infra/apps-int01
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Container/Dienst Ziel vaultwarden apps-int01 paperless apps-int01 xwiki apps-int01 seafile apps-int01 wenn es bleibt redis-paperless apps-int01 redis apps-int01 wenn app-nah mariadb apps-int01 wenn bewusst gemeinsame App-DB adminer apps-int01 oder nur on-demand phpmyadmin apps-int01 oder nur on-demand
3 commits 1 branch 0 tags 45 KiB
Find a file
mrwacka 569a7c377a ein guter Tag
2026-09-08 06:58:25 +02:00
compose erste Compose 2026-09-07 21:54:52 +02:00
config erste Compose 2026-09-07 21:54:52 +02:00
scripts erste Compose 2026-09-07 21:54:52 +02:00
.gitignore erste Compose 2026-09-07 21:54:52 +02:00
README.md ein guter Tag 2026-09-08 06:58:25 +02:00

README.md

Ja. Dann wuerde ich fuer apps-int01 die Dienste als getrennte Compose-Dateien pro App bauen. Das passt zu deiner Struktur unter /srv/apps-int01/compose/... und zu deiner App-Liste auf apps-int01: Vaultwarden, Paperless, XWiki, Nextcloud, Seafile und OnlyOffice [1].

Ich wuerde ausserdem pro App:

  • ein eigenes internes Docker-Netz nehmen
  • nur Web-Frontends zusaetzlich an proxy-nw haengen
  • Daten konsequent unter /srv/apps-int01/data/... halten
  • Konfigurationen unter /srv/apps-int01/config/... halten

Vorab: externes Proxy-Netz einmalig anlegen

Falls noch nicht vorhanden:

docker network create proxy-nw

1. Vaultwarden

Datei: /srv/apps-int01/compose/vaultwarden/compose.yaml

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      TZ: Europe/Zurich
      SIGNUPS_ALLOWED: "false"
      WEBSOCKET_ENABLED: "true"
      ADMIN_TOKEN: "CHANGE_ME_ADMIN_TOKEN"
    volumes:
      - /srv/apps-int01/data/vaultwarden/data:/data
    networks:
      - proxy-nw
      - vaultwarden-nw
    healthcheck:
      test: ["CMD", "/vaultwarden", "--version"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s

networks:
  proxy-nw:
    external: true
  vaultwarden-nw:
    driver: bridge

Starten:

cd /srv/apps-int01/compose/vaultwarden
docker compose up -d

2. Paperless

Datei: /srv/apps-int01/compose/paperless/compose.yaml

services:
  broker:
    image: redis:7-alpine
    container_name: paperless-redis
    restart: unless-stopped
    volumes:
      - /srv/apps-int01/data/paperless/redis:/data
    networks:
      - paperless-nw

  db:
    image: postgres:16-alpine
    container_name: paperless-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: paperless
      POSTGRES_USER: paperless
      POSTGRES_PASSWORD: "CHANGE_ME_DB_PASSWORD"
    volumes:
      - /srv/apps-int01/data/paperless/db:/var/lib/postgresql/data
    networks:
      - paperless-nw
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U paperless -d paperless"]
      interval: 10s
      timeout: 5s
      retries: 5

  webserver:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      broker:
        condition: service_started
    environment:
      TZ: Europe/Zurich
      PAPERLESS_REDIS: redis://broker:6379
      PAPERLESS_DBHOST: db
      PAPERLESS_DBNAME: paperless
      PAPERLESS_DBUSER: paperless
      PAPERLESS_DBPASS: "CHANGE_ME_DB_PASSWORD"
      PAPERLESS_SECRET_KEY: "CHANGE_ME_SECRET_KEY"
      PAPERLESS_URL: "https://paperless.example.internal"
      PAPERLESS_TIME_ZONE: Europe/Zurich
      PAPERLESS_OCR_LANGUAGE: deu+eng
    volumes:
      - /srv/apps-int01/data/paperless/data:/usr/src/paperless/data
      - /srv/apps-int01/data/paperless/media:/usr/src/paperless/media
      - /srv/apps-int01/data/paperless/export:/usr/src/paperless/export
      - /srv/apps-int01/data/paperless/consume:/usr/src/paperless/consume
    networks:
      - proxy-nw
      - paperless-nw
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8000 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

networks:
  proxy-nw:
    external: true
  paperless-nw:
    driver: bridge

Hinweis: In deiner bisherigen Ordnerstruktur fuer paperless waren data, media, export und consume bereits vorgesehen [1]. Fuer diese Compose kommt noch db und redis dazu.

3. XWiki

Datei: /srv/apps-int01/compose/xwiki/compose.yaml

services:
  db:
    image: postgres:16-alpine
    container_name: xwiki-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: xwiki
      POSTGRES_USER: xwiki
      POSTGRES_PASSWORD: "CHANGE_ME_DB_PASSWORD"
    volumes:
      - /srv/apps-int01/data/xwiki/db:/var/lib/postgresql/data
    networks:
      - xwiki-nw
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U xwiki -d xwiki"]
      interval: 10s
      timeout: 5s
      retries: 5

  xwiki:
    image: xwiki:stable-postgres-tomcat
    container_name: xwiki
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      TZ: Europe/Zurich
      DB_HOST: db
      DB_DATABASE: xwiki
      DB_USER: xwiki
      DB_PASSWORD: "CHANGE_ME_DB_PASSWORD"
    volumes:
      - /srv/apps-int01/data/xwiki/data:/usr/local/xwiki
    networks:
      - proxy-nw
      - xwiki-nw
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

networks:
  proxy-nw:
    external: true
  xwiki-nw:
    driver: bridge

4. Nextcloud

Datei: /srv/apps-int01/compose/nextcloud/compose.yaml

services:
  db:
    image: mariadb:11
    container_name: nextcloud-db
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    environment:
      MYSQL_ROOT_PASSWORD: "CHANGE_ME_ROOT_PASSWORD"
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
    volumes:
      - /srv/apps-int01/data/nextcloud/db:/var/lib/mysql
    networks:
      - nextcloud-nw
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  redis:
    image: redis:7-alpine
    container_name: nextcloud-redis
    restart: unless-stopped
    volumes:
      - /srv/apps-int01/data/nextcloud/redis:/data
    networks:
      - nextcloud-nw

  app:
    image: nextcloud:apache
    container_name: nextcloud
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    environment:
      TZ: Europe/Zurich
      MYSQL_HOST: db
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
      REDIS_HOST: redis
      NEXTCLOUD_TRUSTED_DOMAINS: "nextcloud.example.internal"
      OVERWRITEHOST: "nextcloud.example.internal"
      OVERWRITEPROTOCOL: "https"
    volumes:
      - /srv/apps-int01/data/nextcloud/app:/var/www/html
      - /srv/apps-int01/data/nextcloud/data:/var/www/html/data
    networks:
      - proxy-nw
      - nextcloud-nw
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost/status.php || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  cron:
    image: nextcloud:apache
    container_name: nextcloud-cron
    restart: unless-stopped
    entrypoint: /cron.sh
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    environment:
      TZ: Europe/Zurich
      MYSQL_HOST: db
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
      REDIS_HOST: redis
    volumes:
      - /srv/apps-int01/data/nextcloud/app:/var/www/html
      - /srv/apps-int01/data/nextcloud/data:/var/www/html/data
    networks:
      - nextcloud-nw

networks:
  proxy-nw:
    external: true
  nextcloud-nw:
    driver: bridge

Da du Nextcloud nur fuer Kalender, Aufgaben und Kontakte nutzt, ist das auf apps-int01 weiterhin gut vertretbar [1].

5. Seafile

Datei: /srv/apps-int01/compose/seafile/compose.yaml

services:
  db:
    image: mariadb:11
    container_name: seafile-db
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: "CHANGE_ME_ROOT_PASSWORD"
      MYSQL_DATABASE: seafile
      MYSQL_USER: seafile
      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
    volumes:
      - /srv/apps-int01/data/seafile/mariadb:/var/lib/mysql
    networks:
      - seafile-nw
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  memcached:
    image: memcached:alpine
    container_name: seafile-memcached
    restart: unless-stopped
    networks:
      - seafile-nw

  seafile:
    image: seafileltd/seafile-mc:latest
    container_name: seafile
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      memcached:
        condition: service_started
    environment:
      DB_HOST: db
      DB_ROOT_PASSWD: "CHANGE_ME_ROOT_PASSWORD"
      TIME_ZONE: Europe/Zurich
      SEAFILE_ADMIN_EMAIL: "admin@example.internal"
      SEAFILE_ADMIN_PASSWORD: "CHANGE_ME_ADMIN_PASSWORD"
      SEAFILE_SERVER_LETSENCRYPT: "false"
      SEAFILE_SERVER_HOSTNAME: "seafile.example.internal"
    volumes:
      - /srv/apps-int01/data/seafile/data:/shared
    networks:
      - proxy-nw
      - seafile-nw
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:80 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

networks:
  proxy-nw:
    external: true
  seafile-nw:
    driver: bridge

In deiner bisherigen Struktur fuer Seafile waren data, db und mariadb vorgesehen [1]. Ich wuerde fuer dieses Compose effektiv mariadb als Datenpfad nutzen; db kannst du reserviert lassen oder spaeter streichen.

6. OnlyOffice

Datei: /srv/apps-int01/compose/onlyoffice/compose.yaml

services:
  onlyoffice:
    image: onlyoffice/documentserver:latest
    container_name: onlyoffice
    restart: unless-stopped
    environment:
      TZ: Europe/Zurich
      JWT_ENABLED: "true"
      JWT_SECRET: "CHANGE_ME_JWT_SECRET"
    volumes:
      - /srv/apps-int01/data/onlyoffice/data:/var/www/onlyoffice/Data
      - /srv/apps-int01/data/onlyoffice/logs:/var/log/onlyoffice
    networks:
      - proxy-nw
      - onlyoffice-nw
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost/healthcheck || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

networks:
  proxy-nw:
    external: true
  onlyoffice-nw:
    driver: bridge

Startreihenfolge

Ich wuerde auf apps-int01 so starten:

  1. vaultwarden
  2. paperless
  3. xwiki
  4. nextcloud
  5. seafile
  6. onlyoffice

Das passt auch dazu, dass apps-int01 deine zentrale interne App-VM fuer genau diese Dienste ist [1].

Startbefehle

Je App:

cd /srv/apps-int01/compose/vaultwarden && docker compose up -d
cd /srv/apps-int01/compose/paperless && docker compose up -d
cd /srv/apps-int01/compose/xwiki && docker compose up -d
cd /srv/apps-int01/compose/nextcloud && docker compose up -d
cd /srv/apps-int01/compose/seafile && docker compose up -d
cd /srv/apps-int01/compose/onlyoffice && docker compose up -d

Wichtiger Hinweis

Ein Teil der Image-Details und Environment-Variablen oben stammt aus allgemeinem Docker-/App-Wissen, nicht direkt aus deinem Kontext. Die App-Zuordnung, die Struktur unter /srv/apps-int01 und die Diensteliste fuer apps-int01 kommen aus deinem vorhandenen Plan [1].

Wenn du willst, mache ich dir als naechstes die Compose-Dateien auch noch direkt:

  • mit deinen echten FQDNs
  • mit 10.100.20.49 als DNS
  • und ohne Healthchecks, falls du sie erstmal schlanker willst.