First attempt at diarization (with custom Dockerfile extension).

Reviewed-on: #2

README.md

@@ -1,3 +1,3 @@
 # containers
 
-compose.yaml and other configuration data for Docker containers
+compose.yaml and other configuration data for Docker containers.

beszel/.gitignore

@@ -0,0 +1,3 @@
+/beszel_agent_data/
+/beszel_data/
+

beszel/compose.yaml

@@ -0,0 +1,27 @@
+services:
+  beszel:
+    image: henrygd/beszel:latest
+    container_name: beszel
+    restart: unless-stopped
+    environment:
+      APP_URL: http://localhost:8090
+    ports:
+      - 8090:8090
+    volumes:
+      - /var/lib/beszel/beszel_data:/beszel_data
+      - /var/lib/beszel/beszel_socket:/beszel_socket
+
+  beszel-agent:
+    image: henrygd/beszel-agent:latest
+    container_name: beszel-agent
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - /var/lib/beszel/beszel_agent_data:/var/lib/beszel-agent
+      - /var/lib/beszel/beszel_socket:/beszel_socket
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      LISTEN: /beszel_socket/beszel.sock
+      HUB_URL: http://localhost:8090
+      TOKEN: da52524a-fa93-47ef-908c-dd001c9e8e18
+      KEY: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFgDayLLA8JOzQ7fZtqTlUaRIQvhtoYSZvkUC9PrdQJG"

gitea/compose.yaml

@@ -18,7 +18,7 @@ services:
     networks:
       - gitea
     volumes:
-      - /mnt/storage/appdata/gitea/data:/data
+      - /var/lib/gitea/data:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     ports:
@@ -38,6 +38,6 @@ services:
     networks:
       - gitea
     volumes:
-      - /mnt/storage/appdata/gitea/mysql:/var/lib/mysql
+      - /var/lib/gitea/db:/var/lib/mysql
 
       

immich/.env

@@ -1,15 +1,16 @@
 # You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables
 
 # The location where your uploaded files are stored
-UPLOAD_LOCATION=/mnt/storage/appdata/immich/library
+UPLOAD_LOCATION=/var/lib/immich/data
 # The location where your database files are stored
-DB_DATA_LOCATION=/mnt/storage/appdata/immich/postgres
+DB_DATA_LOCATION=/var/lib/immich/db
 
 # To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
 TZ=America/New_York
 
 # The Immich version to use. You can pin this to a specific version like "v1.71.0"
-IMMICH_VERSION=v1.138.0
+IMMICH_VERSION=v2.7.5
+
 
 # Connection secret for postgres. You should change it to a random password
 DB_PASSWORD=postgres

immich/compose.yaml

@@ -1,10 +1,11 @@
 #
-# WARNING: Make sure to use the docker-compose.yml of the current release:
+# WARNING: To install Immich, follow our guide: https://immich.app/docs/install/docker-compose
+#
+# Make sure to use the docker-compose.yml of the current release:
 #
 # https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
 #
 # The compose file on main may not be compatible with the latest release.
-#
 
 name: immich
 
@@ -16,54 +17,57 @@ services:
     #   file: hwaccel.transcoding.yml
     #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
     volumes:
-      - ${UPLOAD_LOCATION}:/usr/src/app/upload
+      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
+      - ${UPLOAD_LOCATION}:/data
       - /etc/localtime:/etc/localtime:ro
     env_file:
       - .env
     ports:
-      - 2283:2283
+      - '2283:2283'
     depends_on:
       - redis
       - database
     restart: always
+    healthcheck:
+      disable: false
 
   immich-machine-learning:
     container_name: immich_machine_learning
-    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
+    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
     # Example tag: ${IMMICH_VERSION:-release}-cuda
     image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
     # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
     #   file: hwaccel.ml.yml
-    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
+    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
     volumes:
       - model-cache:/cache
     env_file:
       - .env
     restart: always
+    healthcheck:
+      disable: false
 
   redis:
     container_name: immich_redis
-    image: docker.io/redis:6.2-alpine@sha256:d6c2911ac51b289db208767581a5d154544f2b2fe4914ea5056443f62dc6e900
+    image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always
 
   database:
     container_name: immich_postgres
-    image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:8d292bdb796aa58bbbaa47fe971c8516f6f57d6a47e7172e62754feb6ed4e7b0
     environment:
       POSTGRES_PASSWORD: ${DB_PASSWORD}
       POSTGRES_USER: ${DB_USERNAME}
       POSTGRES_DB: ${DB_DATABASE_NAME}
       POSTGRES_INITDB_ARGS: '--data-checksums'
+      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
+      # DB_STORAGE_TYPE: 'HDD'
     volumes:
+      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
       - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
-    healthcheck:
-      test: pg_isready --dbname='${DB_DATABASE_NAME}' || exit 1; Chksum="$$(psql --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
-      interval: 5m
-      start_interval: 30s
-      start_period: 5m
-    command: ["postgres", "-c" ,"shared_preload_libraries=vectors.so", "-c", 'search_path="$$user", public, vectors', "-c", "logging_collector=on", "-c", "max_wal_size=2GB", "-c", "shared_buffers=512MB", "-c", "wal_compression=on"]
+    shm_size: 128mb
     restart: always
 
 volumes:

jellyfin/compose.yaml

@@ -4,19 +4,19 @@ services:
     container_name: jellyfin
     network_mode: 'host'
     volumes:
-      - /mnt/storage/appdata/jellyfin/config:/config
-      - /mnt/storage/appdata/jellyfin/config/web-config.json:/jellyfin/jellyfin-web/config.json
-      - /mnt/storage/appdata/jellyfin/cache:/cache
+      - /etc/jellyfin:/config
+#      - /etc/jellyfin/web-config.json:/jellyfin/jellyfin-web/config.json
+      - /var/lib/jellyfin/cache:/cache
       - /mnt/cygnus:/cygnus:ro
       - type: bind
-        source: /mnt/storage/appdata/jellyfin/media
+        source: /var/lib/jellyfin/media
         target: /media
         read_only: true
     restart: 'unless-stopped'
     # Optional - alternative address used for autodiscovery
-    # environment:
-    #   - JELLYFIN_PublishedServerUrl=http://example.com
+    environment:
+      - JELLYFIN_PublishedServerUrl=http://127.0.0.1:8096
     # Optional - may be necessary for docker healthcheck to pass if running in host network mode
     # extra_hosts:
     #   - 'host.docker.internal:host-gateway'
-      
+    

loki/README.md

@@ -0,0 +1,121 @@
+# Homelab Log Aggregation Stack
+
+Grafana Alloy + Loki + Grafana, configured for:
+- **MikroTik RB5009** (and other network devices) via syslog
+- **Docker container logs** on the host machine
+
+## Quick Start
+
+```bash
+# (Optional) load secrets first if using the Vaultwarden secrets workflow
+# ./secrets-load.sh docker/loki-stack .env
+
+docker compose up -d
+```
+
+Grafana will be available at **http://\<host-ip\>:3098**
+Default login: `admin` / `admin` — you will be prompted to change this.
+
+---
+
+## MikroTik RB5009 Configuration
+
+In RouterOS (Winbox or SSH), run:
+
+```routeros
+# Create a remote logging action pointing at this Docker host
+/system logging action
+add name=remote-loki \
+    target=remote \
+    remote=<YOUR-DOCKER-HOST-IP> \
+    remote-port=514 \
+    bsd-syslog=yes \
+    syslog-facility=local0 \
+    syslog-severity=auto
+
+# Send all log topics to Loki
+/system logging
+add action=remote-loki topics=all
+```
+
+To verify it's working, SSH into the RB5009 and run:
+```routeros
+/log print follow
+```
+...then in Grafana, open Explore → Loki and query `{source="network"}`.
+You should see entries appearing within a few seconds.
+
+---
+
+## Useful LogQL Queries
+
+**All RB5009 logs:**
+```logql
+{job="syslog", source="network"}
+```
+
+**RB5009 interface/link events only:**
+```logql
+{job="syslog", source="network"} |= "link"
+```
+
+**All logs from a specific Docker container:**
+```logql
+{job="docker", container="myapp"}
+```
+
+**Errors across all Docker containers:**
+```logql
+{job="docker"} |= "error" | logfmt | level="error"
+```
+
+**Everything in the last 24 hours, newest first:**
+```logql
+{job=~"syslog|docker"} | line_format "{{.source}} {{.container}} {{.message}}"
+```
+
+---
+
+## File Layout
+
+```
+loki-stack/
+├── docker-compose.yml
+├── alloy/
+│   └── config.alloy        # Alloy pipeline config (syslog + Docker)
+├── loki/
+│   └── loki-config.yml     # Loki storage and retention config
+└── grafana/
+    └── provisioning/
+        └── datasources/
+            └── loki.yml    # Auto-provisions Loki as default datasource
+```
+
+## Retention
+
+Logs are kept for **90 days** by default. To change this, edit `loki/loki-config.yml`:
+```yaml
+limits_config:
+  retention_period: 30d   # or 180d, etc.
+```
+Then restart Loki: `docker compose restart loki`
+
+## Adding More Syslog Sources
+
+Any device that can send syslog (UDP/TCP 514) will work automatically —
+the `host` label will be set from the syslog hostname field, so you can
+filter per-device in Grafana with `{host="my-device-hostname"}`.
+
+---
+
+## Integrating with the Vaultwarden Secrets Workflow
+
+If you're using the `secrets-load.sh` script, store the Grafana admin
+password as a custom field named `GF_SECURITY_ADMIN_PASSWORD` in a
+Vaultwarden item called `docker/loki-stack`, then replace the hardcoded
+value in `docker-compose.yml` with:
+
+```yaml
+env_file:
+  - .env
+```

loki/compose.yaml

@@ -0,0 +1,69 @@
+---
+# Loki + Alloy + Grafana log aggregation stack
+# Place this file in a directory e.g. ~/docker/loki-stack/
+# Run with: docker compose up -d
+
+networks:
+  logging:
+    driver: bridge
+
+services:
+
+  # ── Loki: log storage and query engine ──────────────────────────────────────
+  loki:
+    image: grafana/loki:3.4.2
+    container_name: loki
+    restart: unless-stopped
+    networks:
+      - logging
+    ports:
+      - "3100:3100"       # Loki HTTP API (Alloy pushes here; Grafana queries here)
+    volumes:
+      - /var/lib/loki:/loki
+      - /etc/loki:/etc/loki:ro
+    command: -config.file=/etc/loki/loki.yml
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:3100/ready || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+
+  # ── Alloy: log collector / syslog receiver ───────────────────────────────────
+  alloy:
+    image: grafana/alloy:v1.7.5
+    container_name: alloy
+    restart: unless-stopped
+    networks:
+      - logging
+    ports:
+      - "5140:5140/udp"     # Syslog UDP (for MikroTik and other network devices)
+      - "5140:5140/tcp"     # Syslog TCP
+      - "12345:12345"     # Alloy UI (optional, useful for debugging)
+    volumes:
+      - /etc/alloy/alloy.alloy:/etc/alloy/config.alloy:ro
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro  # Docker log access
+      - /var/run/docker.sock:/var/run/docker.sock:ro              # Docker metadata
+    command: run /etc/alloy/config.alloy --server.http.listen-addr=0.0.0.0:12345
+    depends_on:
+      loki:
+        condition: service_healthy
+
+  # ── Grafana: log query UI ────────────────────────────────────────────────────
+  grafana:
+    image: grafana/grafana:11.5.2
+    container_name: grafana
+    restart: unless-stopped
+    networks:
+      - logging
+    ports:
+      - "3098:3000"
+    volumes:
+      - /var/lib/grafana:/var/lib/grafana
+      - /etc/grafana/grafana-datasources.yml:/etc/grafana/provisioning/datasources/loki.yml:ro
+    environment:
+      - GF_AUTH_ANONYMOUS_ENABLED=true         # Remove if you want login
+      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin       # Remove if you want login
+      - GF_SECURITY_ADMIN_PASSWORD=changeme    # Change this
+    depends_on:
+      loki:
+        condition: service_healthy

matter-server/compose.yaml

@@ -0,0 +1,11 @@
+services:  
+  matter-server:  
+    container_name: matter-server  
+    image: ghcr.io/home-assistant-libs/python-matter-server:stable  
+    restart: unless-stopped  
+    security_opt:  
+      - apparmor=unconfined  
+    volumes:  
+      - ./data:/data  
+      - /run/dbus:/run/dbus:ro  
+    network_mode: host

nextcloud/compose.yaml

@@ -4,7 +4,7 @@ services:
     restart: always
     command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
     volumes:
-      - /mnt/storage/appdata/nextcloud/mysql:/var/lib/mysql
+      - /var/lib/nextcloud/db:/var/lib/mysql
     networks:
       - default
     environment:
@@ -16,12 +16,12 @@ services:
   app:
     depends_on:
       - db
-    image: nextcloud:30
+    image: nextcloud:33
     restart: always
     ports:
       - 8080:80
     volumes:
-      - /mnt/storage/appdata/nextcloud/www/html:/var/www/html
+      - /var/lib/nextcloud/data/www/html:/var/www/html
     networks:
       - default
     environment:

portainer/compose.yaml

@@ -1,33 +1,16 @@
 services:
   portainer:
-    image: portainer/portainer:latest
+    image: portainer/portainer-ce:lts
     container_name: portainer
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
-    networks:
-      - proxy
     volumes:
       - /etc/localtime:/etc/localtime:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - /mnt/storage/appdata/portainer/data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /var/lib/portainer:/data
     ports:
-      - 9000:9000
-    labels:
-      - "traefik.enable=false"
-      - "traefik.http.routers.portainer.entrypoints=http"
-      - "traefik.http.routers.portainer.rule=Host(`portainer.objectbrokers.com`)"
-      - "traefik.http.middlewares.portainer-https-redirect.redirectscheme.scheme=https"
-      - "traefik.http.routers.portainer.middlewares=portainer-https-redirect"
-      - "traefik.http.routers.portainer-secure.entrypoints=https"
-      - "traefik.http.routers.portainer-secure.rule=Host(`portainer.objectbrokers.com`)"
-      - "traefik.http.routers.portainer-secure.tls=true"
-      - "traefik.http.routers.portainer-secure.tls.certresolver=http"
-      - "traefik.http.routers.portainer-secure.service=portainer"
-      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
-      - "traefik.docker.network=proxy"
+      - 9443:9443
+      - 8000:8000
 
 networks:
-  proxy:
-    external: true
-    
+  default:
+    name: portainer_network

vaultwarden/compose.yaml

@@ -8,10 +8,10 @@ services:
       - 8030:80
     environment:
 #      - DOMAIN='https://vaultwarden.objectbrokers.com'
-      - ADMIN_TOKEN="llanfairpwll"
+      - ADMIN_TOKEN=mfLzuPlsXDqtIwTGSN/oZ3cgmFKWXY/zv+hO94gtqsJeHdl7+O+tJeMZrTzQNMfI
 #      DOMAIN: "https://vaultwarden.objectbrokers.com"  # Your domain; vaultwarden needs to know it's https to work properly with attachments
 #      ADMIN_TOKEN: ADMIN_TOKEN=${VAULTWARDEN_ADMIN_TOKEN}
     volumes:
-      - /mnt/storage/appdata/bitwarden:/data
+      - /var/lib/vaultwarden:/data
 
 

whisper/.gitignore

@@ -0,0 +1 @@
+whisper-live.env

whisper/Dockerfile

@@ -0,0 +1,5 @@
+FROM ghcr.io/collabora/whisperlive-openvino:latest
+
+# Install pyannote.audio and its dependencies.
+# --no-cache-dir keeps the image layer smaller.
+RUN pip install --no-cache-dir pyannote.audio

whisper/compose.yaml

@@ -0,0 +1,35 @@
+services:
+  whisper-live:
+    image: whisper-live-diarization:latest
+    container_name: whisper-live
+    restart: unless-stopped
+    ports:
+      - "9097:9090"
+    volumes:
+      - whisper-live-data:/var/lib/whisper-live
+      - whisper-pyannote-cache:/root/.cache/huggingface/hub
+    env_file:
+      - whisper-live.env          # contains HUGGING_FACE_HUB_TOKEN — not in git
+    command:
+      - "python3"
+      - "run_server.py"
+      - "--port"
+      - "9090"
+      - "--backend"
+      - "openvino"
+      - "--omp_num_threads"
+      - "4"
+      - "--max_clients"
+      - "1"
+      - "--max_connection_time"
+      - "7200"
+      - "--raw_pcm_input"
+    devices:
+      - /dev/dri/renderD128:/dev/dri/renderD128
+      - /dev/dri/card1:/dev/dri/card1
+    cpuset: "0-7"
+    mem_limit: 10g
+
+volumes:
+  whisper-live-data:
+  whisper-pyannote-cache: