Before you start
- Docker and its Compose plugin installed (see installing Docker on Debian or Ubuntu)
- A server with a fixed IP address on the local network
In plain words
A compose.yaml file is your server's shopping list: which applications to install, where to keep their data, which door to come in through. Writing it by hand means knowing each application's habits (its database, its folders, its variables). The tool fills in the list for you: you tick, it writes clean, commented files that fit together.
What the tool produces
| File | Contents |
|---|---|
compose.yaml |
One service per application, with its dependencies (PostgreSQL, Redis or Valkey), its volumes under the data folder and restart: unless-stopped. |
.env |
The common settings (folder, time zone, UID and GID) and 32-character passwords generated at random in your browser. |
Caddyfile |
In "domain name" mode: one subdomain per service, with a Let's Encrypt certificate or one from Caddy's internal authority. |
Two ways to reach the services:
- By IP and port: the web interfaces are published on the server's address only (
192.168.1.10:8096), not on all its network cards. Simple, suited to a local network. - By domain name, through Caddy: only Caddy publishes ports 80 and 443; the applications stay on the internal Docker network and can only be reached through it, over HTTPS. This is the mode to choose for Vaultwarden and for any access from outside.
Up-to-date images, but controlled versions
The tool uses the tags recommended by each project (often latest). For a server you don't watch closely, replace them with a specific version (jellyfin/jellyfin:10.11): updates become a choice, not a surprise. Update with docker compose pull && docker compose up -d.
Before the first start
- Check the file with
docker compose config --quiet: no output means the syntax and variables are correct. - Keep the
.envprivate (chmod 600 .env) and back it up with the data folder: without it, the databases won't open any more. - Open the necessary ports in the host's firewall. Careful: Docker bypasses ufw and firewalld for published ports, hence publishing on the server's IP. The firewall rule generator explains this point.
- Back up the data folder regularly; for PostgreSQL, a
pg_dumpis safer than copying the files while running (see Docker Compose).
What the tool doesn't do
It checks neither the disk space, nor the permissions on your media folders, nor your router's port forwarding. The generated passwords only protect you if the .env stays private. Always read a generated file before running it.
To understand each line: Docker Compose: describing your services in a file, then Building your homelab for the overall organisation.