build

__swarm/authentik/stack.env

@@ -3,7 +3,7 @@ PG_USER=authentik
 PG_DB=authentik
 AUTHENTIK_SECRET_KEY=ZKkVCxj8kKj5ZklvzxKG2IgYQOftDoLPRjc57yomr1qzbKEQVZ
 AUTHENTIK_ERROR_REPORTING__ENABLED=true
-AUTHENTIK_TAG=2025.8.4
+AUTHENTIK_TAG=2025.10.2
 POSTGRES_PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
 POSTGRES_USER=authentik
 POSTGRES_DB=authentik

__swarm/gitlab/gitlab-swarm.yml

@@ -9,6 +9,9 @@
       labels:
         - wud.watch.digest=true
         - wud.watch=true
+      dns:
+        - 192.168.77.1
+        - 192.168.77.101
     app:
       environment:
         GITLAB_OMNIBUS_CONFIG: |

__swarm/hashicorp/hashicorp-swarm.yml

@@ -0,0 +1,47 @@
+services:
+  vault:
+    image: hashicorp/vault:latest
+    command: server -config=/vault/config/vault.hcl
+    volumes:
+      - data:/vault/data
+    configs:
+      - source: vault_hcl
+        target: /vault/config/vault.hcl
+    ports:
+      - "8200:8200"
+    environment:
+      VAULT_LOCAL_CONFIG: |
+        {
+          "backend": {
+            "file": {
+              "path": "/vault/file"
+            }
+          },
+          "listener": {
+            "tcp": {
+              "address": "0.0.0.0:8200",
+              "tls_disable": 1
+            }
+          },
+          "disable_mlock": true
+        }
+      VAULT_API_ADDR: "http://192.168.77.101:8200"
+    cap_add:
+      - IPC_LOCK
+    networks:
+      - vault-net
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+
+configs:
+  vault_hcl:
+    external: true
+volumes:
+  data:
+networks:
+  vault-net:
+    driver: overlay

__swarm/home-assistant/home-assistant-swarm.yml

@@ -1,11 +1,16 @@
+
+
 services:
   homeassistant:
-    network_mode: host
     image: ${DOCKER_REGISTRY:-}ghcr.io/home-assistant/home-assistant:latest
     volumes:
     - ha_config:/config
     - /var/run/docker.sock:/var/run/docker.sock
     - /run/dbus:/run/dbus:ro
+    networks:
+      - swarm-ipvlan 
+      - traefik-public
+      - homeassistant-internal
     privileged: true
     environment:
       DISABLE_JEMALLOC: value

__swarm/homepage/homepage-swarm.yml

@@ -1,6 +1,7 @@
 services:
   homepage:
     dns:
+    - 192.168.77.1
     - 192.168.77.101
     environment:
       HOMEPAGE_ALLOWED_HOSTS: sectorq.eu,active.home.lan:3003,m-server.home.lan:3003,rpi5.home.lan:3003,nas.home.lan:3003,192.168.77.238:3003,rack.home.lan:3003,192.168.80.222:3003

__swarm/mediacenter/mediacenter-swarm.yml

@@ -16,7 +16,12 @@ volumes:
   radarr_config:
   sonarr_config:
   bazarr_config:
-
+  m-server_music:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=192.168.77.101,rw,nfsvers=4.1
+      device: :/music
 services:
   bazarr:
     environment:
@@ -27,6 +32,8 @@ services:
     image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/bazarr:latest
     networks:
     - mediarr
+    dns:
+      - 192.168.77.101
     ports:
     - target: 6767
       published: 6767
@@ -58,6 +65,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   flaresolverr:
     environment:
       LOG_LEVEL: info
@@ -80,6 +88,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   homarr:
     hostname: homarr
     image: ${DOCKER_REGISTRY:-}ghcr.io/ajnart/homarr:latest
@@ -104,6 +113,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   jackett:
     dns:
     - 192.168.77.101
@@ -145,12 +155,13 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   jellyfin:
     environment:
-      PUID: '1000'
-      PGID: '1000'
       TZ: Europe/Bratislava
       JELLYFIN_PublishedServerUrl: https://jf.sectorq.eu
+      VAAPI_DEVICE: /dev/dri/renderD128
+      LIBVA_DRIVER_NAME: radeonsi
     hostname: jellyfin
     image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/jellyfin:latest
 
@@ -167,15 +178,19 @@ services:
       published: 7359
       protocol: tcp
       mode: ingress
+    user: root
     volumes:
     - jellyfin_config:/config
     - /media/m-server/movies:/data/movies/m-server
-    - /media/m-server/music:/data/music/m-server
+    - m-server_music:/data/music/m-server
     - /media/m-server/shows:/data/shows/m-server
     - /media/nas/movies:/data/movies/nas
     - /media/nas/music:/data/music/nas
     - /media/nas/shows:/data/shows/nas
     - /media/nas/xxx:/data/xxx/nas
+    - /dev/dri:/dev/dri
+    devices:
+      - /dev/dri/renderD128:/dev/dri/renderD128
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
@@ -196,15 +211,8 @@ services:
       placement:
         constraints:
         - node.role == manager
-      resources:
-        reservations:
-          devices:
-            - driver: "runc"
-              capabilities: ["gpu"]
-              device_ids: ["/dev/dri/renderD128"]
-            - driver: "runc"
-              capabilities: ["gpu"]
-              device_ids: ["/dev/dri/card1"]
+        - node.labels.gpu == amd
+
   jellyseerr:
     environment:
       LOG_LEVEL: debug
@@ -240,6 +248,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   lidarr:
     environment:
       PUID: '1000'
@@ -278,6 +287,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   qbittorrent:
     environment:
       PUID: '1000'
@@ -312,7 +322,7 @@ services:
         homepage.name: Qbittorrent
         homepage.server: my-docker-swarm
         homepage.weight: '95'
-        homepage.widget.enableLeechProgress: 'true'
+        homepage.widget.enableLeechProgress: 'false'
         homepage.widget.password: ${QBIT_TOKEN}
         homepage.widget.type: qbittorrent
         homepage.widget.url: https://qbit.sectorq.eu
@@ -323,6 +333,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   radarr:
     dns:
     - 192.168.77.101
@@ -365,6 +376,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   sonarr:
     dns:
     - 192.168.77.101

__swarm/pihole/pihole-swarm.yml

@@ -1,5 +1,5 @@
 volumes:
-  data::
+  data:
     driver: local
   dnsmasq_d:
     driver: local
@@ -43,6 +43,10 @@ services:
     volumes:
     - data:/etc/pihole
     - dnsmasq_d:/etc/dnsmasq.d
+    - type: tmpfs
+      target: /dev/shm
+      tmpfs:
+        size: 248000000
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'

__swarm/wud/stack.env

@@ -65,6 +65,15 @@ WUD_WATCHER_MSERVER_CRON=0 * * * *
 WUD_WATCHER_MSERVER_WATCHALL=true
 WUD_WATCHER_MSERVER_WATCHBYDEFAULT=false
 
+WUD_WATCHER_MS_HOST=192.168.77.101
+WUD_WATCHER_MS_PORT=2376
+WUD_WATCHER_MS_CERTFILE=/certs/m-server/cert.pem
+WUD_WATCHER_MS_CAFILE=/certs/m-server/ca.pem
+WUD_WATCHER_MS_KEYFILE=/certs/m-server/key.pem
+WUD_WATCHER_MS_CRON=0 * * * *
+WUD_WATCHER_MS_WATCHALL=true
+WUD_WATCHER_MS_WATCHBYDEFAULT=true
+
 # WUD_WATCHER_RPI5_HOST=192.168.77.238
 # WUD_WATCHER_RPI5_PORT=2376
 # WUD_WATCHER_RPI5_CERTFILE=/certs/rpi5/cert.pem

__swarm/zabbix-server/zabbix-server-swarm.yml

@@ -58,7 +58,7 @@ services:
     env_file:
     - stack.env
     #image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
-    image: r.sectorq.eu/library/jaydee/zabbix-server:latest
+    image: r.sectorq.eu/jaydee/zabbix-server-pgsql:latest
     volumes:
     - alertscripts:/usr/lib/zabbix/alertscripts
     networks:
@@ -72,7 +72,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: zabbix-server-zabbix-server-1
+        homepage.container: zabbix-server_zabbix-server
         homepage.description: Monitoring server
         homepage.group: Utilities
         homepage.href: https://${APPNAME}.sectorq.eu
@@ -108,24 +108,24 @@ services:
       placement:
         constraints:
         - node.role == manager
-  postinstall:
-    image: debian:12-slim
-    environment:
-      PUID: '0'
-      PGID: '0'
-    volumes:
-    - /usr/bin:/usr/bin
-    - /usr/lib:/usr/lib
-    - /var/run/docker.sock:/var/run/docker.sock
-    - scripts:/scripts
-    entrypoint:
-    - /bin/sh
-    - /scripts/install-curl.sh
-    deploy:
-      replicas: 1
-      placement:
-        constraints:
-        - node.role == manager
+  # postinstall:
+  #   image: debian:12-slim
+  #   environment:
+  #     PUID: '0'
+  #     PGID: '0'
+  #   volumes:
+  #   - /usr/bin:/usr/bin
+  #   - /usr/lib:/usr/lib
+  #   - /var/run/docker.sock:/var/run/docker.sock
+  #   - scripts:/scripts
+  #   entrypoint:
+  #   - /bin/sh
+  #   - /scripts/install-curl.sh
+  #   deploy:
+  #     replicas: 1
+  #     placement:
+  #       constraints:
+  #       - node.role == manager
 volumes:
   db:
   certs:

pihole/docker-compose.yml

@@ -33,6 +33,17 @@ services:
       TZ: Europe/Bratislava
     hostname: m-server
     image: pihole/pihole:latest
+    shm_size: '256mb'
+    logging:
+      driver: loki
+      options:
+        loki-url: http://192.168.77.101:3100/loki/api/v1/push
+        loki-relabel-config: |
+          - action: labelmap
+            regex: swarm_stack
+            replacement: namespace
+          - action: labelmap
+            regex: swarm_(service)
     labels:
       com.centurylinklabs.watchtower.enable: 'true'
       homepage.container: pihole
@@ -53,10 +64,15 @@ services:
       pihole:
         ipv4_address: 192.168.78.254
     ports:
-    - '53:53'
+    - '53:53/udp'
     - '9380:80'
     - '9343:443'  
     restart: always
     volumes:
-    - /share/docker_data/pihole/etc-pihole:/etc/pihole
-    - /share/docker_data/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
+    - data:/etc/pihole
+    - dnsmasq_d:/etc/dnsmasq.d
+volumes:
+  data:
+    driver: local
+  dnsmasq_d:
+    driver: local