docker-compose.yml

version: '3'

services:
  docker-socket-proxy:
    # https://hub.docker.com/r/tecnativa/docker-socket-proxy
    image: tecnativa/docker-socket-proxy
    container_name: docker-socket-proxy
    restart: unless-stopped
    privileged: true
    networks:
      - socket-proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      TZ: '${TZ}'
      CONTAINERS: '1'
  openvpn-client:
    # https://hub.docker.com/r/dperson/openvpn-client
    image: dperson/openvpn-client
    container_name: openvpn-client
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    networks:
      vpn-tunnel:
      traefik-internal:
        aliases:
          - 'transmission'
    volumes:
      - ${LOCAL_STORAGE}/config/openvpn-client:/vpn:Z
    environment:
      TZ: '${TZ}'
      DNS: ''
      FIREWALL: ''
      VPNPORT: '${OPENVPN_FORWARDED_PORT}'
      OTHER_ARGS: '${OPENVPN_OTHER_ARGS}'
    sysctls:
      net.ipv6.conf.all.disable_ipv6: '0'
  traefik:
    # https://hub.docker.com/_/traefik/
    image: traefik:${TRAEFIK_TAG}
    container_name: traefik
    restart: unless-stopped
    depends_on:
      - docker-socket-proxy
    networks:
      - traefik-external
      - traefik-internal
      - socket-proxy
    ports:
      - 80:80
      - 443:443
    volumes:
      - ${LOCAL_STORAGE}/config/traefik/traefik.toml:/etc/traefik/traefik.toml:Z
      - ${LOCAL_STORAGE}/config/traefik/traefik-dynamic.toml:/etc/traefik/traefik-dynamic.toml:Z
      - ${LOCAL_STORAGE}/data/traefik/acme.json:/acme.json:Z
    environment:
      TZ: '${TZ}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.traefik.rule: 'Host(`traefik.${DOMAIN_NAME}`)'
      traefik.http.routers.traefik.entrypoints: 'websecure'
      traefik.http.routers.traefik.service: 'api@internal'
      traefik.http.routers.traefik.middlewares: 'set-security-headers@file, restrict-external-access@file, traefik-auth'
      traefik.http.middlewares.traefik-auth.basicauth.users: '${TRAEFIK_API_USER}:${TRAEFIK_API_PASSWORD}'
  transmission:
    # https://hub.docker.com/r/linuxserver/transmission
    image: linuxserver/transmission
    container_name: transmission
    restart: unless-stopped
    depends_on:
      - openvpn-client
    network_mode: service:openvpn-client
    volumes:
      - ${LOCAL_STORAGE}/data/transmission:/config:Z
      - ${MOUNT_POINT}/downloads/bittorrent/downloads:/downloads:slave
      - ${MOUNT_POINT}/downloads/bittorrent/watch:/watch:slave
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
      USER: '${TRANSMISSION_USER}'
      PASS: '${TRANSMISSION_PASSWORD}'
    labels:
      traefik.enable: 'true'
      traefik.http.routers.transmission.rule: 'Host(`transmission.${DOMAIN_NAME}`)'
      traefik.http.routers.transmission.entrypoints: 'websecure'
      traefik.http.routers.transmission.middlewares: 'set-security-headers@file, restrict-external-access@file'
      traefik.http.services.transmission.loadbalancer.server.port: '9091'
  sabnzbd:
    # https://hub.docker.com/r/linuxserver/sabnzbd/
    image: linuxserver/sabnzbd
    container_name: sabnzbd
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/sabnzbd:/config:Z
      - ${MOUNT_POINT}/downloads/usenet/completed:/downloads:slave
      - ${MOUNT_POINT}/downloads/usenet/processing:/incomplete-downloads:slave
      - ${MOUNT_POINT}/downloads/usenet/watching:/watching:slave
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.sabnzbd.rule: 'Host(`sabnzbd.${DOMAIN_NAME}`)'
      traefik.http.routers.sabnzbd.entrypoints: 'websecure'
      traefik.http.routers.sabnzbd.middlewares: 'set-security-headers@file, restrict-external-access@file'
      traefik.http.services.sabnzbd.loadbalancer.server.port: '8080'
  flaresolverr:
    # https://hub.docker.com/r/flaresolverr/flaresolverr
    image: flaresolverr/flaresolverr
    container_name: flaresolverr
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    environment:
      TZ: '${TZ}'
      CAPTCHA_SOLVER: 'hcaptcha-solver'
  unpackerr:
    # https://hub.docker.com/r/golift/unpackerr
    image: golift/unpackerr
    container_name: unpackerr
    restart: unless-stopped
    networks:
      - traefik-internal
    volumes:
      - ${MOUNT_POINT}/downloads/bittorrent/downloads:/downloads/bittorrent/downloads:slave
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
      UN_SONARR_0_URL: 'http://sonarr:8989'
      UN_SONARR_0_API_KEY: '${UNPACKER_SONARR_API_KEY}'
      UN_SONARR_0_PATHS_0: '/downloads/bittorrent/downloads/tv'
      UN_SONARR_0_PROTOCOLS: 'torrent'
      UN_RADARR_0_URL: 'http://radarr:7878'
      UN_RADARR_0_API_KEY: '${UNPACKER_RADARR_API_KEY}'
      UN_RADARR_0_PATHS_0: '/downloads/bittorrent/downloads/movies'
      UN_RADARR_0_PROTOCOLS: 'torrent'
      UN_LIDARR_0_URL: 'http://lidarr:8686'
      UN_LIDARR_0_API_KEY: '${UNPACKER_LIDARR_API_KEY}'
      UN_LIDARR_0_PATHS_0: '/downloads/bittorrent/downloads/audio'
      UN_LIDARR_0_PROTOCOLS: 'torrent'
      UN_READARR_0_URL: 'http://readarr:8787'
      UN_READARR_0_API_KEY: '${UNPACKER_READARR_API_KEY}'
      UN_READARR_0_PATHS_0: '/downloads/bittorrent/downloads/books'
      UN_READARR_0_PROTOCOLS: 'torrent'
  prowlarr:
    # https://hub.docker.com/r/linuxserver/prowlarr/
    image: linuxserver/prowlarr:develop
    container_name: prowlarr
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/prowlarr:/config:Z
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.prowlarr.rule: 'Host(`prowlarr.${DOMAIN_NAME}`)'
      traefik.http.routers.prowlarr.entrypoints: 'websecure'
      traefik.http.routers.prowlarr.middlewares: 'set-security-headers@file, restrict-external-access@file'
      traefik.http.services.prowlarr.loadbalancer.server.port: '9696'
  radarr:
    # https://hub.docker.com/r/linuxserver/radarr/
    image: linuxserver/radarr
    container_name: radarr
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/radarr:/config:Z
      - ${MOUNT_POINT}/downloads:/downloads:slave
      - ${MOUNT_POINT}/medias/movies:/movies:slave
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.radarr.rule: 'Host(`radarr.${DOMAIN_NAME}`)'
      traefik.http.routers.radarr.entrypoints: 'websecure'
      traefik.http.routers.radarr.middlewares: 'set-security-headers@file, restrict-external-access@file'
      traefik.http.services.radarr.loadbalancer.server.port: '7878'
  sonarr:
    # https://hub.docker.com/r/linuxserver/sonarr/
    image: linuxserver/sonarr
    container_name: sonarr
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/sonarr:/config:Z
      - ${MOUNT_POINT}/downloads:/downloads:slave
      - ${MOUNT_POINT}/medias/series:/tv:slave
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.sonarr.rule: 'Host(`sonarr.${DOMAIN_NAME}`)'
      traefik.http.routers.sonarr.entrypoints: 'websecure'
      traefik.http.routers.sonarr.middlewares: 'set-security-headers@file, restrict-external-access@file'
      traefik.http.services.sonarr.loadbalancer.server.port: '8989'
  bazarr:
    # https://hub.docker.com/r/linuxserver/bazarr
    image: linuxserver/bazarr
    container_name: bazarr
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/bazarr:/config:Z
      - ${MOUNT_POINT}/medias/movies:/movies:slave
      - ${MOUNT_POINT}/medias/series:/tv:slave
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.bazarr.rule: 'Host(`bazarr.${DOMAIN_NAME}`)'
      traefik.http.routers.bazarr.entrypoints: 'websecure'
      traefik.http.routers.bazarr.middlewares: 'set-security-headers@file, restrict-external-access@file'
      traefik.http.services.bazarr.loadbalancer.server.port: '6767'
  lidarr:
    # https://hub.docker.com/r/linuxserver/lidarr/
    image: linuxserver/lidarr
    container_name: lidarr
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/lidarr:/config:Z
      - ${MOUNT_POINT}/downloads:/downloads:slave
      - ${MOUNT_POINT}/medias/music:/music:slave
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.lidarr.rule: 'Host(`lidarr.${DOMAIN_NAME}`)'
      traefik.http.routers.lidarr.entrypoints: 'websecure'
      traefik.http.routers.lidarr.middlewares: 'set-security-headers@file, restrict-external-access@file'
      traefik.http.services.lidarr.loadbalancer.server.port: '8686'
  readarr:
    # https://hub.docker.com/r/linuxserver/readarr/
    image: linuxserver/readarr:develop
    container_name: readarr
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/readarr:/config:Z
      - ${MOUNT_POINT}/downloads:/downloads:slave
      - ${MOUNT_POINT}/medias/books:/books:slave
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.readarr.rule: 'Host(`readarr.${DOMAIN_NAME}`)'
      traefik.http.routers.readarr.entrypoints: 'websecure'
      traefik.http.routers.readarr.middlewares: 'set-security-headers@file, restrict-external-access@file'
      traefik.http.services.readarr.loadbalancer.server.port: '8787'
  mylar:
    # https://hub.docker.com/r/linuxserver/mylar3
    image: linuxserver/mylar3
    container_name: mylar
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/mylar:/config:Z
      - ${MOUNT_POINT}/downloads:/downloads:slave
      - ${MOUNT_POINT}/medias/comics:/comics:slave
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.mylar.rule: 'Host(`mylar.${DOMAIN_NAME}`)'
      traefik.http.routers.mylar.entrypoints: 'websecure'
      traefik.http.routers.mylar.middlewares: 'set-security-headers@file, restrict-external-access@file'
      traefik.http.services.mylar.loadbalancer.server.port: '8090'
  overseerr:
    # https://hub.docker.com/r/sctx/overseerr/
    image: sctx/overseerr
    container_name: overseerr
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/overseerr:/app/config:Z
    environment:
      TZ: '${TZ}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.overseerr.rule: 'Host(`overseerr.${DOMAIN_NAME}`)'
      traefik.http.routers.overseerr.entrypoints: 'websecure'
      traefik.http.routers.overseerr.middlewares: 'set-security-headers@file'
      traefik.http.services.overseerr.loadbalancer.server.port: '5055'
  plex:
    # https://hub.docker.com/r/plexinc/pms-docker/
    image: plexinc/pms-docker:${PLEX_TAG}
    container_name: plex
    restart: unless-stopped
    networks:
      - plex-external
      - traefik-internal
    ports:
      - 32400:32400/tcp
      - 3005:3005/tcp
      - 8324:8324/tcp
      - 32469:32469/tcp
      - 1900:1900/udp
      - 32410:32410/udp
      - 32412:32412/udp
      - 32413:32413/udp
      - 32414:32414/udp
    volumes:
      - ${LOCAL_STORAGE}/data/plex:/config:Z
      - ${MOUNT_POINT}/medias/audiobooks:/data/audiobooks:slave,ro
      - ${MOUNT_POINT}/medias/audiodrama:/data/audiodrama:slave,ro
      - ${MOUNT_POINT}/medias/movies:/data/movies:slave,ro
      - ${MOUNT_POINT}/medias/music:/data/music:slave,ro
      - ${MOUNT_POINT}/medias/series:/data/series:slave,ro
    environment:
      TZ: '${TZ}'
      PLEX_UID: '${PUID}'
      PLEX_GID: '${PGID}'
      PLEX_CLAIM: '${PLEX_CLAIM}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.plex.rule: 'Host(`plex.${DOMAIN_NAME}`)'
      traefik.http.routers.plex.entrypoints: 'websecure'
      traefik.http.routers.plex.middlewares: 'set-security-headers@file'
      traefik.http.services.plex.loadbalancer.server.port: '32400'
  tautulli:
    # https://hub.docker.com/r/tautulli/tautulli/
    image: tautulli/tautulli
    container_name: tautulli
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/tautulli:/config:Z
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.tautulli.rule: 'Host(`tautulli.${DOMAIN_NAME}`)'
      traefik.http.routers.tautulli.entrypoints: 'websecure'
      traefik.http.routers.tautulli.middlewares: 'set-security-headers@file, restrict-external-access@file'
      traefik.http.services.tautulli.loadbalancer.server.port: '8181'
  calibre:
    # https://hub.docker.com/r/linuxserver/calibre
    image: linuxserver/calibre
    container_name: calibre
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/calibre:/config:Z
      - ${MOUNT_POINT}/medias/books:/books:slave
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.calibre.rule: 'Host(`calibre.${DOMAIN_NAME}`)'
      traefik.http.routers.calibre.entrypoints: 'websecure'
      traefik.http.routers.calibre.middlewares: 'set-security-headers@file, restrict-external-access@file, calibre-auth'
      traefik.http.routers.calibre.service: 'calibre'
      traefik.http.middlewares.calibre-auth.basicauth.users: '${CALIBRE_USER}:${CALIBRE_PASSWORD}'
      traefik.http.services.calibre.loadbalancer.server.port: '8080'
      traefik.http.routers.calibre-cs.rule: 'Host(`calibre-cs.${DOMAIN_NAME}`)'
      traefik.http.routers.calibre-cs.entrypoints: 'websecure'
      traefik.http.routers.calibre-cs.middlewares: 'set-security-headers@file, restrict-external-access@file'
      traefik.http.routers.calibre-cs.service: 'calibre-cs'
      traefik.http.services.calibre-cs.loadbalancer.server.port: '8081'
  calibre-web:
    # https://hub.docker.com/r/linuxserver/calibre-web
    image: linuxserver/calibre-web
    container_name: calibre-web
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/calibre-web:/config:Z
      - ${MOUNT_POINT}/medias/books:/books:slave
    environment:
      TZ: '${TZ}'
      PUID: '${PUID}'
      PGID: '${PGID}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.calibre-web.rule: 'Host(`calibre-web.${DOMAIN_NAME}`)'
      traefik.http.routers.calibre-web.entrypoints: 'websecure'
      traefik.http.routers.calibre-web.middlewares: 'set-security-headers@file'
      traefik.http.services.calibre-web.loadbalancer.server.port: '8083'
  komga:
    # https://hub.docker.com/r/gotson/komga
    image: gotson/komga
    container_name: komga
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/data/komga:/config:Z
      - ${MOUNT_POINT}/medias/comics:/books:slave
    environment:
      TZ: '${TZ}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.komga.rule: 'Host(`komga.${DOMAIN_NAME}`)'
      traefik.http.routers.komga.entrypoints: 'websecure'
      traefik.http.routers.komga.middlewares: 'set-security-headers@file'
      traefik.http.services.komga.loadbalancer.server.port: '8080'
  nextcloud_mariadb:
    # https://hub.docker.com/_/mariadb/
    image: mariadb:${NC_MARIADB_TAG}
    container_name: nextcloud_mariadb
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --skip-innodb-read-only-compressed
    networks:
      - nextcloud-internal
    volumes:
      - ${LOCAL_STORAGE}/runtime/nextcloud_mariadb:/var/lib/mysql:Z
      - ${LOCAL_STORAGE}/data/nextcloud_mariadb:/opt/dumps:Z
    environment:
      TZ: '${TZ}'
      MYSQL_ROOT_PASSWORD: '${NC_MYSQL_ROOT_PASSWORD}'
      MYSQL_PASSWORD: '${NC_MYSQL_PASSWORD}'
      MYSQL_DATABASE: '${NC_MYSQL_DATABASE}'
      MYSQL_USER: '${NC_MYSQL_USER}'
  nextcloud_redis:
    # https://hub.docker.com/_/redis/
    image: redis:${NC_REDIS_TAG}
    container_name: nextcloud_redis
    restart: unless-stopped
    command: --requirepass ${NC_REDIS_PASSWORD}
    networks:
      - nextcloud-internal
    environment:
      TZ: '${TZ}'
  # Need that container in order to be able to use cron as a background job in Nextcloud
  # This container has one process running: cron, which execute /var/www/html/cron.php every 15 minutes
  # More info here: https://github.com/nextcloud/docker/pull/220
  nextcloud_cron:
    # https://hub.docker.com/_/nextcloud/
    image: nextcloud:${NEXTCLOUD_TAG}
    container_name: nextcloud_cron
    restart: unless-stopped
    depends_on:
      - nextcloud
    networks:
      - web-egress
      - traefik-internal
      - nextcloud-internal
    entrypoint: /cron.sh
    volumes:
      - ${LOCAL_STORAGE}/data/nextcloud:/var/www/html:z
      - ${MOUNT_POINT}/cloud/data:/var/www/html/data:slave
    environment:
      TZ: '${TZ}'
  nextcloud:
    # https://hub.docker.com/_/nextcloud/
    image: nextcloud:${NEXTCLOUD_TAG}
    container_name: nextcloud
    restart: unless-stopped
    depends_on:
      - nextcloud_mariadb
      - nextcloud_redis
    networks:
      - web-egress
      - traefik-internal
      - nextcloud-internal
    volumes:
      - ${LOCAL_STORAGE}/data/nextcloud:/var/www/html:z
      - ${MOUNT_POINT}/cloud/data:/var/www/html/data:slave
    environment:
      TZ: '${TZ}'
      APACHE_DISABLE_REWRITE_IP: '1'
      TRUSTED_PROXIES: '172.16.0.0/12'
      NEXTCLOUD_TRUSTED_DOMAINS: 'cloud.${DOMAIN_NAME}'
      MYSQL_DATABASE: '${NC_MYSQL_DATABASE}'
      MYSQL_USER: '${NC_MYSQL_USER}'
      MYSQL_PASSWORD: '${NC_MYSQL_PASSWORD}'
      MYSQL_HOST: 'nextcloud_mariadb'
      REDIS_HOST_PASSWORD: '${NC_REDIS_PASSWORD}'
      REDIS_HOST: 'nextcloud_redis'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.cloud.rule: 'Host(`cloud.${DOMAIN_NAME}`)'
      traefik.http.routers.cloud.entrypoints: 'websecure'
      traefik.http.routers.cloud.middlewares: 'set-security-headers@file, nextcloud-dav-redirect'
      traefik.http.services.cloud.loadbalancer.server.port: '80'
      traefik.http.middlewares.nextcloud-dav-redirect.redirectRegex.permanent: 'true'
      traefik.http.middlewares.nextcloud-dav-redirect.redirectRegex.regex: 'https://(.*)/.well-known/(card|cal)dav'
      traefik.http.middlewares.nextcloud-dav-redirect.redirectRegex.replacement: 'https://$${1}/remote.php/dav/'
  collaboraonline:
    # https://hub.docker.com/r/collabora/code/
    image: collabora/code
    container_name: collaboraonline
    restart: unless-stopped
    networks:
      - web-egress
      - traefik-internal
    cap_add:
      - MKNOD
    environment:
      TZ: '${TZ}'
      aliasgroup1: 'https://cloud.${DOMAIN_NAME}:443'
      username: '${COLLABORA_USERNAME}'
      password: '${COLLABORA_PASSWORD}'
      dictionaries: '${COLLABORA_DICTIONARIES}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.office.rule: 'Host(`office.${DOMAIN_NAME}`)'
      traefik.http.routers.office.entrypoints: 'websecure'
      traefik.http.routers.office.middlewares: 'set-security-headers@file'
      traefik.http.services.office.loadbalancer.server.port: '9980'
      traefik.http.services.office.loadbalancer.server.scheme: 'https'
  photoprism_mariadb:
    # https://hub.docker.com/_/mariadb/
    image: mariadb:${PHOTOPRISM_MARIADB_TAG}
    container_name: photoprism_mariadb
    restart: unless-stopped
    command: --innodb-buffer-pool-size=128M --transaction-isolation=READ-COMMITTED --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci --max-connections=512 --innodb-rollback-on-timeout=OFF --innodb-lock-wait-timeout=120
    networks:
      - photoprism-internal
    volumes:
      - ${LOCAL_STORAGE}/runtime/photoprism_mariadb:/var/lib/mysql:Z
    environment:
      TZ: '${TZ}'
      MYSQL_ROOT_PASSWORD: '${PHOTOPRISM_MYSQL_ROOT_PASSWORD}'
      MYSQL_DATABASE: '${PHOTOPRISM_MYSQL_DATABASE}'
      MYSQL_USER: '${PHOTOPRISM_MYSQL_USER}'
      MYSQL_PASSWORD: '${PHOTOPRISM_MYSQL_PASSWORD}'
  photoprism:
    # https://hub.docker.com/r/photoprism/photoprism
    image: photoprism/photoprism:latest
    container_name: photoprism
    restart: unless-stopped
    working_dir: /photoprism
    depends_on:
      - photoprism_mariadb
    networks:
      - web-egress
      - traefik-internal
      - photoprism-internal
    volumes:
      - ${LOCAL_STORAGE}/data/photoprism:/photoprism/storage:Z
      - ${LOCAL_STORAGE}/runtime/photoprism/sidecar:/photoprism/sidecar:Z
      - ${LOCAL_STORAGE}/runtime/photoprism/cache:/photoprism/cache:Z
      - ${MOUNT_POINT}/cloud/data/${PHOTOPRISM_PICTURES_PATH}:/photoprism/originals/pictures:slave
      - ${MOUNT_POINT}/cloud/data/${PHOTOPRISM_VIDEOS_PATH}:/photoprism/originals/videos:slave
    environment:
      TZ: '${TZ}'
      #PHOTOPRISM_ADMIN_PASSWORD: 'initialadminpassword'
      PHOTOPRISM_SITE_URL: 'https://photos.${DOMAIN_NAME}/'
      PHOTOPRISM_DATABASE_DRIVER: 'mysql'
      PHOTOPRISM_DATABASE_SERVER: 'photoprism_mariadb:3306'
      PHOTOPRISM_DATABASE_NAME: '${PHOTOPRISM_MYSQL_DATABASE}'
      PHOTOPRISM_DATABASE_USER: '${PHOTOPRISM_MYSQL_USER}'
      PHOTOPRISM_DATABASE_PASSWORD: '${PHOTOPRISM_MYSQL_PASSWORD}'
      PHOTOPRISM_SIDECAR_PATH: '/photoprism/sidecar'
      PHOTOPRISM_CACHE_PATH: '/photoprism/cache'
      PHOTOPRISM_ORIGINALS_LIMIT: 5000
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.photos.rule: 'Host(`photos.${DOMAIN_NAME}`)'
      traefik.http.routers.photos.entrypoints: 'websecure'
      traefik.http.routers.photos.middlewares: 'set-security-headers@file'
      traefik.http.services.photos.loadbalancer.server.port: '2342'
  ttrss_postgres:
    # https://hub.docker.com/_/postgres
    image: postgres:${TTRSS_POSTGRES_TAG}
    container_name: ttrss_postgres
    restart: unless-stopped
    networks:
      - ttrss-internal
    volumes:
      - ${LOCAL_STORAGE}/runtime/ttrss_postgres:/var/lib/postgresql/data:Z
      - ${LOCAL_STORAGE}/data/ttrss_postgres:/opt/dumps:Z
    environment:
      TZ: '${TZ}'
      POSTGRES_DB: '${TTRSS_POSTGRES_DB}'
      POSTGRES_USER: '${TTRSS_POSTGRES_USER}'
      POSTGRES_PASSWORD: '${TTRSS_POSTGRES_PASSWORD}'
  ttrss_updater:
    # https://hub.docker.com/r/cthulhoo/ttrss-fpm-pgsql-static
    image: cthulhoo/ttrss-fpm-pgsql-static
    container_name: ttrss_updater
    restart: unless-stopped
    command: /opt/tt-rss/updater.sh
    depends_on:
      - ttrss_app
    networks:
      - web-egress
      - ttrss-internal
    volumes:
      - ${LOCAL_STORAGE}/data/ttrss_app:/var/www/html:z
    environment:
      TZ: '${TZ}'
      OWNER_UID: '${PUID}'
      OWNER_GID: '${PGID}'
      TTRSS_DB_TYPE: 'pgsql'
      TTRSS_DB_HOST: 'ttrss_postgres'
      TTRSS_DB_NAME: '${TTRSS_POSTGRES_DB}'
      TTRSS_DB_USER: '${TTRSS_POSTGRES_USER}'
      TTRSS_DB_PASS: '${TTRSS_POSTGRES_PASSWORD}'
      TTRSS_SELF_URL_PATH: 'https://ttrss.${DOMAIN_NAME}/tt-rss'
  ttrss_app:
    # https://hub.docker.com/r/cthulhoo/ttrss-fpm-pgsql-static
    image: cthulhoo/ttrss-fpm-pgsql-static
    container_name: ttrss_app
    restart: unless-stopped
    depends_on:
      - ttrss_postgres
    networks:
      - web-egress
      - ttrss-internal
    volumes:
      - ${LOCAL_STORAGE}/data/ttrss_app:/var/www/html:z
    environment:
      TZ: '${TZ}'
      OWNER_UID: '${PUID}'
      OWNER_GID: '${PGID}'
      TTRSS_DB_TYPE: 'pgsql'
      TTRSS_DB_HOST: 'ttrss_postgres'
      TTRSS_DB_NAME: '${TTRSS_POSTGRES_DB}'
      TTRSS_DB_USER: '${TTRSS_POSTGRES_USER}'
      TTRSS_DB_PASS: '${TTRSS_POSTGRES_PASSWORD}'
      TTRSS_SELF_URL_PATH: 'https://ttrss.${DOMAIN_NAME}/tt-rss'
  ttrss:
    # https://hub.docker.com/_/nginx
    image: nginx:${TTRSS_NGINX_TAG}
    container_name: ttrss
    restart: unless-stopped
    depends_on:
      - ttrss_app
    networks:
      - web-egress
      - traefik-internal
    volumes:
      - ${LOCAL_STORAGE}/config/ttrss/nginx.conf:/etc/nginx/nginx.conf:ro,Z
      - ${LOCAL_STORAGE}/data/ttrss_app:/var/www/html:ro,z
    environment:
      TZ: '${TZ}'
    labels:
      traefik.enable: 'true'
      traefik.docker.network: 'traefik-internal'
      traefik.http.routers.ttrss.rule: 'Host(`ttrss.${DOMAIN_NAME}`)'
      traefik.http.routers.ttrss.entrypoints: 'websecure'
      traefik.http.routers.ttrss.middlewares: 'set-security-headers@file'
      traefik.http.services.ttrss.loadbalancer.server.port: '80'

networks:
  traefik-external:
    external: true
  plex-external:
    external: true
  web-egress:
    external: true
  vpn-tunnel:
    external: true
  socket-proxy:
    external: true
  traefik-internal:
    external: true
  nextcloud-internal:
    external: true
  photoprism-internal:
    external: true
  ttrss-internal:
    external: true