Files

T

miczekandCursor 5014d55d62 Initial homelab infrastructure

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-02-13 19:41:46 +02:00

7.1 KiB

Raw Blame History

Homelab Additions Plan: Kuma, Watchtower, Drone CI, CUPS Printer

Overview

Add four new capabilities to the homelab:

Uptime Kuma – Monitor service availability (HTTP, ping, etc.)
Watchtower – Auto-update container images
Drone CI – CI/CD for Gitea repos (server + Docker runner)
CUPS – USB printer sharing for remote printing

1. Uptime Kuma

Image: louislam/uptime-kuma:1
Port: 3001
Data: ./uptime-kuma:/app/data
Traefik: kuma.zea.lt with basic auth (same as other admin services)
Optional: Mount /var/run/docker.sock for container monitoring

2. Watchtower

Note: Watchtower is no longer maintained. Alternatives:

WUD (What's Up Docker) – Web UI, manual/controlled updates, notifications
Diun – Notifications only (you decide when to update)

If you still want Watchtower for automatic updates, it works but may not receive future fixes.

Image: containrrr/watchtower
Config: Mount /var/run/docker.sock, run with --schedule "0 0 4 * * *" (daily at 4 AM) or --interval 86400
Optional: WATCHTOWER_CLEANUP=true to remove old images
Label: Add com.centurylinklabs.watchtower.enable=false to services you want to exclude (e.g. Traefik, WireGuard)

3. Drone CI

Requires Gitea OAuth app (manual step before starting Drone):

In Gitea: Settings → Applications → Create OAuth2 Application
Application Name: Drone
Redirect URI: https://drone.zea.lt/login
Confidential Client: checked
Save and copy Client ID and Client Secret

Components:

Drone Server

Image: drone/drone:2
Database: SQLite in /data (simplest for homelab)
Env: DRONE_GITEA_*, DRONE_RPC_SECRET, DRONE_SERVER_HOST, DRONE_SERVER_PROTO
Traefik: drone.zea.lt

Drone Docker Runner

Image: drone/drone-runner-docker:1
Volume: /var/run/docker.sock
Env: DRONE_RPC_HOST=drone, DRONE_RPC_PROTO=http, DRONE_RPC_SECRET=<same as server>
Network: homelab (to reach Gitea, Registry)

Critical: DRONE_GITEA_SERVER must be reachable from the Drone server. Use https://git.zea.lt (external URL) for OAuth; internal http://gitea:3000 can cause callback issues when Gitea redirects.

4. CUPS (USB Printer via Docker)

Image: infra7/cups:latest (supports arm64 for Raspberry Pi)
Device: --device /dev/bus/usb
Ports: 631:631 (IPP + web admin)
Env: CUPSADMIN, CUPSPASSWORD (or Docker secrets)
Volume: ./cups/config:/etc/cups for persistence
Traefik: print.zea.lt for web admin (optional)

Remote printing:

Clients add printer: ipp://YOUR_SERVER_IP:631/printers/<printer-name>
Or via print.zea.lt if you proxy IPP (less common)

USB setup:

Plug in printer
Run lsusb on host to verify
Ensure Docker can access /dev/bus/usb (permissions)
Open http://YOUR_SERVER_IP:631 or https://print.zea.lt and add printer

DNS Updates

Add to pihole/etc-dnsmasq.d/02-custom.conf:

address=/kuma.zea.lt/YOUR_SERVER_IP
address=/drone.zea.lt/YOUR_SERVER_IP
address=/print.zea.lt/YOUR_SERVER_IP

Docker Compose Additions (draft)

  ### 📊 Uptime Kuma ###
  uptime-kuma:
    image: louislam/uptime-kuma:1
    container_name: uptime-kuma
    restart: always
    volumes:
      - ./uptime-kuma:/app/data
      - /var/run/docker.sock:/var/run/docker.sock  # optional: monitor containers
    networks:
      - homelab
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.kuma.rule=Host(`kuma.zea.lt`)"
      - "traefik.http.routers.kuma.entrypoints=websecure"
      - "traefik.http.routers.kuma.tls.certresolver=leresolver"
      - "traefik.http.routers.kuma.middlewares=auth"
      - "traefik.http.services.kuma.loadbalancer.server.port=3001"

  ### 🔄 Watchtower ###
  watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_SCHEDULE=0 0 4 * * *
      - WATCHTOWER_CLEANUP=true
    networks:
      - homelab

  ### 🚀 Drone CI ###
  drone-server:
    image: drone/drone:2
    container_name: drone
    restart: always
    environment:
      - DRONE_GITEA_SERVER=https://git.zea.lt
      - DRONE_GITEA_CLIENT_ID=${DRONE_GITEA_CLIENT_ID}
      - DRONE_GITEA_CLIENT_SECRET=${DRONE_GITEA_CLIENT_SECRET}
      - DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
      - DRONE_SERVER_HOST=drone.zea.lt
      - DRONE_SERVER_PROTO=https
      - DRONE_USER_CREATE=username:YOUR_GITEA_USER,admin:true  # first admin
    volumes:
      - ./drone:/data
    networks:
      - homelab
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.drone.rule=Host(`drone.zea.lt`)"
      - "traefik.http.routers.drone.entrypoints=websecure"
      - "traefik.http.routers.drone.tls.certresolver=leresolver"
      - "traefik.http.routers.drone.middlewares=auth"
      - "traefik.http.services.drone.loadbalancer.server.port=80"

  drone-runner:
    image: drone/drone-runner-docker:1
    container_name: drone-runner
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - DRONE_RPC_HOST=drone
      - DRONE_RPC_PROTO=http
      - DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
      - DRONE_RUNNER_CAPACITY=2
    networks:
      - homelab

  ### 🖨️ CUPS Printer Server ###
  cups:
    image: infra7/cups:latest
    container_name: cups
    restart: always
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    devices:
      - /dev/bus/usb:/dev/bus/usb
    environment:
      - TZ=Europe/London
      - CUPSADMIN=${CUPSADMIN:-admin}
      - CUPSPASSWORD=${CUPSPASSWORD}
    volumes:
      - ./cups/config:/etc/cups
    ports:
      - "631:631"
    networks:
      - homelab
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.print.rule=Host(`print.zea.lt`)"
      - "traefik.http.routers.print.entrypoints=websecure"
      - "traefik.http.routers.print.tls.certresolver=leresolver"
      - "traefik.http.services.print.loadbalancer.server.port=631"

.env Additions

# Drone CI (create OAuth app in Gitea first)
DRONE_GITEA_CLIENT_ID=your-client-id
DRONE_GITEA_CLIENT_SECRET=your-client-secret
DRONE_RPC_SECRET=<openssl rand -hex 16>

# CUPS printer admin
CUPSADMIN=admin
CUPSPASSWORD=your-secure-password

Implementation Order

Add DNS entries for kuma.zea.lt, drone.zea.lt, print.zea.lt
Create directories: mkdir -p uptime-kuma drone cups/config
Add services to docker-compose.yml
Add secrets to .env
Create Gitea OAuth app
docker compose up -d for new services
Plug in USB printer, access CUPS at https://print.zea.lt or :631, add printer
Open Drone at https://drone.zea.lt, activate repos
Configure Uptime Kuma monitors for your services

Watchtower Exclusions (optional)

To prevent Watchtower from updating critical services (Traefik, WireGuard), add:

labels:
  - "com.centurylinklabs.watchtower.enable=false"

To services: traefik, wireguard, optionally pihole.

7.1 KiB Raw Blame History Unescape Escape