feat: add Ampache music streaming server to media stack

- Add ampache service to media/compose.yaml with PostgreSQL backend
- Create ampache database in postgres init script
- Configure Ampache environment variables in arty.yml
- Mount Music directory read-only
- Expose at ampache.media.pivoine.art via Traefik

media/compose.yaml

@@ -149,6 +149,44 @@ services:
     networks:
       - compose_network
 
+  # Ampache - Music streaming server with public sharing
+  ampache:
+    image: ${MEDIA_AMPACHE_IMAGE:-ampache/ampache:latest}
+    container_name: ${MEDIA_COMPOSE_PROJECT_NAME}_ampache
+    restart: unless-stopped
+    volumes:
+      - ampache_config:/var/www/config
+      - ampache_log:/var/log/ampache
+      - /mnt/hidrive/users/valknar/Music:/media:ro
+    environment:
+      TZ: ${TIMEZONE:-Europe/Berlin}
+      DB_HOST: ${CORE_DB_HOST}
+      DB_PORT: ${CORE_DB_PORT}
+      DB_NAME: ${MEDIA_AMPACHE_DB_NAME}
+      DB_USERNAME: ${DB_USER}
+      DB_PASSWORD: ${DB_PASSWORD}
+      AMPACHE_WEB_PATH: https://${MEDIA_AMPACHE_TRAEFIK_HOST}
+    networks:
+      - compose_network
+    labels:
+      - 'traefik.enable=${MEDIA_TRAEFIK_ENABLED}'
+      # HTTP to HTTPS redirect
+      - 'traefik.http.middlewares.${MEDIA_COMPOSE_PROJECT_NAME}-ampache-redirect-web-secure.redirectscheme.scheme=https'
+      - 'traefik.http.routers.${MEDIA_COMPOSE_PROJECT_NAME}-ampache-web.middlewares=${MEDIA_COMPOSE_PROJECT_NAME}-ampache-redirect-web-secure'
+      - 'traefik.http.routers.${MEDIA_COMPOSE_PROJECT_NAME}-ampache-web.rule=Host(`${MEDIA_AMPACHE_TRAEFIK_HOST}`)'
+      - 'traefik.http.routers.${MEDIA_COMPOSE_PROJECT_NAME}-ampache-web.entrypoints=web'
+      # HTTPS router
+      - 'traefik.http.routers.${MEDIA_COMPOSE_PROJECT_NAME}-ampache-web-secure.rule=Host(`${MEDIA_AMPACHE_TRAEFIK_HOST}`)'
+      - 'traefik.http.routers.${MEDIA_COMPOSE_PROJECT_NAME}-ampache-web-secure.tls.certresolver=resolver'
+      - 'traefik.http.routers.${MEDIA_COMPOSE_PROJECT_NAME}-ampache-web-secure.entrypoints=web-secure'
+      - 'traefik.http.middlewares.${MEDIA_COMPOSE_PROJECT_NAME}-ampache-web-secure-compress.compress=true'
+      - 'traefik.http.routers.${MEDIA_COMPOSE_PROJECT_NAME}-ampache-web-secure.middlewares=${MEDIA_COMPOSE_PROJECT_NAME}-ampache-web-secure-compress,security-headers@file'
+      # Service
+      - 'traefik.http.services.${MEDIA_COMPOSE_PROJECT_NAME}-ampache-web-secure.loadbalancer.server.port=80'
+      - 'traefik.docker.network=${NETWORK_NAME}'
+      # Watchtower
+      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
+
 volumes:
   jellyfin_config:
     name: ${MEDIA_COMPOSE_PROJECT_NAME}_jellyfin_config
@@ -160,6 +198,10 @@ volumes:
     name: ${MEDIA_COMPOSE_PROJECT_NAME}_koel_covers
   koel_search_index:
     name: ${MEDIA_COMPOSE_PROJECT_NAME}_koel_search_index
+  ampache_config:
+    name: ${MEDIA_COMPOSE_PROJECT_NAME}_ampache_config
+  ampache_log:
+    name: ${MEDIA_COMPOSE_PROJECT_NAME}_ampache_log
 
 networks:
   compose_network: