Update authentik

Reviewed-on: #16

.archived/adguardhome-sync/docker-compose.yml

@@ -0,0 +1,22 @@
+# Docker Compose configuration for AdGuardHome Sync service
+
+services:
+  adguardhome-sync:
+    # Basic container configuration
+    container_name: adguardhome-sync
+    image: docker.io/linuxserver/adguardhome-sync:0.7.6
+    restart: unless-stopped
+    
+    # Environment configuration
+    environment:
+      - PUID=${PUID}  # User ID for the container
+      - PGID=${PGID}  # Group ID for the container
+      - TZ=${TZ}      # Timezone
+    
+    # Persistent storage configuration
+    volumes:
+      - ${CONFIG_PATH}:/config  # Maps host config directory to container
+    
+    # Network port configuration
+    ports:
+      - ${PORT}:8080  # Web interface port

.archived/gickup/docker-compose.yml

@@ -0,0 +1,18 @@
+# Gickup service configuration
+services:
+  gickup:
+    # Basic container configuration
+    container_name: gickup
+    image: ghcr.io/cooperspencer/gickup:0.10.38
+    restart: unless-stopped
+    
+    # Command to run when the container starts
+    command: ["/gickup/conf.yml"]  # Points to the configuration file inside the container
+    
+    # Environment variables
+    environment:
+      - TZ=${TZ}  # Timezone
+    
+    # Persistent storage configuration
+    volumes:
+      - ${APPDATA_PATH}/gickup/conf.yml:/gickup/conf.yml

.archived/gitea-mirror/docker-compose.yml

@@ -23,10 +23,6 @@ services:
     ports:
       - ${PORT}:4321  # Maps host port to container
     
-    # Network configuration
-    networks:
-      - internal  # Connects to internal network
-    
     # Health check configuration
     healthcheck:
       test: ["CMD", "wget", "--no-verbose", "--tries=3", "--spider", "http://localhost:4321/api/health"]
@@ -34,8 +30,3 @@ services:
       timeout: 10s  # Check timeout
       retries: 5  # Allowed retries
       start_period: 15s  # Initial delay before checks
-
-# External network definition
-networks:
-  internal:
-    external: true  # Uses pre-existing internal network

.archived/glance/docker-compose.yml

@@ -0,0 +1,22 @@
+# Glance - A modern dashboard for your self-hosted services
+# Documentation: https://glanceapp.io/docs
+
+services:
+  glance:
+    # Basic container configuration
+    container_name: glance
+    image: glanceapp/glance:v0.8.4  # Official Glance image with version
+    restart: unless-stopped  # Automatically restart unless explicitly stopped
+
+    # Environment variables configuration
+    environment:
+      - MY_SECRET_TOKEN=${MY_SECRET_TOKEN}  # Secret token for API authentication
+    
+    # Persistent storage configuration
+    volumes:
+      - ${APPDATA_PATH}/glance/config:/app/config  # Configuration files
+      - ${APPDATA_PATH}/glance/assets:/app/assets  # Static assets and cache
+    
+    # Network configuration
+    ports:
+      - ${PORT}:8080  # Map host port to container port (host:container)

.archived/glance/glance.yml

@@ -0,0 +1,105 @@
+pages:
+  - name: Home
+    # Optionally, if you only have a single page you can hide the desktop navigation for a cleaner look
+    # hide-desktop-navigation: true
+    columns:
+      - size: small
+        widgets:
+          - type: calendar
+            first-day-of-week: monday
+
+          - type: rss
+            limit: 10
+            collapse-after: 3
+            cache: 12h
+            feeds:
+              - url: https://selfh.st/rss/
+                title: selfh.st
+                limit: 4
+              - url: https://ciechanow.ski/atom.xml
+              - url: https://www.joshwcomeau.com/rss.xml
+                title: Josh Comeau
+              - url: https://samwho.dev/rss.xml
+              - url: https://ishadeed.com/feed.xml
+                title: Ahmad Shadeed
+
+          - type: twitch-channels
+            channels:
+              - theprimeagen
+              - j_blow
+              - piratesoftware
+              - cohhcarnage
+              - christitustech
+              - EJ_SA
+
+      - size: full
+        widgets:
+          - type: group
+            widgets:
+              - type: hacker-news
+              - type: lobsters
+
+          - type: videos
+            channels:
+              - UCXuqSBlHAE6Xw-yeJA0Tunw # Linus Tech Tips
+              - UCR-DXc1voovS8nhAvccRZhg # Jeff Geerling
+              - UCsBjURrPoezykLs9EqgamOA # Fireship
+              - UCBJycsmduvYEL83R_U4JriQ # Marques Brownlee
+              - UCHnyfMqiRRG1u-2MsSQLbXA # Veritasium
+
+          - type: group
+            widgets:
+              - type: reddit
+                subreddit: technology
+                show-thumbnails: true
+              - type: reddit
+                subreddit: selfhosted
+                show-thumbnails: true
+
+      - size: small
+        widgets:
+          - type: weather
+            location: London, United Kingdom
+            units: metric # alternatively "imperial"
+            hour-format: 12h # alternatively "24h"
+            # Optionally hide the location from being displayed in the widget
+            # hide-location: true
+
+          - type: markets
+            markets:
+              - symbol: SPY
+                name: S&P 500
+              - symbol: BTC-USD
+                name: Bitcoin
+              - symbol: NVDA
+                name: NVIDIA
+              - symbol: AAPL
+                name: Apple
+              - symbol: MSFT
+                name: Microsoft
+
+          - type: releases
+            cache: 1d
+            # Without authentication the Github API allows for up to 60 requests per hour. You can create a
+            # read-only token from your Github account settings and use it here to increase the limit.
+            # token: ...
+            repositories:
+              - glanceapp/glance
+              - go-gitea/gitea
+              - immich-app/immich
+              - syncthing/syncthing
+
+  # Add more pages here:
+  # - name: Your page name
+  #   columns:
+  #     - size: small
+  #       widgets:
+  #         # Add widgets here
+
+  #     - size: full
+  #       widgets:
+  #         # Add widgets here
+
+  #     - size: small
+  #       widgets:
+  #         # Add widgets here

.archived/glance/home.yml

@@ -0,0 +1,88 @@
+- name: Home
+  # Optionally, if you only have a single page you can hide the desktop navigation for a cleaner look
+  # hide-desktop-navigation: true
+  columns:
+    - size: small
+      widgets:
+        - type: calendar
+          first-day-of-week: monday
+
+        - type: rss
+          limit: 10
+          collapse-after: 3
+          cache: 12h
+          feeds:
+            - url: https://selfh.st/rss/
+              title: selfh.st
+            - url: https://ciechanow.ski/atom.xml
+            - url: https://www.joshwcomeau.com/rss.xml
+              title: Josh Comeau
+            - url: https://samwho.dev/rss.xml
+            - url: https://ishadeed.com/feed.xml
+              title: Ahmad Shadeed
+
+        - type: twitch-channels
+          channels:
+            - theprimeagen
+            - j_blow
+            - piratesoftware
+            - cohhcarnage
+            - christitustech
+            - EJ_SA
+
+    - size: full
+      widgets:
+        - type: group
+          widgets:
+            - type: hacker-news
+            - type: lobsters
+
+        - type: videos
+          channels:
+            - UCXuqSBlHAE6Xw-yeJA0Tunw # Linus Tech Tips
+            - UCR-DXc1voovS8nhAvccRZhg # Jeff Geerling
+            - UCsBjURrPoezykLs9EqgamOA # Fireship
+            - UCBJycsmduvYEL83R_U4JriQ # Marques Brownlee
+            - UCHnyfMqiRRG1u-2MsSQLbXA # Veritasium
+
+        - type: group
+          widgets:
+            - type: reddit
+              subreddit: technology
+              show-thumbnails: true
+            - type: reddit
+              subreddit: selfhosted
+              show-thumbnails: true
+
+    - size: small
+      widgets:
+        - type: weather
+          location: London, United Kingdom
+          units: metric # alternatively "imperial"
+          hour-format: 12h # alternatively "24h"
+          # Optionally hide the location from being displayed in the widget
+          # hide-location: true
+
+        - type: markets
+          markets:
+            - symbol: SPY
+              name: S&P 500
+            - symbol: BTC-USD
+              name: Bitcoin
+            - symbol: NVDA
+              name: NVIDIA
+            - symbol: AAPL
+              name: Apple
+            - symbol: MSFT
+              name: Microsoft
+
+        - type: releases
+          cache: 1d
+          # Without authentication the Github API allows for up to 60 requests per hour. You can create a
+          # read-only token from your Github account settings and use it here to increase the limit.
+          # token: ...
+          repositories:
+            - glanceapp/glance
+            - go-gitea/gitea
+            - immich-app/immich
+            - syncthing/syncthing

.archived/minio/docker-compose.yml

@@ -1,36 +0,0 @@
-# MinIO Object Storage Service Configuration
-services:
-  minio:
-    # Basic container configuration
-    container_name: minio
-    image: docker.io/minio/minio:RELEASE.2025-04-22T22-12-26Z
-    restart: unless-stopped
-    
-    # Runtime command and user permissions
-    command: server --console-address ":9001" /data
-    user: ${PUID}:${PGID}
-    
-    # Environment variables for authentication and configuration
-    environment:
-      - MINIO_ROOT_USER=${MINIO_ROOT_USER}  # Admin username
-      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}  # Admin password
-      - MINIO_SERVER_URL=${MINIO_SERVER_URL}  # Server endpoint
-      - MINIO_BROWSER_REDIRECT_URL=${MINIO_BROWSER_REDIRECT_URL}  # Console URL
-    
-    # Persistent data storage
-    volumes:
-      - ${APPDATA_PATH}/minio/data:/data  # Maps host directory to container
-    
-    # Network ports (API:9000, Console:9001)
-    ports:
-      - ${API_PORT}:9000  # MinIO API port
-      - ${CONSOLE_PORT}:9001  # MinIO Console port
-    
-    # Network configuration
-    networks:
-      - frontend  # Connects to frontend network
-
-# External network definition
-networks:
-  frontend:
-    external: true  # Uses pre-existing network

adminer/docker-compose.yml

@@ -9,12 +9,3 @@ services:
     # Network port configuration
     ports:
       - ${PORT}:8080  # Maps host port to Adminer web interface
-    
-    # Network configuration
-    networks:
-      - backend  # Connects to backend network
-
-# External network definition
-networks:
-  backend:
-    external: true  # Uses pre-existing backend network

authentik/docker-compose.yaml

@@ -1,16 +1,17 @@
 services:
-  authentik_postgres:
-    image: docker.io/library/postgres:17.5
-    container_name: authentik_postgres
+  authentik_db:
+    container_name: authentik_db
+    image: docker.io/library/postgres:17.5-alpine
+    restart: unless-stopped
     environment:
-      - POSTGRES_DB=${POSTGRES_DB}
+      # Database configuration
       - POSTGRES_USER=${POSTGRES_USER}
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
     volumes:
       - ${APPDATA_PATH}/authentik/db:/var/lib/postgresql/data
     ports:
       - ${POSTGRES_PORT}:5432
-    restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -d ${POSTGRES_DB} -U ${POSTGRES_USER}"]
       start_period: 20s
@@ -19,14 +20,12 @@ services:
       timeout: 5s
 
   authentik_valkey:
-    image: docker.io/valkey/valkey:8.1.2
     container_name: authentik_valkey
-    command: valkey-server --save 60 1 --loglevel warning --requirepass ${VALKEY_PASSWORD}
+    image: docker.io/valkey/valkey:8.1.3-alpine
+    restart: unless-stopped
+    command: valkey-server --save 60 1 --requirepass ${VALKEY_PASSWORD}
     volumes:
       - ${APPDATA_PATH}/authentik/valkey:/data
-    ports:
-      - ${VALKEY_PORT}:6379
-    restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "echo 'auth ${VALKEY_PASSWORD}\nping' | valkey-cli | grep PONG"]
       start_period: 20s
@@ -35,23 +34,30 @@ services:
       timeout: 3s
 
   authentik_server:
-    image: ghcr.io/goauthentik/server:2025.6.2
     container_name: authentik_server
+    image: ghcr.io/goauthentik/server:2025.6.3
+    restart: unless-stopped
     depends_on:
-      authentik_postgres:
+      authentik_db:
         condition: service_healthy
       authentik_valkey:
         condition: service_healthy
     command: server
     environment:
+      # Generic configuration
       - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
-      - AUTHENTIK_POSTGRESQL__HOST=authentik_postgres
+
+      # Database configuration
+      - AUTHENTIK_POSTGRESQL__HOST=authentik_db
       - AUTHENTIK_POSTGRESQL__NAME=${POSTGRES_DB}
       - AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER}
       - AUTHENTIK_POSTGRESQL__PASSWORD=${POSTGRES_PASSWORD}
+
+      # Valkey cache configuration
       - AUTHENTIK_REDIS__HOST=authentik_valkey
       - AUTHENTIK_REDIS__PASSWORD=${VALKEY_PASSWORD}
-      - AUTHENTIK_ERROR_REPORTING__ENABLED=${AUTHENTIK_ERROR_REPORTING__ENABLED}
+
+      # Email configuration
       - AUTHENTIK_EMAIL__HOST=${AUTHENTIK_EMAIL__HOST}
       - AUTHENTIK_EMAIL__PORT=${AUTHENTIK_EMAIL__PORT}
       - AUTHENTIK_EMAIL__USERNAME=${AUTHENTIK_EMAIL__USERNAME}
@@ -66,26 +72,33 @@ services:
     ports:
       - ${AUTHENTIK_HTTP_PORT}:9000
       - ${AUTHENTIK_HTTPS_PORT}:9443
-    restart: unless-stopped
 
   authentik_worker:
-    image: ghcr.io/goauthentik/server:2025.6.2
     container_name: authentik_worker
+    image: ghcr.io/goauthentik/server:2025.6.3
+    restart: unless-stopped
     depends_on:
-      authentik_postgres:
+      authentik_db:
         condition: service_healthy
       authentik_valkey:
         condition: service_healthy
     command: worker
+    user: ${PUID}:${PGID}
     environment:
+      # Generic configuration
       - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
-      - AUTHENTIK_POSTGRESQL__HOST=authentik_postgres
+
+      # Database configuration
+      - AUTHENTIK_POSTGRESQL__HOST=authentik_db
       - AUTHENTIK_POSTGRESQL__NAME=${POSTGRES_DB}
       - AUTHENTIK_POSTGRESQL__USER=${POSTGRES_USER}
       - AUTHENTIK_POSTGRESQL__PASSWORD=${POSTGRES_PASSWORD}
+
+      # Valkey cache configuration
       - AUTHENTIK_REDIS__HOST=authentik_valkey
       - AUTHENTIK_REDIS__PASSWORD=${VALKEY_PASSWORD}
-      - AUTHENTIK_ERROR_REPORTING__ENABLED=${AUTHENTIK_ERROR_REPORTING__ENABLED}
+
+      # Email configuration
       - AUTHENTIK_EMAIL__HOST=${AUTHENTIK_EMAIL__HOST}
       - AUTHENTIK_EMAIL__PORT=${AUTHENTIK_EMAIL__PORT}
       - AUTHENTIK_EMAIL__USERNAME=${AUTHENTIK_EMAIL__USERNAME}
@@ -98,4 +111,3 @@ services:
       - ${APPDATA_PATH}/authentik/media:/media
       - ${APPDATA_PATH}/authentik/certs:/certs
       - ${APPDATA_PATH}/authentik/custom-templates:/templates
-    restart: unless-stopped

caddy-cloudflare-ddns-crowdsec/docker-compose.yml

@@ -1,19 +1,30 @@
+# Caddy with Cloudflare DDNS and CrowdSec Security
 services:
+  # CrowdSec - Security automation service that protects from attacks
   crowdsec:
-    image: ghcr.io/crowdsecurity/crowdsec:v1.6.10
     container_name: crowdsec
+    image: ghcr.io/crowdsecurity/crowdsec:v1.6.10  # Official CrowdSec image
+    restart: unless-stopped  # Auto-restart unless explicitly stopped
+    
+    # Environment configuration
     environment:
-      - BOUNCER_KEY_CADDY=${CROWDSEC_API_KEY}
-      - GID=${GID}
-      - COLLECTIONS=${COLLECTIONS}
+      - BOUNCER_KEY_CADDY=${CROWDSEC_API_KEY}  # API key for Caddy integration
+      - GID=${GID}  # Group ID for file permissions
+      - COLLECTIONS=${COLLECTIONS}  # Security collections to enable
+    
+    # Persistent storage volumes
     volumes:
-      - ${APPDATA_PATH}/caddy/crowdsec-acquis.d:/etc/crowdsec/acquis.d
-      - ${APPDATA_PATH}/caddy/crowdsec-db:/var/lib/crowdsec/data/
-      - ${APPDATA_PATH}/caddy/crowdsec-config:/etc/crowdsec/
-      - ${APPDATA_PATH}/caddy/caddy-logs:/var/log/caddy:ro
+      - ${APPDATA_PATH}/caddy/crowdsec-acquis.d:/etc/crowdsec/acquis.d  # Log parsers
+      - ${APPDATA_PATH}/caddy/crowdsec-db:/var/lib/crowdsec/data/  # Security database
+      - ${APPDATA_PATH}/caddy/crowdsec-config:/etc/crowdsec/  # Configuration files
+      - ${APPDATA_PATH}/caddy/caddy-logs:/var/log/caddy:ro  # Read-only log access
+    
+    # Networks
     networks:
-      - frontend
-    restart: unless-stopped
+      proxy:
+        ipv4_address: 172.30.0.3
+    
+    # Health check configuration
     healthcheck:
       test: ["CMD-SHELL", "wget --spider --quiet --tries=1 --timeout=5 http://localhost:8080/health > /dev/null 2>&1 || exit 1"]
       interval: 30s
@@ -21,31 +32,50 @@ services:
       retries: 3
       start_period: 30s 
 
+  # Caddy web server with Cloudflare DDNS integration
   caddy:
-    image: docker.io/ryuupendragon/caddy-cloudflare-ddns-crowdsec:2.10.0
     container_name: caddy
+    image: docker.io/ryuupendragon/caddy-cloudflare-ddns-crowdsec:2.10.0  # Custom Caddy image with Cloudflare, DDNS and CrowdSec plugins
+    restart: unless-stopped  # Auto-restart on failure
+    
+    # Service dependencies
     depends_on:
       crowdsec:
-        condition: service_healthy
+        condition: service_healthy  # Requires working CrowdSec before starting
+    
+    # Required network capabilities
     cap_add:
-      - NET_ADMIN
+      - NET_ADMIN  # Needed for network-level operations
+    
+    # Environment configuration
     environment:
-      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN}
-      - CROWDSEC_API_KEY=${CROWDSEC_API_KEY}
+      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN}  # Cloudflare API token for DNS updates
+      - CROWDSEC_API_KEY=${CROWDSEC_API_KEY}  # Security key for CrowdSec integration
+    
+    # Persistent storage volumes
     volumes:
-      - ${APPDATA_PATH}/caddy/caddy-file:/etc/caddy
-      - ${APPDATA_PATH}/caddy/caddy-config:/config
-      - ${APPDATA_PATH}/caddy/caddy-data:/data
-      - ${APPDATA_PATH}/caddy/caddy-logs:/logs
-      - ${APPDATA_PATH}/caddy/caddy-srv:/srv
+      - ${APPDATA_PATH}/caddy/caddy-file:/etc/caddy  # Caddyfile configuration
+      - ${APPDATA_PATH}/caddy/caddy-config:/config  # Automatic HTTPS certificates
+      - ${APPDATA_PATH}/caddy/caddy-data:/data  # Site data and assets
+      - ${APPDATA_PATH}/caddy/caddy-logs:/logs  # Access logs
+      - ${APPDATA_PATH}/caddy/caddy-srv:/srv  # Served content
+    
+    # Network ports
     ports:
-      - ${HTTP_PORT}:80
-      - ${HTTPS_PORT}:443
-      - ${HTTPS_PORT}:443/udp
+      - ${HTTP_PORT}:80  # HTTP traffic
+      - ${HTTPS_PORT}:443  # HTTPS traffic
+      - ${HTTPS_PORT}:443/udp  # QUIC/HTTP3 support
+    
+    # Networks
     networks:
-      - frontend
-    restart: unless-stopped
+      proxy:
+        ipv4_address: 172.30.0.2
 
 networks:
-  frontend:
-    external: true
+  proxy:
+    name: proxy
+    driver: bridge
+    ipam:
+     config:
+       - subnet: 172.30.0.0/16
+         gateway: 172.30.0.1

caddy-crowdsec/docker-compose.yml

@@ -1,19 +1,30 @@
+# Caddy with CrowdSec Security
 services:
+  # CrowdSec - Security automation service that protects from attacks
   crowdsec:
-    image: ghcr.io/crowdsecurity/crowdsec:v1.6.10
     container_name: crowdsec
+    image: ghcr.io/crowdsecurity/crowdsec:v1.6.10  # Official CrowdSec image
+    restart: unless-stopped  # Auto-restart unless explicitly stopped
+    
+    # Environment configuration
     environment:
-      - BOUNCER_KEY_CADDY=${CROWDSEC_API_KEY}
-      - GID=${GID}
-      - COLLECTIONS=${COLLECTIONS}
+      - BOUNCER_KEY_CADDY=${CROWDSEC_API_KEY}  # API key for Caddy integration
+      - GID=${GID}  # Group ID for file permissions
+      - COLLECTIONS=${COLLECTIONS}  # Security collections to enable
+    
+    # Persistent storage volumes
     volumes:
-      - ${APPDATA_PATH}/caddy/crowdsec-acquis.d:/etc/crowdsec/acquis.d
-      - ${APPDATA_PATH}/caddy/crowdsec-db:/var/lib/crowdsec/data/
-      - ${APPDATA_PATH}/caddy/crowdsec-config:/etc/crowdsec/
-      - ${APPDATA_PATH}/caddy/caddy-logs:/var/log/caddy:ro
+      - ${APPDATA_PATH}/caddy/crowdsec-acquis.d:/etc/crowdsec/acquis.d  # Log parsers
+      - ${APPDATA_PATH}/caddy/crowdsec-db:/var/lib/crowdsec/data/  # Security database
+      - ${APPDATA_PATH}/caddy/crowdsec-config:/etc/crowdsec/  # Configuration files
+      - ${APPDATA_PATH}/caddy/caddy-logs:/var/log/caddy:ro  # Read-only log access
+    
+    # Networks
     networks:
-      - frontend
-    restart: unless-stopped
+      proxy:
+        ipv4_address: 172.30.0.3
+    
+    # Health check configuration
     healthcheck:
       test: ["CMD-SHELL", "wget --spider --quiet --tries=1 --timeout=5 http://localhost:8080/health > /dev/null 2>&1 || exit 1"]
       interval: 30s
@@ -21,30 +32,49 @@ services:
       retries: 3
       start_period: 30s 
 
+  # Caddy web server with CrowdSec security
   caddy:
-    image: docker.io/ryuupendragon/caddy-crowdsec:2.10.0
     container_name: caddy
+    image: docker.io/ryuupendragon/caddy-crowdsec:2.10.0  # Custom Caddy image with CrowdSec plugins
+    restart: unless-stopped  # Auto-restart on failure
+    
+    # Service dependencies
     depends_on:
       crowdsec:
-        condition: service_healthy
+        condition: service_healthy  # Requires working CrowdSec before starting
+    
+    # Required network capabilities
     cap_add:
-      - NET_ADMIN
+      - NET_ADMIN  # Needed for network-level operations
+    
+    # Environment configuration
     environment:
-      - CROWDSEC_API_KEY=${CROWDSEC_API_KEY}
+      - CROWDSEC_API_KEY=${CROWDSEC_API_KEY}  # Security key for CrowdSec integration
+    
+    # Persistent storage volumes
     volumes:
-      - ${APPDATA_PATH}/caddy/caddy-file:/etc/caddy
-      - ${APPDATA_PATH}/caddy/caddy-config:/config
-      - ${APPDATA_PATH}/caddy/caddy-data:/data
-      - ${APPDATA_PATH}/caddy/caddy-logs:/logs
-      - ${APPDATA_PATH}/caddy/caddy-srv:/srv
+      - ${APPDATA_PATH}/caddy/caddy-file:/etc/caddy  # Caddyfile configuration
+      - ${APPDATA_PATH}/caddy/caddy-config:/config  # Automatic HTTPS certificates
+      - ${APPDATA_PATH}/caddy/caddy-data:/data  # Site data and assets
+      - ${APPDATA_PATH}/caddy/caddy-logs:/logs  # Access logs
+      - ${APPDATA_PATH}/caddy/caddy-srv:/srv  # Served content
+    
+    # Network ports
     ports:
-      - ${HTTP_PORT}:80
-      - ${HTTPS_PORT}:443
-      - ${HTTPS_PORT}:443/udp
+      - ${HTTP_PORT}:80  # HTTP traffic
+      - ${HTTPS_PORT}:443  # HTTPS traffic
+      - ${HTTPS_PORT}:443/udp  # QUIC/HTTP3 support
+    
+    # Networks
     networks:
-      - frontend
-    restart: unless-stopped
+      proxy:
+        ipv4_address: 172.30.0.2
 
 networks:
-  frontend:
-    external: true
+  proxy:
+    name: proxy
+    driver: bridge
+    ipam:
+     config:
+       - subnet: 172.30.0.0/16
+         gateway: 172.30.0.1

forgejo/docker-compose.yml

@@ -17,12 +17,3 @@ services:
     # Network port configuration
     ports:
       - ${SERVER_PORT}:3000  # Maps host port to Forgejo web interface
-    
-    # Network configuration
-    networks:
-      - frontend  # Connects to frontend network
-
-# External network definition
-networks:
-  frontend:
-    external: true  # Uses pre-existing frontend network

gitea/docker-compose-mariadb.yml

@@ -1,85 +0,0 @@
-# Gitea Git Service with MariaDB Database Configuration
-services:
-  # MariaDB Database Service
-  gitea_db:
-    # Basic container configuration
-    container_name: gitea_db
-    image: docker.io/library/mariadb:11.8.2
-    restart: unless-stopped
-    
-    # Database optimization parameters
-    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --innodb-file-per-table=1 --skip-innodb-read-only-compressed
-    
-    # Database credentials and configuration
-    environment:
-      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}  # Root password
-      - MYSQL_USER=${MYSQL_USER}  # Gitea database user
-      - MYSQL_PASSWORD=${MYSQL_PASSWORD}  # Gitea user password
-      - MYSQL_DATABASE=${MYSQL_DATABASE}  # Database name for Gitea
-    
-    # Persistent storage configuration
-    volumes:
-      - ${APPDATA_PATH}/gitea/db:/var/lib/mysql
-    
-    # Network port configuration
-    ports:
-      - ${DB_PORT}:3306  # Maps host port to MariaDB
-    
-    # Network configuration
-    networks:
-      - backend  # Connects to backend network
-    
-    # Health check configuration
-    healthcheck:
-      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
-      start_period: 10s  # Initial delay before checks
-      interval: 10s  # Check interval
-      timeout: 5s  # Check timeout
-      retries: 3  # Allowed retries
-
-  # Gitea Server Service
-  gitea_server:
-    # Basic container configuration
-    container_name: gitea_server
-    image: docker.io/gitea/gitea:1.24.2-rootless
-    restart: unless-stopped
-    
-    # Service dependencies
-    depends_on:
-      gitea_db:
-        condition: service_healthy  # Requires healthy database
-    
-    # Runtime configuration
-    user: ${PUID}:${PGID}  # Runs as specified user/group
-    
-    # Gitea configuration
-    environment:
-      - GITEA__database__DB_TYPE=mysql
-      - GITEA__database__HOST=gitea_db:3306
-      - GITEA__database__NAME=${MYSQL_DATABASE}
-      - GITEA__database__USER=${MYSQL_USER}
-      - GITEA__database__PASSWD=${MYSQL_PASSWORD}
-    
-    # Persistent storage configuration
-    volumes:
-      - ${APPDATA_PATH}/gitea/config:/etc/gitea
-      - ${APPDATA_PATH}/gitea/data:/var/lib/gitea
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    
-    # Network port configuration
-    ports:
-      - ${SERVER_PORT}:3000
-      - ${SSH_PORT}:22
-    
-    # Network configuration
-    networks:
-      - frontend  # Connects to frontend network
-      - backend  # Connects to backend network
-
-# Internal network definition
-networks:
-  frontend:
-    external: true  # Uses pre-existing frontend network
-  backend:
-    external: true  # Uses pre-existing backend network

gitea/docker-compose.yml

@@ -21,10 +21,6 @@ services:
     ports:
       - ${DB_PORT}:5432  # Maps host port to PostgreSQL
     
-    # Network configuration
-    networks:
-      - backend  # Connects to backend network
-    
     # Health check configuration
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -d ${POSTGRES_DB} -U ${POSTGRES_USER}"]
@@ -37,7 +33,7 @@ services:
   gitea_server:
     # Basic container configuration
     container_name: gitea_server
-    image: docker.io/gitea/gitea:1.24.2-rootless
+    image: docker.io/gitea/gitea:1.24.3-rootless
     restart: unless-stopped
     
     # Service dependencies
@@ -65,15 +61,3 @@ services:
     ports:
       - ${SERVER_PORT}:3000  # Maps host port to Gitea web interface
       - ${SSH_PORT}:22  # Maps host port to Gitea SSH
-    
-    # Network configuration
-    networks:
-      - frontend  # Connects to frontend network
-      - backend  # Connects to backend network
-
-# External network definition
-networks:
-  frontend:
-    external: true  # Uses pre-existing frontend network
-  backend:
-    external: true  # Uses pre-existing backend network

gotify/docker-compose.yml

@@ -18,12 +18,3 @@ services:
     # Network port configuration
     ports:
       - ${PORT}:80  # Maps host port to Gotify web interface
-    
-    # Network configuration
-    networks:
-      - frontend  # Connects to frontend network
-
-# External network definition
-networks:
-  frontend:
-    external: true  # Uses pre-existing frontend network

healthchecks/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   healthchecks:
     # Basic container configuration
     container_name: healthchecks
-    image: ghcr.io/linuxserver/healthchecks:3.10.20250705
+    image: ghcr.io/linuxserver/healthchecks:3.10.20250714
     restart: unless-stopped
     
     # User and system configuration
@@ -50,12 +50,3 @@ services:
     ports:
       - ${PORT}:8000  # Web interface port
       - ${SMTP_PORT}:2525  # SMTP port for email
-    
-    # Network configuration
-    networks:
-      - frontend  # Connects to frontend network
-
-# External network configuration
-networks:
-  frontend:
-    external: true  # Uses pre-existing frontend network

homeassistant/docker-compose.yml

@@ -3,23 +3,20 @@ services:
   homeassistant:
     # Basic container configuration
     container_name: homeassistant
-    image: docker.io/homeassistant/home-assistant:2025.7.1
-    restart: unless-stopped
+    image: docker.io/homeassistant/home-assistant:2025.7.2  # Official Home Assistant image
+    restart: unless-stopped  # Auto-restart on failure
+
+    # Network configuration (host mode for full local network access)
+    network_mode: host  # Required for discovering local devices and integrations
     
     # Persistent storage and system configuration
     volumes:
       - ${APPDATA_PATH}/homeassistant/config:/config  # Configuration files
-      - /etc/localtime:/etc/localtime:ro  # Sync host timezone
-    
-    # Network port configuration
-    ports:
-      - ${PORT}:8123  # Web interface port
-    
-    # Network configuration
-    networks:
-      - frontend  # Connects to frontend network
+      - /etc/localtime:/etc/localtime:ro  # Sync host timezone for proper logging
 
-# External network definition
-networks:
-  frontend:
-    external: true  # Uses pre-existing frontend network
+    # Health check configuration
+    healthcheck:
+      test: "curl --connect-timeout 10 --silent -f http://127.0.0.1:8123/ || exit 1"
+      interval: 45s
+      timeout: 30s
+      retries: 3

minio/docker-compose.yml

@@ -0,0 +1,54 @@
+# MinIO Object Storage Service Configuration
+services:
+  # MinIO Server Service
+  minio:
+    # Basic container configuration
+    container_name: minio
+    image: docker.io/minio/minio:RELEASE.2025-06-13T11-33-47Z  # Official MinIO image
+    restart: unless-stopped  # Auto-restart on failure
+    
+    # Runtime command and user permissions
+    command: server /data  # Start in server mode
+    user: ${PUID}:${PGID}  # Run as specified user/group
+    
+    # Environment variables for authentication and configuration
+    environment:
+      - MINIO_ROOT_USER=${MINIO_ROOT_USER}  # Admin username
+      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}  # Admin password
+      - MINIO_SERVER_URL=${MINIO_SERVER_URL}  # Public server endpoint URL
+      - MINIO_BROWSER_REDIRECT_URL=${MINIO_BROWSER_REDIRECT_URL}  # Web console redirect URL
+    
+    # Persistent data storage
+    volumes:
+      - ${APPDATA_PATH}/minio/data:/data  # Maps host directory to container
+    
+    # Network ports
+    ports:
+      - ${API_PORT}:9000  # MinIO API port
+
+    # Health check configuration
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  # MinIO Console Service (separate from main server)
+  minio-console:
+    # Basic container configuration
+    container_name: minio-console
+    image: ghcr.io/georgmangold/console:v1.8.1  # Community console UI
+    restart: unless-stopped  # Auto-restart on failure
+    
+    # Service dependencies
+    depends_on:
+      minio:
+        condition: service_healthy
+    
+    # Environment configuration
+    environment:
+      - CONSOLE_MINIO_SERVER=http://minio:9000  # Points to MinIO server
+    
+    # Network ports
+    ports:
+      - ${CONSOLE_PORT}:9090  # Web console access port

nextcloud/docker-compose.yml

@@ -20,8 +20,6 @@ services:
     # Network configuration
     ports:
       - ${DB_PORT}:5432  # PostgreSQL port
-    networks:
-      - backend  # Connects to backend network
     
     # Health monitoring
     healthcheck:
@@ -48,8 +46,6 @@ services:
     # Network configuration
     ports:
       - ${VALKEY_PORT}:6379  # Valkey port
-    networks:
-      - backend  # Connects to backend network
     
     # Health monitoring
     healthcheck:
@@ -61,14 +57,17 @@ services:
 
   # Nextcloud Application Service
   nextcloud_app:
+    # Basic container configuration
     image: docker.io/library/nextcloud:31.0.7
     container_name: nextcloud_app
     restart: unless-stopped
+
+    # Service dependencies
     depends_on:
       nextcloud_db:
-        condition: service_healthy
+        condition: service_healthy  # Requires healthy database
       nextcloud_valkey:
-        condition: service_healthy
+        condition: service_healthy  # Requires healthy valkey
     
     # Environment variables
     environment:
@@ -97,15 +96,15 @@ services:
     # Network configuration
     ports:
       - ${APP_PORT}:80
-    networks:
-      - frontend  # Connects to frontend network
-      - backend  # Connects to backend network
 
   # Nextcloud Cron Service
   nextcloud_cron:
+    # Basic container configuration
     image: docker.io/library/nextcloud:31.0.7
     container_name: nextcloud_cron
     restart: unless-stopped
+    
+    # Service dependencies
     depends_on:
       - nextcloud_app
     
@@ -135,15 +134,3 @@ services:
     # Persistent storage configuration
     volumes:
       - ${APPDATA_PATH}/nextcloud/app:/var/www/html
-    
-    # Network configuration
-    networks:
-      - frontend  # Connects to frontend network
-      - backend  # Connects to backend network
-
-# External network definitions
-networks:
-  frontend:
-    external: true  # Uses pre-existing network
-  backend:
-    external: true  # Uses pre-existing network

opengist/docker-compose-mariadb.yml

@@ -1,94 +0,0 @@
-# OpenGist with MariaDB Configuration
-services:
-  # MariaDB Database Service
-  opengist_db:
-    # Basic container configuration
-    container_name: opengist_db
-    image: docker.io/library/mariadb:11.8.2
-    restart: unless-stopped
-    
-    # Database performance tuning
-    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --innodb-file-per-table=1 --skip-innodb-read-only-compressed
-    
-    # Database credentials
-    environment:
-      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}  # Root password
-      - MYSQL_USER=${MYSQL_USER}  # Application username
-      - MYSQL_PASSWORD=${MYSQL_PASSWORD}  # Application password
-      - MYSQL_DATABASE=${MYSQL_DATABASE}  # Database name
-    
-    # Persistent storage configuration
-    volumes:
-      - ${APPDATA_PATH}/opengist/db:/var/lib/mysql  # Database files
-    
-    # Network configuration
-    ports:
-      - ${DB_PORT}:3306  # MariaDB port
-    networks:
-      - backend  # Connects to backend network  
-    
-    # Health monitoring
-    healthcheck:
-      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
-      interval: 10s  # Check frequency
-      timeout: 5s  # Timeout duration
-      retries: 3  # Retry attempts
-      start_period: 10s  # Initial delay
-
-  # OpenGist Application Service
-  opengist_server:
-    # Basic container configuration
-    container_name: opengist_server
-    image: ghcr.io/thomiceli/opengist:1.10.0
-    restart: unless-stopped
-    
-    # Service dependencies
-    depends_on:
-      opengist_db:
-        condition: service_healthy  # Wait for healthy database
-    
-    # Runtime configuration
-    environment:
-      # User and group IDs for file permissions
-      - UID=${UID}  # User ID for file permissions
-      - GID=${GID}  # Group ID for file permissions
-      
-      # Database connection
-      - OG_DB_URI=mysql://${MYSQL_USER}:${MYSQL_PASSWORD}@opengist_db:3306/${MYSQL_DATABASE}  # MariaDB connection string
-      
-      # Application settings
-      - OG_EXTERNAL_URL=${OG_EXTERNAL_URL}  # Public URL for OpenGist
-      - OG_SECRET_KEY=${OG_SECRET_KEY}  # Encryption key for sessions
-      
-      # Git protocol configuration
-      - OG_HTTP_GIT_ENABLED=${OG_HTTP_GIT_ENABLED}  # Enable HTTP Git access
-      - OG_SSH_GIT_ENABLED=${OG_SSH_GIT_ENABLED}  # Enable SSH Git access
-      
-      # Gitea integration
-      - OG_GITEA_CLIENT_KEY=${OG_GITEA_CLIENT_KEY}  # OAuth client key
-      - OG_GITEA_SECRET=${OG_GITEA_SECRET}  # OAuth secret
-      - OG_GITEA_URL=${OG_GITEA_URL}  # Gitea instance URL
-      - OG_GITEA_NAME=${OG_GITEA_NAME}  # Gitea application name
-      
-      # Customization
-      - OG_CUSTOM_STATIC_LINK_0_NAME=${OG_CUSTOM_STATIC_LINK_0_NAME}  # Custom link name
-      - OG_CUSTOM_STATIC_LINK_0_PATH=${OG_CUSTOM_STATIC_LINK_0_PATH}  # Custom link path
-    
-    # Persistent storage configuration
-    volumes:
-      - ${APPDATA_PATH}/opengist/data:/opengist
-    
-    # Network configuration
-    ports:
-      - ${SERVER_PORT}:6157  # Web interface port
-      - 2222:2222  # SSH port for Git operations
-    networks:
-      - frontend  # Connects to frontend network
-      - backend  # Connects to backend network
-
-# External network definitions
-networks:
-  frontend:
-    external: true # Uses pre-existing network
-  backend:
-    external: true # Uses pre-existing network

opengist/docker-compose.yml

@@ -20,8 +20,6 @@ services:
     # Network configuration
     ports:
       - ${DB_PORT}:5432  # PostgreSQL port
-    networks:
-      - backend  # Connects to backend network
     
     # Health monitoring
     healthcheck:
@@ -78,13 +76,3 @@ services:
     ports:
       - ${SERVER_PORT}:6157  # Web interface port
       - 2222:2222  # SSH port for Git operations
-    networks:
-      - frontend  # Connects to frontend network
-      - backend  # Connects to backend network
-
-# External network definitions
-networks:
-  frontend:
-    external: true # Uses pre-existing network
-  backend:
-    external: true # Uses pre-existing network

palmr/docker-compose-minio.yml

@@ -0,0 +1,37 @@
+# Palmr File Transfer Service Configuration
+services:
+  palmr:
+    # Basic container configuration
+    container_name: palmr
+    image: docker.io/kyantech/palmr:v3.1.2-beta
+    restart: unless-stopped
+    
+    # Application settings
+    environment:
+      # Storage Configuration
+      - ENABLE_S3=true  # Set to 'true' to enable S3-compatible storage backend, 'false' for local filesystem
+      
+      # S3 Configuration
+      - S3_ENDPOINT=${S3_ENDPOINT}  # S3 endpoint (you have to set this to the s3 endpoint of the s3 server) CHANGE THIS TO YOUR S3 ENDPOINT
+      - S3_USE_SSL=true  # Use ssl for the s3 server always true for s3
+      - S3_ACCESS_KEY=${S3_ACCESS_KEY}  # S3 access key
+      - S3_SECRET_KEY=${S3_SECRET_KEY}  # S3 secret key
+      - S3_REGION=us-east-1  # S3 region (us-east-1 is the default region) but it depends on your s3 server region
+      - S3_BUCKET_NAME=${S3_BUCKET_NAME}  # Bucket name for the S3 storage
+      - S3_FORCE_PATH_STYLE=true  # For MinIO compatibility we have to set this to true
+
+      # Security Settings
+      - ENCRYPTION_KEY=${ENCRYPTION_KEY}  # Data encryption key for security
+      - SECURE_SITE=${SECURE_SITE}  # Set to 'true' to enable HTTPS and security headers
+      
+      # User/Group Permissions
+      - PALMR_UID=${PUID}  # User ID under which the application runs
+      - PALMR_GID=${PGID}  # Group ID under which the application runs
+    
+    # Persistent storage configuration
+    volumes:
+      - ${APPDATA_PATH}/palmr/server:/app/server  # Database directory
+    
+    # Network configuration
+    ports:
+      - ${PORT}:5487  # Web interface port

palmr/docker-compose.yml

@@ -3,29 +3,26 @@ services:
   palmr:
     # Basic container configuration
     container_name: palmr
-    image: docker.io/kyantech/palmr:v3.1.1-beta
+    image: docker.io/kyantech/palmr:v3.1.2-beta
     restart: unless-stopped
     
     # Application settings
     environment:
-      - ENABLE_S3=${ENABLE_S3}  # Enable/Disable S3-compatible storage backend
+      # Storage Configuration
+      - ENABLE_S3=false
+
+      # Security Settings
       - ENCRYPTION_KEY=${ENCRYPTION_KEY}  # Data encryption key for security
       - SECURE_SITE=${SECURE_SITE}  # Enable/Disable HTTPS security features
+
+      # User/Group Permissions
       - PALMR_UID=${PUID}  # User ID for proper file permissions
       - PALMR_GID=${PGID}  # Group ID for proper file permissions
     
     # Persistent storage configuration
     volumes:
-      - ${APPDATA_PATH}/palmr/db:/app/server/prisma  # Transfer metadata database
-      - ${DATA_PATH}/palmr/data:/app/server  # File storage directory
+      - ${APPDATA_PATH}/palmr/server:/app/server  # Database and File storage directory
     
     # Network configuration
     ports:
       - ${PORT}:5487  # Web interface port
-    networks:
-      - frontend  # Connects to frontend network
-
-# External network definition
-networks:
-  frontend:
-    external: true  # Uses pre-existing network

portainer-agent/docker-compose.yml

@@ -3,14 +3,14 @@ services:
   portainer-agent:
     # Basic container configuration
     container_name: portainer-agent
-    image: docker.io/portainer/agent:latest
+    image: docker.io/portainer/agent:alpine
     restart: unless-stopped
 
     # System access configuration
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock  # Docker API access
       - /var/lib/docker/volumes:/var/lib/docker/volumes  # Volume management
-    
+
     # Network port configuration
     ports:
       - 9001:9001  # Agent communication port

portainer/docker-compose.yml

@@ -3,16 +3,24 @@ services:
   portainer:
     # Basic container configuration
     container_name: portainer
-    image: docker.io/portainer/portainer-ee:latest
+    image: docker.io/portainer/portainer-ee:alpine
     restart: unless-stopped
-    
+
     # Persistent storage and system access configuration
     volumes:
       - ./data:/data  # Portainer configuration and database
       - /etc/localtime:/etc/localtime:ro  # Sync host timezone
       - /var/run/docker.sock:/var/run/docker.sock  # Docker API access
-    
+
     # Network ports configuration
     ports:
       - 8000:8000  # Edge agent communication port
       - 9443:9443  # Web UI HTTPS port
+
+    # Health check configuration
+    healthcheck:
+      test: "wget --no-verbose --tries=1 --spider http://localhost:9000/api/system/status || exit 1"
+      start_period: 10s  # Initial delay before checks
+      interval: 10s  # Check interval
+      timeout: 5s  # Check timeout
+      retries: 3  # Allowed retries

radicale/docker-compose.yml

@@ -38,16 +38,9 @@ services:
     # Network configuration
     ports:
       - ${PORT}:5232  # DAV service port
-    networks:
-      - frontend  # Connects to frontend network
 
     # Health monitoring
     healthcheck:
       test: curl -f http://127.0.0.1:5232 || exit 1  # Simple HTTP check
       interval: 30s  # Check every 30 seconds
       retries: 3  # Allow 3 failures before marking unhealthy
-
-# External network definition
-networks:
-  frontend:
-    external: true # Uses pre-existing network

renovate.json

@@ -16,6 +16,12 @@
     ],
     "ignorePaths": [
       ".archived/"
+    ],
+    "packageRules": [
+      {
+        "matchPackageNames": "docker.io/minio/minio",
+        "versioning": "regex:^RELEASE\\.(?<major>\\d{4})-(?<minor>\\d{2})-(?<patch>\\d{2})"
+      }
     ]
   }
 }

stirling-pdf/docker-compose.yml

@@ -27,10 +27,11 @@ services:
     # Network configuration
     ports:
       - ${PORT}:8080  # Web interface port
-    networks:
-      - frontend  # Connects to frontend network
 
-# External network definition
-networks:
-  frontend:
-    external: true  # Uses existing Docker network
+    # Health check configuration
+    healthcheck:
+      test: [ "CMD-SHELL", "curl -f http://localhost:8080/api/v1/info/status | grep -q 'UP'" ]
+      interval: 5s
+      timeout: 10s
+      retries: 5
+      start_period: 120s

syncyomi/docker-compose.yml

@@ -18,10 +18,10 @@ services:
     # Network configuration
     ports:
       - ${PORT}:8282  # Web interface port
-    networks:
-      - frontend  # Connects to frontend network
 
-# External network definition
-networks:
-  frontend:
-    external: true  # Uses existing Docker network
+    # Health check configuration
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8282"]
+      interval: 10s
+      timeout: 10s
+      retries: 3

uptime-kuma/docker-compose.yml

@@ -13,10 +13,3 @@ services:
     # Network configuration
     ports:
       - ${PORT}:3001  # Web dashboard port
-    networks:
-      - frontend  # Connects to frontend network
-
-# External network definition
-networks:
-  frontend:
-    external: true  # Uses existing Docker network