docker-compose.yml

version: "3.7"
# https://www.smarthomebeginner.com/traefik-2-docker-tutorial/#Basic_Docker_Commands_to_Know
########################### NETWORKS
# There is no need to create any networks outside this docker-compose file.
# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please.
# Docker Compose version 3.5 or higher required to define networks this way.

networks:
  t2_proxy:
    name: t2_proxy
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.90.0/24
  default:
    driver: bridge
  socket_proxy:
    name: socket_proxy
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.91.0/24
########################### SERVICES
services:
  ############################# FRONTENDS

  # Traefik 2 - Reverse Proxy
  # Touch (create empty files) traefik.log and acme/acme.json. Set acme.json permissions to 600.
  # touch $DOCKERDIR/traefik2/acme/acme.json
  # chmod 600 $DOCKERDIR/traefik2/acme/acme.json
  # touch $DOCKERDIR/traefik2/traefik.log
  traefik:
    container_name: traefik
    image: traefik:latest # picodon v2.3.x # chevrotin v2.2.x
    restart: always
    command: # CLI arguments
      - --global.checkNewVersion=true
      - --global.sendAnonymousUsage=true
      - --entryPoints.http.address=:80
      - --entryPoints.https.address=:443
      - --entryPoints.wireguard.address=:51820/udp
      - --entryPoints.traefik.address=:8080
      - --api.insecure=true
      - --api.dashboard=true
      #- --pilot.token=$TRAEFIK_PILOT_TOKEN
      - --log=true
      - --log.level=WARN # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
      - --accessLog=true
      - --accessLog.filePath=/traefik.log
      - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines
      - --accessLog.filters.statusCodes=400-499
      - --providers.docker=true
      - --providers.docker.endpoint=unix:///var/run/docker.sock # Use Docker Socket Proxy instead for improved security
      # Automatically set Host rule for services
      - --providers.docker.defaultrule=Host(`{{ index .Labels "com.docker.compose.service" }}.$DOMAINNAME`)
      - --providers.docker.exposedByDefault=false
      - --entrypoints.https.http.tls.certresolver=dns-route53
      - --entrypoints.https.http.tls.domains[0].main=$DOMAINNAME
      - --entrypoints.https.http.tls.domains[0].sans=*.$DOMAINNAME
      - --providers.docker.network=t2_proxy
      - --providers.docker.swarmMode=false
      - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory
      - --providers.file.watch=true # Only works on top level files in the rules folder
      #- --certificatesResolvers.dns-route53.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # LetsEncrypt Staging Server - uncomment when testing
      - --certificatesResolvers.dns-route53.acme.storage=/acme.json
      - --certificatesResolvers.dns-route53.acme.dnsChallenge.provider=route53
      - --certificatesResolvers.dns-route53.acme.dnsChallenge.delayBeforeCheck=20 # To delay DNS check and reduce LE hitrate
    networks:
      t2_proxy:
        ipv4_address: 192.168.90.254 # You can specify a static IP
      socket_proxy:
    security_opt:
      - no-new-privileges:true
    #healthcheck:
    #  test: ["CMD", "traefik", "healthcheck", "--ping"]
    #  interval: 5s
    #  retries: 3
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
      - target: 8080
        published: 8080
        protocol: tcp
        mode: host
      - target: 51820
        published: 51820
        protocol: udp
        mode: host
    volumes:
      - $DOCKERDIR/traefik2/rules:/rules # file provider directory
      - /var/run/docker.sock:/var/run/docker.sock:ro # Use Docker Socket Proxy instead for improved security
      - $DOCKERDIR/traefik2/acme/acme.json:/acme.json # cert location - you must touch this file and change permissions to 600
      - $DOCKERDIR/traefik2/traefik.log:/traefik.log # for fail2ban - make sure to touch file before starting container
    environment:
      - AWS_ACCESS_KEY_ID=$AK
      - AWS_SECRET_ACCESS_KEY=$ASK
      - HTPASSWD_FILE=/run/secrets/htpasswd # HTPASSWD_FILE can be whatever as it is not used/called anywhere.
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      # HTTP-to-HTTPS Redirect
      - "traefik.http.routers.http-catchall.entrypoints=http"
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # HTTP Routers
      - "traefik.http.routers.traefik-rtr.entrypoints=https"
      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME`)"
      - "traefik.http.routers.traefik-rtr.tls=true"
      ## Services - API
      - "traefik.http.routers.traefik-rtr.service=api@internal"
      ## Healthcheck/ping
      #- "traefik.http.routers.ping.rule=Host(`traefik.$DOMAINNAME0`) && Path(`/ping`)"
      #- "traefik.http.routers.ping.tls=true"
      #- "traefik.http.routers.ping.service=ping@internal"
      ## Middlewares
      #- "traefik.http.routers.traefik-rtr.middlewares=middlewares-rate-limit" 


# Portainer - WebUI for Containers
  portainer:
    container_name: portainer
    image: portainer/portainer-ce:latest
    restart: unless-stopped
    command: -H unix:///var/run/docker.sock
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
#    ports:
#      - "$PORTAINER_PORT:9000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - $DOCKERDIR/portainer/data:/data 
    environment:
      - TZ=$TZ
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.portainer-rtr.entrypoints=https"
      - "traefik.http.routers.portainer-rtr.rule=Host(`portainer.$DOMAINNAME`)"
      - "traefik.http.routers.portainer-rtr.tls=true"
      ## Middlewares
      ## HTTP Services
      - "traefik.http.routers.portainer-rtr.service=portainer-svc"
      - "traefik.http.services.portainer-svc.loadbalancer.server.port=9000"

# MariaDB - MySQL Database
  mariadb:
    container_name: mariadb
    image: linuxserver/mariadb:latest
    restart: always
    networks:
      t2_proxy:
        ipv4_address: 192.168.90.240 # You can specify a static IP
    security_opt:
      - no-new-privileges:true
    ports:
      - "3306:3306"
    volumes:
      - $DOCKERDIR/mariadb/data:/config
      #- /etc/timezone:/usr/share/zoneinfo:ro
      - /etc/localtime:/etc/localtime:ro
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - MYSQL_ROOT_PASSWORD=$MYSQL_ROOT_PASSWORD
      - TZ=$TZ
    labels:
      - "com.centurylinklabs.watchtower.enable=true"


# phpMyAdmin - Database management
  phpmyadmin:
    image: phpmyadmin/phpmyadmin:latest
    container_name: phpmyadmin
    restart: unless-stopped
    hostname: pma.$DOMAINNAME
    networks:
      - t2_proxy
      - default
    depends_on:
      - mariadb    
    security_opt:
      - no-new-privileges:true
    # ports:
    #   - "$PHPMYADMIN_PORT:80"
# The volumes caused an overwrite of the standard above and hence no login with user /pass possible, diabled and working now T.M
#    volumes:
#      - $DOCKERDIR/phpmyadmin:/etc/phpmyadmin
#      - $DOCKERDIR/phpmyadmin/ini/php.ini:/usr/local/etc/php/php.ini
    environment:
      #- PMA_PORT=3306
      - PMA_ARBITRARY=1
      - PMA_HOST=mariadb
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.phpmyadmin-rtr.entrypoints=https"
      - "traefik.http.routers.phpmyadmin-rtr.rule=Host(`pma.$DOMAINNAME`)"
      ## Middlewares
      #- "traefik.http.routers.phpmyadmin-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.phpmyadmin-rtr.service=phpmyadmin-svc"
      - "traefik.http.services.phpmyadmin-svc.loadbalancer.server.port=80"

# Dozzle - Real-time Docker Log Viewer
  dozzle:
    image: amir20/dozzle:latest
    container_name: dozzle
    restart: unless-stopped
    networks:
      - t2_proxy
      - socket_proxy
    #depends_on:
    #  - socket_proxy
    security_opt:
      - no-new-privileges:true
    # ports:
    #   - "$DOZZLE_PORT:8080"
    environment:
      DOZZLE_LEVEL: info
      DOZZLE_TAILSIZE: 300
      DOZZLE_FILTER: "status=running"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # Use Docker Socket Proxy instead for improved security
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.dozzle-rtr.entrypoints=https"
      - "traefik.http.routers.dozzle-rtr.rule=Host(`dozzle.$DOMAINNAME`)"
      ## Middlewares
      ## HTTP Services
      - "traefik.http.routers.dozzle-rtr.service=dozzle-svc"
      - "traefik.http.services.dozzle-svc.loadbalancer.server.port=8080"

# Guacamole Daemon - Needed for Guacamole
  guacd:
    image: guacamole/guacd
    container_name: guacd
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - t2_proxy
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

# Guacamole - Remote desktop, SSH, on Telnet on any HTML5 Browser 
# Create all databases and tables first
  guacamole:
    image: guacamole/guacamole:latest
    container_name: guacamole
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
#    ports:
#      - "8080:8080"
    volumes:
      - $DOCKERDIR/guacamole:/opt/local
    environment:
      GUACD_HOSTNAME: guacd
      MYSQL_HOSTNAME: mariadb
#      MYSQL_PORT: 3306
      MYSQL_DATABASE: guacamole
      MYSQL_USER: guacdb_user
      MYSQL_PASSWORD: Poll0000
      GUACAMOLE_HOME: /opt/local
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.guacamole-rtr.entrypoints=https"
      - "traefik.http.routers.guacamole-rtr.rule=Host(`guac.$DOMAINNAME`)"
      - "traefik.http.routers.guacamole-rtr.tls=true"
#      ## Middlewares
      - "traefik.http.routers.guacamole-rtr.middlewares=add-guacamole" 
      - "traefik.http.middlewares.add-guacamole.addPrefix.prefix=/guacamole"
#      ## HTTP Services
      - "traefik.http.routers.guacamole-rtr.service=guacamole-svc"
      - "traefik.http.services.guacamole-svc.loadbalancer.server.port=8080"


  # Firefox - Web Broswer
  # VNC password not working - check
  firefox:
    image: jlesage/firefox:latest
    container_name: firefox
    restart: unless-stopped
    networks:
      - t2_proxy

    security_opt:
      - no-new-privileges:true
      - seccomp:unconfined # October 15, 2020 https://github.com/jlesage/docker-firefox/blob/master/README.md#allowing-the-membarrier-system-call
    # ports:
    #   - "$FIREFOX_PORT:5800"
    volumes:
      - $DOCKERDIR/firefox:/config
      - $DOCKERDIR/firefox/downloads:/data/downloads
      - /dev/shm:/dev/shm
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
      UMASK: 002
      KEEP_APP_RUNNING: 1
      CLEAN_TMP_DIR: 1
      DISPLAY_WIDTH: 1920
      DISPLAY_HEIGHT: 1080
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.firefox-rtr.entrypoints=https"
      - "traefik.http.routers.firefox-rtr.rule=Host(`firefox.$DOMAINNAME`)"
      ## Middlewares
      ## HTTP Services
      - "traefik.http.routers.firefox-rtr.service=firefox-svc"
      - "traefik.http.services.firefox-svc.loadbalancer.server.port=5800"


 # Heimdall - Unified Frontend Alternative
  # Putting all services behind Oragnizr slows things down.
  heimdall:
    container_name: heimdall
    image: linuxserver/heimdall:latest
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    # ports:
    #   - "$HEIMDALL_PORT:80"
    volumes:
      - $DOCKERDIR/heimdall:/config
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.heimdall-rtr.entrypoints=https"
      - "traefik.http.routers.heimdall-rtr.rule=Host(`heimdall.$DOMAINNAME`)"
      ## Middlewares
      ## HTTP Services
      - "traefik.http.routers.heimdall-rtr.service=heimdall-svc"
      - "traefik.http.services.heimdall-svc.loadbalancer.server.port=80"


# Traefik Certs Dumper - Extract LetsEncrypt Certificates - Traefik2 Compatible
  certdumper:
    container_name: traefik_certdumper
    image: humenius/traefik-certs-dumper:latest
    network_mode: none
    security_opt:
      - no-new-privileges:true
    # command: --restart-containers container1,container2,container3
    volumes:
      - $DOCKERDIR/traefik2/acme:/traefik:ro
      - $DOCKERDIR/shared/certs:/output:rw
      # - /var/run/docker.sock:/var/run/docker.sock:ro # Only needed if restarting containers (use Docker Socket Proxy instead)
    # Dumps all domains T.M
    #environment:
    #  DOMAIN: $DOMAINNAME
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

# updates images
  watchtower:
    command: --label-enable --cleanup --interval 43200
    image: containrrr/watchtower
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    network_mode: none
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      
# VPN Server Software
  wireguard:
    image: linuxserver/wireguard
    container_name: wireguard
  # network_mode: service:traefik
    networks:
      t2_proxy:
        ipv4_address: 192.168.90.230
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
      - SERVERURL=$DOMAINNAME
      - SERVERPORT=51820
      - PEERS=5
      - PEERDNS=auto    
      - INTERNAL_SUBNET=10.50.50.0
    volumes:
      - $DOCKERDIR/wireguard/config:/config
      - /usr/src:/usr/src
      - /lib/modules:/lib/modules
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=t2_proxy"
    ## UDP Routers
      - "traefik.udp.routers.wireguard-udp.entrypoints=wireguard"
    ## UDP Services
      - "traefik.udp.routers.wireguard-udp.service=wireguard-udp-svc"
      - "traefik.udp.services.wireguard-udp-svc.loadbalancer.server.port=51820"

#This sets the DNS on Route53 should the need DNS change
  R53DDNS:
      container_name: R53DDNS
      restart: unless-stopped
      environment:
          - AWS_ACCESS_KEY_ID=$AK
          - AWS_SECRET_ACCESS_KEY=$ASK
          - AWS_REGION=$AWS_REGION
          - ROUTE53_HOSTED_ZONE_ID=$ROUTE53_HOSTED_ZONE_ID
          - ROUTE53_DOMAIN=$DOMAINNAME
          - ROUTE53_TYPE=A
          - ROUTE53_TTL=60
          - SEND_EMAIL_SES=true
          - SES_TO_ADDRESS=$SES_TO_ADDRESS
          - SES_FROM_ADDRESS=$SES_TO_ADDRESS
      image: 'sjmayotte/route53-dynamic-dns:latest'