docker-compose-t2-nuc.yml

version: "3.7"

# IMPORTANT
############# WORK IN PROGRESS ON THIS FILE. #############
# PATHS ETC. HAVE NOT BEEN UPDATED TO THE NEW WAY SHOWN IN docker-compose-t2.yml

# DOCKER-COMPOSE FOR INTEL NUC HOME SERVER
# NUC8 i7
# 32 GB RAM
# 480 GB SSD Ubuntu Server (future Proxmox)
# Data and Media CIFS mounted from Synology NAS

########################### NETWORKS
# Create t2_proxy network
# docker network create t2_proxy
# docker network create socket_proxy
# Alternatively, you can specify the gateway and subnet to use
# docker network create --gateway 192.168.90.1 --subnet 192.168.90.0/24 t2_proxy
# docker network create --gateway 192.168.91.1 --subnet 192.168.91.0/24 socket_proxy
# Subnet range 192.168.0.0/16 covers 192.168.0.0 to 192.168.255.255

networks:
  t2_proxy:
    external:
      name: t2_proxy
  default:
    driver: bridge
  socket_proxy:
    external:
      name: socket_proxy

########################### SECRETS
secrets:
  cloudflare_email:
    file: $SECRETSDIR/cloudflare_email
  cloudflare_api_key:
    file: $SECRETSDIR/cloudflare_api_key
  cloudflare_api_token:
    file: $SECRETSDIR/cloudflare_api_token
  authelia_jwt_secret:
    file: $SECRETSDIR/authelia_jwt_secret
  authelia_session_secret:
    file: $SECRETSDIR/authelia_session_secret
  authelia_storage_mysql_password:
    file: $SECRETSDIR/authelia_storage_mysql_password
  authelia_notifier_smtp_password:
    file: $SECRETSDIR/authelia_notifier_smtp_password
  authelia_duo_api_secret_key:
    file: $SECRETSDIR/authelia_duo_api_secret_key
  oauth_secret:
    file: $SECRETSDIR/oauth_secret
  google_client_secret:
    file: $SECRETSDIR/google_client_secret
  google_client_id:
    file: $SECRETSDIR/google_client_id
  my_email:
    file: $SECRETSDIR/my_email
  mysql_root_password:
    file: $SECRETSDIR/mysql_root_password
  plex_claim:
    file: $SECRETSDIR/plex_claim
  guac_db_name:
    file: $SECRETSDIR/guac_db_name
  guac_mysql_user:
    file: $SECRETSDIR/guac_mysql_user
  guac_mysql_password:
    file: $SECRETSDIR/guac_mysql_password
  traefik_pilot_token:
    file: $SECRETSDIR/traefik_pilot_token

########################### SERVICES
services:
  ############################# FRONTENDS

  # Traefik 2 - Reverse Proxy
  # Touch (create empty files) traefik.log and acme/acme.json. Set acme.json permissions to 600.
  # touch $DOCKERDIR/traefik2/acme/acme.json
  # chmod 600 $DOCKERDIR/traefik2/acme/acme.json
  # touch $DOCKERDIR/traefik2/traefik.log
  traefik:
    container_name: traefik
    image: traefik:picodon # chevrotin # the chevrotin tag refers to v2.2.x
    restart: unless-stopped
    command: # CLI arguments
      - --global.checkNewVersion=true
      - --global.sendAnonymousUsage=true
      - --entryPoints.http.address=:80
      - --entryPoints.https.address=:443
      # Allow these IPs to set the X-Forwarded-* headers - Cloudflare IPs: https://www.cloudflare.com/ips/
      - --entrypoints.https.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22
      - --entryPoints.traefik.address=:8080
      # - --entryPoints.ping.address=:8081
      - --api=true
      # - --api.insecure=true
      - --api.dashboard=true
      #- --ping=true
      #- --pilot.token=$TRAEFIK_PILOT_TOKEN
      # - --serversTransport.insecureSkipVerify=true
      - --log=true
      - --log.level=WARN # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
      - --accessLog=true
      - --accessLog.filePath=/traefik.log
      - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines
      - --accessLog.filters.statusCodes=400-499
      - --providers.docker=true
      # - --providers.docker.endpoint=unix:///var/run/docker.sock # Use Docker Socket Proxy instead for improved security
      - --providers.docker.endpoint=tcp://socket-proxy:2375
      # Automatically set Host rule for services
      # - --providers.docker.defaultrule=Host(`{{ index .Labels "com.docker.compose.service" }}.$DOMAINNAME`)
      - --providers.docker.exposedByDefault=false
      # - --entrypoints.https.http.middlewares=chain-oauth@file
      - --entrypoints.https.http.tls.options=tls-opts@file
      # Add dns-cloudflare as default certresolver for all services. Also enables TLS and no need to specify on individual services
      - --entrypoints.https.http.tls.certresolver=dns-cloudflare
      - --entrypoints.https.http.tls.domains[0].main=$DOMAINNAME
      - --entrypoints.https.http.tls.domains[0].sans=*.$DOMAINNAME
      # - --entrypoints.https.http.tls.domains[1].main=$DOMAIN # Pulls main cert for second domain
      # - --entrypoints.https.http.tls.domains[1].sans=*.$DOMAIN # Pulls wildcard cert for second domain
      - --providers.docker.network=t2_proxy
      - --providers.docker.swarmMode=false
      - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory
      # - --providers.file.filename=/path/to/file # Load dynamic configuration from a file
      - --providers.file.watch=true # Only works on top level files in the rules folder
      # - --certificatesResolvers.dns-cloudflare.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # LetsEncrypt Staging Server - uncomment when testing
      - --certificatesResolvers.dns-cloudflare.acme.email=$CLOUDFLARE_EMAIL
      - --certificatesResolvers.dns-cloudflare.acme.storage=/acme.json
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.provider=cloudflare
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.delayBeforeCheck=90 # To delay DNS check and reduce LE hitrate
    networks:
      t2_proxy:
        ipv4_address: 192.168.90.254 # You can specify a static IP
      # networks:
      #   - t2_proxy
      socket_proxy:
    #depends_on:
    #  - socket-proxy
    security_opt:
      - no-new-privileges:true
    #healthcheck:
    #  test: ["CMD", "traefik", "healthcheck", "--ping"]
    #  interval: 5s
    #  retries: 3
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
      # - target: 8080
      #   published: 8080
      #   protocol: tcp
      #   mode: host
      #- target: 8081
      #  published: 8082
      #  protocol: tcp
      #  mode: host
    volumes:
      - $DOCKERDIR/traefik2/rules:/rules # file provider directory
      # - /var/run/docker.sock:/var/run/docker.sock:ro # Use Docker Socket Proxy instead for improved security
      - $DOCKERDIR/traefik2/acme/acme.json:/acme.json # cert location - you must touch this file and change permissions to 600
      - $DOCKERDIR/traefik2/traefik.log:/traefik.log # for fail2ban - make sure to touch file before starting container
      - $DOCKERDIR/shared:/shared
    environment:
      - CF_API_EMAIL_FILE=/run/secrets/cloudflare_email
      - CF_API_KEY_FILE=/run/secrets/cloudflare_api_key
    secrets:
      - cloudflare_email
      - cloudflare_api_key
    labels:
      #- "autoheal=true"
      - "traefik.enable=true"
      # HTTP-to-HTTPS Redirect
      - "traefik.http.routers.http-catchall.entrypoints=http"
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # HTTP Routers
      - "traefik.http.routers.traefik-rtr.entrypoints=https"
      - "traefik.http.routers.traefik-rtr.rule=Host(`traefikh.$DOMAINNAME`)"
      ## Services - API
      - "traefik.http.routers.traefik-rtr.service=api@internal"
      ## Healthcheck/ping
      #- "traefik.http.routers.ping.rule=Host(`traefik.$DOMAINNAME`) && Path(`/ping`)"
      #- "traefik.http.routers.ping.tls=true"
      #- "traefik.http.routers.ping.service=ping@internal"
      ## Middlewares
      - "traefik.http.routers.traefik-rtr.middlewares=chain-oauth@file"

  # Docker Socket Proxy - Security Enchanced Proxy for Docker Socket
  socket-proxy:
    container_name: socket-proxy
    image: fluencelabs/docker-socket-proxy
    restart: always
    networks:
      # t2_proxy:
      socket_proxy:
        ipv4_address: 192.168.91.254 # You can specify a static IP
    privileged: true
    ports:
      #- "127.0.0.1:2375:2375" # Port 2375 should only ever get exposed to the internal network. When possible use this line.
      # I use the next line instead, as I want portainer to manage multiple docker endpoints within my home network.
      - "2375:2375"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      - LOG_LEVEL=info # debug,info,notice,warning,err,crit,alert,emerg
      ## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.).
      # 0 to revoke access.
      # 1 to grant access.
      ## Granted by Default
      - EVENTS=1
      - PING=1
      - VERSION=1
      ## Revoked by Default
      # Security critical
      - AUTH=0
      - SECRETS=0
      - POST=1 # Watchtower
      - DELETE=1 # Watchtower
        # GET Optons
      - BUILD=0
      - COMMIT=0
      - CONFIGS=0
      - CONTAINERS=1 # Traefik, portainer, etc.
      - DISTRIBUTION=0
      - EXEC=0
      - IMAGES=1 # Portainer, Watchtower
      - INFO=1 # Portainer
      - NETWORKS=1 # Portainer, Watchtower
      - NODES=0
      - PLUGINS=0
      - SERVICES=1 # Portainer
      - SESSION=0
      - SWARM=0
      - SYSTEM=0
      - TASKS=1 # Portaienr
      - VOLUMES=1 # Portainer
      # POST Options
      - CONTAINERS_CREATE=1 # WatchTower
      - CONTAINERS_START=1 # WatchTower
      - CONTAINERS_UPDATE=1 # WatchTower
      # DELETE Options
      - CONTAINERS_DELETE=1 # WatchTower
      - IMAGES_DELETE=1 # WatchTower

  # Google OAuth - Single Sign On using OAuth 2.0
  # https://hub.docker.com/r/thomseddon/traefik-forward-auth
  # https://www.smarthomebeginner.com/google-oauth-with-traefik-docker/
  oauth:
    container_name: oauth
    image: thomseddon/traefik-forward-auth:latest
    # image: thomseddon/traefik-forward-auth:2.1-arm # Use this image with Raspberry Pi
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    # Allow apps to bypass OAuth. Radarr example below will bypass OAuth if API key is present in the request (eg. from NZB360 mobile app).
    # While this is one way, the recommended way is to bypass authentication using Traefik labels shown in some of the apps later.
    # command: --rule.radarr.action=allow --rule.radarr.rule="Headers(`X-Api-Key`, `$RADARR_API_KEY`)"
    # command: --rule.sabnzbd.action=allow --rule.sabnzbd.rule="HeadersRegexp(`X-Forwarded-Uri`, `$SABNZBD_API_KEY`)"
    environment:
      - CLIENT_ID=$GOOGLE_CLIENT_ID
      - CLIENT_SECRET=$GOOGLE_CLIENT_SECRET
      - SECRET=$OAUTH_SECRET
      - COOKIE_DOMAIN=$DOMAINNAME
      - INSECURE_COOKIE=false
      - AUTH_HOST=oauth.$DOMAINNAME
      - URL_PATH=/_oauth
      - WHITELIST=$MY_EMAIL
      - LOG_LEVEL=warn
      - LOG_FORMAT=text
      - LIFETIME=86400 # 1 day
      - DEFAULT_ACTION=auth
      - DEFAULT_PROVIDER=google
    secrets: # had trouble getting secrets to work: https://github.com/thomseddon/traefik-forward-auth/issues/155#issuecomment-664630985
      - google_client_id
      - google_client_secret
      - oauth_secret
      - my_email
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.oauth-rtr.tls=true"
      - "traefik.http.routers.oauth-rtr.entrypoints=https"
      - "traefik.http.routers.oauth-rtr.rule=Host(`oauthh.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.oauth-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.oauth-rtr.service=oauth-svc"
      - "traefik.http.services.oauth-svc.loadbalancer.server.port=4181"

  # Portainer - WebUI for Containers
  # Moved to NAS and added this stack as to Portainer as a separate endpoint.
  # Autoindex - Simple Directory Index
  autoindex:
    container_name: autoindex
    image: dceoy/nginx-autoindex:latest
    restart: always
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    # ports:
    #   - "$AUTOINDEX_PORT:80"
    volumes:
      - /media:/var/lib/nginx/html:ro # Location you want to index
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.autoindex-rtr.entrypoints=https"
      - "traefik.http.routers.autoindex-rtr.rule=Host(`indexh.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.autoindex-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.autoindex-rtr.service=autoindex-svc"
      - "traefik.http.services.autoindex-svc.loadbalancer.server.port=80"

  ############################# SMART HOME

  # Home Assistant Core - Home Automation
  # Added temporarily since HASS.io (Home Assistant Supervised) on Docker has been deprecated.
  homeassistant:
    container_name: hass-core
    restart: unless-stopped
    image: homeassistant/home-assistant:2021.1.5
    network_mode: host
    #    networks:
    #      - t2_proxy
    devices:
      - /dev/ttyUSB0:/dev/ttyUSB0
      - /dev/ttyUSB1:/dev/ttyUSB1
      - /dev/ttyACM0:/dev/ttyACM0
    privileged: true
    volumes:
      - $USERDIR/docker/homeassistant:/config
      - /etc/localtime:/etc/localtime:ro
      #- /media/ssd/motioneye:/media/motioneye
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
    labels:
      ## Exclude From Watchtower
      - "com.centurylinklabs.watchtower.enable=false"

  # Home Assistant Core - Home Automation
  # If you want Home Assistant, use the one above. This is was old setup. I am still migrating things from this one to Home Assistant Core Above.
  # Added temporarily since HASS.io (Home Assistant Supervised) on Docker has been deprecated.
  hassio:
    container_name: hassio
    restart: unless-stopped
    image: homeassistant/home-assistant:0.111.0
    networks:
      - t2_proxy
    devices:
      - /dev/ttyUSB0:/dev/ttyUSB0
      - /dev/ttyUSB1:/dev/ttyUSB1
      - /dev/ttyACM0:/dev/ttyACM0
    ports:
      - target: 8123
        published: $HOMEASSISTANT_PORT
        protocol: tcp
        mode: host
    privileged: true
    volumes:
      - $USERDIR/docker/hassio/homeassistant:/config
      - /etc/localtime:/etc/localtime:ro
      - $USERDIR/docker/shared:/shared
      - $USERDIR/docker/open-zwave:/open-zwave
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
    labels:
      ## Exclude From Watchtower
      - "com.centurylinklabs.watchtower.enable=false"

  # MotionEye - Video Surveillance
  motioneye:
    image: ccrisan/motioneye:master-amd64
    container_name: motioneye
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    ports:
      - "$MOTIONEYE_CAM1:8081"
      - "$MOTIONEYE_CAM2:8082"
      - "$MOTIONEYE_CAM3:8083"
      - "$MOTIONEYE_PORT:8765"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - $DOCKERDIR/shared:/shared
      - $DOCKERDIR/motioneye/etc:/etc/motioneye
      - $DOCKERDIR/motioneye/merged:/var/lib/motioneye # merged = local + google drive, using rclone and mergerfs
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
    labels:
      - "traefik.enable=true"
      ## HTTP Routers Auth Bypass
      # - "traefik.http.routers.motioneye-rtr-bypass.entrypoints=https"
      # - "traefik.http.routers.motioneye-rtr-bypass.rule=Headers(`$MOTIONEYE_BYPASS_KEY`, `$MOTIONEYE_BYPASS_VALUE`)"
      # - "traefik.http.routers.motioneye-rtr-bypass.priority=100"
      ## HTTP Routers Auth
      - "traefik.http.routers.motioneye-rtr.entrypoints=https"
      - "traefik.http.routers.motioneye-rtr.rule=Host(`meye.$DOMAINNAME`)"
      - "traefik.http.routers.motioneye-rtr.priority=99"
      ## Middlewares
      # - "traefik.http.routers.motioneye-rtr-bypass.middlewares=chain-no-auth@file"
      - "traefik.http.routers.motioneye-rtr.middlewares=chain-no-auth@file"
      ## HTTP Services
      - "traefik.http.routers.motioneye-rtr.service=motioneye-svc"
      # - "traefik.http.routers.motioneye-rtr-bypass.service=motioneye-svc"
      - "traefik.http.services.motioneye-svc.loadbalancer.server.port=8765"

  ############################# DATABASE
  # Mariadb moved to NAS
  # Influxdb moved to NAS

  # phpMyAdmin - Database management
  # Create a new user with admin privileges. Cannot login as MySQL root for some reason.
  phpmyadmin:
    image: phpmyadmin/phpmyadmin:latest
    container_name: phpmyadmin
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    # ports:
    #   - "$PHPMYADMIN_PORT:80"
    # volumes:
    #   - $DOCKERDIR/phpmyadmin:/etc/phpmyadmin
    environment:
      - PMA_HOST=$DB_HOST
      - PMA_PORT=$DB_PORT
      #- PMA_ARBITRARY=1
      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/mysql_root_password
    secrets:
      - mysql_root_password
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.phpmyadmin-rtr.entrypoints=https"
      - "traefik.http.routers.phpmyadmin-rtr.rule=Host(`pmah.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.phpmyadmin-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.phpmyadmin-rtr.service=phpmyadmin-svc"
      - "traefik.http.services.phpmyadmin-svc.loadbalancer.server.port=80"

  # Redis - Key-value Store
  # Moved to NAS

  # Plex - Media Server
  plexms:
    image: plexinc/pms-docker:public
    container_name: plexms
    restart: unless-stopped
    networks:
      - t2_proxy
    devices:
      - /dev/dri:/dev/dri # for harware transcoding
    security_opt:
      - no-new-privileges:true
    ports:
      - "$PLEX_PORT:32400/tcp"
      - "3005:3005/tcp"
      - "8324:8324/tcp"
      - "32469:32469/tcp"
      - "1900:1900/udp" # conflicts with xTeVe
      - "32410:32410/udp"
      - "32412:32412/udp"
      - "32413:32413/udp"
      - "32414:32414/udp"
      - "$PLEX_WEB_TOOLS_PORT:33400"
    volumes:
      - $DOCKERDIR/plexms:/config
      - $USERDIR/Downloads:/data/downloads
      - /media/ds918/data/media:/data/media
      - /dev/shm:/data/transcode # Offload transcoding to RAM if you have enough RAM
    #   - $USERDIR/Downloads/plex_tmp:/transcode
    environment:
      TZ: $TZ
      HOSTNAME: "nucPlex"
      PLEX_CLAIM_FILE: /run/secrets/plex_claim
      PLEX_UID: $PUID
      PLEX_GID: $PGID
      ADVERTISE_IP: http://$SERVER_IP:$PLEX_PORT/
    secrets:
      - plex_claim
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.plexms-rtr.entrypoints=https"
      - "traefik.http.routers.plexms-rtr.rule=Host(`nucplex.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.plexms-rtr.middlewares=chain-no-auth@file"
      ## HTTP Services
      - "traefik.http.routers.plexms-rtr.service=plexms-svc"
      - "traefik.http.services.plexms-svc.loadbalancer.server.port=32400"

  # Plex-Sync - For Syncing watched status between plex servers
  # Sync Plex between NUC and Synology
  plex-sync:
    image: patsissons/plex-sync:develop
    container_name: plex-sync
    security_opt:
      - no-new-privileges:true
    environment:
      INITIAL_RUN: "true"
      # DRY_RUN: 0
      CRON_SCHEDULE: "*/5 * * * *"
      SECTION_MAPS: $SYN_PLEX/$SYN_PLEX_HOLLYWOOD $NUC_PLEX/$NUC_PLEX_HOLLYWOOD | $SYN_PLEX/$SYN_PLEX_TVSHOWS $NUC_PLEX/$NUC_PLEX_TVSHOWS | $SYN_PLEX/$SYN_PLEX_INDIAN $NUC_PLEX/$NUC_PLEX_INDIAN | $SYN_PLEX/$SYN_PLEX_KOLLYWOOD $NUC_PLEX/$NUC_PLEX_KOLLYWOOD | $SYN_PLEX/$SYN_PLEX_DOCMOVIES $NUC_PLEX/$NUC_PLEX_DOCMOVIES | $SYN_PLEX/$SYN_PLEX_DOCSHOWS $NUC_PLEX/$NUC_PLEX_DOCSHOWS | $SYN_PLEX/$SYN_PLEX_KIDSMOVIES $NUC_PLEX/$NUC_PLEX_KIDSMOVIES | $SYN_PLEX/$SYN_PLEX_INTERNATIONAL $NUC_PLEX/$NUC_PLEX_INTERNATIONAL
    restart: unless-stopped

  # Plex-Sync - For Syncing watched status between plex servers
  # Sync Plex between NUC and Proxmox
  prox-sync:
    image: patsissons/plex-sync:develop
    container_name: prox-sync
    security_opt:
      - no-new-privileges:true
    environment:
      INITIAL_RUN: "true"
      # DRY_RUN: 0
      CRON_SCHEDULE: "*/5 * * * *"
      SECTION_MAPS: $PROX_PLEX/$PROX_PLEX_HOLLYWOOD $NUC_PLEX/$NUC_PLEX_HOLLYWOOD | $PROX_PLEX/$PROX_PLEX_TVSHOWS $NUC_PLEX/$NUC_PLEX_TVSHOWS | $PROX_PLEX/$PROX_PLEX_INDIAN $NUC_PLEX/$NUC_PLEX_INDIAN | $PROX_PLEX/$PROX_PLEX_KOLLYWOOD $NUC_PLEX/$NUC_PLEX_KOLLYWOOD | $PROX_PLEX/$PROX_PLEX_DOCMOVIES $NUC_PLEX/$NUC_PLEX_DOCMOVIES | $PROX_PLEX/$PROX_PLEX_DOCSHOWS $NUC_PLEX/$NUC_PLEX_DOCSHOWS | $PROX_PLEX/$PROX_PLEX_KIDSMOVIES $NUC_PLEX/$NUC_PLEX_KIDSMOVIES | $PROX_PLEX/$PROX_PLEX_INTERNATIONAL $NUC_PLEX/$NUC_PLEX_INTERNATIONAL
    restart: unless-stopped

  # Firefox - Web Broswer
  # VNC password not working - check
  firefox:
    image: jlesage/firefox:latest
    container_name: firefox
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
      - seccomp:unconfined # October 15, 2020 https://github.com/jlesage/docker-firefox/blob/master/README.md#allowing-the-membarrier-system-call
    # ports:
    #   - "$FIREFOX_PORT:5800"
    volumes:
      - $DOCKERDIR/firefox:/config
      - $USERDIR/Downloads/completed:/config/downloads
      - /media/ds918/downloads:/nas/downloads
      - /dev/shm:/dev/shm
      - $DOCKERDIR/shared:/shared
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
      UMASK: 002
      KEEP_APP_RUNNING: 1
      CLEAN_TMP_DIR: 1
      DISPLAY_WIDTH: 1600
      DISPLAY_HEIGHT: 960
      VNC_PASSWD: $FIREFOX_VNC_PASSWD
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.firefox-rtr.entrypoints=https"
      - "traefik.http.routers.firefox-rtr.rule=Host(`firefoxh.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.firefox-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.firefox-rtr.service=firefox-svc"
      - "traefik.http.services.firefox-svc.loadbalancer.server.port=5800"

  # Glances - System Information
  glances:
    image: nicolargo/glances:latest
    container_name: glances
    restart: unless-stopped
    privileged: true
    # network_mode: host
    networks:
      - t2_proxy
      - socket_proxy
    depends_on:
      - socket-proxy
    security_opt:
      - no-new-privileges:true
    # ports:
    #   - "$GLANCES_PORT:61208"
    pid: host
    volumes:
      - $DOCKERDIR/glances/glances.conf:/glances/conf/glances.conf # Use this if you want to add a glances.conf file
      # - /var/run/docker.sock:/var/run/docker.sock:ro # Use Docker Socket Proxy instead for improved security
    environment:
      # GLANCES_OPT: "-C /glances/conf/glances.conf --quiet --export influxdb"
      GLANCES_OPT: "-w"
      DOCKER_HOST: tcp://socket-proxy:2375
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.glances-rtr.entrypoints=https"
      - "traefik.http.routers.glances-rtr.rule=Host(`glancesh.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.glances-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.glances-rtr.service=glances-svc"
      - "traefik.http.services.glances-svc.loadbalancer.server.port=61208"

  # APCUPSD - APC UPS Management
  # create the apcupsd.conf file
  apcupsd:
    image: gersilex/apcupsd:latest
    container_name: apcupsd
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    ports:
      - "$APCUPSD_PORT:3551"
    privileged: true
    tty: true
    volumes:
      - /tmp/apcupsd-docker:/tmp/apcupsd-docker
      - $DOCKERDIR/apcupsd/apcupsd.conf:/etc/apcupsd/apcupsd.conf
      - $DOCKERDIR/apcupsd/doshutdown:/etc/apcupsd/doshutdown
      - $DOCKERDIR/apcupsd/apcupsd.events:/var/log/apcupsd.events

  # qDirStat - Directory Statistics
  qdirstat:
    image: jlesage/qdirstat:latest
    container_name: qdirstat
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    # ports:
    #   - "$QDIRSTAT_PORT:5800"
    volumes:
      - $USERDIR:/storage:ro
      - $DOCKERDIR/qdirstat/config:/config:rw
      - /media:/nas
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      UMASK: 002
      TZ: $TZ
      KEEP_APP_RUNNING: 1
      CLEAN_TMP_DIR: 1
      DISPLAY_WIDTH: 1600
      DISPLAY_HEIGHT: 960
      VNC_PASSWORD: $QDIRSTAT_VNC_PASSWD
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.qdirstat-rtr.entrypoints=https"
      - "traefik.http.routers.qdirstat-rtr.rule=Host(`qdirstath.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.qdirstat-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.qdirstat-rtr.service=qdirstat-svc"
      - "traefik.http.services.qdirstat-svc.loadbalancer.server.port=5800"

  # Dozzle - Real-time Docker Log Viewer
  dozzle:
    image: amir20/dozzle:latest
    container_name: dozzle
    restart: unless-stopped
    networks:
      - t2_proxy
      - socket_proxy
    depends_on:
      - socket-proxy
    security_opt:
      - no-new-privileges:true
    # ports:
    #   - "$DOZZLE_PORT:8080"
    environment:
      DOZZLE_LEVEL: info
      DOZZLE_TAILSIZE: 300
      DOZZLE_FILTER: "status=running"
      # DOZZLE_FILTER: "label=log_me" # limits logs displayed to containers with this label
      DOCKER_HOST: tcp://socket-proxy:2375
    # volumes:
    #  - /var/run/docker.sock:/var/run/docker.sock # Use Docker Socket Proxy instead for improved security
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.dozzle-rtr.entrypoints=https"
      - "traefik.http.routers.dozzle-rtr.rule=Host(`dozzleh.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.dozzle-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.dozzle-rtr.service=dozzle-svc"
      - "traefik.http.services.dozzle-svc.loadbalancer.server.port=8080"

  # VSCode - VSCode Editing
  vscode:
    image: codercom/code-server:latest
    container_name: vscode
    restart: unless-stopped
    networks:
      - t2_proxy
    ports:
      - "$VSCODE_PORT:8080"
    volumes:
      - $USERDIR/server:/home/coder/server
      - $DOCKERDIR:/home/coder/docker
      - $DOCKERDIR/hassio/homeassistant:/home/coder/hassio
      - $DOCKERDIR/homeassistant:/home/coder/homeassistant
      - $USERDIR/Downloads:/home/coder/Downloads
      - $DOCKERDIR/vscode:/home/coder
      - /media/sdocker:/home/coder/sdocker
    environment:
      PASSWORD: $VSCODE_PASSWORD
      # Run as root first, create the directories, then change permissions to user:docker and 775. Disable run as root below.
      user: $PUID:$PGID
      # user: "0"
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.vscode-rtr.entrypoints=https"
      - "traefik.http.routers.vscode-rtr.rule=Host(`codeh.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.vscode-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.vscode-rtr.service=vscode-svc"
      - "traefik.http.services.vscode-svc.loadbalancer.server.port=8080"

  ############################# MAINTENANCE

  # WatchTower - Automatic Docker Container Updates
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: unless-stopped
    networks:
      - default
      - socket_proxy
    depends_on:
      - socket-proxy
    environment:
      TZ: $TZ
      WATCHTOWER_CLEANUP: "true"
      WATCHTOWER_REMOVE_VOLUMES: "true"
      WATCHTOWER_INCLUDE_STOPPED: "true"
      WATCHTOWER_NO_STARTUP_MESSAGE: "false"
      WATCHTOWER_SCHEDULE: "0 30 12 * * *" # Everyday at 12:30
      WATCHTOWER_NOTIFICATIONS: shoutrrr
      WATCHTOWER_NOTIFICATION_URL: "telegram://$TGRAM_BOT_TOKEN@telegram?channels=$TGRAM_CHAT_ID"
      WATCHTOWER_NOTIFICATIONS_LEVEL: info
      DOCKER_HOST: tcp://socket-proxy:2375
      DOCKER_API_VERSION: "1.40"

  # Docker-GC - Automatic Docker Garbage Collection
  # Create docker-gc-exclude file
  dockergc:
    image: clockworksoul/docker-gc-cron:latest
    container_name: docker-gc
    restart: unless-stopped
    networks:
      - socket_proxy
    depends_on:
      - socket-proxy
    volumes:
      # - /var/run/docker.sock:/var/run/docker.sock # Use Docker Socket Proxy instead for improved security
      - $DOCKERDIR/docker-gc/docker-gc-exclude:/etc/docker-gc-exclude
    environment:
      CRON: 0 0 0 * * ? # Everyday at midnight. Previously 0 0 * * *
      FORCE_IMAGE_REMOVAL: 1
      FORCE_CONTAINER_REMOVAL: 0
      GRACE_PERIOD_SECONDS: 604800
      DRY_RUN: 0
      CLEAN_UP_VOLUMES: 1
      TZ: $TZ
      DOCKER_HOST: tcp://socket-proxy:2375

  # Traefik Certs Dumper - Extract LetsEncrypt Certificates - Traefik2 Compatible
  certdumper:
    container_name: traefik_certdumper
    image: humenius/traefik-certs-dumper:latest
    network_mode: none
    security_opt:
      - no-new-privileges:true
    # command: --restart-containers container1,container2,container3
    volumes:
      - $DOCKERDIR/traefik2/acme:/traefik:ro
      - $DOCKERDIR/shared/certs:/output:rw
      # - /var/run/docker.sock:/var/run/docker.sock:ro # Only needed if restarting containers (use Docker Socket Proxy instead)
    environment:
      DOMAIN: $DOMAINNAME

  # Cloudflare DDNS - Dynamic DNS Updater
  # Moved to NAS

  # Cloudflare-Companion - Automatic CNAME DNS Creation
  cf-companion:
    container_name: cf-companion
    image: tiredofit/traefik-cloudflare-companion:latest
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    networks:
      - socket_proxy
    #depends_on:
    #  - socket-proxy
    environment:
      - TIMEZONE=$TZ
      - TRAEFIK_VERSION=2
      #- CF_EMAIL=$CLOUDFLARE_EMAIL
      - CF_TOKEN=$CLOUDFLARE_API_TOKEN
      - TARGET_DOMAIN=home.$DOMAINNAME
      - DOMAIN1=$DOMAINNAME
      - DOMAIN1_ZONE_ID=$CLOUDFLARE_ZONEID # Copy from Cloudflare Overview page
      - DOMAIN1_PROXIED=TRUE
      - DOCKER_HOST=tcp://socket-proxy:2375
    secrets: # not working
      - cloudflare_api_token
    labels:
      # Add hosts specified in rules here to force cf-companion to create the CNAMEs
      # Since cf-companion creates CNAMEs based on host rules, this a workaround for non-docker/external apps
      - "traefik.http.routers.cf-companion-rtr.rule=Host(`portainerh.$DOMAINNAME`) || `glancess.$DOMAINNAME`) || `piholeh.$DOMAINNAME`) || Host(`shellh.$DOMAINNAME`) || Host(`syno.$DOMAINNAME`) || Host(`webminh.$DOMAINNAME`) || Host(`synplex.$DOMAINNAME`)"

  #PyRenamer - Easily Rename Your Files
  pyrenamer:
    image: mikenye/pyrenamer:latest
    container_name: pyrenamer
    restart: "no"
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    # ports:
    #   - "$PYRENAMER_PORT:5800"
    volumes:
      - $USERDIR/Downloads:/data/downloads:rw
      - $DOCKERDIR/appdata/pyrenamer:/config:rw
      - /media/shb-drive/data/media:/data/shb:rw
      - /media/ds918/data/media:/data/ds918:rw
      - /dev/shm:/dev/shm
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
      UMASK: 002
      DISPLAY_WIDTH: 1600
      DISPLAY_HEIGHT: 960
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.pyrenamer-rtr.entrypoints=https"
      - "traefik.http.routers.pyrenamer-rtr.rule=Host(`pyrenamer.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.pyrenamer-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.pyrenamer-rtr.service=pyrenamer-svc"
      - "traefik.http.services.pyrenamer-svc.loadbalancer.server.port=5800"

  rclone-shb:
    container_name: rclone-shb
    hostname: rclone-shb
    image: rclone/rclone:1.50.2 # latest v1.53 has a bug
    restart: unless-stopped
    user: $PUID:$PGID
    command: "mount shb-drive: /data/shb-drive \
      --use-mmap \
      --allow-other \
      --user-agent=1000 \
      --poll-interval 15s \
      --buffer-size 256M \
      --umask 002 \
      --vfs-read-chunk-size 10M \
      --vfs-read-chunk-size-limit 512M \
      --drive-chunk-size 256M \
      --log-file /config/rclone/logs/shb.log \
      --log-level INFO"
    devices:
      - /dev/fuse
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    volumes:
      - $DOCKERDIR/rclone:/config/rclone
      - /media/shb-drive:/data/shb-drive:shared
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro
      - /etc/fuse.conf:/etc/fuse.conf:ro
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ