Update kimai stack.

automation/docker-compose.yaml

@@ -38,9 +38,15 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.semaphore.entrypoints=web"
-      - "traefik.http.routers.semaphore.rule=Host(`ansible.lan`)"
+      - "traefik.http.routers.semaphore.rule=Host(`ansible.fam-steinle.de`)"
-      - "traefik.http.routers.semaphore.service=semaphore"
+      - "traefik.http.routers.semaphore.middlewares=semaphore"
-      - "traefik.http.services.semaphore.loadbalancer.server.port=3000"
+      - "traefik.http.middlewares.semaphore.redirectscheme.scheme=https"
+      - "traefik.http.routers.semaphore-secure.entrypoints=websecure"
+      - "traefik.http.routers.semaphore-secure.rule=Host(`ansible.fam-steinle.de`)"
+      - "traefik.http.routers.semaphore-secure.service=semaphore-secure"
+      - "traefik.http.routers.semaphore-secure.tls=true"
+      - "traefik.http.routers.semaphore-secure.tls.certresolver=myresolver"
+      - "traefik.http.services.semaphore-secure.loadbalancer.server.port=3000"
       - "com.centurylinklabs.watchtower.monitor-only=true"
 
   semaphore-db:

backup/docker-compose.yaml

@@ -7,31 +7,37 @@ volumes:
     name: duplicati-conf
   nextcloud-data:
     external: true
+  gitea:
+    external: true
 
 services:
   duplicati:
-    image: duplicati/duplicati:beta
+    image: duplicati/duplicati:stable
     restart: unless-stopped
     container_name: duplicati
     hostname: duplicati
-    ports:
-      - "8200:8200"
     volumes:
       - duplicati-conf:/data
       - nextcloud-data:/nextcloud:ro
+      - gitea:/gitea:ro
       - /media/backup:/backup
-    networks:
-      - proxy
     environment:
       DUPLICATI__DISABLE_DB_ENCRYPTION: true
-    deploy:
+      DUPLICATI__WEBSERVICE_ALLOWEDHOSTNAMES: backup.fam-steinle.de
-      resources:
+    networks:
-        limits:
+      - proxy
-          memory: 16g
+    ports:
+      - "8200:8200"
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.duplicati.entrypoints=web"
-      - "traefik.http.routers.duplicati.rule=Host(`duplicati.lan`)"
+      - "traefik.http.routers.duplicati.rule=Host(`backup.fam-steinle.de`)"
-      - "traefik.http.services.duplicati.loadbalancer.server.port=8200"
+      - "traefik.http.routers.duplicati.middlewares=duplicati"
-
+      - "traefik.http.middlewares.duplicati.redirectscheme.scheme=https"
+      - "traefik.http.routers.duplicati-secure.entrypoints=websecure"
+      - "traefik.http.routers.duplicati-secure.rule=Host(`backup.fam-steinle.de`)"
+      - "traefik.http.routers.duplicati-secure.service=duplicati-secure"
+      - "traefik.http.routers.duplicati-secure.tls=true"
+      - "traefik.http.routers.duplicati-secure.tls.certresolver=myresolver"
+      - "traefik.http.services.duplicati-secure.loadbalancer.server.port=8200"
 

gitea/docker-compose.yaml

@@ -4,6 +4,7 @@ networks:
   gitea:
     name: gitea
     external: false
+    enable_ipv6: true
 
 volumes:
   gitea:
@@ -75,11 +76,14 @@ services:
   runner:
     image: gitea/act_runner
     restart: always
+    privileged: true
     depends_on:
       - gitea
     volumes:
       - gitea-runner:/data
       - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - gitea
     environment:
       - GITEA_INSTANCE_URL=https://gitea.fam-steinle.de
       - GITEA_RUNNER_REGISTRATION_TOKEN=FQDt05qG37BLO0OBl6eX94aNNVE9Ni5nFdeVFoKm

kimai/docker-compose.yaml

@@ -23,7 +23,6 @@ services:
       ADMINMAIL: ${ADMIN_USER}
       ADMINPASS: ${ADMIN_PASS}
       DATABASE_URL: mysql://${DB_USER}:${DB_PASS}@kimai-db/${DB_NAME}?charset=utf8&serverVersion=8.1.0
-      TRUSTED_HOSTS: kimai.lan,kimai-web,localhost,127.0.0.1
       APP_SECRET: ${APP_SECRET}
     depends_on:
       - kimai-db

monitoring/docker-compose.yaml

@@ -29,7 +29,7 @@ services:
       - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
 
   cadvisor:
-    image: gcr.io/cadvisor/cadvisor:v0.51.0
+    image: gcr.io/cadvisor/cadvisor:v0.52.1
     container_name: cadvisor
     hostname: cadvisor
     restart: unless-stopped
@@ -98,7 +98,7 @@ services:
     environment:
       WATCHTOWER_INCLUDE_STOPPED: true
       WATCHTOWER_MONITOR_ONLY: false
-      WATCHWOWER_CLEANUP: true
+      WATCHTOWER_CLEANUP: true
       WATCHTOWER_REMOVE_VOLUMES: true
       WATCHTOWER_WARN_ON_HEAD_FAILURE: "never"
       WATCHTOWER_SCHEDULE: "0 20 4 * * *"

networking/docker-compose.yaml

@@ -14,7 +14,7 @@ networks:
           gateway: 192.168.178.1
           ip_range: 192.168.178.0/29
         - subnet: fd00::/64
-          gateway: fd00::de15:c8ff:feec:9960
+          gateway: fd00::4a5d:35ff:fed9:b94f
           ip_range: fd00::0/80
     name: home
   proxy:
@@ -48,6 +48,7 @@ services:
       home:
         ipv4_address: 192.168.178.2
         ipv6_address: fd00::2
+      proxy:
     ports:
       - "80:80"
       - "443:443"
@@ -68,6 +69,8 @@ services:
       - "traefik.http.routers.pihole-secure.middlewares=pihole-secure"
       - "traefik.http.middlewares.pihole-secure.headers.addvaryheader=true"
       - "traefik.http.middlewares.pihole-secure.headers.accesscontrolalloworiginlist=https://homer.fam-steinle.de"
+      - "traefik.http.middlewares.pihole-secure.headers.accesscontrolallowheaders=*"
+      - "traefik.http.middlewares.pihole-secure.headers.accesscontrolallowmethods=GET,POST,OPTIONS"
       - "traefik.http.routers.pihole-secure.service=pihole-secure"
       - "traefik.http.routers.pihole-secure.tls=true"
       - "traefik.http.routers.pihole-secure.tls.certresolver=myresolver"
@@ -102,11 +105,36 @@ services:
     environment:
       NFS_DIR: /nfs-share
       NFS_DOMAIN: 192.168.178.0/24
-      NFS_OPTION: rw,sync,no_subtree_check,nohide,no_root_squash
+      NFS_OPTION: rw,sync,no_subtree_check,nohide,no_root_squash,fsid=0
     volumes:
       - /media/backup:/nfs-share
     restart: unless-stopped
 
+  # Exec into container at first start
+  # and create the user and the samba password:
+  #   adduser USER
+  #   smbpasswd -a USER
+  samba:
+    image: gists/samba-server
+    container_name: samba
+    hostname: samba
+    networks:
+      - networking
+    ports:
+      - "137:137/udp"
+      - "138:138/udp"
+      - "139:139/tcp"
+      - "445:445/tcp"
+    environment:
+      PUID: 1000
+      GUID: 1000
+      TZ: Europe/Berlin
+      PASSWORD: lmaa,dw.
+    restart: unless-stopped
+    volumes:
+      - ./smb.conf:/etc/samba/smb.conf:ro
+      - /media/backup:/mnt
+
   sftp:
     image: drakkan/sftpgo:alpine-slim
     container_name: sftp

networking/smb.conf

@@ -5,6 +5,7 @@
     security = user
     guest account = nobody
     map to guest = Bad User
+    host msdfs = no
     name resolve order = bcast host lmhosts wins
 
     load printers = no

nextcloud/docker-compose.yaml

@@ -60,12 +60,15 @@ services:
       - "traefik.http.routers.nextcloud-secure.tls=true"
       - "traefik.http.routers.nextcloud-secure.tls.certresolver=myresolver"
       - "traefik.http.services.nextcloud-secure.loadbalancer.server.port=80"
-      - "traefik.http.routers.nextcloud-secure.middlewares=nextcloud-secure,nextcloud-redirect"
+      - "traefik.http.routers.nextcloud-secure.middlewares=nextcloud-secure,nextcloud-redirect-1,nextcloud-redirect-2"
       - "traefik.http.middlewares.nextcloud-secure.headers.stsSeconds=15552000"
       - "traefik.http.middlewares.nextcloud-secure.headers.stsPreload=true"
-      - "traefik.http.middlewares.nextcloud-redirect.redirectregex.permanent=true"
+      - "traefik.http.middlewares.nextcloud-redirect-1.redirectregex.permanent=true"
-      - "traefik.http.middlewares.nextcloud-redirect.redirectregex.regex=^https://(.*)/.well-known/(card|cal)dav"
+      - "traefik.http.middlewares.nextcloud-redirect-1.redirectregex.regex=^https://(.*)/.well-known/(card|cal)dav"
-      - "traefik.http.middlewares.nextcloud-redirect.redirectregex.replacement=https://$${1}/remote.php/dav/"
+      - "traefik.http.middlewares.nextcloud-redirect-1.redirectregex.replacement=https://$${1}/remote.php/dav/"
+      - "traefik.http.middlewares.nextcloud-redirect-2.redirectregex.permanent=true"
+      - "traefik.http.middlewares.nextcloud-redirect-2.redirectregex.regex=^https://(.*)(/.well-known[^#]*)"
+      - "traefik.http.middlewares.nextcloud-redirect-2.redirectregex.replacement=https://$${1}/index.php$${2}"
     depends_on:
       - nextcloud
     networks:

paperless/docker-compose.yml

@@ -14,7 +14,7 @@ volumes:
 
 services:
   broker:
-    image: redis:7
+    image: redis:8
     restart: unless-stopped
     volumes:
       - paperless-redis:/data
@@ -75,7 +75,7 @@ services:
 
 
   gotenberg:
-    image: docker.io/gotenberg/gotenberg:8.19
+    image: gotenberg/gotenberg:8.22
     restart: unless-stopped
     command:
       - "gotenberg"
@@ -85,7 +85,7 @@ services:
       - paperless
 
   tika:
-    image: tika:latest
+    image: apache/tika:latest
     restart: unless-stopped
     networks:
       - paperless