cloud.yml

# cloud — files, secrets, git, dashboard, status.
# Routes for these live in traefik/dynamic.yml.template (LAN-only by default).

x-logging: &logging
  logging:
    driver: json-file
    options:
      max-size: "10m"
      max-file: "3"

networks:
  proxy:
    name: proxy
  internal:
    name: baseplate_internal
    internal: true

volumes:
  nextcloud_data:
  nextcloud_db:
  vaultwarden_data:
  gitea_data:
  homarr_config:
  uptime_kuma_data:
  paperless_data:
  paperless_media:
  paperless_db:

services:

  nextcloud:
    image: nextcloud:apache
    container_name: nextcloud
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["nextcloud"]
    networks: [proxy, internal]
    depends_on:
      nextcloud_db:
        condition: service_healthy
      nextcloud_redis:
        condition: service_healthy
    cpus: 2.0
    volumes:
      - nextcloud_data:/var/www/html
    environment:
      MYSQL_HOST: nextcloud_db
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: "${NEXTCLOUD_DB_PASSWORD}"
      REDIS_HOST: nextcloud_redis
      OVERWRITEPROTOCOL: https
      OVERWRITECLIURL: "https://cloud.${DOMAIN}"
      TRUSTED_PROXIES: "172.16.0.0/12 10.0.0.0/8 192.168.0.0/16"
      APACHE_BODY_LIMIT: "0"   # no upload size cap at the Apache layer

  # Background jobs. Nextcloud needs a cron runner; without it the instance falls
  # back to less reliable AJAX cron. Shares the app volume with the web container.
  nextcloud_cron:
    image: nextcloud:apache
    container_name: nextcloud_cron
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["nextcloud"]
    networks: [internal]
    entrypoint: /cron.sh
    depends_on:
      nextcloud_db:
        condition: service_healthy
      nextcloud_redis:
        condition: service_healthy
    volumes:
      - nextcloud_data:/var/www/html

  nextcloud_db:
    # Pinned to the 10.11 LTS (supported to Feb 2028) on purpose. 11.4 clears no
    # CVEs over 10.11 and a major bump is one-way: it needs mariadb-upgrade
    # against the Nextcloud database with no supported downgrade.
    image: mariadb:10.11
    container_name: nextcloud_db
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    stop_grace_period: 60s
    profiles: ["nextcloud"]
    networks: [internal]
    volumes:
      - nextcloud_db:/var/lib/mysql
    environment:
      MYSQL_ROOT_PASSWORD: "${NEXTCLOUD_DB_ROOT_PASSWORD}"
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: "${NEXTCLOUD_DB_PASSWORD}"
    # Lets dependents wait on `service_healthy` so Nextcloud never starts against
    # an uninitialised database.
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s

  nextcloud_redis:
    image: redis:7-alpine
    container_name: nextcloud_redis
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["nextcloud"]
    networks: [internal]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s

  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["vaultwarden"]
    networks: [proxy]
    volumes:
      - vaultwarden_data:/data
    environment:
      DOMAIN: "https://vault.${DOMAIN}"
      # Argon2-hash the admin token (see README). Empty disables the admin page.
      ADMIN_TOKEN: "${VAULTWARDEN_ADMIN_TOKEN}"

  gitea:
    image: gitea/gitea:1
    container_name: gitea
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["gitea"]
    networks: [proxy, internal]
    volumes:
      - gitea_data:/data
    ports:
      # Raw TCP: Traefik never sees this, so the lan-only middleware does not
      # apply. Firewall the port at the host if the box is internet-facing.
      - "2222:22"   # git over SSH
    environment:
      TZ: "${TZ:-UTC}"
      USER_UID: "${PUID:-1000}"
      USER_GID: "${PGID:-1000}"
      GITEA__server__ROOT_URL: "https://git.${DOMAIN}/"
      GITEA__server__DOMAIN: "git.${DOMAIN}"
      GITEA__server__SSH_DOMAIN: "git.${DOMAIN}"
      GITEA__server__SSH_PORT: "2222"

  homarr:
    image: ghcr.io/homarr-labs/homarr:latest
    container_name: homarr
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["homarr"]
    networks: [proxy]
    volumes:
      - homarr_config:/appdata
    environment:
      SECRET_ENCRYPTION_KEY: "${HOMARR_SECRET_KEY}"

  uptime-kuma:
    # slim, not plain :2 — the full image bundles Chromium and carries 109
    # critical CVEs against its Debian base, versus 6 here. Trade-off: no
    # "real browser" monitor type. Apprise notifications still work.
    image: louislam/uptime-kuma:2-slim
    container_name: uptime-kuma
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["kuma"]
    networks: [proxy]
    volumes:
      - uptime_kuma_data:/app/data

  # ── Paperless-ngx (opt-in) ──────────────────────────────────────────────────

  paperless_db:
    image: postgres:17
    container_name: paperless_db
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    stop_grace_period: 60s
    profiles: ["paperless"]
    networks: [internal]
    volumes:
      - paperless_db:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: paperless
      POSTGRES_USER: paperless
      POSTGRES_PASSWORD: "${PAPERLESS_DB_PASSWORD}"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U paperless -d paperless"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  paperless_redis:
    image: redis:7-alpine
    container_name: paperless_redis
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["paperless"]
    networks: [internal]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s

  paperless:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless
    restart: unless-stopped
    security_opt: ["no-new-privileges:true"]
    <<: *logging
    profiles: ["paperless"]
    networks: [proxy, internal]
    depends_on:
      paperless_db:
        condition: service_healthy
      paperless_redis:
        condition: service_healthy
    volumes:
      - paperless_data:/usr/src/paperless/data
      - paperless_media:/usr/src/paperless/media
    environment:
      PAPERLESS_URL: "https://paperless.${DOMAIN}"
      PAPERLESS_SECRET_KEY: "${PAPERLESS_SECRET_KEY}"
      PAPERLESS_REDIS: "redis://paperless_redis:6379"
      PAPERLESS_DBHOST: paperless_db
      PAPERLESS_DBUSER: paperless
      PAPERLESS_DBPASS: "${PAPERLESS_DB_PASSWORD}"
      PAPERLESS_ADMIN_USER: "${PAPERLESS_ADMIN_USER:-admin}"
      PAPERLESS_ADMIN_PASSWORD: "${PAPERLESS_ADMIN_PASSWORD}"