compose.yaml

name: HomeAssistant
services:
  Frigate:
    image: ghcr.io/blakeblackshear/frigate:0.17.2@sha256:d4351369984d4a9e2a49ac59736f6490856a7ea11f7790040746d21496967010
    container_name: Frigate
    restart: unless-stopped
    shm_size: 256M # https://docs.frigate.video/frigate/installation/#calculating-required-shm-size
    devices:
      - /dev/dri/renderD128 # For intel hwaccel, needs to be updated for your hardware
    ports:
      # WebRTC
      - 8555:8555/tcp
      - 8555:8555/udp
    hostname: frigate
    networks:
      - Frigate
      - MQTT
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${DOCKER_VOLUMES}/Frigate:/config
      - frigate_media:/media/frigate
      - type: tmpfs # Optional: 1GB of memory, reduces SSD/SD Card wear
        target: /tmp/cache
        tmpfs:
          size: 1000000000
    environment:
      FRIGATE_MQTT_USER: "${MQTT_USER}"
      FRIGATE_MQTT_PASSWORD: "${MQTT_PASSWORD}"
    depends_on:
      - MQTT

    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - FOWNER
      - SETUID
      - SETGID
      - NET_RAW
      - PERFMON # For Intel GPU stats

    logging:
      driver: "journald"

    deploy:
      resources:
        limits:
          cpus: 1
          memory: 2GB
          pids: 1024

  Glances:
    image: docker.io/nicolargo/glances:4.5.6@sha256:1d41d61685b620256a8189ca6761129d30c76eb2ef50f100b9dc6265d977f1a3
    container_name: Glances
    restart: unless-stopped
    pid: host
    hostname: glances
    networks:
      Glances:
    environment:
      - GLANCES_OPT=-w --disable-webui # Enable webserver mode (which is required to use the Home Assistant integration)
      - TZ=${TZ}
      - USER=${UID}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro # Allow Glances to report information about the state of Docker Containers on the host

    user: "${UID}:${GID}"
    group_add:
      - ${DOCKER_GID} # Replace this with the output from `getent group docker | cut -d: -f3` on your host machine in order to ensure Glances has read permission for Docker Socket
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    logging:
      driver: journald
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://127.0.0.1:61208/api/4/status || exit 1
      interval: 1m
      timeout: 5s
      retries: 3
      start_period: 30s

    deploy:
      resources:
        limits:
          cpus: 0.5
          memory: 256M
          pids: 50

  HomeAssistant:
    image: ghcr.io/home-assistant/home-assistant:2026.8.1@sha256:6340a3de3917a9b19368e767310a96dd090f6a19aca8aeadf87fd1145cec9682
    container_name: HomeAssistant
    restart: unless-stopped
    hostname: homeassistant
    networks:
      # macvlan network
      LAN:
        gw_priority: 1
        ipv4_address: 10.0.11.11
      # bridge networks:
      Glances:
      HomeAssistant:
      MQTT:
      Piper:
      Whisper:
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./pyscript:/config/pyscript:ro # Mount pyscript apps folder from this repository into the container
      - ./pyscript_modules:/config/pyscript_modules:ro # Mount pyscript modules folder from this repository into the container
      - ${DOCKER_VOLUMES}/HomeAssistant:/config
      # Required for Bluetooth
      - /var/run/dbus:/run/dbus:ro
    depends_on:
      - Frigate
      - Glances
      - MQTT
      - MusicAssistant
      - ntfy
      - Piper
      - Whisper

    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_RAW # Required for DHCP / Bluetooth capabilities
      - NET_ADMIN # Required for Bluetooth

    logging:
      driver: journald
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://localhost:8123/ || exit 1
      interval: 1m
      timeout: 5s
      retries: 3
      start_period: 30s

    deploy:
      resources:
        limits:
          cpus: 2
          memory: 1.5GB
          pids: 256

  MQTT:
    image: eclipse-mosquitto:2.1.2-alpine@sha256:6f8d8a947c506f8a2290ec65cd4bd2bc7cb4d43fb5f6271f861cb013e2ef9797
    container_name: MQTT
    restart: unless-stopped
    hostname: mqtt
    networks:
      - MQTT
    configs:
      - source: mqtt_config
        target: /mosquitto/config/mosquitto.conf
    volumes:
      - ${DOCKER_VOLUMES}/MQTT/mosquitto.passwd:/mosquitto/config/mosquitto.passwd:ro

    user: "${UID}:${GID}"
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    logging:
      driver: "journald"
    healthcheck:
      test: mosquitto_sub -t check -C 1 -W 4 2>&1 | grep -q 'not authorised' || exit 1
      interval: 1m
      timeout: 5s
      retries: 3
      start_period: 15s

    deploy:
      update_config:
        order: start-first
      resources:
        limits:
          cpus: 0.25
          memory: 32M
          pids: 4

  MusicAssistant:
    container_name: MusicAssistant
    image: ghcr.io/music-assistant/server:2.9.13@sha256:5ded610a2804fb7a973d2cbe390df09ceb67f0d7f603bcacd21ebaaa5a8a9b62
    restart: unless-stopped
    hostname: musicassistant
    networks:
      # macvlan network
      LAN:
        gw_priority: 1
        ipv4_address: 10.0.11.12
      # bridge network
      MusicAssistant:
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${DOCKER_VOLUMES}/MusicAssistant:/data
      - ${MUSIC_VOLUME}:/media:ro # Read only is necessary if you're mounting music from a folder within Nextcloud's internal storage in order to prevent data corruption and other issues.

    user: "${UID}:${GID}"
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    logging:
      driver: "journald"
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://localhost:8095/ || exit 1
      interval: 1m
      timeout: 5s
      retries: 3
      start_period: 15s

    deploy:
      resources:
        limits:
          cpus: 2
          memory: 1.5GB
          pids: 256

  ntfy:
    container_name: ntfy
    image: binwiederhier/ntfy:v2.27.0@sha256:f2419f405127afa868f10985c1a41449e673477cee1eb19994339a5ae8b592e7
    restart: unless-stopped
    hostname: ntfy
    networks:
      ntfy:
    init: true # needed if healthcheck is used to prevent zombie processes
    command: serve
    environment:
      NTFY_ATTACHMENT_CACHE_DIR: /var/cache/ntfy/attachments
      NTFY_ATTACHMENT_EXPIRY_DURATION: 30d
      NTFY_ATTACHMENT_TOTAL_SIZE_LIMIT: 5G
      NTFY_AUTH_FILE: /var/lib/ntfy/auth.db
      NTFY_AUTH_DEFAULT_ACCESS: deny-all
      NTFY_AUTH_USERS: "${NTFY_AUTH_USERS}"
      NTFY_AUTH_ACCESS: "${NTFY_AUTH_ACCESS}"
      NTFY_CACHE_DURATION: 30d
      NTFY_CACHE_FILE: /var/cache/ntfy/cache.db
      NTFY_BASE_URL: "${NTFY_BASE_URL}"
      NTFY_BEHIND_PROXY: true
      NTFY_ENABLE_LOGIN: true
      NTFY_REQUIRE_LOGIN: true
      NTFY_VISITOR_ATTACHMENT_TOTAL_SIZE_LIMIT: 3G
      NTFY_VISITOR_ATTACHMENT_DAILY_BANDWIDTH_LIMIT: 1G
      NTFY_VISITOR_REQUEST_LIMIT_EXEMPT_HOSTS: 172.16.0.0/16
      TZ: "${TZ}"
    volumes:
      - ${DOCKER_VOLUMES}/ntfy/cache:/var/cache/ntfy
      - ${DOCKER_VOLUMES}/ntfy/data:/var/lib/ntfy

    user: "${UID}:${GID}"
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    logging:
      driver: "journald"
    healthcheck:
      test: wget -q --tries=1 http://localhost:80/v1/health -O - | grep -Eo '"healthy"\s*:\s*true' || exit 1
      interval: 1m
      timeout: 10s
      retries: 3
      start_period: 40s

    # TODO: test and further constrain resource limits
    deploy:
      resources:
        limits:
          cpus: 1
          memory: 1GB
          pids: 512

  Piper:
    image: rhasspy/wyoming-piper:2.4.0@sha256:fd574ef5c9fe199a337a4c9f14b745d5140eeaba593153a43eb74048629562b2
    container_name: Piper
    restart: unless-stopped
    hostname: piper
    networks:
      Piper:
    command: --voice en_US-lessac-medium
    volumes:
      - ${DOCKER_VOLUMES}/Piper:/data

    user: "${UID}:${GID}"
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    logging:
      driver: journald
    healthcheck:
      test: bash -c '</dev/tcp/127.0.0.1/10200' 2>/dev/null || exit 1
      interval: 1m
      timeout: 5s
      retries: 3
      start_period: 30s

    deploy:
      resources:
        limits:
          cpus: 1
          memory: 512M
          pids: 50

  Whisper:
    image: rhasspy/wyoming-whisper:3.5.0@sha256:308b7959a925d0cca381c3e6e77292fed87822695635db39c24199d6b7a9e610
    container_name: Whisper
    restart: unless-stopped
    hostname: whisper
    networks:
      Whisper:
    command: --model tiny-int8 --language en
    environment:
      - HF_HOME=/data/cache
    volumes:
      - ${DOCKER_VOLUMES}/Whisper:/data

    user: "${UID}:${GID}"
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    logging:
      driver: journald
    healthcheck:
      test: bash -c '</dev/tcp/127.0.0.1/10300' 2>/dev/null || exit 1
      interval: 1m
      timeout: 5s
      retries: 3
      start_period: 30s

    deploy:
      resources:
        limits:
          cpus: 2
          memory: 512M
          pids: 50

networks:
  # macvlan network
  LAN:
    external: true
  # bridge networks
  Frigate:
    external: true
  Glances:
    external: true
  HomeAssistant:
    external: true
  MQTT:
    external: true
  MusicAssistant:
    external: true
  ntfy:
    external: true
  Piper:
    external: true
  Whisper:
    external: true

configs:
  mqtt_config:
    file: ./mosquitto.conf

volumes:
  frigate_media: