build

__swarm/api_server/.env

@@ -0,0 +1,2 @@
+APPNAME=wordpress
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/api_server/api_server-swarm.yml

@@ -0,0 +1,23 @@
+services:
+  app:
+    image: ${DOCKER_REGISTRY:-}api-server:latest
+    secrets:
+    - vault_token
+    environment:
+      VAULT_TOKEN: /run/secrets/vault_token
+      API_TOKEN: mysecrettoken
+    ports:
+    - target: 8000
+      published: 8002
+      protocol: tcp
+      mode: ingress
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+
+secrets:
+  vault_token:
+    external: true
+

__swarm/authentik/.env

@@ -3,7 +3,7 @@ PG_USER=authentik
 PG_DB=authentik
 AUTHENTIK_SECRET_KEY=ZKkVCxj8kKj5ZklvzxKG2IgYQOftDoLPRjc57yomr1qzbKEQVZ
 AUTHENTIK_ERROR_REPORTING__ENABLED=true
-AUTHENTIK_TAG=2025.10.2
+AUTHENTIK_TAG=2026.2.1
 POSTGRES_PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
 POSTGRES_USER=authentik
 POSTGRES_DB=authentik

__swarm/authentik/authentik-swarm.yml

@@ -30,6 +30,11 @@ services:
       POSTGRES_PASSWORD: ${PG_PASS:?database password required}
       POSTGRES_USER: ${PG_USER:-authentik}
       TZ: Europe/Bratislava
+    ports:
+    - target: 5432
+      published: 5433
+      protocol: tcp
+      mode: ingress
     healthcheck:
       interval: 30s
       retries: 5

__swarm/authentik/stack.env

@@ -3,7 +3,7 @@ PG_USER=authentik
 PG_DB=authentik
 AUTHENTIK_SECRET_KEY=ZKkVCxj8kKj5ZklvzxKG2IgYQOftDoLPRjc57yomr1qzbKEQVZ
 AUTHENTIK_ERROR_REPORTING__ENABLED=true
-AUTHENTIK_TAG=2025.10.2
+AUTHENTIK_TAG=2026.2.1
 POSTGRES_PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
 POSTGRES_USER=authentik
 POSTGRES_DB=authentik

__swarm/home-assistant/.env

@@ -1,3 +1,2 @@
 APPNAME=home-assistant
-DOCKER_REGISTRY=r.sectorq.eu/library/
 RESTART=always

__swarm/home-assistant/docker-compose.yml

@@ -34,6 +34,7 @@ services:
     restart: ${RESTART:-unless-stopped}
     dns:
       - 192.168.77.101
+      - 192.168.77.238
   # ollama:
   #   volumes:
   #       - /share/docker_data/ollama:/root/.ollama

__swarm/homepage/homepage-swarm.yml

@@ -3,8 +3,9 @@ services:
     dns:
     - 192.168.77.1
     - 192.168.77.101
+    - 192.168.77.238
     environment:
-      HOMEPAGE_ALLOWED_HOSTS: sectorq.eu,active.home.lan:3003,m-server.home.lan:3003,rpi5.home.lan:3003,nas.home.lan:3003,192.168.77.238:3003,rack.home.lan:3003,192.168.80.222:3003
+      HOMEPAGE_ALLOWED_HOSTS: "*"
       TZ: Europe/Bratislava
     image: ${DOCKER_REGISTRY:-}ghcr.io/gethomepage/homepage:latest
     ports:

__swarm/mosquitto/.env

@@ -1,2 +1 @@
 APPNAME=mosquitto
-DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/n8n/n8n-swarm.yml

@@ -4,7 +4,7 @@ services:
     image: ${DOCKER_REGISTRY:-}n8nio/n8n:latest
     ports:
     - target: 5678
-      published: 5679
+      published: 5678
       protocol: tcp
       mode: ingress
     environment:
@@ -15,13 +15,18 @@ services:
       N8N_BASIC_AUTH_USER: sth
       N8N_BASIC_AUTH_PASSWORD: pwd
       N8N_RUNNERS_ENABLED: 'true'
-      N8N_RUNNERS_MODE: internal
+      N8N_RUNNERS_MODE: external
+      N8N_RUNNERS_BROKER_LISTEN_ADDRESS: 0.0.0.0
+      N8N_RUNNERS_AUTH_TOKEN: l4c1j4yd33Du5lo
+      N8N_NATIVE_PYTHON_RUNNER: 'true'
       N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: 'true'
       N8N_SECURE_COOKIE: 'false'
+      N8N_GIT_NODE_ALLOW_LOCAL: 'true'
       WEBHOOK_URL: https://n8n.sectorq.eu
       NODES_EXCLUDE: "[]"
     volumes:
     - data:/home/node/.n8n
+    - files:/home/node/.n8n-files/
     stop_grace_period: 60s
     deploy:
       labels:
@@ -38,6 +43,16 @@ services:
       placement:
         constraints:
         - node.role == manager
+  task-runners:
+    image: n8nio/runners:latest
+    environment:
+      N8N_RUNNERS_TASK_BROKER_URI: http://n8n-main:5679
+      N8N_RUNNERS_AUTH_TOKEN: l4c1j4yd33Du5lo
+      # etc.
+    depends_on:
+      - n8n
 volumes:
   data:
     driver: local
+  files:
+    driver: local

__swarm/nginx/nginx-swarm.yml

@@ -4,7 +4,7 @@ networks:
 services:
   app:
     dns:
-    - 192.168.78.254
+    - 192.168.77.1
     healthcheck:
       interval: 10s
       test:

authentik/docker-compose.yml

@@ -20,6 +20,8 @@ services:
       POSTGRES_PASSWORD: ${PG_PASS:?database password required}
       POSTGRES_USER: ${PG_USER:-authentik}
       TZ: Europe/Bratislava
+    ports:
+    - 5433:5432
     healthcheck:
       interval: 30s
       retries: 5

authentik/stack.env

@@ -3,7 +3,7 @@ PG_USER=authentik
 PG_DB=authentik
 AUTHENTIK_SECRET_KEY=ZKkVCxj8kKj5ZklvzxKG2IgYQOftDoLPRjc57yomr1qzbKEQVZ
 AUTHENTIK_ERROR_REPORTING__ENABLED=true
-AUTHENTIK_TAG=2025.8.4
+AUTHENTIK_TAG=2025.10.4
 POSTGRES_PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
 POSTGRES_USER=authentik
 POSTGRES_DB=authentik

databasus/docker-compose.yml

@@ -0,0 +1,11 @@
+services:
+  databasus:
+    container_name: databasus
+    image: databasus/databasus:latest
+    ports:
+      - "4005:4005"
+    volumes:
+      - data:/databasus-data
+    restart: unless-stopped
+volumes:
+  data: null

hashicorp/docker-compose.yml

@@ -0,0 +1,47 @@
+services:
+  vault:
+    image: hashicorp/vault:latest
+    command: server -config=/vault/config/vault.hcl
+    volumes:
+      - data:/vault/data
+    configs:
+      - source: vault_hcl
+        target: /vault/config/vault.hcl
+    ports:
+      - "8200:8200"
+    environment:
+      VAULT_LOCAL_CONFIG: |
+        {
+          "backend": {
+            "file": {
+              "path": "/vault/file"
+            }
+          },
+          "listener": {
+            "tcp": {
+              "address": "0.0.0.0:8200",
+              "tls_disable": 1
+            }
+          },
+          "disable_mlock": true
+        }
+      VAULT_API_ADDR: "http://192.168.77.101:8200"
+    cap_add:
+      - IPC_LOCK
+    networks:
+      - vault-net
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+
+configs:
+  vault_hcl:
+    external: true
+volumes:
+  data:
+networks:
+  vault-net:
+    driver: overlay

hashicorp/hashicorp-swarm.yml

@@ -0,0 +1,47 @@
+services:
+  vault:
+    image: hashicorp/vault:latest
+    command: server -config=/vault/config/vault.hcl
+    volumes:
+      - data:/vault/data
+    configs:
+      - source: vault_hcl
+        target: /vault/config/vault.hcl
+    ports:
+      - "8200:8200"
+    environment:
+      VAULT_LOCAL_CONFIG: |
+        {
+          "backend": {
+            "file": {
+              "path": "/vault/file"
+            }
+          },
+          "listener": {
+            "tcp": {
+              "address": "0.0.0.0:8200",
+              "tls_disable": 1
+            }
+          },
+          "disable_mlock": true
+        }
+      VAULT_API_ADDR: "http://192.168.77.101:8200"
+    cap_add:
+      - IPC_LOCK
+    networks:
+      - vault-net
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+
+configs:
+  vault_hcl:
+    external: true
+volumes:
+  data:
+networks:
+  vault-net:
+    driver: overlay

home-assistant/.env

@@ -1,4 +1,2 @@
 APPNAME=home-assistant
-DOCKER_REGISTRY=r.sectorq.eu/library/
 RESTART=always
-HA_VERSION=2025.12.4

kestra/docker-compose.yml

@@ -38,7 +38,6 @@ services:
           server:
             cors:
               enabled: true
-
     image: ${DOCKER_REGISTRY:-}kestra/kestra:${KESTRA_VERSION:-latest}
     labels:
       com.centurylinklabs.watchtower.enable: 'true'
@@ -61,7 +60,7 @@ services:
     user: root
     volumes:
     - /etc/localtime:/etc/localtime:ro
-    - /share/docker_data/kestra/kestra-data:/app/storage
+    - app:/app/storage
     - /var/run/docker.sock:/var/run/docker.sock
     - /tmp/kestra-wd:/tmp/kestra-wd
   postgres:
@@ -81,9 +80,9 @@ services:
       wud.watch: false
     restart: ${RESTART:-unless-stopped}
     volumes:
-    - /share/docker_data/kestra/postgres-data:/var/lib/postgresql/data
+    - db:/var/lib/postgresql/data
 volumes:
-  kestra-data:
+  app:
     driver: local
-  postgres-data:
+  db:
     driver: local

kestra/stack.env

@@ -1 +1,2 @@
 APPNAME=kestra
+KESTRA_VERSION=latest

linkding/docker-compose.yml

@@ -0,0 +1,11 @@
+services:
+  linkding:
+    container_name: "${LD_CONTAINER_NAME:-linkding}"
+    image: sissbruecker/linkding:latest
+    ports:
+      - "${LD_HOST_PORT:-9090}:9090"
+    volumes:
+      - "data:/etc/linkding/data"
+    restart: unless-stopped
+volumes:
+  data:

linkwarden/.env

@@ -0,0 +1,473 @@
+NEXTAUTH_URL=https://linkwarden.sectorq.eu/api/v1/auth
+NEXTAUTH_SECRET=l4c1j4yd33Du5lo
+DOCKER_REGISTRY=r.sectorq.eu/library/
+# Manual installation database settings
+# Example: DATABASE_URL=postgresql://user:password@localhost:5432/linkwarden
+DATABASE_URL=
+
+# Docker installation database settings
+POSTGRES_PASSWORD=postgress
+
+# Additional Optional Settings
+PAGINATION_TAKE_COUNT=
+STORAGE_FOLDER=
+AUTOSCROLL_TIMEOUT=
+NEXT_PUBLIC_DISABLE_REGISTRATION=
+NEXT_PUBLIC_CREDENTIALS_ENABLED=
+DISABLE_NEW_SSO_USERS=
+MAX_LINKS_PER_USER=
+ARCHIVE_TAKE_COUNT=
+BROWSER_TIMEOUT=
+IGNORE_UNAUTHORIZED_CA=
+IGNORE_HTTPS_ERRORS=
+IGNORE_URL_SIZE_LIMIT=
+NEXT_PUBLIC_DEMO=
+NEXT_PUBLIC_DEMO_USERNAME=
+NEXT_PUBLIC_DEMO_PASSWORD=
+NEXT_PUBLIC_ADMIN=
+NEXT_PUBLIC_MAX_FILE_BUFFER=
+PDF_MAX_BUFFER=
+SCREENSHOT_MAX_BUFFER=
+READABILITY_MAX_BUFFER=
+PREVIEW_MAX_BUFFER=
+MONOLITH_MAX_BUFFER=
+MONOLITH_CUSTOM_OPTIONS=
+IMPORT_LIMIT=
+PLAYWRIGHT_LAUNCH_OPTIONS_EXECUTABLE_PATH=
+PLAYWRIGHT_WS_URL=
+MAX_WORKERS=
+DISABLE_PRESERVATION=
+NEXT_PUBLIC_RSS_POLLING_INTERVAL_MINUTES=
+RSS_SUBSCRIPTION_LIMIT_PER_USER=
+TEXT_CONTENT_LIMIT=
+SEARCH_FILTER_LIMIT=
+INDEX_TAKE_COUNT=
+MEILI_TIMEOUT=
+
+# AI Settings
+NEXT_PUBLIC_OLLAMA_ENDPOINT_URL=
+OLLAMA_MODEL=
+
+# https://ai-sdk.dev/providers/openai-compatible-providers
+OPENAI_API_KEY=
+OPENAI_MODEL=
+# Optional: Set a custom OpenAI base URL and name (for third-party providers)
+CUSTOM_OPENAI_BASE_URL=
+CUSTOM_OPENAI_NAME=
+
+# https://sdk.vercel.ai/providers/ai-sdk-providers/azure
+AZURE_API_KEY=
+AZURE_RESOURCE_NAME=
+AZURE_MODEL=
+
+# https://sdk.vercel.ai/providers/ai-sdk-providers/anthropic
+ANTHROPIC_API_KEY=
+ANTHROPIC_MODEL=
+
+# https://github.com/OpenRouterTeam/ai-sdk-provider
+OPENROUTER_API_KEY=
+OPENROUTER_MODEL=
+
+# https://ai-sdk.dev/providers/ai-sdk-providers/perplexity
+PERPLEXITY_API_KEY=
+PERPLEXITY_MODEL=
+
+# MeiliSearch Settings
+MEILI_HOST=
+MEILI_MASTER_KEY=
+
+# AWS S3 Settings
+SPACES_KEY=
+SPACES_SECRET=
+SPACES_ENDPOINT=
+SPACES_BUCKET_NAME=
+SPACES_REGION=
+SPACES_FORCE_PATH_STYLE=
+
+# SMTP Settings
+NEXT_PUBLIC_EMAIL_PROVIDER=
+EMAIL_FROM=
+EMAIL_SERVER=
+BASE_URL=
+
+# Proxy settings
+PROXY=
+PROXY_USERNAME=
+PROXY_PASSWORD=
+PROXY_BYPASS=
+
+# PDF archive settings
+PDF_MARGIN_TOP=
+PDF_MARGIN_BOTTOM=
+
+#################
+# SSO Providers #
+#################
+
+# 42 School
+NEXT_PUBLIC_FORTYTWO_ENABLED=
+FORTYTWO_CUSTOM_NAME=
+FORTYTWO_CLIENT_ID=
+FORTYTWO_CLIENT_SECRET=
+
+# Apple
+NEXT_PUBLIC_APPLE_ENABLED=
+APPLE_CUSTOM_NAME=
+APPLE_ID=
+APPLE_SECRET=
+
+# Atlassian
+NEXT_PUBLIC_ATLASSIAN_ENABLED=
+ATLASSIAN_CUSTOM_NAME=
+ATLASSIAN_CLIENT_ID=
+ATLASSIAN_CLIENT_SECRET=
+ATLASSIAN_SCOPE=
+
+# Auth0
+NEXT_PUBLIC_AUTH0_ENABLED=
+AUTH0_CUSTOM_NAME=
+AUTH0_ISSUER=
+AUTH0_CLIENT_SECRET=
+AUTH0_CLIENT_ID=
+
+# Authelia
+NEXT_PUBLIC_AUTHELIA_ENABLED=
+AUTHELIA_CLIENT_ID=
+AUTHELIA_CLIENT_SECRET=
+AUTHELIA_WELLKNOWN_URL=
+
+# Authentik
+NEXT_PUBLIC_AUTHENTIK_ENABLED=true
+AUTHENTIK_CUSTOM_NAME=authentik
+AUTHENTIK_ISSUER=https://auth.sectorq.eu/application/o/linkwarden
+AUTHENTIK_CLIENT_ID=WCCDVYuXdj5LJeBflMi9ogSqsRAgugRht58gpFO0
+AUTHENTIK_CLIENT_SECRET=FEmcxaOUREXzQSjq2rvtf7lNlgjg9vMBBSt4sWCGeZiirrmSrvZnX5O5UPfYTVEt4pwGugiiJG58yUVXWmRhFVPRK33hfOA5yHPJ31SxcTzYI4w7BoajZm37ibC7z4tf
+
+# Azure AD B2C
+NEXT_PUBLIC_AZURE_AD_B2C_ENABLED=
+AZURE_AD_B2C_TENANT_NAME=
+AZURE_AD_B2C_CLIENT_ID=
+AZURE_AD_B2C_CLIENT_SECRET=
+AZURE_AD_B2C_PRIMARY_USER_FLOW=
+
+# Azure AD
+NEXT_PUBLIC_AZURE_AD_ENABLED=
+AZURE_AD_CLIENT_ID=
+AZURE_AD_CLIENT_SECRET=
+AZURE_AD_TENANT_ID=
+
+# Battle.net
+NEXT_PUBLIC_BATTLENET_ENABLED=
+BATTLENET_CUSTOM_NAME=
+BATTLENET_CLIENT_ID=
+BATTLENET_CLIENT_SECRET=
+BATTLENET_ISSUER=
+
+# Box
+NEXT_PUBLIC_BOX_ENABLED=
+BOX_CUSTOM_NAME=
+BOX_CLIENT_ID=
+BOX_CLIENT_SECRET=
+
+# Bungie
+NEXT_PUBLIC_BUNGIE_ENABLED=
+BUNGIE_CUSTOM_NAME=
+BUNGIE_CLIENT_ID=
+BUNGIE_CLIENT_SECRET=
+BUNGIE_API_KEY=
+
+# Cognito
+NEXT_PUBLIC_COGNITO_ENABLED=
+COGNITO_CUSTOM_NAME=
+COGNITO_CLIENT_ID=
+COGNITO_CLIENT_SECRET=
+COGNITO_ISSUER=
+
+# Coinbase
+NEXT_PUBLIC_COINBASE_ENABLED=
+COINBASE_CUSTOM_NAME=
+COINBASE_CLIENT_ID=
+COINBASE_CLIENT_SECRET=
+
+# Discord
+NEXT_PUBLIC_DISCORD_ENABLED=
+DISCORD_CUSTOM_NAME=
+DISCORD_CLIENT_ID=
+DISCORD_CLIENT_SECRET=
+
+# Dropbox
+NEXT_PUBLIC_DROPBOX_ENABLED=
+DROPBOX_CUSTOM_NAME=
+DROPBOX_CLIENT_ID=
+DROPBOX_CLIENT_SECRET=
+
+# DuendeIndentityServer6
+NEXT_PUBLIC_DUENDE_IDS6_ENABLED=
+DUENDE_IDS6_CUSTOM_NAME=
+DUENDE_IDS6_CLIENT_ID=
+DUENDE_IDS6_CLIENT_SECRET=
+DUENDE_IDS6_ISSUER=
+
+# EVE Online
+NEXT_PUBLIC_EVEONLINE_ENABLED=
+EVEONLINE_CUSTOM_NAME=
+EVEONLINE_CLIENT_ID=
+EVEONLINE_CLIENT_SECRET=
+
+# Facebook
+NEXT_PUBLIC_FACEBOOK_ENABLED=
+FACEBOOK_CUSTOM_NAME=
+FACEBOOK_CLIENT_ID=
+FACEBOOK_CLIENT_SECRET=
+
+# FACEIT
+NEXT_PUBLIC_FACEIT_ENABLED=
+FACEIT_CUSTOM_NAME=
+FACEIT_CLIENT_ID=
+FACEIT_CLIENT_SECRET=
+
+# Foursquare
+NEXT_PUBLIC_FOURSQUARE_ENABLED=
+FOURSQUARE_CUSTOM_NAME=
+FOURSQUARE_CLIENT_ID=
+FOURSQUARE_CLIENT_SECRET=
+FOURSQUARE_APIVERSION=
+
+# Freshbooks
+NEXT_PUBLIC_FRESHBOOKS_ENABLED=
+FRESHBOOKS_CUSTOM_NAME=
+FRESHBOOKS_CLIENT_ID=
+FRESHBOOKS_CLIENT_SECRET=
+
+# FusionAuth
+NEXT_PUBLIC_FUSIONAUTH_ENABLED=
+FUSIONAUTH_CUSTOM_NAME=
+FUSIONAUTH_CLIENT_ID=
+FUSIONAUTH_CLIENT_SECRET=
+FUSIONAUTH_ISSUER=
+FUSIONAUTH_TENANT_ID=
+
+# GitHub
+NEXT_PUBLIC_GITHUB_ENABLED=
+GITHUB_CUSTOM_NAME=
+GITHUB_ID=
+GITHUB_SECRET=
+
+# GitLab
+NEXT_PUBLIC_GITLAB_ENABLED=
+GITLAB_CUSTOM_NAME=
+GITLAB_CLIENT_ID=
+GITLAB_CLIENT_SECRET=
+GITLAB_AUTH_URL=
+
+# Google
+NEXT_PUBLIC_GOOGLE_ENABLED=
+GOOGLE_CUSTOM_NAME=
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+
+# HubSpot
+NEXT_PUBLIC_HUBSPOT_ENABLED=
+HUBSPOT_CUSTOM_NAME=
+HUBSPOT_CLIENT_ID=
+HUBSPOT_CLIENT_SECRET=
+
+# IdentityServer4
+NEXT_PUBLIC_IDS4_ENABLED=
+IDS4_CUSTOM_NAME=
+IDS4_CLIENT_ID=
+IDS4_CLIENT_SECRET=
+IDS4_ISSUER=
+
+# Kakao
+NEXT_PUBLIC_KAKAO_ENABLED=
+KAKAO_CUSTOM_NAME=
+KAKAO_CLIENT_ID=
+KAKAO_CLIENT_SECRET=
+
+# Keycloak
+NEXT_PUBLIC_KEYCLOAK_ENABLED=
+KEYCLOAK_CUSTOM_NAME=
+KEYCLOAK_ISSUER=
+KEYCLOAK_CLIENT_ID=
+KEYCLOAK_CLIENT_SECRET=
+
+# LINE
+NEXT_PUBLIC_LINE_ENABLED=
+LINE_CUSTOM_NAME=
+LINE_CLIENT_ID=
+LINE_CLIENT_SECRET=
+
+# LinkedIn
+NEXT_PUBLIC_LINKEDIN_ENABLED=
+LINKEDIN_CUSTOM_NAME=
+LINKEDIN_CLIENT_ID=
+LINKEDIN_CLIENT_SECRET=
+
+# Mailchimp
+NEXT_PUBLIC_MAILCHIMP_ENABLED=
+MAILCHIMP_CUSTOM_NAME=
+MAILCHIMP_CLIENT_ID=
+MAILCHIMP_CLIENT_SECRET=
+
+# Mail.ru
+NEXT_PUBLIC_MAILRU_ENABLED=
+MAILRU_CUSTOM_NAME=
+MAILRU_CLIENT_ID=
+MAILRU_CLIENT_SECRET=
+
+# Naver
+NEXT_PUBLIC_NAVER_ENABLED=
+NAVER_CUSTOM_NAME=
+NAVER_CLIENT_ID=
+NAVER_CLIENT_SECRET=
+
+# Netlify
+NEXT_PUBLIC_NETLIFY_ENABLED=
+NETLIFY_CUSTOM_NAME=
+NETLIFY_CLIENT_ID=
+NETLIFY_CLIENT_SECRET=
+
+# Okta
+NEXT_PUBLIC_OKTA_ENABLED=
+OKTA_CUSTOM_NAME=
+OKTA_CLIENT_ID=
+OKTA_CLIENT_SECRET=
+OKTA_ISSUER=
+
+# OneLogin
+NEXT_PUBLIC_ONELOGIN_ENABLED=
+ONELOGIN_CUSTOM_NAME=
+ONELOGIN_CLIENT_ID=
+ONELOGIN_CLIENT_SECRET=
+ONELOGIN_ISSUER=
+
+# Osso
+NEXT_PUBLIC_OSSO_ENABLED=
+OSSO_CUSTOM_NAME=
+OSSO_CLIENT_ID=
+OSSO_CLIENT_SECRET=
+OSSO_ISSUER=
+
+# osu!
+NEXT_PUBLIC_OSU_ENABLED=
+OSU_CUSTOM_NAME=
+OSU_CLIENT_ID=
+OSU_CLIENT_SECRET=
+
+# Patreon
+NEXT_PUBLIC_PATREON_ENABLED=
+PATREON_CUSTOM_NAME=
+PATREON_CLIENT_ID=
+PATREON_CLIENT_SECRET=
+
+# Pinterest
+NEXT_PUBLIC_PINTEREST_ENABLED=
+PINTEREST_CUSTOM_NAME=
+PINTEREST_CLIENT_ID=
+PINTEREST_CLIENT_SECRET=
+
+# Pipedrive
+NEXT_PUBLIC_PIPEDRIVE_ENABLED=
+PIPEDRIVE_CUSTOM_NAME=
+PIPEDRIVE_CLIENT_ID=
+PIPEDRIVE_CLIENT_SECRET=
+
+# Reddit
+NEXT_PUBLIC_REDDIT_ENABLED=
+REDDIT_CUSTOM_NAME=
+REDDIT_CLIENT_ID=
+REDDIT_CLIENT_SECRET=
+
+# Salesforce
+NEXT_PUBLIC_SALESFORCE_ENABLED=
+SALESFORCE_CUSTOM_NAME=
+SALESFORCE_CLIENT_ID=
+SALESFORCE_CLIENT_SECRET=
+
+# Slack
+NEXT_PUBLIC_SLACK_ENABLED=
+SLACK_CUSTOM_NAME=
+SLACK_CLIENT_ID=
+SLACK_CLIENT_SECRET=
+
+# Spotify
+NEXT_PUBLIC_SPOTIFY_ENABLED=
+SPOTIFY_CUSTOM_NAME=
+SPOTIFY_CLIENT_ID=
+SPOTIFY_CLIENT_SECRET=
+
+# Strava
+NEXT_PUBLIC_STRAVA_ENABLED=
+STRAVA_CUSTOM_NAME=
+STRAVA_CLIENT_ID=
+STRAVA_CLIENT_SECRET=
+
+# Synology
+NEXT_PUBLIC_SYNOLOGY_ENABLED=
+SYNOLOGY_CUSTOM_NAME=
+SYNOLOGY_CLIENT_ID=
+SYNOLOGY_CLIENT_SECRET=
+SYNOLOGY_WELLKNOWN_URL=
+
+# Todoist
+NEXT_PUBLIC_TODOIST_ENABLED=
+TODOIST_CUSTOM_NAME=
+TODOIST_CLIENT_ID=
+TODOIST_CLIENT_SECRET=
+
+# Twitch
+NEXT_PUBLIC_TWITCH_ENABLED=
+TWITCH_CUSTOM_NAME=
+TWITCH_CLIENT_ID=
+TWITCH_CLIENT_SECRET=
+
+# United Effects
+NEXT_PUBLIC_UNITED_EFFECTS_ENABLED=
+UNITED_EFFECTS_CUSTOM_NAME=
+UNITED_EFFECTS_CLIENT_ID=
+UNITED_EFFECTS_CLIENT_SECRET=
+UNITED_EFFECTS_ISSUER=
+
+# VK
+NEXT_PUBLIC_VK_ENABLED=
+VK_CUSTOM_NAME=
+VK_CLIENT_ID=
+VK_CLIENT_SECRET=
+
+# Wikimedia
+NEXT_PUBLIC_WIKIMEDIA_ENABLED=
+WIKIMEDIA_CUSTOM_NAME=
+WIKIMEDIA_CLIENT_ID=
+WIKIMEDIA_CLIENT_SECRET=
+
+# Wordpress.com
+NEXT_PUBLIC_WORDPRESS_ENABLED=
+WORDPRESS_CUSTOM_NAME=
+WORDPRESS_CLIENT_ID=
+WORDPRESS_CLIENT_SECRET=
+
+# Yandex
+NEXT_PUBLIC_YANDEX_ENABLED=
+YANDEX_CUSTOM_NAME=
+YANDEX_CLIENT_ID=
+YANDEX_CLIENT_SECRET=
+
+# Zitadel
+NEXT_PUBLIC_ZITADEL_ENABLED=
+ZITADEL_CUSTOM_NAME=
+ZITADEL_CLIENT_ID=
+ZITADEL_CLIENT_SECRET=
+ZITADEL_ISSUER=
+
+# Zoho
+NEXT_PUBLIC_ZOHO_ENABLED=
+ZOHO_CUSTOM_NAME=
+ZOHO_CLIENT_ID=
+ZOHO_CLIENT_SECRET=
+
+# Zoom
+NEXT_PUBLIC_ZOOM_ENABLED=
+ZOOM_CUSTOM_NAME=
+ZOOM_CLIENT_ID=
+ZOOM_CLIENT_SECRET=

linkwarden/docker-compose.yml

@@ -0,0 +1,49 @@
+services:
+  postgres:
+    image: ${DOCKER_REGISTRY:-}postgres:16-alpine
+    env_file: .env
+
+    restart: always
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+  linkwarden:
+    env_file: .env
+    environment:
+      - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres
+    restart: always
+    # build: . # uncomment to build from source
+    image: ${DOCKER_REGISTRY:-}ghcr.io/linkwarden/linkwarden:latest # comment to build from source
+    ports:
+      - 3011:3000
+    volumes:
+      - data:/data/data
+    depends_on:
+      - postgres
+      - meilisearch
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      homepage.container: linkwarden-linkwarden-1
+      homepage.description: Link Manager
+      homepage.group: Utilities
+      homepage.href: https://linkwarden.sectorq.eu
+      homepage.icon: linkwarden.png
+      homepage.name: Linkwarden
+      homepage.server: my-docker
+      homepage.weight: 1
+      homepage.widget.type: linkwarden
+      homepage.widget.url: https://linkwarden.sectorq.eu
+      homepage.widget.key: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..yD9dHgIGR0BMXOs9.IM74UCsBShLgiDEKD78DRfFlunnwAI2S7FL0CUph-V4LuCrmmcRiiL-mpM3TLGQ_AaQZ2tKF9YQrBxZeZahKZ-JWK59hoijHznIu33EKIChoMGHhx54H.WPXJS-6CDYwfwox_0RpZkg
+      wud.watch: true
+      wud.watch.digest: true
+  meilisearch:
+    image: ${DOCKER_REGISTRY:-}getmeili/meilisearch:v1.12.8
+    restart: always
+    env_file:
+      - .env
+    volumes:
+      - meili_data:/meili_data
+
+volumes:
+  pgdata:
+  data:
+  meili_data:

mailu3/.env

@@ -1,4 +1,3 @@
 APPNAME=mailu
-DOCKER_REGISTRY=r.sectorq.eu/library/
 MAILU_VERSION=2024.06
 LOGGING=syslog

mailu3/docker-compose copy.yml

@@ -0,0 +1,251 @@
+networks:
+  clamav:
+    driver: bridge
+  default:
+    driver: bridge
+    ipam:
+      config:
+      - subnet: 192.168.205.0/24
+      driver: default
+  fts_attachments:
+    driver: bridge
+    internal: true
+  oletools:
+    driver: bridge
+    internal: true
+  radicale:
+    driver: bridge
+  webmail:
+    driver: bridge
+services:
+  admin:
+    depends_on:
+      - redis
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/data:/data
+      - /share/docker_data/mailu3/dkim:/dkim
+  antispam:
+    depends_on:
+      - front
+      - redis
+      - oletools
+      - antivirus
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    hostname: antispam
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - default
+      - oletools
+      - clamav
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/filter:/var/lib/rspamd
+      - /share/docker_data/mailu3/overrides/rspamd:/overrides:ro
+  antivirus:
+    healthcheck:
+      interval: 10s
+      retries: 3
+      start_period: 10s
+      test:
+        - CMD-SHELL
+        - "clamdcheck.sh"
+      timeout: 5s
+    image: ${DOCKER_REGISTRY:-}clamav/clamav-debian:1.4
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - clamav
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/filter/clamav:/var/lib/clamav
+  fetchmail:
+    depends_on:
+      - admin
+      - smtp
+      - imap
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}fetchmail:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/mailu3/data/fetchmail:/data
+  front:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    extends:
+      file: logging.yml
+      service: ${LOGGING:-syslog}
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+      homepage.container: mailu3-front-1
+      homepage.description: eMail server
+      homepage.group: Utilities
+      homepage.href: https://mail.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Mailu
+      homepage.server: my-docker
+      homepage.weight: 1
+
+    networks:
+      - default
+      - webmail
+      - radicale
+    ports:
+      - 0.0.0.0:8880:80
+      - 0.0.0.0:8443:443
+      - 0.0.0.0:25:25
+      - 0.0.0.0:465:465
+      - 0.0.0.0:587:587
+      - 0.0.0.0:110:110
+      - 0.0.0.0:995:995
+      - 0.0.0.0:143:143
+      - 0.0.0.0:993:993
+      - 0.0.0.0:4190:4190
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/certs:/certs
+      - /share/docker_data/mailu3/overrides/nginx:/overrides:ro
+  fts_attachments:
+    depends_on:
+     - resolver
+    dns:
+      - 192.168.205.254
+    healthcheck:
+      interval: 10s
+      retries: 3
+      start_period: 10s
+      test:
+        - CMD-SHELL
+        - wget -nv -t1 -O /dev/null http://127.0.0.1:9998/tika || exit 1
+      timeout: 5s
+    hostname: tika
+    image: ${DOCKER_REGISTRY:-}apache/tika:2.9.2.1-full
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - fts_attachments
+    restart: ${RESTART:-unless-stopped}
+  imap:
+    depends_on:
+      - front
+      - fts_attachments
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - default
+      - fts_attachments
+    ulimits:
+      nofile:
+        soft: 30000
+        hard: 30000
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/mail:/mail
+      - /share/docker_data/mailu3/overrides/dovecot:/overrides:ro
+  oletools:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    hostname: oletools
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}oletools:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - oletools
+    restart: ${RESTART:-unless-stopped}
+  redis:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    image: ${DOCKER_REGISTRY:-}redis:alpine
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: unless-stopped
+    volumes:
+    - /share/docker_data/mailu3/redis:/data
+  resolver:
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      default:
+        ipv4_address: 192.168.205.254
+    restart: ${RESTART:-unless-stopped}
+  smtp:
+    depends_on:
+      - front
+      - resolver
+    dns:
+     - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+     - /share/docker_data/mailu3/mailqueue:/queue
+     - /share/docker_data/mailu3/overrides/postfix:/overrides:ro
+  webdav:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}radicale:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - radicale
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/dav:/data
+  webmail:
+    depends_on:
+      - front
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}webmail:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - webmail
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/webmail:/data
+      - /share/docker_data/mailu3/overrides/roundcube:/overrides:ro

mailu3/docker-compose.yml

@@ -31,8 +31,8 @@ services:
       wud.watch.digest: true
     restart: ${RESTART:-unless-stopped}
     volumes:
-      - /share/docker_data/mailu3/data:/data
+      - mailu3_data:/data
-      - /share/docker_data/mailu3/dkim:/dkim
+      - mailu3_dkim:/dkim
   antispam:
     depends_on:
       - front
@@ -54,8 +54,8 @@ services:
       - clamav
     restart: ${RESTART:-unless-stopped}
     volumes:
-      - /share/docker_data/mailu3/filter:/var/lib/rspamd
+      - antispam_filter:/var/lib/rspamd
-      - /share/docker_data/mailu3/overrides/rspamd:/overrides:ro
+      - antispam_rspamd:/overrides:ro
   antivirus:
     healthcheck:
       interval: 10s
@@ -73,7 +73,7 @@ services:
       - clamav
     restart: ${RESTART:-unless-stopped}
     volumes:
-      - /share/docker_data/mailu3/filter/clamav:/var/lib/clamav
+      - antivirus_clamav:/var/lib/clamav
   fetchmail:
     depends_on:
       - admin
@@ -89,7 +89,7 @@ services:
       wud.watch.digest: true
     restart: ${RESTART:-unless-stopped}
     volumes:
-    - /share/docker_data/mailu3/data/fetchmail:/data
+    - fetchmail:/data
   front:
     depends_on:
       - resolver
@@ -129,8 +129,8 @@ services:
       - 0.0.0.0:4190:4190
     restart: ${RESTART:-unless-stopped}
     volumes:
-      - /share/docker_data/mailu3/certs:/certs
+      - nginx_certs:/certs
-      - /share/docker_data/mailu3/overrides/nginx:/overrides:ro
+      - nginx_overrides:/overrides:ro
   fts_attachments:
     depends_on:
      - resolver
@@ -173,8 +173,8 @@ services:
         hard: 30000
     restart: ${RESTART:-unless-stopped}
     volumes:
-      - /share/docker_data/mailu3/mail:/mail
+      - imap_mail:/mail
-      - /share/docker_data/mailu3/overrides/dovecot:/overrides:ro
+      - imap_dovecot:/overrides:ro
   oletools:
     depends_on:
       - resolver
@@ -199,7 +199,7 @@ services:
       wud.watch.digest: true
     restart: unless-stopped
     volumes:
-    - /share/docker_data/mailu3/redis:/data
+    - redis:/data
   resolver:
     env_file: stack.env
     image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-2024.06}
@@ -223,8 +223,8 @@ services:
       wud.watch.digest: true
     restart: ${RESTART:-unless-stopped}
     volumes:
-     - /share/docker_data/mailu3/mailqueue:/queue
+     - mailqueue:/queue
-     - /share/docker_data/mailu3/overrides/postfix:/overrides:ro
+     - postfix_overrides:/overrides:ro
   webdav:
     image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}radicale:${MAILU_VERSION:-2024.06}
     labels:
@@ -234,7 +234,7 @@ services:
       - radicale
     restart: ${RESTART:-unless-stopped}
     volumes:
-      - /share/docker_data/mailu3/dav:/data
+      - webdav_data:/data
   webmail:
     depends_on:
       - front
@@ -247,5 +247,22 @@ services:
       - webmail
     restart: ${RESTART:-unless-stopped}
     volumes:
-      - /share/docker_data/mailu3/webmail:/data
+      - webmail:/data
-      - /share/docker_data/mailu3/overrides/roundcube:/overrides:ro
+      - roundcube:/overrides:ro
+volumes:
+  antivirus_clamav:
+  antispam_filter:
+  antispam_rspamd:
+  fetchmail:
+  imap_mail:
+  imap_dovecot:
+  mailu3_data:
+  mailu3_dkim:
+  mailqueue:
+  nginx_certs:
+  nginx_overrides:
+  postfix_overrides:
+  webdav_data:
+  webmail:
+  roundcube:
+  redis:

mailu3/stack.env

@@ -141,10 +141,10 @@ COMPOSE_PROJECT_NAME=mailu
 CREDENTIAL_ROUNDS=12
 
 # Header to take the real ip from
-REAL_IP_HEADER=X-Real-IP
+# REAL_IP_HEADER=X-Real-IP
-
+REAL_IP_HEADER=X-Forwarded-For
 # IPs for nginx set_real_ip_from (CIDR list separated by commas)
-REAL_IP_FROM=192.168.77.101
+REAL_IP_FROM=172.0.0.0/8
 
 # choose wether mailu bounces (no) or rejects (yes) mail when recipient is unknown (value: yes, no)
 REJECT_UNLISTED_RECIPIENT=

mediacenter/docker-compose_nas.yml

@@ -0,0 +1,361 @@
+networks:
+  duplicati:
+    driver: bridge
+  mediarr:
+    driver: bridge
+volumes:
+  homarr_configs:
+  homarr_icons:
+  homarr_data:
+  jackett_config:
+  jackett_downloads:
+  jellyfin_config:
+  jellyseerr_config:
+  lidarr_config:
+  qbittorrent_config:
+  radarr_config:
+  sonarr_config:
+  bazarr_config:
+  # m-server_music:
+  #   driver: local
+  #   driver_opts:
+  #     type: nfs
+  #     o: addr=192.168.77.101,rw,nfsvers=4.1,nolock,nofail
+  #     device: "192.168.77.101:/music"
+  # m-server_movies:
+  #   driver: local
+  #   driver_opts:
+  #     type: nfs
+  #     o: addr=192.168.77.101,rw,nfsvers=4.1,nolock,nofail
+  #     device: "192.168.77.101:/movies"
+  # m-server_shows:
+  #   driver: local
+  #   driver_opts:
+  #     type: nfs
+  #     o: addr=192.168.77.101,rw,nfsvers=4.1,nolock,nofail
+  #     device: "192.168.77.101:/shows"
+
+services:
+  bazarr:
+    container_name: bazarr
+    depends_on:
+      - sonarr
+      - radarr
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Bratislava
+    hostname: bazarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/bazarr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: bazarr
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://bazarr.sectorq.eu
+      homepage.icon: bazarr.png
+      homepage.name: bazarr
+      homepage.server: my-docker
+      homepage.weight: '90'
+      homepage.widget.key: ${BAZARR_TOKEN}
+      homepage.widget.type: bazarr
+      homepage.widget.url: https://bazarr.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - mediarr
+    ports:
+      - 6767:6767
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - bazarr_config:/config
+      # - m-server_movies:/movies/m-server
+      # - m-server_shows:/tv/m-server
+      - /share/movies:/movies/nas
+      - /share/shows:/tv/nas
+  flaresolverr:
+    container_name: flaresolverr
+    environment:
+    - LOG_LEVEL=info
+    - TZ=Europe/Bratislava
+    hostname: flaresolverr
+    image: ${DOCKER_REGISTRY:-}ghcr.io/flaresolverr/flaresolverr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - mediarr
+    ports:
+      - 8191:8191
+    restart: ${RESTART:-unless-stopped}
+  homarr:
+    container_name: homarr
+    hostname: homarr
+    image: ${DOCKER_REGISTRY:-}ghcr.io/ajnart/homarr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - mediarr
+    ports:
+      - 7575:7575
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - homarr_configs:/app/data/configs
+      - homarr_icons:/app/public/icons
+      - homarr_data:/data
+  jackett:
+    container_name: jackett
+    dns:
+      - 192.168.77.101
+    depends_on:
+      - sonarr
+      - radarr
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Bratislava
+      - AUTO_UPDATE=true
+      - RUN_OPTS=
+    hostname: jackett
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/jackett:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: jackett
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://jackett.sectorq.eu
+      homepage.icon: jackett.png
+      homepage.name: Jackett
+      homepage.server: my-docker
+      homepage.weight: '80'
+      homepage.widget.password: ${JACKET_TOKEN}
+      homepage.widget.type: jackett
+      homepage.widget.url: https://jackett.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 9117:9117
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - jackett_config:/config
+    - jackett_downloads:/downloads
+  jellyfin:
+    container_name: jellyfin
+    environment:
+    - PUID=1000
+    - PGID=1000
+    - TZ=Europe/Bratislava
+    - JELLYFIN_PublishedServerUrl=https://jf.sectorq.eu
+    extends:
+      file: hwaccel.yml
+      service: ${HW_MODE:-cpu}
+    hostname: jellyfin
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/jellyfin:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: jellyfin
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://jf.sectorq.eu
+      homepage.icon: jellyfin.png
+      homepage.name: Jellyfin
+      homepage.server: my-docker
+      homepage.weight: '10'
+      homepage.widget.key: ${JELLYFIN_TOKEN}
+      homepage.widget.type: jellyfin
+      homepage.widget.url: https://jf.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    network_mode: host
+    ports:
+    - 8096:8096
+    - 8920:8920
+    - 7359:7359
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - jellyfin_config:/config
+    # - m-server_movies:/data/movies/m-server
+    # - m-server_music:/data/music/m-server
+    # - m-server_shows:/data/shows/m-server
+    - /share/movies:/data/movies/nas
+    - /share/music:/data/music/nas
+    - /share/shows:/data/shows/nas
+    - /share/live:/data/live/nas
+    - /share/xxx:/data/xxx/nas
+  jellyseerr:
+    container_name: jellyseerr
+    environment:
+    - LOG_LEVEL=debug
+    - TZ=Europe/Bratislava
+    hostname: jellyseerr
+    image: ${DOCKER_REGISTRY:-}fallenbagel/jellyseerr:latest
+    labels:
+      com.centurylinklabs.watchtower.enabl: 'true'
+      homepage.container: jellyseerr
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://js.sectorq.eu
+      homepage.icon: jellyseerr.png
+      homepage.name: Jellyseerr
+      homepage.server: my-docker
+      homepage.weight: '20'
+      homepage.widget.key: ${JELLYSEER_TOKEN}
+      homepage.widget.type: jellyseerr
+      homepage.widget.url: https://js.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 5055:5055
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - jellyseerr_config:/app/config
+  lidarr:
+    container_name: lidarr
+    dns:
+      - 8.8.8.8
+      - 192.168.77.101
+    environment:
+    # - PUID=1000
+    # - PGID=1000
+    - TZ=Europe/Bratislava
+    hostname: lidarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/lidarr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: lidarr
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://lidarr.sectorq.eu
+      homepage.icon: lidarr.png
+      homepage.name: Lidarr
+      homepage.server: my-docker
+      homepage.weight: '60'
+      homepage.widget.key: ${LIDARR_TOKEN}
+      homepage.widget.type: lidarr
+      homepage.widget.url: https://lidarr.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 8686:8686
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - lidarr_config:/config
+    # - m-server_music:/music
+    - /share/downloads:/downloads
+  qbittorrent:
+    container_name: qbittorrent
+    environment:
+    - PUID=1000
+    - PGID=1000
+    - TZ=Europe/Bratislava
+    - WEBUI_PORT=8085
+    - FILE__PASSWORD=/run/secrets/mysecretpassword
+    hostname: qbittorrent
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/qbittorrent:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: qbittorrent
+      homepage.description: Subtitles
+      homepage.group: Utilities
+      homepage.href: https://qbit.sectorq.eu
+      homepage.icon: qbittorrent.png
+      homepage.name: Qbittorrent
+      homepage.server: my-docker
+      homepage.weight: '95'
+      homepage.widget.enableLeechProgress: 'false'
+      homepage.widget.password: ${QBIT_TOKEN}
+      homepage.widget.type: qbittorrent
+      homepage.widget.url: https://qbit.sectorq.eu
+      homepage.widget.username: admin
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 8085:8085
+    - 6881:6881
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - qbittorrent_config:/config
+    - /share/downloads:/downloads
+  radarr:
+    container_name: radarr
+    dns:
+    - 192.168.77.101
+    environment:
+    - PUID=1000
+    - PGID=1000
+    - TZ=Europe/Bratislava
+    hostname: radarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/radarr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: radarr
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://radarr.sectorq.eu
+      homepage.icon: radarr.png
+      homepage.name: Radarr
+      homepage.server: my-docker
+      homepage.weight: '20'
+      homepage.widget.key: ${RADARR_TOKEN}
+      homepage.widget.type: radarr
+      homepage.widget.url: https://radarr.sectorq.eu
+      wud.display.icon: mdi:radarr
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 7878:7878
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - radarr_config:/config
+    # - m-server_movies:/movies-m-server
+    - /share/movies:/movies-nas
+    - /share/downloads:/downloads
+  sonarr:
+    container_name: sonarr
+    dns:
+      - 192.168.77.101
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Bratislava
+    hostname: sonarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/sonarr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: sonarr
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://sonarr.sectorq.eu
+      homepage.icon: sonarr.png
+      homepage.name: Sonarr
+      homepage.server: my-docker
+      homepage.weight: '30'
+      homepage.widget.key: ${SONARR_TOKEN}
+      homepage.widget.type: sonarr
+      homepage.widget.url: https://sonarr.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 8989:8989
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - sonarr_config:/config
+    # - m-server_shows:/tv-m-server
+    - /share/shows:/tv-nas
+    - /share/downloads:/downloads

mosquitto/.env

@@ -1,2 +1 @@
 APPNAME=mosquitto
-DOCKER_REGISTRY=r.sectorq.eu/library/

n8n/docker-compose.yml

@@ -2,9 +2,9 @@ version: "3"
 services:
   n8n:
     image: ${DOCKER_REGISTRY:-}n8nio/n8n:latest
-    container_name: n8n
+    container_name: n8n-main
     ports:
-      - "5679:5678"
+      - "5678:5678"
     environment:
       - N8N_HOST=n8n.sectorq.eu
       - N8N_PORT=5678
@@ -13,13 +13,20 @@ services:
       - N8N_BASIC_AUTH_USER=sth
       - N8N_BASIC_AUTH_PASSWORD=pwd
       - N8N_RUNNERS_ENABLED=true
-      - N8N_RUNNERS_MODE=internal
+      - N8N_RUNNERS_MODE=external
+      - N8N_RUNNERS_BROKER_LISTEN_ADDRESS=0.0.0.0
+      - N8N_RUNNERS_AUTH_TOKEN=l4c1j4yd33Du5lo
+      - N8N_NATIVE_PYTHON_RUNNER=true
+      - N8N_GIT_NODE_ALLOW_LOCAL=true
       - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
       - N8N_SECURE_COOKIE=false
       - WEBHOOK_URL=https://n8n.sectorq.eu
       - NODES_EXCLUDE="[]"
+      - NODE_FUNCTION_ALLOW_EXTERNAL=caldav
+      - NODE_FUNCTION_ALLOW_BUILTIN=datetime
     volumes:
-      - n8n-data:/home/node/.n8n
+      - data:/home/node/.n8n
+      - files:/home/node/.n8n-files/
     restart: ${RESTART:-unless-stopped}
     stop_grace_period: 60s
     labels:      
@@ -32,6 +39,19 @@ services:
       homepage.server: my-docker
       wud.watch: true
       wud.watch.digest: true
+  task-runners:
+    image: n8nio/runners:latest
+    container_name: n8n-runners
+    environment:
+      N8N_RUNNERS_TASK_BROKER_URI: http://n8n-main:5679
+      N8N_RUNNERS_AUTH_TOKEN: l4c1j4yd33Du5lo
+      N8N_RUNNERS_STDLIB_ALLOW: "*"
+      N8N_RUNNERS_EXTERNAL_ALLOW: "*"
+      # etc.
+    depends_on:
+      - n8n
 volumes:
-  n8n-data:
+  data:
+    driver: local
+  files:
     driver: local

nginx/docker-compose.yml

@@ -35,6 +35,8 @@ services:
     - 81:81
     restart: unless-stopped
     volumes:
-    - /share/docker_data/nginx/data:/data
+    - data:/data
-    - /share/docker_data/nginx/letsencrypt:/etc/letsencrypt
+    - letsencrypt:/etc/letsencrypt
-version: '3.8'
+volumes:
+  data:
+  letsencrypt:

ollama/docker-compose.yml

@@ -33,6 +33,7 @@ services:
       # Disables user/password login form. Required when ENABLE_OAUTH_SIGNUP=true.
       - ENABLE_LOGIN_FORM=false
       - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
+    restart: ${RESTART:-unless-stopped}
 volumes:
   open-webui:
   models:

pihole/docker-compose.yml

@@ -33,7 +33,7 @@ services:
       TZ: Europe/Bratislava
     hostname: ${PIHOLE_HOSTNAME}
     image: pihole/pihole:latest
-    shm_size: '256mb'
+    shm_size: '512mb'
     logging:
       driver: loki
       options:

puppet/docker-compose.yml

@@ -0,0 +1,31 @@
+version: "3.8"
+
+services:
+  puppetserver:
+    image: puppet/puppetserver:latest
+    container_name: puppetserver
+    hostname: active.home.lan
+    ports:
+      - "8140:8140"
+    environment:
+      - PUPPETSERVER_HOSTNAME=active.home.lan
+    volumes:
+      # Main Puppet config
+      - puppet-puppet:/etc/puppetlabs/puppet
+      - puppet-server:/etc/puppetlabs/puppetserver
+      # Puppet code (manifests, modules)
+      - puppet-code:/etc/puppetlabs/code
+
+    networks:
+      puppetnet:
+        aliases:
+          - puppet
+          - puppetserver
+          - active.home.lan
+
+networks:
+  puppetnet:
+volumes:
+  puppet-code:
+  puppet-server:
+  puppet-puppet:

puppet_agent/docker-compose.yml

@@ -0,0 +1,13 @@
+---
+services:
+  puppet-agent:
+    image: puppet/puppet-agent:latest
+    container_name: puppet-agent
+    hostname: nas.home.lan
+    environment:
+      - PUPPET_SERVER=active.home.lan
+    volumes:
+      - data:/etc/puppetlabs/puppet
+    command: ["agent", "-t"]
+volumes:
+  data:

registry/docker-compose_nas.yml

@@ -0,0 +1,24 @@
+name: registry
+services:
+  registry:
+    container_name: registry
+    environment:
+    - REGISTRY_STORAGE_DELETE_ENABLED=true
+    - REGISTRY_AUTH=htpasswd
+    - REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm
+    - REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd
+    image: registry:2
+    labels:
+      wud.watch: false
+      wud.watch.digest: false
+    logging:
+      driver: loki
+      options:
+        loki-url: http://192.168.77.101:3100/loki/api/v1/push
+    ports:
+    - 5000:5000
+    restart: always
+    volumes:
+    - /share/docker_data/registry/auth:/auth
+    - /share/docker_registry/data:/var/lib/registry
+    - /share/docker_data/registry/config:/etc/docker/registry/

repo_mirror/docker-compose.yml

@@ -1,46 +1,46 @@
 version: "3.9"
 
 services:
-  # Rocky Linux 9 mirror
+  # # Rocky Linux 9 mirror
-  rocky9-sync:
+  # rocky9-sync:
-    image: rockylinux:9
+  #   image: rockylinux:9
-    container_name: rocky9-sync
+  #   container_name: rocky9-sync
-    user: root
+  #   user: root
-    volumes:
+  #   volumes:
-      - /share/docker_data/repo_mirror/data/rocky/9:/repos   # mirror storage
+  #     - /media/nas/qda_1/repos/rocky/9:/repos   # mirror storage
-      - /share/docker_data/repo_mirror/scripts/rocky9.sh:/rocky9.sh
+  #     - /share/docker_data/repo_mirror/scripts/rocky9.sh:/rocky9.sh
-    command: /rocky9.sh
+  #   command: /rocky9.sh
-    restart: "no"
+  #   restart: "no"
 
-  # Debian mirror
+  # # Debian mirror
-  debian-sync:
+  # debian-sync:
-    image: ubuntu:24.04
+  #   image: ubuntu:24.04
-    container_name: debian-sync
+  #   container_name: debian-sync
-    user: root
+  #   user: root
-    volumes:
+  #   volumes:
-      - /share/docker_data/repo_mirror/data/debian:/mirror
+  #     - /media/nas/qda_1/repos/debian:/mirror
-      - /share/docker_data/repo_mirror/scripts/debian13.sh:/debian13.sh
+  #     - /share/docker_data/repo_mirror/scripts/debian.sh:/debian.sh
-    command: /debian13.sh
+  #   command: /debian.sh
-    restart: "no"
+  #   restart: "no"
-  # Ubuntu mirror
+  # # Ubuntu mirror
-  ubuntu-sync:
+  # ubuntu-sync:
-    image: ubuntu:24.04
+  #   image: ubuntu:24.04
-    container_name: ubuntu-sync
+  #   container_name: ubuntu-sync
-    user: root
+  #   user: root
-    volumes:
+  #   volumes:
-      - /share/docker_data/repo_mirror/data/ubuntu:/mirror
+  #     - /media/nas/qda_1/repos/ubuntu:/mirror
-      - /share/docker_data/repo_mirror/scripts/ubuntu.sh:/ubuntu.sh
+  #     - /share/docker_data/repo_mirror/scripts/ubuntu.sh:/ubuntu.sh
-    command: /ubuntu.sh
+  #   command: /ubuntu.sh
-    restart: "no"
+  #   restart: "no"
-  # Optional: Nginx to serve both mirrors
+  # # Optional: Nginx to serve both mirrors
   nginx:
     image: nginx:1.28
     container_name: mirror-nginx
     ports:
       - "8383:80"
     volumes:
-      - /media/m-server/repos/ubuntu/:/usr/share/nginx/html/ubuntu
+      - /media/nas/qda_1/repos/docker/:/usr/share/nginx/html/docker
-      - /share/docker_data/repo_mirror/data/rocky:/usr/share/nginx/html/rocky
+      - /media/nas/qda_1/repos/ubuntu/:/usr/share/nginx/html/ubuntu
-      - /share/docker_data/repo_mirror/data/debian:/usr/share/nginx/html/debian
+      - /media/nas/qda_1/repos/rocky/:/usr/share/nginx/html/rocky
       - /share/docker_data/repo_mirror/config/nginx.conf:/etc/nginx/nginx.conf:ro
     restart: unless-stopped