build

__swarm/authentik/.env

@@ -0,0 +1,16 @@
+PG_PASS=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
+PG_USER=authentik
+PG_DB=authentik
+AUTHENTIK_SECRET_KEY=ZKkVCxj8kKj5ZklvzxKG2IgYQOftDoLPRjc57yomr1qzbKEQVZ
+AUTHENTIK_ERROR_REPORTING__ENABLED=true
+AUTHENTIK_TAG=2025.8.4
+POSTGRES_PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
+POSTGRES_USER=authentik
+POSTGRES_DB=authentik
+TZ=Europe/Bratislava
+AUTHENTIK_REDIS__HOST=redis
+AUTHENTIK_POSTGRESQL__HOST=postgresql
+AUTHENTIK_POSTGRESQL__USER=authentik
+AUTHENTIK_POSTGRESQL__NAME=authentik
+AUTHENTIK_POSTGRESQL__PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/authentik/authentik-swarm.yml

@@ -0,0 +1,150 @@
+services:
+  authentik_ldap:
+    environment:
+      AUTHENTIK_HOST: https://auth.sectorq.eu
+      AUTHENTIK_INSECURE: 'false'
+      AUTHENTIK_TOKEN: EfLokorVuj1woeO0p1he3mRJvVfGfvdKM8Bdew3DtDZZ3To6bVpFSDI7GOqY
+      TZ: Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}ghcr.io/goauthentik/ldap:${AUTHENTIK_TAG:-2024.6.1}
+    ports:
+    - target: 3389
+      published: 2389
+      protocol: tcp
+      mode: ingress
+    - target: 6636
+      published: 2636
+      protocol: tcp
+      mode: ingress
+    deploy:
+      labels:
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  postgresql:
+    environment:
+      AUTHENTIK_SECRET_KEY: $AUTHENTIK_SECRET_KEY
+      POSTGRES_DB: ${PG_DB:-authentik}
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+      TZ: Europe/Bratislava
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+      - CMD-SHELL
+      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
+    image: ${DOCKER_REGISTRY:-docker.io/library/}postgres:16-alpine
+    volumes:
+    - database:/var/lib/postgresql/data
+    deploy:
+      labels:
+        wud.watch: 'false'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  redis:
+    command: --save 60 1 --loglevel warning
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+      - CMD-SHELL
+      - redis-cli ping | grep PONG
+      timeout: 3s
+    image: ${DOCKER_REGISTRY:-docker.io/library/}redis:alpine
+    volumes:
+    - redis:/data
+    deploy:
+      labels:
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  server:
+    command: server
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_SECRET_KEY: $AUTHENTIK_SECRET_KEY
+      TZ: Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2024.6.1}
+    ports:
+    - target: 9000
+      published: 9003
+      protocol: tcp
+      mode: ingress
+    - target: 9443
+      published: 9453
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - media:/media
+    - custom-templates:/templates
+    - /var/run/docker.sock:/var/run/docker.sock
+    deploy:
+      labels:
+        homepage.container: authentik_server
+        homepage.description: Authentification server
+        homepage.group: Utilities
+        homepage.href: https://auth.sectorq.eu
+        homepage.icon: authentik.png
+        homepage.name: Authentik
+        homepage.server: my-docker-swarm
+        homepage.weight: '10'
+        homepage.widget.key: sVOwPPInTue7ZnvolmKG15hkE9gCyLcuAelLOQny6OIVn7JUilny9loPTG0v
+        homepage.widget.type: authentik
+        homepage.widget.url: https://auth.sectorq.eu
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  worker:
+    command: worker
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_SECRET_KEY: $AUTHENTIK_SECRET_KEY
+      TZ: Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2024.6.1}
+    user: root
+    volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
+    - media:/media
+    - certs:/certs
+    - custom-templates:/templates
+    deploy:
+      labels:
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  database:
+    driver: local
+  redis:
+    driver: local
+  custom-templates:
+    driver: local
+  media:
+    driver: local
+  certs:
+    driver: local

__swarm/authentik/docker-compose.yml

@@ -0,0 +1,125 @@
+services:
+  authentik_ldap:
+    environment:
+      AUTHENTIK_HOST: https://auth.sectorq.eu
+      AUTHENTIK_INSECURE: 'false'
+      AUTHENTIK_TOKEN: EfLokorVuj1woeO0p1he3mRJvVfGfvdKM8Bdew3DtDZZ3To6bVpFSDI7GOqY
+      TZ: Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}ghcr.io/goauthentik/ldap:${AUTHENTIK_TAG:-2024.6.1}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    ports:
+    - 2389:3389
+    - 2636:6636
+    restart: ${RESTART:-unless-stopped}
+  postgresql:
+    environment:
+      AUTHENTIK_SECRET_KEY: $AUTHENTIK_SECRET_KEY
+      POSTGRES_DB: ${PG_DB:-authentik}
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+      TZ: Europe/Bratislava
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+      - CMD-SHELL
+      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
+    image: ${DOCKER_REGISTRY:-docker.io/library/}postgres:16-alpine
+    labels:
+      wud.watch: false
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - database:/var/lib/postgresql/data
+  redis:
+    command: --save 60 1 --loglevel warning
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+      - CMD-SHELL
+      - redis-cli ping | grep PONG
+      timeout: 3s
+    image: ${DOCKER_REGISTRY:-docker.io/library/}redis:alpine
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - authentik_redis:/data
+  server:
+    command: server
+    depends_on:
+    - postgresql
+    - redis
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_SECRET_KEY: $AUTHENTIK_SECRET_KEY
+      TZ: Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2024.6.1}
+    labels:
+      homepage.container: authentik-server-1
+      homepage.description: Authentification server
+      homepage.group: Utilities
+      homepage.href: https://auth.sectorq.eu
+      homepage.icon: authentik.png
+      homepage.name: Authentik
+      homepage.server: my-docker
+      homepage.weight: '10'
+      homepage.widget.key: sVOwPPInTue7ZnvolmKG15hkE9gCyLcuAelLOQny6OIVn7JUilny9loPTG0v
+      homepage.widget.type: authentik
+      homepage.widget.url: https://auth.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    ports:
+    - 9003:9000
+    - 9453:9443
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - media:/media
+    - templates:/templates
+    - /var/run/docker.sock:/var/run/docker.sock
+  worker:
+    command: worker
+    depends_on:
+    - postgresql
+    - redis
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_REDIS__HOST: redis
+      AUTHENTIK_SECRET_KEY: $AUTHENTIK_SECRET_KEY
+      TZ: Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2024.6.1}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    user: root
+    volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
+    - media:/media
+    - certs:/certs
+    - custom-templates:/templates
+
+volumes:
+  database:
+    driver: local
+  redis:
+    driver: local
+  custom-templates:
+    driver: local
+  media:
+    driver: local
+  certs:
+    driver: local

__swarm/authentik/stack.env

@@ -0,0 +1,15 @@
+PG_PASS=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
+PG_USER=authentik
+PG_DB=authentik
+AUTHENTIK_SECRET_KEY=ZKkVCxj8kKj5ZklvzxKG2IgYQOftDoLPRjc57yomr1qzbKEQVZ
+AUTHENTIK_ERROR_REPORTING__ENABLED=true
+AUTHENTIK_TAG=2025.10.2
+POSTGRES_PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
+POSTGRES_USER=authentik
+POSTGRES_DB=authentik
+TZ=Europe/Bratislava
+AUTHENTIK_REDIS__HOST=redis
+AUTHENTIK_POSTGRESQL__HOST=postgresql
+AUTHENTIK_POSTGRESQL__USER=authentik
+AUTHENTIK_POSTGRESQL__NAME=authentik
+AUTHENTIK_POSTGRESQL__PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp

__swarm/bitwarden/.env

@@ -0,0 +1,2 @@
+APPNAME=bitwarden
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/bitwarden/bitwarden-stack.yml

@@ -0,0 +1,39 @@
+services:
+  bitwarden:
+    environment:
+      WEBSOCKET_ENABLED: 'true'
+      SIGNUPS_ALLOWED: 'true'
+      DOMAIN: https://pw.sectorq.eu
+      SMTP_HOST: mail.sectorq.eu
+      SMTP_FROM: jaydee@sectorq.eu
+      SMTP_PORT: '465'
+      SMTP_SSL: 'true'
+      SMTP_USERNAME: jaydee@sectorq.eu
+      SMTP_PASSWORD: $SMTP_PASSWORD
+      ADMIN_TOKEN: $ADMIN_PASSWORD
+    image: ${DOCKER_REGISTRY:-}vaultwarden/server:latest
+    ports:
+    - target: 80
+      published: 8181
+      protocol: tcp
+      mode: ingress
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/bitwarden/bw-data:/data
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: vaultwarden
+        homepage.description: Password manager
+        homepage.group: Utilities
+        homepage.href: https://pw.sectorq.eu
+        homepage.icon: bitwarden.png
+        homepage.name: Bitwarden
+        homepage.server: my-docker
+        homepage.weight: '1'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager

__swarm/bitwarden/bitwarden-swarm.yml

@@ -0,0 +1,42 @@
+volumes:
+  data:
+    driver: local
+services:
+  bitwarden:
+    environment:
+      WEBSOCKET_ENABLED: 'true'
+      SIGNUPS_ALLOWED: 'true'
+      DOMAIN: https://pw.sectorq.eu
+      SMTP_HOST: mail.sectorq.eu
+      SMTP_FROM: jaydee@sectorq.eu
+      SMTP_PORT: '465'
+      SMTP_SSL: 'true'
+      SMTP_USERNAME: jaydee@sectorq.eu
+      SMTP_PASSWORD: $SMTP_PASSWORD
+      ADMIN_TOKEN: $ADMIN_PASSWORD
+    image: ${DOCKER_REGISTRY:-}vaultwarden/server:latest
+    ports:
+    - target: 80
+      published: 8181
+      protocol: tcp
+      mode: ingress
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - data:/data
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: bitwarden_bitwarden
+        homepage.description: Password manager
+        homepage.group: Utilities
+        homepage.href: https://pw.sectorq.eu
+        homepage.icon: bitwarden.png
+        homepage.name: Bitwarden
+        homepage.server: my-docker-swarm
+        homepage.weight: '1'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager

__swarm/bitwarden/docker-compose.yml

@@ -0,0 +1,35 @@
+services:
+  bitwarden:
+    container_name: vaultwarden
+    environment:
+    - WEBSOCKET_ENABLED=true
+    - SIGNUPS_ALLOWED=true
+    - DOMAIN=https://pw.sectorq.eu
+    - SMTP_HOST=mail.sectorq.eu
+    - SMTP_FROM=jaydee@sectorq.eu
+    - SMTP_PORT=465
+    - SMTP_SSL=true
+    - SMTP_USERNAME=jaydee@sectorq.eu
+    - SMTP_PASSWORD=$SMTP_PASSWORD
+    - ADMIN_TOKEN=$ADMIN_PASSWORD
+    image: ${DOCKER_REGISTRY:-}vaultwarden/server:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      homepage.container: vaultwarden
+      homepage.description: Password manager
+      homepage.group: Utilities
+      homepage.href: https://pw.sectorq.eu
+      homepage.icon: bitwarden.png
+      homepage.name: Bitwarden
+      homepage.server: my-docker
+      homepage.weight: 1
+      wud.watch: true
+      wud.watch.digest: true
+    ports:
+    - 8181:80
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - data:/data
+volumes:
+  data:
+    driver: local

__swarm/bookstack/.env

@@ -0,0 +1,2 @@
+APPNAME=bookstack
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/bookstack/bookstack-swarm.yml

@@ -0,0 +1,52 @@
+volumes:
+  app_data:
+    driver: local
+  db_data:
+    driver: local
+
+services:
+  app:
+    env_file:
+    - stack.env
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/bookstack:latest
+    ports:
+    - target: 80
+      published: 6875
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - app_data:/config
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: bookstack_app
+        homepage.description: Books
+        homepage.group: Utilities
+        homepage.href: https://bookstack.sectorq.eu
+        homepage.icon: bookstack.png
+        homepage.name: Bookstack
+        homepage.server: my-docker-swarm
+        homepage.weight: '1'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  db:
+    env_file:
+    - stack.env
+    environment:
+      PGID: 0
+      PUID: 0
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/mariadb
+    volumes:
+    - db_data:/config
+    deploy:
+      labels:
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager

__swarm/bookstack/docker-compose copy.yml

@@ -0,0 +1,88 @@
+---
+version: "2"
+services:
+  app:
+    image: lscr.io/linuxserver/bookstack:latest
+    environment:
+      PUID: 1000
+      PGID: 1000
+      APP_URL: https://bookstack.sectorq.eu
+      DB_HOST: db
+      DB_PORT: 3306
+      DB_USER: bookstack
+      DB_PASS: l4c1j4yd33Du5lo
+      DB_DATABASE: bookstackapp
+      # Set authentication method to be saml2
+      AUTH_METHOD: saml2
+      # Control if BookStack automatically initiates login via your SAML system if it's the only authentication method.
+      # Prevents the need for the user to click the "Login with x" button on the login page.
+      # Setting this to true enables auto-initiation.
+      AUTH_AUTO_INITIATE: false
+      # Set the display name to be shown on the login button.
+      # (Login with <name>)
+      SAML2_NAME: authentik
+      # Name of the attribute which provides the user's email address
+      SAML2_EMAIL_ATTRIBUTE: email
+      # Name of the attribute to use as an ID for the SAML user.
+      SAML2_EXTERNAL_ID_ATTRIBUTE: uid
+      # Enable SAML group sync.
+      SAML2_USER_TO_GROUPS: true
+      # Set the attribute from which BookStack will read groups names from.
+      # You will need to rename your roles in Bookstack to match your groups in authentik.
+      SAML2_GROUP_ATTRIBUTE: http://schemas.xmlsoap.org/claims/Group
+      # Name of the attribute(s) to use for the user's display name
+      # Can have multiple attributes listed, separated with a '|' in which
+      # case those values will be joined with a space.
+      # Example: SAML2_DISPLAY_NAME_ATTRIBUTES=firstName|lastName
+      # Defaults to the ID value if not found.
+      ######SAML2_DISPLAY_NAME_ATTRIBUTES: http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname
+      SAML2_DISPLAY_NAME_ATTRIBUTES: username
+
+      # Identity Provider entityID URL
+      SAML2_IDP_ENTITYID: https://auth.sectorq.eu/api/v3/providers/saml/10/metadata/?download
+      
+      # Auto-load metadata from the IDP
+      # Setting this to true negates the need to specify the next three options
+      SAML2_AUTOLOAD_METADATA: true
+
+
+
+
+
+
+      
+    volumes:
+      - /share/docker_data/bookstack/bookstack_app_data:/config
+    ports:
+      - 6875:80
+    restart: ${RESTART:-unless-stopped}
+    depends_on:
+      - db
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      homepage.group: Utilities
+      homepage.name: Bookstack
+      homepage.weight: 1
+      homepage.icon: bookstack.png
+      homepage.href: https://bookstack.sectorq.eu
+      homepage.description: Books
+      homepage.server: my-docker
+      homepage.container: bookstack-app-1
+      # homepage.widget.type: ${APPNAME}
+      # homepage.widget.url: https://${APPNAME}.sectorq.eu
+      # homepage.widget.key: ddfc91b29920082636da70cc677aec74c88a7666
+      # homepage.widget.version: 2
+  db:
+    image: lscr.io/linuxserver/mariadb
+    environment:
+      PUID: 0
+      PGID: 0
+      MYSQL_ROOT_PASSWORD: l4c1j4yd33Du5lo
+      TZ: Europe/Bratislava
+      MYSQL_DATABASE: bookstackapp
+      MYSQL_USER: bookstack
+      MYSQL_PASSWORD: l4c1j4yd33Du5lo
+    
+    volumes:
+      - /share/docker_data/bookstack/bookstack_db_data:/config
+    restart: ${RESTART:-unless-stopped}

__swarm/bookstack/docker-compose.yml

@@ -0,0 +1,38 @@
+services:
+  app:
+    depends_on:
+    - db
+    env_file:
+    - stack.env
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/bookstack:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      homepage.container: bookstack-app-1
+      homepage.description: Books
+      homepage.group: Utilities
+      homepage.href: https://bookstack.sectorq.eu
+      homepage.icon: bookstack.png
+      homepage.name: Bookstack
+      homepage.server: my-docker
+      homepage.weight: 1
+      wud.watch: true
+      wud.watch.digest: true
+    ports:
+    - 6875:80
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/bookstack/bookstack_app_data:/config
+  db:
+    env_file:
+    - stack.env
+    environment:
+      PGID: 0
+      PUID: 0
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/mariadb
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/bookstack/bookstack_db_data:/config
+version: '2'

__swarm/bookstack/stack.env

@@ -0,0 +1,86 @@
+PUID=1000
+PGID=1000
+APP_URL=https://bookstack.sectorq.eu
+DB_HOST=db
+DB_PORT=3306
+DB_USER=bookstack
+DB_PASS=l4c1j4yd33Du5lo
+DB_DATABASE=bookstackapp
+MYSQL_ROOT_PASSWORD=l4c1j4yd33Du5lo
+TZ=Europe/Bratislava
+MYSQL_DATABASE=bookstackapp
+MYSQL_USER=bookstack
+MYSQL_PASSWORD=l4c1j4yd33Du5lo
+# # Set authentication method to be saml2
+# AUTH_METHOD: saml2
+# # Control if BookStack automatically initiates login via your SAML system if it's the only authentication method.
+# # Prevents the need for the user to click the "Login with x" button on the login page.
+# # Setting this to true enables auto-initiation.
+# AUTH_AUTO_INITIATE: false
+# # Set the display name to be shown on the login button.
+# # (Login with <name>)
+# SAML2_NAME: authentik
+# # Name of the attribute which provides the user's email address
+# SAML2_EMAIL_ATTRIBUTE: email
+# # Name of the attribute to use as an ID for the SAML user.
+# SAML2_EXTERNAL_ID_ATTRIBUTE: uid
+# # Enable SAML group sync.
+# SAML2_USER_TO_GROUPS: true
+# # Set the attribute from which BookStack will read groups names from.
+# # You will need to rename your roles in Bookstack to match your groups in authentik.
+# SAML2_GROUP_ATTRIBUTE: http://schemas.xmlsoap.org/claims/Group
+# # Name of the attribute(s) to use for the user's display name
+# # Can have multiple attributes listed, separated with a '|' in which
+# # case those values will be joined with a space.
+# # Example: SAML2_DISPLAY_NAME_ATTRIBUTES=firstName|lastName
+# # Defaults to the ID value if not found.
+# ######SAML2_DISPLAY_NAME_ATTRIBUTES: http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname
+# SAML2_DISPLAY_NAME_ATTRIBUTES: username
+
+# # Identity Provider entityID URL
+# SAML2_IDP_ENTITYID: https://auth.sectorq.eu/api/v3/providers/saml/10/metadata/?download
+
+# # Auto-load metadata from the IDP
+# # Setting this to true negates the need to specify the next three options
+# SAML2_AUTOLOAD_METADATA: true
+
+
+# Set OIDC to be the authentication method
+AUTH_METHOD=oidc
+#AUTH_METHOD: standard 
+# Control if BookStack automatically initiates login via your OIDC system 
+# if it's the only authentication method. Prevents the need for the
+# user to click the "Login with x" button on the login page.
+# Setting this to true enables auto-initiation.
+AUTH_AUTO_INITIATE=true
+
+# Set the display name to be shown on the login button.
+# (Login with <name>)
+OIDC_NAME=SSO
+
+# Name of the claims(s) to use for the user's display name.
+# Can have multiple attributes listed, separated with a '|' in which 
+# case those values will be joined with a space.
+# Example: OIDC_DISPLAY_NAME_CLAIMS=given_name|family_name
+OIDC_DISPLAY_NAME_CLAIMS=name
+
+# OAuth Client ID to access the identity provider
+OIDC_CLIENT_ID=GCPj547vTmEpmsCM8jkuR222SS31yZMdp7oAU82U
+
+# OAuth Client Secret to access the identity provider
+OIDC_CLIENT_SECRET=Nador7SOdsYgfNhRwbeRKLNPkPiASBAlTnKVi294xbOz8MM3e2RlzAaWQsQNZmBtLLZVifb1TG3OpKrVXeeW3Vu8HmJuvy8GwSAT2r0pP0241tDdEShq7UkP9G5Esdt8
+
+# Issuer URL
+# Must start with 'https://'
+OIDC_ISSUER=https://auth.sectorq.eu/application/o/bookstack/
+
+# The "end session" (RP-initiated logout) URL to call during BookStack logout.
+# By default this is false which disables RP-initiated logout.
+# Setting to "true" will enable logout if found as supported by auto-discovery.
+# Otherwise, this can be set as a specific URL endpoint.
+OIDC_END_SESSION_ENDPOINT=false
+
+# Enable auto-discovery of endpoints and token keys.
+# As per the standard, expects the service to serve a 
+# `<issuer>/.well-known/openid-configuration` endpoint.
+OIDC_ISSUER_DISCOVER=true

__swarm/dockermon/.env

@@ -0,0 +1,2 @@
+APPNAME=dockermon
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/dockermon/docker-compose.yml

@@ -0,0 +1,14 @@
+services:
+  docker_mon:
+    image: ${DOCKER_REGISTRY:-}philhawthorne/ha-dockermon:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      wud.watch: true
+      wud.watch.digest: true
+    ports:
+    - 8126:8126
+    restart: unless-stopped
+    volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
+    - /share/docker_data/dockermon/config:/config
+version: '2'

__swarm/dockermon/dockermon-swarm.yml

@@ -0,0 +1,22 @@
+services:
+  docker_mon:
+    image: ${DOCKER_REGISTRY:-}philhawthorne/ha-dockermon:latest
+    ports:
+    - target: 8126
+      published: 8126
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
+    - config:/config
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  config:

__swarm/fail2ban/.env

@@ -0,0 +1,2 @@
+APPNAME=fail2ban
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/fail2ban/docker-compose.yaml

@@ -0,0 +1,49 @@
+---
+services:
+  # fail2ban:
+  #   image: lscr.io/linuxserver/fail2ban:latest
+  #   container_name: fail2ban
+  #   cap_add:
+  #     - NET_ADMIN
+  #     - NET_RAW
+  #   network_mode: host
+  #   environment:
+  #     - PUID=1000
+  #     - PGID=1000
+  #     - TZ=Europe/Bratislava
+  #     - VERBOSITY=-vvv #optional
+  #   volumes:
+  #     - /share/docker_data/fail2ban/config:/config
+  #     - /share/docker_data/fail2ban/log:/var/log:ro
+  #     # - /path/to/airsonic/log:/remotelogs/airsonic:ro #optional
+  #     # - /path/to/apache2/log:/remotelogs/apache2:ro #optional
+  #     # - /path/to/authelia/log:/remotelogs/authelia:ro #optional
+  #     # - /path/to/emby/log:/remotelogs/emby:ro #optional
+  #     # - /path/to/filebrowser/log:/remotelogs/filebrowser:ro #optional
+  #     - /share/docker_data/ha:/remotelogs/homeassistant:ro #optional
+  #     # - /path/to/lighttpd/log:/remotelogs/lighttpd:ro #optional
+  #     # - /path/to/nextcloud/log:/remotelogs/nextcloud:ro #optional
+  #     # - /path/to/nginx/log:/remotelogs/nginx:ro #optional
+  #     # - /path/to/nzbget/log:/remotelogs/nzbget:ro #optional
+  #     # - /path/to/overseerr/log:/remotelogs/overseerr:ro #optional
+  #     # - /path/to/prowlarr/log:/remotelogs/prowlarr:ro #optional
+  #     # - /path/to/radarr/log:/remotelogs/radarr:ro #optional
+  #     # - /path/to/sabnzbd/log:/remotelogs/sabnzbd:ro #optional
+  #     # - /path/to/sonarr/log:/remotelogs/sonarr:ro #optional
+  #     # - /path/to/unificontroller/log:/remotelogs/unificontroller:ro #optional
+  #     # - /path/to/vaultwarden/log:/remotelogs/vaultwarden:ro #optional
+  #   restart: unless-stopped
+  blockips-unifi:
+    stdin_open: true
+    tty: true
+    container_name: blockips-unifi
+    restart: always
+    environment:
+        - TZ=Europe/Bratislava
+    volumes:
+        - /share/docker_data/unify_block/config.php:/config.php
+        - /share/docker_data/unify_block/ban.sh:/ban.sh
+        - /share/docker_data/unify_block/crontab:/etc/crontabs/root
+        - /share/docker_data/fail2ban/ban:/ban
+        - /share/docker_data/fail2ban/unban:/unban
+    image: ${DOCKER_REGISTRY:-}tusc/blockips-unifi:latest

__swarm/fail2ban/fail2ban.env

@@ -0,0 +1,12 @@
+TZ=Europe/Bratislava
+
+F2B_LOG_TARGET=/log/fail2ban.log
+F2B_LOG_LEVEL=INFO
+F2B_DB_PURGE_AGE=1d
+
+SSMTP_HOST=mail.sectorq.eu
+SSMTP_PORT=465
+SSMTP_HOSTNAME=mail.sectorq.eu
+SSMTP_USER=fail2ban@sectorq.eu
+SSMTP_PASSWORD=l4c1j4yd33Du5lo
+SSMTP_TLS=YES

__swarm/gitea/.env

@@ -0,0 +1,3 @@
+APPNAME=gitea
+DOCKER_REGISTRY=r.sectorq.eu/library/
+TOKEN=ddfc91b29920082636da70cc677aec74c88a7666

__swarm/gitea/docker-compose.yml

@@ -0,0 +1,55 @@
+networks:
+  gitea:
+    external: false
+services:
+  server:
+    container_name: gitea
+    environment:
+      USER_UID: 1000
+      USER_GID: 1000
+      ROOT_URL: https://gitea.sectorq.eu
+      ENABLE_PASSWORD_SIGNIN_FORM: false
+      DISABLE_REGISTRATION: true
+    image: ${DOCKER_REGISTRY:-}gitea/gitea:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      homepage.container: gitea
+      homepage.description: Version control server
+      homepage.group: Utilities
+      homepage.href: https://${APPNAME}.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Gitea
+      homepage.server: my-docker
+      homepage.weight: 1
+      homepage.widget.key: ${TOKEN}
+      homepage.widget.type: ${APPNAME}
+      homepage.widget.url: https://${APPNAME}.sectorq.eu
+      homepage.widget.version: 2
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - gitea
+    ports:
+    - 3000:3000
+    - '222:22'
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/gitea:/data
+    - /etc/timezone:/etc/timezone:ro
+    - /etc/localtime:/etc/localtime:ro
+  runner:
+    image: ${DOCKER_REGISTRY:-}docker.io/gitea/act_runner:nightly
+    environment:
+      CONFIG_FILE: /config/config.yaml
+      GITEA_INSTANCE_URL: "https://gitea.sectorq.eu/"
+      GITEA_RUNNER_REGISTRATION_TOKEN: "8nmKqJhkvYwltmNfF2o9vs0tzo70ufHSQpVg6ymb"
+      GITEA_RUNNER_NAME: jaydee
+      GITEA_RUNNER_LABELS: jaydee
+    volumes:
+      - /share/docker_data/gitea-runner/config:/config
+      - /share/docker_data/gitea-runner/data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    restart: ${RESTART:-unless-stopped}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true

__swarm/gitea/gitea-swarm.yml

@@ -0,0 +1,81 @@
+networks:
+  gitea:
+    external: false
+services:
+  server:
+    environment:
+      USER_UID: 1000
+      USER_GID: 1000
+      ROOT_URL: https://gitea.sectorq.eu
+      ENABLE_PASSWORD_SIGNIN_FORM: 'false'
+      DISABLE_REGISTRATION: 'true'
+    image: ${DOCKER_REGISTRY:-}gitea/gitea:latest
+    networks:
+    - gitea
+    ports:
+    - target: 3000
+      published: 3000
+      protocol: tcp
+      mode: ingress
+    - target: 22
+      published: 222
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - data:/data
+    - /etc/localtime:/etc/localtime:ro
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: gitea_server
+        homepage.description: Version control server
+        homepage.group: Utilities
+        homepage.href: https://${APPNAME}.sectorq.eu
+        homepage.icon: ${APPNAME}.png
+        homepage.name: Gitea
+        homepage.server: my-docker-swarm
+        homepage.weight: '1'
+        homepage.widget.key: "b7b6e21beb7489c170215e2b7ae0d9b0099132d6"
+        homepage.widget.type: ${APPNAME}
+        homepage.widget.url: https://${APPNAME}.sectorq.eu
+        homepage.widget.version: '2'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  runner:
+    image: ${DOCKER_REGISTRY:-}docker.io/gitea/act_runner:nightly
+    secrets:
+      - gitea_runner_registration_token
+    environment:
+      CONFIG_FILE: /config/config.yaml
+      GITEA_INSTANCE_URL: https://gitea.sectorq.eu/
+      GITEA_RUNNER_REGISTRATION_TOKEN_FILE: /run/secrets/gitea_runner_registration_token
+      GITEA_RUNNER_NAME: jaydee
+      GITEA_RUNNER_LABELS: jaydee
+    volumes:
+    
+    - runner_config:/config
+    - runner_data:/data
+    - /var/run/docker.sock:/var/run/docker.sock
+    - /etc/localtime:/etc/localtime:ro
+    deploy:
+      labels:
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  data:
+    driver: local
+  runner_config:
+    driver: local
+  runner_data:
+    driver: local
+secrets:
+  gitea_runner_registration_token:
+    external: true

__swarm/gitlab/docker-compose.yml

@@ -0,0 +1,70 @@
+services:
+  runner:
+    container_name: gitlab-runner
+    restart: always
+    volumes:
+      - runner:/etc/gitlab-runner
+      - /var/run/docker.sock:/var/run/docker.sock
+    image: ${DOCKER_REGISTRY:-}gitlab/gitlab-runner:latest
+    labels:
+      - wud.watch.digest=true
+      - wud.watch=true
+  web:
+  
+    container_name: gitlab
+    environment:
+      GITLAB_OMNIBUS_CONFIG: "external_url 'https://gitlab.sectorq.eu'\nnginx['listen_port']\
+        \ = 80\nnginx['listen_https'] = false\nweb_server['username'] = 'git'\ngitlab_rails['time_zone']\
+        \ = 'Europe/Bratislava'\ngitlab_rails['omniauth_enabled'] = true\ngitlab_rails['omniauth_allow_single_sign_on']\
+        \ = ['saml']\ngitlab_rails['omniauth_sync_email_from_provider'] = 'saml'\n\
+        gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']\ngitlab_rails['omniauth_sync_profile_attributes']\
+        \ = ['email']\ngitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'\n\
+        gitlab_rails['omniauth_block_auto_created_users'] = false\ngitlab_rails['omniauth_auto_link_saml_user']\
+        \ = true\ngitlab_rails['omniauth_providers'] = [\n  {\n    name: 'saml',\n\
+        \    args: {\n      assertion_consumer_service_url: 'https://gitlab.sectorq.eu/users/auth/saml/callback',\n\
+        \      # Shown when navigating to certificates in authentik1\n      idp_cert_fingerprint:\
+        \ 'f7:fd:49:03:b3:38:52:b3:23:f5:43:c4:8d:08:65:32:e0:5a:7b:0e',\n      idp_sso_target_url:\
+        \ 'https://auth.sectorq.eu/application/saml/gitlab/sso/binding/redirect/',\n\
+        \      issuer: 'https://gitlab.sectorq.eu',\n      name_identifier_format:\
+        \ 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n      attribute_statements:\
+        \ {\n        email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],\n\
+        \        first_name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],\n\
+        \        nickname: ['http://schemas.goauthentik.io/2021/02/saml/username']\n\
+        \      }\n    },\n    label: 'authentik'\n  }\n]\n"
+      TZ: Europe/Bratislava
+    hostname: gitlab.sectorq.eu
+    image: ${DOCKER_REGISTRY:-}gitlab/gitlab-ce:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: gitlab
+      homepage.description: Version control
+      homepage.group: Infrastructure
+      homepage.href: https://gitlab.sectorq.eu
+      homepage.icon: gitlab.png
+      homepage.name: Gitlab
+      homepage.server: my-docker
+      homepage.weight: '1'
+      homepage.widget.key: glpat-BuMKcaDqeD-Wx3dW4TM9
+      homepage.widget.type: gitlab
+      homepage.widget.url: https://gitlab.sectorq.eu
+      homepage.widget.user_id: '2'
+      wud.watch: true
+      wud.watch.digest: true
+    network_mode: bridge
+    ports:
+    - 8785:80
+    - 8743:443
+    - '8722:22'
+    restart: unless-stopped
+    shm_size: 4gb
+    volumes:
+    - config:/etc/gitlab
+    - logs:/var/log/gitlab
+    - data:/var/opt/gitlab
+    - /etc/localtime:/etc/localtime:ro
+version: '3.6'
+volumes:
+  runner:
+  config:
+  logs:
+  data:

__swarm/gitlab/gitlab-swarm.yml

@@ -0,0 +1,101 @@
+  services:
+    runner:
+      container_name: gitlab-runner
+      restart: always
+      volumes:
+        - runner:/etc/gitlab-runner
+        - /var/run/docker.sock:/var/run/docker.sock
+      image: ${DOCKER_REGISTRY:-}gitlab/gitlab-runner:latest
+      labels:
+        - wud.watch.digest=true
+        - wud.watch=true
+      dns:
+        - 192.168.77.1
+        - 192.168.77.101
+    app:
+      environment:
+        GITLAB_OMNIBUS_CONFIG: |
+          external_url 'https://gitlab.sectorq.eu'
+          nginx['listen_port'] = 80
+          nginx['listen_https'] = false
+          web_server['username'] = 'git'
+          gitlab_rails['time_zone'] = 'Europe/Bratislava'
+          gitlab_rails['omniauth_enabled'] = true
+          gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
+          gitlab_rails['omniauth_sync_email_from_provider'] = 'saml'
+          gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']
+          gitlab_rails['omniauth_sync_profile_attributes'] = ['email']
+          gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'
+          gitlab_rails['omniauth_block_auto_created_users'] = false
+          gitlab_rails['omniauth_auto_link_saml_user'] = true
+          gitlab_rails['omniauth_providers'] = [
+            {
+              name: 'saml',
+              args: {
+                assertion_consumer_service_url: 'https://gitlab.sectorq.eu/users/auth/saml/callback',
+                # Shown when navigating to certificates in authentik1
+                idp_cert_fingerprint: 'f7:fd:49:03:b3:38:52:b3:23:f5:43:c4:8d:08:65:32:e0:5a:7b:0e',
+                idp_sso_target_url: 'https://auth.sectorq.eu/application/saml/gitlab/sso/binding/redirect/',
+                issuer: 'https://gitlab.sectorq.eu',
+                name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
+                attribute_statements: {
+                  email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],
+                  first_name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],
+                  nickname: ['http://schemas.goauthentik.io/2021/02/saml/username']
+                }
+              },
+              label: 'authentik'
+            }
+          ]
+        TZ: Europe/Bratislava
+      hostname: gitlab.sectorq.eu
+      image: ${DOCKER_REGISTRY:-}gitlab/gitlab-ce:latest
+      network_mode: bridge
+      ports:
+      - target: 80
+        published: 8785
+        protocol: tcp
+        mode: ingress
+      - target: 443
+        published: 8743
+        protocol: tcp
+        mode: ingress
+      - target: 22
+        published: 8722
+        protocol: tcp
+        mode: ingress
+      shm_size: 4gb
+      volumes:
+      - config:/etc/gitlab
+      - logs:/var/log/gitlab
+      - data:/var/opt/gitlab
+      - /etc/localtime:/etc/localtime:ro
+      deploy:
+        labels:
+          com.centurylinklabs.watchtower.enable: 'true'
+          homepage.container: gitlab
+          homepage.description: Version control
+          homepage.group: Infrastructure
+          homepage.href: https://gitlab.sectorq.eu
+          homepage.icon: gitlab.png
+          homepage.name: Gitlab
+          homepage.server: my-docker-swarm
+          homepage.weight: '1'
+          homepage.widget.key: glpat-BuMKcaDqeD-Wx3dW4TM9
+          homepage.widget.type: gitlab
+          homepage.widget.url: https://gitlab.sectorq.eu
+          homepage.widget.user_id: '2'
+          wud.watch: 'true'
+          wud.watch.digest: 'true'
+        replicas: 1
+        placement:
+          constraints:
+          - node.role == manager
+
+  volumes:
+    config:
+      driver: local
+    logs:
+      driver: local
+    data:
+      driver: local

__swarm/gotify/.env

@@ -0,0 +1,3 @@
+APPNAME=gotify
+DOCKER_REGISTRY=r.sectorq.eu/library/
+CLIENT_TOKEN=CowKqc8UU5Xn-EA

__swarm/gotify/docker-compose copy.yml

@@ -0,0 +1,22 @@
+name: gotify
+services:
+    server:
+        ports:
+            - 8010:80
+        environment:
+            - TZ=Europe/Berlin
+            - GOTIFY_DEFAULTUSER_PASS='admin'
+        volumes:
+            - /share/docker_data/gotify/data:/app/data
+        image: ${DOCKER_REGISTRY:-}gotify/server
+        labels:
+          - com.centurylinklabs.watchtower.enable=true
+          - homepage.group=Utilities
+          - homepage.name=Gotify
+          - homepage.weight=1
+          - homepage.icon=gotify.png
+          - homepage.href=https://gotify.sectorq.eu
+          - homepage.description=Notification Server
+          - homepage.widget.type=gotify
+          - homepage.widget.url=https://gotify.sectorq.eu
+          - homepage.widget.key=C3Fy8AQym_sc1zS

__swarm/gotify/docker-compose.yml

@@ -0,0 +1,46 @@
+version: '3.8'
+
+services:
+  gotify:
+    container_name: gotify
+    hostname: gotify
+    image: gotify/server
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - net
+    ports:
+      - "8680:80"
+    volumes:
+      - data:/app/data
+    environment:
+      GOTIFY_DEFAULTUSER_PASS:  'l4c1j4yd33Du5lo'   # Change me!!!!!
+
+
+  igotify:
+    container_name: igotify
+    hostname: igotify
+    image: ghcr.io/androidseb25/igotify-notification-assist:latest
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    pull_policy: always
+    networks:
+      - net
+    ports:
+      - "8681:8080"
+    volumes:
+      - api-data:/app/data
+    environment:                 # option environment see above note
+      GOTIFY_URLS: 'https://gotify.sectorq.eu'
+      GOTIFY_CLIENT_TOKENS: ${CLIENT_TOKEN}
+      SECNTFY_TOKENS: 'NTFY-DEVICE-nmE8MaAk1PX9wCRSkqKatiKzD4LCvDTENi3LTPwcn5cckXtkwQQ'
+      GOTIFY_DEFAULTUSER_PASS:  'l4c1j4yd33Du5lo' 
+
+networks:
+  net:
+
+volumes:
+  data:
+  api-data:

__swarm/gotify/stack.env

@@ -0,0 +1,4 @@
+GOTIFY_URLS=https://gotify.sectorq.eu
+GOTIFY_CLIENT_TOKENS=CfYatBoIszgIr07
+SECNTFY_TOKENS=NTFY-DEVICE-CIrIeIoagAdUFwI8uOZlo6Qd9b3OF1x1NSpdns6mlImvzb4X0kI
+GOTIFY_DEFAULTUSER_PASS=l4c1j4yd33Du5lo

__swarm/grafana/.env

@@ -0,0 +1,2 @@
+APPNAME=grafana
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/grafana/docker-compose.yml

@@ -0,0 +1,88 @@
+name: grafana
+networks:
+  loki: null
+services:
+  grafana:
+    container_name: grafana
+    entrypoint:
+    - sh
+    - -euc
+    - "mkdir -p /etc/grafana/provisioning/datasources\ncat <<EOF > /etc/grafana/provisioning/datasources/ds.yaml\n\
+      apiVersion: 1\ndatasources:\n- name: Loki\n  type: loki\n  access: proxy\n \
+      \ orgId: 1\n  url: http://loki:3100\n  basicAuth: false\n  isDefault: true\n\
+      \  version: 1\n  editable: false\nEOF\n/run.sh\n"
+    environment:
+      GF_AUTH_GENERIC_OAUTH_API_URL: https://auth.sectorq.eu/application/o/userinfo/
+      GF_AUTH_GENERIC_OAUTH_AUTH_URL: https://auth.sectorq.eu/application/o/authorize/
+      GF_AUTH_GENERIC_OAUTH_CLIENT_ID: xc8AKsYOvHFmYnRjfnvt2YfgR5pg8Mlfc9YEqd3T
+      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: gb5ThPlyIUN2I8UPvIKAqQBoGFmTAb7tFxt5OiJQkAG6Ef2HDKksNOjWPJFfXiO22RuCnWuyzl6IMqPYO6QTa55EYfoN5N87enh5MOhTXjo2JTTnEL1eZhEI1Sw1vBO8
+      GF_AUTH_GENERIC_OAUTH_ENABLED: 'true'
+      GF_AUTH_GENERIC_OAUTH_NAME: authentik
+      GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: contains(groups, 'Grafana Admins')
+        && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'
+      GF_AUTH_GENERIC_OAUTH_SCOPES: openid profile email
+      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: https://auth.sectorq.eu/application/o/token/
+      GF_AUTH_OAUTH_AUTO_LOGIN: 'true'
+      GF_AUTH_SIGNOUT_REDIRECT_URL: https://auth.sectorq.eu/application/o/grafana/end-session/
+      GF_INSTALL_PLUGINS: https://storage.googleapis.com/integration-artifacts/alexanderzobnin-zabbix-app/4.5.7/main/163fabf651b776bf70adc08fa41bec4f52645374/alexanderzobnin-zabbix-app-4.5.7%2B163fabf6.linux_amd64.zip;alexanderzobnin-zabbix-app
+      GF_LOG_FILTERS: rendering:debug
+      GF_RENDERING_CALLBACK_URL: http://grafana:3000/
+      GF_RENDERING_SERVER_URL: http://renderer:8092/render
+      GF_SERVER_ROOT_URL: https://g.sectorq.eu/
+    image: ${DOCKER_REGISTRY:-}grafana/grafana:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: grafana
+      homepage.description: Graphs
+      homepage.group: Smarthome
+      homepage.href: https://g.sectorq.eu
+      homepage.icon: grafana.png
+      homepage.name: Grafana
+      homepage.server: my-docker
+      homepage.weight: '1'
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - loki
+    ports:
+    - 3007:3000
+    restart: ${RESTART:-unless-stopped}
+    user: 0:0
+    volumes:
+    - /share/docker_data/grafana/data:/var/lib/grafana
+    - /share/docker_data/grafana/certs:/certs
+  loki:
+    command: -config.file=/etc/loki/local-config.yaml
+    image: ${DOCKER_REGISTRY:-}grafana/loki:latest
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - loki
+    ports:
+      - 3100:3100
+    restart: ${RESTART:-unless-stopped}
+  promtail:
+    command: -config.file=/etc/promtail/config.yml
+    image: ${DOCKER_REGISTRY:-}grafana/promtail:latest
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - loki
+    volumes:
+      - /var/log:/var/log
+      - /share/docker_data/grafana/promtail/config.yml:/etc/promtail/config.yml
+      - /share/Data/__GITLAB/omv_backup/:/share/Data/__GITLAB/omv_backup/
+    restart: ${RESTART:-unless-stopped}
+  renderer:
+    image: ${DOCKER_REGISTRY:-}grafana/grafana-image-renderer:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      wud.watch: true
+      wud.watch.digest: true
+    ports:
+    - 8092
+    networks:
+    - loki
+    restart: ${RESTART:-unless-stopped}

__swarm/grafana/grafana-swarm.yml

@@ -0,0 +1,120 @@
+networks:
+  loki:
+volumes:
+  loki_data:
+  grafana_data:
+  grafana_certs:
+services:
+  grafana:
+    entrypoint:
+    - sh
+    - -euc
+    - "mkdir -p /etc/grafana/provisioning/datasources\ncat <<EOF > /etc/grafana/provisioning/datasources/ds.yaml\n\
+      apiVersion: 1\ndatasources:\n- name: Loki\n  type: loki\n  access: proxy\n \
+      \ orgId: 1\n  url: http://loki:3100\n  basicAuth: false\n  isDefault: true\n\
+      \  version: 1\n  editable: false\nEOF\n/run.sh\n"
+    environment:
+      GF_AUTH_GENERIC_OAUTH_API_URL: https://auth.sectorq.eu/application/o/userinfo/
+      GF_AUTH_GENERIC_OAUTH_AUTH_URL: https://auth.sectorq.eu/application/o/authorize/
+      GF_AUTH_GENERIC_OAUTH_CLIENT_ID: xc8AKsYOvHFmYnRjfnvt2YfgR5pg8Mlfc9YEqd3T
+      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: gb5ThPlyIUN2I8UPvIKAqQBoGFmTAb7tFxt5OiJQkAG6Ef2HDKksNOjWPJFfXiO22RuCnWuyzl6IMqPYO6QTa55EYfoN5N87enh5MOhTXjo2JTTnEL1eZhEI1Sw1vBO8
+      GF_AUTH_GENERIC_OAUTH_ENABLED: 'true'
+      GF_AUTH_GENERIC_OAUTH_NAME: authentik
+      GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: contains(groups, 'Grafana Admins')
+        && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'
+      GF_AUTH_GENERIC_OAUTH_SCOPES: openid profile email
+      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: https://auth.sectorq.eu/application/o/token/
+      GF_AUTH_OAUTH_AUTO_LOGIN: 'true'
+      GF_AUTH_SIGNOUT_REDIRECT_URL: https://auth.sectorq.eu/application/o/grafana/end-session/
+      GF_INSTALL_PLUGINS: https://storage.googleapis.com/integration-artifacts/alexanderzobnin-zabbix-app/4.5.7/main/163fabf651b776bf70adc08fa41bec4f52645374/alexanderzobnin-zabbix-app-4.5.7%2B163fabf6.linux_amd64.zip;alexanderzobnin-zabbix-app
+      GF_LOG_FILTERS: rendering:debug
+      GF_RENDERING_CALLBACK_URL: http://grafana:3000/
+      GF_RENDERING_SERVER_URL: http://renderer:8092/render
+      GF_SERVER_ROOT_URL: https://g.sectorq.eu/
+    image: ${DOCKER_REGISTRY:-}grafana/grafana:latest
+    networks:
+    - loki
+    ports:
+    - target: 3000
+      published: 3007
+      protocol: tcp
+      mode: ingress
+    user: 0:0
+    volumes:
+    - grafana_data:/var/lib/grafana
+    - grafana_certs:/certs
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: grafana_grafana
+        homepage.description: Graphs
+        homepage.group: Smarthome
+        homepage.href: https://g.sectorq.eu
+        homepage.icon: grafana.png
+        homepage.name: Grafana
+        homepage.server: my-docker-swarm
+        homepage.weight: '1'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  loki:
+    command: -config.file=/etc/loki/local-config.yaml
+    image: ${DOCKER_REGISTRY:-}grafana/loki:latest
+    volumes:
+    - loki_data:/loki
+    networks:
+    - loki
+    ports:
+    - target: 3100
+      published: 3100
+      protocol: tcp
+      mode: ingress
+    deploy:
+      labels:
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  promtail:
+    command: -config.file=/etc/promtail/config.yml
+    image: ${DOCKER_REGISTRY:-}grafana/promtail:latest
+    networks:
+    - loki
+    configs:
+      - source: promtail
+        target: /etc/promtail/config.yml
+    volumes:
+    - /var/log:/var/log
+    #- /share/docker_data/grafana/promtail/config.yml:/etc/promtail/config.yml
+    #- /share/Data/__GITLAB/omv_backup/:/share/Data/__GITLAB/omv_backup/
+    deploy:
+      labels:
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  renderer:
+    image: ${DOCKER_REGISTRY:-}grafana/grafana-image-renderer:latest
+    ports:
+    - 8092
+    networks:
+    - loki
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+configs:
+  promtail:
+    external: true

__swarm/hashicorp/hashicorp-swarm.yml

@@ -0,0 +1,47 @@
+services:
+  vault:
+    image: hashicorp/vault:latest
+    command: server -config=/vault/config/vault.hcl
+    volumes:
+      - data:/vault/data
+    configs:
+      - source: vault_hcl
+        target: /vault/config/vault.hcl
+    ports:
+      - "8200:8200"
+    environment:
+      VAULT_LOCAL_CONFIG: |
+        {
+          "backend": {
+            "file": {
+              "path": "/vault/file"
+            }
+          },
+          "listener": {
+            "tcp": {
+              "address": "0.0.0.0:8200",
+              "tls_disable": 1
+            }
+          },
+          "disable_mlock": true
+        }
+      VAULT_API_ADDR: "http://192.168.77.101:8200"
+    cap_add:
+      - IPC_LOCK
+    networks:
+      - vault-net
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+
+configs:
+  vault_hcl:
+    external: true
+volumes:
+  data:
+networks:
+  vault-net:
+    driver: overlay

__swarm/home-assistant-swarm.yml

@@ -0,0 +1,230 @@
+version: '3.9'
+services:
+  homeassistant:
+    network_mode: host
+    image: ${DOCKER_REGISTRY:-}ghcr.io/home-assistant/home-assistant:latest
+    volumes:
+    - /share/docker_data/ha/:/config
+    - /var/run/docker.sock:/var/run/docker.sock
+    - /run/dbus:/run/dbus:ro
+    privileged: true
+    environment:
+    - DISABLE_JEMALLOC=value
+    - TZ=Europe/Bratislava
+    dns:
+    - 192.168.77.101
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      labels:
+        com.centurylinklabs.watchtower.enable: true
+        homepage.group: Smarthome
+        homepage.name: Home Assistant
+        homepage.weight: 1
+        homepage.icon: home-assistant.png
+        homepage.href: https://ha.sectorq.eu
+        homepage.description: 3D Printing
+        homepage.server: my-docker
+        homepage.container: HomeAssistant
+        homepage.widget.type: homeassistant
+        homepage.widget.url: https://ha.sectorq.eu
+        homepage.widget.key: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiIzOTk5NGJjYjIzYjk0YzExYmM5OWZiNTBlNzU0N2M2YyIsImlhdCI6MTc0MDM5OTY4NCwiZXhwIjoyMDU1NzU5Njg0fQ.LDebvPGreyZzlWT1CylHSdSt8i_cWO72HnNCsCAIaG8
+        wud.watch: true
+        wud.watch.digest: true
+      placement:
+        constraints:
+        - node.role == manager
+  esphome:
+    image: ${DOCKER_REGISTRY:-}esphome/esphome:latest
+    volumes:
+    - /share/docker_data/esphome/config:/config
+    - /etc/localtime:/etc/localtime:ro
+    privileged: true
+    network_mode: host
+    environment:
+    - USERNAME=jaydee
+    - PASSWORD=jaydee1
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      labels:
+        com.centurylinklabs.watchtower.enable: true
+        homepage.group: Smarthome
+        homepage.name: ESPHome
+        homepage.weight: 1
+        homepage.icon: esphome.png
+        homepage.href: https://esphome.sectorq.eu
+        homepage.description: 3D Printing
+        homepage.server: my-docker
+        homepage.container: esphome
+        homepage.widget.type: esphome
+        homepage.widget.url: https://esphome.sectorq.eu
+        homepage.widget.username: jaydee
+        homepage.widget.password: jaydee1
+        wud.watch: true
+        wud.watch.digest: true
+      placement:
+        constraints:
+        - node.role == manager
+  wyoming-piper-en:
+    image: ${DOCKER_REGISTRY:-}rhasspy/wyoming-piper
+    ports:
+    - 10200:10200
+    volumes:
+    - /share/docker_data/piper/english:/data
+    command: --data-dir /data --voice en_US-lessac-medium
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      labels:
+        com.centurylinklabs.watchtower.enable: true
+        wud.watch: true
+        wud.watch.digest: true
+      placement:
+        constraints:
+        - node.role == manager
+  wyoming-whisper-en:
+    image: ${DOCKER_REGISTRY:-}rhasspy/wyoming-whisper
+    ports:
+    - 10300:10300
+    volumes:
+    - /share/docker_data/whisper/english:/data
+    command: --data-dir /data --model tiny-int8 --language en
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      labels:
+        com.centurylinklabs.watchtower.enable: true
+        wud.watch: true
+        wud.watch.digest: true
+      placement:
+        constraints:
+        - node.role == manager
+  openwakeword:
+    image: ${DOCKER_REGISTRY:-}rhasspy/wyoming-openwakeword:latest
+    command: --preload-model 'ok_nabu' --custom-model-dir /custom --model 'ok nabu'
+      --model 'ok_nabu' --uri 'tcp://0.0.0.0:10400' --threshold 0.7 --trigger-level
+      2 --debug
+    volumes:
+    - /share/docker_data/openwakeword-data:/data
+    - /share/docker_data/openwakeword-data:/custom
+    environment:
+    - TZ=Europe/Bratislava
+    ports:
+    - 10400:10400
+    - 10400:10400/udp
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      labels:
+        com.centurylinklabs.watchtower.enable: true
+        wud.watch: true
+        wud.watch.digest: true
+      placement:
+        constraints:
+        - node.role == manager
+  matter-server:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/home-assistant-libs/python-matter-server:stable
+    security_opt:
+    - apparmor=unconfined
+    volumes:
+    - /share/docker_data/matter-server:/data
+    - /run/dbus:/run/dbus:ro
+    network_mode: host
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      labels:
+        com.centurylinklabs.watchtower.enable: true
+        wud.watch: true
+        wud.watch.digest: true
+      placement:
+        constraints:
+        - node.role == manager
+  music-assistant-server:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/music-assistant/server:latest
+    network_mode: host
+    volumes:
+    - /share/docker_data/music-assistant-server/data:/data/
+    cap_add:
+    - SYS_ADMIN
+    - DAC_READ_SEARCH
+    security_opt:
+    - apparmor:unconfined
+    environment:
+    - LOG_LEVEL=info
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      labels:
+        com.centurylinklabs.watchtower.enable: true
+        wud.watch: true
+        wud.watch.digest: true
+        homepage.group: Smarthome
+        homepage.name: music-assistant
+        homepage.weight: 1
+        homepage.icon: music-assistant.png
+        homepage.href: https://music.sectorq.eu
+        homepage.description: Music
+        homepage.server: my-docker
+        homepage.container: music-assistant-server
+      placement:
+        constraints:
+        - node.role == manager
+  influxdb:
+    ports:
+    - 8086:8086
+    volumes:
+    - /share/docker_data/influxdb/data:/var/lib/influxdb2
+    - /share/docker_data/influxdb/config:/etc/influxdb2
+    secrets:
+    - influxdb2-admin-username
+    - influxdb2-admin-password
+    - influxdb2-admin-token
+    environment:
+    - DOCKER_INFLUXDB_INIT_MODE=setup
+    - DOCKER_INFLUXDB_INIT_USERNAME=ha
+    - DOCKER_INFLUXDB_INIT_PASSWORD=haHAhaHA
+    - DOCKER_INFLUXDB_INIT_ORG=ha
+    - DOCKER_INFLUXDB_INIT_BUCKET=ha
+    - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN=mytoken123
+    - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE=/run/secrets/influxdb2-admin-token
+    image: ${DOCKER_REGISTRY:-}influxdb:2
+    healthcheck:
+      test: echo  test > /var/lib/influxdb2/hc || exit 1
+      interval: 10s
+      timeout: 3s
+      retries: 2
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      labels:
+        com.centurylinklabs.watchtower.enable: true
+        wud.watch: true
+        wud.watch.digest: true
+      placement:
+        constraints:
+        - node.role == manager
+secrets:
+  influxdb2-admin-username:
+    file: .env.influxdb2-admin-username
+  influxdb2-admin-password:
+    file: .env.influxdb2-admin-password
+  influxdb2-admin-token:
+    file: .env.influxdb2-admin-token

__swarm/home-assistant/.env

@@ -0,0 +1,3 @@
+APPNAME=home-assistant
+DOCKER_REGISTRY=r.sectorq.eu/library/
+RESTART=always

__swarm/home-assistant/docker-compose.yml

@@ -168,18 +168,32 @@ services:
       com.centurylinklabs.watchtower.enable: true
       wud.watch: true
       wud.watch.digest: true
+      homepage.group: Smarthome
+      homepage.name: music-assistant
+      homepage.weight: 1
+      homepage.icon: music-assistant.png
+      homepage.href: https://music.sectorq.eu
+      homepage.description: Music
+      homepage.server: my-docker
+      homepage.container: music-assistant-server
   influxdb:
     ports:
       - 8086:8086
     volumes:
       - /share/docker_data/influxdb/data:/var/lib/influxdb2
       - /share/docker_data/influxdb/config:/etc/influxdb2
+    secrets:
+      - influxdb2-admin-username
+      - influxdb2-admin-password
+      - influxdb2-admin-token
     environment:
       - DOCKER_INFLUXDB_INIT_MODE=setup
       - DOCKER_INFLUXDB_INIT_USERNAME=ha
       - DOCKER_INFLUXDB_INIT_PASSWORD=haHAhaHA
       - DOCKER_INFLUXDB_INIT_ORG=ha
       - DOCKER_INFLUXDB_INIT_BUCKET=ha
+      - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN=mytoken123
+      - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE=/run/secrets/influxdb2-admin-token
     image: ${DOCKER_REGISTRY:-}influxdb:2
     restart: ${RESTART:-unless-stopped}
     healthcheck:
@@ -190,4 +204,11 @@ services:
     labels:
       com.centurylinklabs.watchtower.enable: true
       wud.watch: true
-      wud.watch.digest: true
+      wud.watch.digest: true
+secrets:
+  influxdb2-admin-username:
+    file: .env.influxdb2-admin-username
+  influxdb2-admin-password:
+    file: .env.influxdb2-admin-password
+  influxdb2-admin-token:
+    file: .env.influxdb2-admin-token      

__swarm/home-assistant/home-assistant-swarm.yml

@@ -0,0 +1,225 @@
+
+
+services:
+  homeassistant:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/home-assistant/home-assistant:latest
+    volumes:
+    - ha_config:/config
+    - /var/run/docker.sock:/var/run/docker.sock
+    - /run/dbus:/run/dbus:ro
+    networks:
+      - swarm-ipvlan 
+      - traefik-public
+      - homeassistant-internal
+    privileged: true
+    environment:
+      DISABLE_JEMALLOC: value
+      TZ: Europe/Bratislava
+    dns:
+    - 192.168.77.101
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.group: Smarthome
+        homepage.name: Home Assistant
+        homepage.weight: '1'
+        homepage.icon: home-assistant.png
+        homepage.href: https://ha.sectorq.eu
+        homepage.description: 3D Printing
+        homepage.server: my-docker-swarm
+        homepage.container: HomeAssistant
+        homepage.widget.type: homeassistant
+        homepage.widget.url: https://ha.sectorq.eu
+        homepage.widget.key: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiIzOTk5NGJjYjIzYjk0YzExYmM5OWZiNTBlNzU0N2M2YyIsImlhdCI6MTc0MDM5OTY4NCwiZXhwIjoyMDU1NzU5Njg0fQ.LDebvPGreyZzlWT1CylHSdSt8i_cWO72HnNCsCAIaG8
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  esphome:
+    image: ${DOCKER_REGISTRY:-}esphome/esphome:latest
+    volumes:
+    - esphome_config:/config
+    - /etc/localtime:/etc/localtime:ro
+    privileged: true
+    network_mode: host
+    environment:
+      USERNAME: jaydee
+      PASSWORD: jaydee1
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.group: Smarthome
+        homepage.name: ESPHome
+        homepage.weight: '1'
+        homepage.icon: esphome.png
+        homepage.href: https://esphome.sectorq.eu
+        homepage.description: 3D Printing
+        homepage.server: my-docker-swarm
+        homepage.container: esphome
+        homepage.widget.type: esphome
+        homepage.widget.url: https://esphome.sectorq.eu
+        homepage.widget.username: jaydee
+        homepage.widget.password: jaydee1
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  wyoming-piper-en:
+    image: ${DOCKER_REGISTRY:-}rhasspy/wyoming-piper
+    ports:
+    - target: 10200
+      published: 10200
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - piper_data:/data
+    command: --data-dir /data --voice en_US-lessac-medium
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  wyoming-whisper-en:
+    image: ${DOCKER_REGISTRY:-}rhasspy/wyoming-whisper
+    ports:
+    - target: 10300
+      published: 10300
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - whisper_data:/data
+    command: --data-dir /data --model tiny-int8 --language en
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  openwakeword:
+    image: ${DOCKER_REGISTRY:-}rhasspy/wyoming-openwakeword:latest
+    command: --preload-model 'ok_nabu' --custom-model-dir /custom --model 'ok nabu'
+      --model 'ok_nabu' --uri 'tcp://0.0.0.0:10400' --threshold 0.7 --trigger-level
+      2 --debug
+    volumes:
+    - openwakeword_data:/data
+    - openwakeword_data:/custom
+    environment:
+      TZ: Europe/Bratislava
+    ports:
+    - target: 10400
+      published: 10400
+      protocol: tcp
+      mode: ingress
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  matter-server:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/home-assistant-libs/python-matter-server:stable
+    security_opt:
+    - apparmor=unconfined
+    volumes:
+    - matter-server:/data
+    - /run/dbus:/run/dbus:ro
+    network_mode: host
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  music-assistant-server:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/music-assistant/server:latest
+    network_mode: host
+    volumes:
+    - music_assistant_server_data:/data/
+    cap_add:
+    - SYS_ADMIN
+    - DAC_READ_SEARCH
+    security_opt:
+    - apparmor:unconfined
+    environment:
+      LOG_LEVEL: info
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+        homepage.group: Smarthome
+        homepage.name: music-assistant
+        homepage.weight: '1'
+        homepage.icon: music-assistant.png
+        homepage.href: https://music.sectorq.eu
+        homepage.description: Music
+        homepage.server: my-docker-swarm
+        homepage.container: music-assistant-server
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  influxdb:
+    ports:
+    - target: 8086
+      published: 8086
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - influxdb2_data:/var/lib/influxdb2
+    - influxdb2_config:/etc/influxdb2
+    secrets:
+    - ha_influxdb2_admin_token
+    environment:
+      DOCKER_INFLUXDB_INIT_MODE: setup
+      DOCKER_INFLUXDB_INIT_USERNAME: ha
+      DOCKER_INFLUXDB_INIT_PASSWORD: haHAhaHA
+      DOCKER_INFLUXDB_INIT_ORG: ha
+      DOCKER_INFLUXDB_INIT_BUCKET: ha
+      #DOCKER_INFLUXDB_INIT_ADMIN_TOKEN: mytoken123
+      DOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE: /run/secrets/ha_influxdb2_admin_token
+    image: ${DOCKER_REGISTRY:-}influxdb:2
+    healthcheck:
+      test: echo  test > /var/lib/influxdb2/hc || exit 1
+      interval: 10s
+      timeout: 3s
+      retries: 2
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  influxdb2_data:
+  influxdb2_config:
+  music_assistant_server_data:
+  matter-server:
+  ha_config:
+  esphome_config:
+  piper_data:
+  whisper_data:
+  openwakeword_data:
+secrets:
+  ha_influxdb2_admin_token:
+    external: true

__swarm/homepage/.env

@@ -0,0 +1,2 @@
+APPNAME=homepage
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/homepage/docker-compose.yml

@@ -0,0 +1,26 @@
+networks:
+  pihole_pihole:
+    external: true
+services:
+  homepage:
+    container_name: homepage
+    dns:
+    - 192.168.78.254
+    environment:
+      HOMEPAGE_ALLOWED_HOSTS: sectorq.eu,active.home.lan:3003,m-server.home.lan:3003,rpi5.home.lan:3003,nas.home.lan:3003,192.168.77.238:3003,rack.home.lan:3003
+      TZ: Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}ghcr.io/gethomepage/homepage:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - pihole_pihole
+    ports:
+    - 3003:3000
+    restart: unless-stopped
+    volumes:
+    - /share/docker_data/homepage/config:/app/config
+    - /var/run/docker.sock:/var/run/docker.sock:ro
+    - /share/docker_data/homepage/images:/app/public/images
+    - /share/docker_data/homepage/icons:/app/public/icons

__swarm/homepage/homepage-swarm.yml

@@ -0,0 +1,35 @@
+services:
+  homepage:
+    dns:
+    - 192.168.77.1
+    - 192.168.77.101
+    environment:
+      HOMEPAGE_ALLOWED_HOSTS: sectorq.eu,active.home.lan:3003,m-server.home.lan:3003,rpi5.home.lan:3003,nas.home.lan:3003,192.168.77.238:3003,rack.home.lan:3003,192.168.80.222:3003
+      TZ: Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}ghcr.io/gethomepage/homepage:latest
+    ports:
+    - target: 3000
+      published: 3003
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - config:/app/config
+    - /var/run/docker.sock:/var/run/docker.sock:ro
+    - images:/app/public/images
+    - icons:/app/public/icons
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  config:
+    driver: local
+  images:
+    driver: local
+  icons:
+    driver: local

__swarm/immich/.env

@@ -0,0 +1,26 @@
+# You can find documentation for all the supported env variables at https://docs.immich.app/install/environment-variables
+
+# The location where your uploaded files are stored
+UPLOAD_LOCATION=/media/nas/qda_1/immich/library
+
+# The location where your database files are stored. Network shares are not supported for the database
+DB_DATA_LOCATION=/share/docker_data/immich/db
+
+# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
+# TZ=Etc/UTC
+
+# The Immich version to use. You can pin this to a specific version like "v1.71.0"
+IMMICH_VERSION=release
+
+# Connection secret for postgres. You should change it to a random password
+# Please use only the characters `A-Za-z0-9`, without special characters or spaces
+DB_PASSWORD=postgres
+
+# The values below this line do not need to be changed
+###################################################################################
+DB_USERNAME=postgres
+DB_DATABASE_NAME=immich
+HW_MODE1=vaapi
+HW_MODE2=openvino
+APPNAME=immich
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/immich/docker-compose copy.yml

@@ -0,0 +1,88 @@
+name: immich
+services:
+  database:
+    command: postgres -c shared_preload_libraries=vectors.so -c 'search_path="$$user",
+      public, vectors' -c logging_collector=on -c max_wal_size=2GB -c shared_buffers=512MB
+      -c wal_compression=on
+    container_name: immich_postgres
+    env_file:
+    - stack.env
+    environment:
+      POSTGRES_INITDB_ARGS: --data-checksums
+    healthcheck:
+      interval: 5m
+      start_interval: 30s
+      start_period: 5m
+      test: pg_isready --dbname="$${DB_PASSWORD}" --username="$${DB_USERNAME}" ||
+        exit 1; Chksum="$$(psql --dbname="$${DB_DATABASE_NAME}" --username="$${DB_USERNAME}"
+        --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures),
+        0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [
+        "$$Chksum" = '0' ] || exit 1
+    image: ${DOCKER_REGISTRY:-}docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/immich/db:/var/lib/postgresql/data
+  immich-machine-learning:
+    container_name: immich_machine_learning
+    env_file:
+    - stack.env
+    extends:
+      file: hwaccel.ml.yml
+      service: ${HW_MODE2:-cpu}
+    healthcheck:
+      disable: false
+    image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - model-cache:/cache
+  immich-server:
+    container_name: immich_server
+    depends_on:
+    - redis
+    - database
+    env_file:
+    - stack.env
+    extends:
+      file: hwaccel.transcoding.yml
+      service: ${HW_MODE1:-cpu}
+    healthcheck:
+      disable: false
+    image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    labels:
+      homepage.container: immich_server
+      homepage.description: Photo server
+      homepage.group: Media
+      homepage.href: https://${APPNAME}.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Immich
+      homepage.server: my-docker
+      homepage.widget.key: wVxjlztA8MpeuzKkNGCSUPK2WjAY55qq4cfs9Zr5opU
+      homepage.widget.type: ${APPNAME}
+      homepage.widget.url: https://${APPNAME}.sectorq.eu
+      homepage.widget.version: '2'
+      wud.watch: true
+      wud.watch.digest: true
+    ports:
+    - 2283:2283
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/immich/library:/usr/src/app/upload
+    - /media/nas/nas-photo:/mnt/photos2
+    - /etc/localtime:/etc/localtime:ro
+  redis:
+    container_name: immich_redis
+    healthcheck:
+      test: redis-cli ping || exit 1
+    image: ${DOCKER_REGISTRY:-}docker.io/redis:6.2-alpine
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+volumes:
+  model-cache: null

__swarm/immich/docker-compose.yml

@@ -0,0 +1,88 @@
+#
+# WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose
+#
+# Make sure to use the docker-compose.yml of the current release:
+#
+# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+#
+# The compose file on main may not be compatible with the latest release.
+
+name: immich
+
+services:
+  immich-server:
+    container_name: immich_server
+    image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    extends:
+      file: hwaccel.transcoding.yml
+      service: ${HW_MODE1:-vaapi} # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
+    volumes:
+      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
+      - ${UPLOAD_LOCATION}:/data
+      - /etc/localtime:/etc/localtime:ro
+      - /media/nas/photo:/mnt/photos2
+    env_file:
+      - .env
+    ports:
+      - '2283:2283'
+    depends_on:
+      - redis
+      - database
+    restart: ${RESTART:-unless-stopped}
+    healthcheck:
+      disable: false
+    labels:
+      homepage.container: immich_server
+      homepage.description: Photo server
+      homepage.group: Media
+      homepage.href: https://${APPNAME}.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Immich
+      homepage.server: my-docker
+      homepage.widget.key: mdaRNyiY19w9YEz3MXT3fiPD9XH3CtQYRM26C0wZJM
+      homepage.widget.type: ${APPNAME}
+      homepage.widget.url: https://${APPNAME}.sectorq.eu
+      homepage.widget.version: '2'
+      wud.watch: true
+      wud.watch.digest: true
+  immich-machine-learning:
+    container_name: immich_machine_learning
+    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
+    # Example tag: ${IMMICH_VERSION:-release}-cuda
+    image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
+    extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
+      file: hwaccel.ml.yml
+      service: ${HW_MODE2:-openvino} # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
+    volumes:
+      - model-cache:/cache
+    env_file:
+      - .env
+    restart: ${RESTART:-unless-stopped}
+    healthcheck:
+      disable: false
+
+  redis:
+    container_name: immich_redis
+    image: ${DOCKER_REGISTRY:-}docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
+    healthcheck:
+      test: redis-cli ping || exit 1
+    restart: ${RESTART:-unless-stopped}
+
+  database:
+    container_name: immich_postgres
+    image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_USER: ${DB_USERNAME}
+      POSTGRES_DB: ${DB_DATABASE_NAME}
+      POSTGRES_INITDB_ARGS: '--data-checksums'
+      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
+      # DB_STORAGE_TYPE: 'HDD'
+    volumes:
+      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
+      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
+    shm_size: 128mb
+    restart: ${RESTART:-unless-stopped}
+
+volumes:
+  model-cache:

__swarm/immich/hwaccel.ml.yml

@@ -0,0 +1,43 @@
+# Configurations for hardware-accelerated machine learning
+
+# If using Unraid or another platform that doesn't allow multiple Compose files,
+# you can inline the config for a backend by copying its contents
+# into the immich-machine-learning service in the docker-compose.yml file.
+
+# See https://immich.app/docs/features/ml-hardware-acceleration for info on usage.
+
+services:
+  armnn:
+    devices:
+      - /dev/mali0:/dev/mali0
+    volumes:
+      - /lib/firmware/mali_csffw.bin:/lib/firmware/mali_csffw.bin:ro # Mali firmware for your chipset (not always required depending on the driver)
+      - /usr/lib/libmali.so:/usr/lib/libmali.so:ro # Mali driver for your chipset (always required)
+
+  cpu: {}
+
+  cuda:
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: 1
+              capabilities:
+                - gpu
+
+  openvino:
+    device_cgroup_rules:
+      - 'c 189:* rmw'
+    devices:
+      - /dev/dri:/dev/dri
+    volumes:
+      - /dev/bus/usb:/dev/bus/usb
+
+  openvino-wsl:
+    devices:
+      - /dev/dri:/dev/dri
+      - /dev/dxg:/dev/dxg
+    volumes:
+      - /dev/bus/usb:/dev/bus/usb
+      - /usr/lib/wsl:/usr/lib/wsl

__swarm/immich/hwaccel.transcoding.yml

@@ -0,0 +1,57 @@
+# Configurations for hardware-accelerated transcoding
+
+# If using Unraid or another platform that doesn't allow multiple Compose files,
+# you can inline the config for a backend by copying its contents
+# into the immich-microservices service in the docker-compose.yml file.
+
+# See https://immich.app/docs/features/hardware-transcoding for more info on using hardware transcoding.
+
+services:
+  cpu: {}
+
+  nvenc:
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: 1
+              capabilities:
+                - gpu
+                - compute
+                - video
+
+  quicksync:
+    devices:
+      - /dev/dri:/dev/dri
+
+  rkmpp:
+    security_opt: # enables full access to /sys and /proc, still far better than privileged: true
+      - systempaths=unconfined
+      - apparmor=unconfined
+    group_add:
+      - video
+    devices:
+      - /dev/rga:/dev/rga
+      - /dev/dri:/dev/dri
+      - /dev/dma_heap:/dev/dma_heap
+      - /dev/mpp_service:/dev/mpp_service
+      #- /dev/mali0:/dev/mali0 # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
+    volumes:
+      #- /etc/OpenCL:/etc/OpenCL:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
+      #- /usr/lib/aarch64-linux-gnu/libmali.so.1:/usr/lib/aarch64-linux-gnu/libmali.so.1:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
+
+  vaapi:
+    devices:
+      - /dev/dri:/dev/dri
+    group_add:
+      - video
+      - 993
+  vaapi-wsl: # use this for VAAPI if you're running Immich in WSL2
+    devices:
+      - /dev/dri:/dev/dri
+      - /dev/dxg:/dev/dxg
+    volumes:
+      - /usr/lib/wsl:/usr/lib/wsl
+    environment:
+      - LIBVA_DRIVER_NAME=d3d12

__swarm/immich/immich-swarm.yml

@@ -0,0 +1,85 @@
+services:
+  server:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    # devices:
+    #   - /dev/dri:/dev/dri
+    # group_add:
+    #   - video
+    #   - 993
+    volumes:
+    - ${UPLOAD_LOCATION}:/data
+    - /etc/localtime:/etc/localtime:ro
+    - /media/nas/photo:/mnt/photos2
+    env_file:
+    - .env
+    ports:
+    - target: 2283
+      published: 2283
+      protocol: tcp
+      mode: ingress
+    healthcheck:
+      disable: false
+    deploy:
+      labels:
+        homepage.container: immich_server
+        homepage.description: Photo server
+        homepage.group: Media
+        homepage.href: https://${APPNAME}.sectorq.eu
+        homepage.icon: ${APPNAME}.png
+        homepage.name: Immich
+        homepage.server: my-docker-swarm
+        homepage.widget.key: mdaRNyiY19w9YEz3MXT3fiPD9XH3CtQYRM26C0wZJM
+        homepage.widget.type: ${APPNAME}
+        homepage.widget.url: https://${APPNAME}.sectorq.eu
+        homepage.widget.version: '2'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  machine-learning:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
+    # device_cgroup_rules:
+    #   - 'c 189:* rmw'
+    # devices:
+    #   - /dev/dri:/dev/dri
+    volumes:
+    - model-cache:/cache
+    - /dev/bus/usb:/dev/bus/usb
+    env_file:
+    - .env
+    healthcheck:
+      disable: false
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  redis:
+    image: ${DOCKER_REGISTRY:-}docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
+    healthcheck:
+      test: redis-cli ping || exit 1
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  database:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_USER: ${DB_USERNAME}
+      POSTGRES_DB: ${DB_DATABASE_NAME}
+      POSTGRES_INITDB_ARGS: --data-checksums
+    volumes:
+    - db:/var/lib/postgresql/data
+    shm_size: 128mb
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  model-cache: null
+  db: null

__swarm/immich/stack.env

@@ -0,0 +1,25 @@
+# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables
+
+# The location where your uploaded files are stored
+UPLOAD_LOCATION=/media/nas/qda_1/immich/library
+#UPLOAD_LOCATION=/share/docker_data/immich/library
+# The location where your database files are stored
+DB_DATA_LOCATION=/share/docker_data/immich/db
+
+# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
+# TZ=Etc/UTC
+TZ=Europe/Bratislava
+# The Immich version to use. You can pin this to a specific version like "v1.71.0"
+IMMICH_VERSION=release
+
+# Connection secret for postgres. You should change it to a random password
+# Please use only the characters `A-Za-z0-9`, without special characters or spaces
+DB_PASSWORD=postgres
+
+# The values below this line do not need to be changed
+###################################################################################
+DB_USERNAME=postgres
+DB_DATABASE_NAME=immich
+POSTGRES_PASSWORD=postgres
+APPNAME=immich
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/influxdb/.env

@@ -0,0 +1,3 @@
+APPNAME=influxdb
+DOCKER_REGISTRY=r.sectorq.eu/library/
+RESTART=always

__swarm/influxdb/.env.influxdb2-admin-password

@@ -0,0 +1 @@
+ha

__swarm/influxdb/.env.influxdb2-admin-token

@@ -0,0 +1 @@
+l4c1j4yd33Du5lo

__swarm/influxdb/.env.influxdb2-admin-username

@@ -0,0 +1 @@
+ha

__swarm/influxdb/docker-compose.yml

@@ -0,0 +1,37 @@
+version: '3'
+services:
+  influxdb:
+    ports:
+      - 8087:8086
+    volumes:
+      - /share/docker_data/influxdb2/data:/var/lib/influxdb2
+      - /share/docker_data/influxdb2/config:/etc/influxdb2
+    secrets:
+      - influxdb2-admin-username
+      - influxdb2-admin-password
+      - influxdb2-admin-token
+    environment:
+      - DOCKER_INFLUXDB_INIT_MODE=setup
+      - DOCKER_INFLUXDB_INIT_USERNAME=ha
+      - DOCKER_INFLUXDB_INIT_PASSWORD=haHAhaHA
+      - DOCKER_INFLUXDB_INIT_ORG=ha
+      - DOCKER_INFLUXDB_INIT_BUCKET=ha
+      - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE=/run/secrets/influxdb2-admin-token
+    image: ${DOCKER_REGISTRY:-}influxdb:2
+    restart: ${RESTART:-unless-stopped}
+    healthcheck:
+      test: "echo  test > /var/lib/influxdb2/hc || exit 1"
+      interval: 10s
+      timeout: 3s
+      retries: 2
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      wud.watch: true
+      wud.watch.digest: true
+secrets:
+  influxdb2-admin-username:
+    file: .env.influxdb2-admin-username
+  influxdb2-admin-password:
+    file: .env.influxdb2-admin-password
+  influxdb2-admin-token:
+    file: .env.influxdb2-admin-token      

__swarm/influxdb/influxdb-swarm.yml

@@ -0,0 +1,37 @@
+services:
+  influxdb:
+    ports:
+    - target: 8086
+      published: 8087
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - data:/var/lib/influxdb2
+    - config:/etc/influxdb2
+    secrets:
+    - influxdb2-admin-token
+    environment:
+      DOCKER_INFLUXDB_INIT_MODE: setup
+      DOCKER_INFLUXDB_INIT_USERNAME: ha
+      DOCKER_INFLUXDB_INIT_PASSWORD: haHAhaHA
+      DOCKER_INFLUXDB_INIT_ORG: ha
+      DOCKER_INFLUXDB_INIT_BUCKET: ha
+      DOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE: /run/secrets/influxdb2-admin-token
+    image: ${DOCKER_REGISTRY:-}influxdb:2
+    healthcheck:
+      test: echo  test > /var/lib/influxdb2/hc || exit 1
+      interval: 10s
+      timeout: 3s
+      retries: 2
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+secrets:
+  influxdb2-admin-token:
+    external: true
+volumes:
+  data:
+  config:

__swarm/jupyter/jupyter-swarm.yml

@@ -0,0 +1,27 @@
+services:
+  base-notebook:
+    ports:
+    - target: 8888
+      published: 8888
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - data:/home/jovyan/work
+    image: ${DOCKER_REGISTRY:-}jupyter/base-notebook:latest
+    deploy:
+      labels:
+        homepage.container: jupyter_base-notebook
+        homepage.description: Python server
+        homepage.group: Utils
+        homepage.href: http://m-server.home.lan:8888/
+        homepage.icon: ${APPNAME}.png
+        homepage.name: Jupyter Notebook
+        homepage.server: my-docker-swarm
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  data:

__swarm/kestra/.env

@@ -0,0 +1,2 @@
+APPNAME=kestra
+PASSWORD=l4c1j4yd33Du5lo

__swarm/kestra/docker-compose.yml

@@ -0,0 +1,89 @@
+services:
+  kestra:
+    command: server standalone --worker-thread=128
+    depends_on:
+      postgres:
+        condition: service_started
+    environment:
+      SECRET_MYPASSWORD: bDRjMWo0eWQzM0R1NWxv
+      SECRET_GITLAB: Z2xwYXQtdWotbi1lRWZUWTM5OFBFNHZLU1M=
+      KESTRA_CONFIGURATION: |
+        datasources:
+          postgres:
+            url: jdbc:postgresql://postgres:5432/kestra
+            driverClassName: org.postgresql.Driver
+            username: kestra
+            password: k3str4
+        kestra:
+          server:
+            basicAuth:
+              enabled: false
+              username: "jaydee@sectorq.eu" # it must be a valid email address
+              password: ${PASSWORD}
+          repository:
+            type: postgres
+          storage:
+            type: local
+            local:
+              basePath: "/app/storage"
+          queue:
+            type: postgres
+          tasks:
+            tmpDir:
+              path: /tmp/kestra-wd/tmp
+          url: http://localhost:8080/
+          tutorial-flows:
+            enabled: false
+        micronaut:
+          server:
+            cors:
+              enabled: true
+
+    image: ${DOCKER_REGISTRY:-}kestra/kestra:${KESTRA_VERSION:-latest}
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: kestra-kestra-1
+      homepage.description: Automation
+      homepage.group: Infrastructure
+      homepage.href: https://${APPNAME}.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Kestra
+      homepage.server: my-docker
+      homepage.weight: '1'
+      wud.display.icon: mdi:evernote
+      wud.watch: true
+      wud.watch.digest: true
+    ports:
+    - 8980:8080
+    - 8981:8081
+    pull_policy: always
+    restart: ${RESTART:-unless-stopped}
+    user: root
+    volumes:
+    - /etc/localtime:/etc/localtime:ro
+    - /share/docker_data/kestra/kestra-data:/app/storage
+    - /var/run/docker.sock:/var/run/docker.sock
+    - /tmp/kestra-wd:/tmp/kestra-wd
+  postgres:
+    environment:
+      POSTGRES_DB: kestra
+      POSTGRES_PASSWORD: k3str4
+      POSTGRES_USER: kestra
+    healthcheck:
+      interval: 30s
+      retries: 10
+      test:
+      - CMD-SHELL
+      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 10s
+    image: ${DOCKER_REGISTRY:-}postgres:16
+    labels:
+      wud.watch: false
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/kestra/postgres-data:/var/lib/postgresql/data
+volumes:
+  kestra-data:
+    driver: local
+  postgres-data:
+    driver: local

__swarm/kestra/kestra-swarm.yml

@@ -0,0 +1,98 @@
+services:
+  kestra:
+    command: server standalone --worker-thread=128
+    environment:
+      SECRET_MYPASSWORD: bDRjMWo0eWQzM0R1NWxv
+      SECRET_GITLAB: Z2xwYXQtdWotbi1lRWZUWTM5OFBFNHZLU1M=
+      KESTRA_CONFIGURATION: |
+        datasources:
+          postgres:
+            url: jdbc:postgresql://postgres:5432/kestra
+            driverClassName: org.postgresql.Driver
+            username: kestra
+            password: k3str4
+        kestra:
+          server:
+            basicAuth:
+              enabled: false
+              username: "jaydee@sectorq.eu" # it must be a valid email address
+              password: ${PASSWORD}
+          repository:
+            type: postgres
+          storage:
+            type: local
+            local:
+              basePath: "/app/storage"
+          queue:
+            type: postgres
+          tasks:
+            tmpDir:
+              path: /tmp/kestra-wd/tmp
+          url: http://localhost:8080/
+          tutorial-flows:
+            enabled: false
+        micronaut:
+          server:
+            cors:
+              enabled: true
+    image: ${DOCKER_REGISTRY:-}kestra/kestra:${KESTRA_VERSION:-latest}
+    ports:
+    - target: 8080
+      published: 8980
+      protocol: tcp
+      mode: ingress
+    - target: 8081
+      published: 8981
+      protocol: tcp
+      mode: ingress
+    user: root
+    volumes:
+    - /etc/localtime:/etc/localtime:ro
+    - data:/app/storage
+    - /var/run/docker.sock:/var/run/docker.sock
+    - /tmp/kestra-wd:/tmp/kestra-wd
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: kestra_kestra
+        homepage.description: Automation
+        homepage.group: Infrastructure
+        homepage.href: https://${APPNAME}.sectorq.eu
+        homepage.icon: ${APPNAME}.png
+        homepage.name: Kestra
+        homepage.server: my-docker-swarm
+        homepage.weight: '1'
+        wud.display.icon: mdi:evernote
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  postgres:
+    environment:
+      POSTGRES_DB: kestra
+      POSTGRES_PASSWORD: k3str4
+      POSTGRES_USER: kestra
+    healthcheck:
+      interval: 30s
+      retries: 10
+      test:
+      - CMD-SHELL
+      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 10s
+    image: ${DOCKER_REGISTRY:-}postgres:16
+    volumes:
+    -  db:/var/lib/postgresql/data
+    deploy:
+      labels:
+        wud.watch: 'false'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  data:
+    driver: local
+  db:
+    driver: local

__swarm/kestra/stack.env

@@ -0,0 +1 @@
+APPNAME=kestra

__swarm/mailu/.env

@@ -0,0 +1,4 @@
+APPNAME=mailu
+DOCKER_REGISTRY=r.sectorq.eu/library/
+MAILU_VERSION=2024.06
+LOGGING=syslog

__swarm/mailu/docker-compose.yml

@@ -0,0 +1,247 @@
+networks:
+  clamav:
+    driver: bridge
+  default:
+    driver: bridge
+    ipam:
+      config:
+      - subnet: 192.168.205.0/24
+      driver: default
+  fts_attachments:
+    driver: bridge
+    internal: true
+  oletools:
+    driver: bridge
+    internal: true
+  radicale:
+    driver: bridge
+  webmail:
+    driver: bridge
+services:
+  admin:
+    depends_on:
+      - redis
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/data:/data
+      - /share/docker_data/mailu3/dkim:/dkim
+  antispam:
+    depends_on:
+      - front
+      - redis
+      - oletools
+      - antivirus
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    hostname: antispam
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - default
+      - oletools
+      - clamav
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/filter:/var/lib/rspamd
+      - /share/docker_data/mailu3/overrides/rspamd:/overrides:ro
+  antivirus:
+    healthcheck:
+      interval: 10s
+      retries: 3
+      start_period: 10s
+      test:
+        - CMD-SHELL
+        - kill -0 `cat /tmp/clamd.pid` && kill -0 `cat /tmp/freshclam.pid`
+      timeout: 5s
+    image: ${DOCKER_REGISTRY:-}clamav/clamav-debian:1.2.0-6
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - clamav
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/filter/clamav:/var/lib/clamav
+  fetchmail:
+    depends_on:
+      - admin
+      - smtp
+      - imap
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}fetchmail:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/mailu3/data/fetchmail:/data
+  front:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    extends:
+      file: logging.yml
+      service: ${LOGGING:-syslog}
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+      homepage.container: mailu3-front-1
+      homepage.description: eMail server
+      homepage.group: Utilities
+      homepage.href: https://mail.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Mailu
+      homepage.server: my-docker
+      homepage.weight: 1
+
+    networks:
+      - default
+      - webmail
+      - radicale
+    ports:
+      - 0.0.0.0:8880:80
+      - 0.0.0.0:8443:443
+      - 0.0.0.0:25:25
+      - 0.0.0.0:465:465
+      - 0.0.0.0:587:587
+      - 0.0.0.0:110:110
+      - 0.0.0.0:995:995
+      - 0.0.0.0:143:143
+      - 0.0.0.0:993:993
+      - 0.0.0.0:4190:4190
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/certs:/certs
+      - /share/docker_data/mailu3/overrides/nginx:/overrides:ro
+  fts_attachments:
+    depends_on:
+     - resolver
+    dns:
+      - 192.168.205.254
+    healthcheck:
+      interval: 10s
+      retries: 3
+      start_period: 10s
+      test:
+        - CMD-SHELL
+        - wget -nv -t1 -O /dev/null http://127.0.0.1:9998/tika || exit 1
+      timeout: 5s
+    hostname: tika
+    image: ${DOCKER_REGISTRY:-}apache/tika:2.9.2.1-full
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - fts_attachments
+    restart: ${RESTART:-unless-stopped}
+  imap:
+    depends_on:
+      - front
+      - fts_attachments
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - default
+      - fts_attachments
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/mail:/mail
+      - /share/docker_data/mailu3/overrides/dovecot:/overrides:ro
+  oletools:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    hostname: oletools
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}oletools:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - oletools
+    restart: ${RESTART:-unless-stopped}
+  redis:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    image: ${DOCKER_REGISTRY:-}redis:alpine
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: unless-stopped
+    volumes:
+    - /share/docker_data/mailu3/redis:/data
+  resolver:
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      default:
+        ipv4_address: 192.168.205.254
+    restart: ${RESTART:-unless-stopped}
+  smtp:
+    depends_on:
+      - front
+      - resolver
+    dns:
+     - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+     - /share/docker_data/mailu3/mailqueue:/queue
+     - /share/docker_data/mailu3/overrides/postfix:/overrides:ro
+  webdav:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}radicale:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - radicale
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/dav:/data
+  webmail:
+    depends_on:
+      - front
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}webmail:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - webmail
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/webmail:/data
+      - /share/docker_data/mailu3/overrides/roundcube:/overrides:ro

__swarm/mailu/logging.yml

@@ -0,0 +1,18 @@
+---
+services:
+  syslog:
+    logging:
+      driver: syslog
+      options:
+        tag: mailu-front
+  journald:
+    logging:
+      driver: journald
+      options:
+        tag: mailu-front
+  loki:
+    logging:
+      driver: loki
+      options:
+        loki-url: "http://192.168.77.101:3100/loki/api/v1/push"
+

__swarm/mailu/stack.env

@@ -0,0 +1,167 @@
+# Mailu main configuration file
+#
+# This file is autogenerated by the configuration management wizard for compose flavor.
+# For a detailed list of configuration variables, see the documentation at
+# https://mailu.io
+
+###################################
+# Common configuration variables
+###################################
+
+# Set to a randomly generated 16 bytes string
+SECRET_KEY=T1GSGDDBVRYF7UR7
+
+# Subnet of the docker network. This should not conflict with any networks to which your system is connected. (Internal and external!)
+SUBNET=192.168.205.0/24
+
+# Main mail domain
+DOMAIN=mail.sectorq.eu
+
+# Hostnames for this server, separated with commas
+HOSTNAMES=mail.sectorq.eu,sectorq.eu
+
+# Postmaster local part (will append the main mail domain)
+POSTMASTER=admin
+
+# Choose how secure connections will behave (value: letsencrypt, cert, notls, mail, mail-letsencrypt)
+#TLS_FLAVOR=cert
+TLS_FLAVOR=letsencrypt
+# Authentication rate limit per IP (per /24 on ipv4 and /48 on ipv6)
+AUTH_RATELIMIT_IP=5/hour
+
+# Authentication rate limit per user (regardless of the source-IP)
+AUTH_RATELIMIT_USER=50/day
+
+# Opt-out of statistics, replace with "True" to opt out
+DISABLE_STATISTICS=True
+
+###################################
+# Optional features
+###################################
+
+# Expose the admin interface (value: true, false)
+ADMIN=true
+
+# Choose which webmail to run if any (values: roundcube, snappymail, none). To enable this feature, recreate the docker-compose.yml file via setup.
+WEBMAIL=roundcube
+
+# Expose the API interface (value: true, false)
+API=true
+
+# Dav server implementation (value: radicale, none). To enable this feature, recreate the docker-compose.yml file via setup.
+WEBDAV=radicale
+
+# Antivirus solution (value: clamav, none). To enable this feature, recreate the docker-compose.yml file via setup.
+ANTIVIRUS=clamav
+
+# Scan Macros solution (value: true, false). To enable this feature, recreate the docker-compose.yml file via setup.
+SCAN_MACROS=true
+
+###################################
+# Mail settings
+###################################
+
+# Message size limit in bytes
+# Default: accept messages up to 50MB
+# Max attachment size will be 33% smaller
+MESSAGE_SIZE_LIMIT=50000000
+
+# Message rate limit (per user)
+MESSAGE_RATELIMIT=200/day
+
+# Networks granted relay permissions
+# Use this with care, all hosts in this networks will be able to send mail without authentication!
+RELAYNETS=
+
+# Will relay all outgoing mails if configured
+RELAYHOST=
+
+# Enable fetchmail
+FETCHMAIL_ENABLED=true
+
+# Fetchmail delay
+FETCHMAIL_DELAY=600
+
+# Recipient delimiter, character used to delimiter localpart from custom address part
+RECIPIENT_DELIMITER=+
+
+# DMARC rua and ruf email
+DMARC_RUA=admin
+DMARC_RUF=admin
+
+# Welcome email, enable and set a topic and body if you wish to send welcome
+# emails to all users.
+WELCOME=false
+WELCOME_SUBJECT=Welcome to your new email account
+WELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!
+
+# Maildir Compression
+# choose compression-method, default: none (value: gz, bz2, zstd)
+COMPRESSION=
+# change compression-level, default: 6 (value: 1-9)
+COMPRESSION_LEVEL=
+
+# IMAP full-text search is enabled by default.
+# Set the following variable to off in order to disable the feature
+# or a comma separated list of language codes to support
+FULL_TEXT_SEARCH=en
+
+###################################
+# Web settings
+###################################
+
+# Path to redirect / to
+WEBROOT_REDIRECT=/webmail
+
+# Path to the admin interface if enabled
+WEB_ADMIN=/admin
+
+# Path to the webmail if enabled
+WEB_WEBMAIL=/webmail
+
+# Path to the API interface if enabled
+WEB_API=/api
+
+# Website name
+SITENAME=sectorq
+
+# Linked Website URL
+WEBSITE=https://mail.sectorq.eu
+
+
+
+###################################
+# Advanced settings
+###################################
+
+# Docker-compose project name, this will prepended to containers names.
+COMPOSE_PROJECT_NAME=mailu
+
+# Number of rounds used by the password hashing scheme
+CREDENTIAL_ROUNDS=12
+
+# Header to take the real ip from
+REAL_IP_HEADER=X-Real-IP
+
+# IPs for nginx set_real_ip_from (CIDR list separated by commas)
+REAL_IP_FROM=192.168.77.101
+
+# choose wether mailu bounces (no) or rejects (yes) mail when recipient is unknown (value: yes, no)
+REJECT_UNLISTED_RECIPIENT=
+
+# Log level threshold in start.py (value: CRITICAL, ERROR, WARNING, INFO, DEBUG, NOTSET)
+LOG_LEVEL=INFO
+
+# Timezone for the Mailu containers. See this link for all possible values https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+TZ=EU/Bratislava
+
+# Default spam threshold used for new users
+DEFAULT_SPAM_THRESHOLD=80
+
+# API token required for authenticating to the RESTful API.
+# This is a mandatory setting for using the RESTful API.
+API_TOKEN=WM4QHB7FA6YBOQHC0M98CGM2LDG2OP4N
+
+# Whether tika should be enabled (scan/OCR email attachements). To enable this feature, recreate the docker-compose.yml file via setup.
+FULL_TEXT_SEARCH_ATTACHMENTS=true
+LD_PRELOAD=/usr/lib/libhardened_malloc.so

__swarm/mailu3/.env

@@ -0,0 +1,4 @@
+APPNAME=mailu
+DOCKER_REGISTRY=r.sectorq.eu/library/
+MAILU_VERSION=2024.06
+LOGGING=syslog

__swarm/mailu3/docker-compose.yml

@@ -0,0 +1,247 @@
+networks:
+  clamav:
+    driver: bridge
+  default:
+    driver: bridge
+    ipam:
+      config:
+      - subnet: 192.168.205.0/24
+      driver: default
+  fts_attachments:
+    driver: bridge
+    internal: true
+  oletools:
+    driver: bridge
+    internal: true
+  radicale:
+    driver: bridge
+  webmail:
+    driver: bridge
+services:
+  admin:
+    depends_on:
+      - redis
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/data:/data
+      - /share/docker_data/mailu3/dkim:/dkim
+  antispam:
+    depends_on:
+      - front
+      - redis
+      - oletools
+      - antivirus
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    hostname: antispam
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - default
+      - oletools
+      - clamav
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/filter:/var/lib/rspamd
+      - /share/docker_data/mailu3/overrides/rspamd:/overrides:ro
+  antivirus:
+    healthcheck:
+      interval: 10s
+      retries: 3
+      start_period: 10s
+      test:
+        - CMD-SHELL
+        - kill -0 `cat /tmp/clamd.pid` && kill -0 `cat /tmp/freshclam.pid`
+      timeout: 5s
+    image: ${DOCKER_REGISTRY:-}clamav/clamav-debian:1.2.0-6
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - clamav
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/filter/clamav:/var/lib/clamav
+  fetchmail:
+    depends_on:
+      - admin
+      - smtp
+      - imap
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}fetchmail:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/mailu3/data/fetchmail:/data
+  front:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    extends:
+      file: logging.yml
+      service: ${LOGGING:-syslog}
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+      homepage.container: mailu3-front-1
+      homepage.description: eMail server
+      homepage.group: Utilities
+      homepage.href: https://mail.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Mailu
+      homepage.server: my-docker
+      homepage.weight: 1
+
+    networks:
+      - default
+      - webmail
+      - radicale
+    ports:
+      - '8880:80'
+      - '8443:443'
+      - '25:25'
+      - '465:465'
+      - '587:587'
+      - '110:110' 
+      - '995:995'
+      - '143:143'
+      - '993:993'
+      - '4190:4190'
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/certs:/certs
+      - /share/docker_data/mailu3/overrides/nginx:/overrides:ro
+  fts_attachments:
+    depends_on:
+     - resolver
+    dns:
+      - 192.168.205.254
+    healthcheck:
+      interval: 10s
+      retries: 3
+      start_period: 10s
+      test:
+        - CMD-SHELL
+        - wget -nv -t1 -O /dev/null http://127.0.0.1:9998/tika || exit 1
+      timeout: 5s
+    hostname: tika
+    image: ${DOCKER_REGISTRY:-}apache/tika:2.9.2.1-full
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - fts_attachments
+    restart: ${RESTART:-unless-stopped}
+  imap:
+    depends_on:
+      - front
+      - fts_attachments
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - default
+      - fts_attachments
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/mail:/mail
+      - /share/docker_data/mailu3/overrides/dovecot:/overrides:ro
+  oletools:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    hostname: oletools
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}oletools:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - oletools
+    restart: ${RESTART:-unless-stopped}
+  redis:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    image: ${DOCKER_REGISTRY:-}redis:alpine
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: unless-stopped
+    volumes:
+    - /share/docker_data/mailu3/redis:/data
+  resolver:
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      default:
+        ipv4_address: 192.168.205.254
+    restart: ${RESTART:-unless-stopped}
+  smtp:
+    depends_on:
+      - front
+      - resolver
+    dns:
+     - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+     - /share/docker_data/mailu3/mailqueue:/queue
+     - /share/docker_data/mailu3/overrides/postfix:/overrides:ro
+  webdav:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}radicale:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - radicale
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/dav:/data
+  webmail:
+    depends_on:
+      - front
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}webmail:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - webmail
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/webmail:/data
+      - /share/docker_data/mailu3/overrides/roundcube:/overrides:ro

__swarm/mailu3/logging.yml

@@ -0,0 +1,18 @@
+---
+services:
+  syslog:
+    logging:
+      driver: syslog
+      options:
+        tag: mailu-front
+  journald:
+    logging:
+      driver: journald
+      options:
+        tag: mailu-front
+  loki:
+    logging:
+      driver: loki
+      options:
+        loki-url: "http://192.168.77.101:3100/loki/api/v1/push"
+

__swarm/mailu3/mailu3-swarm.yml

@@ -0,0 +1,259 @@
+networks:
+  clamav:
+    driver: overlay
+  default:
+    driver: overlay
+    ipam:
+      config:
+        - subnet: 192.168.205.0/24
+      driver: default
+  fts_attachments:
+    driver: overlay
+    internal: true
+  oletools:
+    driver: overlay
+    internal: true
+  radicale:
+    driver: overlay
+  webmail:
+    driver: overlay
+
+services:
+  admin:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-2024.06}
+    env_file: stack.env
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    volumes:
+      - /share/docker_data/mailu3/data:/data
+      - /share/docker_data/mailu3/dkim:/dkim
+    networks:
+      # Swarm uses service discovery, but requires network connection
+      - default
+      # DNS is handled by Swarm's internal DNS resolver (the resolver service will be discoverable by name)
+  
+  antispam:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-2024.06}
+    env_file: stack.env
+    hostname: antispam
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    volumes:
+      - /share/docker_data/mailu3/filter:/var/lib/rspamd
+      - /share/docker_data/mailu3/overrides/rspamd:/overrides:ro
+    networks:
+      - default
+      - oletools
+      - clamav
+
+  antivirus:
+    image: ${DOCKER_REGISTRY:-}clamav/clamav-debian:1.2.0-6
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    volumes:
+      - /share/docker_data/mailu3/filter/clamav:/var/lib/clamav
+    networks:
+      - clamav
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - kill -0 `cat /tmp/clamd.pid` && kill -0 `cat /tmp/freshclam.pid`
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  fetchmail:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}fetchmail:${MAILU_VERSION:-2024.06}
+    env_file: stack.env
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    volumes:
+      - /share/docker_data/mailu3/data/fetchmail:/data
+    networks:
+      - default # Connect to 'default' for service discovery
+
+
+  front:
+    # NOTE: 'extends' is removed. You must manually define logging or accept default.
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-2024.06}
+    env_file: stack.env
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+      homepage.container: mailu3-front-1
+      homepage.description: eMail server
+      homepage.group: Utilities
+      homepage.href: https://mail.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Mailu
+      homepage.server: my-docker
+      homepage.weight: 1
+    volumes:
+      - /share/docker_data/mailu3/certs:/certs
+      - /share/docker_data/mailu3/overrides/nginx:/overrides:ro
+    networks:
+      - default
+      - webmail
+      - radicale
+    ports:
+      - target: 80
+        published: 8880
+        protocol: tcp
+        mode: ingress
+      - target: 443
+        published: 8443
+        protocol: tcp
+        mode: ingress
+      - target: 25
+        published: 25
+        protocol: tcp
+        mode: ingress
+      - target: 465
+        published: 465
+        protocol: tcp
+        mode: ingress
+      - target: 587
+        published: 587
+        protocol: tcp
+        mode: ingress
+      - target: 110
+        published: 110
+        protocol: tcp
+        mode: ingress
+      - target: 995
+        published: 995
+        protocol: tcp
+        mode: ingress
+      - target: 143
+        published: 143
+        protocol: tcp
+        mode: ingress
+      - target: 993
+        published: 993
+        protocol: tcp
+        mode: ingress
+      - target: 4190
+        published: 4190
+        protocol: tcp
+        mode: ingress
+
+
+  fts_attachments:
+    image: ${DOCKER_REGISTRY:-}apache/tika:2.9.2.1-full
+    hostname: tika
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    networks:
+      - fts_attachments
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - wget -nv -t1 -O /dev/null http://127.0.0.1:9998/tika || exit 1
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+
+  imap:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-2024.06}
+    env_file: stack.env
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    volumes:
+      - /share/docker_data/mailu3/mail:/mail
+      - /share/docker_data/mailu3/overrides/dovecot:/overrides:ro
+    networks:
+      - default
+      - fts_attachments
+
+
+  oletools:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}oletools:${MAILU_VERSION:-2024.06}
+    hostname: oletools
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    networks:
+      - oletools
+
+
+  redis:
+    image: ${DOCKER_REGISTRY:-}redis:alpine
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    volumes:
+      - /share/docker_data/mailu3/redis:/data
+    networks:
+      - default # Connect to default network
+
+
+  resolver:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-2024.06}
+    env_file: stack.env
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    networks:
+      default:
+        # NOTE: Swarm does not support static IPs for scaling. 
+        # This will fail standard 'docker stack deploy'. 
+        # For mailu, the static IP is critical, so we attempt to enforce it 
+        # via the deploy key, but be aware this is highly non-standard.
+        # It's better to configure Mailu to use the service name 'resolver' instead of the static IP.
+        # If using a customized deployer:
+        # deploy:
+        #   placement:
+        #     constraints:
+        #       - node.hostname == your-swarm-manager
+        #   endpoint_mode: dnsrr
+        #   mode: global
+        #   replicas: 1
+        #   labels:
+        #     com.docker.stack.static_ips: 192.168.205.254
+        #     com.docker.stack.static_network: default
+        ipv4_address: 192.168.205.254
+
+
+  smtp:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-2024.06}
+    env_file: stack.env
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    volumes:
+      - /share/docker_data/mailu3/mailqueue:/queue
+      - /share/docker_data/mailu3/overrides/postfix:/overrides:ro
+    networks:
+      - default # Connect to default network
+
+  webdav:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}radicale:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    volumes:
+      - /share/docker_data/mailu3/dav:/data
+    networks:
+      - radicale
+
+
+  webmail:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}webmail:${MAILU_VERSION:-2024.06}
+    env_file: stack.env
+    labels:
+      wud.watch: 'true'
+      wud.watch.digest: 'true'
+    volumes:
+      - /share/docker_data/mailu3/webmail:/data
+      - /share/docker_data/mailu3/overrides/roundcube:/overrides:ro
+    networks:
+      - webmail

__swarm/mailu3/stack.env

@@ -0,0 +1,167 @@
+# Mailu main configuration file
+#
+# This file is autogenerated by the configuration management wizard for compose flavor.
+# For a detailed list of configuration variables, see the documentation at
+# https://mailu.io
+
+###################################
+# Common configuration variables
+###################################
+
+# Set to a randomly generated 16 bytes string
+SECRET_KEY=T1GSGDDBVRYF7UR7
+
+# Subnet of the docker network. This should not conflict with any networks to which your system is connected. (Internal and external!)
+SUBNET=192.168.205.0/24
+
+# Main mail domain
+DOMAIN=mail.sectorq.eu
+
+# Hostnames for this server, separated with commas
+HOSTNAMES=mail.sectorq.eu,sectorq.eu
+
+# Postmaster local part (will append the main mail domain)
+POSTMASTER=admin
+
+# Choose how secure connections will behave (value: letsencrypt, cert, notls, mail, mail-letsencrypt)
+#TLS_FLAVOR=cert
+TLS_FLAVOR=letsencrypt
+# Authentication rate limit per IP (per /24 on ipv4 and /48 on ipv6)
+AUTH_RATELIMIT_IP=5/hour
+
+# Authentication rate limit per user (regardless of the source-IP)
+AUTH_RATELIMIT_USER=50/day
+
+# Opt-out of statistics, replace with "True" to opt out
+DISABLE_STATISTICS=True
+
+###################################
+# Optional features
+###################################
+
+# Expose the admin interface (value: true, false)
+ADMIN=true
+
+# Choose which webmail to run if any (values: roundcube, snappymail, none). To enable this feature, recreate the docker-compose.yml file via setup.
+WEBMAIL=roundcube
+
+# Expose the API interface (value: true, false)
+API=true
+
+# Dav server implementation (value: radicale, none). To enable this feature, recreate the docker-compose.yml file via setup.
+WEBDAV=radicale
+
+# Antivirus solution (value: clamav, none). To enable this feature, recreate the docker-compose.yml file via setup.
+ANTIVIRUS=clamav
+
+# Scan Macros solution (value: true, false). To enable this feature, recreate the docker-compose.yml file via setup.
+SCAN_MACROS=true
+
+###################################
+# Mail settings
+###################################
+
+# Message size limit in bytes
+# Default: accept messages up to 50MB
+# Max attachment size will be 33% smaller
+MESSAGE_SIZE_LIMIT=50000000
+
+# Message rate limit (per user)
+MESSAGE_RATELIMIT=200/day
+
+# Networks granted relay permissions
+# Use this with care, all hosts in this networks will be able to send mail without authentication!
+RELAYNETS=
+
+# Will relay all outgoing mails if configured
+RELAYHOST=
+
+# Enable fetchmail
+FETCHMAIL_ENABLED=true
+
+# Fetchmail delay
+FETCHMAIL_DELAY=600
+
+# Recipient delimiter, character used to delimiter localpart from custom address part
+RECIPIENT_DELIMITER=+
+
+# DMARC rua and ruf email
+DMARC_RUA=admin
+DMARC_RUF=admin
+
+# Welcome email, enable and set a topic and body if you wish to send welcome
+# emails to all users.
+WELCOME=false
+WELCOME_SUBJECT=Welcome to your new email account
+WELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!
+
+# Maildir Compression
+# choose compression-method, default: none (value: gz, bz2, zstd)
+COMPRESSION=
+# change compression-level, default: 6 (value: 1-9)
+COMPRESSION_LEVEL=
+
+# IMAP full-text search is enabled by default.
+# Set the following variable to off in order to disable the feature
+# or a comma separated list of language codes to support
+FULL_TEXT_SEARCH=en
+
+###################################
+# Web settings
+###################################
+
+# Path to redirect / to
+WEBROOT_REDIRECT=/webmail
+
+# Path to the admin interface if enabled
+WEB_ADMIN=/admin
+
+# Path to the webmail if enabled
+WEB_WEBMAIL=/webmail
+
+# Path to the API interface if enabled
+WEB_API=/api
+
+# Website name
+SITENAME=sectorq
+
+# Linked Website URL
+WEBSITE=https://mail.sectorq.eu
+
+
+
+###################################
+# Advanced settings
+###################################
+
+# Docker-compose project name, this will prepended to containers names.
+COMPOSE_PROJECT_NAME=mailu
+
+# Number of rounds used by the password hashing scheme
+CREDENTIAL_ROUNDS=12
+
+# Header to take the real ip from
+REAL_IP_HEADER=X-Real-IP
+
+# IPs for nginx set_real_ip_from (CIDR list separated by commas)
+REAL_IP_FROM=192.168.77.101
+
+# choose wether mailu bounces (no) or rejects (yes) mail when recipient is unknown (value: yes, no)
+REJECT_UNLISTED_RECIPIENT=
+
+# Log level threshold in start.py (value: CRITICAL, ERROR, WARNING, INFO, DEBUG, NOTSET)
+LOG_LEVEL=INFO
+
+# Timezone for the Mailu containers. See this link for all possible values https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+TZ=EU/Bratislava
+
+# Default spam threshold used for new users
+DEFAULT_SPAM_THRESHOLD=80
+
+# API token required for authenticating to the RESTful API.
+# This is a mandatory setting for using the RESTful API.
+API_TOKEN=WM4QHB7FA6YBOQHC0M98CGM2LDG2OP4N
+
+# Whether tika should be enabled (scan/OCR email attachements). To enable this feature, recreate the docker-compose.yml file via setup.
+FULL_TEXT_SEARCH_ATTACHMENTS=true
+LD_PRELOAD=/usr/lib/libhardened_malloc.so

__swarm/mealie/.env

@@ -0,0 +1,4 @@
+RESTART=always
+DOCKER_REGISTRY=r.sectorq.eu/library/
+APPNAME=mealie
+

__swarm/mealie/docker-compose.yml

@@ -0,0 +1,42 @@
+services:
+  mealie:
+    image: ${DOCKER_REGISTRY}ghcr.io/mealie-recipes/mealie:v2.8.0 # 
+    container_name: mealie
+    restart: always
+    ports:
+        - "9925:9000" # 
+    deploy:
+      resources:
+        limits:
+          memory: 1000M # 
+    volumes:
+      - /share/docker_data/mealie/data:/app/data/
+    environment:
+      # Set Backend ENV Variables Here
+      ALLOW_SIGNUP: "false"
+      PUID: 1000
+      PGID: 1000
+      TZ: Europe/Bratislava
+      BASE_URL: https://mealie.sectorq.eu
+      OIDC_AUTH_ENABLED: true
+      OIDC_PROVIDER_NAME: authentik
+      OIDC_CONFIGURATION_URL: https://auth.sectorq.eu/application/o/mealie/.well-known/openid-configuration
+      OIDC_CLIENT_ID: "QfrrMn3EzUqkb3ueFl8UQe983qCxr50O2eScPZ3b"
+      OIDC_CLIENT_SECRET: "SN5QQJzEZO6kFbyZJ4JcaUbev1CH3VDFfyfB0oeJXo23r0Wx74xpfLS3OMAvoRW8QFxpaYwsRm492MHtZIHaofwf29yhjADHA2DABPecSGAm8V6JVU8m4HRSF3NjDyTV"
+      OIDC_SIGNUP_ENABLED: true
+      OIDC_USER_GROUP: mealie-users
+      OIDC_ADMIN_GROUP: mealie-admins
+      OIDC_AUTO_REDIRECT: true   # Optional: The login page will be bypassed and you will be sent directly to your Identity Provider.
+      OIDC_REMEMBER_ME: true
+    labels:      
+      homepage.container: mealie
+      homepage.description: Recipe server
+      homepage.group: Utils
+      homepage.href: https://${APPNAME}.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Mealie
+      homepage.server: my-docker
+      wud.watch: true
+      wud.watch.digest: true     
+volumes:
+  mealie-data:

__swarm/mealie/mealie-swarm.yml

@@ -0,0 +1,46 @@
+services:
+  app:
+    image: ${DOCKER_REGISTRY}ghcr.io/mealie-recipes/mealie:v2.8.0
+    ports:
+    - target: 9000
+      published: 9925
+      protocol: tcp
+      mode: ingress
+    deploy:
+      resources:
+        limits:
+          memory: 1000M
+      labels:
+        homepage.container: mealie_app
+        homepage.description: Recipe server
+        homepage.group: Utils
+        homepage.href: https://${APPNAME}.sectorq.eu
+        homepage.icon: ${APPNAME}.png
+        homepage.name: Mealie
+        homepage.server: my-docker-swarm
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+    volumes:
+    - data:/app/data/
+    environment:
+      ALLOW_SIGNUP: 'false'
+      PUID: 1000
+      PGID: 1000
+      TZ: Europe/Bratislava
+      BASE_URL: https://mealie.sectorq.eu
+      OIDC_AUTH_ENABLED: 'true'
+      OIDC_PROVIDER_NAME: authentik
+      OIDC_CONFIGURATION_URL: https://auth.sectorq.eu/application/o/mealie/.well-known/openid-configuration
+      OIDC_CLIENT_ID: QfrrMn3EzUqkb3ueFl8UQe983qCxr50O2eScPZ3b
+      OIDC_CLIENT_SECRET: SN5QQJzEZO6kFbyZJ4JcaUbev1CH3VDFfyfB0oeJXo23r0Wx74xpfLS3OMAvoRW8QFxpaYwsRm492MHtZIHaofwf29yhjADHA2DABPecSGAm8V6JVU8m4HRSF3NjDyTV
+      OIDC_SIGNUP_ENABLED: 'true'
+      OIDC_USER_GROUP: mealie-users
+      OIDC_ADMIN_GROUP: mealie-admins
+      OIDC_AUTO_REDIRECT: 'true'
+      OIDC_REMEMBER_ME: 'true'
+volumes:
+  data:

__swarm/mealie/stack.env

@@ -0,0 +1,37 @@
+###############################################################################
+# Paperless-ngx settings                                                      #
+###############################################################################
+
+# See http://docs.paperless-ngx.com/configuration/ for all available options.
+
+# The UID and GID of the user used to run paperless in the container. Set this
+# to your UID and GID on the host so that you have write access to the
+# consumption directory.
+#USERMAP_UID=1000
+#USERMAP_GID=1000
+
+# See the documentation linked above for all options. A few commonly adjusted settings
+# are provided below.
+
+# This is required if you will be exposing Paperless-ngx on a public domain
+# (if doing so please consider security measures such as reverse proxy)
+#PAPERLESS_URL=https://paperless.example.com
+
+# Adjust this key if you plan to make paperless available publicly. It should
+# be a very long sequence of random characters. You don't need to remember it.
+#PAPERLESS_SECRET_KEY=change-me
+
+# Use this variable to set a timezone for the Paperless Docker containers. Defaults to UTC.
+#PAPERLESS_TIME_ZONE=America/Los_Angeles
+
+# The default language to use for OCR. Set this to the language most of your
+# documents are written in.
+#PAPERLESS_OCR_LANGUAGE=eng
+
+# Additional languages to install for text recognition, separated by a whitespace.
+# Note that this is different from PAPERLESS_OCR_LANGUAGE (default=eng), which defines
+# the language used for OCR.
+# The container installs English, German, Italian, Spanish and French by default.
+# See https://packages.debian.org/search?keywords=tesseract-ocr-&searchon=names&suite=buster
+# for available languages.
+#PAPERLESS_OCR_LANGUAGES=tur ces

__swarm/mediacenter/.env

@@ -0,0 +1,12 @@
+APPNAME=mediacenter
+DOCKER_REGISTRY=r.sectorq.eu/library/
+LOGGING=syslog
+JELLYSEER_TOKEN=MTczMTY1NTk3ODUwOTY3NmJiOTM0LTY1MDctNGI2NS1hMmEyLTE3MjQ1MmI3OTI0Yg==
+JELLYFIN_TOKEN=0b0247d8030b46a0afe71be194311521
+JACKET_TOKEN=l4c1j4yd33Du5lo
+BAZARR_TOKEN=be4265d373929be3672ac813154baf6a
+LIDARR_TOKEN=a9d7379966bd467aa0ad226848575e03
+QBIT_TOKEN=l4c1j4yd33Du5lo
+RADARR_TOKEN=671f20f9518b4ab3a977cc00f95b0427
+SONARR_TOKEN=325b15a81c544ed2a1cd2bb16e95a129
+HW_MODE=cpu

__swarm/mediacenter/docker-compose.yml

@@ -0,0 +1,326 @@
+networks:
+  duplicati:
+    driver: bridge
+  mediarr:
+    driver: bridge
+services:
+  bazarr:
+    container_name: bazarr
+    depends_on:
+      - sonarr
+      - radarr
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Bratislava
+    hostname: bazarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/bazarr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: bazarr
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://bazarr.sectorq.eu
+      homepage.icon: bazarr.png
+      homepage.name: bazarr
+      homepage.server: my-docker
+      homepage.weight: '90'
+      homepage.widget.key: ${BAZARR_TOKEN}
+      homepage.widget.type: bazarr
+      homepage.widget.url: https://bazarr.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - mediarr
+    ports:
+      - 6767:6767
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/bazarr/config:/config
+      - /media/m-server/movies:/movies/m-server
+      - /media/m-server/shows:/tv/m-server
+      - /media/nas/movies:/movies/nas
+      - /media/nas/shows:/tv/nas
+  flaresolverr:
+    container_name: flaresolverr
+    environment:
+    - LOG_LEVEL=info
+    - TZ=Europe/Bratislava
+    hostname: flaresolverr
+    image: ${DOCKER_REGISTRY:-}ghcr.io/flaresolverr/flaresolverr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - mediarr
+    ports:
+      - 8191:8191
+    restart: ${RESTART:-unless-stopped}
+  homarr:
+    container_name: homarr
+    hostname: homarr
+    image: ${DOCKER_REGISTRY:-}ghcr.io/ajnart/homarr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - mediarr
+    ports:
+      - 7575:7575
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /share/docker_data/homarr/configs:/app/data/configs
+      - /share/docker_data/homarr/icons:/app/public/icons
+      - /share/docker_data/homarr/data:/data
+  jackett:
+    container_name: jackett
+    dns:
+      - 192.168.77.101
+    depends_on:
+      - sonarr
+      - radarr
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Bratislava
+      - AUTO_UPDATE=true
+      - RUN_OPTS=
+    hostname: jackett
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/jackett:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: jackett
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://jackett.sectorq.eu
+      homepage.icon: jackett.png
+      homepage.name: Jackett
+      homepage.server: my-docker
+      homepage.weight: '80'
+      homepage.widget.password: ${JACKET_TOKEN}
+      homepage.widget.type: jackett
+      homepage.widget.url: https://jackett.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 9117:9117
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/jackett/config:/config
+    - /share/docker_data/jackett/downloads:/downloads
+  jellyfin:
+    container_name: jellyfin
+    environment:
+    - PUID=1000
+    - PGID=1000
+    - TZ=Europe/Bratislava
+    - JELLYFIN_PublishedServerUrl=https://jf.sectorq.eu
+    extends:
+      file: hwaccel.yml
+      service: ${HW_MODE:-cpu}
+    hostname: jellyfin
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/jellyfin:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: jellyfin
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://jf.sectorq.eu
+      homepage.icon: jellyfin.png
+      homepage.name: Jellyfin
+      homepage.server: my-docker
+      homepage.weight: '10'
+      homepage.widget.key: ${JELLYFIN_TOKEN}
+      homepage.widget.type: jellyfin
+      homepage.widget.url: https://jf.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    network_mode: host
+    ports:
+    - 8096:8096
+    - 8920:8920
+    - 7359:7359
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/jellyfin:/config
+    - /media/m-server/movies:/data/movies/m-server
+    - /media/m-server/music:/data/music/m-server
+    - /media/m-server/shows:/data/shows/m-server
+    - /media/nas/movies:/data/movies/nas
+    - /media/nas/music:/data/music/nas
+    - /media/nas/shows:/data/shows/nas
+    - /media/nas/xxx:/data/xxx/nas
+  jellyseerr:
+    container_name: jellyseerr
+    environment:
+    - LOG_LEVEL=debug
+    - TZ=Europe/Bratislava
+    hostname: jellyseerr
+    image: ${DOCKER_REGISTRY:-}fallenbagel/jellyseerr:latest
+    labels:
+      com.centurylinklabs.watchtower.enabl: 'true'
+      homepage.container: jellyseerr
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://js.sectorq.eu
+      homepage.icon: jellyseerr.png
+      homepage.name: Jellyseerr
+      homepage.server: my-docker
+      homepage.weight: '20'
+      homepage.widget.key: ${JELLYSEER_TOKEN}
+      homepage.widget.type: jellyseerr
+      homepage.widget.url: https://js.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 5055:5055
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/jellyseerr/config:/app/config
+  lidarr:
+    container_name: lidarr
+    environment:
+    - PUID=1000
+    - PGID=1000
+    - TZ=Europe/Bratislava
+    hostname: lidarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/lidarr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: lidarr
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://lidarr.sectorq.eu
+      homepage.icon: lidarr.png
+      homepage.name: Lidarr
+      homepage.server: my-docker
+      homepage.weight: '60'
+      homepage.widget.key: ${LIDARR_TOKEN}
+      homepage.widget.type: lidarr
+      homepage.widget.url: https://lidarr.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 8686:8686
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/lidarr/config:/config
+    - /media/m-server/music:/music
+    - /media/m-server/downloads:/downloads
+  qbittorrent:
+    container_name: qbittorrent
+    environment:
+    - PUID=1000
+    - PGID=1000
+    - TZ=Europe/Bratislava
+    - WEBUI_PORT=8085
+    - FILE__PASSWORD=/run/secrets/mysecretpassword
+    hostname: qbittorrent
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/qbittorrent:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: qbittorrent
+      homepage.description: Subtitles
+      homepage.group: Utilities
+      homepage.href: https://qbit.sectorq.eu
+      homepage.icon: qbittorrent.png
+      homepage.name: Qbittorrent
+      homepage.server: my-docker
+      homepage.weight: '95'
+      homepage.widget.enableLeechProgress: 'true'
+      homepage.widget.password: ${QBIT_TOKEN}
+      homepage.widget.type: qbittorrent
+      homepage.widget.url: https://qbit.sectorq.eu
+      homepage.widget.username: admin
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 8085:8085
+    - 6881:6881
+
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/qbittorrent/config:/config
+    - /media/m-server/downloads:/downloads
+  radarr:
+    container_name: radarr
+    dns:
+    - 192.168.77.101
+    environment:
+    - PUID=1000
+    - PGID=1000
+    - TZ=Europe/Bratislava
+    hostname: radarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/radarr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: radarr
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://radarr.sectorq.eu
+      homepage.icon: radarr.png
+      homepage.name: Radarr
+      homepage.server: my-docker
+      homepage.weight: '20'
+      homepage.widget.key: ${RADARR_TOKEN}
+      homepage.widget.type: radarr
+      homepage.widget.url: https://radarr.sectorq.eu
+      wud.display.icon: mdi:radarr
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 7878:7878
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/radarr/config:/config
+    - /media/m-server/movies/:/movies-m-server
+    - /media/nas/movies/:/movies-nas
+    - /media/m-server/downloads:/downloads
+  sonarr:
+    container_name: sonarr
+    dns:
+      - 192.168.77.101
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Bratislava
+    hostname: sonarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/sonarr:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: sonarr
+      homepage.description: Subtitles
+      homepage.group: Media
+      homepage.href: https://sonarr.sectorq.eu
+      homepage.icon: sonarr.png
+      homepage.name: Sonarr
+      homepage.server: my-docker
+      homepage.weight: '30'
+      homepage.widget.key: ${SONARR_TOKEN}
+      homepage.widget.type: sonarr
+      homepage.widget.url: https://sonarr.sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - mediarr
+    ports:
+    - 8989:8989
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/sonarr/config:/config
+    - /media/m-server/shows:/tv-m-server
+    - /media/nas/shows:/tv-nas
+    - /media/m-server/downloads:/downloads

__swarm/mediacenter/hwaccel.yml

@@ -0,0 +1,8 @@
+---
+services:
+  cpu: {}
+
+  hw:
+    devices:
+      - /dev/dri/renderD128
+      - /dev/dri/card1

__swarm/mediacenter/mediacenter-swarm.yml

@@ -0,0 +1,420 @@
+networks:
+  duplicati:
+    driver: overlay
+  mediarr:
+    driver: overlay
+volumes:
+  homarr_configs:
+  homarr_icons:
+  homarr_data:
+  jackett_config:
+  jackett_downloads:
+  jellyfin_config:
+  jellyseerr_config:
+  lidarr_config:
+  qbittorrent_config:
+  radarr_config:
+  sonarr_config:
+  bazarr_config:
+  m-server_music:
+    driver: local
+    driver_opts:
+      type: nfs
+      o: addr=192.168.77.101,rw,nfsvers=4.1
+      device: :/music
+services:
+  bazarr:
+    environment:
+      PUID: '1000'
+      PGID: '1000'
+      TZ: Europe/Bratislava
+    hostname: bazarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/bazarr:latest
+    networks:
+    - mediarr
+    dns:
+      - 192.168.77.101
+    ports:
+    - target: 6767
+      published: 6767
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - bazarr_config:/config
+    - /media/m-server/movies:/movies/m-server
+    - /media/m-server/shows:/tv/m-server
+    - /media/nas/movies:/movies/nas
+    - /media/nas/shows:/tv/nas
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: mediacenter_bazarr
+        homepage.description: Subtitles
+        homepage.group: Media
+        homepage.href: https://bazarr.sectorq.eu
+        homepage.icon: bazarr.png
+        homepage.name: bazarr
+        homepage.server: my-docker-swarm
+        homepage.weight: '90'
+        homepage.widget.key: ${BAZARR_TOKEN}
+        homepage.widget.type: bazarr
+        homepage.widget.url: https://bazarr.sectorq.eu
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+
+  flaresolverr:
+    environment:
+      LOG_LEVEL: info
+      TZ: Europe/Bratislava
+    hostname: flaresolverr
+    image: ${DOCKER_REGISTRY:-}ghcr.io/flaresolverr/flaresolverr:latest
+    networks:
+    - mediarr
+    ports:
+    - target: 8191
+      published: 8191
+      protocol: tcp
+      mode: ingress
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+
+  homarr:
+    hostname: homarr
+    image: ${DOCKER_REGISTRY:-}ghcr.io/ajnart/homarr:latest
+    networks:
+    - mediarr
+    ports:
+    - target: 7575
+      published: 7575
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
+    - homarr_configs:/app/data/configs
+    - homarr_icons:/app/public/icons
+    - homarr_data:/data
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+
+  jackett:
+    dns:
+    - 192.168.77.101
+    environment:
+      PUID: '1000'
+      PGID: '1000'
+      TZ: Europe/Bratislava
+      AUTO_UPDATE: 'true'
+      RUN_OPTS: ''
+    hostname: jackett
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/jackett:latest
+    networks:
+    - mediarr
+    ports:
+    - target: 9117
+      published: 9117
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - jackett_config:/config
+    - jackett_downloads:/downloads
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: mediacenter_jackett
+        homepage.description: Subtitles
+        homepage.group: Media
+        homepage.href: https://jackett.sectorq.eu
+        homepage.icon: jackett.png
+        homepage.name: Jackett
+        homepage.server: my-docker-swarm
+        homepage.weight: '80'
+        homepage.widget.password: ${JACKET_TOKEN}
+        homepage.widget.type: jackett
+        homepage.widget.url: https://jackett.sectorq.eu
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+
+  jellyfin:
+    environment:
+      TZ: Europe/Bratislava
+      JELLYFIN_PublishedServerUrl: https://jf.sectorq.eu
+      VAAPI_DEVICE: /dev/dri/renderD128
+      LIBVA_DRIVER_NAME: radeonsi
+    hostname: jellyfin
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/jellyfin:latest
+
+    ports:
+    - target: 8096
+      published: 8096
+      protocol: tcp
+      mode: ingress
+    - target: 8920
+      published: 8920
+      protocol: tcp
+      mode: ingress
+    - target: 7359
+      published: 7359
+      protocol: tcp
+      mode: ingress
+    user: root
+    volumes:
+    - jellyfin_config:/config
+    - /media/m-server/movies:/data/movies/m-server
+    - m-server_music:/data/music/m-server
+    - /media/m-server/shows:/data/shows/m-server
+    - /media/nas/movies:/data/movies/nas
+    - /media/nas/music:/data/music/nas
+    - /media/nas/shows:/data/shows/nas
+    - /media/nas/xxx:/data/xxx/nas
+    - /dev/dri:/dev/dri
+    devices:
+      - /dev/dri/renderD128:/dev/dri/renderD128
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: mediacenter_jellyfin
+        homepage.description: Subtitles
+        homepage.group: Media
+        homepage.href: https://jf.sectorq.eu
+        homepage.icon: jellyfin.png
+        homepage.name: Jellyfin
+        homepage.server: my-docker-swarm
+        homepage.weight: '10'
+        homepage.widget.key: ${JELLYFIN_TOKEN}
+        homepage.widget.type: jellyfin
+        homepage.widget.url: https://jf.sectorq.eu
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+        - node.labels.gpu == amd
+
+  jellyseerr:
+    environment:
+      LOG_LEVEL: debug
+      TZ: Europe/Bratislava
+    hostname: jellyseerr
+    image: ${DOCKER_REGISTRY:-}fallenbagel/jellyseerr:latest
+    networks:
+    - mediarr
+    ports:
+    - target: 5055
+      published: 5055
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - jellyseerr_config:/app/config
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enabl: 'true'
+        homepage.container: mediacenter_jellyseerr
+        homepage.description: Subtitles
+        homepage.group: Media
+        homepage.href: https://js.sectorq.eu
+        homepage.icon: jellyseerr.png
+        homepage.name: Jellyseerr
+        homepage.server: my-docker-swarm
+        homepage.weight: '20'
+        homepage.widget.key: ${JELLYSEER_TOKEN}
+        homepage.widget.type: jellyseerr
+        homepage.widget.url: https://js.sectorq.eu
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+
+  lidarr:
+    environment:
+      PUID: '1000'
+      PGID: '1000'
+      TZ: Europe/Bratislava
+    hostname: lidarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/lidarr:latest
+    networks:
+    - mediarr
+    ports:
+    - target: 8686
+      published: 8686
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - lidarr_config:/config
+    - /media/m-server/music:/music
+    - /media/m-server/downloads:/downloads
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: mediacenter_lidarr
+        homepage.description: Subtitles
+        homepage.group: Media
+        homepage.href: https://lidarr.sectorq.eu
+        homepage.icon: lidarr.png
+        homepage.name: Lidarr
+        homepage.server: my-docker-swarm
+        homepage.weight: '60'
+        homepage.widget.key: ${LIDARR_TOKEN}
+        homepage.widget.type: lidarr
+        homepage.widget.url: https://lidarr.sectorq.eu
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+
+  qbittorrent:
+    environment:
+      PUID: '1000'
+      PGID: '1000'
+      TZ: Europe/Bratislava
+      WEBUI_PORT: '8085'
+      FILE__PASSWORD: /run/secrets/mysecretpassword
+    hostname: qbittorrent
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/qbittorrent:latest
+    networks:
+    - mediarr
+    ports:
+    - target: 8085
+      published: 8085
+      protocol: tcp
+      mode: ingress
+    - target: 6881
+      published: 6881
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - qbittorrent_config:/config
+    - /media/m-server/downloads:/downloads
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: mediacenter_qbittorrent
+        homepage.description: Subtitles
+        homepage.group: Utilities
+        homepage.href: https://qbit.sectorq.eu
+        homepage.icon: qbittorrent.png
+        homepage.name: Qbittorrent
+        homepage.server: my-docker-swarm
+        homepage.weight: '95'
+        homepage.widget.enableLeechProgress: 'false'
+        homepage.widget.password: ${QBIT_TOKEN}
+        homepage.widget.type: qbittorrent
+        homepage.widget.url: https://qbit.sectorq.eu
+        homepage.widget.username: admin
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+
+  radarr:
+    dns:
+    - 192.168.77.101
+    environment:
+      PUID: '1000'
+      PGID: '1000'
+      TZ: Europe/Bratislava
+    hostname: radarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/radarr:latest
+    networks:
+    - mediarr
+    ports:
+    - target: 7878
+      published: 7878
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - radarr_config:/config
+    - /media/m-server/movies/:/movies-m-server
+    - /media/nas/movies/:/movies-nas
+    - /media/m-server/downloads:/downloads
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: mediacenter_radarr
+        homepage.description: Subtitles
+        homepage.group: Media
+        homepage.href: https://radarr.sectorq.eu
+        homepage.icon: radarr.png
+        homepage.name: Radarr
+        homepage.server: my-docker-swarm
+        homepage.weight: '20'
+        homepage.widget.key: ${RADARR_TOKEN}
+        homepage.widget.type: radarr
+        homepage.widget.url: https://radarr.sectorq.eu
+        wud.display.icon: mdi:radarr
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+
+  sonarr:
+    dns:
+    - 192.168.77.101
+    environment:
+      PUID: '1000'
+      PGID: '1000'
+      TZ: Europe/Bratislava
+    hostname: sonarr
+    image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/sonarr:latest
+    networks:
+    - mediarr
+    ports:
+    - target: 8989
+      published: 8989
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - sonarr_config:/config
+    - /media/m-server/shows:/tv-m-server
+    - /media/nas/shows:/tv-nas
+    - /media/m-server/downloads:/downloads
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: mediacenter_sonarr
+        homepage.description: Subtitles
+        homepage.group: Media
+        homepage.href: https://sonarr.sectorq.eu
+        homepage.icon: sonarr.png
+        homepage.name: Sonarr
+        homepage.server: my-docker-swarm
+        homepage.weight: '30'
+        homepage.widget.key: ${SONARR_TOKEN}
+        homepage.widget.type: sonarr
+        homepage.widget.url: https://sonarr.sectorq.eu
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager

__swarm/mosquitto/.env

@@ -0,0 +1,2 @@
+APPNAME=mosquitto
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/mosquitto/docker-compose.yml

@@ -0,0 +1,15 @@
+name: mosquitto
+services:
+  mosquitto:
+    image: ${DOCKER_REGISTRY:-}eclipse-mosquitto
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      wud.watch: true
+      wud.watch.digest: true
+    mem_limit: 1g
+    network_mode: host
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/mosquitto/conf:/mosquitto/config
+    - /share/docker_data/mosquitto/data:/mosquitto/data
+    - /share/docker_data/mosquitto/log:/mosquitto/log

__swarm/mosquitto/mosquitto-swarm.yml

@@ -0,0 +1,25 @@
+services:
+  mosquitto:
+    image: ${DOCKER_REGISTRY:-}eclipse-mosquitto
+    ports:
+    - target: 1883
+      published: 1883
+      protocol: tcp
+      mode: host
+    volumes:
+    - conf:/mosquitto/config
+    - data:/mosquitto/data
+    - log:/mosquitto/log
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  conf:
+  data:
+  log:

__swarm/motioneye/.env

@@ -0,0 +1,3 @@
+APPNAME=motioneye
+DOCKER_REGISTRY=r.sectorq.eu/library/
+RESTART=always

__swarm/motioneye/docker-compose.yml

@@ -0,0 +1,28 @@
+services:
+  motioneye:
+    container_name: motioneye
+    dns:
+      - 192.168.77.101
+    environment:
+      - TZ=Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}ghcr.io/motioneye-project/motioneye:edge
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      homepage.container: motioneye
+      homepage.description: Video manager
+      homepage.group: Media
+      homepage.href: http://m-server.home.lan:8765/
+      homepage.icon: /images/motioneye.webp
+      homepage.name: MotionEye
+      homepage.server: my-docker
+      homepage.weight: '1'
+      wud.watch: true
+      wud.watch.digest: true
+    ports:
+      - 8081:8081
+      - 8765:8765
+    restart: unless-stopped
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /share/docker_data/motioneye/etc_motioneye:/etc/motioneye
+      - /share/docker_data/motioneye/var_lib_motioneye:/var/lib/motioneye

__swarm/motioneye/motioneye-swarm.yml

@@ -0,0 +1,40 @@
+services:
+  app:
+    dns:
+    - 192.168.77.101
+    environment:
+      TZ: Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}ghcr.io/motioneye-project/motioneye:edge
+    ports:
+    - target: 8081
+      published: 8081
+      protocol: tcp
+      mode: ingress
+    - target: 8765
+      published: 8765
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - /etc/localtime:/etc/localtime:ro
+    - config:/etc/motioneye
+    - data:/var/lib/motioneye
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        homepage.container: motioneye_app
+        homepage.description: Video manager
+        homepage.group: Media
+        homepage.href: http://m-server.home.lan:8765/
+        homepage.icon: /images/motioneye.webp
+        homepage.name: MotionEye
+        homepage.server: my-docker-swarm
+        homepage.weight: '1'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  config:
+  data:

__swarm/n8n/.env

@@ -0,0 +1,2 @@
+APPNAME=n8n
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/n8n/docker-compose.yml

@@ -0,0 +1,33 @@
+version: "3"
+services:
+  n8n:
+    image: ${DOCKER_REGISTRY:-}n8nio/n8n:latest
+    container_name: n8n
+    ports:
+      - "5679:5678"
+    environment:
+      - N8N_HOST=n8n.sectorq.eu
+      - N8N_PORT=5678
+      - N8N_PROTOCOL=https
+      - N8N_BASIC_AUTH_ACTIVE=true
+      - N8N_BASIC_AUTH_USER=sth
+      - N8N_BASIC_AUTH_PASSWORD=pwd
+      - N8N_RUNNERS_ENABLED=true
+      - N8N_RUNNERS_MODE=internal
+      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
+      - N8N_SECURE_COOKIE=false
+      - WEBHOOK_URL=https://n8n.sectorq.eu
+    volumes:
+      - /share/docker_data/n8n/n8n-data:/home/node/.n8n
+    restart: ${RESTART:-unless-stopped}
+    stop_grace_period: 60s
+    labels:      
+      homepage.container: n8n
+      homepage.description: Workflow management
+      homepage.group: Utils
+      homepage.href: https://${APPNAME}.sectorq.eu
+      homepage.icon: /icons/n8n.svg
+      homepage.name: n8n
+      homepage.server: my-docker
+      wud.watch: true
+      wud.watch.digest: true   

__swarm/n8n/n8n-swarm.yml

@@ -0,0 +1,42 @@
+version: '3'
+services:
+  app:
+    image: ${DOCKER_REGISTRY:-}n8nio/n8n:latest
+    ports:
+    - target: 5678
+      published: 5679
+      protocol: tcp
+      mode: ingress
+    environment:
+      N8N_HOST: n8n.sectorq.eu
+      N8N_PORT: '5678'
+      N8N_PROTOCOL: https
+      N8N_BASIC_AUTH_ACTIVE: 'true'
+      N8N_BASIC_AUTH_USER: sth
+      N8N_BASIC_AUTH_PASSWORD: pwd
+      N8N_RUNNERS_ENABLED: 'true'
+      N8N_RUNNERS_MODE: internal
+      N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: 'true'
+      N8N_SECURE_COOKIE: 'false'
+      WEBHOOK_URL: https://n8n.sectorq.eu
+    volumes:
+    - data:/home/node/.n8n
+    stop_grace_period: 60s
+    deploy:
+      labels:
+        homepage.container: n8n_app
+        homepage.description: Workflow management
+        homepage.group: Utils
+        homepage.href: https://${APPNAME}.sectorq.eu
+        homepage.icon: /icons/n8n.svg
+        homepage.name: n8n
+        homepage.server: my-docker-swarm
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  data:
+    driver: local

__swarm/nebula/.env

@@ -0,0 +1,2 @@
+APPNAME=nebula
+PASSWORD=l4c1j4yd33Du5lo

__swarm/nebula/docker-compose copy.yml

@@ -0,0 +1,17 @@
+services:
+  nebula-sync:
+    image: ghcr.io/lovelaze/nebula-sync:latest
+    container_name: nebula-sync
+    environment:
+    - PRIMARY=http://192.168.77.101:9380|l4c1j4yd33Du5lo
+    - REPLICAS=http://192.168.77.238:9380|l4c1j4yd33Du5lo,http://192.168.77.106:9380|l4c1j4yd33Du5lo
+    - CLIENT_SKIP_TLS_VERIFICATION=true
+
+    - FULL_SYNC=true
+    - RUN_GRAVITY=true
+    - CRON=0 * * * *      
+    labels:
+
+      wud.watch: true
+      wud.watch.digest: true
+    restart: always

__swarm/nebula/docker-compose.yml

@@ -0,0 +1,11 @@
+services:
+  nebula-sync:
+    image: ghcr.io/lovelaze/nebula-sync:latest
+    environment:
+    - PRIMARY=http://192.168.77.101:9380|l4c1j4yd33Du5lo
+    - REPLICAS=http://192.168.77.106:9380|l4c1j4yd33Du5lo
+    - CLIENT_SKIP_TLS_VERIFICATION=true
+
+    - FULL_SYNC=true
+    - RUN_GRAVITY=true
+    - CRON=0 * * * *      

__swarm/nebula/nebula-swarm.yml

@@ -0,0 +1,15 @@
+services:
+  nebula-sync:
+    image: ghcr.io/lovelaze/nebula-sync:latest
+    environment:
+      PRIMARY: http://192.168.77.101:9380|l4c1j4yd33Du5lo
+      REPLICAS: http://192.168.77.106:9380|l4c1j4yd33Du5lo
+      CLIENT_SKIP_TLS_VERIFICATION: 'true'
+      FULL_SYNC: 'true'
+      RUN_GRAVITY: 'true'
+      CRON: 0 * * * *
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager

__swarm/nextcloud/.env

@@ -0,0 +1,3 @@
+APPNAME=nextcloud
+#RESTART=always
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/nextcloud/docker-compose.yml

@@ -0,0 +1,94 @@
+networks:
+  nextcloud_network:
+    ipam:
+      config:
+      - subnet: 192.168.80.0/28
+      driver: default
+  pihole_pihole:
+    external: true
+services:
+  app:
+    depends_on:
+    - db
+    dns:
+    - 192.168.78.254
+    env_file:
+    - stack.env
+    image: ${DOCKER_REGISTRY:-}nextcloud:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      com.centurylinklabs.watchtower.lifecycle.post-update: apt update;apt install
+        -y smbclient;chown -R www-data:www-data /var/www/html
+      homepage.container: nextcloud-app-1
+      homepage.description: Cloud server
+      homepage.group: Infrastructure
+      homepage.href: https://nc.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Nextcloud
+      homepage.server: my-docker
+      homepage.widget.password: oGeiy-tTc8p-LJdt5-na3JF-dbWpY
+      homepage.widget.type: ${APPNAME}
+      homepage.widget.url: https://nc.sectorq.eu
+      homepage.widget.username: jaydee
+      wud.watch: true
+      wud.watch.digest: true
+    links:
+    - db
+    networks:
+    - nextcloud_network
+    - pihole_pihole
+    ports:
+    - 8134:80
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/nextcloud/app:/var/www/html
+    - /share/docker_data/nextcloud/app-hooks/pre-installation:/docker-entrypoint-hooks.d/pre-installation
+    - /share/docker_data/nextcloud/app-hooks/post-installation:/docker-entrypoint-hooks.d/post-installation
+    - /share/docker_data/nextcloud/app-hooks/pre-upgrade:/docker-entrypoint-hooks.d/pre-upgrade
+    - /share/docker_data/nextcloud/app-hooks/post-upgrade:/docker-entrypoint-hooks.d/post-upgrade
+    - /share/docker_data/nextcloud/app-hooks/before-starting:/docker-entrypoint-hooks.d/before-starting
+  db:
+    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --innodb-file-per-table=1
+      --skip-innodb-read-only-compressed
+    env_file:
+    - stack.env
+    image: ${DOCKER_REGISTRY:-}yobasystems/alpine-mariadb:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: true
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - nextcloud_network
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/nextcloud/mariadb:/var/lib/mysql
+    - /etc/localtime:/etc/localtime
+  redis:
+    image: ${DOCKER_REGISTRY:-}redis:alpine
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - nextcloud_network
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/nextcloud/redis:/data
+  appapi-harp:
+    environment:
+      - HP_SHARED_KEY=l4c1j4yd33Du5lo
+      - NC_INSTANCE_URL=https://nc.sectorq.eu
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /share/docker_data/nextcloud/certs:/certs
+    container_name: appapi-harp
+    hostname: appapi-harp
+    restart: unless-stopped
+    ports:
+      - 8780:8780
+      - 8782:8782
+    image: ${DOCKER_REGISTRY:-}ghcr.io/nextcloud/nextcloud-appapi-harp:release
+    networks:
+    - nextcloud_network
+    labels:
+      wud.watch: true
+      wud.watch.digest: true

__swarm/nextcloud/nextcloud-swarm.yml

@@ -0,0 +1,109 @@
+services:
+  app:
+    dns:
+    - 192.168.77.101
+    env_file:
+    - stack.env
+    image: ${DOCKER_REGISTRY:-}nextcloud:latest
+    links:
+    - db
+    ports:
+    - target: 80
+      published: 8134
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - data:/var/www/html
+    - pre-installation:/docker-entrypoint-hooks.d/pre-installation
+    - post-installation:/docker-entrypoint-hooks.d/post-installation
+    - pre-upgrade:/docker-entrypoint-hooks.d/pre-upgrade
+    - post-upgrade:/docker-entrypoint-hooks.d/post-upgrade
+    - before-starting:/docker-entrypoint-hooks.d/before-starting
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        com.centurylinklabs.watchtower.lifecycle.post-update: apt update;apt install
+          -y smbclient;chown -R www-data:www-data /var/www/html
+        homepage.container: nextcloud_app
+        homepage.description: Cloud server
+        homepage.group: Infrastructure
+        homepage.href: https://nc.sectorq.eu
+        homepage.icon: ${APPNAME}.png
+        homepage.name: Nextcloud
+        homepage.server: my-docker-swarm
+        homepage.widget.password: oGeiy-tTc8p-LJdt5-na3JF-dbWpY
+        homepage.widget.type: ${APPNAME}
+        homepage.widget.url: https://nc.sectorq.eu
+        homepage.widget.username: jaydee
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  db:
+    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --innodb-file-per-table=1
+      --skip-innodb-read-only-compressed
+    env_file:
+    - stack.env
+    image: ${DOCKER_REGISTRY:-}yobasystems/alpine-mariadb:latest
+    volumes:
+    - mariadb:/var/lib/mysql
+    - /etc/localtime:/etc/localtime
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  redis:
+    image: ${DOCKER_REGISTRY:-}redis:alpine
+    volumes:
+    - redis:/data
+    deploy:
+      labels:
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+  appapi-harp:
+    environment:
+      HP_SHARED_KEY: l4c1j4yd33Du5lo
+      NC_INSTANCE_URL: https://nc.sectorq.eu
+    volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
+    - certs:/certs
+    hostname: appapi-harp
+    ports:
+    - target: 8780
+      published: 8780
+      protocol: tcp
+      mode: ingress
+    - target: 8782
+      published: 8782
+      protocol: tcp
+      mode: ingress
+    image: ${DOCKER_REGISTRY:-}ghcr.io/nextcloud/nextcloud-appapi-harp:release
+    deploy:
+      labels:
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  data:
+  pre-installation:
+  post-installation:
+  pre-upgrade:
+  post-upgrade:
+  before-starting:
+  mariadb:
+  redis:
+  certs:

__swarm/nextcloud/stack.env

@@ -0,0 +1,10 @@
+TZ=Europe/Bratislava
+MYSQL_ROOT_PASSWORD=l4c1j4yd33Du5lo
+MYSQL_PASSWORD=l4c1j4yd33Du5lo
+MYSQL_DATABASE=nextcloud
+MYSQL_USER=nextcloud
+MYSQL_HOST=db
+REDIS_HOST=redis
+PHP_MEMORY_LIMIT=1024M
+PHP_UPLOAD_LIMIT=1024M
+NEXTCLOUD_MEMORY_LIMIT=1024M

__swarm/nginx/.env

@@ -0,0 +1 @@
+APPNAME=nginx

__swarm/nginx/docker-compose.yml

@@ -0,0 +1,40 @@
+networks:
+  pihole_pihole:
+    external: true
+services:
+  app:
+    dns:
+    - 192.168.78.254
+    healthcheck:
+      interval: 10s
+      test:
+      - CMD
+      - /usr/bin/check-health
+      timeout: 3s
+    image: jc21/nginx-proxy-manager:latest
+    labels:
+      homepage.container: nginx-app-1
+      homepage.description: Reverse Proxy
+      homepage.group: Infrastructure
+      homepage.href: http://active.home.lan:81
+      homepage.icon: nginx-proxy-manager.png
+      homepage.name: Nginx
+      homepage.server: my-docker
+      homepage.weight: '25'
+      homepage.widget.password: OdyAJvifHvDPMOyFdbiKak5S
+      homepage.widget.type: npm
+      homepage.widget.url: http://active.home.lan:81
+      homepage.widget.username: monitoring@sectorq.eu
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+    - pihole_pihole
+    ports:
+    - 8099:80
+    - 4439:443
+    - 81:81
+    restart: unless-stopped
+    volumes:
+    - /share/docker_data/nginx/data:/data
+    - /share/docker_data/nginx/letsencrypt:/etc/letsencrypt
+version: '3.8'

__swarm/nginx/nginx-swarm.yml

@@ -0,0 +1,55 @@
+networks:
+  pihole_pihole:
+    external: true
+services:
+  app:
+    dns:
+    - 192.168.78.254
+    healthcheck:
+      interval: 10s
+      test:
+      - CMD
+      - /usr/bin/check-health
+      timeout: 3s
+    image: jc21/nginx-proxy-manager:latest
+    networks:
+    - pihole_pihole
+    ports:
+    - target: 80
+      published: 8099
+      protocol: tcp
+      mode: ingress
+    - target: 443
+      published: 4439
+      protocol: tcp
+      mode: ingress
+    - target: 81
+      published: 81
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - data:/data
+    - letsencrypt:/etc/letsencrypt
+    deploy:
+      labels:
+        homepage.container: nginx-app-1
+        homepage.description: Reverse Proxy
+        homepage.group: Infrastructure
+        homepage.href: http://active.home.lan:81
+        homepage.icon: nginx-proxy-manager.png
+        homepage.name: Nginx
+        homepage.server: my-docker-swarm
+        homepage.weight: '25'
+        homepage.widget.password: OdyAJvifHvDPMOyFdbiKak5S
+        homepage.widget.type: npm
+        homepage.widget.url: http://active.home.lan:81
+        homepage.widget.username: monitoring@sectorq.eu
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  data:
+  letsencrypt:

__swarm/node-red/.env

@@ -0,0 +1,2 @@
+APPNAME=node-red
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/node-red/docker-compose.yml

@@ -0,0 +1,28 @@
+networks:
+  node-red-net: null
+services:
+  node-red:
+    dns:
+    - 192.168.77.101
+    environment:
+    - TZ=Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}nodered/node-red:latest
+    labels:
+      com.centurylinklabs.watchtower.enable: 'true'
+      wud.watch: true
+      wud.watch.digest: true
+      homepage.container: node-red-node-red-1
+      homepage.description:  Node red
+      homepage.group: Infrastructure
+      homepage.href: http://active.home.lan:1880
+      homepage.icon: node-red.png
+      homepage.name: Node-red
+      homepage.server: my-docker
+    mem_limit: 1g
+    networks:
+    - node-red-net
+    ports:
+    - 1880:1880
+    restart: always
+    volumes:
+    - /share/docker_data/node-red:/data

__swarm/node-red/node-red-swarm.yml

@@ -0,0 +1,32 @@
+services:
+  app:
+    dns:
+    - 192.168.77.101
+    environment:
+      TZ: Europe/Bratislava
+    image: ${DOCKER_REGISTRY:-}nodered/node-red:latest
+    ports:
+    - target: 1880
+      published: 1880
+      protocol: tcp
+      mode: ingress
+    volumes:
+    - data:/data
+    deploy:
+      labels:
+        com.centurylinklabs.watchtower.enable: 'true'
+        wud.watch: 'true'
+        wud.watch.digest: 'true'
+        homepage.container: node-red_app
+        homepage.description: Node red
+        homepage.group: Infrastructure
+        homepage.href: http://active.home.lan:1880
+        homepage.icon: node-red.png
+        homepage.name: Node-red
+        homepage.server: my-docker-swarm
+      replicas: 1
+      placement:
+        constraints:
+        - node.role == manager
+volumes:
+  data: