build

__swarm/authentik/stack.env

@@ -3,7 +3,7 @@ PG_USER=authentik
 PG_DB=authentik
 AUTHENTIK_SECRET_KEY=ZKkVCxj8kKj5ZklvzxKG2IgYQOftDoLPRjc57yomr1qzbKEQVZ
 AUTHENTIK_ERROR_REPORTING__ENABLED=true
-AUTHENTIK_TAG=2025.8.4
+AUTHENTIK_TAG=2025.10.2
 POSTGRES_PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
 POSTGRES_USER=authentik
 POSTGRES_DB=authentik

__swarm/gitea/gitea-swarm.yml

@@ -35,7 +35,7 @@ services:
         homepage.name: Gitea
         homepage.server: my-docker-swarm
         homepage.weight: '1'
-        homepage.widget.key: ${TOKEN}
+        homepage.widget.key: "b7b6e21beb7489c170215e2b7ae0d9b0099132d6"
         homepage.widget.type: ${APPNAME}
         homepage.widget.url: https://${APPNAME}.sectorq.eu
         homepage.widget.version: '2'
@@ -56,6 +56,7 @@ services:
       GITEA_RUNNER_NAME: jaydee
       GITEA_RUNNER_LABELS: jaydee
     volumes:
+    
     - runner_config:/config
     - runner_data:/data
     - /var/run/docker.sock:/var/run/docker.sock

__swarm/gitlab/docker-compose.yml

@@ -1,5 +1,16 @@
 services:
+  runner:
+    container_name: gitlab-runner
+    restart: always
+    volumes:
+      - runner:/etc/gitlab-runner
+      - /var/run/docker.sock:/var/run/docker.sock
+    image: ${DOCKER_REGISTRY:-}gitlab/gitlab-runner:latest
+    labels:
+      - wud.watch.digest=true
+      - wud.watch=true
   web:
+  
     container_name: gitlab
     environment:
       GITLAB_OMNIBUS_CONFIG: "external_url 'https://gitlab.sectorq.eu'\nnginx['listen_port']\
@@ -47,8 +58,13 @@ services:
     restart: unless-stopped
     shm_size: 4gb
     volumes:
-    - /share/docker_data/gitlab/config:/etc/gitlab
+    - config:/etc/gitlab
-    - /share/docker_data/gitlab/logs:/var/log/gitlab
+    - logs:/var/log/gitlab
-    - /share/docker_data/gitlab/data:/var/opt/gitlab
+    - data:/var/opt/gitlab
     - /etc/localtime:/etc/localtime:ro
 version: '3.6'
+volumes:
+  runner:
+  config:
+  logs:
+  data:

__swarm/gitlab/gitlab-swarm.yml

@@ -1,73 +1,101 @@
-services:
+  services:
-  web:
+    runner:
-    environment:
+      container_name: gitlab-runner
-      GITLAB_OMNIBUS_CONFIG: "external_url 'https://gitlab.sectorq.eu'\nnginx['listen_port']\
+      restart: always
-        \ = 80\nnginx['listen_https'] = false\nweb_server['username'] = 'git'\ngitlab_rails['time_zone']\
+      volumes:
-        \ = 'Europe/Bratislava'\ngitlab_rails['omniauth_enabled'] = true\ngitlab_rails['omniauth_allow_single_sign_on']\
+        - runner:/etc/gitlab-runner
-        \ = ['saml']\ngitlab_rails['omniauth_sync_email_from_provider'] = 'saml'\n\
+        - /var/run/docker.sock:/var/run/docker.sock
-        gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']\ngitlab_rails['omniauth_sync_profile_attributes']\
+      image: ${DOCKER_REGISTRY:-}gitlab/gitlab-runner:latest
-        \ = ['email']\ngitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'\n\
-        gitlab_rails['omniauth_block_auto_created_users'] = false\ngitlab_rails['omniauth_auto_link_saml_user']\
-        \ = true\ngitlab_rails['omniauth_providers'] = [\n  {\n    name: 'saml',\n\
-        \    args: {\n      assertion_consumer_service_url: 'https://gitlab.sectorq.eu/users/auth/saml/callback',\n\
-        \      # Shown when navigating to certificates in authentik1\n      idp_cert_fingerprint:\
-        \ 'f7:fd:49:03:b3:38:52:b3:23:f5:43:c4:8d:08:65:32:e0:5a:7b:0e',\n      idp_sso_target_url:\
-        \ 'https://auth.sectorq.eu/application/saml/gitlab/sso/binding/redirect/',\n\
-        \      issuer: 'https://gitlab.sectorq.eu',\n      name_identifier_format:\
-        \ 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n      attribute_statements:\
-        \ {\n        email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],\n\
-        \        first_name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],\n\
-        \        nickname: ['http://schemas.goauthentik.io/2021/02/saml/username']\n\
-        \      }\n    },\n    label: 'authentik'\n  }\n]\n"
-      TZ: Europe/Bratislava
-    hostname: gitlab.sectorq.eu
-    image: ${DOCKER_REGISTRY:-}gitlab/gitlab-ce:latest
-    network_mode: bridge
-    ports:
-    - target: 80
-      published: 8785
-      protocol: tcp
-      mode: ingress
-    - target: 443
-      published: 8743
-      protocol: tcp
-      mode: ingress
-    - target: 22
-      published: 8722
-      protocol: tcp
-      mode: ingress
-    shm_size: 4gb
-    volumes:
-    - config:/etc/gitlab
-    - logs:/var/log/gitlab
-    - data:/var/opt/gitlab
-    - /etc/localtime:/etc/localtime:ro
-    deploy:
       labels:
-        com.centurylinklabs.watchtower.enable: 'true'
+        - wud.watch.digest=true
-        homepage.container: gitlab
+        - wud.watch=true
-        homepage.description: Version control
+      dns:
-        homepage.group: Infrastructure
+        - 192.168.77.1
-        homepage.href: https://gitlab.sectorq.eu
+        - 192.168.77.101
-        homepage.icon: gitlab.png
+    app:
-        homepage.name: Gitlab
+      environment:
-        homepage.server: my-docker-swarm
+        GITLAB_OMNIBUS_CONFIG: |
-        homepage.weight: '1'
+          external_url 'https://gitlab.sectorq.eu'
-        homepage.widget.key: glpat-BuMKcaDqeD-Wx3dW4TM9
+          nginx['listen_port'] = 80
-        homepage.widget.type: gitlab
+          nginx['listen_https'] = false
-        homepage.widget.url: https://gitlab.sectorq.eu
+          web_server['username'] = 'git'
-        homepage.widget.user_id: '2'
+          gitlab_rails['time_zone'] = 'Europe/Bratislava'
-        wud.watch: 'true'
+          gitlab_rails['omniauth_enabled'] = true
-        wud.watch.digest: 'true'
+          gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
-      replicas: 1
+          gitlab_rails['omniauth_sync_email_from_provider'] = 'saml'
-      placement:
+          gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']
-        constraints:
+          gitlab_rails['omniauth_sync_profile_attributes'] = ['email']
-        - node.role == manager
+          gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'
+          gitlab_rails['omniauth_block_auto_created_users'] = false
+          gitlab_rails['omniauth_auto_link_saml_user'] = true
+          gitlab_rails['omniauth_providers'] = [
+            {
+              name: 'saml',
+              args: {
+                assertion_consumer_service_url: 'https://gitlab.sectorq.eu/users/auth/saml/callback',
+                # Shown when navigating to certificates in authentik1
+                idp_cert_fingerprint: 'f7:fd:49:03:b3:38:52:b3:23:f5:43:c4:8d:08:65:32:e0:5a:7b:0e',
+                idp_sso_target_url: 'https://auth.sectorq.eu/application/saml/gitlab/sso/binding/redirect/',
+                issuer: 'https://gitlab.sectorq.eu',
+                name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
+                attribute_statements: {
+                  email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],
+                  first_name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],
+                  nickname: ['http://schemas.goauthentik.io/2021/02/saml/username']
+                }
+              },
+              label: 'authentik'
+            }
+          ]
+        TZ: Europe/Bratislava
+      hostname: gitlab.sectorq.eu
+      image: ${DOCKER_REGISTRY:-}gitlab/gitlab-ce:latest
+      network_mode: bridge
+      ports:
+      - target: 80
+        published: 8785
+        protocol: tcp
+        mode: ingress
+      - target: 443
+        published: 8743
+        protocol: tcp
+        mode: ingress
+      - target: 22
+        published: 8722
+        protocol: tcp
+        mode: ingress
+      shm_size: 4gb
+      volumes:
+      - config:/etc/gitlab
+      - logs:/var/log/gitlab
+      - data:/var/opt/gitlab
+      - /etc/localtime:/etc/localtime:ro
+      deploy:
+        labels:
+          com.centurylinklabs.watchtower.enable: 'true'
+          homepage.container: gitlab
+          homepage.description: Version control
+          homepage.group: Infrastructure
+          homepage.href: https://gitlab.sectorq.eu
+          homepage.icon: gitlab.png
+          homepage.name: Gitlab
+          homepage.server: my-docker-swarm
+          homepage.weight: '1'
+          homepage.widget.key: glpat-BuMKcaDqeD-Wx3dW4TM9
+          homepage.widget.type: gitlab
+          homepage.widget.url: https://gitlab.sectorq.eu
+          homepage.widget.user_id: '2'
+          wud.watch: 'true'
+          wud.watch.digest: 'true'
+        replicas: 1
+        placement:
+          constraints:
+          - node.role == manager
 
-volumes:
+  volumes:
-  config:
+    config:
-    driver: local
+      driver: local
-  logs:
+    logs:
-    driver: local
+      driver: local
-  data:
+    data:
-    driver: local 
+      driver: local

__swarm/hashicorp/hashicorp-swarm.yml

@@ -0,0 +1,47 @@
+services:
+  vault:
+    image: hashicorp/vault:latest
+    command: server -config=/vault/config/vault.hcl
+    volumes:
+      - data:/vault/data
+    configs:
+      - source: vault_hcl
+        target: /vault/config/vault.hcl
+    ports:
+      - "8200:8200"
+    environment:
+      VAULT_LOCAL_CONFIG: |
+        {
+          "backend": {
+            "file": {
+              "path": "/vault/file"
+            }
+          },
+          "listener": {
+            "tcp": {
+              "address": "0.0.0.0:8200",
+              "tls_disable": 1
+            }
+          },
+          "disable_mlock": true
+        }
+      VAULT_API_ADDR: "http://192.168.77.101:8200"
+    cap_add:
+      - IPC_LOCK
+    networks:
+      - vault-net
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+
+configs:
+  vault_hcl:
+    external: true
+volumes:
+  data:
+networks:
+  vault-net:
+    driver: overlay

__swarm/home-assistant/home-assistant-swarm.yml

@@ -1,11 +1,16 @@
+
+
 services:
   homeassistant:
-    network_mode: host
     image: ${DOCKER_REGISTRY:-}ghcr.io/home-assistant/home-assistant:latest
     volumes:
     - ha_config:/config
     - /var/run/docker.sock:/var/run/docker.sock
     - /run/dbus:/run/dbus:ro
+    networks:
+      - swarm-ipvlan 
+      - traefik-public
+      - homeassistant-internal
     privileged: true
     environment:
       DISABLE_JEMALLOC: value

__swarm/homepage/homepage-swarm.yml

@@ -1,16 +1,12 @@
-networks:
-  pihole_pihole:
-    external: true
 services:
   homepage:
     dns:
-    - 192.168.78.254
+    - 192.168.77.1
+    - 192.168.77.101
     environment:
       HOMEPAGE_ALLOWED_HOSTS: sectorq.eu,active.home.lan:3003,m-server.home.lan:3003,rpi5.home.lan:3003,nas.home.lan:3003,192.168.77.238:3003,rack.home.lan:3003,192.168.80.222:3003
       TZ: Europe/Bratislava
     image: ${DOCKER_REGISTRY:-}ghcr.io/gethomepage/homepage:latest
-    networks:
-    - pihole_pihole
     ports:
     - target: 3000
       published: 3003

__swarm/immich/.env

@@ -21,4 +21,6 @@ DB_PASSWORD=postgres
 DB_USERNAME=postgres
 DB_DATABASE_NAME=immich
 HW_MODE1=vaapi
-HW_MODE2=openvino
+HW_MODE2=openvino
+APPNAME=immich
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/immich/immich-swarm.yml

@@ -1,5 +1,5 @@
 services:
-  immich-server:
+  server:
     image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
     # devices:
     #   - /dev/dri:/dev/dri
@@ -38,7 +38,7 @@ services:
       placement:
         constraints:
         - node.role == manager
-  immich-machine-learning:
+  machine-learning:
     image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
     # device_cgroup_rules:
     #   - 'c 189:* rmw'

__swarm/immich/stack.env

@@ -20,4 +20,6 @@ DB_PASSWORD=postgres
 ###################################################################################
 DB_USERNAME=postgres
 DB_DATABASE_NAME=immich
-POSTGRES_PASSWORD=postgres
+POSTGRES_PASSWORD=postgres
+APPNAME=immich
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/influxdb/influxdb-swarm.yml

@@ -29,9 +29,6 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-      placement:
-        constraints:
-        - node.role == manager
 secrets:
   influxdb2-admin-token:
     external: true

__swarm/jupyter/jupyter-swarm.yml

@@ -10,7 +10,7 @@ services:
     image: ${DOCKER_REGISTRY:-}jupyter/base-notebook:latest
     deploy:
       labels:
-        homepage.container: jupyter-base-notebook-1
+        homepage.container: jupyter_base-notebook
         homepage.description: Python server
         homepage.group: Utils
         homepage.href: http://m-server.home.lan:8888/

__swarm/kestra/kestra-swarm.yml

@@ -4,15 +4,37 @@ services:
     environment:
       SECRET_MYPASSWORD: bDRjMWo0eWQzM0R1NWxv
       SECRET_GITLAB: Z2xwYXQtdWotbi1lRWZUWTM5OFBFNHZLU1M=
-      KESTRA_CONFIGURATION: "datasources:\n  postgres:\n    url: jdbc:postgresql://postgres:5432/kestra\n\
+      KESTRA_CONFIGURATION: |
-        \    driverClassName: org.postgresql.Driver\n    username: kestra\n    password:\
+        datasources:
-        \ k3str4\nkestra:\n  server:\n    basicAuth:\n      enabled: false\n     \
+          postgres:
-        \ username: \"jaydee@sectorq.eu\" # it must be a valid email address\n   \
+            url: jdbc:postgresql://postgres:5432/kestra
-        \   password: ${PASSWORD}\n  repository:\n    type: postgres\n  storage:\n\
+            driverClassName: org.postgresql.Driver
-        \    type: local\n    local:\n      basePath: \"/app/storage\"\n  queue:\n\
+            username: kestra
-        \    type: postgres\n  tasks:\n    tmpDir:\n      path: /tmp/kestra-wd/tmp\n\
+            password: k3str4
-        \  url: http://localhost:8080/\n  tutorial-flows:\n    enabled: false\nmicronaut:\n\
+        kestra:
-        \  server:\n    cors:\n      enabled: true\n"
+          server:
+            basicAuth:
+              enabled: false
+              username: "jaydee@sectorq.eu" # it must be a valid email address
+              password: ${PASSWORD}
+          repository:
+            type: postgres
+          storage:
+            type: local
+            local:
+              basePath: "/app/storage"
+          queue:
+            type: postgres
+          tasks:
+            tmpDir:
+              path: /tmp/kestra-wd/tmp
+          url: http://localhost:8080/
+          tutorial-flows:
+            enabled: false
+        micronaut:
+          server:
+            cors:
+              enabled: true
     image: ${DOCKER_REGISTRY:-}kestra/kestra:${KESTRA_VERSION:-latest}
     ports:
     - target: 8080
@@ -32,7 +54,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: kestra-kestra-1
+        homepage.container: kestra_kestra
         homepage.description: Automation
         homepage.group: Infrastructure
         homepage.href: https://${APPNAME}.sectorq.eu

__swarm/mealie/mealie-swarm.yml

@@ -1,5 +1,5 @@
 services:
-  mealie:
+  app:
     image: ${DOCKER_REGISTRY}ghcr.io/mealie-recipes/mealie:v2.8.0
     ports:
     - target: 9000
@@ -11,7 +11,7 @@ services:
         limits:
           memory: 1000M
       labels:
-        homepage.container: mealie
+        homepage.container: mealie_app
         homepage.description: Recipe server
         homepage.group: Utils
         homepage.href: https://${APPNAME}.sectorq.eu

__swarm/mediacenter/mediacenter-swarm.yml

@@ -16,8 +16,18 @@ volumes:
   radarr_config:
   sonarr_config:
   bazarr_config:
-  flaresolverr_config:
+  m-server_music:
-
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=192.168.77.101,rw,nfsvers=4.2,nolock
+      device: :/music
+  m-server_movies:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=192.168.77.101,rw,nfsvers=4.2,nolock
+      device: :/movies
 services:
   bazarr:
     environment:
@@ -28,6 +38,8 @@ services:
     image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/bazarr:latest
     networks:
     - mediarr
+    dns:
+      - 192.168.77.101
     ports:
     - target: 6767
       published: 6767
@@ -42,7 +54,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: bazarr
+        homepage.container: mediacenter_bazarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://bazarr.sectorq.eu
@@ -59,6 +71,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   flaresolverr:
     environment:
       LOG_LEVEL: info
@@ -81,6 +94,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   homarr:
     hostname: homarr
     image: ${DOCKER_REGISTRY:-}ghcr.io/ajnart/homarr:latest
@@ -105,6 +119,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   jackett:
     dns:
     - 192.168.77.101
@@ -129,7 +144,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: jackett
+        homepage.container: mediacenter_jackett
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://jackett.sectorq.eu
@@ -146,15 +161,16 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   jellyfin:
     environment:
-      PUID: '1000'
-      PGID: '1000'
       TZ: Europe/Bratislava
       JELLYFIN_PublishedServerUrl: https://jf.sectorq.eu
+      VAAPI_DEVICE: /dev/dri/renderD128
+      LIBVA_DRIVER_NAME: radeonsi
     hostname: jellyfin
     image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/jellyfin:latest
-    network_mode: host
+
     ports:
     - target: 8096
       published: 8096
@@ -168,19 +184,23 @@ services:
       published: 7359
       protocol: tcp
       mode: ingress
+    user: root
     volumes:
     - jellyfin_config:/config
-    - /media/m-server/movies:/data/movies/m-server
+    - m-server_movies:/data/movies/m-server
-    - /media/m-server/music:/data/music/m-server
+    - m-server_music:/data/music/m-server
     - /media/m-server/shows:/data/shows/m-server
     - /media/nas/movies:/data/movies/nas
     - /media/nas/music:/data/music/nas
     - /media/nas/shows:/data/shows/nas
     - /media/nas/xxx:/data/xxx/nas
+    - /dev/dri:/dev/dri
+    devices:
+      - /dev/dri/renderD128:/dev/dri/renderD128
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: jellyfin
+        homepage.container: mediacenter_jellyfin
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://jf.sectorq.eu
@@ -197,6 +217,8 @@ services:
       placement:
         constraints:
         - node.role == manager
+        - node.labels.gpu == amd
+
   jellyseerr:
     environment:
       LOG_LEVEL: debug
@@ -215,7 +237,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enabl: 'true'
-        homepage.container: jellyseerr
+        homepage.container: mediacenter_jellyseerr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://js.sectorq.eu
@@ -232,6 +254,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   lidarr:
     environment:
       PUID: '1000'
@@ -253,7 +276,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: lidarr
+        homepage.container: mediacenter_lidarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://lidarr.sectorq.eu
@@ -270,6 +293,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   qbittorrent:
     environment:
       PUID: '1000'
@@ -296,7 +320,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: qbittorrent
+        homepage.container: mediacenter_qbittorrent
         homepage.description: Subtitles
         homepage.group: Utilities
         homepage.href: https://qbit.sectorq.eu
@@ -304,7 +328,7 @@ services:
         homepage.name: Qbittorrent
         homepage.server: my-docker-swarm
         homepage.weight: '95'
-        homepage.widget.enableLeechProgress: 'true'
+        homepage.widget.enableLeechProgress: 'false'
         homepage.widget.password: ${QBIT_TOKEN}
         homepage.widget.type: qbittorrent
         homepage.widget.url: https://qbit.sectorq.eu
@@ -315,6 +339,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   radarr:
     dns:
     - 192.168.77.101
@@ -339,7 +364,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: radarr
+        homepage.container: mediacenter_radarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://radarr.sectorq.eu
@@ -357,6 +382,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+
   sonarr:
     dns:
     - 192.168.77.101
@@ -381,7 +407,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: sonarr
+        homepage.container: mediacenter_sonarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://sonarr.sectorq.eu

__swarm/mosquitto/mosquitto-swarm.yml

@@ -1,7 +1,11 @@
 services:
   mosquitto:
     image: ${DOCKER_REGISTRY:-}eclipse-mosquitto
-    network_mode: host
+    ports:
+    - target: 1883
+      published: 1883
+      protocol: tcp
+      mode: host
     volumes:
     - conf:/mosquitto/config
     - data:/mosquitto/data

__swarm/motioneye/motioneye-swarm.yml

@@ -1,5 +1,5 @@
 services:
-  motioneye:
+  app:
     dns:
     - 192.168.77.101
     environment:
@@ -16,12 +16,12 @@ services:
       mode: ingress
     volumes:
     - /etc/localtime:/etc/localtime:ro
-    - /share/docker_data/motioneye/etc_motioneye:/etc/motioneye
+    - config:/etc/motioneye
-    - /share/docker_data/motioneye/var_lib_motioneye:/var/lib/motioneye
+    - data:/var/lib/motioneye
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: motioneye
+        homepage.container: motioneye_app
         homepage.description: Video manager
         homepage.group: Media
         homepage.href: http://m-server.home.lan:8765/
@@ -35,3 +35,6 @@ services:
       placement:
         constraints:
         - node.role == manager
+volumes:
+  config:
+  data:

__swarm/n8n/n8n-swarm.yml

@@ -1,6 +1,6 @@
 version: '3'
 services:
-  n8n:
+  app:
     image: ${DOCKER_REGISTRY:-}n8nio/n8n:latest
     ports:
     - target: 5678
@@ -20,11 +20,11 @@ services:
       N8N_SECURE_COOKIE: 'false'
       WEBHOOK_URL: https://n8n.sectorq.eu
     volumes:
-    - n8n-data:/home/node/.n8n
+    - data:/home/node/.n8n
     stop_grace_period: 60s
     deploy:
       labels:
-        homepage.container: n8n
+        homepage.container: n8n_app
         homepage.description: Workflow management
         homepage.group: Utils
         homepage.href: https://${APPNAME}.sectorq.eu
@@ -38,5 +38,5 @@ services:
         constraints:
         - node.role == manager
 volumes:
-  n8n-data:
+  data:
     driver: local

__swarm/nebula/nebula-swarm.yml

@@ -0,0 +1,15 @@
+services:
+  nebula-sync:
+    image: ghcr.io/lovelaze/nebula-sync:latest
+    environment:
+      PRIMARY: http://192.168.77.101:9380|l4c1j4yd33Du5lo
+      REPLICAS: http://192.168.77.106:9380|l4c1j4yd33Du5lo
+      CLIENT_SKIP_TLS_VERIFICATION: 'true'
+      FULL_SYNC: 'true'
+      RUN_GRAVITY: 'true'
+      CRON: 0 * * * *
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager

__swarm/nextcloud/.env

@@ -1,2 +1,3 @@
 APPNAME=nextcloud
-#RESTART=always
+#RESTART=always
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/nextcloud/nextcloud-swarm.yml

@@ -1,23 +1,12 @@
-networks:
-  nextcloud_network:
-    ipam:
-      config:
-      - subnet: 192.168.80.0/28
-      driver: default
-  pihole_pihole:
-    external: true
 services:
   app:
     dns:
-    - 192.168.78.254
+    - 192.168.77.101
     env_file:
     - stack.env
     image: ${DOCKER_REGISTRY:-}nextcloud:latest
     links:
     - db
-    networks:
-    - nextcloud_network
-    - pihole_pihole
     ports:
     - target: 80
       published: 8134
@@ -35,7 +24,7 @@ services:
         com.centurylinklabs.watchtower.enable: 'true'
         com.centurylinklabs.watchtower.lifecycle.post-update: apt update;apt install
           -y smbclient;chown -R www-data:www-data /var/www/html
-        homepage.container: nextcloud-app-1
+        homepage.container: nextcloud_app
         homepage.description: Cloud server
         homepage.group: Infrastructure
         homepage.href: https://nc.sectorq.eu
@@ -58,8 +47,6 @@ services:
     env_file:
     - stack.env
     image: ${DOCKER_REGISTRY:-}yobasystems/alpine-mariadb:latest
-    networks:
-    - nextcloud_network
     volumes:
     - mariadb:/var/lib/mysql
     - /etc/localtime:/etc/localtime
@@ -74,8 +61,6 @@ services:
         - node.role == manager
   redis:
     image: ${DOCKER_REGISTRY:-}redis:alpine
-    networks:
-    - nextcloud_network
     volumes:
     - redis:/data
     deploy:
@@ -104,8 +89,6 @@ services:
       protocol: tcp
       mode: ingress
     image: ${DOCKER_REGISTRY:-}ghcr.io/nextcloud/nextcloud-appapi-harp:release
-    networks:
-    - nextcloud_network
     deploy:
       labels:
         wud.watch: 'true'

__swarm/node-red/node-red-swarm.yml

@@ -1,14 +1,10 @@
-networks:
-  node-red-net: null
 services:
-  node-red:
+  app:
     dns:
     - 192.168.77.101
     environment:
       TZ: Europe/Bratislava
     image: ${DOCKER_REGISTRY:-}nodered/node-red:latest
-    networks:
-    - node-red-net
     ports:
     - target: 1880
       published: 1880
@@ -21,7 +17,7 @@ services:
         com.centurylinklabs.watchtower.enable: 'true'
         wud.watch: 'true'
         wud.watch.digest: 'true'
-        homepage.container: node-red-node-red-1
+        homepage.container: node-red_app
         homepage.description: Node red
         homepage.group: Infrastructure
         homepage.href: http://active.home.lan:1880

__swarm/ollama/ollama-swarm.yml

@@ -1,11 +1,11 @@
 services:
-  ollama:
+  app:
     image: ${DOCKER_REGISTRY:-}ollama/ollama:rocm
     devices:
     - /dev/kfd
     - /dev/dri
     volumes:
-    - ollama_models:/root/.ollama
+    - models:/root/.ollama
     environment:
       HSA_OVERRIDE_GFX_VERSION: 11.0.0
     ports:
@@ -21,4 +21,4 @@ services:
         constraints:
         - node.role == manager
 volumes:
-  ollama_models:
+  models:

__swarm/onlyoffice/onlyoffice-swarm.yml

@@ -1,11 +1,11 @@
 services:
-  onlyoffice-documentserver:
+  server:
     build:
       context: .
     image: onlyoffice/documentserver
     environment:
       DB_TYPE: postgres
-      DB_HOST: onlyoffice-postgresql
+      DB_HOST: postgresql
       DB_PORT: '5432'
       DB_NAME: onlyoffice
       DB_USER: onlyoffice
@@ -42,10 +42,10 @@ services:
         com.centurylinklabs.watchtower.enable: 'true'
         wud.watch: 'true'
         wud.watch.digest: 'true'
-        homepage.container: onlyoffice-documentserver
+        homepage.container: onlyoffice_server
         homepage.description: OnlyOffice Document Server
         homepage.group: Infrastructure
-        homepage.href: http://active.home.lan:8280/example
+        homepage.href: http://active.home.lan:8280/example/
         homepage.icon: onlyoffice.png
         homepage.name: OnlyOffice Document Server
         homepage.server: my-docker-swarm
@@ -71,7 +71,7 @@ services:
       placement:
         constraints:
         - node.role == manager
-  onlyoffice-postgresql:
+  postgresql:
     image: postgres:15
     environment:
       POSTGRES_DB: onlyoffice
@@ -80,7 +80,7 @@ services:
     expose:
     - '5432'
     volumes:
-    - postgresql_data:/var/lib/postgresql
+    - db:/var/lib/postgresql
     healthcheck:
       test:
       - CMD-SHELL
@@ -95,7 +95,7 @@ services:
         constraints:
         - node.role == manager
 volumes:
-  postgresql_data:
+  db:
   data:
   logs:
   cache:

__swarm/pihole/pihole-swarm.yml

@@ -1,7 +1,7 @@
 volumes:
-  pihole_etc_pihole:
+  data:
     driver: local
-  pihole_etc_dnsmasq_d:
+  dnsmasq_d:
     driver: local
 
 networks:
@@ -12,7 +12,7 @@ networks:
       config:
         - subnet: 192.168.78.0/24
 services:
-  pihole:
+  app:
     cap_add:
     - NET_ADMIN
     - SYS_TIME
@@ -41,12 +41,16 @@ services:
       protocol: tcp
       mode: ingress
     volumes:
-    - pihole_etc_pihole:/etc/pihole
+    - data:/etc/pihole
-    - pihole_etc_dnsmasq_d:/etc/dnsmasq.d
+    - dnsmasq_d:/etc/dnsmasq.d
+    - type: tmpfs
+      target: /dev/shm
+      tmpfs:
+        size: 248000000
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: pihole
+        homepage.container: pihole_app
         homepage.description: Add blocker
         homepage.group: Infrastructure
         homepage.href: https://active.home.lan:9343/admin

__swarm/rancher/rancher-swarm.yml

@@ -11,7 +11,6 @@ services:
       published: 7443
       protocol: tcp
       mode: ingress
-    privileged: true
     volumes:
     - data:/var/lib/rancher
     cap_add:

__swarm/registry/docker-compose.yml

@@ -21,3 +21,4 @@ services:
     volumes:
     - /share/docker_data/registry/auth:/auth
     - /share/docker_registry/data:/var/lib/registry
+    - /share/docker_data/registry/config:/etc/docker/registry/

__swarm/registry/registry-swarm.yml

@@ -1,5 +1,5 @@
 services:
-  registry:
+  app:
     environment:
       REGISTRY_STORAGE_DELETE_ENABLED: 'true'
       REGISTRY_AUTH: htpasswd
@@ -10,6 +10,12 @@ services:
       driver: loki
       options:
         loki-url: http://192.168.77.101:3100/loki/api/v1/push
+        loki-relabel-config: |
+          - action: labelmap
+            regex: swarm_stack
+            replacement: namespace
+          - action: labelmap
+            regex: swarm_(service)
     ports:
     - target: 5000
       published: 5000
@@ -17,15 +23,18 @@ services:
       mode: ingress
     volumes:
     - auth:/auth
-    - data:/var/lib/registry
+    - /share/docker_registry/data:/var/lib/registry
+    - config:/etc/docker/registry/
+    
     deploy:
       labels:
         wud.watch: 'false'
         wud.watch.digest: 'false'
+        service_name: 'registry'
       replicas: 1
-      placement:
+      restart_policy:
-        constraints:
+        condition: any
-        - node.role == manager
+
 volumes:
   auth:
-  data:
+  config:

__swarm/regsync/regsync-swarm.yml

@@ -1,8 +1,8 @@
 volumes:
-  regsync:
+  config:
     driver: local
 services:
-  regsync:
+  app:
     command: -c /home/appuser/regsync.yml server
     env_file:
     - stack.env
@@ -11,15 +11,23 @@ services:
       driver: loki
       options:
         loki-url: http://192.168.77.101:3100/loki/api/v1/push
-    network_mode: host
+        loki-relabel-config: |
+          - action: labelmap
+            regex: swarm_stack
+            replacement: namespace
+          - action: labelmap
+            regex: swarm_(service)
     stdin_open: true
     volumes:
-    - regsync:/home/appuser/
+    - config:/home/appuser/
     - /etc/localtime:/etc/localtime
+    # labels:
+    #     service_name: 'regsync'
     deploy:
       labels:
         wud.watch: 'true'
         wud.watch.digest: 'true'
+        service_name: 'regsync'
       replicas: 1
       placement:
         constraints:

__swarm/regsync/stack.env

@@ -4,3 +4,5 @@ HUB_USER=sectorq
 HUB_PASS=dckr_pat_7XN8zNgj8JRPq1mlS5IvMcxJDUA
 LOCAL_USER=jaydee
 LOCAL_PASS=l4c1j4yd33Du5lo
+APPNAME=regsync
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/semaphore/docker-compose.yml

@@ -10,7 +10,7 @@ services:
       SEMAPHORE_ADMIN: administrator
       SEMAPHORE_ADMIN_EMAIL: administrator@sectorq.eu
       SEMAPHORE_ADMIN_NAME: administrator
-      SEMAPHORE_ADMIN_PASSWORD: $SEMAPHORE_ADMIN_PASSWORD
+      SEMAPHORE_ADMIN_PASSWORD: administrator
       SEMAPHORE_DB: semaphore_db
       SEMAPHORE_DB_HOST: db
       SEMAPHORE_DB_PASS: StrongPassw0rd
@@ -21,7 +21,7 @@ services:
       SEMAPHORE_LDAP_DN_SEARCH: dc=sectorq,dc=eu
       SEMAPHORE_LDAP_HOST: 192.168.77.101
       SEMAPHORE_LDAP_NEEDTLS: 'no'
-      SEMAPHORE_LDAP_PASSWORD: $LDAP_ADMIN_PASSWORD
+      SEMAPHORE_LDAP_PASSWORD: administrator
       SEMAPHORE_LDAP_PORT: '2389'
       SEMAPHORE_LDAP_SEARCH_FILTER: (&(objectClass=inetOrgPerson)(uid=%s))
       SEMAPHORE_PLAYBOOK_PATH: /tmp/semaphore/

__swarm/semaphore/semaphore-swarm.yml

@@ -3,12 +3,14 @@ services:
     dns:
     - 192.168.77.101
     - 192.168.77.1
+    secrets:
+    - semaphore_admin_password
     environment:
       SEMAPHORE_ACCESS_KEY_ENCRYPTION: MflCLIUF5bn6Lgkuwy4BoAdIFhoZ4Ief2oocXmuZSjs=
-      SEMAPHORE_ADMIN: administrator
+      SEMAPHORE_ADMIN: admin
-      SEMAPHORE_ADMIN_EMAIL: administrator@sectorq.eu
+      SEMAPHORE_ADMIN_EMAIL: jaydee@sectorq.eu
-      SEMAPHORE_ADMIN_NAME: administrator
+      SEMAPHORE_ADMIN_NAME: admin
-      SEMAPHORE_ADMIN_PASSWORD: $SEMAPHORE_ADMIN_PASSWORD
+      SEMAPHORE_ADMIN_PASSWORD_FILE: /run/secrets/semaphore_admin_password
       SEMAPHORE_DB: semaphore_db
       SEMAPHORE_DB_HOST: db
       SEMAPHORE_DB_PASS: StrongPassw0rd
@@ -19,7 +21,7 @@ services:
       SEMAPHORE_LDAP_DN_SEARCH: dc=sectorq,dc=eu
       SEMAPHORE_LDAP_HOST: 192.168.77.101
       SEMAPHORE_LDAP_NEEDTLS: 'no'
-      SEMAPHORE_LDAP_PASSWORD: $LDAP_ADMIN_PASSWORD
+      SEMAPHORE_LDAP_PASSWORD: administrator
       SEMAPHORE_LDAP_PORT: '2389'
       SEMAPHORE_LDAP_SEARCH_FILTER: (&(objectClass=inetOrgPerson)(uid=%s))
       SEMAPHORE_PLAYBOOK_PATH: /tmp/semaphore/
@@ -39,9 +41,6 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-      placement:
-        constraints:
-        - node.role == manager
   db:
     environment:
       MYSQL_DATABASE: semaphore_db
@@ -56,9 +55,9 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-      placement:
-        constraints:
-        - node.role == manager
 volumes:
   data:
   db:
+secrets:
+  semaphore_admin_password:
+    external: true

__swarm/uptime-kuma/uptime-kuma-swarm.yml

@@ -15,8 +15,7 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-      placement:
+      restart_policy:
-        constraints:
+        condition: any
-        - node.role == manager
 volumes:
   data:

__swarm/wud/stack.env

@@ -16,7 +16,7 @@ WUD_AUTH_OIDC_AUTHENTIK_TIMEOUT=2000
 
 # BASIC
 WUD_AUTH_BASIC_JAYDEE_USER=homepage
-WUD_AUTH_BASIC_JAYDEE_HASH=$$apr1$$pGMz1QxU$$y6XuTscvGcYgas15JWlfg/
+WUD_AUTH_BASIC_JAYDEE_HASH=$apr1$OZNN/65l$cQp3tMfyQdftPIgje.uDZ1
 # GOTIFY
 WUD_TRIGGER_GOTIFY_EXTERNAL_PRIORITY=0
 WUD_TRIGGER_GOTIFY_EXTERNAL_TOKEN="AFxvpm1JpPSsmkf"
@@ -47,14 +47,14 @@ WUD_LOG_LEVEL=debug
 # text json
 WUD_LOG_FORMAT=text
 
-WUD_WATCHER_EXTDOCKER_HOST=193.168.144.164
+# WUD_WATCHER_EXTDOCKER_HOST=193.168.144.164
-WUD_WATCHER_EXTDOCKER_PORT=2376
+# WUD_WATCHER_EXTDOCKER_PORT=2376
-WUD_WATCHER_EXTDOCKER_CERTFILE=/certs/ext/cert.pem
+# WUD_WATCHER_EXTDOCKER_CERTFILE=/certs/ext/cert.pem
-WUD_WATCHER_EXTDOCKER_CAFILE=/certs/ext/ca.pem
+# WUD_WATCHER_EXTDOCKER_CAFILE=/certs/ext/ca.pem
-WUD_WATCHER_EXTDOCKER_KEYFILE=/certs/ext/key.pem
+# WUD_WATCHER_EXTDOCKER_KEYFILE=/certs/ext/key.pem
-WUD_WATCHER_EXTDOCKER_CRON=0 * * * *
+# WUD_WATCHER_EXTDOCKER_CRON=0 * * * *
-WUD_WATCHER_EXTDOCKER_WATCHALL=true
+# WUD_WATCHER_EXTDOCKER_WATCHALL=true
-WUD_WATCHER_EXTDOCKER_WATCHBYDEFAULT=true
+# WUD_WATCHER_EXTDOCKER_WATCHBYDEFAULT=true
 
 WUD_WATCHER_MSERVER_HOST=192.168.77.101
 WUD_WATCHER_MSERVER_PORT=2376
@@ -65,14 +65,23 @@ WUD_WATCHER_MSERVER_CRON=0 * * * *
 WUD_WATCHER_MSERVER_WATCHALL=true
 WUD_WATCHER_MSERVER_WATCHBYDEFAULT=false
 
-WUD_WATCHER_RPI5_HOST=192.168.77.238
+WUD_WATCHER_MS_HOST=192.168.77.101
-WUD_WATCHER_RPI5_PORT=2376
+WUD_WATCHER_MS_PORT=2376
-WUD_WATCHER_RPI5_CERTFILE=/certs/rpi5/cert.pem
+WUD_WATCHER_MS_CERTFILE=/certs/m-server/cert.pem
-WUD_WATCHER_RPI5_CAFILE=/certs/rpi5/ca.pem
+WUD_WATCHER_MS_CAFILE=/certs/m-server/ca.pem
-WUD_WATCHER_RPI5_KEYFILE=/certs/rpi5/key.pem
+WUD_WATCHER_MS_KEYFILE=/certs/m-server/key.pem
-WUD_WATCHER_RPI5_CRON=0 * * * *
+WUD_WATCHER_MS_CRON=0 * * * *
-WUD_WATCHER_RPI5_WATCHALL=true
+WUD_WATCHER_MS_WATCHALL=true
-WUD_WATCHER_RPI5_WATCHBYDEFAULT=true
+WUD_WATCHER_MS_WATCHBYDEFAULT=true
+
+# WUD_WATCHER_RPI5_HOST=192.168.77.238
+# WUD_WATCHER_RPI5_PORT=2376
+# WUD_WATCHER_RPI5_CERTFILE=/certs/rpi5/cert.pem
+# WUD_WATCHER_RPI5_CAFILE=/certs/rpi5/ca.pem
+# WUD_WATCHER_RPI5_KEYFILE=/certs/rpi5/key.pem
+# WUD_WATCHER_RPI5_CRON=0 * * * *
+# WUD_WATCHER_RPI5_WATCHALL=true
+# WUD_WATCHER_RPI5_WATCHBYDEFAULT=true
 
 WUD_WATCHER_NAS_HOST=192.168.77.106
 WUD_WATCHER_NAS_PORT=2376
@@ -83,13 +92,13 @@ WUD_WATCHER_NAS_CRON=0 * * * *
 WUD_WATCHER_NAS_WATCHALL=true
 WUD_WATCHER_NAS_WATCHBYDEFAULT=true
 
-WUD_WATCHER_RACK_HOST=192.168.77.55
+# WUD_WATCHER_RACK_HOST=192.168.77.55
-WUD_WATCHER_RACK_PORT=2376
+# WUD_WATCHER_RACK_PORT=2376
-WUD_WATCHER_RACK_CERTFILE=/certs/rack/cert.pem
+# WUD_WATCHER_RACK_CERTFILE=/certs/rack/cert.pem
-WUD_WATCHER_RACK_CAFILE=/certs/rack/ca.pem
+# WUD_WATCHER_RACK_CAFILE=/certs/rack/ca.pem
-WUD_WATCHER_RACK_KEYFILE=/certs/rack/key.pem
+# WUD_WATCHER_RACK_KEYFILE=/certs/rack/key.pem
-WUD_WATCHER_RACK_CRON=0 * * * *
+# WUD_WATCHER_RACK_CRON=0 * * * *
-WUD_WATCHER_RACK_WATCHALL=true
+# WUD_WATCHER_RACK_WATCHALL=true
-WUD_WATCHER_RACK_WATCHBYDEFAULT=true
+# WUD_WATCHER_RACK_WATCHBYDEFAULT=true
 
 WUD_SERVER_CORS_ENABLED=true

__swarm/wud/wud-swarm.yml

@@ -1,5 +1,5 @@
 services:
-  whatsupdocker:
+  app:
     env_file:
     - stack.env
     image: ${DOCKER_REGISTRY:-}getwud/wud
@@ -19,7 +19,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: wud
+        homepage.container: wud_app
         homepage.description: Docker container management
         homepage.group: Infrastructure
         homepage.href: https://wud.sectorq.eu
@@ -34,9 +34,8 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-      placement:
+      restart_policy:
-        constraints:
+        condition: any
-        - node.role == manager
 volumes:
   data:
   certs:

__swarm/zabbix-server/.env

@@ -1,2 +1,3 @@
 APPNAME=zabbix
-#RESTART=always
+#RESTART=always
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/zabbix-server/Dockerfile

@@ -0,0 +1,5 @@
+FROM zabbix/zabbix-server-pgsql:alpine-latest
+
+USER root
+RUN apk add --no-cache curl
+USER zabbix

__swarm/zabbix-server/docker-compose.yml

@@ -48,7 +48,11 @@ services:
     extends:
       file: logging.yml
       service: ${LOGGING:-syslog}
-    image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    #image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: zabbix-server-custom:latest
     volumes:
       - /share/docker_data/zabbix-server/server/alertscripts:/usr/lib/zabbix/alertscripts
     labels:

__swarm/zabbix-server/stack.env

@@ -1,6 +1,6 @@
 # Zabbix global
 # ZBX_DEBUGLEVEL=3
-
+DOCKER_REGISTRY=r.sectorq.eu/library/
 # Database
 MYSQL_PASSWORD=zabbix
 MYSQL_USER=zabbix

__swarm/zabbix-server/zabbix-server-swarm.yml

@@ -1,11 +1,10 @@
 networks:
   zabbix:
     driver: overlay
-    attachable: true
     ipam:
       config:
-        - subnet: 192.168.82.0/24
+      - subnet: 192.168.89.0/28
-
+      driver: default
 services:
   db-server:
     env_file:
@@ -13,13 +12,14 @@ services:
     image: ${DOCKER_REGISTRY:-}postgres:16-alpine
     networks:
       zabbix:
+        ipv4_address: 192.168.89.4
     ports:
-    - target: 5432
+      - target: 5432
-      published: 5432
+        published: 5432
-      protocol: tcp
+        protocol: tcp
-      mode: ingress
+        mode: ingress
     volumes:
-    - postgres-data:/var/lib/postgresql/data
+      - db:/var/lib/postgresql/data
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
@@ -33,6 +33,7 @@ services:
     image: ${DOCKER_REGISTRY:-}zabbix/zabbix-web-nginx-pgsql:alpine-latest
     networks:
       zabbix:
+        ipv4_address: 192.168.89.3
     ports:
     - target: 8080
       published: 8051
@@ -56,11 +57,13 @@ services:
   zabbix-server:
     env_file:
     - stack.env
-    image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    #image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    image: r.sectorq.eu/jaydee/zabbix-server-pgsql:latest
     volumes:
     - alertscripts:/usr/lib/zabbix/alertscripts
     networks:
       zabbix:
+        ipv4_address: 192.168.89.2
     ports:
     - target: 10051
       published: 10051
@@ -69,7 +72,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: zabbix-server-zabbix-server-1
+        homepage.container: zabbix-server_zabbix-server
         homepage.description: Monitoring server
         homepage.group: Utilities
         homepage.href: https://${APPNAME}.sectorq.eu
@@ -105,26 +108,26 @@ services:
       placement:
         constraints:
         - node.role == manager
-  postinstall:
+  # postinstall:
-    image: debian:12-slim
+  #   image: debian:12-slim
-    environment:
+  #   environment:
-      PUID: '0'
+  #     PUID: '0'
-      PGID: '0'
+  #     PGID: '0'
-    volumes:
+  #   volumes:
-    - /usr/bin:/usr/bin
+  #   - /usr/bin:/usr/bin
-    - /usr/lib:/usr/lib
+  #   - /usr/lib:/usr/lib
-    - /var/run/docker.sock:/var/run/docker.sock
+  #   - /var/run/docker.sock:/var/run/docker.sock
-    - scripts:/scripts
+  #   - scripts:/scripts
-    entrypoint:
+  #   entrypoint:
-    - /bin/sh
+  #   - /bin/sh
-    - /scripts/install-curl.sh
+  #   - /scripts/install-curl.sh
-    deploy:
+  #   deploy:
-      replicas: 1
+  #     replicas: 1
-      placement:
+  #     placement:
-        constraints:
+  #       constraints:
-        - node.role == manager
+  #       - node.role == manager
 volumes:
-  scripts:
+  db:
   certs:
   alertscripts:
-  postgres-data:
+  scripts:

pihole/docker-compose.yml

@@ -33,6 +33,17 @@ services:
       TZ: Europe/Bratislava
     hostname: m-server
     image: pihole/pihole:latest
+    shm_size: '256mb'
+    logging:
+      driver: loki
+      options:
+        loki-url: http://192.168.77.101:3100/loki/api/v1/push
+        loki-relabel-config: |
+          - action: labelmap
+            regex: swarm_stack
+            replacement: namespace
+          - action: labelmap
+            regex: swarm_(service)
     labels:
       com.centurylinklabs.watchtower.enable: 'true'
       homepage.container: pihole
@@ -53,10 +64,15 @@ services:
       pihole:
         ipv4_address: 192.168.78.254
     ports:
-    - '53:53'
+    - '53:53/udp'
     - '9380:80'
     - '9343:443'  
     restart: always
     volumes:
-    - /share/docker_data/pihole/etc-pihole:/etc/pihole
+    - data:/etc/pihole
-    - /share/docker_data/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
+    - dnsmasq_d:/etc/dnsmasq.d
+volumes:
+  data:
+    driver: local
+  dnsmasq_d:
+    driver: local

rancher/docker-compose.yml

@@ -12,4 +12,6 @@ services:
     privileged: true
     restart: ${RESTART:-unless-stopped}
     volumes:
-    - /share/docker_data/rancher:/var/lib/rancher
+    - data:/var/lib/rancher
+volumes:
+  data:

registry/docker-compose.yml

@@ -21,3 +21,4 @@ services:
     volumes:
     - /share/docker_data/registry/auth:/auth
     - /share/docker_registry/data:/var/lib/registry
+    - /share/docker_data/registry/config:/etc/docker/registry/

regsync/docker-compose.yml

@@ -1,5 +1,5 @@
 volumes:
-  regsync-data:
+  data:
     driver: local
 services:
   regsync:
@@ -18,5 +18,5 @@ services:
     restart: ${RESTART:-unless-stopped}
     stdin_open: true
     volumes:
-    - regsync-data:/home/appuser/
+    - data:/home/appuser/
     - /etc/localtime:/etc/localtime