new services

.gitea/workflows/test.yml

@@ -11,58 +11,50 @@ on:
 jobs:
   healthcheck:
     runs-on: ubuntu-latest
-    name: Code, dbt & Live App Health Check
+    name: Compose Templates Health Check
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
 
       - name: Install System Dependencies
         run: |
-          apt-get update && apt-get install -y curl unzip git ca-certificates
+          apt-get update && apt-get install -y python3 python3-yaml git ca-certificates
 
-      - name: Install uv
+      - name: Validate Compose Templates & Workflows
         run: |
-          curl -LsSf https://astral.sh/uv/install.sh | sh
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-          echo "/root/.local/bin" >> $GITHUB_PATH
-
-      - name: Install Project Dependencies
-        run: |
-          export PATH="$HOME/.local/bin:/root/.local/bin:$PATH"
-          uv sync
-
-      - name: Python Syntax & Compilation Verification
-        run: |
-          export PATH="$HOME/.local/bin:/root/.local/bin:$PATH"
-          echo "==> Validating Python scripts compilation..."
-          uv run python -m py_compile streamlit_app/app.py scripts/db_storage.py
-          echo "✓ Python scripts compiled without errors"
-
-      - name: dbt Manifest & Model Validation
-        run: |
-          export PATH="$HOME/.local/bin:/root/.local/bin:$PATH"
-          echo "==> Validating dbt package dependencies..."
-          uv run dbt deps --project-dir dbt_nba --profiles-dir dbt_nba
-          echo "==> Validating dbt models, seeds, and tests compilation..."
-          uv run dbt parse --project-dir dbt_nba --profiles-dir dbt_nba
-          echo "✓ All dbt models, seeds, and macros validated"
-
-      - name: Cloudflare R2 Storage Probe (Optional if secrets present)
-        env:
-          S3_ENDPOINT_URL: ${{ secrets.S3_ENDPOINT_URL }}
-          S3_BUCKET_NAME: ${{ secrets.S3_BUCKET_NAME }}
-          S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
-          S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
-          S3_REGION: ${{ secrets.S3_REGION || 'auto' }}
-          S3_DB_KEY: ${{ secrets.S3_DB_KEY || 'dbt_nba.duckdb' }}
-        run: |
-          export PATH="$HOME/.local/bin:/root/.local/bin:$PATH"
-          if [ -n "${S3_ENDPOINT_URL:-}" ]; then
-            echo "==> Probing Cloudflare R2 storage status..."
-            uv run python scripts/db_storage.py status
-          else
-            echo "==> S3 secrets not configured for this step; skipping storage probe."
-          fi
+          echo "==> Validating all docker-compose.yml files..."
+          python3 - <<'PY'
+          import pathlib, sys
+          try:
+              import yaml
+          except ImportError:
+              print("pyyaml missing"); sys.exit(1)
+          failures = []
+          files = sorted(pathlib.Path(".").glob("*/docker-compose.yml"))
+          assert files, "no */docker-compose.yml found"
+          for f in files:
+              try:
+                  doc = yaml.safe_load(f.read_text())
+              except Exception as e:
+                  failures.append(f"{f}: YAML parse error: {e}")
+                  continue
+              if not isinstance(doc, dict) or "services" not in doc:
+                  failures.append(f"{f}: missing top-level 'services' key")
+                  continue
+              for svc, cfg in doc["services"].items():
+                  if not isinstance(cfg, dict) or "image" not in cfg:
+                      failures.append(f"{f}: service '{svc}' missing 'image'")
+              print(f"OK {f} services={list(doc['services'].keys())}")
+          for f in sorted(pathlib.Path(".gitea/workflows").glob("*.y*ml")):
+              try:
+                  yaml.safe_load(f.read_text())
+                  print(f"OK {f}")
+              except Exception as e:
+                  failures.append(f"{f}: YAML parse error: {e}")
+          if failures:
+              print("FAILURES:"); [print(" -", x) for x in failures]; sys.exit(1)
+          print("All templates validated")
+          PY
 
       - name: Live Production App Health Probe
         run: |

cloudflare/.env.example

@@ -0,0 +1,14 @@
+# Copy to .env and fill in before `docker compose up -d`
+# Cloudflare API token with Zone:DNS:Edit + Zone:Zone:Read (favonia/cloudflare-ddns)
+CLOUDFLARE_API_TOKEN=
+# Comma-separated list, e.g. example.com,sub.example.com
+DOMAINS=
+PROXIED=true
+UPDATE_CRON=*/5 * * * *
+
+# cloudflared-web UI (wisdomsky/cloudflared-web)
+WEBUI_PORT=14333
+BASIC_AUTH_USER=admin
+BASIC_AUTH_PASS=change-me
+
+TZ=UTC

cloudflare/docker-compose.yml

@@ -0,0 +1,26 @@
+services:
+  cloudflare-ddns:
+    image: favonia/cloudflare-ddns:latest
+    container_name: cloudflare-ddns
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:?set CLOUDFLARE_API_TOKEN in .env}
+      DOMAINS: ${DOMAINS:?set DOMAINS in .env}
+      PROXIED: ${PROXIED:-true}
+      UPDATE_CRON: ${UPDATE_CRON:-*/5 * * * *}
+      TZ: ${TZ:-UTC}
+
+  cloudflared-web:
+    image: wisdomsky/cloudflared-web:latest
+    container_name: cloudflared-web
+    restart: unless-stopped
+    ports:
+      - '${WEBUI_PORT:-14333}:14333'
+    environment:
+      WEBUI_PORT: ${WEBUI_PORT:-14333}
+      BASIC_AUTH_USER: ${BASIC_AUTH_USER:-admin}
+      BASIC_AUTH_PASS: ${BASIC_AUTH_PASS:-}
+      TZ: ${TZ:-UTC}
+    volumes:
+      - /data/cloudflare/files/config:/config

dozzle-dockge/docker-compose.yml

@@ -0,0 +1,25 @@
+services:
+  dozzle:
+    image: amir20/dozzle:latest
+    container_name: dozzle
+    restart: unless-stopped
+    ports:
+      - '9999:8080'
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      TZ: ${TZ:-UTC}
+
+  dockge:
+    image: louislam/dockge:1
+    container_name: dockge
+    restart: unless-stopped
+    ports:
+      - '5001:5001'
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /data/dockge/files/data:/app/data
+      - /data/dockge/files/stacks:/opt/stacks
+    environment:
+      DOCKGE_STACKS_DIR: /opt/stacks
+      TZ: ${TZ:-UTC}

it-tools/docker-compose.yml

@@ -0,0 +1,7 @@
+services:
+  it-tools:
+    image: corentinth/it-tools:latest
+    container_name: it-tools
+    restart: unless-stopped
+    ports:
+      - '8080:80'

n8n/.env.example

@@ -0,0 +1,12 @@
+# Copy to .env and fill in secrets before `docker compose up -d`
+POSTGRES_USER=n8n
+POSTGRES_PASSWORD=change-me
+POSTGRES_DB=n8n
+
+# Public hostname / protocol used to access n8n (no port suffix needed when behind a reverse proxy)
+N8N_HOST=localhost
+N8N_PROTOCOL=http
+N8N_PORT=5678
+WEBHOOK_URL=http://localhost:5678/
+
+TZ=UTC

n8n/docker-compose.yml

@@ -0,0 +1,41 @@
+services:
+  postgres:
+    image: postgres:16
+    container_name: n8n-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-n8n}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      POSTGRES_DB: ${POSTGRES_DB:-n8n}
+    volumes:
+      - /data/n8n/postgres:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}']
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  n8n:
+    image: n8nio/n8n:latest
+    container_name: n8n
+    restart: unless-stopped
+    ports:
+      - '${N8N_PORT:-5678}:5678'
+    environment:
+      DB_TYPE: postgresdb
+      DB_POSTGRESDB_HOST: postgres
+      DB_POSTGRESDB_PORT: '5432'
+      DB_POSTGRESDB_DATABASE: ${POSTGRES_DB:-n8n}
+      DB_POSTGRESDB_USER: ${POSTGRES_USER:-n8n}
+      DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      N8N_HOST: ${N8N_HOST:-localhost}
+      N8N_PORT: '5678'
+      N8N_PROTOCOL: ${N8N_PROTOCOL:-http}
+      WEBHOOK_URL: ${WEBHOOK_URL:-}
+      GENERIC_TIMEZONE: ${TZ:-UTC}
+      TZ: ${TZ:-UTC}
+    volumes:
+      - /data/n8n/files:/home/node/.n8n
+    depends_on:
+      postgres:
+        condition: service_healthy

paperless-ngx/docker-compose.yml

@@ -0,0 +1,39 @@
+services:
+  broker:
+    image: docker.io/library/redis:6.0
+    restart: unless-stopped
+  webserver:
+    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    ports:
+      - '8010:8000'
+    volumes:
+      - /data/paperless-ngx/data:/usr/src/paperless/data
+      - /data/paperless-ngx/media:/usr/src/paperless/media
+      - /data/paperless-ngx/export:/usr/src/paperless/export
+      - /data/paperless-ngx/consume:/usr/src/paperless/consume
+      - /data/paperless-ngx/redis/data:/data
+    environment:
+      PAPERLESS_REDIS: redis://broker:6379
+      USERMAP_UID: ${PUID}
+      USERMAP_GID: ${PGID}
+      PAPERLESS_TIME_ZONE: ${TZ}
+      PAPERLESS_URL: ${PAPERLESSURL}
+      PAPERLESS_SECRET_KEY: ${RANDOMKEY}
+      PAPERLESS_OCR_LANGUAGE: ${LANG}
+      PAPERLESS_ADMIN_USER: ${ADMIN_USER}
+      PAPERLESS_ADMIN_PASSWORD: ${ADMIN_PASS}
+    healthcheck:
+      test:
+        - CMD
+        - curl
+        - '-fs'
+        - '-S'
+        - '--max-time'
+        - '2'
+        - http://localhost:8000
+      interval: 30s
+      timeout: 10s
+      retries: 5
+    depends_on:
+      - broker
+    restart: unless-stopped