fd48fed9d8
Core Infrastructure: - Add LLDAP for centralized user authentication (lldap.fig.systems) - Configure Tinyauth with LLDAP backend for SSO (auth.fig.systems) - Set up Traefik v3.3 with Let's Encrypt SSL automation - Create homelab Docker network for service isolation Media Services: - Configure Jellyfin with /media folder mappings (flix.fig.systems) - Add Jellyseerr for media requests (requests.fig.systems) - Update Immich with photo library access (photos.fig.systems) - Set up Sonarr for TV automation (sonarr.fig.systems) - Set up Radarr for movie automation (radarr.fig.systems) - Configure SABnzbd for Usenet downloads (sabnzbd.fig.systems) - Add qBittorrent for torrent downloads (qbt.fig.systems) Utility Services: - Update Linkwarden with proper networking (links.fig.systems) - Configure Vikunja task management (tasks.fig.systems) - Set up LubeLogger vehicle tracking (garage.fig.systems) - Configure Calibre-web for ebooks (books.fig.systems) - Add Booklore for book tracking (booklore.fig.systems) - Update FreshRSS reader (rss.fig.systems) - Update RSSHub with internal networking (rsshub.fig.systems) - Update MicroBin pastebin (paste.fig.systems) - Add File Browser for media access (files.fig.systems) Technical Improvements: - Standardize all compose files to compose.yaml (Docker best practice) - Add Traefik labels to all services for SSL termination - Implement proper network isolation (homelab + service-specific networks) - Add health checks to database services - Configure dual domain support (fig.systems + edfig.dev) - Set proper /media folder mappings for all media services - Add comprehensive README with deployment instructions Security: - Enable SSO via Tinyauth for most services - Configure LLDAP with admin user (edfig/admin@edfig.dev) - Services with built-in auth have SSO disabled by default - All traffic secured with automatic Let's Encrypt certificates
103 lines
3.7 KiB
YAML
103 lines
3.7 KiB
YAML
#
|
|
# Immich - Self-hosted photo and video management
|
|
# WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose
|
|
#
|
|
# Make sure to use the docker-compose.yml of the current release:
|
|
#
|
|
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
|
|
# https://docs.immich.app/install/docker-compose/
|
|
#
|
|
# The compose file on main may not be compatible with the latest release.
|
|
|
|
name: immich
|
|
|
|
services:
|
|
immich-server:
|
|
container_name: immich_server
|
|
image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
|
|
# extends:
|
|
# file: hwaccel.transcoding.yml
|
|
# service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
|
|
volumes:
|
|
# Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
|
|
- ${UPLOAD_LOCATION}:/data
|
|
- /etc/localtime:/etc/localtime:ro
|
|
# External photo library (optional - can be imported into Immich)
|
|
- /media/photos:/media/photos:ro
|
|
env_file:
|
|
- .env
|
|
ports:
|
|
- '2283:2283'
|
|
depends_on:
|
|
- redis
|
|
- database
|
|
restart: always
|
|
networks:
|
|
- homelab
|
|
- immich_internal
|
|
healthcheck:
|
|
disable: false
|
|
labels:
|
|
traefik.enable: true
|
|
traefik.docker.network: homelab
|
|
traefik.http.routers.immich.rule: Host(`photos.fig.systems`) || Host(`photos.edfig.dev`)
|
|
traefik.http.routers.immich.entrypoints: websecure
|
|
traefik.http.routers.immich.tls.certresolver: letsencrypt
|
|
traefik.http.services.immich.loadbalancer.server.port: 2283
|
|
# Optional: Enable SSO (note: Immich has its own user management)
|
|
# traefik.http.routers.immich.middlewares: tinyauth
|
|
|
|
immich-machine-learning:
|
|
container_name: immich_machine_learning
|
|
# For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
|
|
# Example tag: ${IMMICH_VERSION:-release}-cuda
|
|
image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
|
|
# extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
|
|
# file: hwaccel.ml.yml
|
|
# service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
|
|
volumes:
|
|
- model-cache:/cache
|
|
env_file:
|
|
- .env
|
|
restart: always
|
|
networks:
|
|
- immich_internal
|
|
healthcheck:
|
|
disable: false
|
|
|
|
redis:
|
|
container_name: immich_redis
|
|
image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
|
|
healthcheck:
|
|
test: redis-cli ping || exit 1
|
|
restart: always
|
|
networks:
|
|
- immich_internal
|
|
|
|
database:
|
|
container_name: immich_postgres
|
|
image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
|
|
environment:
|
|
POSTGRES_PASSWORD: ${DB_PASSWORD}
|
|
POSTGRES_USER: ${DB_USERNAME}
|
|
POSTGRES_DB: ${DB_DATABASE_NAME}
|
|
POSTGRES_INITDB_ARGS: '--data-checksums'
|
|
# Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
|
|
# DB_STORAGE_TYPE: 'HDD'
|
|
volumes:
|
|
# Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
|
|
- ${DB_DATA_LOCATION}:/var/lib/postgresql/data
|
|
shm_size: 128mb
|
|
restart: always
|
|
networks:
|
|
- immich_internal
|
|
|
|
networks:
|
|
homelab:
|
|
external: true
|
|
immich_internal:
|
|
name: immich_internal
|
|
driver: bridge
|
|
|
|
volumes:
|
|
model-cache:
|