docker-compose.yml

networks:
  default:
    name: "homelab_default"
    driver: bridge
    driver_opts:
      com.docker.network.bridge.host_binding_ipv4: ${SERVER_IP}
    ipam:
      config:
        - subnet: 172.20.69.0/24

services:
  # https://hub.docker.com/_/traefik/
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    depends_on:
      - authelia
    environment:
      TZ: "${TZ}"
      CF_API_EMAIL: "${CF_API_EMAIL}"
      CF_API_KEY: "${CF_API_KEY}"
    networks:
      - default
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik/log:/var/log
      - ./traefik:/etc/traefik:rw
    labels:
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.traefik.tls.certresolver: prod
      traefik.http.routers.traefik.rule: Host(`${TRAEFIK_HOST}`)
      traefik.http.routers.traefik.middlewares: authelia
      traefik.http.routers.traefik.service: api@internal
      traefik.http.middlewares.test-auth.basicauth.users: "${BASICAUTH_USERS}"
      traefik.http.middlewares.basicauth.basicauth.usersfile: /etc/traefik/.htpasswd
      traefik.http.middlewares.ipallowlist.ipwhitelist.sourcerange: "${IPALLOWLIST}"
      traefik.http.middlewares.hsts-header.headers.customResponseHeaders.Strict-Transport-Security: "max-age=63072000"
    extra_hosts:
      - host.docker.internal:172.17.0.1

  # https://hub.docker.com/r/netdata/netdata
  netdata:
    image: netdata/netdata
    container_name: netdata
    restart: unless-stopped
    hostname: ${NETDATA_HOST}
    environment:
      PGID: ${DOCKER_PGID}
      TZ: ${TZ}
    cap_add:
      - SYS_PTRACE
    security_opt:
      - apparmor:unconfined
    volumes:
      - /etc/passwd:/host/etc/passwd:ro
      - /etc/group:/host/etc/group:ro
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - default
    labels:
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.netdata.tls.certresolver: prod
      traefik.http.routers.netdata.rule: Host(`${NETDATA_HOST}`)
      traefik.http.routers.netdata.middlewares: hsts-header, authelia

  # https://github.com/esphome/esphome
  esphome:
    image: esphome/esphome
    container_name: esphome
    network_mode: host
    restart: unless-stopped
    environment:
      TZ: ${TZ}
    volumes:
      - ${CONFIG_DIR}/esphome:/config
    labels:
      traefik.enable: "true"
      traefik.http.routers.esphome.tls.certresolver: prod
      traefik.http.routers.esphome.rule: Host(`${ESPHOME_HOST}`)
      traefik.http.routers.esphome.middlewares: hsts-header, authelia
      traefik.http.services.esphome.loadbalancer.server.port: 6052
      traefik.http.services.esphome.loadbalancer.server.scheme: http

  # https://github.com/cdr/code-server
  code:
    image: lscr.io/linuxserver/code-server
    container_name: code
    restart: unless-stopped
    environment:
      TZ: ${TZ}
      PUID: ${PUID}
      PGID: ${PGID}
      SUDO_PASSWORD_HASH: ${CODE_SUDO_PASSWORD_HASH}
      PORT: ${CODE_PORT}
    volumes:
      - ${CONFIG_DIR}/code:/config
      - ${CODE_DIR}:/home/code
    networks:
      - default
    labels:
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.code.tls.certresolver: prod
      traefik.http.routers.code.rule: Host(`${CODE_HOST}`)
      traefik.http.routers.code.middlewares: hsts-header, authelia
      traefik.http.services.code.loadbalancer.server.port: ${CODE_PORT}
      traefik.http.services.code.loadbalancer.server.scheme: http

  # https://github.com/cfbender/personal-site
  personal-site:
    container_name: personal-site
    build:
      context: ../personal-site
      dockerfile: Dockerfile
      args:
        - SHOW_DASHBOARD=true
    restart: unless-stopped
    environment:
      PORT: ${WWW_PORT}
      SECRET_KEY_BASE: ${SECRET_KEY_BASE}
      HOSTNAME: ${COOKIE_DOMAIN}
    networks:
      - default
    labels:
      com.centurylinklabs.watchtower.enable: "false"
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.personal-site.tls.certresolver: prod
      traefik.http.routers.personal-site.rule: "Host(`${PERSONAL_SITE_HOST}`) || Host(`${COOKIE_DOMAIN}`)"
      traefik.http.routers.personal-site.middlewares: hsts-header
      traefik.http.routers.personal-site-dashboard.tls.certresolver: prod
      traefik.http.routers.personal-site-dashboard.rule: "(Host(`${PERSONAL_SITE_HOST}`) || Host(`${COOKIE_DOMAIN}`)) && PathPrefix(`${DASHBOARD_PATH}`)"
      traefik.http.routers.personal-site-dashboard.middlewares: hsts-header, authelia
      traefik.http.services.personal-site.loadbalancer.server.port: ${WWW_PORT}
      traefik.http.services.personal-site.loadbalancer.server.scheme: http

  # https://registry.hub.docker.com/r/adguard/adguardhome
  adguard:
    image: adguard/adguardhome
    container_name: adguard
    restart: unless-stopped
    network_mode: host
    volumes:
      - ${DATA_DIR}/adguard:/opt/adguardhome/work
      - ${CONFIG_DIR}/adguard:/opt/adguardhome/conf
    dns: ${GATEWAY_IP}
    labels:
      traefik.enable: "true"
      traefik.http.routers.adguard.tls.certresolver: prod
      traefik.http.routers.adguard.rule: Host(`${ADGUARD_HOST}`)
      traefik.http.routers.adguard.middlewares: hsts-header
      # Be sure to configure this after install to bind to this port instead of 80!
      traefik.http.services.adguard.loadbalancer.server.port: 3333
      traefik.http.services.adguard.loadbalancer.server.scheme: http

  # https://github.com/bakito/adguardhome-sync/
  adguard-sync:
    image: lscr.io/linuxserver/adguardhome-sync
    restart: unless-stopped
    container_name: adguard-sync
    environment:
      PUID: ${PUID}
      PGID: ${PUID}
      TZ: ${TZ}
      CONFIGFILE: /config/adguardhome-sync.yaml
    volumes:
      - ${CONFIG_DIR}/adguard:/config
    ports:
      - 8090:8080
    networks:
      - default

  # https://github.com/thomseddon/traefik-forward-auth
  # traefik-forward-auth:
  #   image: thomseddon/traefik-forward-auth:2
  #   container_name: traefik-forward-auth
  #   restart: unless-stopped
  #   environment:
  #     - PROVIDERS_GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
  #     - PROVIDERS_GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
  #     - SECRET=${AUTH_SECRET}
  #     - WHITELIST=${OAUTH_WHITELIST}
  #     - LOG_LEVEL=debug
  #     - AUTH_HOST=${AUTH_HOST}
  #     - COOKIE_DOMAIN=${COOKIE_DOMAIN}
  #     - LIFETIME=604800 # 1 week
  #   networks:
  #     - default
  #   labels:
  #     traefik.enable: "true"
  #     traefik.docker.network: homelab_default
  #     traefik.http.routers.traefik-forward-auth.tls.certresolver: prod
  #     traefik.http.routers.traefik-forward-auth.rule: Host(`${AUTH_HOST}`)
  #     traefik.http.routers.traefik-forward-auth.middlewares: traefik-forward-auth
  #     traefik.http.middlewares.traefik-forward-auth.forwardauth.address: http://traefik-forward-auth:4181
  #     traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders: X-Forwarded-User
  #     traefik.http.services.traefik-forward-auth.loadbalancer.server.port: 4181

  # https://github.com/authelia/authelia
  authelia:
    container_name: authelia
    image: docker.io/authelia/authelia:latest
    restart: unless-stopped
    networks:
      default:
        aliases: []
    expose:
      - 9091
    environment:
      TZ: ${TZ}
      AUTHELIA_JWT_SECRET: ${AUTHELIA_JWT_SECRET}
    volumes:
      - ${CONFIG_DIR}/authelia:/config
    labels:
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.authelia.tls.certresolver: prod
      traefik.http.routers.authelia.rule: Host(`${AUTHELIA_HOST}`)
      traefik.http.middlewares.authelia.forwardAuth.address: http://authelia:9091/api/authz/forward-auth
      traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader: "true"
      traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders: "Remote-User,Remote-Groups,Remote-Email,Remote-Name"
      traefik.http.services.authelia.loadbalancer.server.port: 9091

  # https://github.com/containrrr/watchtower/
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: unless-stopped
    environment:
      TZ: ${TZ}
      WATCHTOWER_NOTIFICATIONS: "shoutrrr"
      WATCHTOWER_NOTIFICATION_URL: ${WATCHTOWER_NOTIFICATION_URL}
      WATCHTOWER_CLEANUP: "true"
      WATCHTOWER_WARN_ON_HEAD_FAILURE: "never"
    command: --schedule "0 0 20 * * *" # runs daily at 8 PM
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - default

  # https://github.com/portainer/portainer
  portainer:
    image: portainer/portainer-ce
    container_name: portainer
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${DATA_DIR}/portainer:/data
    networks:
      - default
    labels:
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.portainer.tls.certresolver: prod
      traefik.http.routers.portainer.rule: Host(`${PORTAINER_HOST}`)
      traefik.http.routers.portainer.middlewares: hsts-header
      traefik.http.services.portainer.loadbalancer.server.port: 9000
      traefik.http.services.portainer.loadbalancer.server.scheme: http

  # https://github.com/linuxserver/docker-unifi-controller
  unifi:
    image: lscr.io/linuxserver/unifi-controller
    container_name: unifi
    restart: unless-stopped
    environment:
      PUID: ${PUID}
      PGID: ${PGID}
    volumes:
      - ${CONFIG_DIR}/unifi:/config
    ports:
      - 3478:3478/udp
      - 10001:10001/udp
      - 8080:8080
      - 8443:8443
      - 6789:6789 # optional
    networks:
      - default
    labels:
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.unifi.tls.certresolver: prod
      traefik.http.routers.unifi.rule: Host(`${UNIFI_HOST}`)
      traefik.http.routers.unifi.middlewares: hsts-header
      traefik.http.services.unifi.loadbalancer.server.port: 8443
      traefik.http.services.unifi.loadbalancer.server.scheme: https

  # https://github.com/BookStackApp/BookStack
  bookstack:
    image: lscr.io/linuxserver/bookstack
    container_name: bookstack
    restart: unless-stopped
    environment:
      PUID: ${PUID}
      PGID: ${PGID}
      APP_URL: https://${BOOKSTACK_HOST}
      DB_HOST: bookstack_db
      DB_DATABASE: bookstackapp
      DB_USERNAME: ${BOOKSTACK_DB_USER}
      DB_PASSWORD: ${BOOKSTACK_DB_PASS}
    volumes:
      - ${DATA_DIR}/bookstack:/config
    depends_on:
      - bookstack_db
    networks:
      - default
    labels:
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.bookstack.tls.certresolver: prod
      traefik.http.routers.bookstack.rule: Host(`${BOOKSTACK_HOST}`)
      traefik.http.routers.bookstack.middlewares: hsts-header
      traefik.http.services.bookstack.loadbalancer.server.port: 80
      traefik.http.services.bookstack.loadbalancer.server.scheme: http

  bookstack_db:
    image: lscr.io/linuxserver/mariadb
    container_name: bookstack_db
    restart: unless-stopped
    environment:
      PUID: ${PUID}
      PGID: ${PGID}
      TZ: ${TZ}
      MYSQL_DATABASE: bookstackapp
      MYSQL_USER: ${BOOKSTACK_DB_USER}
      MYSQL_PASSWORD: ${BOOKSTACK_DB_PASS}
      MYSQL_ROOT_PASSWORD: ${BOOKSTACK_DB_ROOT_PASS}
    volumes:
      - ${DATA_DIR}/bookstack_db:/config
    networks:
      - default

  # https://hub.docker.com/r/tailscale/tailscale
  tailscale:
    image: tailscale/tailscale:latest
    container_name: tailscale
    restart: unless-stopped
    network_mode: host
    cap_add:
      - NET_ADMIN
      - NET_RAW
    environment:
      TZ: ${TZ}
      TS_AUTHKEY: ${TAILSCALE_AUTH_KEY}
      TS_ROUTES: ${TAILSCALE_ADVERTISED_ROUTES}
    volumes:
      - /var/lib:/var/lib
      - /dev/net/tun:/dev/net/tun

  mosquitto:
    image: eclipse-mosquitto
    container_name: mosquitto
    restart: unless-stopped
    environment:
      TZ: ${TZ}
    ports:
      - 1883:1883/tcp
      - 9001:9001/tcp
    volumes:
      - ${CONFIG_DIR}/mosquitto:/mosquitto/config
      - ${DATA_DIR}/mosquitto:/mosquitto/data
      - ${DATA_DIR}/mosquitto/log:/mosquitto/log
      - /etc/localtime:/etc/localtime:ro
    networks:
      - default

  fail2ban:
    image: crazymax/fail2ban:latest
    container_name: fail2ban
    restart: unless-stopped
    network_mode: host
    environment:
      TZ: ${TZ}
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - ./fail2ban:/data
      - ./traefik/log/access.log:/var/log/access.log:ro
      - ${CONFIG_DIR}/home/home-assistant.log:/var/log/home-assistant.log:ro
      - /var/log/auth.log:/var/log/auth.log:ro

  # https://github.com/benbusby/whoogle-search
  whoogle:
    image: benbusby/whoogle-search
    container_name: whoogle
    restart: unless-stopped
    pids_limit: 50
    mem_limit: 256mb
    memswap_limit: 256mb
    # user debian-tor from tor package
    user: whoogle
    security_opt:
      - no-new-privileges
    cap_drop:
      - ALL
    tmpfs:
      - /config/:size=10M,uid=927,gid=927,mode=1700
      - /var/lib/tor/:size=15M,uid=927,gid=927,mode=1700
      - /run/tor/:size=1M,uid=927,gid=927,mode=1700
    environment:
      TZ: ${TZ}
      WHOOGLE_CONFIG_THEME: system
      WHOOGLE_CONFIG_PREFERENCES_ENCRYPTED: 1
      WHOOGLE_CONFIG_PREFERENCES_KEY: ${WHOOGLE_PREFERENCES_KEY}
      WHOOGLE_CONFIG_COUNTRY: US
      WHOOGLE_CONFIG_SEARCH_LANGUAGE: lang_en
      WHOOGLE_CONFIG_GET_ONLY: 1
      WHOOGLE_CONFIG_DISABLE: 0
      WHOOGLE_CONFIG_VIEW_IMAGE: 1
      WHOOGLE_CONFIG_NEW_TAB: 0
    ports:
      - 5000:5000/tcp
    labels:
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.whoogle-opensearch.tls.certresolver: prod
      traefik.http.routers.whoogle-opensearch.rule: "(Host(`${WHOOGLE_HOST}`) && Path(`/opensearch.xml`))"
      traefik.http.routers.whoogle-opensearch.middlewares: hsts-header
      traefik.http.routers.whoogle.tls.certresolver: prod
      traefik.http.routers.whoogle.rule: Host(`${WHOOGLE_HOST}`)
      traefik.http.routers.whoogle.middlewares: hsts-header, authelia
      traefik.http.services.whoogle.loadbalancer.server.port: 5000
      traefik.http.services.whoogle.loadbalancer.server.scheme: http

  #https://github.com/Lissy93/dashy
  dashy:
    image: lissy93/dashy:latest
    container_name: dashy
    restart: unless-stopped
    environment:
      TZ: ${TZ}
      WHOOGLE_CONFIG_THEME: system
      WHOOGLE_CONFIG_PREFERENCES_ENCRYPTED: 1
      WHOOGLE_CONFIG_PREFERENCES_KEY: ${WHOOGLE_PREFERENCES_KEY}
      WHOOGLE_CONFIG_COUNTRY: US
      WHOOGLE_CONFIG_SEARCH_LANGUAGE: lang_en
      WHOOGLE_CONFIG_GET_ONLY: 1
      WHOOGLE_CONFIG_DISABLE: 0
      WHOOGLE_CONFIG_VIEW_IMAGE: 1
      WHOOGLE_CONFIG_NEW_TAB: 0
      NODE_ENV: production
    ports:
      - 8081:80/tcp
    volumes:
      - ${CONFIG_DIR}/dashy/dashy-conf.yml:/app/public/conf.yml
    healthcheck:
      test: ["CMD", "node", "/app/services/healthcheck"]
      interval: 1m30s
      timeout: 10s
      retries: 3
      start_period: 40s
    labels:
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.dashy.tls.certresolver: prod
      traefik.http.routers.dashy.rule: Host(`${DASHY_HOST}`)
      traefik.http.routers.dashy.middlewares: hsts-header, authelia
      traefik.http.services.dashy.loadbalancer.server.port: 80
      traefik.http.services.dashy.loadbalancer.server.scheme: http

  #https://github.com/cfbender/edison
  edison:
    container_name: edison
    build:
      context: ../edison
      dockerfile: Dockerfile
      args:
        - EDISON_MECHMARKET_ROLE_ID=${EDISON_MECHMARKET_ROLE_ID}
        - EDISON_MECHMARKET_QUERY=${EDISON_MECHMARKET_QUERY}
        - EDISON_MECHMARKET_CHANNEL=${EDISON_MECHMARKET_CHANNEL}
        - EDISON_BOT_TOKEN=${EDISON_BOT_TOKEN}
    restart: unless-stopped
    labels:
      com.centurylinklabs.watchtower.enable: "false"
    environment:
      EDISON_MECHMARKET_ROLE_ID: ${EDISON_MECHMARKET_ROLE_ID}
      EDISON_MECHMARKET_QUERY: ${EDISON_MECHMARKET_QUERY}
      EDISON_MECHMARKET_CHANNEL: ${EDISON_MECHMARKET_CHANNEL}
      EDISON_BOT_TOKEN: ${EDISON_BOT_TOKEN}

  # https://github.com/hay-kot/homebox
  homebox:
    image: ghcr.io/hay-kot/homebox:latest
    container_name: homebox
    restart: unless-stopped
    environment:
      - HBOX_LOG_LEVEL=info
      - HBOX_LOG_FORMAT=text
      - HBOX_WEB_MAX_UPLOAD_SIZE=10
      - HBOX_OPTIONS_ALLOW_REGISTRATION=false
    volumes:
      - ${DATA_DIR}/homebox:/data/
    ports:
      - 3100:7745
    labels:
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.homebox.tls.certresolver: prod
      traefik.http.routers.homebox.rule: Host(`${HOMEBOX_HOST}`)
      traefik.http.routers.homebox.middlewares: hsts-header

  # https://github.com/janeczku/calibre-web
  calibre-web:
    image: linuxserver/calibre-web:latest
    container_name: calibre-web
    restart: unless-stopped
    environment:
      PUID: ${PUID}
      PGID: ${PGID}
      TZ: ${TZ}
      DOCKER_MODS: linuxserver/mods:universal-calibre
    volumes:
      - ${DATA_DIR}/books:/books
      - ${CONFIG_DIR}/config:/config
    ports:
      - 8083:8083/tcp
    labels:
      traefik.enable: "true"
      traefik.docker.network: homelab_default
      traefik.http.routers.calibre.tls.certresolver: prod
      traefik.http.routers.calibre.rule: Host(`${CALIBRE_HOST}`)
      traefik.http.routers.calibre.middlewares: hsts-header, authelia

  overseerr:
    image: sctx/overseerr:latest
    container_name: overseerr
    restart: unless-stopped
    security_opt:
      - seccomp:unconfined
    volumes:
      - "${CONFIG_DIR}/overseerr:/app/config"
    labels:
      traefik.enable: "true"
      traefik.http.routers.overseer.tls.certresolver: prod
      traefik.http.routers.overseer.middlewares: hsts-header
      traefik.http.routers.overseer.rule: Host(`request.${BASE_DOMAIN}`)
      traefik.http.services.overseer.loadbalancer.server.port: 5055

  sabnzbd:
    image: lscr.io/linuxserver/sabnzbd:latest
    container_name: sabnzbd
    restart: unless-stopped
    environment:
      PUID: "${PUID}"
      PGID: "${PGID}"
    volumes:
      - ${MEDIA_DIR}:/data
      - "${CONFIG_DIR}/sabnzbd:/config"
    labels:
      traefik.enable: "true"
      traefik.http.routers.sabnzbd.tls.certresolver: prod
      traefik.http.routers.sabnzbd.middlewares: hsts-header, authelia
      traefik.http.routers.sabnzbd.rule: Host(`nzb.${BASE_DOMAIN}`)
      traefik.http.services.sabnzbd.loadbalancer.server.port: 8080

  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    restart: unless-stopped
    environment:
      PUID: "${PUID}"
      PGID: "${PGID}"
    volumes:
      - "${CONFIG_DIR}/radarr:/config"
      - ${MEDIA_DIR}:/data
    labels:
      traefik.enable: "true"
      traefik.http.routers.radarr.tls.certresolver: prod
      traefik.http.routers.radarr.middlewares: hsts-header, authelia
      traefik.http.routers.radarr.rule: Host(`radarr.${BASE_DOMAIN}`)
      traefik.http.services.radarr.loadbalancer.server.port: 7878

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    restart: unless-stopped
    environment:
      PUID: "${PUID}"
      PGID: "${PGID}"
    volumes:
      - "${CONFIG_DIR}/sonarr:/config"
      - ${MEDIA_DIR}:/data
    labels:
      traefik.enable: "true"
      traefik.http.routers.sonarr.tls.certresolver: prod
      traefik.http.routers.sonarr.middlewares: hsts-header, authelia
      traefik.http.routers.sonarr.rule: Host(`sonarr.${BASE_DOMAIN}`)
      traefik.http.services.sonarr.loadbalancer.server.port: 8989