468 lines
19 KiB
YAML
468 lines
19 KiB
YAML
# LibNovel homelab
|
|
#
|
|
# Runs on 192.168.0.109. Hosts:
|
|
# - libnovel runner (background task worker)
|
|
# - tooling: GlitchTip, Umami, Fider, Dozzle, Uptime Kuma, Gotify
|
|
# - observability: OTel Collector, Tempo, Loki, Prometheus, Grafana
|
|
# - cloudflared tunnel (public subdomains via Cloudflare Zero Trust)
|
|
# - shared Postgres for tooling DBs
|
|
#
|
|
# All secrets come from Doppler (project=libnovel, config=prd_homelab).
|
|
# Run with: doppler run -- docker compose up -d
|
|
#
|
|
# Public subdomains (via Cloudflare Tunnel — no ports exposed to internet):
|
|
# errors.libnovel.cc → glitchtip-web:8000
|
|
# analytics.libnovel.cc → umami:3000
|
|
# feedback.libnovel.cc → fider:3000
|
|
# logs.libnovel.cc → dozzle:8080
|
|
# uptime.libnovel.cc → uptime-kuma:3001
|
|
# push.libnovel.cc → gotify:80
|
|
# grafana.libnovel.cc → grafana:3000
|
|
|
|
services:
|
|
|
|
# ── Cloudflare Tunnel ───────────────────────────────────────────────────────
|
|
# Outbound-only encrypted tunnel to Cloudflare.
|
|
# Routes all public subdomains to their respective containers on this network.
|
|
# No inbound ports needed — cloudflared initiates all connections outward.
|
|
cloudflared:
|
|
image: cloudflare/cloudflared:latest
|
|
restart: unless-stopped
|
|
command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TUNNEL_TOKEN}
|
|
environment:
|
|
CLOUDFLARE_TUNNEL_TOKEN: "${CLOUDFLARE_TUNNEL_TOKEN}"
|
|
|
|
# ── LibNovel Runner ─────────────────────────────────────────────────────────
|
|
# Background task worker. Connects to prod PocketBase, MinIO, Meilisearch
|
|
# via their public subdomains (pb.libnovel.cc, storage.libnovel.cc, etc.)
|
|
runner:
|
|
image: kalekber/libnovel-runner:latest
|
|
restart: unless-stopped
|
|
stop_grace_period: 135s
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
environment:
|
|
POCKETBASE_URL: "https://pb.libnovel.cc"
|
|
POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
|
|
POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
|
|
|
|
MINIO_ENDPOINT: "storage.libnovel.cc"
|
|
MINIO_ACCESS_KEY: "${MINIO_ROOT_USER}"
|
|
MINIO_SECRET_KEY: "${MINIO_ROOT_PASSWORD}"
|
|
MINIO_USE_SSL: "true"
|
|
MINIO_PUBLIC_ENDPOINT: "${MINIO_PUBLIC_ENDPOINT}"
|
|
MINIO_PUBLIC_USE_SSL: "${MINIO_PUBLIC_USE_SSL}"
|
|
|
|
MEILI_URL: "${MEILI_URL}"
|
|
MEILI_API_KEY: "${MEILI_API_KEY}"
|
|
VALKEY_ADDR: ""
|
|
GODEBUG: "preferIPv4=1"
|
|
|
|
KOKORO_URL: "http://kokoro-fastapi:8880"
|
|
KOKORO_VOICE: "${KOKORO_VOICE}"
|
|
|
|
POCKET_TTS_URL: "http://pocket-tts:8000"
|
|
|
|
RUNNER_WORKER_ID: "${RUNNER_WORKER_ID}"
|
|
RUNNER_POLL_INTERVAL: "${RUNNER_POLL_INTERVAL}"
|
|
RUNNER_MAX_CONCURRENT_SCRAPE: "${RUNNER_MAX_CONCURRENT_SCRAPE}"
|
|
RUNNER_MAX_CONCURRENT_AUDIO: "${RUNNER_MAX_CONCURRENT_AUDIO}"
|
|
RUNNER_TIMEOUT: "${RUNNER_TIMEOUT}"
|
|
RUNNER_METRICS_ADDR: "${RUNNER_METRICS_ADDR}"
|
|
RUNNER_SKIP_INITIAL_CATALOGUE_REFRESH: "true"
|
|
|
|
LOG_LEVEL: "${LOG_LEVEL}"
|
|
GLITCHTIP_DSN: "${GLITCHTIP_DSN}"
|
|
|
|
# OTel — send runner traces/metrics to the local collector (HTTP)
|
|
OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-collector:4318"
|
|
OTEL_SERVICE_NAME: "runner"
|
|
|
|
healthcheck:
|
|
test: ["CMD", "/healthcheck", "file", "/tmp/runner.alive", "120"]
|
|
interval: 60s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
# ── Shared Postgres ─────────────────────────────────────────────────────────
|
|
# Hosts glitchtip, umami, and fider databases.
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: "${POSTGRES_USER}"
|
|
POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
|
|
POSTGRES_DB: postgres
|
|
expose:
|
|
- "5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD", "pg_isready", "-U", "${POSTGRES_USER}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ── Postgres database initialisation ────────────────────────────────────────
|
|
postgres-init:
|
|
image: postgres:16-alpine
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
PGPASSWORD: "${POSTGRES_PASSWORD}"
|
|
entrypoint: >
|
|
/bin/sh -c "
|
|
psql -h postgres -U ${POSTGRES_USER} -d postgres -tc \"SELECT 1 FROM pg_database WHERE datname='fider'\" | grep -q 1 ||
|
|
psql -h postgres -U ${POSTGRES_USER} -d postgres -c \"CREATE DATABASE fider\";
|
|
psql -h postgres -U ${POSTGRES_USER} -d postgres -tc \"SELECT 1 FROM pg_database WHERE datname='glitchtip'\" | grep -q 1 ||
|
|
psql -h postgres -U ${POSTGRES_USER} -d postgres -c \"CREATE DATABASE glitchtip\";
|
|
psql -h postgres -U ${POSTGRES_USER} -d postgres -tc \"SELECT 1 FROM pg_database WHERE datname='umami'\" | grep -q 1 ||
|
|
psql -h postgres -U ${POSTGRES_USER} -d postgres -c \"CREATE DATABASE umami\";
|
|
echo 'postgres-init: databases ready';
|
|
"
|
|
restart: "no"
|
|
|
|
# ── GlitchTip DB migration ──────────────────────────────────────────────────
|
|
glitchtip-migrate:
|
|
image: glitchtip/glitchtip:latest
|
|
depends_on:
|
|
postgres-init:
|
|
condition: service_completed_successfully
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
DATABASE_URL: "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/glitchtip"
|
|
SECRET_KEY: "${GLITCHTIP_SECRET_KEY}"
|
|
GLITCHTIP_DOMAIN: "${GLITCHTIP_DOMAIN}"
|
|
EMAIL_URL: "${GLITCHTIP_EMAIL_URL}"
|
|
DEFAULT_FROM_EMAIL: "noreply@libnovel.cc"
|
|
VALKEY_URL: "redis://valkey:6379/1"
|
|
command: "./manage.py migrate"
|
|
restart: "no"
|
|
|
|
# ── GlitchTip web ───────────────────────────────────────────────────────────
|
|
glitchtip-web:
|
|
image: glitchtip/glitchtip:latest
|
|
restart: unless-stopped
|
|
depends_on:
|
|
glitchtip-migrate:
|
|
condition: service_completed_successfully
|
|
expose:
|
|
- "8000"
|
|
environment:
|
|
DATABASE_URL: "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/glitchtip"
|
|
SECRET_KEY: "${GLITCHTIP_SECRET_KEY}"
|
|
GLITCHTIP_DOMAIN: "${GLITCHTIP_DOMAIN}"
|
|
EMAIL_URL: "${GLITCHTIP_EMAIL_URL}"
|
|
DEFAULT_FROM_EMAIL: "noreply@libnovel.cc"
|
|
VALKEY_URL: "redis://valkey:6379/1"
|
|
PORT: "8000"
|
|
ENABLE_USER_REGISTRATION: "false"
|
|
healthcheck:
|
|
test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/0/')"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ── GlitchTip worker ────────────────────────────────────────────────────────
|
|
glitchtip-worker:
|
|
image: glitchtip/glitchtip:latest
|
|
restart: unless-stopped
|
|
depends_on:
|
|
glitchtip-migrate:
|
|
condition: service_completed_successfully
|
|
environment:
|
|
DATABASE_URL: "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/glitchtip"
|
|
SECRET_KEY: "${GLITCHTIP_SECRET_KEY}"
|
|
GLITCHTIP_DOMAIN: "${GLITCHTIP_DOMAIN}"
|
|
EMAIL_URL: "${GLITCHTIP_EMAIL_URL}"
|
|
DEFAULT_FROM_EMAIL: "noreply@libnovel.cc"
|
|
VALKEY_URL: "redis://valkey:6379/1"
|
|
SERVER_ROLE: "worker"
|
|
|
|
# ── Umami ───────────────────────────────────────────────────────────────────
|
|
umami:
|
|
image: ghcr.io/umami-software/umami:postgresql-latest
|
|
restart: unless-stopped
|
|
depends_on:
|
|
postgres-init:
|
|
condition: service_completed_successfully
|
|
postgres:
|
|
condition: service_healthy
|
|
expose:
|
|
- "3000"
|
|
environment:
|
|
DATABASE_URL: "postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/umami"
|
|
APP_SECRET: "${UMAMI_APP_SECRET}"
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-sf", "http://localhost:3000/api/heartbeat"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ── Fider ───────────────────────────────────────────────────────────────────
|
|
fider:
|
|
image: getfider/fider:stable
|
|
restart: unless-stopped
|
|
depends_on:
|
|
postgres-init:
|
|
condition: service_completed_successfully
|
|
postgres:
|
|
condition: service_healthy
|
|
expose:
|
|
- "3000"
|
|
environment:
|
|
BASE_URL: "${FIDER_BASE_URL}"
|
|
DATABASE_URL: "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/fider?sslmode=disable"
|
|
JWT_SECRET: "${FIDER_JWT_SECRET}"
|
|
EMAIL_NOREPLY: "noreply@libnovel.cc"
|
|
EMAIL_SMTP_HOST: "${FIDER_SMTP_HOST}"
|
|
EMAIL_SMTP_PORT: "${FIDER_SMTP_PORT}"
|
|
EMAIL_SMTP_USERNAME: "${FIDER_SMTP_USER}"
|
|
EMAIL_SMTP_PASSWORD: "${FIDER_SMTP_PASSWORD}"
|
|
EMAIL_SMTP_ENABLE_STARTTLS: "false"
|
|
OAUTH_GOOGLE_CLIENTID: "${OAUTH_GOOGLE_CLIENTID}"
|
|
OAUTH_GOOGLE_SECRET: "${OAUTH_GOOGLE_SECRET}"
|
|
OAUTH_GITHUB_CLIENTID: "${OAUTH_GITHUB_CLIENTID}"
|
|
OAUTH_GITHUB_SECRET: "${OAUTH_GITHUB_SECRET}"
|
|
|
|
# ── Dozzle ──────────────────────────────────────────────────────────────────
|
|
# Watches both homelab and prod containers.
|
|
# Prod agent runs on 165.22.70.138:7007 (added separately to prod compose).
|
|
dozzle:
|
|
image: amir20/dozzle:latest
|
|
restart: unless-stopped
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- ./dozzle/users.yml:/data/users.yml:ro
|
|
expose:
|
|
- "8080"
|
|
environment:
|
|
DOZZLE_AUTH_PROVIDER: simple
|
|
DOZZLE_HOSTNAME: "logs.libnovel.cc"
|
|
DOZZLE_REMOTE_AGENT: "prod@165.22.70.138:7007"
|
|
healthcheck:
|
|
test: ["CMD", "/dozzle", "healthcheck"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ── Uptime Kuma ─────────────────────────────────────────────────────────────
|
|
uptime-kuma:
|
|
image: louislam/uptime-kuma:1
|
|
restart: unless-stopped
|
|
volumes:
|
|
- uptime_kuma_data:/app/data
|
|
expose:
|
|
- "3001"
|
|
healthcheck:
|
|
test: ["CMD", "extra/healthcheck"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ── Gotify ──────────────────────────────────────────────────────────────────
|
|
gotify:
|
|
image: gotify/server:latest
|
|
restart: unless-stopped
|
|
volumes:
|
|
- gotify_data:/app/data
|
|
expose:
|
|
- "80"
|
|
environment:
|
|
GOTIFY_DEFAULTUSER_NAME: "${GOTIFY_ADMIN_USER}"
|
|
GOTIFY_DEFAULTUSER_PASS: "${GOTIFY_ADMIN_PASS}"
|
|
GOTIFY_SERVER_PORT: "80"
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-sf", "http://localhost:80/health"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ── Valkey ──────────────────────────────────────────────────────────────────
|
|
# Used by GlitchTip for task queuing.
|
|
valkey:
|
|
image: valkey/valkey:7-alpine
|
|
restart: unless-stopped
|
|
expose:
|
|
- "6379"
|
|
volumes:
|
|
- valkey_data:/data
|
|
healthcheck:
|
|
test: ["CMD", "valkey-cli", "ping"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ── OTel Collector ──────────────────────────────────────────────────────────
|
|
# Receives OTLP from backend/ui/runner, fans out to Tempo + Prometheus + Loki.
|
|
otel-collector:
|
|
image: otel/opentelemetry-collector-contrib:latest
|
|
restart: unless-stopped
|
|
volumes:
|
|
- ./otel/collector.yaml:/etc/otelcol-contrib/config.yaml:ro
|
|
expose:
|
|
- "4317" # OTLP gRPC
|
|
- "4318" # OTLP HTTP
|
|
- "8888" # Collector self-metrics (scraped by Prometheus)
|
|
depends_on:
|
|
- tempo
|
|
- prometheus
|
|
- loki
|
|
# No healthcheck — distroless image has no shell or curl
|
|
|
|
# ── Tempo ───────────────────────────────────────────────────────────────────
|
|
# Distributed trace storage. Receives OTLP from the collector.
|
|
tempo:
|
|
image: grafana/tempo:2.6.1
|
|
restart: unless-stopped
|
|
command: ["-config.file=/etc/tempo.yaml"]
|
|
volumes:
|
|
- ./otel/tempo.yaml:/etc/tempo.yaml:ro
|
|
- tempo_data:/var/tempo
|
|
expose:
|
|
- "3200" # Tempo query API (queried by Grafana)
|
|
- "4317" # OTLP gRPC ingest (collector → tempo)
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://localhost:3200/ready"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ── Prometheus ──────────────────────────────────────────────────────────────
|
|
# Scrapes metrics from backend (via prod), runner, and otel-collector.
|
|
prometheus:
|
|
image: prom/prometheus:latest
|
|
restart: unless-stopped
|
|
command:
|
|
- "--config.file=/etc/prometheus/prometheus.yaml"
|
|
- "--storage.tsdb.path=/prometheus"
|
|
- "--storage.tsdb.retention.time=30d"
|
|
- "--web.enable-remote-write-receiver"
|
|
volumes:
|
|
- ./otel/prometheus.yaml:/etc/prometheus/prometheus.yaml:ro
|
|
- prometheus_data:/prometheus
|
|
expose:
|
|
- "9090"
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://localhost:9090/-/healthy"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ── Loki ────────────────────────────────────────────────────────────────────
|
|
# Log aggregation. Receives logs from OTel collector. Replaces manual Dozzle
|
|
# tailing for structured log search.
|
|
loki:
|
|
image: grafana/loki:latest
|
|
restart: unless-stopped
|
|
command: ["-config.file=/etc/loki/loki.yaml"]
|
|
volumes:
|
|
- ./otel/loki.yaml:/etc/loki/loki.yaml:ro
|
|
- loki_data:/loki
|
|
expose:
|
|
- "3100"
|
|
# No healthcheck — distroless image has no shell or curl
|
|
|
|
# ── Grafana ─────────────────────────────────────────────────────────────────
|
|
# Single UI for traces (Tempo), metrics (Prometheus), and logs (Loki).
|
|
# Accessible at grafana.libnovel.cc via Cloudflare Tunnel.
|
|
grafana:
|
|
image: grafana/grafana:latest
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- tempo
|
|
- prometheus
|
|
- loki
|
|
expose:
|
|
- "3000"
|
|
volumes:
|
|
- grafana_data:/var/lib/grafana
|
|
- ./otel/grafana/provisioning:/etc/grafana/provisioning:ro
|
|
environment:
|
|
GF_SERVER_ROOT_URL: "https://grafana.libnovel.cc"
|
|
GF_SECURITY_ADMIN_USER: "${GRAFANA_ADMIN_USER}"
|
|
GF_SECURITY_ADMIN_PASSWORD: "${GRAFANA_ADMIN_PASSWORD}"
|
|
GF_AUTH_ANONYMOUS_ENABLED: "false"
|
|
GF_FEATURE_TOGGLES_ENABLE: "traceqlEditor"
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/health"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# ── Kokoro-FastAPI (GPU TTS) ────────────────────────────────────────────────
|
|
# OpenAI-compatible TTS service backed by the Kokoro model, running on the
|
|
# homelab RTX 3050 (8 GB VRAM). Replaces the broken kokoro.kalekber.cc DNS.
|
|
# Voices match existing IDs: af_bella, af_sky, af_heart, etc.
|
|
# The runner reaches it at http://kokoro-fastapi:8880 via the Docker network.
|
|
kokoro-fastapi:
|
|
image: kokoro-fastapi:latest
|
|
restart: unless-stopped
|
|
deploy:
|
|
resources:
|
|
reservations:
|
|
devices:
|
|
- driver: nvidia
|
|
count: 1
|
|
capabilities: [gpu]
|
|
expose:
|
|
- "8880"
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-sf", "http://localhost:8880/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
start_period: 60s
|
|
|
|
# ── pocket-tts (CPU TTS) ────────────────────────────────────────────────────
|
|
# Lightweight CPU-only TTS using kyutai-labs/pocket-tts.
|
|
# Image is built locally on homelab from https://github.com/kyutai-labs/pocket-tts
|
|
# (no prebuilt image published): cd /tmp && git clone --depth=1 https://github.com/kyutai-labs/pocket-tts.git && docker build -t pocket-tts:latest /tmp/pocket-tts
|
|
# OpenAI-compatible: POST /tts (multipart form) on port 8000.
|
|
# Voices: alba, marius, javert, jean, fantine, cosette, eponine, azelma, etc.
|
|
# Not currently used by the runner (runner uses kokoro-fastapi), but available
|
|
# for experimentation / fallback.
|
|
pocket-tts:
|
|
image: pocket-tts:latest
|
|
restart: unless-stopped
|
|
command: ["uv", "run", "pocket-tts", "serve", "--host", "0.0.0.0"]
|
|
expose:
|
|
- "8000"
|
|
volumes:
|
|
- pocket_tts_cache:/root/.cache/pocket_tts
|
|
- hf_cache:/root/.cache/huggingface
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-sf", "http://localhost:8000/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
start_period: 120s
|
|
|
|
# ── Watchtower ──────────────────────────────────────────────────────────────
|
|
# Auto-updates runner image when CI pushes a new tag.
|
|
# Only watches services with the watchtower label.
|
|
watchtower:
|
|
image: containrrr/watchtower:latest
|
|
restart: unless-stopped
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
command: --label-enable --interval 300 --cleanup
|
|
environment:
|
|
WATCHTOWER_NOTIFICATIONS: "${WATCHTOWER_NOTIFICATIONS}"
|
|
WATCHTOWER_NOTIFICATION_URL: "${WATCHTOWER_NOTIFICATION_URL}"
|
|
DOCKER_API_VERSION: "1.44"
|
|
|
|
volumes:
|
|
postgres_data:
|
|
valkey_data:
|
|
uptime_kuma_data:
|
|
gotify_data:
|
|
tempo_data:
|
|
prometheus_data:
|
|
loki_data:
|
|
grafana_data:
|
|
pocket_tts_cache:
|
|
hf_cache:
|