Plenty changes

.gitignore

@@ -6,3 +6,6 @@ letsencrypt
 website-pro
 config/gitea/conf
 config/affine/private.key
+kopia-gcp-key.json
+config/garage
+DragnCards

README.md

@@ -1,36 +1,35 @@
 # Self-Hosted Services
 
-This repository contains my personal Docker Compose configuration for various self-hosted services, all exposed via Traefik.
+This repository contains my personal Docker Compose configuration for various self-hosted services, all exposed via Traefik. It serves primarily as a personal deployment configuration and a reference for others.
-It serves primarily as a personal deployment configuration and a reference for others.
 
----
+***
 
 ### Services Included:
 
--   **Traefik:** Reverse proxy and load balancer with automatic HTTPS, now also handling SSH entry points and `bouvais.lu` redirection.
+*   **Traefik:** Reverse proxy and load balancer with automatic HTTPS, now also handling SSH entry points and `bouvais.lu` redirection.
--   **Prometheus:** Monitoring system.
+*   **Monitoring Stack:**
--   **Grafana:** Data visualization and dashboarding for Prometheus.
+    *   **Prometheus:** Monitoring system.
--   **cAdvisor:** Container resource usage and performance analysis.
+    *   **Grafana:** Data visualization and dashboarding for Prometheus.
--   **Node Exporter:** Exposes hardware and OS metrics for Prometheus.
+    *   **cAdvisor:** Container resource usage and performance analysis.
--   **Nvidia GPU Exporter:** Exposes NVIDIA GPU metrics for Prometheus.
+    *   **Node Exporter:** Exposes hardware and OS metrics for Prometheus.
--   **Fail2Ban:** Intrusion prevention for various services, specifically configured to monitor Docker logs.
+    *   **Nvidia GPU Exporter:** Exposes NVIDIA GPU metrics for Prometheus.
--   **Vaultwarden:** Unofficial Bitwarden server implementation, with an added secure admin interface.
+*   **Fail2Ban:** Intrusion prevention for various services, specifically configured to monitor Traefik's access logs.
--   **Kopia:** Fast, secure, and incremental backups, with a web UI.
+*   **Vaultwarden:** Unofficial Bitwarden server implementation, with an added secure admin interface.
--   **Siyuan:** A local-first personal knowledge management system (replaces Memos).
+*   **Kopia:** Two instances for fast, secure, and incremental backups: one for local backups (`kopia`) and another for off-site backups to Google Cloud Platform (`kopia-gcp`).
--   **Jellyfin:** Free software media system.
+*   **Siyuan:** A local-first personal knowledge management system.
--   **Filebrowser:** Web interface to browse and manage files.
+*   **Jellyfin:** Free software media system.
--   **Gitea:** Lightweight Git service (this repository is hosted on it!), also serving documentation via MkDocs.
+*   **Filebrowser:** Web interface to browse and manage files.
--   **Gitea Runner:** A runner for Gitea actions.
+*   **LibreOffice Online:** A web-based version of the LibreOffice suite for in-browser document editing.
--   **MkDocs ZipponDB:** Serves documentation generated by MkDocs.
+*   **Gitea & Gitea Runner:** A lightweight Git service and a runner for Gitea actions.
--   **Actual Budget:** Local-first personal finance app.
+*   **MkDocs:** Serves a static documentation site generated by MkDocs.
--   **MinIO:** High performance, S3 compatible object storage.
+*   **Docker Registry & UI:** A private Docker registry to store custom images, complete with a web interface for management.
--   **Open WebUI:** A user-friendly interface for interacting with large language models.
+*   **Actual Budget:** Local-first personal finance app.
--   **Ollama:** A framework for running large language models locally, with GPU support.
+*   **MinIO:** High performance, S3 compatible object storage. For DVC.
--   **Personal Website (website-pro):** A custom-built professional website.
+*   **Open WebUI & Pipelines:** A user-friendly interface for interacting with large language models, supported by a backend pipeline service.
+*   **Web-based Arch Linux Terminals:** Two `ttyd`-based containers (`arch-cpu` and `arch-gpu`) providing persistent Arch Linux environments accessible through a web browser, with one configured for GPU access.
 
----
+***
 
 ### Usage
 
-This repository is not intended for direct cloning and deployment as-is. It is highly tailored to my specific setup, including domain names (`bouvais.lu`), paths, and personal configurations.
+This repository is not intended for direct cloning and deployment as-is. It is highly tailored to my specific setup, including domain names (`bouvais.lu`), paths, and personal configurations. However, you can use this repository as an example or reference.
-However, you can use this repository as an example or reference.

apps.yml

@@ -1,17 +1,4 @@
 services:
-  #memos:
-  #  image: neosmemo/memos:stable
-  #  container_name: memos
-  #  restart: unless-stopped
-  #  volumes:
-  #    - "./hdd0/memos:/var/opt/memos"
-  #  labels:
-  #    - "traefik.enable=true"
-  #    - "traefik.http.routers.memos.rule=Host(`notes.bouvais.lu`)"
-  #    - "traefik.http.routers.memos.entrypoints=websecure"
-  #    - "traefik.http.routers.memos.tls.certresolver=myresolver"
-  #    - "traefik.http.services.memos.loadbalancer.server.port=5230"
-
   jellyfin:
     image: jellyfin/jellyfin
     container_name: jellyfin
@@ -20,17 +7,17 @@ services:
       - '107' #render
       - '44' #video
     volumes:
-      - "./cache/jellyfin/cache:/cache"
+      - ./cache/jellyfin/cache:/cache
-      - "./hdd0/jellyfin/config:/config"
+      - ./hdd0/jellyfin/config:/config
       - type: bind
         source: ./hdd0/media
         target: /media
     labels:
-      - "traefik.enable=true"
+      - traefik.enable=true
-      - "traefik.http.routers.jellyfin.rule=Host(`jellyfin.bouvais.lu`)"
+      - traefik.http.routers.jellyfin.rule=Host(`jellyfin.bouvais.lu`)
-      - "traefik.http.routers.jellyfin.entrypoints=websecure"
+      - traefik.http.routers.jellyfin.entrypoints=websecure
-      - "traefik.http.routers.jellyfin.tls.certresolver=myresolver"
+      - traefik.http.routers.jellyfin.tls.certresolver=myresolver
-      - "traefik.http.services.jellyfin.loadbalancer.server.port=8096"
+      - traefik.http.services.jellyfin.loadbalancer.server.port=8096
 
   filebrowser:
     image: filebrowser/filebrowser:latest
@@ -40,70 +27,41 @@ services:
       TZ: Europe/Luxembourg
       FB_BASEURL: /
     volumes:
-      - "./config/filebrowser/filebrowser.json:/.filebrowser.json"
+      - ./config/filebrowser/filebrowser.json:/.filebrowser.json
-      - "./hdd0/filebrowser/filebrowser.db:/database.db" 
+      - ./hdd0/filebrowser/filebrowser.db:/database.db 
-      - "./hdd0/my_files:/srv"
+      - ./hdd0/my_files:/srv
+      - ./hdd0/media:/srv/media
     labels:
-      - "traefik.enable=true"
+      - traefik.enable=true
-      - "traefik.http.routers.filebrowser.rule=Host(`files.bouvais.lu`)"
+      - traefik.http.routers.filebrowser.rule=Host(`files.bouvais.lu`)
-      - "traefik.http.routers.filebrowser.entrypoints=websecure"
+      - traefik.http.routers.filebrowser.entrypoints=websecure
-      - "traefik.http.routers.filebrowser.tls.certresolver=myresolver"
+      - traefik.http.routers.filebrowser.tls.certresolver=myresolver
-      - "traefik.http.services.filebrowser.loadbalancer.server.port=80"
+      - traefik.http.services.filebrowser.loadbalancer.server.port=80
-
-  actualbudget:
-    image: actualbudget/actual-server:latest
-    container_name: actualbudget
-    restart: unless-stopped
-    volumes:
-      - "./hdd0/actualbudget:/data"
-    environment:
-      - TZ=Europe/Luxembourg
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.actualbudget.rule=Host(`budget.bouvais.lu`)"
-      - "traefik.http.routers.actualbudget.entrypoints=websecure"
-      - "traefik.http.routers.actualbudget.tls.certresolver=myresolver"
-      - "traefik.http.services.actualbudget.loadbalancer.server.port=5006"
 
   vaultwarden:
-    image: vaultwarden/server:1.33.2
+    image: vaultwarden/server:latest
     container_name: vaultwarden
     restart: unless-stopped
     environment:
-      DOMAIN: "https://vault.bouvais.lu"
+      DOMAIN: https://vault.bouvais.lu
-      SIGNUPS_ALLOWED: false
+      SIGNUPS_ALLOWED: true
+      ADMIN_TOKEN: ${ADMIN_PASSWORD}
+    ports:
+      - "80:80"
     volumes:
-      - "./hdd0/vaultwarden:/data/"
+      - ./hdd0/vaultwarden:/data/
     labels:
-      - "traefik.enable=true"
+      - traefik.enable=true
-      - "traefik.http.services.my-vaultwarden-service.loadbalancer.server.port=80"
+      - traefik.http.services.my-vaultwarden-service.loadbalancer.server.port=80
-      - "traefik.http.routers.vaultwarden.rule=Host(`vault.bouvais.lu`)"
+      - traefik.http.routers.vaultwarden.rule=Host(`vault.bouvais.lu`)
-      - "traefik.http.routers.vaultwarden.entrypoints=websecure"
+      - traefik.http.routers.vaultwarden.entrypoints=websecure
-      - "traefik.http.routers.vaultwarden.tls.certresolver=myresolver"
+      - traefik.http.routers.vaultwarden.tls.certresolver=myresolver
-      - "traefik.http.routers.vaultwarden.service=my-vaultwarden-service@docker"
+      - traefik.http.routers.vaultwarden.service=my-vaultwarden-service@docker
-      - "traefik.http.routers.vaultwarden-admin.rule=Host(`vault.bouvais.lu`) && PathPrefix(`/admin`)"
+      - traefik.http.routers.vaultwarden-admin.rule=Host(`vault.bouvais.lu`) && PathPrefix(`/admin`)
-      - "traefik.http.routers.vaultwarden-admin.entrypoints=websecure"
+      - traefik.http.routers.vaultwarden-admin.entrypoints=websecure
-      - "traefik.http.routers.vaultwarden-admin.tls.certresolver=myresolver"
+      - traefik.http.routers.vaultwarden-admin.tls.certresolver=myresolver
-      - "traefik.http.routers.vaultwarden-admin.middlewares=auth@docker"
+      - traefik.http.routers.vaultwarden-admin.middlewares=auth@docker
-      - "traefik.http.routers.vaultwarden-admin.service=my-vaultwarden-service@docker"
+      - traefik.http.routers.vaultwarden-admin.service=my-vaultwarden-service@docker
-
-  siyuan:
-    image: b3log/siyuan
-    container_name: siyuan
-    command: ['--workspace=/siyuan/workspace/']
-    volumes:
-      - /siyuan/workspace:/siyuan/workspace
-      - "./hdd0/siyuan/workspace:/siyuan/workspace"
-    restart: unless-stopped
-    environment:
-      - TZ=Europe/Luxembourg
-      - SIYUAN_ACCESS_AUTH_CODE=${SIYUAN_ACCESS_AUTH_CODE}
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.siyuan.rule=Host(`notes.bouvais.lu`)"
-      - "traefik.http.routers.siyuan.entrypoints=websecure"
-      - "traefik.http.routers.siyuan.tls.certresolver=myresolver"
-      - "traefik.http.services.siyuan.loadbalancer.server.port=6806"
 
   libreoffice:
     image: lscr.io/linuxserver/libreoffice:latest
@@ -115,14 +73,43 @@ services:
       - PASSWORD=${MASTER_PASSWORD}
       - TZ=Europe/Luxembourg
     ports:
-      - "3000:3000"
+      - 3000:3000
-      - "3001:3001"
+      - 3001:3001
     volumes:
       - ./hdd0/libreoffice:/config
+      - ./hdd0/my_files/:/data
     restart: unless-stopped
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.libreoffice.rule=Host(`libreoffice.bouvais.lu`)
+      - traefik.http.routers.libreoffice.entrypoints=websecure
+      - traefik.http.routers.libreoffice.tls.certresolver=myresolver
+      - traefik.http.services.libreoffice.loadbalancer.server.port=3000
+
+  home:
+    image: registry.bouvais.lu/home:v0.1.4
+    container_name: home
+    restart: unless-stopped
+    depends_on:
+      - registry
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.libreoffice.rule=Host(`libreoffice.bouvais.lu`)"
+      - "traefik.http.routers.myapp.rule=Host(`home.bouvais.lu`)"
-      - "traefik.http.routers.libreoffice.entrypoints=websecure"
+      - "traefik.http.routers.myapp.entrypoints=websecure"
-      - "traefik.http.routers.libreoffice.tls.certresolver=myresolver"
+      - "traefik.http.routers.myapp.tls.certresolver=myresolver"
-      - "traefik.http.services.libreoffice.loadbalancer.server.port=3000"
+      - "traefik.http.services.myapp.loadbalancer.server.port=8080"
+
+  drawio:
+    image: jgraph/drawio:latest
+    container_name: drawio
+    restart: unless-stopped
+    environment:
+      - TZ=Europe/Luxembourg
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.drawio.rule=Host(`draw.bouvais.lu`)"
+      - "traefik.http.routers.drawio.entrypoints=websecure"
+      - "traefik.http.routers.drawio.tls.certresolver=myresolver"
+      - "traefik.http.services.drawio.loadbalancer.server.port=8080"
+
+

developer.yml

@@ -1,15 +1,15 @@
 services:
   gitea:
-    image: "docker.gitea.com/gitea:1.23.8"
+    image: docker.gitea.com/gitea:1.23.8
     container_name: gitea
-    restart: unless-stopped
+    restart: always
     environment:
       - GITEA_CUSTOM=/etc/gitea
     volumes:
-      - "./hdd0/gitea:/data"
+      - ./hdd0/gitea:/data
-      - "./config/gitea:/etc/gitea"
+      - ./config/gitea:/etc/gitea
-      - "/etc/timezone:/etc/timezone:ro"
+      - /etc/timezone:/etc/timezone:ro
-      - "/etc/localtime:/etc/localtime:ro"
+      - /etc/localtime:/etc/localtime:ro
     labels:
       - traefik.enable=true
       # HTTP/S
@@ -21,6 +21,14 @@ services:
       - traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)
       - traefik.tcp.routers.gitea-ssh.entrypoints=ssh
       - traefik.tcp.services.gitea-ssh.loadbalancer.server.port=22
+    deploy:
+      resources:
+        limits:
+          memory: 4G
+          cpus: 2
+        reservations:
+          memory: 512M
+          cpus: 1
 
   gitea-runner:
     image: docker.io/gitea/act_runner:latest
@@ -36,20 +44,6 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./hdd0/mkdocs-sites:/sites
 
-  mkdocs-zippondb:
-    image: squidfunk/mkdocs-material
-    container_name: mkdocs-zippondb
-    restart: unless-stopped
-    volumes:
-      - ./hdd0/mkdocs-sites/zippondb:/docs
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.gitea_runner.rule=Host(`docs.bouvais.lu`)
-      - traefik.http.routers.gitea_runner.entrypoints=websecure
-      - traefik.http.routers.gitea_runner.tls.certresolver=myresolver
-      - traefik.http.routers.gitea_runner.middlewares=auth@docker
-      - traefik.http.services.gitea_runner.loadbalancer.server.port=3000
-
   registry:
     image: registry:2
     container_name: registry
@@ -86,3 +80,47 @@ services:
       - traefik.http.routers.registry_ui.entrypoints=websecure
       - traefik.http.routers.registry_ui.tls.certresolver=myresolver 
       - traefik.http.services.registry_ui.loadbalancer.server.port=80
+
+  garage:
+    image: dxflrs/garage:v2.1.0
+    container_name: garage
+    restart: unless-stopped
+    volumes:
+      - ./config/garage/garage.toml:/etc/garage.toml
+      - ./hdd0/garage/meta:/var/lib/garage/meta
+      - ./hdd0/garage/data:/var/lib/garage/data
+    environment:
+      - RUST_LOG=garage=info
+    labels:
+      - traefik.enable=true
+
+      # S3 API
+      - traefik.http.routers.garages3.rule=Host(`s3.garage.bouvais.lu`)
+      - traefik.http.routers.garages3.entrypoints=websecure
+      - traefik.http.routers.garages3.tls.certresolver=myresolver
+      - traefik.http.routers.garages3.service=garages3
+      - traefik.http.services.garages3.loadbalancer.server.port=3900
+
+      # Admin API
+      - traefik.http.routers.garageadmin.rule=Host(`admin.garage.bouvais.lu`)
+      - traefik.http.routers.garageadmin.entrypoints=websecure
+      - traefik.http.routers.garageadmin.tls.certresolver=myresolver
+      - traefik.http.routers.garageadmin.service=garageadmin
+      - traefik.http.services.garageadmin.loadbalancer.server.port=3903
+
+      # Web (Garage's internal web endpoint)
+      - traefik.http.routers.garageweb.rule=Host(`web.garage.bouvais.lu`)
+      - traefik.http.routers.garageweb.entrypoints=websecure
+      - traefik.http.routers.garageweb.tls.certresolver=myresolver
+      - traefik.http.routers.garageweb.service=garageweb_svc
+      - traefik.http.services.garageweb_svc.loadbalancer.server.port=3902
+      
+      - traefik.http.routers.mystaticsite.rule=Host(`zig-dimal.bouvais.lu`)
+      - traefik.http.routers.mystaticsite.entrypoints=websecure
+      - traefik.http.routers.mystaticsite.tls.certresolver=myresolver
+      - traefik.http.routers.mystaticsite.service=garageweb_svc
+      
+      - traefik.http.routers.mystaticsite.rule=Host(`zigma.bouvais.lu`)
+      - traefik.http.routers.mystaticsite.entrypoints=websecure
+      - traefik.http.routers.mystaticsite.tls.certresolver=myresolver
+      - traefik.http.routers.mystaticsite.service=garageweb_svc

docker-compose.yml

@@ -2,34 +2,32 @@ include:
   - apps.yml
   - developer.yml
   - llm.yml
-  - monitoring.yml
-  - vms.yml
 
 services:
   traefik:
-    image: "traefik:v3.4"
+    image: traefik:latest
-    container_name: "traefik"
+    container_name: traefik
     restart: unless-stopped
     command:
       # HTTPS TSL stuff
-      - "--providers.docker=true"
+      - --providers.docker=true
-      - "--providers.docker.exposedbydefault=false"
+      - --providers.docker.exposedbydefault=false
-      - "--entryPoints.websecure.address=:443"
+      - --entryPoints.websecure.address=:443
-      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
+      - --certificatesresolvers.myresolver.acme.tlschallenge=true
-      - "--certificatesresolvers.myresolver.acme.email=adrien.bouvais.pro@gmail.com"
+      - --certificatesresolvers.myresolver.acme.email=adrien.bouvais.pro@gmail.com
-      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json" # Relative path on SSD
+      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
       # Enable Traefik API and Dashboard (securely)
-      - "--api.dashboard=true"
+      - --api.dashboard=true
-      - "--metrics.prometheus=true"
+      - --metrics.prometheus=true
-      - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
+      - --metrics.prometheus.buckets=0.1,0.3,1.2,5.0
-      - "--entryPoints.ssh.address=:2101"
+      - --entryPoints.ssh.address=:2101
-      - "--entrypoints.web.transport.respondingTimeouts.readTimeout=180m"
+      - --entrypoints.web.transport.respondingTimeouts.readTimeout=180m
-      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=180m"
+      - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=180m
       # Logs - Traefik will write its logs to /logs within the container, which maps to /data/logs on host
-      - "--accesslog=true"
+      - --accesslog=true
-      - "--accesslog.format=json"
+      - --accesslog.format=json
-      - "--accesslog.filepath=/logs/access.log"
+      - --accesslog.filepath=/logs/access.log
-      - "--accesslog.bufferingSize=0"
+      - --accesslog.bufferingSize=0
     ports:
       - target: 443
         published: 443
@@ -40,30 +38,30 @@ services:
         protocol: tcp
         mode: host
     volumes:
-      - "./letsencrypt:/letsencrypt"
+      - ./letsencrypt:/letsencrypt
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - "./config/users.cred:/users.cred"
+      - ./config/users.cred:/users.cred
-      - "./hdd0/logs:/logs"
+      - ./hdd0/logs:/logs
     labels:
-      - "traefik.enable=true"
+      - traefik.enable=true
       # Dashboard Router
-      - "traefik.http.routers.dashboard.rule=Host(`traefik.bouvais.lu`)"
+      - traefik.http.routers.dashboard.rule=Host(`traefik.bouvais.lu`)
-      - "traefik.http.routers.dashboard.entrypoints=websecure"
+      - traefik.http.routers.dashboard.entrypoints=websecure
-      - "traefik.http.routers.dashboard.service=api@internal"
+      - traefik.http.routers.dashboard.service=api@internal
-      - "traefik.http.routers.dashboard.middlewares=auth@docker"
+      - traefik.http.routers.dashboard.middlewares=auth@docker
-      - "traefik.http.routers.dashboard.tls.certresolver=myresolver"
+      - traefik.http.routers.dashboard.tls.certresolver=myresolver
       # Traefik Middleware
-      - "traefik.http.middlewares.auth.basicauth.usersfile=/users.cred"
+      - traefik.http.middlewares.auth.basicauth.usersfile=/users.cred
-      - "traefik.http.middlewares.ratelimit.ratelimit.average=20"
+      - traefik.http.middlewares.ratelimit.ratelimit.average=20
-      - "traefik.http.middlewares.ratelimit.ratelimit.burst=40"
+      - traefik.http.middlewares.ratelimit.ratelimit.burst=40
         # bouvais.lu redirection
-      - "traefik.http.routers.bouvais-redirect.rule=Host(`bouvais.lu`)"
+      - traefik.http.routers.bouvais-redirect.rule=Host(`bouvais.lu`)
-      - "traefik.http.routers.bouvais-redirect.entrypoints=websecure"
+      - traefik.http.routers.bouvais-redirect.entrypoints=websecure
-      - "traefik.http.routers.bouvais-redirect.middlewares=redirect-to-gitea@docker"
+      - traefik.http.routers.bouvais-redirect.middlewares=redirect-to-gitea@docker
-      - "traefik.http.routers.bouvais-redirect.tls.certresolver=myresolver"
+      - traefik.http.routers.bouvais-redirect.tls.certresolver=myresolver
-      - "traefik.http.middlewares.redirect-to-gitea.redirectregex.regex=^https?://(www\\.)?bouvais\\.lu(.*)"
+      - traefik.http.middlewares.redirect-to-gitea.redirectregex.regex=^https?://(www\\.)?bouvais\\.lu(.*)
-      - "traefik.http.middlewares.redirect-to-gitea.redirectregex.replacement=https://git.bouvais.lu$${2}"
+      - traefik.http.middlewares.redirect-to-gitea.redirectregex.replacement=https://git.bouvais.lu$${2}
-      - "traefik.http.middlewares.redirect-to-gitea.redirectregex.permanent=true"
+      - traefik.http.middlewares.redirect-to-gitea.redirectregex.permanent=true
 
   fail2ban:
     image: crazymax/fail2ban:1.1.0
@@ -74,11 +72,11 @@ services:
       - NET_RAW
     network_mode: host
     volumes:
-      - "./hdd0/fail2ban/data:/data"
+      - ./hdd0/fail2ban/data:/data
-      - "./hdd0/fail2ban/log:/var/log"
+      - ./hdd0/fail2ban/log:/var/log
-      - "./hdd0/logs:/logs:ro"
+      - ./hdd0/logs:/logs:ro
-      - "/etc/localtime:/etc/localtime:ro"
+      - /etc/localtime:/etc/localtime:ro
-      - "/etc/timezone:/etc/timezone:ro"
+      - /etc/timezone:/etc/timezone:ro
     environment:
       - F2B_IPTABLES_CHAIN=DOCKER-USER
 
@@ -87,78 +85,52 @@ services:
     container_name: kopia
     restart: unless-stopped
     command:
-        - server
+      - server
-        - start
+      - start
-        - --insecure
+      - --insecure
-        - --address=0.0.0.0:51515
+      - --address=0.0.0.0:51515
-        - --server-username=adrien
+      - --server-username=adrien
-        - --server-password=${MASTER_PASSWORD}
+      - --server-password=${MASTER_PASSWORD}
     environment:
-        KOPIA_PASSWORD: ${MASTER_PASSWORD}
+      - KOPIA_PASSWORD=${MASTER_PASSWORD}
-        USER: "adrien"
+      - USER=adrien
     volumes:
-        - ./config/kopia:/app/config
+      - ./config/kopia:/app/config
-        - ./cache/kopia:/app/cache
+      - ./cache/kopia:/app/cache
-        - ./hdd0/logs/:/app/logs
+      - ./hdd0/logs/:/app/logs
-        - ./hdd0:/hdd0
+      - ./hdd0:/hdd0
-        - ./hdd0_backups/kopia/dir:/repository
+      - ./hdd0_backups/kopia/dir:/repository
-        - ./hdd0_backups/kopia/shared:/tmp:shared
+      - ./hdd0_backups/kopia/shared:/tmp:shared
     labels:
-      - "traefik.enable=true"
+      - traefik.enable=true
-      - "traefik.http.routers.kopia.rule=Host(`kopia.bouvais.lu`)"
+      - traefik.http.routers.kopia.rule=Host(`kopia.bouvais.lu`)
-      - "traefik.http.routers.kopia.entrypoints=websecure"
+      - traefik.http.routers.kopia.entrypoints=websecure
-      - "traefik.http.routers.kopia.tls.certresolver=myresolver"
+      - traefik.http.routers.kopia.tls.certresolver=myresolver
-      - "traefik.http.services.kopia.loadbalancer.server.port=51515"
+      - traefik.http.services.kopia.loadbalancer.server.port=51515
 
-  kopia-gcp:
+  # kopia-cloud:
-    image: kopia/kopia:latest
+  #   image: kopia/kopia:latest
-    container_name: kopia-gcp
+  #   container_name: kopia-cloud
-    restart: unless-stopped
+  #   restart: unless-stopped
-    command:
+  #   command:
-        - server
+  #     - server
-        - start
+  #     - start
-        - --insecure
+  #     - --insecure
-        - --address=0.0.0.0:51516
+  #     - --address=0.0.0.0:51516
-        - --server-username=adrien
+  #     - --server-username=adrien
-        - --server-password=${MASTER_PASSWORD}
+  #     - --server-password=${MASTER_PASSWORD}
-    environment:
+  #   environment:
-        KOPIA_PASSWORD: ${MASTER_PASSWORD}
+  #       KOPIA_PASSWORD: ${MASTER_PASSWORD}
-        USER: "adrien"
+  #       USER: "adrien"
-    volumes:
+  #   volumes:
-        - ./config/kopia-gcp:/app/config
+  #     - ./config/kopia-cloud:/app/config
-        - ./cache/kopia-gcp:/app/cache
+  #     - ./cache/kopia-cloud:/app/cache
-        - ./hdd0/logs/gcp:/app/logs
+  #     - ./hdd0/logs/kopia-cloud:/app/logs
-        - ./hdd0:/hdd0
+  #     - ./hdd0:/hdd0
-        - ./kopia-gcp-key.json:/cred.json
+  #     - ./kopia-gcp-key.json:/cred.json
-    labels:
+  #   labels:
-      - "traefik.enable=true"
+  #     - traefik.enable=true
-      - "traefik.http.routers.kopia_gcp.rule=Host(`kopia-gcp.bouvais.lu`)"
+  #     - traefik.http.routers.kopia_gcp.rule=Host(`kopia-cloud.bouvais.lu`)
-      - "traefik.http.routers.kopia_gcp.entrypoints=websecure"
+  #     - traefik.http.routers.kopia_gcp.entrypoints=websecure
-      - "traefik.http.routers.kopia_gcp.tls.certresolver=myresolver"
+  #     - traefik.http.routers.kopia_gcp.tls.certresolver=myresolver
-      - "traefik.http.services.kopia_gcp.loadbalancer.server.port=51516"
+  #     - traefik.http.services.kopia_gcp.loadbalancer.server.port=51516
-
-  minio:
-    image: minio/minio:latest
-    container_name: minio
-    restart: unless-stopped
-    environment:
-      MINIO_ROOT_USER: adrien
-      MINIO_ROOT_PASSWORD: ${MASTER_PASSWORD}
-    command: server /data --console-address ":9001"
-    volumes:
-      - ./hdd0/minio_data:/data
-    labels:
-      - "traefik.enable=true"
-      # Router and service for the MinIO API
-      - "traefik.http.routers.minio-api.rule=Host(`minio-api.bouvais.lu`)"
-      - "traefik.http.routers.minio-api.entrypoints=websecure"
-      - "traefik.http.routers.minio-api.tls.certresolver=myresolver"
-      - "traefik.http.services.minio-api-service.loadbalancer.server.port=9000"
-      - "traefik.http.routers.minio-api.service=minio-api-service"
-
-      # Router and service for the MinIO Console (WebUI)
-      - "traefik.http.routers.minio-console.rule=Host(`minio-console.bouvais.lu`)"
-      - "traefik.http.routers.minio-console.entrypoints=websecure"
-      - "traefik.http.routers.minio-console.tls.certresolver=myresolver"
-      - "traefik.http.services.minio-console-service.loadbalancer.server.port=9001"
-      - "traefik.http.routers.minio-console.service=minio-console-service"

llm.yml

@@ -6,32 +6,35 @@ services:
     volumes:
       - ./hdd0/openwebui:/app/backend/data
     labels:
-      - "traefik.enable=true"
+      - traefik.enable=true
-      - "traefik.http.routers.openwebui.rule=Host(`openwebui.bouvais.lu`)"
+      - traefik.http.routers.openwebui.rule=Host(`openwebui.bouvais.lu`)
-      - "traefik.http.routers.openwebui.entrypoints=websecure"
+      - traefik.http.routers.openwebui.entrypoints=websecure
-      - "traefik.http.routers.openwebui.tls.certresolver=myresolver"
+      - traefik.http.routers.openwebui.tls.certresolver=myresolver
-      - "traefik.http.services.openwebui.loadbalancer.server.port=8080"
+      - traefik.http.services.openwebui.loadbalancer.server.port=8080
     environment:
       OLLAMA_BASE_URLS: http://ollama:11434
 
-  # ollama:
-  #   image: ollama/ollama:latest
-  #   container_name: ollama
-  #   volumes:
-  #     - ./hdd0/ollama:/root/.ollama
-  #   deploy:
-  #     resources:
-  #       reservations:
-  #         devices:
-  #           - driver: nvidia
-  #             capabilities: ["gpu"]
-  #             count: all
-
   openwebui-pipeline:
     image: ghcr.io/open-webui/pipelines:main
     container_name: openwebui-pipelines
     restart: unless-stopped
     ports:
-      - "9099:9099"
+      - 9099:9099
     volumes:
       - ./hdd0/openwebui-pipelines:/app/pipelines
+
+  ollama:
+    image: ollama/ollama:latest
+    container_name: ollama
+    restart: unless-stopped
+    volumes:
+      - ./usb1/ollama:/root/.ollama
+    environment:
+      - OLLAMA_CONTEXT_LENGTH=64000
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: 1
+              capabilities: [gpu]

monitoring.yml

@@ -9,22 +9,19 @@ services:
       - ./config/prometheus:/etc/prometheus
       - ./hdd0/prometheus:/prometheus
     command:
-      - '--config.file=/etc/prometheus/prometheus.yml'
+      - --config.file=/etc/prometheus/prometheus.yml
-      - '--storage.tsdb.path=/prometheus'
+      - --storage.tsdb.path=/prometheus
-      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
+      - --web.console.libraries=/usr/share/prometheus/console_libraries
-      - '--web.console.templates=/usr/share/prometheus/consoles'
+      - --web.console.templates=/usr/share/prometheus/consoles
-      - '--web.enable-lifecycle'
+      - --web.enable-lifecycle
     labels:
-      - "traefik.enable=true"
+      - traefik.enable=true
-      - "traefik.http.routers.prometheus.rule=Host(`prometheus.bouvais.lu`)"
+      - traefik.http.routers.prometheus.rule=Host(`prometheus.bouvais.lu`)
-      - "traefik.http.routers.prometheus.entrypoints=websecure"
+      - traefik.http.routers.prometheus.entrypoints=websecure
-      - "traefik.http.routers.prometheus.tls.certresolver=myresolver"
+      - traefik.http.routers.prometheus.tls.certresolver=myresolver
-      - "traefik.http.routers.prometheus.service=prometheus"
+      - traefik.http.routers.prometheus.service=prometheus
-      - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
+      - traefik.http.services.prometheus.loadbalancer.server.port=9090
-      - "traefik.http.routers.prometheus.middlewares=auth@docker"
+      - traefik.http.routers.prometheus.middlewares=auth@docker
-    depends_on:
-      - cadvisor
-      - node-exporter
 
   grafana:
     image: grafana/grafana:12.0.1
@@ -39,30 +36,16 @@ services:
       - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_MY_PASSWORD}
       - GF_SERVER_ROOT_URL=https://grafana.bouvais.lu
     labels:
-      - "traefik.enable=true"
+      - traefik.enable=true
-      - "traefik.http.routers.grafana.rule=Host(`grafana.bouvais.lu`)"
+      - traefik.http.routers.grafana.rule=Host(`grafana.bouvais.lu`)
-      - "traefik.http.routers.grafana.entrypoints=websecure"
+      - traefik.http.routers.grafana.entrypoints=websecure
-      - "traefik.http.routers.grafana.tls.certresolver=myresolver"
+      - traefik.http.routers.grafana.tls.certresolver=myresolver
-      - "traefik.http.routers.grafana.service=grafana"
+      - traefik.http.routers.grafana.service=grafana
-      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
+      - traefik.http.services.grafana.loadbalancer.server.port=3000
-      - "traefik.http.routers.grafana.middlewares=auth@docker"
+      - traefik.http.routers.grafana.middlewares=auth@docker
     depends_on:
       - prometheus
-
+  #
-  cadvisor:
-    image: gcr.io/cadvisor/cadvisor:v0.52.0
-    container_name: cadvisor
-    privileged: true
-    restart: unless-stopped
-    volumes:
-      - /:/rootfs:ro
-      - /var/run:/var/run:rw
-      - /sys:/sys:ro
-      - /var/lib/docker/:/var/lib/docker:ro
-      - /dev/disk/:/dev/disk:ro
-    devices:
-      - /dev/kmsg:/dev/kmsg
-
   node-exporter:
     image: prom/node-exporter:v1.9.1
     container_name: node-exporter
@@ -73,26 +56,7 @@ services:
       - /sys:/host/sys:ro
       - /:/rootfs:ro
     command:
-      - '--path.procfs=/host/proc'
+      - --path.procfs=/host/proc
-      - '--path.sysfs=/host/sys'
+      - --path.sysfs=/host/sys
-      - '--path.rootfs=/rootfs'
+      - --path.rootfs=/rootfs
-      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)'
+      - --collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)
-
-  nvidia-gpu-exporter:
-    image: utkuozdemir/nvidia_gpu_exporter:1.3.1
-    container_name: nvidia-gpu-exporter
-    restart: unless-stopped
-    privileged: true # This might be needed for full access to devices, or try without first
-    devices:
-      - /dev/nvidia0:/dev/nvidia0
-    volumes:
-      - /usr/bin/nvidia-smi:/usr/bin/nvidia-smi:ro
-      - /usr/lib/x86_64-linux-gnu/libnvidia-ml.so:/usr/lib/x86_64-linux-gnu/libnvidia-ml.so:ro
-      - /usr/lib/x86_64-linux-gnu/libnvidia-ml.so.1:/usr/lib/x86_64-linux-gnu/libnvidia-ml.so.1:ro
-    command:
-      - --web.listen-address=:9835
-      - --web.telemetry-path=/metrics
-      - --nvidia-smi-command=nvidia-smi
-      - --log.level=info
-      - --query-field-names=AUTO
-      - --log.format=logfmt

vms.yml

@@ -1,60 +0,0 @@
-services:
-  arch-cpu:
-    image: registry.bouvais.lu/vms/arch-ttyd-cpu:1.0.0
-    container_name: arch-cpu
-    restart: unless-stopped
-    volumes:
-      - ./hdd0/vms/arch/data:/data
-      - ./hdd0/vms/arch/root:/root
-    command: >
-      ttyd
-      -p 7681
-      -c "${TTYD_USERNAME}:${MASTER_PASSWORD}"
-      -W
-      bash
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.arch.rule=Host(`arch.bouvais.lu`)"
-      - "traefik.http.routers.arch.entrypoints=websecure"
-      - "traefik.http.routers.arch.tls.certresolver=myresolver"
-      - "traefik.http.services.arch.loadbalancer.server.port=7681"
-    deploy:
-      resources:
-        limits:
-          cpus: '1.0'
-          memory: 512M
-        reservations:
-          cpus: '0.5'
-          memory: 256M
-
-  arch-gpu:
-    image: registry.bouvais.lu/vms/arch-ttyd-gpu:1.0.0
-    container_name: arch-gpu
-    restart: unless-stopped
-    volumes:
-      - ./hdd0/vms/arch_gpu/data:/data
-      - ./hdd0/vms/arch_gpu/root:/root
-    command: >
-      ttyd
-      -p 7682
-      -c "${TTYD_USERNAME}:${MASTER_PASSWORD}"
-      -W
-      bash
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.arch_gpu.rule=Host(`arch-gpu.bouvais.lu`)"
-      - "traefik.http.routers.arch_gpu.entrypoints=websecure"
-      - "traefik.http.routers.arch_gpu.tls.certresolver=myresolver"
-      - "traefik.http.services.arch_gpu.loadbalancer.server.port=7682"
-    deploy:
-      resources:
-        limits:
-          cpus: '2.0'
-          memory: 1G
-        reservations:
-          cpus: '0.5'
-          memory: 256M
-          devices:
-            - driver: nvidia
-              capabilities: ["gpu"]
-              count: all

website.yml

@@ -1,13 +0,0 @@
-services:
-  website-pro:
-    build:
-      context: ./website-pro
-      dockerfile: Dockerfile
-    container_name: website-pro
-    restart: unless-stopped
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.www.rule=Host(`www.bouvais.lu`)"
-      - "traefik.http.routers.www.entrypoints=websecure"
-      - "traefik.http.routers.www.tls.certresolver=myresolver"
-      - "traefik.http.services.www.loadbalancer.server.port=8080"