From 52c02beb3d91a177aa13d0037d7f9716dfabb46f Mon Sep 17 00:00:00 2001 From: Lucas Media Date: Mon, 12 Oct 2026 18:10:41 +0000 Subject: [PATCH] mediahost docker backup add gite to shared proxy add usb dev and NET privilige to HA add immich image server remove sonarr-en add jackett indexer for ABB add gluetun-proxy for general proxy add blackbox exporter to check https sites set node-exporter to network host to see interface traffic decrease resolution of cadvisor to save RAM add status and code SANs for nginx add upstream block so sites are not redirecte to cloud... add homeassistant config add nginx exporter for prometheus --- .../mediahost/gitea/docker-compose.yaml | 8 +- .../homeassistant/docker-compose.yaml | 5 + .../mediahost/immich/docker-compose.yaml | 81 ++++++++++ .../mediahost/jellyfin/docker-compose.yaml | 2 +- .../mediahost/mediaarr/docker-compose.yaml | 59 +++++--- .../mediahost/mediaarr/gluetun-proxy/wg0.conf | 11 ++ .../mediahost/monitoring/blackbox.yml | 8 + .../mediahost/monitoring/docker-compose.yaml | 30 +++- .../mediahost/monitoring/prometheus.yml | 50 ++++++- .../mediahost/navidrome/docker-compose.yaml | 1 + .../mediahost/nginx/conf.d/reverseProxy.conf | 140 +++++++++++++----- .../mediahost/nginx/docker-compose.yaml | 22 ++- .../mediahost/redis/docker-compose.yaml | 2 +- 13 files changed, 345 insertions(+), 74 deletions(-) create mode 100644 docker_compose/mediahost/immich/docker-compose.yaml create mode 100644 docker_compose/mediahost/mediaarr/gluetun-proxy/wg0.conf create mode 100644 docker_compose/mediahost/monitoring/blackbox.yml diff --git a/docker_compose/mediahost/gitea/docker-compose.yaml b/docker_compose/mediahost/gitea/docker-compose.yaml index aa75d76..497021a 100644 --- a/docker_compose/mediahost/gitea/docker-compose.yaml +++ b/docker_compose/mediahost/gitea/docker-compose.yaml @@ -16,4 +16,10 @@ services: - /data/gitea:/data - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro - + networks: + - default + - shared-proxy-services +networks: + default: + shared-proxy-services: + external: true diff --git a/docker_compose/mediahost/homeassistant/docker-compose.yaml b/docker_compose/mediahost/homeassistant/docker-compose.yaml index 585bef7..c106a76 100644 --- a/docker_compose/mediahost/homeassistant/docker-compose.yaml +++ b/docker_compose/mediahost/homeassistant/docker-compose.yaml @@ -9,6 +9,11 @@ services: TZ: Europe/Vienna volumes: - /srv/homeassistant:/config + devices: + - /dev/bus/usb:/dev/bus/usb + cap_add: + - NET_ADMIN + - NET_RAW mosquitto: container_name: mosquitto diff --git a/docker_compose/mediahost/immich/docker-compose.yaml b/docker_compose/mediahost/immich/docker-compose.yaml new file mode 100644 index 0000000..cbf38a0 --- /dev/null +++ b/docker_compose/mediahost/immich/docker-compose.yaml @@ -0,0 +1,81 @@ +# +# WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose +# +# Make sure to use the docker-compose.yml of the current release: +# +# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml +# +# The compose file on main may not be compatible with the latest release. + +name: immich + +services: + immich-server: + container_name: immich_server + image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} + # extends: + # file: hwaccel.transcoding.yml + # service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding + volumes: + # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file + - ${UPLOAD_LOCATION}:/data + - /data/immich/pictures:/libary + - /etc/localtime:/etc/localtime:ro + env_file: + - .env + ports: + - '2283:2283' + depends_on: + - database + restart: always + healthcheck: + disable: false + networks: + - immich + - shared-redis-services + + immich-machine-learning: + container_name: immich_machine_learning + # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag. + # Example tag: ${IMMICH_VERSION:-release}-cuda + image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release} + # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration + # file: hwaccel.ml.yml + # service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable + volumes: + - model-cache:/cache + env_file: + - .env + restart: always + healthcheck: + disable: false + networks: + - immich + + database: + container_name: immich_postgres + image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23 + environment: + POSTGRES_PASSWORD: ${DB_PASSWORD} + POSTGRES_USER: ${DB_USERNAME} + POSTGRES_DB: ${DB_DATABASE_NAME} + POSTGRES_INITDB_ARGS: '--data-checksums' + # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs + # DB_STORAGE_TYPE: 'HDD' + volumes: + # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file + - ${DB_DATA_LOCATION}:/var/lib/postgresql/data + shm_size: 128mb + restart: always + healthcheck: + disable: false + networks: + - immich + +volumes: + model-cache: +networks: + immich: + shared-redis-services: + external: true + diff --git a/docker_compose/mediahost/jellyfin/docker-compose.yaml b/docker_compose/mediahost/jellyfin/docker-compose.yaml index 3a106be..7bea011 100644 --- a/docker_compose/mediahost/jellyfin/docker-compose.yaml +++ b/docker_compose/mediahost/jellyfin/docker-compose.yaml @@ -15,7 +15,6 @@ services: networks: - default - shared-proxy-services - seerr: image: ghcr.io/seerr-team/seerr:latest container_name: seerr @@ -29,6 +28,7 @@ services: networks: - default - shared-proxy-services + networks: default: external: true diff --git a/docker_compose/mediahost/mediaarr/docker-compose.yaml b/docker_compose/mediahost/mediaarr/docker-compose.yaml index 763b62e..3e6b79a 100644 --- a/docker_compose/mediahost/mediaarr/docker-compose.yaml +++ b/docker_compose/mediahost/mediaarr/docker-compose.yaml @@ -1,22 +1,5 @@ services: - sonarr-en: - image: lscr.io/linuxserver/sonarr:latest - container_name: sonarr-en - restart: unless-stopped - ports: - - "8989:8989" - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Berlin - volumes: - - ./sonarr_EN:/config - - /data/jellyfin/media/series-english:/JellyfinSeriesEnglish - - /data/jellyfin/media/anime-english:/JellyfinAnimeEnglish - - /data/jellyfin/media/documentaries-english:/JellyfinDocus - - /data/jellyfin/buffer:/buffer - - /torrent/qbittorrent/downloads:/downloads sonarr-de: image: lscr.io/linuxserver/sonarr:latest container_name: sonarr-de @@ -31,10 +14,13 @@ services: - ./sonarr_DE:/config - /data/jellyfin/media/series-german:/JellyfinSeriesGerman - /data/jellyfin/media/anime-german:/JellyfinAnimeGerman + - /data/jellyfin/media/series-english:/JellyfinSeriesEnglish + - /data/jellyfin/media/anime-english:/JellyfinAnimeEnglish + - /data/jellyfin/media/documentaries-english:/JellyfinDocus - /data/jellyfin/media/series-kids:/JellyfinKinder - /data/jellyfin/buffer:/buffer - /torrent/qbittorrent/downloads:/downloads - - /torrent/rundfunkarr:/downloads-rundfunkarr + - /torrent/rundfunkarr-de:/downloads-rundfunkarr radarr-en: image: lscr.io/linuxserver/radarr:latest container_name: radarr-en @@ -67,7 +53,7 @@ services: - /data/jellyfin/media/movies-kids:/JellyfinKinder - /data/jellyfin/buffer:/buffer - /torrent/qbittorrent/downloads:/downloads - - /torrent/rundfunkarr:/downloads-rundfunkarr + - /torrent/rundfunkarr-de:/downloads-rundfunkarr prowlarr: image: lscr.io/linuxserver/prowlarr:latest container_name: prowlarr @@ -177,7 +163,7 @@ services: - TZ=Europe/Berlin volumes: - ./lidarr:/config - - /data/navidrome/music:/music + - /data/navidrome/music/music:/music - /torrent/qbittorrent/downloads:/downloads ports: @@ -261,14 +247,43 @@ services: - /data/jellyfin/media/comedy-english:/data/comedy-english:ro - /data/jellyfin/media/movies-german:/data/movies-german:ro - /data/jellyfin/media/movies-kids:/data/movies-kids:ro -# - /data/audiobookshelf/podcasts:/podcasts -# - /data/audiobookshelf/audiobooks-englisch:/audiobooks - /data/navidrome/music:/data/music:ro - /data/audiobookshelf/data/audiobooks-englisch:/data/audiobooks-english:ro - /data/audiobookshelf/data/audiobooks-deutsch:/data/audiobooks-german:ro - /data/audiobookshelf/data/audiobooks-kinder:/data/audiobooks-kinder:ro # Download location - /torrent/qbittorrent/downloads:/downloads + jackett: + image: lscr.io/linuxserver/jackett:latest + container_name: jackett + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Vienna + volumes: + - ./jackett/config:/config + - ./jackett/downloads:/downloads + ports: + - "9117:9117" + restart: unless-stopped + gluetun-proxy: + image: qmcgaw/gluetun:latest + container_name: gluetun-proxy + cap_add: + - NET_ADMIN + ports: + - "8889:8888" # HTTP proxy + - "8388:8388" # SOCKS5 proxy + volumes: + - ./gluetun-proxy:/gluetun/wireguard + - /dev/net/tun:/dev/net/tun + environment: + - VPN_SERVICE_PROVIDER=custom + - VPN_TYPE=wireguard + - SOCKS5_ENABLED=on + - HTTPPROXY=on + - SOCKSPROXY=on + restart: unless-stopped networks: default: diff --git a/docker_compose/mediahost/mediaarr/gluetun-proxy/wg0.conf b/docker_compose/mediahost/mediaarr/gluetun-proxy/wg0.conf new file mode 100644 index 0000000..4cef4f3 --- /dev/null +++ b/docker_compose/mediahost/mediaarr/gluetun-proxy/wg0.conf @@ -0,0 +1,11 @@ +# +# Use this configuration with WireGuard client +# +[Interface] +Address = 10.14.0.2/16 +PrivateKey = mKeDQdxtM1iFJS7WLlb2jPGabZIt3NkoA/nGCcNOU1I= +DNS = 162.252.172.57, 149.154.159.92 +[Peer] +PublicKey = dPZe8Jq3Hu0k07MDk+Y4+AS2XHSLYalyg91TSFXRYEA= +AllowedIPs = 0.0.0.0/0 +Endpoint = 87.249.133.4:51820 diff --git a/docker_compose/mediahost/monitoring/blackbox.yml b/docker_compose/mediahost/monitoring/blackbox.yml new file mode 100644 index 0000000..1b74093 --- /dev/null +++ b/docker_compose/mediahost/monitoring/blackbox.yml @@ -0,0 +1,8 @@ +modules: + http_2xx: + prober: http + timeout: 5s + http: + valid_status_codes: [] + method: GET + preferred_ip_protocol: ip4 diff --git a/docker_compose/mediahost/monitoring/docker-compose.yaml b/docker_compose/mediahost/monitoring/docker-compose.yaml index a2bc6ee..71d284f 100644 --- a/docker_compose/mediahost/monitoring/docker-compose.yaml +++ b/docker_compose/mediahost/monitoring/docker-compose.yaml @@ -8,6 +8,9 @@ services: volumes: - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro - prometheus-data:/prometheus + networks: + - default + - shared-proxy-services grafana: image: grafana/grafana:latest @@ -47,9 +50,9 @@ services: volumes: - '/:/host:ro,rslave' - ./node_exporter/textfile_collector:/textfile:ro - ports: - - '9100:9100' - +# ports: +# - '9100:9100' + network_mode: host cadvisor: image: gcr.io/cadvisor/cadvisor:latest container_name: cadvisor @@ -58,9 +61,24 @@ services: - "8080:8080" volumes: - /:/rootfs:ro - - /data:/data:ro - - /docker:/docker:ro - +# - /data:/data:ro +# - /docker:/docker:ro + - /var/run:/var/run:ro + - /sys:/sys:ro + - /var/lib/docker:/var/lib/docker:ro + command: + - "--disable_metrics=percpu,tcp,udp,process,sched" + - "--housekeeping_interval=30s" + - "--housekeeping_interval=1m" + - "--docker_only=true" + blackbox-exporter: + image: prom/blackbox-exporter:latest + container_name: blackbox-exporter + restart: unless-stopped + ports: + - "9115:9115" + volumes: + - ./blackbox.yml:/etc/blackbox_exporter/config.yml:ro volumes: prometheus-data: grafana-data: diff --git a/docker_compose/mediahost/monitoring/prometheus.yml b/docker_compose/mediahost/monitoring/prometheus.yml index 2e72443..bc4cf00 100644 --- a/docker_compose/mediahost/monitoring/prometheus.yml +++ b/docker_compose/mediahost/monitoring/prometheus.yml @@ -1,6 +1,6 @@ global: - scrape_interval: 15s - evaluation_interval: 15s + scrape_interval: 30s + evaluation_interval: 30s scrape_configs: @@ -8,6 +8,35 @@ scrape_configs: static_configs: - targets: - "prometheus:9090" + - job_name: "nginx" + static_configs: + - targets: + - nginx-exporter:9113 + - job_name: blackbox_https + metrics_path: /probe + params: + module: [http_2xx] + + static_configs: + - targets: + - https://cloud.someoneslinux.selfhost.eu + - https://media.someoneslinux.selfhost.eu + - https://audiobooks.someoneslinux.selfhost.eu +# - https://login.someoneslinux.selfhost.eu + - https://auto.someoneslinux.selfhost.eu + - https://music.someoneslinux.selfhost.eu + - https://passwd.someoneslinux.selfhost.eu + - https://requests.someoneslinux.selfhost.eu + - https://torrent.someoneslinux.selfhost.eu + - https://status.someoneslinux.selfhost.eu + + relabel_configs: + - source_labels: [__address__] + target_label: __param_target + - source_labels: [__param_target] + target_label: instance + - target_label: __address__ + replacement: blackbox-exporter:9115 - job_name: "node-exporter" static_configs: @@ -16,20 +45,33 @@ scrape_configs: labels: host: serverhost - targets: - - "node-exporter:9100" + - "192.168.0.4:9100" labels: host: "mediahost" - + - targets: + - "192.168.0.39:9100" + labels: + host: "quiethost" - job_name: "cadvisor" static_configs: - targets: - "cadvisor:8080" + labels: + host: mediahost + - targets: + - "192.168.0.2:8081" + labels: + host: serverhost - job_name: "smartctl" static_configs: - targets: - "192.168.0.2:9633" labels: host: serverhost + - targets: + - "192.168.0.39:9633" + labels: + host: "quiethost" - targets: - "192.168.0.4:9633" labels: diff --git a/docker_compose/mediahost/navidrome/docker-compose.yaml b/docker_compose/mediahost/navidrome/docker-compose.yaml index 88e7fe3..c321aa0 100755 --- a/docker_compose/mediahost/navidrome/docker-compose.yaml +++ b/docker_compose/mediahost/navidrome/docker-compose.yaml @@ -23,6 +23,7 @@ services: - /data/navidrome/music/kamerun:/kamerun:ro - /data/navidrome/music/weihnachten:/weihnachten:ro - /data/navidrome/music/playlists:/playlists:ro + - /data/navidrome/music/playlists-export:/playlists-export networks: - shared-proxy-services - default diff --git a/docker_compose/mediahost/nginx/conf.d/reverseProxy.conf b/docker_compose/mediahost/nginx/conf.d/reverseProxy.conf index 534ba70..efcd236 100644 --- a/docker_compose/mediahost/nginx/conf.d/reverseProxy.conf +++ b/docker_compose/mediahost/nginx/conf.d/reverseProxy.conf @@ -17,7 +17,8 @@ server { passwd.someoneslinux.selfhost.eu requests.someoneslinux.selfhost.eu torrent.someoneslinux.selfhost.eu - status.someoneslinux.selfhost.eu; + status.someoneslinux.selfhost.eu + code.someoneslinux.selfhost.eu; #ssl_conf_command Groups X25519:secp256r1:secp384r1; # ssl_conf_command Groups X25519:prime256v1:secp384r1; location /.well-known/acme-challenge/ { @@ -27,12 +28,28 @@ server { location / { return 301 https://$host$request_uri; + + } + + listen 8080; + location /nginx_status { + stub_status; + allow 172.16.0.0/12; + deny all; } } # Common SSL settings ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; +server { + listen 443 ssl default_server; + server_name _; + + ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem; + ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem; + return 404; +} ################### # NEXTCLOUD @@ -51,6 +68,8 @@ server { location / { proxy_pass http://nextcloud:80; + # Do not try another upstream on errors + proxy_next_upstream off; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -76,6 +95,8 @@ server { location / { proxy_pass http://jellyfin:8096; + # Do not try another upstream on errors + proxy_next_upstream off; proxy_http_version 1.1; proxy_set_header Host $host; @@ -103,6 +124,8 @@ server { location / { proxy_pass http://audiobookshelf:80; + # Do not try another upstream on errors + proxy_next_upstream off; proxy_http_version 1.1; proxy_set_header Host $host; @@ -112,40 +135,14 @@ server { } } -################### -# AUTHENTIK -################### -server { - listen 443 ssl;http2 on; - server_name login.someoneslinux.selfhost.eu; - - add_header Content-Security-Policy "frame-ancestors 'self';" always; - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-Content-Type-Options "nosniff" always; - add_header Referrer-Policy "strict-origin-when-cross-origin" always; - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; - - ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem; - ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem; - - location / { - proxy_pass http://authentik-server-1:9000; - proxy_http_version 1.1; - - proxy_set_header X-Forwarded-Proto https; - proxy_set_header X-Forwarded-Host $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - } -} - #################### -## HOME ASSISTANT +## AUTHENTIK #################### #server { # listen 443 ssl;http2 on; -# server_name auto.someoneslinux.selfhost.eu; +# server_name login.someoneslinux.selfhost.eu; # -# add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always; +# add_header Content-Security-Policy "frame-ancestors 'self';" always; # add_header X-Frame-Options "SAMEORIGIN" always; # add_header X-Content-Type-Options "nosniff" always; # add_header Referrer-Policy "strict-origin-when-cross-origin" always; @@ -155,17 +152,45 @@ server { # ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem; # # location / { -# proxy_pass http://192.168.0.4:8123; +# proxy_pass http://authentik-server-1:9000; # proxy_http_version 1.1; -# -# proxy_set_header Host $host; -# proxy_set_header Upgrade $http_upgrade; -# proxy_set_header Connection $connection_upgrade; -# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +# # proxy_set_header X-Forwarded-Proto https; +# proxy_set_header X-Forwarded-Host $host; +# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # } #} +################### +# HOME ASSISTANT +################### +server { + listen 443 ssl;http2 on; + server_name auto.someoneslinux.selfhost.eu; + +# add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + + ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem; + ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem; + + location / { + proxy_pass http://192.168.0.4:8123; + # Do not try another upstream on errors + proxy_next_upstream off; + proxy_http_version 1.1; + + proxy_set_header Host $host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + } +} + ################### # NAVIDROME ################### @@ -184,6 +209,8 @@ server { location / { proxy_pass http://navidrome:4533; + # Do not try another upstream on errors + proxy_next_upstream off; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Real-IP $remote_addr; @@ -208,6 +235,8 @@ server { location / { proxy_pass http://vaultwarden:80; + # Do not try another upstream on errors + proxy_next_upstream off; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; @@ -216,6 +245,8 @@ server { location /notifications/hub { proxy_pass http://vaultwarden:3012; + # Do not try another upstream on errors + proxy_next_upstream off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; @@ -240,6 +271,8 @@ server { location / { proxy_pass http://seerr:5055; + # Do not try another upstream on errors + proxy_next_upstream off; proxy_http_version 1.1; proxy_set_header Host $host; @@ -268,6 +301,8 @@ server { location / { proxy_pass http://192.168.0.2:8080; + # Do not try another upstream on errors + proxy_next_upstream off; proxy_http_version 1.1; proxy_set_header Host $host; @@ -275,6 +310,7 @@ server { proxy_set_header Connection $connection_upgrade; proxy_set_header X-Forwarded-Proto https; } + } ################### @@ -294,6 +330,8 @@ server { location / { proxy_pass http://grafana:3000; + # Do not try another upstream on errors + proxy_next_upstream off; proxy_http_version 1.1; proxy_set_header Host $host; @@ -302,3 +340,33 @@ server { proxy_set_header X-Forwarded-Proto https; } } + +################### +# GITEA +################### +server { + listen 443 ssl;http2 on; + server_name code.someoneslinux.selfhost.eu; + + add_header Content-Security-Policy "frame-ancestors 'self';" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + + ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem; + ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem; + + location / { + proxy_pass http://gitea:3000; + # Do not try another upstream on errors + proxy_next_upstream off; + proxy_http_version 1.1; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + } +} diff --git a/docker_compose/mediahost/nginx/docker-compose.yaml b/docker_compose/mediahost/nginx/docker-compose.yaml index 693f30d..e58f6fc 100644 --- a/docker_compose/mediahost/nginx/docker-compose.yaml +++ b/docker_compose/mediahost/nginx/docker-compose.yaml @@ -3,11 +3,9 @@ services: image: nginx:stable container_name: nginx restart: unless-stopped - ports: - "80:80" - "443:443" - volumes: - ./conf.d:/etc/nginx/conf.d - ./certs:/etc/nginx/certs @@ -15,8 +13,23 @@ services: # Access and error logs - ./logs:/var/log/nginx networks: + - default - shared-proxy-services + nginx-exporter: + image: nginx/nginx-prometheus-exporter:latest + container_name: nginx-exporter + restart: unless-stopped + command: + - --nginx.scrape-uri=http://nginx:8080/nginx_status + ports: + - "9113:9113" + depends_on: + - nginx + networks: + - default + - shared-proxy-services + crowdsec: image: crowdsecurity/crowdsec:latest container_name: crowdsec @@ -29,7 +42,8 @@ services: - crowdsec-db:/var/lib/crowdsec/data - ./logs:/var/log/nginx:ro - /etc/localtime:/etc/localtime:ro - + networks: + - default certbot: image: certbot/certbot:latest @@ -41,7 +55,9 @@ services: - shared-proxy-services networks: + default: shared-proxy-services: external: true + volumes: crowdsec-db: diff --git a/docker_compose/mediahost/redis/docker-compose.yaml b/docker_compose/mediahost/redis/docker-compose.yaml index e388045..9c4c9c4 100644 --- a/docker_compose/mediahost/redis/docker-compose.yaml +++ b/docker_compose/mediahost/redis/docker-compose.yaml @@ -3,7 +3,7 @@ services: image: redis:7 container_name: redis restart: unless-stopped - command: redis-server --appendonly yes --requirepass PerCent7heStorySp0tInOrd3r + command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD} healthcheck: test: