Mon homelab en 2026 : tour d'horizon de ma stack logicielle

services:
  beszel:
    image: henrygd/beszel:latest
    container_name: beszel
    restart: unless-stopped
    volumes:
      - /rpool/docker/beszel:/beszel_data
    ports:
      - "443:443"
      - "9000:9000"

  uptime-kuma:
    image: louislam/uptime-kuma:2
    container_name: uptime-kuma
    volumes:
      - /rpool/docker/uptime-kuma:/app/data
      - /usr/local/share/ca-certificates:/app/data/docker-tls:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "3001:3001"
    environment:
      NODE_EXTRA_CA_CERTS: /app/data/docker-tls/Pads_Home_CA.crt
    restart: unless-stopped

services:
  server:
    image: gitea/gitea:latest
    container_name: gitea
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=db:5432
      - GITEA__database__NAME=gitea
      - GITEA__database__USER=gitea
      - GITEA__database__PASSWD=change_me
      - GITEA__actions__ENABLED=true
      - GITEA__packages__ENABLED=true
      - GITEA__packages__DOCKER_V2_ENABLED=true
      - GITEA__server__ROOT_URL=https://git.home.lan/
    restart: always
    networks:
      - gitea
      - traefik_gateway
    volumes:
      - /rpool/docker/gitea/data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "2222:22"
      - "3000:3000"
    depends_on:
      - db

  db:
    image: postgres:15
    container_name: gitea_db
    restart: always
    environment:
      - POSTGRES_USER=gitea
      - POSTGRES_PASSWORD=change_me
      - POSTGRES_DB=gitea
    networks:
      - gitea
    volumes:
      - /rpool/docker/gitea/postgres:/var/lib/postgresql/data

#
# WARNING: To install Immich, follow our guide: https://immich.app/docs/install/docker-compose
#
# Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    devices:
      - /dev/dri:/dev/dri
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the stack.env file
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - stack.env
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-public-proxy:
    image: alangrainger/immich-public-proxy:latest
    container_name: immich-public-proxy
    restart: always
    environment:
      PUBLIC_BASE_URL: https://immich.domain.tld
      IMMICH_URL: http://immich_server:2283
    healthcheck:
      test: curl -s http://localhost:3000/share/healthcheck -o /dev/null || exit 1
      start_period: 10s
      timeout: 5s

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    volumes:
      - model-cache:/cache
    env_file:
      - stack.env
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:9@sha256:3eeb09785cd61ec8e3be35f8804c8892080f3ca21934d628abc24ee4ed1698f6
    networks:
      - immich
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      DB_STORAGE_TYPE: 'HDD'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the stack.env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always

UPLOAD_LOCATION=
DB_DATA_LOCATION=
IMMICH_VERSION=release
DB_PASSWORD=
DB_USERNAME=immich
DB_DATABASE_NAME=immich

services:
  donetick:
    container_name: donetick
    image: donetick/donetick:latest
    restart: unless-stopped
    volumes:
      - /rpool/docker/donetick/data:/donetick-data
      - /rpool/docker/donetick/config:/config
    environment:
      - DT_ENV=selfhosted
      - DT_SQLITE_PATH=/donetick-data/donetick.db
    ports:
      - "2021:2021"

services:
  trilium:
    # Optionally, replace `latest` with a version tag like `v0.90.3`
    # Using `latest` may cause unintended updates to the container
    container_name: trilium
    image: triliumnext/trilium:latest
    # Restart the container unless it was stopped by the user
    restart: unless-stopped
    environment:
      - TRILIUM_DATA_DIR=/home/node/trilium-data
      - NODE_TLS_REJECT_UNAUTHORIZED=0
    ports:
      # By default, Trilium will be available at http://localhost:8080
      # It will also be accessible at http://<host-ip>:8080
      # You might want to limit this with something like Docker Networks, reverse proxies, or firewall rules,
      # however be aware that using UFW is known to not work with default Docker installations, see:
      # https://docs.docker.com/engine/network/packet-filtering-firewalls/#docker-and-ufw
      - '8080:8080'
    volumes:
      # Unless TRILIUM_DATA_DIR is set, the data will be stored in the "trilium-data" directory in the home directory.
      # This can also be changed with by replacing the line below with `- /path/of/your/choice:/home/node/trilium-data
      - ${TRILIUM_DATA_DIR:-~/trilium-data}:/home/node/trilium-data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    networks:
      - traefik_gateway

services:
  step-ca:
    image: smallstep/step-ca:latest
    container_name: step-ca
    restart: unless-stopped
    ports:
      - "443:443"
      - "9000:9000"
    volumes:
      - ./step-ca_data:/step-ca
      - ./config.json:/etc/step-ca/config.json:ro
    environment:
      - STEP_CA_CONFIG=/etc/step-ca/config.json

# Initialiser la CA (à exécuter une seule fois)
docker run -it --rm \
  -v $(pwd)/step-ca_data:/step-ca \
  smallstep/step-ca:latest step ca init \
    --name "Homelab CA" \
    --dns home.lan \
    --dns *.home.lan \
    --address ":443" \
    --provisioner admin \
    --provisioner-type JWK

{
  "certificates": [{
    "gencsr": false,
    "listen": ":443",
    "hosts": ["home.lan", "*.home.lan"]
  }],
  "authority": {
    "provisioners": {
      "passwordless": [{
        "type": "JWK",
        "name": "admin",
        "key": {
          "kty": "OKP",
          "crv": "Ed25519",
          "x": "...",
          "d": "..."
        }
      }, {
        "type": "ACME",
        "name": "acme",
        "authorizationFormat": ["cn"]
      }]
    }
  }
}

# Obtenir un certificat pour un service
certbot certonly \
  --server https://ca.home.lan/acme/directory \
  --cert-name gitea.home.lan \
  --dns \
  --email [email protected] \
  --agree-tos

# ou avec step client
step certificate create gitea.home.lan \
  gitea.crt gitea.key \
  --ca https://ca.home.lan \
  --provisioner admin \
  --san dns:gitea.home.lan \
  --san dns:gitea \
  --no-password \
  --insecure

services:
  glance:
    image: glanceapp/glance:latest
    container_name: glance
    restart: unless-stopped
    ports:
      - "3002:8080"
    volumes:
      - ./glance-config.yaml:/app/glance.yaml

glance:
  pages:
    - name: Accueil
      columns:
        - size: small
          widgets:
            - type: calendar

            - type: rss
              limit: 10
              feeds:
                - url: https://blog.example.com/feed.xml

        - size: main
          widgets:
            - type: links
              items:
                - title: Gitea
                  url: https://git.home.lan
                - title: Immich
                  url: https://photos.home.lan
                - title: Trilium
                  url: https://notes.home.lan
                - title: DoneTick
                  url: https://todo.home.lan
                - title: Uptime-Kuma
                  url: https://status.home.lan

            - type: rss
              limit: 20
              feeds:
                - url: https://feeds.example.com/tech

        - size: small
          widgets:
            - type: weather
              location: Paris, France

            - type: monitoring
              refresh: 5m
              sites:
                - name: Gitea
                  url: https://git.home.lan
                - name: Immich
                  url: https://photos.home.lan