build

__swarm/authentik/stack.env

@@ -3,7 +3,7 @@ PG_USER=authentik
 PG_DB=authentik
 AUTHENTIK_SECRET_KEY=ZKkVCxj8kKj5ZklvzxKG2IgYQOftDoLPRjc57yomr1qzbKEQVZ
 AUTHENTIK_ERROR_REPORTING__ENABLED=true
-AUTHENTIK_TAG=2025.8.4
+AUTHENTIK_TAG=2025.10.2
 POSTGRES_PASSWORD=499NU6Ze5HcJK4IwSShO8oDbj3j0i0CalyEzfgEp
 POSTGRES_USER=authentik
 POSTGRES_DB=authentik

__swarm/gitlab/docker-compose.yml

@@ -1,5 +1,16 @@
 services:
+  runner:
+    container_name: gitlab-runner
+    restart: always
+    volumes:
+      - runner:/etc/gitlab-runner
+      - /var/run/docker.sock:/var/run/docker.sock
+    image: ${DOCKER_REGISTRY:-}gitlab/gitlab-runner:latest
+    labels:
+      - wud.watch.digest=true
+      - wud.watch=true
   web:
+  
     container_name: gitlab
     environment:
       GITLAB_OMNIBUS_CONFIG: "external_url 'https://gitlab.sectorq.eu'\nnginx['listen_port']\
@@ -47,8 +58,13 @@ services:
     restart: unless-stopped
     shm_size: 4gb
     volumes:
-    - /share/docker_data/gitlab/config:/etc/gitlab
-    - /share/docker_data/gitlab/logs:/var/log/gitlab
-    - /share/docker_data/gitlab/data:/var/opt/gitlab
+    - config:/etc/gitlab
+    - logs:/var/log/gitlab
+    - data:/var/opt/gitlab
     - /etc/localtime:/etc/localtime:ro
 version: '3.6'
+volumes:
+  runner:
+  config:
+  logs:
+  data:

__swarm/gitlab/gitlab-swarm.yml

@@ -1,73 +1,101 @@
-services:
-  web:
-    environment:
-      GITLAB_OMNIBUS_CONFIG: "external_url 'https://gitlab.sectorq.eu'\nnginx['listen_port']\
-        \ = 80\nnginx['listen_https'] = false\nweb_server['username'] = 'git'\ngitlab_rails['time_zone']\
-        \ = 'Europe/Bratislava'\ngitlab_rails['omniauth_enabled'] = true\ngitlab_rails['omniauth_allow_single_sign_on']\
-        \ = ['saml']\ngitlab_rails['omniauth_sync_email_from_provider'] = 'saml'\n\
-        gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']\ngitlab_rails['omniauth_sync_profile_attributes']\
-        \ = ['email']\ngitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'\n\
-        gitlab_rails['omniauth_block_auto_created_users'] = false\ngitlab_rails['omniauth_auto_link_saml_user']\
-        \ = true\ngitlab_rails['omniauth_providers'] = [\n  {\n    name: 'saml',\n\
-        \    args: {\n      assertion_consumer_service_url: 'https://gitlab.sectorq.eu/users/auth/saml/callback',\n\
-        \      # Shown when navigating to certificates in authentik1\n      idp_cert_fingerprint:\
-        \ 'f7:fd:49:03:b3:38:52:b3:23:f5:43:c4:8d:08:65:32:e0:5a:7b:0e',\n      idp_sso_target_url:\
-        \ 'https://auth.sectorq.eu/application/saml/gitlab/sso/binding/redirect/',\n\
-        \      issuer: 'https://gitlab.sectorq.eu',\n      name_identifier_format:\
-        \ 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n      attribute_statements:\
-        \ {\n        email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],\n\
-        \        first_name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],\n\
-        \        nickname: ['http://schemas.goauthentik.io/2021/02/saml/username']\n\
-        \      }\n    },\n    label: 'authentik'\n  }\n]\n"
-      TZ: Europe/Bratislava
-    hostname: gitlab.sectorq.eu
-    image: ${DOCKER_REGISTRY:-}gitlab/gitlab-ce:latest
-    network_mode: bridge
-    ports:
-    - target: 80
-      published: 8785
-      protocol: tcp
-      mode: ingress
-    - target: 443
-      published: 8743
-      protocol: tcp
-      mode: ingress
-    - target: 22
-      published: 8722
-      protocol: tcp
-      mode: ingress
-    shm_size: 4gb
-    volumes:
-    - config:/etc/gitlab
-    - logs:/var/log/gitlab
-    - data:/var/opt/gitlab
-    - /etc/localtime:/etc/localtime:ro
-    deploy:
+  services:
+    runner:
+      container_name: gitlab-runner
+      restart: always
+      volumes:
+        - runner:/etc/gitlab-runner
+        - /var/run/docker.sock:/var/run/docker.sock
+      image: ${DOCKER_REGISTRY:-}gitlab/gitlab-runner:latest
       labels:
-        com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: gitlab
-        homepage.description: Version control
-        homepage.group: Infrastructure
-        homepage.href: https://gitlab.sectorq.eu
-        homepage.icon: gitlab.png
-        homepage.name: Gitlab
-        homepage.server: my-docker-swarm
-        homepage.weight: '1'
-        homepage.widget.key: glpat-BuMKcaDqeD-Wx3dW4TM9
-        homepage.widget.type: gitlab
-        homepage.widget.url: https://gitlab.sectorq.eu
-        homepage.widget.user_id: '2'
-        wud.watch: 'true'
-        wud.watch.digest: 'true'
-      replicas: 1
-      placement:
-        constraints:
-        - node.role == manager
+        - wud.watch.digest=true
+        - wud.watch=true
+      dns:
+        - 192.168.77.1
+        - 192.168.77.101
+    app:
+      environment:
+        GITLAB_OMNIBUS_CONFIG: |
+          external_url 'https://gitlab.sectorq.eu'
+          nginx['listen_port'] = 80
+          nginx['listen_https'] = false
+          web_server['username'] = 'git'
+          gitlab_rails['time_zone'] = 'Europe/Bratislava'
+          gitlab_rails['omniauth_enabled'] = true
+          gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
+          gitlab_rails['omniauth_sync_email_from_provider'] = 'saml'
+          gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']
+          gitlab_rails['omniauth_sync_profile_attributes'] = ['email']
+          gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'
+          gitlab_rails['omniauth_block_auto_created_users'] = false
+          gitlab_rails['omniauth_auto_link_saml_user'] = true
+          gitlab_rails['omniauth_providers'] = [
+            {
+              name: 'saml',
+              args: {
+                assertion_consumer_service_url: 'https://gitlab.sectorq.eu/users/auth/saml/callback',
+                # Shown when navigating to certificates in authentik1
+                idp_cert_fingerprint: 'f7:fd:49:03:b3:38:52:b3:23:f5:43:c4:8d:08:65:32:e0:5a:7b:0e',
+                idp_sso_target_url: 'https://auth.sectorq.eu/application/saml/gitlab/sso/binding/redirect/',
+                issuer: 'https://gitlab.sectorq.eu',
+                name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
+                attribute_statements: {
+                  email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],
+                  first_name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],
+                  nickname: ['http://schemas.goauthentik.io/2021/02/saml/username']
+                }
+              },
+              label: 'authentik'
+            }
+          ]
+        TZ: Europe/Bratislava
+      hostname: gitlab.sectorq.eu
+      image: ${DOCKER_REGISTRY:-}gitlab/gitlab-ce:latest
+      network_mode: bridge
+      ports:
+      - target: 80
+        published: 8785
+        protocol: tcp
+        mode: ingress
+      - target: 443
+        published: 8743
+        protocol: tcp
+        mode: ingress
+      - target: 22
+        published: 8722
+        protocol: tcp
+        mode: ingress
+      shm_size: 4gb
+      volumes:
+      - config:/etc/gitlab
+      - logs:/var/log/gitlab
+      - data:/var/opt/gitlab
+      - /etc/localtime:/etc/localtime:ro
+      deploy:
+        labels:
+          com.centurylinklabs.watchtower.enable: 'true'
+          homepage.container: gitlab
+          homepage.description: Version control
+          homepage.group: Infrastructure
+          homepage.href: https://gitlab.sectorq.eu
+          homepage.icon: gitlab.png
+          homepage.name: Gitlab
+          homepage.server: my-docker-swarm
+          homepage.weight: '1'
+          homepage.widget.key: glpat-BuMKcaDqeD-Wx3dW4TM9
+          homepage.widget.type: gitlab
+          homepage.widget.url: https://gitlab.sectorq.eu
+          homepage.widget.user_id: '2'
+          wud.watch: 'true'
+          wud.watch.digest: 'true'
+        replicas: 1
+        placement:
+          constraints:
+          - node.role == manager
 
-volumes:
-  config:
-    driver: local
-  logs:
-    driver: local
-  data:
-    driver: local 
+  volumes:
+    config:
+      driver: local
+    logs:
+      driver: local
+    data:
+      driver: local

__swarm/hashicorp/hashicorp-swarm.yml

@@ -0,0 +1,47 @@
+services:
+  vault:
+    image: hashicorp/vault:latest
+    command: server -config=/vault/config/vault.hcl
+    volumes:
+      - data:/vault/data
+    configs:
+      - source: vault_hcl
+        target: /vault/config/vault.hcl
+    ports:
+      - "8200:8200"
+    environment:
+      VAULT_LOCAL_CONFIG: |
+        {
+          "backend": {
+            "file": {
+              "path": "/vault/file"
+            }
+          },
+          "listener": {
+            "tcp": {
+              "address": "0.0.0.0:8200",
+              "tls_disable": 1
+            }
+          },
+          "disable_mlock": true
+        }
+      VAULT_API_ADDR: "http://192.168.77.101:8200"
+    cap_add:
+      - IPC_LOCK
+    networks:
+      - vault-net
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+
+configs:
+  vault_hcl:
+    external: true
+volumes:
+  data:
+networks:
+  vault-net:
+    driver: overlay

__swarm/home-assistant/home-assistant-swarm.yml

@@ -1,11 +1,16 @@
+
+
 services:
   homeassistant:
-    network_mode: host
     image: ${DOCKER_REGISTRY:-}ghcr.io/home-assistant/home-assistant:latest
     volumes:
     - ha_config:/config
     - /var/run/docker.sock:/var/run/docker.sock
     - /run/dbus:/run/dbus:ro
+    networks:
+      - swarm-ipvlan 
+      - traefik-public
+      - homeassistant-internal
     privileged: true
     environment:
       DISABLE_JEMALLOC: value

__swarm/homepage/homepage-swarm.yml

@@ -1,6 +1,7 @@
 services:
   homepage:
     dns:
+    - 192.168.77.1
     - 192.168.77.101
     environment:
       HOMEPAGE_ALLOWED_HOSTS: sectorq.eu,active.home.lan:3003,m-server.home.lan:3003,rpi5.home.lan:3003,nas.home.lan:3003,192.168.77.238:3003,rack.home.lan:3003,192.168.80.222:3003

__swarm/influxdb/influxdb-swarm.yml

@@ -29,9 +29,6 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-      placement:
-        constraints:
-        - node.role == manager
 secrets:
   influxdb2-admin-token:
     external: true

__swarm/mediacenter/mediacenter-swarm.yml

@@ -16,7 +16,6 @@ volumes:
   radarr_config:
   sonarr_config:
   bazarr_config:
-  flaresolverr_config:
 
 services:
   bazarr:
@@ -28,6 +27,8 @@ services:
     image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/bazarr:latest
     networks:
     - mediarr
+    dns:
+      - 192.168.77.101
     ports:
     - target: 6767
       published: 6767
@@ -42,7 +43,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: bazarr
+        homepage.container: mediacenter_bazarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://bazarr.sectorq.eu
@@ -129,7 +130,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: jackett
+        homepage.container: mediacenter_jackett
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://jackett.sectorq.eu
@@ -148,13 +149,13 @@ services:
         - node.role == manager
   jellyfin:
     environment:
-      PUID: '1000'
-      PGID: '1000'
       TZ: Europe/Bratislava
       JELLYFIN_PublishedServerUrl: https://jf.sectorq.eu
+      VAAPI_DEVICE: /dev/dri/renderD128
+      LIBVA_DRIVER_NAME: radeonsi
     hostname: jellyfin
     image: ${DOCKER_REGISTRY:-}lscr.io/linuxserver/jellyfin:latest
-    network_mode: host
+
     ports:
     - target: 8096
       published: 8096
@@ -168,6 +169,7 @@ services:
       published: 7359
       protocol: tcp
       mode: ingress
+    user: root
     volumes:
     - jellyfin_config:/config
     - /media/m-server/movies:/data/movies/m-server
@@ -177,10 +179,13 @@ services:
     - /media/nas/music:/data/music/nas
     - /media/nas/shows:/data/shows/nas
     - /media/nas/xxx:/data/xxx/nas
+    - /dev/dri:/dev/dri
+    devices:
+      - /dev/dri/renderD128:/dev/dri/renderD128
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: jellyfin
+        homepage.container: mediacenter_jellyfin
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://jf.sectorq.eu
@@ -197,6 +202,7 @@ services:
       placement:
         constraints:
         - node.role == manager
+        - node.labels.gpu == amd
   jellyseerr:
     environment:
       LOG_LEVEL: debug
@@ -215,7 +221,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enabl: 'true'
-        homepage.container: jellyseerr
+        homepage.container: mediacenter_jellyseerr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://js.sectorq.eu
@@ -253,7 +259,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: lidarr
+        homepage.container: mediacenter_lidarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://lidarr.sectorq.eu
@@ -296,7 +302,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: qbittorrent
+        homepage.container: mediacenter_qbittorrent
         homepage.description: Subtitles
         homepage.group: Utilities
         homepage.href: https://qbit.sectorq.eu
@@ -304,7 +310,7 @@ services:
         homepage.name: Qbittorrent
         homepage.server: my-docker-swarm
         homepage.weight: '95'
-        homepage.widget.enableLeechProgress: 'true'
+        homepage.widget.enableLeechProgress: 'false'
         homepage.widget.password: ${QBIT_TOKEN}
         homepage.widget.type: qbittorrent
         homepage.widget.url: https://qbit.sectorq.eu
@@ -339,7 +345,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: radarr
+        homepage.container: mediacenter_radarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://radarr.sectorq.eu
@@ -381,7 +387,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: sonarr
+        homepage.container: mediacenter_sonarr
         homepage.description: Subtitles
         homepage.group: Media
         homepage.href: https://sonarr.sectorq.eu

__swarm/pihole/pihole-swarm.yml

@@ -1,5 +1,5 @@
 volumes:
-  data::
+  data:
     driver: local
   dnsmasq_d:
     driver: local
@@ -43,6 +43,10 @@ services:
     volumes:
     - data:/etc/pihole
     - dnsmasq_d:/etc/dnsmasq.d
+    - type: tmpfs
+      target: /dev/shm
+      tmpfs:
+        size: 248000000
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'

__swarm/wud/stack.env

@@ -65,6 +65,15 @@ WUD_WATCHER_MSERVER_CRON=0 * * * *
 WUD_WATCHER_MSERVER_WATCHALL=true
 WUD_WATCHER_MSERVER_WATCHBYDEFAULT=false
 
+WUD_WATCHER_MS_HOST=192.168.77.101
+WUD_WATCHER_MS_PORT=2376
+WUD_WATCHER_MS_CERTFILE=/certs/m-server/cert.pem
+WUD_WATCHER_MS_CAFILE=/certs/m-server/ca.pem
+WUD_WATCHER_MS_KEYFILE=/certs/m-server/key.pem
+WUD_WATCHER_MS_CRON=0 * * * *
+WUD_WATCHER_MS_WATCHALL=true
+WUD_WATCHER_MS_WATCHBYDEFAULT=true
+
 # WUD_WATCHER_RPI5_HOST=192.168.77.238
 # WUD_WATCHER_RPI5_PORT=2376
 # WUD_WATCHER_RPI5_CERTFILE=/certs/rpi5/cert.pem

__swarm/zabbix-server/.env

@@ -1,2 +1,3 @@
 APPNAME=zabbix
-#RESTART=always
+#RESTART=always
+DOCKER_REGISTRY=r.sectorq.eu/library/

__swarm/zabbix-server/Dockerfile

@@ -0,0 +1,5 @@
+FROM zabbix/zabbix-server-pgsql:alpine-latest
+
+USER root
+RUN apk add --no-cache curl
+USER zabbix

__swarm/zabbix-server/docker-compose.yml

@@ -48,7 +48,11 @@ services:
     extends:
       file: logging.yml
       service: ${LOGGING:-syslog}
-    image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    #image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: zabbix-server-custom:latest
     volumes:
       - /share/docker_data/zabbix-server/server/alertscripts:/usr/lib/zabbix/alertscripts
     labels:

__swarm/zabbix-server/stack.env

@@ -1,6 +1,6 @@
 # Zabbix global
 # ZBX_DEBUGLEVEL=3
-
+DOCKER_REGISTRY=r.sectorq.eu/library/
 # Database
 MYSQL_PASSWORD=zabbix
 MYSQL_USER=zabbix

__swarm/zabbix-server/zabbix-server-swarm.yml

@@ -24,7 +24,9 @@ services:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
       replicas: 1
-
+      placement:
+        constraints:
+        - node.role == manager
   zabbix-frontend:
     env_file:
     - stack.env
@@ -49,11 +51,14 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-
+      placement:
+        constraints:
+        - node.role == manager
   zabbix-server:
     env_file:
     - stack.env
-    image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    #image: ${DOCKER_REGISTRY:-}zabbix/zabbix-server-pgsql:alpine-latest
+    image: r.sectorq.eu/jaydee/zabbix-server-pgsql:latest
     volumes:
     - alertscripts:/usr/lib/zabbix/alertscripts
     networks:
@@ -67,7 +72,7 @@ services:
     deploy:
       labels:
         com.centurylinklabs.watchtower.enable: 'true'
-        homepage.container: zabbix-server-zabbix-server-1
+        homepage.container: zabbix-server_zabbix-server
         homepage.description: Monitoring server
         homepage.group: Utilities
         homepage.href: https://${APPNAME}.sectorq.eu
@@ -81,7 +86,9 @@ services:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-
+      placement:
+        constraints:
+        - node.role == manager
   webdriver:
     ports:
     - target: 4444
@@ -92,30 +99,33 @@ services:
       published: 7900
       protocol: tcp
       mode: ingress
-    shm_size: 2g
     image: ${DOCKER_REGISTRY:-}docker.io/selenium/standalone-chrome:latest
     deploy:
       labels:
         wud.watch: 'true'
         wud.watch.digest: 'true'
       replicas: 1
-
-  postinstall:
-    image: debian:12-slim
-    environment:
-      PUID: '0'
-      PGID: '0'
-    volumes:
-    - /usr/bin:/usr/bin
-    - /usr/lib:/usr/lib
-    - /var/run/docker.sock:/var/run/docker.sock
-    - scripts:/scripts
-    entrypoint:
-    - /bin/sh
-    - /scripts/install-curl.sh
-    deploy:
-      replicas: 1
-
+      placement:
+        constraints:
+        - node.role == manager
+  # postinstall:
+  #   image: debian:12-slim
+  #   environment:
+  #     PUID: '0'
+  #     PGID: '0'
+  #   volumes:
+  #   - /usr/bin:/usr/bin
+  #   - /usr/lib:/usr/lib
+  #   - /var/run/docker.sock:/var/run/docker.sock
+  #   - scripts:/scripts
+  #   entrypoint:
+  #   - /bin/sh
+  #   - /scripts/install-curl.sh
+  #   deploy:
+  #     replicas: 1
+  #     placement:
+  #       constraints:
+  #       - node.role == manager
 volumes:
   db:
   certs:

pihole/docker-compose.yml

@@ -33,6 +33,17 @@ services:
       TZ: Europe/Bratislava
     hostname: m-server
     image: pihole/pihole:latest
+    shm_size: '256mb'
+    logging:
+      driver: loki
+      options:
+        loki-url: http://192.168.77.101:3100/loki/api/v1/push
+        loki-relabel-config: |
+          - action: labelmap
+            regex: swarm_stack
+            replacement: namespace
+          - action: labelmap
+            regex: swarm_(service)
     labels:
       com.centurylinklabs.watchtower.enable: 'true'
       homepage.container: pihole
@@ -53,10 +64,15 @@ services:
       pihole:
         ipv4_address: 192.168.78.254
     ports:
-    - '53:53'
+    - '53:53/udp'
     - '9380:80'
     - '9343:443'  
     restart: always
     volumes:
-    - /share/docker_data/pihole/etc-pihole:/etc/pihole
-    - /share/docker_data/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
+    - data:/etc/pihole
+    - dnsmasq_d:/etc/dnsmasq.d
+volumes:
+  data:
+    driver: local
+  dnsmasq_d:
+    driver: local