docker-compose.yml

services:
  mariadb:
    restart: unless-stopped
    image: mariadb:latest
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --character-set-server=utf8
    volumes:
      - ./mariadb-storage:/var/lib/mysql
    networks:
      backend:
        ipv4_address: 172.1.0.2
    ports:
      - 3306:3306
    secrets:
      - db-root-password
      - db-password
      - db-user
      - db-database
    environment:
      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db-root-password
      - MYSQL_PASSWORD_FILE=/run/secrets/db-password
      - MYSQL_USER_FILE=/run/secrets/db-user
      - MYSQL_DATABASE_FILE=/run/secrets/db-database

  nextcloud:
    restart: unless-stopped
    image: nextcloud:latest
    volumes:
      - ./nextcloud-storage:/var/www/html
    networks:
      frontend:
      backend:
        ipv4_address: 172.1.0.3
    secrets:
      - db-password
      - db-user
      - db-database
      - db-host
      - redis-password
    environment:
      - REDIS_HOST=172.1.0.8
      - REDIS_HOST_PORT=6379
      - REDIS_HOST_PASSWORD_FILE=/run/secrets/redis-password
    depends_on:
      - mariadb
      - redis

  gitlab:
    restart: unless-stopped
    image: gitlab/gitlab-ce:latest
    volumes:
      - ./gitlab-storage/config:/etc/gitlab
      - ./gitlab-storage/logs:/var/log/gitlab
      - ./gitlab-storage/data:/var/opt/gitlab
    networks:
      frontend:
      backend:
        ipv4_address: 172.1.0.4
    ports:
      - "2222:22"

  homepage:
    restart: unless-stopped
    image: ghcr.io/gethomepage/homepage:latest
    volumes:
      - ./homepage-storage:/app/config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      frontend:
      backend:
        ipv4_address: 172.1.0.5

  nginxproxymanager:
    restart: unless-stopped
    image: jc21/nginx-proxy-manager:latest
    volumes:
      - ./nginxproxymanager-storage:/data
      - ./letsencrypt-storage:/etc/letsencrypt
    networks:
      frontend:
      backend:
        ipv4_address: 172.1.0.6
    ports:
      - 80:80
      - 81:81
      - 443:443

  portainer:
    restart: unless-stopped
    image: portainer/portainer-ce:alpine
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./portainer-storage:/data
    networks:
      backend:
        ipv4_address: 172.1.0.7

  gitlab-runner:
    restart: unless-stopped
    image: gitlab/gitlab-runner:latest
    networks:
      frontend:
    volumes:
      - ./gitlab-storage/runner-config:/etc/gitlab-runner
      - ./gitlab-storage/runner-cache:/home/gitlab-runner
      - /var/run/docker.sock:/var/run/docker.sock

  redis:
    restart: unless-stopped
    image: redis:latest
    command:
      [
        "bash",
        "-c",
        ' docker-entrypoint.sh --requirepass "$$(cat $$REDIS_PASSWORD_FILE)" '
      ]
    volumes:
      - ./redis-storage/data:/data
      - ./redis-storage/config:/usr/local/etc/redis/
    networks:
      backend:
        ipv4_address: 172.1.0.8
    ports:
      - 6379:6379
    secrets:
      - redis-password
    environment:
      - REDIS_PASSWORD_FILE=/run/secrets/redis-password

  syncthing:
    restart: unless-stopped
    image: syncthing/syncthing:latest
    volumes:
      - './syncthing-storage:/var/syncthing'
    network_mode: host
    #ports:
#  - 8384:8384 # Web UI
#     - 22000:22000/tcp # TCP file transfers
#     - 22000:22000/udp # QUIC file transfers
#     - 21027:21027/udp # Receive local discovery broadcasts

  open-webui:
    restart: unless-stopped
    image: ghcr.io/open-webui/open-webui:main
    volumes:
      - './open-webui-storage:/app/backend/data'
    networks:
      frontend:
      backend:
        ipv4_address: 172.1.0.9
     
  ollama:
    restart: unless-stopped
    image: ollama/ollama
    volumes:
      - ./ollama-storage:/root/.ollama
    networks:
      frontend:
      backend:
        ipv4_address: 172.1.0.10
    ports:
      - 11434:11434

  pihole:
    restart: unless-stopped
    image: pihole/pihole:latest
    environment:
      TZ: 'Europe/Amsterdam'
      WEBPASSWORD_FILE: /run/secrets/pihole-password
    volumes:
      - './pihole-storage/etc-pihole:/etc/pihole'
      - './pihole-storage/etc-dnsmasq.d:/etc/dnsmasq.d'
      #   https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
      # cap_add:
      # - NET_ADMIN # Required if you are using Pi-hole as your DHCP server, else not needed
    networks:
      frontend:
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      # - "67:67/udp" # Only required if you are using Pi-hole as your DHCP server
      # - "8080:80/tcp"
    labels:
      - "com.centurylinklabs.watchtower.enable=false"

  watchtower:
    restart: unless-stopped
    image: containrrr/watchtower:latest
    environment:
      - TZ=Europe/Amsterdam
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_SCHEDULE=0 0 12 * * *
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      frontend:


networks:
  frontend:
    driver: bridge

  backend:
    attachable: true
    internal: true
    ipam:
      config:
        - subnet: 172.1.0.0/24
          gateway: 172.1.0.1

secrets:
  db-root-password:
    file: ./secrets/MYSQL_ROOT_PASSWORD.txt
  db-password:
    file: ./secrets/MYSQL_PASSWORD.txt
  db-user:
    file: ./secrets/MYSQL_USER.txt
  db-database:
    file: ./secrets/MYSQL_DATABASE.txt
  db-host:
    file: ./secrets/MYSQL_HOST.txt
  redis-password:
    file: ./secrets/REDIS_PASSWORD.txt
  pihole-password:
    file: ./secrets/PIHOLE_PASSWORD.txt