diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e69de29 diff --git a/README.md b/README.md index e69de29..c1992ee 100644 --- a/README.md +++ b/README.md @@ -0,0 +1,438 @@ +Ja. Dann wuerde ich fuer `apps-int01` die Dienste als **getrennte Compose-Dateien pro App** bauen. Das passt zu deiner Struktur unter `/srv/apps-int01/compose/...` und zu deiner App-Liste auf `apps-int01`: Vaultwarden, Paperless, XWiki, Nextcloud, Seafile und OnlyOffice [1]. + +Ich wuerde ausserdem pro App: +- ein eigenes internes Docker-Netz nehmen +- nur Web-Frontends zusaetzlich an `proxy-nw` haengen +- Daten konsequent unter `/srv/apps-int01/data/...` halten +- Konfigurationen unter `/srv/apps-int01/config/...` halten + +## Vorab: externes Proxy-Netz einmalig anlegen +Falls noch nicht vorhanden: + +```bash +docker network create proxy-nw +``` + +--- + +# 1. Vaultwarden +Datei: +`/srv/apps-int01/compose/vaultwarden/compose.yaml` + +```yaml +services: + vaultwarden: + image: vaultwarden/server:latest + container_name: vaultwarden + restart: unless-stopped + environment: + TZ: Europe/Zurich + SIGNUPS_ALLOWED: "false" + WEBSOCKET_ENABLED: "true" + ADMIN_TOKEN: "CHANGE_ME_ADMIN_TOKEN" + volumes: + - /srv/apps-int01/data/vaultwarden/data:/data + networks: + - proxy-nw + - vaultwarden-nw + healthcheck: + test: ["CMD", "/vaultwarden", "--version"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 20s + +networks: + proxy-nw: + external: true + vaultwarden-nw: + driver: bridge +``` + +Starten: +```bash +cd /srv/apps-int01/compose/vaultwarden +docker compose up -d +``` + +--- + +# 2. Paperless +Datei: +`/srv/apps-int01/compose/paperless/compose.yaml` + +```yaml +services: + broker: + image: redis:7-alpine + container_name: paperless-redis + restart: unless-stopped + volumes: + - /srv/apps-int01/data/paperless/redis:/data + networks: + - paperless-nw + + db: + image: postgres:16-alpine + container_name: paperless-db + restart: unless-stopped + environment: + POSTGRES_DB: paperless + POSTGRES_USER: paperless + POSTGRES_PASSWORD: "CHANGE_ME_DB_PASSWORD" + volumes: + - /srv/apps-int01/data/paperless/db:/var/lib/postgresql/data + networks: + - paperless-nw + healthcheck: + test: ["CMD-SHELL", "pg_isready -U paperless -d paperless"] + interval: 10s + timeout: 5s + retries: 5 + + webserver: + image: ghcr.io/paperless-ngx/paperless-ngx:latest + container_name: paperless + restart: unless-stopped + depends_on: + db: + condition: service_healthy + broker: + condition: service_started + environment: + TZ: Europe/Zurich + PAPERLESS_REDIS: redis://broker:6379 + PAPERLESS_DBHOST: db + PAPERLESS_DBNAME: paperless + PAPERLESS_DBUSER: paperless + PAPERLESS_DBPASS: "CHANGE_ME_DB_PASSWORD" + PAPERLESS_SECRET_KEY: "CHANGE_ME_SECRET_KEY" + PAPERLESS_URL: "https://paperless.example.internal" + PAPERLESS_TIME_ZONE: Europe/Zurich + PAPERLESS_OCR_LANGUAGE: deu+eng + volumes: + - /srv/apps-int01/data/paperless/data:/usr/src/paperless/data + - /srv/apps-int01/data/paperless/media:/usr/src/paperless/media + - /srv/apps-int01/data/paperless/export:/usr/src/paperless/export + - /srv/apps-int01/data/paperless/consume:/usr/src/paperless/consume + networks: + - proxy-nw + - paperless-nw + healthcheck: + test: ["CMD-SHELL", "curl -fsS http://localhost:8000 || exit 1"] + interval: 30s + timeout: 10s + retries: 5 + start_period: 30s + +networks: + proxy-nw: + external: true + paperless-nw: + driver: bridge +``` + +Hinweis: In deiner bisherigen Ordnerstruktur fuer `paperless` waren `data`, `media`, `export` und `consume` bereits vorgesehen [1]. Fuer diese Compose kommt noch `db` und `redis` dazu. + +--- + +# 3. XWiki +Datei: +`/srv/apps-int01/compose/xwiki/compose.yaml` + +```yaml +services: + db: + image: postgres:16-alpine + container_name: xwiki-db + restart: unless-stopped + environment: + POSTGRES_DB: xwiki + POSTGRES_USER: xwiki + POSTGRES_PASSWORD: "CHANGE_ME_DB_PASSWORD" + volumes: + - /srv/apps-int01/data/xwiki/db:/var/lib/postgresql/data + networks: + - xwiki-nw + healthcheck: + test: ["CMD-SHELL", "pg_isready -U xwiki -d xwiki"] + interval: 10s + timeout: 5s + retries: 5 + + xwiki: + image: xwiki:stable-postgres-tomcat + container_name: xwiki + restart: unless-stopped + depends_on: + db: + condition: service_healthy + environment: + TZ: Europe/Zurich + DB_HOST: db + DB_DATABASE: xwiki + DB_USER: xwiki + DB_PASSWORD: "CHANGE_ME_DB_PASSWORD" + volumes: + - /srv/apps-int01/data/xwiki/data:/usr/local/xwiki + networks: + - proxy-nw + - xwiki-nw + healthcheck: + test: ["CMD-SHELL", "curl -fsS http://localhost:8080 || exit 1"] + interval: 30s + timeout: 10s + retries: 5 + start_period: 60s + +networks: + proxy-nw: + external: true + xwiki-nw: + driver: bridge +``` + +--- + +# 4. Nextcloud +Datei: +`/srv/apps-int01/compose/nextcloud/compose.yaml` + +```yaml +services: + db: + image: mariadb:11 + container_name: nextcloud-db + restart: unless-stopped + command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW + environment: + MYSQL_ROOT_PASSWORD: "CHANGE_ME_ROOT_PASSWORD" + MYSQL_DATABASE: nextcloud + MYSQL_USER: nextcloud + MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD" + volumes: + - /srv/apps-int01/data/nextcloud/db:/var/lib/mysql + networks: + - nextcloud-nw + healthcheck: + test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"] + interval: 10s + timeout: 5s + retries: 5 + start_period: 20s + + redis: + image: redis:7-alpine + container_name: nextcloud-redis + restart: unless-stopped + volumes: + - /srv/apps-int01/data/nextcloud/redis:/data + networks: + - nextcloud-nw + + app: + image: nextcloud:apache + container_name: nextcloud + restart: unless-stopped + depends_on: + db: + condition: service_healthy + redis: + condition: service_started + environment: + TZ: Europe/Zurich + MYSQL_HOST: db + MYSQL_DATABASE: nextcloud + MYSQL_USER: nextcloud + MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD" + REDIS_HOST: redis + NEXTCLOUD_TRUSTED_DOMAINS: "nextcloud.example.internal" + OVERWRITEHOST: "nextcloud.example.internal" + OVERWRITEPROTOCOL: "https" + volumes: + - /srv/apps-int01/data/nextcloud/app:/var/www/html + - /srv/apps-int01/data/nextcloud/data:/var/www/html/data + networks: + - proxy-nw + - nextcloud-nw + healthcheck: + test: ["CMD-SHELL", "curl -fsS http://localhost/status.php || exit 1"] + interval: 30s + timeout: 10s + retries: 5 + start_period: 60s + + cron: + image: nextcloud:apache + container_name: nextcloud-cron + restart: unless-stopped + entrypoint: /cron.sh + depends_on: + db: + condition: service_healthy + redis: + condition: service_started + environment: + TZ: Europe/Zurich + MYSQL_HOST: db + MYSQL_DATABASE: nextcloud + MYSQL_USER: nextcloud + MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD" + REDIS_HOST: redis + volumes: + - /srv/apps-int01/data/nextcloud/app:/var/www/html + - /srv/apps-int01/data/nextcloud/data:/var/www/html/data + networks: + - nextcloud-nw + +networks: + proxy-nw: + external: true + nextcloud-nw: + driver: bridge +``` + +Da du Nextcloud nur fuer Kalender, Aufgaben und Kontakte nutzt, ist das auf `apps-int01` weiterhin gut vertretbar [1]. + +--- + +# 5. Seafile +Datei: +`/srv/apps-int01/compose/seafile/compose.yaml` + +```yaml +services: + db: + image: mariadb:11 + container_name: seafile-db + restart: unless-stopped + environment: + MYSQL_ROOT_PASSWORD: "CHANGE_ME_ROOT_PASSWORD" + MYSQL_DATABASE: seafile + MYSQL_USER: seafile + MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD" + volumes: + - /srv/apps-int01/data/seafile/mariadb:/var/lib/mysql + networks: + - seafile-nw + healthcheck: + test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"] + interval: 10s + timeout: 5s + retries: 5 + start_period: 20s + + memcached: + image: memcached:alpine + container_name: seafile-memcached + restart: unless-stopped + networks: + - seafile-nw + + seafile: + image: seafileltd/seafile-mc:latest + container_name: seafile + restart: unless-stopped + depends_on: + db: + condition: service_healthy + memcached: + condition: service_started + environment: + DB_HOST: db + DB_ROOT_PASSWD: "CHANGE_ME_ROOT_PASSWORD" + TIME_ZONE: Europe/Zurich + SEAFILE_ADMIN_EMAIL: "admin@example.internal" + SEAFILE_ADMIN_PASSWORD: "CHANGE_ME_ADMIN_PASSWORD" + SEAFILE_SERVER_LETSENCRYPT: "false" + SEAFILE_SERVER_HOSTNAME: "seafile.example.internal" + volumes: + - /srv/apps-int01/data/seafile/data:/shared + networks: + - proxy-nw + - seafile-nw + healthcheck: + test: ["CMD-SHELL", "curl -fsS http://localhost:80 || exit 1"] + interval: 30s + timeout: 10s + retries: 5 + start_period: 60s + +networks: + proxy-nw: + external: true + seafile-nw: + driver: bridge +``` + +In deiner bisherigen Struktur fuer Seafile waren `data`, `db` und `mariadb` vorgesehen [1]. Ich wuerde fuer dieses Compose effektiv `mariadb` als Datenpfad nutzen; `db` kannst du reserviert lassen oder spaeter streichen. + +--- + +# 6. OnlyOffice +Datei: +`/srv/apps-int01/compose/onlyoffice/compose.yaml` + +```yaml +services: + onlyoffice: + image: onlyoffice/documentserver:latest + container_name: onlyoffice + restart: unless-stopped + environment: + TZ: Europe/Zurich + JWT_ENABLED: "true" + JWT_SECRET: "CHANGE_ME_JWT_SECRET" + volumes: + - /srv/apps-int01/data/onlyoffice/data:/var/www/onlyoffice/Data + - /srv/apps-int01/data/onlyoffice/logs:/var/log/onlyoffice + networks: + - proxy-nw + - onlyoffice-nw + healthcheck: + test: ["CMD-SHELL", "curl -fsS http://localhost/healthcheck || exit 1"] + interval: 30s + timeout: 10s + retries: 5 + start_period: 60s + +networks: + proxy-nw: + external: true + onlyoffice-nw: + driver: bridge +``` + +--- + +## Startreihenfolge +Ich wuerde auf `apps-int01` so starten: + +1. vaultwarden +2. paperless +3. xwiki +4. nextcloud +5. seafile +6. onlyoffice + +Das passt auch dazu, dass `apps-int01` deine zentrale interne App-VM fuer genau diese Dienste ist [1]. + +## Startbefehle +Je App: + +```bash +cd /srv/apps-int01/compose/vaultwarden && docker compose up -d +cd /srv/apps-int01/compose/paperless && docker compose up -d +cd /srv/apps-int01/compose/xwiki && docker compose up -d +cd /srv/apps-int01/compose/nextcloud && docker compose up -d +cd /srv/apps-int01/compose/seafile && docker compose up -d +cd /srv/apps-int01/compose/onlyoffice && docker compose up -d +``` + +## Wichtiger Hinweis +Ein Teil der Image-Details und Environment-Variablen oben stammt aus allgemeinem Docker-/App-Wissen, nicht direkt aus deinem Kontext. Die App-Zuordnung, die Struktur unter `/srv/apps-int01` und die Diensteliste fuer `apps-int01` kommen aus deinem vorhandenen Plan [1]. + +Wenn du willst, mache ich dir als naechstes die Compose-Dateien auch noch direkt: +- mit deinen echten FQDNs +- mit `10.100.20.49` als DNS +- und ohne Healthchecks, falls du sie erstmal schlanker willst. \ No newline at end of file diff --git a/compose/nextcloud/compose.yaml b/compose/nextcloud/compose.yaml new file mode 100644 index 0000000..e69de29 diff --git a/compose/onlyoffice/compose.yaml b/compose/onlyoffice/compose.yaml new file mode 100644 index 0000000..e69de29 diff --git a/compose/paperless/compose.yaml b/compose/paperless/compose.yaml new file mode 100644 index 0000000..e69de29 diff --git a/compose/seafile/compose.yaml b/compose/seafile/compose.yaml new file mode 100644 index 0000000..e69de29 diff --git a/compose/vaultwarden/compose.yaml b/compose/vaultwarden/compose.yaml new file mode 100644 index 0000000..e69de29 diff --git a/compose/xwiki/compose.yaml b/compose/xwiki/compose.yaml new file mode 100644 index 0000000..e69de29 diff --git a/config/nextcloud/.gitkeep b/config/nextcloud/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/config/onlyoffice/.gitkeep b/config/onlyoffice/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/config/paperless/.gitkeep b/config/paperless/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/config/seafile/.gitkeep b/config/seafile/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/config/vaultwarden/.gitkeep b/config/vaultwarden/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/config/xwiki/.gitkeep b/config/xwiki/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/scripts/deploy.sh b/scripts/deploy.sh new file mode 100644 index 0000000..e69de29 diff --git a/scripts/init-dirs.sh b/scripts/init-dirs.sh new file mode 100644 index 0000000..e69de29