From 69130c5077e940b21205ccd60afc1f09af732770 Mon Sep 17 00:00:00 2001 From: "Spectre7651 (Alfie)" Date: Fri, 18 Sep 2026 13:00:36 +0100 Subject: [PATCH] Add Garage Service with fixes recommended --- .github/workflows/linting.yml | 4 +- CONTRIBUTING.md | 39 +++++++- README.md | 18 +++- services/actual-budget/.env | 7 +- services/actual-budget/README.md | 2 +- services/actual-budget/compose.yaml | 16 ++-- services/adguardhome-sync/.env | 4 +- services/adguardhome-sync/README.md | 2 +- services/adguardhome-sync/compose.yaml | 16 +++- services/adguardhome/.env | 4 +- services/adguardhome/README.md | 2 +- services/adguardhome/compose.yaml | 16 ++-- services/affine/.env | 7 +- services/affine/README.md | 2 +- services/affine/{compose.yml => compose.yaml} | 48 ++++++---- services/anchor/.env | 7 +- services/anchor/README.md | 2 +- services/anchor/compose.yaml | 21 ++--- services/arcane/.env | 10 +- services/arcane/README.md | 2 +- services/arcane/compose.yaml | 17 ++-- services/artisttrackarr/.env | 7 +- services/artisttrackarr/README.md | 2 +- services/artisttrackarr/compose.yaml | 20 ++-- services/audiobookshelf/.env | 4 +- services/audiobookshelf/README.md | 2 +- services/audiobookshelf/compose.yaml | 18 ++-- services/bazarr/.env | 4 +- services/bazarr/README.md | 2 +- services/bazarr/compose.yaml | 18 ++-- services/bentopdf/.env | 4 +- services/bentopdf/README.md | 4 +- services/bentopdf/compose.yaml | 16 ++-- services/beszel-agent/.env | 4 +- services/beszel-agent/README.md | 2 +- services/beszel-agent/compose.yaml | 16 ++-- services/beszel-hub/.env | 4 +- services/beszel-hub/README.md | 2 +- services/beszel-hub/compose.yaml | 17 ++-- services/booklore/.env | 16 ++-- services/booklore/README.md | 4 +- services/booklore/compose.yaml | 38 ++++---- services/caddy/.env | 6 +- services/caddy/README.md | 6 +- services/caddy/compose.yaml | 30 +++--- services/changedetection/.env | 4 +- services/changedetection/README.md | 2 +- services/changedetection/compose.yaml | 18 ++-- services/clipcascade/.env | 4 +- services/clipcascade/README.md | 2 +- services/clipcascade/compose.yaml | 18 ++-- services/coder/.env | 4 +- services/coder/README.md | 11 ++- services/coder/compose.yaml | 23 +++-- services/configarr/.env | 4 +- services/configarr/README.md | 4 +- services/configarr/compose.yaml | 27 +++--- services/convertx/.env | 4 +- services/convertx/README.md | 2 +- services/convertx/compose.yaml | 19 ++-- services/copyparty/.env | 4 +- services/copyparty/README.md | 4 +- services/copyparty/compose.yaml | 19 ++-- services/cyberchef/.env | 4 +- services/cyberchef/README.md | 2 +- services/cyberchef/compose.yaml | 18 ++-- services/ddns-updater/.env | 4 +- services/ddns-updater/README.md | 11 ++- services/ddns-updater/compose.yaml | 23 ++--- services/dockge/.env | 13 ++- services/dockge/README.md | 2 +- services/dockge/compose.yaml | 22 +++-- services/dockhand/.env | 7 +- services/dockhand/README.md | 2 +- services/dockhand/compose.yaml | 22 ++--- services/docmost/.env | 10 +- services/docmost/README.md | 13 ++- services/docmost/compose.yaml | 39 +++++--- services/donetick/.env | 4 +- services/donetick/README.md | 2 +- services/donetick/compose.yaml | 21 ++--- services/dozzle/.env | 4 +- services/dozzle/README.md | 2 +- services/dozzle/compose.yaml | 18 ++-- services/dumbdo/.env | 4 +- services/dumbdo/README.md | 18 ++-- services/dumbdo/compose.yaml | 21 ++--- services/eigenfocus/.env | 4 +- services/eigenfocus/README.md | 2 +- services/eigenfocus/compose.yaml | 26 +++--- services/espocrm/.env | 11 ++- services/espocrm/README.md | 10 +- .../espocrm/{compose.yml => compose.yaml} | 27 ++++-- services/excalidraw/.env | 4 +- services/excalidraw/README.md | 2 +- services/excalidraw/compose.yaml | 23 ++--- services/filebrowser/.env | 5 +- .../filebrowser/{compose.yml => compose.yaml} | 15 +-- services/flaresolverr/.env | 4 +- services/flaresolverr/README.md | 2 +- services/flaresolverr/compose.yaml | 23 +++-- services/flatnotes/.env | 7 +- services/flatnotes/README.md | 20 ++-- services/flatnotes/compose.yaml | 21 ++--- services/forgejo/.env | 4 +- services/forgejo/README.md | 2 +- services/forgejo/compose.yaml | 16 ++-- services/formbricks/.env | 7 +- services/formbricks/README.md | 6 +- services/formbricks/compose.yaml | 30 +++++- services/fossflow/.env | 4 +- services/fossflow/README.md | 2 +- services/fossflow/compose.yaml | 24 +++-- services/freshrss/.env | 3 +- services/freshrss/compose.yaml | 10 +- services/frigate/.env | 7 +- services/frigate/README.md | 2 +- services/frigate/compose.yaml | 19 ++-- services/garage/.env | 33 +++++++ services/garage/README.md | 92 +++++++++++++++++++ services/garage/compose.yaml | 80 ++++++++++++++++ services/garage/garage.toml | 22 +++++ services/ghost/.env | 7 +- services/ghost/README.md | 4 +- services/ghost/compose.yaml | 32 ++++--- services/gitea/.env | 4 +- services/gitea/README.md | 2 +- services/gitea/compose.yaml | 16 ++-- services/gitsave/.env | 4 +- services/gitsave/README.md | 2 +- services/gitsave/compose.yaml | 16 ++-- services/glance/.env | 4 +- services/glance/README.md | 2 +- services/glance/compose.yaml | 20 ++-- services/gokapi/.env | 4 +- services/gokapi/README.md | 2 +- services/gokapi/compose.yaml | 23 ++--- services/gotify/.env | 4 +- services/gotify/README.md | 2 +- services/gotify/compose.yaml | 24 ++--- services/grampsweb/.env | 4 +- services/grampsweb/README.md | 2 +- services/grampsweb/compose.yaml | 33 +++++-- services/haptic/.env | 6 +- services/haptic/README.md | 2 +- services/haptic/compose.yaml | 28 +++--- services/hemmelig/.env | 4 +- services/hemmelig/README.md | 2 +- services/hemmelig/compose.yaml | 29 ++---- services/homarr/.env | 7 +- services/homarr/README.md | 12 ++- services/homarr/compose.yaml | 20 ++-- services/home-assistant/.env | 4 +- services/home-assistant/README.md | 20 ++-- services/home-assistant/compose.yaml | 16 ++-- services/homebox/.env | 11 ++- services/homebox/README.md | 10 +- services/homebox/compose.yaml | 23 ++--- services/homepage/.env | 4 +- services/homepage/README.md | 2 +- services/homepage/compose.yaml | 26 +++--- services/hytale/.env | 5 +- services/hytale/compose.yaml | 15 +-- services/immich/.env | 11 +-- services/immich/README.md | 10 +- services/immich/compose.yaml | 27 +++--- services/isley/.env | 4 +- services/isley/README.md | 2 +- services/isley/compose.yaml | 23 ++--- services/it-tools/.env | 4 +- services/it-tools/README.md | 2 +- services/it-tools/compose.yaml | 18 ++-- services/jellyfin/.env | 4 +- services/jellyfin/README.md | 2 +- services/jellyfin/compose.yaml | 18 ++-- services/kaneo/.env | 18 +--- services/kaneo/README.md | 2 +- services/kaneo/compose.yaml | 37 +++++--- services/karakeep/.env | 7 +- services/karakeep/README.md | 2 +- services/karakeep/compose.yaml | 41 +++++---- services/kavita/.env | 4 +- services/kavita/README.md | 2 +- services/kavita/compose.yaml | 21 ++--- services/kitchenowl/.env | 12 ++- services/kitchenowl/README.md | 2 +- services/kitchenowl/compose.yaml | 21 +++-- services/languagetool/.env | 4 +- services/languagetool/README.md | 2 +- services/languagetool/compose.yaml | 23 ++--- services/linkding/.env | 4 +- services/linkding/.linkding.env | 2 +- services/linkding/README.md | 2 +- services/linkding/compose.yaml | 23 ++--- services/lube-logger/.env | 4 +- services/lube-logger/README.md | 2 +- services/lube-logger/compose.yaml | 26 +++--- services/mailpit/.env | 7 +- services/mailpit/compose.yaml | 17 ++-- services/mattermost/.env | 27 +++--- services/mattermost/README.md | 14 ++- services/mattermost/compose.yaml | 33 ++++--- services/mealie/.env | 4 +- services/mealie/README.md | 2 +- services/mealie/compose.yaml | 23 ++--- services/memos/.env | 7 +- services/memos/README.md | 2 +- services/memos/compose.yaml | 17 ++-- services/metube/.env | 4 +- services/metube/README.md | 2 +- services/metube/compose.yaml | 18 ++-- services/minecraft/.env | 5 +- services/minecraft/README.md | 2 +- services/minecraft/compose.yaml | 24 ++--- services/miniflux/.env | 7 +- services/miniflux/README.md | 2 +- services/miniflux/compose.yaml | 20 ++-- services/miniqr/.env | 4 +- services/miniqr/README.md | 2 +- services/miniqr/compose.yaml | 16 ++-- services/nanote/.env | 4 +- services/nanote/README.md | 2 +- services/nanote/compose.yaml | 16 ++-- services/navidrome/.env | 4 +- services/navidrome/README.md | 4 +- services/navidrome/compose.yaml | 27 +++--- services/nessus/.env | 4 +- services/nessus/README.md | 2 +- services/nessus/compose.yaml | 16 ++-- services/netbox/.env | 27 +++--- services/netbox/README.md | 13 ++- services/netbox/compose.yaml | 45 +++++---- services/newwallpaperwhodis/.env | 6 +- services/newwallpaperwhodis/compose.yaml | 11 ++- services/next-explorer/.env | 8 +- services/next-explorer/README.md | 4 +- services/next-explorer/compose.yaml | 32 +++---- services/nodered/.env | 4 +- services/nodered/README.md | 11 ++- services/nodered/compose.yaml | 23 ++--- services/ntfy/.env | 4 +- services/ntfy/README.md | 2 +- services/ntfy/compose.yaml | 18 ++-- services/ollama/.env | 7 +- services/ollama/README.md | 7 +- services/ollama/compose.yaml | 9 +- services/open-webui/.env | 10 +- services/open-webui/README.md | 4 +- services/open-webui/compose.yaml | 13 +-- services/paperless/.env | 9 +- services/paperless/README.md | 2 +- .../paperless/{compose.yml => compose.yaml} | 34 ++++--- services/picard/.env | 7 +- services/picard/README.md | 2 +- services/picard/compose.yaml | 20 ++-- services/pihole/.env | 4 +- services/pihole/README.md | 2 +- services/pihole/compose.yaml | 23 ++--- services/pingvin-share/.env | 4 +- services/pingvin-share/README.md | 2 +- services/pingvin-share/compose.yaml | 23 ++--- services/plex/.env | 4 +- services/plex/README.md | 2 +- services/plex/compose.yaml | 18 ++-- services/pocket-id/.env | 8 +- services/pocket-id/README.md | 47 ++++++++-- services/pocket-id/compose.yaml | 21 ++--- services/portainer/.env | 4 +- services/portainer/README.md | 2 +- services/portainer/compose.yaml | 18 ++-- services/portracker/.env | 4 +- services/portracker/README.md | 2 +- services/portracker/compose.yaml | 26 +++--- services/posterizarr/.env | 4 +- services/posterizarr/README.md | 11 ++- services/posterizarr/compose.yaml | 24 ++--- services/prowlarr/.env | 4 +- services/prowlarr/README.md | 2 +- services/prowlarr/compose.yaml | 18 ++-- services/qbittorrent/.env | 4 +- services/qbittorrent/README.md | 2 +- services/qbittorrent/compose.yaml | 20 ++-- services/radarr/.env | 4 +- services/radarr/README.md | 2 +- services/radarr/compose.yaml | 18 ++-- services/radicale/.env | 6 +- services/radicale/README.md | 2 +- services/radicale/compose.yaml | 24 ++--- services/recyclarr/.env | 6 +- services/recyclarr/README.md | 11 ++- services/recyclarr/compose.yaml | 28 +++--- services/resilio-sync/.env | 4 +- services/resilio-sync/README.md | 2 +- services/resilio-sync/compose.yaml | 18 ++-- services/rustdesk-server/.env | 9 +- services/rustdesk-server/README.md | 2 +- .../{compose.yml => compose.yaml} | 22 ++--- services/seafile/.env | 24 ++--- services/seafile/README.md | 21 ++++- services/seafile/compose.yaml | 27 ++++-- services/searxng/.env | 10 +- services/searxng/README.md | 4 +- services/searxng/compose.yaml | 35 ++++--- services/seerr/.env | 4 +- services/seerr/README.md | 11 ++- services/seerr/compose.yaml | 18 ++-- services/slink/.env | 4 +- services/slink/README.md | 2 +- services/slink/compose.yaml | 25 ++--- services/sonarr/.env | 4 +- services/sonarr/README.md | 2 +- services/sonarr/compose.yaml | 18 ++-- services/speedtest-tracker/.env | 7 +- services/speedtest-tracker/README.md | 12 ++- services/speedtest-tracker/compose.yaml | 19 ++-- services/stirlingpdf/.env | 4 +- services/stirlingpdf/README.md | 2 +- services/stirlingpdf/compose.yaml | 24 ++--- services/subtrackr/.env | 4 +- services/subtrackr/README.md | 2 +- services/subtrackr/compose.yaml | 21 ++--- services/sure/.env | 15 +-- services/sure/compose.yaml | 35 +++++-- services/swingmx/.env | 6 +- services/swingmx/README.md | 4 +- services/swingmx/compose.yaml | 16 ++-- services/tailscale-app-connector-node/.env | 5 +- .../tailscale-app-connector-node/compose.yaml | 6 +- services/tailscale-exit-node/.env | 7 +- services/tailscale-exit-node/compose.yaml | 6 +- services/tailscale-subnet-router-node/.env | 7 +- .../tailscale-subnet-router-node/compose.yaml | 6 +- services/tandoor/.env | 2 +- services/tandoor/README.md | 2 +- services/tandoor/compose.yaml | 18 ++-- services/tautulli/.env | 4 +- services/tautulli/README.md | 2 +- services/tautulli/compose.yaml | 18 ++-- services/technitium/.env | 4 +- services/technitium/compose.yaml | 13 +-- services/tracktor/.env | 11 ++- services/tracktor/README.md | 6 +- services/tracktor/compose.yaml | 21 +++-- services/traefik/.env | 4 +- services/traefik/README.md | 14 ++- services/traefik/compose.yaml | 36 ++++---- services/traefik/traefik/app/traefik.yml | 0 services/transmute/.env | 7 +- services/transmute/README.md | 2 +- services/transmute/compose.yaml | 22 ++--- services/uptime-kuma/.env | 4 +- services/uptime-kuma/README.md | 2 +- services/uptime-kuma/compose.yaml | 25 +++-- services/vaultwarden/.env | 4 +- services/vaultwarden/README.md | 2 +- services/vaultwarden/compose.yaml | 18 ++-- services/vikunja/.env | 9 +- services/vikunja/README.md | 2 +- services/vikunja/compose.yaml | 24 +++-- services/wallos/.env | 4 +- services/wallos/README.md | 2 +- services/wallos/compose.yaml | 23 ++--- services/xwiki/.env | 5 +- services/xwiki/{compose.yml => compose.yaml} | 31 +++++-- templates/service-template/.env | 16 ++-- templates/service-template/README.md | 2 +- templates/service-template/compose.yaml | 35 +++++-- 367 files changed, 2448 insertions(+), 1857 deletions(-) rename services/affine/{compose.yml => compose.yaml} (71%) rename services/espocrm/{compose.yml => compose.yaml} (73%) rename services/filebrowser/{compose.yml => compose.yaml} (79%) create mode 100644 services/garage/.env create mode 100644 services/garage/README.md create mode 100644 services/garage/compose.yaml create mode 100644 services/garage/garage.toml rename services/paperless/{compose.yml => compose.yaml} (71%) rename services/rustdesk-server/{compose.yml => compose.yaml} (78%) delete mode 100644 services/traefik/traefik/app/traefik.yml rename services/xwiki/{compose.yml => compose.yaml} (70%) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 6213890f..95c90496 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -29,9 +29,9 @@ jobs: - name: Clone this repo uses: actions/checkout@v7 - - name: Lint services + - name: Lint Markdown uses: rvben/rumdl@v0.2.73 with: - path: "services/" + path: "." config: ".markdownlint.yml" report-type: annotations diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1c8e487a..78e516a8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -35,11 +35,40 @@ Thanks for helping improve these Tailscale sidecar examples. port you expose. Remove the Serve configuration when the service does not use Tailscale Serve. -5. Add a health check that the application image can run. - - Prefer an application endpoint or an upstream health command. Remove the - application health check when no reliable check exists. Keep the Tailscale - health check. +5. Configure the application's health check. + + Use the first option that the image supports. The template lists the same + options in the same order. + + 1. When the image defines its own `HEALTHCHECK`, omit the block and add a + `# Healthcheck: defined by the image (...)` comment that names the + command or what it checks. Override the image's check only when it does + not work with the stack, and say why in a comment. + 2. Call an application endpoint with a client that ships with the image. + 3. Run a health command that ships with the image. + 4. Check a fixed process name with `pidof` or `pgrep -x`, when the + container has no endpoint or the image has no HTTP client. `pgrep -x` + matches at most 15 characters of the process name. When the process + name is generic, such as `python`, use `pgrep -f` with a fixed pattern. + 5. When the image has no shell, HTTP client, or health command, no check + is possible. Omit the block and add a `# Healthcheck: none possible ...` + comment that names the reason. + + Run the command inside the running container before you commit it. Avoid + `pgrep -f ${SERVICE}`, which breaks when `SERVICE` is renamed. + + A container that runs once and exits needs no check. Omit the block and + add a `# Healthcheck: none needed ...` comment that names the reason. + + For a database, connect over TCP, for example with + `pg_isready -h 127.0.0.1` or `mariadb-admin ping -h 127.0.0.1`. During the + first start, the image runs a temporary server that accepts only socket + connections, so a socket check reports ready too early. When another + service depends on the database, wait with `condition: service_healthy`. + A database image's own `HEALTHCHECK` still comes first. When that check + connects over the socket, say so in the comment. + + Keep the Tailscale health check. 6. Complete the service README. diff --git a/README.md b/README.md index 4d6d507a..e6f9481b 100644 --- a/README.md +++ b/README.md @@ -51,11 +51,11 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose - [🎥 Media and Entertainment](#-media-and-entertainment) - [💼 Productivity and Collaboration](#-productivity-and-collaboration) - [📊 Dashboards and Visualization](#-dashboards-and-visualization) - - [🛠️ Development Tools](#️-development-tools) + - [🛠️ Development Tools](#development-tools) - [📈 Monitoring and Analytics](#-monitoring-and-analytics) - [🏠 Smart Home](#-smart-home) - [📱 Utilities](#-utilities) - - [🍽️ Food \& Wellness](#️-food--wellness) + - [🍽️ Food \& Wellness](#food-wellness) - [Tailscale Information](#tailscale-information) - [Tailscale Funnel vs. Tailscale Serve](#tailscale-funnel-vs-tailscale-serve) - [Tailscale Funnel](#tailscale-funnel) @@ -80,7 +80,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 🔍 **Nessus** | A powerful vulnerability scanner with a free Essentials model for home use. | [Details](services/nessus) | | 🗃️ **Netbox** | NetBox is the leading solution for modeling and documenting modern networks. | [Details](services/netbox) | | 🧩 **Pi-hole** | A network-level ad blocker that acts as a DNS sinkhole. | [Details](services/pihole) | -| 🆔 **Pocket ID** | A self-hosted decentralized identity (OIDC) solution for secure authentication. | [Details](services/pocket-id) | +| 🆔 **Pocket ID** | A self-hosted OIDC provider that signs users in to your services with passkeys. | [Details](services/pocket-id) | | 🌐 **Rustdesk Server** | RustDesk is an open source remote control alternative for self-hosting and security. | [Details](services/rustdesk-server) | | 🔒 **Technitium DNS** | An open-source DNS server that can be used for self-hosted DNS services. | [Details](services/technitium) | | 🌐 **Traefik** | A modern reverse proxy and load balancer for microservices. | [Details](services/traefik) | @@ -92,13 +92,14 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 🎥 Service | 📝 Description | 🔗 Link | | -------------------- | ------------------------------------------------------------------------------------------------------- | ---------------------------------- | -| 🎵 **ArtistTrackarr** | A self-hosted dashboard for tracking upcoming and newly released albums and EP's. | [Details](services/artisttrackarr) | +| 🎵 **ArtistTrackarr** | A self-hosted dashboard for tracking upcoming and newly released albums and EPs. | [Details](services/artisttrackarr) | | 🎧 **Audiobookshelf** | A self-hosted audiobook and podcast server with multi-user support and playback syncing. | [Details](services/audiobookshelf) | | 🎥 **Bazarr** | A companion tool to Radarr and Sonarr for managing subtitles. | [Details](services/bazarr) | | 📚 **BookLore** | A self-hosted application for managing and reading books. | [Details](services/booklore) | | 📰 **FreshRSS** | A customizable feed reader with themes, extensions, and no separate database. | [Details](services/freshrss) | | 🎥 **Frigate** | A self-hosted NVR with real-time AI object detection for IP cameras and local video monitoring. | [Details](services/frigate) | | 🎮 **Hytale** | A self-hosted Hytale game server. | [Details](services/hytale) | +| ⛏️ **Minecraft** | A self-hosted Minecraft Java Edition server for private Tailnet multiplayer. | [Details](services/minecraft) | | 🖼️ **Immich** | A self-hosted Google Photos alternative with face recognition and mobile sync. | [Details](services/immich) | | 📺 **Jellyfin** | An open-source media system that puts you in control of managing and streaming your media. | [Details](services/jellyfin) | | 📖 **Kavita** | An open-source, self-hosted digital library for comics, manga, and ebooks. | [Details](services/kavita) | @@ -125,6 +126,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 💼 Service | 📝 Description | 🔗 Link | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | | 💰 **Actual Budget** | A self-hosted personal finance and budgeting app focused on privacy and full data ownership. | [Details](services/actual-budget) | +| 🧠 **AFFiNE** | A self-hosted workspace for documents, whiteboards, and databases. | [Details](services/affine) | | ⚓ **Anchor** | An offline-first, self-hosted note-taking app with sync, attachments, sharing, and optional OIDC authentication. | [Details](services/anchor) | | 📄 **BentoPDF** | A lightweight, self-hosted web app for viewing and managing PDF documents. | [Details](services/bentopdf) | | ✂️ **ClipCascade** | A self-hosted clipboard manager for syncing and organizing clipboard history. | [Details](services/clipcascade) | @@ -138,6 +140,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 📝 **Flatnotes** | A simple, self-hosted note-taking app using Markdown files. | [Details](services/flatnotes) | | 👨🏼‍💻 **Forgejo** | A community-driven, self-hosted Git service. | [Details](services/forgejo) | | 📋 **Formbricks** | A self-hosted, open-source platform for collecting user feedback, surveys, and NPS. | [Details](services/formbricks) | +| 💾 **Garage** | A self-hosted, open-source s3 compatible object storage backend built to be resilient and performant | [Details](services/garage) | | 👨🏼‍💻 **Gitea** | A lightweight, self-hosted Git service with repository hosting, pull requests, and issue tracking. | [Details](services/gitea) | | ✍️ **Ghost** | A modern, open-source publishing platform for blogs and newsletters. | [Details](services/ghost) | | 🧑‍🧑‍🧒‍🧒 **Gramps Web** | A web-based genealogy platform for collaborative family tree browsing, editing, AI-powered chat, media tagging, mapping, charts, search, and reporting. | [Details](services/grampsweb) | @@ -150,6 +153,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 📥 **Mattermost** | A self-hosted collaborative workflow and communication tool. | [Details](services/mattermost) | | 📝 **Memos** | A lightweight, self-hosted note-taking and knowledge management platform for capturing ideas, daily notes, and personal knowledge. | [Details](services/memos) | | 📝 **Nanote** | A lightweight, self-hosted note-taking app with Markdown support. | [Details](services/nanote) | +| 📂 **NextExplorer** | A self-hosted file explorer for managing mounted directories. | [Details](services/next-explorer) | | 🤖 **Open WebUI** | A self-hosted AI platform with a ChatGPT-style interface for local and cloud-based models. | [Details](services/open-webui) | | 🔗 **Pingvin Share** | **PROJECT ARCHIVED** A self-hosted file sharing platform. | [Details](services/pingvin-share) | | 📅 **Radicale** | A lightweight CalDAV and CardDAV server for self-hosted calendar, to-do, and contact sync. | [Details](services/radicale) | @@ -171,6 +175,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 🏠 **Homepage** | A modern, highly customizable homepage for organizing links and monitoring services. | [Details](services/homepage) | | 🖼️ **NewWallpaperWhoDis** | A lightweight, self-hosted wallpaper management server and dynamic rotation engine built on flat-file architecture. | [Details](services/newwallpaperwhodis) | + ### 🛠️ Development Tools @@ -183,6 +188,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 🐳 **Dockhand** | A modern, lightweight Docker management UI for containers and Compose stacks. | [Details](services/dockhand) | | 🐳 **Dockge** | A lightweight, self-hosted Docker Compose stack manager with a web UI. | [Details](services/dockge) | | 🖥️ **Dozzle** | A real-time log viewer for Docker containers. | [Details](services/dozzle) | +| 📁 **Filebrowser** | A lightweight web file manager for a host directory. | [Details](services/filebrowser) | | 🔁 **FossFLOW** | A self-hosted tool to make beautiful isometric infrastructure diagrams. | [Details](services/fossflow) | | 🖥️ **GitSave** | A self-hosted service to back up your GitHub repositories via a simple REST API and scheduled runs. | [Details](services/gitsave) | | 🖥️ **Gokapi** | A lightweight self-hosted file sharing platform. | [Details](services/gokapi) | @@ -224,6 +230,8 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 🚗 **Tracktor** | Self-hosted vehicle maintenance tracker. | [Details](services/tracktor) | | 🔁 **Transmute** | A self-hosted file conversion and transformation service for handling documents, media, and other format changes. | [Details](services/transmute) | + + ### 🍽️ Food & Wellness | 🥘 Service | 📝 Description | 🔗 Link | @@ -272,7 +280,7 @@ Made with [contrib.rocks](https://contrib.rocks). ## Contributing -See [CONTRIBUTING.md](/CONTRIBUTING.md) for guidance on adding services with the [template](/templates/service-template/) to keep Tailscale-sidecar setups consistent. +See [CONTRIBUTING.md](CONTRIBUTING.md) for guidance on adding services with the [template](templates/service-template/) to keep Tailscale-sidecar setups consistent. ## Star History diff --git a/services/actual-budget/.env b/services/actual-budget/.env index 87077102..9107e8cf 100644 --- a/services/actual-budget/.env +++ b/services/actual-budget/.env @@ -11,12 +11,13 @@ SERVICEPORT=5006 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/actual-budget/README.md b/services/actual-budget/README.md index 535aaddf..93282d00 100644 --- a/services/actual-budget/README.md +++ b/services/actual-budget/README.md @@ -10,7 +10,7 @@ When paired with Tailscale, Actual Budget becomes accessible across your devices ## Configuration Overview -In this setup, the `tailscale-actual` service runs Tailscale, which manages secure networking for Actual Budget. The `actual` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures the application is only reachable over your Tailnet unless you explicitly expose ports. +In this setup, the `tailscale-actual` service runs Tailscale, which manages secure networking for Actual Budget. The `actual` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures the application is only reachable over your Tailnet unless you explicitly expose ports. ## Key Features diff --git a/services/actual-budget/compose.yaml b/services/actual-budget/compose.yaml index 72bd66a8..64559d59 100644 --- a/services/actual-budget/compose.yaml +++ b/services/actual-budget/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -72,7 +72,7 @@ services: condition: service_healthy healthcheck: # Enable health check for the instance - test: ['CMD-SHELL', 'node src/scripts/health-check.js'] + test: ['CMD-SHELL', 'node src/scripts/health-check.js'] # Check if the service is responding interval: 60s timeout: 10s retries: 3 diff --git a/services/adguardhome-sync/.env b/services/adguardhome-sync/.env index c03156f2..5743c44a 100644 --- a/services/adguardhome-sync/.env +++ b/services/adguardhome-sync/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/adguardhome-sync/README.md b/services/adguardhome-sync/README.md index 1540bdf2..0a3c2f80 100644 --- a/services/adguardhome-sync/README.md +++ b/services/adguardhome-sync/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[AdGuardHome Sync](https://github.co ## Configuration Overview -In this setup, the `tailscale-adguardhome-sync` service runs Tailscale, which manages secure networking for the AdGuardHome Sync service. The `adguardhome-sync` container uses the Tailscale network stack via Docker’s `network_mode: service:` configuration. This ensures that all sync communication is confined to your private Tailscale network, preventing exposure to the public internet. +In this setup, the `tailscale-adguardhome-sync` service runs Tailscale, which manages secure networking for the AdGuardHome Sync service. The `adguardhome-sync` container uses the Tailscale network stack via Docker’s `network_mode: service:tailscale` configuration. This ensures that all sync communication is confined to your private Tailscale network, preventing exposure to the public internet. diff --git a/services/adguardhome-sync/compose.yaml b/services/adguardhome-sync/compose.yaml index 0ef1f9b6..85723b2e 100644 --- a/services/adguardhome-sync/compose.yaml +++ b/services/adguardhome-sync/compose.yaml @@ -1,6 +1,6 @@ services: # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -13,7 +13,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true volumes: - ./config:/config # Config folder used to store Tailscale files - you may need to change the path @@ -23,7 +23,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -35,10 +35,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management command: run environment: @@ -69,4 +69,10 @@ services: depends_on: tailscale: condition: service_healthy + healthcheck: + test: ["CMD", "/opt/go/adguardhome-sync", "healthcheck"] # Built-in check against the API server; the image has no shell or HTTP client + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always diff --git a/services/adguardhome/.env b/services/adguardhome/.env index b2b89159..bc2788d9 100644 --- a/services/adguardhome/.env +++ b/services/adguardhome/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/adguardhome/README.md b/services/adguardhome/README.md index e7fa44fa..b9f36dd3 100644 --- a/services/adguardhome/README.md +++ b/services/adguardhome/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [AdGuard Home](https://github.com/Adgu ## Configuration Overview -In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for the AdGuard Home service. The `adguardhome` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that AdGuard Home's DNS service is only accessible through the Tailscale network (or local as well, if preferred). +In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for the AdGuard Home service. The `adguardhome` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that AdGuard Home's DNS service is only accessible through the Tailscale network (or local as well, if preferred). ## Binding to your local host machine? Port 53 - DNSStubListener diff --git a/services/adguardhome/compose.yaml b/services/adguardhome/compose.yaml index ccf8aaf7..dffdf232 100644 --- a/services/adguardhome/compose.yaml +++ b/services/adguardhome/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -38,8 +38,8 @@ services: - "0.0.0.0:53:53/udp" # Binding port 53/udp to the local network - may be removed if only exposure to your Tailnet is required - "0.0.0.0:53:53/tcp" # Binding port 53/tcp to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -48,10 +48,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TZ=${TZ} @@ -62,7 +62,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "pidof", "AdGuardHome"] # Check if the AdGuard Home process is running; its web port changes after the setup wizard interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/affine/.env b/services/affine/.env index 6e65bb1c..e7d3c64d 100644 --- a/services/affine/.env +++ b/services/affine/.env @@ -11,9 +11,10 @@ SERVICEPORT=3010 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # select a revision to deploy, available values: stable, beta, canary @@ -30,4 +31,4 @@ AFFINE_SERVER_EXTERNAL_URL=https://affine..ts.net # database credentials DB_USERNAME=affine DB_PASSWORD=affine -DB_DATABASE=affine \ No newline at end of file +DB_DATABASE=affine diff --git a/services/affine/README.md b/services/affine/README.md index 27478ccf..3e066b19 100644 --- a/services/affine/README.md +++ b/services/affine/README.md @@ -20,7 +20,7 @@ AFFiNE is designed around modern knowledge work, blending structured content and ## Configuration Overview -In this setup, the `tailscale-affine` service runs Tailscale and handles secure networking for the stack. The `affine` service shares the Tailscale container's network namespace using Docker's `network_mode: service:` configuration. This means AFFiNE is reachable through your Tailnet without exposing it directly to the public internet. +In this setup, the `tailscale-affine` service runs Tailscale and handles secure networking for the stack. The `affine` service shares the Tailscale container's network namespace using Docker's `network_mode: service:tailscale` configuration. This means AFFiNE is reachable through your Tailnet without exposing it directly to the public internet. This approach provides a secure and simple way to self-host AFFiNE privately, whether for personal note-taking, team collaboration, or internal documentation. diff --git a/services/affine/compose.yml b/services/affine/compose.yaml similarity index 71% rename from services/affine/compose.yml rename to services/affine/compose.yaml index e8f4a4dc..da408e3d 100644 --- a/services/affine/compose.yml +++ b/services/affine/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: - # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Make sure you have updated/checked the .env file with the correct variables. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: [ "CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz" ] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,12 +47,14 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ghcr.io/toeverything/affine:${AFFINE_REVISION:-stable} # Image to be used container_name: app-${SERVICE} # Name for local container management - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale depends_on: + tailscale: + condition: service_healthy redis: condition: service_healthy postgres: @@ -66,27 +68,34 @@ services: env_file: - .env environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. - REDIS_SERVER_HOST=redis - - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${postgres:-affine} + - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${DB_DATABASE:-affine} - AFFINE_INDEXER_ENABLED=false #- EXAMPLE_VAR=${EXAMPLE_VAR} + healthcheck: + test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3010/info').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"] # Check if the service is responding; the image has no wget or curl + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always affine_migration: image: ghcr.io/toeverything/affine:${AFFINE_REVISION:-stable} # Image to be used - container_name: affine_migration_job # Name for local container management + container_name: app-${SERVICE}-migration # Name for local container management volumes: # custom configurations - ./${SERVICE}-storage:/root/.affine/storage - ./${SERVICE}-config:/root/.affine/config command: [ 'sh', '-c', 'node ./scripts/self-host-predeploy.js' ] + # Healthcheck: none needed. The migration job runs once and exits before AFFiNE starts. env_file: - .env environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. - REDIS_SERVER_HOST=redis - - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${postgres:-affine} + - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${DB_DATABASE:-affine} - AFFINE_INDEXER_ENABLED=false #- EXAMPLE_VAR=${EXAMPLE_VAR} depends_on: @@ -97,9 +106,9 @@ services: redis: image: redis # Image to be used - container_name: affine_redis # Name for local container management + container_name: app-${SERVICE}-redis # Name for local container management healthcheck: - test: [ 'CMD', 'redis-cli', '--raw', 'incr', 'ping' ] # Check if redis process is running + test: [ 'CMD', 'redis-cli', '--raw', 'incr', 'ping' ] # Check if Redis responds interval: 10s # How often to perform the check timeout: 5s # Time to wait for the check to succeed retries: 5 # Number of retries before marking as unhealthy @@ -107,22 +116,23 @@ services: postgres: image: pgvector/pgvector:pg16 # Image to be used - container_name: affine_postgres # Name for local container management + container_name: app-${SERVICE}-postgres # Name for local container management volumes: - ./postgres:/var/lib/postgresql/data environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. POSTGRES_USER: ${DB_USERNAME} POSTGRES_PASSWORD: ${DB_PASSWORD} - POSTGRES_DB: ${postgres:-affine} + POSTGRES_DB: ${DB_DATABASE:-affine} POSTGRES_INITDB_ARGS: '--data-checksums' # you better set a password for you database # or you may add 'POSTGRES_HOST_AUTH_METHOD=trust' to ignore postgres security policy POSTGRES_HOST_AUTH_METHOD: trust #- EXAMPLE_VAR=${EXAMPLE_VAR} healthcheck: - test: [ 'CMD', 'pg_isready', '-U', "${DB_USERNAME}", '-d', "${postgres:-affine}" ] # Check if postgres process is running + test: [ 'CMD', 'pg_isready', '-h', '127.0.0.1', '-U', "${DB_USERNAME}", '-d', "${DB_DATABASE:-affine}" ] # Check if PostgreSQL accepts connections interval: 15s # How often to perform the check timeout: 5s # Time to wait for the check to succeed retries: 5 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always diff --git a/services/anchor/.env b/services/anchor/.env index e95785fa..45e18299 100644 --- a/services/anchor/.env +++ b/services/anchor/.env @@ -11,12 +11,13 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/anchor/README.md b/services/anchor/README.md index 70f49d43..d16c77b3 100644 --- a/services/anchor/README.md +++ b/services/anchor/README.md @@ -18,7 +18,7 @@ This Docker Compose configuration sets up [Anchor](https://github.com/ZhFahim/an ## Configuration Overview -In this setup, the `tailscale-anchor` service runs Tailscale and manages secure networking for Anchor. The `anchor` service shares that network stack via Docker's `network_mode: service:` configuration, which keeps the app private to your Tailnet unless you intentionally add host port mappings or funnel it through another public entrypoint. +In this setup, the `tailscale-anchor` service runs Tailscale and manages secure networking for Anchor. The `anchor` service shares that network stack via Docker's `network_mode: service:tailscale` configuration, which keeps the app private to your Tailnet unless you intentionally add host port mappings or funnel it through another public entrypoint. ## Upstream documentation diff --git a/services/anchor/compose.yaml b/services/anchor/compose.yaml index 5b4024f6..65c7d05b 100644 --- a/services/anchor/compose.yaml +++ b/services/anchor/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -61,10 +61,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:3000"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against /api/health), so this file does not override it. restart: always diff --git a/services/arcane/.env b/services/arcane/.env index 89794c0b..20cc1e4a 100644 --- a/services/arcane/.env +++ b/services/arcane/.env @@ -11,12 +11,14 @@ SERVICEPORT=3552 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables -TAILNET_NAME= # for example: tail-scale +# for example: tail-scale +TAILNET_NAME= -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/arcane/README.md b/services/arcane/README.md index aa65e1f4..c086f358 100644 --- a/services/arcane/README.md +++ b/services/arcane/README.md @@ -22,7 +22,7 @@ This Docker Compose configuration sets up **Arcane** with a Tailscale sidecar co In this deployment, a **Tailscale sidecar container** (for example `tailscale-arcane`) runs the Tailscale client and joins your private Tailscale network. The main `arcane` service uses: ```plain -network_mode: service:tailscale-arcane +network_mode: service:tailscale ``` This configuration routes all traffic through the Tailscale interface, ensuring that the Arcane web UI and API are accessible **only via your Tailscale network**. This provides a simple and secure way to access your Docker management console from all trusted devices while preventing public access to container controls. diff --git a/services/arcane/compose.yaml b/services/arcane/compose.yaml index 70808e89..655f141d 100644 --- a/services/arcane/compose.yaml +++ b/services/arcane/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - APP_URL=https://arcane.${TAILNET_NAME}.ts.net @@ -61,6 +61,7 @@ services: - LOG_LEVEL=info # Optional - LOG_JSON=false # Optional - OIDC_ENABLED=false # Optional + - TZ=${TZ} volumes: - /var/run/docker.sock:/var/run/docker.sock - ./${SERVICE}-data:/app/data @@ -69,7 +70,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:3552/", "-s", "-o", "/dev/null"] + test: ["CMD", "curl", "-f", "http://localhost:3552/", "-s", "-o", "/dev/null"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/artisttrackarr/.env b/services/artisttrackarr/.env index fa5d4d5f..124a66e0 100644 --- a/services/artisttrackarr/.env +++ b/services/artisttrackarr/.env @@ -11,12 +11,13 @@ SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ @@ -30,4 +31,4 @@ POLL_INTERVAL=6h TRUST_PROXY=false # SPOTIFY_CLIENT_ID= # SPOTIFY_CLIENT_SECRET= -# SPOTIFY_MARKET=US \ No newline at end of file +# SPOTIFY_MARKET=US diff --git a/services/artisttrackarr/README.md b/services/artisttrackarr/README.md index 37594da4..890ec199 100644 --- a/services/artisttrackarr/README.md +++ b/services/artisttrackarr/README.md @@ -10,7 +10,7 @@ Pairing ArtistTrackarr with Tailscale provides private access to its web interfa ## Configuration Overview -In this setup, the `tailscale-artist-trackarr` service runs Tailscale and manages secure networking for ArtistTrackarr. The `artist-trackarr` service uses the Tailscale container's network stack through Docker's `network_mode: service:tailscale-artist-trackarr` configuration. +In this setup, the `tailscale-artist-trackarr` service runs Tailscale and manages secure networking for ArtistTrackarr. The `artist-trackarr` service uses the Tailscale container's network stack through Docker's `network_mode: service:tailscale` configuration. ArtistTrackarr listens on port `8080`. Because both containers share the same network namespace, Tailscale Serve can forward traffic directly to `http://127.0.0.1:8080`. diff --git a/services/artisttrackarr/compose.yaml b/services/artisttrackarr/compose.yaml index 472ab33f..c885f105 100644 --- a/services/artisttrackarr/compose.yaml +++ b/services/artisttrackarr/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,12 +47,12 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. PUID: 1000 PGI: 1000 TZ: ${TZ} @@ -82,7 +82,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8080/readyz"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:8080/readyz"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy @@ -95,4 +95,4 @@ secrets: encryption_key: environment: APP_ENCRYPTION_KEY session_secret: - environment: SESSION_SECRET \ No newline at end of file + environment: SESSION_SECRET diff --git a/services/audiobookshelf/.env b/services/audiobookshelf/.env index 5409ba97..2f3fccbd 100644 --- a/services/audiobookshelf/.env +++ b/services/audiobookshelf/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/audiobookshelf/README.md b/services/audiobookshelf/README.md index 677fc8d5..9ef2f84f 100644 --- a/services/audiobookshelf/README.md +++ b/services/audiobookshelf/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Audiobookshelf](https://github.com/ad ## Configuration Overview -In this setup, the `tailscale-audiobookshelf` service runs Tailscale, which manages secure networking for the Audiobookshelf service. The `audiobookshelf` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Audiobookshelf’s web interface and streaming capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your personal audiobook and podcast collection. +In this setup, the `tailscale-audiobookshelf` service runs Tailscale, which manages secure networking for the Audiobookshelf service. The `audiobookshelf` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Audiobookshelf’s web interface and streaming capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your personal audiobook and podcast collection. diff --git a/services/audiobookshelf/compose.yaml b/services/audiobookshelf/compose.yaml index 618d828a..b987d159 100644 --- a/services/audiobookshelf/compose.yaml +++ b/services/audiobookshelf/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -65,7 +65,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:80/healthcheck"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/bazarr/.env b/services/bazarr/.env index 5aa35477..7d1477db 100644 --- a/services/bazarr/.env +++ b/services/bazarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/bazarr/README.md b/services/bazarr/README.md index 408c58d6..c966f62b 100644 --- a/services/bazarr/README.md +++ b/services/bazarr/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Bazarr](https://github.com/morpheus65 ## Configuration Overview -In this setup, the tailscale-bazarr service runs Tailscale, which manages secure networking for the Bazarr service. The bazarr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Bazarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted subtitle manager. +In this setup, the tailscale-bazarr service runs Tailscale, which manages secure networking for the Bazarr service. The bazarr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Bazarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted subtitle manager. diff --git a/services/bazarr/compose.yaml b/services/bazarr/compose.yaml index aa371410..96ba2aa2 100644 --- a/services/bazarr/compose.yaml +++ b/services/bazarr/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -64,7 +64,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:6767/api/system/ping"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/bentopdf/.env b/services/bentopdf/.env index 273069a4..90245a07 100644 --- a/services/bentopdf/.env +++ b/services/bentopdf/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/bentopdf/README.md b/services/bentopdf/README.md index aaa8b27c..7db369cb 100644 --- a/services/bentopdf/README.md +++ b/services/bentopdf/README.md @@ -25,7 +25,9 @@ PDF files often contain sensitive personal or business information. Self-hosting In this deployment, a **Tailscale sidecar container** (for example `tailscale-bentopdf`) runs the Tailscale client and joins your private Tailscale network. The main `bentopdf` service uses: ```plain -network_mode: service:tailscale-bentopdf +network_mode: service:tailscale ``` This configuration routes all traffic through the Tailscale interface, ensuring that the BentoPDF web UI is accessible **only via your Tailscale network**. This provides a simple and secure way to access your PDF library from all trusted devices. + +BentoPDF listens on port `8080` inside the container. If you enable the optional host mapping, `SERVICEPORT` is the host port and maps to container port `8080`. diff --git a/services/bentopdf/compose.yaml b/services/bentopdf/compose.yaml index efea88d6..51fcb570 100644 --- a/services/bentopdf/compose.yaml +++ b/services/bentopdf/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:8080 # Binding the host port to BentoPDF's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -62,7 +62,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://127.0.0.1:8080/ || exit 1"] + test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://127.0.0.1:8080/ || exit 1"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/beszel-agent/.env b/services/beszel-agent/.env index 4d2a035c..bec65f90 100644 --- a/services/beszel-agent/.env +++ b/services/beszel-agent/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/beszel-agent/README.md b/services/beszel-agent/README.md index 9913020f..3826dddb 100644 --- a/services/beszel-agent/README.md +++ b/services/beszel-agent/README.md @@ -8,4 +8,4 @@ The Beszel Agent is the client-side component that connects to the Hub to send a ## Configuration Overview -In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Agent service. The Agent service connects to the Tailscale network stack using Docker's `network_mode: service:` configuration. This setup guarantees that the Agent's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. +In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Agent service. The Agent service connects to the Tailscale network stack using Docker's `network_mode: service:tailscale` configuration. This setup guarantees that the Agent's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. diff --git a/services/beszel-agent/compose.yaml b/services/beszel-agent/compose.yaml index d6292f59..4aa14933 100644 --- a/services/beszel-agent/compose.yaml +++ b/services/beszel-agent/compose.yaml @@ -1,6 +1,6 @@ services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -12,7 +12,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true volumes: - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path @@ -21,10 +21,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -33,10 +33,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: PORT: 45876 diff --git a/services/beszel-hub/.env b/services/beszel-hub/.env index b52819b0..451c8a9d 100644 --- a/services/beszel-hub/.env +++ b/services/beszel-hub/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/beszel-hub/README.md b/services/beszel-hub/README.md index b2e4035c..a209b06f 100644 --- a/services/beszel-hub/README.md +++ b/services/beszel-hub/README.md @@ -8,4 +8,4 @@ The Beszel Hub is the core component responsible for routing messages between ag ## Configuration Overview -In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Hub service. The Hub service connects to the Tailscale network stack using Docker's `network_mode: service:` configuration. This setup guarantees that the Hub's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. +In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Hub service. The Hub service connects to the Tailscale network stack using Docker's `network_mode: service:tailscale` configuration. This setup guarantees that the Hub's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. diff --git a/services/beszel-hub/compose.yaml b/services/beszel-hub/compose.yaml index 6c0d85a4..3ea4b34d 100644 --- a/services/beszel-hub/compose.yaml +++ b/services/beszel-hub/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,15 +47,14 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 - PGID=1000 - - TZ=${TZ} volumes: - ./${SERVICE}-data/beszel_data:/beszel_data # Work directory for Beszel Hub - you may need to change the path depends_on: diff --git a/services/booklore/.env b/services/booklore/.env index eba934a3..5e53f3cb 100644 --- a/services/booklore/.env +++ b/services/booklore/.env @@ -11,20 +11,20 @@ SERVICEPORT=80 DNS_SERVER=9.9.9.9 # Tailscale Configuration -TS_AUTHKEY= # Add your TS authkey +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # MariaDB Credentials -MYSQL_ROOT_PASSWORD= # Use a strong password for the databases root user, should be different from MYSQL_PASSWORD +# Use a strong password for the databases root user, should be different from MYSQL_PASSWORD +MYSQL_ROOT_PASSWORD= MYSQL_DATABASE=booklore MYSQL_USER=booklore -MYSQL_PASSWORD= # Use a strong password; must match DATABASE_PASSWORD defined in the booklore container +# Use a strong password; must match DATABASE_PASSWORD defined in the booklore container +MYSQL_PASSWORD= -# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List -TZ=Europe/Paris - -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/booklore/README.md b/services/booklore/README.md index 4ff1a917..789f895c 100644 --- a/services/booklore/README.md +++ b/services/booklore/README.md @@ -8,4 +8,6 @@ This Docker Compose configuration sets up [BookLore](https://github.com/booklore ## Configuration Overview -In this setup, the `tailscale-booklore` service runs Tailscale, which manages secure networking for the BookLore service. The `booklore` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that BookLore’s web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy. +In this setup, the `tailscale-booklore` service runs Tailscale, which manages secure networking for the BookLore service. The `booklore` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that BookLore’s web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy. + +BookLore listens on port `6060` inside the container. If you enable the optional host port mapping, `SERVICEPORT` is the host port and maps to container port `6060`. diff --git a/services/booklore/compose.yaml b/services/booklore/compose.yaml index 96fc5c68..aa81e4ae 100644 --- a/services/booklore/compose.yaml +++ b/services/booklore/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:6060 # Binding the host port to BookLore's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,32 +47,37 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 - PGID=1000 - DATABASE_URL=jdbc:mariadb://mariadb:3306/booklore # Only modify this if you're familiar with JDBC and your database setup - DATABASE_USERNAME=${MYSQL_USER} # Must match MYSQL_USER defined in the mariadb container - - DATABASE_PASSWORD=${MYSQL_PASSWORD} # Use a strong password; must match MYSQL_PASSWORD defined in the mariadb container + - DATABASE_PASSWORD=${MYSQL_PASSWORD} # Use a strong password; must match MYSQL_PASSWORD defined in the mariadb container - SWAGGER_ENABLED=false # Swagger UI (API docs). -# ports: -# - "6060:6060" + - TZ=${TZ} volumes: - ./data:/app/data - ./books:/books1 # Book library folder — point to one of your collections depends_on: mariadb: - condition: service_healthy + condition: service_healthy tailscale: condition: service_healthy - restart: unless-stopped + healthcheck: + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:6060/api/v1/healthcheck"] # Check if the service is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 60s # Time to wait before starting health checks + restart: always mariadb: image: lscr.io/linuxserver/mariadb:11.4.5 - container_name: mariadb + container_name: app-${SERVICE}-mariadb environment: - PUID=1000 - PGID=1000 @@ -82,9 +87,10 @@ services: - MYSQL_PASSWORD=${MYSQL_PASSWORD} # Use a strong password; must match DATABASE_PASSWORD defined in the booklore container volumes: - ./mariadb_config:/config - restart: unless-stopped + restart: always healthcheck: - test: ["CMD", "mariadb-admin", "ping", "-h", "localhost"] + test: ["CMD", "mariadb-admin", "ping", "-h", "127.0.0.1"] # Check if MariaDB accepts TCP connections; localhost would use the Unix socket interval: 5s timeout: 5s retries: 10 + start_period: 30s diff --git a/services/caddy/.env b/services/caddy/.env index 77b5b6fc..693b93e0 100644 --- a/services/caddy/.env +++ b/services/caddy/.env @@ -3,7 +3,7 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE=caddy # If this is changed please set docker-compose.yml services:caddy_proxy:healthcheck $SERVICE to the string caddy. Also update the Caddyfile FQDN. +SERVICE=caddy # If this changes, update the Caddyfile hostname. IMAGE_URL=caddy:latest # Network Configuration @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/caddy/README.md b/services/caddy/README.md index c57dac9e..32e6c6af 100644 --- a/services/caddy/README.md +++ b/services/caddy/README.md @@ -8,14 +8,16 @@ This Docker Compose configuration sets up [Caddy](https://github.com/caddyserver ## Configuration Overview -In this setup, the `tailscale-caddy` service runs Tailscale, which manages secure networking for the Caddy service. The `caddy_proxy` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Caddy’s dashboard and routing functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of privacy and security to your network architecture. +In this setup, the `tailscale-caddy` service runs Tailscale, which manages secure networking for Caddy. The `application` service uses Docker's `network_mode: service:tailscale` configuration. This keeps Caddy's dashboard and routes on your Tailnet unless you publish a host port. To get this working: - Update the FQDN in `Caddyfile` to match your `${SERVICE}.MagicDNSname.ts.net`. - Update the TS_AUTHKEY in the .env file to your Tailscale key. -If you change the `SERVICE=caddy` line in the .env file, the hostname of the FQDN in the Caddyfile must be updated as well. Additionally please replace $SERVICE in compose.yaml services:caddy_proxy:healthcheck with the string caddy. +If you change `SERVICE` in `.env`, update the hostname in `Caddyfile` as well. The healthcheck calls Caddy's admin API on `127.0.0.1:2019`, so it does not depend on the hostname. + +Both containers mount the Tailscale socket directory. Caddy only uses the socket to get HTTPS certificates, which the sample `http://` site address does not request (see below). Sharing the directory instead of the socket file lets Caddy use the new socket after Tailscale restarts. The example `compose.yaml` uses a simple webserver for testing purposes. diff --git a/services/caddy/compose.yaml b/services/caddy/compose.yaml index 4cc90251..130e4b18 100644 --- a/services/caddy/compose.yaml +++ b/services/caddy/compose.yaml @@ -1,6 +1,6 @@ services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -9,24 +9,23 @@ services: environment: - TS_AUTHKEY=${TS_AUTHKEY} - TS_STATE_DIR=/var/lib/tailscale - - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true volumes: - ./config:/config # Config folder used to store Tailscale files - you may need to change the path - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path - #- ./tailscale/tmp:/tmp # Share the tmp folder with the tailscale socket for TLS. Remove # if required. + - ./tailscale/tmp:/tmp # Share the tmp folder with the tailscale socket for TLS. devices: - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -36,26 +35,26 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 - PGID=1000 - TZ=${TZ} volumes: - - $PWD/Caddyfile:/etc/caddy/Caddyfile - - $PWD/site:/srv - - $PWD/caddy_data:/data - - $PWD/caddy_config:/config - - $PWD/tailscale/tmp/tailscaled.sock:/var/run/tailscale/tailscaled.sock # mount the socket at the right place. Comment out if not required. + - ./Caddyfile:/etc/caddy/Caddyfile + - ./site:/srv + - ./caddy_data:/data + - ./caddy_config:/config + - ./tailscale/tmp:/var/run/tailscale # Share the directory so socket replacement survives Tailscale restarts. depends_on: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"] # Check if Caddy's admin API responds; it does not depend on the Tailnet hostname interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy @@ -65,3 +64,4 @@ services: # This is a sample internal website on port 80 whoami: image: traefik/whoami:latest + # Healthcheck: none possible. The image contains only the /whoami binary, with no shell, HTTP client, or health command. diff --git a/services/changedetection/.env b/services/changedetection/.env index 394f9375..b25f4cd1 100644 --- a/services/changedetection/.env +++ b/services/changedetection/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/changedetection/README.md b/services/changedetection/README.md index 3f6b9e11..c5a692fd 100644 --- a/services/changedetection/README.md +++ b/services/changedetection/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [ChangeDetection.io](https://github.co ## Configuration Overview -In this setup, the `tailscale-changedetection` service runs Tailscale, which manages secure networking for the ChangeDetection.io service. The `changedetection` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that ChangeDetection.io’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your website monitoring setup. +In this setup, the `tailscale-changedetection` service runs Tailscale, which manages secure networking for the ChangeDetection.io service. The `changedetection` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that ChangeDetection.io’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your website monitoring setup. diff --git a/services/changedetection/compose.yaml b/services/changedetection/compose.yaml index a01b0f5f..d564c443 100644 --- a/services/changedetection/compose.yaml +++ b/services/changedetection/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -62,7 +62,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:5000/', timeout=5)"] # Check if the service is responding; the image has no wget, curl, or pgrep interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/clipcascade/.env b/services/clipcascade/.env index 939bec9f..a16e8f09 100644 --- a/services/clipcascade/.env +++ b/services/clipcascade/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/clipcascade/README.md b/services/clipcascade/README.md index faea6370..38bf28d8 100644 --- a/services/clipcascade/README.md +++ b/services/clipcascade/README.md @@ -15,4 +15,4 @@ This Docker Compose configuration sets up [ClipCascade](https://github.com/Sathv ## Configuration Overview -In this setup, the `tailscale-clipcascade` service runs Tailscale, which manages secure networking for the ClipCascade service. The `clipcascade` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that ClipCascade’s web interface and functionality are only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your clipboard history. +In this setup, the `tailscale-clipcascade` service runs Tailscale, which manages secure networking for the ClipCascade service. The `clipcascade` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that ClipCascade’s web interface and functionality are only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your clipboard history. diff --git a/services/clipcascade/compose.yaml b/services/clipcascade/compose.yaml index eb1c8840..604e4c05 100644 --- a/services/clipcascade/compose.yaml +++ b/services/clipcascade/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: # To learn more about environment variables, check the Advanced Details section in the GitHub README. @@ -65,7 +65,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "-b", "/tmp/healthcheck-cookies", "-c", "/tmp/healthcheck-cookies", "http://127.0.0.1:8080/health"] # Check if the service is responding; the cookie jar reuses one session, because the service creates a new one-year session for every request without a cookie interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/coder/.env b/services/coder/.env index 7584c568..d2705617 100644 --- a/services/coder/.env +++ b/services/coder/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -25,4 +25,4 @@ POSTGRES_PASSWORD=strongpassword POSTGRES_DB=coder CODER_ACCESS_URL=https://coder..ts.net -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/coder/README.md b/services/coder/README.md index d35ac6bc..3553c46b 100644 --- a/services/coder/README.md +++ b/services/coder/README.md @@ -17,4 +17,13 @@ This Docker Compose configuration sets up [**Coder**](https://github.com/coder/c ## Configuration Overview -In this deployment, the `tailscale-coder` service runs the Tailscale client to establish a secure private network. The `coder` container uses `network_mode: service:tailscale-coder` to route all traffic through the Tailscale interface. This ensures that your development environments, admin UI, and web IDEs are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-coder` service runs the Tailscale client to establish a secure private network. The `coder` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your development environments, admin UI, and web IDEs are only accessible via Tailscale, preventing public exposure. + +## Volume Permissions + +The Coder image runs as UID/GID `1000`. Docker creates missing bind-mount directories as `root:root`, and Coder then fails with `mkdir /home/coder/.cache: permission denied`. Create the home directory before the first start: + +```sh +mkdir -p coder-data/coder-home +sudo chown 1000:1000 coder-data/coder-home +``` diff --git a/services/coder/compose.yaml b/services/coder/compose.yaml index 06b29988..ad5f2240 100644 --- a/services/coder/compose.yaml +++ b/services/coder/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,15 +47,16 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL}:${CODER_VERSION:-latest} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: CODER_PG_CONNECTION_URL: "postgresql://${POSTGRES_USER:-username}:${POSTGRES_PASSWORD:-password}@localhost/${POSTGRES_DB:-coder}?sslmode=disable" CODER_HTTP_ADDRESS: "0.0.0.0:7080" CODER_ACCESS_URL: "${CODER_ACCESS_URL}" + TZ: ${TZ} volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - ./${SERVICE}-data/coder-home:/home/coder @@ -65,7 +66,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:7080/healthz"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy @@ -74,7 +75,7 @@ services: database: container_name: app-${SERVICE}-database # Name for local container management - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale # Minimum supported version is 13. # More versions here: https://hub.docker.com/_/postgres image: "postgres:17" @@ -88,8 +89,10 @@ services: test: [ "CMD-SHELL", - "pg_isready -U ${POSTGRES_USER:-username} -d ${POSTGRES_DB:-coder}", + "pg_isready -h 127.0.0.1 -U ${POSTGRES_USER:-username} -d ${POSTGRES_DB:-coder}", ] interval: 5s timeout: 5s retries: 5 + start_period: 30s + restart: always diff --git a/services/configarr/.env b/services/configarr/.env index d5329758..db220f74 100644 --- a/services/configarr/.env +++ b/services/configarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/configarr/README.md b/services/configarr/README.md index bda68f1b..f37df56e 100644 --- a/services/configarr/README.md +++ b/services/configarr/README.md @@ -31,9 +31,11 @@ This is especially useful for homelabs, shared servers, and environments where c In this deployment, a **Tailscale sidecar container** (for example, `tailscale-configarr`) runs the Tailscale client and joins your private Tailscale network. The Configarr service uses: ```plain -network_mode: service:tailscale-configarr +network_mode: service:tailscale ``` This setup ensures that **all Configarr network traffic flows exclusively through the Tailscale interface**, allowing it to securely communicate with Radarr and Sonarr instances that are also connected via Tailscale. No ports need to be exposed, and the service remains completely inaccessible from the public Internet. +The Configarr container runs one sync and then exits, so the Compose file uses `restart: "no"`. To run it on a schedule, trigger `docker compose up application` from cron or another scheduler. + With this configuration, Configarr can safely enforce and maintain your desired media configuration state — privately, securely, and reproducibly. diff --git a/services/configarr/compose.yaml b/services/configarr/compose.yaml index a599c813..239c20fb 100644 --- a/services/configarr/compose.yaml +++ b/services/configarr/compose.yaml @@ -1,6 +1,6 @@ services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -12,7 +12,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true volumes: - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path @@ -21,9 +21,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -33,25 +33,20 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TZ=${TZ} volumes: - ./${SERVICE}-data/config:/app/config - - ${PWD}/${SERVICE}-data/dockerrepos:/app/repos + - ./${SERVICE}-data/dockerrepos:/app/repos depends_on: tailscale: condition: service_healthy - # healthcheck: - # test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - # interval: 1m # How often to perform the check - # timeout: 10s # Time to wait for the check to succeed - # retries: 3 # Number of retries before marking as unhealthy - # start_period: 30s # Time to wait before starting health checks - restart: never + # Healthcheck: none needed. Configarr runs one sync and exits. + restart: "no" # Configarr runs one sync and exits. Schedule repeated runs externally, for example with cron. + - diff --git a/services/convertx/.env b/services/convertx/.env index fd865a25..ac8418ad 100644 --- a/services/convertx/.env +++ b/services/convertx/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/convertx/README.md b/services/convertx/README.md index 7e4f5e35..8d10844d 100644 --- a/services/convertx/README.md +++ b/services/convertx/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [ConvertX](https://github.com/C4illin/ ## Configuration Overview -In this setup, the `tailscale-convertx` service runs Tailscale, which manages secure networking for the ConvertX service. The `convertx` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that ConvertX’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your self-hosted media conversion workflow. +In this setup, the `tailscale-convertx` service runs Tailscale, which manages secure networking for the ConvertX service. The `convertx` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that ConvertX’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your self-hosted media conversion workflow. diff --git a/services/convertx/compose.yaml b/services/convertx/compose.yaml index c77c330f..0ac1e3d6 100644 --- a/services/convertx/compose.yaml +++ b/services/convertx/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,20 +47,21 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - JWT_SECRET=aLongAndSecretStringUsedToSignTheJSONWebToken1234 # will use randomUUID() if unset + - TZ=${TZ} volumes: - ./${SERVICE}-data:/app/data depends_on: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "bun"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:3000/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/copyparty/.env b/services/copyparty/.env index 62c2472f..cca550be 100644 --- a/services/copyparty/.env +++ b/services/copyparty/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/copyparty/README.md b/services/copyparty/README.md index c86205a2..0a6a22b9 100644 --- a/services/copyparty/README.md +++ b/services/copyparty/README.md @@ -22,4 +22,6 @@ With Tailscale in place, all of these features are securely tunneled through you ## Configuration Overview -In this setup, the `tailscale-copyparty` service runs Tailscale, which handles the secure networking layer. The `copyparty` service uses Docker’s `network_mode: service:` setting to share the network stack of the Tailscale container. This means the Copyparty web interface and all file sharing functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted file server. +In this setup, the `tailscale-copyparty` service runs Tailscale, which handles the secure networking layer. The `copyparty` service uses Docker’s `network_mode: service:tailscale` setting to share the network stack of the Tailscale container. This means the Copyparty web interface and all file sharing functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted file server. + +Before starting the stack, replace `/path/to/your/fileshare/top/folder` in `compose.yaml` with an absolute host directory for the files Copyparty should serve. diff --git a/services/copyparty/compose.yaml b/services/copyparty/compose.yaml index 14dc3102..2f488717 100644 --- a/services/copyparty/compose.yaml +++ b/services/copyparty/compose.yaml @@ -22,8 +22,8 @@ configs: rw: admin services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -36,7 +36,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -49,9 +49,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -61,10 +61,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management user: "1000:1000" configs: @@ -80,10 +80,11 @@ services: # enabling mimalloc by replacing "NOPE" with "2" will make some stuff twice as fast, but everything will use twice as much ram: environment: LD_PRELOAD: /usr/lib/libmimalloc-secure.so.NOPE + TZ: ${TZ} stop_grace_period: 15s # thumbnailer is allowed to continue finishing up for 10s after the shutdown signal healthcheck: - # hide it from logs with "/._" so it matches the default --lf-url filter - test: ["CMD-SHELL", "wget --spider -q 127.0.0.1:3923/?reset=/._"] + # hide it from logs with "/._" so it matches the default --lf-url filter + test: ["CMD-SHELL", "wget --spider -q 127.0.0.1:3923/?reset=/._"] # Check if the service is responding interval: 1m timeout: 2s retries: 5 diff --git a/services/cyberchef/.env b/services/cyberchef/.env index b0b32531..c7b3e696 100644 --- a/services/cyberchef/.env +++ b/services/cyberchef/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/cyberchef/README.md b/services/cyberchef/README.md index 3b335c68..327279ff 100644 --- a/services/cyberchef/README.md +++ b/services/cyberchef/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [CyberChef](https://github.com/gchq/Cy ## Configuration Overview -In this setup, the `tailscale-cyberchef` service runs Tailscale, which manages secure networking for the CyberChef service. The `cyberchef` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that CyberChef’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted data analysis tool. +In this setup, the `tailscale-cyberchef` service runs Tailscale, which manages secure networking for the CyberChef service. The `cyberchef` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that CyberChef’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted data analysis tool. diff --git a/services/cyberchef/compose.yaml b/services/cyberchef/compose.yaml index f885d29c..81c2d1fd 100644 --- a/services/cyberchef/compose.yaml +++ b/services/cyberchef/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TZ=${TZ} @@ -58,7 +58,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "nginx"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8080/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/ddns-updater/.env b/services/ddns-updater/.env index 938195e2..a1584122 100644 --- a/services/ddns-updater/.env +++ b/services/ddns-updater/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/ddns-updater/README.md b/services/ddns-updater/README.md index 94777442..999d950b 100644 --- a/services/ddns-updater/README.md +++ b/services/ddns-updater/README.md @@ -15,4 +15,13 @@ By combining DDNS Updater with Tailscale, you can securely manage your dynamic D ## Configuration Overview -In this setup, the `tailscale-ddns-updater` service runs Tailscale, providing a secure networking layer for the DDNS Updater service. The `ddns-updater` service utilizes Docker's `network_mode: service:` configuration to route all traffic through the Tailscale network. This setup ensures that the DDNS Updater's web interface and API are only accessible within your private Tailnet, adding an extra layer of security to your DNS management. +In this setup, the `tailscale-ddns-updater` service runs Tailscale, providing a secure networking layer for the DDNS Updater service. The `ddns-updater` service utilizes Docker's `network_mode: service:tailscale` configuration to route all traffic through the Tailscale network. This setup ensures that the DDNS Updater's web interface and API are only accessible within your private Tailnet, adding an extra layer of security to your DNS management. + +## Volume Permissions + +The DDNS Updater image runs as UID `1000`. Docker creates missing bind-mount directories as `root:root`, and DDNS Updater then exits with `permission denied` when it writes `config.json`. Create the data directory before the first start: + +```sh +mkdir -p ddns-updater-data/data +sudo chown -R 1000:1000 ddns-updater-data +``` diff --git a/services/ddns-updater/compose.yaml b/services/ddns-updater/compose.yaml index 62c88d8d..5b1934da 100644 --- a/services/ddns-updater/compose.yaml +++ b/services/ddns-updater/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TZ=${TZ} @@ -82,10 +82,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (/updater/ddns-updater healthcheck), so this file does not override it. restart: always diff --git a/services/dockge/.env b/services/dockge/.env index f07918af..69ae7bd2 100644 --- a/services/dockge/.env +++ b/services/dockge/.env @@ -7,14 +7,19 @@ SERVICE=dockge # Service name (e.g., adguard). Used as hostname in Tailscale and IMAGE_URL=louislam/dockge:1 # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT=5001 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables -STACKS_DIR= # Absolute path on host to store stack files. Must be bind mounted to the same path in compose.yaml. +STACKS_DIR=/opt/stacks +# Absolute path on host to store stack files. The host and container paths must match. # For example, create a folder in your docker compose folder with the name stacks (mkdir stacks) and use /path/to/docker-compose-container-folder/stacks. PUID=1000 # Set the stack file/dir ownership to this user -PGID=1000 # Set the stack file/dir ownership to this group \ No newline at end of file +PGID=1000 # Set the stack file/dir ownership to this group + +# Time Zone setting for containers +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/dockge/README.md b/services/dockge/README.md index 9fae38da..54fccc67 100644 --- a/services/dockge/README.md +++ b/services/dockge/README.md @@ -20,4 +20,4 @@ It is especially well-suited for homelabs, self-hosted environments, and DevOps ## Important Notice -Make sure to populate the `STACKS_DIR=` variable in the `.env` before first startup. +Set `STACKS_DIR` in `.env` to an absolute host path. The Compose file mounts that path at the same path inside the container. The sample uses `/opt/stacks`. diff --git a/services/dockge/compose.yaml b/services/dockge/compose.yaml index 7d21c9b3..8d2b548c 100644 --- a/services/dockge/compose.yaml +++ b/services/dockge/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: - # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Make sure you have updated/checked the .env file with the correct variables. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: [ "CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz" ] # Check Tailscale has a Tailnet IP and is operational @@ -47,21 +47,23 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. - DOCKGE_STACKS_DIR=${STACKS_DIR} # Tell Dockge where your stacks directory is - PUID=${PUID} # Set the stack file/dir ownership to this user - PGID=${PGID} # Set the stack file/dir ownership to this group + - TZ=${TZ} volumes: - ./${SERVICE}-data/app/config:/app/data - /var/run/docker.sock:/var/run/docker.sock - - ${STACKS_DIR}:/stacks + - ${STACKS_DIR}:${STACKS_DIR} depends_on: tailscale: condition: service_healthy - restart: always \ No newline at end of file + # Healthcheck: defined by the image (extra/healthcheck), so this file does not override it. + restart: always diff --git a/services/dockhand/.env b/services/dockhand/.env index 74a7ec0a..a8c411d3 100644 --- a/services/dockhand/.env +++ b/services/dockhand/.env @@ -11,12 +11,13 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/dockhand/README.md b/services/dockhand/README.md index 5f764ec4..a6c63d94 100644 --- a/services/dockhand/README.md +++ b/services/dockhand/README.md @@ -30,7 +30,7 @@ Self-hosting Dockhand ensures that you maintain full ownership and operational c In this deployment, a Tailscale sidecar container (for example `tailscale-dockhand`) runs the Tailscale client and joins your private Tailscale network. The main `dockhand` service uses: ```plain -network_mode: service:tailscale-dockhand +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Dockhand web interface and Docker API interactions are accessible only via your Tailscale network. diff --git a/services/dockhand/compose.yaml b/services/dockhand/compose.yaml index 2b4e9780..5a9defcf 100644 --- a/services/dockhand/compose.yaml +++ b/services/dockhand/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICEPORT} to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,23 +47,19 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - HOST_DATA_DIR=/app/data + - TZ=${TZ} volumes: - /var/run/docker.sock:/var/run/docker.sock - ./dockhand-data:/app/data # Data directory for Dockhand - you may need to change the path depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "curl", "-fsS", "http://127.0.0.1:41234/healthz"] # Check if ${SERVICE} is responding - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against the web UI, including HTTPS mode), so this file does not override it. restart: always diff --git a/services/docmost/.env b/services/docmost/.env index 10dfbdf4..bada527f 100644 --- a/services/docmost/.env +++ b/services/docmost/.env @@ -13,10 +13,16 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +# Required: at least 32 characters. Generate with: openssl rand -hex 32 +APP_SECRET= +# Required: password for the Docmost PostgreSQL user. Use letters and digits only, because it is part of DATABASE_URL. +# PostgreSQL applies it only when the database is first created. Existing installations must keep their current password. +DB_PASSWORD= + +#EXAMPLE_VAR="Environment variable" diff --git a/services/docmost/README.md b/services/docmost/README.md index 6a0685a7..09f4c372 100644 --- a/services/docmost/README.md +++ b/services/docmost/README.md @@ -19,4 +19,15 @@ This Docker Compose configuration sets up [**Docmost**](https://github.com/docmo ## Configuration Overview -In this configuration, the `tailscale-docmost` service runs the Tailscale client to secure network traffic. The `docmost` service uses `network_mode: service:tailscale-docmost`, ensuring all requests are routed through the Tailscale interface. This safeguards your documentation from public exposure, making it accessible only within your private mesh. +In this configuration, the `tailscale-docmost` service runs the Tailscale client to secure network traffic. The `docmost` service uses `network_mode: service:tailscale`, ensuring all requests are routed through the Tailscale interface. This safeguards your documentation from public exposure, making it accessible only within your private mesh. + +## Files to check + +Please check the following contents for validity as some variables need to be defined upfront. + +* `.env` + * Required: `TS_AUTHKEY` + * Required: `APP_SECRET`, at least 32 characters. Generate it with `openssl rand -hex 32`. + * Required: `DB_PASSWORD`. Use letters and digits only, because the value is part of `DATABASE_URL`. + +Compose stops with an error if `APP_SECRET` or `DB_PASSWORD` is empty. PostgreSQL applies `DB_PASSWORD` only when it first creates the database. If you are upgrading, set `APP_SECRET` and `DB_PASSWORD` in `.env` to the values that your `compose.yaml` used before. diff --git a/services/docmost/compose.yaml b/services/docmost/compose.yaml index 36359f3f..6f1ada5a 100644 --- a/services/docmost/compose.yaml +++ b/services/docmost/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,16 +47,17 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: APP_URL: 'http://localhost:3000' - APP_SECRET: 'REPLACE_WITH_LONG_SECRET' # Please replace with a long secret - DATABASE_URL: 'postgresql://docmost:STRONG_DB_PASSWORD@localhost:5432/docmost?schema=public' + APP_SECRET: ${APP_SECRET:?Set APP_SECRET in .env} + DATABASE_URL: 'postgresql://docmost:${DB_PASSWORD:?Set DB_PASSWORD in .env}@localhost:5432/docmost?schema=public' REDIS_URL: 'redis://localhost:6379' + TZ: ${TZ} volumes: - ./${SERVICE}-data/docmost:/app/data/storage depends_on: @@ -67,7 +68,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:3000/api/health"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy @@ -76,20 +77,32 @@ services: db: image: postgres:16-alpine - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE}-database # Name for local container management environment: POSTGRES_DB: docmost POSTGRES_USER: docmost - POSTGRES_PASSWORD: STRONG_DB_PASSWORD + POSTGRES_PASSWORD: ${DB_PASSWORD:?Set DB_PASSWORD in .env} + healthcheck: + test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U docmost -d docmost"] # Check if PostgreSQL accepts connections + interval: 10s # How often to perform the check + timeout: 5s # Time to wait for the check to succeed + retries: 5 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always volumes: - ./${SERVICE}-data/db-data:/var/lib/postgresql/data redis: image: redis:7.2-alpine - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE}-redis # Name for local container management + healthcheck: + test: ["CMD", "redis-cli", "ping"] # Check if Redis responds + interval: 10s # How often to perform the check + timeout: 5s # Time to wait for the check to succeed + retries: 5 # Number of retries before marking as unhealthy + start_period: 10s # Time to wait before starting health checks restart: always volumes: - ./${SERVICE}-data/redis-data:/data diff --git a/services/donetick/.env b/services/donetick/.env index 2988a77a..dc1df097 100644 --- a/services/donetick/.env +++ b/services/donetick/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/donetick/README.md b/services/donetick/README.md index a74481ed..94fb01b5 100644 --- a/services/donetick/README.md +++ b/services/donetick/README.md @@ -16,7 +16,7 @@ This Docker Compose configuration sets up **[Donetick](https://github.com/doneti ## Configuration Overview -In this setup, the `tailscale-donetick` service runs Tailscale, which manages secure networking for the Donetick service. The `donetick` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Donetick’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and checklists. +In this setup, the `tailscale-donetick` service runs Tailscale, which manages secure networking for the Donetick service. The `donetick` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Donetick’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and checklists. ## Files to check diff --git a/services/donetick/compose.yaml b/services/donetick/compose.yaml index 06e21d00..08adef95 100644 --- a/services/donetick/compose.yaml +++ b/services/donetick/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -64,10 +64,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (wget against /health), so this file does not override it. restart: always diff --git a/services/dozzle/.env b/services/dozzle/.env index 0568563d..ba7a7b34 100644 --- a/services/dozzle/.env +++ b/services/dozzle/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/dozzle/README.md b/services/dozzle/README.md index 771cbcc7..b1034951 100644 --- a/services/dozzle/README.md +++ b/services/dozzle/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Dozzle](https://github.com/amir20/doz ## Configuration Overview -In this setup, the `tailscale-dozzle` service runs Tailscale, which manages secure networking for the Dozzle service. The `dozzle` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Dozzle’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted log viewer. +In this setup, the `tailscale-dozzle` service runs Tailscale, which manages secure networking for the Dozzle service. The `dozzle` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Dozzle’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted log viewer. diff --git a/services/dozzle/compose.yaml b/services/dozzle/compose.yaml index 80641336..9b1d4d93 100644 --- a/services/dozzle/compose.yaml +++ b/services/dozzle/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,11 +47,13 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management + environment: + - TZ=${TZ} volumes: - ./${SERVICE}-data/dozzle-data:/data - /var/run/docker.sock:/var/run/docker.sock:ro diff --git a/services/dumbdo/.env b/services/dumbdo/.env index 1ff7a70b..24b8b9e2 100644 --- a/services/dumbdo/.env +++ b/services/dumbdo/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/dumbdo/README.md b/services/dumbdo/README.md index e196a05a..2cfc595f 100644 --- a/services/dumbdo/README.md +++ b/services/dumbdo/README.md @@ -1,18 +1,18 @@ -# DumbDo with Tailscale Sidecar Configuration +# DumbDo with Tailscale Sidecar Configuration This Docker Compose configuration sets up [DumbDo](https://github.com/DumbWareio/DumbDo) with Tailscale as a sidecar container to securely manage and access your lightweight task manager over a private Tailscale network. By integrating Tailscale, you can ensure that your DumbDo instance remains private and accessible only to authorized devices within your Tailscale network. -## DumbDo +## DumbDo [DumbDo](https://github.com/DumbWareio/DumbDo) is a self-hosted, minimalistic task management tool designed to provide a distraction-free experience for managing to-do lists and tasks. With its simple interface and lightweight nature, DumbDo allows users to focus on productivity without unnecessary complexity. By integrating Tailscale, you can keep your task manager secure and accessible only within your private network. -## Key Features +## Key Features -- **Minimalist Task Management** – A straightforward approach to to-do lists without unnecessary complexity. -- **Self-Hosted** – Maintain full control over your data with a locally hosted instance. -- **Lightweight & Fast** – Designed for speed and efficiency without bloated features. -- **Secure Integration** – Pair with Tailscale to restrict access to authorized devices only. +- **Minimalist Task Management** – A straightforward approach to to-do lists without unnecessary complexity. +- **Self-Hosted** – Maintain full control over your data with a locally hosted instance. +- **Lightweight & Fast** – Designed for speed and efficiency without bloated features. +- **Secure Integration** – Pair with Tailscale to restrict access to authorized devices only. -## Configuration Overview +## Configuration Overview -In this setup, the `tailscale-dumbdo` service runs Tailscale, which manages secure networking for the DumbDo service. The `dumbdo` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that DumbDo’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your task management system. +In this setup, the `tailscale-dumbdo` service runs Tailscale, which manages secure networking for the DumbDo service. The `dumbdo` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that DumbDo’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your task management system. diff --git a/services/dumbdo/compose.yaml b/services/dumbdo/compose.yaml index b24c7ef4..b7fc4ad8 100644 --- a/services/dumbdo/compose.yaml +++ b/services/dumbdo/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -62,10 +62,5 @@ services: depends_on: tailscale: condition: service_healthy - # healthcheck: - # test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - # interval: 1m # How often to perform the check - # timeout: 10s # Time to wait for the check to succeed - # retries: 3 # Number of retries before marking as unhealthy - # start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (wget against port 3000), so this file does not override it. restart: always diff --git a/services/eigenfocus/.env b/services/eigenfocus/.env index 64a5045b..7e61052e 100644 --- a/services/eigenfocus/.env +++ b/services/eigenfocus/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/eigenfocus/README.md b/services/eigenfocus/README.md index c561528c..60ebbbc5 100644 --- a/services/eigenfocus/README.md +++ b/services/eigenfocus/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Eigenfocus](https://github.com/Eige ## Configuration Overview -In this setup, the `tailscale-eigenfocus` service runs Tailscale, which manages secure networking for the Eigenfocus service. The `eigenfocus` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Eigenfocus’ web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and projects. +In this setup, the `tailscale-eigenfocus` service runs Tailscale, which manages secure networking for the Eigenfocus service. The `eigenfocus` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Eigenfocus’ web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and projects. diff --git a/services/eigenfocus/compose.yaml b/services/eigenfocus/compose.yaml index bb0886d9..415daf44 100644 --- a/services/eigenfocus/compose.yaml +++ b/services/eigenfocus/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -62,10 +62,10 @@ services: depends_on: tailscale: condition: service_healthy - # healthcheck: - # test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - # interval: 1m # How often to perform the check - # timeout: 10s # Time to wait for the check to succeed - # retries: 3 # Number of retries before marking as unhealthy - # start_period: 30s # Time to wait before starting health checks + healthcheck: + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:3000/up"] # Check if the service is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always diff --git a/services/espocrm/.env b/services/espocrm/.env index 18ad0d94..7998a830 100644 --- a/services/espocrm/.env +++ b/services/espocrm/.env @@ -7,21 +7,22 @@ SERVICE=espocrm # Service name (e.g., adguard). Used as hostname in Tailscale an IMAGE_URL=espocrm/espocrm # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" TS_DOMAIN=.ts.net @@ -31,7 +32,7 @@ MARIADB_USER=espocrm MARIADB_PASSWORD=password ESPOCRM_DEFAULT_CURRENCY=EUR ESPOCRM_DATABASE_PLATFORM=Mysql -ESPOCRM_DATABASE_HOST=espocrm-db +ESPOCRM_DATABASE_HOST=database # Compose service name of the MariaDB container ESPOCRM_DATABASE_USER=espocrm ESPOCRM_DATABASE_PASSWORD=password ESPOCRM_ADMIN_USERNAME=admin diff --git a/services/espocrm/README.md b/services/espocrm/README.md index bd270096..1c742f1c 100644 --- a/services/espocrm/README.md +++ b/services/espocrm/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [EspoCRM](https://www.espocrm.com/) wi ## Configuration Overview -In this setup, the `tailscale-EspoCRM` service runs Tailscale, which manages secure networking for EspoCRM. The `EspoCRM` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-EspoCRM` service runs Tailscale, which manages secure networking for EspoCRM. The `EspoCRM` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## What to document for users @@ -20,3 +20,11 @@ Please check the following contents for validity as some variables need to be de - `.env` // Main variable `TS_AUTHKEY` - `.env` // Required for normal operation. `TS_DOMAIN` + +## Upgrading from an older ScaleTail configuration + +From EspoCRM 10, the upstream Docker setup no longer mounts the whole `/var/www/html` directory. This configuration follows it and mounts only `data`, `custom`, and `client/custom` from `./espocrm-data`, so existing data and customizations stay in place. + +1. Back up `./espocrm-data`. +2. Run `docker compose down`, then `docker compose pull` and `docker compose up -d`. +3. Optionally, remove the files that older images copied into `./espocrm-data`, such as `application`, `vendor`, and `bootstrap.php`. The [EspoCRM 10 migration guide](https://docs.espocrm.com/administration/docker/installation/#migration-to-espocrm-10) lists them all. diff --git a/services/espocrm/compose.yml b/services/espocrm/compose.yaml similarity index 73% rename from services/espocrm/compose.yml rename to services/espocrm/compose.yaml index 47c34065..8b7b363a 100644 --- a/services/espocrm/compose.yml +++ b/services/espocrm/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,7 +35,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -47,7 +47,7 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application database: image: mariadb:12.2 container_name: db-${SERVICE} @@ -60,14 +60,14 @@ services: - ./${SERVICE}-db:/var/lib/mysql restart: always healthcheck: - test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"] + test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"] # Check if MariaDB accepts TCP connections and InnoDB is initialized interval: 1m start_period: 30s timeout: 10s retries: 3 application: image: ${IMAGE_URL} - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} environment: - ESPOCRM_DATABASE_PLATFORM=${ESPOCRM_DATABASE_PLATFORM} @@ -78,11 +78,20 @@ services: - ESPOCRM_ADMIN_PASSWORD=${ESPOCRM_ADMIN_PASSWORD} - ESPOCRM_SITE_URL=${ESPOCRM_SITE_URL} - ESPOCRM_DEFAULT_CURRENCY=${ESPOCRM_DEFAULT_CURRENCY} - volumes: - - ./${SERVICE}-data:/var/www/html + - TZ=${TZ} + volumes: # EspoCRM 10 and later only need these directories mounted, not all of /var/www/html. + - ./${SERVICE}-data/data:/var/www/html/data + - ./${SERVICE}-data/custom:/var/www/html/custom + - ./${SERVICE}-data/client/custom:/var/www/html/client/custom + healthcheck: + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:80/"] # Check if the service is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always depends_on: tailscale: condition: service_healthy database: - condition: service_started + condition: service_healthy diff --git a/services/excalidraw/.env b/services/excalidraw/.env index 8ee7adef..1571e5cb 100644 --- a/services/excalidraw/.env +++ b/services/excalidraw/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/excalidraw/README.md b/services/excalidraw/README.md index 7e8bee13..69063be9 100644 --- a/services/excalidraw/README.md +++ b/services/excalidraw/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Excalidraw](https://github.com/excali ## Configuration Overview -In this setup, the `tailscale-excalidraw` service runs Tailscale, which manages secure networking for the Excalidraw service. The `excalidraw` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This design ensures that Excalidraw's collaboration and editing features are only accessible through the Tailscale network (or locally, if preferred), providing enhanced security and privacy for your self-hosted Excalidraw instance. +In this setup, the `tailscale-excalidraw` service runs Tailscale, which manages secure networking for the Excalidraw service. The `excalidraw` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This design ensures that Excalidraw's collaboration and editing features are only accessible through the Tailscale network (or locally, if preferred), providing enhanced security and privacy for your self-hosted Excalidraw instance. diff --git a/services/excalidraw/compose.yaml b/services/excalidraw/compose.yaml index e8a3fb3f..73932f29 100644 --- a/services/excalidraw/compose.yaml +++ b/services/excalidraw/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - NODE_ENV=production @@ -61,10 +61,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD-SHELL", "curl -f http://localhost:80 || exit 1"] # Check if Excalidraw is running and accessible - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (wget against the web UI), so this file does not override it. restart: always diff --git a/services/filebrowser/.env b/services/filebrowser/.env index fd58305c..2dec50da 100644 --- a/services/filebrowser/.env +++ b/services/filebrowser/.env @@ -3,7 +3,7 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE=filebrowser # Service name (e.g., adguard). Used as hostnme in Tailscale and for ctainer naming (app-${SERVICE}). +SERVICE=filebrowser # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). IMAGE_URL=filebrowser/filebrowser:s6 # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration @@ -11,7 +11,8 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/filebrowser/compose.yml b/services/filebrowser/compose.yaml similarity index 79% rename from services/filebrowser/compose.yml rename to services/filebrowser/compose.yaml index aa017c20..e91b84eb 100644 --- a/services/filebrowser/compose.yml +++ b/services/filebrowser/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,7 +35,7 @@ services: cap_add: - net_admin # Tailscale requirement # ports: - #- 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your + #- 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -62,10 +62,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks - restart: always \ No newline at end of file + # Healthcheck: defined by the image (/healthcheck.sh), so this file does not override it. + restart: always diff --git a/services/flaresolverr/.env b/services/flaresolverr/.env index 3ec266d3..8bb988a9 100644 --- a/services/flaresolverr/.env +++ b/services/flaresolverr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/flaresolverr/README.md b/services/flaresolverr/README.md index cfa40be0..d5e7216b 100644 --- a/services/flaresolverr/README.md +++ b/services/flaresolverr/README.md @@ -8,4 +8,4 @@ FlareSolverr is an open-source proxy server to bypass Cloudflare and other anti- ## Configuration Overview -In this setup, the tailscale-flaresolverr service runs Tailscale, which manages secure networking for the FlareSolverr service. The flaresolverr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that FlareSolverr’s API (typically running on port 8191) is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted anti-bot proxy. +In this setup, the tailscale-flaresolverr service runs Tailscale, which manages secure networking for the FlareSolverr service. The flaresolverr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that FlareSolverr’s API (typically running on port 8191) is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted anti-bot proxy. diff --git a/services/flaresolverr/compose.yaml b/services/flaresolverr/compose.yaml index 2ee7d572..c635e247 100644 --- a/services/flaresolverr/compose.yaml +++ b/services/flaresolverr/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,7 +35,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -47,15 +47,24 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale - container_name: app-${SERVICE}-server # Name for local container management + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale + container_name: app-${SERVICE} # Name for local container management environment: - LOG_LEVEL=${LOG_LEVEL:-info} - LOG_FILE=${LOG_FILE:-none} - LOG_HTML=${LOG_HTML:-false} - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none} - TZ=${TZ} - restart: unless-stopped + depends_on: + tailscale: + condition: service_healthy + healthcheck: + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8191/health"] # Check if the service is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks + restart: always diff --git a/services/flatnotes/.env b/services/flatnotes/.env index 6e2f3ee9..0e23715b 100644 --- a/services/flatnotes/.env +++ b/services/flatnotes/.env @@ -13,19 +13,16 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#Time Zone for container -TZ=Europe/Amsterdam - # Flatnotes environment FLATNOTES_AUTH_TYPE=password FLATNOTES_USERNAME=user FLATNOTES_PASSWORD=changeMe! FLATNOTES_SECRET_KEY=aLongRandomSeriesOfCharacters -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/flatnotes/README.md b/services/flatnotes/README.md index 447685b3..82c12647 100644 --- a/services/flatnotes/README.md +++ b/services/flatnotes/README.md @@ -1,19 +1,19 @@ -# Flatnotes with Tailscale Sidecar Configuration +# Flatnotes with Tailscale Sidecar Configuration This Docker Compose configuration sets up **[Flatnotes](https://github.com/dullage/flatnotes)** with Tailscale as a sidecar container to securely manage and access your self-hosted note-taking application over a private Tailscale network. By integrating Tailscale, you can ensure that your Flatnotes instance remains private and accessible only to authorized devices within your Tailscale network. -## Flatnotes +## Flatnotes [Flatnotes](https://github.com/dullage/flatnotes) is a **lightweight, self-hosted note-taking app** that stores notes in plain text Markdown files. With a simple yet powerful interface, Flatnotes offers **tag-based organization**, **full-text search**, and a **distraction-free writing experience**. By integrating Tailscale, you can keep your notes private and secure, ensuring that only trusted devices can access them. -## Key Features +## Key Features -- **Markdown-Based Notes** – Write and store notes in Markdown format for flexibility. -- **Tag-Based Organization** – Easily categorize and manage notes with tags. -- **Full-Text Search** – Quickly find notes with an efficient search function. -- **Self-Hosted Privacy** – Keep full control of your data without relying on third-party services. -- **Secure Access with Tailscale** – Restrict access to only authorized devices within your private network. +- **Markdown-Based Notes** – Write and store notes in Markdown format for flexibility. +- **Tag-Based Organization** – Easily categorize and manage notes with tags. +- **Full-Text Search** – Quickly find notes with an efficient search function. +- **Self-Hosted Privacy** – Keep full control of your data without relying on third-party services. +- **Secure Access with Tailscale** – Restrict access to only authorized devices within your private network. -## Configuration Overview +## Configuration Overview -In this setup, the `tailscale-flatnotes` service runs Tailscale, which manages secure networking for the Flatnotes service. The `flatnotes` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Flatnotes’ web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your notes. +In this setup, the `tailscale-flatnotes` service runs Tailscale, which manages secure networking for the Flatnotes service. The `flatnotes` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Flatnotes’ web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your notes. diff --git a/services/flatnotes/compose.yaml b/services/flatnotes/compose.yaml index 21a8c068..b77288c4 100644 --- a/services/flatnotes/compose.yaml +++ b/services/flatnotes/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -65,10 +65,5 @@ services: depends_on: tailscale: condition: service_healthy - # healthcheck: - # test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - # interval: 1m # How often to perform the check - # timeout: 10s # Time to wait for the check to succeed - # retries: 3 # Number of retries before marking as unhealthy - # start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (/healthcheck.sh), so this file does not override it. restart: always diff --git a/services/forgejo/.env b/services/forgejo/.env index 0e242992..d0b77995 100644 --- a/services/forgejo/.env +++ b/services/forgejo/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/forgejo/README.md b/services/forgejo/README.md index b779a3ea..d53c84ad 100644 --- a/services/forgejo/README.md +++ b/services/forgejo/README.md @@ -19,7 +19,7 @@ This Docker Compose configuration sets up [**Forgejo**](https://forgejo.org/) wi ## Configuration Overview -In this deployment, the `tailscale-forgejo` service runs the Tailscale client to establish a secure private network. The `forgejo` container uses `network_mode: service:tailscale-forgejo` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. +In this deployment, the `tailscale-forgejo` service runs the Tailscale client to establish a secure private network. The `forgejo` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. ## Reference Material diff --git a/services/forgejo/compose.yaml b/services/forgejo/compose.yaml index 872afb89..55915fa9 100644 --- a/services/forgejo/compose.yaml +++ b/services/forgejo/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - USER_UID=1000 @@ -64,7 +64,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "s6-supervise"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:3000/api/healthz"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/formbricks/.env b/services/formbricks/.env index 0167f955..e8d2ca74 100644 --- a/services/formbricks/.env +++ b/services/formbricks/.env @@ -4,16 +4,17 @@ # Service Configuration SERVICE=formbricks # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). -IMAGE_URL=ghcr.io/formbricks/formbricks:latest +IMAGE_URL=ghcr.io/formbricks/formbricks:4.9.7 # Pinned: Formbricks 5.0 and later also require Cube, Hub, and SpiceDB services that this stack does not include. # Network Configuration SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables diff --git a/services/formbricks/README.md b/services/formbricks/README.md index 2538f729..bb44ed39 100644 --- a/services/formbricks/README.md +++ b/services/formbricks/README.md @@ -29,7 +29,11 @@ Feedback data can include sensitive product insights, internal metrics, and pers In this deployment, a **Tailscale sidecar container** (for example `tailscale-formbricks`) runs the Tailscale client and joins your private Tailscale network. The main `formbricks` service uses: ```plain -network_mode: service:tailscale-formbricks +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Formbricks admin UI, APIs, and feedback endpoints are accessible **only via your Tailscale network**. This keeps sensitive feedback data protected while still allowing secure access for authorized team members. + +## Image Version + +This configuration pins Formbricks to `4.9.7`. Formbricks 5.0 and later also require Cube, Hub, and SpiceDB services, which this stack does not include. See the [upstream Docker Compose file](https://github.com/formbricks/formbricks/blob/main/docker/docker-compose.yml) before you upgrade. diff --git a/services/formbricks/compose.yaml b/services/formbricks/compose.yaml index 9e9b19ed..efeb97b0 100644 --- a/services/formbricks/compose.yaml +++ b/services/formbricks/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,7 +35,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -48,6 +48,13 @@ services: restart: always postgres: + container_name: app-${SERVICE}-postgres # Name for local container management + healthcheck: + test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U postgres"] # Check if PostgreSQL accepts connections + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always image: pgvector/pgvector:pg17 volumes: @@ -55,6 +62,13 @@ services: environment: - POSTGRES_PASSWORD=postgres redis: + container_name: app-${SERVICE}-redis # Name for local container management + healthcheck: + test: ["CMD", "valkey-cli", "ping"] # Check if Valkey responds + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d command: valkey-server --appendonly yes @@ -146,7 +160,13 @@ services: tailscale: condition: service_healthy postgres: - condition: service_started + condition: service_healthy redis: - condition: service_started + condition: service_healthy + healthcheck: + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/health"] # Check if the service is responding; the first start runs many database migrations + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 300s # Time to wait before starting health checks restart: always diff --git a/services/fossflow/.env b/services/fossflow/.env index dac5e6bb..152d0afc 100644 --- a/services/fossflow/.env +++ b/services/fossflow/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/fossflow/README.md b/services/fossflow/README.md index c5e022ba..15336f70 100644 --- a/services/fossflow/README.md +++ b/services/fossflow/README.md @@ -17,4 +17,4 @@ FossFLOW is a free and open-source flow **visualization** tool. Unlike automatio ## Configuration Overview -This setup includes a `tailscale-fossflow` container running the Tailscale client to establish a secure connection. The `fossflow` container uses `network_mode: service:tailscale-fossflow`, ensuring all traffic routes through Tailscale. This keeps your flow diagrams accessible only to authenticated devices within your Tailnet, with no exposure to the public internet. +This setup includes a `tailscale-fossflow` container running the Tailscale client to establish a secure connection. The `fossflow` container uses `network_mode: service:tailscale`, ensuring all traffic routes through Tailscale. This keeps your flow diagrams accessible only to authenticated devices within your Tailnet, with no exposure to the public internet. diff --git a/services/fossflow/compose.yaml b/services/fossflow/compose.yaml index 55e1eb11..4833d2d9 100644 --- a/services/fossflow/compose.yaml +++ b/services/fossflow/compose.yaml @@ -4,12 +4,12 @@ configs: {"TCP":{"443":{"HTTPS":true}}, "Web":{"$${TS_CERT_DOMAIN}:443": {"Handlers":{"/": - {"Proxy":"http://127.0.0.1:3000"}}}}, + {"Proxy":"http://127.0.0.1:80"}}}}, "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:80 # Binding the host port to FossFLOW's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,21 +47,19 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management - build: - context: https://github.com/stan-smith/FossFLOW.git - dockerfile: Dockerfile environment: - - PUBLIC_URL="https://fossflow..ts.net" + - PUBLIC_URL=https://fossflow..ts.net + - TZ=${TZ} depends_on: tailscale: condition: service_healthy healthcheck: - test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:3000 || exit 1"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:80/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/freshrss/.env b/services/freshrss/.env index 7b41415d..4c17aeb1 100644 --- a/services/freshrss/.env +++ b/services/freshrss/.env @@ -15,7 +15,8 @@ TS_AUTHKEY= # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TAILNET_NAME= # Include the ".ts.net" if it is part of your Tailnet name +# Include the ".ts.net" if it is part of your Tailnet name +TAILNET_NAME= # FreshRSS Configuration # You must set these before the first start. They are only applied while the data diff --git a/services/freshrss/compose.yaml b/services/freshrss/compose.yaml index a0860b69..995c5bca 100644 --- a/services/freshrss/compose.yaml +++ b/services/freshrss/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,7 +35,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: # Variables are declared in the .env file. - TZ=${TZ} diff --git a/services/frigate/.env b/services/frigate/.env index c7580701..a5e70557 100644 --- a/services/frigate/.env +++ b/services/frigate/.env @@ -11,12 +11,13 @@ SERVICEPORT=8971 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/frigate/README.md b/services/frigate/README.md index b86293a6..454141a9 100644 --- a/services/frigate/README.md +++ b/services/frigate/README.md @@ -10,7 +10,7 @@ Frigate is often paired with Tailscale to ensure that camera feeds, recordings, ## Configuration Overview -In this setup, the `tailscale-frigate` service runs Tailscale, which manages secure networking for Frigate. The `frigate` container shares the network stack using Docker’s `network_mode: service:tailscale-frigate`. +In this setup, the `tailscale-frigate` service runs Tailscale, which manages secure networking for Frigate. The `frigate` container shares the network stack using Docker’s `network_mode: service:tailscale`. This ensures: diff --git a/services/frigate/compose.yaml b/services/frigate/compose.yaml index edd403dc..287715d3 100644 --- a/services/frigate/compose.yaml +++ b/services/frigate/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -40,7 +40,7 @@ services: - "8555:8555/tcp" # WebRTC over tcp - "8555:8555/udp" # WebRTC over udp # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -50,10 +50,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management privileged: true # this may not be necessary for all setups, but Frigate needs access to the host's hardware for video processing. Adjust as needed for your specific setup and security requirements. stop_grace_period: 30s # allow enough time to shut down the various services @@ -80,10 +80,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against /api/version, with a 300s start period), so this file does not override it. restart: always diff --git a/services/garage/.env b/services/garage/.env new file mode 100644 index 00000000..5b2fb6a3 --- /dev/null +++ b/services/garage/.env @@ -0,0 +1,33 @@ +#version=1.1 +#URL=https://github.com/tailscale-dev/ScaleTail +#COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. + +# Service Configuration +# Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). +SERVICE=garage +# Docker image URL from container registry (e.g., adguard/adguard-home). +IMAGE_URL=dxflrs/garage:v2.3.0 + +# Network Configuration +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= + +# Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. +DNS_SERVER=9.9.9.9 + +# Tailscale Configuration +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= + +# Optional Service variables +# PUID=1000 + +#Time Zone setting for containers +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones + +# Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ + +# Before running please configure Garage's secrets by running the openssl commands below and copying the output +GARAGE_RPC_SECRET= # "openssl rand -hex 32" +GARAGE_ADMIN_TOKEN= # "openssl rand -base64 32" +GARAGE_METRICS_TOKEN= # "openssl rand -base64 32" diff --git a/services/garage/README.md b/services/garage/README.md new file mode 100644 index 00000000..f4bba5be --- /dev/null +++ b/services/garage/README.md @@ -0,0 +1,92 @@ +# Garage with Tailscale Sidecar Configuration + +This Docker Compose configuration sets up [**Garage**](https://garagehq.deuxfleurs.fr/) with tailscale as a sidecar container. Allowing you to securely host your own S3 compatible backend on your tailnet + +## Garage + +[**Garage**](https://garagehq.deuxfleurs.fr/) is an S3 compatible storage solution designed for self hosting at a small scale. Supporting Geo-replication and redundancy optimised for performance and resiliance to node failures. + +## Key Features + +- S3 API +- Geo-distribution +- Flexible deployments +- Multiple replication modes +- Compression & Deduplication +- And many more [**here**](https://garagehq.deuxfleurs.fr/documentation/reference-manual/features/) + +## Configuration Overview + +In this deployment, the `tailscale-garage` service runs the Tailscale client to establish a secure private network. The `garage` container uses `network_mode: service:tailscale-garage` to route its traffic through the Tailscale interface. This ensures that all Garage api routes are only accessible securely through your tailnet. + +| Port | Purpose | Address | +|:-----|:--------|:--------| +| 3900 | S3 API | `https://garage..ts.net` | +| 3902 | Static Websites | `https://garage..ts.net:3902` | +| 3903 | Admin API & Metrics | `https://garage..ts.net:3903` | + +## Files to check + +Please check the following variables in the .env file + +- `TS_AUTHKEY` // Auth Key from [https://tailscale.com/admin/authkeys](https://tailscale.com/admin/authkeys) +- `TZ` // Configure the correct time zone +- `GARAGE_RPC_SECRET` //Generate from the command in `.env` +- `GARAGE_ADMIN_TOKEN` //Generate from the command in `.env` +- `GARAGE_METRICS_TOKEN` //Generate from the command in `.env` + +## Setup Guidelines + +Before you start using garage you need to configure your instance. + +### 1. Check Garage is configured correctly + +```bash +docker exec app-garage /garage status +``` + +You should get a output like this: + +```bash +==== HEALTHY NODES ==== +ID Hostname Address Tags Zone Capacity DataAvail Version +4014a6c5a274f246 garage 127.0.0.1:3901 NO ROLE ASSIGNED v2.3.0 +``` + +### 2. Configure the layout + +```bash +docker exec app-garage /garage layout assign -z dc1 -c 1G +``` + +node ID is taken from step 1 e.g. 4014a6c5a274f246 + +To assign more than 1GB of storage change the ``` 1G ``` parameter in the command. + +### 3. Apply the configured layout + +```bash +docker exec app-garage /garage layout apply --version 1 +``` + +### 4. Create a bucket + +```bash +docker exec app-garage /garage bucket create test-bucket +``` + +### 5. Create a key + +```bash +docker exec app-garage /garage key create my-key +``` + +Save these credentials and keep them secret! + +### 6. Grant key access to the test-bucket bucket + +```bash +docker exec app-garage /garage bucket allow --read --write --owner test-bucket --key my-key +``` + +### Congratulations your all setup with a s3 compatible bucket and key for more info take a look at the [documentation](https://garagehq.deuxfleurs.fr/documentation/quick-start/) diff --git a/services/garage/compose.yaml b/services/garage/compose.yaml new file mode 100644 index 00000000..d5835884 --- /dev/null +++ b/services/garage/compose.yaml @@ -0,0 +1,80 @@ +configs: + ts-serve: + content: | + {"TCP":{"443":{"HTTPS":true},"3902":{"HTTPS":true},"3903":{"HTTPS":true}}, + "Web":{"$${TS_CERT_DOMAIN}:443": + {"Handlers":{"/": + {"Proxy":"http://127.0.0.1:3900"}}}, + "$${TS_CERT_DOMAIN}:3902": + {"Handlers":{"/": + {"Proxy":"http://127.0.0.1:3902"}}}, + "$${TS_CERT_DOMAIN}:3903": + {"Handlers":{"/": + {"Proxy":"http://127.0.0.1:3903"}}}}, + "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} + +services: +# Make sure you have updated/checked the .env file with the correct variables. +# All the ${ xx } need to be defined there. + # Tailscale Sidecar Configuration + tailscale: + image: tailscale/tailscale:latest # Image to be used + container_name: tailscale-${SERVICE} # Name for local container management + hostname: ${SERVICE} # Name used within your Tailscale environment + environment: + - TS_AUTHKEY=${TS_AUTHKEY} + - TS_STATE_DIR=/var/lib/tailscale + - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required + - TS_USERSPACE=false + - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" + - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint + #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + - TS_AUTH_ONCE=true + configs: + - source: ts-serve + target: /config/serve.json + volumes: + - ./config:/config # Config folder used to store Tailscale files - you may need to change the path + - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path + devices: + - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work + cap_add: + - net_admin # Tailscale requirement + #ports: + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below + #dns: + # - ${DNS_SERVER} + healthcheck: + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 10s # Time to wait before starting health checks + restart: always + + # ${SERVICE} + application: + image: ${IMAGE_URL} # Image to be used + network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + container_name: app-${SERVICE} # Name for local container management + environment: # Variables are delared in .env file. + - TZ=${TZ} + - GARAGE_RPC_SECRET=${GARAGE_RPC_SECRET} + - GARAGE_ADMIN_TOKEN=${GARAGE_ADMIN_TOKEN} + - GARAGE_METRICS_TOKEN=${GARAGE_METRICS_TOKEN} + #- EXAMPLE_VAR=${EXAMPLE_VAR} + volumes: + - ./garage.toml:/etc/garage.toml + - ./${SERVICE}-data/data:/var/lib/garage/data + - ./${SERVICE}-data/meta:/var/lib/garage/meta + depends_on: + tailscale: + condition: service_healthy + healthcheck: + test: ["CMD", "/garage", "status"] # Check that the Garage node responds over RPC + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks + restart: always diff --git a/services/garage/garage.toml b/services/garage/garage.toml new file mode 100644 index 00000000..fd9f5a61 --- /dev/null +++ b/services/garage/garage.toml @@ -0,0 +1,22 @@ +metadata_dir = "/var/lib/garage/meta" +data_dir = "/var/lib/garage/data" +db_engine = "sqlite" + +replication_factor = 1 + +rpc_bind_addr = "[::]:3901" +rpc_public_addr = "127.0.0.1:3901" + + +[s3_api] +s3_region = "garage" +api_bind_addr = "[::]:3900" +root_domain = ".s3.garage.localhost" + +[s3_web] +bind_addr = "127.0.0.1:3902" +root_domain = ".web.garage.localhost" +index = "index.html" + +[admin] +api_bind_addr = "127.0.0.1:3903" \ No newline at end of file diff --git a/services/ghost/.env b/services/ghost/.env index 9c309958..5471dd32 100644 --- a/services/ghost/.env +++ b/services/ghost/.env @@ -13,10 +13,13 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +# Public URL used by Ghost to build links and redirects. Replace the placeholder with your Tailnet hostname. +GHOST_URL=https://ghost..ts.net + +#EXAMPLE_VAR="Environment variable" diff --git a/services/ghost/README.md b/services/ghost/README.md index 5dfbfaa0..e47a8313 100644 --- a/services/ghost/README.md +++ b/services/ghost/README.md @@ -16,4 +16,6 @@ This Docker Compose configuration sets up **[Ghost](https://github.com/TryGhost/ ## Configuration Overview -In this setup, the `tailscale-ghost` service runs Tailscale, which manages secure networking for the Ghost service. The `ghost` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Ghost’s web interface and publishing tools are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your publishing workflow. +In this setup, the `tailscale-ghost` service runs Tailscale, which manages secure networking for the Ghost service. The `ghost` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Ghost’s web interface and publishing tools are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your publishing workflow. + +Set `GHOST_URL` in `.env` to the HTTPS hostname that you use on your Tailnet. Ghost listens on port `2368`, and Tailscale Serve forwards HTTPS traffic to that port. diff --git a/services/ghost/compose.yaml b/services/ghost/compose.yaml index 0e1bbd50..9bab8e8f 100644 --- a/services/ghost/compose.yaml +++ b/services/ghost/compose.yaml @@ -4,12 +4,12 @@ configs: {"TCP":{"443":{"HTTPS":true}}, "Web":{"$${TS_CERT_DOMAIN}:443": {"Handlers":{"/": - {"Proxy":"http://127.0.0.1:80"}}}}, + {"Proxy":"http://127.0.0.1:2368"}}}}, "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:2368 # Binding the host port to Ghost's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: # see https://ghost.org/docs/config/#configuration-options @@ -59,10 +59,10 @@ services: database__connection__user: root database__connection__password: example database__connection__database: ghost - + # this url value is just an example, and is likely wrong for your environment! - url: http://localhost:8080 - + url: ${GHOST_URL} + # contrary to the default mentioned in the linked documentation, this image defaults to NODE_ENV=production (so development mode needs to be explicitly specified if desired) #NODE_ENV: development volumes: @@ -71,8 +71,10 @@ services: depends_on: tailscale: condition: service_healthy + db: + condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "node"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "-q", "-O", "/dev/null", "--header", "X-Forwarded-Proto: https", "http://127.0.0.1:2368/ghost/api/admin/site/"] # Check if the service is responding; the header avoids the redirect to the https url interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy @@ -86,4 +88,10 @@ services: MYSQL_ROOT_PASSWORD: example volumes: - ./${SERVICE}-data/db:/var/lib/mysql + healthcheck: + test: ["CMD", "mysqladmin", "ping", "-h", "127.0.0.1", "--silent"] # Check if MySQL accepts connections + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always diff --git a/services/gitea/.env b/services/gitea/.env index 10e24d48..95f71218 100644 --- a/services/gitea/.env +++ b/services/gitea/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/gitea/README.md b/services/gitea/README.md index 1a8d850e..f8852494 100644 --- a/services/gitea/README.md +++ b/services/gitea/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up [Gitea](https://gitea.com/) with Tails ## Configuration Overview -In this deployment, the `tailscale-gitea` service runs the Tailscale client to establish a secure private network. The `gitea` container uses `network_mode: service:tailscale-gitea` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. +In this deployment, the `tailscale-gitea` service runs the Tailscale client to establish a secure private network. The `gitea` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. diff --git a/services/gitea/compose.yaml b/services/gitea/compose.yaml index 034b02cc..65263939 100644 --- a/services/gitea/compose.yaml +++ b/services/gitea/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - USER_UID=1000 @@ -64,7 +64,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "gitea"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:3000/api/healthz"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/gitsave/.env b/services/gitsave/.env index e8858d08..c68b4216 100644 --- a/services/gitsave/.env +++ b/services/gitsave/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -24,4 +24,4 @@ JWT_SECRET="REPLACE_THIS" DISABLE_AUTH=false ENCRYPTION_SECRET="REPLACE_THIS_WITH_32_CHARACTERS_SECRET" -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/gitsave/README.md b/services/gitsave/README.md index 2ac17176..f9c6e5e9 100644 --- a/services/gitsave/README.md +++ b/services/gitsave/README.md @@ -17,4 +17,4 @@ This Docker Compose configuration sets up [**GitSave**](https://github.com/TimWi ## Configuration Overview -In this deployment, the `tailscale-gitsave` service runs the Tailscale client to establish a secure private network. The `gitsave` container uses `network_mode: service:tailscale-gitsave` to route all traffic through the Tailscale interface. This ensures that your GitHub backup service and its API endpoints are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-gitsave` service runs the Tailscale client to establish a secure private network. The `gitsave` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your GitHub backup service and its API endpoints are only accessible via Tailscale, preventing public exposure. diff --git a/services/gitsave/compose.yaml b/services/gitsave/compose.yaml index 2a115836..1b177964 100644 --- a/services/gitsave/compose.yaml +++ b/services/gitsave/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -66,7 +66,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:3000/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/glance/.env b/services/glance/.env index 25c787e5..5493b3f0 100644 --- a/services/glance/.env +++ b/services/glance/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/glance/README.md b/services/glance/README.md index 19596432..62c90bb1 100644 --- a/services/glance/README.md +++ b/services/glance/README.md @@ -10,4 +10,4 @@ To install Glance properly, make sure to add the files glance.yml and home.yml t ## Configuration Overview -In this setup, the `tailscale-glance` service runs Tailscale, which provides secure networking for the Glance service. The `glance` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that the Glance dashboard is only accessible through the Tailscale network (or locally, if desired), adding a robust layer of privacy and security to your self-hosted monitoring setup. +In this setup, the `tailscale-glance` service runs Tailscale, which provides secure networking for the Glance service. The `glance` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that the Glance dashboard is only accessible through the Tailscale network (or locally, if desired), adding a robust layer of privacy and security to your self-hosted monitoring setup. diff --git a/services/glance/compose.yaml b/services/glance/compose.yaml index 55213ac2..9357297b 100644 --- a/services/glance/compose.yaml +++ b/services/glance/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: - # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Make sure you have updated/checked the .env file with the correct variables. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,11 +47,13 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management + environment: + - TZ=${TZ} volumes: - ./${SERVICE}-data/config:/app/config # Make sure to add the files glance.yml and home.yml to the config folder. See: (https://github.com/glanceapp/docker-compose-template/tree/main/root/config) - ./${SERVICE}-data/assets:/app/assets # Make sure to add the file user.css to the assets folder. See: (https://github.com/glanceapp/docker-compose-template/tree/main/root/assets) @@ -59,7 +61,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8080/api/healthz"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/gokapi/.env b/services/gokapi/.env index b6c2d484..e132278e 100644 --- a/services/gokapi/.env +++ b/services/gokapi/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/gokapi/README.md b/services/gokapi/README.md index 597a79ae..a1289ac4 100644 --- a/services/gokapi/README.md +++ b/services/gokapi/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Gokapi](https://github.com/Forceu/Gok ## Configuration Overview -In this setup, the `tailscale-gokapi` service runs Tailscale, which manages secure networking for the Gokapi service. The `gokapi` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Gokapi's web interface and file-sharing services are only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your file-sharing solution. +In this setup, the `tailscale-gokapi` service runs Tailscale, which manages secure networking for the Gokapi service. The `gokapi` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Gokapi's web interface and file-sharing services are only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your file-sharing solution. diff --git a/services/gokapi/compose.yaml b/services/gokapi/compose.yaml index b3bec0e7..c263d595 100644 --- a/services/gokapi/compose.yaml +++ b/services/gokapi/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TZ=${TZ} @@ -60,10 +60,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against the web UI), so this file does not override it. restart: always diff --git a/services/gotify/.env b/services/gotify/.env index 4aad5555..27805bd6 100644 --- a/services/gotify/.env +++ b/services/gotify/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/gotify/README.md b/services/gotify/README.md index f3ca6474..e846b7e6 100644 --- a/services/gotify/README.md +++ b/services/gotify/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up [Gotify](https://github.com/gotify/ser ## Configuration Overview -In this deployment, the `tailscale-gotify` service runs the Tailscale client to establish a secure private network. The `gotify` container uses `network_mode: service:tailscale-gotify` to route its traffic through the Tailscale interface. This ensures that the Gotify web UI and backend services are only reachable via your Tailscale network, keeping your notifications safe from public exposure. +In this deployment, the `tailscale-gotify` service runs the Tailscale client to establish a secure private network. The `gotify` container uses `network_mode: service:tailscale` to route its traffic through the Tailscale interface. This ensures that the Gotify web UI and backend services are only reachable via your Tailscale network, keeping your notifications safe from public exposure. diff --git a/services/gotify/compose.yaml b/services/gotify/compose.yaml index 43b5b4ad..945715f3 100644 --- a/services/gotify/compose.yaml +++ b/services/gotify/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: - # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Make sure you have updated/checked the .env file with the correct variables. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -46,23 +46,19 @@ services: retries: 3 # Number of retries before marking as unhealthy start_period: 10s # Time to wait before starting health checks restart: always - - # ${SERVICE} + + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - GOTIFY_DEFAULTUSER_PASS=admin + - TZ=${TZ} volumes: - ./${SERVICE}-data/app/data:/app/data depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:80"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against /health), so this file does not override it. restart: always diff --git a/services/grampsweb/.env b/services/grampsweb/.env index 292211dc..3cccf44d 100644 --- a/services/grampsweb/.env +++ b/services/grampsweb/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/grampsweb/README.md b/services/grampsweb/README.md index ac8809f9..6239ee2b 100644 --- a/services/grampsweb/README.md +++ b/services/grampsweb/README.md @@ -19,4 +19,4 @@ This Docker Compose configuration sets up [**Gramps Web**](https://github.com/gr ## Configuration Overview -In this deployment, the `tailscale-grampsweb` service runs the Tailscale client to establish a secure private network. The `grampsweb` container uses `network_mode: service:tailscale-grampsweb` to route all traffic through the Tailscale interface. This ensures that your genealogy database, charts, and administration interface are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-grampsweb` service runs the Tailscale client to establish a secure private network. The `grampsweb` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your genealogy database, charts, and administration interface are only accessible via Tailscale, preventing public exposure. diff --git a/services/grampsweb/compose.yaml b/services/grampsweb/compose.yaml index fe426317..68bf7b5e 100644 --- a/services/grampsweb/compose.yaml +++ b/services/grampsweb/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,15 +47,15 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: &grampsweb image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: PUID: 1000 PGID: 1000 - TZ: Europe/Amsterdam + TZ: ${TZ} GRAMPSWEB_TREE: "Gramps Web" # will create a new tree if not exists GRAMPSWEB_CELERY_CONFIG__broker_url: "redis://grampsweb_redis:6379/0" GRAMPSWEB_CELERY_CONFIG__result_backend: "redis://grampsweb_redis:6379/0" @@ -74,6 +74,12 @@ services: condition: service_healthy grampsweb_redis: condition: service_healthy + healthcheck: + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:5000/ready"] # Check if the service is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always grampsweb_celery: @@ -81,14 +87,21 @@ services: ports: [] container_name: app-${SERVICE}-celery depends_on: - - grampsweb_redis + application: + condition: service_healthy # Wait until the web app has run the database migrations; both containers run them at startup command: celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2 + healthcheck: + test: ["CMD", "pgrep", "-f", "celery -A gramps_webapi.celery worker"] # Check if the Celery worker process is running + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks grampsweb_redis: image: docker.io/library/redis:7.2.4-alpine container_name: app-${SERVICE}-redis healthcheck: - test: ["CMD", "redis-cli", "ping"] # Check if ${SERVICE} process is running + test: ["CMD", "redis-cli", "ping"] # Check if Redis responds interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/haptic/.env b/services/haptic/.env index e436d1f3..2a1747cc 100644 --- a/services/haptic/.env +++ b/services/haptic/.env @@ -7,16 +7,16 @@ SERVICE=haptic IMAGE_URL=chroxify/haptic-web:latest # Network Configuration -SERVICEPORT=3000 +SERVICEPORT=80 DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/haptic/README.md b/services/haptic/README.md index a4b7d691..e82b60e9 100644 --- a/services/haptic/README.md +++ b/services/haptic/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Haptic](https://github.com/chroxify ## Configuration Overview -In this setup, the `tailscale-haptic` service runs Tailscale, which manages secure networking for the Haptic service. The `haptic` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Haptic’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your bookmarks. +In this setup, the `tailscale-haptic` service runs Tailscale, which manages secure networking for the Haptic service. The `haptic` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Haptic’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your bookmarks. diff --git a/services/haptic/compose.yaml b/services/haptic/compose.yaml index 87910b0e..9af3e938 100644 --- a/services/haptic/compose.yaml +++ b/services/haptic/compose.yaml @@ -4,12 +4,12 @@ configs: {"TCP":{"443":{"HTTPS":true}}, "Web":{"$${TS_CERT_DOMAIN}:443": {"Handlers":{"/": - {"Proxy":"http://127.0.0.1:3000"}}}}, + {"Proxy":"http://127.0.0.1:80"}}}}, "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -61,10 +61,10 @@ services: depends_on: tailscale: condition: service_healthy - # healthcheck: - # test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - # interval: 1m # How often to perform the check - # timeout: 10s # Time to wait for the check to succeed - # retries: 3 # Number of retries before marking as unhealthy - # start_period: 30s # Time to wait before starting health checks + healthcheck: + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:80/"] # Check if the service is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always diff --git a/services/hemmelig/.env b/services/hemmelig/.env index 45fdf998..cc5d3977 100644 --- a/services/hemmelig/.env +++ b/services/hemmelig/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/hemmelig/README.md b/services/hemmelig/README.md index 92950dcb..b03c880b 100644 --- a/services/hemmelig/README.md +++ b/services/hemmelig/README.md @@ -25,7 +25,7 @@ While a public SaaS instance of Hemmelig (e.g., hemmelig.app) exists, **self-hos In this deployment, a **Tailscale sidecar container** (e.g., `tailscale-hemmelig`) runs the Tailscale client and joins your private Tailscale network. The main `hemmelig` service uses: ```plain -network_mode: service:tailscale-hemmelig +network_mode: service:tailscale ``` This effectively **routes all traffic through the Tailscale network interface**, making the app private and unreachable from the public Internet while still accessible to any device on your Tailscale network. Remote team members can securely access the Hemmelig web UI, API, and encryption features over Tailscale without exposing the app publicly. diff --git a/services/hemmelig/compose.yaml b/services/hemmelig/compose.yaml index 566d73ce..93bd317b 100644 --- a/services/hemmelig/compose.yaml +++ b/services/hemmelig/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -67,18 +67,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: - [ - 'CMD', - 'wget', - '--no-verbose', - '--tries=1', - '--spider', - 'http://localhost:3000/api/healthz', - ] - interval: 1m - timeout: 10s - retries: 3 - start_period: 30s + # Healthcheck: defined by the image (wget against /api/health/ready), so this file does not override it. restart: always diff --git a/services/homarr/.env b/services/homarr/.env index 59e7e882..60390f57 100644 --- a/services/homarr/.env +++ b/services/homarr/.env @@ -13,10 +13,13 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +# Required: generate a 64-character hex key with: openssl rand -hex 32 +SECRET_ENCRYPTION_KEY= + +#EXAMPLE_VAR="Environment variable" diff --git a/services/homarr/README.md b/services/homarr/README.md index 61ebe760..a0ec402e 100644 --- a/services/homarr/README.md +++ b/services/homarr/README.md @@ -8,4 +8,14 @@ This Docker Compose configuration sets up [Homarr](https://github.com/ajnart/hom ## Configuration Overview -In this setup, the tailscale-homarr service runs Tailscale, which manages secure networking for the Homarr service. The homarr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Homarr’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. +In this setup, the tailscale-homarr service runs Tailscale, which manages secure networking for the Homarr service. The homarr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Homarr’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. + +## Files to check + +Please check the following contents for validity as some variables need to be defined upfront. + +- `.env` + - Required: `TS_AUTHKEY` + - Required: `SECRET_ENCRYPTION_KEY`, a 64-character hex key. Generate it with `openssl rand -hex 32`. Compose stops with an error if it is empty. + +If you previously set `SECRET_ENCRYPTION_KEY` in `compose.yaml`, move that value to `.env`. A new key cannot decrypt the integration secrets that Homarr already stored. diff --git a/services/homarr/compose.yaml b/services/homarr/compose.yaml index 120101fb..690dce31 100644 --- a/services/homarr/compose.yaml +++ b/services/homarr/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,16 +47,16 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 - PGID=1000 - TZ=${TZ} - - SECRET_ENCRYPTION_KEY= # Please generate a key with: openssl rand -hex 32 + - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:?Set SECRET_ENCRYPTION_KEY in .env} volumes: # - /var/run/docker.sock:/var/run/docker.sock # Optional, only if you want docker integration - ./${SERVICE}-data/appdata:/appdata @@ -64,7 +64,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:7575/api/health/live"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/home-assistant/.env b/services/home-assistant/.env index dfbd3933..1a83ff15 100644 --- a/services/home-assistant/.env +++ b/services/home-assistant/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/home-assistant/README.md b/services/home-assistant/README.md index 2b36d106..fc207c21 100644 --- a/services/home-assistant/README.md +++ b/services/home-assistant/README.md @@ -1,28 +1,28 @@ -# Home Assistant with Tailscale Sidecar Configuration +# Home Assistant with Tailscale Sidecar Configuration This Docker Compose configuration sets up **[Home Assistant](https://github.com/home-assistant/)** with Tailscale as a sidecar container to securely manage and access your smart home automation platform over a private Tailscale network. By integrating Tailscale, you can ensure that your Home Assistant instance remains private and accessible only to authorized devices within your Tailscale network. -## Home Assistant +## Home Assistant [Home Assistant](https://github.com/home-assistant/) is an open-source home automation platform that allows you to control and automate smart devices from a unified interface. With support for thousands of integrations, it provides powerful automation capabilities and privacy-focused self-hosted control over your smart home. Pairing Home Assistant with Tailscale ensures a secure, remote-accessible smart home without exposing it to the public internet. -## Key Features +## Key Features -- **Local Control & Privacy** – Self-hosted and privacy-focused, keeping your data in your home. -- **Extensive Integrations** – Supports thousands of smart home devices and services. -- **Automation & Customization** – Create complex automations with YAML or visual editors. -- **Secure Remote Access** – Pair with Tailscale to safely access your Home Assistant instance from anywhere. +- **Local Control & Privacy** – Self-hosted and privacy-focused, keeping your data in your home. +- **Extensive Integrations** – Supports thousands of smart home devices and services. +- **Automation & Customization** – Create complex automations with YAML or visual editors. +- **Secure Remote Access** – Pair with Tailscale to safely access your Home Assistant instance from anywhere. -## Configuration Overview +## Configuration Overview -In this setup, the `tailscale-homeassistant` service runs Tailscale, which manages secure networking for the Home Assistant service. The `homeassistant` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Home Assistant’s web interface and smart home control features are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for your home automation system. +In this setup, the `tailscale-homeassistant` service runs Tailscale, which manages secure networking for the Home Assistant service. The `homeassistant` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Home Assistant’s web interface and smart home control features are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for your home automation system. ## Troubleshooting If you encounter a `400: Bad Request` after deployment, please alter the file `ha-data/config/configurations.yaml` to trust the reverse proxy configuration used by Tailscale. The `configurations.yaml` should look like this. ```plain -$ cat ha-data/config/configuration.yaml +$ cat ha-data/config/configuration.yaml # Loads default set of integrations. Do not remove. default_config: diff --git a/services/home-assistant/compose.yaml b/services/home-assistant/compose.yaml index 9a937478..b2ac0de6 100644 --- a/services/home-assistant/compose.yaml +++ b/services/home-assistant/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management privileged: true environment: @@ -65,7 +65,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: "curl --fail http://localhost:8123/ || exit 1" # Check if ${SERVICE} process is running + test: "curl --fail http://localhost:8123/ || exit 1" # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/homebox/.env b/services/homebox/.env index a00750b2..677c119f 100644 --- a/services/homebox/.env +++ b/services/homebox/.env @@ -11,12 +11,17 @@ SERVICEPORT=7745 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +# Required: at least 32 bytes. Generate with: openssl rand -base64 48 +# Changing it later invalidates all issued API keys. +HBOX_AUTH_API_KEY_PEPPER= + +#EXAMPLE_VAR="Environment variable" diff --git a/services/homebox/README.md b/services/homebox/README.md index c5823c2b..387ca0fe 100644 --- a/services/homebox/README.md +++ b/services/homebox/README.md @@ -30,7 +30,7 @@ When combined with Tailscale, Homebox becomes a **secure, Tailnet-only inventory In this deployment, a **Tailscale sidecar container** (for example `tailscale-homebox`) runs the Tailscale client and joins your private Tailscale network. The main `homebox` service uses: ```plain -network_mode: service:tailscale-homebox +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Homebox web UI and API are accessible **only via your Tailscale network**. No public port exposure is required unless explicitly configured. @@ -52,3 +52,11 @@ This is especially important when using the rootless or hardened Homebox images ```plain user: 65532:65532 ``` + +## Files to check + +Please check the following contents for validity as some variables need to be defined upfront. + +- `.env` + - Required: `TS_AUTHKEY` + - Required: `HBOX_AUTH_API_KEY_PEPPER`, at least 32 bytes. Generate it with `openssl rand -base64 48`. Compose stops with an error if it is empty. Changing it later invalidates all issued API keys. diff --git a/services/homebox/compose.yaml b/services/homebox/compose.yaml index d3129372..f7a78306 100644 --- a/services/homebox/compose.yaml +++ b/services/homebox/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,25 +47,20 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management user: "65532:65532" environment: - PUID=1000 - PGID=1000 - - TZ=${TZ} + - HBOX_AUTH_API_KEY_PEPPER=${HBOX_AUTH_API_KEY_PEPPER:?Set HBOX_AUTH_API_KEY_PEPPER in .env} volumes: - ./${SERVICE}-data:/data depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "api"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (wget against /api/v1/status), so this file does not override it. restart: always diff --git a/services/homepage/.env b/services/homepage/.env index 367438e2..bae1b0e8 100644 --- a/services/homepage/.env +++ b/services/homepage/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -21,4 +21,4 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim TAILNET_NAME= -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/homepage/README.md b/services/homepage/README.md index b04f85d4..c1b93a30 100644 --- a/services/homepage/README.md +++ b/services/homepage/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Homepage](https://github.com/gethomep ## Configuration Overview -In this setup, the `tailscale-homepage` service runs Tailscale, which manages secure networking for the Homepage service. The `homepage` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Homepage’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. +In this setup, the `tailscale-homepage` service runs Tailscale, which manages secure networking for the Homepage service. The `homepage` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Homepage’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. diff --git a/services/homepage/compose.yaml b/services/homepage/compose.yaml index de0519cd..3bf19788 100644 --- a/services/homepage/compose.yaml +++ b/services/homepage/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: - # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Make sure you have updated/checked the .env file with the correct variables. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -46,24 +46,20 @@ services: retries: 3 # Number of retries before marking as unhealthy start_period: 10s # Time to wait before starting health checks restart: always - - # ${SERVICE} + + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - HOMEPAGE_ALLOWED_HOSTS=homepage.${TAILNET_NAME}.ts.net + - TZ=${TZ} volumes: - ./${SERVICE}-data/config:/app/config - /var/run/docker.sock:/var/run/docker.sock:ro # optional, for docker integrations depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "next-server"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (wget against /api/healthcheck), so this file does not override it. restart: always diff --git a/services/hytale/.env b/services/hytale/.env index b873a677..ad983a19 100644 --- a/services/hytale/.env +++ b/services/hytale/.env @@ -13,7 +13,7 @@ DNS_SERVER=1.1.1.1 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Hytale Configuration @@ -21,6 +21,5 @@ SERVER_IP=0.0.0.0 SERVER_PORT=5520 PROD=FALSE DEBUG=FALSE -TZ=US/Eastern -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/hytale/compose.yaml b/services/hytale/compose.yaml index 05167aa7..c54c831b 100644 --- a/services/hytale/compose.yaml +++ b/services/hytale/compose.yaml @@ -1,6 +1,6 @@ services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -12,7 +12,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true volumes: - ./config:/config # Config folder used to store Tailscale files - you may need to change the path @@ -21,8 +21,8 @@ services: - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work cap_add: - net_admin # Tailscale requirement - ports: - - "${SERVICEPORT}:${SERVICEPORT}/udp" + #ports: + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT}/udp # Binding the game port to the local network - only required for players outside your Tailnet # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -34,10 +34,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - SERVER_IP=${SERVER_IP} @@ -53,4 +53,5 @@ services: depends_on: tailscale: condition: service_healthy - restart: unless-stopped + # Healthcheck: defined by the image (ss checks the game UDP port), so this file does not override it. + restart: always diff --git a/services/immich/.env b/services/immich/.env index ccbf69ab..aab430db 100644 --- a/services/immich/.env +++ b/services/immich/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Custom Immich - https://immich.app/docs/install/docker-compose @@ -23,13 +23,12 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # PUID=1000 # The location where your uploaded files are stored -UPLOAD_LOCATION=./library +UPLOAD_LOCATION=./${SERVICE}-data/upload # The location where your database files are stored. Network shares are not supported for the database -DB_DATA_LOCATION=./postgres +DB_DATA_LOCATION=./${SERVICE}-data/database -# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List -TZ=Europe/Amsterdam +# To set a timezone, change the TZ value above to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List # The Immich version to use. You can pin this to a specific version like "v1.71.0" IMMICH_VERSION=release @@ -43,4 +42,4 @@ DB_PASSWORD=postgres DB_USERNAME=postgres DB_DATABASE_NAME=immich -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/immich/README.md b/services/immich/README.md index bfca4b23..1bb9a1cc 100644 --- a/services/immich/README.md +++ b/services/immich/README.md @@ -19,4 +19,12 @@ Immich is a self-hosted, high-performance solution for backing up and browsing p ## Configuration Overview -In this deployment, the `tailscale-immich` service runs the Tailscale client to establish a secure private network. The `immich` container uses `network_mode: service:tailscale-immich` to route its traffic through the Tailscale interface. This ensures that the Immich web UI and backend services are only reachable via your Tailscale network, keeping your personal media safe from public exposure. +In this deployment, the `tailscale-immich` service runs the Tailscale client to establish a secure private network. The `immich` container uses `network_mode: service:tailscale` to route its traffic through the Tailscale interface. This ensures that the Immich web UI and backend services are only reachable via your Tailscale network, keeping your personal media safe from public exposure. + +## Usage Notes + +* **Keep `TS_ACCEPT_DNS` disabled.** The `application` service shares the DNS configuration of the `tailscale` service. With `TS_ACCEPT_DNS=true`, Tailscale replaces Docker's DNS with MagicDNS, which cannot resolve the `database`, `redis`, and `immich-machine-learning` services. Immich then fails to start with `getaddrinfo ENOTFOUND database`. You can reach Immich over your Tailnet without this setting. +* **Resolving MagicDNS names from Immich.** If Immich itself must look up other Tailnet devices by name, such as an OAuth provider or SMTP server, uncomment the `dns` block of the `tailscale` service and set `100.100.100.100` as the DNS server. Docker keeps resolving the service names and forwards all other lookups to MagicDNS. Use the full name, such as `device.example.ts.net`. +* **Storage locations.** `UPLOAD_LOCATION` and `DB_DATA_LOCATION` in `.env` set where Immich stores your media and its database. The defaults are `./immich-data/upload` and `./immich-data/database`. To move your media to another disk, set `UPLOAD_LOCATION` to an absolute path. Keep the database on a local disk, because Immich does not support network shares for it. +* **Updating an existing installation.** Earlier versions of this stack ignored both variables and always used the default folders. If your `.env` still contains `UPLOAD_LOCATION=./library` or `DB_DATA_LOCATION=./postgres`, replace them with the defaults above before you restart. Otherwise Immich starts with an empty library and a new database. Your existing files stay untouched in `./immich-data`. +* **Renamed services.** Immich connects to the hostnames `database` and `redis` by default. If you rename these services in `compose.yaml`, set `DB_HOSTNAME` and `REDIS_HOSTNAME` in `.env` to the new names. diff --git a/services/immich/compose.yaml b/services/immich/compose.yaml index fc2ca9fb..505e54ec 100644 --- a/services/immich/compose.yaml +++ b/services/immich/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Keep disabled: it replaces Docker DNS, so Immich cannot resolve database and redis - see the README - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,8 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below + # To resolve MagicDNS names from Immich, uncomment the config below and use 100.100.100.100 as the DNS server #dns: # - ${DNS_SERVER} healthcheck: @@ -47,22 +48,20 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE}-server # Name for local container management # extends: # file: hwaccel.transcoding.yml # service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding volumes: # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file - - ./${SERVICE}-data/upload:/data + - ${UPLOAD_LOCATION}:/data - /etc/localtime:/etc/localtime:ro env_file: - .env - # ports: - # - '2283:2283' depends_on: redis: condition: service_healthy @@ -70,9 +69,8 @@ services: condition: service_healthy tailscale: condition: service_healthy + # Healthcheck: defined by the image (immich-healthcheck), so this file does not override it. restart: always - healthcheck: - disable: false immich-machine-learning: container_name: app-${SERVICE}-machine-learning @@ -86,15 +84,14 @@ services: - ./${SERVICE}-data/model-cache:/cache env_file: - .env + # Healthcheck: defined by the image (python3 healthcheck.py), so this file does not override it. restart: always - healthcheck: - disable: false redis: container_name: app-${SERVICE}-redis image: docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9 healthcheck: - test: redis-cli ping || exit 1 + test: redis-cli ping || exit 1 # Check if Valkey responds restart: always database: @@ -109,5 +106,7 @@ services: # DB_STORAGE_TYPE: 'HDD' volumes: # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file - - ./${SERVICE}-data/database:/var/lib/postgresql/data + - ${DB_DATA_LOCATION}:/var/lib/postgresql/data + # Healthcheck: defined by the image (/usr/local/bin/healthcheck.sh), so this file does not override it. + # The image's check connects over the Unix socket, so it can report ready during first-start initialization. restart: always diff --git a/services/isley/.env b/services/isley/.env index d9b7f9e5..4859679e 100644 --- a/services/isley/.env +++ b/services/isley/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/isley/README.md b/services/isley/README.md index c0a7013d..a3d650ea 100644 --- a/services/isley/README.md +++ b/services/isley/README.md @@ -24,4 +24,4 @@ With integration options for popular grow equipment, Isley simplifies and elevat ## Configuration Overview -In this setup, the `tailscale-isley` service runs Tailscale, which manages secure networking for the Isley service. The `isley` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Isley's interface is not exposed to the public internet, protecting your grow journal and data with an additional layer of privacy. +In this setup, the `tailscale-isley` service runs Tailscale, which manages secure networking for the Isley service. The `isley` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Isley's interface is not exposed to the public internet, protecting your grow journal and data with an additional layer of privacy. diff --git a/services/isley/compose.yaml b/services/isley/compose.yaml index 234ee74a..4e697da6 100644 --- a/services/isley/compose.yaml +++ b/services/isley/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TZ=${TZ} @@ -60,10 +60,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (wget against /health), so this file does not override it. restart: always diff --git a/services/it-tools/.env b/services/it-tools/.env index 29217ab4..59f3b619 100644 --- a/services/it-tools/.env +++ b/services/it-tools/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/it-tools/README.md b/services/it-tools/README.md index 0e7cd15f..7c3999c5 100644 --- a/services/it-tools/README.md +++ b/services/it-tools/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [IT-Tools](https://github.com/Corentin ## Configuration Overview -In this setup, the `tailscale-it-tools` service runs Tailscale, which manages secure networking for the IT-Tools service. The `it-tools` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that IT-Tools’ web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted developer utilities. +In this setup, the `tailscale-it-tools` service runs Tailscale, which manages secure networking for the IT-Tools service. The `it-tools` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that IT-Tools’ web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted developer utilities. diff --git a/services/it-tools/compose.yaml b/services/it-tools/compose.yaml index 3ee24503..2095bbe2 100644 --- a/services/it-tools/compose.yaml +++ b/services/it-tools/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TZ=${TZ} @@ -58,7 +58,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "nginx"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:80/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/jellyfin/.env b/services/jellyfin/.env index 6c773dd0..48a70b33 100644 --- a/services/jellyfin/.env +++ b/services/jellyfin/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/jellyfin/README.md b/services/jellyfin/README.md index d8664eb4..1547ac48 100644 --- a/services/jellyfin/README.md +++ b/services/jellyfin/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Jellyfin](https://github.com/jellyfin ## Configuration Overview -In this setup, the tailscale-jellyfin service runs Tailscale, which manages secure networking for the Jellyfin service. The jellyfin service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Jellyfin’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media server. +In this setup, the tailscale-jellyfin service runs Tailscale, which manages secure networking for the Jellyfin service. The jellyfin service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Jellyfin’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media server. diff --git a/services/jellyfin/compose.yaml b/services/jellyfin/compose.yaml index 7a0bfbc3..63b01802 100644 --- a/services/jellyfin/compose.yaml +++ b/services/jellyfin/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -65,7 +65,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8096/health"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/kaneo/.env b/services/kaneo/.env index 5ee5eec1..da2f2314 100644 --- a/services/kaneo/.env +++ b/services/kaneo/.env @@ -16,12 +16,13 @@ SERVICEPORT_DATABASE=5432 DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ @@ -32,20 +33,11 @@ KANEO_CLIENT_URL="https://kaneo..ts.net" # AUTH Configuration AUTH_SECRET= -BETTER_AUTH_TRUSTED_PROXIES: "0.0.0.0/0" +# Kaneo trusts only loopback proxies by default (TRUSTED_PROXIES), which covers Tailscale Serve. # DB Configuration DB_USERNAME=kaneo DB_DATABASE_NAME=kaneo DB_PASSWORD= -# Tailscale Configuration -TS_AUTHKEY= - -# Time Zone setting for containers -TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones - -# Optional Service variables -# PUID=1000 - -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/kaneo/README.md b/services/kaneo/README.md index cd542b2d..82ce868c 100644 --- a/services/kaneo/README.md +++ b/services/kaneo/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Kaneo](https://github.com/usekaneo/ ## Configuration Overview -In this setup, the `tailscale-kaneo` service runs Tailscale, which manages secure networking for the Kaneo service. The `kaneo` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Kaneo’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding a strong layer of privacy and security to your self-hosted project management platform. +In this setup, the `tailscale-kaneo` service runs Tailscale, which manages secure networking for the Kaneo service. The `kaneo` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Kaneo’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding a strong layer of privacy and security to your self-hosted project management platform. diff --git a/services/kaneo/compose.yaml b/services/kaneo/compose.yaml index 23294d12..ce9f5496 100644 --- a/services/kaneo/compose.yaml +++ b/services/kaneo/compose.yaml @@ -10,8 +10,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -24,7 +24,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -37,9 +37,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -49,10 +49,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} - DB + # Database postgres: image: ${IMAGE_URL_DATABASE} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE}-postgres # Name for local container management env_file: - .env @@ -63,17 +63,17 @@ services: volumes: - ./${SERVICE}-data/postgres_data:/var/lib/postgresql/data healthcheck: - test: ["CMD-SHELL", "pg_isready -U ${DB_USERNAME} -d ${DB_DATABASE_NAME}"] + test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U ${DB_USERNAME} -d ${DB_DATABASE_NAME}"] # Check if PostgreSQL accepts connections interval: 10s # How often to perform the check timeout: 5s # Time to wait for the check to succeed retries: 5 # Number of retries before marking as unhealthy start_period: 30s # Time to wait before starting health checks - restart: unless-stopped + restart: always - # ${SERVICE} - Backend (API) + # Backend (API) backend: image: ${IMAGE_URL_BACKEND} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE}-backend # Name for local container management env_file: - .env @@ -84,12 +84,13 @@ services: condition: service_healthy postgres: condition: service_healthy - restart: unless-stopped + # Healthcheck: defined by the image (wget against /api/health), so this file does not override it. + restart: always - # ${SERVICE} - Frontend (Web) + # Frontend (Web) frontend: image: ${IMAGE_URL_FRONTEND} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE}-frontend # Name for local container management env_file: - .env @@ -98,7 +99,13 @@ services: condition: service_healthy backend: condition: service_started - restart: unless-stopped + healthcheck: + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:5173/"] # Check if the service is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks + restart: always volumes: postgres_data: diff --git a/services/karakeep/.env b/services/karakeep/.env index 4778fd2d..0255c8b7 100644 --- a/services/karakeep/.env +++ b/services/karakeep/.env @@ -4,7 +4,8 @@ # Service Configuration SERVICE=karakeep -IMAGE_URL= # Docker image URL from container registry (e.g., adguard/adguard-home). +# Docker image URL from container registry (e.g., adguard/adguard-home). +IMAGE_URL= # Network Configuration SERVICEPORT=3000 @@ -13,7 +14,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -28,4 +29,4 @@ MAX_ASSET_SIZE_MB=50 DISABLE_SIGNUPS=false DISABLE_PASSWORD_AUTH=false -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/karakeep/README.md b/services/karakeep/README.md index 5e43d5e8..614d4bbe 100644 --- a/services/karakeep/README.md +++ b/services/karakeep/README.md @@ -34,4 +34,4 @@ This Docker Compose configuration sets up **[Karakeep](https://github.com/karake ## Configuration Overview -In this setup, the `tailscale-karakeep` service runs Tailscale, which manages secure networking for the Karakeep service. The `karakeep` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Karakeep’s web interface is only accessible through the Tailscale network (or locally, if preferred), enhancing the privacy and security of your notes and collaborative workspace. +In this setup, the `tailscale-karakeep` service runs Tailscale, which manages secure networking for the Karakeep service. The `karakeep` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Karakeep’s web interface is only accessible through the Tailscale network (or locally, if preferred), enhancing the privacy and security of your notes and collaborative workspace. diff --git a/services/karakeep/compose.yaml b/services/karakeep/compose.yaml index 43c845e5..e5e27286 100644 --- a/services/karakeep/compose.yaml +++ b/services/karakeep/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application web: image: ghcr.io/karakeep-app/karakeep:${KARAKEEP_VERSION:-release} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE}-web # Name for local container management env_file: - .env @@ -70,28 +70,35 @@ services: depends_on: tailscale: condition: service_healthy + # Healthcheck: defined by the image (wget against /api/health), so this file does not override it. + restart: always + + chrome: + image: ghcr.io/karakeep-app/karakeep-chrome:release # Replaces the unmaintained alpine-chrome image; see Karakeep's Chrome image migration guide healthcheck: - test: ["CMD", "pgrep", "-f", "next-server"] # Check if ${SERVICE} process is running + test: ["CMD", "pidof", "headless-shell"] # Check if the browser process is running; the image has no HTTP client interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy start_period: 30s # Time to wait before starting health checks restart: always - - chrome: - image: gcr.io/zenika-hub/alpine-chrome:123 - restart: always container_name: app-${SERVICE}-chrome # Name for local container management - command: - - --no-sandbox + init: true + command: # The image entrypoint adds --no-sandbox and exposes the debugging port on 9222 - --disable-gpu - --disable-dev-shm-usage - - --remote-debugging-address=0.0.0.0 - - --remote-debugging-port=9222 - --hide-scrollbars - + - --disable-blink-features=AutomationControlled + - --window-size=1440,900 + meilisearch: image: getmeili/meilisearch:v1.11.1 + healthcheck: + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:7700/health"] # Check if Meilisearch is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always container_name: app-${SERVICE}-meilisearch # Name for local container management env_file: diff --git a/services/kavita/.env b/services/kavita/.env index ee12bba1..c74dc854 100644 --- a/services/kavita/.env +++ b/services/kavita/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/kavita/README.md b/services/kavita/README.md index 05185484..869abc89 100644 --- a/services/kavita/README.md +++ b/services/kavita/README.md @@ -17,7 +17,7 @@ This Docker Compose configuration sets up [Kavita](https://github.com/Kareadita/ ## Configuration Overview -In this setup, the `tailscale-kavita` service runs the Tailscale client to join your private mesh network. The `kavita` service is configured with `network_mode: service:tailscale-kavita`, so all network traffic for Kavita is routed through the Tailscale container. This ensures the web UI and API are reachable only via your Tailscale network (or locally), adding an extra layer of privacy and security to your self-hosted library. +In this setup, the `tailscale-kavita` service runs the Tailscale client to join your private mesh network. The `kavita` service is configured with `network_mode: service:tailscale`, so all network traffic for Kavita is routed through the Tailscale container. This ensures the web UI and API are reachable only via your Tailscale network (or locally), adding an extra layer of privacy and security to your self-hosted library. ## Files to check diff --git a/services/kavita/compose.yaml b/services/kavita/compose.yaml index 5bf9a005..2099f684 100644 --- a/services/kavita/compose.yaml +++ b/services/kavita/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TZ=${TZ} @@ -62,10 +62,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against /api/health), so this file does not override it. restart: always diff --git a/services/kitchenowl/.env b/services/kitchenowl/.env index 43895e9f..7473b23d 100755 --- a/services/kitchenowl/.env +++ b/services/kitchenowl/.env @@ -11,19 +11,21 @@ SERVICEPORT=8080 DNS_SERVER=9.9.9.9 # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" -JWT_SECRET_KEY= # Generate a random string for JWT secret key, e.g., using: openssl rand -base64 32 +# Generate a random string for JWT secret key, e.g., using: openssl rand -base64 32 +JWT_SECRET_KEY= FRONT_URL=https://kitchenowl..ts.net # the exact URL of your kitchenowl instance, required when using OIDC authentication, e.g https://kitchenowl.example.com #OIDC_ISSUER= # your OIDC issuer, e.g https://accounts.google.com #OIDC_CLIENT_ID= # to be generated by your OIDC provider -#OIDC_CLIENT_SECRET= # to be generated by your OIDC provider \ No newline at end of file +#OIDC_CLIENT_SECRET= # to be generated by your OIDC provider diff --git a/services/kitchenowl/README.md b/services/kitchenowl/README.md index ac5f3d72..84869ad6 100644 --- a/services/kitchenowl/README.md +++ b/services/kitchenowl/README.md @@ -21,7 +21,7 @@ Kitchenowl is useful for families, housemates, and home labs that want a private ## Tailscale Integration -This setup uses a **Tailscale sidecar container** to provide secure private networking for Kitchenowl. The Kitchenowl container shares the Tailscale container's network stack using Docker's `network_mode: service:` pattern. +This setup uses a **Tailscale sidecar container** to provide secure private networking for Kitchenowl. The Kitchenowl container shares the Tailscale container's network stack using Docker's `network_mode: service:tailscale` pattern. Because of this, Kitchenowl does not need to publish ports directly to the host. Instead, you access the web interface through the Tailscale hostname or Tailnet IP assigned to the sidecar. This keeps the service private, reduces exposure, and avoids the need for public DNS, inbound firewall rules, or a public reverse proxy. diff --git a/services/kitchenowl/compose.yaml b/services/kitchenowl/compose.yaml index 48921bec..ee3e406c 100755 --- a/services/kitchenowl/compose.yaml +++ b/services/kitchenowl/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -34,11 +34,11 @@ services: - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work cap_add: - net_admin # Tailscale requirement - ports: - - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + #ports: + # - 0.0.0.0:${SERVICEPORT}:8080 # Binding the host port to KitchenOwl's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application kitchenowl: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management env_file: .env volumes: @@ -65,4 +65,5 @@ services: depends_on: tailscale: condition: service_healthy - restart: unless-stopped \ No newline at end of file + # Healthcheck: defined by the image (uwsgi_curl against /api/health), so this file does not override it. + restart: always diff --git a/services/languagetool/.env b/services/languagetool/.env index c3a3512b..ac27dda8 100644 --- a/services/languagetool/.env +++ b/services/languagetool/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/languagetool/README.md b/services/languagetool/README.md index 50bdec3a..7d5692a4 100644 --- a/services/languagetool/README.md +++ b/services/languagetool/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [LanguageTool](https://languagetool.or ## Configuration Overview -In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for LanguageTool. The `languagetool` service utilizes the Tailscale network stack via Docker's `network_mode: service:`. This setup ensures that LanguageTool's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your LanguageTool deployment. +In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for LanguageTool. The `languagetool` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale`. This setup ensures that LanguageTool's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your LanguageTool deployment. ## Using n-gram datasets diff --git a/services/languagetool/compose.yaml b/services/languagetool/compose.yaml index cb53fa10..d333d420 100644 --- a/services/languagetool/compose.yaml +++ b/services/languagetool/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - langtool_languageModel=/ngrams # OPTIONAL: Using ngrams data @@ -62,10 +62,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against /v2/check), so this file does not override it. restart: always diff --git a/services/linkding/.env b/services/linkding/.env index df5694e8..f0b1a3be 100644 --- a/services/linkding/.env +++ b/services/linkding/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/linkding/.linkding.env b/services/linkding/.linkding.env index 37fdbd5a..3d188246 100644 --- a/services/linkding/.linkding.env +++ b/services/linkding/.linkding.env @@ -46,4 +46,4 @@ LD_DB_HOST= # Should use the default port if not set LD_DB_PORT= # Any additional options to pass to the database (default: {}) -LD_DB_OPTIONS= \ No newline at end of file +LD_DB_OPTIONS= diff --git a/services/linkding/README.md b/services/linkding/README.md index f59647dc..27fbd4e9 100644 --- a/services/linkding/README.md +++ b/services/linkding/README.md @@ -15,4 +15,4 @@ This Docker Compose configuration sets up [Linkding](https://github.com/sissbrue ## Configuration Overview -In this setup, the `tailscale-linkding` service runs Tailscale, which manages secure networking for the Linkding service. The `linkding` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Linkding’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your bookmarks. +In this setup, the `tailscale-linkding` service runs Tailscale, which manages secure networking for the Linkding service. The `linkding` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Linkding’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your bookmarks. diff --git a/services/linkding/compose.yaml b/services/linkding/compose.yaml index 9ae1ee35..8386e879 100644 --- a/services/linkding/compose.yaml +++ b/services/linkding/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -63,10 +63,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "curl", "-sf", "http://127.0.0.1:9090/login/"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against /health), so this file does not override it. restart: always diff --git a/services/lube-logger/.env b/services/lube-logger/.env index 446b925c..4b48ea73 100644 --- a/services/lube-logger/.env +++ b/services/lube-logger/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -30,4 +30,4 @@ LUBELOGGER_DOMAIN="lubelogger..ts.net" #MailConfig__Password="" #LOGGING__LOGLEVEL__DEFAULT=Error -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/lube-logger/README.md b/services/lube-logger/README.md index 6a12b993..b9c9a84a 100644 --- a/services/lube-logger/README.md +++ b/services/lube-logger/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[LubeLogger](https://github.com/harg ## Configuration Overview -In this deployment, the `tailscale-lubelogger` service runs the Tailscale client to establish a secure private network. The `lubelogger` container uses `network_mode: service:tailscale-lubelogger` to tunnel its network traffic through the Tailscale network interface. This ensures that the web UI is accessible only through Tailscale, keeping your vehicle data safe from public exposure. +In this deployment, the `tailscale-lubelogger` service runs the Tailscale client to establish a secure private network. The `lubelogger` container uses `network_mode: service:tailscale` to tunnel its network traffic through the Tailscale network interface. This ensures that the web UI is accessible only through Tailscale, keeping your vehicle data safe from public exposure. diff --git a/services/lube-logger/compose.yaml b/services/lube-logger/compose.yaml index 6229ac88..691f182e 100644 --- a/services/lube-logger/compose.yaml +++ b/services/lube-logger/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management build: . env_file: @@ -61,10 +61,10 @@ services: depends_on: tailscale: condition: service_healthy - # healthcheck: - # test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - # interval: 1m # How often to perform the check - # timeout: 10s # Time to wait for the check to succeed - # retries: 3 # Number of retries before marking as unhealthy - # start_period: 30s # Time to wait before starting health checks + healthcheck: + test: ["CMD", "pgrep", "-x", "CarCareTracker"] # Check if the LubeLogger process is running; the image has no HTTP client + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always diff --git a/services/mailpit/.env b/services/mailpit/.env index 5a4e1031..5910b483 100644 --- a/services/mailpit/.env +++ b/services/mailpit/.env @@ -11,12 +11,13 @@ SERVICEPORT=8025 # Mailpit web port. It is not exposed locally; Tailscale Serve DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ @@ -26,4 +27,4 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim MAIL_DOMAIN_REGEX='@example\.com$' # Catch all recipients at example.com; change this to your escaped domain. MAILPIT_MAX_MESSAGES=0 # Maximum stored messages; 0 disables count-based pruning. MAILPIT_MAX_AGE=90d # Delete messages older than this age. Use hours (36h) or days (90d). -MAILPIT_MAX_MESSAGE_SIZE=50 # Maximum accepted message size in MB. \ No newline at end of file +MAILPIT_MAX_MESSAGE_SIZE=50 # Maximum accepted message size in MB. diff --git a/services/mailpit/compose.yaml b/services/mailpit/compose.yaml index 25659fae..4e8d732e 100644 --- a/services/mailpit/compose.yaml +++ b/services/mailpit/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used (for example tailscale/tailscale:latest) @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -48,10 +48,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application mailpit: image: ${IMAGE_URL} # Image to be used (for example axllent/mailpit:latest) - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: # Variables are declared in the .env file. - TZ=${TZ} @@ -65,10 +65,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "/mailpit", "readyz"] # Check Mailpit is ready to accept web and SMTP traffic - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks - restart: always \ No newline at end of file + # Healthcheck: defined by the image (/mailpit readyz), so this file does not override it. + restart: always diff --git a/services/mattermost/.env b/services/mattermost/.env index bd11ec92..ce744d1d 100644 --- a/services/mattermost/.env +++ b/services/mattermost/.env @@ -13,13 +13,13 @@ DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" se # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -## Example settings (any additional setting added here also needs to be introduced in the docker-compose.yml) +## Example settings (any additional setting added here also needs to be introduced in compose.yaml) # Domain of service DOMAIN=mattermost.example.com MM_SERVICESETTINGS_SITEURL=https://${DOMAIN} @@ -32,14 +32,14 @@ HTTP_PORT=80 CALLS_PORT=8443 # Mattermost settings -## Inside the container the uid and gid is 2000. The folder owner can be set with -## `sudo chown -R 2000:2000 ${PWD}/${SERVICE}-data/mattermost`. -MATTERMOST_CONFIG_PATH=${PWD}/${SERVICE}-data/config -MATTERMOST_DATA_PATH=${PWD}/${SERVICE}-data/data -MATTERMOST_LOGS_PATH=${PWD}/${SERVICE}-data/logs -MATTERMOST_PLUGINS_PATH=${PWD}/${SERVICE}-data/plugins -MATTERMOST_CLIENT_PLUGINS_PATH=${PWD}/${SERVICE}-data/client/plugins -MATTERMOST_BLEVE_INDEXES_PATH=${PWD}/${SERVICE}-data/bleve-indexes +## Inside the container the uid and gid is 2000. Set the owner of the Mattermost paths below (not the +## PostgreSQL path) to 2000:2000 before the first start. See the README for the commands. +MATTERMOST_CONFIG_PATH=./${SERVICE}-data/config +MATTERMOST_DATA_PATH=./${SERVICE}-data/data +MATTERMOST_LOGS_PATH=./${SERVICE}-data/logs +MATTERMOST_PLUGINS_PATH=./${SERVICE}-data/plugins +MATTERMOST_CLIENT_PLUGINS_PATH=./${SERVICE}-data/client/plugins +MATTERMOST_BLEVE_INDEXES_PATH=./${SERVICE}-data/bleve-indexes ## Bleve index (inside the container) MM_BLEVESETTINGS_INDEXDIR=/mattermost/bleve-indexes @@ -52,8 +52,9 @@ MATTERMOST_CONTAINER_READONLY=false # Postgres Settings ## A guide on how to change the database user to a nonsuperuser can be found in docs/creation-of-nonsuperuser.md -POSTGRES_IMAGE_TAG=13-alpine -POSTGRES_DATA_PATH=${PWD}/${SERVICE}-data/postgres/data +## Use the major version your database was created with. Versions 18 and later need a different mount (see compose.yaml). +POSTGRES_IMAGE_TAG=17-alpine +POSTGRES_DATA_PATH=./${SERVICE}-data/postgres/data POSTGRES_USER=MMus3r ##Please Change POSTGRES_PASSWORD=MMus3r_P4ssword ##Please Change @@ -61,4 +62,4 @@ POSTGRES_DB=mattermost MM_SQLSETTINGS_DRIVERNAME=postgres MM_SQLSETTINGS_DATASOURCE=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db-${SERVICE}:5432/${POSTGRES_DB}?sslmode=disable&connect_timeout=10 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/mattermost/README.md b/services/mattermost/README.md index 1c6b14d3..444c745d 100644 --- a/services/mattermost/README.md +++ b/services/mattermost/README.md @@ -1,6 +1,6 @@ # Mattermost with Tailscale Sidecar Configuration -This Docker Compose configuration sets up [Mattermost](https://mattermost.com/platform-overview/) with Tailscale as a sidecar container to securely manage and access your clipboard history over a private Tailscale network. By integrating Tailscale, you can ensure that your Mattermost instance remains private and accessible only to authorized devices on your Tailscale network. +This Docker Compose configuration sets up [Mattermost](https://mattermost.com/platform-overview/) with Tailscale as a sidecar container to securely manage team communication over a private Tailscale network. By integrating Tailscale, you can ensure that your Mattermost instance remains private and accessible only to authorized devices on your Tailscale network. ## Mattermost @@ -17,20 +17,24 @@ This Docker Compose configuration sets up [Mattermost](https://mattermost.com/pl ## Configuration Overview -In this setup, the `tailscale-Mattermost` service runs Tailscale, which manages secure networking for the Mattermost service. The `Mattermost` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Mattermost’s web interface and functionality are only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your clipboard history. +In this setup, the `tailscale-Mattermost` container runs Tailscale, which manages secure networking for the Mattermost service. The `Mattermost` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Mattermost’s web interface and functionality are only accessible through the Tailscale network unless you enable host port mappings. + +The stack stores Mattermost and PostgreSQL data under the local `${SERVICE}-data` directory, which is `mattermost-data` by default. The path variables in `.env` are relative to this service directory, so the stack does not depend on the shell's current PWD variable. ## Troubleshooting -After initial start-up you may experience an error. +The Mattermost image runs as UID/GID `2000`. Docker creates missing bind-mount directories as `root:root`, and Mattermost then fails with: ```plain app-mattermost | Error: failed to load configuration: could not create config file: open /mattermost/config/config.json: permission denied ``` -Please adjust the permissions of the newly created folder `mattermost-data/` with the following command and restart the service. +Create the Mattermost directories and set their owner before the first start. Run the commands from this service directory. If you changed `SERVICE` in `.env`, set `DATA_DIR` to `-data`. Do not change the owner of the `postgres` directory, which PostgreSQL manages itself. ```bash -chown -R 2000:2000 mattermost-data/ +DATA_DIR=mattermost-data +mkdir -p "$DATA_DIR"/{config,data,logs,plugins,client/plugins,bleve-indexes} +sudo chown -R 2000:2000 "$DATA_DIR"/{config,data,logs,plugins,client,bleve-indexes} ``` Reference - [Starting/Stopping Docker](https://github.com/mattermost/mattermost-docker/commit/37331ba3d7122aeb30272308dddf51ef70e2134c#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L146) diff --git a/services/mattermost/compose.yaml b/services/mattermost/compose.yaml index 8f570f9c..3c8545ab 100644 --- a/services/mattermost/compose.yaml +++ b/services/mattermost/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,13 +35,13 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - ${HTTP_PORT}:${HTTP_PORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required - # - ${HTTPS_PORT}:${HTTPS_PORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - ${HTTP_PORT}:${HTTP_PORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required + # - ${HTTPS_PORT}:${HTTPS_PORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # - ${CALLS_PORT}:${CALLS_PORT}/udp # - ${CALLS_PORT}:${CALLS_PORT}/tcp # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -53,7 +53,7 @@ services: application: image: ${IMAGE_URL} # Image to be used container_name: app-${SERVICE} # Name for local container management - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale volumes: - ${MATTERMOST_CONFIG_PATH}:/mattermost/config:rw ## ./${SERVICE}-data/mattermost/ - ${MATTERMOST_DATA_PATH}:/mattermost/data:rw @@ -62,7 +62,7 @@ services: - ${MATTERMOST_CLIENT_PLUGINS_PATH}:/mattermost/client/plugins:rw - ${MATTERMOST_BLEVE_INDEXES_PATH}:/mattermost/bleve-indexes:rw # When you want to use SSO with GitLab, you have to add the cert pki chain of GitLab inside Alpine - # to avoid Token request failed: certificate signed by unknown authority + # to avoid Token request failed: certificate signed by unknown authority # (link: https://github.com/mattermost/mattermost-server/issues/13059 and https://github.com/mattermost/docker/issues/34) # - ${GITLAB_PKI_CHAIN_PATH}:/etc/ssl/certs/pki_chain.pem:ro security_opt: @@ -79,14 +79,23 @@ services: - MM_BLEVESETTINGS_INDEXDIR # additional settings - MM_SERVICESETTINGS_SITEURL + # Healthcheck: defined by the image (mmctl system status --local), so this file does not override it. restart: always depends_on: - - database - - tailscale + tailscale: + condition: service_healthy + database: + condition: service_healthy database: - image: postgres:latest + image: postgres:${POSTGRES_IMAGE_TAG} # PostgreSQL 18 images use a different data directory layout; keep a 17 or older tag for this mount container_name: db-${SERVICE} + healthcheck: + test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U $$POSTGRES_USER -d $$POSTGRES_DB"] # Check if PostgreSQL accepts connections + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always security_opt: - no-new-privileges:true diff --git a/services/mealie/.env b/services/mealie/.env index 1b98930f..c2cfb530 100644 --- a/services/mealie/.env +++ b/services/mealie/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/mealie/README.md b/services/mealie/README.md index 73baf451..2acd1851 100644 --- a/services/mealie/README.md +++ b/services/mealie/README.md @@ -18,4 +18,4 @@ This Docker Compose configuration sets up [**Mealie**](https://github.com/mealie ## Configuration Overview -In this deployment, the `tailscale-mealie` service runs the Tailscale client to establish a secure private network. The `mealie` container uses `network_mode: service:tailscale-mealie` to route its network traffic through the Tailscale network interface. This configuration ensures that the web UI is only accessible over Tailscale, protecting your recipes and personal data from public exposure. +In this deployment, the `tailscale-mealie` service runs the Tailscale client to establish a secure private network. The `mealie` container uses `network_mode: service:tailscale` to route its network traffic through the Tailscale network interface. This configuration ensures that the web UI is only accessible over Tailscale, protecting your recipes and personal data from public exposure. diff --git a/services/mealie/compose.yaml b/services/mealie/compose.yaml index 4e08e6c0..4f6cc9c3 100644 --- a/services/mealie/compose.yaml +++ b/services/mealie/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management deploy: resources: @@ -61,17 +61,12 @@ services: ALLOW_SIGNUP: "false" PUID: 1000 PGID: 1000 - TZ: Europe/Amsterdam + TZ: ${TZ} BASE_URL: https://mealie.yourdomain.ts.net # Alter to your domain volumes: - ./${SERVICE}-data:/app/data/ depends_on: tailscale: condition: service_healthy - # healthcheck: - # test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - # interval: 1m # How often to perform the check - # timeout: 10s # Time to wait for the check to succeed - # retries: 3 # Number of retries before marking as unhealthy - # start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image ($MEALIE_HOME/healthcheck.sh), so this file does not override it. restart: always diff --git a/services/memos/.env b/services/memos/.env index 1f1ff897..b4ba42c8 100644 --- a/services/memos/.env +++ b/services/memos/.env @@ -11,12 +11,13 @@ SERVICEPORT=5230 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/memos/README.md b/services/memos/README.md index ac884843..3bb1bf6a 100644 --- a/services/memos/README.md +++ b/services/memos/README.md @@ -10,7 +10,7 @@ By pairing Memos with Tailscale, you ensure that your notes remain private and a ## Configuration Overview -In this setup, the `tailscale-memos` service runs Tailscale and manages secure networking. The `memos` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale-memos` configuration. This ensures that Memos is only accessible through your Tailnet unless you explicitly expose ports. +In this setup, the `tailscale-memos` service runs Tailscale and manages secure networking. The `memos` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Memos is only accessible through your Tailnet unless you explicitly expose ports. ## Files to check diff --git a/services/memos/compose.yaml b/services/memos/compose.yaml index e6111e83..d0d60756 100644 --- a/services/memos/compose.yaml +++ b/services/memos/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,22 +47,23 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: MEMOS_PORT: 5230 MEMOS_DRIVER: sqlite MEMOS_INSTANCE_URL: https://memos..ts.net # Update with your Tailscale domain + TZ: ${TZ} volumes: - ./${SERVICE}-data:/var/opt/memos depends_on: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:5230"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:5230"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/metube/.env b/services/metube/.env index 31f7e7ec..dc1b7b2e 100644 --- a/services/metube/.env +++ b/services/metube/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/metube/README.md b/services/metube/README.md index 2bde43ee..f7c0cdee 100644 --- a/services/metube/README.md +++ b/services/metube/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Metube](https://github.com/alexta69/m ## Configuration Overview -In this setup, the `tailscale-metube` service runs Tailscale, which manages secure networking for the metube application. The `metube` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that metube’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security. +In this setup, the `tailscale-metube` service runs Tailscale, which manages secure networking for the metube application. The `metube` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that metube’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security. diff --git a/services/metube/compose.yaml b/services/metube/compose.yaml index fd3f1c58..e072c09b 100644 --- a/services/metube/compose.yaml +++ b/services/metube/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,8 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - - TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + - TS_ACCEPT_DNS=true # MagicDNS is enabled for this service. Remove this line to use Docker DNS only. + - TS_AUTH_ONCE=true configs: - source: ts-serve target: /config/serve.json @@ -34,7 +35,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -46,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -60,10 +61,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against the web UI), so this file does not override it. restart: always diff --git a/services/minecraft/.env b/services/minecraft/.env index 86a8031c..4ebd668d 100644 --- a/services/minecraft/.env +++ b/services/minecraft/.env @@ -11,12 +11,13 @@ SERVICEPORT=25565 # Port to expose to local network. Uncomment the "ports:" sect DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ diff --git a/services/minecraft/README.md b/services/minecraft/README.md index 9dbdada7..527b2007 100644 --- a/services/minecraft/README.md +++ b/services/minecraft/README.md @@ -26,7 +26,7 @@ No `serve.json` configuration is needed for this service. ## Configuration Overview -In this setup, the `tailscale-minecraft` service runs the Tailscale client to join your private mesh network. The `minecraft` service is configured with `network_mode: service:tailscale-minecraft`, so all network traffic for the game server is routed through the Tailscale container. The Minecraft server binds TCP port 25565, which is reachable only from devices on your Tailnet. +In this setup, the `tailscale-minecraft` service runs the Tailscale client to join your private mesh network. The `minecraft` service is configured with `network_mode: service:tailscale`, so all network traffic for the game server is routed through the Tailscale container. The Minecraft server binds TCP port 25565, which is reachable only from devices on your Tailnet. ## Setup diff --git a/services/minecraft/compose.yaml b/services/minecraft/compose.yaml index 9985e540..81ebff38 100644 --- a/services/minecraft/compose.yaml +++ b/services/minecraft/compose.yaml @@ -1,15 +1,6 @@ -configs: - ts-serve: - content: | - {"TCP":{"443":{"HTTPS":true}}, - "Web":{"$${TS_CERT_DOMAIN}:443": - {"Handlers":{"/": - {"Proxy":"http://127.0.0.1:25565"}}}}, - "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} - services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -18,15 +9,11 @@ services: environment: - TS_AUTHKEY=${TS_AUTHKEY} - TS_STATE_DIR=/var/lib/tailscale - - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true - configs: - - source: ts-serve - target: /config/serve.json volumes: - ./config:/config # Config folder used to store Tailscale files - you may need to change the path - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path @@ -35,7 +22,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICEPORT} to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -47,10 +34,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - EULA=TRUE # Required — accepted by the user @@ -67,4 +54,5 @@ services: depends_on: tailscale: condition: service_healthy + # Healthcheck: defined by the image (mc-health), so this file does not override it. restart: always diff --git a/services/miniflux/.env b/services/miniflux/.env index 4047e0eb..68f9808e 100644 --- a/services/miniflux/.env +++ b/services/miniflux/.env @@ -13,9 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TAILNET_NAME= # Include the ".ts.net" if it is part of your Tailnet name +# Include the ".ts.net" if it is part of your Tailnet name +TAILNET_NAME= # Miniflux Configuration # You must set these @@ -26,4 +27,4 @@ POSTGRES_USER=miniflux POSTGRES_PASSWORD= POSTGRES_DB=miniflux -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/miniflux/README.md b/services/miniflux/README.md index 7cc1e906..7dbfc6e8 100644 --- a/services/miniflux/README.md +++ b/services/miniflux/README.md @@ -17,7 +17,7 @@ This Docker Compose configuration sets up [Miniflux](https://github.com/miniflux ## Configuration Overview -In this deployment, the `tailscale-miniflux` service runs the Tailscale client to establish a secure private network. The `miniflux` application and its `postgres` database both use `network_mode: service:tailscale-miniflux`. This means all services share the same network namespace, allowing them to communicate via `localhost` and keeping the application reachable only via the Tailscale network. +In this deployment, the `tailscale-miniflux` service runs the Tailscale client to establish a secure private network. The `miniflux` application and its `postgres` database both use `network_mode: service:tailscale`. This means all services share the same network namespace, allowing them to communicate via `localhost` and keeping the application reachable only via the Tailscale network. ## Files to check diff --git a/services/miniflux/compose.yaml b/services/miniflux/compose.yaml index ba4418d9..cddef7a8 100644 --- a/services/miniflux/compose.yaml +++ b/services/miniflux/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@localhost/${POSTGRES_DB}?sslmode=disable @@ -59,13 +59,14 @@ services: - ADMIN_USERNAME=${ADMIN_USERNAME} - ADMIN_PASSWORD=${ADMIN_PASSWORD} - BASE_URL=https://${SERVICE}.${TAILNET_NAME} # Change to your tailnet name + - TZ=${TZ} depends_on: tailscale: condition: service_healthy db: condition: service_healthy healthcheck: - test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"] + test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy @@ -84,8 +85,9 @@ services: volumes: - ./${SERVICE}-data/db:/var/lib/postgresql/data healthcheck: - test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"] + test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U ${POSTGRES_USER} -d ${POSTGRES_DB}"] # Check if PostgreSQL accepts connections interval: 10s timeout: 5s retries: 5 + start_period: 30s restart: always diff --git a/services/miniqr/.env b/services/miniqr/.env index 7a2d28d6..70be8663 100644 --- a/services/miniqr/.env +++ b/services/miniqr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/miniqr/README.md b/services/miniqr/README.md index 2f655b8f..b5605aa6 100644 --- a/services/miniqr/README.md +++ b/services/miniqr/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Mini-QR](https://github.com/lyqht/m ## Configuration Overview -In this setup, the `tailscale-miniqr` service runs Tailscale, which handles secure networking for the Mini-QR service. The `mini-qr` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that the Mini-QR web interface is only accessible via your Tailscale network (or locally if preferred), giving you complete control over access and visibility. +In this setup, the `tailscale-miniqr` service runs Tailscale, which handles secure networking for the Mini-QR service. The `mini-qr` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that the Mini-QR web interface is only accessible via your Tailscale network (or locally if preferred), giving you complete control over access and visibility. diff --git a/services/miniqr/compose.yaml b/services/miniqr/compose.yaml index 9b44a047..b69cc779 100644 --- a/services/miniqr/compose.yaml +++ b/services/miniqr/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -60,7 +60,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "serve"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8080/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/nanote/.env b/services/nanote/.env index 92aa9eee..4bd55a6d 100644 --- a/services/nanote/.env +++ b/services/nanote/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/nanote/README.md b/services/nanote/README.md index ebd67b82..83500e38 100644 --- a/services/nanote/README.md +++ b/services/nanote/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Nanote](https://github.com/omarmir/ ## Configuration Overview -In this setup, the `tailscale-nanote` service runs Tailscale, which manages secure networking for the Nanote service. The `nanote` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Nanote’s web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your note-taking workflow. +In this setup, the `tailscale-nanote` service runs Tailscale, which manages secure networking for the Nanote service. The `nanote` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Nanote’s web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your note-taking workflow. diff --git a/services/nanote/compose.yaml b/services/nanote/compose.yaml index cf7c6486..768ff696 100644 --- a/services/nanote/compose.yaml +++ b/services/nanote/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -64,7 +64,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ['CMD', 'curl', '-f', 'http://localhost:3000/api/health'] + test: ['CMD', 'curl', '-f', 'http://localhost:3000/api/health'] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/navidrome/.env b/services/navidrome/.env index b0e74ea3..f87952f1 100644 --- a/services/navidrome/.env +++ b/services/navidrome/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/navidrome/README.md b/services/navidrome/README.md index ef112169..4ed224e2 100644 --- a/services/navidrome/README.md +++ b/services/navidrome/README.md @@ -17,4 +17,6 @@ Navidrome is a self-hosted music streaming server and web-based player. It allow ## Configuration Overview -In this setup, the `tailscale-navidrome` container runs the Tailscale client and forms a private mesh network. The `navidrome` container is configured with `network_mode: service:tailscale-navidrome`, which routes all of Navidrome’s traffic through Tailscale. This ensures that your music server is never exposed publicly, and can only be accessed from devices authenticated through your Tailscale Tailnet. +In this setup, the `tailscale-navidrome` container runs the Tailscale client and forms a private mesh network. The `navidrome` container is configured with `network_mode: service:tailscale`, which routes all of Navidrome’s traffic through Tailscale. This ensures that your music server is never exposed publicly, and can only be accessed from devices authenticated through your Tailscale Tailnet. + +Before starting the stack, replace `/path/to/your/music/folder` in `compose.yaml` with the absolute host directory that contains your music library. diff --git a/services/navidrome/compose.yaml b/services/navidrome/compose.yaml index a5328631..7e6d8837 100644 --- a/services/navidrome/compose.yaml +++ b/services/navidrome/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,27 +47,26 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: # Optional: put your config options customization here. Examples: # ND_LOGLEVEL: debug - PUID=1000 - PGID=1000 - - TZ=${TZ} volumes: - ./${SERVICE}-data/data:/data - /path/to/your/music/folder:/music:ro # Adjust to your liking depends_on: tailscale: condition: service_healthy - # healthcheck: - # test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - # interval: 1m # How often to perform the check - # timeout: 10s # Time to wait for the check to succeed - # retries: 3 # Number of retries before marking as unhealthy - # start_period: 30s # Time to wait before starting health checks + healthcheck: + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:4533/ping"] # Check if the service is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always diff --git a/services/nessus/.env b/services/nessus/.env index 454aba64..8b451dab 100644 --- a/services/nessus/.env +++ b/services/nessus/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/nessus/README.md b/services/nessus/README.md index 5a858959..91f309c5 100644 --- a/services/nessus/README.md +++ b/services/nessus/README.md @@ -22,6 +22,6 @@ Nessus Essentials offers a free version of the tool for personal and home use, [ ## Configuration Overview -In this setup, the `tailscale-nessus` service runs Tailscale, which manages secure networking for the Nessus service. The `nessus` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Nessus’ web interface and scanning functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an additional layer of security to your vulnerability management infrastructure. +In this setup, the `tailscale-nessus` service runs Tailscale, which manages secure networking for the Nessus service. The `nessus` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Nessus’ web interface and scanning functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an additional layer of security to your vulnerability management infrastructure. For additional configuration (environment variables) - please refer to the [Tenable documentation](https://docs.tenable.com/nessus/Content/DeployNessusDocker.htm). diff --git a/services/nessus/compose.yaml b/services/nessus/compose.yaml index 323af6e4..aa945e3e 100644 --- a/services/nessus/compose.yaml +++ b/services/nessus/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -62,7 +62,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "python3", "-c", "import ssl, urllib.request; urllib.request.urlopen('https://127.0.0.1:8834/server/status', context=ssl._create_unverified_context(), timeout=5)"] # Check if the service is responding; Nessus serves a self-signed certificate interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/netbox/.env b/services/netbox/.env index afb03ad4..5cbb1b52 100644 --- a/services/netbox/.env +++ b/services/netbox/.env @@ -11,21 +11,24 @@ SERVICEPORT=8080 DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= // your tailscale authentication key +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables -#Please change this password -SUPER_SECRET=t3Ph722qJ5QHeQ1qfu36 +# Required: base value for the PostgreSQL and Redis passwords below. Use letters and digits only. +# Generate with: openssl rand -hex 16 +# PostgreSQL applies DB_PASSWORD only when the database is first created. Existing installations must keep their current value. +SUPER_SECRET= #NETBOX Environment variables CORS_ORIGIN_ALLOW_ALL=True DB_HOST=${SERVICE}-postgres DB_NAME=netbox -DB_PASSWORD=${SUPER_SECRET}DB +DB_PASSWORD=${SUPER_SECRET:?Set SUPER_SECRET in .env}DB DB_USER=netbox DB_WAIT_DEBUG=1 EMAIL_FROM=netbox@bar.com @@ -45,25 +48,23 @@ METRICS_ENABLED=false REDIS_CACHE_DATABASE=1 REDIS_CACHE_HOST=${SERVICE}-rediscache REDIS_CACHE_INSECURE_SKIP_TLS_VERIFY=false -REDIS_CACHE_PASSWORD=${SUPER_SECRET}REDIS +REDIS_CACHE_PASSWORD=${SUPER_SECRET:?Set SUPER_SECRET in .env}REDIS REDIS_CACHE_SSL=false REDIS_DATABASE=0 REDIS_HOST=${SERVICE}-rediscache REDIS_INSECURE_SKIP_TLS_VERIFY=false -REDIS_PASSWORD=${SUPER_SECRET}REDIS +REDIS_PASSWORD=${SUPER_SECRET:?Set SUPER_SECRET in .env}REDIS REDIS_SSL=false RELEASE_CHECK_URL=https://api.github.com/repos/netbox-community/netbox/releases -SECRET_KEY=${SUPER_SECRET}_SECRET! +# Required: at least 50 characters. Generate with: openssl rand -base64 48 +SECRET_KEY= SKIP_SUPERUSER=true WEBHOOKS_ENABLED=true #POSTGRES Environment variables POSTGRES_DB=netbox -POSTGRES_PASSWORD=${SUPER_SECRET}DB +POSTGRES_PASSWORD=${SUPER_SECRET:?Set SUPER_SECRET in .env}DB POSTGRES_USER=netbox -#REDIS Environment variables -REDIS_PASSWORD=${SUPER_SECRET}REDIS - -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/netbox/README.md b/services/netbox/README.md index 8bf32893..c9652eaf 100644 --- a/services/netbox/README.md +++ b/services/netbox/README.md @@ -8,4 +8,15 @@ This Docker Compose configuration sets up [Netbox](https://github.com/netbox-com ## Configuration Overview -In this setup, the `tailscale-netbox` service runs Tailscale, which manages secure networking for the Netbox application. The `netbox` application uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that your Netbox application is only accessible through the Tailscale network (or local as well, if preferred). +In this setup, the `tailscale-netbox` service runs Tailscale, which manages secure networking for the Netbox application. The `netbox` application uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that your Netbox application is only accessible through the Tailscale network (or local as well, if preferred). + +## Files to check + +Please check the following contents for validity as some variables need to be defined upfront. + +- `.env` + - Required: `TS_AUTHKEY` + - Required: `SUPER_SECRET`, the base value for the PostgreSQL and Redis passwords. Use letters and digits only. Generate it with `openssl rand -hex 16`. + - Required: `SECRET_KEY`, at least 50 characters. Generate it with `openssl rand -base64 48`. + +Compose stops with an error if `SUPER_SECRET` or `SECRET_KEY` is empty. PostgreSQL applies the database password only when it first creates the database. If you are upgrading, set `SUPER_SECRET` to the value from your previous `.env`, including the old default if you never changed it. Otherwise NetBox cannot authenticate to the existing database. diff --git a/services/netbox/compose.yaml b/services/netbox/compose.yaml index 76f49e37..a91f5bc3 100644 --- a/services/netbox/compose.yaml +++ b/services/netbox/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -18,11 +18,12 @@ services: environment: - TS_AUTHKEY=${TS_AUTHKEY} - TS_STATE_DIR=/var/lib/tailscale - - TS_SERVE_CONFIG=/config/serve.json # Tailsacale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required + - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - - TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve + - TS_AUTH_ONCE=true configs: - source: ts-serve target: /config/serve.json @@ -34,8 +35,8 @@ services: cap_add: - net_admin # Tailscale requirement # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -43,12 +44,13 @@ services: retries: 3 # Number of retries before marking as unhealthy start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application netbox: &netbox image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: ${SERVICE} # Name for local container management environment: + - SECRET_KEY=${SECRET_KEY:?Set SECRET_KEY in .env} - TZ=${TZ} volumes: - ./config:/etc/netbox/config:z,ro @@ -56,19 +58,21 @@ services: - ./${SERVICE}/reports:/opt/netbox/netbox/reports - ./${SERVICE}/scripts:/opt/netbox/netbox/scripts depends_on: - postgres: - condition: service_healthy - redis: - condition: service_healthy - redis-cache: - condition: service_healthy + tailscale: + condition: service_healthy + postgres: + condition: service_healthy + redis: + condition: service_healthy + redis-cache: + condition: service_healthy healthcheck: - test: curl -f http://localhost:8080/login/ || exit 1 - start_period: 90s + test: curl -f http://localhost:8080/login/ || exit 1 # Check if the service is responding + start_period: 600s # The first start runs database migrations that can take several minutes, longer on slow hosts timeout: 3s interval: 15s restart: always - env_file: /.env + env_file: ./.env netbox-worker: <<: *netbox container_name: worker-${SERVICE} # Name for local container management @@ -88,15 +92,16 @@ services: postgres: image: docker.io/postgres:17-alpine container_name: ${SERVICE}-postgres - env_file: /.env + env_file: ./.env healthcheck: - test: pg_isready -q -t 2 -d $$POSTGRES_DB -U $$POSTGRES_USER + test: pg_isready -h 127.0.0.1 -q -t 2 -d $$POSTGRES_DB -U $$POSTGRES_USER # Check if PostgreSQL accepts connections start_period: 20s timeout: 30s interval: 10s retries: 5 volumes: - ./${SERVICE}/postgres/data:/var/lib/postgresql/data + restart: always # redis redis: @@ -115,6 +120,7 @@ services: retries: 5 volumes: - ./${SERVICE}/redis/data:/data + restart: always redis-cache: container_name: ${SERVICE}-rediscache image: docker.io/valkey/valkey:8.1-alpine @@ -126,3 +132,4 @@ services: healthcheck: *redis-healthcheck volumes: - ./${SERVICE}/redis/cache:/data + restart: always diff --git a/services/newwallpaperwhodis/.env b/services/newwallpaperwhodis/.env index c943f0c1..d2edda9c 100644 --- a/services/newwallpaperwhodis/.env +++ b/services/newwallpaperwhodis/.env @@ -11,7 +11,11 @@ SERVICEPORT=6767 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 + +# Time Zone setting for containers +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/newwallpaperwhodis/compose.yaml b/services/newwallpaperwhodis/compose.yaml index 543caa49..7b645f59 100644 --- a/services/newwallpaperwhodis/compose.yaml +++ b/services/newwallpaperwhodis/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: - # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Make sure you have updated/checked the .env file with the correct variables. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -37,7 +37,7 @@ services: #ports: # - "0.0.0.0:${SERVICEPORT:-6767}:3000" # Binding port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: [ "CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz" ] # Check Tailscale has a Tailnet IP and is operational @@ -54,6 +54,7 @@ services: container_name: app-${SERVICE} environment: - NODE_ENV=production + - TZ=${TZ} volumes: # Map the data folder where the SQLite DB or structured metadata will live - ./data:/app/data @@ -63,7 +64,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:3000/favicon.svg"] + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:3000/favicon.svg"] # Check if the service is responding interval: 1m timeout: 10s retries: 3 diff --git a/services/next-explorer/.env b/services/next-explorer/.env index 691d23ef..2e4ee85c 100644 --- a/services/next-explorer/.env +++ b/services/next-explorer/.env @@ -11,20 +11,20 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables PUID=1000 PGID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ ACCESS_PATH=/home/root/data # Change this to the path you want to share with Tailscale. This should be an absolute path on the host machine. For example, if you want to share the /home/user/files directory, set ACCESS_PATH=/home/user/files. -TAILNET_NAME=your-tailnet-name # Change this to your Tailnet name, which is the domain you use for Tailscale. For example, if your Tailnet is "example.com", set TAILNET_NAME=example.com. SESSION_SECRET=your-super-secret # Use 'openssl rand -base64 32' in your CLI to generate a secure random key. PUBLIC_URL=https://file-explorer..ts.net # Optional: Set this to the public URL of your service if needed for correct URL generation in the app. For example, if you are exposing the service at https://example.com, set PUBLIC_URL=https://example.com. -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/next-explorer/README.md b/services/next-explorer/README.md index 7107efde..2cf4ce39 100644 --- a/services/next-explorer/README.md +++ b/services/next-explorer/README.md @@ -8,4 +8,6 @@ This Docker Compose configuration sets up [NextExplorer](https://github.com/nxza ## Configuration Overview -In this setup, the `tailscale-files` service runs Tailscale, which manages secure networking for the NextExplorer service. The `files` service uses the Tailscale network stack via Docker’s `network_mode: service:` configuration. This setup ensures that NextExplorer management interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for managing your file systems. +In this setup, the `tailscale` service runs Tailscale, which manages secure networking for NextExplorer. The `application` service uses Docker's `network_mode: service:tailscale` configuration. This keeps the management interface on your Tailnet unless you enable the optional host port mapping. + +Set `ACCESS_PATH` in `.env` to an absolute host directory before starting the stack. NextExplorer mounts that directory at `/mnt/Files`. Replace the sample `SESSION_SECRET` and `PUBLIC_URL` values with deployment-specific values when those settings are used. diff --git a/services/next-explorer/compose.yaml b/services/next-explorer/compose.yaml index c4b2c5a8..17c4ca08 100644 --- a/services/next-explorer/compose.yaml +++ b/services/next-explorer/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,27 +47,27 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} - restart: unless-stopped - #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required - # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: - # - ${DNS_SERVER} + depends_on: + tailscale: + condition: service_healthy + # Healthcheck: defined by the image (node healthcheck.js), so this file does not override it. + restart: always environment: - NODE_ENV=production - PUBLIC_URL=${PUBLIC_URL} # Optional: Set this to the public URL of your service if needed for correct URL generation in the app. For example, if you are exposing the service at https://example.com, set PUBLIC_URL=https://example.com. - + # Optional: lock sessions to a known secret - SESSION_SECRET=${SESSION_SECRET} - + # Optional host UID/GID mapping - PUID=${PUID} # Change according to your customization if needed - PGID=${PGID} # Change according to your customization if needed + - TZ=${TZ} volumes: - ./config:/config - ./cache:/cache diff --git a/services/nodered/.env b/services/nodered/.env index 03dcab80..d7740427 100644 --- a/services/nodered/.env +++ b/services/nodered/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/nodered/README.md b/services/nodered/README.md index 7f0b9abd..7c01ac56 100644 --- a/services/nodered/README.md +++ b/services/nodered/README.md @@ -8,4 +8,13 @@ This Docker Compose configuration sets up [Node-RED](https://github.com/node-red ## Configuration Overview -In this setup, the `tailscale-node-red` service runs Tailscale, which manages secure networking for the Node-RED service. The `node-red` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Node-RED’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your flow-based programming environment. +In this setup, the `tailscale-node-red` service runs Tailscale, which manages secure networking for the Node-RED service. The `node-red` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Node-RED’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your flow-based programming environment. + +## Volume Permissions + +The Node-RED image runs as UID/GID `1000`. Docker creates missing bind-mount directories as `root:root`, and Node-RED then exits with `EACCES` when it copies `settings.js` into `/data`. Create the data directory before the first start: + +```sh +mkdir -p nodered-data/app/config +sudo chown -R 1000:1000 nodered-data +``` diff --git a/services/nodered/compose.yaml b/services/nodered/compose.yaml index 2c692395..bd8bc04c 100644 --- a/services/nodered/compose.yaml +++ b/services/nodered/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -61,10 +61,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (node /healthcheck.js), so this file does not override it. restart: always diff --git a/services/ntfy/.env b/services/ntfy/.env index 79ae02b7..e6d9a1f3 100644 --- a/services/ntfy/.env +++ b/services/ntfy/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/ntfy/README.md b/services/ntfy/README.md index 2cc548dd..6e3284f7 100644 --- a/services/ntfy/README.md +++ b/services/ntfy/README.md @@ -8,6 +8,6 @@ This Docker Compose configuration sets up [ntfy](https://ntfy.sh/) with Tailscal ## Configuration Overview -In this setup, the `tailscale-ntfy` service runs the Tailscale daemon to provide secure, private networking. The `ntfy` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:` syntax. This binds ntfy’s network interface to the Tailscale container, making the HTTP API available only through your Tailscale network (or locally, if needed). +In this setup, the `tailscale-ntfy` service runs the Tailscale daemon to provide secure, private networking. The `ntfy` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:tailscale` syntax. This binds ntfy’s network interface to the Tailscale container, making the HTTP API available only through your Tailscale network (or locally, if needed). This architecture is ideal for self-hosters who want to send and receive notifications from anywhere without exposing the ntfy broker to the internet, maintaining both ease of access and strict privacy controls. diff --git a/services/ntfy/compose.yaml b/services/ntfy/compose.yaml index 6291e5d9..b736eae2 100644 --- a/services/ntfy/compose.yaml +++ b/services/ntfy/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: - # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Make sure you have updated/checked the .env file with the correct variables. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement # ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -46,7 +46,7 @@ services: retries: 3 # Number of retries before marking as unhealthy start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: command: - serve @@ -54,7 +54,7 @@ services: - ./${SERVICE}-data/cache:/var/cache/ntfy - ./${SERVICE}-data/etc:/etc/ntfy image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TZ=${TZ} @@ -63,7 +63,7 @@ services: tailscale: condition: service_healthy healthcheck: # optional: remember to adapt the host:port to your environment - test: ["CMD-SHELL", "wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo '\"healthy\"\\s*:\\s*true' || exit 1"] + test: ["CMD-SHELL", "wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo '\"healthy\"\\s*:\\s*true' || exit 1"] # Check if the service is responding interval: 60s timeout: 10s retries: 3 diff --git a/services/ollama/.env b/services/ollama/.env index 6edc7260..13391479 100644 --- a/services/ollama/.env +++ b/services/ollama/.env @@ -11,13 +11,14 @@ SERVICEPORT=11434 # Ollama's default API port. Uncomment the "ports:" section in DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ # Ollama-specific variables # OLLAMA_API_KEY= # Optional: set a secret key to restrict API access (leave blank to disable auth) -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/ollama/README.md b/services/ollama/README.md index b363fc5b..483acc67 100644 --- a/services/ollama/README.md +++ b/services/ollama/README.md @@ -42,9 +42,10 @@ If you don't use a shared proxy network, remove the `networks:` sections from `c Tailscale Serve is pre-configured to proxy HTTPS on port 443 to Ollama's internal port 11434. To enable it: -1. Uncomment `TS_ACCEPT_DNS=true` in the `tailscale` service environment. -2. Ensure your Tailnet has MagicDNS and HTTPS certificates enabled in the [Tailscale admin console](https://login.tailscale.com/admin/dns). -3. The `serve.json` config in `compose.yaml` uses `$TS_CERT_DOMAIN` automatically — no manual editing needed. +1. Ensure your Tailnet has MagicDNS and HTTPS certificates enabled in the [Tailscale admin console](https://login.tailscale.com/admin/dns). +2. The `serve.json` config in `compose.yaml` uses `$TS_CERT_DOMAIN` automatically — no manual editing needed. + +Serve does not need `TS_ACCEPT_DNS=true`. Uncomment it only if the Ollama container itself must resolve MagicDNS names. You can then reach Ollama at `https://ollama..ts.net`. diff --git a/services/ollama/compose.yaml b/services/ollama/compose.yaml index 1650e48a..c2b7a6d3 100644 --- a/services/ollama/compose.yaml +++ b/services/ollama/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: @@ -24,7 +24,7 @@ services: - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - TS_AUTH_ONCE=true - # - TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + # - TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve configs: - source: ts-serve target: /config/serve.json @@ -35,9 +35,8 @@ services: - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work cap_add: - net_admin # Tailscale requirement - - sys_module # Required to load kernel modules for Tailscale #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -68,7 +67,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: [ "CMD", "pgrep", "-f", "${SERVICE}" ] # Check if Ollama process is running + test: ["CMD", "ollama", "list"] # Check if the Ollama API responds; the image has no wget or curl interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/open-webui/.env b/services/open-webui/.env index a603f9bd..0129cef7 100644 --- a/services/open-webui/.env +++ b/services/open-webui/.env @@ -11,7 +11,8 @@ SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Open WebUI Configuration # Point to your Ollama instance - can be local or remote. @@ -21,7 +22,8 @@ TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://t # Ollama over Tailnet: http://100.x.x.x:11434 # Leave blank to configure a different provider (e.g. OpenAI) via the UI. OLLAMA_BASE_URL=http://host.docker.internal:11434 -WEBUI_SECRET_KEY= # Random secret key for session security. Generate with: openssl rand -hex 32 -TZ=Europe/Amsterdam # Timezone for the container. +# Random secret key for session security. Generate with: openssl rand -hex 32 +WEBUI_SECRET_KEY= +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/open-webui/README.md b/services/open-webui/README.md index 3ee50cdf..e62f56d4 100644 --- a/services/open-webui/README.md +++ b/services/open-webui/README.md @@ -8,13 +8,13 @@ This Docker Compose configuration sets up [Open WebUI](https://openwebui.com/) w ## Configuration Overview -In this setup, the `tailscale-open-webui` service runs Tailscale, which manages secure networking for Open WebUI. The `open-webui` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-open-webui` service runs Tailscale, which manages secure networking for Open WebUI. The `open-webui` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## What to document for users - **Prerequisites**: Docker and Docker Compose installed. No special group membership, GPU, or devices required for CPU-only inference. A Tailscale account with an auth key from . - **Volumes**: Pre-create `./open-webui-data` before deploying to avoid Docker creating a root-owned directory: `mkdir -p ./open-webui-data ./config ./ts/state` -- **MagicDNS/Serve**: Enable MagicDNS and HTTPS in your Tailscale admin console before deploying. The serve config proxies to port `8080` — this is hardcoded in the `configs` block and does not consume `.env` values. Uncomment `TS_ACCEPT_DNS=true` in `compose.yaml` if DNS resolution issues arise. +- **MagicDNS/Serve**: Enable MagicDNS and HTTPS in your Tailscale admin console before deploying. The serve config proxies to port `8080` — this is hardcoded in the `configs` block and does not consume `.env` values. Uncomment `TS_ACCEPT_DNS=true` in `compose.yaml` only if Open WebUI itself must resolve MagicDNS names, such as an Ollama instance addressed by its Tailnet name. - **Ollama**: Set `OLLAMA_BASE_URL` in `.env` to point at your Ollama instance. Options: - Same Docker host: `http://host.docker.internal:11434` - LAN machine: `http://:11434` (use the private IP of the machine running Ollama) diff --git a/services/open-webui/compose.yaml b/services/open-webui/compose.yaml index 9bfd0c11..e4e32fb1 100644 --- a/services/open-webui/compose.yaml +++ b/services/open-webui/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,7 +35,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICEPORT} to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -61,10 +61,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "open-webui"] # Check if open-webui process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against /health), so this file does not override it. restart: always diff --git a/services/paperless/.env b/services/paperless/.env index 3b314f0b..1916ab28 100644 --- a/services/paperless/.env +++ b/services/paperless/.env @@ -11,15 +11,16 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -PAPERLESS_TIME_ZONE=Europe/London +PAPERLESS_TIME_ZONE=Europe/Amsterdam PAPERLESS_OCR_LANGUAGE=eng PAPERLESS_SECRET_KEY='change this to any random sting' #https://docs.paperless-ngx.com/configuration/#PAPERLESS_SECRET_KEY PAPERLESS_ADMIN_USER=admin @@ -27,4 +28,4 @@ PAPERLESS_ADMIN_PASSWORD=changeme POSTGRES_USER=paperless POSTGRES_PASSWORD=paperless -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/paperless/README.md b/services/paperless/README.md index 1cadb1cf..adc2d7b5 100644 --- a/services/paperless/README.md +++ b/services/paperless/README.md @@ -8,6 +8,6 @@ This Docker Compose configuration sets up [Paperless-ngx](https://docs.paperless ## Configuration Overview -In this setup, the `tailscale-paperless` service runs the Tailscale daemon to provide secure, private networking. The `paperless` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:` syntax. This binds Paperless network interface to the Tailscale container, making the service available only through your Tailscale network (or locally, if needed). +In this setup, the `tailscale-paperless` service runs the Tailscale daemon to provide secure, private networking. The `paperless` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:tailscale` syntax. This binds Paperless network interface to the Tailscale container, making the service available only through your Tailscale network (or locally, if needed). This architecture is ideal for self-hosters who want to send and receive notifications from anywhere without exposing Paperless-ngx to the internet, maintaining both ease of access and strict privacy controls. diff --git a/services/paperless/compose.yml b/services/paperless/compose.yaml similarity index 71% rename from services/paperless/compose.yml rename to services/paperless/compose.yaml index 9b5b125b..420feeb5 100644 --- a/services/paperless/compose.yml +++ b/services/paperless/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -55,11 +55,11 @@ services: tailscale: condition: service_healthy db: - condition: service_started + condition: service_healthy broker: - condition: service_started + condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-L", "-o", "/dev/null", "http://localhost:80/"] # Check if the service is responding; overrides the image check, which targets port 8000 while this stack sets PAPERLESS_PORT=80. Uses localhost, the only host Paperless always accepts when PAPERLESS_ALLOWED_HOSTS is set interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy @@ -73,7 +73,7 @@ services: environment: - PUID=1000 - PGID=1000 - - TZ=Europe/Amsterdam + - TZ=${TZ} - PAPERLESS_TIME_ZONE=${PAPERLESS_TIME_ZONE} - PAPERLESS_OCR_LANGUAGE=${PAPERLESS_OCR_LANGUAGE} - PAPERLESS_SECRET_KEY=${PAPERLESS_SECRET_KEY} @@ -86,23 +86,35 @@ services: db: image: docker.io/library/postgres:18 container_name: app-${SERVICE}-db # Name for local container management + healthcheck: + test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U $$POSTGRES_USER -d paperless"] # Check if PostgreSQL accepts connections + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always volumes: - ./${SERVICE}-data/pgdata:/var/lib/postgresql environment: - PUID=1000 - PGID=1000 - - TZ=Europe/Amsterdam + - TZ=${TZ} - POSTGRES_DB=paperless - POSTGRES_USER=${POSTGRES_USER} - POSTGRES_PASSWORD=${POSTGRES_PASSWORD} broker: image: docker.io/library/redis:8 container_name: app-${SERVICE}-broker # Name for local container management + healthcheck: + test: ["CMD", "redis-cli", "ping"] # Check if Redis responds + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always volumes: - ./${SERVICE}-data/redisdata:/data environment: - PUID=1000 - PGID=1000 - - TZ=Europe/Amsterdam + - TZ=${TZ} diff --git a/services/picard/.env b/services/picard/.env index a46ce7ef..cd5d32a5 100644 --- a/services/picard/.env +++ b/services/picard/.env @@ -11,12 +11,13 @@ SERVICEPORT=5800 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/picard/README.md b/services/picard/README.md index ade3554b..01c99d95 100644 --- a/services/picard/README.md +++ b/services/picard/README.md @@ -34,7 +34,7 @@ With this setup, your tagging process is secured and contained — perfect for p In this deployment, a **Tailscale sidecar container** (for example `tailscale-picard`) connects your Picard instance to your private Tailnet. The main `picard` container uses: ```plain -network_mode: service:tailscale-picard +network_mode: service:tailscale ``` This means all Picard traffic — web interface, plugin updates, and library calls — travels securely through Tailscale. diff --git a/services/picard/compose.yaml b/services/picard/compose.yaml index 50dc0634..aece9e69 100644 --- a/services/picard/compose.yaml +++ b/services/picard/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,15 +47,15 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - USER_ID=1000 - GROUP_ID=1000 - - TZ=Europe/Amsterdam # Change according to your timezone or set by mapping /etc/localtime between the host and the container. + - TZ=${TZ} volumes: - ./${SERVICE}-data/config:/config:rw - ./${SERVICE}-data/music:/storage:rw @@ -63,10 +63,10 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:5800/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy start_period: 30s # Time to wait before starting health checks restart: always - + diff --git a/services/pihole/.env b/services/pihole/.env index c711cedf..e4fd3c96 100644 --- a/services/pihole/.env +++ b/services/pihole/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/pihole/README.md b/services/pihole/README.md index 5ab4bd2d..d2292210 100644 --- a/services/pihole/README.md +++ b/services/pihole/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Pi-hole](https://github.com/pi-hole/p ## Configuration Overview -In this setup, the `tailscale-pihole` service runs Tailscale, which manages secure networking for the Pi-hole service. The `pihole` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Pi-hole’s DNS service and web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your network-wide ad blocker. +In this setup, the `tailscale-pihole` service runs Tailscale, which manages secure networking for the Pi-hole service. The `pihole` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Pi-hole’s DNS service and web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your network-wide ad blocker. ## Binding to your local host machine? Port 53 - DNSStubListener diff --git a/services/pihole/compose.yaml b/services/pihole/compose.yaml index ac51c7ea..3b3b9b92 100644 --- a/services/pihole/compose.yaml +++ b/services/pihole/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -63,10 +63,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "pihole-FTL"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (dig queries the local DNS server), so this file does not override it. restart: always diff --git a/services/pingvin-share/.env b/services/pingvin-share/.env index 898c8a00..c583bab7 100644 --- a/services/pingvin-share/.env +++ b/services/pingvin-share/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/pingvin-share/README.md b/services/pingvin-share/README.md index 382408b6..d9c2729f 100644 --- a/services/pingvin-share/README.md +++ b/services/pingvin-share/README.md @@ -10,4 +10,4 @@ This Docker Compose configuration sets up [Pingvin Share](https://github.com/sto ## Configuration Overview -In this setup, the `tailscale-pingvin` service runs Tailscale, which manages secure networking for the Pingvin Share service. The `pingvin-share` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Pingvin Share’s web interface and file-sharing capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted file-sharing needs. +In this setup, the `tailscale-pingvin` service runs Tailscale, which manages secure networking for the Pingvin Share service. The `pingvin-share` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Pingvin Share’s web interface and file-sharing capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted file-sharing needs. diff --git a/services/pingvin-share/compose.yaml b/services/pingvin-share/compose.yaml index 641432e7..4cf94451 100644 --- a/services/pingvin-share/compose.yaml +++ b/services/pingvin-share/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TRUST_PROXY=false # Set to true if a reverse proxy is in front of the container @@ -61,10 +61,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "caddy"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against /api/health), so this file does not override it. restart: always diff --git a/services/plex/.env b/services/plex/.env index c57df591..168cf607 100644 --- a/services/plex/.env +++ b/services/plex/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/plex/README.md b/services/plex/README.md index e9712a3c..efc54976 100644 --- a/services/plex/README.md +++ b/services/plex/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Plex Media Server](https://hub.docker ## Configuration Overview -In this setup, the `tailscale-plex` service runs Tailscale, which manages secure networking for the Plex Media Server. The `plex` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Plex's media streaming service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your media server. +In this setup, the `tailscale-plex` service runs Tailscale, which manages secure networking for the Plex Media Server. The `plex` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Plex's media streaming service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your media server. diff --git a/services/plex/compose.yaml b/services/plex/compose.yaml index 9fc40b2e..02507258 100644 --- a/services/plex/compose.yaml +++ b/services/plex/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -66,7 +66,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "Plex Media Server"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:32400/identity"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/pocket-id/.env b/services/pocket-id/.env index e890aeb2..19a8e103 100644 --- a/services/pocket-id/.env +++ b/services/pocket-id/.env @@ -13,13 +13,15 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # See the documentation for more information: https://pocket-id.org/docs/configuration/environment-variables -# Optional Service variables # These variables must be configured for your deployment: +# The URL where you access Pocket ID. Its hostname must be SERVICE followed by your Tailnet name. +# Tailscale Serve publishes the app on the machine name (SERVICE), not on APP_URL, so a different +# name here is never served. To use another name, change SERVICE to match - see the README first. APP_URL=https://pocket-id..ts.net # Encryption key (choose one method): @@ -36,4 +38,4 @@ MAXMIND_LICENSE_KEY= PUID=1000 PGID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/pocket-id/README.md b/services/pocket-id/README.md index 59df32a0..e892adff 100644 --- a/services/pocket-id/README.md +++ b/services/pocket-id/README.md @@ -1,19 +1,50 @@ # Pocket ID with Tailscale Sidecar Configuration -This Docker Compose configuration sets up [Pocket ID](https://github.com/stonith404/pocket-id) with Tailscale as a sidecar container to securely manage and access your decentralized identity service over a private Tailscale network. By integrating Tailscale, you can ensure that your Pocket ID instance remains private and accessible only to authorized devices within your Tailscale network. +This Docker Compose configuration sets up [Pocket ID](https://pocket-id.org/) with Tailscale as a sidecar container, enabling secure access to your self-hosted identity provider over a private Tailscale network. With this setup, your Pocket ID instance remains private and accessible only from devices on your Tailnet, over HTTPS. ## Pocket ID -[Pocket ID](https://github.com/stonith404/pocket-id) is an open-source, self-hosted decentralized identity (DID) solution that simplifies user authentication and identity management. It leverages the power of blockchain principles and modern cryptographic techniques to provide a secure, privacy-first approach to identity verification. With Pocket ID, you can authenticate users, manage permissions, and securely issue verifiable credentials, all while maintaining complete control over your identity system. +[Pocket ID](https://github.com/pocket-id/pocket-id) is a simple, self-hosted OpenID Connect (OIDC) provider that lets users sign in to your services with passkeys instead of passwords. It is a lightweight alternative to larger identity providers such as Keycloak, and gives the other services on your Tailnet a single sign-on. ## Key Features -- **Decentralized Identity**: Built on W3C’s DID standards, enabling privacy-first, self-sovereign identity management. -- **Verifiable Credentials**: Issue, share, and verify credentials without relying on centralized authorities. -- **Interoperability**: Compatible with a wide range of DID methods and cryptographic algorithms. -- **Self-Hosted**: Maintain full control over your identity solution by hosting it locally. -- **Secure Integration**: Pair with Tailscale for enhanced security, limiting access to your identity services to authorized devices. +- **Passkey-Only Sign-In** – Users authenticate with passkeys; there are no passwords to manage. +- **OIDC Provider** – Add single sign-on to any application that supports OpenID Connect. +- **Security Key Support** – Physical security keys, such as a YubiKey, work as passkeys. +- **Simple to Run** – One container and a SQLite database by default. +- **Self-Hosted** – Users, clients, and signing keys stay on your own hardware. +- **Private by Default with Tailscale** – No public exposure, no reverse proxies or port forwarding, and HTTPS handled by Tailscale Serve. ## Configuration Overview -In this setup, the `tailscale-pocket-id` service runs Tailscale, which manages secure networking for the Pocket ID service. The `pocket-id` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Pocket ID’s web interface and APIs are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your identity management system. +In this setup, the `tailscale` service (container `tailscale-pocket-id`) runs Tailscale and joins your Tailnet as the host `pocket-id`. The `application` service (container `app-pocket-id`) uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. Tailscale Serve terminates HTTPS on port 443 and proxies to Pocket ID on `127.0.0.1:1411` inside that shared namespace. This keeps the app Tailnet-only unless you intentionally expose ports. + +## Prerequisites + +- HTTPS certificates [enabled for your Tailnet](https://console.tailscale.com/admin/dns) (**DNS → HTTPS Certificates**). Pocket ID requires a secure context, so passkeys do not work without HTTPS. + +## Files to check + +Please verify the following files and variables before deploying: + +- `.env` — set `TS_AUTHKEY`, `APP_URL`, and `ENCRYPTION_KEY`. Generate the key with `openssl rand -base64 32`. +- `compose.yaml` — confirm the volume paths and the `Proxy` port in the `ts-serve` config. + +## Usage Notes + +- **`APP_URL` must match `SERVICE`.** Tailscale Serve publishes Pocket ID on the machine name, which comes from `SERVICE`, so the app is reached at `https://..ts.net`. `APP_URL` does not change that address. It only tells Pocket ID which URL to use for its OIDC issuer, its endpoints, and passkeys. When the two differ, the app answers on the `SERVICE` name while clients are sent to an address that does not exist, and passkey sign-in fails. +- **Using another name.** To serve Pocket ID at, for example, `https://id..ts.net`, set `SERVICE=id` and set `APP_URL` to that URL. Choose the name before users register passkeys, because passkeys are bound to the hostname in `APP_URL`. +- **Renaming an existing deployment.** The data folder is `./${SERVICE}-data`, so a new `SERVICE` value starts Pocket ID with an empty folder. Run `docker compose down`, change `SERVICE` and `APP_URL`, rename the folder (for example `mv pocket-id-data id-data`), and run `docker compose up -d`. Tailscale renames the existing machine from the stored state, so no new auth key is needed. A machine that you renamed by hand in the admin console keeps that name. +- **Custom domains.** Tailscale Serve only serves the machine's `ts.net` name. A custom domain in `APP_URL` needs your own DNS and reverse proxy, which this stack does not include. +- **First run.** Open `https://pocket-id..ts.net/setup` to create the admin account and its first passkey. +- **Health check.** The image defines its own health check (`/app/pocket-id healthcheck`), so `compose.yaml` does not override it. +- **Ports.** The `ports` block stays commented out; the Tailnet is the only way in. Uncommenting it publishes plain HTTP on the host, where passkeys do not work. + +## References + +- [Pocket ID website](https://pocket-id.org/) +- [Pocket ID on GitHub](https://github.com/pocket-id/pocket-id) +- [Pocket ID installation](https://pocket-id.org/docs/setup/installation) +- [Pocket ID environment variables](https://pocket-id.org/docs/configuration/environment-variables) +- [Tailscale Serve documentation](https://tailscale.com/kb/1242/tailscale-serve) +- [Tailscale auth keys](https://tailscale.com/kb/1085/auth-keys) diff --git a/services/pocket-id/compose.yaml b/services/pocket-id/compose.yaml index e5d8787d..06dde482 100644 --- a/services/pocket-id/compose.yaml +++ b/services/pocket-id/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management env_file: .env volumes: @@ -58,10 +58,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "curl -f http://localhost/health"] # Check if process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (/app/pocket-id healthcheck), so this file does not override it. restart: always diff --git a/services/portainer/.env b/services/portainer/.env index 1e901ff5..21bc1531 100644 --- a/services/portainer/.env +++ b/services/portainer/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/portainer/README.md b/services/portainer/README.md index 03146cc6..893de772 100644 --- a/services/portainer/README.md +++ b/services/portainer/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Portainer](https://github.com/portain ## Configuration Overview -In this setup, the `tailscale-portainer` service runs Tailscale, which manages secure networking for the Portainer service. The `portainer` service uses the Tailscale network stack via Docker’s `network_mode: service:` configuration. This setup ensures that Portainer’s management interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for managing your Docker environments. +In this setup, the `tailscale-portainer` service runs Tailscale, which manages secure networking for the Portainer service. The `portainer` service uses the Tailscale network stack via Docker’s `network_mode: service:tailscale` configuration. This setup ensures that Portainer’s management interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for managing your Docker environments. diff --git a/services/portainer/compose.yaml b/services/portainer/compose.yaml index a173f821..e1160a28 100644 --- a/services/portainer/compose.yaml +++ b/services/portainer/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,19 +47,19 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 - PGID=1000 - - TZ=${TZ} volumes: - /var/run/docker.sock:/var/run/docker.sock - ./${SERVICE}-data/portainer_data:/data depends_on: tailscale: condition: service_healthy + # Healthcheck: none possible. The image contains only the /portainer binary, with no shell, HTTP client, or health command. restart: always diff --git a/services/portracker/.env b/services/portracker/.env index 31ec3c98..84d8d198 100644 --- a/services/portracker/.env +++ b/services/portracker/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/portracker/README.md b/services/portracker/README.md index 3461ace3..257d9589 100644 --- a/services/portracker/README.md +++ b/services/portracker/README.md @@ -19,4 +19,4 @@ With Tailscale in place, all of these features are securely tunneled through you ## Configuration Overview -In this setup, the `tailscale-portracker` service runs Tailscale, which handles the secure networking layer. The `portracker` service uses Docker’s `network_mode: service:` setting to share the network stack of the Tailscale container. This means the Portracker web interface and all monitoring functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted port tracker. +In this setup, the `tailscale-portracker` service runs Tailscale, which handles the secure networking layer. The `portracker` service uses Docker’s `network_mode: service:tailscale` setting to share the network stack of the Tailscale container. This means the Portracker web interface and all monitoring functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted port tracker. diff --git a/services/portracker/compose.yaml b/services/portracker/compose.yaml index 9de793bd..18ac1c7c 100644 --- a/services/portracker/compose.yaml +++ b/services/portracker/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: - # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Make sure you have updated/checked the .env file with the correct variables. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement # ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -46,13 +46,13 @@ services: retries: 3 # Number of retries before marking as unhealthy start_period: 10s # Time to wait before starting health checks restart: always - - # ${SERVICE} + + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management - # network_mode: "host" Disabled as it is not possible to use host networking with Tailscale sidecar. + # network_mode: "host" Disabled as it is not possible to use host networking with Tailscale sidecar. volumes: # Required for data persistence - ./${SERVICE}-data/data:/data @@ -60,13 +60,9 @@ services: - /var/run/docker.sock:/var/run/docker.sock:ro environment: - DATABASE_PATH=/data/portracker.db + - TZ=${TZ} depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "index.js"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (wget against /api/health), so this file does not override it. restart: always diff --git a/services/posterizarr/.env b/services/posterizarr/.env index cea35b11..4af8f53d 100644 --- a/services/posterizarr/.env +++ b/services/posterizarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/posterizarr/README.md b/services/posterizarr/README.md index dce5b71b..d59a1d62 100644 --- a/services/posterizarr/README.md +++ b/services/posterizarr/README.md @@ -31,9 +31,18 @@ This approach is ideal for homelabs, media servers, and multi-location setups wh In this deployment, a **Tailscale sidecar container** (for example, `tailscale-posterizarr`) runs the Tailscale client and connects to your private Tailscale network. The Posterizarr service uses: ```plain -network_mode: service:tailscale-posterizarr +network_mode: service:tailscale ``` This configuration ensures that **all Posterizarr traffic is routed exclusively through the Tailscale interface**, allowing it to securely communicate with Radarr and Sonarr instances over your private network. No ports are exposed to the public Internet, and the service remains fully isolated. With this setup, Posterizarr can reliably enforce consistent artwork standards across your media library — securely, privately, and automatically. + +## Volume Permissions + +The Compose file runs Posterizarr as UID/GID `1000`. Docker creates missing bind-mount directories as `root:root`, and Posterizarr then fails with `Permission denied: '/config/database'`. Create the data directories before the first start: + +```sh +mkdir -p posterizarr-data/config posterizarr-data/assets posterizarr-data/assetsbackup posterizarr-data/manualassets +sudo chown -R 1000:1000 posterizarr-data +``` diff --git a/services/posterizarr/compose.yaml b/services/posterizarr/compose.yaml index 2259a047..8550486f 100644 --- a/services/posterizarr/compose.yaml +++ b/services/posterizarr/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,16 +47,16 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - - TZ=Europe/Amsterdam - - TERM=xterm - - RUN_TIME=disabled - user: "1000:1000" + - TZ=${TZ} + - TERM=xterm + - RUN_TIME=disabled + user: "1000:1000" volumes: - ./${SERVICE}-data/config:/config:rw - ./${SERVICE}-data/assets:/assets:rw @@ -66,7 +66,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8000/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/prowlarr/.env b/services/prowlarr/.env index ba759b0b..9527d741 100644 --- a/services/prowlarr/.env +++ b/services/prowlarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/prowlarr/README.md b/services/prowlarr/README.md index 1bb1892f..ba0c486c 100644 --- a/services/prowlarr/README.md +++ b/services/prowlarr/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Prowlarr](https://github.com/Prowlarr ## Configuration Overview -In this setup, the `tailscale-prowlarr` service runs Tailscale, which manages secure networking for the Prowlarr service. The `prowlarr` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Prowlarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted indexer manager. +In this setup, the `tailscale-prowlarr` service runs Tailscale, which manages secure networking for the Prowlarr service. The `prowlarr` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Prowlarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted indexer manager. diff --git a/services/prowlarr/compose.yaml b/services/prowlarr/compose.yaml index e2d09489..5dfe20b4 100644 --- a/services/prowlarr/compose.yaml +++ b/services/prowlarr/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -62,7 +62,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:9696/ping"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/qbittorrent/.env b/services/qbittorrent/.env index bcf3d0b4..1e2d65cb 100644 --- a/services/qbittorrent/.env +++ b/services/qbittorrent/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/qbittorrent/README.md b/services/qbittorrent/README.md index df90fb3e..529520ad 100644 --- a/services/qbittorrent/README.md +++ b/services/qbittorrent/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [qBittorrent](https://www.qbittorrent. ## Configuration Overview -In this setup, the tailscale-qbittorrent service runs Tailscale, which manages secure networking for the qBittorrent service. The qbittorrent service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that qBittorrent’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted torrent client. +In this setup, the tailscale-qbittorrent service runs Tailscale, which manages secure networking for the qBittorrent service. The qbittorrent service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that qBittorrent’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted torrent client. diff --git a/services/qbittorrent/compose.yaml b/services/qbittorrent/compose.yaml index 26bc363c..1ace784a 100644 --- a/services/qbittorrent/compose.yaml +++ b/services/qbittorrent/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,16 +47,16 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 - PGID=1000 - TZ=${TZ} - - WEBUI_PORT=8080 + - WEBUI_PORT=8080 # - TORRENTING_PORT=6881 #optional volumes: - ./${SERVICE}-data/config:/config @@ -65,7 +65,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8080/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/radarr/.env b/services/radarr/.env index 4a4c4d75..fcd67441 100644 --- a/services/radarr/.env +++ b/services/radarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/radarr/README.md b/services/radarr/README.md index 062c6fbe..fad9e8e6 100644 --- a/services/radarr/README.md +++ b/services/radarr/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Radarr](https://github.com/Radarr/Rad ## Configuration Overview -In this setup, the `tailscale-radarr` service runs Tailscale, which manages secure networking for the Radarr service. The `radarr` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Radarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. +In this setup, the `tailscale-radarr` service runs Tailscale, which manages secure networking for the Radarr service. The `radarr` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Radarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. ### Trouble with presets or optimal download quality, try diff --git a/services/radarr/compose.yaml b/services/radarr/compose.yaml index 8426980c..8c83387b 100644 --- a/services/radarr/compose.yaml +++ b/services/radarr/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -64,7 +64,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:7878/ping"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/radicale/.env b/services/radicale/.env index 199dbfe9..fb41d304 100644 --- a/services/radicale/.env +++ b/services/radicale/.env @@ -11,7 +11,11 @@ SERVICEPORT=5232 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY=... # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 + +# Time Zone setting for containers +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/radicale/README.md b/services/radicale/README.md index 7121b99d..981e3c2f 100644 --- a/services/radicale/README.md +++ b/services/radicale/README.md @@ -17,7 +17,7 @@ This Docker Compose configuration sets up [Radicale](https://radicale.org/) with ## Configuration Overview -In this setup, the `tailscale-radicale` service runs Tailscale, which manages secure networking for Radicale. The `radicale` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-radicale` service runs Tailscale, which manages secure networking for Radicale. The `radicale` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. The container runs with hardened security settings: read-only filesystem, no new privileges, dropped capabilities, and resource limits (256M memory, 50 pids). diff --git a/services/radicale/compose.yaml b/services/radicale/compose.yaml index 85729304..2830c102 100644 --- a/services/radicale/compose.yaml +++ b/services/radicale/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: - # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Make sure you have updated/checked the .env file with the correct variables. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: [ "CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz" ] # Check Tailscale has a Tailnet IP and is operational @@ -47,13 +47,14 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TAKE_FILE_OWNERSHIP=true + - TZ=${TZ} volumes: - ./${SERVICE}-data/app/data:/data - ./${SERVICE}-data/config/radicale.conf:/config/radicale.conf @@ -62,12 +63,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: - - CMD-SHELL - - wget -qO- http://127.0.0.1:5232/.well-known/carddav || exit 1 - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against the web UI), so this file does not override it. restart: always diff --git a/services/recyclarr/.env b/services/recyclarr/.env index 01ed5606..5b040989 100644 --- a/services/recyclarr/.env +++ b/services/recyclarr/.env @@ -4,7 +4,7 @@ # Service Configuration SERVICE=recyclarr -IMAGE_URL=ghcr.io/recyclarr/recyclarr +IMAGE_URL=ghcr.io/recyclarr/recyclarr:8 # Recyclarr publishes major-version tags and no "latest" tag. # Network Configuration SERVICEPORT= @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/recyclarr/README.md b/services/recyclarr/README.md index a0b5fa4e..8494cb9d 100644 --- a/services/recyclarr/README.md +++ b/services/recyclarr/README.md @@ -31,9 +31,18 @@ This is especially valuable in homelabs, seedbox setups, or multi-location media In this deployment, a **Tailscale sidecar container** (for example, `tailscale-recyclarr`) runs the Tailscale client and joins your private Tailscale network. The Recyclarr service uses: ```plain -network_mode: service:tailscale-recyclarr +network_mode: service:tailscale ``` This setup ensures that **all Recyclarr traffic flows exclusively through the Tailscale interface**, allowing it to securely reach Radarr and Sonarr instances that are also on your Tailscale network. No ports need to be exposed, and the container remains completely inaccessible from the public Internet. With this configuration, Recyclarr can safely automate and enforce your media quality standards across your entire media stack — privately, securely, and reproducibly. + +## Volume Permissions + +The Compose file runs Recyclarr as UID/GID `1000`. Docker creates missing bind-mount directories as `root:root`, and Recyclarr then exits with `Access to the path '/config/state' is denied`. Create the config directory before the first start: + +```sh +mkdir -p recyclarr-data/config +sudo chown -R 1000:1000 recyclarr-data +``` diff --git a/services/recyclarr/compose.yaml b/services/recyclarr/compose.yaml index 58dbd5ec..98150306 100644 --- a/services/recyclarr/compose.yaml +++ b/services/recyclarr/compose.yaml @@ -1,6 +1,6 @@ services: - # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Make sure you have updated/checked the .env file with the correct variables. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -12,7 +12,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true volumes: - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path @@ -21,9 +21,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -33,10 +33,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management volumes: - ./${SERVICE}-data/config:/config @@ -47,10 +47,10 @@ services: depends_on: tailscale: condition: service_healthy - # healthcheck: - # test: ["CMD", "pgrep", "-f", "yarn"] # Check if ${SERVICE} process is running - # interval: 1m # How often to perform the check - # timeout: 10s # Time to wait for the check to succeed - # retries: 3 # Number of retries before marking as unhealthy - # start_period: 30s # Time to wait before starting health checks - # restart: unless-stopped + healthcheck: + test: ["CMD", "pgrep", "-x", "supercronic"] # Check if the cron scheduler is running + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks + restart: always # The default entrypoint keeps running and syncs on CRON_SCHEDULE. diff --git a/services/resilio-sync/.env b/services/resilio-sync/.env index d3c604cb..7e1a7a8d 100644 --- a/services/resilio-sync/.env +++ b/services/resilio-sync/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/resilio-sync/README.md b/services/resilio-sync/README.md index f79247d9..1806c34a 100644 --- a/services/resilio-sync/README.md +++ b/services/resilio-sync/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Resilio Sync](https://github.com/linu ## Configuration Overview -In this setup, the `tailscale-resilio-sync` service runs Tailscale, which manages secure networking for the Resilio Sync service. The `resilio-sync` service uses the Tailscale network stack via Docker’s `network_mode: service:` configuration. This setup ensures that Resilio Sync is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your file synchronization and sharing tasks. +In this setup, the `tailscale-resilio-sync` service runs Tailscale, which manages secure networking for the Resilio Sync service. The `resilio-sync` service uses the Tailscale network stack via Docker’s `network_mode: service:tailscale` configuration. This setup ensures that Resilio Sync is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your file synchronization and sharing tasks. diff --git a/services/resilio-sync/compose.yaml b/services/resilio-sync/compose.yaml index 95c20acf..5cc52726 100644 --- a/services/resilio-sync/compose.yaml +++ b/services/resilio-sync/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -64,7 +64,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "rslsync"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8888/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/rustdesk-server/.env b/services/rustdesk-server/.env index 967a33db..401341bf 100644 --- a/services/rustdesk-server/.env +++ b/services/rustdesk-server/.env @@ -11,15 +11,16 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -# Time zone -TZ=Europe/Amsterdam +# Time Zone setting for containers +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Always use the relay. As this is run in tailnet and relays aren't needed, this setting in most cases should remain off. ALWAYS_USE_RELAY=N -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/rustdesk-server/README.md b/services/rustdesk-server/README.md index 36fce958..a132c3c1 100644 --- a/services/rustdesk-server/README.md +++ b/services/rustdesk-server/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Rustdesk Server](https://rustdesk.com ## Configuration Overview -In this setup, the `tailscale-rustdesk-server` service runs Tailscale, which manages secure networking for Rustdesk Server. The `Rustdesk Server` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-rustdesk-server` service runs Tailscale, which manages secure networking for Rustdesk Server. The `Rustdesk Server` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## Client setup diff --git a/services/rustdesk-server/compose.yml b/services/rustdesk-server/compose.yaml similarity index 78% rename from services/rustdesk-server/compose.yml rename to services/rustdesk-server/compose.yaml index 9ca8b0be..fdb489c4 100644 --- a/services/rustdesk-server/compose.yml +++ b/services/rustdesk-server/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,24 +47,24 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} container_name: app-${SERVICE}-hbbs # Name for local container management - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale command: hbbs volumes: - ./${SERVICE}-data/hbbs:/root environment: - PUID=1000 - PGID=1000 - - TZ=${TZ} - ALWAYS_USE_RELAY=${ALWAYS_USE_RELAY} depends_on: tailscale: condition: service_healthy - hbbr: + hbbr: condition: service_started + # Healthcheck: none possible. The image contains only the hbbs and hbbr binaries, with no shell, HTTP client, or health command. restart: always hbbr: @@ -76,6 +76,6 @@ services: environment: - PUID=1000 - PGID=1000 - - TZ=${TZ} - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale + # Healthcheck: none possible. The image contains only the hbbs and hbbr binaries, with no shell, HTTP client, or health command. restart: always diff --git a/services/seafile/.env b/services/seafile/.env index b3e65a84..9a6aa72e 100644 --- a/services/seafile/.env +++ b/services/seafile/.env @@ -3,27 +3,28 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE= seafile # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). +SERVICE=seafile # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). SEAFILE_IMAGE=seafileltd/seafile-mc:13.0-latest # Docker image URL from container registry (e.g., adguard/adguard-home). SEAFILE_DB_IMAGE=mariadb:10.11 -SEAFILE_MEMCACHED_IMAGE=memcached:1.6.29 +SEAFILE_MEMCACHED_IMAGE=memcached:1.6.29 # Must be a Debian-based tag: the healthcheck needs perl, which Alpine tags lack # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers -TZ=Europe/London # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +# Time Zone setting for containers +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" SEAFILE_VOLUME=./seafile-data SEAFILE_MYSQL_VOLUME=./db SEAFILE_MYSQL_DB_HOST=db @@ -31,13 +32,14 @@ INIT_SEAFILE_MYSQL_ROOT_PASSWORD=REPLACE_WITH_RANDOM_ALPHANUMERIC_PASSWORD SEAFILE_MYSQL_DB_USER=seafile SEAFILE_MYSQL_DB_PASSWORD=REPLACE_WITH_RANDOM_ALPHANUMERIC_PASSWORD TIME_ZONE=Etc/UTC -JWT_PRIVATE_KEY= #A random string with a length of no less than 32 characters, generate example: pwgen -s 40 1 or use openssl rand -base64 40 +#A random string with a length of no less than 32 characters, generate example: pwgen -s 40 1 or use openssl rand -base64 40 +JWT_PRIVATE_KEY= SEAFILE_SERVER_HOSTNAME=seafile..ts.net # update with specific MagicDNS suffix SEAFILE_SERVER_PROTOCOL=https -INIT_SEAFILE_ADMIN_EMAIL= ADD_EMAIL_ADDRESS_HERE +INIT_SEAFILE_ADMIN_EMAIL=ADD_EMAIL_ADDRESS_HERE INIT_SEAFILE_ADMIN_PASSWORD=REPLACE_WITH_RANDOM_ALPHANUMERIC_PASSWORD ENABLE_SEADOC=false ENABLE_NOTIFICATION_SERVER=false CACHE_PROVIDER=memcached -MEMCACHED_HOST=app-seafile-memcached -MEMCACHED_PORT=11211 \ No newline at end of file +MEMCACHED_HOST=memcached # Compose service name - keeps working when SERVICE changes +MEMCACHED_PORT=11211 diff --git a/services/seafile/README.md b/services/seafile/README.md index 242255e8..684d5c96 100644 --- a/services/seafile/README.md +++ b/services/seafile/README.md @@ -8,11 +8,12 @@ This Docker Compose configuration sets up [Seafile Community Edition](https://ww ## Configuration Overview -In this setup, the `tailscale-seafile` service runs Tailscale, which manages secure networking for Seafile. The Seafile service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-seafile` service runs Tailscale, which manages secure networking for Seafile. The Seafile service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## Notes - This configuration is intended for small (single digit) groups of users. It omits the SeaDoc, Collabora and Notification servers, and uses Memcached instead of Redis. You would probably want all of those things in a large deployment. +- Keep `SEAFILE_MEMCACHED_IMAGE` on a Debian-based tag. The Memcached health check needs perl, which Alpine tags lack, and Seafile waits for Memcached to be healthy before it starts. - Additional Docker Compose settings for Seafile can be found here: ## Files to check @@ -21,7 +22,23 @@ Please check the following contents for validity as some variables need to be de - `TS_AUTHKEY`: Paste in an Auth Key for your Tailnet. - Volumes: Update the locations for the `SEAFILE_VOLUME` and `SEAFILE_MYSQL_VOLUME` in .ENV. -- Passwords: There are three passwords (for MySQL/MariaDB and intial Seafile administrator) which need to be set in .ENV. +- Passwords: There are three passwords (for MySQL/MariaDB and initial Seafile administrator) which need to be set in .ENV. - Admin Email: Update `INIT_SEAFILE_ADMIN_EMAIL`. This doesn't have to be a valid email address, although you can configure SMTP notifications in Seafile, which will require a valid email address. - `JWT_PRIVATE_KEY`: Generate this by running `pwgen -s 40 1` or `openssl rand -base64 40` - `SEAFILE_SERVER_HOSTNAME`: Update the FQDN to match your Tailnet MagicDNS suffix. + +## Troubleshooting + +### Seafile cannot connect to the database + +Seafile waits for the database before it starts and logs nothing while it waits. The `app-seafile` container stays up, turns `unhealthy`, and the web interface answers `502 Bad Gateway`. Two causes are common. + +**`TS_ACCEPT_DNS=true` is enabled.** Seafile shares the network of the Tailscale container and reaches the database and Memcached through the Compose service names `db` and `memcached`. With `TS_ACCEPT_DNS=true`, Tailscale replaces Docker DNS and those names no longer resolve. Check whether the names resolve: + +```bash +docker exec app-seafile getent hosts db memcached +``` + +If the command prints nothing, comment out `TS_ACCEPT_DNS` in `compose.yaml` and run `docker compose up -d`. Seafile does not need MagicDNS, and Tailscale Serve works without this setting. + +**The database passwords changed after the first start.** MariaDB applies `INIT_SEAFILE_MYSQL_ROOT_PASSWORD` only when it creates an empty data directory, and Seafile creates its database user with `SEAFILE_MYSQL_DB_PASSWORD` on the first start. Later changes in `.env` do not reach the existing database, so Seafile can no longer log in and `docker logs app-seafile-db` shows `Access denied for user`. Restore the original passwords. On a new installation without data, you can instead stop the stack, delete the `SEAFILE_MYSQL_VOLUME` and `SEAFILE_VOLUME` directories, and start again. diff --git a/services/seafile/compose.yaml b/services/seafile/compose.yaml index addebbce..508dcfd2 100644 --- a/services/seafile/compose.yaml +++ b/services/seafile/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. - # All the ${xx} need to be defined there. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -20,11 +20,11 @@ services: - TS_STATE_DIR=/var/lib/tailscale - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required - TS_USERSPACE=false - # Uncomment this line and comment out TS_AUTH_ONCE if you want to the service to receive advertised routes, or add other arguements. + # Uncomment this line and comment out TS_AUTH_ONCE if you want to the service to receive advertised routes, or add other arguments. #- TS_EXTRA_ARGS=--accept-routes=true - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -37,7 +37,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:80 # Binding the host port to Seafile's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -52,7 +52,7 @@ services: db: image: ${SEAFILE_DB_IMAGE:-mariadb:10.11} container_name: app-${SERVICE}-db - restart: unless-stopped + restart: always environment: - MYSQL_ROOT_PASSWORD=${INIT_SEAFILE_MYSQL_ROOT_PASSWORD:-} - MYSQL_LOG_CONSOLE=true @@ -77,14 +77,19 @@ services: image: ${SEAFILE_MEMCACHED_IMAGE:-memcached:1.6.29} container_name: app-${SERVICE}-memcached entrypoint: memcached -m 256 + healthcheck: + test: ["CMD", "perl", "-MIO::Socket::INET", "-e", "my $$s = IO::Socket::INET->new('127.0.0.1:11211') or exit 1; print $$s \"version\\r\\n\"; exit((<$$s> // '') =~ /^VERSION/ ? 0 : 1)"] # Check if memcached answers; the image has no nc or HTTP client, and Alpine memcached tags have no perl + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks + restart: always seafile: image: ${SEAFILE_IMAGE:-seafileltd/seafile-mc:13.0-latest} container_name: app-${SERVICE} network_mode: service:tailscale - restart: unless-stopped - #ports: - #- "80:80" + restart: always volumes: - ${SEAFILE_VOLUME:-/opt/seafile-data}:/shared environment: @@ -123,13 +128,15 @@ services: - SEAFILE_AI_SECRET_KEY=${JWT_PRIVATE_KEY:?Variable is not set or empty} - MD_FILE_COUNT_LIMIT=${MD_FILE_COUNT_LIMIT:-100000} healthcheck: - test: ["CMD-SHELL", "curl -f http://localhost:80 || exit 1"] + test: ["CMD-SHELL", "curl -f http://localhost:80 || exit 1"] # Check if the service is responding interval: 30s timeout: 10s retries: 3 start_period: 10s depends_on: + tailscale: + condition: service_healthy db: condition: service_healthy memcached: - condition: service_started \ No newline at end of file + condition: service_healthy diff --git a/services/searxng/.env b/services/searxng/.env index 6eabe229..bd413529 100644 --- a/services/searxng/.env +++ b/services/searxng/.env @@ -13,14 +13,16 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +# Your Tailnet name, as in ..ts.net. Required: SearXNG builds its public base URL from it. TAILNET_NAME= # Optional Service variables # PUID=1000 -SEARXNG_SECRET= # Generate a random secret for searxng, e.g. using `openssl rand -hex 32` -SEARXNG_VALKEY_URL=valkey://valkey-searxng:6379/0 # URL for valkey, format: valkey://:/ +# Generate a random secret for searxng, e.g. using `openssl rand -hex 32` +SEARXNG_SECRET= +SEARXNG_VALKEY_URL=valkey://valkey:6379/0 # URL for valkey, format: valkey://:/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/searxng/README.md b/services/searxng/README.md index a9d8f9a6..6b42d634 100644 --- a/services/searxng/README.md +++ b/services/searxng/README.md @@ -8,10 +8,12 @@ This Docker Compose configuration sets up [searXNG](https://github.com/searxng/s ## Configuration Overview -In this setup, the `tailscale-searxng` service runs Tailscale, which manages secure networking for the searXNG service. The `searxng` service utilizes the Tailscale network stack via Docker’s `network_mode: service:` configuration. This setup ensures that searXNG is only accessible through your Tailscale network (or locally, if preferred). With this configuration, you can enjoy a private, secure, and customizable search engine experience, free from user tracking or external access. +In this setup, the `tailscale-searxng` service runs Tailscale, which manages secure networking for the searXNG service. The `searxng` service utilizes the Tailscale network stack via Docker’s `network_mode: service:tailscale` configuration. This setup ensures that searXNG is only accessible through your Tailscale network (or locally, if preferred). With this configuration, you can enjoy a private, secure, and customizable search engine experience, free from user tracking or external access. We use `/searxng/settings.yml` copied from as the default settings file. This dir is mounted as a volume, on docker and required for the first run. The default `settings.yml` does not use valkey ([valkey](https://github.com/searxng/searxng/blob/master/searx/settings.yml#L121) URL is set to `false`). We enable this by setting the `SEARXNG_VALKEY_URL` in `.env` file and using that in the `compose.yaml` file. +Set `SEARXNG_SECRET` in `.env` to a random value, for example with `openssl rand -hex 32`. The Compose file passes it to the mounted settings file as the instance secret, and Compose stops with an error if it is empty. +Set `TAILNET_NAME` in `.env` to your Tailnet name, the part between the service name and `.ts.net`. The Compose file builds the base URL `https://..ts.net/` from it. SearXNG uses it to build its inbound links, and an empty value would produce an invalid address, so Compose stops with an error if `TAILNET_NAME` is empty. ## References diff --git a/services/searxng/compose.yaml b/services/searxng/compose.yaml index 639004cf..62620488 100644 --- a/services/searxng/compose.yaml +++ b/services/searxng/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,15 +47,16 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 - PGID=1000 - - SEARXNG_BASE_URL=https://${SERVICE}.${TAILNET_NAME}.ts.net/ + - SEARXNG_BASE_URL=https://${SERVICE}.${TAILNET_NAME:?Set TAILNET_NAME in .env}.ts.net/ + - SEARXNG_SECRET=${SEARXNG_SECRET:?Set SEARXNG_SECRET in .env} - SEARXNG_VALKEY_URL=${SEARXNG_VALKEY_URL} - TZ=${TZ} volumes: @@ -66,6 +67,12 @@ services: - CHOWN - SETGID - SETUID + healthcheck: + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/healthz"] # Check if the service is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always logging: driver: "json-file" @@ -76,13 +83,19 @@ services: tailscale: condition: service_healthy valkey: - condition: service_started + condition: service_healthy valkey: - container_name: valkey-searxng + container_name: app-${SERVICE}-valkey image: docker.io/valkey/valkey:8-alpine command: valkey-server --save 30 1 --loglevel warning - restart: unless-stopped + healthcheck: + test: ["CMD", "valkey-cli", "ping"] # Check if Valkey responds + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks + restart: always volumes: - valkey-data2:/data cap_drop: diff --git a/services/seerr/.env b/services/seerr/.env index 8dd2a356..6d920a88 100644 --- a/services/seerr/.env +++ b/services/seerr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/seerr/README.md b/services/seerr/README.md index a778eb0f..19625ab4 100644 --- a/services/seerr/README.md +++ b/services/seerr/README.md @@ -8,6 +8,15 @@ This Docker Compose configuration sets up [Seerr](https://github.com/seerr-team/ ## Configuration Overview -In this setup, the `tailscale-seerr` service runs the Tailscale daemon to provide secure, private networking. The `seerr` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:` syntax. This binds Seer’s network interface to the Tailscale container, making the web UI and API available only through your Tailscale network (or locally, if needed). +In this setup, the `tailscale-seerr` service runs the Tailscale daemon to provide secure, private networking. The `seerr` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:tailscale` syntax. This binds Seer’s network interface to the Tailscale container, making the web UI and API available only through your Tailscale network (or locally, if needed). This architecture is ideal for self-hosters who want to access Seerr from anywhere without exposing it to the internet, maintaining both ease of access and strict privacy controls. + +## Volume Permissions + +The Seerr image runs as the non-root `node` user (UID/GID `1000`). Docker creates missing bind-mount directories as `root:root`, and Seerr then exits with `EACCES` when it creates `/app/config/logs`. Create the config directory before the first start: + +```sh +mkdir -p seerr-data/config +sudo chown -R 1000:1000 seerr-data +``` diff --git a/services/seerr/compose.yaml b/services/seerr/compose.yaml index f0ceadf8..a4327df2 100644 --- a/services/seerr/compose.yaml +++ b/services/seerr/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: - # Make sure you have updated/checked the .env file with the correct variables. - # All the ${ xx } need to be defined there. + # Make sure you have updated/checked the .env file with the correct variables. + # Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -46,11 +46,11 @@ services: retries: 3 # Number of retries before marking as unhealthy start_period: 10s # Time to wait before starting health checks restart: always - - # ${SERVICE} + + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management init: true # Use an init system to properly handle signals and process reaping environment: @@ -63,7 +63,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: wget --no-verbose --tries=1 --spider http://localhost:5055/api/v1/status || exit 1 # Check if ${SERVICE} process is running + test: wget --no-verbose --tries=1 --spider http://localhost:5055/api/v1/status || exit 1 # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/slink/.env b/services/slink/.env index a1e4ba93..08ab391d 100644 --- a/services/slink/.env +++ b/services/slink/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/slink/README.md b/services/slink/README.md index 6442221d..571111f4 100644 --- a/services/slink/README.md +++ b/services/slink/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Slink](https://github.com/andrii-kryv ## Configuration Overview -In this setup, the `tailscale-slink` service runs Tailscale, which manages secure networking for the Slink service. The `slink` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Slink's file-sharing interface is only accessible through the Tailscale network, adding an extra layer of security and privacy for your self-hosted file-sharing system. +In this setup, the `tailscale-slink` service runs Tailscale, which manages secure networking for the Slink service. The `slink` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Slink's file-sharing interface is only accessible through the Tailscale network, adding an extra layer of security and privacy for your self-hosted file-sharing system. diff --git a/services/slink/compose.yaml b/services/slink/compose.yaml index fb092ab4..77b9f692 100644 --- a/services/slink/compose.yaml +++ b/services/slink/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -65,12 +65,12 @@ services: # User password requirements - USER_PASSWORD_MIN_LENGTH=8 - - USER_PASSWORD_REQUIREMENTS=15 # bitmask of requirements + - USER_PASSWORD_REQUIREMENTS=15 # bitmask of requirements # Maximum image size allowed to be uploaded (no more than 50M) - IMAGE_MAX_SIZE=15M - # Storage provider to use. + # Storage provider to use. # Available options are local and smb - STORAGE_PROVIDER=local volumes: @@ -79,10 +79,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (wget against /api/health on the internal API port 8080), so this file does not override it. restart: always diff --git a/services/sonarr/.env b/services/sonarr/.env index 1a574fa2..4eef8c42 100644 --- a/services/sonarr/.env +++ b/services/sonarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/sonarr/README.md b/services/sonarr/README.md index c960287b..3c6cfa9a 100644 --- a/services/sonarr/README.md +++ b/services/sonarr/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Sonarr](https://github.com/Sonarr/Son ## Configuration Overview -In this setup, the tailscale-sonarr service runs Tailscale, which manages secure networking for the Sonarr service. The sonarr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Sonarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. +In this setup, the tailscale-sonarr service runs Tailscale, which manages secure networking for the Sonarr service. The sonarr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Sonarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. ### Trouble with presets or optimal download quality, try diff --git a/services/sonarr/compose.yaml b/services/sonarr/compose.yaml index 2f65db89..191b98dd 100644 --- a/services/sonarr/compose.yaml +++ b/services/sonarr/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -64,7 +64,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8989/ping"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/speedtest-tracker/.env b/services/speedtest-tracker/.env index 5eb822c2..cb5f3296 100644 --- a/services/speedtest-tracker/.env +++ b/services/speedtest-tracker/.env @@ -13,10 +13,13 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +# Required: generate with: echo "base64:$(openssl rand -base64 32)" +APP_KEY= + +#EXAMPLE_VAR="Environment variable" diff --git a/services/speedtest-tracker/README.md b/services/speedtest-tracker/README.md index e571bb07..476bb0f6 100644 --- a/services/speedtest-tracker/README.md +++ b/services/speedtest-tracker/README.md @@ -15,4 +15,14 @@ This Docker Compose configuration sets up [Speedtest Tracker](https://github.com ## Configuration Overview -In this setup, the `tailscale-speedtest` service runs Tailscale, which manages secure networking for the Speedtest Tracker service. The `speedtest-tracker` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Speedtest Tracker’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your internet speed monitoring. +In this setup, the `tailscale-speedtest` service runs Tailscale, which manages secure networking for the Speedtest Tracker service. The `speedtest-tracker` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Speedtest Tracker’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your internet speed monitoring. + +## Files to check + +Please check the following contents for validity as some variables need to be defined upfront. + +- `.env` + - Required: `TS_AUTHKEY` + - Required: `APP_KEY`. Generate it with `echo "base64:$(openssl rand -base64 32)"`. Compose stops with an error if it is empty. + +If you previously set `APP_KEY` in `compose.yaml`, move that value to `.env`. A new key cannot decrypt data that Speedtest Tracker already encrypted. diff --git a/services/speedtest-tracker/compose.yaml b/services/speedtest-tracker/compose.yaml index 5fe108d4..b185b1ff 100644 --- a/services/speedtest-tracker/compose.yaml +++ b/services/speedtest-tracker/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,15 +47,16 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 - PGID=1000 - - APP_KEY= + - TZ=${TZ} + - APP_KEY=${APP_KEY:?Set APP_KEY in .env} - DB_CONNECTION=sqlite #- APP_NAME= - APP_URL= # Base URL used for notifications. example: speedtest.funny-name.ts.net @@ -72,7 +73,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8888/api/healthcheck"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/stirlingpdf/.env b/services/stirlingpdf/.env index 865b0d66..79488069 100644 --- a/services/stirlingpdf/.env +++ b/services/stirlingpdf/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/stirlingpdf/README.md b/services/stirlingpdf/README.md index c3d6a734..122268a1 100644 --- a/services/stirlingpdf/README.md +++ b/services/stirlingpdf/README.md @@ -8,4 +8,4 @@ Stirling-PDF is a versatile, open-source toolkit that allows you to perform vari ## Configuration Overview -In this setup, the `tailscale-stirlingpdf` service runs Tailscale, which manages secure networking for the Stirling-PDF service. The `stirlingpdf` service uses the Tailscale network stack via Docker’s `network_mode: service:` configuration. This setup ensures that Stirling-PDF's interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your PDF processing tasks. +In this setup, the `tailscale-stirlingpdf` service runs Tailscale, which manages secure networking for the Stirling-PDF service. The `stirlingpdf` service uses the Tailscale network stack via Docker’s `network_mode: service:tailscale` configuration. This setup ensures that Stirling-PDF's interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your PDF processing tasks. diff --git a/services/stirlingpdf/compose.yaml b/services/stirlingpdf/compose.yaml index b836f031..9a5e7511 100644 --- a/services/stirlingpdf/compose.yaml +++ b/services/stirlingpdf/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,15 +47,16 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - DOCKER_ENABLE_SECURITY=false - INSTALL_BOOK_AND_ADVANCED_HTML_OPS=false - LANGS=en_GB + - TZ=${TZ} volumes: - ./${SERVICE}-data/trainingData:/usr/share/tessdata # Required for extra OCR languages - ./${SERVICE}-data/extraConfigs:/configs @@ -64,10 +65,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "app.jar"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against /api/v1/info/status), so this file does not override it. restart: always diff --git a/services/subtrackr/.env b/services/subtrackr/.env index 36b5072a..1911f31e 100644 --- a/services/subtrackr/.env +++ b/services/subtrackr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/subtrackr/README.md b/services/subtrackr/README.md index aedd00ec..87a6a263 100644 --- a/services/subtrackr/README.md +++ b/services/subtrackr/README.md @@ -18,4 +18,4 @@ This Docker Compose configuration sets up [**Subtrackr**](https://github.com/bsc ## Configuration Overview -In this deployment, the `tailscale-subtrackr` service runs the Tailscale client to establish a secure private network. The `subtrackr` container uses `network_mode: service:tailscale-subtrackr` to route all traffic through the Tailscale interface. This ensures that your subscription data, dashboards, and administration interface are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-subtrackr` service runs the Tailscale client to establish a secure private network. The `subtrackr` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your subscription data, dashboards, and administration interface are only accessible via Tailscale, preventing public exposure. diff --git a/services/subtrackr/compose.yaml b/services/subtrackr/compose.yaml index 6cd381cf..69aaaea5 100644 --- a/services/subtrackr/compose.yaml +++ b/services/subtrackr/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -63,10 +63,5 @@ services: depends_on: tailscale: condition: service_healthy - # healthcheck: - # test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running - # interval: 1m # How often to perform the check - # timeout: 10s # Time to wait for the check to succeed - # retries: 3 # Number of retries before marking as unhealthy - # start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (curl against /healthz), so this file does not override it. restart: always diff --git a/services/sure/.env b/services/sure/.env index 0cd788e3..6750b9f8 100755 --- a/services/sure/.env +++ b/services/sure/.env @@ -11,12 +11,13 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ @@ -33,17 +34,19 @@ POSTGRES_HOST=db # Used by the backup service (on sure_net, Docker DNS works) REDIS_URL=redis://172.28.0.11:6379/1 # Static IP of redis on sure_net (web/worker share tailscale namespace where Docker DNS is overridden by MagicDNS) # Sure Application -SECRET_KEY_BASE= #openssl rand -hex 64 +#openssl rand -hex 64 +SECRET_KEY_BASE= SELF_HOSTED=true RAILS_FORCE_SSL=true RAILS_ASSUME_SSL=true -PORT=8070 # OpenAI (Optional) -OPENAI_ACCESS_TOKEN= # NOTE: enabling OpenAI will incur costs when you use AI-related features in the app (chat, rules) +# NOTE: enabling OpenAI will incur costs when you use AI-related features in the app (chat, rules) +OPENAI_ACCESS_TOKEN= # OIDC Authentication (Optional) -OIDC_ISSUER= # OIDC issuer URL for authentication +# OIDC issuer URL for authentication +OIDC_ISSUER= OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= OIDC_REDIRECT_URI=https:///auth/openid_connect/callback diff --git a/services/sure/compose.yaml b/services/sure/compose.yaml index f92e6810..245740c0 100755 --- a/services/sure/compose.yaml +++ b/services/sure/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -51,7 +51,13 @@ services: network_mode: service:tailscale volumes: - ./app-storage:/rails/storage - restart: unless-stopped + healthcheck: + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:3000/up"] # Check if the service is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks + restart: always environment: - POSTGRES_USER=${POSTGRES_USER:-sure_user} - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-sure_password} @@ -68,6 +74,7 @@ services: - OIDC_CLIENT_ID=${OIDC_CLIENT_ID} # Optional: OIDC client ID for authentication. Required if OIDC_ISSUER is set. - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET} # Optional: OIDC client secret for authentication. Required if OIDC_ISSUER is set. - OIDC_REDIRECT_URI=${OIDC_REDIRECT_URI} # Optional: OIDC redirect URI for authentication. Required if OIDC_ISSUER is set. + - TZ=${TZ} # BINDING: "::" # Uncomment for IPv6 dual-stack inside the container depends_on: tailscale: @@ -84,7 +91,13 @@ services: command: bundle exec sidekiq volumes: - ./app-storage:/rails/storage - restart: unless-stopped + healthcheck: + test: ["CMD", "pgrep", "-f", "sidekiq"] # Check if the Sidekiq worker process is running + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks + restart: always depends_on: tailscale: condition: service_healthy @@ -104,11 +117,12 @@ services: - DB_PORT=${DB_PORT:-5432} - REDIS_URL=${REDIS_URL:-redis://172.28.0.11:6379/1} - OPENAI_ACCESS_TOKEN=${OPENAI_ACCESS_TOKEN} # NOTE: enabling OpenAI will incur costs when you use AI-related features in the app (chat, rules). Make sure you have set appropriate spend limits on your account before adding this. + - TZ=${TZ} db: image: postgres:16 container_name: app-${SERVICE}-db - restart: unless-stopped + restart: always volumes: - ./postgres-data:/var/lib/postgresql/data environment: @@ -116,10 +130,11 @@ services: - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-sure_password} - POSTGRES_DB=${POSTGRES_DB:-sure_production} healthcheck: - test: [ "CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB" ] + test: [ "CMD-SHELL", "pg_isready -h 127.0.0.1 -U $$POSTGRES_USER -d $$POSTGRES_DB" ] # Check if PostgreSQL accepts connections interval: 5s timeout: 5s retries: 5 + start_period: 30s networks: sure_net: ipv4_address: 172.28.0.10 @@ -129,7 +144,8 @@ services: - backup image: prodrigestivill/postgres-backup-local container_name: app-${SERVICE}-backup - restart: unless-stopped + # Healthcheck: defined by the image (curl against the backup HTTP port), so this file does not override it. + restart: always volumes: - ./backups:/backups # Change this path to your desired backup location on the host machine environment: @@ -142,18 +158,19 @@ services: - BACKUP_KEEP_WEEKS=${BACKUP_KEEP_WEEKS:-4} - BACKUP_KEEP_MONTHS=${BACKUP_KEEP_MONTHS:-6} depends_on: - - db + db: + condition: service_healthy networks: - sure_net redis: image: redis:latest container_name: app-${SERVICE}-redis - restart: unless-stopped + restart: always volumes: - ./redis-data:/data healthcheck: - test: [ "CMD", "redis-cli", "ping" ] + test: [ "CMD", "redis-cli", "ping" ] # Check if Redis responds interval: 5s timeout: 5s retries: 5 diff --git a/services/swingmx/.env b/services/swingmx/.env index 78ba5dba..27d66ed8 100644 --- a/services/swingmx/.env +++ b/services/swingmx/.env @@ -4,7 +4,7 @@ # Service Configuration SERVICE=swingmusic -IMAGE_URL=swingmx/swingmusic:latest +IMAGE_URL=ghcr.io/swingmx/swingmusic:latest # Network Configuration SERVICEPORT=1970 @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/swingmx/README.md b/services/swingmx/README.md index e00fff95..a365b8d2 100644 --- a/services/swingmx/README.md +++ b/services/swingmx/README.md @@ -27,7 +27,9 @@ Self-hosting Swing Music gives you **full ownership of your music library**, com In this deployment, a **Tailscale sidecar container** (for example `tailscale-swingmusic`) runs the Tailscale client and joins your private Tailscale network. The main `swingmusic` service uses: ```plain -network_mode: service:tailscale-swingmusic +network_mode: service:tailscale ``` This configuration routes all traffic through the Tailscale interface, ensuring the Swing Music web UI and streaming endpoints are accessible **only via your Tailscale network**. This keeps your music library secure while allowing seamless access from all your trusted devices. + +Before starting the stack, replace `/path/to/music` in `compose.yaml` with the absolute host directory that contains your music library. diff --git a/services/swingmx/compose.yaml b/services/swingmx/compose.yaml index 13ba29a0..959198c4 100644 --- a/services/swingmx/compose.yaml +++ b/services/swingmx/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -63,7 +63,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:1970/', timeout=5)"] # Check if the service is responding; the image has no wget, curl, or pgrep interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/tailscale-app-connector-node/.env b/services/tailscale-app-connector-node/.env index cc1b9d25..85c4c6d6 100644 --- a/services/tailscale-app-connector-node/.env +++ b/services/tailscale-app-connector-node/.env @@ -7,7 +7,8 @@ SERVICE=app-connector IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= DNS_SERVER=9.9.9.9 # Tailscale Configuration @@ -16,7 +17,7 @@ TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ diff --git a/services/tailscale-app-connector-node/compose.yaml b/services/tailscale-app-connector-node/compose.yaml index 767b71d8..89f003e3 100644 --- a/services/tailscale-app-connector-node/compose.yaml +++ b/services/tailscale-app-connector-node/compose.yaml @@ -1,6 +1,6 @@ services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -13,7 +13,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true volumes: - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path diff --git a/services/tailscale-exit-node/.env b/services/tailscale-exit-node/.env index d18f2142..60cfe71a 100644 --- a/services/tailscale-exit-node/.env +++ b/services/tailscale-exit-node/.env @@ -7,16 +7,17 @@ SERVICE=exit-node IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/tailscale-exit-node/compose.yaml b/services/tailscale-exit-node/compose.yaml index fc8097a3..3ab3bdb6 100644 --- a/services/tailscale-exit-node/compose.yaml +++ b/services/tailscale-exit-node/compose.yaml @@ -1,6 +1,6 @@ services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -13,7 +13,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true volumes: - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path diff --git a/services/tailscale-subnet-router-node/.env b/services/tailscale-subnet-router-node/.env index ef054713..f9285774 100644 --- a/services/tailscale-subnet-router-node/.env +++ b/services/tailscale-subnet-router-node/.env @@ -7,7 +7,8 @@ SERVICE=subnet-router IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= DNS_SERVER=9.9.9.9 # Tailscale Configuration @@ -16,7 +17,7 @@ TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ @@ -25,4 +26,4 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Add comma separated list of subnet routes SUBNET_ROUTES=10.1.234.0/24 # See: https://tailscale.com/docs/features/subnet-routers -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/tailscale-subnet-router-node/compose.yaml b/services/tailscale-subnet-router-node/compose.yaml index d3207367..8bc2a363 100644 --- a/services/tailscale-subnet-router-node/compose.yaml +++ b/services/tailscale-subnet-router-node/compose.yaml @@ -1,6 +1,6 @@ services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -14,7 +14,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true volumes: - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path diff --git a/services/tandoor/.env b/services/tandoor/.env index f6f4e0b0..0abb304c 100644 --- a/services/tandoor/.env +++ b/services/tandoor/.env @@ -16,7 +16,7 @@ DNS_SERVER=9.9.9.9 TS_AUTHKEY= # Time Zone setting for containers -TZ=Europe/Amsterdam +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Tandoor Configuration # Generate with: base64 /dev/urandom | head -c50 diff --git a/services/tandoor/README.md b/services/tandoor/README.md index 5eb9ec92..d6136245 100644 --- a/services/tandoor/README.md +++ b/services/tandoor/README.md @@ -15,4 +15,4 @@ This Docker Compose configuration sets up [**Tandoor Recipes**](https://github.c ## Configuration Overview -In this setup, the `tailscale-tandoor` service runs Tailscale, which manages secure networking for the service. The `tandoor` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale-tandoor` configuration. This setup ensures that tandoor's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your service. +In this setup, the `tailscale-tandoor` service runs Tailscale, which manages secure networking for the service. The `tandoor` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that tandoor's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your service. diff --git a/services/tandoor/compose.yaml b/services/tandoor/compose.yaml index 56f76204..6426d841 100644 --- a/services/tandoor/compose.yaml +++ b/services/tandoor/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TZ=${TZ} @@ -66,7 +66,7 @@ services: database: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD-SHELL", "h=$${ALLOWED_HOSTS%%,*}; [ \"$$h\" = \"*\" ] && h=localhost; wget -q -O /dev/null --header \"Host: $$h\" http://127.0.0.1:9001/"] # Check if the service is responding; Django only answers for ALLOWED_HOSTS, and rejects a literal * host interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy @@ -84,7 +84,7 @@ services: volumes: - ./${SERVICE}-data/database:/var/lib/postgresql/data healthcheck: - test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"] # Check if postgres is ready + test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U ${POSTGRES_USER} -d ${POSTGRES_DB}"] # Check if postgres is ready interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/tautulli/.env b/services/tautulli/.env index ec603f81..ba34cb08 100644 --- a/services/tautulli/.env +++ b/services/tautulli/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/tautulli/README.md b/services/tautulli/README.md index fd5c5125..a8bc9bc2 100644 --- a/services/tautulli/README.md +++ b/services/tautulli/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Tautulli for Docker](https://hub.dock ## Configuration Overview -In this setup, the tailscale-tautulli service runs Tailscale, which manages secure networking for the Tautulli service. The tautulli service utilizes the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Tautulli’s monitoring interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your Plex server monitoring and management. +In this setup, the tailscale-tautulli service runs Tailscale, which manages secure networking for the Tautulli service. The tautulli service utilizes the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Tautulli’s monitoring interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your Plex server monitoring and management. diff --git a/services/tautulli/compose.yaml b/services/tautulli/compose.yaml index 6681bfb6..d0d2e15d 100644 --- a/services/tautulli/compose.yaml +++ b/services/tautulli/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -62,7 +62,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8181/status"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/technitium/.env b/services/technitium/.env index 0405bfec..cdfb6fcb 100644 --- a/services/technitium/.env +++ b/services/technitium/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" se # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -23,4 +23,4 @@ DNS_SERVER1=9.9.9.9 DNS_SERVER2=8.8.4.4 ADMIN_PASSWORD=ChangeME -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/technitium/compose.yaml b/services/technitium/compose.yaml index 474c1655..218ab009 100644 --- a/services/technitium/compose.yaml +++ b/services/technitium/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -54,10 +54,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - DNS_SERVER_DOMAIN=${SERVICE}.local #The primary domain name used by this DNS Server to identify itself. @@ -80,13 +80,14 @@ services: - DNS_SERVER_FORWARDERS=${DNS_SERVER1},${DNS_SERVER2} #Comma separated list of forwarder addresses. # - DNS_SERVER_FORWARDER_PROTOCOL=Tcp #Forwarder protocol options: Udp, Tcp, Tls, Https, HttpsJson. # - DNS_SERVER_LOG_USING_LOCAL_TIME=true #Enable this option to use local time instead of UTC for logging. + - TZ=${TZ} volumes: - ./${SERVICE}-data/app/config:/config depends_on: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:5380/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/tracktor/.env b/services/tracktor/.env index a95d0512..f8699d33 100644 --- a/services/tracktor/.env +++ b/services/tracktor/.env @@ -11,12 +11,15 @@ SERVICEPORT=3333 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Your Tailnet DNS name without .ts.net (e.g., tail123abc). +TS_TAILNET= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TS_TAILNET= # Your Tailscale tailnet name (e.g., my-tailnet). + # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/tracktor/README.md b/services/tracktor/README.md index 3ef7c199..b6e6934c 100644 --- a/services/tracktor/README.md +++ b/services/tracktor/README.md @@ -30,7 +30,11 @@ When combined with Tailscale, Tracktor becomes a private portal accessible only In this deployment, a **Tailscale sidecar container** (for example `tailscale-tracktor`) runs the Tailscale client and joins your private Tailscale network. The main `tracktor` service uses: ```plain -network_mode: service:tailscale-tracktor +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Tracktor web UI is accessible **only via your Tailscale network**. + +Set `TS_TAILNET` in `.env` to your Tailnet DNS name without `.ts.net`, for example `tail123abc`. Compose appends `.ts.net` to build the allowed browser origin, such as `https://tracktor.tail123abc.ts.net`. + +If you enable the optional host port mapping, it maps `SERVICEPORT` to Tracktor's container port `3000`. diff --git a/services/tracktor/compose.yaml b/services/tracktor/compose.yaml index aa68c51e..87ac2c7f 100644 --- a/services/tracktor/compose.yaml +++ b/services/tracktor/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,8 +22,8 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS - - TS_AUTH_ONCE=true + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve + - TS_AUTH_ONCE=true configs: - source: ts-serve target: /config/serve.json @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:3000 # Binding the host port to Tracktor's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,22 +47,23 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TRACKTOR_DEMO_MODE=false - FORCE_DATA_SEED=false - - CORS_ORIGINS="https://${SERVICE}.${TS_TAILNET}.ts.net" # Adjust as needed for your setup + - CORS_ORIGINS=https://${SERVICE}.${TS_TAILNET}.ts.net # Adjust as needed for your setup + - TZ=${TZ} volumes: - ./${SERVICE}-data:/data depends_on: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "node build"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/api/health"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/traefik/.env b/services/traefik/.env index ecabc10c..d37982a9 100644 --- a/services/traefik/.env +++ b/services/traefik/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/traefik/README.md b/services/traefik/README.md index 054ea7a6..496ecbd9 100644 --- a/services/traefik/README.md +++ b/services/traefik/README.md @@ -8,4 +8,16 @@ This Docker Compose configuration sets up [Traefik](https://github.com/traefik/t ## Configuration Overview -In this setup, the `tailscale-traefik` service runs Tailscale, which manages secure networking for the Traefik service. The `traefik` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Traefik’s dashboard and routing functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of privacy and security to your network architecture. +In this setup, the `tailscale-traefik` service runs Tailscale, which manages secure networking for Traefik. The `traefik_proxy` service uses Docker's `network_mode: service:tailscale` configuration. Traefik reads its static configuration from the `command:` flags in `compose.yaml`. Traefik ignores these flags when it finds a static configuration file, so edit the flags instead of adding a `traefik.yml` file. + +The Traefik health check calls the ping endpoint, so keep the `--ping=true` flag. Traefik routes only to containers that Docker reports as healthy. The `simpleweb` sample therefore becomes reachable only after its first health check passes. + +## Tailnet Access + +Tailscale Serve listens on port 443 of the Tailnet address, terminates HTTPS, and forwards requests to Traefik's `web` entrypoint on port 80. Do not add a Traefik entrypoint on port 443. Traefik shares the network of the Tailscale container, so the port is already in use. Traefik then exits, and the container restarts in a loop. + +Requests through the Tailnet arrive with the host name `..ts.net`. The sample routers match `traefik.domain.local` and `simpleweb.domain.local`, so Traefik answers `404` over the Tailnet. Change a `Host()` rule to the Tailnet name to reach that router through Tailscale Serve. + +## Troubleshooting + +Traefik writes its log to `./${SERVICE}-data/log/traefik.log`, so `docker logs app-traefik` stays empty. Read that file when the container restarts or a router does not work. diff --git a/services/traefik/compose.yaml b/services/traefik/compose.yaml index ba4e6311..4a68d42c 100644 --- a/services/traefik/compose.yaml +++ b/services/traefik/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement ports: - - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application traefik_proxy: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - PUID=1000 @@ -60,24 +60,21 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "traefik", "healthcheck", "--ping"] # Check if the service is responding; needs --ping=true below interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy start_period: 30s # Time to wait before starting health checks restart: always volumes: - - type: bind - source: ./${SERVICE}-data/app/traefik.yml - target: /etc/traefik.yml - ./${SERVICE}-data/log/:/var/log/ - /var/run/docker.sock:/var/run/docker.sock #Required for the Service Connections - command: + command: # Static configuration. Traefik ignores these flags if it finds a traefik.yml file. - "--api.insecure=true" + - "--ping=true" # Required by the health check - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - - "--entrypoints.web.address=:80" - - "--entrypoints.ssl.address=:443" + - "--entrypoints.web.address=:80" # Tailscale Serve already listens on port 443 and forwards to this entrypoint - do not add an entrypoint on port 443 - --log.level=INFO - --log.filepath=/var/log/traefik.log - --accesslog=true @@ -88,10 +85,17 @@ services: - traefik.enable=true - traefik.http.routers.mydashboard.rule=Host(`traefik.domain.local`) - traefik.http.routers.mydashboard.service=api@internal + - traefik.http.services.mydashboard.loadbalancer.server.port=8080 # Traefik drops the labels of a container without a port - this container exposes none, because it uses the Tailscale network simpleweb: image: yeasy/simple-web:latest labels: - - traefik.enable=true # To + - traefik.enable=true # Let Traefik route this sample container - traefik.http.routers.simpleweb.rule=Host(`simpleweb.domain.local`) - traefik.http.routers.simpleweb.entrypoints=web + healthcheck: + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:80/"] # Check if the sample web server is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks diff --git a/services/traefik/traefik/app/traefik.yml b/services/traefik/traefik/app/traefik.yml deleted file mode 100644 index e69de29b..00000000 diff --git a/services/transmute/.env b/services/transmute/.env index d17b1207..60e41497 100644 --- a/services/transmute/.env +++ b/services/transmute/.env @@ -11,14 +11,15 @@ SERVICEPORT=3313 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/transmute/README.md b/services/transmute/README.md index c50001c1..c4f09711 100644 --- a/services/transmute/README.md +++ b/services/transmute/README.md @@ -18,7 +18,7 @@ Running Transmute behind Tailscale ensures that your file processing pipelines a ## Configuration Overview -In this setup, the `tailscale-transmute` service runs Tailscale and manages secure connectivity to your Tailnet. The `transmute` container shares the same network stack using Docker’s `network_mode: service:tailscale-transmute`. +In this setup, the `tailscale-transmute` service runs Tailscale and manages secure connectivity to your Tailnet. The `transmute` container shares the same network stack using Docker’s `network_mode: service:tailscale`. ## Service Notes / Gotchas diff --git a/services/transmute/compose.yaml b/services/transmute/compose.yaml index d283b937..f9eddd41 100644 --- a/services/transmute/compose.yaml +++ b/services/transmute/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,25 +47,25 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. - PUID=1000 - PGID=1000 - TZ=${TZ} - #- EXAMPLE_VAR=${EXAMPLE_VAR} + #- EXAMPLE_VAR=${EXAMPLE_VAR} volumes: - ./${SERVICE}-data:/app/data depends_on: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "wget", "-q", "-O", "/dev/null", "--tries=1", "http://localhost:3313/api/health/ready"] + test: ["CMD", "wget", "-q", "-O", "/dev/null", "--tries=1", "http://localhost:3313/api/health/ready"] # Check if the service is responding interval: 1m timeout: 10s retries: 3 start_period: 30s - restart: always \ No newline at end of file + restart: always diff --git a/services/uptime-kuma/.env b/services/uptime-kuma/.env index 2ef5fe03..0f2e9920 100644 --- a/services/uptime-kuma/.env +++ b/services/uptime-kuma/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/uptime-kuma/README.md b/services/uptime-kuma/README.md index 3a87dcf3..1b2facfb 100644 --- a/services/uptime-kuma/README.md +++ b/services/uptime-kuma/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Uptime Kuma](https://github.com/louis ## Configuration Overview -In this setup, the `tailscale-uptimekuma` service runs Tailscale, which manages secure networking for the Uptime Kuma service. The `uptimekuma` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Uptime Kuma's monitoring dashboard is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your monitoring solution. +In this setup, the `tailscale-uptimekuma` service runs Tailscale, which manages secure networking for the Uptime Kuma service. The `uptimekuma` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Uptime Kuma's monitoring dashboard is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your monitoring solution. diff --git a/services/uptime-kuma/compose.yaml b/services/uptime-kuma/compose.yaml index 56ac3704..072ebde1 100644 --- a/services/uptime-kuma/compose.yaml +++ b/services/uptime-kuma/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,21 +47,18 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management + environment: + - TZ=${TZ} volumes: - ./${SERVICE}-data/uptime-kuma-data:/app/data # uptime-kuma data/configuration folder - /var/run/docker.sock:/var/run/docker.sock:ro # Read-only access to the docker.sock depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD-SHELL", "curl -f http://localhost:3001 || exit 1"] # Check if Uptime Kuma is running and accessible - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks + # Healthcheck: defined by the image (extra/healthcheck), so this file does not override it. restart: always diff --git a/services/vaultwarden/.env b/services/vaultwarden/.env index e9835090..ca110273 100644 --- a/services/vaultwarden/.env +++ b/services/vaultwarden/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/vaultwarden/README.md b/services/vaultwarden/README.md index bc450ebe..f63339da 100644 --- a/services/vaultwarden/README.md +++ b/services/vaultwarden/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Vaultwarden](https://github.com/dani- ## Configuration Overview -In this setup, the `tailscale-vaultwarden` service runs Tailscale, which manages secure networking for the Vaultwarden service. The `vaultwarden` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Vaultwarden’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted password manager. +In this setup, the `tailscale-vaultwarden` service runs Tailscale, which manages secure networking for the Vaultwarden service. The `vaultwarden` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Vaultwarden’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted password manager. diff --git a/services/vaultwarden/compose.yaml b/services/vaultwarden/compose.yaml index 4ca3d09f..d41ddc34 100644 --- a/services/vaultwarden/compose.yaml +++ b/services/vaultwarden/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,17 +47,19 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: # DOMAIN: "https://vaultwarden.example.com" # required when using a reverse proxy; your domain; vaultwarden needs to know it's https to work properly with attachments SIGNUPS_ALLOWED: "true" # Deactivate this with "false" after you have created your account so that no strangers can register + TZ: ${TZ} volumes: - ./${SERVICE}-data/vw-data:/data depends_on: tailscale: condition: service_healthy + # Healthcheck: defined by the image (/healthcheck.sh), so this file does not override it. restart: always diff --git a/services/vikunja/.env b/services/vikunja/.env index a1601c81..2989bcb4 100644 --- a/services/vikunja/.env +++ b/services/vikunja/.env @@ -11,17 +11,18 @@ SERVICEPORT=3456 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" VIKUNJA_SERVICE_PUBLICURL=https://vikunja..ts.net/ -VIKUNJA_DATABASE_PATH=/db/vikunja.db # Path to the SQLite database file. Ensure this path is correctly mapped in your Docker volumes.a \ No newline at end of file +VIKUNJA_DATABASE_PATH=/db/vikunja.db # Path to the SQLite database file. Ensure this path is correctly mapped in your Docker volumes. diff --git a/services/vikunja/README.md b/services/vikunja/README.md index 0172ab44..74f547a2 100644 --- a/services/vikunja/README.md +++ b/services/vikunja/README.md @@ -19,7 +19,7 @@ Vikunja is ideal for individuals or teams who want full ownership of their produ ## Configuration Overview -In this setup, the `tailscale-vikunja` service runs Tailscale, which manages secure networking for Vikunja. The `vikunja` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures the application is only accessible through your Tailnet unless you explicitly expose ports. +In this setup, the `tailscale-vikunja` service runs Tailscale, which manages secure networking for Vikunja. The `vikunja` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures the application is only accessible through your Tailnet unless you explicitly expose ports. ### Service-Specific Notes diff --git a/services/vikunja/compose.yaml b/services/vikunja/compose.yaml index b5b4abd2..abebd2d3 100644 --- a/services/vikunja/compose.yaml +++ b/services/vikunja/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,13 +47,13 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management user: "0:0" - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. - TZ=${TZ} - VIKUNJA_SERVICE_PUBLICURL=${VIKUNJA_SERVICE_PUBLICURL} - VIKUNJA_DATABASE_PATH=${VIKUNJA_DATABASE_PATH} @@ -64,4 +64,10 @@ services: depends_on: tailscale: condition: service_healthy - restart: always \ No newline at end of file + healthcheck: + test: ["CMD", "/app/vikunja/vikunja", "healthcheck"] # Built-in check: starts a second instance and pings the database. It does not test the web server, but the image has no shell or HTTP client + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks + restart: always diff --git a/services/wallos/.env b/services/wallos/.env index d65155bd..03d29164 100644 --- a/services/wallos/.env +++ b/services/wallos/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/wallos/README.md b/services/wallos/README.md index b86c3a30..36e421d8 100644 --- a/services/wallos/README.md +++ b/services/wallos/README.md @@ -17,6 +17,6 @@ Wallos is a self-hosted subscription tracking application that helps you manage ## Configuration Overview -In this configuration, the `tailscale-wallos` container runs the Tailscale client and joins your private mesh network. The `wallos` container is set to use `network_mode: service:tailscale-wallos`, meaning all of Wallos’s network traffic is routed through the Tailscale container. This ensures that the Wallos interface is not publicly exposed and is only reachable from devices connected to your Tailscale network. +In this configuration, the `tailscale-wallos` container runs the Tailscale client and joins your private mesh network. The `wallos` container is set to use `network_mode: service:tailscale`, meaning all of Wallos’s network traffic is routed through the Tailscale container. This ensures that the Wallos interface is not publicly exposed and is only reachable from devices connected to your Tailscale network. This approach combines self-hosted financial tracking with robust, zero-config VPN security—allowing you to safely manage your subscriptions from anywhere. diff --git a/services/wallos/compose.yaml b/services/wallos/compose.yaml index c392fc9e..80abb86c 100644 --- a/services/wallos/compose.yaml +++ b/services/wallos/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,10 +47,10 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - TZ=${TZ} @@ -60,10 +60,5 @@ services: depends_on: tailscale: condition: service_healthy - healthcheck: - test: ["CMD", "pgrep", "-f", "nginx"] # Check if ${SERVICE} process is running - interval: 1m # How often to perform the check - timeout: 10s # Time to wait for the check to succeed - retries: 3 # Number of retries before marking as unhealthy - start_period: 30s # Time to wait before starting health checks - restart: always + # Healthcheck: defined by the image (curl against /health.php), so this file does not override it. + restart: always diff --git a/services/xwiki/.env b/services/xwiki/.env index c5af4187..5f752538 100644 --- a/services/xwiki/.env +++ b/services/xwiki/.env @@ -11,7 +11,8 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones @@ -20,7 +21,7 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" # Default environment values XWIKI_VERSION=18.2.1 diff --git a/services/xwiki/compose.yml b/services/xwiki/compose.yaml similarity index 70% rename from services/xwiki/compose.yml rename to services/xwiki/compose.yaml index 8e919ca6..7948f8a2 100644 --- a/services/xwiki/compose.yml +++ b/services/xwiki/compose.yaml @@ -9,7 +9,7 @@ configs: services: # Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,10 +35,10 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:8080 # Binding the host port to XWiki's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - # dns: - # - ${DNS_SERVER} + #dns: + # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational interval: 1m # How often to perform the check @@ -47,24 +47,31 @@ services: start_period: 10s # Time to wait before starting health checks restart: always -# ${SERVICE} +# Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management depends_on: tailscale: condition: service_healthy db: - condition: service_started - environment: # Varibles are delared in .env file. + condition: service_healthy + environment: # Variables are declared in .env file. - XWIKI_VERSION=${XWIKI_VERSION} - DB_USER=${DB_USER} - DB_PASSWORD=${DB_PASSWORD} - DB_DATABASE=${DB_DATABASE} - DB_HOST=db-${SERVICE} + - TZ=${TZ} volumes: - ./${SERVICE}-data/xwiki:/usr/local/xwiki + healthcheck: + test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8080/rest/"] # Check if the service is responding + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 120s # Time to wait before starting health checks restart: always db: image: "mariadb:12" @@ -83,4 +90,10 @@ services: - "--character-set-server=utf8mb4" - "--collation-server=utf8mb4_bin" - "--explicit-defaults-for-timestamp=1" + healthcheck: + test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"] # Check if MariaDB accepts TCP connections and InnoDB is initialized + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks restart: always diff --git a/templates/service-template/.env b/templates/service-template/.env index ad96b14c..2b2ad66b 100644 --- a/templates/service-template/.env +++ b/templates/service-template/.env @@ -3,22 +3,26 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE= # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). -IMAGE_URL= # Docker image URL from container registry (e.g., adguard/adguard-home). +# Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). +SERVICE= +# Docker image URL from container registry (e.g., adguard/adguard-home). +IMAGE_URL= # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/templates/service-template/README.md b/templates/service-template/README.md index 58af12c9..7ceac722 100644 --- a/templates/service-template/README.md +++ b/templates/service-template/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [SERVICE](LINK TO PAGE OF MAINTAINER) ## Configuration Overview -In this setup, the `tailscale-SERVICE` service runs Tailscale, which manages secure networking for SERVICE. The `SERVICE` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale` service (container `tailscale-SERVICE`) runs Tailscale, which manages secure networking for SERVICE. The `application` service (container `app-SERVICE`) uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## What to document for users diff --git a/templates/service-template/compose.yaml b/templates/service-template/compose.yaml index 03fd6370..33734d16 100644 --- a/templates/service-template/compose.yaml +++ b/templates/service-template/compose.yaml @@ -8,8 +8,8 @@ configs: "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: -# Make sure you have updated/checked the .env file with the correct variables. -# All the ${ xx } need to be defined there. +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there. # Tailscale Sidecar Configuration tailscale: image: tailscale/tailscale:latest # Image to be used @@ -22,7 +22,7 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve - TS_AUTH_ONCE=true configs: - source: ts-serve @@ -35,9 +35,9 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: + #dns: # - ${DNS_SERVER} healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational @@ -47,23 +47,38 @@ services: start_period: 10s # Time to wait before starting health checks restart: always - # ${SERVICE} + # Application application: image: ${IMAGE_URL} # Image to be used - network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale container_name: app-${SERVICE} # Name for local container management - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. - PUID=1000 - PGID=1000 - TZ=${TZ} - #- EXAMPLE_VAR=${EXAMPLE_VAR} + #- EXAMPLE_VAR=${EXAMPLE_VAR} volumes: - ./${SERVICE}-data/app/config:/config depends_on: tailscale: condition: service_healthy + # Healthcheck: use the first option the image supports, and test it inside the running container. + # 1. The image defines its own HEALTHCHECK: remove this block and replace it with + # "# Healthcheck: defined by the image (), so this file does not override it." + # Override it only when it does not work with this stack, and say why in a comment. + # 2. An application endpoint, called with a client the image ships (wget, curl, python3, or node). + # 3. A health command that ships with the image, such as `/app/binary healthcheck`. + # 4. A fixed process name, with `pidof ` or `pgrep -x `, when the container has no endpoint + # or the image has no HTTP client. `pgrep -x` matches at most 15 characters of the name. + # When the process name is generic, such as python, use `pgrep -f `. + # 5. The image has no shell, HTTP client, or health command (for example Portainer and RustDesk): + # no check is possible. Remove this block and replace it with + # "# Healthcheck: none possible. The image contains only , with no shell, HTTP client, or health command." + # A container that runs once and exits needs no check. Remove this block and replace it with + # "# Healthcheck: none needed. ." + # Avoid `pgrep -f ${SERVICE}`: it breaks when SERVICE is renamed, and many images do not include pgrep. healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:80/"] # Check if the service is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy