vh
2be296ffa0
Reorganize the gethomepage dashboard from site-based (PFI-ANA, ESH, NH3) to function-first grouping (Monitoring, AI Systems, Apps, Media, Games, Infra-<site>, Service Networking). Canonical config now tracked in configs/homepage/ with Plex/Jellyfin widget keys moved to env substitution. Label sweep across fleet compose files: - beszel, dozzle, backrest -> Monitoring - rest-server-ana -> Service Networking Healthcheck fixes (previous wget/curl paths broke on distroless + --private-repos 401): - beszel hub: /beszel health --url ... - beszel agent: /agent health (newly added) - rest-server: nc -z localhost 8000 (TCP probe) Group name originally "Wiring / Plumbing" collapsed to single-word group on homepage's parser; renamed to "Service Networking" everywhere.
65 lines
2.4 KiB
YAML
65 lines
2.4 KiB
YAML
# rest-server (Anaheim) — restic backup target for the fleet.
|
|
#
|
|
# Deploys to ana-docker. Data dir is the NFS mount at
|
|
# /mnt/backup/restic/repo/ana, backed by the Debian 12 NFS/SMB file
|
|
# server at 10.250.50.50. (Historically a TrueNAS SCALE appliance; since
|
|
# reprovisioned as vanilla Debian.)
|
|
#
|
|
# Mirrors stacks/rest-server-nh3/ in every meaningful way — same auth
|
|
# model, same on-disk layout, same operational semantics — so each client
|
|
# host uses an identical URL shape against either endpoint:
|
|
#
|
|
# rest:http://<user>:<pw>@10.100.50.50:8000/<user>/ (NH3 Synology)
|
|
# rest:http://<user>:<pw>@10.250.50.70:8000/<user>/ (this stack)
|
|
#
|
|
# Auth model:
|
|
# --private-repos : URL path must start with /<user>/ and the HTTP
|
|
# basic-auth user must match. Per-host repos are
|
|
# strictly isolated.
|
|
# --append-only : on-disk data can be added but not removed or
|
|
# rewritten; a compromised host can't wipe its own
|
|
# history. Prune requires disabling this (see README).
|
|
#
|
|
# Credentials come from /data/.htpasswd — see README for populating it.
|
|
#
|
|
# All tunables live in .env — edit that, not this file.
|
|
|
|
services:
|
|
rest-server:
|
|
image: restic/rest-server:${REST_SERVER_VERSION}
|
|
container_name: rest-server
|
|
restart: unless-stopped
|
|
# Run as the UID that owns the NFS-backed data dir, so file I/O
|
|
# is not subject to NFS root_squash. On ana-docker this is lkraven (1000).
|
|
user: "${REST_UID:-1000}:${REST_GID:-1000}"
|
|
ports:
|
|
- "${REST_PORT}:8000"
|
|
volumes:
|
|
- ${DATA_DIR}:/data
|
|
environment:
|
|
- OPTIONS=--private-repos --append-only --prometheus ${EXTRA_OPTIONS:-}
|
|
- TZ=${TZ:-America/Los_Angeles}
|
|
healthcheck:
|
|
# TCP port probe — busybox nc ships in the restic/rest-server Alpine
|
|
# image. HTTP-level checks fight with --private-repos returning 401
|
|
# (busybox wget exit 8, gnu wget exit 6 — version-dependent and hard
|
|
# to branch on cleanly in POSIX sh).
|
|
test: ["CMD", "nc", "-z", "localhost", "8000"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 15s
|
|
networks:
|
|
- tnet
|
|
labels:
|
|
- homepage.group=Service Networking
|
|
- homepage.name=Restic (rest-server)
|
|
- homepage.icon=mdi-cloud-upload
|
|
- homepage.description=Anaheim restic endpoint (data on NFS)
|
|
- homepage.href=http://10.250.50.70:${REST_PORT}
|
|
|
|
networks:
|
|
tnet:
|
|
name: traefik-net
|
|
external: true
|