Merge pull request #7 from beatz174-bit/codex/move-hard-coded-environment-variables

Move hard-coded compose environment values into default-environment.env

apps/gitea/docker-compose.yml

@@ -5,10 +5,10 @@ services:
     image: gitea/gitea:latest # change to 1-rootless once find out how to move data. 
     restart: always
     environment:
-      - USER_UID=1000
+      - USER_UID=${GITEA_USER_UID}
-      - USER_GID=1000
+      - USER_GID=${GITEA_USER_GID}
-      - GITEA__database__DB_TYPE=sqlite3
+      - GITEA__database__DB_TYPE=${GITEA_DB_TYPE}
-      - GITEA__server__ROOT_URL=https://gitea.lan.ddnsgeek.com/
+      - GITEA__server__ROOT_URL=${GITEA_ROOT_URL}
     volumes:
       - ${PROJECT_ROOT}/apps/gitea/data:/data
     networks:

apps/gramps/docker-compose.yml

@@ -5,9 +5,9 @@ services:
     container_name: gramps-db
     restart: always
     environment:
-      POSTGRES_USER: gramps
+      POSTGRES_USER: ${GRAMPS_POSTGRES_USER}
-      POSTGRES_PASSWORD: grampspassword
+      POSTGRES_PASSWORD: ${GRAMPS_POSTGRES_PASSWORD}
-      POSTGRES_DB: gramps
+      POSTGRES_DB: ${GRAMPS_POSTGRES_DB}
     volumes:
       - ${PROJECT_ROOT}/apps/gramps/db:/var/lib/postgresql
     networks:
@@ -30,14 +30,14 @@ services:
 #    ports:
 #      - "5000:5000"          # access via http://localhost:5000
     environment:
-      DB_URI: postgresql://gramps:grampspassword@db:5432/gramps
+      DB_URI: ${GRAMPS_DB_URI}
-      GRAMPSWEB_LOGLEVEL: INFO
+      GRAMPSWEB_LOGLEVEL: ${GRAMPSWEB_LOGLEVEL}
       # default admin user created on first run:
-      INITIAL_ADMIN: admin
+      INITIAL_ADMIN: ${GRAMPS_INITIAL_ADMIN}
-      INITIAL_ADMIN_PASSWORD: admin
+      INITIAL_ADMIN_PASSWORD: ${GRAMPS_INITIAL_ADMIN_PASSWORD}
       # optional: storage paths inside container
-      GRAMPSWEB_MEDIAPATH: /app/media
+      GRAMPSWEB_MEDIAPATH: ${GRAMPSWEB_MEDIAPATH}
-      GRAMPSWEB_TREE: "main"
+      GRAMPSWEB_TREE: "${GRAMPSWEB_TREE}"
     volumes:
       - ${PROJECT_ROOT}/apps/gramps/data/users:/app/users
       - ${PROJECT_ROOT}/apps/gramps/data/media:/app/media

apps/nextcloud/docker-compose.yml

@@ -16,26 +16,26 @@ services:
       - nextcloud-db
       - nextcloud-redis
     environment:
-      - MYSQL_PASSWORD=R1m@dmin
+      - MYSQL_PASSWORD=${NEXTCLOUD_MYSQL_PASSWORD}
-      - MYSQL_DATABASE=nextcloud
+      - MYSQL_DATABASE=${NEXTCLOUD_MYSQL_DATABASE}
-      - MYSQL_USER=nextcloud
+      - MYSQL_USER=${NEXTCLOUD_MYSQL_USER}
-      - MYSQL_HOST=nextcloud_db:3306
+      - MYSQL_HOST=${NEXTCLOUD_MYSQL_HOST}
-      - NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.lan.ddnsgeek.com
+      - NEXTCLOUD_TRUSTED_DOMAINS=${NEXTCLOUD_TRUSTED_DOMAINS}
-      - OVERWRITEPROTOCOL=https
+      - OVERWRITEPROTOCOL=${NEXTCLOUD_OVERWRITEPROTOCOL}
-      - OVERWRITECLIURL=https://nextcloud.lan.ddnsgeek.com
+      - OVERWRITECLIURL=${NEXTCLOUD_OVERWRITECLIURL}
 
-      - SMTP_HOST=smtp.gmail.com
+      - SMTP_HOST=${NEXTCLOUD_SMTP_HOST}
-      - SMTP_SECURE=tls
+      - SMTP_SECURE=${NEXTCLOUD_SMTP_SECURE}
-      - SMTP_PORT=587
+      - SMTP_PORT=${NEXTCLOUD_SMTP_PORT}
-      - SMTP_AUTHTYPE=login
+      - SMTP_AUTHTYPE=${NEXTCLOUD_SMTP_AUTHTYPE}
-      - MAIL_FROM_ADDRESS=beatz174
+      - MAIL_FROM_ADDRESS=${NEXTCLOUD_MAIL_FROM_ADDRESS}
-      - MAIL_DOMAIN=gmail.com
+      - MAIL_DOMAIN=${NEXTCLOUD_MAIL_DOMAIN}
-      - SMTP_NAME=beatz174@gmail.com
+      - SMTP_NAME=${NEXTCLOUD_SMTP_NAME}
-      - SMTP_PASSWORD=kqdw fvml wlag ldgv
+      - SMTP_PASSWORD=${NEXTCLOUD_SMTP_PASSWORD}
 
-      - REDIS_HOST=redis
+      - REDIS_HOST=${NEXTCLOUD_REDIS_HOST}
-      - REDIS_HOST_PORT=6379
+      - REDIS_HOST_PORT=${NEXTCLOUD_REDIS_HOST_PORT}
-      - REDIS_HOST_PASSWORD=TzBF8wcJNmVd9p2CTmBejPS9dpye6kWQeH3DmrQS9TPfTRriSHFN5VqH4CgzcuVZYWH2GBb7QU5GuEpNDGYdKjM6hjmLyjSgCFMiPms3Hv9n
+      - REDIS_HOST_PASSWORD=${NEXTCLOUD_REDIS_HOST_PASSWORD}
     networks:
       - traefik
       - nextcloud
@@ -81,19 +81,19 @@ services:
     volumes:
       - ${PROJECT_ROOT}/apps/nextcloud/database:/var/lib/mysql:rw
     environment:
-      - MYSQL_ROOT_PASSWORD=R1m@dmin
+      - MYSQL_ROOT_PASSWORD=${NEXTCLOUD_MYSQL_ROOT_PASSWORD}
-      - MYSQL_PASSWORD=R1m@dmin
+      - MYSQL_PASSWORD=${NEXTCLOUD_MYSQL_PASSWORD}
-      - MYSQL_DATABASE=nextcloud
+      - MYSQL_DATABASE=${NEXTCLOUD_MYSQL_DATABASE}
-      - MYSQL_USER=nextcloud
+      - MYSQL_USER=${NEXTCLOUD_MYSQL_USER}
-      - MARIADB_AUTO_UPGRADE=1
+      - MARIADB_AUTO_UPGRADE=${NEXTCLOUD_MARIADB_AUTO_UPGRADE}
-      - NEXTCLOUD_ADMIN_USER=admin
+      - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER}
-      - NEXTCLOUD_ADMIN_PASSWORD=R1m@dmin
+      - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD}
     networks:
       - nextcloud
     labels:
       - "io.portainer.accesscontrol.public"
     healthcheck:
-      test: ["CMD-SHELL", "mariadb-admin ping -u nextcloud --password=R1m@dmin --silent"]
+      test: ["CMD-SHELL", "mariadb-admin ping -u ${NEXTCLOUD_MYSQL_USER} --password=${NEXTCLOUD_MYSQL_PASSWORD} --silent"]
       interval: 10s
       timeout: 5s
       retries: 12
@@ -103,11 +103,11 @@ services:
   nextcloud-redis:
     image: "redis"
     profiles: ["apps","all","nextcloud"]
-    command: ["redis-server", "--requirepass", "TzBF8wcJNmVd9p2CTmBejPS9dpye6kWQeH3DmrQS9TPfTRriSHFN5VqH4CgzcuVZYWH2GBb7QU5GuEpNDGYdKjM6hjmLyjSgCFMiPms3Hv9n", "--appendonly", "yes", "--save", "60", "1000"]
+    command: ["redis-server", "--requirepass", "${NEXTCLOUD_REDIS_HOST_PASSWORD}", "--appendonly", "yes", "--save", "60", "1000"]
     hostname: redis
     container_name: nextcloud-redis
     environment:
-      - REDIS_HOST_PASSWORD=TzBF8wcJNmVd9p2CTmBejPS9dpye6kWQeH3DmrQS9TPfTRriSHFN5VqH4CgzcuVZYWH2GBb7QU5GuEpNDGYdKjM6hjmLyjSgCFMiPms3Hv9n
+      - REDIS_HOST_PASSWORD=${NEXTCLOUD_REDIS_HOST_PASSWORD}
     volumes:
       - ${PROJECT_ROOT}/apps/nextcloud/data/redis:/data:rw
     restart: always
@@ -116,7 +116,7 @@ services:
     labels:
       - "io.portainer.accesscontrol.public"
     healthcheck:
-      test: ["CMD-SHELL", "redis-cli -a TzBF8wcJNmVd9p2CTmBejPS9dpye6kWQeH3DmrQS9TPfTRriSHFN5VqH4CgzcuVZYWH2GBb7QU5GuEpNDGYdKjM6hjmLyjSgCFMiPms3Hv9n PING | grep -q PONG"]
+      test: ["CMD-SHELL", "redis-cli -a ${NEXTCLOUD_REDIS_HOST_PASSWORD} PING | grep -q PONG"]
       interval: 10s
       timeout: 5s
       retries: 6

apps/passbolt/docker-compose.yml

@@ -5,10 +5,10 @@ services:
     image: mariadb:12
     restart: always
     environment:
-      MYSQL_RANDOM_ROOT_PASSWORD: "true"
+      MYSQL_RANDOM_ROOT_PASSWORD: "${PASSBOLT_MYSQL_RANDOM_ROOT_PASSWORD}"
-      MYSQL_DATABASE: "passbolt"
+      MYSQL_DATABASE: "${PASSBOLT_MYSQL_DATABASE}"
-      MYSQL_USER: "passbolt"
+      MYSQL_USER: "${PASSBOLT_MYSQL_USER}"
-      MYSQL_PASSWORD: "P4ssb0lt"
+      MYSQL_PASSWORD: "${PASSBOLT_MYSQL_PASSWORD}"
     volumes:
       - ${PROJECT_ROOT}/apps/passbolt/data/database:/var/lib/mysql
     networks:
@@ -32,12 +32,12 @@ services:
     depends_on:
       - passbolt-db
     environment:
-      APP_FULL_BASE_URL: https://passbolt.lan.ddnsgeek.com
+      APP_FULL_BASE_URL: ${PASSBOLT_APP_FULL_BASE_URL}
-      DATASOURCES_DEFAULT_HOST: "passbolt-db"
+      DATASOURCES_DEFAULT_HOST: "${PASSBOLT_DATASOURCES_DEFAULT_HOST}"
-      DATASOURCES_DEFAULT_USERNAME: "passbolt"
+      DATASOURCES_DEFAULT_USERNAME: "${PASSBOLT_DATASOURCES_DEFAULT_USERNAME}"
-      DATASOURCES_DEFAULT_PASSWORD: "P4ssb0lt"
+      DATASOURCES_DEFAULT_PASSWORD: "${PASSBOLT_DATASOURCES_DEFAULT_PASSWORD}"
-      DATASOURCES_DEFAULT_DATABASE: "passbolt"
+      DATASOURCES_DEFAULT_DATABASE: "${PASSBOLT_DATASOURCES_DEFAULT_DATABASE}"
-      PASSBOLT_GPG_SERVER_KEY_FINGERPRINT: "CBBB2B8F3E9FACA114537ACB8965B750F7363586"
+      PASSBOLT_GPG_SERVER_KEY_FINGERPRINT: "${PASSBOLT_GPG_SERVER_KEY_FINGERPRINT}"
     volumes:
       - ${PROJECT_ROOT}/apps/passbolt/data/gpg:/etc/passbolt/gpg
       - ${PROJECT_ROOT}/apps/passbolt/data/jwt:/etc/passbolt/jwt

core/docker-compose.yml

@@ -51,7 +51,7 @@ services:
     container_name: crowdsec
     restart: always
     environment:
-      - COLLECTIONS=crowdsecurity/traefik
+      - COLLECTIONS=${CROWDSEC_COLLECTIONS}
     volumes:
       - ${PROJECT_ROOT}/core/crowdsec/logs:/logs:ro
       - ${PROJECT_ROOT}/core/crowdsec/data:/var/lib/crowdsec/data
@@ -73,7 +73,7 @@ services:
     container_name: error-pages
     read_only: true
     environment:
-      TEMPLATE_NAME: app-down
+      TEMPLATE_NAME: ${ERROR_PAGES_TEMPLATE_NAME}
     networks:
 #      - reverse_proxy
       - traefik

default-environment.env

@@ -2,3 +2,84 @@ PROJECT_ROOT=/home/nixos/docker
 DOMAIN=lan.ddnsgeek.com
 TZ=Australia/Brisbane
 EMAIL=wayne.bennett@live.com
+
+# Core
+CROWDSEC_COLLECTIONS=crowdsecurity/traefik
+ERROR_PAGES_TEMPLATE_NAME=app-down
+
+# Gitea
+GITEA_USER_UID=1000
+GITEA_USER_GID=1000
+GITEA_DB_TYPE=sqlite3
+GITEA_ROOT_URL=https://gitea.lan.ddnsgeek.com/
+
+# Grafana
+GRAFANA_ROOT_URL=https://grafana.lan.ddnsgeek.com/
+
+# Nextcloud
+NEXTCLOUD_MYSQL_ROOT_PASSWORD=R1m@dmin
+NEXTCLOUD_MYSQL_PASSWORD=R1m@dmin
+NEXTCLOUD_MYSQL_DATABASE=nextcloud
+NEXTCLOUD_MYSQL_USER=nextcloud
+NEXTCLOUD_MYSQL_HOST=nextcloud_db:3306
+NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.lan.ddnsgeek.com
+NEXTCLOUD_OVERWRITEPROTOCOL=https
+NEXTCLOUD_OVERWRITECLIURL=https://nextcloud.lan.ddnsgeek.com
+NEXTCLOUD_SMTP_HOST=smtp.gmail.com
+NEXTCLOUD_SMTP_SECURE=tls
+NEXTCLOUD_SMTP_PORT=587
+NEXTCLOUD_SMTP_AUTHTYPE=login
+NEXTCLOUD_MAIL_FROM_ADDRESS=beatz174
+NEXTCLOUD_MAIL_DOMAIN=gmail.com
+NEXTCLOUD_SMTP_NAME=beatz174@gmail.com
+NEXTCLOUD_SMTP_PASSWORD=kqdw fvml wlag ldgv
+NEXTCLOUD_REDIS_HOST=redis
+NEXTCLOUD_REDIS_HOST_PORT=6379
+NEXTCLOUD_REDIS_HOST_PASSWORD=TzBF8wcJNmVd9p2CTmBejPS9dpye6kWQeH3DmrQS9TPfTRriSHFN5VqH4CgzcuVZYWH2GBb7QU5GuEpNDGYdKjM6hjmLyjSgCFMiPms3Hv9n
+NEXTCLOUD_MARIADB_AUTO_UPGRADE=1
+NEXTCLOUD_ADMIN_USER=admin
+NEXTCLOUD_ADMIN_PASSWORD=R1m@dmin
+
+# Passbolt
+PASSBOLT_MYSQL_RANDOM_ROOT_PASSWORD=true
+PASSBOLT_MYSQL_DATABASE=passbolt
+PASSBOLT_MYSQL_USER=passbolt
+PASSBOLT_MYSQL_PASSWORD=P4ssb0lt
+PASSBOLT_APP_FULL_BASE_URL=https://passbolt.lan.ddnsgeek.com
+PASSBOLT_DATASOURCES_DEFAULT_HOST=passbolt-db
+PASSBOLT_DATASOURCES_DEFAULT_USERNAME=passbolt
+PASSBOLT_DATASOURCES_DEFAULT_PASSWORD=P4ssb0lt
+PASSBOLT_DATASOURCES_DEFAULT_DATABASE=passbolt
+PASSBOLT_GPG_SERVER_KEY_FINGERPRINT=CBBB2B8F3E9FACA114537ACB8965B750F7363586
+
+# Gramps
+GRAMPS_POSTGRES_USER=gramps
+GRAMPS_POSTGRES_PASSWORD=grampspassword
+GRAMPS_POSTGRES_DB=gramps
+GRAMPS_DB_URI=postgresql://gramps:grampspassword@db:5432/gramps
+GRAMPSWEB_LOGLEVEL=INFO
+GRAMPS_INITIAL_ADMIN=admin
+GRAMPS_INITIAL_ADMIN_PASSWORD=admin
+GRAMPSWEB_MEDIAPATH=/app/media
+GRAMPSWEB_TREE=main
+
+# Prometheus stack
+INFLUXDB_INIT_MODE=setup
+INFLUXDB_INIT_USERNAME=admin
+INFLUXDB_INIT_PASSWORD=adminpassword
+INFLUXDB_INIT_ORG=pbs
+INFLUXDB_INIT_BUCKET=telemetry
+DOCKER_EXPORTER_LOG_LEVEL=INFO
+PIHOLE_HOSTNAME=pihole.sweet.home
+PIHOLE_PASSWORD=
+PIHOLE_EXPORTER_PORT=9617
+
+# Gotify
+GOTIFY_DEFAULTUSER_NAME=admin
+GOTIFY_DEFAULTUSER_PASS=R1m@dmin
+GOTIFY_REGISTRATION=false
+GOTIFY_URL=https://gotify.lan.ddnsgeek.com
+GOTIFY_TOKEN=ADuOnDBG7C27hcf
+
+# Portainer
+PORTAINER_GODEBUG=netdns=cgo

monitoring/gotify/docker-compose.yml

@@ -10,9 +10,9 @@ services:
 
     environment:
       - TZ=${TZ}
-      - GOTIFY_DEFAULTUSER_NAME=admin
+      - GOTIFY_DEFAULTUSER_NAME=${GOTIFY_DEFAULTUSER_NAME}
-      - GOTIFY_DEFAULTUSER_PASS=R1m@dmin
+      - GOTIFY_DEFAULTUSER_PASS=${GOTIFY_DEFAULTUSER_PASS}
-      - GOTIFY_REGISTRATION=false
+      - GOTIFY_REGISTRATION=${GOTIFY_REGISTRATION}
 
     networks:
 #      - traefik_reverse_proxy

monitoring/gotify/docker-health-to-gotify.sh

@@ -4,8 +4,8 @@ set -euo pipefail
 #: "${GOTIFY_URL:?Set GOTIFY_URL (e.g. https://gotify.lan.ddnsgeek.com)}"
 #: "${GOTIFY_TOKEN:?Set GOTIFY_TOKEN (AAM..CtNmUGoNIV)}"
 
-GOTIFY_URL="https://gotify.lan.ddnsgeek.com"
+GOTIFY_URL="${GOTIFY_URL}"
-GOTIFY_TOKEN="ADuOnDBG7C27hcf"
+GOTIFY_TOKEN="${GOTIFY_TOKEN}"
 
 STATE_DIR="./docker-health-alert"
 STATE_FILE="${STATE_DIR}/last_unhealthy.txt"

monitoring/grafana/docker-compose.yml

@@ -5,7 +5,7 @@ services:
     container_name: grafana
     restart: unless-stopped
     environment:
-      - GF_SERVER_ROOT_URL=https://grafana.lan.ddnsgeek.com/
+      - GF_SERVER_ROOT_URL=${GRAFANA_ROOT_URL}
     volumes:
       - ${PROJECT_ROOT}/monitoring/grafana/data:/var/lib/grafana
     networks:

monitoring/portainer/docker-compose.yml

@@ -24,7 +24,7 @@ services:
       - traefik.http.services.portainer.loadbalancer.server.port=9000
 
     environment:
-      - GODEBUG=netdns=cgo
+      - GODEBUG=${PORTAINER_GODEBUG}
 #    healthcheck:
 #      test: ["CMD", "wget", "--spider", "-q", "https://portainer.lan.ddnsgeek.com/api/status"]
 #      interval: 30s

monitoring/prometheus/docker-compose.yml

@@ -104,11 +104,11 @@ services:
     volumes:
       - ${PROJECT_ROOT}/monitoring/influxdb:/var/lib/influxdb2
     environment:
-      DOCKER_INFLUXDB_INIT_MODE: setup
+      DOCKER_INFLUXDB_INIT_MODE: ${INFLUXDB_INIT_MODE}
-      DOCKER_INFLUXDB_INIT_USERNAME: admin
+      DOCKER_INFLUXDB_INIT_USERNAME: ${INFLUXDB_INIT_USERNAME}
-      DOCKER_INFLUXDB_INIT_PASSWORD: adminpassword
+      DOCKER_INFLUXDB_INIT_PASSWORD: ${INFLUXDB_INIT_PASSWORD}
-      DOCKER_INFLUXDB_INIT_ORG: pbs
+      DOCKER_INFLUXDB_INIT_ORG: ${INFLUXDB_INIT_ORG}
-      DOCKER_INFLUXDB_INIT_BUCKET: telemetry
+      DOCKER_INFLUXDB_INIT_BUCKET: ${INFLUXDB_INIT_BUCKET}
     networks:
 #      - edge
 #      - traefik_reverse_proxy
@@ -162,7 +162,7 @@ services:
 #      - ${PROJECT_ROOT}/monitoring/docker-exporter/data:/data:rw
 #      - ${PROJECT_ROOT}/services-up.sh:/app/services-up.sh:ro
     environment:
-      LOG_LEVEL: INFO
+      LOG_LEVEL: ${DOCKER_EXPORTER_LOG_LEVEL}
 
     volumes:
       - ~/.docker/config.json:/root/.docker/config.json:ro
@@ -206,9 +206,9 @@ services:
     image: ekofr/pihole-exporter:latest
     container_name: pihole-exporter
     environment:
-      PIHOLE_HOSTNAME: pihole.sweet.home
+      PIHOLE_HOSTNAME: ${PIHOLE_HOSTNAME}
-      PIHOLE_PASSWORD: ""
+      PIHOLE_PASSWORD: "${PIHOLE_PASSWORD}"
-      PORT: 9617
+      PORT: ${PIHOLE_EXPORTER_PORT}
     ports:
       - "9617:9617"
     restart: unless-stopped