Docker Network Utilities Server

services:
  uptime-kuma:
    image: louislam/uptime-kuma:2
    restart: unless-stopped
    volumes:
      - data:/app/data
    ports:
      # <Host Port>:<Container Port>
      - "3001:3001"

volumes:
  data:

services:
  speedtest:
    container_name: speedtest
    image: ghcr.io/librespeed/speedtest:latest
    restart: always
    environment:
      MODE: standalone
      #TITLE: "LibreSpeed"
      #TAGLINE: "No Flash, No Java, No Websockets, No Bullsh*t"
      USE_NEW_DESIGN: "true"
      TELEMETRY: "true"
      #ENABLE_ID_OBFUSCATION: "false"
      #REDACT_IP_ADDRESSES: "false"
      PASSWORD: "${SPEEDTEST_PASS:-}"
      GDPR_EMAIL: "[email protected]"
      #DISABLE_IPINFO: "false"
      #IPINFO_APIKEY: "your api key"
      DISTANCE: "mi"
      #WEBPORT: 8080
    ports:
      - "80:8080" # webport mapping (host:container)

# https://docs.docker.com/compose/how-tos/environment-variables/envvars-precedence/
x-common-environment: &common-environment
  NETDISCO_DOMAIN: '${NETDISCO_DOMAIN:-discover}'
  NETDISCO_DB_TENANT:
  NETDISCO_DB_NAME:
  NETDISCO_DB_HOST: '${NETDISCO_DB_HOST:-netdisco-postgresql}'
  NETDISCO_DB_PORT:
  NETDISCO_DB_USER:
  NETDISCO_DB_PASS:
  NETDISCO_RO_COMMUNITY:
  PGDATABASE:
  PGHOST:
  PGPORT:
  PGUSER:
  PGPASSWORD:
  NETDISCO_CURRENT_PG_VERSION: '${NETDISCO_CURRENT_PG_VERSION:-18}'

services:

  netdisco-postgresql:
    container_name: netdisco-postgresql
    image: netdisco/netdisco:latest-postgresql
    shm_size: 128mb
    hostname: netdisco-postgresql
    # !! healthcheck is defined in the Dockerfile
    volumes:
      - postgresql:/var/lib/postgresql
    environment:
      <<: *common-environment
      NETDISCO_DB_SUPERUSER:

  netdisco-postgresql-13:
    container_name: netdisco-postgresql-13
    image: netdisco/netdisco:latest-postgresql-13
    shm_size: 128mb
    hostname: netdisco-postgresql-13
    volumes:
      - pgdata:/var/lib/postgresql/data
    environment:
      <<: *common-environment
      NETDISCO_DB_SUPERUSER:
    profiles:
      - with-pg-upgrade

  netdisco-db-init:
    container_name: netdisco-db-init
    image: netdisco/netdisco:latest-backend
    entrypoint: ''
    command: "/home/netdisco/bin/netdisco-env /home/netdisco/bin/netdisco-updatedb.sh"
    user: postgres
    depends_on:
      netdisco-postgresql:
        condition: service_healthy
    volumes:
      - pgdata:/var/lib/pgversions/pg13
      - postgresql:/var/lib/pgversions/new
      - config:/home/netdisco/environments
    environment:
      <<: *common-environment
      DEPLOY_ADMIN_USER: '${DEPLOY_ADMIN_USER:-YES}' # or set to NO
      NETDISCO_ADMIN_USER:

  netdisco-backend:
    container_name: netdisco-backend
    image: netdisco/netdisco:latest-backend
    hostname: netdisco-backend
    depends_on:
      netdisco-db-init:
        condition: service_completed_successfully
    init: true # run a full process manager to get signals
    volumes:
      - nd-site-local:/home/netdisco/nd-site-local
      - config:/home/netdisco/environments
      - logs:/home/netdisco/logs
    environment:
      <<: *common-environment
    dns_opt:
      - 'ndots:0'
      - 'timeout:1'
      - 'retries:0'
      - 'attempts:1'
      - edns0
      - trustad

  netdisco-web:
    container_name: netdisco-web
    image: netdisco/netdisco:latest-web
    hostname: netdisco-web
    depends_on:
      netdisco-db-init:
        condition: service_completed_successfully
    init: true # run a full process manager to get signals
    volumes:
      - nd-site-local:/home/netdisco/nd-site-local
      - config:/home/netdisco/environments
      - logs:/home/netdisco/logs
    environment:
      <<: *common-environment
      IPV: '${IPV:-4}'
      PORT:
    ports:
      - "5000:5000"
    dns_opt:
      - 'ndots:0'
      - 'timeout:1'
      - 'retries:0'
      - 'attempts:1'
      - edns0
      - trustad

volumes:
  pgdata:
  postgresql:
  nd-site-local:
  config:
  logs:

services:
    app:
        image: lscr.io/linuxserver/speedtest-tracker:latest
        restart: unless-stopped
        container_name: speedtest-tracker
        ports:
            - 8080:80
            - 8443:443
        environment:
            PUID: 1000
            PGID: 1000
            APP_KEY: ""
            APP_URL: "https://speedtest-tracker.example.com"
            DB_CONNECTION: "pgsql"
            DB_HOST: "db"
            DB_PORT: 5432
            DB_DATABASE: "speedtest_tracker"
            DB_USERNAME: "speedtest_tracker"
            DB_PASSWORD: "${DB_PASS:-}"
            # Optional
            SPEEDTEST_SKIP_IPS: "true"
            SPEEDTEST_SCHEDULE: "6 */2 * * *"
            PRUNE_RESULTS_OLDER_THAN: 60
        volumes:
            - app:/config
            - /path/to-custom-ssl-keys:/config/keys
        depends_on:
            - db
    db:
        image: postgres:18
        restart: always
        environment:
            POSTGRES_DB: "speedtest_tracker"
            POSTGRES_USER: "speedtest_tracker"
            POSTGRES_PASSWORD: "${DB_PASS:-}"
            PGDATA: "/var/lib/postgresql/data/"
        volumes:
            - db:/var/lib/postgresql/data
        healthcheck:
            test: ["CMD-SHELL", "pg_isready -U speedtest_tracker"]
            interval: 10s
            retries: 5
            timeout: 5s
volumes:
  app:
  db:

services:
  rackula:
    image: ghcr.io/rackulalives/rackula:persist
    container_name: rackula
    ports:
      - "${RACKULA_PORT:-8181}:${RACKULA_LISTEN_PORT:-8080}"
    environment:
      - API_HOST=rackula-api
      - API_PORT=${RACKULA_API_PORT:-3001}
      - RACKULA_LISTEN_PORT=${RACKULA_LISTEN_PORT:-8080}
      # Optional: token forwarded to API for PUT/DELETE route auth
      - API_WRITE_TOKEN=${RACKULA_API_WRITE_TOKEN:-}
      - RACKULA_AUTH_MODE=${RACKULA_AUTH_MODE:-local}
      - RACKULA_ENABLE_IPV6=${RACKULA_ENABLE_IPV6:-auto}
      # DNS resolver for nginx upstream resolution (override for Kubernetes)
      - NGINX_RESOLVER=${NGINX_RESOLVER:-127.0.0.11}
    restart: unless-stopped
    stop_grace_period: 10s
    depends_on:
      rackula-api:
        condition: service_healthy

    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 128M
        reservations:
          cpus: "0.10"
          memory: 16M

    # Security hardening (optional but recommended)
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /var/cache/nginx:size=10M
      - /var/run:size=1M
      - /tmp:size=5M
      - /etc/nginx/conf.d:size=1M,uid=101,gid=101

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  rackula-api:
    image: ghcr.io/rackulalives/rackula-api:latest
    container_name: rackula-api
    restart: unless-stopped
    stop_grace_period: 10s
    volumes:
      - data:/data
    environment:
      - DATA_DIR=/data
      - RACKULA_API_PORT=${RACKULA_API_PORT:-3001}
      - CORS_ORIGIN=${CORS_ORIGIN:-http://localhost:8080}
      - RACKULA_API_WRITE_TOKEN=${RACKULA_API_WRITE_TOKEN:-}
      - RACKULA_AUTH_MODE=${RACKULA_AUTH_MODE:-local}
      - RACKULA_AUTH_SESSION_SECRET=${RACKULA_AUTH_SESSION_SECRET:-}
      - RACKULA_LOCAL_USERNAME=${RACKULA_LOCAL_USERNAME:-}
      - RACKULA_LOCAL_PASSWORD=${RACKULA_LOCAL_PASSWORD:-}
      # Session hardening defaults
      - RACKULA_AUTH_SESSION_MAX_AGE_SECONDS=${RACKULA_AUTH_SESSION_MAX_AGE_SECONDS:-43200}
      - RACKULA_AUTH_SESSION_IDLE_TIMEOUT_SECONDS=${RACKULA_AUTH_SESSION_IDLE_TIMEOUT_SECONDS:-1800}
      - RACKULA_AUTH_SESSION_GENERATION=${RACKULA_AUTH_SESSION_GENERATION:-0}
      - RACKULA_AUTH_SESSION_COOKIE_SAMESITE=${RACKULA_AUTH_SESSION_COOKIE_SAMESITE:-Lax}
      # Production-safe default. Set false only for local HTTP auth testing.
      - RACKULA_AUTH_SESSION_COOKIE_SECURE=${RACKULA_AUTH_SESSION_COOKIE_SECURE:-true}
      - RACKULA_AUTH_CSRF_PROTECTION=${RACKULA_AUTH_CSRF_PROTECTION:-true}
      # Explicit insecure fallback (use only for isolated/local testing)
      - ALLOW_INSECURE_CORS=${ALLOW_INSECURE_CORS:-false}

    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 64M
        reservations:
          cpus: "0.05"
          memory: 16M

    # Security hardening
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp:size=5M

    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:${RACKULA_API_PORT:-3001}/health"]
      interval: 30s
      timeout: 10s
      start_period: 5s
      retries: 3

    logging:
      driver: json-file
      options:
        max-size: "5m"
        max-file: "2"

    expose:
      - "${RACKULA_API_PORT:-3001}"

volumes:
  data:

services:
    it-tools:
        container_name: it-tools
        image: corentinth/it-tools:latest
        ports:
            - 7070:80
        restart: unless-stopped