2025-04-24 harmonisations - master branch - PR 1 of 2

This PR spans a number of service definitions. The underlying principles are:

1. To adopt IOTstack conventions where those have been omitted; and

2. To make old-menu and master branch service definitions as *similar*
   as is possible while still having regard to one of the original key
   differences that old-menu service definitions may use environment
   files in the `services` directory while master branch uses inline
   variables.

The word "externalise" is used to mean to make the variable settable
via the `.env` file.

Changes:

* chronograf

	- has a dependency on kapacitor - should be explicit

* deconz

	- externalise `devices:` and `DECONZ_VNC_PASSWORD`

* duckdns

	- externalise token and sub-domains

* grafana, homebridge, python, tasmoadmin, transmission

	- externalise TZ

* influxdb

	- although commented-out, externalise DBA username and password.

* influxdb2

	- externalise DBA username and password
	- externalise organisation and default bucket

* kapacitor

	- externalise and define default DBA username
	- externalise password (no default)
	- externalise hostname

* mariadb, nextcloud

	- externalise default username and password
	- externalise default root password
	- externalise default database name

* nginx

	- externalise admin email and password

* openhab

	- switch from mapping `/etc/localtime` and `/etc/timezone` to
	  proper support for TZ. The former is not supported by trixie.

* postgres, timescaledb

	- externalise password (no default)

* python-matter-server

	- convention for documenting ports-in-use for host mode container
	  is to use `x-ports:` clause. Then, if the container *can* run in
	  non-host mode, it is simpler to move the `x-` prefix to the
	  `hosts:` clause than (un)comment multiple lines.

Signed-off-by: Phill Kelley <34226495+Paraphraser@users.noreply.github.com>

Author: Paraphraser

.templates/chronograf/service.yml

@@ -18,4 +18,4 @@ chronograf:
     - ./volumes/chronograf:/var/lib/chronograf
   depends_on:
     - influxdb
-    # - kapacitor
+    - kapacitor

.templates/deconz/service.yml

@@ -8,11 +8,11 @@ deconz:
     - "5901:5900"
   volumes:
     - ./volumes/deconz:/opt/deCONZ
-  devices:  # This list is replaced during the build process. Modify the list in "build_settings.yml" to change it.
-    - /dev/null
+  devices:
+    - "${DECONZ_DEVICE_PATH:?eg echo DECONZ_DEVICE_PATH=dev/ttyUSB0 >>~/IOTstack/.env}:/dev/ttyUSB0"
   environment:
     - DECONZ_VNC_MODE=1
-    - DECONZ_VNC_PASSWORD=%randomPassword%
+    - DECONZ_VNC_PASSWORD=${DECONZ_VNC_PASSWORD:-%randomPassword%}
     - DEBUG_INFO=1
     - DEBUG_APS=0
     - DEBUG_ZCL=0

.templates/duckdns/service.yml

@@ -7,8 +7,10 @@ duckdns:
     PUID: 1000
     PGID: 1000
     # Required variables, define here on in docker-compose.override.yml
-    #  TOKEN: token from duckdns.org
-    #  SUBDOMAINS: your domain added to duckdns.org (without .duckdns.org)
-    # Optional
-    #  PRIVATE_SUBDOMAINS: your domain added to duckdns.org (without .duckdns.org)
+    # token from duckdns.org
+    TOKEN: ${DUCKDNS_TOKEN:?eg echo DUCKDNS_TOKEN=token >>~/IOTstack/.env}
+    # your domain added to duckdns.org (without .duckdns.org)
+    SUBDOMAINS: ${DUCKDNS_SUBDOMAINS:?eg echo DUCKDNS_SUBDOMAINS=subdomains >>~/IOTstack/.env}
+    # optional your private domain added to duckdns.org (without .duckdns.org)
+    # PRIVATE_SUBDOMAINS: ${DUCKDNS_PRIVATE_SUBDOMAINS:-}
 

.templates/grafana/service.yml

@@ -6,7 +6,7 @@ grafana:
   ports:
     - "3000:3000"
   environment:
-    - TZ=Etc/UTC
+    - TZ=${TZ:-Etc/UTC}
     - GF_PATHS_DATA=/var/lib/grafana
     - GF_PATHS_LOGS=/var/log/grafana
   volumes:

.templates/homebridge/service.yml

@@ -3,7 +3,7 @@ homebridge:
   image: homebridge/homebridge:latest
   restart: unless-stopped
   environment:
-    - TZ=Etc/UTC
+    - TZ=${TZ:-Etc/UTC}
     - PGID=1000
     - PUID=1000
     - HOMEBRIDGE_CONFIG_UI=1

.templates/influxdb/service.yml

@@ -6,16 +6,16 @@ influxdb:
   ports:
     - "8086:8086"
   environment:
-    - TZ=Etc/UTC
+    - TZ=${TZ:-Etc/UTC}
     - INFLUXDB_HTTP_FLUX_ENABLED=false
     - INFLUXDB_REPORTING_DISABLED=false
     - INFLUXDB_HTTP_AUTH_ENABLED=false
     - INFLUXDB_MONITOR_STORE_ENABLED=FALSE
-  # - INFLUX_USERNAME=dba
-  # - INFLUX_PASSWORD=supremo
-  # - INFLUXDB_UDP_ENABLED=false
-  # - INFLUXDB_UDP_BIND_ADDRESS=0.0.0.0:8086
-  # - INFLUXDB_UDP_DATABASE=udp
+  # - INFLUX_USERNAME: ${INFLUXDB1_USERNAME:-dba}
+  # - INFLUX_PASSWORD: ${INFLUXDB1_PASSWORD:?eg echo INFLUXDB1_PASSWORD=supremo >>~/IOTstack/.env}
+  # - INFLUXDB_UDP_ENABLED: false
+  # - INFLUXDB_UDP_BIND_ADDRESS: 0.0.0.0:8086
+  # - INFLUXDB_UDP_DATABASE: udp
   volumes:
     - ./volumes/influxdb/data:/var/lib/influxdb
     - ./backups/influxdb/db:/var/lib/influxdb/backup

.templates/influxdb2/service.yml

@@ -3,11 +3,11 @@ influxdb2:
   image: "influxdb:latest"
   restart: unless-stopped
   environment:
-    - TZ=Etc/UTC
-    - DOCKER_INFLUXDB_INIT_USERNAME=me
-    - DOCKER_INFLUXDB_INIT_PASSWORD=mypassword
-    - DOCKER_INFLUXDB_INIT_ORG=myorg
-    - DOCKER_INFLUXDB_INIT_BUCKET=mybucket
+    - TZ=${TZ:-Etc/UTC}
+    - DOCKER_INFLUXDB_INIT_USERNAME=${INFLUXDB2_USERNAME:-me}
+    - DOCKER_INFLUXDB_INIT_PASSWORD=${INFLUXDB2_PASSWORD:?eg echo INFLUXDB2_PASSWORD=mypassword >>~/IOTstack/.env}
+    - DOCKER_INFLUXDB_INIT_ORG=${INFLUXDB2_ORG:-myorg}
+    - DOCKER_INFLUXDB_INIT_BUCKET=${INFLUXDB2_BUCKET:-mybucket}
     - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN=my-super-secret-auth-token
     - DOCKER_INFLUXDB_INIT_MODE=setup
   # - DOCKER_INFLUXDB_INIT_MODE=upgrade

.templates/kapacitor/service.yml

@@ -6,9 +6,9 @@ kapacitor:
     - TZ=${TZ:-Etc/UTC}
     # see https://docs.influxdata.com/kapacitor/v1.6/administration/configuration/#kapacitor-environment-variables
     - KAPACITOR_INFLUXDB_0_URLS_0=http://influxdb:8086
-    # - KAPACITOR_INFLUXDB_USERNAME=
-    # - KAPACITOR_INFLUXDB_PASSWORD=
-    # - KAPACITOR_HOSTNAME=kapacitor
+    # - KAPACITOR_INFLUXDB_USERNAME=${INFLUXDB1_USERNAME:-dba}
+    # - KAPACITOR_INFLUXDB_PASSWORD=${INFLUXDB1_PASSWORD}
+    # - KAPACITOR_HOSTNAME=${KAPACITOR_HOSTNAME:-kapacitor}
     # - KAPACITOR_LOGGING_LEVEL=INFO
     # - KAPACITOR_REPORTING_ENABLED=false
   ports:

.templates/mariadb/service.yml

@@ -5,10 +5,10 @@ mariadb:
     - TZ=${TZ:-Etc/UTC}
     - PUID=1000
     - PGID=1000
-    - MYSQL_ROOT_PASSWORD=%randomAdminPassword%
-    - MYSQL_DATABASE=default
-    - MYSQL_USER=mariadbuser
-    - MYSQL_PASSWORD=%randomPassword%
+    - MYSQL_ROOT_PASSWORD=${MARIADB_ROOT_PASSWORD:?eg echo MARIADB_ROOT_PASSWORD=%randomAdminPassword% >>~/IOTstack/.env}
+    - MYSQL_DATABASE=${MARIADB_DATABASE:-default}
+    - MYSQL_USER=${MARIADB_USER:-mariadbuser}
+    - MYSQL_PASSWORD=${MARIADB_USER_PASSWORD:?eg echo MARIADB_USER_PASSWORD=%randomPassword% >>~/IOTstack/.env}
   volumes:
     - ./volumes/mariadb/config:/config
     - ./volumes/mariadb/db_backup:/backup

.templates/nextcloud/service.yml

@@ -5,9 +5,9 @@ nextcloud:
   environment:
     - TZ=${TZ:-Etc/UTC}
     - MYSQL_HOST=nextcloud_db
-    - MYSQL_PASSWORD=%randomMySqlPassword%
-    - MYSQL_DATABASE=nextcloud
-    - MYSQL_USER=nextcloud
+    - MYSQL_PASSWORD=${NEXTCLOUD_DB_USER_PASSWORD:?eg echo NEXTCLOUD_DB_USER_PASSWORD=%randomMySqlPassword% >>~/IOTstack/.env}
+    - MYSQL_DATABASE=${NEXTCLOUD_DB_NAME:-nextcloud}
+    - MYSQL_USER=${NEXTCLOUD_DB_USER:-nextcloud}
   ports:
     - "9321:80"
     - "9343:443"
@@ -27,10 +27,10 @@ nextcloud_db:
     - TZ=${TZ:-Etc/UTC}
     - PUID=1000
     - PGID=1000
-    - MYSQL_ROOT_PASSWORD=%randomPassword%
-    - MYSQL_PASSWORD=%randomMySqlPassword%
-    - MYSQL_DATABASE=nextcloud
-    - MYSQL_USER=nextcloud
+    - MYSQL_ROOT_PASSWORD=${NEXTCLOUD_DB_ROOT_PASSWORD:?eg echo NEXTCLOUD_DB_ROOT_PASSWORD=%randomPassword% >>~/IOTstack/.env}
+    - MYSQL_PASSWORD=${NEXTCLOUD_DB_USER_PASSWORD:?eg echo NEXTCLOUD_DB_USER_PASSWORD=%randomMySqlPassword% >>~/IOTstack/.env}
+    - MYSQL_DATABASE=${NEXTCLOUD_DB_NAME:-nextcloud}
+    - MYSQL_USER=${NEXTCLOUD_DB_USER:-nextcloud}
   volumes:
     - ./volumes/nextcloud/db:/config
     - ./volumes/nextcloud/db_backup:/backup