# MyDocker - Home Infrastructure Stack

> Docker Compose based home infrastructure with 40+ services. Domain: **sebson.space**

## Quick Start

```bash
cd /home/seba/mydocker

docker compose up -d              # Start all services
docker compose down               # Stop all
docker compose ps                 # Running containers
docker compose logs -f <service>  # Follow logs
docker compose restart <service>  # Restart single service

./upgrade-container-by-name.sh <service>        # Upgrade service
./upgrade-container-by-name.sh <service> prune  # Upgrade + prune old images
./backup_db.sh                                    # DB backup -> Google Drive
```

## Architecture Overview

```
                          Internet
                              |
                        [ Traefik v3.6.8 ]
                     TLS (Let's Encrypt ACME)
                              |
        ┌─────────────────────┼─────────────────────┐
        |                     |                     |
   [Public Services]    [Monitoring Stack]    [Security Layer]
        |                     |                     |
   Home Assistant        Prometheus           CrowdSec
   Bitwarden             Grafana              traefik-bouncer
   Immich                VictoriaMetrics
   Jellyfin              Loki + Promtail
   HA Dashboard          cAdvisor
   Brana Frontend        Node Exporter
   OpenClaw              mktxp, ping-exporter
                         Smartctl Exporter
```

## Services by Category

### Gateway & Security

| Service | URL | Description |
|---------|-----|-------------|
| [Traefik](traefik/README.md) | https://traefik.sebson.space | Reverse proxy, TLS, geo-blocking |
| [CrowdSec](crowdsec/README.md) | local only | IPS, log analysis, Telegram alerts |
| [Bitwarden](bitwarden/README.md) | https://bward.sebson.space | Password manager (Vaultwarden + YubiKey 2FA) |

### Home Automation & IoT

| Service | URL | Description |
|---------|-----|-------------|
| [Home Assistant](homeassistant/README.md) | https://ha.sebson.space | Central automation engine |
| [ESPHome](esphome/README.md) | http://localhost:6052 | ESP8266/ESP32 firmware OTA |
| [Mosquitto](mosquitto/README.md) | 192.168.1.132:1883 | MQTT broker |
| [UniFi](unifi-config/README.md) | https://192.168.1.239:8443 | Network controller (MongoDB backend) |
| [Brana Frontend](brana-frontend/README.md) | https://brana.sebson.space | Gate control panel (mobile-first) |
| [HA Dashboard](ha-dashboard/README.md) | https://hadash.sebson.space | Flask ops dashboard |

### Surveillance & Cameras

| Service | URL | Description |
|---------|-----|-------------|
| [Frigate](frigate/README.md) | http://acemagic:5000 | NVR + AI object detection (Coral TPU) |
| [Camera LLM](camera-llm/README.md) | local API | LLM-powered camera memory (ChromaDB RAG) |
| [Timelapse](timelapse_service/README.md) | cron-based | Auto timelapse generation from camera frames |

### Media & Storage

| Service | URL | Description |
|---------|-----|-------------|
| [Jellyfin](jellyfin/README.md) | https://jfin.sebson.space | Media server (movies, series, music) |
| [Immich](immich/README.md) | https://immch.sebson.space | Self-hosted photo gallery (AI face recognition) |
| [Prowlarr](prowlarr/README.md) | http://localhost:9696 | Indexer manager (VPN-routed) |
| [Duplicati](duplicati/README.md) | http://localhost:8200 | Encrypted incremental backups |

### Monitoring Stack

```
[Docker Containers] ──> Promtail ──> Loki ──> Grafana
     |                                      ^
     v                                      |
  cAdvisor ──> Prometheus ──> VictoriaMetrics
     |                    |
  Node Exporter ──────────┘
  mktxp (MikroTik)
  ping-exporter
  smartctl-exporter
  PostgreSQL exporter
```

| Service | URL | Description |
|---------|-----|-------------|
| [Prometheus](prometheus/README.md) | https://prom.sebson.space | Metrics collection (30d retention) |
| [Grafana](grafana/README.md) | https://grafana.sebson.space | Dashboards + alerts (Telegram) |
| [Uptime Kuma](uptime-kuma/README.md) | https://kuma.sebson.space | External uptime monitoring + status page |
| [Loki](loki/README.md) | http://loki:3100 | Log aggregation (31d retention) |
| [Promtail](promtail/README.md) | port 9080 | Log shipper (Docker socket discovery) |
| [mktxp](mktxp/README.md) | http://localhost:49090 | MikroTik router metrics |
| [ping-exporter](pingexporter/README.md) | http://localhost:9427 | ICMP latency monitoring |

### Custom Services

| Service | Description |
|---------|-------------|
| [side-agent](side-agent/README.md) | Camera snapshot detector, container version checker, backup scheduler |
| [log-ingester](log-ingester/README.md) | RAG ingestion of Frigate/HA/Docker logs into ChromaDB |
| [OpenClaw](OPENCLAW_SETUP.md) | Personal AI assistant (CLI, Telegram, Web UI) |

## Network Architecture

### Host Network Services
These services run on `network_mode: host` for mDNS, Bluetooth, or device discovery:
- Home Assistant, ESPHome, Mosquitto, UniFi, Node Exporter, ping-exporter

### VPN Namespace (Gluetun)
Services routed through NordVPN (Germany) via `network_mode: "service:gluetun"`:
- qBittorrent, Radarr, Prowlarr

## Storage Layout

| Mount | Capacity | Purpose |
|-------|----------|---------|
| `/media/seagata16t` | 16TB HDD | Immich photos, Jellyfin media, timelapses, camera archives |
| `/media/evo2t` | 2TB SSD | Frigate recordings, Duplicati backups, side-agent data |
| `/media/asustor` | NAS | rsync backup destination |
| `/media/wd1t` | 1TB | Secondary media storage |

## Key Files

| File | Purpose |
|------|---------|
| `docker-compose.yaml` | Single source of truth (2000+ lines) |
| `.env` | Secrets and environment variables |
| `./upgrade-container-by-name.sh` | Per-service container upgrade |
| `./backup_db.sh` | PostgreSQL backup to Google Drive via rclone |
| `./watchdog.sh` | Service health monitoring |
| `./truncate_logs.sh` | Log file size management |
| `side-agent/manifest/container_versions.yaml` | Tracked container versions |

## Torrent Box (Subproject)

Separate Makefile-managed stack in `./torrent-box-with-vpn/`:

```bash
cd torrent-box-with-vpn
make start / stop / restart
make update_containers   # pull + restart all
make generate_certificate
make backup
```

> The legacy `transmission-vpn` service in docker-compose is deprecated and replaced by this subproject.