docker-compose.yml

# This file has been broken up into multiple smaller files, all started with a shell script.
# To start the script, change into the directory containing it and all of the other docker-compose files
# Type 
#   chmod +x ./start-containters.sh
#   ./start-containers.sh
# to bring them all up. This will take quite a while - ~30 containers need to be pulled.


version: '3'
services:

  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    # links:
    #   - unbound
    ports:
      - "${LOCAL_IP}:53:53/tcp"
      - "${LOCAL_IP}:53:53/udp"
      # - "${LOCAL_IP}:80:80/tcp"
      - "${LOCAL_IP}:7443:443/tcp"
      - "${LOCAL_IP}:7080:80/tcp"
    cap_add:
      - NET_ADMIN
    depends_on:
      - traefik
      # - unbound
    environment:
      ServerIP: ${LOCAL_IP}
      WEBPASSWORD: ${PIHOLE_PASSWORD}
      VIRTUAL_PORT: 80
      # DNS1: 192.168.1.2#5322
      # DNS1: ${LOCAL_IP}#5322
      DNS1: 1.1.1.1
      DNS2: "no"
      IPv6: "no"
      TZ: ${TZ}
      # PROXY_LOCATION: pihole
    volumes:
      - ${USERDIR}/pihole:/etc/pihole
      # make sure to manually create this log file before first run
      - ${USERDIR}/pihole/log/pihole.log:/var/log/pihole.log
      - /etc/dnsmasq.d:/etc/dnsmasq.d
     # - ${USERDIR}/pihole/misc/dnsmasq.leases:/var/lib/misc/dnsmasq.leases
     # - ${USERDIR}/pihole/dnsmasq.d/:/etc/dnsmasq.d/
    restart: always
    dns:
      - 127.0.0.1
      - 1.1.1.1
    # networks:
    #   pihole_unbound:
    #     ipv4_address: 192.168.1.3
    #   default:

  # unbound:
  #   container_name: unbound
  #   image: mvance/unbound
  #   depends_on:
  #     - pihole
  #   networks:
  #     pihole_unbound:
  #       ipv4_address: 192.168.1.2
  #   ports:
  #     - "9753:53/tcp"
  #     - "9753:53/udp"
  #     - "5333:5333/tcp"
  #     - "5333:5333/udp"
  #   # volumes:
  #     # - ${USERDIR}/unbound/unbound.conf:/opt/unbound/etc/unbound/unbound.conf
  #     # - ${USERDIR}/unbound/root.hints:/var/unbound/etc/unbound/root.hints
  #     # - ${USERDIR}/unbound/unbound.log:/var/log/unbound/unbound.log
  #   cap_add:
  #   - NET_ADMIN
  #   restart: unless-stopped

  # unbound:
  #   image: folhabranca/unbound:latest
  #   #network_mode: bridge
  #   networks:
  #     pihole_unbound:
  #       ipv4_address: 192.168.1.2
  #     default:
  #   ports:
  #     - "5322:5322/udp"
  #     - "5322:5322"
  #   volumes:
  #     #- ${USERDIR}/unbound/unbound.conf.d:/opt/unbound/etc/unbound/unbound.conf.d
  #     - ${USERDIR}/unbound/unbound.log:/opt/unbound/etc/unbound/log/unbound.log
  #   environment:
  #     - INTERFACE=0.0.0.0
  #     - PORT=5322
  #     - DO_IPV6=no
  #     - DO_IPV4=yes
  #     - DO_UDP=yes
  #     - DO_TCP=yes
  #     - VERBOSITY=1
  #     - NUM_THREADS=1
  #     - SO_REUSEPORT=yes
  #     - HIDE_IDENTITY=yes
  #     - HIDE_VERSION=yes
  #     - QNAME_MINIMISATION=yes
  #     - RRSET_ROUNDROBIN=yes
  #     - USE_CAPS_FOR_ID=yes
  #     - ENABLE_REMOTE_CONTROL=yes
  #     - USE_LOGFILE=no
  #     - USE_CHROOT=yes
  #     - INFRA_HOST_TTL=60
  #   cap_add:
  #     - net_admin
  #   restart: always

  portainer:
    container_name: portainer
    restart: always
    image: portainer/portainer:latest
    volumes:
      - ${USERDIR}/portainer:/data
      - ${USERDIR}/shared:/shared
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - "9000:9000"
    environment:
      - TZ=${TZ}
    networks:
      - traefik_proxy
    labels:
      - "traefik.enable=true"
      - "traefik.port=9000"
      - "traefik.backend=portainer"
      - "traefik.frontend.rule=Host:portainer.${DOMAINNAME}"
      - "traefik.protocol=https"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.frontend.headers.SSLRedirect=true"
      - "traefik.frontend.headers.STSSeconds=315360000"
      - "traefik.frontend.headers.browserXSSFilter=true"
      - "traefik.frontend.headers.contentTypeNosniff=true"
      - "traefik.frontend.headers.forceSTSHeader=true"
      - "traefik.frontend.headers.SSLHost=${DOMAINNAME}.com"
      - "traefik.frontend.headers.STSIncludeSubdomains=true"
      - "traefik.frontend.headers.STSPreload=true"
      - "traefik.frontend.headers.frameDeny=true"
      - "traefik.frontend.headers.customFrameOptionsValue=SAMEORIGIN"

  mosquitto:
    container_name: mosquitto
    restart: always
    image: eclipse-mosquitto:latest
    volumes:
      - ${USERDIR}/mosquitto/config/:/mosquitto/config/
      - ${USERDIR}/mosquitto/log:/mosquitto/log
      - ${USERDIR}/mosquitto/data:/mosquitto/data
      - /etc/localtime:/etc/localtime:ro
    environment:
      - MOSQUITTO_USERNAME=${MOSQUITTO_USERNAME}
      - MOSQUITTO_PASSWORD=${MOSQUITTO_PASSWORD}
    ports:
      - "1883:1883"
      - "9001:9001"
    #   - 8883:8883
    networks:
      - default

  mongo:
    container_name: mongo
    restart: always
    image: mongo:latest
    volumes:
      - ${USERDIR}/mongo:/data/db
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "27017:27017"

  influxdb:
    container_name: influxdb
    restart: always
    image: influxdb:latest
    volumes:
      # files cannot be created by docker-compose, it'll make it as a directory instead. Make sure to touch this file first.
      - ${USERDIR}/influxdb/influxdb.conf:/etc/influxdb/influxdb.conf
      - ${USERDIR}/influxdb/db:/var/lib/influxdb
    ports:
      - "8086:8086"
    networks:
      - traefik_proxy
      - default
    labels:
      - "traefik.enable=false"

  grafana:
    container_name: grafana
    restart: always
    image: grafana/grafana:latest
    depends_on:
      - "influxdb"
    ports:
      - "3000:3000"
    user: "472"
    # to enable persistent storage, you might need to modify user permissions by creating this container in
    # interactive mode and adjusting the permissions from a shell first
    volumes:
      - ${USERDIR}/grafana:/var/lib/grafana

  chronograf:
    container_name: chronograf
    restart: always
    image: chronograf:latest
    depends_on:
      - "influxdb"
    volumes:
      - ${USERDIR}/chronograf:/var/lib/chronograf
    ports:
      - "8888:8888"
    environment:
      - PGID=${PGID}
      - PUID=${PUID}

  homeassistant:
    container_name: home-assistant
    restart: always
    image: homeassistant/home-assistant:latest
    depends_on:
      - "influxdb"
      - "traefik"
    volumes:
      - ${USERDIR}/hass-config:/config
      - /etc/localtime:/etc/localtime:ro
      - ${USERDIR}/hass_media:/media
    #network_mode: host
    privileged: true
    # ports:
    #   - 8123:8123
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    networks:
      - traefik_proxy
      - default
    labels:
      - "traefik.enable=true"
      - "traefik.backend=homeassistant"
      - "traefik.frontend.rule=Host:ha.${DOMAINNAME}"
      - "traefik.port=8123"
      # - "traefik.protocol=https"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.frontend.headers.SSLRedirect=true"
      - "traefik.frontend.headers.STSSeconds=315360000"
      - "traefik.frontend.headers.browserXSSFilter=true"
      - "traefik.frontend.headers.contentTypeNosniff=true"
      - "traefik.frontend.headers.forceSTSHeader=true"
      - "traefik.frontend.headers.SSLHost=${DOMAINNAME}.com"
      - "traefik.frontend.headers.STSIncludeSubdomains=true"
      - "traefik.frontend.headers.STSPreload=true"
      - "traefik.frontend.headers.frameDeny=true"
      - "traefik.frontend.headers.customFrameOptionsValue=SAMEORIGIN"
      - "traefik.frontend.headers.contentSecurityPolicy=upgrade-insecure-requests"
      - "traefik.frontend.headers.customResponseHeaders=X-Robots-Tag:noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"

  nodered:
    container_name: node-red
    restart: always
    image: nodered/node-red-docker:latest
    depends_on:
      - "homeassistant"
    user: root
    volumes:
      - ${USERDIR}/node-red-1/user:/data
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "1880:1880"

  fail2ban:
    container_name: fail2ban
    image: crazymax/fail2ban:latest
    restart: always
    network_mode: "host"
    depends_on:
      - "pihole"
    cap_add:
    - NET_ADMIN
    - NET_RAW
    volumes:
    - ${USERDIR}/traefik/log:/var/log:ro
    - ${USERDIR}/fail2ban/data:/data

  traefik:
    hostname: traefik
    image: traefik:1.7
    container_name: traefik
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # create these toml files first
      - ${USERDIR}/traefik/traefik.toml:/etc/traefik/traefik.toml:ro
      - ${USERDIR}/traefik/rules.toml:/etc/traefik/rules.toml:ro
      - ${USERDIR}/traefik/acme:/etc/traefik/acme
      - ${USERDIR}/shared:/shared
      - ${USERDIR}/traefik/log:/var/log
    ports:
     - "80:80"
     - "443:443"
     #- "8090:8080"
    networks:
      - default
      - traefik_proxy
    environment:
      - CLOUDFLARE_EMAIL=${CLOUDFLARE_EMAIL}
      - CLOUDFLARE_API_KEY=${CLOUDFLARE_API_KEY}
    command:
      - --web
      - --accessLog.filePath=/var/log/access.log
      - --accessLog.filters.statusCodes=400-499
    labels:
      - "traefik.enable=true"
      - "traefik.backend=traefik"
      - "traefik.frontend.rule=Host:traefik.${DOMAINNAME}"
      - "traefik.frontend.auth.basic: ${HTTP_USERNAME}:${HTTP_PASSWORD}"
      - "traefik.port=8080"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.frontend.headers.SSLRedirect=true"
      - "traefik.frontend.headers.STSSeconds=315360000"
      - "traefik.frontend.headers.browserXSSFilter=true"
      - "traefik.frontend.headers.contentTypeNosniff=true"
      - "traefik.frontend.headers.forceSTSHeader=true"
      - "traefik.frontend.headers.SSLHost=${DOMAINNAME}.com"
      - "traefik.frontend.headers.STSIncludeSubdomains=true"
      - "traefik.frontend.headers.STSPreload=true"
      - "traefik.frontend.headers.frameDeny=true"
      - "traefik.frontend.headers.contentSecurityPolicy=upgrade-insecure-requests"
      - "traefik.frontend.headers.customResponseHeaders=X-Robots-Tag:noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"

  nextcloud:
    container_name: nextcloud
    restart: always
    image: linuxserver/nextcloud:latest
    volumes:
      - ${USERDIR}/nextcloud/config:/config
      # path to where nextcloud will store files
      - ${USERDIR}/nextcloud/data:/data
      - ${USERDIR}/shared:/shared
    # ports:
    #    - "9443:443"
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - MYSQL_DATABASE=${NEXTCLOUD_DATABASE}
      - MYSQL_USER=${NEXTCLOUD_DB_USER}
      - MYSQL_PASSWORD=${NEXTCLOUD_DB_PASSWORD}
    networks:
      - traefik_proxy
    depends_on:
      - "pihole"
      - "mariadb"
    links:
      - mariadb
    labels:
      - "traefik.enable=true"
      - "traefik.backend=nextcloud"
      - "traefik.frontend.rule=Host:nextcloud.${DOMAINNAME}"
      - "traefik.port=443"
      - "traefik.protocol=https"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.frontend.headers.SSLRedirect=true"
      - "traefik.frontend.headers.STSSeconds=315360000"
      - "traefik.frontend.headers.browserXSSFilter=true"
      - "traefik.frontend.headers.contentTypeNosniff=true"
      - "traefik.frontend.headers.forceSTSHeader=true"
      - "traefik.frontend.headers.SSLHost=${DOMAINNAME}.com"
      - "traefik.frontend.headers.STSIncludeSubdomains=true"
      - "traefik.frontend.headers.STSPreload=true"
      - "traefik.frontend.headers.frameDeny=true"
      - "traefik.frontend.headers.customFrameOptionsValue=SAMEORIGIN"
      - com.centurylinklabs.watchtower.enable="false"

  mariadb:
    image: mariadb:latest
    container_name: "mariadb"
    hostname: mariadb
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    restart: always
    volumes:
      - ${USERDIR}/mariadb/config:/config
      - ${USERDIR}/mariadb/mysql:/var/lib/mysql
    ports:
      - "${MARIA_DB_PORT}:${MARIA_DB_PORT}/tcp"
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      #- MYSQL_USER=${MYSQL_USER}
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      #- MYSQL_PASSWORD=${MYSQL_PASSWORD}
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    labels:
      - traefik.enable=false
      - com.centurylinklabs.watchtower.enable="false"

  phpmyadmin:
    hostname: phpmyadmin
    container_name: phpmyadmin
    image: phpmyadmin/phpmyadmin:latest
    restart: always
    depends_on:
      - "pihole"
      - "mariadb"
    links:
      - mariadb:db
    ports:
      - 9999:80
    environment:
      - PMA_HOST=mariadb
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
    labels:
      - traefik.enable=false

  ipam:
    container_name: ipam
    depends_on:
      - mariadb
    image: pierrecdn/phpipam:latest
    volumes:
      - ${USERDIR}/phpipam:/var/www/
    environment:
      - MYSQL_ENV_MYSQL_USER=${MYSQL_ROOT_USER}
      - MYSQL_ENV_MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_ENV_MYSQL_HOST=mariadb
      - MYSQL_ENV_MYSQL_DB=${PHPIPAM_DATABASE}
    ports:
      - "3280:80"

  watchtower:
    container_name: watchtower
    hostname: watchtower
    restart: always
    image: v2tec/watchtower:latest
    depends_on:
      - "pihole"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: --schedule "0 0 4 * * *" --cleanup

  organizr:
    container_name: organizr
    restart: always
    image: lsiocommunity/organizr:latest
    volumes:
      - ${USERDIR}/organizr:/config
      - ${USERDIR}/shared:/shared
    #ports:
    #  - "XXXX:80"
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    networks:
      - traefik_proxy
    labels:
      - "traefik.enable=true"
      - "traefik.backend=organizr"
      - "traefik.frontend.rule=Host:organizr.${DOMAINNAME}"
      #- "traefik.frontend.rule=Host:${DOMAINNAME}; PathPrefixStrip: /organizr"
      - "traefik.port=80"
      - "traefik.protocol=https"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.frontend.headers.SSLRedirect=true"
      - "traefik.frontend.headers.STSSeconds=315360000"
      - "traefik.frontend.headers.browserXSSFilter=true"
      - "traefik.frontend.headers.contentTypeNosniff=true"
      - "traefik.frontend.headers.forceSTSHeader=true"
      - "traefik.frontend.headers.SSLHost=${DOMAINNAME}.com"
      - "traefik.frontend.headers.STSIncludeSubdomains=true"
      - "traefik.frontend.headers.STSPreload=true"
      #- "traefik.frontend.headers.frameDeny=true"
      - "traefik.frontend.headers.customFrameOptionsValue=SAMEORIGIN"
      - "traefik.frontend.headers.contentSecurityPolicy=upgrade-insecure-requests"
      - "traefik.frontend.headers.customResponseHeaders=X-Robots-Tag:noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"

  duplicati:
    image: duplicati/duplicati:latest
    container_name: duplicati
    restart: always
    network_mode: "bridge"
    ports:
        - '8200:8200'
    environment:
        - PUID=${PUID}
        - PGID=${PGID}
    volumes:
        - ${USERDIR}/duplicati/config:/config
        - ${USERDIR}/duplicati/data:/data/Duplicati
        - ${BACKUP_DIR}/duplicatiBackups:/backups
        - ${USERDIR}:/source
        - /etc/localtime:/etc/localtime:ro

  bookstack:
    container_name: bookstack
    image: solidnerd/bookstack:latest
    depends_on:
    - mariadb
    environment:
    - DB_HOST=mariadb:${MARIA_DB_PORT}
    - DB_DATABASE=${BOOKSTACK_DATABASE}
    - DB_USERNAME=${BOOKSTACK_DATABASE_USERNAME}
    - DB_PASSWORD=${BOOKSTACK_DATABASE_PASSWORD}
    volumes:
    - ${USERDIR}/bookstack/uploads:/var/www/bookstack/public/uploads
    - ${USERDIR}/bookstack/storage:/var/www/bookstack/public/storage
    ports:
    - "8581:80"

  calibre-web:
    image: linuxserver/calibre-web:latest
    container_name: calibre-web
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/calibre/config:/config
      - ${MEDIA_PATH}/Books:/books
    ports:
      - 8083:8083
    restart: unless-stopped

  mariadb-backup:
    container_name: mariadb-backup
    image: tiredofit/mariadb-backup
    links:
      - mariadb
    volumes:
      - ${BACKUP_DIR}/mariadbBackups:/backups
    environment:
      - DB_SERVER=mariadb
      - DB_NAME=${MYSQL_DATABASE}
      - DB_USER=${MYSQL_ROOT_USER}
      - DB_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - DB_DUMP_FREQ=1440
      - DB_DUMP_BEGIN=+0002
      - DB_CLEANUP_TIME=8640
      - MD5=TRUE
      - COMPRESSION=XZ
      - SPLIT_DB=FALSE
    restart: always

  netdata:
    image: titpetric/netdata
    container_name: netdata
    restart: always
    networks:
        - traefik_proxy
    ports:
        - 19999:19999
    volumes:
        - ${USERDIR}/netdata/proc:/host/proc:ro
        - ${USERDIR}/netdata/sys:/host/sys:ro
        - ${USERDIR}/netdata/var/run/docker.sock:/var/run/docker.sock:ro

  transmission-openvpn:
    image: haugene/transmission-openvpn:latest
    container_name: transmission-openvpn
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    restart: always
    depends_on:
      - "pihole"
    ports:
      - "9091:9091/tcp"
      - "9090:9090/tcp"
      - "9091:9091/udp"
      - "9090:9090/udp"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${USERDIR}/transmission:/data
      - ${MEDIA_PATH}/Downloads:/data/completed
      - ${MEDIA_PATH}/Downloads:/data/incomplete
      - ${MEDIA_PATH}/torrent-files:/data/watch
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - OPENVPN_PROVIDER=${OPENVPN_PROVIDER}
      - OPENVPN_USERNAME=${OPENVPN_USERNAME}
      - OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
      - OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
      - LOCAL_NETWORK=${LOCAL_NETWORK}/24
      - TRANSMISSION_RATIO_LIMIT=0.01
      - TRANSMISSION_RATIO_LIMIT_ENABLED=true
      - TRANSMISSION_SPEED_LIMIT_UP=1
      - TRANSMISSION_SPEED_LIMIT_UP_ENABLED=false
      - TRANSMISSION_PEER_PORT=${TRANSMISSION_PEER_PORT}
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
  # proxy:
  #   image: haugene/transmission-openvpn-proxy
  #   links:
  #     - transmission
  #   ports:
  #     - 8080:8080
  #   volumes:
  #     - /etc/localtime:/etc/localtime:ro

  # rss:
  #   image: haugene/transmission-rss
  #   links:
  #     - transmission
  #   environment:
  #     - RSS_URL=http://.../xxxxx.rss

  sonarr:
    image: linuxserver/sonarr:latest
    container_name: sonarr
    restart: always
    networks:
        - traefik_proxy
    ports:
        - "8989:8989"
    depends_on:
      - "transmission-openvpn"
    volumes:
        - ${USERDIR}/sonarr/config:/config
        - ${MEDIA_PATH}/Downloads:/downloads
        - ${MEDIA_PATH}/TV:/tv
        - /etc/localtime:/etc/localtime:ro
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}

  radarr:
    image: linuxserver/radarr:latest
    container_name: radarr
    depends_on:
      - "transmission-openvpn"
    ports:
      - "7878:7878"
    volumes:
        - ${USERDIR}/radarr/config:/config
        - ${MEDIA_PATH}/Movies:/movies
        - ${MEDIA_PATH}/Downloads:/downloads
        - /etc/localtime:/etc/localtime:ro
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    # labels:
    #     - traefik.backend=radarr
    #     - traefik.frontend.rule=Host:radarr.${DOMAIN}
    #     - traefik.docker.network=traefik
    #     - traefik.port=7878
    networks:
        - traefik_proxy
    # expose:
    #     - 7878
    restart: always

  lidarr:
    image: linuxserver/lidarr:latest
    container_name: lidarr
    depends_on:
      - "transmission-openvpn"
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/lidarr/config:/config
      - ${MEDIA_PATH}/Music:/music
      - ${MEDIA_PATH}/Downloads:/downloads
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "8686:8686"
    restart: always

  jackett:
    image: linuxserver/jackett:latest
    container_name: jackett
    depends_on:
      - "transmission-openvpn"
    ports:
      - "9117:9117"
    volumes:
        - /${USERDIR}/jackett/config:/config
        - ${MEDIA_PATH}/Downloads:/downloads
        - /etc/localtime:/etc/localtime:ro
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    # labels:
    #     - traefik.backend=jackett
    #     - traefik.frontend.rule=Host:jackett.${DOMAIN}
    #     - traefik.docker.network=traefik
    #     - traefik.port=9117
    networks:
        - traefik_proxy
    # expose:
    #     - 9117
    restart: always

  beets:
    image: linuxserver/beets:latest
    container_name: beets
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/beets/config:/config
      - ${MEDIA_PATH}/Music:/music
      - ${MEDIA_PATH}/Downloads:/downloads
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "8337:8337"
    restart: always

  ubooquity:
    image: linuxserver/ubooquity:latest
    container_name: ubooquity
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/ubooquity/config:/config
      - ${MEDIA_PATH}/Books:/books
      - ${MEDIA_PATH}/Comics:/comics
      # - ${MEDIA_PATH}/books:/files
    ports:
      - "2202:2202"
      - "2203:2203"
    restart: unless-stopped

  lazylibrarian:
    image: linuxserver/lazylibrarian:latest
    container_name: lazylibrarian
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/lazyLibrarian:/config
      - ${MEDIA_PATH}/Downloads:/downloads
      - ${MEDIA_PATH}/books:/books
    ports:
      - "5299:5299"
    restart: unless-stopped

  bazarr:
    image: linuxserver/bazarr:latest
    container_name: bazarr
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${USERDIR}/bazaar/config:/config
      - ${MEDIA_PATH}/Movies:/movies
      - ${MEDIA_PATH}/TV:/tv
    ports:
      - "6767:6767"
    restart: unless-stopped

  plex:
    container_name: plex
    image: linuxserver/plex:latest
    restart: unless-stopped
    #network_mode: host
    ports:
      - "32400:32400/tcp"
      - "3005:3005/tcp"
      - "8324:8324/tcp"
      - "32469:32469/tcp"
      - "1900:1900/udp"
      - "32410:32410/udp"
      - "32412:32412/udp"
      - "32413:32413/udp"
      - "32414:32414/udp"
    environment:
      - TZ=${TZ}
      - PUID=${PUID}
      - PGID=${PGID}
      - VERSION=docker
      - PLEX_CLAIM={PLEX_CLAIM}
      - ADVERTISE_IP=http://{LOCAL_IP}:32400/,https://plex.${DOMAINNAME}:443
      - HOSTNAME="plex"
      - ALLOWED_NETWORKS={LOCAL_NETWORK}/255.255.255.0
    volumes:
      - ${USERDIR}/plex:/config
      - ${MEDIA_PATH}/temp:/transcode
      - ${MEDIA_PATH}/Movies:/data/movies
      - ${MEDIA_PATH}/TV:/data/tvshows
      - ${MEDIA_PATH}/Music:/data/music
    networks:
      - traefik_proxy
      - default
    labels:
      - "traefik.enable=true"
      - "traefik.backend=plex"
      - "traefik.frontend.rule=Host:plex.${DOMAINNAME}"
      #- "traefik.frontend.rule=Host:${DOMAINNAME}; PathPrefixStrip: /plex"
      - "traefik.port=32400"
      - "traefik.protocol=https"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.frontend.headers.SSLRedirect=true"
      - "traefik.frontend.headers.STSSeconds=315360000"
      - "traefik.frontend.headers.browserXSSFilter=true"
      - "traefik.frontend.headers.contentTypeNosniff=true"
      - "traefik.frontend.headers.forceSTSHeader=true"
      - "traefik.frontend.headers.SSLHost=${DOMAINNAME}.com"
      - "traefik.frontend.headers.STSIncludeSubdomains=true"
      - "traefik.frontend.headers.STSPreload=true"
      - "traefik.frontend.headers.frameDeny=true"
      - "traefik.frontend.headers.customFrameOptionsValue=SAMEORIGIN"
      - "traefik.frontend.headers.contentSecurityPolicy=upgrade-insecure-requests"
      - "traefik.frontend.headers.customResponseHeaders=X-Robots-Tag:noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"

  ombi:
    container_name: ombi
    restart: always
    image: linuxserver/ombi:latest
    volumes:
      - ${USERDIR}/ombi:/config
    ports:
      - "3579:3579"
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    # networks:
    #   - traefik_proxy
    # labels:
    #   - "traefik.enable=true"
    #   - "traefik.backend=ombi"
    #   - "traefik.frontend.rule=Host:ombi.${DOMAINNAME}"
    #   #- "traefik.frontend.rule=Host:${DOMAINNAME}; PathPrefixStrip: /ombi"
    #   - "traefik.port=3579"
    #   - "traefik.protocol=https"
    #   - "traefik.docker.network=traefik_proxy"
    #   - "traefik.frontend.headers.SSLRedirect=true"
    #   - "traefik.frontend.headers.STSSeconds=315360000"
    #   - "traefik.frontend.headers.browserXSSFilter=true"
    #   - "traefik.frontend.headers.contentTypeNosniff=true"
    #   - "traefik.frontend.headers.forceSTSHeader=true"
    #   - "traefik.frontend.headers.SSLHost=${DOMAINNAME}.com"
    #   - "traefik.frontend.headers.STSIncludeSubdomains=true"
    #   - "traefik.frontend.headers.STSPreload=true"
    #   - "traefik.frontend.headers.frameDeny=true"
    #   - "traefik.frontend.headers.customFrameOptionsValue=SAMEORIGIN"
    #   - "traefik.frontend.headers.contentSecurityPolicy=upgrade-insecure-requests"
    #   - "traefik.frontend.headers.customResponseHeaders=X-Robots-Tag:noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"

  firefly_iii: 
    container_name: firefly_iii
    image: jc5x/firefly-iii:latest
    depends_on:
      - mariadb
    links:
      - mariadb
    networks: 
      - default
    ports: 
      - "8675:80"
    volumes: 
      - ${USERDIR}/fireflyiii/storage/export:/var/www/firefly-iii/storage/export
      - ${USERDIR}/fireflyiii/storage/upload:/var/www/firefly-iii/storage/upload
      - ${USERDIR}/fireflyiii/storage:/var/www/firefly-iii/storage/
    environment:
      - TZ=${TZ}
      - DB_CONNECTION=mysql
      - DB_HOST=mariadb
      - DB_PORT=${MARIA_DB_PORT}
      - DB_DATABASE=${FIREFLY_DATABASE}
      - DB_USERNAME=${FIREFLY_USER}
      - DB_PASSWORD=${FIREFLY_DB_PASSWORD}
      - APP_KEY=${FIREFLY_APP_KEY}
      - APP_LOG_LEVEL=debug
      - APP_ENV=local

  monicahq:
    container_name: monica
    image: monicahq/monicahq
    depends_on:
      - mariadb
    ports:
      - "9521:80"
    volumes:
      - ${USERDIR}/monica:/var/www/monica/storage
    restart: always
    environment:
      - DB_CONNECTION=mysql
      - DB_HOST=mariadb
      - DB_PORT=${MARIA_DB_PORT}
      - DB_DATABASE=${MONICA_DATABASE}
      - DB_USERNAME=${MONICA_DATABASE_USER}
      - DB_PASSWORD=${MONICA_DB_PASSWORD}
      - APP_KEY=${MONICA_APP_KEY}
      - APP_LOG_LEVEL=debug
      - APP_ENV=local
  
  rhasspy:
    container_name: rhasspy
    image: synesthesiam/rhasspy-server:latest
    volumes:
      - ${USERDIR}/rhasspy/profiles:/profiles
    devices:
      - /dev/snd:/dev/snd
    ports:
      - "12101:12101"
    command: --profile en --user-profiles /profiles

  marytts:
    container_name: marytts
    image: synesthesiam/marytts:5.2
    restart: unless-stopped
    ports:
      - "59125:59125"

networks:
  traefik_proxy:
    external:
      name: traefik_proxy
  default:
    driver: bridge
  # pihole_unbound:
  #   external:
  #     name: pihole_unbound