First attempt at diarization (with custom Dockerfile extension).

README.md

@@ -1,3 +1,3 @@
 # containers
 
-compose.yaml and other configuration data for Docker containers
+compose.yaml and other configuration data for Docker containers.

beszel/.gitignore

@@ -0,0 +1,3 @@
+/beszel_agent_data/
+/beszel_data/
+

beszel/compose.yaml

@@ -0,0 +1,27 @@
+services:
+  beszel:
+    image: henrygd/beszel:latest
+    container_name: beszel
+    restart: unless-stopped
+    environment:
+      APP_URL: http://localhost:8090
+    ports:
+      - 8090:8090
+    volumes:
+      - /var/lib/beszel/beszel_data:/beszel_data
+      - /var/lib/beszel/beszel_socket:/beszel_socket
+
+  beszel-agent:
+    image: henrygd/beszel-agent:latest
+    container_name: beszel-agent
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - /var/lib/beszel/beszel_agent_data:/var/lib/beszel-agent
+      - /var/lib/beszel/beszel_socket:/beszel_socket
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      LISTEN: /beszel_socket/beszel.sock
+      HUB_URL: http://localhost:8090
+      TOKEN: da52524a-fa93-47ef-908c-dd001c9e8e18
+      KEY: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFgDayLLA8JOzQ7fZtqTlUaRIQvhtoYSZvkUC9PrdQJG"

gitea/compose.yaml

@@ -18,7 +18,7 @@ services:
     networks:
       - gitea
     volumes:
-      - /mnt/storage/appdata/gitea/data:/data
+      - /var/lib/gitea/data:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     ports:
@@ -38,6 +38,6 @@ services:
     networks:
       - gitea
     volumes:
-      - /mnt/storage/appdata/gitea/mysql:/var/lib/mysql
+      - /var/lib/gitea/db:/var/lib/mysql
 
       

immich/.env

@@ -1,15 +1,16 @@
 # You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables
 
 # The location where your uploaded files are stored
-UPLOAD_LOCATION=/mnt/storage/appdata/immich/library
+UPLOAD_LOCATION=/var/lib/immich/data
 # The location where your database files are stored
-DB_DATA_LOCATION=/mnt/storage/appdata/immich/postgres
+DB_DATA_LOCATION=/var/lib/immich/db
 
 # To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
 TZ=America/New_York
 
 # The Immich version to use. You can pin this to a specific version like "v1.71.0"
-IMMICH_VERSION=v2.3.1
+IMMICH_VERSION=v2.7.5
+
 
 # Connection secret for postgres. You should change it to a random password
 DB_PASSWORD=postgres

jellyfin/compose.yaml

@@ -4,19 +4,19 @@ services:
     container_name: jellyfin
     network_mode: 'host'
     volumes:
-      - /mnt/storage/appdata/jellyfin/config:/config
+      - /etc/jellyfin:/config
-      - /mnt/storage/appdata/jellyfin/config/web-config.json:/jellyfin/jellyfin-web/config.json
+#      - /etc/jellyfin/web-config.json:/jellyfin/jellyfin-web/config.json
-      - /mnt/storage/appdata/jellyfin/cache:/cache
+      - /var/lib/jellyfin/cache:/cache
       - /mnt/cygnus:/cygnus:ro
       - type: bind
-        source: /mnt/storage/appdata/jellyfin/media
+        source: /var/lib/jellyfin/media
         target: /media
         read_only: true
     restart: 'unless-stopped'
     # Optional - alternative address used for autodiscovery
-    # environment:
+    environment:
-    #   - JELLYFIN_PublishedServerUrl=http://example.com
+      - JELLYFIN_PublishedServerUrl=http://127.0.0.1:8096
     # Optional - may be necessary for docker healthcheck to pass if running in host network mode
     # extra_hosts:
     #   - 'host.docker.internal:host-gateway'
-      
+    

loki/README.md

@@ -0,0 +1,121 @@
+# Homelab Log Aggregation Stack
+
+Grafana Alloy + Loki + Grafana, configured for:
+- **MikroTik RB5009** (and other network devices) via syslog
+- **Docker container logs** on the host machine
+
+## Quick Start
+
+```bash
+# (Optional) load secrets first if using the Vaultwarden secrets workflow
+# ./secrets-load.sh docker/loki-stack .env
+
+docker compose up -d
+```
+
+Grafana will be available at **http://\<host-ip\>:3098**
+Default login: `admin` / `admin` — you will be prompted to change this.
+
+---
+
+## MikroTik RB5009 Configuration
+
+In RouterOS (Winbox or SSH), run:
+
+```routeros
+# Create a remote logging action pointing at this Docker host
+/system logging action
+add name=remote-loki \
+    target=remote \
+    remote=<YOUR-DOCKER-HOST-IP> \
+    remote-port=514 \
+    bsd-syslog=yes \
+    syslog-facility=local0 \
+    syslog-severity=auto
+
+# Send all log topics to Loki
+/system logging
+add action=remote-loki topics=all
+```
+
+To verify it's working, SSH into the RB5009 and run:
+```routeros
+/log print follow
+```
+...then in Grafana, open Explore → Loki and query `{source="network"}`.
+You should see entries appearing within a few seconds.
+
+---
+
+## Useful LogQL Queries
+
+**All RB5009 logs:**
+```logql
+{job="syslog", source="network"}
+```
+
+**RB5009 interface/link events only:**
+```logql
+{job="syslog", source="network"} |= "link"
+```
+
+**All logs from a specific Docker container:**
+```logql
+{job="docker", container="myapp"}
+```
+
+**Errors across all Docker containers:**
+```logql
+{job="docker"} |= "error" | logfmt | level="error"
+```
+
+**Everything in the last 24 hours, newest first:**
+```logql
+{job=~"syslog|docker"} | line_format "{{.source}} {{.container}} {{.message}}"
+```
+
+---
+
+## File Layout
+
+```
+loki-stack/
+├── docker-compose.yml
+├── alloy/
+│   └── config.alloy        # Alloy pipeline config (syslog + Docker)
+├── loki/
+│   └── loki-config.yml     # Loki storage and retention config
+└── grafana/
+    └── provisioning/
+        └── datasources/
+            └── loki.yml    # Auto-provisions Loki as default datasource
+```
+
+## Retention
+
+Logs are kept for **90 days** by default. To change this, edit `loki/loki-config.yml`:
+```yaml
+limits_config:
+  retention_period: 30d   # or 180d, etc.
+```
+Then restart Loki: `docker compose restart loki`
+
+## Adding More Syslog Sources
+
+Any device that can send syslog (UDP/TCP 514) will work automatically —
+the `host` label will be set from the syslog hostname field, so you can
+filter per-device in Grafana with `{host="my-device-hostname"}`.
+
+---
+
+## Integrating with the Vaultwarden Secrets Workflow
+
+If you're using the `secrets-load.sh` script, store the Grafana admin
+password as a custom field named `GF_SECURITY_ADMIN_PASSWORD` in a
+Vaultwarden item called `docker/loki-stack`, then replace the hardcoded
+value in `docker-compose.yml` with:
+
+```yaml
+env_file:
+  - .env
+```

loki/compose.yaml

@@ -0,0 +1,69 @@
+---
+# Loki + Alloy + Grafana log aggregation stack
+# Place this file in a directory e.g. ~/docker/loki-stack/
+# Run with: docker compose up -d
+
+networks:
+  logging:
+    driver: bridge
+
+services:
+
+  # ── Loki: log storage and query engine ──────────────────────────────────────
+  loki:
+    image: grafana/loki:3.4.2
+    container_name: loki
+    restart: unless-stopped
+    networks:
+      - logging
+    ports:
+      - "3100:3100"       # Loki HTTP API (Alloy pushes here; Grafana queries here)
+    volumes:
+      - /var/lib/loki:/loki
+      - /etc/loki:/etc/loki:ro
+    command: -config.file=/etc/loki/loki.yml
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:3100/ready || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+
+  # ── Alloy: log collector / syslog receiver ───────────────────────────────────
+  alloy:
+    image: grafana/alloy:v1.7.5
+    container_name: alloy
+    restart: unless-stopped
+    networks:
+      - logging
+    ports:
+      - "5140:5140/udp"     # Syslog UDP (for MikroTik and other network devices)
+      - "5140:5140/tcp"     # Syslog TCP
+      - "12345:12345"     # Alloy UI (optional, useful for debugging)
+    volumes:
+      - /etc/alloy/alloy.alloy:/etc/alloy/config.alloy:ro
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro  # Docker log access
+      - /var/run/docker.sock:/var/run/docker.sock:ro              # Docker metadata
+    command: run /etc/alloy/config.alloy --server.http.listen-addr=0.0.0.0:12345
+    depends_on:
+      loki:
+        condition: service_healthy
+
+  # ── Grafana: log query UI ────────────────────────────────────────────────────
+  grafana:
+    image: grafana/grafana:11.5.2
+    container_name: grafana
+    restart: unless-stopped
+    networks:
+      - logging
+    ports:
+      - "3098:3000"
+    volumes:
+      - /var/lib/grafana:/var/lib/grafana
+      - /etc/grafana/grafana-datasources.yml:/etc/grafana/provisioning/datasources/loki.yml:ro
+    environment:
+      - GF_AUTH_ANONYMOUS_ENABLED=true         # Remove if you want login
+      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin       # Remove if you want login
+      - GF_SECURITY_ADMIN_PASSWORD=changeme    # Change this
+    depends_on:
+      loki:
+        condition: service_healthy

nextcloud/compose.yaml

@@ -4,7 +4,7 @@ services:
     restart: always
     command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
     volumes:
-      - /mnt/storage/appdata/nextcloud/mysql:/var/lib/mysql
+      - /var/lib/nextcloud/db:/var/lib/mysql
     networks:
       - default
     environment:
@@ -16,12 +16,12 @@ services:
   app:
     depends_on:
       - db
-    image: nextcloud:32
+    image: nextcloud:33
     restart: always
     ports:
       - 8080:80
     volumes:
-      - /mnt/storage/appdata/nextcloud/www/html:/var/www/html
+      - /var/lib/nextcloud/data/www/html:/var/www/html
     networks:
       - default
     environment:

portainer/compose.yaml

@@ -1,33 +1,16 @@
 services:
   portainer:
-    image: portainer/portainer:latest
+    image: portainer/portainer-ce:lts
     container_name: portainer
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
-    networks:
-      - proxy
     volumes:
       - /etc/localtime:/etc/localtime:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /var/run/docker.sock:/var/run/docker.sock
-      - /mnt/storage/appdata/portainer/data:/data
+      - /var/lib/portainer:/data
     ports:
-      - 9000:9000
+      - 9443:9443
-    labels:
+      - 8000:8000
-      - "traefik.enable=false"
-      - "traefik.http.routers.portainer.entrypoints=http"
-      - "traefik.http.routers.portainer.rule=Host(`portainer.objectbrokers.com`)"
-      - "traefik.http.middlewares.portainer-https-redirect.redirectscheme.scheme=https"
-      - "traefik.http.routers.portainer.middlewares=portainer-https-redirect"
-      - "traefik.http.routers.portainer-secure.entrypoints=https"
-      - "traefik.http.routers.portainer-secure.rule=Host(`portainer.objectbrokers.com`)"
-      - "traefik.http.routers.portainer-secure.tls=true"
-      - "traefik.http.routers.portainer-secure.tls.certresolver=http"
-      - "traefik.http.routers.portainer-secure.service=portainer"
-      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
-      - "traefik.docker.network=proxy"
 
 networks:
-  proxy:
+  default:
-    external: true
+    name: portainer_network
-    

prometheus/compose.yaml

@@ -1,88 +0,0 @@
-volumes:
-  prometheus_data: {}
-  grafana_data: {}
-
-networks:
-  monitoring:
-    driver: bridge
-
-services:
-  prometheus:
-    image: prom/prometheus:latest
-    container_name: prometheus
-    volumes:
-      - ./prometheus:/etc/prometheus
-      - prometheus_data:/prometheus
-    command:
-      - '--config.file=/etc/prometheus/prometheus.yml'
-      - '--storage.tsdb.path=/prometheus'
-      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
-      - '--web.console.templates=/usr/share/prometheus/consoles'
-      - '--web.enable-lifecycle'
-    ports:
-      - "9098:9090"
-    networks:
-      - monitoring
-    restart: unless-stopped
-
-  node-exporter:
-    image: prom/node-exporter:latest
-    container_name: node-exporter
-    volumes:
-      - /proc:/host/proc:ro
-      - /sys:/host/sys:ro
-      - /:/rootfs:ro
-    command:
-      - '--path.procfs=/host/proc'
-      - '--path.sysfs=/host/sys'
-      - '--collector.filesystem.ignored-mount-points=^/(sys|proc|dev|host|etc)($|/)'
-    ports:
-      - "9100:9100"
-    networks:
-      - monitoring
-    restart: unless-stopped
-
-  cadvisor:
-    image: gcr.io/cadvisor/cadvisor:latest
-    container_name: cadvisor
-    volumes:
-      - /:/rootfs:ro
-      - /var/run:/var/run:rw
-      - /sys:/sys:ro
-      - /var/lib/docker/:/var/lib/docker:ro
-      - /dev/disk/:/dev/disk:ro
-    ports:
-      - "8080:8080"
-    networks:
-      - monitoring
-    restart: unless-stopped
-
-  grafana:
-    image: grafana/grafana:latest
-    container_name: grafana
-    volumes:
-      - grafana_data:/var/lib/grafana
-      - ./grafana/provisioning:/etc/grafana/provisioning
-    environment:
-      - GF_SECURITY_ADMIN_USER=admin
-      - GF_SECURITY_ADMIN_PASSWORD=admin
-      - GF_USERS_ALLOW_SIGN_UP=false
-    ports:
-      - "3000:3000"
-    networks:
-      - monitoring
-    restart: unless-stopped
-
-  alertmanager:
-    image: prom/alertmanager:latest
-    container_name: alertmanager
-    volumes:
-      - ./alertmanager:/etc/alertmanager
-    command:
-      - '--config.file=/etc/alertmanager/config.yml'
-      - '--storage.path=/alertmanager'
-    ports:
-      - "9093:9093"
-    networks:
-      - monitoring
-    restart: unless-stopped

prometheus/prometheus.yml

@@ -1,13 +0,0 @@
-global:
-  scrape_interval: 15s
-
-scrape_configs:
-  - job_name: 'prometheus'
-    static_configs:
-      - targets: ['localhost:9098']
-
-  - job_name: 'docker'
-    static_configs:
-      - targets: ['172.17.0.1:9323']
-
-

vaultwarden/compose.yaml

@@ -8,10 +8,10 @@ services:
       - 8030:80
     environment:
 #      - DOMAIN='https://vaultwarden.objectbrokers.com'
-      - ADMIN_TOKEN="llanfairpwll"
+      - ADMIN_TOKEN=mfLzuPlsXDqtIwTGSN/oZ3cgmFKWXY/zv+hO94gtqsJeHdl7+O+tJeMZrTzQNMfI
 #      DOMAIN: "https://vaultwarden.objectbrokers.com"  # Your domain; vaultwarden needs to know it's https to work properly with attachments
 #      ADMIN_TOKEN: ADMIN_TOKEN=${VAULTWARDEN_ADMIN_TOKEN}
     volumes:
-      - /mnt/storage/appdata/bitwarden:/data
+      - /var/lib/vaultwarden:/data
 
 

whisper/.gitignore

@@ -0,0 +1 @@
+whisper-live.env

whisper/Dockerfile

@@ -0,0 +1,5 @@
+FROM ghcr.io/collabora/whisperlive-openvino:latest
+
+# Install pyannote.audio and its dependencies.
+# --no-cache-dir keeps the image layer smaller.
+RUN pip install --no-cache-dir pyannote.audio

whisper/compose.yaml

@@ -0,0 +1,35 @@
+services:
+  whisper-live:
+    image: whisper-live-diarization:latest
+    container_name: whisper-live
+    restart: unless-stopped
+    ports:
+      - "9097:9090"
+    volumes:
+      - whisper-live-data:/var/lib/whisper-live
+      - whisper-pyannote-cache:/root/.cache/huggingface/hub
+    env_file:
+      - whisper-live.env          # contains HUGGING_FACE_HUB_TOKEN — not in git
+    command:
+      - "python3"
+      - "run_server.py"
+      - "--port"
+      - "9090"
+      - "--backend"
+      - "openvino"
+      - "--omp_num_threads"
+      - "4"
+      - "--max_clients"
+      - "1"
+      - "--max_connection_time"
+      - "7200"
+      - "--raw_pcm_input"
+    devices:
+      - /dev/dri/renderD128:/dev/dri/renderD128
+      - /dev/dri/card1:/dev/dri/card1
+    cpuset: "0-7"
+    mem_limit: 10g
+
+volumes:
+  whisper-live-data:
+  whisper-pyannote-cache: