我的 Self-hosting 记录

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy

# The Caddyfile is an easy way to configure your Caddy web server.
#
# Unless the file starts with a global options block, the first
# uncommented line is always the address of your site.
#
# To use your own domain name (with automatic HTTPS), first make
# sure your domain's A/AAAA DNS records are properly pointed to
# this machine's public IP, then replace ":80" below with your
# domain name.
{
	servers {
		metrics
	}
}
 
:2019 {
	metrics /metrics
}
 
:80 {
	# Set this path to your site's directory.
	root * /usr/share/caddy
 
	# Enable the static file server.
	file_server
 
	# Another common task is to set up a reverse proxy:
	# reverse_proxy localhost:8080
 
	# Or serve a PHP site through php-fpm:
	# php_fastcgi localhost:9000
}
 
alist.lkwplus.com {
	reverse_proxy 127.0.0.1:5244
}
# Refer to the Caddy docs for more information:
# https://caddyserver.com/docs/caddyfile

# 启动
systemctl start caddy
caddy start --config /etc/caddy/Caddyfile
# 关闭
systemctl stop caddy
caddy stop
# 重载配置文件
caddy reload --config /etc/caddy/Caddyfile
# 格式化 Caddyfile
caddy fmt --config /etc/caddy/Caddyfile

---
services:
  sabnzbd:
    image: lscr.io/linuxserver/sabnzbd:latest
    container_name: sabnzbd
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Asia/Shanghai
    volumes:
      - /opt/sabnzbd/config:/config
      - /opt/sabnzbd/downloads:/downloads
      - /opt/sabnzbd/tmp:/incomplete-downloads
    ports:
      - 127.0.0.1:12467:8080
    restart: unless-stopped

# 安装
curl -fsSL "https://alist.nn.ci/v3.sh" | bash -s install
# 更新
curl -fsSL "https://alist.nn.ci/v3.sh" | bash -s update
# 卸载
curl -fsSL "https://alist.nn.ci/v3.sh" | bash -s uninstall

# 启动
systemctl start alist
# 关闭
systemctl stop alist
# 状态
systemctl status alist
# 重启
systemctl restart alist

/path/to/alist/alist admin set NEW_PASSWORD

{
  "site_url": "https://alist.lkwplus.com",
  "token_expires_in": 48,
  "scheme": {
    "address": "127.0.0.1", // 限制本机访问，外网访问通过 Caddy 反向代理
    "http_port": 5244
  }
}

docker run amir20/dozzle generate lkw123 --password password --email test@email.net --name "John Doe" > data/users.yml

users:
  lkw123:
    email: test@example.com
    name: lkw123
    password: $2a$11$jZEMe2xxxxx

services:
  dozzle:
    image: amir20/dozzle:latest
    container_name: dozzle
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /opt/dozzle/data:/data
    environment:
      - DOZZLE_AUTH_PROVIDER=simple # 开启 auth 功能
      - DOZZLE_NO_ANALYTICS=true # 关闭向 Dozzle 发送匿名统计数据
    ports:
      - 127.0.0.1:18083:8080
    restart: unless-stopped

services:
  glance:
    image: glanceapp/glance:latest
    container_name: glance
    volumes:
      - /opt/glance/glance.yml:/app/glance.yml
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 127.0.0.1:13242:8080
    restart: unless-stopped

services:
  n8n:
    image: docker.n8n.io/n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    environment:
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=host.docker.internal
      - DB_POSTGRESDB_PORT=5444
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=n8n
      - DB_POSTGRESDB_PASSWORD=<PASSWORD>
    ports:
      - 127.0.0.1:15678:5678
    volumes:
      - /opt/n8n/n8n-storage:/home/node/.n8n
    extra_hosts:
      - host.docker.internal:host-gateway

services:
  node_exporter:
    image: quay.io/prometheus/node-exporter:latest
    container_name: node_exporter
    command:
      - '--path.rootfs=/host'
    network_mode: host
    pid: host
    restart: unless-stopped
    volumes:
      - '/:/host:ro,rslave'

services:
  postgres-exporter:
    image: quay.io/prometheuscommunity/postgres-exporter:latest
    container_name: postgres_exporter
    environment:
      DATA_SOURCE_URI: 'localhost:5444/postgres?sslmode=disable'
      DATA_SOURCE_USER: '{your_username}'
      DATA_SOURCE_PASS: '{your_password}'
    network_mode: host
    restart: unless-stopped

services:
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    container_name: cadvisor
    privileged: true
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    devices:
      - /dev/kmsg
    command:
      - '--docker_only=true'
      - '--housekeeping_interval=10s'
      - '--disable_metrics=disk,udp,referenced_memory,cpu_topology,resctrl,tcp,advtcp,sched,process,hugetlb,percpu'
    restart: unless-stopped
    networks:
      - monitoring
 
networks:
  monitoring:
    external: true

services:
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    hostname: prometheus
    restart: unless-stopped
    volumes:
      - /opt/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
      - /opt/prometheus/data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--web.enable-lifecycle'
    ports:
      - 127.0.0.1:19090:9090
    networks:
      - monitoring
    extra_hosts:
      - host.docker.internal:host-gateway
 
networks:
  monitoring:
    external: true

global:
  scrape_interval: 15s
  evaluation_interval: 15s
 
scrape_configs:
  - job_name: prometheus
    static_configs:
      - targets: ['localhost:9090']
        labels:
          instance: prometheus
  - job_name: node
    static_configs:
      - targets: ['host.docker.internal:9100']
  - job_name: postgres
    static_configs:
      - targets: ['host.docker.internal:9187']
  - job_name: caddy
    static_configs:
      - targets: ['host.docker.internal:2019']
  - job_name: cadvisor
    scrape_interval: 30s
    static_configs:
      - targets: ['cadvisor:8080']

services:
  victoriametrics:
    image: victoriametrics/victoria-metrics:latest
    container_name: victoriametrics
    hostname: victoriametrics
    restart: unless-stopped
    volumes:
      - /opt/victoriametrics/data:/victoria-metrics-data
    command:
      - '--storageDataPath=/victoria-metrics-data'
      - '--httpListenAddr=:8428'
      - '--retentionPeriod=1'
    ports:
      - 127.0.0.1:18428:8428
    networks:
      - monitoring
    extra_hosts:
      - host.docker.internal:host-gateway
 
  vmagent:
    image: victoriametrics/vmagent:latest
    container_name: vmagent
    hostname: vmagent
    restart: unless-stopped
    volumes:
      - /opt/victoriametrics/vmagent.yml:/etc/vmagent/vmagent.yml
    command:
      - '--promscrape.config=/etc/vmagent/vmagent.yml'
      - '--remoteWrite.url=http://victoriametrics:8428/api/v1/write'
    networks:
      - monitoring
    depends_on:
      - victoriametrics
    extra_hosts:
      - host.docker.internal:host-gateway
 
networks:
  monitoring:
    external: true

- GF_DATABASE_TYPE=postgres
- GF_DATABASE_HOST=host.docker.internal:5444
- GF_DATABASE_NAME=grafana
- GF_DATABASE_USER=grafana
- GF_DATABASE_PASSWORD={your_password}
- GF_DATABASE_SSL_MODE=disable

services:
  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    environment:
      - GF_SERVER_ROOT_URL=https://grafana.lkwplus.com/
    extra_hosts:
      - host.docker.internal:host-gateway
    ports:
      - 127.0.0.1:19823:3000
    volumes:
      - /opt/grafana/data:/var/lib/grafana
    networks:
      - monitoring
 
networks:
  monitoring:
    external: true

services:
  server:
    image: gitea/gitea:latest
    container_name: gitea
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=host.docker.internal:5444
      - GITEA__database__NAME=gitea
      - GITEA__database__USER=gitea
      - GITEA__database__PASSWD={your_password}
    restart: unless-stopped
    extra_hosts:
      - host.docker.internal:host-gateway
    volumes:
      - /opt/gitea/data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 127.0.0.1:13099:3000
      - 222:22

services:
  qbittorrent:
    image: linuxserver/qbittorrent:latest
    container_name: qbittorrent
    environment:
      - TZ=Asia/Shanghai
      - UMASK_SET=022
      - WEBUI_PORT=8081
    volumes:
      - /opt/qbittorrent/config:/config
      - /opt/qbittorrent/downloads:/downloads
    ports:
      - 65231:65231
      - 65231:65231/udp
      - 127.0.0.1:8081:8081
    restart: unless-stopped

services:
  server:
    image: yooooomi/your_spotify_server:latest
    container_name: your_spotify_server
    restart: unless-stopped
    ports:
      - 127.0.0.1:18777:8080
    environment:
      API_ENDPOINT: https://your-spotify.lkwplus.com
      CLIENT_ENDPOINT: https://spotify.lkwplus.com
      TIMEZONE: Asia/Shanghai
      SPOTIFY_PUBLIC: { your_spotify_client_id }
      SPOTIFY_SECRET: { your_spotify_secret }
      MONGO_ENDPOINT: mongodb+srv://lkw123:{password}@cluster0.kopgi.mongodb.net/your_spotify?retryWrites=true&w=majority&appName=Cluster0
      MONGO_NO_ADMIN_RIGHTS: true
      CORS: i-want-a-security-vulnerability-and-want-to-allow-all-origins
 
  web:
    image: yooooomi/your_spotify_client:latest
    container_name: your_spotify_client
    restart: unless-stopped
    ports:
      - 127.0.0.1:13241:3000
    environment:
      API_ENDPOINT: https://your-spotify.lkwplus.com

services:
  opengist:
    image: ghcr.io/thomiceli/opengist:1
    container_name: opengist
    restart: unless-stopped
    ports:
      - 127.0.0.1:16157:6157 # Web
      - 2222:2222 # SSH
    volumes:
      - /opt/opengist/data:/opengist

services:
  redis:
    image: redis:latest
    container_name: redis
    restart: unless-stopped
    ports:
      - 6479:6379
    volumes:
      - /opt/redis/data:/data
      - /opt/redis/redis.conf:/usr/local/etc/redis/redis.conf
      - /opt/redis/logs:/logs
    command: redis-server /usr/local/etc/redis/redis.conf --appendonly yes --requirepass '{your_password}'

services:
  app:
    image: cooderl/wewe-rss-sqlite:latest
    container_name: wewerss
    ports:
      - 127.0.0.1:4005:4000
    environment:
      # 数据库连接地址
      # - DATABASE_URL=file:../data/wewe-rss.db
      - DATABASE_TYPE=sqlite
      # 服务接口请求授权码
      # - AUTH_CODE=0211
      # 提取全文内容模式
      # - FEED_MODE=fulltext
      # 定时更新订阅源Cron表达式
      # - CRON_EXPRESSION=35 5,17 * * *
      # 服务接口请求限制，每分钟请求次数
      # - MAX_REQUEST_PER_MINUTE=60
      # 外网访问时，需设置为服务器的公网 IP 或者域名地址
      - SERVER_ORIGIN_URL=https://wewerss.lkwplus.com
    restart: unless-stopped
    volumes:
      # 映射数据库文件存储位置，容器重启后不丢失
      - /opt/wewerss/data:/app/data

services:
  moments:
    image: kingwrcy/moments:latest
    container_name: moments
    ports:
      - 127.0.0.1:16237:3000
    volumes:
      - /opt/moments/data:/app/data
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    restart: unless-stopped

services:
  uptime-kuma:
    image: louislam/uptime-kuma:latest
    container_name: uptime-kuma
    restart: unless-stopped
    ports:
      - 127.0.0.1:13059:3001
    volumes:
      - /opt/uptime-kuma/data:/app/data
      - /var/run/docker.sock:/var/run/docker.sock # 用于监控 Docker 容器状态

# 拉取镜像
docker pull containrrr/watchtower
# 执行手动更新
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock containrrr/watchtower -cR {CONTAINER_NAME}

services:
  watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: container1 container2 container3 # 可选，仅更新指定容器
    environment:
      - TZ=Asia/Shanghai
      - WATCHTOWER_POLL_INTERVAL=86400 # 24h
      - WATCHTOWER_NOTIFICATIONS_HOSTNAME={your_hostname}
      - WATCHTOWER_NOTIFICATIONS=shoutrrr
      - WATCHTOWER_NOTIFICATION_URL=telegram://{HTTP_API_TOKEN}@telegram/?chats={CHAT_ID}
      - WATCHTOWER_CLEANUP=true

services:
  diun:
    image: crazymax/diun:latest
    container_name: diun
    command: serve
    volumes:
      - /opt/diun/data:/data
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - 'TZ=Asia/Shanghai'
      - 'DIUN_WATCH_WORKERS=20'
      - 'DIUN_WATCH_SCHEDULE=0 */6 * * *'
      - 'DIUN_WATCH_JITTER=30s'
      - 'DIUN_PROVIDERS_DOCKER=true'
      - 'DIUN_PROVIDERS_DOCKER_WATCHBYDEFAULT=true'
      - 'DIUN_NOTIF_TELEGRAM_TOKEN={your_bot_token}'
      - 'DIUN_NOTIF_TELEGRAM_CHATIDS={your_chat_id}'
    labels:
      - 'diun.enable=true'
    restart: unless-stopped

export AWS_DEFAULT_REGION={your_region}
export AWS_ACCESS_KEY_ID={your_access_key}
export AWS_SECRET_ACCESS_KEY={your_secret_key}
export RESTIC_PASSWORD={your_restic_password}
export RESTIC_REPOSITORY=s3:https://{your_endpoint}.r2.cloudflarestorage.com/{your_bucket_name}
restic init

restic backup /which/path/to/backup --dry-run -vv

30 4 * * * /usr/bin/restic backup /which/path/to/backup --dry-run -vv >> /path/to/backup.log 2>&1

$ free -h
               total        used        free      shared  buff/cache   available
Mem:           1.8Gi       1.1Gi       100Mi        35Mi       800Mi       680Mi
Swap:          2.0Gi       184Mi       1.8Gi
 
$ docker stats --no-stream
CONTAINER ID   NAME                CPU %     MEM USAGE / LIMIT     MEM %     NET I/O           BLOCK I/O         PIDS
923f971d3b37   dozzle              0.00%     10.34MiB / 1.796GiB   0.56%     1.25MB / 5.29MB   4.95MB / 6.84MB   9
fd237887aecd   new-api             0.00%     58.19MiB / 1.796GiB   3.16%     7.41MB / 2.07MB   27.8MB / 28.5MB   6
8f37d4f379fe   grafana             0.09%     97.36MiB / 1.796GiB   5.29%     86.9MB / 133MB    297MB / 51.9MB    9
fc932e8b8fd5   prometheus          0.21%     172.6MiB / 1.796GiB   9.38%     5.22GB / 142MB    1.07GB / 1.94GB   9
6990c8fa1463   cadvisor            2.79%     68.21MiB / 1.796GiB   3.71%     104MB / 5.96GB    36MB / 12MB       11
4a601308c9e1   postgres_exporter   0.00%     10.92MiB / 1.796GiB   0.59%     0B / 0B           17.2MB / 11.7MB   7
093f763befb5   node_exporter       0.00%     19.05MiB / 1.796GiB   1.04%     0B / 0B           25.6MB / 11.4MB   7
65e3cb4e66c8   sabnzbd             0.03%     50.29MiB / 1.796GiB   2.73%     2.53MB / 12.1MB   68.8MB / 17.8MB   30
b36798faaa29   qbittorrent         0.02%     11.46MiB / 1.796GiB   0.62%     1.48MB / 1.43MB   54.3MB / 9.61MB   17
6c5a7fffe90a   redis               0.32%     8.031MiB / 1.796GiB   0.44%     509kB / 297kB     21MB / 2.34MB     6
3f8854c8002c   postgres            4.10%     38.79MiB / 1.796GiB   2.11%     125MB / 563MB     38.1MB / 30.6MB   9
c7dfa82dcf03   glance              0.00%     18.48MiB / 1.796GiB   1.01%     7.24MB / 1.56MB   12MB / 4.97MB     6
7bddcf9118ce   wewerss             0.00%     58.85MiB / 1.796GiB   3.20%     797kB / 285kB     81.6MB / 3.16MB   15

app = 'lkw123-reader'
primary_region = 'iad'
 
[build]
  image = "hectorqin/reader:openj9-latest"
 
[env]
  SPRING_PROFILES_ACTIVE = "prod"
  READER_APP_USERLIMIT = "1"
  READER_APP_USERBOOKLIMIT = "200"
  READER_APP_CACHECHAPTERCONTENT = "true"
  READER_APP_SECURE = "true"
  READER_APP_SECUREKEY = "{your_secret_key}"
 
[http_service]
  internal_port = 8080
  force_https = true
  auto_stop_machines = 'off'
  auto_start_machines = false
  min_machines_running = 0
  processes = ['app']
 
[mounts]
  source="reader_data"
  destination="/storage"
 
[[vm]]
  size = 'shared-cpu-1x'

app = 'lkw123-fastapi'
primary_region = 'iad'
 
[build]
  builder = 'paketobuildpacks/builder:base'
 
[env]
  PORT = '8000'
 
[http_service]
  internal_port = 8000
  force_https = true
  auto_stop_machines = 'off'
  auto_start_machines = false
  min_machines_running = 0
  processes = ['app']
 
[[vm]]
  size = 'shared-cpu-1x'

app = 'lkw123-vault'
primary_region = 'iad'
 
[http_service]
  internal_port = 8080
  force_https = true
  auto_stop_machines = 'off'
  auto_start_machines = false
  min_machines_running = 0
  processes = ['app']
 
[env]
  SIGNUPS_ALLOWED = "false"
 
[build]
  image = "vaultwarden/server:latest"
 
[mounts]
  source = "vw_data"
  destination = "/data"
 
[[services]]
  http_checks = []
  internal_port = 80
  [[services.ports]]
    force_https = true
    handlers = ["http"]
    port = 80
 
  [[services.ports]]
    handlers = ["tls", "http"]
    port = 443
 
  [[services.tcp_checks]]
    grace_period = "1s"
    interval = "15s"
    restart_limit = 0
    timeout = "2s"
 
[[vm]]
  size = 'shared-cpu-1x'

flyctl secrets set BOT_TOKEN="{your_bot_token}"

app = 'lkw123-memos'
primary_region = 'iad'
 
[build]
  image = 'ghcr.io/hu3rror/memos-litestream:stable-memogram'
 
[env]
  LITESTREAM_REPLICA_BUCKET = '{lkw123-memos}'
  LITESTREAM_REPLICA_ENDPOINT = '{s3.us-west-004.backblazeb2.com}'
  LITESTREAM_REPLICA_PATH = 'memos_prod.db'
 
[[mounts]]
  source = 'memos_data'
  destination = '/var/opt/memos'
 
[http_service]
  internal_port = 5230
  force_https = true
  auto_stop_machines = false
  auto_start_machines = true
  min_machines_running = 0
 
[[vm]]
  size = 'shared-cpu-1x'

/* 设置 Memos 标签样式 */
span.inline-block.w-auto.text-blue-600.dark\:text-blue-400 {
  color: #f3f3f3;
  background-color: #40b76b;
  box-shadow: 0 4px 8px rgba(0, 0, 0, 0.1);
  border-radius: 2px;
  padding: 2px 6px;
  font-size: 15px;
  margin-bottom: 4px;
}
/* 设置同级下不同的标签显示不同的颜色 */
/* 第2个标签 */
span.inline-block.w-auto.text-blue-600.dark\:text-blue-400:nth-child(n + 2) {
  background-color: #157cf5;
}
/* 第3个标签 */
span.inline-block.w-auto.text-blue-600.dark\:text-blue-400:nth-child(n + 4) {
  background-color: #f298a6;
}
/* 第4个标签 */
span.inline-block.w-auto.text-blue-600.dark\:text-blue-400:nth-child(n + 6) {
  background-color: #fdb15d;
}
/* 第5个标签 */
span.inline-block.w-auto.text-blue-600.dark\:text-blue-400:nth-child(n + 8) {
  background-color: #67d6ca;
}
/* 第6个标签 */
span.inline-block.w-auto.text-blue-600.dark\:text-blue-400:nth-child(n + 10) {
  background-color: #7445e0;
}