From 3d3b9097d5894d5daa59112f9759f5f1dcb269d2 Mon Sep 17 00:00:00 2001
From: Mike McFetridge <91107715+mmcfetridge1969@users.noreply.github.com>
Date: Wed, 22 Jul 2026 20:31:54 -0400
Subject: [PATCH] Update

---
 authentik/.env               | 28 +++++++++++
 authentik/docker-compose.yml | 98 ++++++++++++++++++------------------
 duplicati/.env               | 19 +++++++
 duplicati/docker-compose.yml | 37 +++++++++-----
 immich/.env                  | 18 +++++++
 immich/docker-compose.yml    | 62 +++++++++++++----------
 obsidian/.env                | 15 ++++++
 obsidian/docker-compose.yml  | 40 ++++++++-------
 8 files changed, 211 insertions(+), 106 deletions(-)
 create mode 100644 authentik/.env
 create mode 100644 duplicati/.env
 create mode 100644 immich/.env
 create mode 100644 obsidian/.env

diff --git a/authentik/.env b/authentik/.env
new file mode 100644
index 0000000..49ef236
--- /dev/null
+++ b/authentik/.env
@@ -0,0 +1,28 @@
+# ============================================================
+# SYSTEM SETTINGS
+# ============================================================
+TZ=America/New_York
+PUID=1000
+PGID=1000
+DATA_PATH=/home/miker/docker/authentik
+
+# ============================================================
+# AUTHENTIK VERSION & PORTS
+# ============================================================
+AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
+AUTHENTIK_TAG=2026.2.1
+COMPOSE_PORT_HTTP=9000
+COMPOSE_PORT_HTTPS=9443
+
+# ============================================================
+# DATABASE CREDENTIALS
+# ============================================================
+PG_DB=authentik
+PG_USER=authentik
+PG_PASS=GenerateSecurePasswordHere
+
+# ============================================================
+# SECURITY KEYS
+# ============================================================
+# Generate with: openssl rand -base64 36
+AUTHENTIK_SECRET_KEY=GenerateSecureSecretKeyHere
diff --git a/authentik/docker-compose.yml b/authentik/docker-compose.yml
index dcf7850..063e261 100644
--- a/authentik/docker-compose.yml
+++ b/authentik/docker-compose.yml
@@ -1,79 +1,79 @@
+# Authentik Identity & SSO Stack
 services:
   postgresql:
-    env_file:
-    - .env
+    image: docker.io/library/postgres:16-alpine
+    container_name: authentik-db
+    restart: unless-stopped
     environment:
-      POSTGRES_DB: ${PG_DB:-authentik}
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
-      POSTGRES_USER: ${PG_USER:-authentik}
+      - POSTGRES_DB=${PG_DB:-authentik}
+      - POSTGRES_USER=${PG_USER:-authentik}
+      - POSTGRES_PASSWORD=${PG_PASS}
+      - TZ=${TZ}
+    volumes:
+      - ${DATA_PATH}/database:/var/lib/postgresql/data
     healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
       interval: 30s
+      timeout: 5s
       retries: 5
       start_period: 20s
-      test:
-      - CMD-SHELL
-      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
-      timeout: 5s
-    image: docker.io/library/postgres:16-alpine
-    restart: unless-stopped
-    volumes:
-    - /home/miker/docker/authentik/database:/var/lib/postgresql/data
     networks:
       - authentik
 
   server:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.1}
+    container_name: authentik-server
+    restart: unless-stopped
     command: server
+    environment:
+      - AUTHENTIK_POSTGRESQL__HOST=postgresql
+      - AUTHENTIK_POSTGRESQL__NAME=${PG_DB:-authentik}
+      - AUTHENTIK_POSTGRESQL__USER=${PG_USER:-authentik}
+      - AUTHENTIK_POSTGRESQL__PASSWORD=${PG_PASS}
+      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
+      - TZ=${TZ}
+    volumes:
+      - ${DATA_PATH}/data:/data
+      - ${DATA_PATH}/custom-templates:/templates
+    ports:
+      - "${COMPOSE_PORT_HTTP}:9000"
+      - "${COMPOSE_PORT_HTTPS}:9443"
+    shm_size: 512mb
     depends_on:
       postgresql:
         condition: service_healthy
-    env_file:
-    - .env
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.1}
-    ports:
-    - ${COMPOSE_PORT_HTTP}:9000
-    - ${COMPOSE_PORT_HTTPS}:9443
-    restart: unless-stopped
-    shm_size: 512mb
-    volumes:
-    - /home/miker/docker/authentik/data:/data
-    - /home/miker/docker/authentik/custom-templates:/templates
     networks:
       - authentik
       - main
 
   worker:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.1}
+    container_name: authentik-worker
+    restart: unless-stopped
     command: worker
+    user: root
+    environment:
+      - AUTHENTIK_POSTGRESQL__HOST=postgresql
+      - AUTHENTIK_POSTGRESQL__NAME=${PG_DB:-authentik}
+      - AUTHENTIK_POSTGRESQL__USER=${PG_USER:-authentik}
+      - AUTHENTIK_POSTGRESQL__PASSWORD=${PG_PASS}
+      - AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
+      - TZ=${TZ}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ${DATA_PATH}/data:/data
+      - ${DATA_PATH}/certs:/certs
+      - ${DATA_PATH}/custom-templates:/templates
+    shm_size: 512mb
     depends_on:
       postgresql:
         condition: service_healthy
-    env_file:
-    - .env
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.1}
-    restart: unless-stopped
-    shm_size: 512mb
-    user: root
-    volumes:
-    - /var/run/docker.sock:/var/run/docker.sock
-    - /home/miker/docker/authentik/data:/data
-    - /home/miker/docker/authentik/certs:/certs
-    - /home/miker/docker/authentik/custom-templates:/templates
     networks:
       - authentik
       - main
+
 networks:
   main:
-    external: true    # Tells Compose not to create this network
+    external: true
   authentik:
-    external: true    # Tells Compose not to create this network
+    external: true
diff --git a/duplicati/.env b/duplicati/.env
new file mode 100644
index 0000000..4a29a0a
--- /dev/null
+++ b/duplicati/.env
@@ -0,0 +1,19 @@
+# ============================================================
+# SYSTEM SETTINGS
+# ============================================================
+TZ=America/New_York
+PUID=1000
+PGID=1000
+PORT=8250
+
+# ============================================================
+# PATH LOCATIONS
+# ============================================================
+DATA_PATH=/home/miker/docker/duplicati
+DOCKER_ROOT=/home/miker/docker
+IMMICH_LIBRARY=/home/miker/docker/immich/library
+
+# ============================================================
+# SECURITY KEYS
+# ============================================================
+SETTINGS_ENCRYPTION_KEY=84Jo17Ecw5muzGgqVjpeZQYnWBH7XFM7R01CdR646jSIfNbxgp
diff --git a/duplicati/docker-compose.yml b/duplicati/docker-compose.yml
index 08efc8e..c406a56 100644
--- a/duplicati/docker-compose.yml
+++ b/duplicati/docker-compose.yml
@@ -1,17 +1,30 @@
+# Duplicati — Encrypted Offsite/Local Backup Client
 services:
   duplicati:
     image: lscr.io/linuxserver/duplicati:latest
     container_name: duplicati
-    environment:
-      - PUID=1000 # Your host user ID
-      - PGID=1000 # Your host group ID
-      - TZ=America/New_York
-      - SETTINGS_ENCRYPTION_KEY=84Jo17Ecw5muzGgqVjpeZQYnWBH7XFM7R01CdR646jSIfNbxgp  # <-- Add this line
-    volumes:
-      - /home/miker/docker/duplicati/config:/config
-      - /home/miker/docker/immich/library:/source/photos:ro       # Mounts your photo directory as read-only
-      - /home/miker/docker:/source/apps:ro # Mounts your application data files
-      - /home/miker/docker/duplicati/backups:/backups             # Optional local backup location
-    ports:
-      - 8250:8200
     restart: unless-stopped
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - SETTINGS_ENCRYPTION_KEY=${SETTINGS_ENCRYPTION_KEY}
+    volumes:
+      - ${DATA_PATH}/config:/config
+      - ${DATA_PATH}/backups:/backups
+      - ${IMMICH_LIBRARY}:/source/photos:ro
+      - ${DOCKER_ROOT}:/source/apps:ro
+    ports:
+      - "${PORT}:8200"
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:8200/ || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    networks:
+      - main
+
+networks:
+  main:
+    external: true
diff --git a/immich/.env b/immich/.env
new file mode 100644
index 0000000..a0ffe9d
--- /dev/null
+++ b/immich/.env
@@ -0,0 +1,18 @@
+# ============================================================
+# SYSTEM SETTINGS
+# ============================================================
+TZ=America/New_York
+IMMICH_VERSION=v3
+
+# ============================================================
+# PATH LOCATIONS
+# ============================================================
+UPLOAD_LOCATION=/home/miker/docker/immich/library
+DB_DATA_LOCATION=/home/miker/docker/immich/postgres
+
+# ============================================================
+# DATABASE CREDENTIALS
+# ============================================================
+DB_USERNAME=postgresadmin
+DB_PASSWORD=mM3PXXUjK0QMz7
+DB_DATABASE_NAME=immich
diff --git a/immich/docker-compose.yml b/immich/docker-compose.yml
index f85fb6c..aeae41a 100644
--- a/immich/docker-compose.yml
+++ b/immich/docker-compose.yml
@@ -1,51 +1,56 @@
+# Immich — Self-Hosted Photo & Video Management
 name: immich
 
 services:
   immich-server:
     container_name: immich_server
-    image: ghcr.io/immich-app/immich-server:v3
+    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-v3}
     # extends:
     #   file: hwaccel.transcoding.yml
     #   service: cpu
-    volumes:
-      - /home/miker/docker/immich/library:/data
-      - /etc/localtime:/etc/localtime:ro
     environment:
-      DB_USERNAME: postgresadmin
-      DB_PASSWORD: mM3PXXUjK0QMz7
-      DB_DATABASE_NAME: immich
+      - DB_USERNAME=${DB_USERNAME}
+      - DB_PASSWORD=${DB_PASSWORD}
+      - DB_DATABASE_NAME=${DB_DATABASE_NAME}
+      - TZ=${TZ}
+    volumes:
+      - ${UPLOAD_LOCATION}:/data
+      - /etc/localtime:/etc/localtime:ro
     ports:
-      - '2283:2283'
+      - "2283:2283"
     depends_on:
-      - redis
-      - database
-    restart: always
-    healthcheck:
-      disable: false
+      database:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    restart: unless-stopped
     networks:
       - immich
       - main
 
   immich-machine-learning:
     container_name: immich_machine_learning
-    image: ghcr.io/immich-app/immich-machine-learning:v3
+    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-v3}
     # extends:
     #   file: hwaccel.ml.yml
     #   service: cpu
+    environment:
+      - TZ=${TZ}
     volumes:
       - model-cache:/cache
-    restart: always
-    healthcheck:
-      disable: false
+    restart: unless-stopped
     networks:
       - immich
 
   redis:
     container_name: immich_redis
     image: docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+    restart: unless-stopped
     healthcheck:
       test: ["CMD-SHELL", "valkey-cli ping || exit 1"]
-    restart: always
+      interval: 10s
+      timeout: 5s
+      retries: 5
     networks:
       - immich
 
@@ -53,16 +58,21 @@ services:
     container_name: immich_postgres
     image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
     environment:
-      POSTGRES_PASSWORD: mM3PXXUjK0QMz7
-      POSTGRES_USER: postgresadmin
-      POSTGRES_DB: immich
-      POSTGRES_INITDB_ARGS: '--data-checksums'
+      - POSTGRES_USER=${DB_USERNAME}
+      - POSTGRES_PASSWORD=${DB_PASSWORD}
+      - POSTGRES_DB=${DB_DATABASE_NAME}
+      - POSTGRES_INITDB_ARGS=--data-checksums
+      - TZ=${TZ}
     volumes:
-      - /home/miker/docker/immich/postgres:/var/lib/postgresql/data
-    shm_size: 128mb
-    restart: always
+      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
+    shm_size: 512mb
+    restart: unless-stopped
     healthcheck:
-      disable: false
+      test: ["CMD-SHELL", "pg_isready -U ${DB_USERNAME} -d ${DB_DATABASE_NAME}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 15s
     networks:
       - immich
 
diff --git a/obsidian/.env b/obsidian/.env
new file mode 100644
index 0000000..b1c634b
--- /dev/null
+++ b/obsidian/.env
@@ -0,0 +1,15 @@
+# ============================================================
+# SYSTEM SETTINGS
+# ============================================================
+TZ=America/New_York
+PUID=1000
+PGID=1000
+DATA_PATH=/home/miker/docker/obsidian
+
+# ============================================================
+# OBSIDIAN LIVESYNC / COUCHDB CONFIGURATION
+# ============================================================
+COUCHDB_USER=miker
+COUCHDB_PASSWORD=tw9222dvO91ZHb
+COUCHDB_DATABASE=obsidian
+SERVER_DOMAIN=https://obsidian.mikemcfetridge.com
diff --git a/obsidian/docker-compose.yml b/obsidian/docker-compose.yml
index 29e463a..edfb536 100644
--- a/obsidian/docker-compose.yml
+++ b/obsidian/docker-compose.yml
@@ -1,30 +1,32 @@
+# Obsidian Self-Hosted LiveSync (CouchDB Engine)
 services:
   couchdb-obsidian-livesync:
+    image: docker.io/oleduc/docker-obsidian-livesync-couchdb:master
     container_name: obsidian-livesync
-#    image: couchdb:3.3.3 # Specify a stable CouchDB version
-    image: 'docker.io/oleduc/docker-obsidian-livesync-couchdb:master'
+    restart: unless-stopped
     environment:
-      # User and password for CouchDB admin access
-      - COUCHDB_USER=miker
-      - COUCHDB_PASSWORD=tw9222dvO91ZHb
-      - COUCHDB_DATABASE=obsidian
-      - SERVER_DOMAIN=https://obsidian.mikemcfetridge.com
-      # Optional: Set PUID, PGID, UMASK, and TZ for user/group permissions and timezone
-      - PUID=1000
-      - PGID=1000
-      - UMASK=0022
-      - TZ=America/New_York # Adjust timezone as needed
+      - COUCHDB_USER=${COUCHDB_USER}
+      - COUCHDB_PASSWORD=${COUCHDB_PASSWORD}
+      - COUCHDB_DATABASE=${COUCHDB_DATABASE}
+      - SERVER_DOMAIN=${SERVER_DOMAIN}
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - UMASK=002
+      - TZ=${TZ}
     volumes:
-      # Mount a local directory for CouchDB data persistence
-      - /home/miker/docker/obsidian/data:/opt/couchdb/data
-      # Mount a local directory for CouchDB configuration files
-      - /home/miker/docker/obsidian/config:/opt/couchdb/etc/local.d
+      - ${DATA_PATH}/data:/opt/couchdb/data
+      - ${DATA_PATH}/config:/opt/couchdb/etc/local.d
     ports:
-      # Map CouchDB's default port 5984 to the host machine
       - "5984:5984"
-    restart: unless-stopped # Ensure the container restarts automatically unless explicitly stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:5984/_up"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 20s
     networks:
       - main
+
 networks:
   main:
-    external: true    # Tells Compose not to create this network
+    external: true