build

__swarm/authentik/stack.env

@@ -3,7 +3,7 @@ PG_USER=authentik
 PG_DB=authentik
 AUTHENTIK_SECRET_KEY=ZKkVCxj8kKj5ZklvzxKG2IgYQOftDoLPRjc57yomr1qzbKEQVZ
 AUTHENTIK_ERROR_REPORTING__ENABLED=true
-AUTHENTIK_TAG=2025.8.4
+AUTHENTIK_TAG=2025.10.2
 POSTGRES_PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
 POSTGRES_USER=authentik
 POSTGRES_DB=authentik

__swarm/gitlab/docker-compose.yml

@@ -1,5 +1,16 @@
 services:
+  runner:
+    container_name: gitlab-runner
+    restart: always
+    volumes:
+      - runner:/etc/gitlab-runner
+      - /var/run/docker.sock:/var/run/docker.sock
+    image: ${DOCKER_REGISTRY:-}gitlab/gitlab-runner:latest
+    labels:
+      - wud.watch.digest=true
+      - wud.watch=true
   web:
+  
     container_name: gitlab
     environment:
       GITLAB_OMNIBUS_CONFIG: "external_url 'https://gitlab.sectorq.eu'\nnginx['listen_port']\
@@ -47,8 +58,13 @@ services:
     restart: unless-stopped
     shm_size: 4gb
     volumes:
-    - /share/docker_data/gitlab/config:/etc/gitlab
+    - config:/etc/gitlab
-    - /share/docker_data/gitlab/logs:/var/log/gitlab
+    - logs:/var/log/gitlab
-    - /share/docker_data/gitlab/data:/var/opt/gitlab
+    - data:/var/opt/gitlab
     - /etc/localtime:/etc/localtime:ro
 version: '3.6'
+volumes:
+  runner:
+  config:
+  logs:
+  data:

__swarm/gitlab/gitlab-swarm.yml

@@ -1,88 +1,101 @@
-services:
+  services:
-  app:
+    runner:
-    environment:
+      container_name: gitlab-runner
-      GITLAB_OMNIBUS_CONFIG: |
+      restart: always
-        external_url 'https://gitlab.sectorq.eu'
+      volumes:
-        nginx['listen_port'] = 80
+        - runner:/etc/gitlab-runner
-        nginx['listen_https'] = false
+        - /var/run/docker.sock:/var/run/docker.sock
-        web_server['username'] = 'git'
+      image: ${DOCKER_REGISTRY:-}gitlab/gitlab-runner:latest
-        gitlab_rails['time_zone'] = 'Europe/Bratislava'
-        gitlab_rails['omniauth_enabled'] = true
-        gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
-        gitlab_rails['omniauth_sync_email_from_provider'] = 'saml'
-        gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']
-        gitlab_rails['omniauth_sync_profile_attributes'] = ['email']
-        gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'
-        gitlab_rails['omniauth_block_auto_created_users'] = false
-        gitlab_rails['omniauth_auto_link_saml_user'] = true
-        gitlab_rails['omniauth_providers'] = [
-          {
-            name: 'saml',
-            args: {
-              assertion_consumer_service_url: 'https://gitlab.sectorq.eu/users/auth/saml/callback',
-              # Shown when navigating to certificates in authentik1
-              idp_cert_fingerprint: 'f7:fd:49:03:b3:38:52:b3:23:f5:43:c4:8d:08:65:32:e0:5a:7b:0e',
-              idp_sso_target_url: 'https://auth.sectorq.eu/application/saml/gitlab/sso/binding/redirect/',
-              issuer: 'https://gitlab.sectorq.eu',
-              name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
-              attribute_statements: {
-                email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],
-                first_name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],
-                nickname: ['http://schemas.goauthentik.io/2021/02/saml/username']
-              }
-            },
-            label: 'authentik'
-          }
-        ]
-      TZ: Europe/Bratislava
-    hostname: gitlab.sectorq.eu
-    image: ${DOCKER_REGISTRY:-}gitlab/gitlab-ce:latest
-    network_mode: bridge
-    ports:
-    - target: 80
-      published: 8785
-      protocol: tcp
-      mode: ingress
-    - target: 443
-      published: 8743
-      protocol: tcp
-      mode: ingress
-    - target: 22
-      published: 8722
-      protocol: tcp
-      mode: ingress
-    shm_size: 4gb
-    volumes:
-    - config:/etc/gitlab
-    - logs:/var/log/gitlab
-    - data:/var/opt/gitlab
-    - /etc/localtime:/etc/localtime:ro
-    deploy:
       labels:
-        com.centurylinklabs.watchtower.enable: 'true'
+        - wud.watch.digest=true
-        homepage.container: gitlab
+        - wud.watch=true
-        homepage.description: Version control
+      dns:
-        homepage.group: Infrastructure
+        - 192.168.77.1
-        homepage.href: https://gitlab.sectorq.eu
+        - 192.168.77.101
-        homepage.icon: gitlab.png
+    app:
-        homepage.name: Gitlab
+      environment:
-        homepage.server: my-docker-swarm
+        GITLAB_OMNIBUS_CONFIG: |
-        homepage.weight: '1'
+          external_url 'https://gitlab.sectorq.eu'
-        homepage.widget.key: glpat-BuMKcaDqeD-Wx3dW4TM9
+          nginx['listen_port'] = 80
-        homepage.widget.type: gitlab
+          nginx['listen_https'] = false
-        homepage.widget.url: https://gitlab.sectorq.eu
+          web_server['username'] = 'git'
-        homepage.widget.user_id: '2'
+          gitlab_rails['time_zone'] = 'Europe/Bratislava'
-        wud.watch: 'true'
+          gitlab_rails['omniauth_enabled'] = true
-        wud.watch.digest: 'true'
+          gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
-      replicas: 1
+          gitlab_rails['omniauth_sync_email_from_provider'] = 'saml'
-      placement:
+          gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']
-        constraints:
+          gitlab_rails['omniauth_sync_profile_attributes'] = ['email']
-        - node.role == manager
+          gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'
+          gitlab_rails['omniauth_block_auto_created_users'] = false
+          gitlab_rails['omniauth_auto_link_saml_user'] = true
+          gitlab_rails['omniauth_providers'] = [
+            {
+              name: 'saml',
+              args: {
+                assertion_consumer_service_url: 'https://gitlab.sectorq.eu/users/auth/saml/callback',
+                # Shown when navigating to certificates in authentik1
+                idp_cert_fingerprint: 'f7:fd:49:03:b3:38:52:b3:23:f5:43:c4:8d:08:65:32:e0:5a:7b:0e',
+                idp_sso_target_url: 'https://auth.sectorq.eu/application/saml/gitlab/sso/binding/redirect/',
+                issuer: 'https://gitlab.sectorq.eu',
+                name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
+                attribute_statements: {
+                  email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],
+                  first_name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],
+                  nickname: ['http://schemas.goauthentik.io/2021/02/saml/username']
+                }
+              },
+              label: 'authentik'
+            }
+          ]
+        TZ: Europe/Bratislava
+      hostname: gitlab.sectorq.eu
+      image: ${DOCKER_REGISTRY:-}gitlab/gitlab-ce:latest
+      network_mode: bridge
+      ports:
+      - target: 80
+        published: 8785
+        protocol: tcp
+        mode: ingress
+      - target: 443
+        published: 8743
+        protocol: tcp
+        mode: ingress
+      - target: 22
+        published: 8722
+        protocol: tcp
+        mode: ingress
+      shm_size: 4gb
+      volumes:
+      - config:/etc/gitlab
+      - logs:/var/log/gitlab
+      - data:/var/opt/gitlab
+      - /etc/localtime:/etc/localtime:ro
+      deploy:
+        labels:
+          com.centurylinklabs.watchtower.enable: 'true'
+          homepage.container: gitlab
+          homepage.description: Version control
+          homepage.group: Infrastructure
+          homepage.href: https://gitlab.sectorq.eu
+          homepage.icon: gitlab.png
+          homepage.name: Gitlab
+          homepage.server: my-docker-swarm
+          homepage.weight: '1'
+          homepage.widget.key: glpat-BuMKcaDqeD-Wx3dW4TM9
+          homepage.widget.type: gitlab
+          homepage.widget.url: https://gitlab.sectorq.eu
+          homepage.widget.user_id: '2'
+          wud.watch: 'true'
+          wud.watch.digest: 'true'
+        replicas: 1
+        placement:
+          constraints:
+          - node.role == manager
 
-volumes:
+  volumes:
-  config:
+    config:
-    driver: local
+      driver: local
-  logs:
+    logs:
-    driver: local
+      driver: local
-  data:
+    data:
-    driver: local 
+      driver: local

__swarm/hashicorp/hashicorp-swarm.yml

@@ -0,0 +1,47 @@
+services:
+  vault:
+    image: hashicorp/vault:latest
+    command: server -config=/vault/config/vault.hcl
+    volumes:
+      - data:/vault/data
+    configs:
+      - source: vault_hcl
+        target: /vault/config/vault.hcl
+    ports:
+      - "8200:8200"
+    environment:
+      VAULT_LOCAL_CONFIG: |
+        {
+          "backend": {
+            "file": {
+              "path": "/vault/file"
+            }
+          },
+          "listener": {
+            "tcp": {
+              "address": "0.0.0.0:8200",
+              "tls_disable": 1
+            }
+          },
+          "disable_mlock": true
+        }
+      VAULT_API_ADDR: "http://192.168.77.101:8200"
+    cap_add:
+      - IPC_LOCK
+    networks:
+      - vault-net
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+
+configs:
+  vault_hcl:
+    external: true
+volumes:
+  data:
+networks:
+  vault-net:
+    driver: overlay

__swarm/home-assistant/home-assistant-swarm.yml

@@ -1,11 +1,16 @@
+
+
 services:
   homeassistant:
-    network_mode: host
     image: ${DOCKER_REGISTRY:-}ghcr.io/home-assistant/home-assistant:latest
     volumes:
     - ha_config:/config
     - /var/run/docker.sock:/var/run/docker.sock
     - /run/dbus:/run/dbus:ro
+    networks:
+      - swarm-ipvlan 
+      - traefik-public
+      - homeassistant-internal
     privileged: true
     environment:
       DISABLE_JEMALLOC: value

__swarm/homepage/homepage-swarm.yml

@@ -1,6 +1,7 @@
 services:
   homepage:
     dns:
+    - 192.168.77.1
     - 192.168.77.101
     environment:
       HOMEPAGE_ALLOWED_HOSTS: sectorq.eu,active.home.lan:3003,m-server.home.lan:3003,rpi5.home.lan:3003,nas.home.lan:3003,192.168.77.238:3003,rack.home.lan:3003,192.168.80.222:3003

__swarm/mediacenter/mediacenter-swarm.yml

@@ -16,8 +16,18 @@ volumes:
   radarr_config:
   sonarr_config:
   bazarr_config:
-  flaresolverr_config:
+  m-server_music:
-
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=192.168.77.101,rw,nfsvers=4.2,nolock
+      device: :/music
+  m-server_movies:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=192.168.77.101,rw,nfsvers=4.2,nolock
+      device: :/movies
 services:
   bazarr:
     environment:
@@ -28,6 +38,8 @@ services:
     image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/bazarr:latest
     networks:
     - mediarr
+    dns:
+      - 192.168.77.101
     ports:
     - target: 6767
       published: 6767
@@ -42,7 +54,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: bazarr
+        homepage.container: mediacenter_bazarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://bazarr.sectorq.eu
@@ -59,6 +71,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   flaresolverr:
     environment:
       LOG_LEVEL: info
@@ -81,6 +94,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   homarr:
     hostname: homarr
     image: ${DOCKER_REGISTRY:-}ghcr.io/ajnart/homarr:latest
@@ -105,6 +119,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   jackett:
     dns:
     - 192.168.77.101
@@ -129,7 +144,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: jackett
+        homepage.container: mediacenter_jackett
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://jackett.sectorq.eu
@@ -146,15 +161,16 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   jellyfin:
     environment:
-      PUID: '1000'
-      PGID: '1000'
       TZ: Europe/Bratislava
       JELLYFIN_PublishedServerUrl: https://jf.sectorq.eu
+      VAAPI_DEVICE: /dev/dri/renderD128
+      LIBVA_DRIVER_NAME: radeonsi
     hostname: jellyfin
     image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/jellyfin:latest
-    network_mode: host
+
     ports:
     - target: 8096
       published: 8096
@@ -168,19 +184,23 @@ services:
       published: 7359
       protocol: tcp
       mode: ingress
+    user: root
     volumes:
     - jellyfin_config:/config
-    - /media/m-server/movies:/data/movies/m-server
+    - m-server_movies:/data/movies/m-server
-    - /media/m-server/music:/data/music/m-server
+    - m-server_music:/data/music/m-server
     - /media/m-server/shows:/data/shows/m-server
     - /media/nas/movies:/data/movies/nas
     - /media/nas/music:/data/music/nas
     - /media/nas/shows:/data/shows/nas
     - /media/nas/xxx:/data/xxx/nas
+    - /dev/dri:/dev/dri
+    devices:
+      - /dev/dri/renderD128:/dev/dri/renderD128
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: jellyfin
+        homepage.container: mediacenter_jellyfin
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://jf.sectorq.eu
@@ -197,6 +217,8 @@ services:
       placement:
         constraints:
         - node.role == manager
+        - node.labels.gpu == amd
+
   jellyseerr:
     environment:
       LOG_LEVEL: debug
@@ -215,7 +237,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enabl: 'true'
-        homepage.container: jellyseerr
+        homepage.container: mediacenter_jellyseerr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://js.sectorq.eu
@@ -232,6 +254,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   lidarr:
     environment:
       PUID: '1000'
@@ -253,7 +276,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: lidarr
+        homepage.container: mediacenter_lidarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://lidarr.sectorq.eu
@@ -270,6 +293,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   qbittorrent:
     environment:
       PUID: '1000'
@@ -296,7 +320,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: qbittorrent
+        homepage.container: mediacenter_qbittorrent
         homepage.description: Subtitles
         homepage.group: Utilities
         homepage.href: https://qbit.sectorq.eu
@@ -304,7 +328,7 @@ services:
         homepage.name: Qbittorrent
         homepage.server: my-docker-swarm
         homepage.weight: '95'
-        homepage.widget.enableLeechProgress: 'true'
+        homepage.widget.enableLeechProgress: 'false'
         homepage.widget.password: ${QBIT_TOKEN}
         homepage.widget.type: qbittorrent
         homepage.widget.url: https://qbit.sectorq.eu
@@ -315,6 +339,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   radarr:
     dns:
     - 192.168.77.101
@@ -339,7 +364,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: radarr
+        homepage.container: mediacenter_radarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://radarr.sectorq.eu
@@ -357,6 +382,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   sonarr:
     dns:
     - 192.168.77.101
@@ -381,7 +407,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: sonarr
+        homepage.container: mediacenter_sonarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://sonarr.sectorq.eu

__swarm/pihole/pihole-swarm.yml

@@ -1,5 +1,5 @@
 volumes:
-  data::
+  data:
     driver: local
   dnsmasq_d:
     driver: local
@@ -43,6 +43,10 @@ services:
     volumes:
     - data:/etc/pihole
     - dnsmasq_d:/etc/dnsmasq.d
+    - type: tmpfs
+      target: /dev/shm
+      tmpfs:
+        size: 248000000
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'

__swarm/wud/stack.env

@@ -65,6 +65,15 @@ WUD_WATCHER_MSERVER_CRON=0 * * * *
 WUD_WATCHER_MSERVER_WATCHALL=true
 WUD_WATCHER_MSERVER_WATCHBYDEFAULT=false
 
+WUD_WATCHER_MS_HOST=192.168.77.101
+WUD_WATCHER_MS_PORT=2376
+WUD_WATCHER_MS_CERTFILE=/certs/m-server/cert.pem
+WUD_WATCHER_MS_CAFILE=/certs/m-server/ca.pem
+WUD_WATCHER_MS_KEYFILE=/certs/m-server/key.pem
+WUD_WATCHER_MS_CRON=0 * * * *
+WUD_WATCHER_MS_WATCHALL=true
+WUD_WATCHER_MS_WATCHBYDEFAULT=true
+
 # WUD_WATCHER_RPI5_HOST=192.168.77.238
 # WUD_WATCHER_RPI5_PORT=2376
 # WUD_WATCHER_RPI5_CERTFILE=/certs/rpi5/cert.pem

__swarm/zabbix-server/.env

@@ -1,2 +1,3 @@
 APPNAME=zabbix
 #RESTART=always
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/zabbix-server/Dockerfile

@@ -0,0 +1,5 @@
+FROM zabbix/zabbix-server-pgsql:alpine-latest
+
+USER root
+RUN apk add --no-cache curl
+USER zabbix

__swarm/zabbix-server/docker-compose.yml

@@ -48,7 +48,11 @@ services:
     extends:
       file: logging.yml
       service: ${LOGGING:-syslog}
-    image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    #image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: zabbix-server-custom:latest
     volumes:
       - /share/docker_data/zabbix-server/server/alertscripts:/usr/lib/zabbix/alertscripts
     labels:

__swarm/zabbix-server/stack.env

@@ -1,6 +1,6 @@
 # Zabbix global
 # ZBX_DEBUGLEVEL=3
-
+DOCKER_REGISTRY=r.sectorq.eu/library/
 # Database
 MYSQL_PASSWORD=zabbix
 MYSQL_USER=zabbix

__swarm/zabbix-server/zabbix-server-swarm.yml

@@ -58,7 +58,7 @@ services:
     env_file:
     - stack.env
     #image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
-    image: r.sectorq.eu/library/jaydee/zabbix-server:latest
+    image: r.sectorq.eu/jaydee/zabbix-server-pgsql:latest
     volumes:
     - alertscripts:/usr/lib/zabbix/alertscripts
     networks:
@@ -72,7 +72,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: zabbix-server-zabbix-server-1
+        homepage.container: zabbix-server_zabbix-server
         homepage.description: Monitoring server
         homepage.group: Utilities
         homepage.href: https://${APPNAME}.sectorq.eu
@@ -99,7 +99,6 @@ services:
       published: 7900
       protocol: tcp
       mode: ingress
-    shm_size: 2g
     image: ${DOCKER_REGISTRY:-}docker.io/selenium/standalone-chrome:latest
     deploy:
       labels:
@@ -109,24 +108,24 @@ services:
       placement:
         constraints:
         - node.role == manager
-  postinstall:
+  # postinstall:
-    image: debian:12-slim
+  #   image: debian:12-slim
-    environment:
+  #   environment:
-      PUID: '0'
+  #     PUID: '0'
-      PGID: '0'
+  #     PGID: '0'
-    volumes:
+  #   volumes:
-    - /usr/bin:/usr/bin
+  #   - /usr/bin:/usr/bin
-    - /usr/lib:/usr/lib
+  #   - /usr/lib:/usr/lib
-    - /var/run/docker.sock:/var/run/docker.sock
+  #   - /var/run/docker.sock:/var/run/docker.sock
-    - scripts:/scripts
+  #   - scripts:/scripts
-    entrypoint:
+  #   entrypoint:
-    - /bin/sh
+  #   - /bin/sh
-    - /scripts/install-curl.sh
+  #   - /scripts/install-curl.sh
-    deploy:
+  #   deploy:
-      replicas: 1
+  #     replicas: 1
-      placement:
+  #     placement:
-        constraints:
+  #       constraints:
-        - node.role == manager
+  #       - node.role == manager
 volumes:
   db:
   certs:

pihole/docker-compose.yml

@@ -33,6 +33,17 @@ services:
       TZ: Europe/Bratislava
     hostname: m-server
     image: pihole/pihole:latest
+    shm_size: '256mb'
+    logging:
+      driver: loki
+      options:
+        loki-url: http://192.168.77.101:3100/loki/api/v1/push
+        loki-relabel-config: |
+          - action: labelmap
+            regex: swarm_stack
+            replacement: namespace
+          - action: labelmap
+            regex: swarm_(service)
     labels:
       com.centurylinklabs.watchtower.enable: 'true'
       homepage.container: pihole
@@ -53,10 +64,15 @@ services:
       pihole:
         ipv4_address: 192.168.78.254
     ports:
-    - '53:53'
+    - '53:53/udp'
     - '9380:80'
     - '9343:443'  
     restart: always
     volumes:
-    - /share/docker_data/pihole/etc-pihole:/etc/pihole
+    - data:/etc/pihole
-    - /share/docker_data/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
+    - dnsmasq_d:/etc/dnsmasq.d
+volumes:
+  data:
+    driver: local
+  dnsmasq_d:
+    driver: local