docker-compose.yml

networks:
  home:
    driver: bridge

x-env: &env
  PUID: 1000
  PGID: 1000
  TZ: Europe/London

x-healthcheck: &healthcheck
  test: [ "CMD-SHELL", "curl -f https://icanhazip.com/ || exit 1" ]
  interval: 10s
  timeout: 3s
  retries: 5

x-common: &common
  environment:
    <<: *env
  restart: unless-stopped
  healthcheck:
    <<: *healthcheck
  networks:
    home:
  security_opt:
    - no-new-privileges:true

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    ports:
      - 80:80
      - 443:443
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/traefik/traefik.yaml:/traefik.yaml:ro
      - ./config/traefik/acme.json:/acme.json
    environment:
      - CF_DNS_API_TOKEN=${CLOUDFLARE_TRAEFIK_TOKEN}
    networks:
      home:
    labels:
      - traefik.enable=true
      - traefik.http.middlewares.admin.basicauth.users=${TRAEFIK_BASIC_AUTH_USER}:${TRAEFIK_BASIC_AUTH_PASSWORD}
      - traefik.http.routers.traefik.entrypoints=websecure
      - traefik.http.routers.traefik.middlewares=admin
      - traefik.http.routers.traefik.rule=Host(`traefik.petalas.dev`)
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.routers.traefik.tls.certresolver=cloudflare
      - traefik.http.routers.traefik.tls.domains[0].sans=*.petalas.dev
      - traefik.http.services.traefik.loadbalancer.server.port=443

  whoami:
    image: traefik/whoami
    container_name: whoami
    networks:
      home:
    labels:
      - traefik.enable=true
      - traefik.http.routers.whoami.entrypoints=websecure
      - traefik.http.routers.whoami.rule=Host(`whoami.petalas.dev`)
      - traefik.http.routers.whoami.service=whoami
      - traefik.http.routers.whoami.tls=true
      - traefik.http.services.whoami.loadbalancer.server.port=80

  glances:
    image: nicolargo/glances:latest-full
    container_name: glances
    restart: unless-stopped
    pid: host
    network_mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/glances:/etc/glances
      - /mnt:/mnt:ro
    environment:
      TZ: Europe/London
      GLANCES_OPT: "-w"
    labels:
      - traefik.enable=false

  uptime-kuma:
    image: louislam/uptime-kuma:1
    container_name: uptime-kuma
    <<: *common
    environment:
      # can't have PUID and GUID of 1000 (needs to run as root for docker.sock permissions)
      TZ: Europe/London
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/uptime-kuma:/app/data
    ports:
      - 3001:3001
    labels:
      - traefik.enable=true
      - traefik.http.routers.kuma.entrypoints=websecure
      - traefik.http.routers.kuma.rule=Host(`kuma.petalas.dev`)
      - traefik.http.routers.kuma.service=kuma
      - traefik.http.routers.kuma.tls=true
      - traefik.http.services.kuma.loadbalancer.server.port=3001

  code-server:
    image: lscr.io/linuxserver/code-server:latest
    container_name: code-server
    <<: *common
    environment:
      <<: *env
      PROXY_DOMAIN: code-server.petalas.dev
      DEFAULT_WORKSPACE: /git
      PASSWORD: ${CODE_SERVER_PASSWORD}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/code-server:/config
      - ${HOME}/git:/git
    ports:
      - 8443:8443
    healthcheck:
      <<: *healthcheck
      test: [ "CMD-SHELL", "curl -f http://localhost:8443 || exit 1" ]
    labels:
      - traefik.enable=true
      - traefik.http.routers.code-server.service=code-server
      - traefik.http.routers.code-server.entrypoints=websecure
      - traefik.http.routers.code-server.rule=Host(`code-server.petalas.dev`)
      - traefik.http.routers.code-server.tls=true
      - traefik.http.services.code-server.loadbalancer.server.port=8443

  homepage:
    # image: ghcr.io/gethomepage/homepage:latest
    build:
      context: ./dockerfiles
      dockerfile: ./homepage
    container_name: homepage
    restart: unless-stopped
    environment:
      HOMEPAGE_ALLOWED_HOSTS: dashboard.petalas.dev
      HOMEPAGE_VAR_PIHOLE_API_KEY: ${HOMEPAGE_VAR_PIHOLE_API_KEY}
    healthcheck:
      <<: *healthcheck
      test: [ "CMD-SHELL", "exit 0" ] # TODO: figure out what kind of healthcheck we can do
    ports:
      - 3000:3000
    volumes:
      - ./config/homepage:/app/config
      - ./images:/app/public/images
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      home:
    labels:
      - traefik.enable=true
      - traefik.http.routers.homepage.entrypoints=websecure
      - traefik.http.routers.homepage.rule=Host(`dashboard.petalas.dev`)
      - traefik.http.routers.homepage.service=homepage
      - traefik.http.routers.homepage.tls=true
      - traefik.http.services.homepage.loadbalancer.server.port=3000

  plex:
    image: linuxserver/plex
    container_name: plex
    network_mode: host
    environment:
      <<: *env
      VERSION: docker
    restart: unless-stopped
    healthcheck:
      <<: *healthcheck
      test: [ "CMD-SHELL", "curl -f https://plex.com/ || exit 1" ]
    volumes:
      - ./config/plex:/config
      - ./config/plex/transcode:/transcode
      - /mnt/storage/tv:/tv
      - /mnt/storage/movies:/movies
      - /mnt/storage/music:/music
      - /mnt/storage/books:/books
    labels:
      - traefik.enable=false
      - homepage.group=brr
      - homepage.weight=2
      - homepage.name=plex
      - homepage.icon=plex.svg
      - homepage.href=http://192.168.1.102:32400
      - homepage.widget.type=plex
      - homepage.widget.url=http://192.168.1.102:32400
      - homepage.widget.key=${PLEX_API_KEY}

  sonarr:
    image: lscr.io/linuxserver/sonarr:develop
    container_name: sonarr
    <<: *common
    volumes:
      - ./config/sonarr:/config
      - ./scripts:/scripts:ro
      - /mnt/storage/:/data
    ports:
      - 32784:8989
    healthcheck:
      <<: *healthcheck
      test:
        [
          "CMD-SHELL",
          "curl -f http://localhost:8989/sonarr/ping || exit 1"
        ]
    depends_on:
      qbittorrent:
        condition: service_healthy
      sabnzbd:
        condition: service_healthy
      prowlarr:
        condition: service_healthy
    labels:
      - traefik.enable=false
      - homepage.weight=3
      - homepage.group=media
      - homepage.name=sonarr
      - homepage.icon=sonarr.svg
      - homepage.href=http://192.168.1.102:32784
      - homepage.widget.type=sonarr
      - homepage.widget.url=http://192.168.1.102:32784
      - homepage.widget.key=${SONARR_API_KEY}
      - homepage.widget.enableQueue=true

  # nicotine:
  #   image: npetalas/nicotineplus:xpra
  #   container_name: nicotine
  #   restart: unless-stopped
  #   environment:
  #     <<: *env
  #     DARKMODE: true
  #     LOGIN: ${SOULSEEK_LOGIN}
  #     PASSW: ${SOULSEEK_PASSWORD}
  #   volumes:
  #     - ./config/nicotine:/root/.config/nicotine # (Optional) Save your config persistently
  #     - ./config/nicotine/data:/root/.local/share/nicotine #(Optional) Store your logs, database, and history
  #     - /mnt/storage/music:/music
  #   deploy:
  #     resources:
  #       limits:
  #         cpus: '0.5'
  #         memory: 2G
  #   network_mode: service:gluetun
  #   depends_on:
  #     gluetun:
  #       condition: service_healthy

  # gluetun:
  #   image: qmcgaw/gluetun
  #   container_name: gluetun
  #   cap_add:
  #     - NET_ADMIN
  #   devices:
  #     - /dev/net/tun:/dev/net/tun
  #   ports:
  #     - 8000:8000 # control server
  #     - 6565:6565 # nicotine+
  #     - ${VPN_FORWARDED_PORT}:${VPN_FORWARDED_PORT}
  #   volumes:
  #     - ./config/gluetun:/gluetun
  #   environment:
  #     <<: *env
  #     VPN_SERVICE_PROVIDER: private internet access
  #     OPENVPN_USER: ${VPN_USER}
  #     OPENVPN_PASSWORD: ${VPN_PASSWORD}
  #     SERVER_REGIONS: UK London
  #     VPN_PORT_FORWARDING: on
  #     PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET: 'normal' # strong|normal|none, default 'strong'
  #   networks:
  #    home:

  radarr:
    image: linuxserver/radarr
    container_name: radarr
    <<: *common
    volumes:
      - ./config/radarr:/config
      - ./scripts:/scripts:ro
      - /mnt/storage/:/data
    ports:
      - 32783:7878
    healthcheck:
      <<: *healthcheck
      test:
        [
          "CMD-SHELL",
          "curl -f http://localhost:7878/radarr/ping || exit 1"
        ]
    depends_on:
      qbittorrent:
        condition: service_healthy
      sabnzbd:
        condition: service_healthy
      prowlarr:
        condition: service_healthy
    labels:
      - traefik.enable=false
      - homepage.weight=2
      - homepage.group=media
      - homepage.name=radarr
      - homepage.icon=radarr.svg
      - homepage.href=http://192.168.1.102:32783
      - homepage.widget.type=radarr
      - homepage.widget.url=http://192.168.1.102:32783
      - homepage.widget.key=${RADARR_API_KEY}
      - homepage.widget.enableQueue=true

  sabnzbd:
    image: linuxserver/sabnzbd
    container_name: sabnzbd
    <<: *common
    volumes:
      - ./config/sabnzbd:/config
      - /mnt/storage:/data
    ports:
      - 32781:8080
      - 32782:9090
    healthcheck:
      <<: *healthcheck
      test: [ "CMD-SHELL", "curl -f http://localhost:8080 || exit 1" ]
    labels:
      - traefik.enable=false
      - homepage.weight=3
      - homepage.group=downloaders
      - homepage.name=sabnzbd
      - homepage.icon=sabnzbd.svg
      - homepage.href=http://192.168.1.102:32781
      - homepage.widget.type=sabnzbd
      - homepage.widget.url=http://192.168.1.102:32781
      - homepage.widget.key=${SABNZBD_API_KEY}
      - homepage.widget.refreshInterval=1000

  qbittorrent:
    image: ghcr.io/hotio/qbittorrent:release-5.0.1
    container_name: qbittorrent
    <<: *common
    environment:
      <<: *env
      VPN_ENABLED: true
      VPN_CONF: wg0
      VPN_PROVIDER: pia
      VPN_LAN_NETWORK: 192.168.1.0/24
      VPN_LAN_LEAK_ENABLED: false
      VPN_EXPOSE_PORTS_ON_LAN:
      VPN_AUTO_PORT_FORWARD: true
      VPN_AUTO_PORT_FORWARD_TO_PORTS:
      VPN_KEEP_LOCAL_DNS: true
      VPN_FIREWALL_TYPE: auto
      VPN_HEALTHCHECK_ENABLED: true
      VPN_PIA_PREFERRED_REGION: uk
      VPN_PIA_USER: ${VPN_USER}
      VPN_PIA_PASS: ${VPN_PASSWORD}
      VPN_PIA_DIP_TOKEN: no
      VPN_PIA_PORT_FORWARD_PERSIST: true
      PRIVOXY_ENABLED: false
      UNBOUND_ENABLED: false
      WEBUI_PORTS: 8080/tcp,8080/udp
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1 #
      - net.ipv6.conf.all.disable_ipv6=1 #
    volumes:
      - ./config/qbittorrent:/config
      - /mnt/storage:/data
    ports:
      - 8080:8080
    healthcheck:
      <<: *healthcheck
      test: [ "CMD-SHELL", "curl -f http://localhost:8080 || exit 1" ]
    labels:
      - traefik.enable=false
      - homepage.weight=2
      - homepage.group=downloaders
      - homepage.name=qbittorrent
      - homepage.icon=qbittorrent.svg
      - homepage.href=http://192.168.1.102:8080
      - homepage.widget.type=qbittorrent
      - homepage.widget.url=http://192.168.1.102:8080
      - homepage.widget.username=${QBIT_USER}
      - homepage.widget.password=${QBIT_PASS}
      - homepage.widget.refreshInterval=1000

  lidarr:
    image: linuxserver/lidarr
    container_name: lidarr
    <<: *common
    volumes:
      - ./config/lidarr:/config
      - /mnt/storage:/data
    ports:
      - 32786:8686
    healthcheck:
      <<: *healthcheck
      test:
        [
          "CMD-SHELL",
          "curl -f http://localhost:8686/lidarr/ping || exit 1"
        ]
    depends_on:
      qbittorrent:
        condition: service_healthy
      sabnzbd:
        condition: service_healthy
      prowlarr:
        condition: service_healthy
    labels:
      - traefik.enable=false
      - homepage.weight=4
      - homepage.group=media
      - homepage.name=lidarr
      - homepage.icon=lidarr.svg
      - homepage.href=http://192.168.1.102:32786
      - homepage.widget.type=lidarr
      - homepage.widget.url=http://192.168.1.102:32786
      - homepage.widget.key=${LIDARR_API_KEY}

  readarr:
    image: lscr.io/linuxserver/readarr:develop
    # build:
    #   context: ./dockerfiles
    #   dockerfile: ./readarr
    container_name: readarr
    <<: *common
    volumes:
      - ./config/readarr:/config
      - /mnt/storage:/data
    ports:
      - 8787:8787
    healthcheck:
      <<: *healthcheck
      test:
        [
          "CMD-SHELL",
          "curl -f http://localhost:8787/readarr/ping || exit 1"
        ]
    depends_on:
      qbittorrent:
        condition: service_healthy
      sabnzbd:
        condition: service_healthy
      prowlarr:
        condition: service_healthy
    labels:
      - traefik.enable=false

  prowlarr:
    image: linuxserver/prowlarr:develop
    container_name: prowlarr
    <<: *common
    volumes:
      - ./config/prowlarr:/config
    ports:
      - 32787:9696
    healthcheck:
      <<: *healthcheck
      test:
        [
          "CMD-SHELL",
          "curl -f http://localhost:9696/prowlarr/ping || exit 1"
        ]
    depends_on:
      flaresolverr:
        condition: service_healthy
    labels:
      - traefik.enable=false
      - homepage.group=brr
      - homepage.weight=3
      - homepage.name=prowlarr
      - homepage.icon=prowlarr.svg
      - homepage.href=http://192.168.1.102:32787
      - homepage.widget.type=prowlarr
      - homepage.widget.url=http://192.168.1.102:32787
      - homepage.widget.key=${PROWLARR_API_KEY}

  iperf3:
    image: networkstatic/iperf3
    container_name: iperf3
    ports:
      - 5201:5201
    restart: unless-stopped
    command: -s
    healthcheck:
      <<: *healthcheck
      # not a real healthcheck, only confirms there's a process named iperf3 running
      test:
        [
          "CMD-SHELL",
          "grep iperf3 /proc/*[0-9]*/status || exit 1"
        ]
    labels:
      - traefik.enable=false

  netdata:
    image: netdata/netdata
    container_name: netdata
    environment:
      <<: *env
    restart: unless-stopped
    healthcheck:
      <<: *healthcheck
    network_mode: host
    cap_add:
      - SYS_PTRACE
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    volumes:
      - ./config/netdata/config:/etc/netdata
      - ./config/netdata/data:/var/lib/netdata
      - ./config/netdata/cache:/var/cache/netdata
      - /etc/passwd:/host/etc/passwd:ro
      - /etc/group:/host/etc/group:ro
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /etc/VERSION:/host/etc/os-release:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    labels:
      - traefik.enable=false
      # - homepage.group=network
      # - homepage.name=Netdata
      # - homepage.icon=netdata.svg
      # - homepage.href=http://192.168.1.102:19999
      # - homepage.widget.type=netdata
      # - homepage.widget.url=http://192.168.1.102:19999

  recyclarr:
    image: ghcr.io/recyclarr/recyclarr
    container_name: recyclarr
    <<: *common
    volumes:
      - ./config/recyclarr:/config
    healthcheck:
      <<: *healthcheck
      test: [ "CMD-SHELL", "exit 0" ] # TODO: figure out what kind of healthcheck we can do
    labels:
      - traefik.enable=false

  autobrr:
    image: ghcr.io/autobrr/autobrr:latest
    container_name: autobrr
    <<: *common
    logging:
      driver: json-file
      options:
        max-file: "1"
        max-size: "10M"
    volumes:
      - ./config/autobrr:/config
    ports:
      - 7474:7474
    healthcheck:
      <<: *healthcheck
      test: [ "CMD", "curl", "-f", "http://localhost:7474" ]
    depends_on:
      prowlarr:
        condition: service_healthy
      radarr:
        condition: service_healthy
      sonarr:
        condition: service_healthy
      lidarr:
        condition: service_healthy
      readarr:
        condition: service_healthy
    labels:
      - traefik.enable=false
      - homepage.group=brr
      - homepage.weight=1
      - homepage.name=autobrr
      - homepage.icon=autobrr.svg
      - homepage.href=http://192.168.1.102:7474
      - homepage.widget.type=autobrr
      - homepage.widget.url=http://192.168.1.102:7474
      - homepage.widget.key=${AUTOBRR_API_KEY}

  omegabrr:
    container_name: omegabrr
    image: ghcr.io/autobrr/omegabrr:latest
    <<: *common
    healthcheck:
      test: [ "CMD", "true" ]
    ports:
      - "7441:7441"
    volumes:
      - "./config/omegabrr:/config"
    depends_on:
      autobrr:
        condition: service_healthy
      prowlarr:
        condition: service_healthy
      radarr:
        condition: service_healthy
      sonarr:
        condition: service_healthy
      lidarr:
        condition: service_healthy
      readarr:
        condition: service_healthy
    labels:
      - traefik.enable=false

  cross-seed:
    image: crossseed/cross-seed
    container_name: cross-seed
    <<: *common
    healthcheck:
      test: [ "CMD", "true" ]
    volumes:
      - ./config/cross-seed:/config
      - ./config/qbittorrent/data/BT_backup:/torrents:ro # note that this volume can and should be mounted read-only
      - /mnt/storage:/data # this is optional dataDir path (for data-based matching) - will need to mirror your torrent client's path (like Arr's do)
      - /mnt/storage/cross-seeds:/cross-seeds
    command: daemon
    ports:
      - 2468:2468
    depends_on:
      prowlarr:
        condition: service_healthy
      qbittorrent:
        condition: service_healthy
    labels:
      - traefik.enable=false

  qbit_manage:
    container_name: qbit_manage
    image: bobokun/qbit_manage
    <<: *common
    healthcheck:
      test: [ "CMD", "true" ]
    volumes:
      - ./config/qbit_manage/:/config:rw
      - /mnt/storage:/data
      - ./config/qbittorrent/qBittorrent/BT_backup:/qbittorrent/:ro
    environment:
      <<: *env
      QBT_RUN: "false"
      QBT_SCHEDULE: "5"
      QBT_CONFIG: "config.yml"
      QBT_LOGFILE: "activity.log"
      QBT_CROSS_SEED: "false"
      QBT_RECHECK: "true"
      QBT_CAT_UPDATE: "false"
      QBT_TAG_UPDATE: "true"
      QBT_REM_UNREGISTERED: "false"
      QBT_REM_ORPHANED: "false"
      QBT_TAG_TRACKER_ERROR: "true"
      QBT_TAG_NOHARDLINKS: "true"
      QBT_SHARE_LIMITS: "false"
      QBT_SKIP_CLEANUP: "false"
      QBT_DRY_RUN: "false"
      QBT_LOG_LEVEL: "WARNING"
      QBT_DIVIDER: ""
      QBT_WIDTH: "100"
      QBT_DEBUG: "false"
    depends_on:
      qbittorrent:
        condition: service_healthy
    labels:
      - traefik.enable=false

  flaresolverr:
    # DockerHub mirror flaresolverr/flaresolverr:latest
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    <<: *common
    environment:
      <<: *env
      LOG_LEVEL: ${LOG_LEVEL:-info}
      LOG_HTML: ${LOG_HTML:-false}
      CAPTCHA_SOLVER: ${CAPTCHA_SOLVER:-none}
    ports:
      - 8191:8191
    healthcheck:
      <<: *healthcheck
      test: [ "CMD", "curl", "-f", "http://localhost:8191" ]
    labels:
      - traefik.enable=false

  filebrowser:
    image: filebrowser/filebrowser:s6
    container_name: filebrowser
    <<: *common
    ports:
      - 8888:80
    volumes:
      - /:/srv
      - ./config/filebrowser/filebrowser.db:/database/filebrowser.db
      - ./config/filebrowser/settings.json:/config/settings.json

  unpackerr:
    image: golift/unpackerr
    container_name: unpackerr
    <<: *common
    volumes:
      - /mnt/storage:/data
      - ./config/unpackerr/:/config:rw
    user: 1000:1000 # env vars do not seem to be enough so also have to set this here
    environment:
      <<: *env
      # General config
      UN_DEBUG: false
      UN_LOG_FILE: /config/unpackerr.log
      UN_LOG_FILES: 10
      UN_LOG_FILE_MB: 10
      UN_INTERVAL: 2m
      UN_START_DELAY: 1m
      UN_RETRY_DELAY: 5m
      UN_MAX_RETRIES: 3
      UN_PARALLEL: 1
      UN_FILE_MODE: 644
      UN_DIR_MODE: 755
      # Sonarr Config
      UN_SONARR_0_URL: http://sonarr:8989
      UN_SONARR_0_API_KEY: ${SONARR_API_KEY}
      UN_SONARR_0_PATHS_0: /data/tv
      UN_SONARR_0_PROTOCOLS: torrent
      UN_SONARR_0_TIMEOUT: 10s
      UN_SONARR_0_DELETE_ORIG: false
      UN_SONARR_0_DELETE_DELAY: 5m
      # Radarr Config
      UN_RADARR_0_URL: http://radarr:7878
      UN_RADARR_0_API_KEY: ${RADARR_API_KEY}
      UN_RADARR_0_PATHS_0: /data/movies
      UN_RADARR_0_PROTOCOLS: torrent
      UN_RADARR_0_TIMEOUT: 10s
      UN_RADARR_0_DELETE_ORIG: false
      UN_RADARR_0_DELETE_DELAY: 5m