docker-compose.yml

version: "3.7"

#### Services ####
services:
  dockerproxy:
    image: tecnativa/docker-socket-proxy:latest
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /etc/localtime:/etc/localtime:ro
    environment:
      - CONTAINERS=1
      - IMAGES=1 # DIUN
    networks:
      - dockerproxy
    healthcheck:
      test: wget --no-cache --spider http://localhost:2375/v1.40/_ping || exit 1
    labels:
      diun.enable: "true"

  oauth:
    image: thomseddon/traefik-forward-auth:latest
    restart: unless-stopped
    networks:
      - proxy
    security_opt:
      - no-new-privileges:true
    environment:
      - PROVIDERS_GENERIC_OAUTH_AUTH_URL=https://github.com/login/oauth/authorize
      - PROVIDERS_GENERIC_OAUTH_TOKEN_URL=https://github.com/login/oauth/access_token
      - PROVIDERS_GENERIC_OAUTH_USER_URL=https://api.github.com/user
      - PROVIDERS_GENERIC_OAUTH_CLIENT_ID=${GITHUB_OAUTH_CLIENT_ID}
      - PROVIDERS_GENERIC_OAUTH_CLIENT_SECRET=${GITHUB_OAUTH_CLIENT_SECRET}
      - SECRET=${OAUTH_SECRET}
      - COOKIE_DOMAIN=${DOMAINNAME}
      - INSECURE_COOKIE=false
      - AUTH_HOST=oauth.${DOMAINNAME}
      - URL_PATH=/_oauth
      - WHITELIST=${ADMIN_EMAIL}
      - LOG_LEVEL=info
      - LOG_FORMAT=text
      - LIFETIME=2592000 # 30 days
      - DEFAULT_ACTION=auth
      - DEFAULT_PROVIDER=generic-oauth
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.oauth.service: oauth
      traefik.http.routers.oauth.entrypoints: websecure
      traefik.http.routers.oauth.rule: Host(`oauth.${DOMAINNAME}`)
      traefik.http.services.oauth.loadbalancer.server.port: 4181
      traefik.http.middlewares.oauth.forwardauth.address: http://oauth:4181
      traefik.http.middlewares.oauth.forwardauth.trustForwardHeader: "true"
      traefik.http.middlewares.oauth.forwardauth.authResponseHeaders: X-Forwarded-User
      traefik.http.routers.oauth.middlewares: oauth

  traefik:
    image: traefik:chevrotin
    restart: unless-stopped
    command:
      - --api=true
      - --api.dashboard=true
      - --ping=true
      - --log=true
      - --log.level=INFO
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http.tls.domains[0].sans=*.${DOMAINNAME}
      - --providers.docker=true
      - --providers.docker.network=proxy
      - --providers.docker.exposedbydefault=false
      - --providers.docker.endpoint=tcp://dockerproxy:2375
      - --certificatesResolvers.dns-cloudflare.acme.email=${ADMIN_EMAIL}
      - --certificatesResolvers.dns-cloudflare.acme.storage=/etc/traefik/acme/acme.json
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.provider=cloudflare
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.delayBeforeCheck=90
    environment:
      - CF_API_EMAIL=${ADMIN_EMAIL}
      - CF_API_KEY=${CF_API_KEY}
    ports:
      - 80:80
      - 443:443
    networks:
      dockerproxy: null
      proxy: null
    volumes:
      - traefik-acme:/etc/traefik/acme:rw
    depends_on:
      - dockerproxy
    healthcheck:
      test: traefik healthcheck --ping
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.dashboard-https.middlewares: oauth
      traefik.http.routers.dashboard-https.service: api@internal
      traefik.http.routers.dashboard-https.entrypoints: websecure
      traefik.http.routers.dashboard-https.tls.certresolver: dns-cloudflare
      traefik.http.routers.dashboard-https.rule: Host(`traefik.${DOMAINNAME}`)

  traefik-error-pages:
    container_name: traefik-error-pages
    image: guillaumebriday/traefik-custom-error-pages:latest
    restart: unless-stopped
    networks:
      - proxy
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.traefik-error-pages-rtr.entrypoints: websecure
      traefik.http.routers.traefik-error-pages-rtr.rule: HostRegexp(`{host:.+}`)
      traefik.http.routers.traefik-error-pages-rtr.priority: "1"
      traefik.http.routers.traefik-error-pages-rtr.middlewares: traefik-error-pages
      traefik.http.middlewares.traefik-error-pages.errors.service: traefik-error-pages-svc
      traefik.http.middlewares.traefik-error-pages.errors.status: 401,403,404,429,500,502,503
      traefik.http.middlewares.traefik-error-pages.errors.query: /{status}.html
      traefik.http.routers.traefik-error-pages-rtr.service: traefik-error-pages-svc
      traefik.http.services.traefik-error-pages-svc.loadbalancer.server.port: "80"

  adguardhome:
    image: adguard/adguardhome:latest
    restart: unless-stopped
    networks:
      - proxy
    ports:
      - "53:53/tcp"
      - "53:53/udp"
    volumes:
      - adguard-data:/opt/adguardhome/work
      - ./configs/adguard:/opt/adguardhome/conf
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.adguard-https.entrypoints: websecure
      traefik.http.routers.adguard-https.rule: Host(`adguard.${DOMAINNAME}`)
      traefik.http.routers.adguard-https.tls.certresolver: dns-cloudflare
      traefik.http.services.adguard-https.loadbalancer.server.port: 80

  bitwarden:
    image: bitwardenrs/server:latest
    restart: unless-stopped
    environment:
      ADMIN_TOKEN: ${BITWARDEN_ADMIN_TOKEN}
      DOMAIN: https://bitwarden.${DOMAINNAME}
      INVITATIONS_ALLOWED: "true"
      SHOW_PASSWORD_HINT: "false"
      SIGNUPS_ALLOWED: "false"
      SMTP_AUTH_MECHANISM: Plain
      SMTP_FROM: ${SMTP_FROM}
      SMTP_HOST: ${SMTP_HOST}
      SMTP_PASSWORD: ${SMTP_PASSWORD}
      SMTP_PORT: "587"
      SMTP_SSL: "true"
      SMTP_USERNAME: ${SMTP_USERNAME}
      WEBSOCKET_ENABLED: "true"
      WEB_VAULT_ENABLED: "true"
      TZ: Europe/Madrid
    networks:
      - proxy
    volumes:
      - bitwarden-data:/data:rw
    depends_on:
      - traefik
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.bitwarden-ui-https.entrypoints: websecure
      traefik.http.routers.bitwarden-ui-https.rule: Host(`bitwarden.${DOMAINNAME}`)
      traefik.http.routers.bitwarden-ui-https.service: bitwarden-ui
      traefik.http.routers.bitwarden-ui-https.tls: "true"
      traefik.http.routers.bitwarden-ui-https.tls.certresolver: dns-cloudflare
      traefik.http.routers.bitwarden-websocket-https.entrypoints: websecure
      traefik.http.routers.bitwarden-websocket-https.rule: Host(`bitwarden.${DOMAINNAME}`) && Path(`/notifications/hub`)
      traefik.http.routers.bitwarden-websocket-https.service: bitwarden-websocket
      traefik.http.routers.bitwarden-websocket-https.tls: "true"
      traefik.http.routers.bitwarden-websocket-https.tls.certresolver: dns-cloudflare
      traefik.http.services.bitwarden-ui.loadbalancer.server.port: "80"
      traefik.http.services.bitwarden-websocket.loadbalancer.server.port: "3012"

  netdata:
    image: netdata/netdata:latest
    restart: unless-stopped
    hostname: netdata.${DOMAINNAME}
    cap_add:
      - SYS_PTRACE
    security_opt:
      - apparmor:unconfined
    environment:
      - DOCKER_HOST=dockerproxy:2375
    networks:
      - proxy
      - dockerproxy
    depends_on:
      - dockerproxy
      - traefik
    volumes:
      - netdata-config:/etc/netdata
      - netdata-lib:/var/lib/netdata
      - netdata-cache:/var/cache/netdata
      - /etc/passwd:/host/etc/passwd:ro
      - /etc/group:/host/etc/group:ro
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /etc/os-release:/host/etc/os-release:ro
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.netdata-https.entrypoints: websecure
      traefik.http.routers.netdata-https.rule: Host(`netdata.${DOMAINNAME}`)
      traefik.http.routers.netdata-https.tls.certresolver: dns-cloudflare
      traefik.http.routers.netdata-https.middlewares: oauth

  diun:
    image: crazymax/diun:latest
    restart: unless-stopped
    networks:
      - default
      - dockerproxy
    volumes:
      - diun-data:/data
      - ./configs/diun.yml:/config/files/diun.yml
    environment:
      - TZ=Europe/Madrid
      - LOG_LEVEL=info
      - LOG_JSON=false
      - DIUN_WATCH_WORKERS=10
      - DIUN_WATCH_SCHEDULE=0 */6 * * *
      - DIUN_PROVIDERS_DOCKER=true
      - DIUN_PROVIDERS_DOCKER_ENDPOINT=tcp://dockerproxy:2375
      - DIUN_NOTIF_TELEGRAM_TOKEN=${TELEGRAM_BOT_TOKEN}
      - DIUN_NOTIF_TELEGRAM_CHATIDS=${TELEGRAM_CHAT_ID}
      - DIUN_PROVIDERS_FILE_FILENAME=/config/files/diun.yml
      - DIUN_WATCH_FIRSTCHECKNOTIF=true
    labels:
      diun.enable: "true"

  sse:
    image: krosf/sse
    expose:
      - 8000
    restart: unless-stopped
    networks:
      - proxy
    healthcheck:
      test: wget --no-cache --spider http://localhost:8000/ || exit 1
    depends_on:
      - traefik
    labels:
      traefik.enable: "true"
      traefik.http.routers.sse-https.entrypoints: websecure
      traefik.http.routers.sse-https.rule: Host(`sse.${DOMAINNAME}`)
      traefik.http.routers.sse-https.tls.certresolver: dns-cloudflare

  dozzle:
    image: amir20/dozzle:latest
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    environment:
      DOCKER_HOST: tcp://dockerproxy:2375
      DOZZLE_LEVEL: info
      DOZZLE_TAILSIZE: 300
      DOZZLE_FILTER: "status=running"
    volumes:
      - /etc/localtime:/etc/localtime:ro
    networks:
      - proxy
      - dockerproxy
    depends_on:
      - dockerproxy
      - traefik
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.dozzle-https.entrypoints: websecure
      traefik.http.routers.dozzle-https.tls.certresolver: dns-cloudflare
      traefik.http.routers.dozzle-https.rule: Host(`dozzle.${DOMAINNAME}`)
      traefik.http.routers.dozzle-https.middlewares: oauth

  rxresume:
    image: amruthpillai/reactive-resume:latest
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    volumes:
      - rxresume-data:/usr/src/app
    depends_on:
      - traefik
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.rxresume-https.entrypoints: websecure
      traefik.http.routers.rxresume-https.rule: Host(`rxresume.${DOMAINNAME}`)
      traefik.http.routers.rxresume-https.tls.certresolver: dns-cloudflare
      traefik.http.routers.rxresume-https.middlewares: oauth

  registry:
    image: registry:2
    restart: unless-stopped
    environment:
      - REGISTRY_HTTP_SECRET=${REGISTRY_HTTP_SECRET}
      - REGISTRY_STORAGE_DELETE_ENABLED=true
      - REGISTRY_AUTH=htpasswd
      - REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm
      - REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd
    volumes:
      - registry-data:/var/lib/registry
      - ./configs/registry/auth:/auth
    networks:
      - proxy
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.registry-https.entrypoints: websecure
      traefik.http.routers.registry-https.rule: Host(`registry.${DOMAINNAME}`) && PathPrefix(`/v2`)
      traefik.http.routers.registry-https.service: registry
      traefik.http.routers.registry-https.tls: "true"
      traefik.http.routers.registry-https.tls.certresolver: dns-cloudflare
      traefik.http.services.registry.loadbalancer.server.port: "5000"

  registry-ui:
    image: jc21/registry-ui:latest
    restart: unless-stopped
    environment:
      - NODE_ENV=production
      - REGISTRY_HOST=registry:5000
      - REGISTRY_DOMAIN=registry.${DOMAINNAME}
      - REGISTRY_STORAGE_DELETE_ENABLED=true
      - REGISTRY_USER=${REGISTRY_USER}
      - REGISTRY_PASS=${REGISTRY_PASSWORD}
    networks:
      - proxy
    depends_on:
      - registry
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.registry-ui-https.entrypoints: websecure
      traefik.http.routers.registry-ui-https.rule: Host(`registry.${DOMAINNAME}`)
      traefik.http.routers.registry-ui-https.service: registry-ui
      traefik.http.routers.registry-ui-https.tls: "true"
      traefik.http.routers.registry-ui-https.tls.certresolver: dns-cloudflare
      traefik.http.services.registry-ui.loadbalancer.server.port: "80"
      traefik.http.routers.registry-ui-https.middlewares: oauth

  filebrowser:
    image: filebrowser/filebrowser:latest
    restart: unless-stopped
    networks:
      - proxy
    volumes:
      - filebrowser-data:/srv
      - ./configs/filebrowser/.filebrowser.json:/.filebrowser.json
      - ./configs/filebrowser/database.db:/database.db
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.files-https.entrypoints: websecure
      traefik.http.routers.files-https.rule: Host(`files.${DOMAINNAME}`)
      traefik.http.routers.files-https.tls.certresolver: dns-cloudflare
      traefik.http.routers.files-https.middlewares: oauth

  xbrowsersync:
    image: xbrowsersync/api:latest
    restart: unless-stopped
    networks:
      - proxy
      - mongo
    environment:
      - XBROWSERSYNC_DB_PWD=$XBS_DB_PASSWORD
      - XBROWSERSYNC_DB_USER=$XBS_DB_USERNAME
    volumes:
      - ./configs/xbrowsersync/settings.json:/usr/src/api/config/settings.json
    depends_on:
      - mongo
    labels:
      diun.enable: "true"
      traefik.enable: "true"
      traefik.http.routers.xbrowsersync-https.entrypoints: websecure
      traefik.http.routers.xbrowsersync-https.rule: Host(`xbrowsersync.${DOMAINNAME}`)
      traefik.http.routers.xbrowsersync-https.tls.certresolver: dns-cloudflare

  mongo:
    image: mongo:latest
    restart: unless-stopped
    networks:
      - mongo
    environment:
      - MONGO_INITDB_DATABASE=xbrowsersync
      - MONGO_INITDB_ROOT_PASSWORD=$XBS_DB_PASSWORD
      - MONGO_INITDB_ROOT_USERNAME=$XBS_DB_USERNAME
    volumes:
      - mongo-data:/data/db
      - ./configs/xbrowsersync/mongoconfig.js:/docker-entrypoint-initdb.d/mongoconfig.js
    labels:
      diun.enable: "true"

#### Volumes ####
volumes:
  traefik-acme:
    driver: local-persist
    driver_opts:
      mountpoint: /mnt/hdd1/traefik/acme

  bitwarden-data:
    driver: local-persist
    driver_opts:
      mountpoint: /mnt/hdd1/bitwarden/data

  netdata-lib:
    driver: local-persist
    driver_opts:
      mountpoint: /mnt/hdd1/netdata/lib

  netdata-cache:
    driver: local-persist
    driver_opts:
      mountpoint: /mnt/hdd1/netdata/cache

  netdata-config:
    driver: local-persist
    driver_opts:
      mountpoint: /mnt/hdd1/netdata/config

  diun-data:
    driver: local-persist
    driver_opts:
      mountpoint: /mnt/hdd1/diun/data

  rxresume-data:
    driver: local-persist
    driver_opts:
      mountpoint: /mnt/hdd1/rxresume/data

  registry-data:
    driver: local-persist
    driver_opts:
      mountpoint: /mnt/hdd1/registry

  filebrowser-data:
    driver: local-persist
    driver_opts:
      mountpoint: /mnt/hdd1/filebrowser/data

  mongo-data:
    driver: local-persist
    driver_opts:
      mountpoint: /mnt/hdd1/mongo/data

  adguard-data:
    driver: local-persist
    driver_opts:
      mountpoint: /mnt/hdd1/adguard/data

#### Networks ####
networks:
  dockerproxy:
    external: false
    internal: true

  mongo:
    external: false
    internal: true

  proxy:
    external: true
    name: proxy