docker-compose.yml

networks:
  traefik_proxy:
    external: true
    name: traefik_proxy
  nc_macvlan:
    name: nc_macvlan
    external: true
    driver_opts:
      parent: eno1
    ipam:
      config:
        - subnet: 10.10.10.0/24
          gateway: 10.10.10.1
  default:
    driver: bridge

services:

  emby:
    container_name: emby
    restart: always
    image: emby/embyserver:beta
    volumes:
      - ${USERDIR}/docker/emby:/config
      - /tank/Video:/tank/Video
      - /tank/Music:/tank/Music
      - ${USERDIR}/docker/shared:/shared
    ports:
      - "8096:8096/tcp"
    environment:
      - UID=${PUID}
      - GID=${PGID}
      - TZ=${TZ}
      - GIDLIST=${PGID},44
    networks:
      - traefik_proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.emby.rule=Host(`media.${DOMAINNAME}`)
      - traefik.http.routers.emby.entrypoints=https
      - traefik.http.routers.emby.tls=true
      - traefik.http.routers.emby.tls.options=default
      - traefik.http.routers.emby.middlewares=securityheaders
      - traefik.http.services.emby.loadbalancer.server.port=8096
      - traefik.docker.network=traefik_proxy
      
  lms:
    container_name: lms
    image: lmscommunity/lyrionmusicserver
    restart: always
    volumes:
      - ${USERDIR}/docker/lms:/config:rw
      - /tank/Music:/music:ro
      - ${USERDIR}/docker/lms:/playlist:rw
    ports:
      - 9000:9000/tcp
      - 9090:9090/tcp
      - 3483:3483/tcp
      - 3483:3483/udp
    environment:
      - HTTP_PORT=9000
      - UID=${PUID}
      - GID=${PGID}
      - TZ=${TZ}
      - EXTRA_ARGS=--advertiseaddr=${STATICIP_LMS}
    networks:
      traefik_proxy:
      nc_macvlan:
        ipv4_address: ${STATICIP_LMS}
    labels:
      - traefik.enable=true
      - traefik.http.routers.lms.rule=Host(`lms.${DOMAINNAME}`)
      - traefik.http.routers.lms.entrypoints=https
      - traefik.http.routers.lms.tls=true
      - traefik.http.routers.lms.tls.options=default
      - traefik.http.routers.lms.middlewares=auth,securityheaders
      - traefik.http.services.lms.loadbalancer.server.port=9000
      - traefik.docker.network=traefik_proxy

  traefik:
    hostname: traefik
    image: traefik:latest
    container_name: traefik
    restart: always
    domainname: ${DOMAINNAME}
    networks:
      - traefik_proxy
    ports:
      - "80:80"
      - "443:443"
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - CF_API_EMAIL=${CLOUDFLARE_EMAIL}
      - CF_API_KEY=${CLOUDFLARE_API_KEY}
    command:
      - --entrypoints.http.address=:80
      - --entrypoints.https.address=:443
      - --providers.docker=true
      - --providers.file.directory=/rules
      - --providers.docker.exposedbydefault=false
      - --global.sendAnonymousUsage=true
      - --api=true
      - --log=true
      - --log.level=INFO
      - --accessLog=true
      - --accessLog.filePath=/traefik.log
      - --accessLog.bufferingSize=1000
      - --accessLog.filters.statusCodes=400-499
      - --certificatesresolvers.cloudflare.acme.email=${NEIL_EMAIL}
      - --certificatesresolvers.cloudflare.acme.dnschallenge=true
      - --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.cloudflare.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53'
      - --certificatesresolvers.cloudflare.acme.storage=/acme.json'
      - --certificatesResolvers.cloudflare.acme.dnsChallenge.delayBeforeCheck=20
      - --certificatesresolvers.cloudflare.acme.dnschallenge.disablepropagationcheck=true
      #- '--certificatesresolvers.cloudflare.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory'
      - --entrypoints.https.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/12,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.rule=Host(`traefik.${DOMAINNAME}`)
      - traefik.http.routers.traefik.entrypoints=https
      - traefik.http.routers.traefik.tls=true
      - traefik.http.routers.traefik.tls.certresolver=cloudflare
      - traefik.http.routers.traefik.tls.options=default
      - traefik.http.routers.traefik.middlewares=auth,securityheaders
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.routers.traefik.tls.domains[0].main=${DOMAINNAME}
      - traefik.http.routers.traefik.tls.domains[0].sans=*.${DOMAINNAME}
      - traefik.http.services.traefik.loadbalancer.server.port=8080
      - traefik.http.middlewares.auth.basicauth.users=${HTTP_USERNAME}:${HTTP_PASSWORD}
      - traefik.http.middlewares.sslredirect.redirectscheme.scheme=https
      - traefik.http.middlewares.securityheaders.headers.forceSTSHeader=true
      - traefik.http.middlewares.securityheaders.headers.stsPreload=true
      - traefik.http.middlewares.securityheaders.headers.stsSeconds=315360000
      - traefik.http.middlewares.securityheaders.headers.stsIncludeSubdomains=true
      - traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)
      - traefik.http.routers.http-catchall.entrypoints=http
      - traefik.http.routers.http-catchall.middlewares=sslredirect
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - $USERDIR/docker/traefik/rules:/rules 
      - $USERDIR/docker/traefik/letsencrypt/acme.json:/acme.json
      - $USERDIR/docker/traefik/traefik.log:/traefik.log 
      - $USERDIR/docker/shared:/shared

  gluetun:
    image: qmcgaw/gluetun:v3
    container_name: gluetun
    restart: always
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - TZ=${TZ}
      - VPN_TYPE=wireguard
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_PROVIDER=protonvpn
      - VPN_SERVICE_PROVIDER=custom
      - VPN_ENDPOINT_IP=${VPN_ENDPOINT_IP}
      - VPN_ENDPOINT_PORT=${VPN_ENDPOINT_PORT}
      - WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY}
      - WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
      - WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
      # - VPN_PORT_FORWARDING_UP_COMMAND
      # - VPN_PORT_FORWARDING_DOWN_COMMAND
    volumes:
      - ${USERDIR}/docker/gluetun/config.toml:/gluetun/auth/config.toml:ro
    networks:
      - traefik_proxy

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - WEBUI_PORT=8080
      - DOCKER_MODS=ghcr.io/t-anc/gsp-qbittorent-gluetun-sync-port-mod:main
      - GSP_GTN_API_KEY=${GSP_GTN_API_KEY}
      - GSP_MINIMAL_LOGS=false
    volumes:
      - ${USERDIR}/docker/qbittorrent:/config
      - ${USERDIR}/qBittorrentDL:/downloads
    network_mode: service:gluetun
    restart: always
    labels:
      - traefik.enable=true
      - traefik.http.routers.qbittorrent.rule=Host(`qbit.${DOMAINNAME}`)
      - traefik.http.routers.qbittorrent.entrypoints=https
      - traefik.http.routers.qbittorrent.tls=true
      - traefik.http.routers.qbittorrent.tls.options=default
      - traefik.http.routers.qbittorrent.middlewares=auth,securityheaders
      - traefik.http.services.qbittorrent.loadbalancer.server.port=8080

  qbittools:
    container_name: qbittools
    image: registry.gitlab.com/alexkm/qbittools
    command: reannounce -s gluetun:8080
    restart: unless-stopped
    networks:
      - traefik_proxy

  qbit_manage:
    container_name: qbit_manage
    image: bobokun/qbit_manage
    volumes:
      - ${USERDIR}/docker/qbit_manage:/config:rw
      - ${USERDIR}/qBittorrentDL:/downloads:rw
    environment:
      - QBT_SCHEDULE=360
      - QBT_CONFIG=config.yml
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    restart: always
    networks:
      - traefik_proxy

  sonarr:
    container_name: sonarr
    image: ghcr.io/hotio/sonarr:latest
    restart: always
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/docker/sonarr:/config
      - /tank/Video:/video
      - ${USERDIR}/qBittorrentDL:/downloads
    network_mode: service:gluetun
    labels:
      - traefik.enable=true
      - traefik.http.routers.sonarr.rule=Host(`sonarr.${DOMAINNAME}`)
      - traefik.http.routers.sonarr.entrypoints=https
      - traefik.http.routers.sonarr.tls=true
      - traefik.http.routers.sonarr.tls.options=default
      - traefik.http.routers.sonarr.middlewares=securityheaders
      - traefik.http.services.sonarr.loadbalancer.server.port=8989

  radarr:
    container_name: radarr
    image: ghcr.io/hotio/radarr:latest
    restart: always
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/docker/radarr:/config
      - /tank/Video:/video
      - ${USERDIR}/qBittorrentDL:/downloads
    network_mode: service:gluetun
    labels:
      - traefik.enable=true
      - traefik.http.routers.radarr.rule=Host(`radarr.${DOMAINNAME}`)
      - traefik.http.routers.radarr.entrypoints=https
      - traefik.http.routers.radarr.tls=true
      - traefik.http.routers.radarr.tls.options=default
      - traefik.http.routers.radarr.middlewares=securityheaders
      - traefik.http.services.radarr.loadbalancer.server.port=7878

  lidarr:
    container_name: lidarr
    image: ghcr.io/hotio/lidarr:latest
    restart: always
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/docker/lidarr:/config
      - /tank/Music:/music
      - ${USERDIR}/qBittorrentDL:/downloads
    network_mode: service:gluetun
    labels:
      - traefik.enable=true
      - traefik.http.routers.lidarr.rule=Host(`lidarr.${DOMAINNAME}`)
      - traefik.http.routers.lidarr.entrypoints=https
      - traefik.http.routers.lidarr.tls=true
      - traefik.http.routers.lidarr.tls.options=default
      - traefik.http.routers.lidarr.middlewares=securityheaders
      - traefik.http.services.lidarr.loadbalancer.server.port=8686

  jackett:
    container_name: jackett
    image: ghcr.io/hotio/jackett:latest
    restart: always
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/docker/jackett:/config
    network_mode: service:gluetun
    labels:
      - traefik.enable=true
      - traefik.http.routers.jackett.rule=Host(`jackett.${DOMAINNAME}`)
      - traefik.http.routers.jackett.entrypoints=https
      - traefik.http.routers.jackett.tls=true
      - traefik.http.routers.jackett.tls.options=default
      - traefik.http.routers.jackett.middlewares=auth,securityheaders
      - traefik.http.services.jackett.loadbalancer.server.port=9117

  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    environment:
      - LOG_LEVEL=info
      - LOG_HTML=false
      - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none}
      - TZ=${TZ}
    restart: unless-stopped
    network_mode: service:gluetun

  autobrr:
    image: ghcr.io/autobrr/autobrr:latest
    container_name: autobrr
    restart: always
    volumes:
      - ${USERDIR}/docker/autobrr:/config
    network_mode: service:gluetun
    user: ${PUID}:${PGID}
    labels:
      - traefik.enable=true
      - traefik.http.routers.autobrr.rule=Host(`autobrr.${DOMAINNAME}`)
      - traefik.http.routers.autobrr.entrypoints=https
      - traefik.http.routers.autobrr.tls=true
      - traefik.http.routers.autobrr.tls.options=default
      - traefik.http.routers.autobrr.middlewares=securityheaders
      - traefik.http.services.autobrr.loadbalancer.server.port=7474

  unpackerr:
    container_name: unpackerr
    image: ghcr.io/hotio/unpackerr:latest
    restart: always
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/docker/unpackerr:/config
      - ${USERDIR}/qBittorrentDL:/downloads
    networks:
      - traefik_proxy

  portainer:
    image: portainer/portainer-ee:alpine-sts
    container_name: portainer
    restart: always
    command: -H unix:///var/run/docker.sock
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${USERDIR}/docker/portainer/data:/data
      - ${USERDIR}/docker/shared:/shared
    environment:
      - TZ=${TZ}
    networks:
      - traefik_proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.portainer.rule=Host(`portainer.${DOMAINNAME}`)
      - traefik.http.routers.portainer.entrypoints=https
      - traefik.http.routers.portainer.tls=true
      - traefik.http.routers.portainer.tls.options=default
      - traefik.http.routers.portainer.middlewares=securityheaders
      - traefik.http.services.portainer.loadbalancer.server.port=9000

  adguardhome:
    image: adguard/adguardhome
    container_name: adguardhome
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${USERDIR}/docker/adguardhome/work:/opt/adguardhome/work
      - ${USERDIR}/docker/adguardhome/conf:/opt/adguardhome/conf
    environment:
      - TZ=${TZ}
    networks:
      traefik_proxy:
      nc_macvlan:
        ipv4_address: ${STATICIP_AGH}
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik_proxy
      - traefik.http.routers.adguardhome.rule=Host(`adguard.${DOMAINNAME}`)
      - traefik.http.routers.adguardhome.entrypoints=https
      - traefik.http.routers.adguardhome.tls=true
      - traefik.http.routers.adguardhome.tls.options=default
      - traefik.http.routers.adguardhome.middlewares=securityheaders
      - traefik.http.services.adguardhome.loadbalancer.server.port=3000

  duplicati:
    image: linuxserver/duplicati
    container_name: duplicati
    restart: always
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - SETTINGS_ENCRYPTION_KEY=${DUPLICATI_ENCRYPTION_KEY}
    volumes:
      - ${USERDIR}/docker/duplicati:/config
      - ${USERDIR}:/source
    networks:
      - traefik_proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.duplicati.rule=Host(`duplicati.${DOMAINNAME}`)
      - traefik.http.routers.duplicati.entrypoints=https
      - traefik.http.routers.duplicati.tls=true
      - traefik.http.routers.duplicati.tls.options=default
      - traefik.http.routers.duplicati.middlewares=securityheaders
      - traefik.http.services.duplicati.loadbalancer.server.port=8200

  cloudflare-ddns:
    container_name: cloudflare-ddns
    restart: always
    image: joshuaavalon/cloudflare-ddns
    environment:
      - ZONE=${DOMAINNAME}
      - HOST=${DOMAINNAME}
      - EMAIL=${CLOUDFLARE_EMAIL}
      - API=${CLOUDFLARE_API_KEY}

  homeassistant:
    container_name: homeassistant
    image: ghcr.io/home-assistant/home-assistant:stable
    volumes:
      - ${USERDIR}/docker/homeassistant:/config
      - /etc/localtime:/etc/localtime:ro
    restart: unless-stopped
    privileged: true
    networks:
      traefik_proxy:
      nc_macvlan:
        ipv4_address: ${STATICIP_HA}
    labels:
      - traefik.enable=true
      - traefik.http.routers.homeassistant.rule=Host(`homeassistant.${DOMAINNAME}`)
      - traefik.http.routers.homeassistant.entrypoints=https
      - traefik.http.routers.homeassistant.tls=true
      - traefik.http.routers.homeassistant.tls.options=default
      - traefik.http.routers.homeassistant.middlewares=securityheaders
      - traefik.http.services.homeassistant.loadbalancer.server.port=8123

  plex:
    container_name: plex
    image: linuxserver/plex:latest
    volumes:
      - ${USERDIR}/docker/plex:/config
      - /tank/Video:/tank/Video
      - /tank/Music:/tank/Music
      - ${USERDIR}/docker/shared:/shared
    restart: unless-stopped
    environment:
      - TZ=${TZ}
      - PLEX_CLAIM=claim-CNvu3qr4Yebz-s2vVwTy
    devices:
       - /dev/dri:/dev/dri
    networks:
      traefik_proxy:
      nc_macvlan:
        ipv4_address: ${STATICIP_PLEX}
    labels:
      - traefik.enable=true
      - traefik.http.routers.plex.rule=Host(`plex.${DOMAINNAME}`)
      - traefik.http.routers.plex.entrypoints=https
      - traefik.http.routers.plex.tls=true
      - traefik.http.routers.plex.tls.options=default
      - traefik.http.routers.plex.middlewares=securityheaders
      - traefik.http.services.plex.loadbalancer.server.port=32400