compose.yaml

x-gpu-devices: &gpu-devices
  # BASE
  - /dev/dri/
  # AMD GPU KFD
  - /dev/kfd
  # ROCKCHIP
  # - /dev/rga/
  # - /dev/dma_heap/
  # - /dev/mpp_service/

services:
#region LOGS
  loki:
    image: grafana/loki:latest
    container_name: loki
    restart: always
    healthcheck:
      test: wget --quiet --tries=1 --output-document=- http://localhost:3100/ready | grep -qw ready || exit 1
    # command: -config.file=/etc/loki/local-config.yaml
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./apps/loki/local-config.yaml:/etc/loki/local-config.yaml:ro
    labels:
      logging: promtail

  promtail:
    image:  grafana/promtail:latest
    container_name: promtail
    restart: always
    # command: -config.file=/etc/promtail/config.yml
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./apps/promtail/config.yml:/etc/promtail/config.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/log:/var/log:ro
    labels:
      logging: promtail
    depends_on:
      - loki

  grafana:
    image: grafana/grafana-oss:latest
    container_name: grafana
    restart: always
    healthcheck:
      test: curl http://localhost:3000/api/health || exit 1
    environment:
      - GF_PATHS_PROVISIONING=/etc/grafana/provisioning
      - GF_AUTH_ANONYMOUS_ENABLED=true
      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
    volumes:
      - /etc/localtime:/etc/localtime:ro
    entrypoint:
      - sh
      - -euc
      - |
        mkdir -p /etc/grafana/provisioning/datasources
        cat <<EOF > /etc/grafana/provisioning/datasources/ds.yaml
        apiVersion: 1
        datasources:
        - name: Loki
          type: loki
          access: proxy
          orgId: 1
          url: http://loki:3100
          basicAuth: false
          isDefault: true
          version: 1
          editable: false
        EOF
        /run.sh
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.grafana.rule: Host(`logs.${HOST?}`)
      traefik.http.routers.grafana.entrypoints: webSecure

      traefik.http.routers.grafana.middlewares: authelia@file
    depends_on:
      - loki
#endregion LOGS

#region BASE
  lldap:
    image: lldap/lldap:stable
    container_name: lldap
    restart: unless-stopped
    # ports:
      # For LDAP
      # - 3890:389
      # For LDAPS (LDAP Over SSL), enable port if LLDAP_LDAPS_OPTIONS__ENABLED set true, look env below
      # - 6360:6360
      # For the web front-end
      # - 17170:17170
    environment:
      - LLDAP_HTTP_URL=https://lldap.${HOST?}
      - LLDAP_LDAP_PORT=389
      - LLDAP_LDAP_BASE_DN=${LDAP_HOST?}
      - LLDAP_LDAP_USER_DN=${LDAP_BIND_ADMIN?}
      - LLDAP_LDAP_USER_EMAIL=${HOST_EMAIL?}
      - LLDAP_LDAP_USER_PASS=${LDAP_BIND_ADMIN_PASSWORD?}
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${APPDATA_VOLUME?}/lldap/:/data/
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.lldap.rule: Host(`lldap.${HOST?}`)
      traefik.http.services.lldap-nas.loadbalancer.server.port: 17170
      traefik.http.routers.lldap.entrypoints: webSecure

      traefik.http.routers.lldap.middlewares: authelia@file

  authelia:
    image: authelia/authelia:latest
    container_name: authelia
    restart: unless-stopped
    secrets: [JWT_SECRET, AUTHENTICATION_BACKEND_LDAP_PASSWORD, SESSION_SECRET, STORAGE_ENCRYPTION_KEY]
    environment:
      - HOST=${HOST?}
      - X_AUTHELIA_CONFIG_FILTERS=template
      - AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE=/run/secrets/JWT_SECRET
      - AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE=/run/secrets/AUTHENTICATION_BACKEND_LDAP_PASSWORD
      - AUTHELIA_SESSION_SECRET_FILE=/run/secrets/SESSION_SECRET
      - AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/run/secrets/STORAGE_ENCRYPTION_KEY
      - AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN=${LDAP_HOST?}
      - AUTHELIA_AUTHENTICATION_BACKEND_LDAP_USER=uid=${LDAP_BIND_ADMIN?},ou=people,${LDAP_HOST?}
      - AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY=${AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY?}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./apps/authelia/configuration.yml:/config/configuration.yml:ro
      - ${APPDATA_VOLUME?}/authelia/:/config/
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.authelia.rule: Host(`auth.${HOST?}`)
      traefik.http.routers.authelia.entrypoints: webSecure
    depends_on:
      - lldap

  traefik:
    # The official v3 Traefik docker image
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    extra_hosts:
      - host.docker.internal:host-gateway
      - router:${ROUTER_IP}
    ports:
      # The HTTP port
      - 80:80
      # The HTTPS port
      - 443:443
      # The Web UI (enabled by --api.insecure=true)
      # - 8080:8080
    healthcheck:
      test: traefik healthcheck --ping
    command:
      - --ping=true
      - --log.level=INFO
      # - --log.level=DEBUG
      # TODO json
      - --accessLog
      - --api.dashboard=true
      # TODO: Uncomment to debug SSL.
      # - --api.insecure=true
      - --providers.docker.exposedByDefault=false
      - --providers.file.directory=/etc/traefik/
      # TODO: Comment to debug dynamic configs.
      - --providers.file.watch=false
      - --entryPoints.web.address=:80
      - --entryPoints.web.http.redirections.entryPoint.to=webSecure
      - --entryPoints.web.http.redirections.entryPoint.scheme=https
      - --entryPoints.web.http.redirections.entryPoint.permanent=true
      - --entryPoints.webSecure.address=:443
      - --entryPoints.webSecure.http.tls.domains[0].main=${HOST?}
      - --entryPoints.webSecure.http.tls.domains[0].sans=*.${HOST?}
      - --entryPoints.webSecure.http.tls.certResolver=ddnsResolver
      - --entryPoints.webSecure.http.middlewares=crowdsec@file,secure-headers@file,gzip@file
      - --certificatesResolvers.ddnsResolver.acme.email=${HOST_EMAIL?}
      - --certificatesResolvers.ddnsResolver.acme.dnsChallenge.provider=${PROVIDER_NAME?}
      # TODO: Long propagation fix https://www.reddit.com/r/Traefik/comments/149dplx/traefik_duckdns_dns_challenge_problem/
      # - --certificatesResolvers.ddnsResolver.acme.dnsChallenge.disablePropagationCheck=true
      # TODO: Uncomment to debug ssl
      # - --certificatesResolvers.ddnsResolver.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory
      - --certificatesResolvers.ddnsResolver.acme.storage=/letsencrypt/acme.json
      # Allow nextcloud-aio-mastercontainer to work.
      - --serversTransport.insecureSkipVerify=true
      - --experimental.plugins.crowdsec-bouncer.moduleName=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
      - --experimental.plugins.crowdsec-bouncer.version=v1.3.5  # To update
    environment:
      - HOST=${HOST?}
      - BOUNCER_KEY_TRAEFIK=${BOUNCER_KEY_TRAEFIK?}
      - ${PROVIDER_ENV?}=${PROVIDER_TOKEN?}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      # Create a letsencrypt dir within the folder where the docker-compose file is
      - ${APPDATA_VOLUME?}/letsencrypt/:/letsencrypt/
      # So that Traefik can listen to the Docker events
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # Traefik dynamic configs
      - ./apps/traefik/:/etc/traefik/:ro
    labels:
      logging: promtail

  whoami:
    image: traefik/whoami:latest
    container_name: whoami
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.whoami.rule: Host(`whoami.${HOST?}`)
      traefik.http.routers.whoami.entrypoints: webSecure

  organizr:
    image: organizr/organizr:latest
    container_name: organizr
    restart: unless-stopped
    # ports:
    #   - 8080:80
    environment:
      - fpm=true  # false by default
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${APPDATA_VOLUME?}/organizr/:/config/
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.organizr.rule: Host(`${HOST?}`) || Host(`www.${HOST?}`)
      traefik.http.services.organizr-nas.loadbalancer.server.scheme: http
      traefik.http.routers.organizr.entrypoints: webSecure

      traefik.http.routers.organizr.middlewares: authelia@file
    depends_on:
      - authelia

  crowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    restart: always
    secrets: [bouncer_key_traefik]
    environment:
      #this is the list of collections we want to install
      - COLLECTIONS=crowdsecurity/sshd crowdsecurity/http-dos crowdsecurity/traefik LePresidente/authelia LePresidente/jellyfin Dominic-Wagner/vaultwarden
      # ? https://app.crowdsec.net/hub/author/crowdsecurity/collections/smb
      # ? https://app.crowdsec.net/hub/author/crowdsecurity/collections/nextcloud
      # ? timokoessler/gitlab gauth-fr/immich
      - DISABLE_SCENARIOS=crowdsecurity/http-crawl-non_statics
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./apps/crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml:ro
      - ${APPDATA_VOLUME?}/crowdsec/:/var/lib/crowdsec/data/
    labels:
      logging: promtail
    depends_on:
      - loki
#endregion BASE

#region CLOUD
  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
    init: true
    restart: always
    # ports:
    #   - 80:80 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
    #   - 8081:8080
    #   - 8443:8443 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
    environment: # Is needed when using any of the options below
      # - AIO_DISABLE_BACKUP_SECTION=false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
      - APACHE_PORT=11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      - APACHE_IP_BINDING=0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      # - APACHE_IP_BINDING=127.0.0.1 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      # - BORG_RETENTION_POLICY=--keep-within=7d --keep-weekly=4 --keep-monthly=6 # Allows to adjust borgs retention policy. See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
      # - COLLABORA_SECCOMP_DISABLED=false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
      - NEXTCLOUD_DATADIR=${APPDATA_VOLUME?}/nextcloud/ # Allows to set the host directory for Nextcloud's datadir. ⚠️⚠️⚠️ Warning: do not set or adjust this value after the initial Nextcloud installation is done! See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir
      - NEXTCLOUD_MOUNT=${STORAGE_VOLUME?}/ # Allows the Nextcloud container to access the chosen directory on the host. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host
      # - NEXTCLOUD_UPLOAD_LIMIT=10G # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud
      # - NEXTCLOUD_MAX_TIME=3600 # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud
      # - NEXTCLOUD_MEMORY_LIMIT=512M # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud
      # - NEXTCLOUD_TRUSTED_CACERTS_DIR=/path/to/my/cacerts # CA certificates in this directory will be trusted by the OS of the nexcloud container (Useful e.g. for LDAPS) See See https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca
      # - NEXTCLOUD_STARTUP_APPS=deck twofactor_totp tasks calendar contacts notes # Allows to modify the Nextcloud apps that are installed on starting AIO the first time. See https://github.com/nextcloud/all-in-one#how-to-change-the-nextcloud-apps-that-are-installed-on-the-first-startup
      # - NEXTCLOUD_ADDITIONAL_APKS=imagemagick # This allows to add additional packages to the Nextcloud container permanently. Default is imagemagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container
      # - NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS=imagick # This allows to add additional php extensions to the Nextcloud container permanently. Default is imagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container
      # - NEXTCLOUD_ENABLE_DRI_DEVICE=true # This allows to enable the /dev/dri device in the Nextcloud container. ⚠️⚠️⚠️ Warning: this only works if the '/dev/dri' device is present on the host! If it should not exist on your host, don't set this to true as otherwise the Nextcloud container will fail to start! See https://github.com/nextcloud/all-in-one#how-to-enable-hardware-transcoding-for-nextcloud
      # - NEXTCLOUD_KEEP_DISABLED_APPS=false # Setting this to true will keep Nextcloud apps that are disabled in the AIO interface and not uninstall them if they should be installed. See https://github.com/nextcloud/all-in-one#how-to-keep-disabled-apps
      # - TALK_PORT=3478 # This allows to adjust the port that the talk container is using. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-talk-port
      # - WATCHTOWER_DOCKER_SOCKET_PATH=/var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. Otherwise mastercontainer updates will fail. For macos it needs to be '/var/run/docker.sock'
    # networks: # Is needed when you want to create the nextcloud-aio network with ipv6-support using this file, see the network config at the bottom of the file
      # - nextcloud-aio # Is needed when you want to create the nextcloud-aio network with ipv6-support using this file, see the network config at the bottom of the file
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config/ # This line is not allowed to be changed as otherwise the built-in backup solution will not work
      - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.nextcloud-aio-mastercontainer.rule: Host(`aio.cloud.${HOST?}`)
      traefik.http.services.nextcloud-aio-mastercontainer-nas.loadbalancer.server.port: 8080
      traefik.http.services.nextcloud-aio-mastercontainer-nas.loadbalancer.server.scheme: https
      traefik.http.routers.nextcloud-aio-mastercontainer.entrypoints: webSecure

      traefik.http.routers.nextcloud-aio-mastercontainer.middlewares: authelia@file

  transmission:
    # https://hub.docker.com/r/linuxserver/transmission
    image: lscr.io/linuxserver/transmission:latest
    container_name: transmission
    restart: unless-stopped
    ports:
      # - 9091:9091
      - 51413:51413
      - 51413:51413/udp
    healthcheck:
      test: curl http://localhost:9091 || exit 1
    # https://github.com/linuxserver/docker-mods/tree/transmission-env-var-settings
    # https://github.com/linuxserver/docker-mods/tree/transmission-transmissionic
    environment:
      - DOCKER_MODS=linuxserver/mods:transmission-env-var-settings|linuxserver/mods:transmission-transmissionic
      - TRANSMISSION_WEB_HOME=/transmissionic/
      # - TRANSMISSION_WEB_HOME=/transmission-web-control/
      # - TRANSMISSION_WEB_HOME=/flood-for-transmission/
      # - TRANSMISSION_ALT_SPEED_DOWN=2048
      # - TRANSMISSION_ALT_SPEED_UP=256
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${APPDATA_VOLUME?}/transmission/:/config/
      - ${STORAGE_VOLUME?}/downloads/:/downloads/
      - ${STORAGE_VOLUME?}/downloads/torrents/:/watch/
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.transmission.rule: Host(`torrent.${HOST?}`)
      traefik.http.routers.transmission.entrypoints: webSecure

      traefik.http.routers.transmission.middlewares: authelia@file

  jellyfin:
    # https://hub.docker.com/r/linuxserver/jellyfin
    image: lscr.io/linuxserver/jellyfin:latest
    group_add: # by id as these may not exist within the container. Needed to provide permissions to the VAAPI Devices
      - '107' #render
      - '44' #video
    container_name: jellyfin
    restart: unless-stopped
    ports:
      - 8096:8096
      - 1900:1900/udp
      - 7359:7359/udp
    healthcheck:
      test: curl http://localhost:8096/health || exit 1
      retries: 6
    environment:
      - JELLYFIN_PublishedServerUrl=${LAN_HOST?}
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      # https://app.crowdsec.net/hub/author/LePresidente/collections/jellyfin
      - ./apps/jellyfin/logging.json:/config/config/logging.json:ro
      - ${APPDATA_VOLUME?}/jellyfin/:/config/
      - ${STORAGE_VOLUME?}/downloads/media/youtube/:/data/youtube/
      - ${STORAGE_VOLUME?}/downloads/media/tvshows/:/data/tvshows/
      - ${STORAGE_VOLUME?}/downloads/media/movies/:/data/movies/
      - ${STORAGE_VOLUME?}/downloads/media/music/:/data/music/
    devices:
      *gpu-devices
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.jellyfin.rule: Host(`media.${HOST?}`)
      traefik.http.services.jellyfin-nas.loadbalancer.server.port: 8096
      traefik.http.routers.jellyfin.entrypoints: webSecure

  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    # ports:
    #   - 80:80
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${APPDATA_VOLUME?}/vaultwarden/:/data/
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.vaultwarden.rule: Host(`bitwarden.${HOST?}`)
      traefik.http.routers.vaultwarden.entrypoints: webSecure

      # traefik.http.routers.vaultwarden.middlewares: authelia@file
#endregion CLOUD

#region Servarr
  flaresolverr:
    # https://hub.docker.com/r/flaresolverr/flaresolverr
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    restart: unless-stopped
    # ports:
    #   - 8191:8191
    # environment:
    #   - LOG_LEVEL=info
    #   - LOG_HTML=false
    #   - CAPTCHA_SOLVER=none
    volumes:
      - /etc/localtime:/etc/localtime:ro
    labels:
      logging: promtail

  prowlarr:
    # https://hub.docker.com/r/linuxserver/prowlarr
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    restart: unless-stopped
    # ports:
    #   - 9696:9696
    healthcheck:
      test: curl http://localhost:9696 || exit 1
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${APPDATA_VOLUME?}/prowlarr/:/config/
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.prowlarr.rule: Host(`prowlarr.${HOST?}`)
      traefik.http.routers.prowlarr.entrypoints: webSecure

      traefik.http.routers.prowlarr.middlewares: authelia@file
    depends_on:
      - transmission

  # lidarr:
  #   # https://hub.docker.com/r/linuxserver/lidarr
  #   image: lscr.io/linuxserver/lidarr:latest
  #   container_name: lidarr
  #   restart: unless-stopped
  #   # ports:
  #   #   - 8686:8686
  #   env_file:
  #     - lscr.env
  #   volumes:
  #     - /etc/localtime:/etc/localtime:ro
  #     - ${APPDATA_VOLUME?}/lidarr/:/config/
  #     - ${STORAGE_VOLUME?}/downloads/:/downloads/
  #   labels:
  #     logging: promtail
  #     traefik.enable: true
  #     traefik.http.routers.lidarr.rule: Host(`lidarr.${HOST?}`)
  #     traefik.http.routers.lidarr.entrypoints: webSecure

  #     traefik.http.routers.lidarr.middlewares: authelia@file
  #   depends_on:
  #     - prowlarr

  radarr:
    # https://hub.docker.com/r/linuxserver/radarr
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    restart: unless-stopped
    # ports:
    #   - 7878:7878
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${APPDATA_VOLUME?}/radarr/:/config/
      - ${STORAGE_VOLUME?}/downloads/:/downloads/
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.radarr.rule: Host(`radarr.${HOST?}`)
      traefik.http.routers.radarr.entrypoints: webSecure

      traefik.http.routers.radarr.middlewares: authelia@file
    depends_on:
      - prowlarr

  sonarr:
    # https://hub.docker.com/r/linuxserver/sonarr
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    restart: unless-stopped
    # ports:
    #   - 8989:8989
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${APPDATA_VOLUME?}/sonarr/:/config/
      - ${STORAGE_VOLUME?}/downloads/:/downloads/
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.sonarr.rule: Host(`sonarr.${HOST?}`)
      traefik.http.routers.sonarr.entrypoints: webSecure

      traefik.http.routers.sonarr.middlewares: authelia@file
    depends_on:
      - prowlarr
#endregion Servarr

#region CLOUD
  tubesync:
    # https://github.com/meeb/tubesync
    image: ghcr.io/meeb/tubesync:latest
    container_name: tubesync
    restart: unless-stopped
    # ports:
    #   - 4848:4848
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${APPDATA_VOLUME?}/tubesync/:/config/
      - ${STORAGE_VOLUME?}/downloads/media/youtube/:/downloads/
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.tubesync.rule: Host(`youtube.${HOST?}`)
      traefik.http.routers.tubesync.entrypoints: webSecure

      traefik.http.routers.tubesync.middlewares: authelia@file

  syncthing:
    image: syncthing/syncthing:latest
    container_name: syncthing
    hostname: sync.${HOST?}
    ports:
      # - 8384:8384 # Web UI
      - 22000:22000/tcp # TCP file transfers
      - 22000:22000/udp # QUIC file transfers
      - 21027:21027/udp # Receive local discovery broadcasts
    healthcheck:
      test: curl -fkLsS -m 2 127.0.0.1:8384/rest/noauth/health | grep -o --color=never OK || exit 1
      interval: 1m
      timeout: 10s
      retries: 3
    # environment:
    #   - PCAP=cap_chown,cap_fowner+ep
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${APPDATA_VOLUME?}/syncthing/:/var/syncthing/config/
      - ${STORAGE_VOLUME?}/sync/:/var/syncthing/Sync/
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.syncthing.rule: Host(`sync.${HOST?}`)
      traefik.http.routers.syncthing.entrypoints: webSecure

      traefik.http.routers.syncthing.middlewares: authelia@file
    restart: unless-stopped

  gitlab:
    image: gitlab/gitlab-ce:latest
    # image: yrzr/gitlab-ce-arm64v8:latest
    container_name: gitlab
    restart: unless-stopped
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://gitlab.${HOST?}'
        nginx['listen_https'] = false
        nginx['listen_port'] = 80

        # Add any other gitlab.rb configuration here, each on its own line
        gitlab_rails['ldap_enabled'] = true
        gitlab_rails['ldap_servers'] = {
          'main' => {
            'label' => 'NAS',
            'host' =>  'lldap',
            'port' => 389,
            'uid' => 'uid',
            'base' => 'ou=people,${LDAP_HOST?}',
            'encryption' => 'plain',
            'bind_dn' => 'uid=${LDAP_BIND_ADMIN?},ou=people,${LDAP_HOST?}',
            'password' => '${LDAP_BIND_ADMIN_PASSWORD?}',
            'active_directory' => false,
            'user_filter' => '(&(objectclass=person)(memberof=cn=git_user,ou=groups,${LDAP_HOST?}))',
            'attributes' => {
              'username' => 'uid',
              'email' => 'mail',
              'name' => 'displayName',
              'first_name' => 'givenName',
              'last_name' => 'sn'
            }
          }
        }
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${APPDATA_VOLUME?}/gitlab/config/:/etc/gitlab/
      - ${APPDATA_VOLUME?}/gitlab/logs/:/var/log/gitlab/
      - ${APPDATA_VOLUME?}/gitlab/data/:/var/opt/gitlab/
    shm_size: '256m'
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.gitlab.rule: Host(`gitlab.${HOST?}`)
      traefik.http.services.gitlab-nas.loadbalancer.server.port: 80
      traefik.http.routers.gitlab.entrypoints: webSecure

      # traefik.http.routers.gitlab.middlewares: authelia@file
#endregion CLOUD

#region GUI
  # browser:
  #   # https://hub.docker.com/r/linuxserver/chromium
  #   image: lscr.io/linuxserver/chromium:latest
  #   # https://hub.docker.com/r/linuxserver/firefox
  #   # image: lscr.io/linuxserver/firefox:latest
  #   container_name: browser
  #   # security_opt:
  #   #   - seccomp:unconfined #optional
  #   # ports:
  #   #   - 3000:3000
  #   # environment:
  #   #   - TITLE=kek
  #   #   - DRINODE=/dev/dri/card0
  #   #   - CHROME_CLI=https://www.linuxserver.io/ #optional
  #   #   - FIREFOX_CLI=https://www.linuxserver.io/ #optional
  #   # env_file:
  #   #   - lscr.env
  #   volumes:
  #     - /etc/localtime:/etc/localtime:ro
  #   devices:
  #     *gpu-devices
  #   shm_size: '1gb'
  #   labels:
  #     logging: promtail
  #     traefik.enable: true
  #     traefik.http.routers.browser.rule: Host(`browser.${HOST?}`)
  #     traefik.http.routers.browser.entrypoints: webSecure

  #     traefik.http.middlewares.gui-disable-security.headers.contentSecurityPolicy: frame-ancestors browser.${HOST?}
  #     # traefik.http.middlewares.gui-disable-security.headers.customResponseHeaders.Content-Security-Policy: ''
  #     traefik.http.routers.browser.middlewares: authelia@file, gui-disable-security
#endregion GUI

#region LocalServices
  samba:
    image: crazymax/samba:latest
    container_name: samba
    restart: unless-stopped
    network_mode: host
    # ports:
    #   - 445:445
    cap_add:
      - CAP_NET_ADMIN
      - CAP_NET_RAW
    environment:
      - USER=${SAMBA_USER?}
      - GROUP=${SAMBA_GROUP?}
      - PASSWORD=${SAMBA_PASSWORD?}
      - SAMBA_LOG_LEVEL=0
      - WSDD2_ENABLE=1
      - WSDD2_NETBIOS_NAME=NAS
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./apps/samba/config.yml:/data/config.yml:ro
      - ${APPDATA_VOLUME?}/samba/:/data/
      - ${STORAGE_VOLUME?}/:/samba/storage/
    labels:
      logging: promtail
#endregion LocalServices

#region MonitorServices
  portainer:
    image: portainer/portainer:1.25.0
    container_name: portainer
    restart: unless-stopped
    command: -H unix:///var/run/docker.sock --no-auth
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - ${APPDATA_VOLUME?}/portainer/:/data/
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.portainer.rule: Host(`docker.${HOST?}`)
      traefik.http.services.portainer-nas.loadbalancer.server.port: 9000
      traefik.http.routers.portainer.entrypoints: webSecure
      traefik.http.routers.portainer.service: portainer-nas

      traefik.http.routers.portainer.middlewares: authelia@file

  watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    restart: unless-stopped
    command: --cleanup --remove-volumes
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock

  glances:
    image: nicolargo/glances:latest
    container_name: glances
    restart: unless-stopped
    pid: host
    environment:
      - GLANCES_OPT=-w
    env_file:
      - lscr.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /etc/os-release:/etc/os-release:ro
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.glances.rule: Host(`control.${HOST?}`)
      traefik.http.routers.glances.entrypoints: webSecure

      traefik.http.routers.glances.middlewares: authelia@file

  scrutiny:
    # https://github.com/AnalogJ/scrutiny
    # https://glances.readthedocs.io/en/latest/cmds.html#interactive-commands
    image: ghcr.io/analogj/scrutiny:master-omnibus
    container_name: scrutiny
    restart: unless-stopped
    # ports:
    #   - 8080:8080 # webapp
    #   - 8086:8086 # influxDB admin
    cap_add:
      - SYS_RAWIO
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /run/udev:/run/udev:ro
      - ${APPDATA_VOLUME?}/scrutiny/config/:/opt/scrutiny/config/
      - ${APPDATA_VOLUME?}/scrutiny/influxdb/:/opt/scrutiny/influxdb/
    devices:
      - /dev/sda
      - /dev/sdb
      - /dev/sdc
      - /dev/sdd
    labels:
      logging: promtail
      traefik.enable: true
      traefik.http.routers.scrutiny.rule: Host(`smart.control.${HOST?}`)
      traefik.http.routers.scrutiny.entrypoints: webSecure

      traefik.http.routers.scrutiny.middlewares: authelia@file
#endregion MonitorServices


secrets:
  JWT_SECRET:
    environment: AUTHELIA_SECRET
  AUTHENTICATION_BACKEND_LDAP_PASSWORD:
    environment: LDAP_BIND_ADMIN_PASSWORD
  SESSION_SECRET:
    environment: AUTHELIA_SECRET
  STORAGE_ENCRYPTION_KEY:
    environment: AUTHELIA_SECRET
  bouncer_key_traefik:
    environment: BOUNCER_KEY_TRAEFIK


volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work