Portainer¶

Portainer CE runs on the NAS (the local environment). It is the source of truth for every media stack's compose and env.

compose/nas/portainer.yml

# Portainer CE on the NAS (created once with `docker run`/compose, not as a stack — it manages the stacks)
services:
  portainer:
    image: portainer/portainer-ce:lts
    container_name: portainer-ce
    restart: unless-stopped
    ports:
      - "9443:9443"                     # HTTPS UI (prefer this)
      - "9000:9000"                     # HTTP UI (LAN only; keep it off the internet)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /volume1/docker/portainer-ce:/data

Create it once by hand (docker run or compose). It is not a stack.
Reach the UI on the LAN only. Never forward 9000/9443/8000 on the router.
Use an access token (My account → Access tokens) for scripts. Keep it in a password manager.
/volume1/docker/portainer-ce (the DB + compose/<id>/) is in the restic backup. Restoring it brings back every stack definition and its env secrets.

Note

Pin :lts rather than an untagged image.