Service config

.pre-commit-config.yaml

@@ -13,7 +13,8 @@ repos:
         exclude: |
             (?x)^(
                 docker/security/authelia/|
-                docker/automation/mosquitto/
+                docker/automation/mosquitto/|
+                docker/tools/searxng/config/
             )
       - id: mixed-line-ending
       - id: fix-byte-order-marker

Taskfile.yaml

@@ -87,6 +87,12 @@ tasks:
       - task: docs:clean
       - task: azure-vm:clean
       - task: aws-vm:clean
+      - task: clean-venvs
+
+  clean-venvs:
+    desc: Remove Python virtual environments (.venv directories)
+    cmds:
+      - find . -type d -name '.venv' -exec rm -rf {} +
 
   btrfs-compsize:
     desc: Show btrfs compression statistics

config-example/docker/myhost/.env

@@ -69,6 +69,10 @@ CROWDSEC_BOUNCER_API_KEY="use-some-very-secure-value-here"
 # Then create the user on Settings -> Admins
 UNIFI_LOCAL_VIEWONLY_USERNAME="use-some-very-secure-value-here"
 UNIFI_LOCAL_VIEWONLY_PASSWORD="use-some-very-secure-value-here"
+# Used to connect the shared mongodb instance
+UNIFI_MONGO_DBNAME="unifi"
+UNIFI_MONGO_USERNAME="use-some-very-secure-value-here"
+UNIFI_MONGO_PASSWORD="use-some-very-secure-value-here"
 
 # Generate a secure random key (min 32 chars) using: `openssl rand -base64 32`
 OPEN_WEBUI_SECRET_KEY="use-some-very-secure-value-here"
@@ -103,6 +107,8 @@ OBSIDIAN_LIVESYNC_PASSPHRASE="use-some-very-secure-value-here"
 GITEA_SECRET_KEY="use-some-very-secure-value-here"
 # Generate these with: docker run --rm gitea/gitea:1.24.6 gitea generate secret INTERNAL_TOKEN
 GITEA_INTERNAL_TOKEN="use-some-very-secure-value-here"
+# act_runner registration - Navigate to Gitea Admin → Actions → Runners → Create Runner
+GITEA_RUNNER_REGISTRATION_TOKEN="use-some-very-secure-value-here"
 
 ### Microsoft SQL Server configuration
 # Password requirements: At least 8 characters, with uppercase, lowercase, numbers, and special characters

docker/ai/litellm/config/config.yaml

@@ -87,9 +87,9 @@ model_list:
       model: gemini/gemini-2.5-pro
       api_key: "os.environ/GEMINI_API_KEY"
 
-  - model_name: gemini-2.5-flash
+  - model_name: gemini-3.5-flash
     litellm_params:
-      model: gemini/gemini-2.5-flash
+      model: gemini/gemini-3.5-flash
       api_key: "os.environ/GEMINI_API_KEY"
 
   # --- Via Openrouter

docker/ai/litellm/litellm.yaml

@@ -9,7 +9,7 @@
 name: litellm
 services:
   litellm:
-    image: ghcr.io/berriai/litellm:v1.91.0-stable
+    image: ghcr.io/berriai/litellm:v1.91.0
     command:
       - --config=/app/config.yaml
       - --telemetry=false

docker/ai/ollama/ollama-amdgpu.yaml

@@ -1,14 +1,22 @@
-# GPU override for Ollama — AMD ROCm hardware inference.
+# GPU override for Ollama — AMD iGPU inference via the Vulkan backend.
 # Enable by setting GPU_COMPOSE_SUFFIX=amdgpu in config/docker/<hostname>/.env
-# Switches to the :rocm image tag and passes both DRI and KFD devices.
+# NOTE: deliberately the STANDARD image, not :rocm — colony's Vega iGPU
+# (Ryzen 7 5825U, gfx90c) has no rocblas kernels in ROCm builds ("dropping
+# ROCm device"), while the standard image ships the ggml Vulkan backend
+# (the :rocm image does not), which supports Vega iGPUs via RADV.
+# OLLAMA_IGPU_ENABLE opts the iGPU into scheduling on Linux.
+# References:
+# - Vulkan backend for AMD/Intel GPUs: https://github.com/ollama/ollama/issues/11247
+# - Hardware support matrix (Vulkan path for iGPUs): https://docs.ollama.com/gpu
 ---
 name: ollama
 services:
   ollama:
-    image: ollama/ollama:0.31.1-rocm
+    image: ollama/ollama:0.31.1
     devices:
       - /dev/dri/renderD128:/dev/dri/renderD128
-      - /dev/kfd:/dev/kfd
+    environment:
+      OLLAMA_IGPU_ENABLE: "1"
     group_add:
       - "${GPU_RENDER_GID}"  # render group — numeric GID required (name may not exist in container)
       - "${GPU_VIDEO_GID}"   # video group

docker/automation/n8n/n8n.yaml

@@ -8,6 +8,13 @@
 ---
 name: n8n
 services:
+  n8n-postgres-init:
+    image: busybox:1.38.0
+    container_name: n8n-postgres-init
+    command: ["sh", "-c", "chown -R 70:70 /var/lib/postgresql/data"]
+    volumes:
+      - ${DOCKER_VOLUMES}/n8n/postgres-data:/var/lib/postgresql/data
+
   n8n-postgres:
     image: postgres:16-alpine
     container_name: n8n-postgres
@@ -19,15 +26,18 @@ services:
       POSTGRES_PASSWORD: ${N8N_POSTGRES_PASSWORD}
       POSTGRES_DB: ${N8N_POSTGRES_DB}
     volumes:
-      - n8n_postgres_storage:/var/lib/postgresql/data
+      - ${DOCKER_VOLUMES}/n8n/postgres-data:/var/lib/postgresql/data
+    depends_on:
+      n8n-postgres-init:
+        condition: service_completed_successfully
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -h localhost -U ${N8N_POSTGRES_USER} -d ${N8N_POSTGRES_DB}"]
       interval: 5s
       timeout: 5s
       retries: 10
 
   initContainer:
-    image: busybox
+    image: busybox:1.38.0
     container_name: n8n-init
     command: ["sh", "-c", "chown -R 1000:1000 /home/node/.n8n"]
     volumes:
@@ -76,6 +86,3 @@ networks:
     external: false
   proxy:
     external: true
-
-volumes:
-  n8n_postgres_storage:

docker/dashboard/homepage/config/services.yaml

@@ -25,9 +25,9 @@
         description: Remote Desktop connection
         icon: windows-10.png
 
-- Arr:
-    - qBittorrent @ NAS:
-        href: https://qbittorrent.{{HOMEPAGE_VAR_MYDOMAIN}}/
-        siteMonitor: https://qbittorrent.{{HOMEPAGE_VAR_MYDOMAIN}}/
-        description: "BitTorrent client"
-        icon: qbittorrent.png
+# - Arr:
+#     - qBittorrent @ NAS:
+#         href: https://qbittorrent.{{HOMEPAGE_VAR_MYDOMAIN}}/
+#         siteMonitor: https://qbittorrent.{{HOMEPAGE_VAR_MYDOMAIN}}/
+#         description: "BitTorrent client"
+#         icon: qbittorrent.png

docker/database/mongodb/mongodb.yaml

@@ -0,0 +1,59 @@
+# MongoDB is a source-available, document-oriented NoSQL database designed for scalability and
+# developer agility, storing data as flexible, JSON-like documents rather than rows and columns.
+#
+# This is a shared instance, following the same pattern as postgresql/couchdb in this category.
+# Mongo's /docker-entrypoint-initdb.d scripts only run once, on first startup with an empty data
+# directory — each consuming service should add its own init script under ./config/initdb when it
+# first starts using this instance. A service added *after* this instance already has data must
+# create its user/db manually via `mongosh` instead, since init scripts won't re-run.
+#
+# Links:
+# - Home: https://www.mongodb.com
+# - Source: https://github.com/docker-library/mongo
+# - Docs: https://hub.docker.com/_/mongo
+#
+# TODO: Add a mongo-express (or similar) admin UI service if a web GUI is wanted
+# TODO: Implement an automated backup solution (mongodump)
+---
+name: mongodb
+services:
+  mongodb-init:
+    image: busybox:1.38.0
+    container_name: mongodb-init
+    command: ["sh", "-c", "chown -R 999:999 /data/db"]
+    volumes:
+      - ${DOCKER_VOLUMES}/mongodb/data:/data/db
+
+  mongodb:
+    image: mongo:7.0.37-jammy
+    container_name: mongodb
+    restart: unless-stopped
+    # kics-scan ignore-block
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: ${MONGO_ROOT_USERNAME:-root}
+      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD:?MongoDB root password must be set}
+    volumes:
+      - ${DOCKER_VOLUMES}/mongodb/data:/data/db
+      - ./config/initdb:/docker-entrypoint-initdb.d
+    ports:
+      - 27017:27017
+    networks:
+      - proxy
+    depends_on:
+      mongodb-init:
+        condition: service_completed_successfully
+    healthcheck:
+      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping')"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    labels:
+      traefik.enable: false
+      homepage.group: Storage
+      homepage.name: MongoDB
+      homepage.icon: mongodb.png
+      homepage.description: "Popular NoSQL document database"
+
+networks:
+  proxy:
+    external: true

docker/database/mssql-server/mssql-server.yaml

@@ -12,6 +12,13 @@
 ---
 name: mssql-server
 services:
+  mssql-server-init:
+    image: busybox:1.38.0
+    container_name: mssql-server-init
+    command: ["sh", "-c", "chown -R 10001:10001 /var/opt/mssql"]
+    volumes:
+      - ${DOCKER_VOLUMES}/mssql-server/data:/var/opt/mssql
+
   mssql-server:
     image: mcr.microsoft.com/mssql/server:2025-latest
     container_name: mssql-server
@@ -27,14 +34,14 @@ services:
     ports:
       - "1433:1433"
     volumes:
-      - mssql_data:/var/opt/mssql
+      - ${DOCKER_VOLUMES}/mssql-server/data:/var/opt/mssql
+    depends_on:
+      mssql-server-init:
+        condition: service_completed_successfully
     labels:
       traefik.enable: false
       homepage.group: Storage
       homepage.name: Microsoft SQL Server
       homepage.icon: microsoft-sql-server.png
       homepage.href: mssql://${LOCAL_NODE_IP:-127.0.0.1}:1433
       homepage.description: Enterprise relational database
-
-volumes:
-  mssql_data:

docker/database/postgresql/postgresql.yaml

@@ -15,6 +15,13 @@
 ---
 name: postgresql
 services:
+  postgresql-init:
+    image: busybox:1.38.0
+    container_name: postgresql-init
+    command: ["sh", "-c", "chown -R 999:999 /var/lib/postgresql"]
+    volumes:
+      - ${DOCKER_VOLUMES}/postgresql/data:/var/lib/postgresql
+
   postgresql:
     image: postgres:18.4-trixie
     container_name: postgresql
@@ -27,12 +34,15 @@ services:
       POSTGRES_DB: ${POSTGRES_DB:-postgres}
       POSTGRES_INITDB_ARGS: --data-checksums
     volumes:
-      - postgres-data:/var/lib/postgresql
+      - ${DOCKER_VOLUMES}/postgresql/data:/var/lib/postgresql
       - ./config/initdb:/docker-entrypoint-initdb.d
     ports:
       - 5432:5432
     networks:
       - proxy
+    depends_on:
+      postgresql-init:
+        condition: service_completed_successfully
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
       interval: 10s
@@ -45,9 +55,6 @@ services:
       homepage.icon: postgresql.png
       homepage.description: "Powerful open source object-relational database system"
 
-volumes:
-  postgres-data:
-
 networks:
   proxy:
     external: true

docker/dev/act-runner/act-runner.yaml

@@ -0,0 +1,51 @@
+# Gitea Runner (formerly act_runner) is the official runner for Gitea Actions.
+# It connects to a Gitea instance and executes CI/CD workflows in isolated Docker containers,
+# supporting three modes: host-level execution, Docker (bind-mounting the host Docker socket),
+# and Docker-in-Docker (DinD) for full isolation.
+#
+# Links:
+# - Home: https://gitea.com/gitea/runner
+# - Source: https://gitea.com/gitea/runner
+# - Docs: https://docs.gitea.com/usage/actions/act-runner
+# - Install instructions URL: https://docs.gitea.com/usage/actions/act-runner
+# - Compose: https://docs.gitea.com/usage/actions/act-runner
+#
+# Registration:
+# 1. Navigate to Gitea Admin → Actions → Runners → Create Runner
+# 2. Copy the registration token and set GITEA_RUNNER_REGISTRATION_TOKEN in the host .env file
+# 3. The runner auto-registers on first start using this token; the resulting .runner file
+#    persists in the /data volume and is used for all subsequent connections
+# 4. To re-register (e.g. after token rotation), stop the container, delete the
+#    ${DOCKER_VOLUMES}/act-runner/.runner file, and restart
+#
+# TODO: Pin to a specific version tag instead of 2.0.0 for production stability
+# TODO: Use the dind-rootless flavour for production deployments requiring job isolation
+# TODO: Configure a shared external cache server across multiple runners to avoid rebuilding on each runner
+# TODO: Mount runner images from a local registry or mirror to avoid rate limits on Docker Hub
+# TODO: Configure container.valid_volumes to restrict which host paths job containers can mount
+# TODO: Join Traefik to the dev-act-runner network in docker/security/traefik/traefik.yaml if a web UI is added
+---
+name: act-runner
+services:
+  act-runner:
+    image: gitea/runner:2.0.0
+    container_name: act-runner
+    restart: unless-stopped
+    environment:
+      TZ: ${TIMEZONE}
+      CONFIG_FILE: /config.yaml
+      GITEA_INSTANCE_URL: https://gitea.${MYDOMAIN}/
+      GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN}
+      GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME:-act-runner}
+      GITEA_RUNNER_LABELS: ${GITEA_RUNNER_LABELS:-docker:docker://node:20-bookworm,ubuntu-latest:docker://node:20-bookworm}
+    volumes:
+      - ${DOCKER_VOLUMES}/act-runner:/data
+      - ./config/config.yaml:/config.yaml:ro
+      # kics-scan ignore-line
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - dev-act-runner
+
+networks:
+  dev-act-runner:
+    external: true

docker/dev/act-runner/config/config.yaml

@@ -0,0 +1,21 @@
+# Gitea Runner configuration
+# See https://gitea.com/gitea/runner/src/branch/main/config.example.yaml
+
+log:
+  level: info
+
+runner:
+  labels:
+    - docker:docker://node:20-bookworm
+    - ubuntu-latest:docker://node:20-bookworm
+
+container:
+  # Empty = the runner creates a per-job docker network, which is the only
+  # way workflow `services:` hostnames (e.g. postgres, qdrant) resolve from
+  # the job container — the default bridge network has no name resolution.
+  network: ""
+  privileged: false
+
+cache:
+  host: ""
+  port: 8088

docker/dev/jupyter-notebook/jupyter-notebook.yaml

@@ -12,7 +12,7 @@
 name: jupyter-notebook
 services:
   jupyter-notebook:
-    image: quay.io/jupyter/minimal-notebook:notebook-7.2.2
+    image: quay.io/jupyter/minimal-notebook:notebook-7.6.0
     container_name: jupyter-notebook
     restart: unless-stopped
     networks: