feat(docker): Add karakeep and keycloak services

Signed-off-by: Tuan-Dat Tran <tuan-dat.tran@tudattr.dev>

group_vars/docker/docker.yml

@@ -0,0 +1,521 @@
+docker:
+  url: "https://download.docker.com/linux"
+  apt_release_channel: "stable"
+  directories:
+    local: "/opt/local/"
+    config: "/opt/docker/config/"
+    compose: "/opt/docker/compose/"
+
+services:
+  - name: syncthing
+    vm:
+      - docker-host00
+    container_name: syncthing
+    image: syncthing/syncthing:1.29
+    restart: unless-stopped
+    volumes:
+      - name: "Data"
+        internal: /var/syncthing/
+        external: /media/docker/data/syncthing/
+    ports:
+      - name: "http"
+        internal: 8384
+        external: "{{ services_external_http.syncthing }}"
+      - name: ""
+        internal: 22000
+        external: 22000
+      - name: ""
+        internal: 22000
+        external: 22000
+      - name: ""
+        internal: 21027
+        external: 21027
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+  - name: status
+    vm:
+      - docker-host00
+    container_name: kuma
+    image: louislam/uptime-kuma:1.23.16
+    restart: unless-stopped
+    volumes:
+      - name: "Data"
+        internal: /app/data
+        external: "{{ docker.directories.local }}/kuma/"
+    ports:
+      - name: "http"
+        internal: 3001
+        external: "{{ services_external_http.kuma }}"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+  - name: plex
+    vm:
+      - docker-host00
+    container_name: plex
+    image: lscr.io/linuxserver/plex:1.41.5
+    restart: unless-stopped
+    volumes:
+      - name: "Configuration"
+        internal: /config
+        external: "{{ docker.directories.local }}/plex/config/"
+      - name: "TV Series"
+        internal: /tv:ro
+        external: /media/series
+      - name: "Movies"
+        internal: /movies:ro
+        external: /media/movies
+      - name: "Music"
+        internal: /music:ro
+        external: /media/songs
+    devices:
+      - name: "Graphics Card"
+        internal: /dev/dri
+        external: /dev/dri
+    ports:
+      - name: "http"
+        internal: 32400
+        external: "{{ services_external_http.plex }}"
+      - name: ""
+        internal: 1900
+        external: 1900
+      - name: ""
+        internal: 3005
+        external: 3005
+      - name: ""
+        internal: 5353
+        external: 5353
+      - name: ""
+        internal: 32410
+        external: 32410
+      - name: ""
+        internal: 8324
+        external: 8324
+      - name: ""
+        internal: 32412
+        external: 32412
+      - name: ""
+        internal: 32469
+        external: 32469
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+      - VERSION=docker
+  - name: jellyfin
+    vm:
+      - docker-host01
+    container_name: jellyfin
+    image: jellyfin/jellyfin:10.10
+    restart: "unless-stopped"
+    volumes:
+      - name: "Configuration"
+        internal: /config
+        external: "{{ docker.directories.local }}/jellyfin/config"
+      - name: "Cache"
+        internal: /cache
+        external: "{{ docker.directories.config }}/jellyfin/cache"
+      - name: "Tv Series"
+        internal: /tv:ro
+        external: /media/series
+      - name: "Music"
+        internal: /movies:ro
+        external: /media/movies
+      - name: "Music"
+        internal: /music:ro
+        external: /media/songs
+    devices:
+      - name: "Graphics Card"
+        internal: /dev/dri
+        external: /dev/dri
+    ports:
+      - name: "http"
+        internal: 8096
+        external: "{{ services_external_http.jellyfin }}"
+    environment:
+  - name: hass
+    vm:
+      - docker-host01
+    container_name: homeassistant
+    image: "ghcr.io/home-assistant/home-assistant:stable"
+    restart: unless-stopped
+    privileged: true
+    volumes:
+      - name: "Configuration"
+        internal: /config/
+        external: "{{ docker.directories.local }}/home-assistant/config/"
+      - name: "Local Time"
+        internal: /etc/localtime:ro
+        external: /etc/localtime
+    ports:
+      - name: "http"
+        internal: 8123
+        external: "{{ services_external_http.hass }}"
+      - name: ""
+        internal: 4357
+        external: 4357
+      - name: ""
+        internal: 5683
+        external: 5683
+      - name: ""
+        internal: 5683
+        external: 5683
+  - name: ddns
+    vm:
+      - docker-host00
+    container_name: ddns-updater
+    image: qmcgaw/ddns-updater:2
+    restart: unless-stopped
+    volumes:
+      - name: "Configuration"
+        internal: /updater/data/"
+        external: "{{ docker.directories.config }}/ddns-updater/data/"
+    ports:
+      - name: "http"
+        internal: 8000
+        external: "{{ services_external_http.ddns }}"
+  - name: sonarr
+    vm:
+      - docker-host00
+    container_name: sonarr
+    image: linuxserver/sonarr:4.0.14
+    restart: unless-stopped
+    volumes:
+      - name: "Configuration"
+        internal: /config
+        external: "{{ docker.directories.local }}/sonarr/config"
+      - name: "Tv Series"
+        internal: /tv
+        external: /media/series
+      - name: "Torrent Downloads"
+        internal: /downloads
+        external: /media/docker/data/arr_downloads/sonarr
+    ports:
+      - name: "http"
+        internal: 8989
+        external: "{{ services_external_http.sonarr }}"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+  - name: radarr
+    vm:
+      - docker-host00
+    container_name: radarr
+    image: linuxserver/radarr:5.21.1
+    restart: unless-stopped
+    volumes:
+      - name: "Configuration"
+        internal: /config
+        external: "{{ docker.directories.local }}/radarr/config"
+      - name: "Movies"
+        internal: /movies
+        external: /media/movies
+      - name: "Torrent Downloads"
+        internal: /downloads
+        external: /media/docker/data/arr_downloads/radarr
+    ports:
+      - name: "http"
+        internal: 7878
+        external: "{{ services_external_http.radarr }}"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+  - name: lidarr
+    vm:
+      - docker-host00
+    container_name: lidarr
+    image: linuxserver/lidarr:2.10.3
+    restart: unless-stopped
+    volumes:
+      - name: "Configuration"
+        internal: /config
+        external: "{{ docker.directories.local }}/lidarr/config"
+      - name: "Music"
+        internal: /music
+        external: /media/songs
+      - name: "Torrent Downloads"
+        internal: /downloads
+        external: /media/docker/data/arr_downloads/lidarr
+    ports:
+      - name: "http"
+        internal: 8686
+        external: "{{ services_external_http.lidarr }}"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+  - name: prowlarr
+    vm:
+      - docker-host00
+    container_name: prowlarr
+    image: linuxserver/prowlarr:1.32.2
+    restart: unless-stopped
+    volumes:
+      - name: "Configuration"
+        internal: /config
+        external: "{{ docker.directories.local }}/prowlarr/config"
+    ports:
+      - name: "http"
+        internal: 9696
+        external: "{{ services_external_http.prowlarr }}"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+  - name: paperless
+    vm:
+      - docker-host00
+    container_name: paperless
+    image: ghcr.io/paperless-ngx/paperless-ngx:2.14
+    restart: unless-stopped
+    depends_on:
+      - paperless-postgres
+      - paperless-broker
+    volumes:
+      - name: "Configuration"
+        internal: /usr/src/paperless/data
+        external: "{{ docker.directories.local }}/paperless/data/data"
+      - name: "Media"
+        internal: /usr/src/paperless/media
+        external: "{{ docker.directories.local }}/paperless/data/media"
+      - name: "Document Export"
+        internal: /usr/src/paperless/export
+        external: "{{ docker.directories.local }}/paperless/data/export"
+      - name: "Document Consume"
+        internal: /usr/src/paperless/consume
+        external: "{{ docker.directories.local }}/paperless/data/consume"
+    environment:
+      - "PAPERLESS_REDIS=redis://paperless-broker:6379"
+      - "PAPERLESS_DBHOST=paperless-postgres"
+      - "PAPERLESS_DBUSER=paperless"
+      - "PAPERLESS_DBPASS={{ vault.docker.paperless.dbpass }}"
+      - "USERMAP_UID=1000"
+      - "USERMAP_GID=1000"
+      - "PAPERLESS_URL=https://paperless.{{ domain }}"
+      - "PAPERLESS_TIME_ZONE=Europe/Berlin"
+      - "PAPERLESS_OCR_LANGUAGE=deu"
+    ports:
+      - name: "http"
+        internal: 8000
+        external: "{{ services_external_http.paperless }}"
+  - name: pdf
+    vm:
+      - docker-host00
+    container_name: stirling
+    image: frooodle/s-pdf:0.45.0
+    restart: unless-stopped
+    ports:
+      - name: "http"
+        internal: 8080
+        external: "{{ services_external_http.pdf }}"
+  - name: git
+    vm:
+      - docker-host01
+    container_name: gitea
+    image: gitea/gitea:1.23-rootless
+    restart: unless-stopped
+    volumes:
+      - name: "Configuration"
+        internal: /etc/gitea
+        external: "{{ docker.directories.local }}/gitea/config"
+      - name: "Data"
+        internal: /var/lib/gitea
+        external: "{{ docker.directories.local }}/gitea/data"
+      - name: "Time Zone"
+        internal: /etc/timezone:ro
+        external: /etc/timezone
+      - name: "Local Time"
+        internal: /etc/localtime:ro
+        external: /etc/localtime
+    ports:
+      - name: "http"
+        internal: 3000
+        external: "{{ services_external_http.git }}"
+      - name: "ssh"
+        internal: 2222
+        external: 2222
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+  - name: changedetection
+    vm:
+      - docker-host00
+    container_name: changedetection
+    image: dgtlmoon/changedetection.io:0.49
+    restart: unless-stopped
+    volumes:
+      - name: "Data"
+        internal: /datastore
+        external: "{{ docker.directories.config }}/changedetection/data/"
+    ports:
+      - name: "http"
+        internal: 5000
+        external: "{{ services_external_http.changedetection }}"
+  - name: gluetun
+    vm:
+      - docker-host00
+    container_name: gluetun
+    image: qmcgaw/gluetun:v3.40
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+    devices:
+      - name: "Tunnel"
+        internal: /dev/net/tun
+        external: /dev/net/tun
+    volumes:
+      - name: "Configuration"
+        internal: /gluetun
+        external: "{{ docker.directories.config }}/gluetun/config"
+    ports:
+      - name: "Qbit Client"
+        internal: 8082
+        external: 8082
+      - name: "Torrentleech Client"
+        internal: 8083
+        external: 8083
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+      - VPN_SERVICE_PROVIDER=protonvpn
+      - UPDATER_VPN_SERVICE_PROVIDERS=protonvpn
+      - UPDATER_PERIOD=24h
+      - "SERVER_COUNTRIES={{ vault.docker.proton.country }}"
+      - "OPENVPN_USER={{ vault.docker.proton.openvpn_user }}"
+      - "OPENVPN_PASSWORD={{ vault.docker.proton.openvpn_password }}"
+  - name: torrentleech
+    vm:
+      - docker-host00
+    container_name: torrentleech
+    image: qbittorrentofficial/qbittorrent-nox
+    restart: unless-stopped
+    depends_on:
+      - gluetun
+    network_mode: "container:gluetun"
+    volumes:
+      - name: "Configuration"
+        internal: /config
+        external: "{{ docker.directories.config }}/torrentleech/config"
+      - name: "Downloads"
+        internal: /downloads
+        external: /media/docker/data/arr_downloads
+    ports:
+      - name: "http"
+        internal: proxy_only
+        external: 8083
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+      - QBT_EULA="accept"
+      - QBT_WEBUI_PORT="8083"
+  - name: qbit
+    vm:
+      - docker-host00
+    container_name: qbit
+    image: qbittorrentofficial/qbittorrent-nox:5.0.4-1
+    restart: unless-stopped
+    depends_on:
+      - gluetun
+    network_mode: "container:gluetun"
+    volumes:
+      - name: "Configuration"
+        internal: /config
+        external: "{{ docker.directories.config }}/qbit/config"
+      - name: "Downloads"
+        internal: /downloads
+        external: /media/docker/data/arr_downloads
+    ports:
+      - name: "http"
+        internal: proxy_only
+        external: 8082
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Berlin
+      - QBT_EULA="accept"
+      - QBT_WEBUI_PORT="8082"
+  - name: cadvisor
+    vm:
+      - docker-host00
+      - docker-host01
+    container_name: cadvisor
+    image: gcr.io/cadvisor/cadvisor:v0.52.1
+    restart: unless-stopped
+    ports:
+      - name: ""
+        internal: 8080
+        external: 8081
+    volumes:
+      - name: "Root"
+        internal: /rootfs:ro
+        external: /
+      - name: "Run"
+        internal: /var/run:rw
+        external: /var/run
+      - name: "System"
+        internal: /sys:ro
+        external: /sys
+      - name: "Docker"
+        internal: /var/lib/docker:ro
+        external: /var/lib/docker
+  - name: karakeep
+    vm:
+      - docker-host01
+    container_name: karakeep
+    image: ghcr.io/karakeep-app/karakeep:0.23.2
+    restart: unless-stopped
+    ports:
+      - name: "http"
+        internal: 3000
+        external: "{{ services_external_http.karakeep }}"
+    volumes:
+      - name: "Data"
+        internal: /data
+        external: "{{ docker.directories.local }}/karakeep/config"
+    environment:
+      - MEILI_ADDR=http://karakeep-meilisearch:7700
+      - BROWSER_WEB_URL=http://karakeep-chrome:9222
+      - NEXTAUTH_SECRET={{ vault.docker.karakeep.nextauth_secret }}
+      - MEILI_MASTER_KEY={{ vault.docker.karakeep.meili_master_key }}
+      - NEXTAUTH_URL=https://karakeep.tudattr.dev/
+      - OPENAI_API_KEY={{ vault.docker.karakeep.openai_key }}
+      - DATA_DIR=/data
+      - DISABLE_SIGNUPS=true
+  - name: keycloak
+    vm:
+      - docker-host01
+    container_name: keycloak
+    image: quay.io/keycloak/keycloak:26.2
+    restart: unless-stopped
+    ports:
+      - name: "http"
+        internal: 8080
+        external: "{{ services_external_http.keycloak }}"
+    volumes:
+      - name: "config"
+        internal: /opt/keycloak/data/import/homelab-realm.json
+        external: "{{ docker.directories.local }}/keycloak/homelab-realm.json"
+    command:
+      - "start"
+      - "--import-realm"
+    environment:
+      - KC_DB=postgres
+      - KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak
+      - KC_DB_USERNAME=keycloak
+      - KC_DB_PASSWORD=password
+      - KC_HOSTNAME=keycloak.{{ internal_domain }}
+      - KC_HTTP_ENABLED=true
+      - KC_HTTP_RELATIVE_PATH=/
+      - KC_PROXY=edge
+      - KC_PROXY_HEADERS=xforwarded
+      - KC_HOSTNAME_URL=https://keycloak.{{ internal_domain }}
+      - KC_HOSTNAME_ADMIN_URL=https://keycloak.{{ internal_domain }}
+      - KC_BOOTSTRAP_ADMIN_USERNAME=serviceadmin-{{ keycloak_admin_hash }}
+      - KC_BOOTSTRAP_ADMIN_PASSWORD={{ vault.docker.keycloak.admin.password }