docker-compose.yml

version: "3.9"
name: homecloud

networks:
  default:
    name: homecloud
    external: true

services:
  whoami:
    container_name: homecloud_whoami
    profiles: ["coreservices"]
    image: traefik/whoami
    restart: unless-stopped
    expose:
      - 80
    deploy:
      resources:
        limits:
          memory: 8M
        reservations:
          memory: 8M

  lb:
    container_name: homecloud_lb
    profiles: ["coreservices"]
    image: axistools/nginx-ldap:alpine
    restart: unless-stopped
    healthcheck:
      test: curl --fail http://localhost/ || exit 1
      start_period: 2m
      interval: 60s
      retries: 5
      timeout: 5s
    deploy:
      resources:
        limits:
          memory: 128M
        reservations:
          memory: 32M
    depends_on:
      - whoami
      - authentikapp
      - nextcloudweb

  mariadb:
    container_name: homecloud_mariadb
    profiles: ["dbonly", "coreservices"]
    image: mariadb:10
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 128M
    expose:
      - 3306
    secrets:
      - mariadb_root_password
    environment:
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/mariadb_root_password
      MARIADB_AUTO_UPGRADE: "yes"
    healthcheck:
      test: mariadb-admin ping -h 127.0.0.1 -uroot -p$$(cat $$MYSQL_ROOT_PASSWORD_FILE)
      start_period: 30s
      interval: 60s
      retries: 5
      timeout: 10s

  postgres:
    container_name: homecloud_postgres
    profiles: ["dbonly", "coreservices"]
    image: postgres:15-alpine
    restart: unless-stopped
    secrets:
      - postgres_psql_password
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_psql_password
    expose:
      - 5432
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 256M
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      start_period: 30s
      interval: 30s
      retries: 5
      timeout: 10s

  redis:
    container_name: homecloud_redis
    profiles: ["coreservices", "dbonly"]
    image: redis
    command: redis-server --save 300 1 --loglevel warning #--requirepass eYVX7EwVmmxKPCDmwMtyKVge8oLd2t81
    restart: unless-stopped
    expose:
      - 6379
    healthcheck:
      test: [ "CMD", "redis-cli", "--raw", "incr", "ping" ]
      start_period: 30s
      interval: 30s
      retries: 5
      timeout: 5s
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 128M

  authentikapp:
    container_name: homecloud_authentikapp
    profiles: ["coreservices"]
    image: ghcr.io/goauthentik/server:2023.10
    restart: unless-stopped
    command: server
    expose:
      - 9000
      - 9443
    secrets:
      - postgres_authentik_password
      - authentik_secret_key
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_REDIS__DB: 1
      AUTHENTIK_POSTGRESQL__HOST: postgres
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_authentik_password
      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
      AUTHENTIK_ERROR_REPORTING__ENABLED: false
      AUTHENTIK_LOG_LEVEL: error
      AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: false
    depends_on:
      - postgres
      - redis
    deploy:
      resources:
        limits:
          memory: 640M
        reservations:
          memory: 128M

  authentikworker:
    container_name: homecloud_authentikworker
    profiles: ["coreservices"]
    image: ghcr.io/goauthentik/server:2023.10
    restart: unless-stopped
    command: worker
    secrets:
      - postgres_authentik_password
      - authentik_secret_key
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_REDIS__DB: 1
      AUTHENTIK_POSTGRESQL__HOST: postgres
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/postgres_authentik_password
      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
      AUTHENTIK_ERROR_REPORTING__ENABLED: false
      AUTHENTIK_LOG_LEVEL: error
      AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: false
    # `user: root` and the docker socket volume are optional.
    # See more for the docker socket integration here:
    # https://goauthentik.io/docs/outposts/integrations/docker
    # Removing `user: root` also prevents the worker from fixing the permissions
    # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
    # (1000:1000 by default)
    user: root
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      - postgres
      - redis
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 256M

  nextcloudapp:
    container_name: homecloud_nextcloudapp
    profiles: ["coreservices"]
    image: nextcloud:31-fpm-alpine
    restart: unless-stopped
    healthcheck:
      test: nc -z postgres 5432 || nc -z 127.0.0.1 9000 || exit 1
      start_period: 2m
      interval: 60s
      retries: 5
      timeout: 5s
    secrets:
      - postgres_nextcloud_password
      - nextcloud_admin_password
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_DB: nextcloud
      POSTGRES_USER: nextcloud
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_nextcloud_password
      REDIS_HOST: redis
      NEXTCLOUD_ADMIN_USER: admin
      NEXTCLOUD_ADMIN_PASSWORD_FILE: /run/secrets/nextcloud_admin_password
      PHP_UPLOAD_LIMIT: 10G
    depends_on:
      - postgres
      - redis
    deploy:
      resources:
        limits:
          memory: 4G
        reservations:
          memory: 256M

  nextcloudweb:
    container_name: homecloud_nextcloudweb
    profiles: ["coreservices"]
    image: nginx:alpine
    restart: unless-stopped
    healthcheck:
      test: curl --fail http://localhost/ || exit 1
      start_period: 1m
      interval: 60s
      retries: 5
      timeout: 5s
    depends_on:
      - nextcloudapp
    deploy:
      resources:
        limits:
          memory: 128M
        reservations:
          memory: 32M

  nextcloudcron:
    container_name: homecloud_nextcloudcron
    profiles: ["coreservices"]
    image: nextcloud:31-fpm-alpine
    restart: unless-stopped
    entrypoint: /cron.sh
    depends_on:
      - nextcloudapp
      - postgres
      - redis
    deploy:
      resources:
        limits:
          memory: 256M
        reservations:
          memory: 128M

  talk:
    container_name: homecloud_talk
    profiles: ["talk"]
    image: nextcloud/aio-talk
    restart: unless-stopped
    ports:
      - 3478:3478/tcp
      - 3478:3478/udp
    environment:
      TZ: "Asia/Singapore"
      TALK_PORT: 3478
    deploy:
      resources:
        limits:
          memory: 256M
        reservations:
          memory: 128M

  code:
    container_name: homecloud_code
    profiles: ['code']
    image: collabora/code
    restart: unless-stopped
    expose:
      - 9980
    environment:
      TZ: "Asia/Singapore"
      dictionaries: en_US
    deploy:
      resources:
        limits:
          memory: 2G
        reservations:
          memory: 256M

  imaginary:
    container_name: homecloud_imaginary
    profiles: ["coreservices"]
    image: nextcloud/aio-imaginary:latest
    restart: unless-stopped
    expose:
      - 9000
    environment:
      TZ: "Asia/Singapore"
    deploy:
      resources:
        limits:
          memory: 4G
        reservations:
          memory: 128M

  clamav:
    container_name: homecloud_clamav
    profiles: ["clamav"]
    image: nextcloud/aio-clamav
    restart: unless-stopped
    expose:
      - 3310
    environment:
      TZ: "Asia/Singapore"
      CLAMD_STARTUP_TIMEOUT: 90
    deploy:
      resources:
        limits:
          memory: 4G
        reservations:
          memory: 3G

  elasticsearch:
    container_name: homecloud_elasticsearch
    profiles: ["coreservices"]
    image: nextcloud/aio-fulltextsearch
    init: false
    restart: unless-stopped
    expose:
      - 9200
    secrets:
      - elasticsearch_elastic_password
    environment:
      TZ: "Asia/Singapore"
      cluster.name: homecloud
      discovery.type: single-node
      http.port: 9200
      ES_JAVA_OPTS: -Xms1024M -Xmx1024M
      logger.org.elasticsearch.discovery: WARN
      bootstrap.memory_lock: true
      xpack.license.self_generated.type: basic
      xpack.security.enabled: true
      xpack.security.audit.enabled: true
      ELASTIC_PASSWORD_FILE: /run/secrets/elasticsearch_elastic_password
    deploy:
      resources:
        limits:
          memory: 2G
        reservations:
          memory: 256M

  calibreweb:
    container_name: homecloud_calibreweb
    profiles: ["calibreweb"]
    image: lscr.io/linuxserver/calibre-web
    healthcheck:
      test: curl --fail http://localhost:8083/ || exit 1
    restart: unless-stopped
    secrets:
      - calibreweb_admin_password
    expose:
      - 8083
    environment:
      TZ: "Asia/Singapore"
      FILE__PASSWORD: /run/secrets/calibreweb_admin_password
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 128M

  jellyfin:
    container_name: homecloud_jellyfin
    profiles: ["jellyfin"]
    image: lscr.io/linuxserver/jellyfin
    healthcheck:
      test: curl --fail http://localhost:8096/ || exit 1
    restart: unless-stopped
    expose:
      - 8096
    environment:
      TZ: "Asia/Singapore"
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 128M

  bookstack:
    container_name: homecloud_bookstack
    profiles: ["bookstack"]
    image: lscr.io/linuxserver/bookstack
    restart: unless-stopped
    secrets:
      - mariadb_bookstack_password
    environment:
      PUID: 1000
      PGID: 1000
      DB_HOST: mariadb
      DB_PORT: 3306
      DB_USER: bookstack
      DB_DATABASE: bookstack
      FILE__DB_PASS: /run/secrets/mariadb_bookstack_password
    expose:
      - 80
    depends_on:
      - mariadb
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 128M