbKEQVZ
 AUTHENTIK_ERROR_REPORTING__ENABLED=true
-AUTHENTIK_TAG=2025.8.4
+AUTHENTIK_TAG=2025.10.2
 POSTGRES_PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
 POSTGRES_USER=authentik
 POSTGRES_DB=authentik

__swarm/gitea/gitea-swarm.yml

@@ -35,7 +35,7 @@ services:
         homepage.name: Gitea
         homepage.server: my-docker-swarm
         homepage.weight: '1'
-        homepage.widget.key: ${TOKEN}
+        homepage.widget.key: "b7b6e21beb7489c170215e2b7ae0d9b0099132d6"
         homepage.widget.type: ${APPNAME}
         homepage.widget.url: https://${APPNAME}.sectorq.eu
         homepage.widget.version: '2'
@@ -56,6 +56,7 @@ services:
       GITEA_RUNNER_NAME: jaydee
       GITEA_RUNNER_LABELS: jaydee
     volumes:
+    
     - runner_config:/config
     - runner_data:/data
     - /var/run/docker.sock:/var/run/docker.sock

__swarm/gitlab/docker-compose.yml

@@ -1,5 +1,16 @@
 services:
+  runner:
+    container_name: gitlab-runner
+    restart: always
+    volumes:
+      - runner:/etc/gitlab-runner
+      - /var/run/docker.sock:/var/run/docker.sock
+    image: ${DOCKER_REGISTRY:-}gitlab/gitlab-runner:latest
+    labels:
+      - wud.watch.digest=true
+      - wud.watch=true
   web:
+  
     container_name: gitlab
     environment:
       GITLAB_OMNIBUS_CONFIG: "external_url 'https://gitlab.sectorq.eu'\nnginx['listen_port']\
@@ -47,8 +58,13 @@ services:
     restart: unless-stopped
     shm_size: 4gb
     volumes:
-    - /share/docker_data/gitlab/config:/etc/gitlab
+    - config:/etc/gitlab
-    - /share/docker_data/gitlab/logs:/var/log/gitlab
+    - logs:/var/log/gitlab
-    - /share/docker_data/gitlab/data:/var/opt/gitlab
+    - data:/var/opt/gitlab
     - /etc/localtime:/etc/localtime:ro
 version: '3.6'
+volumes:
+  runner:
+  config:
+  logs:
+  data:

__swarm/gitlab/gitlab-swarm.yml

@@ -1,73 +1,101 @@
-services:
+  services:
-  web:
+    runner:
-    environment:
+      container_name: gitlab-runner
-      GITLAB_OMNIBUS_CONFIG: "external_url 'https://gitlab.sectorq.eu'\nnginx['listen_port']\
+      restart: always
-        \ = 80\nnginx['listen_https'] = false\nweb_server['username'] = 'git'\ngitlab_rails['time_zone']\
+      volumes:
-        \ = 'Europe/Bratislava'\ngitlab_rails['omniauth_enabled'] = true\ngitlab_rails['omniauth_allow_single_sign_on']\
+        - runner:/etc/gitlab-runner
-        \ = ['saml']\ngitlab_rails['omniauth_sync_email_from_provider'] = 'saml'\n\
+        - /var/run/docker.sock:/var/run/docker.sock
-        gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']\ngitlab_rails['omniauth_sync_profile_attributes']\
+      image: ${DOCKER_REGISTRY:-}gitlab/gitlab-runner:latest
-        \ = ['email']\ngitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'\n\
-        gitlab_rails['omniauth_block_auto_created_users'] = false\ngitlab_rails['omniauth_auto_link_saml_user']\
-        \ = true\ngitlab_rails['omniauth_providers'] = [\n  {\n    name: 'saml',\n\
-        \    args: {\n      assertion_consumer_service_url: 'https://gitlab.sectorq.eu/users/auth/saml/callback',\n\
-        \      # Shown when navigating to certificates in authentik1\n      idp_cert_fingerprint:\
-        \ 'f7:fd:49:03:b3:38:52:b3:23:f5:43:c4:8d:08:65:32:e0:5a:7b:0e',\n      idp_sso_target_url:\
-        \ 'https://auth.sectorq.eu/application/saml/gitlab/sso/binding/redirect/',\n\
-        \      issuer: 'https://gitlab.sectorq.eu',\n      name_identifier_format:\
-        \ 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n      attribute_statements:\
-        \ {\n        email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],\n\
-        \        first_name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],\n\
-        \        nickname: ['http://schemas.goauthentik.io/2021/02/saml/username']\n\
-        \      }\n    },\n    label: 'authentik'\n  }\n]\n"
-      TZ: Europe/Bratislava
-    hostname: gitlab.sectorq.eu
-    image: ${DOCKER_REGISTRY:-}gitlab/gitlab-ce:latest
-    network_mode: bridge
-    ports:
-    - target: 80
-      published: 8785
-      protocol: tcp
-      mode: ingress
-    - target: 443
-      published: 8743
-      protocol: tcp
-      mode: ingress
-    - target: 22
-      published: 8722
-      protocol: tcp
-      mode: ingress
-    shm_size: 4gb
-    volumes:
-    - config:/etc/gitlab
-    - logs:/var/log/gitlab
-    - data:/var/opt/gitlab
-    - /etc/localtime:/etc/localtime:ro
-    deploy:
       labels:
-        com.centurylinklabs.watchtower.enable: 'true'
+        - wud.watch.digest=true
-        homepage.container: gitlab
+        - wud.watch=true
-        homepage.description: Version control
+      dns:
-        homepage.group: Infrastructure
+        - 192.168.77.1
-        homepage.href: https://gitlab.sectorq.eu
+        - 192.168.77.101
-        homepage.icon: gitlab.png
+    app:
-        homepage.name: Gitlab
+      environment:
-        homepage.server: my-docker-swarm
+        GITLAB_OMNIBUS_CONFIG: |
-        homepage.weight: '1'
+          external_url 'https://gitlab.sectorq.eu'
-        homepage.widget.key: glpat-BuMKcaDqeD-Wx3dW4TM9
+          nginx['listen_port'] = 80
-        homepage.widget.type: gitlab
+          nginx['listen_https'] = false
-        homepage.widget.url: https://gitlab.sectorq.eu
+          web_server['username'] = 'git'
-        homepage.widget.user_id: '2'
+          gitlab_rails['time_zone'] = 'Europe/Bratislava'
-        wud.watch: 'true'
+          gitlab_rails['omniauth_enabled'] = true
-        wud.watch.digest: 'true'
+          gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
-      replicas: 1
+          gitlab_rails['omniauth_sync_email_from_provider'] = 'saml'
-      placement:
+          gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']
-        constraints:
+          gitlab_rails['omniauth_sync_profile_attributes'] = ['email']
-        - node.role == manager
+          gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'
+          gitlab_rails['omniauth_block_auto_created_users'] = false
+          gitlab_rails['omniauth_auto_link_saml_user'] = true
+          gitlab_rails['omniauth_providers'] = [
+            {
+              name: 'saml',
+              args: {
+                assertion_consumer_service_url: 'https://gitlab.sectorq.eu/users/auth/saml/callback',
+                # Shown when navigating to certificates in authentik1
+                idp_cert_fingerprint: 'f7:fd:49:03:b3:38:52:b3:23:f5:43:c4:8d:08:65:32:e0:5a:7b:0e',
+                idp_sso_target_url: 'https://auth.sectorq.eu/application/saml/gitlab/sso/binding/redirect/',
+                issuer: 'https://gitlab.sectorq.eu',
+                name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
+                attribute_statements: {
+                  email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],
+                  first_name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],
+                  nickname: ['http://schemas.goauthentik.io/2021/02/saml/username']
+                }
+              },
+              label: 'authentik'
+            }
+          ]
+        TZ: Europe/Bratislava
+      hostname: gitlab.sectorq.eu
+      image: ${DOCKER_REGISTRY:-}gitlab/gitlab-ce:latest
+      network_mode: bridge
+      ports:
+      - target: 80
+        published: 8785
+        protocol: tcp
+        mode: ingress
+      - target: 443
+        published: 8743
+        protocol: tcp
+        mode: ingress
+      - target: 22
+        published: 8722
+        protocol: tcp
+        mode: ingress
+      shm_size: 4gb
+      volumes:
+      - config:/etc/gitlab
+      - logs:/var/log/gitlab
+      - data:/var/opt/gitlab
+      - /etc/localtime:/etc/localtime:ro
+      deploy:
+        labels:
+          com.centurylinklabs.watchtower.enable: 'true'
+          homepage.container: gitlab
+          homepage.description: Version control
+          homepage.group: Infrastructure
+          homepage.href: https://gitlab.sectorq.eu
+          homepage.icon: gitlab.png
+          homepage.name: Gitlab
+          homepage.server: my-docker-swarm
+          homepage.weight: '1'
+          homepage.widget.key: glpat-BuMKcaDqeD-Wx3dW4TM9
+          homepage.widget.type: gitlab
+          homepage.widget.url: https://gitlab.sectorq.eu
+          homepage.widget.user_id: '2'
+          wud.watch: 'true'
+          wud.watch.digest: 'true'
+        replicas: 1
+        placement:
+          constraints:
+          - node.role == manager
 
-volumes:
+  volumes:
-  config:
+    config:
-    driver: local
+      driver: local
-  logs:
+    logs:
-    driver: local
+      driver: local
-  data:
+    data:
-    driver: local 
+      driver: local

__swarm/hashicorp/hashicorp-swarm.yml

@@ -0,0 +1,47 @@
+services:
+  vault:
+    image: hashicorp/vault:latest
+    command: server -config=/vault/config/vault.hcl
+    volumes:
+      - data:/vault/data
+    configs:
+      - source: vault_hcl
+        target: /vault/config/vault.hcl
+    ports:
+      - "8200:8200"
+    environment:
+      VAULT_LOCAL_CONFIG: |
+        {
+          "backend": {
+            "file": {
+              "path": "/vault/file"
+            }
+          },
+          "listener": {
+            "tcp": {
+              "address": "0.0.0.0:8200",
+              "tls_disable": 1
+            }
+          },
+          "disable_mlock": true
+        }
+      VAULT_API_ADDR: "http://192.168.77.101:8200"
+    cap_add:
+      - IPC_LOCK
+    networks:
+      - vault-net
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+
+configs:
+  vault_hcl:
+    external: true
+volumes:
+  data:
+networks:
+  vault-net:
+    driver: overlay

__swarm/home-assistant/home-assistant-swarm.yml

@@ -1,11 +1,16 @@
+
+
 services:
   homeassistant:
-    network_mode: host
     image: ${DOCKER_REGISTRY:-}ghcr.io/home-assistant/home-assistant:latest
     volumes:
     - ha_config:/config
     - /var/run/docker.sock:/var/run/docker.sock
     - /run/dbus:/run/dbus:ro
+    networks:
+      - swarm-ipvlan 
+      - traefik-public
+      - homeassistant-internal
     privileged: true
     environment:
       DISABLE_JEMALLOC: value

__swarm/homepage/homepage-swarm.yml

@@ -1,6 +1,7 @@
 services:
   homepage:
     dns:
+    - 192.168.77.1
     - 192.168.77.101
     environment:
       HOMEPAGE_ALLOWED_HOSTS: sectorq.eu,active.home.lan:3003,m-server.home.lan:3003,rpi5.home.lan:3003,nas.home.lan:3003,192.168.77.238:3003,rack.home.lan:3003,192.168.80.222:3003

__swarm/influxdb/influxdb-swarm.yml

@@ -29,9 +29,6 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-      placement:
-        constraints:
-        - node.role == manager
 secrets:
   influxdb2-admin-token:
     external: true

__swarm/mediacenter/mediacenter-swarm.yml

@@ -16,8 +16,18 @@ volumes:
   radarr_config:
   sonarr_config:
   bazarr_config:
-  flaresolverr_config:
+  m-server_music:
-
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=192.168.77.101,rw,nfsvers=4.2,nolock
+      device: :/music
+  m-server_movies:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=192.168.77.101,rw,nfsvers=4.2,nolock
+      device: :/movies
 services:
   bazarr:
     environment:
@@ -28,6 +38,8 @@ services:
     image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/bazarr:latest
     networks:
     - mediarr
+    dns:
+      - 192.168.77.101
     ports:
     - target: 6767
       published: 6767
@@ -42,7 +54,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: bazarr
+        homepage.container: mediacenter_bazarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://bazarr.sectorq.eu
@@ -59,6 +71,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   flaresolverr:
     environment:
       LOG_LEVEL: info
@@ -81,6 +94,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   homarr:
     hostname: homarr
     image: ${DOCKER_REGISTRY:-}ghcr.io/ajnart/homarr:latest
@@ -105,6 +119,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   jackett:
     dns:
     - 192.168.77.101
@@ -129,7 +144,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: jackett
+        homepage.container: mediacenter_jackett
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://jackett.sectorq.eu
@@ -146,15 +161,16 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   jellyfin:
     environment:
-      PUID: '1000'
-      PGID: '1000'
       TZ: Europe/Bratislava
       JELLYFIN_PublishedServerUrl: https://jf.sectorq.eu
+      VAAPI_DEVICE: /dev/dri/renderD128
+      LIBVA_DRIVER_NAME: radeonsi
     hostname: jellyfin
     image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/jellyfin:latest
-    network_mode: host
+
     ports:
     - target: 8096
       published: 8096
@@ -168,19 +184,23 @@ services:
       published: 7359
       protocol: tcp
       mode: ingress
+    user: root
     volumes:
     - jellyfin_config:/config
-    - /media/m-server/movies:/data/movies/m-server
+    - m-server_movies:/data/movies/m-server
-    - /media/m-server/music:/data/music/m-server
+    - m-server_music:/data/music/m-server
     - /media/m-server/shows:/data/shows/m-server
     - /media/nas/movies:/data/movies/nas
     - /media/nas/music:/data/music/nas
     - /media/nas/shows:/data/shows/nas
     - /media/nas/xxx:/data/xxx/nas
+    - /dev/dri:/dev/dri
+    devices:
+      - /dev/dri/renderD128:/dev/dri/renderD128
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: jellyfin
+        homepage.container: mediacenter_jellyfin
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://jf.sectorq.eu
@@ -197,6 +217,8 @@ services:
       placement:
         constraints:
         - node.role == manager
+        - node.labels.gpu == amd
+
   jellyseerr:
     environment:
       LOG_LEVEL: debug
@@ -215,7 +237,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enabl: 'true'
-        homepage.container: jellyseerr
+        homepage.container: mediacenter_jellyseerr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://js.sectorq.eu
@@ -232,6 +254,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   lidarr:
     environment:
       PUID: '1000'
@@ -253,7 +276,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: lidarr
+        homepage.container: mediacenter_lidarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://lidarr.sectorq.eu
@@ -270,6 +293,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   qbittorrent:
     environment:
       PUID: '1000'
@@ -296,7 +320,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: qbittorrent
+        homepage.container: mediacenter_qbittorrent
         homepage.description: Subtitles
         homepage.group: Utilities
         homepage.href: https://qbit.sectorq.eu
@@ -304,7 +328,7 @@ services:
         homepage.name: Qbittorrent
         homepage.server: my-docker-swarm
         homepage.weight: '95'
-        homepage.widget.enableLeechProgress: 'true'
+        homepage.widget.enableLeechProgress: 'false'
         homepage.widget.password: ${QBIT_TOKEN}
         homepage.widget.type: qbittorrent
         homepage.widget.url: https://qbit.sectorq.eu
@@ -315,6 +339,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   radarr:
     dns:
     - 192.168.77.101
@@ -339,7 +364,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: radarr
+        homepage.container: mediacenter_radarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://radarr.sectorq.eu
@@ -357,6 +382,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   sonarr:
     dns:
     - 192.168.77.101
@@ -381,7 +407,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: sonarr
+        homepage.container: mediacenter_sonarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://sonarr.sectorq.eu

__swarm/pihole/pihole-swarm.yml

@@ -1,5 +1,5 @@
 volumes:
-  data::
+  data:
     driver: local
   dnsmasq_d:
     driver: local
@@ -43,6 +43,10 @@ services:
     volumes:
     - data:/etc/pihole
     - dnsmasq_d:/etc/dnsmasq.d
+    - type: tmpfs
+      target: /dev/shm
+      tmpfs:
+        size: 248000000
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'

__swarm/registry/registry-swarm.yml

@@ -1,5 +1,5 @@
 services:
-  registry:
+  app:
     environment:
       REGISTRY_STORAGE_DELETE_ENABLED: 'true'
       REGISTRY_AUTH: htpasswd
@@ -10,6 +10,12 @@ services:
       driver: loki
       options:
         loki-url: http://192.168.77.101:3100/loki/api/v1/push
+        loki-relabel-config: |
+          - action: labelmap
+            regex: swarm_stack
+            replacement: namespace
+          - action: labelmap
+            regex: swarm_(service)
     ports:
     - target: 5000
       published: 5000
@@ -17,15 +23,18 @@ services:
       mode: ingress
     volumes:
     - auth:/auth
-    - data:/var/lib/registry
+    - /share/docker_registry/data:/var/lib/registry
+    - config:/etc/docker/registry/
+    
     deploy:
       labels:
         wud.watch: 'false'
         wud.watch.digest: 'false'
+        service_name: 'registry'
       replicas: 1
-      placement:
+      restart_policy:
-        constraints:
+        condition: any
-        - node.role == manager
+
 volumes:
   auth:
-  data:
+  config:

__swarm/regsync/regsync-swarm.yml

@@ -1,8 +1,8 @@
 volumes:
-  regsync:
+  config:
     driver: local
 services:
-  regsync:
+  app:
     command: -c /home/appuser/regsync.yml server
     env_file:
     - stack.env
@@ -11,15 +11,23 @@ services:
       driver: loki
       options:
         loki-url: http://192.168.77.101:3100/loki/api/v1/push
-    network_mode: host
+        loki-relabel-config: |
+          - action: labelmap
+            regex: swarm_stack
+            replacement: namespace
+          - action: labelmap
+            regex: swarm_(service)
     stdin_open: true
     volumes:
-    - regsync:/home/appuser/
+    - config:/home/appuser/
     - /etc/localtime:/etc/localtime
+    # labels:
+    #     service_name: 'regsync'
     deploy:
       labels:
         wud.watch: 'true'
         wud.watch.digest: 'true'
+        service_name: 'regsync'
       replicas: 1
       placement:
         constraints:

__swarm/regsync/stack.env

@@ -4,3 +4,5 @@ HUB_USER=sectorq
 HUB_PASS=dckr_pat_7XN8zNgj8JRPq1mlS5IvMcxJDUA
 LOCAL_USER=jaydee
 LOCAL_PASS=l4c1j4yd33Du5lo
+APPNAME=regsync
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/semaphore/docker-compose.yml

@@ -10,7 +10,7 @@ services:
       SEMAPHORE_ADMIN: administrator
       SEMAPHORE_ADMIN_EMAIL: administrator@sectorq.eu
       SEMAPHORE_ADMIN_NAME: administrator
-      SEMAPHORE_ADMIN_PASSWORD: $SEMAPHORE_ADMIN_PASSWORD
+      SEMAPHORE_ADMIN_PASSWORD: administrator
       SEMAPHORE_DB: semaphore_db
       SEMAPHORE_DB_HOST: db
       SEMAPHORE_DB_PASS: StrongPassw0rd
@@ -21,7 +21,7 @@ services:
       SEMAPHORE_LDAP_DN_SEARCH: dc=sectorq,dc=eu
       SEMAPHORE_LDAP_HOST: 192.168.77.101
       SEMAPHORE_LDAP_NEEDTLS: 'no'
-      SEMAPHORE_LDAP_PASSWORD: $LDAP_ADMIN_PASSWORD
+      SEMAPHORE_LDAP_PASSWORD: administrator
       SEMAPHORE_LDAP_PORT: '2389'
       SEMAPHORE_LDAP_SEARCH_FILTER: (&(objectClass=inetOrgPerson)(uid=%s))
       SEMAPHORE_PLAYBOOK_PATH: /tmp/semaphore/

__swarm/semaphore/semaphore-swarm.yml

@@ -3,12 +3,14 @@ services:
     dns:
     - 192.168.77.101
     - 192.168.77.1
+    secrets:
+    - semaphore_admin_password
     environment:
       SEMAPHORE_ACCESS_KEY_ENCRYPTION: MflCLIUF5bn6Lgkuwy4BoAdIFhoZ4Ief2oocXmuZSjs=
-      SEMAPHORE_ADMIN: administrator
+      SEMAPHORE_ADMIN: admin
-      SEMAPHORE_ADMIN_EMAIL: administrator@sectorq.eu
+      SEMAPHORE_ADMIN_EMAIL: jaydee@sectorq.eu
-      SEMAPHORE_ADMIN_NAME: administrator
+      SEMAPHORE_ADMIN_NAME: admin
-      SEMAPHORE_ADMIN_PASSWORD: $SEMAPHORE_ADMIN_PASSWORD
+      SEMAPHORE_ADMIN_PASSWORD_FILE: /run/secrets/semaphore_admin_password
       SEMAPHORE_DB: semaphore_db
       SEMAPHORE_DB_HOST: db
       SEMAPHORE_DB_PASS: StrongPassw0rd
@@ -19,7 +21,7 @@ services:
       SEMAPHORE_LDAP_DN_SEARCH: dc=sectorq,dc=eu
       SEMAPHORE_LDAP_HOST: 192.168.77.101
       SEMAPHORE_LDAP_NEEDTLS: 'no'
-      SEMAPHORE_LDAP_PASSWORD: $LDAP_ADMIN_PASSWORD
+      SEMAPHORE_LDAP_PASSWORD: administrator
       SEMAPHORE_LDAP_PORT: '2389'
       SEMAPHORE_LDAP_SEARCH_FILTER: (&(objectClass=inetOrgPerson)(uid=%s))
       SEMAPHORE_PLAYBOOK_PATH: /tmp/semaphore/
@@ -39,9 +41,6 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-      placement:
-        constraints:
-        - node.role == manager
   db:
     environment:
       MYSQL_DATABASE: semaphore_db
@@ -56,9 +55,9 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-      placement:
-        constraints:
-        - node.role == manager
 volumes:
   data:
   db:
+secrets:
+  semaphore_admin_password:
+    external: true

__swarm/uptime-kuma/uptime-kuma-swarm.yml

@@ -15,8 +15,7 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-      placement:
+      restart_policy:
-        constraints:
+        condition: any
-        - node.role == manager
 volumes:
   data:

__swarm/wud/stack.env

@@ -16,7 +16,7 @@ WUD_AUTH_OIDC_AUTHENTIK_TIMEOUT=2000
 
 # BASIC
 WUD_AUTH_BASIC_JAYDEE_USER=homepage
-WUD_AUTH_BASIC_JAYDEE_HASH=$$apr1$$pGMz1QxU$$y6XuTscvGcYgas15JWlfg/
+WUD_AUTH_BASIC_JAYDEE_HASH=$apr1$OZNN/65l$cQp3tMfyQdftPIgje.uDZ1
 # GOTIFY
 WUD_TRIGGER_GOTIFY_EXTERNAL_PRIORITY=0
 WUD_TRIGGER_GOTIFY_EXTERNAL_TOKEN="AFxvpm1JpPSsmkf"
@@ -47,14 +47,14 @@ WUD_LOG_LEVEL=debug
 # text json
 WUD_LOG_FORMAT=text
 
-WUD_WATCHER_EXTDOCKER_HOST=193.168.144.164
+# WUD_WATCHER_EXTDOCKER_HOST=193.168.144.164
-WUD_WATCHER_EXTDOCKER_PORT=2376
+# WUD_WATCHER_EXTDOCKER_PORT=2376
-WUD_WATCHER_EXTDOCKER_CERTFILE=/certs/ext/cert.pem
+# WUD_WATCHER_EXTDOCKER_CERTFILE=/certs/ext/cert.pem
-WUD_WATCHER_EXTDOCKER_CAFILE=/certs/ext/ca.pem
+# WUD_WATCHER_EXTDOCKER_CAFILE=/certs/ext/ca.pem
-WUD_WATCHER_EXTDOCKER_KEYFILE=/certs/ext/key.pem
+# WUD_WATCHER_EXTDOCKER_KEYFILE=/certs/ext/key.pem
-WUD_WATCHER_EXTDOCKER_CRON=0 * * * *
+# WUD_WATCHER_EXTDOCKER_CRON=0 * * * *
-WUD_WATCHER_EXTDOCKER_WATCHALL=true
+# WUD_WATCHER_EXTDOCKER_WATCHALL=true
-WUD_WATCHER_EXTDOCKER_WATCHBYDEFAULT=true
+# WUD_WATCHER_EXTDOCKER_WATCHBYDEFAULT=true
 
 WUD_WATCHER_MSERVER_HOST=192.168.77.101
 WUD_WATCHER_MSERVER_PORT=2376
@@ -65,14 +65,23 @@ WUD_WATCHER_MSERVER_CRON=0 * * * *
 WUD_WATCHER_MSERVER_WATCHALL=true
 WUD_WATCHER_MSERVER_WATCHBYDEFAULT=false
 
-WUD_WATCHER_RPI5_HOST=192.168.77.238
+WUD_WATCHER_MS_HOST=192.168.77.101
-WUD_WATCHER_RPI5_PORT=2376
+WUD_WATCHER_MS_PORT=2376
-WUD_WATCHER_RPI5_CERTFILE=/certs/rpi5/cert.pem
+WUD_WATCHER_MS_CERTFILE=/certs/m-server/cert.pem
-WUD_WATCHER_RPI5_CAFILE=/certs/rpi5/ca.pem
+WUD_WATCHER_MS_CAFILE=/certs/m-server/ca.pem
-WUD_WATCHER_RPI5_KEYFILE=/certs/rpi5/key.pem
+WUD_WATCHER_MS_KEYFILE=/certs/m-server/key.pem
-WUD_WATCHER_RPI5_CRON=0 * * * *
+WUD_WATCHER_MS_CRON=0 * * * *
-WUD_WATCHER_RPI5_WATCHALL=true
+WUD_WATCHER_MS_WATCHALL=true
-WUD_WATCHER_RPI5_WATCHBYDEFAULT=true
+WUD_WATCHER_MS_WATCHBYDEFAULT=true
+
+# WUD_WATCHER_RPI5_HOST=192.168.77.238
+# WUD_WATCHER_RPI5_PORT=2376
+# WUD_WATCHER_RPI5_CERTFILE=/certs/rpi5/cert.pem
+# WUD_WATCHER_RPI5_CAFILE=/certs/rpi5/ca.pem
+# WUD_WATCHER_RPI5_KEYFILE=/certs/rpi5/key.pem
+# WUD_WATCHER_RPI5_CRON=0 * * * *
+# WUD_WATCHER_RPI5_WATCHALL=true
+# WUD_WATCHER_RPI5_WATCHBYDEFAULT=true
 
 WUD_WATCHER_NAS_HOST=192.168.77.106
 WUD_WATCHER_NAS_PORT=2376
@@ -83,13 +92,13 @@ WUD_WATCHER_NAS_CRON=0 * * * *
 WUD_WATCHER_NAS_WATCHALL=true
 WUD_WATCHER_NAS_WATCHBYDEFAULT=true
 
-WUD_WATCHER_RACK_HOST=192.168.77.55
+# WUD_WATCHER_RACK_HOST=192.168.77.55
-WUD_WATCHER_RACK_PORT=2376
+# WUD_WATCHER_RACK_PORT=2376
-WUD_WATCHER_RACK_CERTFILE=/certs/rack/cert.pem
+# WUD_WATCHER_RACK_CERTFILE=/certs/rack/cert.pem
-WUD_WATCHER_RACK_CAFILE=/certs/rack/ca.pem
+# WUD_WATCHER_RACK_CAFILE=/certs/rack/ca.pem
-WUD_WATCHER_RACK_KEYFILE=/certs/rack/key.pem
+# WUD_WATCHER_RACK_KEYFILE=/certs/rack/key.pem
-WUD_WATCHER_RACK_CRON=0 * * * *
+# WUD_WATCHER_RACK_CRON=0 * * * *
-WUD_WATCHER_RACK_WATCHALL=true
+# WUD_WATCHER_RACK_WATCHALL=true
-WUD_WATCHER_RACK_WATCHBYDEFAULT=true
+# WUD_WATCHER_RACK_WATCHBYDEFAULT=true
 
 WUD_SERVER_CORS_ENABLED=true

__swarm/wud/wud-swarm.yml

@@ -1,5 +1,5 @@
 services:
-  whatsupdocker:
+  app:
     env_file:
     - stack.env
     image: ${DOCKER_REGISTRY:-}getwud/wud
@@ -19,7 +19,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: wud
+        homepage.container: wud_app
         homepage.description: Docker container management
         homepage.group: Infrastructure
         homepage.href: https://wud.sectorq.eu
@@ -34,9 +34,8 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-      placement:
+      restart_policy:
-        constraints:
+        condition: any
-        - node.role == manager
 volumes:
   data:
   certs:

__swarm/zabbix-server/.env

@@ -1,2 +1,3 @@
 APPNAME=zabbix
-#RESTART=always
+#RESTART=always
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/zabbix-server/Dockerfile

@@ -0,0 +1,5 @@
+FROM zabbix/zabbix-server-pgsql:alpine-latest
+
+USER root
+RUN apk add --no-cache curl
+USER zabbix

__swarm/zabbix-server/docker-compose.yml

@@ -48,7 +48,11 @@ services:
     extends:
       file: logging.yml
       service: ${LOGGING:-syslog}
-    image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    #image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: zabbix-server-custom:latest
     volumes:
       - /share/docker_data/zabbix-server/server/alertscripts:/usr/lib/zabbix/alertscripts
     labels:

__swarm/zabbix-server/stack.env

@@ -1,6 +1,6 @@
 # Zabbix global
 # ZBX_DEBUGLEVEL=3
-
+DOCKER_REGISTRY=r.sectorq.eu/library/
 # Database
 MYSQL_PASSWORD=zabbix
 MYSQL_USER=zabbix

__swarm/zabbix-server/zabbix-server-swarm.yml

@@ -1,11 +1,10 @@
 networks:
   zabbix:
     driver: overlay
-    attachable: true
     ipam:
       config:
-        - subnet: 192.168.82.0/24
+      - subnet: 192.168.89.0/28
-
+      driver: default
 services:
   db-server:
     env_file:
@@ -13,13 +12,14 @@ services:
     image: ${DOCKER_REGISTRY:-}postgres:16-alpine
     networks:
       zabbix:
+        ipv4_address: 192.168.89.4
     ports:
-    - target: 5432
+      - target: 5432
-      published: 5432
+        published: 5432
-      protocol: tcp
+        protocol: tcp
-      mode: ingress
+        mode: ingress
     volumes:
-    - postgres-data:/var/lib/postgresql/data
+      - db:/var/lib/postgresql/data
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
@@ -33,6 +33,7 @@ services:
     image: ${DOCKER_REGISTRY:-}zabbix/zabbix-web-nginx-pgsql:alpine-latest
     networks:
       zabbix:
+        ipv4_address: 192.168.89.3
     ports:
     - target: 8080
       published: 8051
@@ -56,11 +57,13 @@ services:
   zabbix-server:
     env_file:
     - stack.env
-    image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    #image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    image: r.sectorq.eu/jaydee/zabbix-server-pgsql:latest
     volumes:
     - alertscripts:/usr/lib/zabbix/alertscripts
     networks:
       zabbix:
+        ipv4_address: 192.168.89.2
     ports:
     - target: 10051
       published: 10051
@@ -69,7 +72,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: zabbix-server-zabbix-server-1
+        homepage.container: zabbix-server_zabbix-server
         homepage.description: Monitoring server
         homepage.group: Utilities
         homepage.href: https://${APPNAME}.sectorq.eu
@@ -105,26 +108,26 @@ services:
       placement:
         constraints:
         - node.role == manager
-  postinstall:
+  # postinstall:
-    image: debian:12-slim
+  #   image: debian:12-slim
-    environment:
+  #   environment:
-      PUID: '0'
+  #     PUID: '0'
-      PGID: '0'
+  #     PGID: '0'
-    volumes:
+  #   volumes:
-    - /usr/bin:/usr/bin
+  #   - /usr/bin:/usr/bin
-    - /usr/lib:/usr/lib
+  #   - /usr/lib:/usr/lib
-    - /var/run/docker.sock:/var/run/docker.sock
+  #   - /var/run/docker.sock:/var/run/docker.sock
-    - scripts:/scripts
+  #   - scripts:/scripts
-    entrypoint:
+  #   entrypoint:
-    - /bin/sh
+  #   - /bin/sh
-    - /scripts/install-curl.sh
+  #   - /scripts/install-curl.sh
-    deploy:
+  #   deploy:
-      replicas: 1
+  #     replicas: 1
-      placement:
+  #     placement:
-        constraints:
+  #       constraints:
-        - node.role == manager
+  #       - node.role == manager
 volumes:
-  scripts:
+  db:
   certs:
   alertscripts:
-  postgres-data:
+  scripts:

pihole/docker-compose.yml

@@ -33,6 +33,17 @@ services:
       TZ: Europe/Bratislava
     hostname: m-server
     image: pihole/pihole:latest
+    shm_size: '256mb'
+    logging:
+      driver: loki
+      options:
+        loki-url: http://192.168.77.101:3100/loki/api/v1/push
+        loki-relabel-config: |
+          - action: labelmap
+            regex: swarm_stack
+            replacement: namespace
+          - action: labelmap
+            regex: swarm_(service)
     labels:
       com.centurylinklabs.watchtower.enable: 'true'
       homepage.container: pihole
@@ -53,10 +64,15 @@ services:
       pihole:
         ipv4_address: 192.168.78.254
     ports:
-    - '53:53'
+    - '53:53/udp'
     - '9380:80'
     - '9343:443'  
     restart: always
     volumes:
-    - /share/docker_data/pihole/etc-pihole:/etc/pihole
+    - data:/etc/pihole
-    - /share/docker_data/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
+    - dnsmasq_d:/etc/dnsmasq.d
+volumes:
+  data:
+    driver: local
+  dnsmasq_d:
+    driver: local

regsync/docker-compose.yml

@@ -1,5 +1,5 @@
 volumes:
-  regsync-data:
+  data:
     driver: local
 services:
   regsync:
@@ -10,9 +10,13 @@ services:
     labels:
       wud.watch: true
       wud.watch.digest: true
+    logging:
+      driver: loki
+      options:
+        loki-url: http://192.168.77.101:3100/loki/api/v1/push
     network_mode: host
     restart: ${RESTART:-unless-stopped}
     stdin_open: true
     volumes:
-    - regsync-data:/home/appuser/
+    - data:/home/appuser/
     - /etc/localtime:/etc/localtime