docker (aerialis)

This container runs general-purpose Docker workloads for services that are not packaged natively in NixOS.

General

This container is used to run regular Docker containers via the compose-runner module.

Restarting containers

This can happen via the following command:

sudo systemctl restart compose-runner-docker

Nextcloud AIO

This container also runs a Nextcloud AIO master container, which administrates its containers by itself. Consult its extensive documentation for more information. Since this container requires a Nextcloud volume at a fixed place, without being able to change it, it is not included in the regular data directory.

Instead, backups are regularly performed via the inbuilt backup function in the admin interface. They can be found at /var/garuda/backups/nextcloud (host path /data_2/backup/nextcloud-aio) and are included in the offsite system backups, together with the AIO master container volume. See Disaster recovery for restoring.

Nix expression

{
  config,
  garuda-lib,
  sources,
  ...
}:
{
  imports = sources.defaultModules ++ [ ../../modules ];

  garuda =
    garuda-lib.mkMonitoring {
      host = "aerialis";
      units = [
        "compose-runner-docker.service"
        "docker.service"
      ];
    }
    // {
      services.compose-runner.docker = {
        envfile = config.sops.secrets."compose/docker".path;
        source = ../../../compose/docker;
        extraEnv = {
          "MATTERBRIDGE_CONFIG" = config.sops.secrets."compose/matterbridge".path;
        };
      };
    };

  sops.secrets = {
    "compose/docker" = {
      restartUnits = [ "compose-runner-docker.service" ];
    };
    "compose/matterbridge" = {
      restartUnits = [ "compose-runner-docker.service" ];
    };
  };

  system.stateVersion = "25.05";
}

Docker containers

services:
  # Nextcloud AIO (self-managed containers)
  # The dummy mounts are for creating the required volumes, even
  # though the container doesn't use them. The actual containers
  # making use of these volumes are started by the master container.
  # Do *not* change container and volume names!
  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    restart: always
    container_name: nextcloud-aio-mastercontainer
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - nextcloud_aio_clamav:/dummy/clamav
      - nextcloud_aio_database:/dummy/database
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - nextcloud_aio_nextcloud:/dummy/nextcloud
      - nextcloud_aio_nextcloud_data:/dummy/nextcloud_data
      - nextcloud_aio_redis:/dummy/redis
    ports: ["8080:8080"]
    environment:
      APACHE_PORT: 11000
      APACHE_IP_BINDING: 10.0.5.60
      NEXTCLOUD_DATADIR: /var/garuda/compose-runner/docker/nextcloud-aio/nextcloud_data
  syncserver:
    container_name: syncserver
    image: crazymax/firefox-syncserver:edge # newest, versioned one 3 years old
    volumes: ["./syncserver:/data"]
    ports: ["5001:5000"]
    environment:
      FF_SYNCSERVER_ACCESSLOG: true
      FF_SYNCSERVER_FORCE_WSGI_ENVIRON: true
      FF_SYNCSERVER_FORWARDED_ALLOW_IPS: "*"
      FF_SYNCSERVER_PUBLIC_URL: https://ffsync.garudalinux.org
      FF_SYNCSERVER_SECRET: ${FF_SYNCSERVER_SECRET:-?err}
      FF_SYNCSERVER_SQLURI: sqlite:////data/syncserver.db
      TZ: Europe/Berlin
    restart: always
  vaultwarden:
    image: vaultwarden/server:1.37.4-alpine
    container_name: vaultwarden
    volumes: ["./bitwarden:/data"]
    ports: ["8081:80"]
    environment:
      ADMIN_TOKEN: ${BW_ADMIN_TOKEN:-?err}
      DOMAIN: https://bitwarden.garudalinux.org
      SIGNUPS_ALLOWED: true
      SMTP_FROM: [email protected]
      SMTP_HOST: mail.garudalinux.org
      SMTP_PASSWORD: ${BW_SMTP_PASSWORD:-?err}
      SMTP_PORT: 465
      SMTP_SSL: true
      SMTP_USERNAME: [email protected]
      WEBSOCKET_ENABLED: true
      YUBICO_CLIENT_ID: ${BW_YUBICO_CLIENT_ID:-?err}
      YUBICO_SECRET_KEY: ${BW_YUBICO_ADMIN_SECRET:-?err}
    restart: always
  matterbridge:
    image: registry.gitlab.com/garuda-linux/tools/matterbridge:latest
    container_name: matterbridge
    volumes:
      - ${MATTERBRIDGE_CONFIG:-?err}:/etc/matterbridge/matterbridge.toml:ro
    deploy:
      restart_policy:
        condition: always
        delay: 120s
  watchtower:
    image: nickfedor/watchtower:1.23.1
    container_name: watchtower
    command: --cleanup matterbridge vaultwarden thelounge syncserver
    volumes: ["/var/run/docker.sock:/var/run/docker.sock"]
    restart: always
volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer
    driver_opts:
      type: none
      device: /var/garuda/compose-runner/docker/nextcloud-aio/mastercontainer
      o: bind
  nextcloud_aio_clamav:
    name: nextcloud_aio_clamav
    driver_opts:
      type: none
      device: /var/garuda/compose-runner/docker/nextcloud-aio/clamav
      o: bind
  nextcloud_aio_database:
    name: nextcloud_aio_database
    driver_opts:
      type: none
      device: /var/garuda/compose-runner/docker/nextcloud-aio/database
      o: bind
  nextcloud_aio_nextcloud:
    name: nextcloud_aio_nextcloud
    driver_opts:
      type: none
      device: /var/garuda/compose-runner/docker/nextcloud-aio/nextcloud
      o: bind
  nextcloud_aio_nextcloud_data:
    name: nextcloud_aio_nextcloud_data
    driver_opts:
      type: none
      device: /var/garuda/compose-runner/docker/nextcloud-aio/nextcloud_data
      o: bind
  nextcloud_aio_redis:
    name: nextcloud_aio_redis
    driver_opts:
      type: none
      device: /var/garuda/compose-runner/docker/nextcloud-aio/redis
      o: bind