landscape.docker-compose.yaml

services:
    # Watchtower - Container Updater
    watchtower:
        container_name: watchtower
        privileged: true
        restart: unless-stopped
        image: containrrr/watchtower
        environment:
            WATCHTOWER_CLEANUP: "true"
            WATCHTOWER_POLL_INTERVAL: 7200
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock

    # Syncthing
    syncthing:
        image: syncthing/syncthing
        container_name: syncthing
        environment:
            - PUID=1000
            - PGID=1000
        volumes:
            - /home/$USER:/var/syncthing
        network_mode: host
        restart: on-failure

    # MDSCL-Camera
    media-date-standardize-copy-loop-camera:
        image: imranrdev/media-date-standardize-copy-loop
        container_name: media-date-standardize-copy-loop-camera
        environment:
            - NTFY_URL=https://ntfy.$SERVICES_DOMAIN/${MAIN_NODE_HOSTNAME_LOWERCASE}_services_mdscl_errors
            - NTFY_TOKEN=$NTFY_SERVICE_USER_TOKEN
        volumes:
            - "$MAIN_PARENT_DIR/deviceSync/DCIM/Camera:/source"
            - "$MAIN_PARENT_DIR/Main/Media/Camera:/destination"
        user: "1000:1000"
        restart: on-failure

    # MDSCL-Screenshots
    media-date-standardize-copy-loop-screenshots:
        image: imranrdev/media-date-standardize-copy-loop
        container_name: media-date-standardize-copy-loop-screenshots
        environment:
            - NTFY_URL=https://ntfy.$SERVICES_DOMAIN/${MAIN_NODE_HOSTNAME_LOWERCASE}_services_mdscl_errors
            - NTFY_TOKEN=$NTFY_SERVICE_USER_TOKEN
        volumes:
            - "$MAIN_PARENT_DIR/deviceSync/Screenshots:/source"
            - "$MAIN_PARENT_DIR/Main/Media/Screenshots:/destination"
        user: "1000:1000"
        restart: on-failure

    # MDSCL-ScreenRecordings
    media-date-standardize-copy-loop-screenrecs:
        image: imranrdev/media-date-standardize-copy-loop
        container_name: media-date-standardize-copy-loop-screenrecs
        environment:
            - NTFY_URL=https://ntfy.$SERVICES_DOMAIN/${MAIN_NODE_HOSTNAME_LOWERCASE}_services_mdscl_errors
            - NTFY_TOKEN=$NTFY_SERVICE_USER_TOKEN
        volumes:
            - "$MAIN_PARENT_DIR/deviceSync/Screen Recordings:/source"
            - "$MAIN_PARENT_DIR/Main/Media/Screenshots:/destination"
        user: "1000:1000"
        restart: on-failure

    # Monero node
    monerod:
        image: sethsimmons/simple-monerod:latest
        restart: unless-stopped
        container_name: monerod
        volumes:
            - $MAIN_PARENT_DIR/.bitmonero:/home/monero/.bitmonero
        ports:
            - 18080:18080
            - 18089:18089
        command:
            - "--rpc-restricted-bind-ip=0.0.0.0"
            - "--rpc-restricted-bind-port=18089"
            - "--no-igd"
            - "--no-zmq"
            - "--enable-dns-blocklist"
            - "--prune-blockchain"
            - "--rpc-login=$MONEROD_RPC_LOGIN"

    # Logtfy - Simple monitoring/alerts
    logtfy:
        image: imranrdev/logtfy:latest
        container_name: logtfy
        hostname: $MAIN_NODE_HOSTNAME
        restart: unless-stopped
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
            - /var/log/journal:/var/log/journal:ro
            - $STATE_DIR/logtfy/config.json:/logtfy/config.json
            - logtfy_tmp:/tmp/logtfy

    # Authelia - 2FA Authentication
    authelia:
        image: authelia/authelia
        container_name: authelia
        user: "1000:1000"
        depends_on:
            - authelia-db
        volumes:
            - $STATE_DIR/authelia/config:/config
        networks:
            - traefik
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.authelia.rule=Host(`auth.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.authelia.entryPoints=websecure"
            - "traefik.http.routers.authelia.tls.certresolver=le"
            - "traefik.http.routers.authelia.tls=true"
            - "traefik.http.routers.authelia.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.middlewares.authelia.forwardAuth.address=http://authelia:9091/api/verify?rd=https%3A%2F%2Fauth.$SERVICES_DOMAIN%2F"
            - "traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true"
            - "traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"
            - "traefik.http.middlewares.authelia-basic.forwardAuth.address=http://authelia:9091/api/verify?auth=basic"
            - "traefik.http.middlewares.authelia-basic.forwardAuth.trustForwardHeader=true"
            - "traefik.http.middlewares.authelia-basic.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"
        expose:
            - 9091
        restart: unless-stopped
    authelia-db:
        image: redis:alpine
        container_name: authelia-db
        user: "1000:1000"
        volumes:
            - $STATE_DIR/authelia/db:/data
        networks:
            - traefik
        expose:
            - 6379
        restart: unless-stopped

    # Traefik - Reverse Proxy
    traefik:
        image: traefik:latest
        container_name: traefik
        depends_on:
            - authelia
        command:
            - "--api=true"
            - "--api.dashboard=true"
            - "--api.insecure=false"
            - "--global.sendAnonymousUsage=false"
            - "--global.checkNewVersion=true"
            - "--log.level=DEBUG"
            - "--accesslog=true"
            - "--accesslog.filePath=/var/log/traefik/access.log"
            - "--metrics.prometheus=true"
            - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
            - "--providers.docker=true"
            - "--providers.docker.exposedByDefault=false"
            - "--providers.file.filename=/etc/traefik/dynamic-configuration.yaml"
            - "--entryPoints.web=true"
            - "--entryPoints.web.address=:8081"
            - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
            - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
            - "--entrypoints.web.http.redirections.entrypoint.permanent=true"
            - "--entryPoints.websecure=true"
            - "--entryPoints.websecure.address=:8443"
            - "--entryPoints.websecure.forwardedHeaders.trustedIPs=172.19.0.0/16,192.168.0.0/16"
            - "--entryPoints.websecure.proxyProtocol.trustedIPs=172.19.0.0/16,192.168.0.0/16"
            - "--entryPoints.websecure.http.middlewares=crowdsec-bouncer@file"
            - "--certificatesresolvers.le.acme.email=$DOMAIN_OWNER_EMAIL"
            - "--certificatesresolvers.le.acme.storage=./acme.json"
            - "--certificatesresolvers.le.acme.tlschallenge=true"
            - "--experimental.plugins.geoblock.modulename=github.com/PascalMinder/geoblock"
            - "--experimental.plugins.geoblock.version=v0.2.8"
        ports:
            - "80:80"
            - "443:8443"
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
            - $STATE_DIR/traefik/acme.json:/acme.json
            - $STATE_DIR/traefik/dynamic-configuration.yaml:/etc/traefik/dynamic-configuration.yaml
            - $STATE_DIR/traefik/mtls:/etc/traefik/mtls/
            - $STATE_DIR/traefik_logs:/var/log/traefik/
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.api.rule=Host(`traefik.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.api.entryPoints=websecure"
            - "traefik.http.routers.api.service=api@internal"
            - "traefik.http.routers.api.tls.certresolver=le"
            - "traefik.http.routers.api.tls=true"
            - "traefik.http.routers.api.middlewares=authelia@docker,geoblock@file"
        restart: unless-stopped
        networks:
            - traefik
    crowdsec:
        image: crowdsecurity/crowdsec:latest
        container_name: crowdsec
        environment:
            GID: "${GID-1000}"
            COLLECTIONS: "crowdsecurity/linux crowdsecurity/traefik"
        depends_on:
            - traefik
        volumes:
            - $STATE_DIR/crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml:ro
            - $STATE_DIR/crowdsec/db:/var/lib/crowdsec/data/
            - $STATE_DIR/crowdsec/config:/etc/crowdsec/
            - $STATE_DIR/traefik_logs:/var/log/traefik/:ro
            - $STATE_DIR/crowdsec/profiles.yaml:/etc/crowdsec/profiles.yaml:ro
            - $STATE_DIR/crowdsec/notifications-http.yaml:/etc/crowdsec/notifications/http.yaml:ro
        networks:
            - traefik
        restart: unless-stopped
    crowdsec-bouncer:
        image: docker.io/fbonalair/traefik-crowdsec-bouncer:latest
        container_name: crowdsec-bouncer
        environment:
            CROWDSEC_BOUNCER_API_KEY: $CROWDSEC_BOUNCER_KEY
            CROWDSEC_AGENT_HOST: crowdsec:8080
        networks:
            - traefik
        depends_on:
            - crowdsec
        restart: unless-stopped
    crowdsec-dashboard:
        image: metabase/metabase
        container_name: crowdsec-dashboard
        depends_on:
            - crowdsec
        restart: unless-stopped
        environment:
            MB_DB_FILE: /data/metabase.db
            MGID: "${GID-1000}"
        networks:
            - traefik
        volumes:
            - $STATE_DIR/crowdsec/dashboard-db:/data # Bootstrap dashboard DB from https://crowdsec-statics-assets.s3-eu-west-1.amazonaws.com/metabase_sqlite.zip
            - $STATE_DIR/crowdsec/db:/metabase-data/
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.crowdsec-dashboard.rule=Host(`crowdsec.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.crowdsec-dashboard.entrypoints=websecure"
            - "traefik.http.routers.crowdsec-dashboard.tls.certresolver=le"
            - "traefik.http.routers.crowdsec-dashboard.tls=true"
            - "traefik.http.routers.crowdsec-dashboard.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.crowdsec-dashboard.loadbalancer.server.port=3000"

    # Grafana + Prometheus - Monitoring
    prometheus:
        image: prom/prometheus
        container_name: prometheus
        depends_on:
            - traefik
        volumes:
            - $STATE_DIR/prometheus/:/config
            - prometheus_data:/prometheus
        command:
            - "--config.file=/config/prometheus.yaml"
            - "--storage.tsdb.path=/prometheus"
            - "--storage.tsdb.retention.size=512MB"
        networks:
            - traefik
        labels:
            - "traefik.http.routers.prometheus.rule=Host(`prometheus.localhost`)"
            - "traefik.http.routers.prometheus.service=prometheus"
            - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
        restart: unless-stopped
    grafana: # Add the Prometheus datasource (https://prometheus:9090) then import this dashboard: https://grafana.com/grafana/dashboards/17346-traefik-official-standalone-dashboard/
        image: grafana/grafana
        container_name: grafana
        depends_on:
            - prometheus
        volumes:
            - grafana_data:/var/lib/grafana
            - $STATE_DIR/grafana/provisioning:/etc/grafana/provisioning/
        user: 1000:1000
        environment:
            GF_INSTALL_PLUGINS: grafana-piechart-panel
        networks:
            - traefik
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.grafana.rule=Host(`grafana.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.grafana.entrypoints=websecure"
            - "traefik.http.routers.grafana.tls.certresolver=le"
            - "traefik.http.routers.grafana.tls=true"
            - "traefik.http.routers.grafana.service=grafana"
            - "traefik.http.routers.grafana.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.grafana.loadbalancer.server.port=3000"
            - "traefik.docker.network=traefik"
        restart: unless-stopped

    # Beszel - Local resource monitoring
    beszel:
        image: henrygd/beszel:latest
        container_name: beszel
        restart: unless-stopped
        depends_on:
            traefik:
                condition: service_started
        extra_hosts:
            - host.docker.internal:host-gateway
        volumes:
            - $STATE_DIR/beszel:/beszel_data
        networks:
            - traefik
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.beszel.rule=Host(`beszel.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.beszel.entrypoints=websecure"
            - "traefik.http.routers.beszel.tls.certresolver=le"
            - "traefik.http.routers.beszel.tls=true"
            - "traefik.http.routers.beszel.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.beszel.loadbalancer.server.port=8090"
    beszel-agent:
        image: henrygd/beszel-agent:latest
        container_name: beszel-agent
        restart: unless-stopped
        network_mode: host
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock:ro
        environment:
            PORT: 45876
            KEY: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL1uvCi9CWycgoKPFc5WWh7YncjnjSUUYpkokvj7Ou+i"

    # OpenCanary - Honeypot
    opencanary:
        container_name: opencanary
        image: thinkst/opencanary
        restart: unless-stopped
        volumes:
            - $STATE_DIR/opencanary/opencanary.json:/root/.opencanary.conf
            # - /var/log/samba-audit.log:/var/log/samba-audit.log
        networks:
            - traefik
        ports:
            - "21:21"
            - "3306:3306"
            - "5000:5000"
            - "8082:8082"
            - "9418:9418"

    # Plausible - Web Analytics
    plausible_db:
        # Plausible v2.1.1 was tested against PostgreSQL versions 15 and 16
        # https://github.com/plausible/analytics/blob/v2.1.1/.github/workflows/elixir.yml#L21-L32
        image: postgres:16-alpine
        container_name: plausible_db
        restart: unless-stopped
        volumes:
            - plausible-db-data:/var/lib/postgresql/data
        environment:
            - POSTGRES_PASSWORD=postgres
        healthcheck:
            test: ["CMD-SHELL", "pg_isready -U postgres"]
            start_period: 1m
        networks:
            - traefik
    plausible_events_db:
        image: clickhouse/clickhouse-server:24.3.3.102-alpine
        restart: unless-stopped
        container_name: plausible_events_db
        networks:
            - traefik
        volumes:
            - plausible-event-data:/var/lib/clickhouse
            - plausible-event-logs:/var/log/clickhouse-server
            - $STATE_DIR/plausible/logs.xml:/etc/clickhouse-server/config.d/logs.xml:ro
            - $STATE_DIR/plausible/ipv4-only.xml:/etc/clickhouse-server/config.d/ipv4-only.xml:ro
        ulimits:
            nofile:
                soft: 262144
                hard: 262144
        healthcheck:
            test:
                [
                    "CMD-SHELL",
                    "wget --no-verbose --tries=1 -O - http://127.0.0.1:8123/ping || exit 1",
                ]
            start_period: 1m
    plausible:
        image: ghcr.io/plausible/community-edition:v2.1.4
        restart: unless-stopped
        container_name: plausible
        command: sh -c "sleep 10 && /entrypoint.sh db createdb && /entrypoint.sh db migrate && /entrypoint.sh run"
        depends_on:
            traefik:
                condition: service_started
            plausible_db:
                condition: service_healthy
            plausible_events_db:
                condition: service_healthy
        networks:
            - traefik
        volumes:
            - plausible-data:/var/lib/plausible
        ulimits:
            nofile:
                soft: 65535
                hard: 65535
        environment:
            - BASE_URL=https://plausible.$SERVICES_DOMAIN
            - SECRET_KEY_BASE=$PLAUSIBLE_SECRET_KEY
            - TOTP_VAULT_KEY=$PLAUSIBLE_TOTP_VAULT_KEY
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.plausible.rule=Host(`plausible.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.plausible.entrypoints=websecure"
            - "traefik.http.routers.plausible.tls.certresolver=le"
            - "traefik.http.routers.plausible.tls=true"
            - "traefik.http.services.plausible.loadbalancer.server.port=8000"
            - "traefik.http.routers.plausible.middlewares=authelia@docker"

    registry:
        container_name: registry
        image: registry
        restart: unless-stopped
        depends_on:
            - traefik
        user: 1000:1000
        environment:
            - REGISTRY_AUTH=htpasswd
            - REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm
            - REGISTRY_AUTH_HTPASSWD_PATH=/auth/.htpasswd
            - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/data
        volumes:
            - $STATE_DIR/registry/auth:/auth
            - $STATE_DIR/registry/data:/data
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.registry.rule=Host(`docker.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.registry.entrypoints=websecure"
            - "traefik.http.routers.registry.tls.certresolver=le"
            - "traefik.http.routers.registry.tls=true"
            - "traefik.http.routers.registry.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.registry.loadbalancer.server.port=5000"
        networks:
            - traefik

    # File Browser
    filebrowser:
        container_name: filebrowser
        image: filebrowser/filebrowser
        restart: unless-stopped
        depends_on:
            - traefik
        user: "1000:1000"
        volumes:
            - $MAIN_PARENT_DIR:/srv
            - $STATE_DIR/filebrowser/filebrowser.db:/database.db
            - $STATE_DIR/filebrowser/filebrowser.json:/.filebrowser.json
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.filebrowser.rule=Host(`files.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.filebrowser.entrypoints=websecure"
            - "traefik.http.routers.filebrowser.tls.certresolver=le"
            - "traefik.http.routers.filebrowser.tls=true"
            - "traefik.http.routers.filebrowser.tls.options=mtls@file"
            - "traefik.http.routers.filebrowser.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.filebrowser.loadbalancer.server.port=80"
        networks:
            - traefik
        healthcheck:
            test: ["CMD", "curl", "-f", "http://localhost:80/health"]
            interval: 30s
            timeout: 20s
            retries: 3

    # Sharry - File Sharing
    sharry:
        image: eikek0/sharry:latest
        container_name: sharry
        command: /opt/sharry.conf
        volumes:
            - $STATE_DIR/sharry/sharry.conf:/opt/sharry.conf
            - $STATE_DIR/sharry/uploads:/uploads
        depends_on:
            sharry-db:
                condition: service_healthy
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.sharry.rule=Host(`share.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.sharry.entrypoints=websecure"
            - "traefik.http.routers.sharry.middlewares=authelia@docker,crowdsec-bouncer@file"
            - "traefik.http.routers.sharry.tls.certresolver=le"
            - "traefik.http.routers.sharry.tls=true"
            - "traefik.http.services.sharry.loadbalancer.server.port=9090"
        networks:
            - traefik
    sharry-db:
        image: postgres:17.2
        container_name: sharry-db
        volumes:
            - $STATE_DIR/sharry/db:/var/lib/postgresql/data/
        environment:
            - POSTGRES_USER=dbuser
            - POSTGRES_PASSWORD=dbpass
            - POSTGRES_DB=dbname
            - PGUSER=dbuser
        healthcheck:
            test: ["CMD-SHELL", "pg_isready", "-d", "dbname"]
            interval: 15s
            timeout: 60s
            retries: 5
            start_period: 15s
        networks:
            - traefik

    # Jellyfin - TV Streaming
    jellyfin:
        container_name: jellyfin
        image: jellyfin/jellyfin
        depends_on:
            - traefik
        user: "1000:1000"
        volumes:
            - "$MAIN_PARENT_DIR/Main/External Media:/media"
            - $STATE_DIR/jellyfin/config:/config
            - $STATE_DIR/jellyfin/cache:/cache
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.jellyfin.rule=Host(`tv.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.jellyfin.entrypoints=websecure"
            - "traefik.http.routers.jellyfin.tls.certresolver=le"
            - "traefik.http.routers.jellyfin.tls=true"
            - "traefik.http.routers.jellyfin.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.middlewares.jellyfin.ratelimit.average=50"
            - "traefik.http.middlewares.jellyfin.ratelimit.burst=25"
        ports:
            - 127.0.0.1:8096:8096
        networks:
            - traefik

    # Ntfy - Push Notifications
    ntfy:
        image: binwiederhier/ntfy
        container_name: ntfy
        user: "1000:1000"
        depends_on:
            - traefik
        command:
            - "serve"
            - "-d"
        volumes:
            - $STATE_DIR/ntfy/cache:/var/cache/ntfy
            - $STATE_DIR/ntfy/etc:/etc/ntfy
        restart: unless-stopped
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.ntfy.rule=Host(`ntfy.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.ntfy.entrypoints=websecure"
            - "traefik.http.routers.ntfy.tls.certresolver=le"
            - "traefik.http.routers.ntfy.tls=true"
            - "traefik.http.routers.ntfy.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.ntfy.loadbalancer.server.port=80"
        networks:
            - traefik

    # PixelNtfy - Tracking Pixels
    pixelntfy:
        container_name: pixelntfy
        image: imranrdev/pixel-ntfy
        depends_on:
            - traefik
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.pixelntfy.rule=Host(`pixelntfy.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.pixelntfy.entrypoints=websecure"
            - "traefik.http.routers.pixelntfy.middlewares=authelia@docker,crowdsec-bouncer@file"
            - "traefik.http.routers.pixelntfy.tls.certresolver=le"
            - "traefik.http.routers.pixelntfy.tls=true"
            - "traefik.http.services.pixelntfy.loadbalancer.server.port=80"
        environment:
            - NTFY_TOPIC=${MAIN_NODE_HOSTNAME_LOWERCASE}_services_${PIXELNTFY_TOPIC_SUFFIX}
            - NTFY_SERVER_URL=https://ntfy.$SERVICES_DOMAIN
            - NTFY_TOKEN=$NTFY_SERVICE_USER_TOKEN
            - PORT=80
            - ANALYTICS_SCRIPT_ELEMENT=<script defer data-domain="pixelntfy.$SERVICES_DOMAIN" src="https://plausible.$SERVICES_DOMAIN/js/script.js"></script>
        networks:
            - traefik

    # D$CPLN - Monthly/Weekly Budget
    dscpln:
        container_name: dscpln
        image: imranrdev/dscpln
        depends_on:
            - traefik
            - ntfy
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.dscpln.rule=Host(`dscpln.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.dscpln.entrypoints=websecure"
            - "traefik.http.routers.dscpln.tls.certresolver=le"
            - "traefik.http.routers.dscpln.tls=true"
            - "traefik.http.routers.dscpln.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.dscpln.loadbalancer.server.port=3300"
        volumes:
            - "$MAIN_PARENT_DIR/Main/Notes/Transactions:/Transactions"
        environment:
            - "TEXTFILE_DATA_PROVIDER_DATA_PATH=/Transactions/Acc 2025.md"
            - MONTHLY_LIMIT_NTFY_URL=https://ntfy.$SERVICES_DOMAIN/${MAIN_NODE_HOSTNAME_LOWERCASE}_services_dscpln
            - WEEKLY_LIMIT_NTFY_URL=https://ntfy.$SERVICES_DOMAIN/${MAIN_NODE_HOSTNAME_LOWERCASE}_services_dscpln
            - NTFY_TOKEN=$NTFY_SERVICE_USER_TOKEN
            - TEXTFILE_BUDGET_INIT_AMT=2400
            - TEXTFILE_FIRST_WEEK_BIAS_INIT_AMT=1400
        networks:
            - traefik
        restart: unless-stopped

    # ParseBalX - Monthly Expenses/Earnings Charts
    parsebalx:
        container_name: parsebalx
        image: imranrdev/parsebalx
        depends_on:
            - traefik
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.parsebalx.rule=Host(`bal.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.parsebalx.entrypoints=websecure"
            - "traefik.http.routers.parsebalx.tls.certresolver=le"
            - "traefik.http.routers.parsebalx.tls=true"
            - "traefik.http.routers.parsebalx.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.parsebalx.loadbalancer.server.port=3000"
        volumes:
            - "$MAIN_PARENT_DIR/Main/Documents/Balance/Balance.xlsx:/Balance.xlsx:ro"
        networks:
            - traefik
        restart: unless-stopped

    # ISBN Lookup
    isbn-lookup:
        container_name: isbn-lookup
        image: imranrdev/isbn-lookup
        depends_on:
            - traefik
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.isbn-lookup.rule=Host(`isbn.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.isbn-lookup.entrypoints=websecure"
            - "traefik.http.routers.isbn-lookup.middlewares=authelia@docker,crowdsec-bouncer@file"
            - "traefik.http.routers.isbn-lookup.tls.certresolver=le"
            - "traefik.http.routers.isbn-lookup.tls=true"
            - "traefik.http.services.isbn-lookup.loadbalancer.server.port=80"
        environment:
            - PORT=80
            - ANALYTICS_SCRIPT_ELEMENT=<script defer data-domain="isbn.$SERVICES_DOMAIN" src="https://plausible.$SERVICES_DOMAIN/js/script.js"></script>
        networks:
            - traefik

    # Immich - Gallery
    immich-server:
        container_name: immich-server
        image: ghcr.io/immich-app/immich-server:release
        extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/hardware-transcoding
            file: $STATE_DIR/immich/hwaccel.transcoding.yml
            service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
        user: 1000:1000
        volumes:
            - $STATE_DIR/immich/upload:/usr/src/app/upload
            - /etc/localtime:/etc/localtime:ro
            - "$MAIN_PARENT_DIR/Main/Media:/mnt/media/ext-media:ro"
        environment:
            - UPLOAD_LOCATION=$STATE_DIR/immich-upload
            - DB_HOSTNAME=immich-database
            - REDIS_HOSTNAME=immich-redis
            - DB_PASSWORD=$IMMICH_DB_PASSWORD
            - DB_USERNAME=postgres
            - DB_DATABASE_NAME=immich
        depends_on:
            - immich-redis
            - immich-database
        restart: always
        networks:
            - traefik
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.immich.rule=Host(`immich.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.immich.entrypoints=websecure"
            - "traefik.http.routers.immich.tls.certresolver=le"
            - "traefik.http.routers.immich.tls=true"
            - "traefik.http.routers.immich.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.immich.loadbalancer.server.port=2283"
    immich-machine-learning:
        container_name: immich-machine-learning
        # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
        # Example tag: release-cuda
        image: ghcr.io/immich-app/immich-machine-learning:release
        extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
            file: $STATE_DIR/immich/hwaccel.ml.yml
            service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
        volumes:
            - immich-model-cache:/cache
        environment:
            - UPLOAD_LOCATION=$STATE_DIR/immich-upload
            - DB_HOSTNAME=immich-database
            - REDIS_HOSTNAME=immich-redis
            - DB_PASSWORD=$IMMICH_DB_PASSWORD
            - DB_USERNAME=postgres
            - DB_DATABASE_NAME=immich
        restart: always
        networks:
            - traefik
    immich-redis:
        container_name: immich-redis
        image: registry.hub.docker.com/library/redis:6.2-alpine
        restart: always
        networks:
            - traefik
    immich-database:
        container_name: immich-postgres
        image: registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0
        environment:
            POSTGRES_PASSWORD: $IMMICH_DB_PASSWORD
            POSTGRES_USER: postgres
            POSTGRES_DB: immich
        volumes:
            - $STATE_DIR/immich/postgres:/var/lib/postgresql/data
        restart: always
        networks:
            - traefik

    # Service Uptime
    uptime:
        container_name: uptime
        image: louislam/uptime-kuma:latest
        restart: unless-stopped
        depends_on:
            - traefik
        environment:
            - PUID=1000
            - PGID=1000
        volumes:
            - $STATE_DIR/uptime:/app/data/
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.uptime.rule=Host(`uptime.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.uptime.entrypoints=websecure"
            - "traefik.http.routers.uptime.tls.certresolver=le"
            - "traefik.http.routers.uptime.tls=true"
            - "traefik.http.routers.uptime.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.uptime.loadbalancer.server.port=3001"
        networks:
            - traefik

    # Navidrome - Music Streaming
    navidrome:
        container_name: navidrome
        image: deluan/navidrome:latest
        user: 1000:1000
        depends_on:
            - traefik
        restart: unless-stopped
        volumes:
            - "$STATE_DIR/navidrome/data:/data"
            - "$MAIN_PARENT_DIR/Main/External Media/Music:/music:ro"
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.navidrome.rule=Host(`music.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.navidrome.entrypoints=websecure"
            - "traefik.http.routers.navidrome.tls.certresolver=le"
            - "traefik.http.routers.navidrome.tls=true"
            - "traefik.http.routers.navidrome.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.navidrome.loadbalancer.server.port=4533"
        networks:
            - traefik

    # Home Assistant + MQTT
    homeassistant:
        container_name: homeassistant
        image: ghcr.io/home-assistant/home-assistant:stable
        volumes:
            - $STATE_DIR/homeassistant:/config/
            - /etc/localtime:/etc/localtime:ro
            - /run/dbus:/run/dbus:ro
        restart: unless-stopped
        privileged: true
        networks:
            - traefik
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.homeassistant.rule=Host(`ha.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.homeassistant.entrypoints=websecure"
            - "traefik.http.routers.homeassistant.tls.certresolver=le"
            - "traefik.http.routers.homeassistant.tls=true"
            - "traefik.http.routers.homeassistant.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.homeassistant.loadbalancer.server.port=8123"
    mosquitto:
        image: eclipse-mosquitto:openssl
        container_name: mosquitto
        ports:
            - 8883:8883
            - 9001:9001
        volumes:
            - $STATE_DIR/mosquitto/config:/mosquitto/config
            - $STATE_DIR/mosquitto/data:/mosquitto/data
            - $STATE_DIR/mosquitto/log:/mosquitto/log
        command: mosquitto -c /mosquitto/config/mosquitto.conf
        restart: unless-stopped
        networks:
            - traefik
    wyoming-whisper:
        image: rhasspy/wyoming-whisper
        container_name: wyoming-whisper
        volumes:
            - $STATE_DIR/homeassistant/wyoming-whisper-data:/data
        command: "--model small-int8"
        restart: unless-stopped
        networks:
            - traefik
    wyoming-piper:
        image: rhasspy/wyoming-piper
        container_name: wyoming-piper
        volumes:
            - $STATE_DIR/homeassistant/wyoming-piper-data:/data
        command: "--voice en_US-lessac-medium"
        restart: unless-stopped
        networks:
            - traefik

    # LLMs
    ollama:
        image: ollama/ollama:latest
        container_name: ollama
        volumes:
            - ollama:/root/.ollama
        networks:
            - traefik
        tty: true
        restart: unless-stopped
        # Uncomment below for GPU support
        # deploy:
        #   resources:
        #     reservations:
        #       devices:
        #         - driver: nvidia
        #           count: 1
        #           capabilities:
        #             - gpu
    ollama-webui:
        image: ghcr.io/open-webui/open-webui:main
        container_name: ollama-webui
        environment:
            - "OLLAMA_BASE_URL=http://ollama:11434"
            - "WEBUI_AUTH_TRUSTED_EMAIL_HEADER=Remote-Email"
            - "WEBUI_AUTH_TRUSTED_NAME_HEADER=Remote-Name"
        volumes:
            - ollama-webui:/app/backend/data
        networks:
            - traefik
        depends_on:
            - ollama
            - traefik
        restart: unless-stopped
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.ollama-webui.rule=Host(`gpt.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.ollama-webui.entrypoints=websecure"
            - "traefik.http.routers.ollama-webui.tls.certresolver=le"
            - "traefik.http.routers.ollama-webui.tls=true"
            - "traefik.http.routers.ollama-webui.middlewares=authelia@docker,geoblock@file"
            - "traefik.http.services.ollama-webui.loadbalancer.server.port=8080"

    # MeTube - YouTube Downloader
    metube:
        image: ghcr.io/alexta69/metube:latest
        container_name: metube
        volumes:
            - $STATE_DIR/metube:/downloads
        networks:
            - traefik
        depends_on:
            - traefik
        restart: unless-stopped
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.metube.rule=Host(`ytdl.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.metube.entrypoints=websecure"
            - "traefik.http.routers.metube.middlewares=authelia@docker,crowdsec-bouncer@file"
            - "traefik.http.routers.metube.tls.certresolver=le"
            - "traefik.http.routers.metube.tls=true"
            - "traefik.http.services.metube.loadbalancer.server.port=8081"

    # WebDAV Server
    webdav:
        image: rclone/rclone:latest
        container_name: webdav
        volumes:
            - $STATE_DIR/webdav/config:/config/rclone
            - $STATE_DIR/webdav/data:/data
        networks:
            - traefik
        depends_on:
            - traefik
        restart: unless-stopped
        command:
            - "serve"
            - "webdav"
            - "/data"
            - "--addr"
            - "0.0.0.0:8080"
            - "--htpasswd"
            - "/config/rclone/htpasswd"
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.webdav.rule=Host(`webdav.$SERVICES_DOMAIN`)"
            - "traefik.http.routers.webdav.entrypoints=websecure"
            - "traefik.http.routers.webdav.middlewares=authelia@docker,crowdsec-bouncer@file"
            - "traefik.http.routers.webdav.tls.certresolver=le"
            - "traefik.http.routers.webdav.tls=true"
            - "traefik.http.services.webdav.loadbalancer.server.port=8080"

networks:
    traefik:
        ipam:
            config:
                - subnet: 172.19.0.0/16

volumes:
    logtfy_tmp: {}
    grafana_data: {}
    prometheus_data: {}
    plausible-db-data: {}
    plausible-event-data: {}
    plausible-event-logs: {}
    plausible-data: {}
    ollama: {}
    ollama-webui: {}
    navidrome-cache: {}
    immich-model-cache: {}