Self-Hosted Infrastructure
Documentation & Setup Guide

Complete media automation suite. Plex serves the library to LAN and remote clients; the *arr stack (Sonarr / Radarr / Bazarr / Prowlarr) handles indexer search, downloads, and subtitle acquisition. Notifiarr is the notification fan-out for events across the suite.

version: "3.9"

services:
  plex:
    image: plexinc/pms-docker
    container_name: plex
    runtime: nvidia
    # Plex needs host networking for DLNA / GDM discovery. Direct-play to LAN clients with no NAT overhead.
    network_mode: host
    environment:
      - PUID=1000
      - PGID=1000
      - VERSION=docker
      # Claim token placeholder. Replace with one from plex.tv/claim before first boot, or remove if already claimed via UI.
      - PLEX_CLAIM=Redacted
      - NVIDIA_VISIBLE_DEVICES=all
      - NVIDIA_DRIVER_CAPABILITIES=compute,video,utility
    volumes:
      - /srv/user/docker/plex/config:/config
      - /srv/user/Desktop/MoviesAndShows/Movies:/movies
      - /srv/user/Desktop/MoviesAndShows/Shows:/shows
      - /mnt/storage/BulkStore/Movies:/bulkstoremovies
      - /mnt/storage/BulkStore/Shows:/bulkstoreshows
      - /srv/user/Desktop/MoviesAndShows/Downloads:/downloads
      - /mnt/storage/BulkStore/Downloads:/bulkstoredownload
    restart: unless-stopped
    tmpfs:
      - "/transcode:size=8g,uid=1000,gid=1000,mode=1777"
    # https://plex.example.com

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    ports:
      - "8989:8989"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      - /srv/user/docker/sonarr/config:/config
      - /srv/user/Desktop/MoviesAndShows/Shows:/tv
      - /mnt/storage/BulkStore/Shows:/bulkstoreshows
      - /srv/user/Desktop/MoviesAndShows/Downloads:/downloads
      - /mnt/storage/BulkStore/Downloads:/bulkstoredownload
    restart: unless-stopped
    # https://sonarr.example.com

  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    ports:
      - "7878:7878"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      - /srv/user/docker/radarr/config:/config
      - /srv/user/Desktop/MoviesAndShows/Movies:/movies
      - /mnt/storage/BulkStore/Movies:/bulkstoremovies
      - /srv/user/Desktop/MoviesAndShows/Downloads:/downloads
      - /mnt/storage/BulkStore/Downloads:/bulkstoredownload
    restart: unless-stopped
    # https://radarr.example.com

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    ports:
      - "9696:9696"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      - /srv/user/docker/prowlarr/config:/config
    restart: unless-stopped
    # https://prowlarr.example.com

  bazarr:
    image: lscr.io/linuxserver/bazarr:latest
    container_name: bazarr
    ports:
      - "6767:6767"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      - /srv/user/docker/bazarr/config:/config
      - /srv/user/Desktop/MoviesAndShows/Movies:/movies
      - /srv/user/Desktop/MoviesAndShows/Shows:/tv
      - /mnt/storage/BulkStore/Movies:/bulkstoremovies
      - /mnt/storage/BulkStore/Shows:/bulkstoreshows
    restart: unless-stopped
    # https://bazarr.example.com
    
  notifiarr:
    image: golift/notifiarr:latest
    container_name: notifiarr
    ports:
      - "5454:5454"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
      - NOTIFIARR_API_KEY=Redacted
    volumes:
      - /srv/user/docker/notifiarr/config:/config
    restart: unless-stopped
    # https://notifiarr.example.com

Open-source media server running alongside Plex against the same library. Acts as a redundant front door. If Plex breaks or its account system goes wrong, Jellyfin still serves the same files. Also avoids Plex Pass dependency for hardware transcoding (Jellyfin includes NVENC free).

version: "3.9"

services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    network_mode: host
    runtime: nvidia
    environment:
      - TZ=America/New_York
      - NVIDIA_VISIBLE_DEVICES=all
      - NVIDIA_DRIVER_CAPABILITIES=compute,video,utility
      - JELLYFIN_PublishedServerUrl=https://jellyfin.example.com
    volumes:
      - jellyfin_config:/config
      - jellyfin_cache:/cache
      - /srv/user/Desktop/MoviesAndShows/Movies:/media/movies-local:ro
      - /srv/user/Desktop/MoviesAndShows/Shows:/media/shows-local:ro
      - /mnt/storage/BulkStore/Movies:/media/movies:ro
      - /mnt/storage/BulkStore/Shows:/media/shows:ro
    restart: unless-stopped

volumes:
  jellyfin_config:
  jellyfin_cache:

Usenet download client, and the primary download path for the media pipeline. Sonarr and Radarr hand NZBs to SABnzbd, which fetches the articles from a Usenet provider, repairs and unpacks them, then hands the finished files back for import.

services:
  sabnzbd:
    image: lscr.io/linuxserver/sabnzbd:latest
    container_name: sabnzbd
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      - /srv/user/docker/sabnzbd/config:/config
      # Same container path Sonarr/Radarr/Downloader use, so completed
      # downloads need no remote-path mapping.
      - /mnt/storage/BulkStore/Downloads:/bulkstoredownload
    ports:
      - "8091:8080"

Downloader routed exclusively through a ProtonVPN tunnel via gluetun. Downloader has no direct network interface. It inherits gluetun's namespace. If the VPN drops or gluetun crashes, Downloader loses internet entirely. The canonical Docker VPN kill-switch pattern.

version: "3.8"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    # NET_ADMIN is required so gluetun can bring up the VPN tunnel interface.
    cap_add:
      - NET_ADMIN
    environment:
      # gluetun handles provider-specific quirks. Server lists, credentials format, kill-switch rules.
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=openvpn
      # ProtonVPN port forwarding is required for inbound peer connections through the VPN's NAT.
      - VPN_PORT_FORWARDING=on

      - OPENVPN_USER=Redacted #Also don't forget to add +pmp
      - OPENVPN_PASSWORD=Redacted

      - SERVER_COUNTRIES=United States  # Or Switzerland, USA, etc.

      # Open this port on gluetun's internal firewall. (Known drift: ProtonVPN assigns a dynamic port. See Cross-cutting · VPN isolation.)
      - FIREWALL_VPN_INPUT_PORTS=8090 
    ports:
      - "8080:8080"        # Downloader Web UI
      - "8090:8090"        # download peer port (TCP)
      - "8090:8090/udp"    # download peer port (UDP)

      - "8888:8888/tcp"  # Gluetun Web UI (uncomment if you want it)

    restart: unless-stopped

  downloader:
    image: lscr.io/linuxserver/sabnzbd:latest
    container_name: downloader
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
      - WEBUI_PORT=8080
    volumes:
      - /srv/user/docker/downloader/config:/config
      - /srv/user/Desktop/MoviesAndShows/Downloads:/downloads
      - /mnt/storage/BulkStore/Downloads:/bulkstoredownload
      - /mnt/storage/BulkStore/ManualDownload:/manualdownload
    
    # Kill-switch pattern. Downloader shares gluetun's network namespace. If gluetun stops, downloader loses ALL internet.
    network_mode: "service:gluetun"
    
    # Ensures gluetun starts first so its namespace exists when downloader attaches.
    depends_on:
      - gluetun
      
    restart: unless-stopped

Watches the *arr queues for completed downloads that arrived as multi-part archives, extracts them, and cleans up the extracted files once the import succeeds.

version: "3.9"

services:
  unpackerr:
    image: golift/unpackerr:latest
    container_name: unpackerr
    user: 1000:1000
    environment:
      - TZ=America/New_York
      - UN_DEBUG=false
      - UN_INTERVAL=2m
      - UN_START_DELAY=1m
      - UN_RETRY_DELAY=5m
      - UN_MAX_RETRIES=3
      - UN_PARALLEL=2
      - UN_FILE_MODE=0644
      - UN_DIR_MODE=0755
      - UN_SONARR_0_URL=http://10.0.0.10:8989
      - UN_SONARR_0_API_KEY=6f170ebf50504509b391f607e773f59a
      - UN_SONARR_0_PATHS_0=/downloads
      - UN_SONARR_0_PATHS_1=/bulkstoredownload
      - UN_SONARR_0_PROTOCOLS=nzb
      - UN_SONARR_0_TIMEOUT=10s
      - UN_SONARR_0_DELETE_ORIG=false
      - UN_RADARR_0_URL=http://10.0.0.10:7878
      - UN_RADARR_0_API_KEY=e480f738286f4a42bf5fae6267376756
      - UN_RADARR_0_PATHS_0=/downloads
      - UN_RADARR_0_PATHS_1=/bulkstoredownload
      - UN_RADARR_0_PROTOCOLS=nzb
      - UN_RADARR_0_TIMEOUT=10s
      - UN_RADARR_0_DELETE_ORIG=false
    volumes:
      - /srv/user/Desktop/MoviesAndShows/Downloads:/downloads
      - /mnt/storage/BulkStore/Downloads:/bulkstoredownload
    restart: unless-stopped

Self-service media request portal. Users browse what is available on Plex, request what is not, and Jellyseerr forwards approved requests to Sonarr/Radarr for automatic acquisition.

version: '3.8'

services:
  jellyseerr:
    image: fallenbagel/jellyseerr:latest
    container_name: jellyseerr
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      # Per-service config convention: /srv/user/docker/<service>/config.
      - /srv/user/docker/jellyseerr/config:/app/config
    ports:
      - "5055:5055"
    restart: unless-stopped

Plex observability. Tracks watch history, currently-playing sessions, transcoding load, library growth, per-user activity. Pushes notifications on configured events.

version: '3.3'
services:
  tautulli:
    image: tautulli/tautulli
    container_name: tautulli
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
    volumes:
      # Holds Plex history DB. Primary long-term value is the historical record.
      - /srv/user/docker/tautulli:/config

    ports:
      - 8181:8181

Statistics and watch-history dashboard for Jellyfin. The Jellyfin counterpart to Tautulli. Tracks playback sessions, most-watched content, and per-user activity.

version: "3.9"

services:
  jellystat-db:
    image: postgres:16-alpine
    container_name: jellystat-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: jellystat
      POSTGRES_PASSWORD: Redacted
      POSTGRES_DB: jellystat
    volumes:
      - jellystat_db_data:/var/lib/postgresql/data

  jellystat:
    image: cyfershepard/jellystat:latest
    container_name: jellystat
    restart: unless-stopped
    ports:
      - "8088:3000"
    environment:
      POSTGRES_USER: jellystat
      POSTGRES_PASSWORD: Redacted
      POSTGRES_IP: jellystat-db
      POSTGRES_PORT: 5432
      POSTGRES_DB: jellystat
      JWT_SECRET: Redacted
      TZ: America/New_York
    depends_on:
      - jellystat-db

volumes:
  jellystat_db_data:

A small purpose-built HTTP proxy. Jellyseerr's API returns pending requests with TMDB IDs but no human-readable titles; this service resolves them and serves a clean JSON feed that the dashboard widget can render directly.

version: "3.9"

services:
  jsr-titles:
    image: python:3.14-alpine
    container_name: jsr-titles
    restart: unless-stopped
    labels:
      - 'wud.tag.include=^3\.\d+-alpine$$'
    ports:
      - "9999:9999"
    environment:
      - JELLYSEERR_URL=http://10.0.0.10:5055
      - JELLYSEERR_KEY=MTc2MTUxNDA0MDAwM2ZkMWQwNjQ5LTliYTYtNDc5Yi05MTc0LWU0Y2Q5YmVmNzdkNw==
    command: >
      # inline Python proxy (~4 KB, base64-embedded) fetches Jellyseerr
      # pending requests and resolves TMDB titles, served on :9999
      sh -c "echo <base64-script> | base64 -d > /app.py && exec python /app.py"

Self-hosted file sync, calendar, contacts, and office collaboration. Replaces Google Drive / iCloud for personal files. Sync clients on every platform push files into the homelab.

version: "3.8"

services:
  db:
    image: mariadb:11
    container_name: nextcloud_db
    restart: unless-stopped
    labels:
      - 'wud.tag.include=^11(\.\d+){0,2}$$'
    environment:
      MYSQL_ROOT_PASSWORD: Redacted
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: Redacted
    volumes:
      - /mnt/storage/NAS/NextCloud/db:/var/lib/mysql
    # Dedicated bridge network. Only nextcloud_app can reach the database.
    networks:
      - nextcloud-net

  app:
    image: nextcloud:34-apache
    container_name: nextcloud_app
    restart: unless-stopped
    labels:
      - 'wud.tag.include=^\d+-apache$$'
    depends_on:
      - db
    ports:
      - 8083:80
    environment:
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: Redacted
      # Resolves via Docker's internal DNS to the 'db' service on the bridge network.
      MYSQL_HOST: db
    volumes:
      - /mnt/storage/NAS/NextCloud/app:/var/www/html
      - /mnt/storage/NAS/NextCloud/data:/var/www/html/data
    networks:
      - nextcloud-net

  redis:
    image: redis:7.2-alpine
    container_name: nextcloud-redis
    restart: unless-stopped
    networks:
      - nextcloud-net

networks:
  nextcloud-net:
    driver: bridge

Self-hosted Notion-style wiki and collaborative document editor. Used for personal notes, project documentation, and longer-form content.

version: "3"

services:
  docmost:
    image: docmost/docmost:latest
    depends_on:
      - db
      - redis
    environment:
      APP_URL: "http://localhost:3000"
      # Used to sign sessions / JWTs. Rotation invalidates all active sessions.
      APP_SECRET: Redacted
      DATABASE_URL: Redacted
      # Redis is queue + cache; opaque to the host (no port exposed).
      REDIS_URL: "redis://redis:6379"
    ports:
      - "3000:3000"
    restart: unless-stopped
    volumes:
      - docmost:/app/data/storage

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: docmost
      POSTGRES_USER: docmost
      POSTGRES_PASSWORD: Redacted
    restart: unless-stopped
    volumes:
      - db_data:/var/lib/postgresql/data

  redis:
    image: redis:7.2-alpine
    restart: unless-stopped
    volumes:
      - redis_data:/data

volumes:
  docmost:
  db_data:
  redis_data:

Self-hosted Bitwarden-compatible password manager. Primary credential store for all personal accounts. A sidecar container produces daily encrypted backups to the NAS for off-host shipping by Duplicati.

version: '3.8'

services:
  vaultwarden:
    image: vaultwarden/server:1.37.1-alpine
    container_name: vaultwarden
    restart: unless-stopped
    labels:
      - 'wud.tag.include=^\d+\.\d+\.\d+-alpine$$'
    ports:
      - "8087:80"
    volumes:
      - vaultwarden_data:/data
    environment:
      # Must match the public URL exactly. Required for WebAuthn / passkey 2FA origin validation.
      - DOMAIN=https://vaultwarden.example.com

      # Upstream default is TRUE. Explicitly disabled to prevent unauthorized account creation.
      - SIGNUPS_ALLOWED=false
      # Closes the secondary path: even existing users cannot invite new ones.
      - INVITATIONS_ALLOWED=false
      - SHOW_PASSWORD_HINT=false

      - WEBSOCKET_ENABLED=true
      - TZ=America/New_York

  vaultwarden-backup:
    image: bruceforce/vaultwarden-backup:latest
    container_name: vaultwarden_backup_tool
    restart: unless-stopped

    volumes:
      - vaultwarden_data:/data:ro
      - /mnt/storage/NAS/Vaultwarden_Backup_Cache:/backup

    environment:
      - TIMESTAMP=true
      - PUID=1000
      - PGID=1000
      - CRON_TIME=30 2 * * *
      - TZ=America/New_York
      - BACKUP_DIR=/backup
      - DOCKER_CONTAINER_NAME=vaultwarden
      - BACKUP_ON_STARTUP=true
      - DELETE_AFTER=30

volumes:
  vaultwarden_data:

A self-written link-sharing web application, deployed as the lab's example of a proper software delivery workflow: production and staging environments, Git-backed deployment, and automated database backups.

services:
  db:
    image: postgres:16-alpine
    container_name: ${INSTANCE:-links}-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: links
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: links
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U links"]
      interval: 5s
      timeout: 5s
      retries: 12
    networks: [linksnet]

  api:
    build: ./server
    container_name: ${INSTANCE:-links}-api
    restart: unless-stopped
    environment:
      DATABASE_URL: Redacted
      SESSION_SECRET: ${SESSION_SECRET}
      ALLOW_SIGNUPS: ${ALLOW_SIGNUPS:-true}
      COOKIE_SECURE: ${COOKIE_SECURE:-false}
      ADMIN_USERNAMES: ${ADMIN_USERNAMES:-}
    depends_on:
      db:
        condition: service_healthy
    networks: [linksnet]

  web:
    build: .
    container_name: ${INSTANCE:-links}-web
    restart: unless-stopped
    environment:
      SITE_ADDRESS: ":80"
      FORWARDED_PROTO: ${FORWARDED_PROTO:-http}
    ports:
      - "${WEB_PORT:-8085}:80"
    depends_on: [api]
    volumes:
      - caddy_data:/data
      - caddy_config:/config
    networks: [linksnet]

  backup:
    image: prodrigestivill/postgres-backup-local:16-alpine
    container_name: ${INSTANCE:-links}-backup
    restart: unless-stopped
    environment:
      POSTGRES_HOST: db
      POSTGRES_DB: links
      POSTGRES_USER: links
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_EXTRA_OPTS: "-Z6"
      SCHEDULE: "0 0 2 * * *"
      BACKUP_KEEP_DAYS: 14
      BACKUP_KEEP_WEEKS: 8
      BACKUP_KEEP_MONTHS: 6
      TZ: America/New_York
    volumes:
      - ${BACKUP_PATH:-/mnt/storage/NAS/linksbackup}:/backups
    depends_on:
      db:
        condition: service_healthy
    networks: [linksnet]

volumes:
  pgdata:
  caddy_data:
  caddy_config:

networks:
  linksnet:
    driver: bridge

Self-hosted PDF toolbox — merge, split, compress, convert, OCR, sign, redact, rotate, watermark. A local replacement for the ad-riddled online PDF sites.

services:
  stirling-pdf:
    image: stirlingtools/stirling-pdf:2.14.3
    container_name: stirling-pdf
    restart: unless-stopped
    ports:
      - "8100:8080"
    environment:
      # 2.x: old DOCKER_ENABLE_SECURITY is ignored. These keep it login-free.
      - DISABLE_ADDITIONAL_FEATURES=true
      - SECURITY_ENABLELOGIN=false
      - LANGS=en_US
      - SYSTEM_DEFAULTLOCALE=en-US
      - TZ=America/New_York
    volumes:
      - /srv/user/docker/stirling/trainingData:/usr/share/tessdata
      - /srv/user/docker/stirling/configs:/configs
      - /srv/user/docker/stirling/customFiles:/customFiles
      - /srv/user/docker/stirling/logs:/logs
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/api/v1/info/status || exit 1"]
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 90s

Exposes the NAS over SMB so Windows / macOS / Linux clients on the LAN can mount it as a network drive.

version: "3.8"

services:
  samba:
    image: dperson/samba
    container_name: samba
    restart: unless-stopped
    # Host networking so SMB broadcast and NetBIOS discovery work without bridge gymnastics.
    network_mode: host
    environment:
      - USERID=1000
      - GROUPID=1000
    volumes:
      - /mnt/storage/NAS:/media/NAS
    # Single share 'NAS' backed by the bulk mount, single user.
    command: >
      -s "NAS;/media/NAS;yes;no;yes;all"
      -u "user;Redacted"

Encrypted, deduplicated, scheduled backups. Picks up the Vaultwarden tarball cache and ships it to long-term backup storage. Configured to back up other critical config paths on the host.

version: '3.8'

services:
  duplicati:
    image: lscr.io/linuxserver/duplicati:latest
    container_name: duplicati
    restart: unless-stopped

    volumes:
      # Holds Duplicati's internal DB and retention rules. Back this up separately or you lose backup history.
      - /opt/duplicati/config:/config

      # Destination is a separate NAS path from any source. Backup-set corruption cannot take out source data.
      - /mnt/storage/NAS/Duplicati_Backups:/destination

      # Source mounted READ-ONLY. The backup process cannot accidentally damage source data.
      - /mnt/storage/NAS/Vaultwarden_Backup_Cache:/vaultwarden:ro
      - /mnt/storage/NAS/config-backup:/source/configs:ro
      - /mnt/storage/NAS/nextcloud-backup:/source/nextcloud:ro
      - /mnt/storage/NAS/portainer-backup:/source/portainer:ro
      - /mnt/storage/NAS/linksbackup:/source/links:ro
      - /mnt/storage/NAS/linksbackup-staging:/source/links-staging:ro

    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
      - SETTINGS_ENCRYPTION_KEY=Redacted

    ports:
      - 8200:8200

Outbound-only tunnel to Cloudflare's edge. Exposes lab services on the public internet without opening any inbound ports on the home router.

version: '3.7'

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared-connector
    restart: unless-stopped
    # Outbound-only persistent connection to Cloudflare edge. No inbound port required on the home router.
    command: tunnel run --token Redacted
    networks:
      - cloudflare-net
    # Custom DNS (1.1.1.1) bypasses the AdGuard container during tunnel registration to avoid a boot-order deadlock.
    dns:
      - 1.1.1.1
      - 1.0.0.1
    # ⬆️ ADD THESE TWO LINES

networks:
  cloudflare-net:
    # This tells Docker Compose that the network was created externally in Portainer
    # Network is created in Portainer separately so other stacks can attach for inbound routing.
    external: true

Network-wide DNS sinkhole. Blocks ads, trackers, and malware domains for every device on the LAN that uses it as a resolver.

version: "3.8"

services:
  adguard:
    image: adguard/adguardhome:latest
    container_name: adguard
    restart: unless-stopped
    # Host networking required to bind port 53 directly and serve as the LAN's primary DNS.
    network_mode: host
    volumes:
      # Query logs and runtime state. Survives container recreate.
      - /opt/adguard/work:/opt/adguardhome/work
      - /opt/adguard/conf:/opt/adguardhome/conf
    environment:
      - TZ=America/New_York

A tiny HAProxy that sits between apps and the Docker socket, exposing only a read-only allowlist of API endpoints. Dashboards and monitors that need to see container state connect to it instead of the raw socket.

services:
  socket-proxy:
    image: tecnativa/docker-socket-proxy:latest
    container_name: socket-proxy
    restart: unless-stopped
    environment:
      - CONTAINERS=1
      - IMAGES=1
      - INFO=1
      - VERSION=1
      - EVENTS=1
      - PING=1
      - NETWORKS=1
      - VOLUMES=1
      - POST=0
      - EXEC=0
      - CONTAINERS_CREATE=0
      - CONTAINERS_START=0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "127.0.0.1:2375:2375"
    networks:
      - socketproxy
    read_only: true
    tmpfs:
      - /run
      - /tmp
networks:
  socketproxy:
    name: socketproxy
    driver: bridge

Modern dashboard with live service widgets (download queues, media now-playing, disk usage) rather than a static grid of links. Runs alongside Flame, which remains the plain launcher.

version: "3.9"

services:
  homepage:
    image: ghcr.io/gethomepage/homepage:latest
    container_name: homepage
    ports:
      - "7676:3000"
    group_add:
      - "984"
    volumes:
      - homepage_config:/app/config
      - homepage_icons:/app/public/icons
      - /mnt/storage/BulkStore:/mnt/bulkstore:ro
      - /mnt/merged:/mnt/merged:ro
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
      - HOMEPAGE_ALLOWED_HOSTS=server.example.com,homepage.example.com,10.0.0.10:7676,localhost:7676
    restart: unless-stopped

volumes:
  homepage_config:
  homepage_icons:

Personal homepage / app launcher. Customizable tile grid linking to every service in the lab.

services:
  flame:
    image: pawelmalak/flame:latest
    container_name: flame
    volumes:
      - /opt/flame/data:/app/data
      - /opt/flame/secrets/password:/run/secrets/password:ro
    ports:
      - "5005:5005"
    environment:
      - PASSWORD_FILE=Redacted
    restart: unless-stopped

Self-hosted status page and uptime monitor. Pings every service in the lab; sends notifications on failure.

services:
  uptime-kuma:
    image: louislam/uptime-kuma:latest
    container_name: uptime-kuma
    restart: always
    volumes:
      - /opt/uptime-kuma/data:/app/data
    ports:
      - "3001:3001"
    environment:
      - TZ=America/New_York

Lightweight host and container resource monitoring. CPU, memory, disk, network and temperatures, with history. Complements Uptime Kuma, which answers "is it up" rather than "is it healthy".

version: "3.9"

services:
  beszel:
    image: henrygd/beszel:latest
    container_name: beszel
    restart: unless-stopped
    ports:
      - "8090:8090"
    volumes:
      - beszel_data:/beszel_data
      - beszel_socket:/beszel_socket

  beszel-agent:
    image: henrygd/beszel-agent:latest
    container_name: beszel-agent
    restart: unless-stopped
    network_mode: host
    volumes:
      - beszel_agent_data:/var/lib/beszel-agent
    environment:
      - LISTEN=45876
      - KEY=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMgiAxUC665hVIuhdCma+UznlWL0F+71nRe/QNeyceaY
      - TOKEN=Redacted
      - HUB_URL=http://127.0.0.1:8090
      - DOCKER_HOST=tcp://127.0.0.1:2375

volumes:
  beszel_data:
  beszel_socket:
  beszel_agent_data:

"What's Up Docker". Watches every running container against its upstream registry and reports when a newer image is published. Findings are pushed to ntfy.

services:
  wud:
    image: ghcr.io/getwud/wud:latest
    container_name: wud
    restart: unless-stopped
    environment:
      - TZ=America/New_York
      # Watch via socket-proxy (read-only) instead of the raw docker socket
      - WUD_WATCHER_LOCAL_HOST=socket-proxy
      - WUD_WATCHER_LOCAL_PORT=2375
      - WUD_WATCHER_LOCAL_CRON=0 6 * * *
      - WUD_WATCHER_LOCAL_WATCHBYDEFAULT=true
      - WUD_TRIGGER_NTFY_HOMELAB_URL=http://10.0.0.10:8093
      - WUD_TRIGGER_NTFY_HOMELAB_TOPIC=homelab
      - WUD_TRIGGER_NTFY_HOMELAB_AUTH_TOKEN=Redacted
      - WUD_TRIGGER_NTFY_HOMELAB_PRIORITY=3
      - WUD_TRIGGER_NTFY_HOMELAB_ONCE=true
      - WUD_TRIGGER_NTFY_HOMELAB_THRESHOLD=minor
      - WUD_REGISTRY_LSCR_PUBLIC_USERNAME=anonymous
      - WUD_REGISTRY_LSCR_PUBLIC_TOKEN=anonymous
    volumes:
      - /srv/user/docker/wud:/store
    ports:
      - "8094:3000"
    networks:
      - socketproxy

networks:
  socketproxy:
    external: true
    name: socketproxy

Self-hosted push notification server. Monitoring and automation publish to topics; the phone app subscribes and delivers them as native push notifications.

services:
  ntfy:
    image: binwiederhier/ntfy:latest
    container_name: ntfy
    restart: unless-stopped
    command: serve
    environment:
      - TZ=America/New_York
    volumes:
      - /srv/user/docker/ntfy/etc:/etc/ntfy
      - /srv/user/docker/ntfy/cache:/var/cache/ntfy
      - /srv/user/docker/ntfy/lib:/var/lib/ntfy
    ports:
      - "8093:80"
    healthcheck:
      test: ["CMD-SHELL", "wget -q --tries=1 -O - http://localhost:80/v1/health 2>/dev/null | grep -Eo '\"healthy\"\\s*:\\s*true' || exit 1"]
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 40s

Real-time Docker log viewer in the browser. Every container's logs in one place, live-streaming, with search and multi-container view.

services:
  dozzle:
    image: amir20/dozzle:latest
    container_name: dozzle
    restart: unless-stopped
    ports:
      - "8101:8080"
    environment:
      - DOZZLE_NO_ANALYTICS=true
      - DOCKER_HOST=tcp://socket-proxy:2375
      - TZ=America/New_York
    networks:
      - socketproxy
    healthcheck:
      test: ["CMD", "/dozzle", "healthcheck"]
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 20s

networks:
  socketproxy:
    external: true
    name: socketproxy

A small scheduled container that tars the config directories of the media apps (Sonarr / Radarr / Prowlarr / Bazarr / Tautulli / SABnzbd / Jellyseerr) to the NAS every night, with rotation.

services:
  config-backup:
    image: alpine:latest
    container_name: config-backup
    restart: unless-stopped
    environment:
      - TZ=America/New_York
    volumes:
      - /srv/user/docker:/src:ro
      - /mnt/storage/NAS/config-backup:/backup
      - /srv/user/docker/config-backup/backup.sh:/backup.sh:ro
    command:
      - /bin/sh
      - -c
      - "apk add --no-cache tar findutils tzdata >/dev/null 2>&1; echo '30 3 * * * /backup.sh' > /etc/crontabs/root; echo 'config-backup ready, cron 03:30 daily'; crond -f -l 8"

Watches the host mount table and sends a phone push (via ntfy) the moment a media drive unmounts, with a recovery notice when it returns.

services:
  mount-monitor:
    image: alpine:latest
    container_name: mount-monitor
    restart: unless-stopped
    environment:
      - TZ=America/New_York
    volumes:
      - /proc:/hostproc:ro
      - /srv/user/docker/mount-monitor/monitor.sh:/monitor.sh:ro
    command:
      - /bin/sh
      - -c
      - "apk add --no-cache curl >/dev/null 2>&1; exec sh /monitor.sh"

Browser-based VS Code, accessible from any device on the LAN. Useful for editing configs and writing scripts from a tablet or borrowed PC without an SSH client.

services:
  code-server:
    image: lscr.io/linuxserver/code-server:latest
    container_name: code-server
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
    volumes:
      # Per-service config convention: /srv/user/docker/<service>/config.
      - /srv/user/docker/code-server/config:/config
    ports:
      - 8443:8443
    restart: unless-stopped

Small self-hosted utility exposed on its own subdomain.

version: "3.9"

services:
  trek:
    image: mauriceboe/trek:latest
    container_name: trek
    restart: unless-stopped
    ports:
      - "8089:3000"
    environment:
      - NODE_ENV=production
      - APP_URL=https://trek.example.com
      - ENCRYPTION_KEY=Redacted
      - TZ=America/New_York
    volumes:
      - trek_data:/app/data
      - trek_uploads:/app/uploads

volumes:
  trek_data:
  trek_uploads: