Netwerk Masterplan

http://10.2.21.12    # SLZB-06 #1
http://10.2.21.13    # SLZB-06 #2

  zigbee2mqtt:
    image: koenkk/zigbee2mqtt:latest
    container_name: zigbee2mqtt
    restart: unless-stopped
    ports:
      - "8092:8080"
    volumes:
      - /opt/humlab/zigbee2mqtt:/app/data
    environment:
      - TZ=Europe/Amsterdam

homeassistant: true
permit_join: false
mqtt:
  base_topic: zigbee2mqtt
  server: mqtt://10.2.30.10:1883
serial:
  port: tcp://10.2.21.12:6638   # SLZB-06 #1
  adapter: zstack                # SLZB-06 coordinator
frontend:
  port: 8080
advanced:
  log_level: info

# In Home Assistant: Settings → Add-ons → Google Drive Backup
# Of via de ingebouwde backup-scheduler:
# Settings → System → Backups → Schedule: dagelijks
# Bewaar: 7 kopieën

bash <(curl -fsSL https://raw.githubusercontent.com/AlwinHummels/humlab/main/setup/humlab-setup.sh)

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl wget git htop usbutils lm-sensors \
  mesa-va-drivers libva-drm2 vainfo

sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target
# Verificatie — verwacht: "masked" voor elk target
sudo systemctl status sleep.target | grep -i masked

sudo apt install -y openssh-server
sudo systemctl enable --now ssh
# Kopieer je SSH-key vanaf je laptop (eenmalig):
# ssh-copy-id alwin@10.2.30.10
# Verificatie:
sudo systemctl status ssh | grep -i active

sudo systemctl enable docker
sudo systemctl enable containerd
# Docker start nu automatisch na herstart — zonder GUI of inlogprompt

echo "deb https://packages.cloud.google.com/apt coral-edgetpu-stable main" | \
  sudo tee /etc/apt/sources.list.d/coral-edgetpu.list
curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
sudo apt update && sudo apt install -y libedgetpu1-std
# Verificatie:
lsusb | grep -i google   # verwacht: "Global Unichip" of "Google LLC"

vainfo 2>&1 | grep VAProfile   # verwacht: H264, HEVC, AV1
ls /dev/dri/                   # verwacht: card0, renderD128

sudo apt install -y mergerfs
sudo mkdir -p /mnt/disk0 /mnt/disk1 /mnt/disk2 /mnt/fast /mnt/storage
sudo mkdir -p /mnt/storage/{media/{films,series},downloads/{complete,incomplete},backups,frigate}

sudo blkid | grep -E "nvme|sd[b-z]"

# ── HDD pool (disk0 + disk1 + disk2 via MergerFS) ─────────────
UUID=acddb75e-768e-48c5-85b2-ef59a260328a  /mnt/disk0  ext4  defaults,nofail  0  2  # humlab-hdd (sdb)
UUID=55779537-301d-452e-a0bc-b8b1bfe7ac20  /mnt/disk1  ext4  defaults,nofail  0  2  # humlab-hdd1 (sdc)
UUID=be0484f7-7fe8-47df-86c9-d674204c27ae  /mnt/disk2  ext4  defaults,nofail  0  2  # humlab-hdd2 (sda)

# ── NVMe fast storage (apart, niet in pool) ────────────────────
UUID=9ba8a674-3df6-4206-8de4-8d2719f2b082  /mnt/fast   ext4  defaults,nofail  0  2  # humlab-fast (nvme1n1)

# ── MergerFS pool (11.7TB — disk0 + disk1 + disk2) ────────────
/mnt/disk0:/mnt/disk1:/mnt/disk2  /mnt/storage  fuse.mergerfs  defaults,allow_other,use_ino,cache.files=off,moveonenospc=true,dropcacheonclose=true,category.create=pfrd,nofail  0  0

sudo mount -a && df -h /mnt/storage   # verwacht: ~11.7TB zichtbaar

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
  sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] \
  https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list
sudo apt update && sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
sudo usermod -aG docker $USER && newgrp docker

sudo mkdir -p /opt/humlab/{adguard/{work,conf},mosquitto/{config,data,log},frigate/{config,media},zigbee2mqtt,plex/{config,transcode},prowlarr,sabnzbd,sonarr,radarr,bazarr,npm/{data,letsencrypt},homarr/{configs,data,icons},uptime-kuma,kavita,mealie,immich/{upload,model-cache},syncthing,paperless/{data,media,export,consume},scrutiny,ntfy,glances,restic/{config,cache},spottarr,seerr}
sudo chown -R $USER:$USER /opt/humlab

# /opt/humlab/docker-compose.yml
# Geen "version:" field — deprecated in Docker Compose v2

services:

  adguard:
    image: adguard/adguardhome:latest
    container_name: adguard
    restart: unless-stopped
    network_mode: host
    volumes:
      - /opt/humlab/adguard/work:/opt/adguardhome/work
      - /opt/humlab/adguard/conf:/opt/adguardhome/conf

  mosquitto:
    image: eclipse-mosquitto:latest
    container_name: mosquitto
    restart: unless-stopped
    ports:
      - "1883:1883"
      - "9001:9001"
    volumes:
      - /opt/humlab/mosquitto/config:/mosquitto/config
      - /opt/humlab/mosquitto/data:/mosquitto/data
      - /opt/humlab/mosquitto/log:/mosquitto/log

  zigbee2mqtt:
    image: koenkk/zigbee2mqtt:latest
    container_name: zigbee2mqtt
    restart: unless-stopped
    ports:
      - "8092:8080"
    volumes:
      - /opt/humlab/zigbee2mqtt:/app/data
    environment:
      - TZ=Europe/Amsterdam

  frigate:
    image: ghcr.io/blakeblackshear/frigate:stable
    container_name: frigate
    privileged: true
    restart: unless-stopped
    shm_size: "256mb"
    devices:
      - /dev/dri/renderD128:/dev/dri/renderD128   # AMD VAAPI
      - /dev/bus/usb:/dev/bus/usb                 # Coral USB TPU
    volumes:
      - /opt/humlab/frigate/config:/config
      - /opt/humlab/frigate/media:/media/frigate
      - /mnt/storage/frigate:/media/storage
      - type: tmpfs
        target: /tmp/cache
        tmpfs:
          size: 1000000000
    ports:
      - "5000:5000"   # web UI
      - "8554:8554"   # RTSP
      - "8555:8555/tcp"
      - "8555:8555/udp"
    environment:
      FRIGATE_RTSP_PASSWORD: "jouw_rtsp_wachtwoord"
    labels:
      - "com.centurylinklabs.watchtower.enable=false"

  plex:
    image: lscr.io/linuxserver/plex:latest
    container_name: plex
    restart: unless-stopped
    network_mode: host
    devices:
      - /dev/dri:/dev/dri                         # AMD VAAPI hardware transcoding
    environment:
      - PUID=1000
      - PGID=1000
      - VERSION=docker
      - PLEX_CLAIM=claim-XXXXXX   # éénmalig via plex.tv/claim
    volumes:
      - /opt/humlab/plex/config:/config
      - /opt/humlab/plex/transcode:/transcode
      - /mnt/storage/media:/data/media

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    restart: unless-stopped
    ports:
      - "9696:9696"
    environment:
      - PUID=1000
      - PGID=1000
    volumes:
      - /opt/humlab/prowlarr:/config

  sabnzbd:
    image: lscr.io/linuxserver/sabnzbd:latest
    container_name: sabnzbd
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      - PUID=1000
      - PGID=1000
    volumes:
      - /opt/humlab/sabnzbd:/config
      - /mnt/storage/downloads:/downloads

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    restart: unless-stopped
    ports:
      - "8989:8989"
    environment:
      - PUID=1000
      - PGID=1000
    volumes:
      - /opt/humlab/sonarr:/config
      - /mnt/storage:/data

  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    restart: unless-stopped
    ports:
      - "7878:7878"
    environment:
      - PUID=1000
      - PGID=1000
    volumes:
      - /opt/humlab/radarr:/config
      - /mnt/storage:/data

  bazarr:
    image: lscr.io/linuxserver/bazarr:latest
    container_name: bazarr
    restart: unless-stopped
    ports:
      - "6767:6767"
    environment:
      - PUID=1000
      - PGID=1000
    volumes:
      - /opt/humlab/bazarr:/config
      - /mnt/storage/media:/data/media

  npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: npm
    restart: unless-stopped
    ports:
      - "80:80"
      - "81:81"
      - "443:443"
    volumes:
      - /opt/humlab/npm/data:/data
      - /opt/humlab/npm/letsencrypt:/etc/letsencrypt

  watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_SCHEDULE=0 0 4 * * *

  homarr:
    image: ghcr.io/ajnart/homarr:latest
    container_name: homarr
    restart: unless-stopped
    ports:
      - "7575:7575"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /opt/humlab/homarr/configs:/app/data/configs
      - /opt/humlab/homarr/data:/data
      - /opt/humlab/homarr/icons:/app/public/icons

  uptime-kuma:
    image: louislam/uptime-kuma:latest
    container_name: uptime-kuma
    restart: unless-stopped
    ports:
      - "3001:3001"
    volumes:
      - /opt/humlab/uptime-kuma:/app/data

  # ── Kavita (ebooks + comics) ──────────────────────────────────
  kavita:
    image: jvmilazz0/kavita:latest
    container_name: kavita
    restart: unless-stopped
    environment:
      - TZ=Europe/Amsterdam
    volumes:
      - /opt/humlab/kavita:/kavita/config
      - /mnt/storage/books:/books
    ports:
      - "8083:5000"

  # ── Mealie (receptenbeheer) ───────────────────────────────────
  mealie:
    image: ghcr.io/mealie-recipes/mealie:latest
    container_name: mealie
    restart: unless-stopped
    environment:
      - TZ=Europe/Amsterdam
      - PUID=1000
      - PGID=1000
      - MAX_WORKERS=1
      - WEB_CONCURRENCY=1
    volumes:
      - /opt/humlab/mealie:/app/data
    ports:
      - "9000:9000"

  # ── Immich (foto-opslag) ──────────────────────────────────────
  immich-server:
    image: ghcr.io/immich-app/immich-server:release
    container_name: immich-server
    restart: unless-stopped
    environment:
      - TZ=Europe/Amsterdam
      - DB_HOSTNAME=immich-postgres
      - DB_USERNAME=immich
      - DB_PASSWORD=${IMMICH_DB_PASS}
      - DB_DATABASE_NAME=immich
      - REDIS_HOSTNAME=immich-redis
    volumes:
      - /opt/humlab/immich/upload:/usr/src/app/upload
    ports:
      - "2283:3001"
    depends_on:
      - immich-postgres
      - immich-redis

  immich-machine-learning:
    image: ghcr.io/immich-app/immich-machine-learning:release
    container_name: immich-ml
    restart: unless-stopped
    volumes:
      - /opt/humlab/immich/model-cache:/cache

  immich-postgres:
    image: tensorchord/pgvecto-rs:pg14-v0.2.0
    container_name: immich-postgres
    restart: unless-stopped
    environment:
      - POSTGRES_USER=immich
      - POSTGRES_PASSWORD=${IMMICH_DB_PASS}
      - POSTGRES_DB=immich
    volumes:
      - /opt/humlab/immich/db:/var/lib/postgresql/data

  immich-redis:
    image: redis:6.2-alpine
    container_name: immich-redis
    restart: unless-stopped

  # ── Syncthing (lokale bestandssync) ──────────────────────────
  syncthing:
    image: lscr.io/linuxserver/syncthing:latest
    container_name: syncthing
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Amsterdam
    volumes:
      - /opt/humlab/syncthing:/config
      - /mnt/storage/syncthing:/data
    ports:
      - "8384:8384"
      - "22000:22000/tcp"
      - "22000:22000/udp"
      - "21027:21027/udp"

  # ── Paperless-ngx (documentarchief) ──────────────────────────
  paperless-broker:
    image: redis:7-alpine
    container_name: paperless-broker
    restart: unless-stopped
    volumes:
      - /opt/humlab/paperless/redis:/data

  paperless:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless
    restart: unless-stopped
    depends_on:
      - paperless-broker
    environment:
      - PAPERLESS_REDIS=redis://paperless-broker:6379
      - PAPERLESS_OCR_LANGUAGE=nld+eng
      - PAPERLESS_TIME_ZONE=Europe/Amsterdam
      - PAPERLESS_SECRET_KEY=${PAPERLESS_SECRET}
    volumes:
      - /opt/humlab/paperless/data:/usr/src/paperless/data
      - /opt/humlab/paperless/media:/usr/src/paperless/media
      - /opt/humlab/paperless/export:/usr/src/paperless/export
      - /opt/humlab/paperless/consume:/usr/src/paperless/consume
    ports:
      - "8000:8000"

  # ── Scrutiny (SMART schijfmonitoring) ────────────────────────
  scrutiny:
    image: ghcr.io/analogj/scrutiny:master-omnibus
    container_name: scrutiny
    restart: unless-stopped
    cap_add:
      - SYS_RAWIO
    privileged: true
    volumes:
      - /run/udev:/run/udev:ro
      - /opt/humlab/scrutiny:/opt/scrutiny/config
    ports:
      - "8088:8080"

  # ── Ntfy (push notificaties) ──────────────────────────────────
  ntfy:
    image: binwiederhier/ntfy:latest
    container_name: ntfy
    restart: unless-stopped
    command: serve
    environment:
      - TZ=Europe/Amsterdam
    volumes:
      - /opt/humlab/ntfy:/var/lib/ntfy
    ports:
      - "8090:80"

  # ── Glances (server monitoring) ──────────────────────────────
  glances:
    image: nicolargo/glances:latest
    container_name: glances
    restart: unless-stopped
    pid: host
    network_mode: host
    environment:
      - GLANCES_OPT=-w
      - TZ=Europe/Amsterdam
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  # ── Spottarr (Spotnet/Usenet indexer voor *Arrs) ─────────────
  spottarr:
    image: ghcr.io/spottarr/spottarr:latest
    container_name: spottarr
    restart: unless-stopped
    environment:
      - USENET__HOSTNAME=${USENET_HOST}
      - USENET__USERNAME=${USENET_USER}
      - USENET__PASSWORD=${USENET_PASS}
      - USENET__PORT=563
      - USENET__USETLS=true
      - USENET__MAXCONNECTIONS=10
      - SPOTNET__RETRIEVEAFTER=2024-01-01T00:00:00Z
      - SPOTNET__IMPORTBATCHSIZE=10000
      - SPOTNET__RETENTIONDAYS=365
      - SPOTNET__IMPORTADULTCONTENT=false
      - TZ=Europe/Amsterdam
    volumes:
      - /opt/humlab/spottarr:/data
    ports:
      - "8383:8383"
    deploy:
      resources:
        limits:
          memory: 200M

  # ── Seerr (media request management) ────────────────────────
  seerr:
    image: ghcr.io/seerr-team/seerr:latest
    container_name: seerr
    restart: unless-stopped
    environment:
      - TZ=Europe/Amsterdam
      - LOG_LEVEL=info
    volumes:
      - /opt/humlab/seerr:/app/config
    ports:
      - "5056:5055"   # 5055 is bezet door ha-failover

  # ── Sunshine (game streaming — Moonlight client op TV/telefoon) ──
  sunshine:
    image: ghcr.io/lizardbyte/sunshine:latest
    container_name: sunshine
    restart: unless-stopped
    network_mode: host
    environment:
      - TZ=Europe/Amsterdam
      - SUNSHINE_USERNAME=admin
      - SUNSHINE_PASSWORD=changeme   # wijzig dit direct via https://10.2.30.10:47990
    volumes:
      - /opt/humlab/sunshine:/config
      - /tmp/.X11-unix:/tmp/.X11-unix:rw
    devices:
      - /dev/dri:/dev/dri             # Radeon 780M GPU toegang
      - /dev/input:/dev/input
    group_add:
      - video
      - input
    cap_add:
      - SYS_ADMIN
    ipc: host

cd /opt/humlab && docker compose up -d
docker compose ps   # alles should show "running"

sudo systemctl stop systemd-resolved
sudo systemctl disable systemd-resolved
sudo rm /etc/resolv.conf
echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf
sudo chattr +i /etc/resolv.conf

sudo chattr -i /etc/resolv.conf
echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf
sudo chattr +i /etc/resolv.conf

listener 1883
allow_anonymous true
persistence true
persistence_location /mosquitto/data/
log_dest file /mosquitto/log/mosquitto.log

mosquitto_sub -h 10.2.30.10 -t "#" -v &   # subscribe op alles
mosquitto_pub -h 10.2.30.10 -t test -m "hallo"   # publish test

mqtt:
  host: 10.2.30.10
  port: 1883

detectors:
  coral:
    type: edgetpu
    device: usb

ffmpeg:
  hwaccel_args: preset-vaapi   # AMD Radeon 780M

cameras:
  voordeur:
    ffmpeg:
      inputs:
        - path: rtsp://10.2.40.10:554/stream   # G400 deurbel
          roles: [detect, record]
    detect:
      width: 1920
      height: 1080
      fps: 5
    record:
      enabled: true
      retain:
        days: 14
        mode: motion

  achtertuin:
    ffmpeg:
      inputs:
        - path: rtsp://10.2.40.11:554/stream   # outdoor camera
          roles: [detect, record]
    detect:
      width: 1920
      height: 1080
      fps: 5
    record:
      enabled: true
      retain:
        days: 7
        mode: motion

lsusb | grep -i google          # verwacht: "Google Inc. Coral USB"
docker logs frigate 2>&1 | grep -i "coral\|detector"

# In Plex Web UI (http://10.2.30.10:32400/web):
# Settings → Troubleshooting → Hardware-Accelerated Transcoding: AAN
# Settings → Transcoder → Hardware transcoding: enable

docker exec plex vainfo 2>&1 | head -20   # verwacht: VAProfileH264, HEVC

#!/bin/bash
DATUM=$(date +%Y-%m-%d)
DEST="/mnt/storage/backups/humlab-$DATUM.tar.gz"
tar -czf "$DEST" /opt/humlab --exclude /opt/humlab/plex/transcode
# Verwijder backups ouder dan 7 dagen
find /mnt/storage/backups -name "humlab-*.tar.gz" -mtime +7 -delete
echo "Backup klaar: $DEST"

chmod +x /opt/humlab/backup.sh
(crontab -l 2>/dev/null; echo "0 3 * * * /opt/humlab/backup.sh") | crontab -

alias: "Google Hub Keuken: Permanent Dashboard"
description: "Houdt HA dashboard actief — herstart elke 9 min"
trigger:
  - platform: time_pattern
    minutes: "/9"
  - platform: state
    entity_id: media_player.google_hub_keuken
    to: "idle"
  - platform: homeassistant
    event: start
condition: []
action:
  - action: cast.show_lovelace_view
    data:
      dashboard_path: dashboard-hub
      view_path: home
      entity_id: media_player.google_hub_keuken
mode: restart

action:
  - repeat:
      for_each:
        - media_player.google_hub_keuken
        - media_player.google_hub_woonkamer
      sequence:
        - action: cast.show_lovelace_view
          data:
            dashboard_path: dashboard-hub
            view_path: home
            entity_id: "{{ repeat.item }}"

alias: "Filmmodus activeren"
trigger:
  - platform: conversation
    command: "filmmodus"
action:
  - service: media_player.turn_on
    target:
      entity_id: media_player.samsung_tv
  - service: media_player.select_source
    data:
      source: "HDMI 1"
    target:
      entity_id: media_player.samsung_tv
  - service: light.turn_off
    target:
      area_id: woonkamer

alias: "Frigate: Persoon bij voordeur"
trigger:
  - platform: mqtt
    topic: frigate/voordeur/person
    payload: "1"
action:
  - service: notify.mobile_app_alwin
    data:
      title: "Beweging gedetecteerd"
      message: "Persoon gezien bij de voordeur"
      data:
        url: /lovelace/cameras
        image: /api/frigate/notifications/{{trigger.payload_json.id}}/snapshot.jpg
  - service: notify.mobile_app_renate
    data:
      title: "Beweging voordeur"
      message: "Iemand bij de voordeur"

cd /opt/humlab
docker compose up -d                          # start alle containers
docker compose down                           # stop alle containers
docker compose pull && docker compose up -d   # update alle images
docker compose ps                             # status overzicht
docker compose logs -f frigate                # live logs van één service

docker restart plex          # herstart één container
docker image prune -f        # verwijder ongebruikte images
docker stats                 # live CPU/geheugen gebruik

https://10.2.30.10:47990
# of via hostnaam:
https://sunshine.humlab.local

sudo dpkg --add-architecture i386
sudo apt update
sudo apt install -y steam-installer

# In Steam UI:
# Steam → Instellingen → Steam Play
# ✅ "Steam Play inschakelen voor alle andere titels"
# Proton versie: kies "Proton Experimental" of nieuwste stabiele versie

Application Name:  Steam Big Picture
Command:           DISPLAY=:99 steam -bigpicture
Working Directory: /home/JOUWGEBRUIKER

vainfo 2>&1 | grep -E "VAProfile|driver"
# Moet "AMD" en H264/HEVC profielen tonen
# Als het werkt: Sunshine → Configuration → Encoder → kies "vaapi"

df -h /mnt/storage && df -h /           # schijfruimte
mount | grep mergerfs                   # MergerFS status
lsusb | grep -i google                  # Coral TPU detectie
vainfo 2>&1 | grep VAProfile            # GPU VAAPI check
sensors | grep -E "Tctl|Tdie|edge"      # temperaturen
sudo blkid | grep -E "sd[b-z]"          # USB-schijf UUIDs
sudo systemctl status sleep.target      # slaapstand status