docker-compose.yml

include:
  - compose/ai.yml
  - compose/smarthome.yml
  - compose/dashboards.yml
  - compose/ebooks.yml
#  - compose/nextcloud.yml  # Uncomment to enable Nextcloud
  - compose/immich.yml     # Uncomment to enable Immich photo management
#  - compose/media.yml      # Uncomment to enable media management services

networks:
  default:
    name: smarthomestack
    driver: bridge

services:

  #Reverse proxy to route conections from each subdomain to the corresponding container
  #Automate certificate creation and renewal for all docker containers that are proxied enabling HTTPS
  traefik:
    image: traefik:v3.3.4
    container_name: traefik
    restart: always
    command:
      - "--providers.docker=true"
    labels: 
      # middleware redirect
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # global redirect to https
      - "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)"
      - "traefik.http.routers.redirs.entrypoints=web"
      - "traefik.http.routers.redirs.middlewares=redirect-to-https"
    ports:
      - 80:80
      - 8907:8080
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./config/traefik/letsencrypt:/letsencrypt
      - ./config/traefik/traefik.yml:/traefik.yml:ro
      - ./config/traefik/config.yml:/config.yml:ro
    dns:
        - 8.8.8.8
        - 1.1.1.1
    logging:
      driver: "json-file"
      options:
        max-size: "1G"

    extra_hosts:
      - "host.docker.internal:host-gateway"

  #System performance monitor
  #https://hub.docker.com/r/netdata/netdata
  netdata:
    container_name: netdata
    image: netdata/netdata
    hostname: ${hostname}
    ports:
      - 19999:19999
    cap_add:
      - SYS_PTRACE
    security_opt:
      - apparmor:unconfined
    volumes:
      - /etc/passwd:/host/etc/passwd:ro
      - /etc/group:/host/etc/group:ro
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - PGID=999
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.netdata.rule=Host(`${hostname}`) && PathPrefix(`/netdata/`)"
      - "traefik.http.middlewares.netdata-strip.stripprefix.prefixes=/netdata"
      - "traefik.http.routers.netdata.middlewares=netdata-strip"
      - "traefik.http.routers.netdata.entrypoints=websecure"
      - "traefik.http.routers.netdata.tls.certresolver=myresolver"
      - "traefik.http.services.netdata.loadbalancer.server.port=19999"
    restart: unless-stopped

  #Docker management UI
  #https://hub.docker.com/r/portainer/portainer/
  portainer:
    container_name: portainer
    image: portainer/portainer-ce
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./config/portainer:/data
    ports:
      - 9000:9000
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.rule=Host(`portainer.${hostname}`)"
      - "traefik.http.routers.portainer.entrypoints=websecure"
      - "traefik.http.routers.portainer.tls.certresolver=myresolver"
      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
    restart: always

  #DNS sinkhole, blocks ads, malware, spam
  #https://hub.docker.com/r/pihole/pihole/
  pihole:
    container_name: pihole
    domainname: ${hostname}
    hostname: ${hostname}
    image: pihole/pihole:latest   
    ports:
      - ${SERVER_IP}:53:53/tcp #Host IP needs to be set here otherwise the other containers can't resolve DNS
      - ${SERVER_IP}:53:53/udp
      # - '67:67/udp'
      - '8001:80'
      - '8002:443'
    volumes:
      - ./config/pihole/pihole:/etc/pihole
      - ./config/pihole/my-external.conf:/etc/lighttpd/external.conf
      # - ${USERDIR}/docker/pihole/pihole.log:/var/log/pihole.log #Uncomment to make logs persistent
      - ./config/pihole/dnsmasq.d:/etc/dnsmasq.d
    cap_add:
      - NET_ADMIN
    dns:
      - 127.0.0.1
      - 8.8.8.8
    environment:
      #- ServerIP=${SERVER_IP}
      - TZ=${TZ}
      - WEBPASSWORD=${piholepasswd}
      - DNS1=127.0.0.1
      - DNS2=1.1.1.1
      - VIRTUAL_HOST= ${hostname}
      - VIRTUAL_PORT= 80
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pihole.rule=Host(`${hostname}`) && PathPrefix(`/pihole`)"
      - "traefik.http.middlewares.pihole-strip.stripprefix.prefixes=/pihole"
      - "traefik.http.routers.pihole.middlewares=pihole-strip"
      - "traefik.http.routers.pihole.entrypoints=websecure"
      - "traefik.http.routers.pihole.tls.certresolver=myresolver"
      - "traefik.http.services.pihole.loadbalancer.server.port=80"
    restart: unless-stopped
  
  # Remote desktop gateway https://hub.docker.com/r/oznu/guacamole
  guacamole:
    image: oznu/guacamole
    container_name: guacamole
    volumes:
      - ./config/guacamole:/config
    ports:
      - 8079:8080
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.guacamole.rule=Host(`guacamole.${hostname}`)"
      - "traefik.http.routers.guacamole.entrypoints=websecure"
      - "traefik.http.routers.guacamole.tls.certresolver=myresolver"
      - "traefik.http.services.guacamole.loadbalancer.server.port=8080"
    restart: unless-stopped

  # Torrent client
  # https://hub.docker.com/r/linuxserver/transmission
  transmission:
    image: linuxserver/transmission
    container_name: transmission
    hostname: transmission
    environment:
      - PUID=${PID}
      - PGID=${GID}
      - TZ=${TZ}
      - TRANSMISSION_WEB_HOME=/combustion-release/
      - USER=username #optional
      - PASS=${transmission_pass} #optional
    volumes:
      - ./config/transmission:/config
      - ${external_storage}/downloads:/downloads
      - ${external_storage}/downloads:/watch
    ports:
      - 8882:9091
      - 51413:51413
      - 51413:51413/udp
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.transmission.rule=Host(`${hostname}`) && PathPrefix(`/transmission/`)"
      - "traefik.http.middlewares.transmission-strip.stripprefix.prefixes=/transmission"
      - "traefik.http.routers.transmission.middlewares=transmission-strip"
      - "traefik.http.routers.transmission.entrypoints=websecure"
      - "traefik.http.routers.transmission.tls.certresolver=myresolver"
    restart: unless-stopped

  # Watchtower to keep the containers up to date https://github.com/containrrr/watchtower
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    environment:
      - TZ=${TZ}
      #WATCHTOWER_NOTIFICATIONS: slack
      #WATCHTOWER_NOTIFICATION_SLACK_HOOK_URL: ${SLACK}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ~/.docker/config.json:/config.json:ro
    restart: unless-stopped
    command: --interval 300 --cleanup
  
  #Backup scheduler
  #https://www.duplicati.com/
  duplicati:
    image: linuxserver/duplicati
    container_name: duplicati
    environment:
      - PUID=0
      - PGID=0
      - TZ=${TZ}
    volumes:
      - ./config/duplicati:/config
      - ${external_storage}/BACKUPS/docker-home-infra:/backups
      - ./:/source
    ports:
      - 8903:8200
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.duplicati.rule=Host(`duplicati.${hostname}`)"
      - "traefik.http.routers.duplicati.entrypoints=websecure"
      - "traefik.http.routers.duplicati.tls.certresolver=myresolver"
    restart: unless-stopped

  #Kanban board
  #https://hub.docker.com/r/restyaplatform/restyaboard
  restyaboard:
    container_name: restya
    hostname: restya
    image: restyaplatform/restyaboard:dev
    depends_on:
      - postgres
    volumes:
      - ./config/restya/media:/usr/share/nginx/html/media
    ports:
      - 8904:80
    environment:
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_ADMIN_USER=postgres
      - POSTGRES_ADMIN_PASS=${postgres_pass}
      - RESTYA_DB_USERNAME=restya
      - RESTYA_DB_USERPASS=${restya_db_pass}
      - RESTYA_DB=restyaboard
      - TZ=${TZ}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.restyaboard.rule=Host(`kanban.${hostname}`)"
      - "traefik.http.routers.restyaboard.entrypoints=websecure"
      - "traefik.http.routers.restyaboard.tls.certresolver=myresolver"
    profiles:
      - DONOTDEPLOY
    restart: always

  # Mail sender, needed to send mail for registration and password recovery
  # https://hub.docker.com/r/boky/postfix for documentation
  smtp_relay:
    container_name: smtp_relay
    image: boky/postfix
    environment:
      #- RELAYHOST=CONFIGURE_ME
      - ALLOW_EMPTY_SENDER_DOMAINS=true
    ports:
      - 9998:587
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.smtp.rule=Host(`smtp.${hostname}`)"
      - "traefik.http.routers.smtp.entrypoints=websecure"
      - "traefik.http.routers.smtp.tls.certresolver=myresolver"
    restart: unless-stopped

  #Database
  postgres:
    container_name: postgres
    image: postgres:13-alpine
    ports:
      - 8909:5432
    labels:
      - "restya db"
      - "traefik.tcp.routers.postgres.rule=HostSNI(`postgres.${hostname}`)"
      - "traefik.tcp.routers.postgres.entrypoints=postgres"
    volumes: #793b443664b0ca41eed9c8dcaf1f5a532d00af8cbeb4d5da221907cd62dd927f
      - ./config/postgres-data:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=${postgres_pass}
    restart: always        
  
  #Database manager
  #https://hub.docker.com/_/adminer/
  adminer:
    container_name: adminer
    image: adminer
    ports:
      - 8905:8080
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.adminer.rule=Host(`adminer.${hostname}`)"
      - "traefik.http.routers.adminer.entrypoints=websecure"
      - "traefik.http.routers.adminer.tls.certresolver=myresolver"
    restart: unless-stopped
    
  sftp:
    image: atmoz/sftp
    volumes:
        - ./config/sftp:/home/${sftp_user}/upload
    ports:
        - "2222:22"
    command: ${sftp_user}:${sftp_pass}:${PID}
  
  crontab-ui:
    #build: .
    container_name: crontab-ui
    image: alseambusher/crontab-ui:latest
    restart: always
    ports:
      - 8989:8000
    volumes:
       - /var/run/docker.sock:/var/run/docker.sock #need to run docker in docker
       - ./config/crontab-ui/scripts:/crontab-ui/scripts 
       - ./config/crontab-ui/backups:/crontab-ui/crontabs 
#      - "/etc/cron.d:/etc/crontabs" #Uncomment this to have your cron set in the host machine
    command: sh -c "apk add docker && supervisord -c /etc/supervisord.conf"
    environment:
      - TZ=${TZ}
      - BASE_URL=/crontab
      - BASIC_AUTH_USER=admin
      - BASIC_AUTH_PWD=${crontab_pass}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.crontab-ui.rule=Host(`${hostname}`) && PathPrefix(`/crontab`)"
      - "traefik.http.routers.crontab-ui.entrypoints=websecure"
      - "traefik.http.routers.crontab-ui.tls.certresolver=myresolver"
      - "traefik.http.services.crontab-ui.loadbalancer.server.port=8000"

  speedtest:
    container_name: speedtest
    image: henrywhitaker3/speedtest-tracker
    ports:
      - 8990:80
    volumes:
      - ./config/speedtest:/config
    environment:
      - TZ=${TZ}
      - PGID=${GID}
      - PUID=${PID}
      - OOKLA_EULA_GDPR=true
      - APP_URL=https://${hostname}/speedtest
      - BASE_PATH=/speedtest
    logging:
      driver: "json-file"
      options:
        max-file: "10"
        max-size: "200k"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.speedtest.rule=Host(`${hostname}`) && PathPrefix(`/speedtest/`)"
      - "traefik.http.routers.speedtest.entrypoints=websecure"
      - "traefik.http.routers.speedtest.tls.certresolver=myresolver"
    restart: unless-stopped

  uptime-kuma:
    container_name: uptime-kuma
    image: louislam/uptime-kuma:1
    ports:
      - 8991:3001
    dns:
      - 8.8.8.8
    volumes:
      - ./config/uptime-kuma:/app/data
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - UPTIME_KUMA_DISABLE_FRAME_SAMEORIGIN=true
    restart: unless-stopped