From 6f18aa9c067fbc61f7d5c33cbd17040f895f902f Mon Sep 17 00:00:00 2001 From: lingkai5wu Date: Sun, 16 Aug 2026 11:58:58 +0800 Subject: [PATCH] feat: add nginx reverse proxy stack Add Nginx and acme.sh for centralized HTTPS termination and certificate management. Move Gitea, Immich, and OpenList to the shared proxy network and remove their direct host port exposure. --- gitea/compose.yaml | 8 +++++--- immich/compose.yaml | 10 ++++++--- nginx/compose.yaml | 47 +++++++++++++++++++++++++++++++++++++++++++ nginx/example.env | 2 ++ openlist/compose.yaml | 7 +++++-- 5 files changed, 66 insertions(+), 8 deletions(-) create mode 100644 nginx/compose.yaml create mode 100644 nginx/example.env diff --git a/gitea/compose.yaml b/gitea/compose.yaml index b329b57..15cf5ab 100644 --- a/gitea/compose.yaml +++ b/gitea/compose.yaml @@ -10,12 +10,14 @@ services: environment: - USER_UID=1000 - USER_GID=1000 - ports: - - '0.0.0.0:3000:3000' - # - 222:22 + networks: + - proxy restart: unless-stopped deploy: resources: limits: cpus: "1.0" memory: 512M +networks: + proxy: + external: true diff --git a/immich/compose.yaml b/immich/compose.yaml index 376abea..9d93c9e 100644 --- a/immich/compose.yaml +++ b/immich/compose.yaml @@ -17,8 +17,9 @@ services: create_host_path: false env_file: - .env - ports: - - '0.0.0.0:2283:2283' + networks: + - default + - proxy restart: unless-stopped healthcheck: disable: false @@ -58,7 +59,7 @@ services: POSTGRES_DB: ${DB_DATABASE_NAME} POSTGRES_INITDB_ARGS: --data-checksums ports: - - '127.0.0.1:5432:5432' + - "127.0.0.1:5432:5432" restart: unless-stopped healthcheck: disable: false @@ -85,3 +86,6 @@ services: reservations: cpus: "0.1" memory: 64M +networks: + proxy: + external: true diff --git a/nginx/compose.yaml b/nginx/compose.yaml new file mode 100644 index 0000000..815c31f --- /dev/null +++ b/nginx/compose.yaml @@ -0,0 +1,47 @@ +name: nginx +services: + nginx: + image: nginx:1-alpine + container_name: nginx + volumes: + - /srv/data/nginx/conf.d:/etc/nginx/conf.d:ro + - /srv/data/nginx/snippets:/etc/nginx/snippets:ro + - /srv/data/nginx/certs:/etc/nginx/certs:ro + ports: + - "192.168.10.101:80:80" + - "192.168.10.101:443:443" + - "[::]:50443:443" + networks: + - proxy + restart: unless-stopped + deploy: + resources: + limits: + cpus: "0.5" + memory: 256M + reservations: + cpus: "0.05" + memory: 16M + acme-sh: + image: neilpang/acme.sh:3.1.4 + container_name: acme.sh + volumes: + - /srv/data/nginx/acme-sh:/acme.sh + - /srv/data/nginx/certs:/certs + - /var/run/docker.sock:/var/run/docker.sock + environment: + CF_Token: ${CF_TOKEN} + CF_Zone_ID: ${CF_ZONE_ID} + command: daemon + restart: unless-stopped + deploy: + resources: + limits: + cpus: "0.2" + memory: 64M + reservations: + cpus: "0.05" + memory: 16M +networks: + proxy: + external: true diff --git a/nginx/example.env b/nginx/example.env new file mode 100644 index 0000000..a49ad8a --- /dev/null +++ b/nginx/example.env @@ -0,0 +1,2 @@ +CF_TOKEN= +CF_ZONE_ID= diff --git a/openlist/compose.yaml b/openlist/compose.yaml index d333491..16e4c93 100644 --- a/openlist/compose.yaml +++ b/openlist/compose.yaml @@ -8,8 +8,8 @@ services: - /mnt/toshiba:/mnt/toshiba environment: - UMASK=022 - ports: - - '0.0.0.0:5244:5244' + networks: + - proxy restart: unless-stopped user: 0:0 deploy: @@ -20,3 +20,6 @@ services: reservations: cpus: "0.2" memory: 64M +networks: + proxy: + external: true