427 lines
15 KiB
YAML
427 lines
15 KiB
YAML
services:
|
|
# ------------------------------------------------------
|
|
# Traefik Reverse Proxy
|
|
# ------------------------------------------------------
|
|
traefik:
|
|
image: traefik:v2.11
|
|
container_name: traefik
|
|
restart: unless-stopped
|
|
command:
|
|
- "--providers.docker=true"
|
|
- "--providers.docker.exposedbydefault=false"
|
|
- "--entrypoints.web.address=:80"
|
|
- "--entrypoints.websecure.address=:443"
|
|
- "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
|
|
- "--certificatesresolvers.letsencrypt.acme.email=inventor@txproducts.de"
|
|
- "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
|
- "./letsencrypt:/letsencrypt"
|
|
|
|
# ------------------------------------------------------
|
|
# Tika (Office text extraction)
|
|
# ------------------------------------------------------
|
|
tika:
|
|
image: apache/tika:latest
|
|
container_name: tika
|
|
restart: unless-stopped
|
|
|
|
# ------------------------------------------------------
|
|
# Gotenberg (Office → PDF conversion)
|
|
# ------------------------------------------------------
|
|
gotenberg:
|
|
image: gotenberg/gotenberg:latest
|
|
container_name: gotenberg
|
|
restart: unless-stopped
|
|
command:
|
|
- "gotenberg"
|
|
- "--chromium-disable-javascript=true"
|
|
- "--chromium-allow-list=file:///tmp/.*"
|
|
- "--libreoffice-start-timeout=900s"
|
|
- "--chromium-start-timeout=900s"
|
|
- "--libreoffice-auto-start=true"
|
|
|
|
# ------------------------------------------------------
|
|
# Paperless-NGX
|
|
# ------------------------------------------------------
|
|
paperless:
|
|
image: ghcr.io/paperless-ngx/paperless-ngx:latest
|
|
container_name: paperless
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- redis
|
|
- paperless_db
|
|
- tika
|
|
- gotenberg
|
|
environment:
|
|
PAPERLESS_URL: https://paperless.txproducts.de
|
|
PAPERLESS_REDIS: redis://redis:6379
|
|
PAPERLESS_DBHOST: paperless_db
|
|
PAPERLESS_DBNAME: paperless
|
|
PAPERLESS_DBUSER: paperless
|
|
PAPERLESS_DBPASS: AVeryStrong123Password
|
|
PAPERLESS_CONSUMER_RECURSIVE: "true"
|
|
PAPERLESS_CONSUMER_DELETE_DUPLICATES: "true"
|
|
PAPERLESS_EMAIL_HOST: "mail.cs537.de"
|
|
PAPERLESS_EMAIL_PORT: 465
|
|
PAPERLESS_EMAIL_HOST_USER: "system@txproducts.de"
|
|
PAPERLESS_EMAIL_HOST_PASSWORD: "OubveTtORoOmPRItNITeRbIDECUppEcT,=,42"
|
|
PAPERLESS_EMAIL_FROM: "system@txproducts.de"
|
|
PAPERLESS_EMAIL_USE_TLS: "true"
|
|
PAPERLESS_EMAIL_USE_SSL: "false"
|
|
# --- Office document support ---
|
|
PAPERLESS_TIKA_ENABLED: "true"
|
|
PAPERLESS_TIKA_GOTENBERG_ENDPOINT: "http://gotenberg:3000"
|
|
PAPERLESS_TIKA_ENDPOINT: "http://tika:9998"
|
|
volumes:
|
|
- ./paperless/data:/usr/src/paperless/data
|
|
- ./paperless/media:/usr/src/paperless/media
|
|
- ./paperless/export:/usr/src/paperless/export
|
|
- ./paperless/consume:/usr/src/paperless/consume
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.paperless.rule=Host(`paperless.txproducts.de`)"
|
|
- "traefik.http.routers.paperless.entrypoints=websecure"
|
|
- "traefik.http.routers.paperless.tls.certresolver=letsencrypt"
|
|
|
|
paperless_db:
|
|
image: postgres:14
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: paperless
|
|
POSTGRES_USER: paperless
|
|
POSTGRES_PASSWORD: AVeryStrong123Password
|
|
volumes:
|
|
- ./paperless/postgres:/var/lib/postgresql/data
|
|
|
|
redis:
|
|
image: redis:7
|
|
restart: unless-stopped
|
|
|
|
# ------------------------------------------------------
|
|
# Paperless AI
|
|
# ------------------------------------------------------
|
|
paperless_ai:
|
|
image: clusterzx/paperless-ai:latest
|
|
container_name: paperless_ai
|
|
restart: unless-stopped
|
|
environment:
|
|
PUID: 1000
|
|
PGID: 1000
|
|
|
|
# Port config
|
|
PAPERLESS_AI_PORT: 3000
|
|
|
|
# RAG engine (enabled by default)
|
|
RAG_SERVICE_URL: http://paperless_ai:8000
|
|
RAG_SERVICE_ENABLED: "true"
|
|
|
|
# Connect to Paperless
|
|
PAPERLESS_URL: https://paperless.txproducts.de
|
|
|
|
# ==== OpenRouter (Custom Provider) ====
|
|
AI_PROVIDER: custom
|
|
CUSTOM_AI_BASE_URL: https://openrouter.ai/api/v1
|
|
CUSTOM_AI_API_KEY: "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"
|
|
CUSTOM_AI_MODEL: "stepfun/step-3.5-flash:free"
|
|
|
|
# OpenRouter required headers!
|
|
HTTP_REFERER: "https://paperai.txproducts.de"
|
|
X_TITLE: "Paperless-AI"
|
|
|
|
volumes:
|
|
- ./paperless-ai/data:/app/data
|
|
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.paperlessai.rule=Host(`paperai.txproducts.de`)"
|
|
- "traefik.http.routers.paperlessai.entrypoints=websecure"
|
|
- "traefik.http.routers.paperlessai.tls.certresolver=letsencrypt"
|
|
|
|
|
|
# ------------------------------------------------------
|
|
# InvenTree + DB
|
|
# ------------------------------------------------------
|
|
inventree:
|
|
image: inventree/inventree:stable
|
|
container_name: inventree
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- inventree_db
|
|
environment:
|
|
INVENTREE_DB_ENGINE: postgresql
|
|
INVENTREE_DB_NAME: inventree
|
|
INVENTREE_DB_USER: inventree
|
|
INVENTREE_DB_PASSWORD: AVeryStrong123Password
|
|
INVENTREE_DB_HOST: inventree_db
|
|
INVENTREE_ADMIN_USER: admin
|
|
INVENTREE_ADMIN_PASSWORD: AVeryStrong123Password
|
|
INVENTREE_ADMIN_EMAIL: dschmidt@txproducts.de
|
|
INVENTREE_PLUGINS_ENABLED: 1
|
|
INVENTREE_PLUGIN_FILE: /home/inventree/data/plugins.txt
|
|
# Required for reverse-proxy setups
|
|
INVENTREE_SITE_URL: https://inventree.txproducts.de
|
|
CSRF_TRUSTED_ORIGINS: https://inventree.txproducts.de
|
|
ALLOWED_HOSTS: inventree.txproducts.de,localhost,127.0.0.1
|
|
volumes:
|
|
- ./inventree/data:/home/inventree/data
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.inventree.rule=Host(`inventree.txproducts.de`)"
|
|
- "traefik.http.routers.inventree.entrypoints=websecure"
|
|
- "traefik.http.routers.inventree.tls.certresolver=letsencrypt"
|
|
# Static files service
|
|
- "traefik.http.services.inventree.loadbalancer.server.port=8000"
|
|
|
|
inventree_db:
|
|
image: postgres:14
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: inventree
|
|
POSTGRES_USER: inventree
|
|
POSTGRES_PASSWORD: AVeryStrong123Password
|
|
volumes:
|
|
- ./inventree/postgres:/var/lib/postgresql/data
|
|
|
|
|
|
inventree_worker:
|
|
image: inventree/inventree:stable
|
|
container_name: inventree_worker
|
|
command: invoke worker
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- inventree
|
|
environment:
|
|
INVENTREE_DB_ENGINE: postgresql
|
|
INVENTREE_DB_NAME: inventree
|
|
INVENTREE_DB_USER: inventree
|
|
INVENTREE_DB_PASSWORD: AVeryStrong123Password
|
|
INVENTREE_DB_HOST: inventree_db
|
|
|
|
INVENTREE_SITE_URL: https://inventree.txproducts.de
|
|
CSRF_TRUSTED_ORIGINS: https://inventree.txproducts.de
|
|
|
|
volumes:
|
|
- ./inventree/data:/home/inventree/data
|
|
|
|
# ------------------------------------------------------
|
|
# Nextcloud + DB
|
|
# ------------------------------------------------------
|
|
nextcloud-db:
|
|
image: mariadb:11
|
|
container_name: nextcloud-db
|
|
restart: unless-stopped
|
|
command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
|
|
environment:
|
|
MYSQL_DATABASE: nextcloud
|
|
MYSQL_USER: nextcloud
|
|
MYSQL_PASSWORD: A_Very_Strong_DB_Password
|
|
MYSQL_ROOT_PASSWORD: A_Very_Strong_Root_Password
|
|
volumes:
|
|
- ./nextcloud/db:/var/lib/mysql
|
|
|
|
nextcloud:
|
|
image: nextcloud:latest
|
|
container_name: nextcloud
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- nextcloud-db
|
|
- redis
|
|
environment:
|
|
# DB connection
|
|
MYSQL_HOST: nextcloud-db
|
|
MYSQL_DATABASE: nextcloud
|
|
MYSQL_USER: nextcloud
|
|
MYSQL_PASSWORD: A_Very_Strong_DB_Password
|
|
REDIS_HOST: redis
|
|
# URL & proxy config
|
|
#NEXTCLOUD_ADMIN_USER: admin
|
|
#NEXTCLOUD_ADMIN_PASSWORD: 97v2*r7APuS^RV3d$YPU
|
|
NEXTCLOUD_TRUSTED_DOMAINS: cloud.txproducts.de
|
|
OVERWRITEHOST: cloud.txproducts.de
|
|
OVERWRITEPROTOCOL: https
|
|
OVERWRITECLIURL: https://cloud.txproducts.de
|
|
TRUSTED_PROXIES: 172.16.0.0/12
|
|
|
|
volumes:
|
|
- ./nextcloud/html:/var/www/html
|
|
- ./nextcloud/data:/var/www/html/data
|
|
- ./paperless:/paperless
|
|
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.nextcloud.rule=Host(`cloud.txproducts.de`)"
|
|
- "traefik.http.routers.nextcloud.entrypoints=websecure"
|
|
- "traefik.http.routers.nextcloud.tls.certresolver=letsencrypt"
|
|
# Optional: increase timeouts for large uploads
|
|
- "traefik.http.services.nextcloud.loadbalancer.server.port=80"
|
|
|
|
- "traefik.http.routers.nextcloud-http.entrypoints=web"
|
|
- "traefik.http.routers.nextcloud-http.rule=Host(`cloud.txproducts.de`)"
|
|
- "traefik.http.routers.nextcloud-http.middlewares=nextcloud-redirect"
|
|
- "traefik.http.middlewares.nextcloud-redirect.redirectscheme.scheme=https"
|
|
|
|
nextcloud-cron:
|
|
image: nextcloud:latest
|
|
container_name: nextcloud-cron
|
|
restart: unless-stopped
|
|
volumes:
|
|
- ./nextcloud/html:/var/www/html
|
|
- ./nextcloud/data:/var/www/html/data
|
|
entrypoint: /cron.sh
|
|
depends_on:
|
|
- nextcloud-db
|
|
- redis
|
|
|
|
talk-hpb:
|
|
image: ghcr.io/nextcloud-releases/aio-talk:latest
|
|
container_name: nextcloud-talk-hpb
|
|
restart: unless-stopped
|
|
init: true
|
|
labels:
|
|
- "traefik.enable=true"
|
|
|
|
# 1. HTTP Router (Redirect HTTP to HTTPS)
|
|
- "traefik.http.routers.talk-http.entrypoints=web"
|
|
- "traefik.http.routers.talk-http.rule=Host(`signal.cloud.txproducts.de`)"
|
|
- "traefik.http.routers.talk-http.middlewares=nextcloud-redirect"
|
|
|
|
# 2. HTTPS Router (Secure WebSocket Access)
|
|
- "traefik.http.routers.talk-https.entrypoints=websecure"
|
|
- "traefik.http.routers.talk-https.rule=Host(`signal.cloud.txproducts.de`)"
|
|
- "traefik.http.routers.talk-https.tls=true"
|
|
- "traefik.http.routers.talk-https.tls.certresolver=letsencrypt"
|
|
|
|
# The Talk service is available internally on port 8081
|
|
- "traefik.http.services.talk-hpb.loadbalancer.server.port=8081"
|
|
environment:
|
|
- NC_DOMAIN=cloud.txproducts.de
|
|
- TALK_HOST=signal.cloud.txproducts.de
|
|
- TALK_PORT=3478
|
|
- TURN_SECRET=1ph34w9hrs0gka5xi2qfbn2ti48390
|
|
- SIGNALING_SECRET=avzeyam5ak1e4a4xseak2m43kih3vp
|
|
- INTERNAL_SECRET=e5hr4dgxnjbsl71kr1stkubqyrz3zh
|
|
ports:
|
|
# Expose the TURN ports (required for external clients)
|
|
- "3478:3478/tcp"
|
|
- "3478:3478/udp"
|
|
# Expose the internal signaling port for the reverse proxy
|
|
- "8081:8081/tcp"
|
|
depends_on:
|
|
- nextcloud
|
|
|
|
nextcloud-whiteboard:
|
|
image: ghcr.io/nextcloud-releases/whiteboard:stable
|
|
container_name: nextcloud-whiteboard
|
|
restart: unless-stopped
|
|
environment:
|
|
NEXTCLOUD_URL: https://cloud.txproducts.de
|
|
JWT_SECRET_KEY: "d7a6599a3864220838281e1796fb06cb90441519a39621ce077a87f80b9c96a6"
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.whiteboard.rule=Host(`cloud.txproducts.de`) && PathPrefix(`/whiteboard`)"
|
|
- "traefik.http.routers.whiteboard.entrypoints=websecure"
|
|
- "traefik.http.routers.whiteboard.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.whiteboard.loadbalancer.server.port=3002"
|
|
- "traefik.http.middlewares.strip-whiteboard.stripprefix.prefixes=/whiteboard"
|
|
- "traefik.http.routers.whiteboard.middlewares=strip-whiteboard"
|
|
depends_on:
|
|
- nextcloud
|
|
|
|
# ------------------------------------------------------
|
|
# Gitea
|
|
# ------------------------------------------------------
|
|
gitea:
|
|
image: gitea/gitea:latest
|
|
container_name: gitea
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- gitea_db
|
|
environment:
|
|
USER_UID: 1000
|
|
USER_GID: 1000
|
|
GITEA__database__DB_TYPE: postgres
|
|
GITEA__database__HOST: gitea_db:5432
|
|
GITEA__database__NAME: gitea
|
|
GITEA__database__USER: gitea
|
|
GITEA__database__PASSWD: AVeryStrongGiteaPassword
|
|
GITEA__server__DOMAIN: git.txproducts.de
|
|
GITEA__server__ROOT_URL: https://git.txproducts.de
|
|
GITEA__server__HTTP_PORT: 3000
|
|
GITEA__server__SSH_DOMAIN: git.txproducts.de
|
|
GITEA__server__SSH_PORT: 2222
|
|
GITEA__mailer__ENABLED: true
|
|
GITEA__mailer__PROTOCOL: smtps
|
|
GITEA__mailer__SMTP_ADDR: mail.cs537.de
|
|
GITEA__mailer__SMTP_PORT: 465
|
|
GITEA__mailer__USER: system@txproducts.de
|
|
GITEA__mailer__PASSWD: OubveTtORoOmPRItNITeRbIDECUppEcT,=,42
|
|
GITEA__mailer__FROM: system@txproducts.de
|
|
GITEA__service__REGISTER_EMAIL_CONFIRM: true
|
|
GITEA__service__DISABLE_REGISTRATION: false
|
|
GITEA__service__ALLOW_ONLY_INTERNAL_REGISTRATION: true
|
|
GITEA__service__ENABLE_NOTIFY_MAIL: true
|
|
volumes:
|
|
- ./gitea/data:/data
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
ports:
|
|
- "222:22" # SSH access for git push/pull
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.gitea.rule=Host(`git.txproducts.de`)"
|
|
- "traefik.http.routers.gitea.entrypoints=websecure"
|
|
- "traefik.http.routers.gitea.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.gitea.loadbalancer.server.port=3000"
|
|
- "traefik.http.routers.gitea-http.entrypoints=web"
|
|
- "traefik.http.routers.gitea-http.rule=Host(`git.txproducts.de`)"
|
|
- "traefik.http.routers.gitea-http.middlewares=gitea-redirect"
|
|
- "traefik.http.middlewares.gitea-redirect.redirectscheme.scheme=https"
|
|
|
|
gitea_db:
|
|
image: postgres:14
|
|
container_name: gitea_db
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: gitea
|
|
POSTGRES_USER: gitea
|
|
POSTGRES_PASSWORD: AVeryStrongGiteaPassword
|
|
volumes:
|
|
- ./gitea/postgres:/var/lib/postgresql/data
|
|
|
|
|
|
# ------------------------------------------------------
|
|
# HiActs Conference Poll
|
|
# ------------------------------------------------------
|
|
hiacts-poll:
|
|
build:
|
|
context: ./poll
|
|
dockerfile_inline: |
|
|
FROM python:3.12-slim
|
|
WORKDIR /app
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
COPY . .
|
|
EXPOSE 5001
|
|
CMD ["python", "app.py"]
|
|
container_name: hiacts-poll
|
|
restart: unless-stopped
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.hiacts-poll.rule=Host(`poll.txproducts.de`)"
|
|
- "traefik.http.routers.hiacts-poll.entrypoints=websecure"
|
|
- "traefik.http.routers.hiacts-poll.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.hiacts-poll.loadbalancer.server.port=5001"
|
|
|
|
networks:
|
|
default:
|
|
driver: bridge
|
|
enable_ipv6: true
|
|
ipam:
|
|
config:
|
|
- subnet: "172.20.0.0/16"
|
|
- subnet: "fd01::/80"
|