erste Compose

README.md

@@ -0,0 +1,438 @@
+Ja. Dann wuerde ich fuer `apps-int01` die Dienste als **getrennte Compose-Dateien pro App** bauen. Das passt zu deiner Struktur unter `/srv/apps-int01/compose/...` und zu deiner App-Liste auf `apps-int01`: Vaultwarden, Paperless, XWiki, Nextcloud, Seafile und OnlyOffice [1].
+
+Ich wuerde ausserdem pro App:
+- ein eigenes internes Docker-Netz nehmen
+- nur Web-Frontends zusaetzlich an `proxy-nw` haengen
+- Daten konsequent unter `/srv/apps-int01/data/...` halten
+- Konfigurationen unter `/srv/apps-int01/config/...` halten
+
+## Vorab: externes Proxy-Netz einmalig anlegen
+Falls noch nicht vorhanden:
+
+```bash
+docker network create proxy-nw
+```
+
+---
+
+# 1. Vaultwarden
+Datei:
+`/srv/apps-int01/compose/vaultwarden/compose.yaml`
+
+```yaml
+services:
+  vaultwarden:
+    image: vaultwarden/server:latest
+    container_name: vaultwarden
+    restart: unless-stopped
+    environment:
+      TZ: Europe/Zurich
+      SIGNUPS_ALLOWED: "false"
+      WEBSOCKET_ENABLED: "true"
+      ADMIN_TOKEN: "CHANGE_ME_ADMIN_TOKEN"
+    volumes:
+      - /srv/apps-int01/data/vaultwarden/data:/data
+    networks:
+      - proxy-nw
+      - vaultwarden-nw
+    healthcheck:
+      test: ["CMD", "/vaultwarden", "--version"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+
+networks:
+  proxy-nw:
+    external: true
+  vaultwarden-nw:
+    driver: bridge
+```
+
+Starten:
+```bash
+cd /srv/apps-int01/compose/vaultwarden
+docker compose up -d
+```
+
+---
+
+# 2. Paperless
+Datei:
+`/srv/apps-int01/compose/paperless/compose.yaml`
+
+```yaml
+services:
+  broker:
+    image: redis:7-alpine
+    container_name: paperless-redis
+    restart: unless-stopped
+    volumes:
+      - /srv/apps-int01/data/paperless/redis:/data
+    networks:
+      - paperless-nw
+
+  db:
+    image: postgres:16-alpine
+    container_name: paperless-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: paperless
+      POSTGRES_USER: paperless
+      POSTGRES_PASSWORD: "CHANGE_ME_DB_PASSWORD"
+    volumes:
+      - /srv/apps-int01/data/paperless/db:/var/lib/postgresql/data
+    networks:
+      - paperless-nw
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U paperless -d paperless"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  webserver:
+    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    container_name: paperless
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+      broker:
+        condition: service_started
+    environment:
+      TZ: Europe/Zurich
+      PAPERLESS_REDIS: redis://broker:6379
+      PAPERLESS_DBHOST: db
+      PAPERLESS_DBNAME: paperless
+      PAPERLESS_DBUSER: paperless
+      PAPERLESS_DBPASS: "CHANGE_ME_DB_PASSWORD"
+      PAPERLESS_SECRET_KEY: "CHANGE_ME_SECRET_KEY"
+      PAPERLESS_URL: "https://paperless.example.internal"
+      PAPERLESS_TIME_ZONE: Europe/Zurich
+      PAPERLESS_OCR_LANGUAGE: deu+eng
+    volumes:
+      - /srv/apps-int01/data/paperless/data:/usr/src/paperless/data
+      - /srv/apps-int01/data/paperless/media:/usr/src/paperless/media
+      - /srv/apps-int01/data/paperless/export:/usr/src/paperless/export
+      - /srv/apps-int01/data/paperless/consume:/usr/src/paperless/consume
+    networks:
+      - proxy-nw
+      - paperless-nw
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost:8000 || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s
+
+networks:
+  proxy-nw:
+    external: true
+  paperless-nw:
+    driver: bridge
+```
+
+Hinweis: In deiner bisherigen Ordnerstruktur fuer `paperless` waren `data`, `media`, `export` und `consume` bereits vorgesehen [1]. Fuer diese Compose kommt noch `db` und `redis` dazu.
+
+---
+
+# 3. XWiki
+Datei:
+`/srv/apps-int01/compose/xwiki/compose.yaml`
+
+```yaml
+services:
+  db:
+    image: postgres:16-alpine
+    container_name: xwiki-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: xwiki
+      POSTGRES_USER: xwiki
+      POSTGRES_PASSWORD: "CHANGE_ME_DB_PASSWORD"
+    volumes:
+      - /srv/apps-int01/data/xwiki/db:/var/lib/postgresql/data
+    networks:
+      - xwiki-nw
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U xwiki -d xwiki"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  xwiki:
+    image: xwiki:stable-postgres-tomcat
+    container_name: xwiki
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      TZ: Europe/Zurich
+      DB_HOST: db
+      DB_DATABASE: xwiki
+      DB_USER: xwiki
+      DB_PASSWORD: "CHANGE_ME_DB_PASSWORD"
+    volumes:
+      - /srv/apps-int01/data/xwiki/data:/usr/local/xwiki
+    networks:
+      - proxy-nw
+      - xwiki-nw
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost:8080 || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+
+networks:
+  proxy-nw:
+    external: true
+  xwiki-nw:
+    driver: bridge
+```
+
+---
+
+# 4. Nextcloud
+Datei:
+`/srv/apps-int01/compose/nextcloud/compose.yaml`
+
+```yaml
+services:
+  db:
+    image: mariadb:11
+    container_name: nextcloud-db
+    restart: unless-stopped
+    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
+    environment:
+      MYSQL_ROOT_PASSWORD: "CHANGE_ME_ROOT_PASSWORD"
+      MYSQL_DATABASE: nextcloud
+      MYSQL_USER: nextcloud
+      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
+    volumes:
+      - /srv/apps-int01/data/nextcloud/db:/var/lib/mysql
+    networks:
+      - nextcloud-nw
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+  redis:
+    image: redis:7-alpine
+    container_name: nextcloud-redis
+    restart: unless-stopped
+    volumes:
+      - /srv/apps-int01/data/nextcloud/redis:/data
+    networks:
+      - nextcloud-nw
+
+  app:
+    image: nextcloud:apache
+    container_name: nextcloud
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    environment:
+      TZ: Europe/Zurich
+      MYSQL_HOST: db
+      MYSQL_DATABASE: nextcloud
+      MYSQL_USER: nextcloud
+      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
+      REDIS_HOST: redis
+      NEXTCLOUD_TRUSTED_DOMAINS: "nextcloud.example.internal"
+      OVERWRITEHOST: "nextcloud.example.internal"
+      OVERWRITEPROTOCOL: "https"
+    volumes:
+      - /srv/apps-int01/data/nextcloud/app:/var/www/html
+      - /srv/apps-int01/data/nextcloud/data:/var/www/html/data
+    networks:
+      - proxy-nw
+      - nextcloud-nw
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost/status.php || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+
+  cron:
+    image: nextcloud:apache
+    container_name: nextcloud-cron
+    restart: unless-stopped
+    entrypoint: /cron.sh
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    environment:
+      TZ: Europe/Zurich
+      MYSQL_HOST: db
+      MYSQL_DATABASE: nextcloud
+      MYSQL_USER: nextcloud
+      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
+      REDIS_HOST: redis
+    volumes:
+      - /srv/apps-int01/data/nextcloud/app:/var/www/html
+      - /srv/apps-int01/data/nextcloud/data:/var/www/html/data
+    networks:
+      - nextcloud-nw
+
+networks:
+  proxy-nw:
+    external: true
+  nextcloud-nw:
+    driver: bridge
+```
+
+Da du Nextcloud nur fuer Kalender, Aufgaben und Kontakte nutzt, ist das auf `apps-int01` weiterhin gut vertretbar [1].
+
+---
+
+# 5. Seafile
+Datei:
+`/srv/apps-int01/compose/seafile/compose.yaml`
+
+```yaml
+services:
+  db:
+    image: mariadb:11
+    container_name: seafile-db
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: "CHANGE_ME_ROOT_PASSWORD"
+      MYSQL_DATABASE: seafile
+      MYSQL_USER: seafile
+      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
+    volumes:
+      - /srv/apps-int01/data/seafile/mariadb:/var/lib/mysql
+    networks:
+      - seafile-nw
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+  memcached:
+    image: memcached:alpine
+    container_name: seafile-memcached
+    restart: unless-stopped
+    networks:
+      - seafile-nw
+
+  seafile:
+    image: seafileltd/seafile-mc:latest
+    container_name: seafile
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+      memcached:
+        condition: service_started
+    environment:
+      DB_HOST: db
+      DB_ROOT_PASSWD: "CHANGE_ME_ROOT_PASSWORD"
+      TIME_ZONE: Europe/Zurich
+      SEAFILE_ADMIN_EMAIL: "admin@example.internal"
+      SEAFILE_ADMIN_PASSWORD: "CHANGE_ME_ADMIN_PASSWORD"
+      SEAFILE_SERVER_LETSENCRYPT: "false"
+      SEAFILE_SERVER_HOSTNAME: "seafile.example.internal"
+    volumes:
+      - /srv/apps-int01/data/seafile/data:/shared
+    networks:
+      - proxy-nw
+      - seafile-nw
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost:80 || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+
+networks:
+  proxy-nw:
+    external: true
+  seafile-nw:
+    driver: bridge
+```
+
+In deiner bisherigen Struktur fuer Seafile waren `data`, `db` und `mariadb` vorgesehen [1]. Ich wuerde fuer dieses Compose effektiv `mariadb` als Datenpfad nutzen; `db` kannst du reserviert lassen oder spaeter streichen.
+
+---
+
+# 6. OnlyOffice
+Datei:
+`/srv/apps-int01/compose/onlyoffice/compose.yaml`
+
+```yaml
+services:
+  onlyoffice:
+    image: onlyoffice/documentserver:latest
+    container_name: onlyoffice
+    restart: unless-stopped
+    environment:
+      TZ: Europe/Zurich
+      JWT_ENABLED: "true"
+      JWT_SECRET: "CHANGE_ME_JWT_SECRET"
+    volumes:
+      - /srv/apps-int01/data/onlyoffice/data:/var/www/onlyoffice/Data
+      - /srv/apps-int01/data/onlyoffice/logs:/var/log/onlyoffice
+    networks:
+      - proxy-nw
+      - onlyoffice-nw
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost/healthcheck || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+
+networks:
+  proxy-nw:
+    external: true
+  onlyoffice-nw:
+    driver: bridge
+```
+
+---
+
+## Startreihenfolge
+Ich wuerde auf `apps-int01` so starten:
+
+1. vaultwarden
+2. paperless
+3. xwiki
+4. nextcloud
+5. seafile
+6. onlyoffice
+
+Das passt auch dazu, dass `apps-int01` deine zentrale interne App-VM fuer genau diese Dienste ist [1].
+
+## Startbefehle
+Je App:
+
+```bash
+cd /srv/apps-int01/compose/vaultwarden && docker compose up -d
+cd /srv/apps-int01/compose/paperless && docker compose up -d
+cd /srv/apps-int01/compose/xwiki && docker compose up -d
+cd /srv/apps-int01/compose/nextcloud && docker compose up -d
+cd /srv/apps-int01/compose/seafile && docker compose up -d
+cd /srv/apps-int01/compose/onlyoffice && docker compose up -d
+```
+
+## Wichtiger Hinweis
+Ein Teil der Image-Details und Environment-Variablen oben stammt aus allgemeinem Docker-/App-Wissen, nicht direkt aus deinem Kontext. Die App-Zuordnung, die Struktur unter `/srv/apps-int01` und die Diensteliste fuer `apps-int01` kommen aus deinem vorhandenen Plan [1].
+
+Wenn du willst, mache ich dir als naechstes die Compose-Dateien auch noch direkt:
+- mit deinen echten FQDNs
+- mit `10.100.20.49` als DNS
+- und ohne Healthchecks, falls du sie erstmal schlanker willst.