docker-compose-dsm.yml

version: '2'

services:

  # a DB server; the underlying DB for NextCloud
  postgres:
    image: postgres:15
    container_name: postgres
    restart: unless-stopped
    ports:
      - 54321:5432
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/postgres/15/data:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}

  # a key value store; acts as cache for NextCloud
  redis:
    image: redis:6
    container_name: redis
    command: redis-server --requirepass somedummypass # this is not exposed and used only in this internal network. It is required because of nextcloud
    restart: unless-stopped
    logging:
      driver: "none"

  # maintenance processes that must be run regularly in order for Nextcloud to run properly
  # same image used for the actual nextcloud service below
  nextcloud-cron:
    image: nextcloud:28-fpm-alpine
    container_name: nextcloud-cron
    restart: unless-stopped
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/nextcloud:/var/www/html
      - /etc/localtime:/etc/localtime:ro
    entrypoint: /cron.sh
    environment:
      - POSTGRES_HOST=postgres
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - REDIS_HOST=redis
      - REDIS_HOST_PASSWORD=somedummypass
    depends_on:
      - postgres
      - redis
    logging:
      driver: "none"

  # a Dropbox alternative, self-hosted
  # example for adding missing indices after update: `docker exec --user www-data nextcloud php occ db:add-missing-indices`
  nextcloud:
    image: nextcloud:28-fpm-alpine
    container_name: nextcloud
    restart: unless-stopped
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/nextcloud:/var/www/html
      - /etc/localtime:/etc/localtime:ro
    environment:
      - POSTGRES_HOST=postgres
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - REDIS_HOST=redis
      - REDIS_HOST_PASSWORD=somedummypass
    depends_on:
      - postgres
      - redis
      - nextcloud-cron
      - nginx-nextcloud-fpm-front
    logging:
      driver: "none"

  # the actual php server for NextCloud
  nginx-nextcloud-fpm-front:
    build: ./nginx-nextcloud-fpm-front-x86
    container_name: nginx-nextcloud-fpm-front
    restart: unless-stopped
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/nextcloud:/var/www/html:ro
    expose:
      - 80
    labels:
      - traefik.enable=true
      - traefik.http.routers.nextcloud.rule=Host(`${NEXTCLOUD_HOST}`)
      - traefik.http.routers.nextcloud.entrypoints=websecure
      - traefik.http.routers.nextcloud.tls.certresolver=myresolver
      # Middlewares
      ## Proxy
      ## https://github.com/azonictechnophile/nextcloud_on_docker/blob/4255c29e58f485ae1bad7f0ade61bb99b09e8c21/roles/docker_container/tasks/nginx.yml#L46
      - traefik.http.middlewares.nextcloud.headers.referrerPolicy=no-referrer
      - traefik.http.middlewares.nextcloud.headers.SSLRedirect=true
      #- traefik.http.middlewares.nextcloud.headers.STSSeconds=15552001
      #- traefik.http.middlewares.nextcloud.headers.STSSeconds=315360000
      - traefik.http.middlewares.nextcloud.headers.browserXSSFilter=true
      - traefik.http.middlewares.nextcloud.headers.contentTypeNosniff=true
      #- traefik.http.middlewares.nextcloud.headers.forceSTSHeader=true
      #- traefik.http.middlewares.nextcloud.headers.STSIncludeSubdomains=true
      #- traefik.http.middlewares.nextcloud.headers.STSPreload=true
      - traefik.http.middlewares.nextcloud.headers.customFrameOptionsValue=SAMEORIGIN
      #- traefik.http.middlewares.nextcloud.headers.customRequestHeaders.X-Forwarded-Proto=https
      ## CalDAV/CardDAV
      ## https://docs.nextcloud.com/server/15/admin_manual/configuration_server/reverse_proxy_configuration.html#traefik
      - traefik.http.middlewares.nextcloud-dav.redirectRegex.permanent=true
      - traefik.http.middlewares.nextcloud-dav.redirectRegex.regex="https://(.*)/.well-known/(card|cal)dav"
      - traefik.http.middlewares.nextcloud-dav.redirectRegex.replacement="https://$${1}/remote.php/dav/"
    logging:
      driver: "none"

  # torrent client
  transmission:
    image: linuxserver/transmission:latest
    container_name: transmission
    restart: unless-stopped
    environment:
      - TZ=Europe/London
      - PUID=0
      - PGID=0
      - USER=${TRANSMISSION_USER}
      - PASS=${TRANSMISSION_PASSWORD}
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/MEDIA:/MEDIA
      - ${DATA_VOLUME_BASE_PATH}/media_services/transmission/config:/config
    ports:
      - 51413:51413
      - 51413:51413/udp
    expose:
      - 9091
    labels:
      - traefik.enable=true
      - traefik.http.routers.transmission.rule=Host(`${TRANSMISSION_HOST}`)
      - traefik.http.routers.transmission.entrypoints=websecure
      - traefik.http.routers.transmission.tls.certresolver=myresolver
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4

  flaresolverr:
    # DockerHub mirror flaresolverr/flaresolverr:latest
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    restart: unless-stopped
    environment:
      - CAPTCHA_SOLVER=none
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4

  # to look for TV series
  sonarr:
    image: linuxserver/sonarr:latest
    container_name: sonarr
    restart: unless-stopped
    environment:
      - TZ=Europe/London
      - PUID=0
      - PGID=0
    depends_on:
      - prowlarr
      - transmission
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/sonarr/config:/config
      - ${DATA_VOLUME_BASE_PATH}/media_services/MEDIA:/MEDIA
    expose:
      - 8989
    labels:
      - traefik.enable=true
      - traefik.http.routers.sonarr.rule=Host(`${SONARR_HOST}`)
      - traefik.http.routers.sonarr.entrypoints=websecure
      - traefik.http.routers.sonarr.tls.certresolver=myresolver
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4

  # to look for movies
  radarr:
    image: linuxserver/radarr:latest
    container_name: radarr
    restart: unless-stopped
    environment:
      - TZ=Europe/London
      - PUID=0
      - PGID=0
    depends_on:
      - prowlarr
      - transmission
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/radarr/config:/config
      - ${DATA_VOLUME_BASE_PATH}/media_services/MEDIA:/MEDIA
    expose:
      - 7878
    labels:
      - traefik.enable=true
      - traefik.http.routers.radarr.rule=Host(`${RADARR_HOST}`)
      - traefik.http.routers.radarr.entrypoints=websecure
      - traefik.http.routers.radarr.tls.certresolver=myresolver
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4

  # subtitle download with integration with radarr and sonarr
  bazarr:
    image: linuxserver/bazarr:latest
    container_name: bazarr
    restart: unless-stopped
    environment:
      - TZ=Europe/London
      - PUID=0
      - PGID=0
    depends_on:
      - radarr
      - sonarr
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/bazarr/config:/config
      - ${DATA_VOLUME_BASE_PATH}/media_services/MEDIA:/MEDIA
    expose:
      - 6767
    labels:
      - traefik.enable=true
      - traefik.http.routers.bazarr.rule=Host(`${BAZARR_HOST}`)
      - traefik.http.routers.bazarr.entrypoints=websecure
      - traefik.http.routers.bazarr.tls.certresolver=myresolver
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4

  # like jackett, an indexer manager but it connects via API to radarr and sonarr in order so sync the indexers
  prowlarr:
    image: ghcr.io/linuxserver/prowlarr:develop
    container_name: prowlarr
    restart: unless-stopped
    environment:
      - TZ=Europe/Lisbon
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/prowlarr/config:/config
    expose:
      - 9696
    labels:
      - traefik.enable=true
      - traefik.http.routers.prowlarr.rule=Host(`${PROWLARR_HOST}`)
      - traefik.http.routers.prowlarr.entrypoints=websecure
      - traefik.http.routers.prowlarr.tls.certresolver=myresolver
    depends_on:
      - flaresolverr
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4

  # Syncs configurations from https://trash-guides.info into sonarr and radarr
  # debug/test examples:  docker-compose -f docker-compose-dsm.yml run --rm recyclarr radarr --debug
  recyclarr:
    image: ghcr.io/recyclarr/recyclarr:7
    container_name: recyclarr
    init: true
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/recyclarr/config:/config
    environment:
      - TZ=Europe/Lisbon

  # a media server like Plex
  jellyfin:
    image: jellyfin/jellyfin
    container_name: jellyfin
    restart: unless-stopped
    user: 0:0
    privileged: true
    expose:
      - 8096
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/jellyfin/config:/config
      - ${DATA_VOLUME_BASE_PATH}/media_services/jellyfin/cache:/cache
      - ${DATA_VOLUME_BASE_PATH}/media_services/MEDIA:/media:ro
    devices:
      - /dev/dri/renderD128:/dev/dri/renderD128
    labels:
      - traefik.enable=true
      - traefik.http.routers.jellyfin.rule=Host(`${JELLYFIN_HOST}`)
      - traefik.http.routers.jellyfin.entrypoints=websecure
      - traefik.http.routers.jellyfin.tls.certresolver=myresolver
      - traefik.frontend.headers.forceSTSHeader=true
      - traefik.frontend.headers.STSSeconds=31536000
    environment:
      - JELLYFIN_PublishedServerUrl=https://${JELLYFIN_HOST}
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4

  # another media server...
  midarr:
    image: ghcr.io/midarrlabs/midarr-server:latest
    container_name: midarr
    restart: unless-stopped
    expose:
      - 4000
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/MEDIA:/MEDIA:ro
    environment:
      - APP_URL=https://${MIDARR_HOSTNAME}
      - DB_USERNAME=midarr
      - DB_PASSWORD=${MIDARR_POSTGRES_PASSWORD}
      - DB_DATABASE=midarr
      - DB_HOSTNAME=postgres
      - SETUP_ADMIN_EMAIL=${MIDARR_ADMIN_EMAIL}
      - SETUP_ADMIN_NAME=${MIDARR_ADMIN_USERNAME}
      - SETUP_ADMIN_PASSWORD=${MIDARR_ADMIN_PASSWORD} # minimum length 1
      - RADARR_BASE_URL=radarr:7878
      - RADARR_API_KEY=${MIDARR_RADARR_API_KEY}
      - SONARR_BASE_URL=sonarr:8989
      - SONARR_API_KEY=${MIDARR_SONARR_API_KEY}
    labels:
      - traefik.enable=true
      - traefik.http.routers.midarr.rule=Host(`${MIDARR_HOSTNAME}`)
      - traefik.http.routers.midarr.entrypoints=websecure
      - traefik.http.routers.midarr.tls.certresolver=myresolver
      - traefik.frontend.headers.forceSTSHeader=true
      - traefik.frontend.headers.STSSeconds=31536000
    depends_on:
      - postgres
      - radarr
      - sonarr

  # updates your no ip DNS. Useful when you want to use a CNAME for your actual DNS server records... E.g. sub.domain.com -> CNAME -> my.dynamic.noip.com
  ddns-updater:
    image: qmcgaw/ddns-updater
    container_name: ddns-updater
    restart: unless-stopped
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/noip/config:/updater/data # must supply a valid configuration file inside this folder, otherwise refer to the image on how to build one first.
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4

  # password manager https://bitwarden.com/
  # this image is not the official one: https://github.com/dani-garcia/bitwarden_rs
  bitwarden:
    container_name: bitwarden
    image: vaultwarden/server:latest
    restart: unless-stopped
    expose:
      - 80
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/bitwarden/data:/data
    environment:
      ADMIN_TOKEN: '${BITWARDEN_ADMIN_TOKEN}'
      DATABASE_URL: '${BITWARDEN_DATABASE}'
      WEBSOCKET_ENABLED: 'true'  # Required to use websockets
      SIGNUPS_ALLOWED: 'false'   # set to false to disable signups
    labels:
      - traefik.enable=true
      - traefik.http.routers.bitwarden.rule=Host(`${BITWARDEN_HOST}`)
      - traefik.http.routers.bitwarden.entrypoints=websecure
      - traefik.http.routers.bitwarden.tls.certresolver=myresolver
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    extra_hosts:
      - "host.docker.internal:host-gateway" # https://github.com/docker/for-linux/issues/264

  # https://github.com/traefik/traefik
  # reverse proxy for our services. reads the labels, and adapts the configuration to correctly forward requests
  # according to the host names.
  traefik:
    image: traefik:v2.7
    container_name: traefik
    restart: unless-stopped
    command:
      #- --log.level=DEBUG
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.myresolver.acme.tlschallenge=true
      #- --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
      - --certificatesresolvers.myresolver.acme.email=${ACME_EMAIL}
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
    extra_hosts:
      - host.docker.internal:172.17.0.1 # Required to be able to route into "host" network mode containers
    ports:
      - 4443:443
      - 8080:8080
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/traefik/letsencrypt:/letsencrypt
      - ${DATA_VOLUME_BASE_PATH}/traefik/basic-auth:/basic-auth
      - /var/run/docker.sock:/var/run/docker.sock:ro

  # runs internet speed tests and keeps track of results
  speedtest:
    image: lscr.io/linuxserver/speedtest-tracker:latest
    container_name: speedtest
    restart: unless-stopped
    ports:
        - 8765:80/tcp
    environment:
      - PUID=1000
      - PGID=1000
      - APP_KEY=${SPEEDTEST_APP_KEY}
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/speedtest/config:/config