Mastodon homelab/nas with Cloudflare tunnel

docker-compose.yml

version: '2.4'

networks:
  http_network:
    external: true

  mastodon_network:
    external: false
    internal: true

services:
  cloudflared:
    image: cloudflare/cloudflared
    container_name: cloudflared
    command: tunnel --no-autoupdate run
    environment:
      - TUNNEL_TOKEN= # get it with create tunnel on Cloudflare
    restart: always
    networks:
      - http_network
      - mastodon_network

  # nginx that combines mastodon and mastodon-streaming
  mastodon-nginx:
    image: supersandro2000/mastodon-nginx
    container_name: mastodon-nginx
    volumes:
      - ./data:/mastodon/public/system
    environment:
      - MASTODON_SERVER=mastodon
      - MASTODON_STREAMING=mastodon
      - NGINX_DOMAIN=0.0.0.0
    networks:
      - mastodon_network
      - http_network
    ports:
      - "3000:80"
    restart: unless-stopped

  # more: https://github.com/Wonderfall/docker-mastodon/pkgs/container/mastodon
  mastodon:
    image: ghcr.io/wonderfall/mastodon:3.5
    container_name: mastodon
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    env_file: ./env.production
    depends_on:
      - mastodon-db
      - mastodon-redis
    volumes:
      - ./data:/mastodon/public/system
      - ./logs:/mastodon/log
    labels:
      - traefik.enable=true
      - traefik.http.routers.mastodon-web-secure.entrypoints=https
      - traefik.http.routers.mastodon-web-secure.rule=Host(`yourdomain.com`)
      - traefik.http.routers.mastodon-web-secure.tls=true
      - traefik.http.routers.mastodon-web-secure.middlewares=hsts-headers@file
      - traefik.http.routers.mastodon-web-secure.tls.certresolver=http
      - traefik.http.routers.mastodon-web-secure.service=mastodon-web
      - traefik.http.services.mastodon-web.loadbalancer.server.port=3000
      - traefik.http.routers.mastodon-streaming-secure.entrypoints=https
      - traefik.http.routers.mastodon-streaming-secure.rule=Host(`yourdomain.com`) && PathPrefix(`/api/v1/streaming`)
      - traefik.http.routers.mastodon-streaming-secure.tls=true
      - traefik.http.routers.mastodon-streaming-secure.middlewares=hsts-headers@file
      - traefik.http.routers.mastodon-streaming-secure.tls.certresolver=http
      - traefik.http.routers.mastodon-streaming-secure.service=mastodon-streaming
      - traefik.http.services.mastodon-streaming.loadbalancer.server.port=4000
      - traefik.docker.network=http_network
    networks:
      - mastodon_network
      - http_network

  mastodon-redis:
    image: redis:alpine
    container_name: mastodon-redis
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    volumes:
      - ./redis:/data
    networks:
      - mastodon_network

  mastodon-db:
    image: postgres:9.6-alpine
    container_name: mastodon-db
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    volumes:
      - ./db:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=mastodon
      - POSTGRES_DB=mastodon
      - POSTGRES_PASSWORD=supersecretpassword
    networks:
      - mastodon_network

Sample .env.production

https://github.com/mastodon/mastodon/blob/main/.env.production.sample