vh
2be296ffa0
Reorganize the gethomepage dashboard from site-based (PFI-ANA, ESH, NH3) to function-first grouping (Monitoring, AI Systems, Apps, Media, Games, Infra-<site>, Service Networking). Canonical config now tracked in configs/homepage/ with Plex/Jellyfin widget keys moved to env substitution. Label sweep across fleet compose files: - beszel, dozzle, backrest -> Monitoring - rest-server-ana -> Service Networking Healthcheck fixes (previous wget/curl paths broke on distroless + --private-repos 401): - beszel hub: /beszel health --url ... - beszel agent: /agent health (newly added) - rest-server: nc -z localhost 8000 (TCP probe) Group name originally "Wiring / Plumbing" collapsed to single-word group on homepage's parser; renamed to "Service Networking" everywhere.
43 lines
1.7 KiB
YAML
43 lines
1.7 KiB
YAML
# rest-server (NH3 Synology) — restic backup target for the fleet.
|
|
#
|
|
# Deploys into Synology Container Manager on 10.100.50.50. Data lives on
|
|
# a Btrfs shared folder so it gets Synology snapshots + optional
|
|
# replication to a sibling share if you configure one later.
|
|
#
|
|
# Auth model:
|
|
# --private-repos : every URL path must start with /<username>/ and the
|
|
# HTTP basic-auth user must match. One user per host.
|
|
# Per-host repos are strictly isolated.
|
|
# --append-only : on-disk data can be ADDED but not REMOVED or REWRITTEN.
|
|
# A compromised host can't delete its own history.
|
|
# Prune requires disabling this (see README).
|
|
#
|
|
# Credentials come from /data/.htpasswd — see README for how to populate
|
|
# it. That file is mounted read-only into the container.
|
|
#
|
|
# All tunables live in .env — edit that, not this file.
|
|
|
|
services:
|
|
rest-server:
|
|
image: restic/rest-server:${REST_SERVER_VERSION}
|
|
container_name: rest-server
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${REST_PORT}:8000"
|
|
volumes:
|
|
- ${DATA_DIR}:/data
|
|
environment:
|
|
- OPTIONS=--private-repos --append-only --prometheus ${EXTRA_OPTIONS:-}
|
|
- TZ=${TZ:-America/Los_Angeles}
|
|
# rest-server stores repos under /data and looks for /data/.htpasswd
|
|
# automatically — no extra bind mount needed as long as the htpasswd
|
|
# file is created inside DATA_DIR before startup.
|
|
healthcheck:
|
|
# TCP port probe — avoids the --private-repos 401 trap.
|
|
# See stacks/rest-server-ana/compose.yaml for reasoning.
|
|
test: ["CMD", "nc", "-z", "localhost", "8000"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 15s
|