lucas/Server-scripts
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mediahost docker backup

Browse Source 
add gite to shared proxy
add usb dev and NET privilige to HA
add immich image server
remove sonarr-en
add jackett indexer for ABB
add gluetun-proxy for general proxy
add blackbox exporter to check https sites
set node-exporter to network host to see interface traffic
decrease resolution of cadvisor to save RAM
add status and code SANs for nginx
add upstream block so sites are not redirecte to cloud...
add homeassistant config
add nginx exporter for prometheus
This commit is contained in:
lucas committed 2026-10-12 18:10:41 +00:00
1 parent 3f14f53184
commit 52c02beb3d
13 files changed
+345 -74
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docker_compose/mediahost/gitea/docker-compose.yaml
+7 -1
View File
@@ -16,4 +16,10 @@ services:
- /data/gitea:/data - /data/gitea:/data
- /etc/timezone:/etc/timezone:ro - /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
networks:
- default
- shared-proxy-services
networks:
default:
shared-proxy-services:
external: true
docker_compose/mediahost/homeassistant/docker-compose.yaml
+5
View File
@@ -9,6 +9,11 @@ services:
TZ: Europe/Vienna TZ: Europe/Vienna
volumes: volumes:
- /srv/homeassistant:/config - /srv/homeassistant:/config
devices:
- /dev/bus/usb:/dev/bus/usb
cap_add:
- NET_ADMIN
- NET_RAW
mosquitto: mosquitto:
container_name: mosquitto container_name: mosquitto
docker_compose/mediahost/immich/docker-compose.yaml
+81
View File
@@ -0,0 +1,81 @@
#
# WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose
#
# Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.
name: immich
services:
immich-server:
container_name: immich_server
image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
# extends:
# file: hwaccel.transcoding.yml
# service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
volumes:
# Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
- ${UPLOAD_LOCATION}:/data
- /data/immich/pictures:/libary
- /etc/localtime:/etc/localtime:ro
env_file:
- .env
ports:
- '2283:2283'
depends_on:
- database
restart: always
healthcheck:
disable: false
networks:
- immich
- shared-redis-services
immich-machine-learning:
container_name: immich_machine_learning
# For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
# Example tag: ${IMMICH_VERSION:-release}-cuda
image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
# extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
# file: hwaccel.ml.yml
# service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
volumes:
- model-cache:/cache
env_file:
- .env
restart: always
healthcheck:
disable: false
networks:
- immich
database:
container_name: immich_postgres
image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
environment:
POSTGRES_PASSWORD: ${DB_PASSWORD}
POSTGRES_USER: ${DB_USERNAME}
POSTGRES_DB: ${DB_DATABASE_NAME}
POSTGRES_INITDB_ARGS: '--data-checksums'
# Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
# DB_STORAGE_TYPE: 'HDD'
volumes:
# Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
- ${DB_DATA_LOCATION}:/var/lib/postgresql/data
shm_size: 128mb
restart: always
healthcheck:
disable: false
networks:
- immich
volumes:
model-cache:
networks:
immich:
shared-redis-services:
external: true
docker_compose/mediahost/jellyfin/docker-compose.yaml
+1 -1
View File
@@ -15,7 +15,6 @@ services:
networks: networks:
- default - default
- shared-proxy-services - shared-proxy-services
seerr: seerr:
image: ghcr.io/seerr-team/seerr:latest image: ghcr.io/seerr-team/seerr:latest
container_name: seerr container_name: seerr
@@ -29,6 +28,7 @@ services:
networks: networks:
- default - default
- shared-proxy-services - shared-proxy-services
networks: networks:
default: default:
external: true external: true
docker_compose/mediahost/mediaarr/docker-compose.yaml
+37 -22
View File
@@ -1,22 +1,5 @@
services: services:
sonarr-en:
image: lscr.io/linuxserver/sonarr:latest
container_name: sonarr-en
restart: unless-stopped
ports:
- "8989:8989"
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Berlin
volumes:
- ./sonarr_EN:/config
- /data/jellyfin/media/series-english:/JellyfinSeriesEnglish
- /data/jellyfin/media/anime-english:/JellyfinAnimeEnglish
- /data/jellyfin/media/documentaries-english:/JellyfinDocus
- /data/jellyfin/buffer:/buffer
- /torrent/qbittorrent/downloads:/downloads
sonarr-de: sonarr-de:
image: lscr.io/linuxserver/sonarr:latest image: lscr.io/linuxserver/sonarr:latest
container_name: sonarr-de container_name: sonarr-de
@@ -31,10 +14,13 @@ services:
- ./sonarr_DE:/config - ./sonarr_DE:/config
- /data/jellyfin/media/series-german:/JellyfinSeriesGerman - /data/jellyfin/media/series-german:/JellyfinSeriesGerman
- /data/jellyfin/media/anime-german:/JellyfinAnimeGerman - /data/jellyfin/media/anime-german:/JellyfinAnimeGerman
- /data/jellyfin/media/series-english:/JellyfinSeriesEnglish
- /data/jellyfin/media/anime-english:/JellyfinAnimeEnglish
- /data/jellyfin/media/documentaries-english:/JellyfinDocus
- /data/jellyfin/media/series-kids:/JellyfinKinder - /data/jellyfin/media/series-kids:/JellyfinKinder
- /data/jellyfin/buffer:/buffer - /data/jellyfin/buffer:/buffer
- /torrent/qbittorrent/downloads:/downloads - /torrent/qbittorrent/downloads:/downloads
- /torrent/rundfunkarr:/downloads-rundfunkarr - /torrent/rundfunkarr-de:/downloads-rundfunkarr
radarr-en: radarr-en:
image: lscr.io/linuxserver/radarr:latest image: lscr.io/linuxserver/radarr:latest
container_name: radarr-en container_name: radarr-en
@@ -67,7 +53,7 @@ services:
- /data/jellyfin/media/movies-kids:/JellyfinKinder - /data/jellyfin/media/movies-kids:/JellyfinKinder
- /data/jellyfin/buffer:/buffer - /data/jellyfin/buffer:/buffer
- /torrent/qbittorrent/downloads:/downloads - /torrent/qbittorrent/downloads:/downloads
- /torrent/rundfunkarr:/downloads-rundfunkarr - /torrent/rundfunkarr-de:/downloads-rundfunkarr
prowlarr: prowlarr:
image: lscr.io/linuxserver/prowlarr:latest image: lscr.io/linuxserver/prowlarr:latest
container_name: prowlarr container_name: prowlarr
@@ -177,7 +163,7 @@ services:
- TZ=Europe/Berlin - TZ=Europe/Berlin
volumes: volumes:
- ./lidarr:/config - ./lidarr:/config
- /data/navidrome/music:/music - /data/navidrome/music/music:/music
- /torrent/qbittorrent/downloads:/downloads - /torrent/qbittorrent/downloads:/downloads
ports: ports:
@@ -261,14 +247,43 @@ services:
- /data/jellyfin/media/comedy-english:/data/comedy-english:ro - /data/jellyfin/media/comedy-english:/data/comedy-english:ro
- /data/jellyfin/media/movies-german:/data/movies-german:ro - /data/jellyfin/media/movies-german:/data/movies-german:ro
- /data/jellyfin/media/movies-kids:/data/movies-kids:ro - /data/jellyfin/media/movies-kids:/data/movies-kids:ro
# - /data/audiobookshelf/podcasts:/podcasts
# - /data/audiobookshelf/audiobooks-englisch:/audiobooks
- /data/navidrome/music:/data/music:ro - /data/navidrome/music:/data/music:ro
- /data/audiobookshelf/data/audiobooks-englisch:/data/audiobooks-english:ro - /data/audiobookshelf/data/audiobooks-englisch:/data/audiobooks-english:ro
- /data/audiobookshelf/data/audiobooks-deutsch:/data/audiobooks-german:ro - /data/audiobookshelf/data/audiobooks-deutsch:/data/audiobooks-german:ro
- /data/audiobookshelf/data/audiobooks-kinder:/data/audiobooks-kinder:ro - /data/audiobookshelf/data/audiobooks-kinder:/data/audiobooks-kinder:ro
# Download location # Download location
- /torrent/qbittorrent/downloads:/downloads - /torrent/qbittorrent/downloads:/downloads
jackett:
image: lscr.io/linuxserver/jackett:latest
container_name: jackett
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Vienna
volumes:
- ./jackett/config:/config
- ./jackett/downloads:/downloads
ports:
- "9117:9117"
restart: unless-stopped
gluetun-proxy:
image: qmcgaw/gluetun:latest
container_name: gluetun-proxy
cap_add:
- NET_ADMIN
ports:
- "8889:8888" # HTTP proxy
- "8388:8388" # SOCKS5 proxy
volumes:
- ./gluetun-proxy:/gluetun/wireguard
- /dev/net/tun:/dev/net/tun
environment:
- VPN_SERVICE_PROVIDER=custom
- VPN_TYPE=wireguard
- SOCKS5_ENABLED=on
- HTTPPROXY=on
- SOCKSPROXY=on
restart: unless-stopped
networks: networks:
default: default:
docker_compose/mediahost/mediaarr/gluetun-proxy/wg0.conf
+11
View File
@@ -0,0 +1,11 @@
#
# Use this configuration with WireGuard client
#
[Interface]
Address = 10.14.0.2/16
PrivateKey = mKeDQdxtM1iFJS7WLlb2jPGabZIt3NkoA/nGCcNOU1I=
DNS = 162.252.172.57, 149.154.159.92
[Peer]
PublicKey = dPZe8Jq3Hu0k07MDk+Y4+AS2XHSLYalyg91TSFXRYEA=
AllowedIPs = 0.0.0.0/0
Endpoint = 87.249.133.4:51820
docker_compose/mediahost/monitoring/blackbox.yml
+8
View File
@@ -0,0 +1,8 @@
modules:
http_2xx:
prober: http
timeout: 5s
http:
valid_status_codes: []
method: GET
preferred_ip_protocol: ip4
docker_compose/mediahost/monitoring/docker-compose.yaml
+24 -6
View File
@@ -8,6 +8,9 @@ services:
volumes: volumes:
- ./prometheus.yml:/etc/prometheus/prometheus.yml:ro - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
- prometheus-data:/prometheus - prometheus-data:/prometheus
networks:
- default
- shared-proxy-services
grafana: grafana:
image: grafana/grafana:latest image: grafana/grafana:latest
@@ -47,9 +50,9 @@ services:
volumes: volumes:
- '/:/host:ro,rslave' - '/:/host:ro,rslave'
- ./node_exporter/textfile_collector:/textfile:ro - ./node_exporter/textfile_collector:/textfile:ro
ports: # ports:
- '9100:9100' # - '9100:9100'
network_mode: host
cadvisor: cadvisor:
image: gcr.io/cadvisor/cadvisor:latest image: gcr.io/cadvisor/cadvisor:latest
container_name: cadvisor container_name: cadvisor
@@ -58,9 +61,24 @@ services:
- "8080:8080" - "8080:8080"
volumes: volumes:
- /:/rootfs:ro - /:/rootfs:ro
- /data:/data:ro # - /data:/data:ro
- /docker:/docker:ro # - /docker:/docker:ro
- /var/run:/var/run:ro
- /sys:/sys:ro
- /var/lib/docker:/var/lib/docker:ro
command:
- "--disable_metrics=percpu,tcp,udp,process,sched"
- "--housekeeping_interval=30s"
- "--housekeeping_interval=1m"
- "--docker_only=true"
blackbox-exporter:
image: prom/blackbox-exporter:latest
container_name: blackbox-exporter
restart: unless-stopped
ports:
- "9115:9115"
volumes:
- ./blackbox.yml:/etc/blackbox_exporter/config.yml:ro
volumes: volumes:
prometheus-data: prometheus-data:
grafana-data: grafana-data:
docker_compose/mediahost/monitoring/prometheus.yml
+46 -4
View File
@@ -1,6 +1,6 @@
global: global:
scrape_interval: 15s scrape_interval: 30s
evaluation_interval: 15s evaluation_interval: 30s
scrape_configs: scrape_configs:
@@ -8,6 +8,35 @@ scrape_configs:
static_configs: static_configs:
- targets: - targets:
- "prometheus:9090" - "prometheus:9090"
- job_name: "nginx"
static_configs:
- targets:
- nginx-exporter:9113
- job_name: blackbox_https
metrics_path: /probe
params:
module: [http_2xx]
static_configs:
- targets:
- https://cloud.someoneslinux.selfhost.eu
- https://media.someoneslinux.selfhost.eu
- https://audiobooks.someoneslinux.selfhost.eu
# - https://login.someoneslinux.selfhost.eu
- https://auto.someoneslinux.selfhost.eu
- https://music.someoneslinux.selfhost.eu
- https://passwd.someoneslinux.selfhost.eu
- https://requests.someoneslinux.selfhost.eu
- https://torrent.someoneslinux.selfhost.eu
- https://status.someoneslinux.selfhost.eu
relabel_configs:
- source_labels: [__address__]
target_label: __param_target
- source_labels: [__param_target]
target_label: instance
- target_label: __address__
replacement: blackbox-exporter:9115
- job_name: "node-exporter" - job_name: "node-exporter"
static_configs: static_configs:
@@ -16,20 +45,33 @@ scrape_configs:
labels: labels:
host: serverhost host: serverhost
- targets: - targets:
- "node-exporter:9100" - "192.168.0.4:9100"
labels: labels:
host: "mediahost" host: "mediahost"
- targets:
- "192.168.0.39:9100"
labels:
host: "quiethost"
- job_name: "cadvisor" - job_name: "cadvisor"
static_configs: static_configs:
- targets: - targets:
- "cadvisor:8080" - "cadvisor:8080"
labels:
host: mediahost
- targets:
- "192.168.0.2:8081"
labels:
host: serverhost
- job_name: "smartctl" - job_name: "smartctl"
static_configs: static_configs:
- targets: - targets:
- "192.168.0.2:9633" - "192.168.0.2:9633"
labels: labels:
host: serverhost host: serverhost
- targets:
- "192.168.0.39:9633"
labels:
host: "quiethost"
- targets: - targets:
- "192.168.0.4:9633" - "192.168.0.4:9633"
labels: labels:
docker_compose/mediahost/navidrome/docker-compose.yaml
+1
View File
@@ -23,6 +23,7 @@ services:
- /data/navidrome/music/kamerun:/kamerun:ro - /data/navidrome/music/kamerun:/kamerun:ro
- /data/navidrome/music/weihnachten:/weihnachten:ro - /data/navidrome/music/weihnachten:/weihnachten:ro
- /data/navidrome/music/playlists:/playlists:ro - /data/navidrome/music/playlists:/playlists:ro
- /data/navidrome/music/playlists-export:/playlists-export
networks: networks:
- shared-proxy-services - shared-proxy-services
- default - default
docker_compose/mediahost/nginx/conf.d/reverseProxy.conf
+104 -36
View File
@@ -17,7 +17,8 @@ server {
passwd.someoneslinux.selfhost.eu passwd.someoneslinux.selfhost.eu
requests.someoneslinux.selfhost.eu requests.someoneslinux.selfhost.eu
torrent.someoneslinux.selfhost.eu torrent.someoneslinux.selfhost.eu
status.someoneslinux.selfhost.eu; status.someoneslinux.selfhost.eu
code.someoneslinux.selfhost.eu;
#ssl_conf_command Groups X25519:secp256r1:secp384r1; #ssl_conf_command Groups X25519:secp256r1:secp384r1;
# ssl_conf_command Groups X25519:prime256v1:secp384r1; # ssl_conf_command Groups X25519:prime256v1:secp384r1;
location /.well-known/acme-challenge/ { location /.well-known/acme-challenge/ {
@@ -27,12 +28,28 @@ server {
location / { location / {
return 301 https://$host$request_uri; return 301 https://$host$request_uri;
}
listen 8080;
location /nginx_status {
stub_status;
allow 172.16.0.0/12;
deny all;
} }
} }
# Common SSL settings # Common SSL settings
ssl_protocols TLSv1.2 TLSv1.3; ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on; ssl_prefer_server_ciphers on;
server {
listen 443 ssl default_server;
server_name _;
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
return 404;
}
################### ###################
# NEXTCLOUD # NEXTCLOUD
@@ -51,6 +68,8 @@ server {
location / { location / {
proxy_pass http://nextcloud:80; proxy_pass http://nextcloud:80;
# Do not try another upstream on errors
proxy_next_upstream off;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -76,6 +95,8 @@ server {
location / { location / {
proxy_pass http://jellyfin:8096; proxy_pass http://jellyfin:8096;
# Do not try another upstream on errors
proxy_next_upstream off;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
@@ -103,6 +124,8 @@ server {
location / { location / {
proxy_pass http://audiobookshelf:80; proxy_pass http://audiobookshelf:80;
# Do not try another upstream on errors
proxy_next_upstream off;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
@@ -112,40 +135,14 @@ server {
} }
} }
###################
# AUTHENTIK
###################
server {
listen 443 ssl;http2 on;
server_name login.someoneslinux.selfhost.eu;
add_header Content-Security-Policy "frame-ancestors 'self';" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
location / {
proxy_pass http://authentik-server-1:9000;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
#################### ####################
## HOME ASSISTANT ## AUTHENTIK
#################### ####################
#server { #server {
# listen 443 ssl;http2 on; # listen 443 ssl;http2 on;
# server_name auto.someoneslinux.selfhost.eu; # server_name login.someoneslinux.selfhost.eu;
# #
# add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always; # add_header Content-Security-Policy "frame-ancestors 'self';" always;
# add_header X-Frame-Options "SAMEORIGIN" always; # add_header X-Frame-Options "SAMEORIGIN" always;
# add_header X-Content-Type-Options "nosniff" always; # add_header X-Content-Type-Options "nosniff" always;
# add_header Referrer-Policy "strict-origin-when-cross-origin" always; # add_header Referrer-Policy "strict-origin-when-cross-origin" always;
@@ -155,17 +152,45 @@ server {
# ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem; # ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
# #
# location / { # location / {
# proxy_pass http://192.168.0.4:8123; # proxy_pass http://authentik-server-1:9000;
# proxy_http_version 1.1; # proxy_http_version 1.1;
# #
# proxy_set_header Host $host;
# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection $connection_upgrade;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_set_header X-Forwarded-Proto https; # proxy_set_header X-Forwarded-Proto https;
# proxy_set_header X-Forwarded-Host $host;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# } # }
#} #}
###################
# HOME ASSISTANT
###################
server {
listen 443 ssl;http2 on;
server_name auto.someoneslinux.selfhost.eu;
# add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
location / {
proxy_pass http://192.168.0.4:8123;
# Do not try another upstream on errors
proxy_next_upstream off;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}
################### ###################
# NAVIDROME # NAVIDROME
################### ###################
@@ -184,6 +209,8 @@ server {
location / { location / {
proxy_pass http://navidrome:4533; proxy_pass http://navidrome:4533;
# Do not try another upstream on errors
proxy_next_upstream off;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
@@ -208,6 +235,8 @@ server {
location / { location / {
proxy_pass http://vaultwarden:80; proxy_pass http://vaultwarden:80;
# Do not try another upstream on errors
proxy_next_upstream off;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Proto https;
@@ -216,6 +245,8 @@ server {
location /notifications/hub { location /notifications/hub {
proxy_pass http://vaultwarden:3012; proxy_pass http://vaultwarden:3012;
# Do not try another upstream on errors
proxy_next_upstream off;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
@@ -240,6 +271,8 @@ server {
location / { location / {
proxy_pass http://seerr:5055; proxy_pass http://seerr:5055;
# Do not try another upstream on errors
proxy_next_upstream off;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
@@ -268,6 +301,8 @@ server {
location / { location / {
proxy_pass http://192.168.0.2:8080; proxy_pass http://192.168.0.2:8080;
# Do not try another upstream on errors
proxy_next_upstream off;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
@@ -275,6 +310,7 @@ server {
proxy_set_header Connection $connection_upgrade; proxy_set_header Connection $connection_upgrade;
proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Proto https;
} }
} }
################### ###################
@@ -294,6 +330,8 @@ server {
location / { location / {
proxy_pass http://grafana:3000; proxy_pass http://grafana:3000;
# Do not try another upstream on errors
proxy_next_upstream off;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
@@ -302,3 +340,33 @@ server {
proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Proto https;
} }
} }
###################
# GITEA
###################
server {
listen 443 ssl;http2 on;
server_name code.someoneslinux.selfhost.eu;
add_header Content-Security-Policy "frame-ancestors 'self';" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
location / {
proxy_pass http://gitea:3000;
# Do not try another upstream on errors
proxy_next_upstream off;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}
docker_compose/mediahost/nginx/docker-compose.yaml
+19 -3
View File
@@ -3,11 +3,9 @@ services:
image: nginx:stable image: nginx:stable
container_name: nginx container_name: nginx
restart: unless-stopped restart: unless-stopped
ports: ports:
- "80:80" - "80:80"
- "443:443" - "443:443"
volumes: volumes:
- ./conf.d:/etc/nginx/conf.d - ./conf.d:/etc/nginx/conf.d
- ./certs:/etc/nginx/certs - ./certs:/etc/nginx/certs
@@ -15,8 +13,23 @@ services:
# Access and error logs # Access and error logs
- ./logs:/var/log/nginx - ./logs:/var/log/nginx
networks: networks:
- default
- shared-proxy-services - shared-proxy-services
nginx-exporter:
image: nginx/nginx-prometheus-exporter:latest
container_name: nginx-exporter
restart: unless-stopped
command:
- --nginx.scrape-uri=http://nginx:8080/nginx_status
ports:
- "9113:9113"
depends_on:
- nginx
networks:
- default
- shared-proxy-services
crowdsec: crowdsec:
image: crowdsecurity/crowdsec:latest image: crowdsecurity/crowdsec:latest
container_name: crowdsec container_name: crowdsec
@@ -29,7 +42,8 @@ services:
- crowdsec-db:/var/lib/crowdsec/data - crowdsec-db:/var/lib/crowdsec/data
- ./logs:/var/log/nginx:ro - ./logs:/var/log/nginx:ro
- /etc/localtime:/etc/localtime:ro - /etc/localtime:/etc/localtime:ro
networks:
- default
certbot: certbot:
image: certbot/certbot:latest image: certbot/certbot:latest
@@ -41,7 +55,9 @@ services:
- shared-proxy-services - shared-proxy-services
networks: networks:
default:
shared-proxy-services: shared-proxy-services:
external: true external: true
volumes: volumes:
crowdsec-db: crowdsec-db:
docker_compose/mediahost/redis/docker-compose.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ services:
image: redis:7 image: redis:7
container_name: redis container_name: redis
restart: unless-stopped restart: unless-stopped
command: redis-server --appendonly yes --requirepass PerCent7heStorySp0tInOrd3r command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
healthcheck: healthcheck:
test: test: