feat: add nginx reverse proxy stack

Add Nginx and acme.sh for centralized HTTPS termination and certificate management.

Move Gitea, Immich, and OpenList to the shared proxy network and remove their direct host port exposure.

gitea/compose.yaml

@@ -10,12 +10,14 @@ services:
     environment:
       - USER_UID=1000
       - USER_GID=1000
-    ports:
-      - '0.0.0.0:3000:3000'
-      # - 222:22
+    networks:
+      - proxy
     restart: unless-stopped
     deploy:
       resources:
         limits:
           cpus: "1.0"
           memory: 512M
+networks:
+  proxy:
+    external: true

immich/compose.yaml

@@ -17,8 +17,9 @@ services:
           create_host_path: false
     env_file:
       - .env
-    ports:
-      - '0.0.0.0:2283:2283'
+    networks:
+      - default
+      - proxy
     restart: unless-stopped
     healthcheck:
       disable: false
@@ -58,7 +59,7 @@ services:
       POSTGRES_DB: ${DB_DATABASE_NAME}
       POSTGRES_INITDB_ARGS: --data-checksums
     ports:
-      - '127.0.0.1:5432:5432'
+      - "127.0.0.1:5432:5432"
     restart: unless-stopped
     healthcheck:
       disable: false
@@ -85,3 +86,6 @@ services:
         reservations:
           cpus: "0.1"
           memory: 64M
+networks:
+  proxy:
+    external: true

nginx/compose.yaml

@@ -0,0 +1,47 @@
+name: nginx
+services:
+  nginx:
+    image: nginx:1-alpine
+    container_name: nginx
+    volumes:
+      - /srv/data/nginx/conf.d:/etc/nginx/conf.d:ro
+      - /srv/data/nginx/snippets:/etc/nginx/snippets:ro
+      - /srv/data/nginx/certs:/etc/nginx/certs:ro
+    ports:
+      - "192.168.10.101:80:80"
+      - "192.168.10.101:443:443"
+      - "[::]:50443:443"
+    networks:
+      - proxy
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 256M
+        reservations:
+          cpus: "0.05"
+          memory: 16M
+  acme-sh:
+    image: neilpang/acme.sh:3.1.4
+    container_name: acme.sh
+    volumes:
+      - /srv/data/nginx/acme-sh:/acme.sh
+      - /srv/data/nginx/certs:/certs
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      CF_Token: ${CF_TOKEN}
+      CF_Zone_ID: ${CF_ZONE_ID}
+    command: daemon
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "0.2"
+          memory: 64M
+        reservations:
+          cpus: "0.05"
+          memory: 16M
+networks:
+  proxy:
+    external: true

nginx/example.env

@@ -0,0 +1,2 @@
+CF_TOKEN=<CLOUDFLARE_API_TOKEN>
+CF_ZONE_ID=<LINKWU_DE_ZONE_ID>

openlist/compose.yaml

@@ -8,8 +8,8 @@ services:
       - /mnt/toshiba:/mnt/toshiba
     environment:
       - UMASK=022
-    ports:
-      - '0.0.0.0:5244:5244'
+    networks:
+      - proxy
     restart: unless-stopped
     user: 0:0
     deploy:
@@ -20,3 +20,6 @@ services:
         reservations:
           cpus: "0.2"
           memory: 64M
+networks:
+  proxy:
+    external: true