Set up gateway, gitea & immich
This commit is contained in:
@@ -0,0 +1,3 @@
|
|||||||
|
**/data/**
|
||||||
|
**/secrets/**
|
||||||
|
.DS_Store
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
# Homelab
|
||||||
|
|
||||||
|
Configuration for the Homelab
|
||||||
|
|
||||||
|
## Project Structure
|
||||||
|
|
||||||
|
- Each folder contains an independently-runnable docker compose which comprises a logical grouping of services
|
||||||
|
- All volumes are placed under a folder `/data`
|
||||||
|
- All secrets are placed under a folder `/secrets`
|
||||||
@@ -0,0 +1,135 @@
|
|||||||
|
# Miscellaneous https://www.authelia.com/configuration/miscellaneous/introduction/
|
||||||
|
# Set also AUTHELIA_JWT_SECRET_FILE
|
||||||
|
theme: auto
|
||||||
|
|
||||||
|
# First Factor https://www.authelia.com/configuration/first-factor/file/
|
||||||
|
authentication_backend:
|
||||||
|
file:
|
||||||
|
path: /config/data/users_database.yml
|
||||||
|
|
||||||
|
# Second Factor https://www.authelia.com/configuration/second-factor/introduction/
|
||||||
|
totp:
|
||||||
|
issuer: 64815139.xyz
|
||||||
|
|
||||||
|
# Security https://www.authelia.com/configuration/security/access-control/
|
||||||
|
access_control:
|
||||||
|
default_policy: "deny"
|
||||||
|
rules:
|
||||||
|
- domain: "*.64815139.xyz"
|
||||||
|
policy: "two_factor"
|
||||||
|
|
||||||
|
# Session https://www.authelia.com/configuration/session/introduction/
|
||||||
|
# Set also AUTHELIA_SESSION_SECRET_FILE
|
||||||
|
session:
|
||||||
|
cookies:
|
||||||
|
- domain: "64815139.xyz"
|
||||||
|
authelia_url: "https://auth.64815139.xyz"
|
||||||
|
|
||||||
|
# https://www.authelia.com/configuration/session/redis/
|
||||||
|
# Set also AUTHELIA_SESSION_REDIS_PASSWORD_FILE if appropriate
|
||||||
|
redis:
|
||||||
|
host: redis
|
||||||
|
port: 6379
|
||||||
|
|
||||||
|
# Storage https://www.authelia.com/configuration/storage/postgres/
|
||||||
|
# Set also AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE
|
||||||
|
# Set also AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
|
||||||
|
storage:
|
||||||
|
postgres:
|
||||||
|
address: "tcp://postgres:5432"
|
||||||
|
database: "authelia"
|
||||||
|
username: "authelia"
|
||||||
|
|
||||||
|
server:
|
||||||
|
endpoints:
|
||||||
|
authz:
|
||||||
|
forward-auth:
|
||||||
|
implementation: 'ForwardAuth'
|
||||||
|
|
||||||
|
# SMTP Notifier https://www.authelia.com/configuration/notifications/smtp/
|
||||||
|
# Set also AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
|
||||||
|
notifier:
|
||||||
|
smtp:
|
||||||
|
address: "smtp://in-v3.mailjet.com:587"
|
||||||
|
username: '{{ secret "/run/secrets/SMTP_USERNAME" }}'
|
||||||
|
sender: "Authelia <authelia@64815139.xyz>"
|
||||||
|
|
||||||
|
identity_providers:
|
||||||
|
oidc:
|
||||||
|
jwks:
|
||||||
|
- key_id: "authelia"
|
||||||
|
algorithm: "RS256"
|
||||||
|
use: "sig"
|
||||||
|
certificate_chain: {{ secret "/run/secrets/OIDC_JWKS_AUTHELIA_PEM" | mindent 10 "|" | msquote }}
|
||||||
|
key: {{ secret "/run/secrets/OIDC_JWKS_AUTHELIA_CERT" | mindent 10 "|" | msquote }}
|
||||||
|
enable_client_debug_messages: false
|
||||||
|
minimum_parameter_entropy: 8
|
||||||
|
enforce_pkce: "public_clients_only"
|
||||||
|
enable_pkce_plain_challenge: false
|
||||||
|
enable_jwt_access_token_stateless_introspection: false
|
||||||
|
discovery_signed_response_alg: "none"
|
||||||
|
discovery_signed_response_key_id: ""
|
||||||
|
require_pushed_authorization_requests: false
|
||||||
|
lifespans:
|
||||||
|
access_token: "1h"
|
||||||
|
authorize_code: "1m"
|
||||||
|
id_token: "1h"
|
||||||
|
refresh_token: "90m"
|
||||||
|
cors:
|
||||||
|
endpoints:
|
||||||
|
- "authorization"
|
||||||
|
- "token"
|
||||||
|
- "revocation"
|
||||||
|
- "introspection"
|
||||||
|
allowed_origins:
|
||||||
|
- "https://immich.64815139.xyz"
|
||||||
|
- "https://gitea.64815139.xyz"
|
||||||
|
allowed_origins_from_client_redirect_uris: false
|
||||||
|
clients:
|
||||||
|
- client_id: T0kYrFHTASAXGCV-rUOlQLDGsW0HFJRx_eAQ1dx9mo-vTgilubJMU46Ud1oRexmtZBjgAsEp
|
||||||
|
client_name: Gitea
|
||||||
|
client_secret: {{ secret "/run/secrets/GITEA_CLIENT_SECRET" }}
|
||||||
|
public: false
|
||||||
|
authorization_policy: 'two_factor'
|
||||||
|
consent_mode: pre-configured
|
||||||
|
token_endpoint_auth_method: 'client_secret_basic'
|
||||||
|
pre_configured_consent_duration: 1w
|
||||||
|
scopes:
|
||||||
|
- 'openid'
|
||||||
|
- 'email'
|
||||||
|
- 'profile'
|
||||||
|
redirect_uris:
|
||||||
|
- https://gitea.64815139.xyz/user/oauth2/Authelia/callback
|
||||||
|
- client_id: Qzmj9S-sJi0bDpUFhuJgqwJPiiGqEBtUGLmjqcZxFpLfQzb7Y9LxnmvZ2K1YoZT2vAXDqWi5
|
||||||
|
client_name: Immich
|
||||||
|
client_secret: {{ secret "/run/secrets/IMMICH_CLIENT_SECRET" }}
|
||||||
|
public: false
|
||||||
|
authorization_policy: two_factor
|
||||||
|
consent_mode: pre-configured
|
||||||
|
token_endpoint_auth_method: 'client_secret_basic'
|
||||||
|
pre_configured_consent_duration: 1w
|
||||||
|
scopes:
|
||||||
|
- openid
|
||||||
|
- groups
|
||||||
|
- email
|
||||||
|
- profile
|
||||||
|
- offline_access
|
||||||
|
redirect_uris:
|
||||||
|
- https://auth.64815139.xyz/
|
||||||
|
- https://auth.64815139.xyz/oauth2/callback
|
||||||
|
- https://immich.64815139.xyz/oauth2/callback
|
||||||
|
- https://immich.64815139.xyz/auth/login
|
||||||
|
- https://immich.64815139.xyz/user-settings
|
||||||
|
- https://immich.64815139.xyz
|
||||||
|
- app.immich:/
|
||||||
|
- app.immich:///oauth-callback
|
||||||
|
- https://immich.64815139.xyz/api/oauth/mobile-redirect
|
||||||
|
grant_types:
|
||||||
|
- refresh_token
|
||||||
|
- authorization_code
|
||||||
|
response_types:
|
||||||
|
- code
|
||||||
|
response_modes:
|
||||||
|
- form_post
|
||||||
|
- query
|
||||||
|
- fragment
|
||||||
@@ -0,0 +1,46 @@
|
|||||||
|
{
|
||||||
|
servers {
|
||||||
|
trusted_proxies static private_ranges
|
||||||
|
trusted_proxies_strict
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
(secure) {
|
||||||
|
header {
|
||||||
|
Cache-Control "no-cache, no-store, must-revalidate"
|
||||||
|
}
|
||||||
|
|
||||||
|
forward_auth authelia:9091 {
|
||||||
|
uri /api/authz/forward-auth
|
||||||
|
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
auth.64815139.xyz {
|
||||||
|
reverse_proxy authelia:9091
|
||||||
|
}
|
||||||
|
|
||||||
|
www.64815139.xyz {
|
||||||
|
import secure *
|
||||||
|
|
||||||
|
root * /var/www/dashboard
|
||||||
|
encode gzip
|
||||||
|
file_server
|
||||||
|
|
||||||
|
log {
|
||||||
|
output file /var/log/caddy/dashboard.log
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
64815139.xyz {
|
||||||
|
redir https://www.{host}{uri}
|
||||||
|
}
|
||||||
|
|
||||||
|
gitea.64815139.xyz {
|
||||||
|
rewrite /user/login /user/oauth2/Authelia
|
||||||
|
reverse_proxy 192.168.0.221:3000
|
||||||
|
}
|
||||||
|
|
||||||
|
immich.64815139.xyz {
|
||||||
|
reverse_proxy 192.168.0.221:2283
|
||||||
|
}
|
||||||
@@ -0,0 +1,36 @@
|
|||||||
|
{
|
||||||
|
"cloudflare": [
|
||||||
|
{
|
||||||
|
"authentication": {
|
||||||
|
"api_token": "${CF_DDNS_API_TOKEN}"
|
||||||
|
},
|
||||||
|
"zone_id": "65b9e7fd2d53286d6af49e9b79357729",
|
||||||
|
"subdomains": [
|
||||||
|
{
|
||||||
|
"name": "",
|
||||||
|
"proxied": false
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "www",
|
||||||
|
"proxied": false
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "auth",
|
||||||
|
"proxied": false
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "gitea",
|
||||||
|
"proxied": false
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "immich",
|
||||||
|
"proxied": false
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"a": true,
|
||||||
|
"aaaa": false,
|
||||||
|
"purgeUnknownRecords": false,
|
||||||
|
"ttl": 300
|
||||||
|
}
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<svg version="1.1" id="main_outline" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px"
|
||||||
|
y="0px" viewBox="0 0 640 640" style="enable-background:new 0 0 640 640;" xml:space="preserve">
|
||||||
|
<g>
|
||||||
|
<path id="teabag" style="fill:#FFFFFF" d="M395.9,484.2l-126.9-61c-12.5-6-17.9-21.2-11.8-33.8l61-126.9c6-12.5,21.2-17.9,33.8-11.8
|
||||||
|
c17.2,8.3,27.1,13,27.1,13l-0.1-109.2l16.7-0.1l0.1,117.1c0,0,57.4,24.2,83.1,40.1c3.7,2.3,10.2,6.8,12.9,14.4
|
||||||
|
c2.1,6.1,2,13.1-1,19.3l-61,126.9C423.6,484.9,408.4,490.3,395.9,484.2z"/>
|
||||||
|
<g>
|
||||||
|
<g>
|
||||||
|
<path style="fill:#609926" d="M622.7,149.8c-4.1-4.1-9.6-4-9.6-4s-117.2,6.6-177.9,8c-13.3,0.3-26.5,0.6-39.6,0.7c0,39.1,0,78.2,0,117.2
|
||||||
|
c-5.5-2.6-11.1-5.3-16.6-7.9c0-36.4-0.1-109.2-0.1-109.2c-29,0.4-89.2-2.2-89.2-2.2s-141.4-7.1-156.8-8.5
|
||||||
|
c-9.8-0.6-22.5-2.1-39,1.5c-8.7,1.8-33.5,7.4-53.8,26.9C-4.9,212.4,6.6,276.2,8,285.8c1.7,11.7,6.9,44.2,31.7,72.5
|
||||||
|
c45.8,56.1,144.4,54.8,144.4,54.8s12.1,28.9,30.6,55.5c25,33.1,50.7,58.9,75.7,62c63,0,188.9-0.1,188.9-0.1s12,0.1,28.3-10.3
|
||||||
|
c14-8.5,26.5-23.4,26.5-23.4s12.9-13.8,30.9-45.3c5.5-9.7,10.1-19.1,14.1-28c0,0,55.2-117.1,55.2-231.1
|
||||||
|
C633.2,157.9,624.7,151.8,622.7,149.8z M125.6,353.9c-25.9-8.5-36.9-18.7-36.9-18.7S69.6,321.8,60,295.4
|
||||||
|
c-16.5-44.2-1.4-71.2-1.4-71.2s8.4-22.5,38.5-30c13.8-3.7,31-3.1,31-3.1s7.1,59.4,15.7,94.2c7.2,29.2,24.8,77.7,24.8,77.7
|
||||||
|
S142.5,359.9,125.6,353.9z M425.9,461.5c0,0-6.1,14.5-19.6,15.4c-5.8,0.4-10.3-1.2-10.3-1.2s-0.3-0.1-5.3-2.1l-112.9-55
|
||||||
|
c0,0-10.9-5.7-12.8-15.6c-2.2-8.1,2.7-18.1,2.7-18.1L322,273c0,0,4.8-9.7,12.2-13c0.6-0.3,2.3-1,4.5-1.5c8.1-2.1,18,2.8,18,2.8
|
||||||
|
l110.7,53.7c0,0,12.6,5.7,15.3,16.2c1.9,7.4-0.5,14-1.8,17.2C474.6,363.8,425.9,461.5,425.9,461.5z"/>
|
||||||
|
<path style="fill:#609926" d="M326.8,380.1c-8.2,0.1-15.4,5.8-17.3,13.8c-1.9,8,2,16.3,9.1,20c7.7,4,17.5,1.8,22.7-5.4
|
||||||
|
c5.1-7.1,4.3-16.9-1.8-23.1l24-49.1c1.5,0.1,3.7,0.2,6.2-0.5c4.1-0.9,7.1-3.6,7.1-3.6c4.2,1.8,8.6,3.8,13.2,6.1
|
||||||
|
c4.8,2.4,9.3,4.9,13.4,7.3c0.9,0.5,1.8,1.1,2.8,1.9c1.6,1.3,3.4,3.1,4.7,5.5c1.9,5.5-1.9,14.9-1.9,14.9
|
||||||
|
c-2.3,7.6-18.4,40.6-18.4,40.6c-8.1-0.2-15.3,5-17.7,12.5c-2.6,8.1,1.1,17.3,8.9,21.3c7.8,4,17.4,1.7,22.5-5.3
|
||||||
|
c5-6.8,4.6-16.3-1.1-22.6c1.9-3.7,3.7-7.4,5.6-11.3c5-10.4,13.5-30.4,13.5-30.4c0.9-1.7,5.7-10.3,2.7-21.3
|
||||||
|
c-2.5-11.4-12.6-16.7-12.6-16.7c-12.2-7.9-29.2-15.2-29.2-15.2s0-4.1-1.1-7.1c-1.1-3.1-2.8-5.1-3.9-6.3c4.7-9.7,9.4-19.3,14.1-29
|
||||||
|
c-4.1-2-8.1-4-12.2-6.1c-4.8,9.8-9.7,19.7-14.5,29.5c-6.7-0.1-12.9,3.5-16.1,9.4c-3.4,6.3-2.7,14.1,1.9,19.8
|
||||||
|
C343.2,346.5,335,363.3,326.8,380.1z"/>
|
||||||
|
</g>
|
||||||
|
</g>
|
||||||
|
</g>
|
||||||
|
</svg>
|
||||||
|
After Width: | Height: | Size: 2.5 KiB |
@@ -0,0 +1,29 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<!-- Generator: Adobe Illustrator 28.3.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->
|
||||||
|
<svg version="1.1" id="Flower" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
|
||||||
|
viewBox="0 0 792 792" style="enable-background:new 0 0 792 792;" xml:space="preserve">
|
||||||
|
<style type="text/css">
|
||||||
|
.st0{fill:#FA2921;}
|
||||||
|
.st1{fill:#ED79B5;}
|
||||||
|
.st2{fill:#FFB400;}
|
||||||
|
.st3{fill:#1E83F7;}
|
||||||
|
.st4{fill:#18C249;}
|
||||||
|
</style>
|
||||||
|
<g id="Flower_00000077325900055813483940000000694823054982625702_">
|
||||||
|
<path class="st0" d="M375.48,267.63c38.64,34.21,69.78,70.87,89.82,105.42c34.42-61.56,57.42-134.71,57.71-181.3
|
||||||
|
c0-0.33,0-0.63,0-0.91c0-68.94-68.77-95.77-128.01-95.77s-128.01,26.83-128.01,95.77c0,0.94,0,2.2,0,3.72
|
||||||
|
C300.01,209.24,339.15,235.47,375.48,267.63z"/>
|
||||||
|
<path class="st1" d="M164.7,455.63c24.15-26.87,61.2-55.99,103.01-80.61c44.48-26.18,88.97-44.47,128.02-52.84
|
||||||
|
c-47.91-51.76-110.37-96.24-154.6-110.91c-0.31-0.1-0.6-0.19-0.86-0.28c-65.57-21.3-112.34,35.81-130.64,92.15
|
||||||
|
c-18.3,56.34-14.04,130.04,51.53,151.34C162.05,454.77,163.25,455.16,164.7,455.63z"/>
|
||||||
|
<path class="st2" d="M681.07,302.19c-18.3-56.34-65.07-113.45-130.64-92.15c-0.9,0.29-2.1,0.68-3.54,1.15
|
||||||
|
c-3.75,35.93-16.6,81.27-35.96,125.76c-20.59,47.32-45.84,88.27-72.51,118c69.18,13.72,145.86,12.98,190.26-1.14
|
||||||
|
c0.31-0.1,0.6-0.2,0.86-0.28C695.11,432.22,699.37,358.52,681.07,302.19z"/>
|
||||||
|
<path class="st3" d="M336.54,510.71c-11.15-50.39-14.8-98.36-10.7-138.08c-64.03,29.57-125.63,75.23-153.26,112.76
|
||||||
|
c-0.19,0.26-0.37,0.51-0.53,0.73c-40.52,55.78-0.66,117.91,47.27,152.72c47.92,34.82,119.33,53.54,159.86-2.24
|
||||||
|
c0.56-0.76,1.3-1.78,2.19-3.01C363.28,602.32,347.02,558.08,336.54,510.71z"/>
|
||||||
|
<path class="st4" d="M617.57,482.52c-35.33,7.54-82.42,9.33-130.72,4.66c-51.37-4.96-98.11-16.32-134.63-32.5
|
||||||
|
c8.33,70.03,32.73,142.73,59.88,180.6c0.19,0.26,0.37,0.51,0.53,0.73c40.52,55.78,111.93,37.06,159.86,2.24
|
||||||
|
c47.92-34.82,87.79-96.95,47.27-152.72C619.2,484.77,618.46,483.75,617.57,482.52z"/>
|
||||||
|
</g>
|
||||||
|
</svg>
|
||||||
|
After Width: | Height: | Size: 2.0 KiB |
@@ -0,0 +1,35 @@
|
|||||||
|
<!DOCTYPE html>
|
||||||
|
<html lang="en">
|
||||||
|
|
||||||
|
<head>
|
||||||
|
<meta charset="UTF-8">
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||||
|
<title>Applications</title>
|
||||||
|
<link rel="stylesheet" href="styles.css">
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
<div class="container">
|
||||||
|
<ul class="app-grid">
|
||||||
|
<li class="app-item">
|
||||||
|
<a href="https://immich.64815139.xyz" target="_blank">
|
||||||
|
<div class="app-icon-wrapper">
|
||||||
|
<img src="icons/immich.svg" alt="Immich" class="app-icon">
|
||||||
|
</div>
|
||||||
|
<span class="app-name">Photos</span>
|
||||||
|
</a>
|
||||||
|
</li>
|
||||||
|
<li class="app-item">
|
||||||
|
<a href="https://gitea.64815139.xyz/user/login" target="_blank">
|
||||||
|
<div class="app-icon-wrapper">
|
||||||
|
<img src="icons/gitea.svg" alt="Gitea" class="app-icon">
|
||||||
|
</div>
|
||||||
|
<span class="app-name">Gitea</span>
|
||||||
|
</a>
|
||||||
|
</li>
|
||||||
|
<!-- Add more application links here -->
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
|
||||||
|
</html>
|
||||||
@@ -0,0 +1,103 @@
|
|||||||
|
/* Basic reset */
|
||||||
|
* {
|
||||||
|
margin: 0;
|
||||||
|
padding: 0;
|
||||||
|
box-sizing: border-box;
|
||||||
|
}
|
||||||
|
|
||||||
|
body {
|
||||||
|
font-family: Arial, sans-serif;
|
||||||
|
background-color: #f0f0f0;
|
||||||
|
display: flex;
|
||||||
|
align-items: center;
|
||||||
|
justify-content: center;
|
||||||
|
height: 100vh;
|
||||||
|
}
|
||||||
|
|
||||||
|
.container {
|
||||||
|
width: 90%;
|
||||||
|
max-width: 1200px;
|
||||||
|
margin: 0 auto;
|
||||||
|
}
|
||||||
|
|
||||||
|
.app-grid {
|
||||||
|
list-style: none;
|
||||||
|
display: flex;
|
||||||
|
flex-wrap: wrap;
|
||||||
|
gap: 20px;
|
||||||
|
justify-content: center;
|
||||||
|
}
|
||||||
|
|
||||||
|
.app-item {
|
||||||
|
background: #fff;
|
||||||
|
border: 1px solid #ddd;
|
||||||
|
overflow: hidden;
|
||||||
|
width: 150px;
|
||||||
|
height: 150px;
|
||||||
|
/* Ensuring the item is square */
|
||||||
|
text-align: center;
|
||||||
|
transition: transform 0.2s, box-shadow 0.2s;
|
||||||
|
}
|
||||||
|
|
||||||
|
.app-item a {
|
||||||
|
text-decoration: none;
|
||||||
|
color: #333;
|
||||||
|
display: block;
|
||||||
|
height: 100%;
|
||||||
|
display: flex;
|
||||||
|
flex-direction: column;
|
||||||
|
align-items: center;
|
||||||
|
justify-content: center;
|
||||||
|
padding: 16px;
|
||||||
|
}
|
||||||
|
|
||||||
|
.app-icon-wrapper {
|
||||||
|
width: 100%;
|
||||||
|
height: 70%;
|
||||||
|
display: flex;
|
||||||
|
align-items: center;
|
||||||
|
justify-content: center;
|
||||||
|
}
|
||||||
|
|
||||||
|
.app-icon {
|
||||||
|
max-height: 100%;
|
||||||
|
max-width: 100%;
|
||||||
|
}
|
||||||
|
|
||||||
|
.app-name {
|
||||||
|
margin-top: 10px;
|
||||||
|
font-size: 16px;
|
||||||
|
font-weight: bold;
|
||||||
|
height: 20%;
|
||||||
|
display: flex;
|
||||||
|
align-items: center;
|
||||||
|
justify-content: center;
|
||||||
|
text-align: center;
|
||||||
|
}
|
||||||
|
|
||||||
|
.app-item:hover {
|
||||||
|
transform: scale(1.05);
|
||||||
|
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.1);
|
||||||
|
}
|
||||||
|
|
||||||
|
.app-item:active {
|
||||||
|
transform: scale(0.95);
|
||||||
|
box-shadow: 0 2px 4px rgba(0, 0, 0, 0.2);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Responsive design */
|
||||||
|
@media (max-width: 768px) {
|
||||||
|
.app-item {
|
||||||
|
width: 120px;
|
||||||
|
height: 120px;
|
||||||
|
/* Ensuring the item is square */
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@media (max-width: 480px) {
|
||||||
|
.app-item {
|
||||||
|
width: 100px;
|
||||||
|
height: 100px;
|
||||||
|
/* Ensuring the item is square */
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,116 @@
|
|||||||
|
name: gateway
|
||||||
|
secrets:
|
||||||
|
JWT_SECRET:
|
||||||
|
file: './authelia/secrets/auth/JWT_SECRET'
|
||||||
|
SESSION_SECRET:
|
||||||
|
file: './authelia/secrets/auth/SESSION_SECRET'
|
||||||
|
STORAGE_ENCRYPTION_KEY:
|
||||||
|
file: './authelia/secrets/auth/STORAGE_ENCRYPTION_KEY'
|
||||||
|
SMTP_USERNAME:
|
||||||
|
file: './authelia/secrets/auth/SMTP_USERNAME'
|
||||||
|
SMTP_PASSWORD:
|
||||||
|
file: './authelia/secrets/auth/SMTP_PASSWORD'
|
||||||
|
HMAC_SECRET:
|
||||||
|
file: './authelia/secrets/auth/HMAC_SECRET'
|
||||||
|
POSTGRES_PASSWORD:
|
||||||
|
file: './authelia/secrets/postgres/POSTGRES_PASSWORD'
|
||||||
|
REDIS_PASSWORD:
|
||||||
|
file: './authelia/secrets/redis/REDIS_PASSWORD'
|
||||||
|
OIDC_JWKS_AUTHELIA_PEM:
|
||||||
|
file: './authelia/secrets/jwks/rs256.pem'
|
||||||
|
OIDC_JWKS_AUTHELIA_CERT:
|
||||||
|
file: './authelia/secrets/jwks/rs256.cert'
|
||||||
|
IMMICH_CLIENT_SECRET:
|
||||||
|
file: './authelia/secrets/clients/IMMICH_CLIENT_SECRET'
|
||||||
|
GITEA_CLIENT_SECRET:
|
||||||
|
file: './authelia/secrets/clients/GITEA_CLIENT_SECRET'
|
||||||
|
services:
|
||||||
|
authelia:
|
||||||
|
image: 'docker.io/authelia/authelia:latest'
|
||||||
|
container_name: gateway_authelia
|
||||||
|
restart: 'unless-stopped'
|
||||||
|
expose:
|
||||||
|
- 9091
|
||||||
|
depends_on:
|
||||||
|
- postgres
|
||||||
|
- redis
|
||||||
|
secrets:
|
||||||
|
- JWT_SECRET
|
||||||
|
- SESSION_SECRET
|
||||||
|
- STORAGE_ENCRYPTION_KEY
|
||||||
|
- SMTP_USERNAME
|
||||||
|
- SMTP_PASSWORD
|
||||||
|
- POSTGRES_PASSWORD
|
||||||
|
- REDIS_PASSWORD
|
||||||
|
- HMAC_SECRET
|
||||||
|
- OIDC_JWKS_AUTHELIA_PEM
|
||||||
|
- OIDC_JWKS_AUTHELIA_CERT
|
||||||
|
- IMMICH_CLIENT_SECRET
|
||||||
|
- GITEA_CLIENT_SECRET
|
||||||
|
environment:
|
||||||
|
AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE: /run/secrets/JWT_SECRET
|
||||||
|
AUTHELIA_SESSION_SECRET_FILE: /run/secrets/SESSION_SECRET
|
||||||
|
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /run/secrets/STORAGE_ENCRYPTION_KEY
|
||||||
|
AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD
|
||||||
|
AUTHELIA_SESSION_REDIS_PASSWORD_FILE: /run/secrets/REDIS_PASSWORD
|
||||||
|
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: /run/secrets/HMAC_SECRET
|
||||||
|
AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: /run/secrets/SMTP_PASSWORD
|
||||||
|
X_AUTHELIA_CONFIG_FILTERS: template
|
||||||
|
volumes:
|
||||||
|
- ./authelia/config:/config
|
||||||
|
postgres:
|
||||||
|
image: postgres:17
|
||||||
|
container_name: gateway_postgres
|
||||||
|
restart: unless-stopped
|
||||||
|
secrets:
|
||||||
|
- POSTGRES_PASSWORD
|
||||||
|
environment:
|
||||||
|
POSTGRES_USER: "authelia"
|
||||||
|
POSTGRES_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD
|
||||||
|
volumes:
|
||||||
|
- ./data/postgres:/var/lib/postgresql/data
|
||||||
|
redis:
|
||||||
|
image: redis:7
|
||||||
|
container_name: gateway_redis
|
||||||
|
restart: unless-stopped
|
||||||
|
env_file:
|
||||||
|
- ./secrets/redis/.env
|
||||||
|
entrypoint: /bin/sh -c
|
||||||
|
command: "redis-server --save 60 1 --loglevel warning --requirepass $$REDIS_PASSWORD"
|
||||||
|
volumes:
|
||||||
|
- ./data/redis:/data
|
||||||
|
caddy:
|
||||||
|
image: caddy:2.8.4-alpine
|
||||||
|
container_name: gateway_caddy
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- "80:80"
|
||||||
|
- "443:443"
|
||||||
|
- "443:443/udp"
|
||||||
|
volumes:
|
||||||
|
- ./caddy/Caddyfile:/etc/caddy/Caddyfile
|
||||||
|
- ./dashboard:/var/www/dashboard
|
||||||
|
- caddy_data:/data
|
||||||
|
- caddy_config:/config
|
||||||
|
ddns:
|
||||||
|
image: timothyjmiller/cloudflare-ddns:latest
|
||||||
|
container_name: gateway_cloudflare_ddns
|
||||||
|
security_opt:
|
||||||
|
- no-new-privileges:true
|
||||||
|
network_mode: 'host'
|
||||||
|
env_file:
|
||||||
|
- ./cloudflare-ddns/secrets/.env
|
||||||
|
environment:
|
||||||
|
PUID: 1000
|
||||||
|
PGID: 1000
|
||||||
|
volumes:
|
||||||
|
- ./cloudflare-ddns/config.json:/config.json
|
||||||
|
restart: unless-stopped
|
||||||
|
watchtower:
|
||||||
|
image: containrrr/watchtower
|
||||||
|
container_name: gateway_watchtower
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
|
volumes:
|
||||||
|
caddy_data:
|
||||||
|
caddy_config:
|
||||||
@@ -0,0 +1,54 @@
|
|||||||
|
name: gitea
|
||||||
|
secrets:
|
||||||
|
SMTP_USERNAME:
|
||||||
|
file: './secrets/mail/SMTP_USERNAME'
|
||||||
|
SMTP_PASSWORD:
|
||||||
|
file: './secrets/mail/SMTP_PASSWORD'
|
||||||
|
services:
|
||||||
|
server:
|
||||||
|
image: gitea/gitea:1.22.2
|
||||||
|
container_name: gitea_app
|
||||||
|
restart: always
|
||||||
|
secrets:
|
||||||
|
- SMTP_USERNAME
|
||||||
|
- SMTP_PASSWORD
|
||||||
|
environment:
|
||||||
|
USER_UID: 1000
|
||||||
|
USER_GID: 1000
|
||||||
|
GITEA__server__ROOT_URL: https://gitea.64815139.xyz
|
||||||
|
GITEA__service__DISABLE_REGISTRATION: false
|
||||||
|
GITEA__service__ENABLE_BASIC_AUTHENTICATION: false
|
||||||
|
GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: true
|
||||||
|
GITEA__service__SHOW_REGISTRATION_BUTTON: false
|
||||||
|
GITEA__service__ENABLE_NOTIFY_MAIL: true
|
||||||
|
GITEA__mailer__ENABLED: true
|
||||||
|
GITEA__mailer__FROM: 'Gitea <gitea@64815139.xyz>'
|
||||||
|
GITEA__mailer__PROTOCOL: smtp+starttls
|
||||||
|
GITEA__mailer__SMTP_ADDR: in-v3.mailjet.com
|
||||||
|
GITEA__mailer__SMTP_PORT: 587
|
||||||
|
GITEA__mailer__USER__FILE: /run/secrets/SMTP_USERNAME
|
||||||
|
GITEA__mailer__PASSWD__FILE: /run/secrets/SMTP_PASSWORD
|
||||||
|
GITEA__openid__ENABLE_OPENID_SIGNIN: true
|
||||||
|
GITEA__openid__ENABLE_OPENID_SIGNUP: true
|
||||||
|
GITEA__openid__WHITELISTED_URLS: auth.64815139.xyz
|
||||||
|
GITEA__oauth2_client__ENABLE_AUTO_REGISTRATION: true
|
||||||
|
GITEA__oauth2_client__ACCOUNT_LINKING: auto
|
||||||
|
GITEA__oauth2_client__USERNAME: nickname
|
||||||
|
GITEA__oauth2_client__OPENID_CONNECT_SCOPES: openid profile email
|
||||||
|
networks:
|
||||||
|
- default
|
||||||
|
volumes:
|
||||||
|
- ./data:/data
|
||||||
|
- /etc/timezone:/etc/timezone:ro
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
ports:
|
||||||
|
- "3000:3000"
|
||||||
|
- "222:22"
|
||||||
|
watchtower:
|
||||||
|
image: containrrr/watchtower
|
||||||
|
container_name: gitea_watchtower
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
|
networks:
|
||||||
|
default:
|
||||||
|
external: false
|
||||||
+17
@@ -0,0 +1,17 @@
|
|||||||
|
# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables
|
||||||
|
|
||||||
|
# The location where your uploaded files are stored
|
||||||
|
UPLOAD_LOCATION=./data/library
|
||||||
|
# The location where your database files are stored
|
||||||
|
DB_DATA_LOCATION=./data/postgres
|
||||||
|
|
||||||
|
# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
|
||||||
|
# TZ=Etc/UTC
|
||||||
|
|
||||||
|
# The Immich version to use. You can pin this to a specific version like "v1.71.0"
|
||||||
|
IMMICH_VERSION=release
|
||||||
|
|
||||||
|
# The values below this line do not need to be changed
|
||||||
|
###################################################################################
|
||||||
|
DB_USERNAME=postgres
|
||||||
|
DB_DATABASE_NAME=immich
|
||||||
@@ -0,0 +1,85 @@
|
|||||||
|
#
|
||||||
|
# WARNING: Make sure to use the docker-compose.yml of the current release:
|
||||||
|
#
|
||||||
|
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
|
||||||
|
#
|
||||||
|
# The compose file on main may not be compatible with the latest release.
|
||||||
|
#
|
||||||
|
|
||||||
|
name: immich
|
||||||
|
|
||||||
|
secrets:
|
||||||
|
POSTGRES_PASSWORD:
|
||||||
|
file: './secrets/postgres/POSTGRES_PASSWORD'
|
||||||
|
services:
|
||||||
|
immich-server:
|
||||||
|
container_name: immich_server
|
||||||
|
image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
|
||||||
|
# extends:
|
||||||
|
# file: hwaccel.transcoding.yml
|
||||||
|
# service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
|
||||||
|
volumes:
|
||||||
|
# Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
|
||||||
|
- ${UPLOAD_LOCATION}:/usr/src/app/upload
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
secrets:
|
||||||
|
- POSTGRES_PASSWORD
|
||||||
|
environment:
|
||||||
|
DB_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
ports:
|
||||||
|
- 2283:3001
|
||||||
|
depends_on:
|
||||||
|
- redis
|
||||||
|
- database
|
||||||
|
restart: always
|
||||||
|
healthcheck:
|
||||||
|
disable: false
|
||||||
|
|
||||||
|
immich-machine-learning:
|
||||||
|
container_name: immich_machine_learning
|
||||||
|
# For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
|
||||||
|
# Example tag: ${IMMICH_VERSION:-release}-cuda
|
||||||
|
image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
|
||||||
|
# extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
|
||||||
|
# file: hwaccel.ml.yml
|
||||||
|
# service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
|
||||||
|
volumes:
|
||||||
|
- model-cache:/cache
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
restart: always
|
||||||
|
healthcheck:
|
||||||
|
disable: false
|
||||||
|
|
||||||
|
redis:
|
||||||
|
container_name: immich_redis
|
||||||
|
image: docker.io/redis:6.2-alpine@sha256:2d1463258f2764328496376f5d965f20c6a67f66ea2b06dc42af351f75248792
|
||||||
|
healthcheck:
|
||||||
|
test: redis-cli ping || exit 1
|
||||||
|
restart: always
|
||||||
|
|
||||||
|
database:
|
||||||
|
container_name: immich_postgres
|
||||||
|
image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
|
||||||
|
secrets:
|
||||||
|
- POSTGRES_PASSWORD
|
||||||
|
environment:
|
||||||
|
POSTGRES_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD
|
||||||
|
POSTGRES_USER: ${DB_USERNAME}
|
||||||
|
POSTGRES_DB: ${DB_DATABASE_NAME}
|
||||||
|
POSTGRES_INITDB_ARGS: '--data-checksums'
|
||||||
|
volumes:
|
||||||
|
# Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
|
||||||
|
- ${DB_DATA_LOCATION}:/var/lib/postgresql/data
|
||||||
|
healthcheck:
|
||||||
|
test: pg_isready --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' || exit 1; Chksum="$$(psql --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
|
||||||
|
interval: 5m
|
||||||
|
start_interval: 30s
|
||||||
|
start_period: 5m
|
||||||
|
command: ["postgres", "-c", "shared_preload_libraries=vectors.so", "-c", 'search_path="$$user", public, vectors', "-c", "logging_collector=on", "-c", "max_wal_size=2GB", "-c", "shared_buffers=512MB", "-c", "wal_compression=on"]
|
||||||
|
restart: always
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
model-cache:
|
||||||
@@ -0,0 +1,43 @@
|
|||||||
|
# Configurations for hardware-accelerated machine learning
|
||||||
|
|
||||||
|
# If using Unraid or another platform that doesn't allow multiple Compose files,
|
||||||
|
# you can inline the config for a backend by copying its contents
|
||||||
|
# into the immich-machine-learning service in the docker-compose.yml file.
|
||||||
|
|
||||||
|
# See https://immich.app/docs/features/ml-hardware-acceleration for info on usage.
|
||||||
|
|
||||||
|
services:
|
||||||
|
armnn:
|
||||||
|
devices:
|
||||||
|
- /dev/mali0:/dev/mali0
|
||||||
|
volumes:
|
||||||
|
- /lib/firmware/mali_csffw.bin:/lib/firmware/mali_csffw.bin:ro # Mali firmware for your chipset (not always required depending on the driver)
|
||||||
|
- /usr/lib/libmali.so:/usr/lib/libmali.so:ro # Mali driver for your chipset (always required)
|
||||||
|
|
||||||
|
cpu: {}
|
||||||
|
|
||||||
|
cuda:
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
reservations:
|
||||||
|
devices:
|
||||||
|
- driver: nvidia
|
||||||
|
count: 1
|
||||||
|
capabilities:
|
||||||
|
- gpu
|
||||||
|
|
||||||
|
openvino:
|
||||||
|
device_cgroup_rules:
|
||||||
|
- 'c 189:* rmw'
|
||||||
|
devices:
|
||||||
|
- /dev/dri:/dev/dri
|
||||||
|
volumes:
|
||||||
|
- /dev/bus/usb:/dev/bus/usb
|
||||||
|
|
||||||
|
openvino-wsl:
|
||||||
|
devices:
|
||||||
|
- /dev/dri:/dev/dri
|
||||||
|
- /dev/dxg:/dev/dxg
|
||||||
|
volumes:
|
||||||
|
- /dev/bus/usb:/dev/bus/usb
|
||||||
|
- /usr/lib/wsl:/usr/lib/wsl
|
||||||
@@ -0,0 +1,55 @@
|
|||||||
|
# Configurations for hardware-accelerated transcoding
|
||||||
|
|
||||||
|
# If using Unraid or another platform that doesn't allow multiple Compose files,
|
||||||
|
# you can inline the config for a backend by copying its contents
|
||||||
|
# into the immich-microservices service in the docker-compose.yml file.
|
||||||
|
|
||||||
|
# See https://immich.app/docs/features/hardware-transcoding for more info on using hardware transcoding.
|
||||||
|
|
||||||
|
services:
|
||||||
|
cpu: {}
|
||||||
|
|
||||||
|
nvenc:
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
reservations:
|
||||||
|
devices:
|
||||||
|
- driver: nvidia
|
||||||
|
count: 1
|
||||||
|
capabilities:
|
||||||
|
- gpu
|
||||||
|
- compute
|
||||||
|
- video
|
||||||
|
|
||||||
|
quicksync:
|
||||||
|
devices:
|
||||||
|
- /dev/dri:/dev/dri
|
||||||
|
|
||||||
|
rkmpp:
|
||||||
|
security_opt: # enables full access to /sys and /proc, still far better than privileged: true
|
||||||
|
- systempaths=unconfined
|
||||||
|
- apparmor=unconfined
|
||||||
|
group_add:
|
||||||
|
- video
|
||||||
|
devices:
|
||||||
|
- /dev/rga:/dev/rga
|
||||||
|
- /dev/dri:/dev/dri
|
||||||
|
- /dev/dma_heap:/dev/dma_heap
|
||||||
|
- /dev/mpp_service:/dev/mpp_service
|
||||||
|
#- /dev/mali0:/dev/mali0 # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
|
||||||
|
volumes:
|
||||||
|
#- /etc/OpenCL:/etc/OpenCL:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
|
||||||
|
#- /usr/lib/aarch64-linux-gnu/libmali.so.1:/usr/lib/aarch64-linux-gnu/libmali.so.1:ro # only required to enable OpenCL-accelerated HDR -> SDR tonemapping
|
||||||
|
|
||||||
|
vaapi:
|
||||||
|
devices:
|
||||||
|
- /dev/dri:/dev/dri
|
||||||
|
|
||||||
|
vaapi-wsl: # use this for VAAPI if you're running Immich in WSL2
|
||||||
|
devices:
|
||||||
|
- /dev/dri:/dev/dri
|
||||||
|
volumes:
|
||||||
|
- /usr/lib/wsl:/usr/lib/wsl
|
||||||
|
environment:
|
||||||
|
- LD_LIBRARY_PATH=/usr/lib/wsl/lib
|
||||||
|
- LIBVA_DRIVER_NAME=d3d12
|
||||||
Reference in New Issue
Block a user