From 435c53b4e45613493fa736a3a63f587a61d59241 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Mon, 14 Sep 2026 12:34:16 +0200 Subject: [PATCH 1/8] Audit and fix repository consistency issues --- .github/workflows/linting.yml | 4 +- README.md | 11 +-- services/actual-budget/.env | 3 +- services/actual-budget/README.md | 2 +- services/adguardhome-sync/README.md | 2 +- services/adguardhome/README.md | 2 +- services/affine/.env | 5 +- services/affine/README.md | 2 +- services/affine/compose.yml | 6 +- services/anchor/.env | 3 +- services/anchor/README.md | 2 +- services/arcane/.env | 6 +- services/arcane/README.md | 2 +- services/artisttrackarr/.env | 5 +- services/artisttrackarr/README.md | 2 +- services/artisttrackarr/compose.yaml | 4 +- services/audiobookshelf/README.md | 2 +- services/bazarr/README.md | 2 +- services/bentopdf/README.md | 4 +- services/bentopdf/compose.yaml | 2 +- services/beszel-agent/README.md | 2 +- services/beszel-hub/README.md | 2 +- services/booklore/.env | 16 ++--- services/booklore/README.md | 4 +- services/caddy/.env | 2 +- services/caddy/README.md | 4 +- services/caddy/compose.yaml | 12 ++-- services/changedetection/README.md | 2 +- services/clipcascade/README.md | 2 +- services/coder/README.md | 2 +- services/configarr/README.md | 2 +- services/configarr/compose.yaml | 2 +- services/convertx/README.md | 2 +- services/copyparty/README.md | 4 +- services/cyberchef/README.md | 2 +- services/ddns-updater/README.md | 2 +- services/dockge/.env | 11 +-- services/dockge/README.md | 2 +- services/dockge/compose.yaml | 6 +- services/dockhand/.env | 3 +- services/dockhand/README.md | 2 +- services/dockhand/compose.yaml | 2 +- services/docmost/README.md | 2 +- services/donetick/README.md | 20 +++--- services/dozzle/README.md | 2 +- services/dumbdo/README.md | 18 ++--- services/eigenfocus/README.md | 2 +- services/espocrm/.env | 6 +- services/espocrm/README.md | 2 +- services/excalidraw/README.md | 2 +- services/filebrowser/.env | 3 +- services/flaresolverr/README.md | 2 +- services/flatnotes/.env | 3 - services/flatnotes/README.md | 20 +++--- services/forgejo/README.md | 2 +- services/formbricks/.env | 3 +- services/formbricks/README.md | 2 +- services/formbricks/compose.yaml | 82 +++++++++++----------- services/fossflow/README.md | 2 +- services/freshrss/.env | 3 +- services/frigate/.env | 3 +- services/frigate/README.md | 2 +- services/ghost/.env | 5 +- services/ghost/README.md | 4 +- services/ghost/compose.yaml | 4 +- services/gitea/README.md | 2 +- services/gitsave/README.md | 2 +- services/glance/README.md | 2 +- services/gokapi/README.md | 2 +- services/gotify/README.md | 2 +- services/grampsweb/README.md | 2 +- services/haptic/README.md | 2 +- services/hemmelig/README.md | 2 +- services/homarr/README.md | 2 +- services/home-assistant/README.md | 20 +++--- services/homebox/.env | 3 +- services/homebox/README.md | 2 +- services/homepage/README.md | 2 +- services/hytale/.env | 3 +- services/immich/.env | 3 +- services/immich/README.md | 2 +- services/isley/README.md | 2 +- services/it-tools/README.md | 2 +- services/jellyfin/README.md | 2 +- services/kaneo/.env | 14 +--- services/kaneo/README.md | 2 +- services/karakeep/.env | 3 +- services/karakeep/README.md | 2 +- services/kavita/README.md | 2 +- services/kitchenowl/.env | 8 ++- services/kitchenowl/README.md | 2 +- services/languagetool/README.md | 2 +- services/linkding/README.md | 2 +- services/lube-logger/README.md | 2 +- services/mailpit/.env | 5 +- services/mattermost/.env | 16 ++--- services/mattermost/README.md | 6 +- services/mealie/README.md | 2 +- services/memos/.env | 3 +- services/memos/README.md | 2 +- services/metube/README.md | 2 +- services/minecraft/.env | 3 +- services/minecraft/README.md | 2 +- services/minecraft/compose.yaml | 13 ---- services/miniflux/.env | 3 +- services/miniflux/README.md | 2 +- services/miniqr/README.md | 2 +- services/nanote/README.md | 2 +- services/navidrome/README.md | 4 +- services/nessus/README.md | 2 +- services/netbox/.env | 6 +- services/netbox/README.md | 2 +- services/netbox/compose.yaml | 6 +- services/newwallpaperwhodis/.env | 3 +- services/next-explorer/.env | 4 +- services/next-explorer/README.md | 4 +- services/nodered/README.md | 2 +- services/ntfy/README.md | 2 +- services/ollama/.env | 3 +- services/open-webui/.env | 6 +- services/open-webui/README.md | 2 +- services/paperless/.env | 3 +- services/paperless/README.md | 2 +- services/picard/.env | 3 +- services/picard/README.md | 2 +- services/pihole/README.md | 2 +- services/pingvin-share/README.md | 2 +- services/plex/README.md | 2 +- services/pocket-id/README.md | 2 +- services/portainer/README.md | 2 +- services/portracker/README.md | 2 +- services/posterizarr/README.md | 2 +- services/prowlarr/README.md | 2 +- services/qbittorrent/README.md | 2 +- services/radarr/README.md | 2 +- services/radicale/README.md | 2 +- services/recyclarr/README.md | 2 +- services/resilio-sync/README.md | 2 +- services/rustdesk-server/.env | 3 +- services/rustdesk-server/README.md | 2 +- services/seafile/.env | 13 ++-- services/seafile/README.md | 2 +- services/searxng/.env | 3 +- services/searxng/README.md | 3 +- services/searxng/compose.yaml | 1 + services/seerr/README.md | 2 +- services/slink/README.md | 2 +- services/sonarr/README.md | 2 +- services/speedtest-tracker/README.md | 2 +- services/stirlingpdf/README.md | 2 +- services/subtrackr/README.md | 2 +- services/sure/.env | 13 ++-- services/swingmx/README.md | 4 +- services/tailscale-app-connector-node/.env | 3 +- services/tailscale-exit-node/.env | 3 +- services/tailscale-subnet-router-node/.env | 3 +- services/tandoor/README.md | 2 +- services/tautulli/README.md | 2 +- services/tracktor/.env | 6 +- services/tracktor/README.md | 4 +- services/tracktor/compose.yaml | 2 +- services/traefik/README.md | 2 +- services/traefik/compose.yaml | 2 +- services/transmute/.env | 3 +- services/transmute/README.md | 2 +- services/transmute/compose.yaml | 4 +- services/uptime-kuma/README.md | 2 +- services/vaultwarden/README.md | 2 +- services/vikunja/.env | 5 +- services/vikunja/README.md | 2 +- services/vikunja/compose.yaml | 4 +- services/wallos/README.md | 2 +- services/xwiki/.env | 5 +- services/xwiki/compose.yml | 2 +- templates/service-template/.env | 12 ++-- templates/service-template/README.md | 2 +- templates/service-template/compose.yaml | 2 +- 177 files changed, 389 insertions(+), 341 deletions(-) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 4172a839..982bfcaf 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -29,9 +29,9 @@ jobs: - name: Clone this repo uses: actions/checkout@v6 - - name: Lint services + - name: Lint Markdown uses: rvben/rumdl@v0.2.41 with: - path: "services/" + path: "." config: ".markdownlint.yml" report-type: annotations diff --git a/README.md b/README.md index 7fdfbae9..622344fb 100644 --- a/README.md +++ b/README.md @@ -51,11 +51,11 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose - [🎥 Media and Entertainment](#-media-and-entertainment) - [💼 Productivity and Collaboration](#-productivity-and-collaboration) - [📊 Dashboards and Visualization](#-dashboards-and-visualization) - - [🛠️ Development Tools](#️-development-tools) + - [🛠️ Development Tools](#-development-tools) - [📈 Monitoring and Analytics](#-monitoring-and-analytics) - [🏠 Smart Home](#-smart-home) - [📱 Utilities](#-utilities) - - [🍽️ Food \& Wellness](#️-food--wellness) + - [🍽️ Food \& Wellness](#-food--wellness) - [Tailscale Information](#tailscale-information) - [Tailscale Funnel vs. Tailscale Serve](#tailscale-funnel-vs-tailscale-serve) - [Tailscale Funnel](#tailscale-funnel) @@ -99,6 +99,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 📰 **FreshRSS** | A customizable feed reader with themes, extensions, and no separate database. | [Details](services/freshrss) | | 🎥 **Frigate** | A self-hosted NVR with real-time AI object detection for IP cameras and local video monitoring. | [Details](services/frigate) | | 🎮 **Hytale** | A self-hosted Hytale game server. | [Details](services/hytale) | +| ⛏️ **Minecraft** | A self-hosted Minecraft Java Edition server for private Tailnet multiplayer. | [Details](services/minecraft) | | 🖼️ **Immich** | A self-hosted Google Photos alternative with face recognition and mobile sync. | [Details](services/immich) | | 📺 **Jellyfin** | An open-source media system that puts you in control of managing and streaming your media. | [Details](services/jellyfin) | | 📖 **Kavita** | An open-source, self-hosted digital library for comics, manga, and ebooks. | [Details](services/kavita) | @@ -125,6 +126,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 💼 Service | 📝 Description | 🔗 Link | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | | 💰 **Actual Budget** | A self-hosted personal finance and budgeting app focused on privacy and full data ownership. | [Details](services/actual-budget) | +| 🧠 **AFFiNE** | A self-hosted workspace for documents, whiteboards, and databases. | [Details](services/affine) | | ⚓ **Anchor** | An offline-first, self-hosted note-taking app with sync, attachments, sharing, and optional OIDC authentication. | [Details](services/anchor) | | 📄 **BentoPDF** | A lightweight, self-hosted web app for viewing and managing PDF documents. | [Details](services/bentopdf) | | ✂️ **ClipCascade** | A self-hosted clipboard manager for syncing and organizing clipboard history. | [Details](services/clipcascade) | @@ -150,6 +152,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 📥 **Mattermost** | A self-hosted collaborative workflow and communication tool. | [Details](services/mattermost) | | 📝 **Memos** | A lightweight, self-hosted note-taking and knowledge management platform for capturing ideas, daily notes, and personal knowledge. | [Details](services/memos) | | 📝 **Nanote** | A lightweight, self-hosted note-taking app with Markdown support. | [Details](services/nanote) | +| 📂 **NextExplorer** | A self-hosted file explorer for managing mounted directories. | [Details](services/next-explorer) | | 🤖 **Open WebUI** | A self-hosted AI platform with a ChatGPT-style interface for local and cloud-based models. | [Details](services/open-webui) | | 🔗 **Pingvin Share** | **PROJECT ARCHIVED** A self-hosted file sharing platform. | [Details](services/pingvin-share) | | 📅 **Radicale** | A lightweight CalDAV and CardDAV server for self-hosted calendar, to-do, and contact sync. | [Details](services/radicale) | @@ -171,7 +174,6 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 🏠 **Homepage** | A modern, highly customizable homepage for organizing links and monitoring services. | [Details](services/homepage) | | 🖼️ **NewWallpaperWhoDis** | A lightweight, self-hosted wallpaper management server and dynamic rotation engine built on flat-file architecture. | [Details](services/newwallpaperwhodis) | - ### 🛠️ Development Tools | 🛠️ Service | 📝 Description | 🔗 Link | @@ -183,6 +185,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 🐳 **Dockhand** | A modern, lightweight Docker management UI for containers and Compose stacks. | [Details](services/dockhand) | | 🐳 **Dockge** | A lightweight, self-hosted Docker Compose stack manager with a web UI. | [Details](services/dockge) | | 🖥️ **Dozzle** | A real-time log viewer for Docker containers. | [Details](services/dozzle) | +| 📁 **Filebrowser** | A lightweight web file manager for a host directory. | [Details](services/filebrowser) | | 🔁 **FossFLOW** | A self-hosted tool to make beautiful isometric infrastructure diagrams. | [Details](services/fossflow) | | 🖥️ **GitSave** | A self-hosted service to back up your GitHub repositories via a simple REST API and scheduled runs. | [Details](services/gitsave) | | 🖥️ **Gokapi** | A lightweight self-hosted file sharing platform. | [Details](services/gokapi) | @@ -272,7 +275,7 @@ Made with [contrib.rocks](https://contrib.rocks). ## Contributing -See [CONTRIBUTING.md](/CONTRIBUTING.md) for guidance on adding services with the [template](/templates/service-template/) to keep Tailscale-sidecar setups consistent. +See [CONTRIBUTING.md](CONTRIBUTING.md) for guidance on adding services with the [template](templates/service-template/) to keep Tailscale-sidecar setups consistent. ## Star History diff --git a/services/actual-budget/.env b/services/actual-budget/.env index 87077102..d49fe2b0 100644 --- a/services/actual-budget/.env +++ b/services/actual-budget/.env @@ -11,7 +11,8 @@ SERVICEPORT=5006 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/actual-budget/README.md b/services/actual-budget/README.md index 535aaddf..93282d00 100644 --- a/services/actual-budget/README.md +++ b/services/actual-budget/README.md @@ -10,7 +10,7 @@ When paired with Tailscale, Actual Budget becomes accessible across your devices ## Configuration Overview -In this setup, the `tailscale-actual` service runs Tailscale, which manages secure networking for Actual Budget. The `actual` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures the application is only reachable over your Tailnet unless you explicitly expose ports. +In this setup, the `tailscale-actual` service runs Tailscale, which manages secure networking for Actual Budget. The `actual` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures the application is only reachable over your Tailnet unless you explicitly expose ports. ## Key Features diff --git a/services/adguardhome-sync/README.md b/services/adguardhome-sync/README.md index 1540bdf2..0a3c2f80 100644 --- a/services/adguardhome-sync/README.md +++ b/services/adguardhome-sync/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[AdGuardHome Sync](https://github.co ## Configuration Overview -In this setup, the `tailscale-adguardhome-sync` service runs Tailscale, which manages secure networking for the AdGuardHome Sync service. The `adguardhome-sync` container uses the Tailscale network stack via Docker’s `network_mode: service:` configuration. This ensures that all sync communication is confined to your private Tailscale network, preventing exposure to the public internet. +In this setup, the `tailscale-adguardhome-sync` service runs Tailscale, which manages secure networking for the AdGuardHome Sync service. The `adguardhome-sync` container uses the Tailscale network stack via Docker’s `network_mode: service:tailscale` configuration. This ensures that all sync communication is confined to your private Tailscale network, preventing exposure to the public internet. diff --git a/services/adguardhome/README.md b/services/adguardhome/README.md index e7fa44fa..b9f36dd3 100644 --- a/services/adguardhome/README.md +++ b/services/adguardhome/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [AdGuard Home](https://github.com/Adgu ## Configuration Overview -In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for the AdGuard Home service. The `adguardhome` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that AdGuard Home's DNS service is only accessible through the Tailscale network (or local as well, if preferred). +In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for the AdGuard Home service. The `adguardhome` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that AdGuard Home's DNS service is only accessible through the Tailscale network (or local as well, if preferred). ## Binding to your local host machine? Port 53 - DNSStubListener diff --git a/services/affine/.env b/services/affine/.env index 6e65bb1c..c14b19e5 100644 --- a/services/affine/.env +++ b/services/affine/.env @@ -11,7 +11,8 @@ SERVICEPORT=3010 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones @@ -30,4 +31,4 @@ AFFINE_SERVER_EXTERNAL_URL=https://affine..ts.net # database credentials DB_USERNAME=affine DB_PASSWORD=affine -DB_DATABASE=affine \ No newline at end of file +DB_DATABASE=affine diff --git a/services/affine/README.md b/services/affine/README.md index 27478ccf..3e066b19 100644 --- a/services/affine/README.md +++ b/services/affine/README.md @@ -20,7 +20,7 @@ AFFiNE is designed around modern knowledge work, blending structured content and ## Configuration Overview -In this setup, the `tailscale-affine` service runs Tailscale and handles secure networking for the stack. The `affine` service shares the Tailscale container's network namespace using Docker's `network_mode: service:` configuration. This means AFFiNE is reachable through your Tailnet without exposing it directly to the public internet. +In this setup, the `tailscale-affine` service runs Tailscale and handles secure networking for the stack. The `affine` service shares the Tailscale container's network namespace using Docker's `network_mode: service:tailscale` configuration. This means AFFiNE is reachable through your Tailnet without exposing it directly to the public internet. This approach provides a secure and simple way to self-host AFFiNE privately, whether for personal note-taking, team collaboration, or internal documentation. diff --git a/services/affine/compose.yml b/services/affine/compose.yml index e8f4a4dc..498ab8e2 100644 --- a/services/affine/compose.yml +++ b/services/affine/compose.yml @@ -66,7 +66,7 @@ services: env_file: - .env environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. - REDIS_SERVER_HOST=redis - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${postgres:-affine} - AFFINE_INDEXER_ENABLED=false @@ -84,7 +84,7 @@ services: env_file: - .env environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. - REDIS_SERVER_HOST=redis - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${postgres:-affine} - AFFINE_INDEXER_ENABLED=false @@ -111,7 +111,7 @@ services: volumes: - ./postgres:/var/lib/postgresql/data environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. POSTGRES_USER: ${DB_USERNAME} POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_DB: ${postgres:-affine} diff --git a/services/anchor/.env b/services/anchor/.env index e95785fa..c8bc01e1 100644 --- a/services/anchor/.env +++ b/services/anchor/.env @@ -11,7 +11,8 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/anchor/README.md b/services/anchor/README.md index 70f49d43..d16c77b3 100644 --- a/services/anchor/README.md +++ b/services/anchor/README.md @@ -18,7 +18,7 @@ This Docker Compose configuration sets up [Anchor](https://github.com/ZhFahim/an ## Configuration Overview -In this setup, the `tailscale-anchor` service runs Tailscale and manages secure networking for Anchor. The `anchor` service shares that network stack via Docker's `network_mode: service:` configuration, which keeps the app private to your Tailnet unless you intentionally add host port mappings or funnel it through another public entrypoint. +In this setup, the `tailscale-anchor` service runs Tailscale and manages secure networking for Anchor. The `anchor` service shares that network stack via Docker's `network_mode: service:tailscale` configuration, which keeps the app private to your Tailnet unless you intentionally add host port mappings or funnel it through another public entrypoint. ## Upstream documentation diff --git a/services/arcane/.env b/services/arcane/.env index 89794c0b..8929be84 100644 --- a/services/arcane/.env +++ b/services/arcane/.env @@ -11,12 +11,14 @@ SERVICEPORT=3552 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables -TAILNET_NAME= # for example: tail-scale +TAILNET_NAME= +# for example: tail-scale #EXAMPLE_VAR="Environment varibale" diff --git a/services/arcane/README.md b/services/arcane/README.md index aa65e1f4..c086f358 100644 --- a/services/arcane/README.md +++ b/services/arcane/README.md @@ -22,7 +22,7 @@ This Docker Compose configuration sets up **Arcane** with a Tailscale sidecar co In this deployment, a **Tailscale sidecar container** (for example `tailscale-arcane`) runs the Tailscale client and joins your private Tailscale network. The main `arcane` service uses: ```plain -network_mode: service:tailscale-arcane +network_mode: service:tailscale ``` This configuration routes all traffic through the Tailscale interface, ensuring that the Arcane web UI and API are accessible **only via your Tailscale network**. This provides a simple and secure way to access your Docker management console from all trusted devices while preventing public access to container controls. diff --git a/services/artisttrackarr/.env b/services/artisttrackarr/.env index fa5d4d5f..ae57838c 100644 --- a/services/artisttrackarr/.env +++ b/services/artisttrackarr/.env @@ -11,7 +11,8 @@ SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -30,4 +31,4 @@ POLL_INTERVAL=6h TRUST_PROXY=false # SPOTIFY_CLIENT_ID= # SPOTIFY_CLIENT_SECRET= -# SPOTIFY_MARKET=US \ No newline at end of file +# SPOTIFY_MARKET=US diff --git a/services/artisttrackarr/README.md b/services/artisttrackarr/README.md index 37594da4..890ec199 100644 --- a/services/artisttrackarr/README.md +++ b/services/artisttrackarr/README.md @@ -10,7 +10,7 @@ Pairing ArtistTrackarr with Tailscale provides private access to its web interfa ## Configuration Overview -In this setup, the `tailscale-artist-trackarr` service runs Tailscale and manages secure networking for ArtistTrackarr. The `artist-trackarr` service uses the Tailscale container's network stack through Docker's `network_mode: service:tailscale-artist-trackarr` configuration. +In this setup, the `tailscale-artist-trackarr` service runs Tailscale and manages secure networking for ArtistTrackarr. The `artist-trackarr` service uses the Tailscale container's network stack through Docker's `network_mode: service:tailscale` configuration. ArtistTrackarr listens on port `8080`. Because both containers share the same network namespace, Tailscale Serve can forward traffic directly to `http://127.0.0.1:8080`. diff --git a/services/artisttrackarr/compose.yaml b/services/artisttrackarr/compose.yaml index 472ab33f..f3cbc3c3 100644 --- a/services/artisttrackarr/compose.yaml +++ b/services/artisttrackarr/compose.yaml @@ -52,7 +52,7 @@ services: image: ${IMAGE_URL} # Image to be used network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} # Name for local container management - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. PUID: 1000 PGI: 1000 TZ: ${TZ} @@ -95,4 +95,4 @@ secrets: encryption_key: environment: APP_ENCRYPTION_KEY session_secret: - environment: SESSION_SECRET \ No newline at end of file + environment: SESSION_SECRET diff --git a/services/audiobookshelf/README.md b/services/audiobookshelf/README.md index 677fc8d5..9ef2f84f 100644 --- a/services/audiobookshelf/README.md +++ b/services/audiobookshelf/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Audiobookshelf](https://github.com/ad ## Configuration Overview -In this setup, the `tailscale-audiobookshelf` service runs Tailscale, which manages secure networking for the Audiobookshelf service. The `audiobookshelf` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Audiobookshelf’s web interface and streaming capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your personal audiobook and podcast collection. +In this setup, the `tailscale-audiobookshelf` service runs Tailscale, which manages secure networking for the Audiobookshelf service. The `audiobookshelf` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Audiobookshelf’s web interface and streaming capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your personal audiobook and podcast collection. diff --git a/services/bazarr/README.md b/services/bazarr/README.md index 408c58d6..c966f62b 100644 --- a/services/bazarr/README.md +++ b/services/bazarr/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Bazarr](https://github.com/morpheus65 ## Configuration Overview -In this setup, the tailscale-bazarr service runs Tailscale, which manages secure networking for the Bazarr service. The bazarr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Bazarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted subtitle manager. +In this setup, the tailscale-bazarr service runs Tailscale, which manages secure networking for the Bazarr service. The bazarr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Bazarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted subtitle manager. diff --git a/services/bentopdf/README.md b/services/bentopdf/README.md index aaa8b27c..7db369cb 100644 --- a/services/bentopdf/README.md +++ b/services/bentopdf/README.md @@ -25,7 +25,9 @@ PDF files often contain sensitive personal or business information. Self-hosting In this deployment, a **Tailscale sidecar container** (for example `tailscale-bentopdf`) runs the Tailscale client and joins your private Tailscale network. The main `bentopdf` service uses: ```plain -network_mode: service:tailscale-bentopdf +network_mode: service:tailscale ``` This configuration routes all traffic through the Tailscale interface, ensuring that the BentoPDF web UI is accessible **only via your Tailscale network**. This provides a simple and secure way to access your PDF library from all trusted devices. + +BentoPDF listens on port `8080` inside the container. If you enable the optional host mapping, `SERVICEPORT` is the host port and maps to container port `8080`. diff --git a/services/bentopdf/compose.yaml b/services/bentopdf/compose.yaml index efea88d6..8daca760 100644 --- a/services/bentopdf/compose.yaml +++ b/services/bentopdf/compose.yaml @@ -35,7 +35,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:8080 # Binding the host port to BentoPDF's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} diff --git a/services/beszel-agent/README.md b/services/beszel-agent/README.md index 9913020f..3826dddb 100644 --- a/services/beszel-agent/README.md +++ b/services/beszel-agent/README.md @@ -8,4 +8,4 @@ The Beszel Agent is the client-side component that connects to the Hub to send a ## Configuration Overview -In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Agent service. The Agent service connects to the Tailscale network stack using Docker's `network_mode: service:` configuration. This setup guarantees that the Agent's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. +In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Agent service. The Agent service connects to the Tailscale network stack using Docker's `network_mode: service:tailscale` configuration. This setup guarantees that the Agent's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. diff --git a/services/beszel-hub/README.md b/services/beszel-hub/README.md index b2e4035c..a209b06f 100644 --- a/services/beszel-hub/README.md +++ b/services/beszel-hub/README.md @@ -8,4 +8,4 @@ The Beszel Hub is the core component responsible for routing messages between ag ## Configuration Overview -In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Hub service. The Hub service connects to the Tailscale network stack using Docker's `network_mode: service:` configuration. This setup guarantees that the Hub's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. +In this setup, the `tailscale` service runs Tailscale, which manages secure networking for the Beszel Hub service. The Hub service connects to the Tailscale network stack using Docker's `network_mode: service:tailscale` configuration. This setup guarantees that the Hub's communication channels are only accessible through the Tailscale network, providing an extra layer of security and privacy. diff --git a/services/booklore/.env b/services/booklore/.env index eba934a3..5e024870 100644 --- a/services/booklore/.env +++ b/services/booklore/.env @@ -7,24 +7,24 @@ SERVICE=booklore IMAGE_URL=ghcr.io/booklore-app/booklore # Network Configuration -SERVICEPORT=80 +SERVICEPORT=6060 DNS_SERVER=9.9.9.9 # Tailscale Configuration -TS_AUTHKEY= # Add your TS authkey +TS_AUTHKEY= +# Add your TS authkey # Time Zone setting for containers -TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +TZ=Europe/Paris # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # MariaDB Credentials -MYSQL_ROOT_PASSWORD= # Use a strong password for the databases root user, should be different from MYSQL_PASSWORD +MYSQL_ROOT_PASSWORD= +# Use a strong password for the databases root user, should be different from MYSQL_PASSWORD MYSQL_DATABASE=booklore MYSQL_USER=booklore -MYSQL_PASSWORD= # Use a strong password; must match DATABASE_PASSWORD defined in the booklore container +MYSQL_PASSWORD= +# Use a strong password; must match DATABASE_PASSWORD defined in the booklore container -# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List -TZ=Europe/Paris - #EXAMPLE_VAR="Environment varibale" diff --git a/services/booklore/README.md b/services/booklore/README.md index 4ff1a917..b2c39176 100644 --- a/services/booklore/README.md +++ b/services/booklore/README.md @@ -8,4 +8,6 @@ This Docker Compose configuration sets up [BookLore](https://github.com/booklore ## Configuration Overview -In this setup, the `tailscale-booklore` service runs Tailscale, which manages secure networking for the BookLore service. The `booklore` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that BookLore’s web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy. +In this setup, the `tailscale-booklore` service runs Tailscale, which manages secure networking for the BookLore service. The `booklore` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that BookLore’s web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy. + +BookLore listens on port `6060`. Set `SERVICEPORT` to `6060` if you enable the optional host port mapping. diff --git a/services/caddy/.env b/services/caddy/.env index 77b5b6fc..0699e545 100644 --- a/services/caddy/.env +++ b/services/caddy/.env @@ -3,7 +3,7 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE=caddy # If this is changed please set docker-compose.yml services:caddy_proxy:healthcheck $SERVICE to the string caddy. Also update the Caddyfile FQDN. +SERVICE=caddy # If this changes, update the Caddyfile hostname. The application healthcheck uses SERVICE automatically. IMAGE_URL=caddy:latest # Network Configuration diff --git a/services/caddy/README.md b/services/caddy/README.md index c57dac9e..a8d66172 100644 --- a/services/caddy/README.md +++ b/services/caddy/README.md @@ -8,14 +8,14 @@ This Docker Compose configuration sets up [Caddy](https://github.com/caddyserver ## Configuration Overview -In this setup, the `tailscale-caddy` service runs Tailscale, which manages secure networking for the Caddy service. The `caddy_proxy` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Caddy’s dashboard and routing functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of privacy and security to your network architecture. +In this setup, the `tailscale-caddy` service runs Tailscale, which manages secure networking for Caddy. The `application` service uses Docker's `network_mode: service:tailscale` configuration. This keeps Caddy's dashboard and routes on your Tailnet unless you publish a host port. To get this working: - Update the FQDN in `Caddyfile` to match your `${SERVICE}.MagicDNSname.ts.net`. - Update the TS_AUTHKEY in the .env file to your Tailscale key. -If you change the `SERVICE=caddy` line in the .env file, the hostname of the FQDN in the Caddyfile must be updated as well. Additionally please replace $SERVICE in compose.yaml services:caddy_proxy:healthcheck with the string caddy. +If you change `SERVICE` in `.env`, update the hostname in `Caddyfile` as well. The application healthcheck uses the value of `SERVICE` automatically. The example `compose.yaml` uses a simple webserver for testing purposes. diff --git a/services/caddy/compose.yaml b/services/caddy/compose.yaml index 4cc90251..5f53e0fc 100644 --- a/services/caddy/compose.yaml +++ b/services/caddy/compose.yaml @@ -18,7 +18,7 @@ services: volumes: - ./config:/config # Config folder used to store Tailscale files - you may need to change the path - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path - #- ./tailscale/tmp:/tmp # Share the tmp folder with the tailscale socket for TLS. Remove # if required. + - ./tailscale/tmp:/tmp # Share the tmp folder with the tailscale socket for TLS. devices: - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work cap_add: @@ -46,11 +46,11 @@ services: - PGID=1000 - TZ=${TZ} volumes: - - $PWD/Caddyfile:/etc/caddy/Caddyfile - - $PWD/site:/srv - - $PWD/caddy_data:/data - - $PWD/caddy_config:/config - - $PWD/tailscale/tmp/tailscaled.sock:/var/run/tailscale/tailscaled.sock # mount the socket at the right place. Comment out if not required. + - ./Caddyfile:/etc/caddy/Caddyfile + - ./site:/srv + - ./caddy_data:/data + - ./caddy_config:/config + - ./tailscale/tmp/tailscaled.sock:/var/run/tailscale/tailscaled.sock # Mount the Tailscale socket for TLS. depends_on: tailscale: condition: service_healthy diff --git a/services/changedetection/README.md b/services/changedetection/README.md index 3f6b9e11..c5a692fd 100644 --- a/services/changedetection/README.md +++ b/services/changedetection/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [ChangeDetection.io](https://github.co ## Configuration Overview -In this setup, the `tailscale-changedetection` service runs Tailscale, which manages secure networking for the ChangeDetection.io service. The `changedetection` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that ChangeDetection.io’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your website monitoring setup. +In this setup, the `tailscale-changedetection` service runs Tailscale, which manages secure networking for the ChangeDetection.io service. The `changedetection` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that ChangeDetection.io’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your website monitoring setup. diff --git a/services/clipcascade/README.md b/services/clipcascade/README.md index faea6370..38bf28d8 100644 --- a/services/clipcascade/README.md +++ b/services/clipcascade/README.md @@ -15,4 +15,4 @@ This Docker Compose configuration sets up [ClipCascade](https://github.com/Sathv ## Configuration Overview -In this setup, the `tailscale-clipcascade` service runs Tailscale, which manages secure networking for the ClipCascade service. The `clipcascade` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that ClipCascade’s web interface and functionality are only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your clipboard history. +In this setup, the `tailscale-clipcascade` service runs Tailscale, which manages secure networking for the ClipCascade service. The `clipcascade` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that ClipCascade’s web interface and functionality are only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your clipboard history. diff --git a/services/coder/README.md b/services/coder/README.md index d35ac6bc..219fee94 100644 --- a/services/coder/README.md +++ b/services/coder/README.md @@ -17,4 +17,4 @@ This Docker Compose configuration sets up [**Coder**](https://github.com/coder/c ## Configuration Overview -In this deployment, the `tailscale-coder` service runs the Tailscale client to establish a secure private network. The `coder` container uses `network_mode: service:tailscale-coder` to route all traffic through the Tailscale interface. This ensures that your development environments, admin UI, and web IDEs are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-coder` service runs the Tailscale client to establish a secure private network. The `coder` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your development environments, admin UI, and web IDEs are only accessible via Tailscale, preventing public exposure. diff --git a/services/configarr/README.md b/services/configarr/README.md index bda68f1b..163980f6 100644 --- a/services/configarr/README.md +++ b/services/configarr/README.md @@ -31,7 +31,7 @@ This is especially useful for homelabs, shared servers, and environments where c In this deployment, a **Tailscale sidecar container** (for example, `tailscale-configarr`) runs the Tailscale client and joins your private Tailscale network. The Configarr service uses: ```plain -network_mode: service:tailscale-configarr +network_mode: service:tailscale ``` This setup ensures that **all Configarr network traffic flows exclusively through the Tailscale interface**, allowing it to securely communicate with Radarr and Sonarr instances that are also connected via Tailscale. No ports need to be exposed, and the service remains completely inaccessible from the public Internet. diff --git a/services/configarr/compose.yaml b/services/configarr/compose.yaml index a599c813..f5ba31bc 100644 --- a/services/configarr/compose.yaml +++ b/services/configarr/compose.yaml @@ -42,7 +42,7 @@ services: - TZ=${TZ} volumes: - ./${SERVICE}-data/config:/app/config - - ${PWD}/${SERVICE}-data/dockerrepos:/app/repos + - ./${SERVICE}-data/dockerrepos:/app/repos depends_on: tailscale: condition: service_healthy diff --git a/services/convertx/README.md b/services/convertx/README.md index 7e4f5e35..8d10844d 100644 --- a/services/convertx/README.md +++ b/services/convertx/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [ConvertX](https://github.com/C4illin/ ## Configuration Overview -In this setup, the `tailscale-convertx` service runs Tailscale, which manages secure networking for the ConvertX service. The `convertx` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that ConvertX’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your self-hosted media conversion workflow. +In this setup, the `tailscale-convertx` service runs Tailscale, which manages secure networking for the ConvertX service. The `convertx` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that ConvertX’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your self-hosted media conversion workflow. diff --git a/services/copyparty/README.md b/services/copyparty/README.md index c86205a2..0a6a22b9 100644 --- a/services/copyparty/README.md +++ b/services/copyparty/README.md @@ -22,4 +22,6 @@ With Tailscale in place, all of these features are securely tunneled through you ## Configuration Overview -In this setup, the `tailscale-copyparty` service runs Tailscale, which handles the secure networking layer. The `copyparty` service uses Docker’s `network_mode: service:` setting to share the network stack of the Tailscale container. This means the Copyparty web interface and all file sharing functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted file server. +In this setup, the `tailscale-copyparty` service runs Tailscale, which handles the secure networking layer. The `copyparty` service uses Docker’s `network_mode: service:tailscale` setting to share the network stack of the Tailscale container. This means the Copyparty web interface and all file sharing functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted file server. + +Before starting the stack, replace `/path/to/your/fileshare/top/folder` in `compose.yaml` with an absolute host directory for the files Copyparty should serve. diff --git a/services/cyberchef/README.md b/services/cyberchef/README.md index 3b335c68..327279ff 100644 --- a/services/cyberchef/README.md +++ b/services/cyberchef/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [CyberChef](https://github.com/gchq/Cy ## Configuration Overview -In this setup, the `tailscale-cyberchef` service runs Tailscale, which manages secure networking for the CyberChef service. The `cyberchef` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that CyberChef’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted data analysis tool. +In this setup, the `tailscale-cyberchef` service runs Tailscale, which manages secure networking for the CyberChef service. The `cyberchef` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that CyberChef’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted data analysis tool. diff --git a/services/ddns-updater/README.md b/services/ddns-updater/README.md index 94777442..6fed8414 100644 --- a/services/ddns-updater/README.md +++ b/services/ddns-updater/README.md @@ -15,4 +15,4 @@ By combining DDNS Updater with Tailscale, you can securely manage your dynamic D ## Configuration Overview -In this setup, the `tailscale-ddns-updater` service runs Tailscale, providing a secure networking layer for the DDNS Updater service. The `ddns-updater` service utilizes Docker's `network_mode: service:` configuration to route all traffic through the Tailscale network. This setup ensures that the DDNS Updater's web interface and API are only accessible within your private Tailnet, adding an extra layer of security to your DNS management. +In this setup, the `tailscale-ddns-updater` service runs Tailscale, providing a secure networking layer for the DDNS Updater service. The `ddns-updater` service utilizes Docker's `network_mode: service:tailscale` configuration to route all traffic through the Tailscale network. This setup ensures that the DDNS Updater's web interface and API are only accessible within your private Tailnet, adding an extra layer of security to your DNS management. diff --git a/services/dockge/.env b/services/dockge/.env index f07918af..13228942 100644 --- a/services/dockge/.env +++ b/services/dockge/.env @@ -7,14 +7,17 @@ SERVICE=dockge # Service name (e.g., adguard). Used as hostname in Tailscale and IMAGE_URL=louislam/dockge:1 # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables -STACKS_DIR= # Absolute path on host to store stack files. Must be bind mounted to the same path in compose.yaml. +STACKS_DIR=/opt/stacks +# Absolute path on host to store stack files. The host and container paths must match. # For example, create a folder in your docker compose folder with the name stacks (mkdir stacks) and use /path/to/docker-compose-container-folder/stacks. PUID=1000 # Set the stack file/dir ownership to this user -PGID=1000 # Set the stack file/dir ownership to this group \ No newline at end of file +PGID=1000 # Set the stack file/dir ownership to this group diff --git a/services/dockge/README.md b/services/dockge/README.md index 9fae38da..54fccc67 100644 --- a/services/dockge/README.md +++ b/services/dockge/README.md @@ -20,4 +20,4 @@ It is especially well-suited for homelabs, self-hosted environments, and DevOps ## Important Notice -Make sure to populate the `STACKS_DIR=` variable in the `.env` before first startup. +Set `STACKS_DIR` in `.env` to an absolute host path. The Compose file mounts that path at the same path inside the container. The sample uses `/opt/stacks`. diff --git a/services/dockge/compose.yaml b/services/dockge/compose.yaml index 7d21c9b3..24a32941 100644 --- a/services/dockge/compose.yaml +++ b/services/dockge/compose.yaml @@ -53,15 +53,15 @@ services: network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} # Name for local container management environment: - # Varibles are delared in .env file. + # Variables are declared in .env file. - DOCKGE_STACKS_DIR=${STACKS_DIR} # Tell Dockge where your stacks directory is - PUID=${PUID} # Set the stack file/dir ownership to this user - PGID=${PGID} # Set the stack file/dir ownership to this group volumes: - ./${SERVICE}-data/app/config:/app/data - /var/run/docker.sock:/var/run/docker.sock - - ${STACKS_DIR}:/stacks + - ${STACKS_DIR}:${STACKS_DIR} depends_on: tailscale: condition: service_healthy - restart: always \ No newline at end of file + restart: always diff --git a/services/dockhand/.env b/services/dockhand/.env index 74a7ec0a..d8a71bf3 100644 --- a/services/dockhand/.env +++ b/services/dockhand/.env @@ -11,7 +11,8 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/dockhand/README.md b/services/dockhand/README.md index 5f764ec4..a6c63d94 100644 --- a/services/dockhand/README.md +++ b/services/dockhand/README.md @@ -30,7 +30,7 @@ Self-hosting Dockhand ensures that you maintain full ownership and operational c In this deployment, a Tailscale sidecar container (for example `tailscale-dockhand`) runs the Tailscale client and joins your private Tailscale network. The main `dockhand` service uses: ```plain -network_mode: service:tailscale-dockhand +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Dockhand web interface and Docker API interactions are accessible only via your Tailscale network. diff --git a/services/dockhand/compose.yaml b/services/dockhand/compose.yaml index 2b4e9780..29c716e2 100644 --- a/services/dockhand/compose.yaml +++ b/services/dockhand/compose.yaml @@ -61,7 +61,7 @@ services: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "curl", "-fsS", "http://127.0.0.1:41234/healthz"] # Check if ${SERVICE} is responding + test: ["CMD", "curl", "-fsS", "http://127.0.0.1:3000/"] # Check if ${SERVICE} is responding interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy diff --git a/services/docmost/README.md b/services/docmost/README.md index 6a0685a7..2a017983 100644 --- a/services/docmost/README.md +++ b/services/docmost/README.md @@ -19,4 +19,4 @@ This Docker Compose configuration sets up [**Docmost**](https://github.com/docmo ## Configuration Overview -In this configuration, the `tailscale-docmost` service runs the Tailscale client to secure network traffic. The `docmost` service uses `network_mode: service:tailscale-docmost`, ensuring all requests are routed through the Tailscale interface. This safeguards your documentation from public exposure, making it accessible only within your private mesh. +In this configuration, the `tailscale-docmost` service runs the Tailscale client to secure network traffic. The `docmost` service uses `network_mode: service:tailscale`, ensuring all requests are routed through the Tailscale interface. This safeguards your documentation from public exposure, making it accessible only within your private mesh. diff --git a/services/donetick/README.md b/services/donetick/README.md index f584d2e0..a6d573ae 100644 --- a/services/donetick/README.md +++ b/services/donetick/README.md @@ -1,19 +1,19 @@ -# Donetick with Tailscale Sidecar Configuration +# Donetick with Tailscale Sidecar Configuration This Docker Compose configuration sets up **[Donetick](https://github.com/donetick/donetick)** with Tailscale as a sidecar container to securely manage and access your self-hosted task management system over a private Tailscale network. By integrating Tailscale, you can ensure that your Donetick instance remains private and accessible only to authorized devices within your Tailscale network. -## Donetick +## Donetick [Donetick](https://github.com/donetick/donetick) is a **self-hosted task and checklist manager** designed for simplicity and efficiency. It helps users stay organized with structured to-do lists and task tracking while ensuring full control over their data. With Donetick, you can create tasks, set deadlines, and track progress without relying on third-party services. By integrating Tailscale, you can further secure your Donetick instance by restricting access to only authorized devices within your private network. -## Key Features +## Key Features -- **Task & Checklist Management** – Organize and track tasks efficiently. -- **Collaborative Workflows** – Share tasks and checklists with team members. -- **Self-Hosted Privacy** – Keep full control over your task management data. -- **Minimalist & Lightweight** – A simple, distraction-free interface for productivity. -- **Secure Access with Tailscale** – Restrict access to only authorized devices within your private network. +- **Task & Checklist Management** – Organize and track tasks efficiently. +- **Collaborative Workflows** – Share tasks and checklists with team members. +- **Self-Hosted Privacy** – Keep full control over your task management data. +- **Minimalist & Lightweight** – A simple, distraction-free interface for productivity. +- **Secure Access with Tailscale** – Restrict access to only authorized devices within your private network. -## Configuration Overview +## Configuration Overview -In this setup, the `tailscale-donetick` service runs Tailscale, which manages secure networking for the Donetick service. The `donetick` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Donetick’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and checklists. +In this setup, the `tailscale-donetick` service runs Tailscale, which manages secure networking for the Donetick service. The `donetick` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Donetick’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and checklists. diff --git a/services/dozzle/README.md b/services/dozzle/README.md index 771cbcc7..b1034951 100644 --- a/services/dozzle/README.md +++ b/services/dozzle/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Dozzle](https://github.com/amir20/doz ## Configuration Overview -In this setup, the `tailscale-dozzle` service runs Tailscale, which manages secure networking for the Dozzle service. The `dozzle` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Dozzle’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted log viewer. +In this setup, the `tailscale-dozzle` service runs Tailscale, which manages secure networking for the Dozzle service. The `dozzle` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Dozzle’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted log viewer. diff --git a/services/dumbdo/README.md b/services/dumbdo/README.md index e196a05a..2cfc595f 100644 --- a/services/dumbdo/README.md +++ b/services/dumbdo/README.md @@ -1,18 +1,18 @@ -# DumbDo with Tailscale Sidecar Configuration +# DumbDo with Tailscale Sidecar Configuration This Docker Compose configuration sets up [DumbDo](https://github.com/DumbWareio/DumbDo) with Tailscale as a sidecar container to securely manage and access your lightweight task manager over a private Tailscale network. By integrating Tailscale, you can ensure that your DumbDo instance remains private and accessible only to authorized devices within your Tailscale network. -## DumbDo +## DumbDo [DumbDo](https://github.com/DumbWareio/DumbDo) is a self-hosted, minimalistic task management tool designed to provide a distraction-free experience for managing to-do lists and tasks. With its simple interface and lightweight nature, DumbDo allows users to focus on productivity without unnecessary complexity. By integrating Tailscale, you can keep your task manager secure and accessible only within your private network. -## Key Features +## Key Features -- **Minimalist Task Management** – A straightforward approach to to-do lists without unnecessary complexity. -- **Self-Hosted** – Maintain full control over your data with a locally hosted instance. -- **Lightweight & Fast** – Designed for speed and efficiency without bloated features. -- **Secure Integration** – Pair with Tailscale to restrict access to authorized devices only. +- **Minimalist Task Management** – A straightforward approach to to-do lists without unnecessary complexity. +- **Self-Hosted** – Maintain full control over your data with a locally hosted instance. +- **Lightweight & Fast** – Designed for speed and efficiency without bloated features. +- **Secure Integration** – Pair with Tailscale to restrict access to authorized devices only. -## Configuration Overview +## Configuration Overview -In this setup, the `tailscale-dumbdo` service runs Tailscale, which manages secure networking for the DumbDo service. The `dumbdo` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that DumbDo’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your task management system. +In this setup, the `tailscale-dumbdo` service runs Tailscale, which manages secure networking for the DumbDo service. The `dumbdo` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that DumbDo’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your task management system. diff --git a/services/eigenfocus/README.md b/services/eigenfocus/README.md index c561528c..60ebbbc5 100644 --- a/services/eigenfocus/README.md +++ b/services/eigenfocus/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Eigenfocus](https://github.com/Eige ## Configuration Overview -In this setup, the `tailscale-eigenfocus` service runs Tailscale, which manages secure networking for the Eigenfocus service. The `eigenfocus` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Eigenfocus’ web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and projects. +In this setup, the `tailscale-eigenfocus` service runs Tailscale, which manages secure networking for the Eigenfocus service. The `eigenfocus` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Eigenfocus’ web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing tasks and projects. diff --git a/services/espocrm/.env b/services/espocrm/.env index 18ad0d94..b931fc23 100644 --- a/services/espocrm/.env +++ b/services/espocrm/.env @@ -7,11 +7,13 @@ SERVICE=espocrm # Service name (e.g., adguard). Used as hostname in Tailscale an IMAGE_URL=espocrm/espocrm # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/services/espocrm/README.md b/services/espocrm/README.md index bd270096..2d30de33 100644 --- a/services/espocrm/README.md +++ b/services/espocrm/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [EspoCRM](https://www.espocrm.com/) wi ## Configuration Overview -In this setup, the `tailscale-EspoCRM` service runs Tailscale, which manages secure networking for EspoCRM. The `EspoCRM` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-EspoCRM` service runs Tailscale, which manages secure networking for EspoCRM. The `EspoCRM` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## What to document for users diff --git a/services/excalidraw/README.md b/services/excalidraw/README.md index 7e8bee13..69063be9 100644 --- a/services/excalidraw/README.md +++ b/services/excalidraw/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Excalidraw](https://github.com/excali ## Configuration Overview -In this setup, the `tailscale-excalidraw` service runs Tailscale, which manages secure networking for the Excalidraw service. The `excalidraw` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This design ensures that Excalidraw's collaboration and editing features are only accessible through the Tailscale network (or locally, if preferred), providing enhanced security and privacy for your self-hosted Excalidraw instance. +In this setup, the `tailscale-excalidraw` service runs Tailscale, which manages secure networking for the Excalidraw service. The `excalidraw` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This design ensures that Excalidraw's collaboration and editing features are only accessible through the Tailscale network (or locally, if preferred), providing enhanced security and privacy for your self-hosted Excalidraw instance. diff --git a/services/filebrowser/.env b/services/filebrowser/.env index fd58305c..a6425982 100644 --- a/services/filebrowser/.env +++ b/services/filebrowser/.env @@ -11,7 +11,8 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/flaresolverr/README.md b/services/flaresolverr/README.md index cfa40be0..d5e7216b 100644 --- a/services/flaresolverr/README.md +++ b/services/flaresolverr/README.md @@ -8,4 +8,4 @@ FlareSolverr is an open-source proxy server to bypass Cloudflare and other anti- ## Configuration Overview -In this setup, the tailscale-flaresolverr service runs Tailscale, which manages secure networking for the FlareSolverr service. The flaresolverr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that FlareSolverr’s API (typically running on port 8191) is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted anti-bot proxy. +In this setup, the tailscale-flaresolverr service runs Tailscale, which manages secure networking for the FlareSolverr service. The flaresolverr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that FlareSolverr’s API (typically running on port 8191) is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted anti-bot proxy. diff --git a/services/flatnotes/.env b/services/flatnotes/.env index 6e2f3ee9..edb0c494 100644 --- a/services/flatnotes/.env +++ b/services/flatnotes/.env @@ -19,9 +19,6 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Optional Service variables # PUID=1000 -#Time Zone for container -TZ=Europe/Amsterdam - # Flatnotes environment FLATNOTES_AUTH_TYPE=password FLATNOTES_USERNAME=user diff --git a/services/flatnotes/README.md b/services/flatnotes/README.md index 447685b3..82c12647 100644 --- a/services/flatnotes/README.md +++ b/services/flatnotes/README.md @@ -1,19 +1,19 @@ -# Flatnotes with Tailscale Sidecar Configuration +# Flatnotes with Tailscale Sidecar Configuration This Docker Compose configuration sets up **[Flatnotes](https://github.com/dullage/flatnotes)** with Tailscale as a sidecar container to securely manage and access your self-hosted note-taking application over a private Tailscale network. By integrating Tailscale, you can ensure that your Flatnotes instance remains private and accessible only to authorized devices within your Tailscale network. -## Flatnotes +## Flatnotes [Flatnotes](https://github.com/dullage/flatnotes) is a **lightweight, self-hosted note-taking app** that stores notes in plain text Markdown files. With a simple yet powerful interface, Flatnotes offers **tag-based organization**, **full-text search**, and a **distraction-free writing experience**. By integrating Tailscale, you can keep your notes private and secure, ensuring that only trusted devices can access them. -## Key Features +## Key Features -- **Markdown-Based Notes** – Write and store notes in Markdown format for flexibility. -- **Tag-Based Organization** – Easily categorize and manage notes with tags. -- **Full-Text Search** – Quickly find notes with an efficient search function. -- **Self-Hosted Privacy** – Keep full control of your data without relying on third-party services. -- **Secure Access with Tailscale** – Restrict access to only authorized devices within your private network. +- **Markdown-Based Notes** – Write and store notes in Markdown format for flexibility. +- **Tag-Based Organization** – Easily categorize and manage notes with tags. +- **Full-Text Search** – Quickly find notes with an efficient search function. +- **Self-Hosted Privacy** – Keep full control of your data without relying on third-party services. +- **Secure Access with Tailscale** – Restrict access to only authorized devices within your private network. -## Configuration Overview +## Configuration Overview -In this setup, the `tailscale-flatnotes` service runs Tailscale, which manages secure networking for the Flatnotes service. The `flatnotes` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Flatnotes’ web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your notes. +In this setup, the `tailscale-flatnotes` service runs Tailscale, which manages secure networking for the Flatnotes service. The `flatnotes` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Flatnotes’ web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your notes. diff --git a/services/forgejo/README.md b/services/forgejo/README.md index b779a3ea..d53c84ad 100644 --- a/services/forgejo/README.md +++ b/services/forgejo/README.md @@ -19,7 +19,7 @@ This Docker Compose configuration sets up [**Forgejo**](https://forgejo.org/) wi ## Configuration Overview -In this deployment, the `tailscale-forgejo` service runs the Tailscale client to establish a secure private network. The `forgejo` container uses `network_mode: service:tailscale-forgejo` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. +In this deployment, the `tailscale-forgejo` service runs the Tailscale client to establish a secure private network. The `forgejo` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. ## Reference Material diff --git a/services/formbricks/.env b/services/formbricks/.env index 0167f955..9e5388ce 100644 --- a/services/formbricks/.env +++ b/services/formbricks/.env @@ -11,7 +11,8 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/formbricks/README.md b/services/formbricks/README.md index 2538f729..01e08d65 100644 --- a/services/formbricks/README.md +++ b/services/formbricks/README.md @@ -29,7 +29,7 @@ Feedback data can include sensitive product insights, internal metrics, and pers In this deployment, a **Tailscale sidecar container** (for example `tailscale-formbricks`) runs the Tailscale client and joins your private Tailscale network. The main `formbricks` service uses: ```plain -network_mode: service:tailscale-formbricks +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Formbricks admin UI, APIs, and feedback endpoints are accessible **only via your Tailscale network**. This keeps sensitive feedback data protected while still allowing secure access for authorized team members. diff --git a/services/formbricks/compose.yaml b/services/formbricks/compose.yaml index 9e9b19ed..0aa2be89 100644 --- a/services/formbricks/compose.yaml +++ b/services/formbricks/compose.yaml @@ -77,7 +77,7 @@ services: - CRON_SECRET=${CRON_SECRET} - REDIS_URL=${REDIS_URL} - LOG_LEVEL=${LOG_LEVEL} - - ENTERPRISE_LICENSE_KEY=${ENTERPRISE_LICENSE_KEY} + - ENTERPRISE_LICENSE_KEY=${ENTERPRISE_LICENSE_KEY:-} - MAIL_FROM=${MAIL_FROM} - MAIL_FROM_NAME=${MAIL_FROM_NAME} - SMTP_HOST=${SMTP_HOST} @@ -91,52 +91,52 @@ services: - PASSWORD_RESET_DISABLED=${PASSWORD_RESET_DISABLED} - EMAIL_AUTH_DISABLED=${EMAIL_AUTH_DISABLED} - INVITE_DISABLED=${INVITE_DISABLED} - - ASSET_PREFIX_URL=${ASSET_PREFIX_URL} - - UNSPLASH_ACCESS_KEY=${UNSPLASH_ACCESS_KEY} + - ASSET_PREFIX_URL=${ASSET_PREFIX_URL:-} + - UNSPLASH_ACCESS_KEY=${UNSPLASH_ACCESS_KEY:-} - PUBLIC_URL=${PUBLIC_URL} - - SENTRY_DSN=${SENTRY_DSN} - - SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN} - - SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT} - - S3_ACCESS_KEY=${S3_ACCESS_KEY} - - S3_SECRET_KEY=${S3_SECRET_KEY} - - S3_REGION=${S3_REGION} - - S3_BUCKET_NAME=${S3_BUCKET_NAME} - - S3_ENDPOINT_URL=${S3_ENDPOINT_URL} + - SENTRY_DSN=${SENTRY_DSN:-} + - SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN:-} + - SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT:-} + - S3_ACCESS_KEY=${S3_ACCESS_KEY:-} + - S3_SECRET_KEY=${S3_SECRET_KEY:-} + - S3_REGION=${S3_REGION:-} + - S3_BUCKET_NAME=${S3_BUCKET_NAME:-} + - S3_ENDPOINT_URL=${S3_ENDPOINT_URL:-} - S3_FORCE_PATH_STYLE=${S3_FORCE_PATH_STYLE} - - TURNSTILE_SITE_KEY=${TURNSTILE_SITE_KEY} - - TURNSTILE_SECRET_KEY=${TURNSTILE_SECRET_KEY} - - RECAPTCHA_SITE_KEY=${RECAPTCHA_SITE_KEY} - - RECAPTCHA_SECRET_KEY=${RECAPTCHA_SECRET_KEY} - - GITHUB_ID=${GITHUB_ID} - - GITHUB_SECRET=${GITHUB_SECRET} - - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID} - - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET} - - AZUREAD_CLIENT_ID=${AZUREAD_CLIENT_ID} - - AZUREAD_CLIENT_SECRET=${AZUREAD_CLIENT_SECRET} - - AZUREAD_TENANT_ID=${AZUREAD_TENANT_ID} - - OIDC_CLIENT_ID=${OIDC_CLIENT_ID} - - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET} - - OIDC_ISSUER=${OIDC_ISSUER} - - OIDC_DISPLAY_NAME=${OIDC_DISPLAY_NAME} - - OIDC_SIGNING_ALGORITHM=${OIDC_SIGNING_ALGORITHM} - - SAML_DATABASE_URL=${SAML_DATABASE_URL} - - NOTION_OAUTH_CLIENT_ID=${NOTION_OAUTH_CLIENT_ID} - - NOTION_OAUTH_CLIENT_SECRET=${NOTION_OAUTH_CLIENT_SECRET} - - GOOGLE_SHEETS_CLIENT_ID=${GOOGLE_SHEETS_CLIENT_ID} - - GOOGLE_SHEETS_CLIENT_SECRET=${GOOGLE_SHEETS_CLIENT_SECRET} - - GOOGLE_SHEETS_REDIRECT_URL=${GOOGLE_SHEETS_REDIRECT_URL} - - AIRTABLE_CLIENT_ID=${AIRTABLE_CLIENT_ID} - - SLACK_CLIENT_ID=${SLACK_CLIENT_ID} - - SLACK_CLIENT_SECRET=${SLACK_CLIENT_SECRET} - - PRIVACY_URL=${PRIVACY_URL} - - TERMS_URL=${TERMS_URL} - - IMPRINT_URL=${IMPRINT_URL} - - IMPRINT_ADDRESS=${IMPRINT_ADDRESS} + - TURNSTILE_SITE_KEY=${TURNSTILE_SITE_KEY:-} + - TURNSTILE_SECRET_KEY=${TURNSTILE_SECRET_KEY:-} + - RECAPTCHA_SITE_KEY=${RECAPTCHA_SITE_KEY:-} + - RECAPTCHA_SECRET_KEY=${RECAPTCHA_SECRET_KEY:-} + - GITHUB_ID=${GITHUB_ID:-} + - GITHUB_SECRET=${GITHUB_SECRET:-} + - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-} + - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-} + - AZUREAD_CLIENT_ID=${AZUREAD_CLIENT_ID:-} + - AZUREAD_CLIENT_SECRET=${AZUREAD_CLIENT_SECRET:-} + - AZUREAD_TENANT_ID=${AZUREAD_TENANT_ID:-} + - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-} + - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-} + - OIDC_ISSUER=${OIDC_ISSUER:-} + - OIDC_DISPLAY_NAME=${OIDC_DISPLAY_NAME:-} + - OIDC_SIGNING_ALGORITHM=${OIDC_SIGNING_ALGORITHM:-} + - SAML_DATABASE_URL=${SAML_DATABASE_URL:-} + - NOTION_OAUTH_CLIENT_ID=${NOTION_OAUTH_CLIENT_ID:-} + - NOTION_OAUTH_CLIENT_SECRET=${NOTION_OAUTH_CLIENT_SECRET:-} + - GOOGLE_SHEETS_CLIENT_ID=${GOOGLE_SHEETS_CLIENT_ID:-} + - GOOGLE_SHEETS_CLIENT_SECRET=${GOOGLE_SHEETS_CLIENT_SECRET:-} + - GOOGLE_SHEETS_REDIRECT_URL=${GOOGLE_SHEETS_REDIRECT_URL:-} + - AIRTABLE_CLIENT_ID=${AIRTABLE_CLIENT_ID:-} + - SLACK_CLIENT_ID=${SLACK_CLIENT_ID:-} + - SLACK_CLIENT_SECRET=${SLACK_CLIENT_SECRET:-} + - PRIVACY_URL=${PRIVACY_URL:-} + - TERMS_URL=${TERMS_URL:-} + - IMPRINT_URL=${IMPRINT_URL:-} + - IMPRINT_ADDRESS=${IMPRINT_ADDRESS:-} - RATE_LIMITING_DISABLED=${RATE_LIMITING_DISABLED} - AUDIT_LOG_ENABLED=${AUDIT_LOG_ENABLED} - AUDIT_LOG_GET_USER_IP=${AUDIT_LOG_GET_USER_IP} - AUTH_SKIP_INVITE_FOR_SSO=${AUTH_SKIP_INVITE_FOR_SSO} - - AUTH_SSO_DEFAULT_TEAM_ID=${AUTH_SSO_DEFAULT_TEAM_ID} + - AUTH_SSO_DEFAULT_TEAM_ID=${AUTH_SSO_DEFAULT_TEAM_ID:-} - USER_MANAGEMENT_MINIMUM_ROLE=${USER_MANAGEMENT_MINIMUM_ROLE} - SESSION_MAX_AGE=${SESSION_MAX_AGE} volumes: diff --git a/services/fossflow/README.md b/services/fossflow/README.md index c5e022ba..15336f70 100644 --- a/services/fossflow/README.md +++ b/services/fossflow/README.md @@ -17,4 +17,4 @@ FossFLOW is a free and open-source flow **visualization** tool. Unlike automatio ## Configuration Overview -This setup includes a `tailscale-fossflow` container running the Tailscale client to establish a secure connection. The `fossflow` container uses `network_mode: service:tailscale-fossflow`, ensuring all traffic routes through Tailscale. This keeps your flow diagrams accessible only to authenticated devices within your Tailnet, with no exposure to the public internet. +This setup includes a `tailscale-fossflow` container running the Tailscale client to establish a secure connection. The `fossflow` container uses `network_mode: service:tailscale`, ensuring all traffic routes through Tailscale. This keeps your flow diagrams accessible only to authenticated devices within your Tailnet, with no exposure to the public internet. diff --git a/services/freshrss/.env b/services/freshrss/.env index 7b41415d..ee2693f1 100644 --- a/services/freshrss/.env +++ b/services/freshrss/.env @@ -15,7 +15,8 @@ TS_AUTHKEY= # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TAILNET_NAME= # Include the ".ts.net" if it is part of your Tailnet name +TAILNET_NAME= +# Include the ".ts.net" if it is part of your Tailnet name # FreshRSS Configuration # You must set these before the first start. They are only applied while the data diff --git a/services/frigate/.env b/services/frigate/.env index c7580701..d4890877 100644 --- a/services/frigate/.env +++ b/services/frigate/.env @@ -11,7 +11,8 @@ SERVICEPORT=8971 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/frigate/README.md b/services/frigate/README.md index b86293a6..454141a9 100644 --- a/services/frigate/README.md +++ b/services/frigate/README.md @@ -10,7 +10,7 @@ Frigate is often paired with Tailscale to ensure that camera feeds, recordings, ## Configuration Overview -In this setup, the `tailscale-frigate` service runs Tailscale, which manages secure networking for Frigate. The `frigate` container shares the network stack using Docker’s `network_mode: service:tailscale-frigate`. +In this setup, the `tailscale-frigate` service runs Tailscale, which manages secure networking for Frigate. The `frigate` container shares the network stack using Docker’s `network_mode: service:tailscale`. This ensures: diff --git a/services/ghost/.env b/services/ghost/.env index 9c309958..5a6d7b51 100644 --- a/services/ghost/.env +++ b/services/ghost/.env @@ -7,7 +7,7 @@ SERVICE=ghost IMAGE_URL=ghost:5-alpine # Network Configuration -SERVICEPORT=8080 +SERVICEPORT=2368 DNS_SERVER=9.9.9.9 # Tailscale Configuration @@ -19,4 +19,7 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Optional Service variables # PUID=1000 +# Public URL used by Ghost to build links and redirects. Replace the placeholder with your Tailnet hostname. +GHOST_URL=https://ghost..ts.net + #EXAMPLE_VAR="Environment varibale" diff --git a/services/ghost/README.md b/services/ghost/README.md index 5dfbfaa0..e47a8313 100644 --- a/services/ghost/README.md +++ b/services/ghost/README.md @@ -16,4 +16,6 @@ This Docker Compose configuration sets up **[Ghost](https://github.com/TryGhost/ ## Configuration Overview -In this setup, the `tailscale-ghost` service runs Tailscale, which manages secure networking for the Ghost service. The `ghost` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Ghost’s web interface and publishing tools are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your publishing workflow. +In this setup, the `tailscale-ghost` service runs Tailscale, which manages secure networking for the Ghost service. The `ghost` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Ghost’s web interface and publishing tools are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your publishing workflow. + +Set `GHOST_URL` in `.env` to the HTTPS hostname that you use on your Tailnet. Ghost listens on port `2368`, and Tailscale Serve forwards HTTPS traffic to that port. diff --git a/services/ghost/compose.yaml b/services/ghost/compose.yaml index 0e1bbd50..13ef80f5 100644 --- a/services/ghost/compose.yaml +++ b/services/ghost/compose.yaml @@ -4,7 +4,7 @@ configs: {"TCP":{"443":{"HTTPS":true}}, "Web":{"$${TS_CERT_DOMAIN}:443": {"Handlers":{"/": - {"Proxy":"http://127.0.0.1:80"}}}}, + {"Proxy":"http://127.0.0.1:2368"}}}}, "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: @@ -61,7 +61,7 @@ services: database__connection__database: ghost # this url value is just an example, and is likely wrong for your environment! - url: http://localhost:8080 + url: ${GHOST_URL} # contrary to the default mentioned in the linked documentation, this image defaults to NODE_ENV=production (so development mode needs to be explicitly specified if desired) #NODE_ENV: development diff --git a/services/gitea/README.md b/services/gitea/README.md index 1a8d850e..f8852494 100644 --- a/services/gitea/README.md +++ b/services/gitea/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up [Gitea](https://gitea.com/) with Tails ## Configuration Overview -In this deployment, the `tailscale-gitea` service runs the Tailscale client to establish a secure private network. The `gitea` container uses `network_mode: service:tailscale-gitea` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. +In this deployment, the `tailscale-gitea` service runs the Tailscale client to establish a secure private network. The `gitea` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures your Git service, web interface, and API endpoints are only accessible via Tailscale, preventing public exposure while still offering seamless remote access to your team. diff --git a/services/gitsave/README.md b/services/gitsave/README.md index 2ac17176..f9c6e5e9 100644 --- a/services/gitsave/README.md +++ b/services/gitsave/README.md @@ -17,4 +17,4 @@ This Docker Compose configuration sets up [**GitSave**](https://github.com/TimWi ## Configuration Overview -In this deployment, the `tailscale-gitsave` service runs the Tailscale client to establish a secure private network. The `gitsave` container uses `network_mode: service:tailscale-gitsave` to route all traffic through the Tailscale interface. This ensures that your GitHub backup service and its API endpoints are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-gitsave` service runs the Tailscale client to establish a secure private network. The `gitsave` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your GitHub backup service and its API endpoints are only accessible via Tailscale, preventing public exposure. diff --git a/services/glance/README.md b/services/glance/README.md index 19596432..62c90bb1 100644 --- a/services/glance/README.md +++ b/services/glance/README.md @@ -10,4 +10,4 @@ To install Glance properly, make sure to add the files glance.yml and home.yml t ## Configuration Overview -In this setup, the `tailscale-glance` service runs Tailscale, which provides secure networking for the Glance service. The `glance` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that the Glance dashboard is only accessible through the Tailscale network (or locally, if desired), adding a robust layer of privacy and security to your self-hosted monitoring setup. +In this setup, the `tailscale-glance` service runs Tailscale, which provides secure networking for the Glance service. The `glance` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that the Glance dashboard is only accessible through the Tailscale network (or locally, if desired), adding a robust layer of privacy and security to your self-hosted monitoring setup. diff --git a/services/gokapi/README.md b/services/gokapi/README.md index 597a79ae..a1289ac4 100644 --- a/services/gokapi/README.md +++ b/services/gokapi/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Gokapi](https://github.com/Forceu/Gok ## Configuration Overview -In this setup, the `tailscale-gokapi` service runs Tailscale, which manages secure networking for the Gokapi service. The `gokapi` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Gokapi's web interface and file-sharing services are only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your file-sharing solution. +In this setup, the `tailscale-gokapi` service runs Tailscale, which manages secure networking for the Gokapi service. The `gokapi` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Gokapi's web interface and file-sharing services are only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your file-sharing solution. diff --git a/services/gotify/README.md b/services/gotify/README.md index f3ca6474..e846b7e6 100644 --- a/services/gotify/README.md +++ b/services/gotify/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up [Gotify](https://github.com/gotify/ser ## Configuration Overview -In this deployment, the `tailscale-gotify` service runs the Tailscale client to establish a secure private network. The `gotify` container uses `network_mode: service:tailscale-gotify` to route its traffic through the Tailscale interface. This ensures that the Gotify web UI and backend services are only reachable via your Tailscale network, keeping your notifications safe from public exposure. +In this deployment, the `tailscale-gotify` service runs the Tailscale client to establish a secure private network. The `gotify` container uses `network_mode: service:tailscale` to route its traffic through the Tailscale interface. This ensures that the Gotify web UI and backend services are only reachable via your Tailscale network, keeping your notifications safe from public exposure. diff --git a/services/grampsweb/README.md b/services/grampsweb/README.md index ac8809f9..6239ee2b 100644 --- a/services/grampsweb/README.md +++ b/services/grampsweb/README.md @@ -19,4 +19,4 @@ This Docker Compose configuration sets up [**Gramps Web**](https://github.com/gr ## Configuration Overview -In this deployment, the `tailscale-grampsweb` service runs the Tailscale client to establish a secure private network. The `grampsweb` container uses `network_mode: service:tailscale-grampsweb` to route all traffic through the Tailscale interface. This ensures that your genealogy database, charts, and administration interface are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-grampsweb` service runs the Tailscale client to establish a secure private network. The `grampsweb` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your genealogy database, charts, and administration interface are only accessible via Tailscale, preventing public exposure. diff --git a/services/haptic/README.md b/services/haptic/README.md index a4b7d691..e82b60e9 100644 --- a/services/haptic/README.md +++ b/services/haptic/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Haptic](https://github.com/chroxify ## Configuration Overview -In this setup, the `tailscale-haptic` service runs Tailscale, which manages secure networking for the Haptic service. The `haptic` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Haptic’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your bookmarks. +In this setup, the `tailscale-haptic` service runs Tailscale, which manages secure networking for the Haptic service. The `haptic` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Haptic’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for managing your bookmarks. diff --git a/services/hemmelig/README.md b/services/hemmelig/README.md index 92950dcb..b03c880b 100644 --- a/services/hemmelig/README.md +++ b/services/hemmelig/README.md @@ -25,7 +25,7 @@ While a public SaaS instance of Hemmelig (e.g., hemmelig.app) exists, **self-hos In this deployment, a **Tailscale sidecar container** (e.g., `tailscale-hemmelig`) runs the Tailscale client and joins your private Tailscale network. The main `hemmelig` service uses: ```plain -network_mode: service:tailscale-hemmelig +network_mode: service:tailscale ``` This effectively **routes all traffic through the Tailscale network interface**, making the app private and unreachable from the public Internet while still accessible to any device on your Tailscale network. Remote team members can securely access the Hemmelig web UI, API, and encryption features over Tailscale without exposing the app publicly. diff --git a/services/homarr/README.md b/services/homarr/README.md index 61ebe760..6df9a06c 100644 --- a/services/homarr/README.md +++ b/services/homarr/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Homarr](https://github.com/ajnart/hom ## Configuration Overview -In this setup, the tailscale-homarr service runs Tailscale, which manages secure networking for the Homarr service. The homarr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Homarr’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. +In this setup, the tailscale-homarr service runs Tailscale, which manages secure networking for the Homarr service. The homarr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Homarr’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. diff --git a/services/home-assistant/README.md b/services/home-assistant/README.md index 2b36d106..fc207c21 100644 --- a/services/home-assistant/README.md +++ b/services/home-assistant/README.md @@ -1,28 +1,28 @@ -# Home Assistant with Tailscale Sidecar Configuration +# Home Assistant with Tailscale Sidecar Configuration This Docker Compose configuration sets up **[Home Assistant](https://github.com/home-assistant/)** with Tailscale as a sidecar container to securely manage and access your smart home automation platform over a private Tailscale network. By integrating Tailscale, you can ensure that your Home Assistant instance remains private and accessible only to authorized devices within your Tailscale network. -## Home Assistant +## Home Assistant [Home Assistant](https://github.com/home-assistant/) is an open-source home automation platform that allows you to control and automate smart devices from a unified interface. With support for thousands of integrations, it provides powerful automation capabilities and privacy-focused self-hosted control over your smart home. Pairing Home Assistant with Tailscale ensures a secure, remote-accessible smart home without exposing it to the public internet. -## Key Features +## Key Features -- **Local Control & Privacy** – Self-hosted and privacy-focused, keeping your data in your home. -- **Extensive Integrations** – Supports thousands of smart home devices and services. -- **Automation & Customization** – Create complex automations with YAML or visual editors. -- **Secure Remote Access** – Pair with Tailscale to safely access your Home Assistant instance from anywhere. +- **Local Control & Privacy** – Self-hosted and privacy-focused, keeping your data in your home. +- **Extensive Integrations** – Supports thousands of smart home devices and services. +- **Automation & Customization** – Create complex automations with YAML or visual editors. +- **Secure Remote Access** – Pair with Tailscale to safely access your Home Assistant instance from anywhere. -## Configuration Overview +## Configuration Overview -In this setup, the `tailscale-homeassistant` service runs Tailscale, which manages secure networking for the Home Assistant service. The `homeassistant` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Home Assistant’s web interface and smart home control features are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for your home automation system. +In this setup, the `tailscale-homeassistant` service runs Tailscale, which manages secure networking for the Home Assistant service. The `homeassistant` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Home Assistant’s web interface and smart home control features are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy for your home automation system. ## Troubleshooting If you encounter a `400: Bad Request` after deployment, please alter the file `ha-data/config/configurations.yaml` to trust the reverse proxy configuration used by Tailscale. The `configurations.yaml` should look like this. ```plain -$ cat ha-data/config/configuration.yaml +$ cat ha-data/config/configuration.yaml # Loads default set of integrations. Do not remove. default_config: diff --git a/services/homebox/.env b/services/homebox/.env index a00750b2..8b26cd80 100644 --- a/services/homebox/.env +++ b/services/homebox/.env @@ -11,7 +11,8 @@ SERVICEPORT=7745 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/homebox/README.md b/services/homebox/README.md index c5823c2b..cccee25d 100644 --- a/services/homebox/README.md +++ b/services/homebox/README.md @@ -30,7 +30,7 @@ When combined with Tailscale, Homebox becomes a **secure, Tailnet-only inventory In this deployment, a **Tailscale sidecar container** (for example `tailscale-homebox`) runs the Tailscale client and joins your private Tailscale network. The main `homebox` service uses: ```plain -network_mode: service:tailscale-homebox +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Homebox web UI and API are accessible **only via your Tailscale network**. No public port exposure is required unless explicitly configured. diff --git a/services/homepage/README.md b/services/homepage/README.md index b04f85d4..c1b93a30 100644 --- a/services/homepage/README.md +++ b/services/homepage/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Homepage](https://github.com/gethomep ## Configuration Overview -In this setup, the `tailscale-homepage` service runs Tailscale, which manages secure networking for the Homepage service. The `homepage` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Homepage’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. +In this setup, the `tailscale-homepage` service runs Tailscale, which manages secure networking for the Homepage service. The `homepage` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Homepage’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted dashboard. diff --git a/services/hytale/.env b/services/hytale/.env index b873a677..73f5a89b 100644 --- a/services/hytale/.env +++ b/services/hytale/.env @@ -14,13 +14,12 @@ DNS_SERVER=1.1.1.1 TS_AUTHKEY= # Time Zone setting for containers -TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +TZ=US/Eastern # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Hytale Configuration SERVER_IP=0.0.0.0 SERVER_PORT=5520 PROD=FALSE DEBUG=FALSE -TZ=US/Eastern #EXAMPLE_VAR="Environment varibale" diff --git a/services/immich/.env b/services/immich/.env index ccbf69ab..2fe63f51 100644 --- a/services/immich/.env +++ b/services/immich/.env @@ -28,8 +28,7 @@ UPLOAD_LOCATION=./library # The location where your database files are stored. Network shares are not supported for the database DB_DATA_LOCATION=./postgres -# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List -TZ=Europe/Amsterdam +# To set a timezone, change the TZ value above to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List # The Immich version to use. You can pin this to a specific version like "v1.71.0" IMMICH_VERSION=release diff --git a/services/immich/README.md b/services/immich/README.md index bfca4b23..a4b447c9 100644 --- a/services/immich/README.md +++ b/services/immich/README.md @@ -19,4 +19,4 @@ Immich is a self-hosted, high-performance solution for backing up and browsing p ## Configuration Overview -In this deployment, the `tailscale-immich` service runs the Tailscale client to establish a secure private network. The `immich` container uses `network_mode: service:tailscale-immich` to route its traffic through the Tailscale interface. This ensures that the Immich web UI and backend services are only reachable via your Tailscale network, keeping your personal media safe from public exposure. +In this deployment, the `tailscale-immich` service runs the Tailscale client to establish a secure private network. The `immich` container uses `network_mode: service:tailscale` to route its traffic through the Tailscale interface. This ensures that the Immich web UI and backend services are only reachable via your Tailscale network, keeping your personal media safe from public exposure. diff --git a/services/isley/README.md b/services/isley/README.md index c0a7013d..a3d650ea 100644 --- a/services/isley/README.md +++ b/services/isley/README.md @@ -24,4 +24,4 @@ With integration options for popular grow equipment, Isley simplifies and elevat ## Configuration Overview -In this setup, the `tailscale-isley` service runs Tailscale, which manages secure networking for the Isley service. The `isley` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Isley's interface is not exposed to the public internet, protecting your grow journal and data with an additional layer of privacy. +In this setup, the `tailscale-isley` service runs Tailscale, which manages secure networking for the Isley service. The `isley` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Isley's interface is not exposed to the public internet, protecting your grow journal and data with an additional layer of privacy. diff --git a/services/it-tools/README.md b/services/it-tools/README.md index 0e7cd15f..7c3999c5 100644 --- a/services/it-tools/README.md +++ b/services/it-tools/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [IT-Tools](https://github.com/Corentin ## Configuration Overview -In this setup, the `tailscale-it-tools` service runs Tailscale, which manages secure networking for the IT-Tools service. The `it-tools` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that IT-Tools’ web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted developer utilities. +In this setup, the `tailscale-it-tools` service runs Tailscale, which manages secure networking for the IT-Tools service. The `it-tools` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that IT-Tools’ web interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted developer utilities. diff --git a/services/jellyfin/README.md b/services/jellyfin/README.md index d8664eb4..1547ac48 100644 --- a/services/jellyfin/README.md +++ b/services/jellyfin/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Jellyfin](https://github.com/jellyfin ## Configuration Overview -In this setup, the tailscale-jellyfin service runs Tailscale, which manages secure networking for the Jellyfin service. The jellyfin service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Jellyfin’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media server. +In this setup, the tailscale-jellyfin service runs Tailscale, which manages secure networking for the Jellyfin service. The jellyfin service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Jellyfin’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media server. diff --git a/services/kaneo/.env b/services/kaneo/.env index 5ee5eec1..f03f0320 100644 --- a/services/kaneo/.env +++ b/services/kaneo/.env @@ -16,7 +16,8 @@ SERVICEPORT_DATABASE=5432 DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -32,20 +33,11 @@ KANEO_CLIENT_URL="https://kaneo..ts.net" # AUTH Configuration AUTH_SECRET= -BETTER_AUTH_TRUSTED_PROXIES: "0.0.0.0/0" +BETTER_AUTH_TRUSTED_PROXIES=0.0.0.0/0 # DB Configuration DB_USERNAME=kaneo DB_DATABASE_NAME=kaneo DB_PASSWORD= -# Tailscale Configuration -TS_AUTHKEY= - -# Time Zone setting for containers -TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones - -# Optional Service variables -# PUID=1000 - #EXAMPLE_VAR="Environment varibale" diff --git a/services/kaneo/README.md b/services/kaneo/README.md index cd542b2d..82ce868c 100644 --- a/services/kaneo/README.md +++ b/services/kaneo/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Kaneo](https://github.com/usekaneo/ ## Configuration Overview -In this setup, the `tailscale-kaneo` service runs Tailscale, which manages secure networking for the Kaneo service. The `kaneo` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Kaneo’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding a strong layer of privacy and security to your self-hosted project management platform. +In this setup, the `tailscale-kaneo` service runs Tailscale, which manages secure networking for the Kaneo service. The `kaneo` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Kaneo’s web interface is only accessible through the Tailscale network (or locally, if preferred), adding a strong layer of privacy and security to your self-hosted project management platform. diff --git a/services/karakeep/.env b/services/karakeep/.env index 4778fd2d..8eb3df54 100644 --- a/services/karakeep/.env +++ b/services/karakeep/.env @@ -4,7 +4,8 @@ # Service Configuration SERVICE=karakeep -IMAGE_URL= # Docker image URL from container registry (e.g., adguard/adguard-home). +IMAGE_URL= +# Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration SERVICEPORT=3000 diff --git a/services/karakeep/README.md b/services/karakeep/README.md index 5e43d5e8..614d4bbe 100644 --- a/services/karakeep/README.md +++ b/services/karakeep/README.md @@ -34,4 +34,4 @@ This Docker Compose configuration sets up **[Karakeep](https://github.com/karake ## Configuration Overview -In this setup, the `tailscale-karakeep` service runs Tailscale, which manages secure networking for the Karakeep service. The `karakeep` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Karakeep’s web interface is only accessible through the Tailscale network (or locally, if preferred), enhancing the privacy and security of your notes and collaborative workspace. +In this setup, the `tailscale-karakeep` service runs Tailscale, which manages secure networking for the Karakeep service. The `karakeep` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Karakeep’s web interface is only accessible through the Tailscale network (or locally, if preferred), enhancing the privacy and security of your notes and collaborative workspace. diff --git a/services/kavita/README.md b/services/kavita/README.md index 05185484..869abc89 100644 --- a/services/kavita/README.md +++ b/services/kavita/README.md @@ -17,7 +17,7 @@ This Docker Compose configuration sets up [Kavita](https://github.com/Kareadita/ ## Configuration Overview -In this setup, the `tailscale-kavita` service runs the Tailscale client to join your private mesh network. The `kavita` service is configured with `network_mode: service:tailscale-kavita`, so all network traffic for Kavita is routed through the Tailscale container. This ensures the web UI and API are reachable only via your Tailscale network (or locally), adding an extra layer of privacy and security to your self-hosted library. +In this setup, the `tailscale-kavita` service runs the Tailscale client to join your private mesh network. The `kavita` service is configured with `network_mode: service:tailscale`, so all network traffic for Kavita is routed through the Tailscale container. This ensures the web UI and API are reachable only via your Tailscale network (or locally), adding an extra layer of privacy and security to your self-hosted library. ## Files to check diff --git a/services/kitchenowl/.env b/services/kitchenowl/.env index 43895e9f..670260b1 100755 --- a/services/kitchenowl/.env +++ b/services/kitchenowl/.env @@ -11,7 +11,8 @@ SERVICEPORT=8080 DNS_SERVER=9.9.9.9 # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones @@ -21,9 +22,10 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim #EXAMPLE_VAR="Environment varibale" -JWT_SECRET_KEY= # Generate a random string for JWT secret key, e.g., using: openssl rand -base64 32 +JWT_SECRET_KEY= +# Generate a random string for JWT secret key, e.g., using: openssl rand -base64 32 FRONT_URL=https://kitchenowl..ts.net # the exact URL of your kitchenowl instance, required when using OIDC authentication, e.g https://kitchenowl.example.com #OIDC_ISSUER= # your OIDC issuer, e.g https://accounts.google.com #OIDC_CLIENT_ID= # to be generated by your OIDC provider -#OIDC_CLIENT_SECRET= # to be generated by your OIDC provider \ No newline at end of file +#OIDC_CLIENT_SECRET= # to be generated by your OIDC provider diff --git a/services/kitchenowl/README.md b/services/kitchenowl/README.md index ac5f3d72..84869ad6 100644 --- a/services/kitchenowl/README.md +++ b/services/kitchenowl/README.md @@ -21,7 +21,7 @@ Kitchenowl is useful for families, housemates, and home labs that want a private ## Tailscale Integration -This setup uses a **Tailscale sidecar container** to provide secure private networking for Kitchenowl. The Kitchenowl container shares the Tailscale container's network stack using Docker's `network_mode: service:` pattern. +This setup uses a **Tailscale sidecar container** to provide secure private networking for Kitchenowl. The Kitchenowl container shares the Tailscale container's network stack using Docker's `network_mode: service:tailscale` pattern. Because of this, Kitchenowl does not need to publish ports directly to the host. Instead, you access the web interface through the Tailscale hostname or Tailnet IP assigned to the sidecar. This keeps the service private, reduces exposure, and avoids the need for public DNS, inbound firewall rules, or a public reverse proxy. diff --git a/services/languagetool/README.md b/services/languagetool/README.md index 50bdec3a..7d5692a4 100644 --- a/services/languagetool/README.md +++ b/services/languagetool/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [LanguageTool](https://languagetool.or ## Configuration Overview -In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for LanguageTool. The `languagetool` service utilizes the Tailscale network stack via Docker's `network_mode: service:`. This setup ensures that LanguageTool's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your LanguageTool deployment. +In this setup, the `tailscale-adguardhome` service runs Tailscale, which manages secure networking for LanguageTool. The `languagetool` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale`. This setup ensures that LanguageTool's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your LanguageTool deployment. ## Using n-gram datasets diff --git a/services/linkding/README.md b/services/linkding/README.md index f59647dc..27fbd4e9 100644 --- a/services/linkding/README.md +++ b/services/linkding/README.md @@ -15,4 +15,4 @@ This Docker Compose configuration sets up [Linkding](https://github.com/sissbrue ## Configuration Overview -In this setup, the `tailscale-linkding` service runs Tailscale, which manages secure networking for the Linkding service. The `linkding` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Linkding’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your bookmarks. +In this setup, the `tailscale-linkding` service runs Tailscale, which manages secure networking for the Linkding service. The `linkding` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Linkding’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your bookmarks. diff --git a/services/lube-logger/README.md b/services/lube-logger/README.md index 6a12b993..b9c9a84a 100644 --- a/services/lube-logger/README.md +++ b/services/lube-logger/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[LubeLogger](https://github.com/harg ## Configuration Overview -In this deployment, the `tailscale-lubelogger` service runs the Tailscale client to establish a secure private network. The `lubelogger` container uses `network_mode: service:tailscale-lubelogger` to tunnel its network traffic through the Tailscale network interface. This ensures that the web UI is accessible only through Tailscale, keeping your vehicle data safe from public exposure. +In this deployment, the `tailscale-lubelogger` service runs the Tailscale client to establish a secure private network. The `lubelogger` container uses `network_mode: service:tailscale` to tunnel its network traffic through the Tailscale network interface. This ensures that the web UI is accessible only through Tailscale, keeping your vehicle data safe from public exposure. diff --git a/services/mailpit/.env b/services/mailpit/.env index 5a4e1031..050ce1de 100644 --- a/services/mailpit/.env +++ b/services/mailpit/.env @@ -11,7 +11,8 @@ SERVICEPORT=8025 # Mailpit web port. It is not exposed locally; Tailscale Serve DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -26,4 +27,4 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim MAIL_DOMAIN_REGEX='@example\.com$' # Catch all recipients at example.com; change this to your escaped domain. MAILPIT_MAX_MESSAGES=0 # Maximum stored messages; 0 disables count-based pruning. MAILPIT_MAX_AGE=90d # Delete messages older than this age. Use hours (36h) or days (90d). -MAILPIT_MAX_MESSAGE_SIZE=50 # Maximum accepted message size in MB. \ No newline at end of file +MAILPIT_MAX_MESSAGE_SIZE=50 # Maximum accepted message size in MB. diff --git a/services/mattermost/.env b/services/mattermost/.env index bd11ec92..5b2868de 100644 --- a/services/mattermost/.env +++ b/services/mattermost/.env @@ -33,13 +33,13 @@ CALLS_PORT=8443 # Mattermost settings ## Inside the container the uid and gid is 2000. The folder owner can be set with -## `sudo chown -R 2000:2000 ${PWD}/${SERVICE}-data/mattermost`. -MATTERMOST_CONFIG_PATH=${PWD}/${SERVICE}-data/config -MATTERMOST_DATA_PATH=${PWD}/${SERVICE}-data/data -MATTERMOST_LOGS_PATH=${PWD}/${SERVICE}-data/logs -MATTERMOST_PLUGINS_PATH=${PWD}/${SERVICE}-data/plugins -MATTERMOST_CLIENT_PLUGINS_PATH=${PWD}/${SERVICE}-data/client/plugins -MATTERMOST_BLEVE_INDEXES_PATH=${PWD}/${SERVICE}-data/bleve-indexes +## `sudo chown -R 2000:2000 ./${SERVICE}-data/mattermost`. +MATTERMOST_CONFIG_PATH=./${SERVICE}-data/config +MATTERMOST_DATA_PATH=./${SERVICE}-data/data +MATTERMOST_LOGS_PATH=./${SERVICE}-data/logs +MATTERMOST_PLUGINS_PATH=./${SERVICE}-data/plugins +MATTERMOST_CLIENT_PLUGINS_PATH=./${SERVICE}-data/client/plugins +MATTERMOST_BLEVE_INDEXES_PATH=./${SERVICE}-data/bleve-indexes ## Bleve index (inside the container) MM_BLEVESETTINGS_INDEXDIR=/mattermost/bleve-indexes @@ -53,7 +53,7 @@ MATTERMOST_CONTAINER_READONLY=false # Postgres Settings ## A guide on how to change the database user to a nonsuperuser can be found in docs/creation-of-nonsuperuser.md POSTGRES_IMAGE_TAG=13-alpine -POSTGRES_DATA_PATH=${PWD}/${SERVICE}-data/postgres/data +POSTGRES_DATA_PATH=./${SERVICE}-data/postgres/data POSTGRES_USER=MMus3r ##Please Change POSTGRES_PASSWORD=MMus3r_P4ssword ##Please Change diff --git a/services/mattermost/README.md b/services/mattermost/README.md index 1c6b14d3..ea5fc6a2 100644 --- a/services/mattermost/README.md +++ b/services/mattermost/README.md @@ -1,6 +1,6 @@ # Mattermost with Tailscale Sidecar Configuration -This Docker Compose configuration sets up [Mattermost](https://mattermost.com/platform-overview/) with Tailscale as a sidecar container to securely manage and access your clipboard history over a private Tailscale network. By integrating Tailscale, you can ensure that your Mattermost instance remains private and accessible only to authorized devices on your Tailscale network. +This Docker Compose configuration sets up [Mattermost](https://mattermost.com/platform-overview/) with Tailscale as a sidecar container to securely manage team communication over a private Tailscale network. By integrating Tailscale, you can ensure that your Mattermost instance remains private and accessible only to authorized devices on your Tailscale network. ## Mattermost @@ -17,7 +17,9 @@ This Docker Compose configuration sets up [Mattermost](https://mattermost.com/pl ## Configuration Overview -In this setup, the `tailscale-Mattermost` service runs Tailscale, which manages secure networking for the Mattermost service. The `Mattermost` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Mattermost’s web interface and functionality are only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for managing your clipboard history. +In this setup, the `tailscale-Mattermost` container runs Tailscale, which manages secure networking for the Mattermost service. The `Mattermost` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Mattermost’s web interface and functionality are only accessible through the Tailscale network unless you enable host port mappings. + +The stack stores Mattermost and PostgreSQL data under the local mattermost-data directory. The path variables in `.env` are relative to this service directory, so the stack does not depend on the shell's current PWD variable. ## Troubleshooting diff --git a/services/mealie/README.md b/services/mealie/README.md index 73baf451..2acd1851 100644 --- a/services/mealie/README.md +++ b/services/mealie/README.md @@ -18,4 +18,4 @@ This Docker Compose configuration sets up [**Mealie**](https://github.com/mealie ## Configuration Overview -In this deployment, the `tailscale-mealie` service runs the Tailscale client to establish a secure private network. The `mealie` container uses `network_mode: service:tailscale-mealie` to route its network traffic through the Tailscale network interface. This configuration ensures that the web UI is only accessible over Tailscale, protecting your recipes and personal data from public exposure. +In this deployment, the `tailscale-mealie` service runs the Tailscale client to establish a secure private network. The `mealie` container uses `network_mode: service:tailscale` to route its network traffic through the Tailscale network interface. This configuration ensures that the web UI is only accessible over Tailscale, protecting your recipes and personal data from public exposure. diff --git a/services/memos/.env b/services/memos/.env index 1f1ff897..483f7993 100644 --- a/services/memos/.env +++ b/services/memos/.env @@ -11,7 +11,8 @@ SERVICEPORT=5230 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/memos/README.md b/services/memos/README.md index ac884843..3bb1bf6a 100644 --- a/services/memos/README.md +++ b/services/memos/README.md @@ -10,7 +10,7 @@ By pairing Memos with Tailscale, you ensure that your notes remain private and a ## Configuration Overview -In this setup, the `tailscale-memos` service runs Tailscale and manages secure networking. The `memos` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale-memos` configuration. This ensures that Memos is only accessible through your Tailnet unless you explicitly expose ports. +In this setup, the `tailscale-memos` service runs Tailscale and manages secure networking. The `memos` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Memos is only accessible through your Tailnet unless you explicitly expose ports. ## Files to check diff --git a/services/metube/README.md b/services/metube/README.md index 2bde43ee..f7c0cdee 100644 --- a/services/metube/README.md +++ b/services/metube/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Metube](https://github.com/alexta69/m ## Configuration Overview -In this setup, the `tailscale-metube` service runs Tailscale, which manages secure networking for the metube application. The `metube` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that metube’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security. +In this setup, the `tailscale-metube` service runs Tailscale, which manages secure networking for the metube application. The `metube` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that metube’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security. diff --git a/services/minecraft/.env b/services/minecraft/.env index 86a8031c..a9f03607 100644 --- a/services/minecraft/.env +++ b/services/minecraft/.env @@ -11,7 +11,8 @@ SERVICEPORT=25565 # Port to expose to local network. Uncomment the "ports:" sect DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/services/minecraft/README.md b/services/minecraft/README.md index 9dbdada7..527b2007 100644 --- a/services/minecraft/README.md +++ b/services/minecraft/README.md @@ -26,7 +26,7 @@ No `serve.json` configuration is needed for this service. ## Configuration Overview -In this setup, the `tailscale-minecraft` service runs the Tailscale client to join your private mesh network. The `minecraft` service is configured with `network_mode: service:tailscale-minecraft`, so all network traffic for the game server is routed through the Tailscale container. The Minecraft server binds TCP port 25565, which is reachable only from devices on your Tailnet. +In this setup, the `tailscale-minecraft` service runs the Tailscale client to join your private mesh network. The `minecraft` service is configured with `network_mode: service:tailscale`, so all network traffic for the game server is routed through the Tailscale container. The Minecraft server binds TCP port 25565, which is reachable only from devices on your Tailnet. ## Setup diff --git a/services/minecraft/compose.yaml b/services/minecraft/compose.yaml index 9985e540..277b4197 100644 --- a/services/minecraft/compose.yaml +++ b/services/minecraft/compose.yaml @@ -1,12 +1,3 @@ -configs: - ts-serve: - content: | - {"TCP":{"443":{"HTTPS":true}}, - "Web":{"$${TS_CERT_DOMAIN}:443": - {"Handlers":{"/": - {"Proxy":"http://127.0.0.1:25565"}}}}, - "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} - services: # Make sure you have updated/checked the .env file with the correct variables. # All the ${ xx } need to be defined there. @@ -18,15 +9,11 @@ services: environment: - TS_AUTHKEY=${TS_AUTHKEY} - TS_STATE_DIR=/var/lib/tailscale - - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS - TS_AUTH_ONCE=true - configs: - - source: ts-serve - target: /config/serve.json volumes: - ./config:/config # Config folder used to store Tailscale files - you may need to change the path - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path diff --git a/services/miniflux/.env b/services/miniflux/.env index 4047e0eb..6f21666d 100644 --- a/services/miniflux/.env +++ b/services/miniflux/.env @@ -15,7 +15,8 @@ TS_AUTHKEY= # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TAILNET_NAME= # Include the ".ts.net" if it is part of your Tailnet name +TAILNET_NAME= +# Include the ".ts.net" if it is part of your Tailnet name # Miniflux Configuration # You must set these diff --git a/services/miniflux/README.md b/services/miniflux/README.md index 7cc1e906..7dbfc6e8 100644 --- a/services/miniflux/README.md +++ b/services/miniflux/README.md @@ -17,7 +17,7 @@ This Docker Compose configuration sets up [Miniflux](https://github.com/miniflux ## Configuration Overview -In this deployment, the `tailscale-miniflux` service runs the Tailscale client to establish a secure private network. The `miniflux` application and its `postgres` database both use `network_mode: service:tailscale-miniflux`. This means all services share the same network namespace, allowing them to communicate via `localhost` and keeping the application reachable only via the Tailscale network. +In this deployment, the `tailscale-miniflux` service runs the Tailscale client to establish a secure private network. The `miniflux` application and its `postgres` database both use `network_mode: service:tailscale`. This means all services share the same network namespace, allowing them to communicate via `localhost` and keeping the application reachable only via the Tailscale network. ## Files to check diff --git a/services/miniqr/README.md b/services/miniqr/README.md index 2f655b8f..b5605aa6 100644 --- a/services/miniqr/README.md +++ b/services/miniqr/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Mini-QR](https://github.com/lyqht/m ## Configuration Overview -In this setup, the `tailscale-miniqr` service runs Tailscale, which handles secure networking for the Mini-QR service. The `mini-qr` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that the Mini-QR web interface is only accessible via your Tailscale network (or locally if preferred), giving you complete control over access and visibility. +In this setup, the `tailscale-miniqr` service runs Tailscale, which handles secure networking for the Mini-QR service. The `mini-qr` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that the Mini-QR web interface is only accessible via your Tailscale network (or locally if preferred), giving you complete control over access and visibility. diff --git a/services/nanote/README.md b/services/nanote/README.md index ebd67b82..83500e38 100644 --- a/services/nanote/README.md +++ b/services/nanote/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up **[Nanote](https://github.com/omarmir/ ## Configuration Overview -In this setup, the `tailscale-nanote` service runs Tailscale, which manages secure networking for the Nanote service. The `nanote` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Nanote’s web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your note-taking workflow. +In this setup, the `tailscale-nanote` service runs Tailscale, which manages secure networking for the Nanote service. The `nanote` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Nanote’s web interface and note storage are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of security and privacy to your note-taking workflow. diff --git a/services/navidrome/README.md b/services/navidrome/README.md index ef112169..4ed224e2 100644 --- a/services/navidrome/README.md +++ b/services/navidrome/README.md @@ -17,4 +17,6 @@ Navidrome is a self-hosted music streaming server and web-based player. It allow ## Configuration Overview -In this setup, the `tailscale-navidrome` container runs the Tailscale client and forms a private mesh network. The `navidrome` container is configured with `network_mode: service:tailscale-navidrome`, which routes all of Navidrome’s traffic through Tailscale. This ensures that your music server is never exposed publicly, and can only be accessed from devices authenticated through your Tailscale Tailnet. +In this setup, the `tailscale-navidrome` container runs the Tailscale client and forms a private mesh network. The `navidrome` container is configured with `network_mode: service:tailscale`, which routes all of Navidrome’s traffic through Tailscale. This ensures that your music server is never exposed publicly, and can only be accessed from devices authenticated through your Tailscale Tailnet. + +Before starting the stack, replace `/path/to/your/music/folder` in `compose.yaml` with the absolute host directory that contains your music library. diff --git a/services/nessus/README.md b/services/nessus/README.md index 5a858959..91f309c5 100644 --- a/services/nessus/README.md +++ b/services/nessus/README.md @@ -22,6 +22,6 @@ Nessus Essentials offers a free version of the tool for personal and home use, [ ## Configuration Overview -In this setup, the `tailscale-nessus` service runs Tailscale, which manages secure networking for the Nessus service. The `nessus` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Nessus’ web interface and scanning functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an additional layer of security to your vulnerability management infrastructure. +In this setup, the `tailscale-nessus` service runs Tailscale, which manages secure networking for the Nessus service. The `nessus` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Nessus’ web interface and scanning functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an additional layer of security to your vulnerability management infrastructure. For additional configuration (environment variables) - please refer to the [Tenable documentation](https://docs.tenable.com/nessus/Content/DeployNessusDocker.htm). diff --git a/services/netbox/.env b/services/netbox/.env index afb03ad4..323875a9 100644 --- a/services/netbox/.env +++ b/services/netbox/.env @@ -11,7 +11,8 @@ SERVICEPORT=8080 DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= // your tailscale authentication key +TS_AUTHKEY= +# your tailscale authentication key # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones @@ -63,7 +64,4 @@ POSTGRES_DB=netbox POSTGRES_PASSWORD=${SUPER_SECRET}DB POSTGRES_USER=netbox -#REDIS Environment variables -REDIS_PASSWORD=${SUPER_SECRET}REDIS - #EXAMPLE_VAR="Environment varibale" diff --git a/services/netbox/README.md b/services/netbox/README.md index 8bf32893..5e42542f 100644 --- a/services/netbox/README.md +++ b/services/netbox/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Netbox](https://github.com/netbox-com ## Configuration Overview -In this setup, the `tailscale-netbox` service runs Tailscale, which manages secure networking for the Netbox application. The `netbox` application uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that your Netbox application is only accessible through the Tailscale network (or local as well, if preferred). +In this setup, the `tailscale-netbox` service runs Tailscale, which manages secure networking for the Netbox application. The `netbox` application uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that your Netbox application is only accessible through the Tailscale network (or local as well, if preferred). diff --git a/services/netbox/compose.yaml b/services/netbox/compose.yaml index 76f49e37..11f49c52 100644 --- a/services/netbox/compose.yaml +++ b/services/netbox/compose.yaml @@ -18,7 +18,7 @@ services: environment: - TS_AUTHKEY=${TS_AUTHKEY} - TS_STATE_DIR=/var/lib/tailscale - - TS_SERVE_CONFIG=/config/serve.json # Tailsacale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required + - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint @@ -68,7 +68,7 @@ services: timeout: 3s interval: 15s restart: always - env_file: /.env + env_file: ./.env netbox-worker: <<: *netbox container_name: worker-${SERVICE} # Name for local container management @@ -88,7 +88,7 @@ services: postgres: image: docker.io/postgres:17-alpine container_name: ${SERVICE}-postgres - env_file: /.env + env_file: ./.env healthcheck: test: pg_isready -q -t 2 -d $$POSTGRES_DB -U $$POSTGRES_USER start_period: 20s diff --git a/services/newwallpaperwhodis/.env b/services/newwallpaperwhodis/.env index c943f0c1..4bcc2b4c 100644 --- a/services/newwallpaperwhodis/.env +++ b/services/newwallpaperwhodis/.env @@ -11,7 +11,8 @@ SERVICEPORT=6767 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/services/next-explorer/.env b/services/next-explorer/.env index 691d23ef..e10d8890 100644 --- a/services/next-explorer/.env +++ b/services/next-explorer/.env @@ -11,7 +11,8 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables PUID=1000 @@ -23,7 +24,6 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ ACCESS_PATH=/home/root/data # Change this to the path you want to share with Tailscale. This should be an absolute path on the host machine. For example, if you want to share the /home/user/files directory, set ACCESS_PATH=/home/user/files. -TAILNET_NAME=your-tailnet-name # Change this to your Tailnet name, which is the domain you use for Tailscale. For example, if your Tailnet is "example.com", set TAILNET_NAME=example.com. SESSION_SECRET=your-super-secret # Use 'openssl rand -base64 32' in your CLI to generate a secure random key. PUBLIC_URL=https://file-explorer..ts.net # Optional: Set this to the public URL of your service if needed for correct URL generation in the app. For example, if you are exposing the service at https://example.com, set PUBLIC_URL=https://example.com. diff --git a/services/next-explorer/README.md b/services/next-explorer/README.md index 7107efde..2cf4ce39 100644 --- a/services/next-explorer/README.md +++ b/services/next-explorer/README.md @@ -8,4 +8,6 @@ This Docker Compose configuration sets up [NextExplorer](https://github.com/nxza ## Configuration Overview -In this setup, the `tailscale-files` service runs Tailscale, which manages secure networking for the NextExplorer service. The `files` service uses the Tailscale network stack via Docker’s `network_mode: service:` configuration. This setup ensures that NextExplorer management interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for managing your file systems. +In this setup, the `tailscale` service runs Tailscale, which manages secure networking for NextExplorer. The `application` service uses Docker's `network_mode: service:tailscale` configuration. This keeps the management interface on your Tailnet unless you enable the optional host port mapping. + +Set `ACCESS_PATH` in `.env` to an absolute host directory before starting the stack. NextExplorer mounts that directory at `/mnt/Files`. Replace the sample `SESSION_SECRET` and `PUBLIC_URL` values with deployment-specific values when those settings are used. diff --git a/services/nodered/README.md b/services/nodered/README.md index 7f0b9abd..f7a38243 100644 --- a/services/nodered/README.md +++ b/services/nodered/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Node-RED](https://github.com/node-red ## Configuration Overview -In this setup, the `tailscale-node-red` service runs Tailscale, which manages secure networking for the Node-RED service. The `node-red` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Node-RED’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your flow-based programming environment. +In this setup, the `tailscale-node-red` service runs Tailscale, which manages secure networking for the Node-RED service. The `node-red` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Node-RED’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your flow-based programming environment. diff --git a/services/ntfy/README.md b/services/ntfy/README.md index 2cc548dd..6e3284f7 100644 --- a/services/ntfy/README.md +++ b/services/ntfy/README.md @@ -8,6 +8,6 @@ This Docker Compose configuration sets up [ntfy](https://ntfy.sh/) with Tailscal ## Configuration Overview -In this setup, the `tailscale-ntfy` service runs the Tailscale daemon to provide secure, private networking. The `ntfy` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:` syntax. This binds ntfy’s network interface to the Tailscale container, making the HTTP API available only through your Tailscale network (or locally, if needed). +In this setup, the `tailscale-ntfy` service runs the Tailscale daemon to provide secure, private networking. The `ntfy` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:tailscale` syntax. This binds ntfy’s network interface to the Tailscale container, making the HTTP API available only through your Tailscale network (or locally, if needed). This architecture is ideal for self-hosters who want to send and receive notifications from anywhere without exposing the ntfy broker to the internet, maintaining both ease of access and strict privacy controls. diff --git a/services/ollama/.env b/services/ollama/.env index 6edc7260..9df39204 100644 --- a/services/ollama/.env +++ b/services/ollama/.env @@ -11,7 +11,8 @@ SERVICEPORT=11434 # Ollama's default API port. Uncomment the "ports:" section in DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. #Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/open-webui/.env b/services/open-webui/.env index a603f9bd..e2e9e390 100644 --- a/services/open-webui/.env +++ b/services/open-webui/.env @@ -11,7 +11,8 @@ SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Open WebUI Configuration # Point to your Ollama instance - can be local or remote. @@ -21,7 +22,8 @@ TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://t # Ollama over Tailnet: http://100.x.x.x:11434 # Leave blank to configure a different provider (e.g. OpenAI) via the UI. OLLAMA_BASE_URL=http://host.docker.internal:11434 -WEBUI_SECRET_KEY= # Random secret key for session security. Generate with: openssl rand -hex 32 +WEBUI_SECRET_KEY= +# Random secret key for session security. Generate with: openssl rand -hex 32 TZ=Europe/Amsterdam # Timezone for the container. #EXAMPLE_VAR="Environment varibale" diff --git a/services/open-webui/README.md b/services/open-webui/README.md index 3ee50cdf..3ba958cb 100644 --- a/services/open-webui/README.md +++ b/services/open-webui/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Open WebUI](https://openwebui.com/) w ## Configuration Overview -In this setup, the `tailscale-open-webui` service runs Tailscale, which manages secure networking for Open WebUI. The `open-webui` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-open-webui` service runs Tailscale, which manages secure networking for Open WebUI. The `open-webui` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## What to document for users diff --git a/services/paperless/.env b/services/paperless/.env index 3b314f0b..381b8adb 100644 --- a/services/paperless/.env +++ b/services/paperless/.env @@ -11,7 +11,8 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/paperless/README.md b/services/paperless/README.md index 1cadb1cf..adc2d7b5 100644 --- a/services/paperless/README.md +++ b/services/paperless/README.md @@ -8,6 +8,6 @@ This Docker Compose configuration sets up [Paperless-ngx](https://docs.paperless ## Configuration Overview -In this setup, the `tailscale-paperless` service runs the Tailscale daemon to provide secure, private networking. The `paperless` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:` syntax. This binds Paperless network interface to the Tailscale container, making the service available only through your Tailscale network (or locally, if needed). +In this setup, the `tailscale-paperless` service runs the Tailscale daemon to provide secure, private networking. The `paperless` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:tailscale` syntax. This binds Paperless network interface to the Tailscale container, making the service available only through your Tailscale network (or locally, if needed). This architecture is ideal for self-hosters who want to send and receive notifications from anywhere without exposing Paperless-ngx to the internet, maintaining both ease of access and strict privacy controls. diff --git a/services/picard/.env b/services/picard/.env index a46ce7ef..405227b5 100644 --- a/services/picard/.env +++ b/services/picard/.env @@ -11,7 +11,8 @@ SERVICEPORT=5800 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/picard/README.md b/services/picard/README.md index ade3554b..01c99d95 100644 --- a/services/picard/README.md +++ b/services/picard/README.md @@ -34,7 +34,7 @@ With this setup, your tagging process is secured and contained — perfect for p In this deployment, a **Tailscale sidecar container** (for example `tailscale-picard`) connects your Picard instance to your private Tailnet. The main `picard` container uses: ```plain -network_mode: service:tailscale-picard +network_mode: service:tailscale ``` This means all Picard traffic — web interface, plugin updates, and library calls — travels securely through Tailscale. diff --git a/services/pihole/README.md b/services/pihole/README.md index 5ab4bd2d..d2292210 100644 --- a/services/pihole/README.md +++ b/services/pihole/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Pi-hole](https://github.com/pi-hole/p ## Configuration Overview -In this setup, the `tailscale-pihole` service runs Tailscale, which manages secure networking for the Pi-hole service. The `pihole` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Pi-hole’s DNS service and web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your network-wide ad blocker. +In this setup, the `tailscale-pihole` service runs Tailscale, which manages secure networking for the Pi-hole service. The `pihole` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Pi-hole’s DNS service and web interface are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your network-wide ad blocker. ## Binding to your local host machine? Port 53 - DNSStubListener diff --git a/services/pingvin-share/README.md b/services/pingvin-share/README.md index 382408b6..d9c2729f 100644 --- a/services/pingvin-share/README.md +++ b/services/pingvin-share/README.md @@ -10,4 +10,4 @@ This Docker Compose configuration sets up [Pingvin Share](https://github.com/sto ## Configuration Overview -In this setup, the `tailscale-pingvin` service runs Tailscale, which manages secure networking for the Pingvin Share service. The `pingvin-share` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Pingvin Share’s web interface and file-sharing capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted file-sharing needs. +In this setup, the `tailscale-pingvin` service runs Tailscale, which manages secure networking for the Pingvin Share service. The `pingvin-share` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Pingvin Share’s web interface and file-sharing capabilities are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted file-sharing needs. diff --git a/services/plex/README.md b/services/plex/README.md index e9712a3c..efc54976 100644 --- a/services/plex/README.md +++ b/services/plex/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Plex Media Server](https://hub.docker ## Configuration Overview -In this setup, the `tailscale-plex` service runs Tailscale, which manages secure networking for the Plex Media Server. The `plex` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Plex's media streaming service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your media server. +In this setup, the `tailscale-plex` service runs Tailscale, which manages secure networking for the Plex Media Server. The `plex` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Plex's media streaming service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your media server. diff --git a/services/pocket-id/README.md b/services/pocket-id/README.md index 59df32a0..8722cbb0 100644 --- a/services/pocket-id/README.md +++ b/services/pocket-id/README.md @@ -16,4 +16,4 @@ This Docker Compose configuration sets up [Pocket ID](https://github.com/stonith ## Configuration Overview -In this setup, the `tailscale-pocket-id` service runs Tailscale, which manages secure networking for the Pocket ID service. The `pocket-id` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Pocket ID’s web interface and APIs are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your identity management system. +In this setup, the `tailscale-pocket-id` service runs Tailscale, which manages secure networking for the Pocket ID service. The `pocket-id` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Pocket ID’s web interface and APIs are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your identity management system. diff --git a/services/portainer/README.md b/services/portainer/README.md index 03146cc6..893de772 100644 --- a/services/portainer/README.md +++ b/services/portainer/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Portainer](https://github.com/portain ## Configuration Overview -In this setup, the `tailscale-portainer` service runs Tailscale, which manages secure networking for the Portainer service. The `portainer` service uses the Tailscale network stack via Docker’s `network_mode: service:` configuration. This setup ensures that Portainer’s management interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for managing your Docker environments. +In this setup, the `tailscale-portainer` service runs Tailscale, which manages secure networking for the Portainer service. The `portainer` service uses the Tailscale network stack via Docker’s `network_mode: service:tailscale` configuration. This setup ensures that Portainer’s management interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for managing your Docker environments. diff --git a/services/portracker/README.md b/services/portracker/README.md index 3461ace3..257d9589 100644 --- a/services/portracker/README.md +++ b/services/portracker/README.md @@ -19,4 +19,4 @@ With Tailscale in place, all of these features are securely tunneled through you ## Configuration Overview -In this setup, the `tailscale-portracker` service runs Tailscale, which handles the secure networking layer. The `portracker` service uses Docker’s `network_mode: service:` setting to share the network stack of the Tailscale container. This means the Portracker web interface and all monitoring functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted port tracker. +In this setup, the `tailscale-portracker` service runs Tailscale, which handles the secure networking layer. The `portracker` service uses Docker’s `network_mode: service:tailscale` setting to share the network stack of the Tailscale container. This means the Portracker web interface and all monitoring functionality are only accessible via the Tailscale network (or locally if preferred), adding a strong privacy layer to your self-hosted port tracker. diff --git a/services/posterizarr/README.md b/services/posterizarr/README.md index dce5b71b..ad797d98 100644 --- a/services/posterizarr/README.md +++ b/services/posterizarr/README.md @@ -31,7 +31,7 @@ This approach is ideal for homelabs, media servers, and multi-location setups wh In this deployment, a **Tailscale sidecar container** (for example, `tailscale-posterizarr`) runs the Tailscale client and connects to your private Tailscale network. The Posterizarr service uses: ```plain -network_mode: service:tailscale-posterizarr +network_mode: service:tailscale ``` This configuration ensures that **all Posterizarr traffic is routed exclusively through the Tailscale interface**, allowing it to securely communicate with Radarr and Sonarr instances over your private network. No ports are exposed to the public Internet, and the service remains fully isolated. diff --git a/services/prowlarr/README.md b/services/prowlarr/README.md index 1bb1892f..ba0c486c 100644 --- a/services/prowlarr/README.md +++ b/services/prowlarr/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Prowlarr](https://github.com/Prowlarr ## Configuration Overview -In this setup, the `tailscale-prowlarr` service runs Tailscale, which manages secure networking for the Prowlarr service. The `prowlarr` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Prowlarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted indexer manager. +In this setup, the `tailscale-prowlarr` service runs Tailscale, which manages secure networking for the Prowlarr service. The `prowlarr` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Prowlarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted indexer manager. diff --git a/services/qbittorrent/README.md b/services/qbittorrent/README.md index df90fb3e..529520ad 100644 --- a/services/qbittorrent/README.md +++ b/services/qbittorrent/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [qBittorrent](https://www.qbittorrent. ## Configuration Overview -In this setup, the tailscale-qbittorrent service runs Tailscale, which manages secure networking for the qBittorrent service. The qbittorrent service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that qBittorrent’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted torrent client. +In this setup, the tailscale-qbittorrent service runs Tailscale, which manages secure networking for the qBittorrent service. The qbittorrent service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that qBittorrent’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted torrent client. diff --git a/services/radarr/README.md b/services/radarr/README.md index 062c6fbe..fad9e8e6 100644 --- a/services/radarr/README.md +++ b/services/radarr/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Radarr](https://github.com/Radarr/Rad ## Configuration Overview -In this setup, the `tailscale-radarr` service runs Tailscale, which manages secure networking for the Radarr service. The `radarr` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Radarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. +In this setup, the `tailscale-radarr` service runs Tailscale, which manages secure networking for the Radarr service. The `radarr` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Radarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. ### Trouble with presets or optimal download quality, try diff --git a/services/radicale/README.md b/services/radicale/README.md index 7121b99d..981e3c2f 100644 --- a/services/radicale/README.md +++ b/services/radicale/README.md @@ -17,7 +17,7 @@ This Docker Compose configuration sets up [Radicale](https://radicale.org/) with ## Configuration Overview -In this setup, the `tailscale-radicale` service runs Tailscale, which manages secure networking for Radicale. The `radicale` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-radicale` service runs Tailscale, which manages secure networking for Radicale. The `radicale` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. The container runs with hardened security settings: read-only filesystem, no new privileges, dropped capabilities, and resource limits (256M memory, 50 pids). diff --git a/services/recyclarr/README.md b/services/recyclarr/README.md index a0b5fa4e..2b41ef62 100644 --- a/services/recyclarr/README.md +++ b/services/recyclarr/README.md @@ -31,7 +31,7 @@ This is especially valuable in homelabs, seedbox setups, or multi-location media In this deployment, a **Tailscale sidecar container** (for example, `tailscale-recyclarr`) runs the Tailscale client and joins your private Tailscale network. The Recyclarr service uses: ```plain -network_mode: service:tailscale-recyclarr +network_mode: service:tailscale ``` This setup ensures that **all Recyclarr traffic flows exclusively through the Tailscale interface**, allowing it to securely reach Radarr and Sonarr instances that are also on your Tailscale network. No ports need to be exposed, and the container remains completely inaccessible from the public Internet. diff --git a/services/resilio-sync/README.md b/services/resilio-sync/README.md index f79247d9..1806c34a 100644 --- a/services/resilio-sync/README.md +++ b/services/resilio-sync/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Resilio Sync](https://github.com/linu ## Configuration Overview -In this setup, the `tailscale-resilio-sync` service runs Tailscale, which manages secure networking for the Resilio Sync service. The `resilio-sync` service uses the Tailscale network stack via Docker’s `network_mode: service:` configuration. This setup ensures that Resilio Sync is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your file synchronization and sharing tasks. +In this setup, the `tailscale-resilio-sync` service runs Tailscale, which manages secure networking for the Resilio Sync service. The `resilio-sync` service uses the Tailscale network stack via Docker’s `network_mode: service:tailscale` configuration. This setup ensures that Resilio Sync is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your file synchronization and sharing tasks. diff --git a/services/rustdesk-server/.env b/services/rustdesk-server/.env index 967a33db..f5616f25 100644 --- a/services/rustdesk-server/.env +++ b/services/rustdesk-server/.env @@ -11,7 +11,8 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/services/rustdesk-server/README.md b/services/rustdesk-server/README.md index 36fce958..a132c3c1 100644 --- a/services/rustdesk-server/README.md +++ b/services/rustdesk-server/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Rustdesk Server](https://rustdesk.com ## Configuration Overview -In this setup, the `tailscale-rustdesk-server` service runs Tailscale, which manages secure networking for Rustdesk Server. The `Rustdesk Server` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-rustdesk-server` service runs Tailscale, which manages secure networking for Rustdesk Server. The `Rustdesk Server` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## Client setup diff --git a/services/seafile/.env b/services/seafile/.env index b3e65a84..759e90bc 100644 --- a/services/seafile/.env +++ b/services/seafile/.env @@ -3,17 +3,19 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE= seafile # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). +SERVICE=seafile # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). SEAFILE_IMAGE=seafileltd/seafile-mc:13.0-latest # Docker image URL from container registry (e.g., adguard/adguard-home). SEAFILE_DB_IMAGE=mariadb:10.11 SEAFILE_MEMCACHED_IMAGE=memcached:1.6.29 # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -31,7 +33,8 @@ INIT_SEAFILE_MYSQL_ROOT_PASSWORD=REPLACE_WITH_RANDOM_ALPHANUMERIC_PASSWORD SEAFILE_MYSQL_DB_USER=seafile SEAFILE_MYSQL_DB_PASSWORD=REPLACE_WITH_RANDOM_ALPHANUMERIC_PASSWORD TIME_ZONE=Etc/UTC -JWT_PRIVATE_KEY= #A random string with a length of no less than 32 characters, generate example: pwgen -s 40 1 or use openssl rand -base64 40 +JWT_PRIVATE_KEY= +#A random string with a length of no less than 32 characters, generate example: pwgen -s 40 1 or use openssl rand -base64 40 SEAFILE_SERVER_HOSTNAME=seafile..ts.net # update with specific MagicDNS suffix SEAFILE_SERVER_PROTOCOL=https INIT_SEAFILE_ADMIN_EMAIL= ADD_EMAIL_ADDRESS_HERE @@ -40,4 +43,4 @@ ENABLE_SEADOC=false ENABLE_NOTIFICATION_SERVER=false CACHE_PROVIDER=memcached MEMCACHED_HOST=app-seafile-memcached -MEMCACHED_PORT=11211 \ No newline at end of file +MEMCACHED_PORT=11211 diff --git a/services/seafile/README.md b/services/seafile/README.md index 242255e8..ace91f5c 100644 --- a/services/seafile/README.md +++ b/services/seafile/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Seafile Community Edition](https://ww ## Configuration Overview -In this setup, the `tailscale-seafile` service runs Tailscale, which manages secure networking for Seafile. The Seafile service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-seafile` service runs Tailscale, which manages secure networking for Seafile. The Seafile service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## Notes diff --git a/services/searxng/.env b/services/searxng/.env index 6eabe229..f2fbf62f 100644 --- a/services/searxng/.env +++ b/services/searxng/.env @@ -20,7 +20,8 @@ TAILNET_NAME= # Optional Service variables # PUID=1000 -SEARXNG_SECRET= # Generate a random secret for searxng, e.g. using `openssl rand -hex 32` +SEARXNG_SECRET= +# Generate a random secret for searxng, e.g. using `openssl rand -hex 32` SEARXNG_VALKEY_URL=valkey://valkey-searxng:6379/0 # URL for valkey, format: valkey://:/ #EXAMPLE_VAR="Environment varibale" diff --git a/services/searxng/README.md b/services/searxng/README.md index a9d8f9a6..c0690c55 100644 --- a/services/searxng/README.md +++ b/services/searxng/README.md @@ -8,10 +8,11 @@ This Docker Compose configuration sets up [searXNG](https://github.com/searxng/s ## Configuration Overview -In this setup, the `tailscale-searxng` service runs Tailscale, which manages secure networking for the searXNG service. The `searxng` service utilizes the Tailscale network stack via Docker’s `network_mode: service:` configuration. This setup ensures that searXNG is only accessible through your Tailscale network (or locally, if preferred). With this configuration, you can enjoy a private, secure, and customizable search engine experience, free from user tracking or external access. +In this setup, the `tailscale-searxng` service runs Tailscale, which manages secure networking for the searXNG service. The `searxng` service utilizes the Tailscale network stack via Docker’s `network_mode: service:tailscale` configuration. This setup ensures that searXNG is only accessible through your Tailscale network (or locally, if preferred). With this configuration, you can enjoy a private, secure, and customizable search engine experience, free from user tracking or external access. We use `/searxng/settings.yml` copied from as the default settings file. This dir is mounted as a volume, on docker and required for the first run. The default `settings.yml` does not use valkey ([valkey](https://github.com/searxng/searxng/blob/master/searx/settings.yml#L121) URL is set to `false`). We enable this by setting the `SEARXNG_VALKEY_URL` in `.env` file and using that in the `compose.yaml` file. +Set `SEARXNG_SECRET` in `.env` to a random value. The Compose file passes it to the mounted settings file as the instance secret. ## References diff --git a/services/searxng/compose.yaml b/services/searxng/compose.yaml index 639004cf..6d8ef7a6 100644 --- a/services/searxng/compose.yaml +++ b/services/searxng/compose.yaml @@ -56,6 +56,7 @@ services: - PUID=1000 - PGID=1000 - SEARXNG_BASE_URL=https://${SERVICE}.${TAILNET_NAME}.ts.net/ + - SEARXNG_SECRET=${SEARXNG_SECRET} - SEARXNG_VALKEY_URL=${SEARXNG_VALKEY_URL} - TZ=${TZ} volumes: diff --git a/services/seerr/README.md b/services/seerr/README.md index a778eb0f..6bc376aa 100644 --- a/services/seerr/README.md +++ b/services/seerr/README.md @@ -8,6 +8,6 @@ This Docker Compose configuration sets up [Seerr](https://github.com/seerr-team/ ## Configuration Overview -In this setup, the `tailscale-seerr` service runs the Tailscale daemon to provide secure, private networking. The `seerr` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:` syntax. This binds Seer’s network interface to the Tailscale container, making the web UI and API available only through your Tailscale network (or locally, if needed). +In this setup, the `tailscale-seerr` service runs the Tailscale daemon to provide secure, private networking. The `seerr` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:tailscale` syntax. This binds Seer’s network interface to the Tailscale container, making the web UI and API available only through your Tailscale network (or locally, if needed). This architecture is ideal for self-hosters who want to access Seerr from anywhere without exposing it to the internet, maintaining both ease of access and strict privacy controls. diff --git a/services/slink/README.md b/services/slink/README.md index 6442221d..571111f4 100644 --- a/services/slink/README.md +++ b/services/slink/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Slink](https://github.com/andrii-kryv ## Configuration Overview -In this setup, the `tailscale-slink` service runs Tailscale, which manages secure networking for the Slink service. The `slink` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Slink's file-sharing interface is only accessible through the Tailscale network, adding an extra layer of security and privacy for your self-hosted file-sharing system. +In this setup, the `tailscale-slink` service runs Tailscale, which manages secure networking for the Slink service. The `slink` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Slink's file-sharing interface is only accessible through the Tailscale network, adding an extra layer of security and privacy for your self-hosted file-sharing system. diff --git a/services/sonarr/README.md b/services/sonarr/README.md index c960287b..3c6cfa9a 100644 --- a/services/sonarr/README.md +++ b/services/sonarr/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [Sonarr](https://github.com/Sonarr/Son ## Configuration Overview -In this setup, the tailscale-sonarr service runs Tailscale, which manages secure networking for the Sonarr service. The sonarr service uses the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Sonarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. +In this setup, the tailscale-sonarr service runs Tailscale, which manages secure networking for the Sonarr service. The sonarr service uses the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Sonarr’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted media manager. ### Trouble with presets or optimal download quality, try diff --git a/services/speedtest-tracker/README.md b/services/speedtest-tracker/README.md index e571bb07..b14766ce 100644 --- a/services/speedtest-tracker/README.md +++ b/services/speedtest-tracker/README.md @@ -15,4 +15,4 @@ This Docker Compose configuration sets up [Speedtest Tracker](https://github.com ## Configuration Overview -In this setup, the `tailscale-speedtest` service runs Tailscale, which manages secure networking for the Speedtest Tracker service. The `speedtest-tracker` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Speedtest Tracker’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your internet speed monitoring. +In this setup, the `tailscale-speedtest` service runs Tailscale, which manages secure networking for the Speedtest Tracker service. The `speedtest-tracker` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Speedtest Tracker’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing enhanced privacy and security for your internet speed monitoring. diff --git a/services/stirlingpdf/README.md b/services/stirlingpdf/README.md index c3d6a734..122268a1 100644 --- a/services/stirlingpdf/README.md +++ b/services/stirlingpdf/README.md @@ -8,4 +8,4 @@ Stirling-PDF is a versatile, open-source toolkit that allows you to perform vari ## Configuration Overview -In this setup, the `tailscale-stirlingpdf` service runs Tailscale, which manages secure networking for the Stirling-PDF service. The `stirlingpdf` service uses the Tailscale network stack via Docker’s `network_mode: service:` configuration. This setup ensures that Stirling-PDF's interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your PDF processing tasks. +In this setup, the `tailscale-stirlingpdf` service runs Tailscale, which manages secure networking for the Stirling-PDF service. The `stirlingpdf` service uses the Tailscale network stack via Docker’s `network_mode: service:tailscale` configuration. This setup ensures that Stirling-PDF's interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your PDF processing tasks. diff --git a/services/subtrackr/README.md b/services/subtrackr/README.md index aedd00ec..87a6a263 100644 --- a/services/subtrackr/README.md +++ b/services/subtrackr/README.md @@ -18,4 +18,4 @@ This Docker Compose configuration sets up [**Subtrackr**](https://github.com/bsc ## Configuration Overview -In this deployment, the `tailscale-subtrackr` service runs the Tailscale client to establish a secure private network. The `subtrackr` container uses `network_mode: service:tailscale-subtrackr` to route all traffic through the Tailscale interface. This ensures that your subscription data, dashboards, and administration interface are only accessible via Tailscale, preventing public exposure. +In this deployment, the `tailscale-subtrackr` service runs the Tailscale client to establish a secure private network. The `subtrackr` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your subscription data, dashboards, and administration interface are only accessible via Tailscale, preventing public exposure. diff --git a/services/sure/.env b/services/sure/.env index 0cd788e3..df561f55 100755 --- a/services/sure/.env +++ b/services/sure/.env @@ -11,7 +11,8 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -33,17 +34,19 @@ POSTGRES_HOST=db # Used by the backup service (on sure_net, Docker DNS works) REDIS_URL=redis://172.28.0.11:6379/1 # Static IP of redis on sure_net (web/worker share tailscale namespace where Docker DNS is overridden by MagicDNS) # Sure Application -SECRET_KEY_BASE= #openssl rand -hex 64 +SECRET_KEY_BASE= +#openssl rand -hex 64 SELF_HOSTED=true RAILS_FORCE_SSL=true RAILS_ASSUME_SSL=true -PORT=8070 # OpenAI (Optional) -OPENAI_ACCESS_TOKEN= # NOTE: enabling OpenAI will incur costs when you use AI-related features in the app (chat, rules) +OPENAI_ACCESS_TOKEN= +# NOTE: enabling OpenAI will incur costs when you use AI-related features in the app (chat, rules) # OIDC Authentication (Optional) -OIDC_ISSUER= # OIDC issuer URL for authentication +OIDC_ISSUER= +# OIDC issuer URL for authentication OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= OIDC_REDIRECT_URI=https:///auth/openid_connect/callback diff --git a/services/swingmx/README.md b/services/swingmx/README.md index e00fff95..a365b8d2 100644 --- a/services/swingmx/README.md +++ b/services/swingmx/README.md @@ -27,7 +27,9 @@ Self-hosting Swing Music gives you **full ownership of your music library**, com In this deployment, a **Tailscale sidecar container** (for example `tailscale-swingmusic`) runs the Tailscale client and joins your private Tailscale network. The main `swingmusic` service uses: ```plain -network_mode: service:tailscale-swingmusic +network_mode: service:tailscale ``` This configuration routes all traffic through the Tailscale interface, ensuring the Swing Music web UI and streaming endpoints are accessible **only via your Tailscale network**. This keeps your music library secure while allowing seamless access from all your trusted devices. + +Before starting the stack, replace `/path/to/music` in `compose.yaml` with the absolute host directory that contains your music library. diff --git a/services/tailscale-app-connector-node/.env b/services/tailscale-app-connector-node/.env index cc1b9d25..0b319780 100644 --- a/services/tailscale-app-connector-node/.env +++ b/services/tailscale-app-connector-node/.env @@ -7,7 +7,8 @@ SERVICE=app-connector IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Tailscale Configuration diff --git a/services/tailscale-exit-node/.env b/services/tailscale-exit-node/.env index d18f2142..d6b88a54 100644 --- a/services/tailscale-exit-node/.env +++ b/services/tailscale-exit-node/.env @@ -7,7 +7,8 @@ SERVICE=exit-node IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Tailscale Configuration diff --git a/services/tailscale-subnet-router-node/.env b/services/tailscale-subnet-router-node/.env index ef054713..dbe219de 100644 --- a/services/tailscale-subnet-router-node/.env +++ b/services/tailscale-subnet-router-node/.env @@ -7,7 +7,8 @@ SERVICE=subnet-router IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Tailscale Configuration diff --git a/services/tandoor/README.md b/services/tandoor/README.md index 5eb9ec92..d6136245 100644 --- a/services/tandoor/README.md +++ b/services/tandoor/README.md @@ -15,4 +15,4 @@ This Docker Compose configuration sets up [**Tandoor Recipes**](https://github.c ## Configuration Overview -In this setup, the `tailscale-tandoor` service runs Tailscale, which manages secure networking for the service. The `tandoor` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale-tandoor` configuration. This setup ensures that tandoor's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your service. +In this setup, the `tailscale-tandoor` service runs Tailscale, which manages secure networking for the service. The `tandoor` service utilizes the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that tandoor's service is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your service. diff --git a/services/tautulli/README.md b/services/tautulli/README.md index fd5c5125..a8bc9bc2 100644 --- a/services/tautulli/README.md +++ b/services/tautulli/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Tautulli for Docker](https://hub.dock ## Configuration Overview -In this setup, the tailscale-tautulli service runs Tailscale, which manages secure networking for the Tautulli service. The tautulli service utilizes the Tailscale network stack via Docker's network_mode: service: configuration. This setup ensures that Tautulli’s monitoring interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your Plex server monitoring and management. +In this setup, the tailscale-tautulli service runs Tailscale, which manages secure networking for the Tautulli service. The tautulli service utilizes the Tailscale network stack via Docker's network_mode: service:tailscale configuration. This setup ensures that Tautulli’s monitoring interface is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your Plex server monitoring and management. diff --git a/services/tracktor/.env b/services/tracktor/.env index a95d0512..7bba6483 100644 --- a/services/tracktor/.env +++ b/services/tracktor/.env @@ -11,11 +11,13 @@ SERVICEPORT=3333 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TS_TAILNET= # Your Tailscale tailnet name (e.g., my-tailnet). +TS_TAILNET= +# Your Tailscale tailnet name (e.g., my-tailnet). # Optional Service variables # PUID=1000 diff --git a/services/tracktor/README.md b/services/tracktor/README.md index 3ef7c199..9d4bb47f 100644 --- a/services/tracktor/README.md +++ b/services/tracktor/README.md @@ -30,7 +30,9 @@ When combined with Tailscale, Tracktor becomes a private portal accessible only In this deployment, a **Tailscale sidecar container** (for example `tailscale-tracktor`) runs the Tailscale client and joins your private Tailscale network. The main `tracktor` service uses: ```plain -network_mode: service:tailscale-tracktor +network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Tracktor web UI is accessible **only via your Tailscale network**. + +Set `TS_TAILNET` in `.env` to your Tailnet DNS suffix. Tracktor uses this value to build its allowed browser origin. If you enable the optional host port mapping, it maps `SERVICEPORT` to Tracktor's container port `3000`. diff --git a/services/tracktor/compose.yaml b/services/tracktor/compose.yaml index aa68c51e..9723227d 100644 --- a/services/tracktor/compose.yaml +++ b/services/tracktor/compose.yaml @@ -35,7 +35,7 @@ services: cap_add: - net_admin # Tailscale requirement #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + # - 0.0.0.0:${SERVICEPORT}:3000 # Binding the host port to Tracktor's container port # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} diff --git a/services/traefik/README.md b/services/traefik/README.md index 054ea7a6..c0bd6287 100644 --- a/services/traefik/README.md +++ b/services/traefik/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Traefik](https://github.com/traefik/t ## Configuration Overview -In this setup, the `tailscale-traefik` service runs Tailscale, which manages secure networking for the Traefik service. The `traefik` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures that Traefik’s dashboard and routing functionalities are only accessible through the Tailscale network (or locally, if preferred), adding an extra layer of privacy and security to your network architecture. +In this setup, the `tailscale-traefik` service runs Tailscale, which manages secure networking for Traefik. The `traefik_proxy` service uses Docker's `network_mode: service:tailscale` configuration. The stack reads its tracked configuration from `traefik/app/traefik.yml`. diff --git a/services/traefik/compose.yaml b/services/traefik/compose.yaml index ba4e6311..595598cf 100644 --- a/services/traefik/compose.yaml +++ b/services/traefik/compose.yaml @@ -68,7 +68,7 @@ services: restart: always volumes: - type: bind - source: ./${SERVICE}-data/app/traefik.yml + source: ./traefik/app/traefik.yml target: /etc/traefik.yml - ./${SERVICE}-data/log/:/var/log/ - /var/run/docker.sock:/var/run/docker.sock #Required for the Service Connections diff --git a/services/transmute/.env b/services/transmute/.env index d17b1207..ac54f9c5 100644 --- a/services/transmute/.env +++ b/services/transmute/.env @@ -11,7 +11,8 @@ SERVICEPORT=3313 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/services/transmute/README.md b/services/transmute/README.md index c50001c1..c4f09711 100644 --- a/services/transmute/README.md +++ b/services/transmute/README.md @@ -18,7 +18,7 @@ Running Transmute behind Tailscale ensures that your file processing pipelines a ## Configuration Overview -In this setup, the `tailscale-transmute` service runs Tailscale and manages secure connectivity to your Tailnet. The `transmute` container shares the same network stack using Docker’s `network_mode: service:tailscale-transmute`. +In this setup, the `tailscale-transmute` service runs Tailscale and manages secure connectivity to your Tailnet. The `transmute` container shares the same network stack using Docker’s `network_mode: service:tailscale`. ## Service Notes / Gotchas diff --git a/services/transmute/compose.yaml b/services/transmute/compose.yaml index d283b937..7d3d72e4 100644 --- a/services/transmute/compose.yaml +++ b/services/transmute/compose.yaml @@ -52,7 +52,7 @@ services: image: ${IMAGE_URL} # Image to be used network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} # Name for local container management - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. - PUID=1000 - PGID=1000 - TZ=${TZ} @@ -68,4 +68,4 @@ services: timeout: 10s retries: 3 start_period: 30s - restart: always \ No newline at end of file + restart: always diff --git a/services/uptime-kuma/README.md b/services/uptime-kuma/README.md index 3a87dcf3..1b2facfb 100644 --- a/services/uptime-kuma/README.md +++ b/services/uptime-kuma/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Uptime Kuma](https://github.com/louis ## Configuration Overview -In this setup, the `tailscale-uptimekuma` service runs Tailscale, which manages secure networking for the Uptime Kuma service. The `uptimekuma` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Uptime Kuma's monitoring dashboard is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your monitoring solution. +In this setup, the `tailscale-uptimekuma` service runs Tailscale, which manages secure networking for the Uptime Kuma service. The `uptimekuma` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Uptime Kuma's monitoring dashboard is only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your monitoring solution. diff --git a/services/vaultwarden/README.md b/services/vaultwarden/README.md index bc450ebe..f63339da 100644 --- a/services/vaultwarden/README.md +++ b/services/vaultwarden/README.md @@ -8,4 +8,4 @@ This Docker Compose configuration sets up [Vaultwarden](https://github.com/dani- ## Configuration Overview -In this setup, the `tailscale-vaultwarden` service runs Tailscale, which manages secure networking for the Vaultwarden service. The `vaultwarden` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This setup ensures that Vaultwarden’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted password manager. +In this setup, the `tailscale-vaultwarden` service runs Tailscale, which manages secure networking for the Vaultwarden service. The `vaultwarden` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This setup ensures that Vaultwarden’s web interface and API are only accessible through the Tailscale network (or locally, if preferred), providing an extra layer of security and privacy for your self-hosted password manager. diff --git a/services/vikunja/.env b/services/vikunja/.env index a1601c81..a19015c6 100644 --- a/services/vikunja/.env +++ b/services/vikunja/.env @@ -11,7 +11,8 @@ SERVICEPORT=3456 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 @@ -24,4 +25,4 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim #EXAMPLE_VAR="Environment varibale" VIKUNJA_SERVICE_PUBLICURL=https://vikunja..ts.net/ -VIKUNJA_DATABASE_PATH=/db/vikunja.db # Path to the SQLite database file. Ensure this path is correctly mapped in your Docker volumes.a \ No newline at end of file +VIKUNJA_DATABASE_PATH=/db/vikunja.db # Path to the SQLite database file. Ensure this path is correctly mapped in your Docker volumes.a diff --git a/services/vikunja/README.md b/services/vikunja/README.md index 0172ab44..74f547a2 100644 --- a/services/vikunja/README.md +++ b/services/vikunja/README.md @@ -19,7 +19,7 @@ Vikunja is ideal for individuals or teams who want full ownership of their produ ## Configuration Overview -In this setup, the `tailscale-vikunja` service runs Tailscale, which manages secure networking for Vikunja. The `vikunja` service uses the Tailscale network stack via Docker's `network_mode: service:` configuration. This ensures the application is only accessible through your Tailnet unless you explicitly expose ports. +In this setup, the `tailscale-vikunja` service runs Tailscale, which manages secure networking for Vikunja. The `vikunja` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures the application is only accessible through your Tailnet unless you explicitly expose ports. ### Service-Specific Notes diff --git a/services/vikunja/compose.yaml b/services/vikunja/compose.yaml index b5b4abd2..53eee906 100644 --- a/services/vikunja/compose.yaml +++ b/services/vikunja/compose.yaml @@ -53,7 +53,7 @@ services: network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} # Name for local container management user: "0:0" - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. - TZ=${TZ} - VIKUNJA_SERVICE_PUBLICURL=${VIKUNJA_SERVICE_PUBLICURL} - VIKUNJA_DATABASE_PATH=${VIKUNJA_DATABASE_PATH} @@ -64,4 +64,4 @@ services: depends_on: tailscale: condition: service_healthy - restart: always \ No newline at end of file + restart: always diff --git a/services/wallos/README.md b/services/wallos/README.md index b86c3a30..36e421d8 100644 --- a/services/wallos/README.md +++ b/services/wallos/README.md @@ -17,6 +17,6 @@ Wallos is a self-hosted subscription tracking application that helps you manage ## Configuration Overview -In this configuration, the `tailscale-wallos` container runs the Tailscale client and joins your private mesh network. The `wallos` container is set to use `network_mode: service:tailscale-wallos`, meaning all of Wallos’s network traffic is routed through the Tailscale container. This ensures that the Wallos interface is not publicly exposed and is only reachable from devices connected to your Tailscale network. +In this configuration, the `tailscale-wallos` container runs the Tailscale client and joins your private mesh network. The `wallos` container is set to use `network_mode: service:tailscale`, meaning all of Wallos’s network traffic is routed through the Tailscale container. This ensures that the Wallos interface is not publicly exposed and is only reachable from devices connected to your Tailscale network. This approach combines self-hosted financial tracking with robust, zero-config VPN security—allowing you to safely manage your subscriptions from anywhere. diff --git a/services/xwiki/.env b/services/xwiki/.env index c5af4187..a63f2893 100644 --- a/services/xwiki/.env +++ b/services/xwiki/.env @@ -7,11 +7,12 @@ SERVICE=xwiki # Service name (e.g., adguard). Used as hostname in Tailscale and IMAGE_URL=xwiki:stable-mariadb-tomcat # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/xwiki/compose.yml b/services/xwiki/compose.yml index 8e919ca6..2384bc39 100644 --- a/services/xwiki/compose.yml +++ b/services/xwiki/compose.yml @@ -57,7 +57,7 @@ services: condition: service_healthy db: condition: service_started - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. - XWIKI_VERSION=${XWIKI_VERSION} - DB_USER=${DB_USER} - DB_PASSWORD=${DB_PASSWORD} diff --git a/templates/service-template/.env b/templates/service-template/.env index ad96b14c..8e80ebab 100644 --- a/templates/service-template/.env +++ b/templates/service-template/.env @@ -3,15 +3,19 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE= # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). -IMAGE_URL= # Docker image URL from container registry (e.g., adguard/adguard-home). +SERVICE= +# Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). +IMAGE_URL= +# Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. # Optional Service variables # PUID=1000 diff --git a/templates/service-template/README.md b/templates/service-template/README.md index 58af12c9..719f454c 100644 --- a/templates/service-template/README.md +++ b/templates/service-template/README.md @@ -8,7 +8,7 @@ This Docker Compose configuration sets up [SERVICE](LINK TO PAGE OF MAINTAINER) ## Configuration Overview -In this setup, the `tailscale-SERVICE` service runs Tailscale, which manages secure networking for SERVICE. The `SERVICE` service utilizes the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. +In this setup, the `tailscale-SERVICE` container runs Tailscale, which manages secure networking for SERVICE. The `SERVICE` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This keeps the app Tailnet-only unless you intentionally expose ports. ## What to document for users diff --git a/templates/service-template/compose.yaml b/templates/service-template/compose.yaml index 03fd6370..c4f20953 100644 --- a/templates/service-template/compose.yaml +++ b/templates/service-template/compose.yaml @@ -52,7 +52,7 @@ services: image: ${IMAGE_URL} # Image to be used network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} # Name for local container management - environment: # Varibles are delared in .env file. + environment: # Variables are declared in .env file. - PUID=1000 - PGID=1000 - TZ=${TZ} From c1663ab9f0959dd143c79337a4d2aa046cba72a7 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Mon, 14 Sep 2026 12:46:26 +0200 Subject: [PATCH 2/8] Fix Caddy healthcheck and socket sharing across restarts --- services/caddy/.env | 2 +- services/caddy/README.md | 4 +++- services/caddy/compose.yaml | 4 ++-- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/services/caddy/.env b/services/caddy/.env index 0699e545..494f6108 100644 --- a/services/caddy/.env +++ b/services/caddy/.env @@ -3,7 +3,7 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE=caddy # If this changes, update the Caddyfile hostname. The application healthcheck uses SERVICE automatically. +SERVICE=caddy # If this changes, update the Caddyfile hostname. IMAGE_URL=caddy:latest # Network Configuration diff --git a/services/caddy/README.md b/services/caddy/README.md index a8d66172..2dcf31bb 100644 --- a/services/caddy/README.md +++ b/services/caddy/README.md @@ -15,7 +15,9 @@ To get this working: - Update the FQDN in `Caddyfile` to match your `${SERVICE}.MagicDNSname.ts.net`. - Update the TS_AUTHKEY in the .env file to your Tailscale key. -If you change `SERVICE` in `.env`, update the hostname in `Caddyfile` as well. The application healthcheck uses the value of `SERVICE` automatically. +If you change `SERVICE` in `.env`, update the hostname in `Caddyfile` as well. The healthcheck checks the `caddy` process regardless of the hostname. + +Both containers mount the socket directory, so Caddy can use the replacement socket after Tailscale restarts. The example `compose.yaml` uses a simple webserver for testing purposes. diff --git a/services/caddy/compose.yaml b/services/caddy/compose.yaml index 5f53e0fc..f2a2849e 100644 --- a/services/caddy/compose.yaml +++ b/services/caddy/compose.yaml @@ -50,12 +50,12 @@ services: - ./site:/srv - ./caddy_data:/data - ./caddy_config:/config - - ./tailscale/tmp/tailscaled.sock:/var/run/tailscale/tailscaled.sock # Mount the Tailscale socket for TLS. + - ./tailscale/tmp:/var/run/tailscale # Share the directory so socket replacement survives Tailscale restarts. depends_on: tailscale: condition: service_healthy healthcheck: - test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running + test: ["CMD", "pgrep", "-x", "caddy"] # The process name is independent of the Tailnet hostname. interval: 1m # How often to perform the check timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy From 85dce1066bcb1ba94d940861deaeada767393cf6 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Mon, 14 Sep 2026 12:46:26 +0200 Subject: [PATCH 3/8] Correct Tracktor allowed origin and Tailnet setup guidance --- services/tracktor/.env | 2 +- services/tracktor/README.md | 4 +++- services/tracktor/compose.yaml | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/services/tracktor/.env b/services/tracktor/.env index 7bba6483..bbc9c71d 100644 --- a/services/tracktor/.env +++ b/services/tracktor/.env @@ -17,7 +17,7 @@ TS_AUTHKEY= # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones TS_TAILNET= -# Your Tailscale tailnet name (e.g., my-tailnet). +# Your Tailnet DNS name without .ts.net (e.g., tail123abc). # Optional Service variables # PUID=1000 diff --git a/services/tracktor/README.md b/services/tracktor/README.md index 9d4bb47f..b6e6934c 100644 --- a/services/tracktor/README.md +++ b/services/tracktor/README.md @@ -35,4 +35,6 @@ network_mode: service:tailscale This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Tracktor web UI is accessible **only via your Tailscale network**. -Set `TS_TAILNET` in `.env` to your Tailnet DNS suffix. Tracktor uses this value to build its allowed browser origin. If you enable the optional host port mapping, it maps `SERVICEPORT` to Tracktor's container port `3000`. +Set `TS_TAILNET` in `.env` to your Tailnet DNS name without `.ts.net`, for example `tail123abc`. Compose appends `.ts.net` to build the allowed browser origin, such as `https://tracktor.tail123abc.ts.net`. + +If you enable the optional host port mapping, it maps `SERVICEPORT` to Tracktor's container port `3000`. diff --git a/services/tracktor/compose.yaml b/services/tracktor/compose.yaml index 9723227d..c16df74f 100644 --- a/services/tracktor/compose.yaml +++ b/services/tracktor/compose.yaml @@ -55,7 +55,7 @@ services: environment: - TRACKTOR_DEMO_MODE=false - FORCE_DATA_SEED=false - - CORS_ORIGINS="https://${SERVICE}.${TS_TAILNET}.ts.net" # Adjust as needed for your setup + - CORS_ORIGINS=https://${SERVICE}.${TS_TAILNET}.ts.net # Adjust as needed for your setup volumes: - ./${SERVICE}-data:/data depends_on: From 40264c7f5dbeaffcc7074f30bc73c931ab43ec7d Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Mon, 14 Sep 2026 12:46:26 +0200 Subject: [PATCH 4/8] Use explicit anchors for emoji headings in the service catalog --- README.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 622344fb..07ab350f 100644 --- a/README.md +++ b/README.md @@ -51,11 +51,11 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose - [🎥 Media and Entertainment](#-media-and-entertainment) - [💼 Productivity and Collaboration](#-productivity-and-collaboration) - [📊 Dashboards and Visualization](#-dashboards-and-visualization) - - [🛠️ Development Tools](#-development-tools) + - [🛠️ Development Tools](#development-tools) - [📈 Monitoring and Analytics](#-monitoring-and-analytics) - [🏠 Smart Home](#-smart-home) - [📱 Utilities](#-utilities) - - [🍽️ Food \& Wellness](#-food--wellness) + - [🍽️ Food \& Wellness](#food-wellness) - [Tailscale Information](#tailscale-information) - [Tailscale Funnel vs. Tailscale Serve](#tailscale-funnel-vs-tailscale-serve) - [Tailscale Funnel](#tailscale-funnel) @@ -174,6 +174,8 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 🏠 **Homepage** | A modern, highly customizable homepage for organizing links and monitoring services. | [Details](services/homepage) | | 🖼️ **NewWallpaperWhoDis** | A lightweight, self-hosted wallpaper management server and dynamic rotation engine built on flat-file architecture. | [Details](services/newwallpaperwhodis) | + + ### 🛠️ Development Tools | 🛠️ Service | 📝 Description | 🔗 Link | @@ -227,6 +229,8 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 🚗 **Tracktor** | Self-hosted vehicle maintenance tracker. | [Details](services/tracktor) | | 🔁 **Transmute** | A self-hosted file conversion and transformation service for handling documents, media, and other format changes. | [Details](services/transmute) | + + ### 🍽️ Food & Wellness | 🥘 Service | 📝 Description | 🔗 Link | From 900c8fa2e97fad4eed4a72cbb446517f2f73b373 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Sun, 27 Sep 2026 16:42:02 +0200 Subject: [PATCH 5/8] Normalize .env comments and fix typos across services - Place explanatory comments above empty variables instead of below them, matching the existing convention in linkding, pocket-id, and tandoor. - Fix the Radicale auth key placeholder, which sent "..." as TS_AUTHKEY. - Move Tracktor's TS_TAILNET into the Tailscale section. - Set SERVICEPORT for Dockge, EspoCRM, and Seafile so the commented port mapping works when enabled. - Use the template's TZ sample value and header everywhere, and align Paperless's own time zone setting with TZ. - Point SearXNG's Valkey URL at the Compose service name. - Fix "varibale", "hostnme", "ctainer", "intial", and other typos, and restore "EPs" and the row alignment in the root catalog. - Document that Configarr runs one sync and exits. Co-Authored-By: Claude Opus 5.5 (1M context) --- README.md | 2 +- services/actual-budget/.env | 6 +++--- services/adguardhome-sync/.env | 4 ++-- services/adguardhome/.env | 4 ++-- services/affine/.env | 4 ++-- services/anchor/.env | 6 +++--- services/arcane/.env | 8 ++++---- services/artisttrackarr/.env | 4 ++-- services/audiobookshelf/.env | 4 ++-- services/bazarr/.env | 4 ++-- services/bentopdf/.env | 4 ++-- services/beszel-agent/.env | 4 ++-- services/beszel-hub/.env | 4 ++-- services/booklore/.env | 12 ++++++------ services/caddy/.env | 4 ++-- services/changedetection/.env | 4 ++-- services/clipcascade/.env | 4 ++-- services/coder/.env | 4 ++-- services/configarr/.env | 4 ++-- services/configarr/README.md | 2 ++ services/convertx/.env | 4 ++-- services/copyparty/.env | 4 ++-- services/cyberchef/.env | 4 ++-- services/ddns-updater/.env | 4 ++-- services/dockge/.env | 5 ++--- services/dockhand/.env | 6 +++--- services/docmost/.env | 4 ++-- services/donetick/.env | 4 ++-- services/dozzle/.env | 4 ++-- services/dumbdo/.env | 4 ++-- services/eigenfocus/.env | 4 ++-- services/espocrm/.env | 9 ++++----- services/excalidraw/.env | 4 ++-- services/filebrowser/.env | 4 ++-- services/flaresolverr/.env | 4 ++-- services/flatnotes/.env | 4 ++-- services/forgejo/.env | 4 ++-- services/formbricks/.env | 4 ++-- services/fossflow/.env | 4 ++-- services/freshrss/.env | 2 +- services/frigate/.env | 6 +++--- services/ghost/.env | 4 ++-- services/gitea/.env | 4 ++-- services/gitsave/.env | 4 ++-- services/glance/.env | 4 ++-- services/gokapi/.env | 4 ++-- services/gotify/.env | 4 ++-- services/grampsweb/.env | 4 ++-- services/haptic/.env | 4 ++-- services/hemmelig/.env | 4 ++-- services/homarr/.env | 4 ++-- services/home-assistant/.env | 4 ++-- services/homebox/.env | 6 +++--- services/homepage/.env | 4 ++-- services/hytale/.env | 6 +++--- services/immich/.env | 4 ++-- services/isley/.env | 4 ++-- services/it-tools/.env | 4 ++-- services/jellyfin/.env | 4 ++-- services/kaneo/.env | 6 +++--- services/karakeep/.env | 6 +++--- services/kavita/.env | 4 ++-- services/kitchenowl/.env | 8 ++++---- services/languagetool/.env | 4 ++-- services/linkding/.env | 4 ++-- services/linkding/.linkding.env | 2 +- services/lube-logger/.env | 4 ++-- services/mailpit/.env | 4 ++-- services/mattermost/.env | 4 ++-- services/mealie/.env | 4 ++-- services/memos/.env | 6 +++--- services/metube/.env | 4 ++-- services/minecraft/.env | 4 ++-- services/miniflux/.env | 6 +++--- services/miniqr/.env | 4 ++-- services/nanote/.env | 4 ++-- services/navidrome/.env | 4 ++-- services/nessus/.env | 4 ++-- services/netbox/.env | 6 +++--- services/newwallpaperwhodis/.env | 2 +- services/next-explorer/.env | 6 +++--- services/nodered/.env | 4 ++-- services/ntfy/.env | 4 ++-- services/ollama/.env | 6 +++--- services/open-webui/.env | 6 +++--- services/paperless/.env | 8 ++++---- services/picard/.env | 6 +++--- services/pihole/.env | 4 ++-- services/pingvin-share/.env | 4 ++-- services/plex/.env | 4 ++-- services/pocket-id/.env | 4 ++-- services/portainer/.env | 4 ++-- services/portracker/.env | 4 ++-- services/posterizarr/.env | 4 ++-- services/prowlarr/.env | 4 ++-- services/qbittorrent/.env | 4 ++-- services/radarr/.env | 4 ++-- services/radicale/.env | 3 ++- services/recyclarr/.env | 4 ++-- services/resilio-sync/.env | 4 ++-- services/rustdesk-server/.env | 4 ++-- services/seafile/.env | 15 +++++++-------- services/seafile/README.md | 2 +- services/searxng/.env | 8 ++++---- services/seerr/.env | 4 ++-- services/slink/.env | 4 ++-- services/sonarr/.env | 4 ++-- services/speedtest-tracker/.env | 4 ++-- services/stirlingpdf/.env | 4 ++-- services/subtrackr/.env | 4 ++-- services/sure/.env | 10 +++++----- services/swingmx/.env | 4 ++-- services/tailscale-app-connector-node/.env | 4 ++-- services/tailscale-exit-node/.env | 6 +++--- services/tailscale-subnet-router-node/.env | 6 +++--- services/tautulli/.env | 4 ++-- services/technitium/.env | 4 ++-- services/tracktor/.env | 11 ++++++----- services/traefik/.env | 4 ++-- services/transmute/.env | 6 +++--- services/uptime-kuma/.env | 4 ++-- services/vaultwarden/.env | 4 ++-- services/vikunja/.env | 8 ++++---- services/wallos/.env | 4 ++-- services/xwiki/.env | 4 ++-- templates/service-template/.env | 12 ++++++------ 126 files changed, 297 insertions(+), 296 deletions(-) diff --git a/README.md b/README.md index 383c0008..07ab350f 100644 --- a/README.md +++ b/README.md @@ -92,7 +92,7 @@ ScaleTail provides ready-to-run [Docker Compose](https://docs.docker.com/compose | 🎥 Service | 📝 Description | 🔗 Link | | -------------------- | ------------------------------------------------------------------------------------------------------- | ---------------------------------- | -| 🎵 **ArtistTrackarr** | A self-hosted dashboard for tracking upcoming and newly released albums and EP's. | [Details](services/artisttrackarr) | +| 🎵 **ArtistTrackarr** | A self-hosted dashboard for tracking upcoming and newly released albums and EPs. | [Details](services/artisttrackarr) | | 🎧 **Audiobookshelf** | A self-hosted audiobook and podcast server with multi-user support and playback syncing. | [Details](services/audiobookshelf) | | 🎥 **Bazarr** | A companion tool to Radarr and Sonarr for managing subtitles. | [Details](services/bazarr) | | 📚 **BookLore** | A self-hosted application for managing and reading books. | [Details](services/booklore) | diff --git a/services/actual-budget/.env b/services/actual-budget/.env index d49fe2b0..9107e8cf 100644 --- a/services/actual-budget/.env +++ b/services/actual-budget/.env @@ -11,13 +11,13 @@ SERVICEPORT=5006 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/adguardhome-sync/.env b/services/adguardhome-sync/.env index c03156f2..5743c44a 100644 --- a/services/adguardhome-sync/.env +++ b/services/adguardhome-sync/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/adguardhome/.env b/services/adguardhome/.env index b2b89159..bc2788d9 100644 --- a/services/adguardhome/.env +++ b/services/adguardhome/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/affine/.env b/services/affine/.env index c14b19e5..e7d3c64d 100644 --- a/services/affine/.env +++ b/services/affine/.env @@ -11,10 +11,10 @@ SERVICEPORT=3010 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # select a revision to deploy, available values: stable, beta, canary diff --git a/services/anchor/.env b/services/anchor/.env index c8bc01e1..45e18299 100644 --- a/services/anchor/.env +++ b/services/anchor/.env @@ -11,13 +11,13 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/arcane/.env b/services/arcane/.env index 8929be84..20cc1e4a 100644 --- a/services/arcane/.env +++ b/services/arcane/.env @@ -11,14 +11,14 @@ SERVICEPORT=3552 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables -TAILNET_NAME= # for example: tail-scale +TAILNET_NAME= -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/artisttrackarr/.env b/services/artisttrackarr/.env index ae57838c..124a66e0 100644 --- a/services/artisttrackarr/.env +++ b/services/artisttrackarr/.env @@ -11,13 +11,13 @@ SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ diff --git a/services/audiobookshelf/.env b/services/audiobookshelf/.env index 5409ba97..2f3fccbd 100644 --- a/services/audiobookshelf/.env +++ b/services/audiobookshelf/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/bazarr/.env b/services/bazarr/.env index 5aa35477..7d1477db 100644 --- a/services/bazarr/.env +++ b/services/bazarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/bentopdf/.env b/services/bentopdf/.env index 273069a4..90245a07 100644 --- a/services/bentopdf/.env +++ b/services/bentopdf/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/beszel-agent/.env b/services/beszel-agent/.env index 4d2a035c..bec65f90 100644 --- a/services/beszel-agent/.env +++ b/services/beszel-agent/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/beszel-hub/.env b/services/beszel-hub/.env index b52819b0..451c8a9d 100644 --- a/services/beszel-hub/.env +++ b/services/beszel-hub/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/booklore/.env b/services/booklore/.env index 5e024870..3dca7f40 100644 --- a/services/booklore/.env +++ b/services/booklore/.env @@ -11,20 +11,20 @@ SERVICEPORT=6060 DNS_SERVER=9.9.9.9 # Tailscale Configuration +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. TS_AUTHKEY= -# Add your TS authkey -# Time Zone setting for containers -TZ=Europe/Paris # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +# Time Zone setting for containers +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # MariaDB Credentials -MYSQL_ROOT_PASSWORD= # Use a strong password for the databases root user, should be different from MYSQL_PASSWORD +MYSQL_ROOT_PASSWORD= MYSQL_DATABASE=booklore MYSQL_USER=booklore -MYSQL_PASSWORD= # Use a strong password; must match DATABASE_PASSWORD defined in the booklore container +MYSQL_PASSWORD= -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/caddy/.env b/services/caddy/.env index 494f6108..693b93e0 100644 --- a/services/caddy/.env +++ b/services/caddy/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/changedetection/.env b/services/changedetection/.env index 394f9375..b25f4cd1 100644 --- a/services/changedetection/.env +++ b/services/changedetection/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/clipcascade/.env b/services/clipcascade/.env index 939bec9f..a16e8f09 100644 --- a/services/clipcascade/.env +++ b/services/clipcascade/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/coder/.env b/services/coder/.env index 7584c568..d2705617 100644 --- a/services/coder/.env +++ b/services/coder/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -25,4 +25,4 @@ POSTGRES_PASSWORD=strongpassword POSTGRES_DB=coder CODER_ACCESS_URL=https://coder..ts.net -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/configarr/.env b/services/configarr/.env index d5329758..db220f74 100644 --- a/services/configarr/.env +++ b/services/configarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/configarr/README.md b/services/configarr/README.md index 163980f6..f37df56e 100644 --- a/services/configarr/README.md +++ b/services/configarr/README.md @@ -36,4 +36,6 @@ network_mode: service:tailscale This setup ensures that **all Configarr network traffic flows exclusively through the Tailscale interface**, allowing it to securely communicate with Radarr and Sonarr instances that are also connected via Tailscale. No ports need to be exposed, and the service remains completely inaccessible from the public Internet. +The Configarr container runs one sync and then exits, so the Compose file uses `restart: "no"`. To run it on a schedule, trigger `docker compose up application` from cron or another scheduler. + With this configuration, Configarr can safely enforce and maintain your desired media configuration state — privately, securely, and reproducibly. diff --git a/services/convertx/.env b/services/convertx/.env index fd865a25..ac8418ad 100644 --- a/services/convertx/.env +++ b/services/convertx/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/copyparty/.env b/services/copyparty/.env index 62c2472f..cca550be 100644 --- a/services/copyparty/.env +++ b/services/copyparty/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/cyberchef/.env b/services/cyberchef/.env index b0b32531..c7b3e696 100644 --- a/services/cyberchef/.env +++ b/services/cyberchef/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/ddns-updater/.env b/services/ddns-updater/.env index 938195e2..a1584122 100644 --- a/services/ddns-updater/.env +++ b/services/ddns-updater/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/dockge/.env b/services/dockge/.env index 13228942..0b0ab129 100644 --- a/services/dockge/.env +++ b/services/dockge/.env @@ -7,13 +7,12 @@ SERVICE=dockge # Service name (e.g., adguard). Used as hostname in Tailscale and IMAGE_URL=louislam/dockge:1 # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT= -# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT=5001 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables STACKS_DIR=/opt/stacks diff --git a/services/dockhand/.env b/services/dockhand/.env index d8a71bf3..a8c411d3 100644 --- a/services/dockhand/.env +++ b/services/dockhand/.env @@ -11,13 +11,13 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/docmost/.env b/services/docmost/.env index 10dfbdf4..cbf62118 100644 --- a/services/docmost/.env +++ b/services/docmost/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/donetick/.env b/services/donetick/.env index 2988a77a..dc1df097 100644 --- a/services/donetick/.env +++ b/services/donetick/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/dozzle/.env b/services/dozzle/.env index 0568563d..ba7a7b34 100644 --- a/services/dozzle/.env +++ b/services/dozzle/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/dumbdo/.env b/services/dumbdo/.env index 1ff7a70b..24b8b9e2 100644 --- a/services/dumbdo/.env +++ b/services/dumbdo/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/eigenfocus/.env b/services/eigenfocus/.env index 64a5045b..7e61052e 100644 --- a/services/eigenfocus/.env +++ b/services/eigenfocus/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/espocrm/.env b/services/espocrm/.env index b931fc23..4d978c64 100644 --- a/services/espocrm/.env +++ b/services/espocrm/.env @@ -7,23 +7,22 @@ SERVICE=espocrm # Service name (e.g., adguard). Used as hostname in Tailscale an IMAGE_URL=espocrm/espocrm # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT= -# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" TS_DOMAIN=.ts.net diff --git a/services/excalidraw/.env b/services/excalidraw/.env index 8ee7adef..1571e5cb 100644 --- a/services/excalidraw/.env +++ b/services/excalidraw/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/filebrowser/.env b/services/filebrowser/.env index a6425982..2dec50da 100644 --- a/services/filebrowser/.env +++ b/services/filebrowser/.env @@ -3,7 +3,7 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE=filebrowser # Service name (e.g., adguard). Used as hostnme in Tailscale and for ctainer naming (app-${SERVICE}). +SERVICE=filebrowser # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). IMAGE_URL=filebrowser/filebrowser:s6 # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration @@ -11,8 +11,8 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones diff --git a/services/flaresolverr/.env b/services/flaresolverr/.env index 3ec266d3..8bb988a9 100644 --- a/services/flaresolverr/.env +++ b/services/flaresolverr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/flatnotes/.env b/services/flatnotes/.env index edb0c494..0e23715b 100644 --- a/services/flatnotes/.env +++ b/services/flatnotes/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -25,4 +25,4 @@ FLATNOTES_USERNAME=user FLATNOTES_PASSWORD=changeMe! FLATNOTES_SECRET_KEY=aLongRandomSeriesOfCharacters -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/forgejo/.env b/services/forgejo/.env index 0e242992..d0b77995 100644 --- a/services/forgejo/.env +++ b/services/forgejo/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/formbricks/.env b/services/formbricks/.env index 9e5388ce..7735cd65 100644 --- a/services/formbricks/.env +++ b/services/formbricks/.env @@ -11,10 +11,10 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables diff --git a/services/fossflow/.env b/services/fossflow/.env index dac5e6bb..152d0afc 100644 --- a/services/fossflow/.env +++ b/services/fossflow/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/freshrss/.env b/services/freshrss/.env index ee2693f1..4c17aeb1 100644 --- a/services/freshrss/.env +++ b/services/freshrss/.env @@ -15,8 +15,8 @@ TS_AUTHKEY= # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TAILNET_NAME= # Include the ".ts.net" if it is part of your Tailnet name +TAILNET_NAME= # FreshRSS Configuration # You must set these before the first start. They are only applied while the data diff --git a/services/frigate/.env b/services/frigate/.env index d4890877..a5e70557 100644 --- a/services/frigate/.env +++ b/services/frigate/.env @@ -11,13 +11,13 @@ SERVICEPORT=8971 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/ghost/.env b/services/ghost/.env index 5a6d7b51..93b30d2f 100644 --- a/services/ghost/.env +++ b/services/ghost/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -22,4 +22,4 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Public URL used by Ghost to build links and redirects. Replace the placeholder with your Tailnet hostname. GHOST_URL=https://ghost..ts.net -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/gitea/.env b/services/gitea/.env index 10e24d48..95f71218 100644 --- a/services/gitea/.env +++ b/services/gitea/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/gitsave/.env b/services/gitsave/.env index e8858d08..c68b4216 100644 --- a/services/gitsave/.env +++ b/services/gitsave/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -24,4 +24,4 @@ JWT_SECRET="REPLACE_THIS" DISABLE_AUTH=false ENCRYPTION_SECRET="REPLACE_THIS_WITH_32_CHARACTERS_SECRET" -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/glance/.env b/services/glance/.env index 25c787e5..5493b3f0 100644 --- a/services/glance/.env +++ b/services/glance/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/gokapi/.env b/services/gokapi/.env index b6c2d484..e132278e 100644 --- a/services/gokapi/.env +++ b/services/gokapi/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/gotify/.env b/services/gotify/.env index 4aad5555..27805bd6 100644 --- a/services/gotify/.env +++ b/services/gotify/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/grampsweb/.env b/services/grampsweb/.env index 292211dc..3cccf44d 100644 --- a/services/grampsweb/.env +++ b/services/grampsweb/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/haptic/.env b/services/haptic/.env index e436d1f3..7aec35ce 100644 --- a/services/haptic/.env +++ b/services/haptic/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/hemmelig/.env b/services/hemmelig/.env index 45fdf998..cc5d3977 100644 --- a/services/hemmelig/.env +++ b/services/hemmelig/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/homarr/.env b/services/homarr/.env index 59e7e882..24b16bd5 100644 --- a/services/homarr/.env +++ b/services/homarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/home-assistant/.env b/services/home-assistant/.env index dfbd3933..1a83ff15 100644 --- a/services/home-assistant/.env +++ b/services/home-assistant/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/homebox/.env b/services/homebox/.env index 8b26cd80..6947915d 100644 --- a/services/homebox/.env +++ b/services/homebox/.env @@ -11,13 +11,13 @@ SERVICEPORT=7745 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/homepage/.env b/services/homepage/.env index 367438e2..bae1b0e8 100644 --- a/services/homepage/.env +++ b/services/homepage/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -21,4 +21,4 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim TAILNET_NAME= -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/hytale/.env b/services/hytale/.env index 73f5a89b..ad983a19 100644 --- a/services/hytale/.env +++ b/services/hytale/.env @@ -13,8 +13,8 @@ DNS_SERVER=1.1.1.1 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers -TZ=US/Eastern # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +# Time Zone setting for containers +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Hytale Configuration SERVER_IP=0.0.0.0 @@ -22,4 +22,4 @@ SERVER_PORT=5520 PROD=FALSE DEBUG=FALSE -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/immich/.env b/services/immich/.env index 2fe63f51..c683e938 100644 --- a/services/immich/.env +++ b/services/immich/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Custom Immich - https://immich.app/docs/install/docker-compose @@ -42,4 +42,4 @@ DB_PASSWORD=postgres DB_USERNAME=postgres DB_DATABASE_NAME=immich -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/isley/.env b/services/isley/.env index d9b7f9e5..4859679e 100644 --- a/services/isley/.env +++ b/services/isley/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/it-tools/.env b/services/it-tools/.env index 29217ab4..59f3b619 100644 --- a/services/it-tools/.env +++ b/services/it-tools/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/jellyfin/.env b/services/jellyfin/.env index 6c773dd0..48a70b33 100644 --- a/services/jellyfin/.env +++ b/services/jellyfin/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/kaneo/.env b/services/kaneo/.env index f03f0320..0978f2dc 100644 --- a/services/kaneo/.env +++ b/services/kaneo/.env @@ -16,13 +16,13 @@ SERVICEPORT_DATABASE=5432 DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ @@ -40,4 +40,4 @@ DB_USERNAME=kaneo DB_DATABASE_NAME=kaneo DB_PASSWORD= -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/karakeep/.env b/services/karakeep/.env index 8eb3df54..0255c8b7 100644 --- a/services/karakeep/.env +++ b/services/karakeep/.env @@ -4,8 +4,8 @@ # Service Configuration SERVICE=karakeep -IMAGE_URL= # Docker image URL from container registry (e.g., adguard/adguard-home). +IMAGE_URL= # Network Configuration SERVICEPORT=3000 @@ -14,7 +14,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -29,4 +29,4 @@ MAX_ASSET_SIZE_MB=50 DISABLE_SIGNUPS=false DISABLE_PASSWORD_AUTH=false -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/kavita/.env b/services/kavita/.env index ee12bba1..c74dc854 100644 --- a/services/kavita/.env +++ b/services/kavita/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/kitchenowl/.env b/services/kitchenowl/.env index 670260b1..7473b23d 100755 --- a/services/kitchenowl/.env +++ b/services/kitchenowl/.env @@ -11,19 +11,19 @@ SERVICEPORT=8080 DNS_SERVER=9.9.9.9 # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" -JWT_SECRET_KEY= # Generate a random string for JWT secret key, e.g., using: openssl rand -base64 32 +JWT_SECRET_KEY= FRONT_URL=https://kitchenowl..ts.net # the exact URL of your kitchenowl instance, required when using OIDC authentication, e.g https://kitchenowl.example.com #OIDC_ISSUER= # your OIDC issuer, e.g https://accounts.google.com diff --git a/services/languagetool/.env b/services/languagetool/.env index c3a3512b..ac27dda8 100644 --- a/services/languagetool/.env +++ b/services/languagetool/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/linkding/.env b/services/linkding/.env index df5694e8..f0b1a3be 100644 --- a/services/linkding/.env +++ b/services/linkding/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/linkding/.linkding.env b/services/linkding/.linkding.env index 37fdbd5a..3d188246 100644 --- a/services/linkding/.linkding.env +++ b/services/linkding/.linkding.env @@ -46,4 +46,4 @@ LD_DB_HOST= # Should use the default port if not set LD_DB_PORT= # Any additional options to pass to the database (default: {}) -LD_DB_OPTIONS= \ No newline at end of file +LD_DB_OPTIONS= diff --git a/services/lube-logger/.env b/services/lube-logger/.env index 446b925c..4b48ea73 100644 --- a/services/lube-logger/.env +++ b/services/lube-logger/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -30,4 +30,4 @@ LUBELOGGER_DOMAIN="lubelogger..ts.net" #MailConfig__Password="" #LOGGING__LOGLEVEL__DEFAULT=Error -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/mailpit/.env b/services/mailpit/.env index 050ce1de..5910b483 100644 --- a/services/mailpit/.env +++ b/services/mailpit/.env @@ -11,13 +11,13 @@ SERVICEPORT=8025 # Mailpit web port. It is not exposed locally; Tailscale Serve DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ diff --git a/services/mattermost/.env b/services/mattermost/.env index 5b2868de..c1d2b25a 100644 --- a/services/mattermost/.env +++ b/services/mattermost/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" se # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -61,4 +61,4 @@ POSTGRES_DB=mattermost MM_SQLSETTINGS_DRIVERNAME=postgres MM_SQLSETTINGS_DATASOURCE=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db-${SERVICE}:5432/${POSTGRES_DB}?sslmode=disable&connect_timeout=10 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/mealie/.env b/services/mealie/.env index 1b98930f..c2cfb530 100644 --- a/services/mealie/.env +++ b/services/mealie/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/memos/.env b/services/memos/.env index 483f7993..b4ba42c8 100644 --- a/services/memos/.env +++ b/services/memos/.env @@ -11,13 +11,13 @@ SERVICEPORT=5230 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/metube/.env b/services/metube/.env index 31f7e7ec..dc1b7b2e 100644 --- a/services/metube/.env +++ b/services/metube/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/minecraft/.env b/services/minecraft/.env index a9f03607..4ebd668d 100644 --- a/services/minecraft/.env +++ b/services/minecraft/.env @@ -11,13 +11,13 @@ SERVICEPORT=25565 # Port to expose to local network. Uncomment the "ports:" sect DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ diff --git a/services/miniflux/.env b/services/miniflux/.env index 6f21666d..68f9808e 100644 --- a/services/miniflux/.env +++ b/services/miniflux/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TAILNET_NAME= # Include the ".ts.net" if it is part of your Tailnet name +TAILNET_NAME= # Miniflux Configuration # You must set these @@ -27,4 +27,4 @@ POSTGRES_USER=miniflux POSTGRES_PASSWORD= POSTGRES_DB=miniflux -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/miniqr/.env b/services/miniqr/.env index 7a2d28d6..70be8663 100644 --- a/services/miniqr/.env +++ b/services/miniqr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/nanote/.env b/services/nanote/.env index 92aa9eee..4bd55a6d 100644 --- a/services/nanote/.env +++ b/services/nanote/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/navidrome/.env b/services/navidrome/.env index b0e74ea3..f87952f1 100644 --- a/services/navidrome/.env +++ b/services/navidrome/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/nessus/.env b/services/nessus/.env index 454aba64..8b451dab 100644 --- a/services/nessus/.env +++ b/services/nessus/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/netbox/.env b/services/netbox/.env index 323875a9..3bbb48b8 100644 --- a/services/netbox/.env +++ b/services/netbox/.env @@ -11,10 +11,10 @@ SERVICEPORT=8080 DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. TS_AUTHKEY= -# your tailscale authentication key -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -64,4 +64,4 @@ POSTGRES_DB=netbox POSTGRES_PASSWORD=${SUPER_SECRET}DB POSTGRES_USER=netbox -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/newwallpaperwhodis/.env b/services/newwallpaperwhodis/.env index 4bcc2b4c..9c990343 100644 --- a/services/newwallpaperwhodis/.env +++ b/services/newwallpaperwhodis/.env @@ -11,8 +11,8 @@ SERVICEPORT=6767 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 diff --git a/services/next-explorer/.env b/services/next-explorer/.env index e10d8890..2e4ee85c 100644 --- a/services/next-explorer/.env +++ b/services/next-explorer/.env @@ -11,14 +11,14 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables PUID=1000 PGID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ @@ -27,4 +27,4 @@ ACCESS_PATH=/home/root/data # Change this to the path you want to share with Tai SESSION_SECRET=your-super-secret # Use 'openssl rand -base64 32' in your CLI to generate a secure random key. PUBLIC_URL=https://file-explorer..ts.net # Optional: Set this to the public URL of your service if needed for correct URL generation in the app. For example, if you are exposing the service at https://example.com, set PUBLIC_URL=https://example.com. -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/nodered/.env b/services/nodered/.env index 03dcab80..d7740427 100644 --- a/services/nodered/.env +++ b/services/nodered/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/ntfy/.env b/services/ntfy/.env index 79ae02b7..e6d9a1f3 100644 --- a/services/ntfy/.env +++ b/services/ntfy/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/ollama/.env b/services/ollama/.env index 9df39204..13391479 100644 --- a/services/ollama/.env +++ b/services/ollama/.env @@ -11,14 +11,14 @@ SERVICEPORT=11434 # Ollama's default API port. Uncomment the "ports:" section in DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ # Ollama-specific variables # OLLAMA_API_KEY= # Optional: set a secret key to restrict API access (leave blank to disable auth) -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/open-webui/.env b/services/open-webui/.env index e2e9e390..3b7dbf3a 100644 --- a/services/open-webui/.env +++ b/services/open-webui/.env @@ -11,8 +11,8 @@ SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Open WebUI Configuration # Point to your Ollama instance - can be local or remote. @@ -22,8 +22,8 @@ TS_AUTHKEY= # Ollama over Tailnet: http://100.x.x.x:11434 # Leave blank to configure a different provider (e.g. OpenAI) via the UI. OLLAMA_BASE_URL=http://host.docker.internal:11434 -WEBUI_SECRET_KEY= # Random secret key for session security. Generate with: openssl rand -hex 32 +WEBUI_SECRET_KEY= TZ=Europe/Amsterdam # Timezone for the container. -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/paperless/.env b/services/paperless/.env index 381b8adb..1916ab28 100644 --- a/services/paperless/.env +++ b/services/paperless/.env @@ -11,16 +11,16 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -PAPERLESS_TIME_ZONE=Europe/London +PAPERLESS_TIME_ZONE=Europe/Amsterdam PAPERLESS_OCR_LANGUAGE=eng PAPERLESS_SECRET_KEY='change this to any random sting' #https://docs.paperless-ngx.com/configuration/#PAPERLESS_SECRET_KEY PAPERLESS_ADMIN_USER=admin @@ -28,4 +28,4 @@ PAPERLESS_ADMIN_PASSWORD=changeme POSTGRES_USER=paperless POSTGRES_PASSWORD=paperless -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/picard/.env b/services/picard/.env index 405227b5..cd5d32a5 100644 --- a/services/picard/.env +++ b/services/picard/.env @@ -11,13 +11,13 @@ SERVICEPORT=5800 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/pihole/.env b/services/pihole/.env index c711cedf..e4fd3c96 100644 --- a/services/pihole/.env +++ b/services/pihole/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/pingvin-share/.env b/services/pingvin-share/.env index 898c8a00..c583bab7 100644 --- a/services/pingvin-share/.env +++ b/services/pingvin-share/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/plex/.env b/services/plex/.env index c57df591..168cf607 100644 --- a/services/plex/.env +++ b/services/plex/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/pocket-id/.env b/services/pocket-id/.env index e890aeb2..22c0b6cc 100644 --- a/services/pocket-id/.env +++ b/services/pocket-id/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # See the documentation for more information: https://pocket-id.org/docs/configuration/environment-variables @@ -36,4 +36,4 @@ MAXMIND_LICENSE_KEY= PUID=1000 PGID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/portainer/.env b/services/portainer/.env index 1e901ff5..21bc1531 100644 --- a/services/portainer/.env +++ b/services/portainer/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/portracker/.env b/services/portracker/.env index 31ec3c98..84d8d198 100644 --- a/services/portracker/.env +++ b/services/portracker/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/posterizarr/.env b/services/posterizarr/.env index cea35b11..4af8f53d 100644 --- a/services/posterizarr/.env +++ b/services/posterizarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/prowlarr/.env b/services/prowlarr/.env index ba759b0b..9527d741 100644 --- a/services/prowlarr/.env +++ b/services/prowlarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/qbittorrent/.env b/services/qbittorrent/.env index bcf3d0b4..1e2d65cb 100644 --- a/services/qbittorrent/.env +++ b/services/qbittorrent/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/radarr/.env b/services/radarr/.env index 4a4c4d75..fcd67441 100644 --- a/services/radarr/.env +++ b/services/radarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/radicale/.env b/services/radicale/.env index 199dbfe9..ecc1cc24 100644 --- a/services/radicale/.env +++ b/services/radicale/.env @@ -11,7 +11,8 @@ SERVICEPORT=5232 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY=... # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +# Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 diff --git a/services/recyclarr/.env b/services/recyclarr/.env index 01ed5606..4cee0618 100644 --- a/services/recyclarr/.env +++ b/services/recyclarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/resilio-sync/.env b/services/resilio-sync/.env index d3c604cb..7e1a7a8d 100644 --- a/services/resilio-sync/.env +++ b/services/resilio-sync/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/rustdesk-server/.env b/services/rustdesk-server/.env index f5616f25..e0d6c194 100644 --- a/services/rustdesk-server/.env +++ b/services/rustdesk-server/.env @@ -11,8 +11,8 @@ SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 @@ -23,4 +23,4 @@ TZ=Europe/Amsterdam # Always use the relay. As this is run in tailnet and relays aren't needed, this setting in most cases should remain off. ALWAYS_USE_RELAY=N -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/seafile/.env b/services/seafile/.env index 759e90bc..20090c53 100644 --- a/services/seafile/.env +++ b/services/seafile/.env @@ -9,23 +9,22 @@ SEAFILE_DB_IMAGE=mariadb:10.11 SEAFILE_MEMCACHED_IMAGE=memcached:1.6.29 # Network Configuration -SERVICEPORT= -# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers -TZ=Europe/London # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +# Time Zone setting for containers +TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" SEAFILE_VOLUME=./seafile-data SEAFILE_MYSQL_VOLUME=./db SEAFILE_MYSQL_DB_HOST=db @@ -33,11 +32,11 @@ INIT_SEAFILE_MYSQL_ROOT_PASSWORD=REPLACE_WITH_RANDOM_ALPHANUMERIC_PASSWORD SEAFILE_MYSQL_DB_USER=seafile SEAFILE_MYSQL_DB_PASSWORD=REPLACE_WITH_RANDOM_ALPHANUMERIC_PASSWORD TIME_ZONE=Etc/UTC -JWT_PRIVATE_KEY= #A random string with a length of no less than 32 characters, generate example: pwgen -s 40 1 or use openssl rand -base64 40 +JWT_PRIVATE_KEY= SEAFILE_SERVER_HOSTNAME=seafile..ts.net # update with specific MagicDNS suffix SEAFILE_SERVER_PROTOCOL=https -INIT_SEAFILE_ADMIN_EMAIL= ADD_EMAIL_ADDRESS_HERE +INIT_SEAFILE_ADMIN_EMAIL=ADD_EMAIL_ADDRESS_HERE INIT_SEAFILE_ADMIN_PASSWORD=REPLACE_WITH_RANDOM_ALPHANUMERIC_PASSWORD ENABLE_SEADOC=false ENABLE_NOTIFICATION_SERVER=false diff --git a/services/seafile/README.md b/services/seafile/README.md index ace91f5c..3592d4f7 100644 --- a/services/seafile/README.md +++ b/services/seafile/README.md @@ -21,7 +21,7 @@ Please check the following contents for validity as some variables need to be de - `TS_AUTHKEY`: Paste in an Auth Key for your Tailnet. - Volumes: Update the locations for the `SEAFILE_VOLUME` and `SEAFILE_MYSQL_VOLUME` in .ENV. -- Passwords: There are three passwords (for MySQL/MariaDB and intial Seafile administrator) which need to be set in .ENV. +- Passwords: There are three passwords (for MySQL/MariaDB and initial Seafile administrator) which need to be set in .ENV. - Admin Email: Update `INIT_SEAFILE_ADMIN_EMAIL`. This doesn't have to be a valid email address, although you can configure SMTP notifications in Seafile, which will require a valid email address. - `JWT_PRIVATE_KEY`: Generate this by running `pwgen -s 40 1` or `openssl rand -base64 40` - `SEAFILE_SERVER_HOSTNAME`: Update the FQDN to match your Tailnet MagicDNS suffix. diff --git a/services/searxng/.env b/services/searxng/.env index f2fbf62f..96375c9c 100644 --- a/services/searxng/.env +++ b/services/searxng/.env @@ -13,15 +13,15 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones TAILNET_NAME= # Optional Service variables # PUID=1000 -SEARXNG_SECRET= # Generate a random secret for searxng, e.g. using `openssl rand -hex 32` -SEARXNG_VALKEY_URL=valkey://valkey-searxng:6379/0 # URL for valkey, format: valkey://:/ +SEARXNG_SECRET= +SEARXNG_VALKEY_URL=valkey://valkey:6379/0 # URL for valkey, format: valkey://:/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/seerr/.env b/services/seerr/.env index 8dd2a356..6d920a88 100644 --- a/services/seerr/.env +++ b/services/seerr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/slink/.env b/services/slink/.env index a1e4ba93..08ab391d 100644 --- a/services/slink/.env +++ b/services/slink/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/sonarr/.env b/services/sonarr/.env index 1a574fa2..4eef8c42 100644 --- a/services/sonarr/.env +++ b/services/sonarr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/speedtest-tracker/.env b/services/speedtest-tracker/.env index 5eb822c2..0a37173a 100644 --- a/services/speedtest-tracker/.env +++ b/services/speedtest-tracker/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/stirlingpdf/.env b/services/stirlingpdf/.env index 865b0d66..79488069 100644 --- a/services/stirlingpdf/.env +++ b/services/stirlingpdf/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/subtrackr/.env b/services/subtrackr/.env index 36b5072a..1911f31e 100644 --- a/services/subtrackr/.env +++ b/services/subtrackr/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/sure/.env b/services/sure/.env index df561f55..6750b9f8 100755 --- a/services/sure/.env +++ b/services/sure/.env @@ -11,13 +11,13 @@ SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ @@ -34,19 +34,19 @@ POSTGRES_HOST=db # Used by the backup service (on sure_net, Docker DNS works) REDIS_URL=redis://172.28.0.11:6379/1 # Static IP of redis on sure_net (web/worker share tailscale namespace where Docker DNS is overridden by MagicDNS) # Sure Application -SECRET_KEY_BASE= #openssl rand -hex 64 +SECRET_KEY_BASE= SELF_HOSTED=true RAILS_FORCE_SSL=true RAILS_ASSUME_SSL=true # OpenAI (Optional) -OPENAI_ACCESS_TOKEN= # NOTE: enabling OpenAI will incur costs when you use AI-related features in the app (chat, rules) +OPENAI_ACCESS_TOKEN= # OIDC Authentication (Optional) -OIDC_ISSUER= # OIDC issuer URL for authentication +OIDC_ISSUER= OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= OIDC_REDIRECT_URI=https:///auth/openid_connect/callback diff --git a/services/swingmx/.env b/services/swingmx/.env index 78ba5dba..859839bf 100644 --- a/services/swingmx/.env +++ b/services/swingmx/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/tailscale-app-connector-node/.env b/services/tailscale-app-connector-node/.env index 0b319780..85c4c6d6 100644 --- a/services/tailscale-app-connector-node/.env +++ b/services/tailscale-app-connector-node/.env @@ -7,8 +7,8 @@ SERVICE=app-connector IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= DNS_SERVER=9.9.9.9 # Tailscale Configuration @@ -17,7 +17,7 @@ TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ diff --git a/services/tailscale-exit-node/.env b/services/tailscale-exit-node/.env index d6b88a54..60cfe71a 100644 --- a/services/tailscale-exit-node/.env +++ b/services/tailscale-exit-node/.env @@ -7,17 +7,17 @@ SERVICE=exit-node IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/tailscale-subnet-router-node/.env b/services/tailscale-subnet-router-node/.env index dbe219de..f9285774 100644 --- a/services/tailscale-subnet-router-node/.env +++ b/services/tailscale-subnet-router-node/.env @@ -7,8 +7,8 @@ SERVICE=subnet-router IMAGE_URL=tailscale/tailscale # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= DNS_SERVER=9.9.9.9 # Tailscale Configuration @@ -17,7 +17,7 @@ TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ @@ -26,4 +26,4 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Add comma separated list of subnet routes SUBNET_ROUTES=10.1.234.0/24 # See: https://tailscale.com/docs/features/subnet-routers -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/tautulli/.env b/services/tautulli/.env index ec603f81..ba34cb08 100644 --- a/services/tautulli/.env +++ b/services/tautulli/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/technitium/.env b/services/technitium/.env index 0405bfec..cdfb6fcb 100644 --- a/services/technitium/.env +++ b/services/technitium/.env @@ -13,7 +13,7 @@ DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" se # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables @@ -23,4 +23,4 @@ DNS_SERVER1=9.9.9.9 DNS_SERVER2=8.8.4.4 ADMIN_PASSWORD=ChangeME -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/tracktor/.env b/services/tracktor/.env index bbc9c71d..f8699d33 100644 --- a/services/tracktor/.env +++ b/services/tracktor/.env @@ -11,14 +11,15 @@ SERVICEPORT=3333 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= +# Your Tailnet DNS name without .ts.net (e.g., tail123abc). +TS_TAILNET= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones -TS_TAILNET= -# Your Tailnet DNS name without .ts.net (e.g., tail123abc). + # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/traefik/.env b/services/traefik/.env index ecabc10c..d37982a9 100644 --- a/services/traefik/.env +++ b/services/traefik/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/transmute/.env b/services/transmute/.env index ac54f9c5..60e41497 100644 --- a/services/transmute/.env +++ b/services/transmute/.env @@ -11,15 +11,15 @@ SERVICEPORT=3313 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/uptime-kuma/.env b/services/uptime-kuma/.env index 2ef5fe03..0f2e9920 100644 --- a/services/uptime-kuma/.env +++ b/services/uptime-kuma/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/vaultwarden/.env b/services/vaultwarden/.env index e9835090..ca110273 100644 --- a/services/vaultwarden/.env +++ b/services/vaultwarden/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/vikunja/.env b/services/vikunja/.env index a19015c6..2989bcb4 100644 --- a/services/vikunja/.env +++ b/services/vikunja/.env @@ -11,18 +11,18 @@ SERVICEPORT=3456 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" VIKUNJA_SERVICE_PUBLICURL=https://vikunja..ts.net/ -VIKUNJA_DATABASE_PATH=/db/vikunja.db # Path to the SQLite database file. Ensure this path is correctly mapped in your Docker volumes.a +VIKUNJA_DATABASE_PATH=/db/vikunja.db # Path to the SQLite database file. Ensure this path is correctly mapped in your Docker volumes. diff --git a/services/wallos/.env b/services/wallos/.env index d65155bd..03d29164 100644 --- a/services/wallos/.env +++ b/services/wallos/.env @@ -13,10 +13,10 @@ DNS_SERVER=9.9.9.9 # Tailscale Configuration TS_AUTHKEY= -# Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Optional Service variables # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" diff --git a/services/xwiki/.env b/services/xwiki/.env index a63f2893..bf0dd95b 100644 --- a/services/xwiki/.env +++ b/services/xwiki/.env @@ -11,8 +11,8 @@ SERVICEPORT=8080 # Port to expose to local network. Uncomment the "ports:" secti DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones @@ -21,7 +21,7 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # PUID=1000 -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" # Default environment values XWIKI_VERSION=18.2.1 diff --git a/templates/service-template/.env b/templates/service-template/.env index 8e80ebab..2b2ad66b 100644 --- a/templates/service-template/.env +++ b/templates/service-template/.env @@ -3,26 +3,26 @@ #COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure. # Service Configuration -SERVICE= # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). -IMAGE_URL= +SERVICE= # Docker image URL from container registry (e.g., adguard/adguard-home). +IMAGE_URL= # Network Configuration -SERVICEPORT= # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT= DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. # Tailscale Configuration -TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= # Optional Service variables # PUID=1000 -#Time Zone setting for containers +# Time Zone setting for containers TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones # Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ -#EXAMPLE_VAR="Environment varibale" +#EXAMPLE_VAR="Environment variable" From e29090c2ae141a5de8522dab8ade42e85da26996 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Sun, 27 Sep 2026 16:42:02 +0200 Subject: [PATCH 6/8] Align Compose deviations with the service template - Add the health-based Tailscale dependency to the main application of AFFiNE, FlareSolverr, Mattermost, NetBox, next-explorer, and Seafile. - Replace the invalid Configarr restart policy "never" with "no" and restart Recyclarr, whose default entrypoint runs a cron schedule. - Use restart: always for long-running services and add it to database and cache containers that had no restart policy. - Fix AFFiNE's database name, which read an undefined variable instead of DB_DATABASE. - Remove app-level port and DNS blocks that cannot work in the shared network namespace (BookLore, Immich, next-explorer, Seafile). - Comment out the KitchenOwl and Hytale host ports, which contradicted their READMEs and the template. - Remove the unused Serve setting from Caddy, which terminates TLS itself. - Add TS_AUTH_ONCE to MeTube and NetBox and correct their MagicDNS comment. - Drop Ollama's sys_module capability, removed elsewhere in #136. - Scope hard-coded helper container names to ${SERVICE}. - Add missing final newlines and fix a Seafile comment typo. Co-Authored-By: Claude Opus 5.5 (1M context) --- services/affine/compose.yml | 16 +++++++++------- services/booklore/compose.yaml | 8 +++----- services/caddy/compose.yaml | 1 - services/coder/compose.yaml | 1 + services/configarr/compose.yaml | 2 +- services/filebrowser/compose.yml | 2 +- services/flaresolverr/compose.yaml | 7 +++++-- services/formbricks/compose.yaml | 2 ++ services/hytale/compose.yaml | 6 +++--- services/immich/compose.yaml | 2 -- services/kaneo/compose.yaml | 6 +++--- services/kitchenowl/compose.yaml | 6 +++--- services/mailpit/compose.yaml | 2 +- services/mattermost/compose.yaml | 6 ++++-- services/metube/compose.yaml | 3 ++- services/netbox/compose.yaml | 20 +++++++++++++------- services/next-explorer/compose.yaml | 10 ++++------ services/ollama/compose.yaml | 1 - services/recyclarr/compose.yaml | 2 +- services/seafile/compose.yaml | 13 +++++++------ services/searxng/compose.yaml | 4 ++-- services/sure/compose.yaml | 10 +++++----- services/traefik/compose.yaml | 2 +- 23 files changed, 71 insertions(+), 61 deletions(-) diff --git a/services/affine/compose.yml b/services/affine/compose.yml index 498ab8e2..c0bca6cf 100644 --- a/services/affine/compose.yml +++ b/services/affine/compose.yml @@ -53,6 +53,8 @@ services: container_name: app-${SERVICE} # Name for local container management network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale depends_on: + tailscale: + condition: service_healthy redis: condition: service_healthy postgres: @@ -68,14 +70,14 @@ services: environment: # Variables are declared in .env file. - REDIS_SERVER_HOST=redis - - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${postgres:-affine} + - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${DB_DATABASE:-affine} - AFFINE_INDEXER_ENABLED=false #- EXAMPLE_VAR=${EXAMPLE_VAR} restart: always affine_migration: image: ghcr.io/toeverything/affine:${AFFINE_REVISION:-stable} # Image to be used - container_name: affine_migration_job # Name for local container management + container_name: app-${SERVICE}-migration # Name for local container management volumes: # custom configurations - ./${SERVICE}-storage:/root/.affine/storage @@ -86,7 +88,7 @@ services: environment: # Variables are declared in .env file. - REDIS_SERVER_HOST=redis - - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${postgres:-affine} + - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${DB_DATABASE:-affine} - AFFINE_INDEXER_ENABLED=false #- EXAMPLE_VAR=${EXAMPLE_VAR} depends_on: @@ -97,7 +99,7 @@ services: redis: image: redis # Image to be used - container_name: affine_redis # Name for local container management + container_name: app-${SERVICE}-redis # Name for local container management healthcheck: test: [ 'CMD', 'redis-cli', '--raw', 'incr', 'ping' ] # Check if redis process is running interval: 10s # How often to perform the check @@ -107,21 +109,21 @@ services: postgres: image: pgvector/pgvector:pg16 # Image to be used - container_name: affine_postgres # Name for local container management + container_name: app-${SERVICE}-postgres # Name for local container management volumes: - ./postgres:/var/lib/postgresql/data environment: # Variables are declared in .env file. POSTGRES_USER: ${DB_USERNAME} POSTGRES_PASSWORD: ${DB_PASSWORD} - POSTGRES_DB: ${postgres:-affine} + POSTGRES_DB: ${DB_DATABASE:-affine} POSTGRES_INITDB_ARGS: '--data-checksums' # you better set a password for you database # or you may add 'POSTGRES_HOST_AUTH_METHOD=trust' to ignore postgres security policy POSTGRES_HOST_AUTH_METHOD: trust #- EXAMPLE_VAR=${EXAMPLE_VAR} healthcheck: - test: [ 'CMD', 'pg_isready', '-U', "${DB_USERNAME}", '-d', "${postgres:-affine}" ] # Check if postgres process is running + test: [ 'CMD', 'pg_isready', '-U', "${DB_USERNAME}", '-d', "${DB_DATABASE:-affine}" ] # Check if postgres process is running interval: 15s # How often to perform the check timeout: 5s # Time to wait for the check to succeed retries: 5 # Number of retries before marking as unhealthy diff --git a/services/booklore/compose.yaml b/services/booklore/compose.yaml index 96fc5c68..e358dd09 100644 --- a/services/booklore/compose.yaml +++ b/services/booklore/compose.yaml @@ -59,8 +59,6 @@ services: - DATABASE_USERNAME=${MYSQL_USER} # Must match MYSQL_USER defined in the mariadb container - DATABASE_PASSWORD=${MYSQL_PASSWORD} # Use a strong password; must match MYSQL_PASSWORD defined in the mariadb container - SWAGGER_ENABLED=false # Swagger UI (API docs). -# ports: -# - "6060:6060" volumes: - ./data:/app/data - ./books:/books1 # Book library folder — point to one of your collections @@ -69,10 +67,10 @@ services: condition: service_healthy tailscale: condition: service_healthy - restart: unless-stopped + restart: always mariadb: image: lscr.io/linuxserver/mariadb:11.4.5 - container_name: mariadb + container_name: app-${SERVICE}-mariadb environment: - PUID=1000 - PGID=1000 @@ -82,7 +80,7 @@ services: - MYSQL_PASSWORD=${MYSQL_PASSWORD} # Use a strong password; must match DATABASE_PASSWORD defined in the booklore container volumes: - ./mariadb_config:/config - restart: unless-stopped + restart: always healthcheck: test: ["CMD", "mariadb-admin", "ping", "-h", "localhost"] interval: 5s diff --git a/services/caddy/compose.yaml b/services/caddy/compose.yaml index f2a2849e..147a33b6 100644 --- a/services/caddy/compose.yaml +++ b/services/caddy/compose.yaml @@ -9,7 +9,6 @@ services: environment: - TS_AUTHKEY=${TS_AUTHKEY} - TS_STATE_DIR=/var/lib/tailscale - - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint diff --git a/services/coder/compose.yaml b/services/coder/compose.yaml index 06b29988..668b8549 100644 --- a/services/coder/compose.yaml +++ b/services/coder/compose.yaml @@ -93,3 +93,4 @@ services: interval: 5s timeout: 5s retries: 5 + restart: always diff --git a/services/configarr/compose.yaml b/services/configarr/compose.yaml index f5ba31bc..de042d2d 100644 --- a/services/configarr/compose.yaml +++ b/services/configarr/compose.yaml @@ -52,6 +52,6 @@ services: # timeout: 10s # Time to wait for the check to succeed # retries: 3 # Number of retries before marking as unhealthy # start_period: 30s # Time to wait before starting health checks - restart: never + restart: "no" # Configarr runs one sync and exits. Schedule repeated runs externally, for example with cron. diff --git a/services/filebrowser/compose.yml b/services/filebrowser/compose.yml index aa017c20..aada8e38 100644 --- a/services/filebrowser/compose.yml +++ b/services/filebrowser/compose.yml @@ -68,4 +68,4 @@ services: timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy start_period: 30s # Time to wait before starting health checks - restart: always \ No newline at end of file + restart: always diff --git a/services/flaresolverr/compose.yaml b/services/flaresolverr/compose.yaml index 2ee7d572..54eaf757 100644 --- a/services/flaresolverr/compose.yaml +++ b/services/flaresolverr/compose.yaml @@ -51,11 +51,14 @@ services: application: image: ${IMAGE_URL} # Image to be used network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale - container_name: app-${SERVICE}-server # Name for local container management + container_name: app-${SERVICE} # Name for local container management environment: - LOG_LEVEL=${LOG_LEVEL:-info} - LOG_FILE=${LOG_FILE:-none} - LOG_HTML=${LOG_HTML:-false} - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none} - TZ=${TZ} - restart: unless-stopped + depends_on: + tailscale: + condition: service_healthy + restart: always diff --git a/services/formbricks/compose.yaml b/services/formbricks/compose.yaml index 0aa2be89..339bcb9e 100644 --- a/services/formbricks/compose.yaml +++ b/services/formbricks/compose.yaml @@ -48,6 +48,7 @@ services: restart: always postgres: + container_name: app-${SERVICE}-postgres # Name for local container management restart: always image: pgvector/pgvector:pg17 volumes: @@ -55,6 +56,7 @@ services: environment: - POSTGRES_PASSWORD=postgres redis: + container_name: app-${SERVICE}-redis # Name for local container management restart: always image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d command: valkey-server --appendonly yes diff --git a/services/hytale/compose.yaml b/services/hytale/compose.yaml index 05167aa7..afb63c42 100644 --- a/services/hytale/compose.yaml +++ b/services/hytale/compose.yaml @@ -21,8 +21,8 @@ services: - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work cap_add: - net_admin # Tailscale requirement - ports: - - "${SERVICEPORT}:${SERVICEPORT}/udp" + #ports: + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT}/udp # Binding the game port to the local network - only required for players outside your Tailnet # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below #dns: # - ${DNS_SERVER} @@ -53,4 +53,4 @@ services: depends_on: tailscale: condition: service_healthy - restart: unless-stopped + restart: always diff --git a/services/immich/compose.yaml b/services/immich/compose.yaml index fc2ca9fb..e2165198 100644 --- a/services/immich/compose.yaml +++ b/services/immich/compose.yaml @@ -61,8 +61,6 @@ services: - /etc/localtime:/etc/localtime:ro env_file: - .env - # ports: - # - '2283:2283' depends_on: redis: condition: service_healthy diff --git a/services/kaneo/compose.yaml b/services/kaneo/compose.yaml index 23294d12..b2ac819e 100644 --- a/services/kaneo/compose.yaml +++ b/services/kaneo/compose.yaml @@ -68,7 +68,7 @@ services: timeout: 5s # Time to wait for the check to succeed retries: 5 # Number of retries before marking as unhealthy start_period: 30s # Time to wait before starting health checks - restart: unless-stopped + restart: always # ${SERVICE} - Backend (API) backend: @@ -84,7 +84,7 @@ services: condition: service_healthy postgres: condition: service_healthy - restart: unless-stopped + restart: always # ${SERVICE} - Frontend (Web) frontend: @@ -98,7 +98,7 @@ services: condition: service_healthy backend: condition: service_started - restart: unless-stopped + restart: always volumes: postgres_data: diff --git a/services/kitchenowl/compose.yaml b/services/kitchenowl/compose.yaml index 48921bec..b9a2ad05 100755 --- a/services/kitchenowl/compose.yaml +++ b/services/kitchenowl/compose.yaml @@ -34,8 +34,8 @@ services: - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work cap_add: - net_admin # Tailscale requirement - ports: - - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required + #ports: + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below # dns: # - ${DNS_SERVER} @@ -65,4 +65,4 @@ services: depends_on: tailscale: condition: service_healthy - restart: unless-stopped \ No newline at end of file + restart: always diff --git a/services/mailpit/compose.yaml b/services/mailpit/compose.yaml index 25659fae..c22a678d 100644 --- a/services/mailpit/compose.yaml +++ b/services/mailpit/compose.yaml @@ -71,4 +71,4 @@ services: timeout: 10s # Time to wait for the check to succeed retries: 3 # Number of retries before marking as unhealthy start_period: 30s # Time to wait before starting health checks - restart: always \ No newline at end of file + restart: always diff --git a/services/mattermost/compose.yaml b/services/mattermost/compose.yaml index 8f570f9c..a9ffce7a 100644 --- a/services/mattermost/compose.yaml +++ b/services/mattermost/compose.yaml @@ -81,8 +81,10 @@ services: - MM_SERVICESETTINGS_SITEURL restart: always depends_on: - - database - - tailscale + tailscale: + condition: service_healthy + database: + condition: service_started database: image: postgres:latest diff --git a/services/metube/compose.yaml b/services/metube/compose.yaml index fd3f1c58..c7b7ec66 100644 --- a/services/metube/compose.yaml +++ b/services/metube/compose.yaml @@ -22,7 +22,8 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - - TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + - TS_ACCEPT_DNS=true # MagicDNS is enabled for this service. Remove this line to use Docker DNS only. + - TS_AUTH_ONCE=true configs: - source: ts-serve target: /config/serve.json diff --git a/services/netbox/compose.yaml b/services/netbox/compose.yaml index 11f49c52..4f956f12 100644 --- a/services/netbox/compose.yaml +++ b/services/netbox/compose.yaml @@ -22,7 +22,8 @@ services: - TS_USERSPACE=false - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint - - TS_ACCEPT_DNS=true # Uncomment when using MagicDNS + - TS_ACCEPT_DNS=true # MagicDNS is enabled for this service. Remove this line to use Docker DNS only. + - TS_AUTH_ONCE=true configs: - source: ts-serve target: /config/serve.json @@ -56,12 +57,14 @@ services: - ./${SERVICE}/reports:/opt/netbox/netbox/reports - ./${SERVICE}/scripts:/opt/netbox/netbox/scripts depends_on: - postgres: - condition: service_healthy - redis: - condition: service_healthy - redis-cache: - condition: service_healthy + tailscale: + condition: service_healthy + postgres: + condition: service_healthy + redis: + condition: service_healthy + redis-cache: + condition: service_healthy healthcheck: test: curl -f http://localhost:8080/login/ || exit 1 start_period: 90s @@ -97,6 +100,7 @@ services: retries: 5 volumes: - ./${SERVICE}/postgres/data:/var/lib/postgresql/data + restart: always # redis redis: @@ -115,6 +119,7 @@ services: retries: 5 volumes: - ./${SERVICE}/redis/data:/data + restart: always redis-cache: container_name: ${SERVICE}-rediscache image: docker.io/valkey/valkey:8.1-alpine @@ -126,3 +131,4 @@ services: healthcheck: *redis-healthcheck volumes: - ./${SERVICE}/redis/cache:/data + restart: always diff --git a/services/next-explorer/compose.yaml b/services/next-explorer/compose.yaml index c4b2c5a8..07e5fed0 100644 --- a/services/next-explorer/compose.yaml +++ b/services/next-explorer/compose.yaml @@ -52,12 +52,10 @@ services: image: ${IMAGE_URL} network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} - restart: unless-stopped - #ports: - # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required - # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below - #dns: - # - ${DNS_SERVER} + depends_on: + tailscale: + condition: service_healthy + restart: always environment: - NODE_ENV=production - PUBLIC_URL=${PUBLIC_URL} # Optional: Set this to the public URL of your service if needed for correct URL generation in the app. For example, if you are exposing the service at https://example.com, set PUBLIC_URL=https://example.com. diff --git a/services/ollama/compose.yaml b/services/ollama/compose.yaml index 1650e48a..e5120073 100644 --- a/services/ollama/compose.yaml +++ b/services/ollama/compose.yaml @@ -35,7 +35,6 @@ services: - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work cap_add: - net_admin # Tailscale requirement - - sys_module # Required to load kernel modules for Tailscale #ports: # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below diff --git a/services/recyclarr/compose.yaml b/services/recyclarr/compose.yaml index 58dbd5ec..eeee6fa8 100644 --- a/services/recyclarr/compose.yaml +++ b/services/recyclarr/compose.yaml @@ -53,4 +53,4 @@ services: # timeout: 10s # Time to wait for the check to succeed # retries: 3 # Number of retries before marking as unhealthy # start_period: 30s # Time to wait before starting health checks - # restart: unless-stopped + restart: always # The default entrypoint keeps running and syncs on CRON_SCHEDULE. diff --git a/services/seafile/compose.yaml b/services/seafile/compose.yaml index addebbce..40c4a7d2 100644 --- a/services/seafile/compose.yaml +++ b/services/seafile/compose.yaml @@ -20,7 +20,7 @@ services: - TS_STATE_DIR=/var/lib/tailscale - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required - TS_USERSPACE=false - # Uncomment this line and comment out TS_AUTH_ONCE if you want to the service to receive advertised routes, or add other arguements. + # Uncomment this line and comment out TS_AUTH_ONCE if you want to the service to receive advertised routes, or add other arguments. #- TS_EXTRA_ARGS=--accept-routes=true - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint @@ -52,7 +52,7 @@ services: db: image: ${SEAFILE_DB_IMAGE:-mariadb:10.11} container_name: app-${SERVICE}-db - restart: unless-stopped + restart: always environment: - MYSQL_ROOT_PASSWORD=${INIT_SEAFILE_MYSQL_ROOT_PASSWORD:-} - MYSQL_LOG_CONSOLE=true @@ -77,14 +77,13 @@ services: image: ${SEAFILE_MEMCACHED_IMAGE:-memcached:1.6.29} container_name: app-${SERVICE}-memcached entrypoint: memcached -m 256 + restart: always seafile: image: ${SEAFILE_IMAGE:-seafileltd/seafile-mc:13.0-latest} container_name: app-${SERVICE} network_mode: service:tailscale - restart: unless-stopped - #ports: - #- "80:80" + restart: always volumes: - ${SEAFILE_VOLUME:-/opt/seafile-data}:/shared environment: @@ -129,7 +128,9 @@ services: retries: 3 start_period: 10s depends_on: + tailscale: + condition: service_healthy db: condition: service_healthy memcached: - condition: service_started \ No newline at end of file + condition: service_started diff --git a/services/searxng/compose.yaml b/services/searxng/compose.yaml index 6d8ef7a6..e3128c8f 100644 --- a/services/searxng/compose.yaml +++ b/services/searxng/compose.yaml @@ -80,10 +80,10 @@ services: condition: service_started valkey: - container_name: valkey-searxng + container_name: app-${SERVICE}-valkey image: docker.io/valkey/valkey:8-alpine command: valkey-server --save 30 1 --loglevel warning - restart: unless-stopped + restart: always volumes: - valkey-data2:/data cap_drop: diff --git a/services/sure/compose.yaml b/services/sure/compose.yaml index f92e6810..b1144e16 100755 --- a/services/sure/compose.yaml +++ b/services/sure/compose.yaml @@ -51,7 +51,7 @@ services: network_mode: service:tailscale volumes: - ./app-storage:/rails/storage - restart: unless-stopped + restart: always environment: - POSTGRES_USER=${POSTGRES_USER:-sure_user} - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-sure_password} @@ -84,7 +84,7 @@ services: command: bundle exec sidekiq volumes: - ./app-storage:/rails/storage - restart: unless-stopped + restart: always depends_on: tailscale: condition: service_healthy @@ -108,7 +108,7 @@ services: db: image: postgres:16 container_name: app-${SERVICE}-db - restart: unless-stopped + restart: always volumes: - ./postgres-data:/var/lib/postgresql/data environment: @@ -129,7 +129,7 @@ services: - backup image: prodrigestivill/postgres-backup-local container_name: app-${SERVICE}-backup - restart: unless-stopped + restart: always volumes: - ./backups:/backups # Change this path to your desired backup location on the host machine environment: @@ -149,7 +149,7 @@ services: redis: image: redis:latest container_name: app-${SERVICE}-redis - restart: unless-stopped + restart: always volumes: - ./redis-data:/data healthcheck: diff --git a/services/traefik/compose.yaml b/services/traefik/compose.yaml index 595598cf..505983a3 100644 --- a/services/traefik/compose.yaml +++ b/services/traefik/compose.yaml @@ -92,6 +92,6 @@ services: simpleweb: image: yeasy/simple-web:latest labels: - - traefik.enable=true # To + - traefik.enable=true # Let Traefik route this sample container - traefik.http.routers.simpleweb.rule=Host(`simpleweb.domain.local`) - traefik.http.routers.simpleweb.entrypoints=web From 39e89b226f42f10437f71b6f13f3d253d3b93863 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Sun, 27 Sep 2026 23:32:59 +0200 Subject: [PATCH 7/8] Fix stacks that fail to start from the repository Each stack was started with the Tailscale sidecar replaced by an idle container. These configurations failed before the application started: - Docmost: move the placeholder secret and database password to .env. - EspoCRM: use the EspoCRM 10 volume layout and the correct database host. - Formbricks: pin 4.9.7; 5.0 and later need Cube, Hub, and SpiceDB. - Fossflow: drop the build from a deleted repository, remove literal quotes from PUBLIC_URL, and proxy nginx on port 80. - HomeBox: add the required API key pepper. - Homarr and Speedtest Tracker: move required keys from compose to .env. - Karakeep: migrate to the maintained Karakeep Chrome image. - Mattermost: use POSTGRES_IMAGE_TAG (17-alpine) instead of latest, and stop the README from changing the owner of PostgreSQL data. - NetBox: require a separate SECRET_KEY of at least 50 characters. - Recyclarr and SwingMX: use image references that exist. - Document non-root volume ownership for Coder, DDNS Updater, Node-RED, Posterizarr, Recyclarr, and Seerr. Co-Authored-By: Claude Opus 5.5 (1M context) --- services/coder/README.md | 9 +++++++++ services/ddns-updater/README.md | 9 +++++++++ services/docmost/.env | 6 ++++++ services/docmost/compose.yaml | 6 +++--- services/espocrm/.env | 2 +- services/espocrm/README.md | 4 ++++ services/espocrm/compose.yml | 6 ++++-- services/formbricks/.env | 2 +- services/formbricks/README.md | 4 ++++ services/fossflow/.env | 2 +- services/fossflow/compose.yaml | 7 ++----- services/homarr/.env | 3 +++ services/homarr/compose.yaml | 2 +- services/homebox/.env | 4 ++++ services/homebox/compose.yaml | 1 + services/karakeep/compose.yaml | 10 +++++----- services/mattermost/.env | 7 ++++--- services/mattermost/README.md | 7 ++++--- services/mattermost/compose.yaml | 2 +- services/netbox/.env | 3 ++- services/nodered/README.md | 9 +++++++++ services/posterizarr/README.md | 9 +++++++++ services/recyclarr/.env | 2 +- services/recyclarr/README.md | 9 +++++++++ services/seerr/README.md | 9 +++++++++ services/speedtest-tracker/.env | 3 +++ services/speedtest-tracker/compose.yaml | 2 +- services/swingmx/.env | 2 +- 28 files changed, 111 insertions(+), 30 deletions(-) diff --git a/services/coder/README.md b/services/coder/README.md index 219fee94..3553c46b 100644 --- a/services/coder/README.md +++ b/services/coder/README.md @@ -18,3 +18,12 @@ This Docker Compose configuration sets up [**Coder**](https://github.com/coder/c ## Configuration Overview In this deployment, the `tailscale-coder` service runs the Tailscale client to establish a secure private network. The `coder` container uses `network_mode: service:tailscale` to route all traffic through the Tailscale interface. This ensures that your development environments, admin UI, and web IDEs are only accessible via Tailscale, preventing public exposure. + +## Volume Permissions + +The Coder image runs as UID/GID `1000`. Docker creates missing bind-mount directories as `root:root`, and Coder then fails with `mkdir /home/coder/.cache: permission denied`. Create the home directory before the first start: + +```sh +mkdir -p coder-data/coder-home +sudo chown 1000:1000 coder-data/coder-home +``` diff --git a/services/ddns-updater/README.md b/services/ddns-updater/README.md index 6fed8414..999d950b 100644 --- a/services/ddns-updater/README.md +++ b/services/ddns-updater/README.md @@ -16,3 +16,12 @@ By combining DDNS Updater with Tailscale, you can securely manage your dynamic D ## Configuration Overview In this setup, the `tailscale-ddns-updater` service runs Tailscale, providing a secure networking layer for the DDNS Updater service. The `ddns-updater` service utilizes Docker's `network_mode: service:tailscale` configuration to route all traffic through the Tailscale network. This setup ensures that the DDNS Updater's web interface and API are only accessible within your private Tailnet, adding an extra layer of security to your DNS management. + +## Volume Permissions + +The DDNS Updater image runs as UID `1000`. Docker creates missing bind-mount directories as `root:root`, and DDNS Updater then exits with `permission denied` when it writes `config.json`. Create the data directory before the first start: + +```sh +mkdir -p ddns-updater-data/data +sudo chown -R 1000:1000 ddns-updater-data +``` diff --git a/services/docmost/.env b/services/docmost/.env index cbf62118..bada527f 100644 --- a/services/docmost/.env +++ b/services/docmost/.env @@ -19,4 +19,10 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Optional Service variables # PUID=1000 +# Required: at least 32 characters. Generate with: openssl rand -hex 32 +APP_SECRET= +# Required: password for the Docmost PostgreSQL user. Use letters and digits only, because it is part of DATABASE_URL. +# PostgreSQL applies it only when the database is first created. Existing installations must keep their current password. +DB_PASSWORD= + #EXAMPLE_VAR="Environment variable" diff --git a/services/docmost/compose.yaml b/services/docmost/compose.yaml index 36359f3f..47092758 100644 --- a/services/docmost/compose.yaml +++ b/services/docmost/compose.yaml @@ -54,8 +54,8 @@ services: container_name: app-${SERVICE} # Name for local container management environment: APP_URL: 'http://localhost:3000' - APP_SECRET: 'REPLACE_WITH_LONG_SECRET' # Please replace with a long secret - DATABASE_URL: 'postgresql://docmost:STRONG_DB_PASSWORD@localhost:5432/docmost?schema=public' + APP_SECRET: ${APP_SECRET} + DATABASE_URL: 'postgresql://docmost:${DB_PASSWORD}@localhost:5432/docmost?schema=public' REDIS_URL: 'redis://localhost:6379' volumes: - ./${SERVICE}-data/docmost:/app/data/storage @@ -81,7 +81,7 @@ services: environment: POSTGRES_DB: docmost POSTGRES_USER: docmost - POSTGRES_PASSWORD: STRONG_DB_PASSWORD + POSTGRES_PASSWORD: ${DB_PASSWORD} restart: always volumes: - ./${SERVICE}-data/db-data:/var/lib/postgresql/data diff --git a/services/espocrm/.env b/services/espocrm/.env index 4d978c64..7998a830 100644 --- a/services/espocrm/.env +++ b/services/espocrm/.env @@ -32,7 +32,7 @@ MARIADB_USER=espocrm MARIADB_PASSWORD=password ESPOCRM_DEFAULT_CURRENCY=EUR ESPOCRM_DATABASE_PLATFORM=Mysql -ESPOCRM_DATABASE_HOST=espocrm-db +ESPOCRM_DATABASE_HOST=database # Compose service name of the MariaDB container ESPOCRM_DATABASE_USER=espocrm ESPOCRM_DATABASE_PASSWORD=password ESPOCRM_ADMIN_USERNAME=admin diff --git a/services/espocrm/README.md b/services/espocrm/README.md index 2d30de33..58b91fa0 100644 --- a/services/espocrm/README.md +++ b/services/espocrm/README.md @@ -20,3 +20,7 @@ Please check the following contents for validity as some variables need to be de - `.env` // Main variable `TS_AUTHKEY` - `.env` // Required for normal operation. `TS_DOMAIN` + +## Upgrading from an older ScaleTail configuration + +EspoCRM 10 and later refuse to start when the whole `/var/www/html` directory is mounted. This configuration mounts `data`, `custom`, and `client/custom` from `./espocrm-data` instead, so existing data stays in place. Back up `./espocrm-data` before you upgrade. See the [EspoCRM 10 migration guide](https://docs.espocrm.com/administration/docker/installation/#migration-to-espocrm-10). diff --git a/services/espocrm/compose.yml b/services/espocrm/compose.yml index 47c34065..7d853df9 100644 --- a/services/espocrm/compose.yml +++ b/services/espocrm/compose.yml @@ -78,8 +78,10 @@ services: - ESPOCRM_ADMIN_PASSWORD=${ESPOCRM_ADMIN_PASSWORD} - ESPOCRM_SITE_URL=${ESPOCRM_SITE_URL} - ESPOCRM_DEFAULT_CURRENCY=${ESPOCRM_DEFAULT_CURRENCY} - volumes: - - ./${SERVICE}-data:/var/www/html + volumes: # EspoCRM 10 and later refuse to start when /var/www/html is mounted as a whole. + - ./${SERVICE}-data/data:/var/www/html/data + - ./${SERVICE}-data/custom:/var/www/html/custom + - ./${SERVICE}-data/client/custom:/var/www/html/client/custom restart: always depends_on: tailscale: diff --git a/services/formbricks/.env b/services/formbricks/.env index 7735cd65..e8d2ca74 100644 --- a/services/formbricks/.env +++ b/services/formbricks/.env @@ -4,7 +4,7 @@ # Service Configuration SERVICE=formbricks # Service name (e.g., adguard). Used as hostname in Tailscale and for container naming (app-${SERVICE}). -IMAGE_URL=ghcr.io/formbricks/formbricks:latest +IMAGE_URL=ghcr.io/formbricks/formbricks:4.9.7 # Pinned: Formbricks 5.0 and later also require Cube, Hub, and SpiceDB services that this stack does not include. # Network Configuration SERVICEPORT=3000 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. diff --git a/services/formbricks/README.md b/services/formbricks/README.md index 01e08d65..bb44ed39 100644 --- a/services/formbricks/README.md +++ b/services/formbricks/README.md @@ -33,3 +33,7 @@ network_mode: service:tailscale ``` This configuration routes all inbound and outbound traffic through the Tailscale interface, ensuring that the Formbricks admin UI, APIs, and feedback endpoints are accessible **only via your Tailscale network**. This keeps sensitive feedback data protected while still allowing secure access for authorized team members. + +## Image Version + +This configuration pins Formbricks to `4.9.7`. Formbricks 5.0 and later also require Cube, Hub, and SpiceDB services, which this stack does not include. See the [upstream Docker Compose file](https://github.com/formbricks/formbricks/blob/main/docker/docker-compose.yml) before you upgrade. diff --git a/services/fossflow/.env b/services/fossflow/.env index 152d0afc..a652ce4f 100644 --- a/services/fossflow/.env +++ b/services/fossflow/.env @@ -7,7 +7,7 @@ SERVICE=fossflow IMAGE_URL=stnsmith/fossflow:latest # Docker image URL from container registry (e.g., adguard/adguard-home). # Network Configuration -SERVICEPORT=3000 +SERVICEPORT=80 DNS_SERVER=9.9.9.9 # Tailscale Configuration diff --git a/services/fossflow/compose.yaml b/services/fossflow/compose.yaml index 55e1eb11..2d7baf10 100644 --- a/services/fossflow/compose.yaml +++ b/services/fossflow/compose.yaml @@ -4,7 +4,7 @@ configs: {"TCP":{"443":{"HTTPS":true}}, "Web":{"$${TS_CERT_DOMAIN}:443": {"Handlers":{"/": - {"Proxy":"http://127.0.0.1:3000"}}}}, + {"Proxy":"http://127.0.0.1:80"}}}}, "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} services: @@ -52,11 +52,8 @@ services: image: ${IMAGE_URL} # Image to be used network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale container_name: app-${SERVICE} # Name for local container management - build: - context: https://github.com/stan-smith/FossFLOW.git - dockerfile: Dockerfile environment: - - PUBLIC_URL="https://fossflow..ts.net" + - PUBLIC_URL=https://fossflow..ts.net depends_on: tailscale: condition: service_healthy diff --git a/services/homarr/.env b/services/homarr/.env index 24b16bd5..60390f57 100644 --- a/services/homarr/.env +++ b/services/homarr/.env @@ -19,4 +19,7 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Optional Service variables # PUID=1000 +# Required: generate a 64-character hex key with: openssl rand -hex 32 +SECRET_ENCRYPTION_KEY= + #EXAMPLE_VAR="Environment variable" diff --git a/services/homarr/compose.yaml b/services/homarr/compose.yaml index 120101fb..3188e770 100644 --- a/services/homarr/compose.yaml +++ b/services/homarr/compose.yaml @@ -56,7 +56,7 @@ services: - PUID=1000 - PGID=1000 - TZ=${TZ} - - SECRET_ENCRYPTION_KEY= # Please generate a key with: openssl rand -hex 32 + - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY} volumes: # - /var/run/docker.sock:/var/run/docker.sock # Optional, only if you want docker integration - ./${SERVICE}-data/appdata:/appdata diff --git a/services/homebox/.env b/services/homebox/.env index 6947915d..677c119f 100644 --- a/services/homebox/.env +++ b/services/homebox/.env @@ -20,4 +20,8 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Optional Service variables # PUID=1000 +# Required: at least 32 bytes. Generate with: openssl rand -base64 48 +# Changing it later invalidates all issued API keys. +HBOX_AUTH_API_KEY_PEPPER= + #EXAMPLE_VAR="Environment variable" diff --git a/services/homebox/compose.yaml b/services/homebox/compose.yaml index d3129372..14196e5b 100644 --- a/services/homebox/compose.yaml +++ b/services/homebox/compose.yaml @@ -57,6 +57,7 @@ services: - PUID=1000 - PGID=1000 - TZ=${TZ} + - HBOX_AUTH_API_KEY_PEPPER=${HBOX_AUTH_API_KEY_PEPPER} volumes: - ./${SERVICE}-data:/data depends_on: diff --git a/services/karakeep/compose.yaml b/services/karakeep/compose.yaml index 43c845e5..ba5d5b54 100644 --- a/services/karakeep/compose.yaml +++ b/services/karakeep/compose.yaml @@ -79,16 +79,16 @@ services: restart: always chrome: - image: gcr.io/zenika-hub/alpine-chrome:123 + image: ghcr.io/karakeep-app/karakeep-chrome:release # Replaces the unmaintained alpine-chrome image; see Karakeep's Chrome image migration guide restart: always container_name: app-${SERVICE}-chrome # Name for local container management - command: - - --no-sandbox + init: true + command: # The image entrypoint adds --no-sandbox and exposes the debugging port on 9222 - --disable-gpu - --disable-dev-shm-usage - - --remote-debugging-address=0.0.0.0 - - --remote-debugging-port=9222 - --hide-scrollbars + - --disable-blink-features=AutomationControlled + - --window-size=1440,900 meilisearch: image: getmeili/meilisearch:v1.11.1 diff --git a/services/mattermost/.env b/services/mattermost/.env index c1d2b25a..698957d9 100644 --- a/services/mattermost/.env +++ b/services/mattermost/.env @@ -32,8 +32,8 @@ HTTP_PORT=80 CALLS_PORT=8443 # Mattermost settings -## Inside the container the uid and gid is 2000. The folder owner can be set with -## `sudo chown -R 2000:2000 ./${SERVICE}-data/mattermost`. +## Inside the container the uid and gid is 2000. Set the owner of the Mattermost paths below (not the +## PostgreSQL path) to 2000:2000 before the first start. See the README for the commands. MATTERMOST_CONFIG_PATH=./${SERVICE}-data/config MATTERMOST_DATA_PATH=./${SERVICE}-data/data MATTERMOST_LOGS_PATH=./${SERVICE}-data/logs @@ -52,7 +52,8 @@ MATTERMOST_CONTAINER_READONLY=false # Postgres Settings ## A guide on how to change the database user to a nonsuperuser can be found in docs/creation-of-nonsuperuser.md -POSTGRES_IMAGE_TAG=13-alpine +## Use the major version your database was created with. Versions 18 and later need a different mount (see compose.yaml). +POSTGRES_IMAGE_TAG=17-alpine POSTGRES_DATA_PATH=./${SERVICE}-data/postgres/data POSTGRES_USER=MMus3r ##Please Change diff --git a/services/mattermost/README.md b/services/mattermost/README.md index ea5fc6a2..d16943dd 100644 --- a/services/mattermost/README.md +++ b/services/mattermost/README.md @@ -23,16 +23,17 @@ The stack stores Mattermost and PostgreSQL data under the local mattermost-data ## Troubleshooting -After initial start-up you may experience an error. +The Mattermost image runs as UID/GID `2000`. Docker creates missing bind-mount directories as `root:root`, and Mattermost then fails with: ```plain app-mattermost | Error: failed to load configuration: could not create config file: open /mattermost/config/config.json: permission denied ``` -Please adjust the permissions of the newly created folder `mattermost-data/` with the following command and restart the service. +Create the Mattermost directories and set their owner before the first start. Do not change the owner of `mattermost-data/postgres`, which PostgreSQL manages itself. ```bash -chown -R 2000:2000 mattermost-data/ +mkdir -p mattermost-data/{config,data,logs,plugins,client/plugins,bleve-indexes} +sudo chown -R 2000:2000 mattermost-data/config mattermost-data/data mattermost-data/logs mattermost-data/plugins mattermost-data/client mattermost-data/bleve-indexes ``` Reference - [Starting/Stopping Docker](https://github.com/mattermost/mattermost-docker/commit/37331ba3d7122aeb30272308dddf51ef70e2134c#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L146) diff --git a/services/mattermost/compose.yaml b/services/mattermost/compose.yaml index a9ffce7a..49203deb 100644 --- a/services/mattermost/compose.yaml +++ b/services/mattermost/compose.yaml @@ -87,7 +87,7 @@ services: condition: service_started database: - image: postgres:latest + image: postgres:${POSTGRES_IMAGE_TAG} # PostgreSQL 18 images use a different data directory layout; keep a 17 or older tag for this mount container_name: db-${SERVICE} restart: always security_opt: diff --git a/services/netbox/.env b/services/netbox/.env index 3bbb48b8..be806043 100644 --- a/services/netbox/.env +++ b/services/netbox/.env @@ -54,7 +54,8 @@ REDIS_INSECURE_SKIP_TLS_VERIFY=false REDIS_PASSWORD=${SUPER_SECRET}REDIS REDIS_SSL=false RELEASE_CHECK_URL=https://api.github.com/repos/netbox-community/netbox/releases -SECRET_KEY=${SUPER_SECRET}_SECRET! +# Required: at least 50 characters. Generate with: openssl rand -base64 48 +SECRET_KEY= SKIP_SUPERUSER=true WEBHOOKS_ENABLED=true diff --git a/services/nodered/README.md b/services/nodered/README.md index f7a38243..7c01ac56 100644 --- a/services/nodered/README.md +++ b/services/nodered/README.md @@ -9,3 +9,12 @@ This Docker Compose configuration sets up [Node-RED](https://github.com/node-red ## Configuration Overview In this setup, the `tailscale-node-red` service runs Tailscale, which manages secure networking for the Node-RED service. The `node-red` service uses the Tailscale network stack via Docker's `network_mode: service:tailscale` configuration. This ensures that Node-RED’s web interface is only accessible through the Tailscale network (or locally, if preferred), providing an additional layer of security and privacy for your flow-based programming environment. + +## Volume Permissions + +The Node-RED image runs as UID/GID `1000`. Docker creates missing bind-mount directories as `root:root`, and Node-RED then exits with `EACCES` when it copies `settings.js` into `/data`. Create the data directory before the first start: + +```sh +mkdir -p nodered-data/app/config +sudo chown -R 1000:1000 nodered-data +``` diff --git a/services/posterizarr/README.md b/services/posterizarr/README.md index ad797d98..d59a1d62 100644 --- a/services/posterizarr/README.md +++ b/services/posterizarr/README.md @@ -37,3 +37,12 @@ network_mode: service:tailscale This configuration ensures that **all Posterizarr traffic is routed exclusively through the Tailscale interface**, allowing it to securely communicate with Radarr and Sonarr instances over your private network. No ports are exposed to the public Internet, and the service remains fully isolated. With this setup, Posterizarr can reliably enforce consistent artwork standards across your media library — securely, privately, and automatically. + +## Volume Permissions + +The Compose file runs Posterizarr as UID/GID `1000`. Docker creates missing bind-mount directories as `root:root`, and Posterizarr then fails with `Permission denied: '/config/database'`. Create the data directories before the first start: + +```sh +mkdir -p posterizarr-data/config posterizarr-data/assets posterizarr-data/assetsbackup posterizarr-data/manualassets +sudo chown -R 1000:1000 posterizarr-data +``` diff --git a/services/recyclarr/.env b/services/recyclarr/.env index 4cee0618..5b040989 100644 --- a/services/recyclarr/.env +++ b/services/recyclarr/.env @@ -4,7 +4,7 @@ # Service Configuration SERVICE=recyclarr -IMAGE_URL=ghcr.io/recyclarr/recyclarr +IMAGE_URL=ghcr.io/recyclarr/recyclarr:8 # Recyclarr publishes major-version tags and no "latest" tag. # Network Configuration SERVICEPORT= diff --git a/services/recyclarr/README.md b/services/recyclarr/README.md index 2b41ef62..8494cb9d 100644 --- a/services/recyclarr/README.md +++ b/services/recyclarr/README.md @@ -37,3 +37,12 @@ network_mode: service:tailscale This setup ensures that **all Recyclarr traffic flows exclusively through the Tailscale interface**, allowing it to securely reach Radarr and Sonarr instances that are also on your Tailscale network. No ports need to be exposed, and the container remains completely inaccessible from the public Internet. With this configuration, Recyclarr can safely automate and enforce your media quality standards across your entire media stack — privately, securely, and reproducibly. + +## Volume Permissions + +The Compose file runs Recyclarr as UID/GID `1000`. Docker creates missing bind-mount directories as `root:root`, and Recyclarr then exits with `Access to the path '/config/state' is denied`. Create the config directory before the first start: + +```sh +mkdir -p recyclarr-data/config +sudo chown -R 1000:1000 recyclarr-data +``` diff --git a/services/seerr/README.md b/services/seerr/README.md index 6bc376aa..19625ab4 100644 --- a/services/seerr/README.md +++ b/services/seerr/README.md @@ -11,3 +11,12 @@ This Docker Compose configuration sets up [Seerr](https://github.com/seerr-team/ In this setup, the `tailscale-seerr` service runs the Tailscale daemon to provide secure, private networking. The `seerr` service is configured to use Tailscale’s network stack via Docker’s `network_mode: service:tailscale` syntax. This binds Seer’s network interface to the Tailscale container, making the web UI and API available only through your Tailscale network (or locally, if needed). This architecture is ideal for self-hosters who want to access Seerr from anywhere without exposing it to the internet, maintaining both ease of access and strict privacy controls. + +## Volume Permissions + +The Seerr image runs as the non-root `node` user (UID/GID `1000`). Docker creates missing bind-mount directories as `root:root`, and Seerr then exits with `EACCES` when it creates `/app/config/logs`. Create the config directory before the first start: + +```sh +mkdir -p seerr-data/config +sudo chown -R 1000:1000 seerr-data +``` diff --git a/services/speedtest-tracker/.env b/services/speedtest-tracker/.env index 0a37173a..cb5f3296 100644 --- a/services/speedtest-tracker/.env +++ b/services/speedtest-tracker/.env @@ -19,4 +19,7 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Optional Service variables # PUID=1000 +# Required: generate with: echo "base64:$(openssl rand -base64 32)" +APP_KEY= + #EXAMPLE_VAR="Environment variable" diff --git a/services/speedtest-tracker/compose.yaml b/services/speedtest-tracker/compose.yaml index 5fe108d4..ac6a3da2 100644 --- a/services/speedtest-tracker/compose.yaml +++ b/services/speedtest-tracker/compose.yaml @@ -55,7 +55,7 @@ services: environment: - PUID=1000 - PGID=1000 - - APP_KEY= + - APP_KEY=${APP_KEY} - DB_CONNECTION=sqlite #- APP_NAME= - APP_URL= # Base URL used for notifications. example: speedtest.funny-name.ts.net diff --git a/services/swingmx/.env b/services/swingmx/.env index 859839bf..27d66ed8 100644 --- a/services/swingmx/.env +++ b/services/swingmx/.env @@ -4,7 +4,7 @@ # Service Configuration SERVICE=swingmusic -IMAGE_URL=swingmx/swingmusic:latest +IMAGE_URL=ghcr.io/swingmx/swingmusic:latest # Network Configuration SERVICEPORT=1970 From 8bdc873a38afeb789474ab3df53d41eb3acea9b4 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Sun, 27 Sep 2026 23:50:38 +0200 Subject: [PATCH 8/8] NetBox: stop committing a working default password SUPER_SECRET is the base of the PostgreSQL and Redis passwords. Leave it empty with instructions to generate a value, as AGENTS.md requires. Existing installations must keep the value their database was created with. Co-Authored-By: Claude Opus 5.5 (1M context) --- services/netbox/.env | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/services/netbox/.env b/services/netbox/.env index be806043..1b3eb2de 100644 --- a/services/netbox/.env +++ b/services/netbox/.env @@ -19,8 +19,10 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Optional Service variables -#Please change this password -SUPER_SECRET=t3Ph722qJ5QHeQ1qfu36 +# Required: base value for the PostgreSQL and Redis passwords below. Use letters and digits only. +# Generate with: openssl rand -hex 16 +# PostgreSQL applies DB_PASSWORD only when the database is first created. Existing installations must keep their current value. +SUPER_SECRET= #NETBOX Environment variables CORS_ORIGIN_ALLOW_ALL=True