feat(komodo): move komodo + gitea off dockerman/compose-manager into repo

komodo: mongo:9.0 + core/periphery :2 + mcp, .env from compose-manager project (no legacy passkeys), komodo.skip labels + init + v2 keys mounts kept. Gitea: gitea:28.0.0 + act_runner:0.6.1, restart=unless-stopped (dockerman had restart=no with Unraid autostart). Both get pangolin proxy-resources blueprint labels (internet via pangolin primary + newt -> host port) next to their traefik routes. Renovate-bumpable now.
2026-10-05 08:23:14 +02:00
1 parent 67574a80c7
commit 1b8d5e5f15
@@ -0,0 +1,71 @@
+# Gitea (web + act runner) — moved off Unraid dockerman into the repo.
+# Exposed via atlas-traefik (LAN) AND pangolin primary (internet) via the
+# pangolin docker-label blueprint. Renovate bumps the pinned tags.
+# Note: dockerman had restart=no (autostart handled by Unraid); here it is
+# unless-stopped so docker/compose restarts it after host boot.
+services:
+  gitea:
+    image: gitea/gitea:28.0.0
+    container_name: "Gitea"
+    restart: unless-stopped
+    ipc: private
+    mac_address: "7e:d9:f5:36:de:80"
+    network_mode: bridge
+    ports:
+      - "2233:22/tcp"
+      - "3322:3000/tcp"
+    environment:
+      - "TZ=Europe/Berlin"
+      - "DELIVER_TIMEOUT=60"
+      - "USER=git"
+      - "GITEA_CUSTOM=/data/gitea"
+    volumes:
+      - "/mnt/user/appdata/gitea:/data"
+    logging:
+      driver: "json-file"
+      options:
+        max-file: "1"
+        max-size: "50m"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.gitea.rule=Host(`gitea.arnoutvw.nl`)
+      - traefik.http.services.gitea.loadbalancer.server.port=3000
+      - pangolin.proxy-resources.gitea.name=Gitea
+      - pangolin.proxy-resources.gitea.full-domain=gitea.arnoutvw.nl
+      - pangolin.proxy-resources.gitea.protocol=http
+      - pangolin.proxy-resources.gitea.ssl=true
+      - pangolin.proxy-resources.gitea.targets[0].method=http
+      - pangolin.proxy-resources.gitea.targets[0].hostname=192.168.10.144
+      - pangolin.proxy-resources.gitea.targets[0].port=3322
+      - pangolin.proxy-resources.gitea.targets[0].healthcheck.hostname=192.168.10.144
+      - pangolin.proxy-resources.gitea.targets[0].healthcheck.port=3322
+      - pangolin.proxy-resources.gitea.targets[0].healthcheck.enabled=true
+      - pangolin.proxy-resources.gitea.auth.sso-enabled=false
+      - pangolin.proxy-resources.gitea.rules[0].match=region
+      - pangolin.proxy-resources.gitea.rules[0].action=allow
+      - pangolin.proxy-resources.gitea.rules[0].value=EU
+      - pangolin.proxy-resources.gitea.rules[1].match=ip
+      - pangolin.proxy-resources.gitea.rules[1].action=allow
+      - pangolin.proxy-resources.gitea.rules[1].value=172.21.0.1
+      - pangolin.proxy-resources.gitea.rules[2].match=ip
+      - pangolin.proxy-resources.gitea.rules[2].action=allow
+      - pangolin.proxy-resources.gitea.rules[2].value=212.227.105.183
+      - pangolin.proxy-resources.gitea.rules[3].match=country
+      - pangolin.proxy-resources.gitea.rules[3].action=deny
+      - pangolin.proxy-resources.gitea.rules[3].value=ALL
+
+  gitea-runner:
+    image: gitea/act_runner:0.6.1
+    container_name: "Gitea-Runner"
+    restart: unless-stopped
+    ipc: private
+    network_mode: bridge
+    entrypoint: [ "/sbin/tini", "--", "run.sh" ]
+    environment:
+      # Registration token for the runner (rotate via gitea admin if leaked).
+      - "GITEA_RUNNER_REGISTRATION_TOKEN=5tPWewhkKr58gQt0UsSvOvh3E4RPFWV1CIXO7imj"
+      - "GITEA_INSTANCE_URL=https://gitea.arnoutvw.nl"
+      - "TZ=Europe/Berlin"
+    volumes:
+      - "/mnt/user/appdata/gitea-runner:/data"
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
@@ -0,0 +1,141 @@
+####################################
+# 🦎 KOMODO COMPOSE - VARIABLES 🦎 #
+####################################
+
+## These compose variables can be used with all Komodo deployment options.
+## Pass these variables to the compose up command using `--env-file komodo/compose.env`.
+## Additionally, they are passed to both Komodo Core and Komodo Periphery with `env_file: ./compose.env`,
+## so you can pass any additional environment variables to Core / Periphery directly in this file as well.
+
+## Stick to a specific version, or use `latest`
+COMPOSE_KOMODO_IMAGE_TAG=2
+
+## DB credentials
+KOMODO_DB_USERNAME=admin
+KOMODO_DB_PASSWORD=admin
+
+## Configure a secure passkey to authenticate between Core / Periphery.
+
+## Set your time zone for schedules
+## https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+TZ=Etc/UTC
+
+#=-------------------------=#
+#= Komodo Core Environment =#
+#=-------------------------=#
+
+## Full variable list + descriptions are available here:
+## 🦎 https://github.com/moghtech/komodo/blob/main/config/core.config.toml 🦎
+
+## Note. Secret variables also support `${VARIABLE}_FILE` syntax to pass docker compose secrets.
+## Docs: https://docs.docker.com/compose/how-tos/use-secrets/#examples
+
+## Used for Oauth / Webhook url suggestion / Caddy reverse proxy.
+KOMODO_HOST=https://komodo.arnoutvw.nl
+## Displayed in the browser tab.
+KOMODO_TITLE=Komodo
+## Create a server matching this address as the "first server".
+## Use `https://host.docker.internal:8120` when using systemd-managed Periphery.
+KOMODO_FIRST_SERVER=https://192.168.10.144:8120
+## Make all buttons just double-click, rather than the full confirmation dialog.
+KOMODO_DISABLE_CONFIRM_DIALOG=false
+
+## Rate Komodo polls your servers for
+## status / container status / system stats / alerting.
+## Options: 1-sec, 5-sec, 15-sec, 1-min, 5-min, 15-min
+## Default: 15-sec
+KOMODO_MONITORING_INTERVAL="15-sec"
+## Interval at which to poll Resources for any updates / automated actions.
+## Options: 15-min, 1-hr, 2-hr, 6-hr, 12-hr, 1-day
+## Default: 1-hr
+KOMODO_RESOURCE_POLL_INTERVAL="1-hr"
+
+## Used to auth incoming webhooks. Alt: KOMODO_WEBHOOK_SECRET_FILE
+KOMODO_WEBHOOK_SECRET=a_random_secret
+## Used to generate jwt. Alt: KOMODO_JWT_SECRET_FILE
+KOMODO_JWT_SECRET=a_random_jwt_secret
+## Time to live for jwt tokens.
+## Options: 1-hr, 12-hr, 1-day, 3-day, 1-wk, 2-wk
+KOMODO_JWT_TTL="1-day"
+
+## Enable login with username + password.
+KOMODO_LOCAL_AUTH=true
+## Disable new user signups.
+KOMODO_DISABLE_USER_REGISTRATION=false
+## All new logins are auto enabled
+KOMODO_ENABLE_NEW_USERS=false
+## Disable non-admins from creating new resources.
+KOMODO_DISABLE_NON_ADMIN_CREATE=false
+## Allows all users to have Read level access to all resources.
+KOMODO_TRANSPARENT_MODE=false
+
+## Prettier logging with empty lines between logs
+KOMODO_LOGGING_PRETTY=false
+## More human readable logging of startup config (multi-line)
+KOMODO_PRETTY_STARTUP_CONFIG=false
+
+## OIDC Login
+KOMODO_OIDC_ENABLED=true
+## Must reachable from Komodo Core container
+KOMODO_OIDC_PROVIDER=https://pass.arnoutvw.nl
+## Change the host to one reachable be reachable by users (optional if it is the same as above).
+## DO NOT include the `path` part of the URL.
+#KOMODO_OIDC_REDIRECT_HOST=https://oidc.provider.external
+## Your OIDC client id
+KOMODO_OIDC_CLIENT_ID=0a4e7af5-73de-41b3-806f-c6fa6da55929
+## Your OIDC client secret.
+## If your provider supports PKCE flow, this can be ommitted.
+KOMODO_OIDC_CLIENT_SECRET=FNQBmSybrizJmNCsUs4Mxh0BRRZVMhOF
+## Make usernames the full email.
+## Note. This does not work for all OIDC providers.
+# KOMODO_OIDC_USE_FULL_EMAIL=true
+## Add additional trusted audiences for token claims verification.
+## Supports comma separated list, and passing with _FILE (for compose secrets).
+# KOMODO_OIDC_ADDITIONAL_AUDIENCES=abc,123 # Alt: KOMODO_OIDC_ADDITIONAL_AUDIENCES_FILE
+
+## Github Oauth
+KOMODO_GITHUB_OAUTH_ENABLED=false
+# KOMODO_GITHUB_OAUTH_ID= # Alt: KOMODO_GITHUB_OAUTH_ID_FILE
+# KOMODO_GITHUB_OAUTH_SECRET= # Alt: KOMODO_GITHUB_OAUTH_SECRET_FILE
+
+## Google Oauth
+KOMODO_GOOGLE_OAUTH_ENABLED=false
+# KOMODO_GOOGLE_OAUTH_ID= # Alt: KOMODO_GOOGLE_OAUTH_ID_FILE
+# KOMODO_GOOGLE_OAUTH_SECRET= # Alt: KOMODO_GOOGLE_OAUTH_SECRET_FILE
+
+## Aws - Used to launch Builder instances.
+KOMODO_AWS_ACCESS_KEY_ID= # Alt: KOMODO_AWS_ACCESS_KEY_ID_FILE
+KOMODO_AWS_SECRET_ACCESS_KEY= # Alt: KOMODO_AWS_SECRET_ACCESS_KEY_FILE
+
+#=------------------------------=#
+#= Komodo Periphery Environment =#
+#=------------------------------=#
+
+## Full variable list + descriptions are available here:
+## 🦎 https://github.com/moghtech/komodo/blob/main/config/periphery.config.toml 🦎
+
+## Specify the root directory used by Periphery agent.
+PERIPHERY_ROOT_DIRECTORY=/etc/komodo
+
+## Periphery passkeys must include KOMODO_PASSKEY to authenticate.
+
+## Specify whether to disable the terminals feature
+## and disallow remote shell access (inside the Periphery container).
+PERIPHERY_DISABLE_TERMINALS=false
+
+## Enable SSL using self signed certificates.
+## Connect to Periphery at https://address:8120.
+PERIPHERY_SSL_ENABLED=true
+
+## If the disk size is overreporting, can use one of these to 
+## whitelist / blacklist the disks to filter them, whichever is easier.
+## Accepts comma separated list of paths.
+## Usually whitelisting just /etc/hostname gives correct size.
+PERIPHERY_INCLUDE_DISK_MOUNTS=/etc/hostname
+# PERIPHERY_EXCLUDE_DISK_MOUNTS=/snap,/etc/repos
+
+## Prettier logging with empty lines between logs
+PERIPHERY_LOGGING_PRETTY=false
+## More human readable logging of startup config (multi-line)
+PERIPHERY_PRETTY_STARTUP_CONFIG=false
+PERIPHERY_CORE_PUBLIC_KEYS=MCowBQYDK2VuAyEAoidjxlTRIeVAy0TMF517ZXxAfPgW7IndrOBsQfmKH3M=
@@ -0,0 +1,121 @@
+# Komodo (mongo, core, periphery for Atlas, MCP proxy) — moved off Unraid
+# compose-manager into the repo so Renovate tracks it.
+# komodo.skip labels prevent Komodo StopAllContainers from taking itself
+# down; deploys DO recreate core (brief UI outage is expected and harmless).
+# Exposed via atlas-traefik (LAN) + pangolin primary (internet) blueprint
+# labels. .env lives next to this file (env_file for core/periphery).
+name: komodo
+
+services:
+  mongo:
+    image: mongo:9.0
+    container_name: komodo-mongo
+    command: --quiet --wiredTigerCacheSizeGB 0.25
+    restart: unless-stopped
+    network_mode: bridge
+    logging:
+      driver: ${COMPOSE_LOGGING_DRIVER:-local}
+    volumes:
+      - /mnt/user/appdata/komodo/mongo/db:/data/db
+      - /mnt/user/appdata/komodo/mongo/config:/data/configdb
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: ${KOMODO_DB_USERNAME}
+      MONGO_INITDB_ROOT_PASSWORD: ${KOMODO_DB_PASSWORD}
+    labels:
+      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
+
+  core:
+    image: ghcr.io/moghtech/komodo-core:${COMPOSE_KOMODO_IMAGE_TAG:-2}
+    container_name: komodo-core
+    restart: unless-stopped
+    init: true
+    network_mode: bridge
+    depends_on:
+      - mongo
+    logging:
+      driver: ${COMPOSE_LOGGING_DRIVER:-local}
+    ports:
+      - 9120:9120
+    env_file: ./.env
+    environment:
+      KOMODO_DATABASE_ADDRESS: mongo:27017
+      KOMODO_DATABASE_USERNAME: ${KOMODO_DB_USERNAME}
+      KOMODO_DATABASE_PASSWORD: ${KOMODO_DB_PASSWORD}
+    volumes:
+      ## Core cache for repos for latest commit hash / contents
+      - /mnt/user/appdata/komodo/core/repos:/repo-cache
+      ## v2 PKI keys
+      - /mnt/user/appdata/komodo/core/keys:/config/keys
+    labels:
+      - komodo.skip=true # Prevent Komodo from stopping with StopAllContainers
+      - traefik.enable=true
+      - traefik.http.routers.komodo.rule=Host(`komodo.arnoutvw.nl`)
+      - traefik.http.services.komodo.loadbalancer.server.port=9120
+      - pangolin.proxy-resources.komodo.name=Komodo
+      - pangolin.proxy-resources.komodo.full-domain=komodo.arnoutvw.nl
+      - pangolin.proxy-resources.komodo.protocol=http
+      - pangolin.proxy-resources.komodo.ssl=true
+      - pangolin.proxy-resources.komodo.targets[0].method=http
+      - pangolin.proxy-resources.komodo.targets[0].hostname=192.168.10.144
+      - pangolin.proxy-resources.komodo.targets[0].port=9120
+      - pangolin.proxy-resources.komodo.targets[0].healthcheck.hostname=192.168.10.144
+      - pangolin.proxy-resources.komodo.targets[0].healthcheck.port=9120
+      - pangolin.proxy-resources.komodo.targets[0].healthcheck.enabled=true
+      - pangolin.proxy-resources.komodo.auth.sso-enabled=false
+      - pangolin.proxy-resources.komodo.rules[0].match=region
+      - pangolin.proxy-resources.komodo.rules[0].action=allow
+      - pangolin.proxy-resources.komodo.rules[0].value=EU
+      - pangolin.proxy-resources.komodo.rules[1].match=ip
+      - pangolin.proxy-resources.komodo.rules[1].action=allow
+      - pangolin.proxy-resources.komodo.rules[1].value=172.21.0.1
+      - pangolin.proxy-resources.komodo.rules[2].match=ip
+      - pangolin.proxy-resources.komodo.rules[2].action=allow
+      - pangolin.proxy-resources.komodo.rules[2].value=212.227.105.183
+      - pangolin.proxy-resources.komodo.rules[3].match=country
+      - pangolin.proxy-resources.komodo.rules[3].action=deny
+      - pangolin.proxy-resources.komodo.rules[3].value=ALL
+
+  periphery:
+    image: ghcr.io/moghtech/komodo-periphery:${COMPOSE_KOMODO_IMAGE_TAG:-2}
+    container_name: komodo-periphery
+    restart: unless-stopped
+    init: true
+    network_mode: bridge
+    logging:
+      driver: ${COMPOSE_LOGGING_DRIVER:-local}
+    env_file: ./.env
+    environment:
+      PERIPHERY_REPO_DIR: ${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}/repos
+      PERIPHERY_STACK_DIR: ${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}/stacks
+      PERIPHERY_SSL_KEY_FILE: ${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}/ssl/key.pem
+      PERIPHERY_SSL_CERT_FILE: ${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}/ssl/cert.pem
+    volumes:
+      ## Mount external docker socket
+      - /var/run/docker.sock:/var/run/docker.sock
+      ## Allow Periphery to see processes outside of container
+      - /proc:/proc
+      ## Specify the Periphery agent root directory - must be the same inside and outside the container.
+      - ${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}:${PERIPHERY_ROOT_DIRECTORY:-/etc/komodo}
+      ## Custom location for docker compose repo
+      - /mnt/user/compose:/mnt/user/compose
+      ## v2 PKI private keys (persist)
+      - /etc/komodo/keys:/config/keys
+    labels:
+      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
+
+  komodo-mcp:
+    image: ghcr.io/myrikld/komodo-mcp:latest
+    container_name: komodo-mcp
+    init: true
+    network_mode: bridge
+    ports:
+      - "8333:8000"
+    environment:
+      - KOMODO_MCP_KOMODO_URL=https://komodo.arnoutvw.nl
+      - KOMODO_MCP_KOMODO_API_KEY=K-Bui3dtbn4ZEcO4Hv4keHpFRo1p5FI4GEePwVLn6J
+      - KOMODO_MCP_KOMODO_API_SECRET=S-NWNKyfgZEd6XvnpLxIlH21PJtwdOrb9ebKg9L7K5
+    restart: unless-stopped
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.komodomcp.rule=Host(`komodo-mcp.arnoutvw.nl`)
+      - traefik.http.services.komodomcp.loadbalancer.server.port=8000