artanis/Inanis_Vault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

"vault backup: 2026-03-08 13:41:28 from Flow"

Browse Source
This commit is contained in:
Spencer Grimes
2026-03-08 13:41:28 -05:00
parent 3eccd6deee
commit ec242f1052
22 changed files with 313 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
21-Server Reference/homelab/stacks/README.md Normal file
View File

@@ -0,0 +1,41 @@
# Docker Stacks Overview
All stacks run on [[../environments#Environment 1 — Homelab]]. Compose files live at `/home/artanis/DockerFiles/` unless noted otherwise.
## Status Summary
| Stack | Status | Containers | Tailscale Node |
|---|---|---|---|
| [[dockhand]] | Running | 2 | `dockhand.bunny-wyvern.ts.net` |
| [[minecraft]] | Running | 1 | None (LAN exposed) |
| [[mealie]] | Running | 2 | `mealie.bunny-wyvern.ts.net` |
| [[linkwarden]] | Running | 3 | `linkwarden.bunny-wyvern.ts.net` |
| [[gitea]] | Running | 3 | `gitea.bunny-wyvern.ts.net` |
| [[matrix]] | Running | 8 | `matrix.bunny-wyvern.ts.net` |
| [[homepage]] | Running | 2 | `homepage.bunny-wyvern.ts.net` |
| [[n8n]] | Running | 2 | `n8n.bunny-wyvern.ts.net` |
| [[calibre]] | **Stopped** | 2 | `calibre.bunny-wyvern.ts.net` |
| [[gluetun]] | Running | 1 | None |
| [[openproject]] | Running | 2 | `openproject.bunny-wyvern.ts.net` |
| [[melodix]] | Running | 1 | None |
## Common Patterns
### Tailscale Sidecar
Most stacks include a `tailscale/tailscale` sidecar that joins the Tailnet and makes the service accessible at `[name].bunny-wyvern.ts.net`. All sidecars share a single Tailscale auth key stored in the compose files.
### Bind Mounts vs Named Volumes
- **Config/data that needs to be easily accessible** uses bind mounts into `/home/artanis/DockerFiles/[stack]/`
- **Tailscale state** always uses named volumes (e.g. `stack_tailscale_state`) so node registration persists across restarts
- **Dockhand vulnerability scanner caches** use named volumes (`dockhand-grype-db`, `dockhand-trivy-db`)
### Orphaned Volumes
The following named volumes exist but are not attached to any running container — likely leftovers from deleted stacks:
- `moltis_moltis-data`
- `moltis_moltis-config`
- `moltis_moltis-tailscale-state`
- `portainer_data`
- `open-project_open_project_tailscale_state`
- `openproject_openproject_tailscale_state` (from an older `openproject` stack iteration)
> Orphaned networks (`blight_default`, old `openproject_default`) have been pruned.

74
21-Server Reference/homelab/stacks/calibre.md Normal file
View File

@@ -0,0 +1,74 @@
# Calibre
Self-hosted e-book library manager (Calibre desktop server).
**Status: STOPPED** — The main `calibre` container is in `Created` state and the Tailscale sidecar exited with code 128. This stack is not currently running.
## Access (when running)
- **Tailscale:** [calibre.bunny-wyvern.ts.net](https://calibre.bunny-wyvern.ts.net)
- Web UI port: `8080` (mapped to host `8088`)
- Content server port: `8081` (mapped to host `8089`)
## Containers
| Container | Image | Status |
|---|---|---|
| `calibre` | `lscr.io/linuxserver/calibre:latest` | Created (never started) |
| `calibre-tailscale-sidecar` | `tailscale/tailscale` (pinned image) | Exited (128) ~3 weeks ago |
> The Tailscale sidecar is running a pinned image hash (`sha256:1a2e759f...`) rather than `latest`. This may be why it failed — the image may be outdated or incompatible.
## Compose File
**Path:** `/home/artanis/DockerFiles/Calibre/docker-compose.yaml`
```yaml
services:
calibre:
image: lscr.io/linuxserver/calibre:latest
container_name: calibre
pull_policy: always
restart: unless-stopped
ports:
- "8088:8080"
- "8089:8081"
- "8181:8181"
volumes:
- /home/artanis/DockerFiles/Calibre/server-config:/config
- /home/artanis/DockerFiles/Calibre/books:/books
environment:
PUID: 1000
PGID: 1000
TZ: America/Chicago
calibre-tailscale-sidecar:
image: tailscale/tailscale:latest
container_name: calibre-tailscale-sidecar
restart: always
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun
volumes:
- calibre_tailscale_state:/var/lib/tailscale
environment:
- TS_AUTHKEY=<redacted>
- TS_HOSTNAME=calibre
- TS_STATE_DIR=/var/lib/tailscale
network_mode: "service:calibre"
volumes:
calibre_tailscale_state:
# calibre-web service is commented out in compose
```
## Data Layout
| Path | Contents |
|---|---|
| `/home/artanis/DockerFiles/Calibre/server-config` | Calibre server configuration |
| `/home/artanis/DockerFiles/Calibre/books` | E-book library files |
## Notes
- A `calibre-web` service (separate lightweight web UI) is fully defined in the compose file but commented out
- To restart this stack, the Tailscale sidecar image may need to be re-pulled (`pull_policy: always` is set on calibre but not the sidecar)

59
21-Server Reference/homelab/stacks/dockhand.md Normal file
View File

@@ -0,0 +1,59 @@
# Dockhand
Docker management UI. Used to manage all containers on the server. Also the tool used to generate this documentation.
## Access
- **Tailscale:** [dockhand.bunny-wyvern.ts.net](https://dockhand.bunny-wyvern.ts.net)
- **LAN:** `http://192.168.2.114:5555`
## Containers
| Container | Image | Role |
|---|---|---|
| `dockhand` | `fnsys/dockhand:latest` | Main web UI |
| `dockhand-tailscale-sidecar` | `tailscale/tailscale:latest` | Tailscale node |
## Compose File
**Path:** `/home/artanis/DockerFiles/Dockhand/docker-compose.yaml`
```yaml
services:
dockhand:
image: fnsys/dockhand:latest
container_name: dockhand
restart: unless-stopped
ports:
- 5555:3000
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /home/artanis/DockerFiles:/DockerFiles
- /Minecraft_Server/docker-compose.yaml:/DockerFiles/Minecraft_Server/docker-compose.yaml
- dockhand_data:/app/data
dockhand-tailscale-sidecar:
image: tailscale/tailscale:latest
container_name: dockhand-tailscale-sidecar
restart: always
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun
volumes:
- dockhand_tailscale_state:/var/lib/tailscale
- /home/artanis/DockerFiles:/DockerFiles
environment:
- TS_AUTHKEY=<redacted>
- TS_HOSTNAME=dockhand
- TS_STATE_DIR=/var/lib/tailscale
network_mode: "service:dockhand"
volumes:
dockhand_data:
dockhand_tailscale_state:
```
## Notes
- The entire `/home/artanis/DockerFiles` directory is mounted into the container at `/DockerFiles`, giving Dockhand read/write access to all compose files
- The Minecraft compose file lives outside `DockerFiles` (`/Minecraft_Server/`) so it is explicitly bind-mounted in
- `dockhand_data` is the named volume for Dockhand's internal state (environments, settings, user accounts)
- Dockhand also manages vulnerability scanning with two cached databases: `dockhand-grype-db` and `dockhand-trivy-db`

85
21-Server Reference/homelab/stacks/gitea.md Normal file
View File

@@ -0,0 +1,85 @@
# Gitea
Self-hosted Git service (GitHub alternative).
## Access
- **Tailscale:** [gitea.bunny-wyvern.ts.net](https://gitea.bunny-wyvern.ts.net)
- **LAN Web:** `http://192.168.2.114:3000`
- **LAN SSH:** `ssh://192.168.2.114:2222`
## Containers
| Container | Image | Role |
|---|---|---|
| `gitea` | `gitea/gitea:latest` | Web app + Git server |
| `gitea_db` | `mysql:8` | MySQL database |
| `gitea-tailscale-sidecar` | `tailscale/tailscale:latest` | Tailscale node |
## Compose File
**Path:** `/home/artanis/DockerFiles/gitea/docker-compose.yml`
```yaml
services:
gitea:
image: gitea/gitea:latest
container_name: gitea
restart: unless-stopped
environment:
- USER_UID=1000
- USER_GID=1000
- GITEA__database__DB_TYPE=mysql
- GITEA__database__HOST=db:3306
- GITEA__database__NAME=gitea
- GITEA__database__USER=gitea
- GITEA__database__PASSWD=<redacted>
volumes:
- /home/artanis/DockerFiles/gitea/gitea_data:/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
ports:
- "3000:3000"
- "2222:2222"
db:
image: mysql:8
container_name: gitea_db
restart: unless-stopped
environment:
- MYSQL_ROOT_PASSWORD=<redacted>
- MYSQL_DATABASE=gitea
- MYSQL_USER=gitea
- MYSQL_PASSWORD=<redacted>
volumes:
- /home/artanis/DockerFiles/gitea/gitea_db_data:/var/lib/mysql
gitea-tailscale-sidecar:
image: tailscale/tailscale:latest
container_name: gitea-tailscale-sidecar
restart: always
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun
volumes:
- gitea_tailscale_state:/var/lib/tailscale
environment:
- TS_AUTHKEY=<redacted>
- TS_HOSTNAME=gitea
- TS_STATE_DIR=/var/lib/tailscale
network_mode: "service:gitea"
volumes:
gitea_tailscale_state:
```
## Data Layout
| Path | Contents |
|---|---|
| `/home/artanis/DockerFiles/gitea/gitea_data` | Gitea repos, config, attachments |
| `/home/artanis/DockerFiles/gitea/gitea_db_data` | MySQL data directory |
## Notes
- Database: MySQL 8 (separate container `gitea_db`)
- Port 2222 is exposed for SSH-based Git operations (clone/push via `ssh://`)
- Timezone files from the host are mounted read-only to keep Gitea's timestamps consistent

60
21-Server Reference/homelab/stacks/gluetun.md Normal file
View File

@@ -0,0 +1,60 @@
# Gluetun (VPN Gateway)
VPN gateway container using Mullvad via WireGuard. Acts as a network proxy for other containers or clients that need to route traffic through the VPN.
## Access
- **HTTP Control Server:** `http://192.168.2.114:8001` (Gluetun management API)
- **HTTP Proxy:** `http://192.168.2.114:8888`
- **Shadowsocks:** `192.168.2.114:8388` (TCP + UDP)
## Containers
| Container | Image | Role |
|---|---|---|
| `gluetun` | `qmcgaw/gluetun:v3` | VPN gateway |
No Tailscale sidecar — this stack is accessed directly on the LAN.
## Compose File
**Path:** `/home/artanis/DockerFiles/gluetun-qbittorent/docker-compose.yaml`
```yaml
services:
gluetun:
image: qmcgaw/gluetun:v3
container_name: gluetun
restart: unless-stopped
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
ports:
- 8001:8000/tcp # HTTP Control Server
- 8888:8888/tcp # HTTP proxy
- 8388:8388/tcp # Shadowsocks
- 8388:8388/udp # Shadowsocks
volumes:
- /home/artanis/DockerFiles/ArrSuite/gluetun:/gluetun
environment:
- VPN_SERVICE_PROVIDER=mullvad
- VPN_TYPE=wireguard
- HTTPPROXY=on
- WIREGUARD_PRIVATE_KEY=<redacted>
- WIREGUARD_ADDRESSES=10.74.136.96/32
- TZ=UTC-06
- SERVER_COUNTRIES=Canada,USA
- DNS_ADDRESS=192.168.2.112
- HTTP_CONTROL_SERVER_ADDRESS=:8000
- FIREWALL_OUTBOUND_SUBNETS=192.168.2.0/24
- UPDATER_PERIOD=24h
```
## Notes
- **VPN Provider:** Mullvad, WireGuard protocol
- **VPN IP:** `10.74.136.96/32` (assigned Mullvad address)
- **Server regions:** Canada and USA
- **DNS:** Routes DNS through `192.168.2.112` (likely the LAN Pihole)
- `FIREWALL_OUTBOUND_SUBNETS=192.168.2.0/24` allows containers using Gluetun as their network to still reach the local LAN
- `UPDATER_PERIOD=24h` — Gluetun automatically refreshes its Mullvad server list every 24 hours
- The stack name is `gluetun-qbittorent`, suggesting qBittorrent was originally planned to run behind this VPN. The qBittorrent service is not currently deployed (only Gluetun is running)
- Config data is bind-mounted to `/home/artanis/DockerFiles/ArrSuite/gluetun` (note: `ArrSuite` directory, suggesting future *arr apps may be planned)

65
21-Server Reference/homelab/stacks/homepage.md Normal file
View File

@@ -0,0 +1,65 @@
# Homepage
Self-hosted dashboard (gethomepage.dev) for quick access to all services.
## Access
- **Tailscale:** [homepage.bunny-wyvern.ts.net](https://homepage.bunny-wyvern.ts.net)
- **LAN:** `http://192.168.2.114:35000`
## Containers
| Container | Image | Role |
|---|---|---|
| `homepage` | `ghcr.io/gethomepage/homepage:latest` | Dashboard web app |
| `homepage-tailscale-sidecar` | `tailscale/tailscale:latest` | Tailscale node |
## Compose File
**Path:** `/home/artanis/DockerFiles/homepage/docker-compose.yml`
```yaml
services:
homepage:
image: ghcr.io/gethomepage/homepage:latest
container_name: homepage
restart: unless-stopped
pull_policy: always
ports:
- 35000:3000
volumes:
- /home/artanis/DockerFiles/homepage/config:/app/config
- /home/artanis/DockerFiles/homepage/images:/app/public/images
- /var/run/docker.sock:/var/run/docker.sock
environment:
HOMEPAGE_ALLOWED_HOSTS: 192.168.2.114:35000,homelab:35000,100.72.0.62:35000,homepage.bunny-wyvern.ts.net
homepage-tailscale-sidecar:
image: tailscale/tailscale:latest
container_name: homepage-tailscale-sidecar
restart: always
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun
volumes:
- homepage_tailscale_state:/var/lib/tailscale
environment:
- TS_AUTHKEY=<redacted>
- TS_HOSTNAME=homepage
- TS_STATE_DIR=/var/lib/tailscale
network_mode: "service:homepage"
volumes:
homepage_tailscale_state:
```
## Data Layout
| Path | Contents |
|---|---|
| `/home/artanis/DockerFiles/homepage/config` | YAML config files (services, widgets, settings) |
| `/home/artanis/DockerFiles/homepage/images` | Custom images for the dashboard |
## Notes
- `HOMEPAGE_ALLOWED_HOSTS` must include all hostnames/IPs from which the dashboard will be accessed — required by Homepage as a CSRF protection measure
- The Docker socket is mounted to enable Homepage's Docker integration (live container status widgets)
- `pull_policy: always` ensures the latest image is pulled on every stack restart

75
21-Server Reference/homelab/stacks/linkwarden.md Normal file
View File

@@ -0,0 +1,75 @@
# Linkwarden
Self-hosted bookmark manager with link archiving.
## Access
- **Tailscale:** [linkwarden.bunny-wyvern.ts.net](https://linkwarden.bunny-wyvern.ts.net)
- **LAN:** `http://192.168.2.114:5001`
## Containers
| Container | Image | Role |
|---|---|---|
| `linkwarden` | `ghcr.io/linkwarden/linkwarden:latest` | Web app |
| `linkwarden-db` | `postgres:16-alpine` | PostgreSQL database |
| `linkwarden-tailscale-sidecar` | `tailscale/tailscale:latest` | Tailscale node |
## Compose File
**Path:** `/home/artanis/DockerFiles/linkwarden/docker-compose.yml`
```yaml
services:
postgres:
image: postgres:16-alpine
container_name: linkwarden-db
restart: always
pull_policy: always
volumes:
- /home/artanis/DockerFiles/linkwarden/pgdata:/var/lib/postgresql/data
linkwarden:
container_name: linkwarden
image: ghcr.io/linkwarden/linkwarden:latest
restart: always
pull_policy: always
ports:
- 5001:3000
volumes:
- /home/artanis/DockerFiles/linkwarden/data:/data/data
environment:
- DATABASE_URL=postgresql://postgres:<redacted>@postgres:5432/postgres
- NEXTAUTH_URL=https://linkwarden.bunny-wyvern.ts.net/api/v1/auth
- NEXTAUTH_SECRET=<redacted>
depends_on:
- postgres
linkwarden-tailscale-sidecar:
image: tailscale/tailscale:latest
container_name: linkwarden-tailscale-sidecar
restart: unless-stopped
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun
volumes:
- linkwarden_tailscale_state:/var/lib/tailscale
environment:
- TS_AUTHKEY=<redacted>
- TS_HOSTNAME=linkwarden
- TS_STATE_DIR=/var/lib/tailscale
network_mode: "service:linkwarden"
volumes:
linkwarden_tailscale_state:
```
## Data Layout
| Path | Contents |
|---|---|
| `/home/artanis/DockerFiles/linkwarden/pgdata` | PostgreSQL data directory |
| `/home/artanis/DockerFiles/linkwarden/data` | Linkwarden app data (archived pages, assets) |
## Notes
- `NEXTAUTH_URL` must point to the Tailscale URL for auth to work correctly
- A Meilisearch service was previously considered (commented out in compose) but not deployed

150
21-Server Reference/homelab/stacks/matrix.md Normal file
View File

@@ -0,0 +1,150 @@
# Matrix
Self-hosted Matrix homeserver (Synapse) with multiple messaging bridges.
## Access
- **Tailscale:** `matrix.bunny-wyvern.ts.net` (Synapse homeserver)
## Containers
| Container | Image | Role |
|---|---|---|
| `synapse` | `matrixdotorg/synapse:latest` | Matrix homeserver |
| `matrix-db` | `postgres:16-alpine` | PostgreSQL database |
| `matrix-tailscale` | `tailscale/tailscale:latest` | Tailscale node (shares synapse network) |
| `mautrix-whatsapp` | `dock.mau.dev/mautrix/whatsapp:latest` | WhatsApp bridge |
| `mautrix-gmessages` | `dock.mau.dev/mautrix/gmessages:latest` | Google Messages bridge |
| `mautrix-slack` | `dock.mau.dev/mautrix/slack:latest` | Slack bridge |
| `mautrix-discord` | `dock.mau.dev/mautrix/discord:latest` | Discord bridge |
| `matrix-relay` | `matrix-matrix-relay` (local build) | Custom relay service |
## Network Architecture
All containers (except the Tailscale sidecar) communicate over a shared internal bridge network `matrix_matrix-internal` (`172.25.0.0/16`). No ports are exposed directly to the host — all external access goes through Tailscale on the `synapse` container.
| Container | Internal IP |
|---|---|
| `synapse` | `172.25.0.2` |
| `mautrix-discord` | `172.25.0.3` |
| `mautrix-whatsapp` | `172.25.0.4` |
| `mautrix-gmessages` | `172.25.0.5` |
| `matrix-db` | `172.25.0.6` |
| `matrix-relay` | `172.25.0.7` |
| `mautrix-slack` | `172.25.0.8` |
## Compose File
**Path:** `/home/artanis/DockerFiles/Matrix/matrix/compose.yaml`
```yaml
services:
matrix-tailscale:
image: tailscale/tailscale:latest
container_name: matrix-tailscale
restart: unless-stopped
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun
volumes:
- matrix_tailscale_state:/var/lib/tailscale
environment:
- TS_AUTHKEY=<redacted>
- TS_HOSTNAME=matrix
- TS_STATE_DIR=/var/lib/tailscale
network_mode: "service:synapse"
matrix-db:
image: postgres:16-alpine
container_name: matrix-db
restart: unless-stopped
environment:
POSTGRES_USER: synapse
POSTGRES_PASSWORD: <redacted>
POSTGRES_DB: synapse
volumes:
- /home/artanis/DockerFiles/Matrix/postgresdata:/var/lib/postgresql/data
networks:
- matrix-internal
synapse:
image: matrixdotorg/synapse:latest
container_name: synapse
restart: unless-stopped
depends_on:
- matrix-db
volumes:
- /home/artanis/DockerFiles/Matrix/synapsedata:/data
networks:
- matrix-internal
mautrix-whatsapp:
image: dock.mau.dev/mautrix/whatsapp:latest
container_name: mautrix-whatsapp
restart: unless-stopped
volumes:
- /home/artanis/DockerFiles/Matrix/whatsappdata:/data
networks:
- matrix-internal
mautrix-gmessages:
image: dock.mau.dev/mautrix/gmessages:latest
container_name: mautrix-gmessages
restart: unless-stopped
volumes:
- /home/artanis/DockerFiles/Matrix/gmessagesdata:/data
networks:
- matrix-internal
mautrix-slack:
image: dock.mau.dev/mautrix/slack:latest
container_name: mautrix-slack
restart: unless-stopped
volumes:
- /home/artanis/DockerFiles/Matrix/slackdata:/data
networks:
- matrix-internal
mautrix-discord:
image: dock.mau.dev/mautrix/discord:latest
container_name: mautrix-discord
restart: unless-stopped
volumes:
- /home/artanis/DockerFiles/Matrix/discorddata:/data
networks:
- matrix-internal
depends_on:
- matrix-db
- synapse
matrix-relay:
build:
context: ../
dockerfile: matrix_relay.Dockerfile
container_name: matrix-relay
restart: unless-stopped
networks:
- matrix-internal
networks:
matrix-internal:
driver: bridge
volumes:
matrix_tailscale_state:
```
## Data Layout
| Path | Contents |
|---|---|
| `/home/artanis/DockerFiles/Matrix/postgresdata` | PostgreSQL data |
| `/home/artanis/DockerFiles/Matrix/synapsedata` | Synapse config, media store |
| `/home/artanis/DockerFiles/Matrix/whatsappdata` | WhatsApp bridge config/state |
| `/home/artanis/DockerFiles/Matrix/gmessagesdata` | Google Messages bridge config/state |
| `/home/artanis/DockerFiles/Matrix/slackdata` | Slack bridge config/state |
| `/home/artanis/DockerFiles/Matrix/discorddata` | Discord bridge config/state |
## Notes
- The `matrix-relay` container is built from a local `matrix_relay.Dockerfile` located one directory up from the compose file (`/home/artanis/DockerFiles/Matrix/`)
- Synapse does not expose any ports to the host — it is only reachable via the `matrix_matrix-internal` network and through Tailscale
- The Tailscale sidecar attaches to `synapse`'s network namespace, so Synapse's internal ports (8008, 8448) become accessible at `matrix.bunny-wyvern.ts.net`

63
21-Server Reference/homelab/stacks/mealie.md Normal file
View File

@@ -0,0 +1,63 @@
# Mealie
Self-hosted recipe manager and meal planner.
## Access
- **Tailscale:** [mealie.bunny-wyvern.ts.net](https://mealie.bunny-wyvern.ts.net)
## Containers
| Container | Image | Role |
|---|---|---|
| `mealie` | `ghcr.io/mealie-recipes/mealie:latest` | Web app |
| `mealie-tailscale-sidecar` | `tailscale/tailscale:latest` | Tailscale node |
## Compose File
**Path:** `/home/artanis/DockerFiles/Mealie/docker-compose.yaml`
```yaml
services:
mealie:
image: ghcr.io/mealie-recipes/mealie:latest
container_name: mealie
restart: always
deploy:
resources:
limits:
memory: 1000M
volumes:
- /home/artanis/DockerFiles/Mealie/data:/app/data/
environment:
ALLOW_SIGNUP: "false"
PUID: 1000
PGID: 1000
TZ: America/Chicago
SECURITY_MAX_LOGIN_ATTEMPTS: 5
SECURITY_USER_LOCKOUT_TIME: 1
BASE_URL: https://mealie.bunny-wyvern.ts.net/
mealie-tailscale-sidecar:
image: tailscale/tailscale:latest
container_name: mealie-tailscale-sidecar
restart: unless-stopped
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun
volumes:
- mealie_tailscale_state:/var/lib/tailscale
environment:
- TS_AUTHKEY=<redacted>
- TS_HOSTNAME=mealie
- TS_STATE_DIR=/var/lib/tailscale
network_mode: "service:mealie"
volumes:
mealie_tailscale_state:
```
## Notes
- Public signup is disabled — accounts must be created by an admin
- Memory capped at 1 GB
- Data is bind-mounted to `/home/artanis/DockerFiles/Mealie/data`
- OpenAI/LLM integration was previously attempted (commented out in compose) — it was disabled because it was too resource-intensive and caused crashes

58
21-Server Reference/homelab/stacks/melodix.md Normal file
View File

@@ -0,0 +1,58 @@
# Melodix
Discord music bot. Plays audio in Discord voice channels.
## Access
Internal only — no web UI, no exposed ports. Controlled via Discord commands.
## Containers
| Container | Image | Role |
|---|---|---|
| `melodix` | `melodix-image` (local build) | Discord bot |
No Tailscale sidecar. The bot connects outbound to Discord's API.
## Compose File
**Path:** `/home/artanis/DockerFiles/melodix/melodix/docker/docker-compose.yml`
```yaml
services:
melodix:
container_name: melodix
restart: always
image: '${ALIAS}-image'
volumes:
- ./data/datastore.json:/usr/project/datastore.json
- ./data/cache:/usr/project/cache
environment:
- DISCORD_TOKEN=${DISCORD_TOKEN}
- ENCODE_VOLUME=${ENCODE_VOLUME}
- ENCODE_CHANNELS=${ENCODE_CHANNELS}
- ENCODE_FRAME_RATE=${ENCODE_FRAME_RATE}
- ENCODE_FRAME_DURATION=${ENCODE_FRAME_DURATION}
- ENCODE_BITRATE=${ENCODE_BITRATE}
- ENCODE_COMPRESSION_LEVEL=${ENCODE_COMPRESSION_LEVEL}
- ENCODE_PACKET_LOSS=${ENCODE_PACKET_LOSS}
- ENCODE_BUFFERED_FRAMES=${ENCODE_BUFFERED_FRAMES}
- ENCODE_VBR=${ENCODE_VBR}
- ENCODE_VOLUME_FLOAT=${ENCODE_VOLUME_FLOAT}
- ENCODE_RECONNECT_AT_EOF=${ENCODE_RECONNECT_AT_EOF}
- ENCODE_RECONNECT_STREAMED=${ENCODE_RECONNECT_STREAMED}
- ENCODE_RECONNECT_ON_NETWORK_ERROR=${ENCODE_RECONNECT_ON_NETWORK_ERROR}
- ENCODE_RECONNECT_ON_HTTP_ERROR=${ENCODE_RECONNECT_ON_HTTP_ERROR}
- ENCODE_RECONNECT_DELAY_MAX=${ENCODE_RECONNECT_DELAY_MAX}
- ENCODE_FFMPEG_BINARY_PATH=${ENCODE_FFMPEG_BINARY_PATH}
- ENCODE_ENCODING_LINE_LOG=${ENCODE_ENCODING_LINE_LOG}
- ENCODE_USER_AGENT=${ENCODE_USER_AGENT}
- ENCODE_RAW_OUTPUT=${ENCODE_RAW_OUTPUT}
entrypoint: /usr/project/app
```
## Notes
- The image is built locally (`melodix-image`) — the build context and Dockerfile are in the parent directory of the compose file
- All configuration comes from the `.env` file at `/home/artanis/DockerFiles/melodix/melodix/docker/.env`
- `DISCORD_TOKEN` is the bot's Discord API token (in `.env`, redacted here)
- The `ENCODE_*` variables control FFmpeg audio encoding settings for the voice stream
- Data is stored via **relative bind mounts** (`./data/`) relative to the compose file directory — so at `/home/artanis/DockerFiles/melodix/melodix/docker/data/`
- Dockhand shows this stack under the name `docker` (the stack name is derived from the compose working directory name)

69
21-Server Reference/homelab/stacks/minecraft.md Normal file
View File

@@ -0,0 +1,69 @@
# Minecraft Server
Self-hosted Minecraft server running the **TerraFirmaGreg: Modern** modpack.
## Access
- **Host:** `192.168.2.114:25565` (LAN / Tailscale)
- **Voice Chat:** `192.168.2.114:24454/udp`
No Tailscale sidecar — ports are exposed directly on the host.
## Containers
| Container | Image | Role |
|---|---|---|
| `minecraft` | `itzg/minecraft-server:latest` | Game server |
## Compose File
**Path:** `/Minecraft_Server/docker-compose.yaml`
> Note: This file lives outside the main `DockerFiles` directory. It is explicitly mounted into the Dockhand container so it can manage it.
```yaml
services:
mc:
image: itzg/minecraft-server:latest
container_name: minecraft
mem_limit: 12g
tty: true
stdin_open: true
ports:
- 25565:25565
- 24454:24454/udp # Voice Chat
volumes:
- /Minecraft_Server/Minecraft_Server/data:/data
- /Minecraft_Server/Minecraft_Server/modpacks:/modpacks:ro
- /Minecraft_Server/Minecraft_Server/downloads:/downloads
environment:
EULA: TRUE
TYPE: AUTO_CURSEFORGE
VERSION: 1.20.1
CF_API_KEY: <redacted>
CF_PAGE_URL: "https://www.curseforge.com/minecraft/modpacks/terrafirmagreg-modern/files/7665541"
CF_BASE_DIR: /data
INIT_MEMORY: 8G
MAX_MEMORY: 12G
ENABLE_AUTOPAUSE: true
MAX_TICK_TIME: -1
AUTOPAUSE_TIMEOUT_INIT: 600 # 10 min before pausing on empty server (init)
AUTOPAUSE_TIMEOUT_EST: 1800 # 30 min before pausing (established)
ENABLE_ROLLING_LOGS: true
LOG_TIMESTAMP: true
MOTD: "Why does Pingle sound like Pringle. Does Sam own Pringles?"
restart: unless-stopped
```
## Data Layout
| Path | Contents |
|---|---|
| `/Minecraft_Server/Minecraft_Server/data` | World saves, server config, plugins |
| `/Minecraft_Server/Minecraft_Server/modpacks` | Modpack files (read-only) |
| `/Minecraft_Server/Minecraft_Server/downloads` | CurseForge download cache |
## Notes
- Uses `itzg/minecraft-server` with `AUTO_CURSEFORGE` type — it auto-downloads the modpack from CurseForge on startup if not already present
- Modpack: **TerraFirmaGreg: Modern** (MC 1.20.1), pinned to a specific file ID (`7665541`)
- Memory: 8 GB initial, 12 GB max (hard limit via `mem_limit: 12g`)
- **Auto-pause** is enabled — server pauses after 30 minutes with no players, resumes on connection
- `MAX_TICK_TIME: -1` disables the watchdog timer (prevents server shutdown if a tick takes too long, common with heavy modpacks)

60
21-Server Reference/homelab/stacks/n8n.md Normal file
View File

@@ -0,0 +1,60 @@
# n8n
Self-hosted workflow automation platform (similar to Zapier/Make).
## Access
- **Tailscale:** [n8n.bunny-wyvern.ts.net](https://n8n.bunny-wyvern.ts.net)
- **LAN:** `http://192.168.2.114:5678`
## Containers
| Container | Image | Role |
|---|---|---|
| `n8n` | `docker.n8n.io/n8nio/n8n` | Web app + workflow engine |
| `n8n-tailscale-sidecar` | `tailscale/tailscale:latest` | Tailscale node |
## Compose File
**Path:** `/home/artanis/DockerFiles/n8n/docker-compose.yml`
```yaml
volumes:
n8n_storage:
n8n_tailscale_state:
services:
n8n:
image: docker.n8n.io/n8nio/n8n
restart: always
pull_policy: always
container_name: n8n
environment:
- DB_TYPE=sqlite
- N8N_RUNNERS_ENABLED=true
- N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}
ports:
- 5678:5678
volumes:
- n8n_storage:/home/node/.n8n
n8n-tailscale-sidecar:
image: tailscale/tailscale:latest
container_name: n8n-tailscale-sidecar
restart: always
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun
volumes:
- n8n_tailscale_state:/var/lib/tailscale
environment:
- TS_AUTHKEY=<redacted>
- TS_HOSTNAME=n8n
- TS_STATE_DIR=/var/lib/tailscale
network_mode: "service:n8n"
```
## Notes
- Database: SQLite (stored in the `n8n_storage` named volume)
- `N8N_HOST` and `DOMAIN_NAME` are set via `.env` file at `/home/artanis/DockerFiles/n8n/.env`
- `N8N_RUNNERS_ENABLED=true` enables the task runner mode for better workflow execution performance
- `N8N_SECURE_COOKIE` is commented out — HTTPS is handled by Tailscale so cookies are secure by default

62
21-Server Reference/homelab/stacks/openproject.md Normal file
View File

@@ -0,0 +1,62 @@
# OpenProject
Self-hosted project management tool (tasks, timelines, wikis).
## Access
- **Tailscale:** [openproject.bunny-wyvern.ts.net](https://openproject.bunny-wyvern.ts.net)
- **LAN:** `http://192.168.2.114:5010`
## Containers
| Container | Image | Role |
|---|---|---|
| `openproject` | `openproject/openproject:17` (pinned hash) | Web app (all-in-one) |
| `openproject-tailscale-sidecar` | `tailscale/tailscale` (pinned hash) | Tailscale node |
> Both containers are running pinned image hashes rather than tags. This means they will not auto-update until the compose file is updated with a new image reference.
## Compose File
**Path:** `/home/artanis/DockerFiles/openproject/docker-compose.yaml`
```yaml
services:
openproject:
image: openproject/openproject:17
container_name: openproject
restart: always
ports:
- "5010:80"
environment:
- SECRET_KEY_BASE=<redacted>
- OPENPROJECT_HOST__NAME=openproject.bunny-wyvern.ts.net
- OPENPROJECT_HTTPS=true
- OPENPROJECT_DEFAULT__LANGUAGE=en
stdin_open: true
tty: true
openproject-tailscale-sidecar:
image: tailscale/tailscale:latest
container_name: openproject-tailscale-sidecar
restart: always
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun
volumes:
- openproject_tailscale_state:/var/lib/tailscale
environment:
- TS_AUTHKEY=<redacted>
- TS_HOSTNAME=openproject
- TS_STATE_DIR=/var/lib/tailscale
network_mode: "service:openproject"
volumes:
openproject_tailscale_state:
```
## Notes
- Uses the **all-in-one** OpenProject image (includes database, worker, web server in a single container)
- Version pinned to `17`
- `OPENPROJECT_HTTPS=true` tells OpenProject it is behind HTTPS (needed for correct URL generation even though TLS is terminated by Tailscale, not OpenProject itself)
- Data is stored in two **anonymous volumes** (auto-generated hashes) — this means data is not trivially accessible on the host filesystem. Use `docker volume inspect` or the Dockhand volume browser to locate them
- There are orphaned volumes from earlier OpenProject stack iterations: `open-project_open_project_tailscale_state`, `open-project_openproject_tailscale_state`, and `openproject_openproject_tailscale_state`