130 lines
3.1 KiB
Plaintext
130 lines
3.1 KiB
Plaintext
# Template anonymisé — à adapter, ne JAMAIS commiter de vraies valeurs
|
|
# Copier ce fichier en docker-compose.yml et remplacer les variables avant usage.
|
|
|
|
version: "3.9"
|
|
|
|
networks:
|
|
proxy-net:
|
|
external: true
|
|
internal-net:
|
|
internal: true
|
|
|
|
services:
|
|
|
|
nginx-proxy-manager:
|
|
image: jc21/nginx-proxy-manager:latest
|
|
container_name: nginx-proxy-manager
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
- "81:81" # interface d'admin, à exposer uniquement via le tunnel
|
|
volumes:
|
|
- ./npm/data:/data
|
|
- ./npm/letsencrypt:/etc/letsencrypt
|
|
networks:
|
|
- proxy-net
|
|
|
|
cloudflared:
|
|
image: cloudflare/cloudflared:latest
|
|
container_name: cloudflared
|
|
restart: unless-stopped
|
|
command: tunnel run
|
|
environment:
|
|
- TUNNEL_TOKEN=__REPLACE_WITH_SECRET__ # à stocker dans un .env, jamais en clair ici
|
|
networks:
|
|
- proxy-net
|
|
|
|
authentik-server:
|
|
image: ghcr.io/goauthentik/server:latest
|
|
container_name: authentik-server
|
|
restart: unless-stopped
|
|
command: server
|
|
environment:
|
|
AUTHENTIK_SECRET_KEY: __REPLACE_WITH_SECRET__
|
|
AUTHENTIK_POSTGRESQL__HOST: authentik-db
|
|
AUTHENTIK_POSTGRESQL__PASSWORD: __REPLACE_WITH_SECRET__
|
|
AUTHENTIK_REDIS__HOST: authentik-redis
|
|
depends_on:
|
|
- authentik-db
|
|
- authentik-redis
|
|
networks:
|
|
- proxy-net
|
|
- internal-net
|
|
|
|
authentik-db:
|
|
image: postgres:16-alpine
|
|
container_name: authentik-db
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_PASSWORD: __REPLACE_WITH_SECRET__
|
|
POSTGRES_USER: authentik
|
|
POSTGRES_DB: authentik
|
|
volumes:
|
|
- ./authentik/database:/var/lib/postgresql/data
|
|
networks:
|
|
- internal-net
|
|
|
|
authentik-redis:
|
|
image: redis:alpine
|
|
container_name: authentik-redis
|
|
restart: unless-stopped
|
|
networks:
|
|
- internal-net
|
|
|
|
vaultwarden:
|
|
image: vaultwarden/server:latest
|
|
container_name: vaultwarden
|
|
restart: unless-stopped
|
|
environment:
|
|
DOMAIN: "https://__REPLACE_WITH_SUBDOMAIN__"
|
|
SIGNUPS_ALLOWED: "false"
|
|
volumes:
|
|
- ./vaultwarden/data:/data
|
|
networks:
|
|
- proxy-net
|
|
|
|
nextcloud:
|
|
image: nextcloud:latest
|
|
container_name: nextcloud
|
|
restart: unless-stopped
|
|
volumes:
|
|
- /mnt/data-pool/nextcloud:/var/www/html
|
|
networks:
|
|
- proxy-net
|
|
- internal-net
|
|
|
|
jellyfin:
|
|
image: jellyfin/jellyfin:latest
|
|
container_name: jellyfin
|
|
restart: unless-stopped
|
|
volumes:
|
|
- /mnt/media-pool/library:/media
|
|
- ./jellyfin/config:/config
|
|
networks:
|
|
- proxy-net
|
|
|
|
gluetun:
|
|
image: qmcgaw/gluetun:latest
|
|
container_name: gluetun
|
|
restart: unless-stopped
|
|
cap_add:
|
|
- NET_ADMIN
|
|
environment:
|
|
VPN_SERVICE_PROVIDER: __REPLACE_WITH_PROVIDER__
|
|
VPN_TYPE: wireguard
|
|
WIREGUARD_PRIVATE_KEY: __REPLACE_WITH_SECRET__
|
|
networks:
|
|
- internal-net
|
|
|
|
deluge:
|
|
image: linuxserver/deluge:latest
|
|
container_name: deluge
|
|
restart: unless-stopped
|
|
network_mode: "service:gluetun"
|
|
depends_on:
|
|
- gluetun
|
|
volumes:
|
|
- /mnt/media-pool/downloads:/downloads
|
|
- ./deluge/config:/config
|