freydis/shared-services
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Consolidated Portainer stack for shared backing services (Meilisearch, MariaDB, PostgreSQL, Redis)
10 commits 1 branch 0 tags 53 KiB
Find a file
Exact
Freydis Mende cb6aa7b497
All checks were successful
CI / deploy (push) Successful in 1s
Details
chore: drop one-off MEILI_UPGRADE_DB after the v1.56 migration
2026-10-27 12:29:42 +01:00
.forgejo/workflows Add CI to redeploy on push 2026-08-17 21:50:45 +02:00
.env.example Add InfluxDB as a shared service 2026-08-17 18:36:33 +02:00
.gitignore Consolidate shared backing services into one stack 2026-08-15 15:00:18 +02:00
docker-compose.yml chore: drop one-off MEILI_UPGRADE_DB after the v1.56 migration 2026-10-27 12:29:42 +01:00
README.md feat: upgrade Redis to 8, InfluxDB to 1.13 and Meilisearch to v1.56 2026-10-27 12:28:35 +01:00

README.md

shared-services

Shared, non-app-specific backing services used by more than one app: Meilisearch, MariaDB, PostgreSQL, Redis, and InfluxDB. Each service gets its own external network and named volume, so apps attach only to the ones they actually need.

cp .env.example .env   # then fill in every *_PASSWORD / *_KEY value
docker compose up -d

Meilisearch

Owns the meili-shared external network. No host port is published; it's reachable only from containers on that network.

  • Connect from an app with MEILI_HOST=http://meilisearch:7700 and MEILI_API_KEY=<MEILI_MASTER_KEY>.
  • Data persists in the meili_data volume.
  • One instance, one index per app — use your own index name in each app's Meilisearch client code.

MariaDB

Owns the mariadb-shared external network.

  • Connect from an app with a mariadb-shared network attachment, host mariadb-shared-db, and the root credentials (or a per-app user you create yourself).
  • Data persists in the mariadbdata volume.
  • Pinned to the current LTS (12.3). MARIADB_AUTO_UPGRADE runs mariadb-upgrade on start after an image bump; take a mariadb-dump first, since a major upgrade can't be rolled back.

PostgreSQL

Owns the pg-shared external network (compose service/network key is postgres-shared).

  • Connect from an app with a pg-shared network attachment, host pg-shared-db, POSTGRES_USER/POSTGRES_PASSWORD.
  • Data persists in the pgdata volume.

Redis

Owns the redis-shared external network.

  • Connect from an app with a redis-shared network attachment, host redis-shared-db, and REDIS_PASSWORD.
  • Data persists in the redisdata volume.
  • RedisInsight (a web UI for browsing keys) is published on 127.0.0.1:5540 — loopback only, since it has no built-in auth of its own and would otherwise give full read/write access to every app's Redis data to anyone who finds the port. Use an SSH tunnel (ssh -L 5540:localhost:5540 <host>) for remote access.

InfluxDB

Owns the influxdb-shared external network, plus 127.0.0.1:8086 on the host — loopback-only, not reachable from the LAN. That's for the evcc-influx-aggregate.sh cron job, which runs directly on the host (not in a container) and has no other way to reach a container-network-only service; it already connects via localhost, so no config change needed there. Containers should use the Docker network instead of this port.

  • Connect from an app with an influxdb-shared network attachment, host influxdb-shared-db, port 8086, and the INFLUXDB_ADMIN_USER/INFLUXDB_ADMIN_PASSWORD credentials.
  • Data persists in the influxdbdata volume — this reuses the pre-existing influxdb_influxdb-data volume from evcc's original standalone InfluxDB stack, so history isn't lost by moving it here.
  • The 1.11+ image runs as influxdb (UID/GID 1500), unlike 1.8 which ran as root, so the volume must be owned by 1500:1500 (chowned when upgrading from 1.8).
  • Holds evcc, evcc_aggr and homeassistant (Home Assistant writes via 127.0.0.1:8086, since it runs with host networking) — InfluxDB 1.x supports multiple databases on one instance, so additional apps can add their own INFLUXDB_DB rather than needing a second instance.

Adding another app

  1. Add the relevant network(s) above as external: true in the app's docker-compose.yml.
  2. Give the app the matching host/credential env vars.
  3. Don't publish DB ports on the app side — connectivity goes over the shared Docker network only.

Maintenance

  • docker compose logs <service> for troubleshooting.
  • Updates: Watchtower auto-updates MariaDB, PostgreSQL, Redis and InfluxDB within their pinned tag (12.3, 18, 8-alpine, 1.13); Diun notifies (notify_on=new) only when a newer version tag appears. Meilisearch is pinned to an exact version and notify-only: upgrade by taking a snapshot + dump, bumping the tag and starting once with MEILI_UPGRADE_DB=true. RedisInsight is fully auto-updated and not watched by Diun.
  • MariaDB/PostgreSQL/InfluxDB only consult their root/admin password env var on first init of an empty volume; changing it later has no effect on an already-initialized database. Redis re-applies REDIS_PASSWORD on every start (via --requirepass), so it must stay in sync with whatever clients already use to authenticate.