freydis/shared-services
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Consolidated Portainer stack for shared backing services (Meilisearch, MariaDB, PostgreSQL, Redis)
5 commits 1 branch 0 tags 39 KiB
Find a file
Exact
Freydis Mende eed4b60a71
All checks were successful
CI / deploy (push) Successful in 1s
Details
Add CI to redeploy on push 
Matches the deploy-webhook pattern used by the other app repos, minus
the build/test jobs since this repo has no application code — just
off-the-shelf images in a compose file.
2026-08-17 21:50:45 +02:00
.forgejo/workflows Add CI to redeploy on push 2026-08-17 21:50:45 +02:00
.env.example Add InfluxDB as a shared service 2026-08-17 18:36:33 +02:00
.gitignore Consolidate shared backing services into one stack 2026-08-15 15:00:18 +02:00
docker-compose.yml Bind RedisInsight to loopback only 2026-08-17 21:39:48 +02:00
README.md Bind RedisInsight to loopback only 2026-08-17 21:39:48 +02:00

README.md

shared-services

Shared, non-app-specific backing services used by more than one app: Meilisearch, MariaDB, PostgreSQL, Redis, and InfluxDB. Each service gets its own external network and named volume, so apps attach only to the ones they actually need.

cp .env.example .env   # then fill in every *_PASSWORD / *_KEY value
docker compose up -d

Meilisearch

Owns the meili-shared external network. No host port is published; it's reachable only from containers on that network.

  • Connect from an app with MEILI_HOST=http://meilisearch:7700 and MEILI_API_KEY=<MEILI_MASTER_KEY>.
  • Data persists in the meili_data volume.
  • One instance, one index per app — use your own index name in each app's Meilisearch client code.

MariaDB

Owns the mariadb-shared external network.

  • Connect from an app with a mariadb-shared network attachment, host mariadb-shared-db, and the root credentials (or a per-app user you create yourself).
  • Data persists in the mariadbdata volume.

PostgreSQL

Owns the pg-shared external network (compose service/network key is postgres-shared).

  • Connect from an app with a pg-shared network attachment, host pg-shared-db, POSTGRES_USER/POSTGRES_PASSWORD.
  • Data persists in the pgdata volume.

Redis

Owns the redis-shared external network.

  • Connect from an app with a redis-shared network attachment, host redis-shared-db, and REDIS_PASSWORD.
  • Data persists in the redisdata volume.
  • RedisInsight (a web UI for browsing keys) is published on 127.0.0.1:5540 — loopback only, since it has no built-in auth of its own and would otherwise give full read/write access to every app's Redis data to anyone who finds the port. Use an SSH tunnel (ssh -L 5540:localhost:5540 <host>) for remote access.

InfluxDB

Owns the influxdb-shared external network, plus 127.0.0.1:8086 on the host — loopback-only, not reachable from the LAN. That's for the evcc-influx-aggregate.sh cron job, which runs directly on the host (not in a container) and has no other way to reach a container-network-only service; it already connects via localhost, so no config change needed there. Containers should use the Docker network instead of this port.

  • Connect from an app with an influxdb-shared network attachment, host influxdb-shared-db, port 8086, and the INFLUXDB_ADMIN_USER/INFLUXDB_ADMIN_PASSWORD credentials.
  • Data persists in the influxdbdata volume — this reuses the pre-existing influxdb_influxdb-data volume from evcc's original standalone InfluxDB stack, so history isn't lost by moving it here.
  • Currently single-tenant (just the evcc database from that migration) — InfluxDB 1.8 supports multiple databases on one instance, so additional apps can add their own INFLUXDB_DB rather than needing a second instance.

Adding another app

  1. Add the relevant network(s) above as external: true in the app's docker-compose.yml.
  2. Give the app the matching host/credential env vars.
  3. Don't publish DB ports on the app side — connectivity goes over the shared Docker network only.

Maintenance

  • docker compose logs <service> for troubleshooting.
  • MariaDB/PostgreSQL/InfluxDB only consult their root/admin password env var on first init of an empty volume; changing it later has no effect on an already-initialized database. Redis re-applies REDIS_PASSWORD on every start (via --requirepass), so it must stay in sync with whatever clients already use to authenticate.