Build the box in an afternoon

# de-clouding.com kit: encrypted off-site backups with a web UI (Backrest, which runs restic)
# Point a plan at /userdata, set a schedule, choose a bucket you rent, and do the test restore.
services:
  backrest:
    image: garethgeorge/backrest:latest
    container_name: backrest
    hostname: backrest
    restart: unless-stopped
    volumes:
      - ./backrest/data:/data
      - ./backrest/config:/config
      - ./backrest/cache:/cache
      - ./backrest/tmp:/tmp
      - /home:/userdata/home:ro           # what to back up: add more lines like these
      - /srv/media:/userdata/media:ro
    environment:
      - BACKREST_DATA=/data
      - BACKREST_CONFIG=/config/config.json
      - XDG_CACHE_HOME=/cache
      - TMPDIR=/tmp
      - TZ=America/New_York
    ports:
      - "9898:9898"

# de-clouding.com kit: DNS filtering and schedules (AdGuard Home)
# Before starting on Ubuntu: free port 53 from systemd-resolved (see the page).
services:
  adguardhome:
    image: adguard/adguardhome
    container_name: adguardhome
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "3000:3000/tcp"   # setup wizard, then the admin UI (choose port 3000 in the wizard)
    volumes:
      - ./adguard/work:/opt/adguardhome/work
      - ./adguard/conf:/opt/adguardhome/conf

# de-clouding.com kit: passwords (Vaultwarden, speaks the Bitwarden protocol)
# Browser extensions need HTTPS: reach this through `tailscale serve` (see the page)
# and set DOMAIN to that https:// address before you create your account.
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      - DOMAIN=https://CHANGE-ME.your-tailnet.ts.net:8443
      - SIGNUPS_ALLOWED=true        # set to false after everyone in the house has an account
    volumes:
      - ./vaultwarden:/data
    ports:
      - "8080:80"

# de-clouding.com kit: file sync between your own devices (Syncthing, no server account)
services:
  syncthing:
    image: syncthing/syncthing
    container_name: syncthing
    hostname: box
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
    volumes:
      - ./syncthing:/var/syncthing
    ports:
      - "8384:8384"         # web UI
      - "22000:22000/tcp"   # sync
      - "22000:22000/udp"
      - "21027:21027/udp"   # discovery on your own network

# de-clouding.com kit: music, movies and TV you own (Jellyfin)
services:
  jellyfin:
    image: jellyfin/jellyfin
    container_name: jellyfin
    restart: unless-stopped
    volumes:
      - ./jellyfin/config:/config
      - ./jellyfin/cache:/cache
      - /srv/media:/media:ro        # put your library here (or change the left side)
    ports:
      - "8096:8096"
    # On an Intel mini PC, uncomment to let the GPU convert video for phones:
    # devices:
    #   - /dev/dri:/dev/dri

# de-clouding.com kit: smart home brain (Home Assistant, container flavor)
# For the long run, Home Assistant OS on its own device is the nicer experience; this gets you started.
services:
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    container_name: homeassistant
    restart: unless-stopped
    privileged: true            # lets it see a Zigbee/Z-Wave USB stick
    network_mode: host          # lets it discover devices on your network
    environment:
      - TZ=America/New_York     # change to your time zone
    volumes:
      - ./homeassistant:/config
      - /run/dbus:/run/dbus:ro

# de-clouding.com kit: the family's own Minecraft (Java) server, friends-only from the first boot
# Add a friend later:  docker compose exec minecraft rcon-cli whitelist add TheirName
services:
  minecraft:
    image: itzg/minecraft-server
    container_name: minecraft
    restart: unless-stopped
    tty: true
    stdin_open: true
    environment:
      - EULA=TRUE                 # you accept Minecraft's EULA by setting this
      - TYPE=PAPER
      - MEMORY=2G
      - ONLINE_MODE=TRUE
      - ENFORCE_WHITELIST=TRUE
      - WHITELIST=KidOne,KidTwo   # Minecraft usernames, comma-separated
      - DIFFICULTY=normal
      - MOTD=Our house. Friends only.
    volumes:
      - ./minecraft:/data
    ports:
      - "25565:25565"

# de-clouding.com kit: your own AI assistant (Ollama + Open WebUI), CPU only
# After it starts, pull a small model:  docker compose exec ollama ollama pull qwen3:4b
# (ask any assistant for a current 3–4B model name; they change monthly). Expect a few words per second on a mini PC.
services:
  ollama:
    image: ollama/ollama
    container_name: ollama
    restart: unless-stopped
    volumes:
      - ./ollama:/root/.ollama
    ports:
      - "11434:11434"
  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: open-webui
    restart: unless-stopped
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
    volumes:
      - ./open-webui:/app/backend/data
    ports:
      - "3001:8080"
    depends_on:
      - ollama