Komodo - инструмент для управления, развертывания и обновления Docker контейнеров и стеков

mkdir /home/user/docker/komodo && cd /home/user/docker/komodo && nano compose.yml

services:
  postgres:
    image: ghcr.io/ferretdb/postgres-documentdb
    labels:
      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
    restart: unless-stopped
    volumes:
      - postgres-data:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: ${KOMODO_DB_USERNAME}
      POSTGRES_PASSWORD: ${KOMODO_DB_PASSWORD}
      POSTGRES_DB: postgres

  ferretdb:
    image: ghcr.io/ferretdb/ferretdb
    labels:
      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
    restart: unless-stopped
    depends_on:
      - postgres
    volumes:
      - ferretdb-state:/state
    environment:
      FERRETDB_POSTGRESQL_URL: postgres://${KOMODO_DB_USERNAME}:${KOMODO_DB_PASSWORD}@postgres:5432/postgres

  core:
    image: ghcr.io/moghtech/komodo-core:${COMPOSE_KOMODO_IMAGE_TAG:-latest}
    container_name: komodo-core
    labels:
      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
    restart: unless-stopped
    depends_on:
      - ferretdb
    ports:
      - 9120:9120
    env_file: .env
    environment:
      KOMODO_DATABASE_ADDRESS: ferretdb:27017
      KOMODO_DATABASE_USERNAME: ${KOMODO_DB_USERNAME}
      KOMODO_DATABASE_PASSWORD: ${KOMODO_DB_PASSWORD}
    volumes:
      - ${COMPOSE_KOMODO_BACKUPS_PATH}:/backups

  periphery:
    image: ghcr.io/moghtech/komodo-periphery:${COMPOSE_KOMODO_IMAGE_TAG:-latest}
    labels:
      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
    restart: unless-stopped
    user: "1000:990"
    env_file: .env
    volumes:
      ## Mount external docker socket
      - /var/run/docker.sock:/var/run/docker.sock
      ## Allow Periphery to see processes outside of container
      - /proc:/proc
      ## Specify the Periphery agent root directory.
      ## Must be the same inside and outside the container,
      ## or docker will get confused. See https://github.com/moghtech/komodo/discussions/180.
      ## Default: /etc/komodo.
      - /home/user/docker:/home/user/docker
      - /home/user/docker/komodo/ssl:/etc/komodo/ssl

volumes:
  # Postgres
  postgres-data:
  # FerretDB
  ferretdb-state:

mkdir /home/user/docker/komodo && cd /home/user/docker/komodo && nano .env

## Stick to a specific version, or use `latest`
COMPOSE_KOMODO_IMAGE_TAG=latest
## Store dated database backups on the host - https://komo.do/docs/setup/backup
COMPOSE_KOMODO_BACKUPS_PATH=/etc/komodo/backups

## DB credentials
KOMODO_DB_USERNAME=admin
KOMODO_DB_PASSWORD=admin

## Configure a secure passkey to authenticate between Core / Periphery.
KOMODO_PASSKEY=

## Set your time zone for schedules
## https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
TZ=Europe/Moscow

## Used for Oauth / Webhook url suggestion / Caddy reverse proxy.
KOMODO_HOST=https://komodo.domain.ru
## Displayed in the browser tab.
KOMODO_TITLE=Komodo
## Create a server matching this address as the "first server".
## Use `https://host.docker.internal:8120` when using systemd-managed Periphery.
KOMODO_FIRST_SERVER=https://periphery:8120
## Give the first server a custom name.
KOMODO_FIRST_SERVER_NAME=Main
## Make all buttons just double-click, rather than the full confirmation dialog.
KOMODO_DISABLE_CONFIRM_DIALOG=false

## Rate Komodo polls your servers for
## status / container status / system stats / alerting.
## Options: 1-sec, 5-sec, 15-sec, 1-min, 5-min, 15-min
## Default: 15-sec
KOMODO_MONITORING_INTERVAL="15-sec"
## Interval at which to poll Resources for any updates / automated actions.
## Options: 15-min, 1-hr, 2-hr, 6-hr, 12-hr, 1-day
## Default: 1-hr
KOMODO_RESOURCE_POLL_INTERVAL="1-hr"

## Used to auth incoming webhooks. Alt: KOMODO_WEBHOOK_SECRET_FILE
KOMODO_WEBHOOK_SECRET=a_random_secret
## Used to generate jwt. Alt: KOMODO_JWT_SECRET_FILE
KOMODO_JWT_SECRET=a_random_jwt_secret
## Time to live for jwt tokens.
## Options: 1-hr, 12-hr, 1-day, 3-day, 1-wk, 2-wk
KOMODO_JWT_TTL="1-day"

## Enable login with username + password.
KOMODO_LOCAL_AUTH=true
## Set the initial admin username created upon first launch.
## Comment out to disable initial user creation,
## and create first user using signup button.
#KOMODO_INIT_ADMIN_USERNAME=admin
## Set the initial admin password
KOMODO_INIT_ADMIN_PASSWORD=changeme
## Disable new user signups.
KOMODO_DISABLE_USER_REGISTRATION=false
## All new logins are auto enabled
KOMODO_ENABLE_NEW_USERS=false
## Disable non-admins from creating new resources.
KOMODO_DISABLE_NON_ADMIN_CREATE=false
## Allows all users to have Read level access to all resources.
KOMODO_TRANSPARENT_MODE=false

## Prettier logging with empty lines between logs
KOMODO_LOGGING_PRETTY=false
## More human readable logging of startup config (multi-line)
KOMODO_PRETTY_STARTUP_CONFIG=false

## OIDC Login
KOMODO_OIDC_ENABLED=false
## Must reachable from Komodo Core container
KOMODO_OIDC_PROVIDER=https://authentik.domain.ru/application/o/komodo/
## Change the host to one reachable be reachable by users (optional if it is the same as above).
## DO NOT include the `path` part of the URL.
# KOMODO_OIDC_REDIRECT_HOST=https://oidc.provider.external
## Your OIDC client id
KOMODO_OIDC_CLIENT_ID= # Alt: KOMODO_OIDC_CLIENT_ID_FILE
## Your OIDC client secret.
## If your provider supports PKCE flow, this can be ommitted.
KOMODO_OIDC_CLIENT_SECRET= # Alt: KOMODO_OIDC_CLIENT_SECRET_FILE
## Make usernames the full email.
## Note. This does not work for all OIDC providers.
# KOMODO_OIDC_USE_FULL_EMAIL=true
## Add additional trusted audiences for token claims verification.
## Supports comma separated list, and passing with _FILE (for compose secrets).
# KOMODO_OIDC_ADDITIONAL_AUDIENCES=abc,123 # Alt: KOMODO_OIDC_ADDITIONAL_AUDIENCES_FILE

## Github Oauth
KOMODO_GITHUB_OAUTH_ENABLED=false
# KOMODO_GITHUB_OAUTH_ID= # Alt: KOMODO_GITHUB_OAUTH_ID_FILE
# KOMODO_GITHUB_OAUTH_SECRET= # Alt: KOMODO_GITHUB_OAUTH_SECRET_FILE

## Google Oauth
KOMODO_GOOGLE_OAUTH_ENABLED=false
# KOMODO_GOOGLE_OAUTH_ID= # Alt: KOMODO_GOOGLE_OAUTH_ID_FILE
# KOMODO_GOOGLE_OAUTH_SECRET= # Alt: KOMODO_GOOGLE_OAUTH_SECRET_FILE

## Aws - Used to launch Builder instances.
KOMODO_AWS_ACCESS_KEY_ID= # Alt: KOMODO_AWS_ACCESS_KEY_ID_FILE
KOMODO_AWS_SECRET_ACCESS_KEY= # Alt: KOMODO_AWS_SECRET_ACCESS_KEY_FILE

#=------------------------------=#
#= Komodo Periphery Environment =#
#=------------------------------=#

## Specify the root directory used by Periphery agent.
PERIPHERY_ROOT_DIRECTORY=/etc/komodo
PERIPHERY_STACK_DIR=/home/user/docker

PERIPHERY_SSL_CERT_FILE=/etc/komodo/ssl/cert.pem
PERIPHERY_SSL_KEY_FILE=/etc/komodo/ssl/key.pem

## Periphery passkeys must include KOMODO_PASSKEY to authenticate.
PERIPHERY_PASSKEYS=${KOMODO_PASSKEY}

## Specify whether to disable the terminals feature
## and disallow remote shell access (inside the Periphery container).
PERIPHERY_DISABLE_TERMINALS=false

## Enable SSL using self signed certificates.
## Connect to Periphery at https://address:8120.
PERIPHERY_SSL_ENABLED=true

## If the disk size is overreporting, can use one of these to
## whitelist / blacklist the disks to filter them, whichever is easier.
## Accepts comma separated list of paths.
## Usually whitelisting just /etc/hostname gives correct size.
PERIPHERY_INCLUDE_DISK_MOUNTS=/etc/hostname
# PERIPHERY_EXCLUDE_DISK_MOUNTS=/snap,/etc/repos

## Prettier logging with empty lines between logs
PERIPHERY_LOGGING_PRETTY=false
## More human readable logging of startup config (multi-line)
PERIPHERY_PRETTY_STARTUP_CONFIG=false

sudo mkdir -p /home/user/docker/komodo/ssl
sudo openssl req -x509 -nodes -days 365 \
  -newkey rsa:2048 \
  -keyout /home/user/docker/komodo/ssl/key.pem \
  -out /home/user/docker/komodo/ssl/cert.pem \
  -subj "/CN=periphery"
sudo chown -R 1000:990 /home/user/docker/komodo/ssl

docker compose up -d

mkdir /home/user/docker/komodo-periphery && cd /home/user/docker/komodo-periphery && nano compose.yml

services:
  periphery:
    image: ghcr.io/moghtech/komodo-periphery:${COMPOSE_KOMODO_IMAGE_TAG:-latest}
    container_name: komodo-agent-${SERVER_NAME}
    # user добавляем для создания файлов под конкретным пользователем
    user: "${UID}:${DOCKER_GID}"
    env_file: .env
    labels:
      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /proc:/proc
      # Точка монтирования к директории с docker compose
      - /home/user/docker:/home/user/docker
      # Директория хранения самовыпущенных сертификатов ssl
      - /home/user/docker/komodo-periphery/ssl:/etc/komodo/ssl
    ports:
       - 8120:8120

mkdir /home/user/docker/komodo-periphery && cd /home/user/docker/komodo-periphery && nano .env

## Версия образа Komodo Periphery
COMPOSE_KOMODO_IMAGE_TAG=latest

## Имя сервера
SERVER_NAME=periphery

UID=1000
DOCKER_GID=990

## Директория, которая будет использоваться для управления репозиториями
#PERIPHERY_REPO_DIR=
## Директория, которая будет использоваться для управления стеками
PERIPHERY_STACK_DIR=/home/user/docker
## Директория, которая будет использоваться для управления билдами
#PERIPHERY_BUILD_DIR=

## Путь до SSL ключа
PERIPHERY_SSL_KEY_FILE=/etc/komodo/ssl/key.pem
## Путь до SSL сертификата
PERIPHERY_SSL_CERT_FILE=/etc/komodo/ssl/cert.pem

## Корневой каталог PERIPHERY
PERIPHERY_ROOT_DIRECTORY=/etc/komodo

## Ключ подключения из переменной KOMODO_PASSKEY komodo server
PERIPHERY_PASSKEYS=

## Включение HTTPS
PERIPHERY_SSL_ENABLED=true
## Разрешить терминалый доступ к shell
PERIPHERY_DISABLE_TERMINALS=false
## Учет точек монтирования при подсчёте дисков
PERIPHERY_INCLUDE_DISK_MOUNTS=/etc/hostname

sudo mkdir -p /home/user/docker/komodo-periphery/ssl
sudo openssl req -x509 -nodes -days 365 \
  -newkey rsa:2048 \
  -keyout /home/user/docker/komodo-periphery/ssl/key.pem \
  -out /home/user/docker/komodo-periphery/ssl/cert.pem \
  -subj "/CN=periphery"
sudo chown -R 1000:990 /home/user/docker/komodo-periphery/ssl

docker compose up -d

`-- docker
    |-- nextcloud
    |   `-- docker-compose.yml

services:
  komodo-telegram-alerter:
    container_name: komodo-telegram-alerter
    image: deniom3/komodo-telegram-alerter:latest
    restart: unless-stopped
    ports:
      - '3000:3000'
    volumes:
      - ./custom-templates:/app/templates:ro

{
  "StackAutoUpdated": {
    "OK": "✅ На сервере {server_name} обновлен образ {images} в стеке {name}",
    "INFO": "ℹ️ На сервере {server_name} выполняется обновление образа {images} в стеке {name}",
    "ERROR": "❌ Ошибка обновления образа {images} на сервере {server_name}"
  },
  "ServerCpu": {
    "WARNING": "⚠️ Высокая загрузка CPU на сервере {name} ({percentage}%)",
    "OK": "✅ Нормальная загрузка CPU на сервере {name} ({percentage}%)",
    "CRITICAL": "❌ Критическая загрузка CPU на сервере {name} ({percentage}%)"
  },
  "StackStateChange": {
    "WARNING": "⚠️ Стек {name} на сервере {server_name} перешёл из состояния {from} в {to}",
    "OK": "✅ Стек {name} на сервере {server_name} работает нормально (состояние {to})"
  },
  "ServerUnreachable": {
    "CRITICAL": "🔴 Сервер {name} недоступен: соединение отклонено ({error})",
    "OK": "🟢 Сервер {name} снова доступен"
  },
  "ServerDisk": {
    "WARNING": "⚠️ Высокое заполнение диска на сервере {name} занято {used_gb}GB из {total_gb}GB",
    "OK": "🟢 Нормальный уровень заполнения диска на сервере {name} занято {used_gb}GB из {total_gb}GB",
    "CRITICAL": "🔴 Критически мало места на сервере {name} занято {used_gb}GB из {total_gb}GB"
  },
  "ServerMem": {
    "WARNING": "⚠️ На сервере {name} большщая нагрузка RAM использовано {used_gb}GB из {total_gb}GB",
    "CRITICAL": "🔴 Критическая нагрузка RAM на сервере {name} использовано {used_gb}GB из {total_gb}GB",
    "OK": "🟢 Нормальная нагрузка RAM на сервере {name}"
  },
  "Custom": {
    "OK": "✅ {message}",
    "WARNING": "⚠️ {message}",
    "CRITICAL": "🔴 {message}"
  },
  "Test": {
    "OK": "✅ {message}",
    "WARNING": "⚠️ {message}",
    "CRITICAL": "🔴 {message}"
  }
}

docker compose up -d

http://<alerter-ip>:3000/alert?token=[[TELEGRAM_TOKEN]]&chat_id=[[TELEGRAM_CHAT_ID]]&message_thread_id=[[TELEGRAM_THREADS_ID]]

KOMODO_OIDC_ENABLED=true
KOMODO_OIDC_PROVIDER=https://authentik.company/application/o/<application_slug>/
KOMODO_OIDC_CLIENT_ID=<authentik_client_ID>
KOMODO_OIDC_CLIENT_SECRET=<authentik client secret>