first commit

2026-06-20 11:21:34 +02:00
commit 0d021fcd66
12 changed files with 637 additions and 0 deletions
@@ -0,0 +1,129 @@
+# Template anonymisé — à adapter, ne JAMAIS commiter de vraies valeurs
+# Copier ce fichier en docker-compose.yml et remplacer les variables avant usage.
+
+version: "3.9"
+
+networks:
+  proxy-net:
+    external: true
+  internal-net:
+    internal: true
+
+services:
+
+  nginx-proxy-manager:
+    image: jc21/nginx-proxy-manager:latest
+    container_name: nginx-proxy-manager
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+      - "81:81"     # interface d'admin, à exposer uniquement via le tunnel
+    volumes:
+      - ./npm/data:/data
+      - ./npm/letsencrypt:/etc/letsencrypt
+    networks:
+      - proxy-net
+
+  cloudflared:
+    image: cloudflare/cloudflared:latest
+    container_name: cloudflared
+    restart: unless-stopped
+    command: tunnel run
+    environment:
+      - TUNNEL_TOKEN=__REPLACE_WITH_SECRET__   # à stocker dans un .env, jamais en clair ici
+    networks:
+      - proxy-net
+
+  authentik-server:
+    image: ghcr.io/goauthentik/server:latest
+    container_name: authentik-server
+    restart: unless-stopped
+    command: server
+    environment:
+      AUTHENTIK_SECRET_KEY: __REPLACE_WITH_SECRET__
+      AUTHENTIK_POSTGRESQL__HOST: authentik-db
+      AUTHENTIK_POSTGRESQL__PASSWORD: __REPLACE_WITH_SECRET__
+      AUTHENTIK_REDIS__HOST: authentik-redis
+    depends_on:
+      - authentik-db
+      - authentik-redis
+    networks:
+      - proxy-net
+      - internal-net
+
+  authentik-db:
+    image: postgres:16-alpine
+    container_name: authentik-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_PASSWORD: __REPLACE_WITH_SECRET__
+      POSTGRES_USER: authentik
+      POSTGRES_DB: authentik
+    volumes:
+      - ./authentik/database:/var/lib/postgresql/data
+    networks:
+      - internal-net
+
+  authentik-redis:
+    image: redis:alpine
+    container_name: authentik-redis
+    restart: unless-stopped
+    networks:
+      - internal-net
+
+  vaultwarden:
+    image: vaultwarden/server:latest
+    container_name: vaultwarden
+    restart: unless-stopped
+    environment:
+      DOMAIN: "https://__REPLACE_WITH_SUBDOMAIN__"
+      SIGNUPS_ALLOWED: "false"
+    volumes:
+      - ./vaultwarden/data:/data
+    networks:
+      - proxy-net
+
+  nextcloud:
+    image: nextcloud:latest
+    container_name: nextcloud
+    restart: unless-stopped
+    volumes:
+      - /mnt/data-pool/nextcloud:/var/www/html
+    networks:
+      - proxy-net
+      - internal-net
+
+  jellyfin:
+    image: jellyfin/jellyfin:latest
+    container_name: jellyfin
+    restart: unless-stopped
+    volumes:
+      - /mnt/media-pool/library:/media
+      - ./jellyfin/config:/config
+    networks:
+      - proxy-net
+
+  gluetun:
+    image: qmcgaw/gluetun:latest
+    container_name: gluetun
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+    environment:
+      VPN_SERVICE_PROVIDER: __REPLACE_WITH_PROVIDER__
+      VPN_TYPE: wireguard
+      WIREGUARD_PRIVATE_KEY: __REPLACE_WITH_SECRET__
+    networks:
+      - internal-net
+
+  deluge:
+    image: linuxserver/deluge:latest
+    container_name: deluge
+    restart: unless-stopped
+    network_mode: "service:gluetun"
+    depends_on:
+      - gluetun
+    volumes:
+      - /mnt/media-pool/downloads:/downloads
+      - ./deluge/config:/config