docker-compose.yml

services:
  traefik:
    image: traefik:v3.3
    container_name: traefik
    restart: always
    environment:
      - CLOUDFLARE_EMAIL=${CLOUDFLARE_EMAIL}
      - CLOUDFLARE_DNS_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}
      - CLOUDFLARE_ZONE_API_TOKEN=${CLOUDFLARE_ZONE_API_TOKEN}
      - LETS_ENCRYPT_EMAIL=${LETS_ENCRYPT_EMAIL}
    command:
      - --ping=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.web-secure.address=:443
      - --entrypoints.web.http.redirections.entryPoint.to=web-secure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --experimental.plugins.rewrite-body.modulename=github.com/packruler/rewrite-body
      - --experimental.plugins.rewrite-body.version=v1.2.0
      - --experimental.plugins.rewriteHeaders.modulename=github.com/XciD/traefik-plugin-rewrite-headers
      - --experimental.plugins.rewriteHeaders.version=v0.0.3
      - --certificatesresolvers.myresolver.acme.dnschallenge=${DNS_CHALLENGE:-true}
      - --certificatesresolvers.myresolver.acme.dnschallenge.provider=${DNS_CHALLENGE_PROVIDER:-cloudflare}
      - --certificatesresolvers.myresolver.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53
      - --certificatesresolvers.myresolver.acme.caserver=${LETS_ENCRYPT_CA_SERVER:-https://acme-v02.api.letsencrypt.org/directory}
      - --certificatesresolvers.myresolver.acme.email=${LETS_ENCRYPT_EMAIL}
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ${CONFIG_ROOT:-.}/letsencrypt:/letsencrypt
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    extra_hosts:
      - host.docker.internal:172.17.0.1
    healthcheck:
      test: [ "CMD", "traefik", "healthcheck", "--ping" ]
      interval: 30s
      retries: 10
  sonarr:
    image: lscr.io/linuxserver/sonarr
    container_name: sonarr
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONFIG_ROOT:-.}/sonarr:/config
      - ${DATA_ROOT}:/data
    restart: always
    healthcheck:
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:8989/sonarr/ping" ]
      interval: 30s
      retries: 10
    labels:
      - traefik.enable=true
      - traefik.http.routers.sonarr.rule=(Host(`${HOSTNAME}`) && PathPrefix(`/sonarr`))
      - traefik.http.routers.sonarr.tls=true
      - traefik.http.routers.sonarr.tls.certresolver=myresolver
      - traefik.http.services.sonarr.loadbalancer.server.port=8989
      - homepage.group=Media
      - homepage.name=Sonarr
      - homepage.icon=sonarr.png
      - homepage.href=/sonarr
      - homepage.description=Series management
      - homepage.weight=0
      - homepage.widget.type=sonarr
      - homepage.widget.url=http://sonarr:8989/sonarr
      - homepage.widget.key=${SONARR_API_KEY}
  radarr:
    image: lscr.io/linuxserver/radarr
    container_name: radarr
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONFIG_ROOT:-.}/radarr:/config
      - ${DATA_ROOT}:/data
    restart: always
    healthcheck:
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:7878/radarr/ping" ]
      interval: 30s
      retries: 10
    labels:
      - traefik.enable=true
      - traefik.http.routers.radarr.rule=(Host(`${HOSTNAME}`) && PathPrefix(`/radarr`))
      - traefik.http.routers.radarr.tls=true
      - traefik.http.routers.radarr.tls.certresolver=myresolver
      - traefik.http.services.radarr.loadbalancer.server.port=7878
      - homepage.group=Media
      - homepage.name=Radarr
      - homepage.icon=radarr.png
      - homepage.href=/radarr
      - homepage.description=Movies management
      - homepage.weight=1
      - homepage.widget.type=radarr
      - homepage.widget.url=http://radarr:7878/radarr
      - homepage.widget.key=${RADARR_API_KEY}
  bazarr:
    image: lscr.io/linuxserver/bazarr
    container_name: bazarr
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONFIG_ROOT:-.}/bazarr/config:/config
      - ${DATA_ROOT}:/data
    restart: always
    healthcheck:
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:6767/bazarr/ping" ]
      interval: 5s
      retries: 10
    labels:
      - traefik.enable=true
      - traefik.http.routers.bazarr.rule=(Host(`${HOSTNAME}`) && PathPrefix(`/bazarr`))
      - traefik.http.routers.bazarr.tls=true
      - traefik.http.routers.bazarr.tls.certresolver=myresolver
      - traefik.http.services.bazarr.loadbalancer.server.port=6767
      - homepage.group=Download
      - homepage.name=Bazarr
      - homepage.icon=bazarr.png
      - homepage.href=/bazarr
      - homepage.description=Subtitles management
      - homepage.weight=4
      - homepage.widget.type=bazarr
      - homepage.widget.url=http://bazarr:6767/bazarr
      - homepage.widget.key=${BAZARR_API_KEY}
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONFIG_ROOT:-.}/prowlarr:/config
    restart: always
    healthcheck:
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:9696/prowlarr/ping" ]
      interval: 30s
      retries: 10
    labels:
      - traefik.enable=true
      - traefik.http.routers.prowlarr.rule=(Host(`${HOSTNAME}`) && PathPrefix(`/prowlarr`))
      - traefik.http.routers.prowlarr.tls=true
      - traefik.http.routers.prowlarr.tls.certresolver=myresolver
      - traefik.http.services.prowlarr.loadbalancer.server.port=9696
      - homepage.group=Download
      - homepage.name=Prowlarr
      - homepage.icon=prowlarr.png
      - homepage.href=/prowlarr
      - homepage.description=Indexers management
      - homepage.weight=1
      - homepage.widget.type=prowlarr
      - homepage.widget.url=http://prowlarr:9696/prowlarr
      - homepage.widget.key=${PROWLARR_API_KEY}
  flaresolverr:
    image: 21hsmw/flaresolverr:nodriver
    container_name: flaresolverr
    restart: always
    environment:
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - LOG_HTML=${LOG_HTML:-false}
      - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none}
      - TZ=${TIMEZONE}
    labels:
      - traefik.enable=true
      - traefik.http.routers.flaresolverr.rule=PathPrefix(`/flaresolverr`)
      - traefik.http.routers.flaresolverr.tls=true
      - traefik.http.services.flaresolverr.loadbalancer.server.port=8191
    profiles:
      - flaresolverr
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:libtorrentv1
    container_name: qbittorrent
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
      - WEBUI_PORT=8080
      - DOCKER_MODS=ghcr.io/gabe565/linuxserver-mod-vuetorrent
    volumes:
      - ${CONFIG_ROOT:-.}/qbittorrent:/config
      - ${DOWNLOAD_ROOT}:/data/torrents
    restart: always
    healthcheck:
      # Container may fail if the PIA's token expired, so mark as unhealthy when there is no internet connection
      # see: https://github.com/qdm12/gluetun/issues/641#issuecomment-933856220
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:8080", "https://google.com" ]
      interval: 30s
      retries: 10
    network_mode: "service:vpn"
    depends_on:
      vpn:
        condition: service_healthy
    labels:
      - traefik.enable=true
      - traefik.http.routers.qbittorrent.rule=(Host(`${HOSTNAME}`) && PathPrefix(`/qbittorrent`))
      - traefik.http.routers.qbittorrent.tls=true
      - traefik.http.routers.qbittorrent.tls.certresolver=myresolver
      - traefik.http.services.qbittorrent.loadbalancer.server.port=8080
      - traefik.http.routers.qbittorrent.middlewares=qbittorrent-strip-slash,qbittorrent-stripprefix
      # https://github.com/qbittorrent/qBittorrent/issues/5693#issuecomment-552146296
      - traefik.http.middlewares.qbittorrent-stripprefix.stripPrefix.prefixes=/qbittorrent
      # https://community.traefik.io/t/middleware-to-add-the-if-needed/1895/19
      - traefik.http.middlewares.qbittorrent-strip-slash.redirectregex.regex=(^.*\/qbittorrent$$)
      - traefik.http.middlewares.qbittorrent-strip-slash.redirectregex.replacement=$$1/
      - traefik.http.middlewares.qbittorrent-strip-slash.redirectregex.permanent=false
      #- com.centurylinklabs.watchtower.depends-on=/vpn
      - homepage.group=Download
      - homepage.name=qBittorrent
      - homepage.icon=qbittorrent.png
      - homepage.href=/qbittorrent
      - homepage.description=Bittorrent client
      - homepage.weight=2
      - homepage.widget.type=qbittorrent
      - homepage.widget.url=http://vpn:8080
      - homepage.widget.username=${QBITTORRENT_USERNAME}
      - homepage.widget.password=${QBITTORRENT_PASSWORD}
  vpn:
    image: thrnz/docker-wireguard-pia
    container_name: vpn
    volumes:
      - ${CONFIG_ROOT:-.}/pia:/pia
      - ${CONFIG_ROOT:-.}/pia-shared:/pia-shared
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - LOC=${PIA_LOCATION}
      - USER=${PIA_USER}
      - PASS=${PIA_PASS}
      - QBT_USER=${QBITTORRENT_USERNAME}
      - QBT_PASS=${QBITTORRENT_PASSWORD}
      - LOCAL_NETWORK=${PIA_LOCAL_NETWORK}
      - PORT_FORWARDING=1
      - PORT_PERSIST=1
      - PORT_SCRIPT=/pia-shared/portupdate-qbittorrent.sh
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.default.disable_ipv6=1
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv6.conf.lo.disable_ipv6=1
    healthcheck:
      test: ping -c 1 www.google.com || exit 1
      interval: 30s
      timeout: 10s
      retries: 3
    restart: always
  unpackerr:
    image: golift/unpackerr:latest
    container_name: unpackerr
    volumes:
      - ${DOWNLOAD_ROOT}:/data/torrents
    restart: always
    user: ${USER_ID}:${GROUP_ID}
    environment:
      - TZ=${TIMEZONE}
      - UN_SONARR_0_URL=http://sonarr:8989/sonarr
      - UN_SONARR_0_API_KEY=${SONARR_API_KEY}
      - UN_RADARR_0_URL=http://radarr:7878/radarr
      - UN_RADARR_0_API_KEY=${RADARR_API_KEY}
    security_opt:
      - no-new-privileges:true
  sabnzbd:
    image: lscr.io/linuxserver/sabnzbd:latest
    container_name: sabnzbd
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONFIG_ROOT:-.}/sabnzbd:/config
      - ${DATA_ROOT}:/data
    restart: always
    labels:
      - traefik.enable=true
      - traefik.http.routers.sabnzbd.rule=(Host(`${HOSTNAME}`) && PathPrefix(`/sabnzbd`) || PathPrefix(`/sabnzbd`))
      - traefik.http.routers.sabnzbd.tls=true
      - traefik.http.routers.sabnzbd.tls.certresolver=myresolver
      - traefik.http.services.sabnzbd.loadbalancer.server.port=8080
      - homepage.group=Download
      - homepage.name=Sabnzbd
      - homepage.icon=sabnzbd.png
      - homepage.href=/sabnzbd
      - homepage.description=Usenet
      - homepage.weight=3
      - homepage.widget.type=sabnzbd
      - homepage.widget.url=http://sabnzbd:8080/sabnzbd
      - homepage.widget.key=${SABNZBD_API_KEY}
    profiles:
      - sabnzbd
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
      - JELLYFIN_PublishedServerUrl=${HOSTNAME}/jellyfin
    volumes:
      - ${CONFIG_ROOT:-.}/jellyfin:/config
      - ${DATA_ROOT}:/data
    ports:
      - "7359:7359/udp"
      #- "1900:1900/udp"
    restart: always
    healthcheck:
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:8096/jellyfin/health" ]
      interval: 30s
      retries: 10
    devices:
      - /dev/dri/renderD128:/dev/dri/renderD128
      - /dev/dri/card0:/dev/dri/card0
    labels:
      - traefik.enable=true
      - traefik.http.routers.jellyfin.rule=(Host(`${HOSTNAME}`) && PathPrefix(`/jellyfin`))
      - traefik.http.routers.jellyfin.tls=true
      - traefik.http.routers.jellyfin.tls.certresolver=myresolver
      - traefik.http.services.jellyfin.loadbalancer.server.port=8096
      - homepage.group=Media
      - homepage.name=Jellyfin
      - homepage.icon=jellyfin.png
      - homepage.href=/jellyfin
      - homepage.description=Media server
      - homepage.weight=4
      - homepage.widget.type=jellyfin
      - homepage.widget.url=http://jellyfin:8096/jellyfin
      - homepage.widget.key=${JELLYFIN_API_KEY}
  calibre-web:
    image: lscr.io/linuxserver/calibre-web:latest
    container_name: calibre-web
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
      - DOCKER_MODS=linuxserver/mods:universal-calibre
      - OAUTHLIB_RELAX_TOKEN_SCOPE=1
    volumes:
      - ${CONFIG_ROOT:-.}/calibre-web:/config
      - ${DATA_ROOT}/books:/books
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.http.middlewares.calibre-headers.headers.customRequestHeaders.X-Scheme=https
      - traefik.http.middlewares.calibre-headers.headers.customRequestHeaders.X-Script-Name=/calibre
      - traefik.http.middlewares.calibre-stripprefixregex.stripPrefixRegex.regex=/calibre
      - traefik.http.routers.calibre.middlewares=calibre-headers,calibre-stripprefixregex
      - traefik.http.routers.calibre.rule=(Host(`${HOSTNAME}`) && PathPrefix(`/calibre`))
      - traefik.http.routers.calibre.tls=true
      - traefik.http.routers.calibre.tls.certresolver=myresolver
      - traefik.http.services.calibre.loadbalancer.server.port=8083
      - homepage.group=Media
      - homepage.name=Calibre-Web
      - homepage.icon=calibre-web.png
      - homepage.href=/calibre
      - homepage.description=Books management
      - homepage.weight=5
      - homepage.widget.type=calibreweb
      - homepage.widget.url=http://calibre-web:8083
      - homepage.widget.username=${CALIBRE_USERNAME}
      - homepage.widget.password=${CALIBRE_PASSWORD}
    profiles:
      - calibre-web
  decluttarr:
    image: ghcr.io/manimatter/decluttarr:latest
    container_name: decluttarr
    restart: always
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
      - RADARR_URL=http://radarr:7878/radarr
      - RADARR_KEY=${RADARR_API_KEY}
      - SONARR_URL=http://sonarr:8989/sonarr
      - SONARR_KEY=${SONARR_API_KEY}
      - QBITTORRENT_URL=http://vpn:8080
      - QBITTORRENT_USERNAME=${QBITTORRENT_USERNAME}
      - QBITTORRENT_PASSWORD=${QBITTORRENT_PASSWORD}
      - LOG_LEVEL=INFO
      - TEST_RUN=${DECLUTTARR_TEST_RUN}
      - REMOVE_TIMER=${DECLUTTARR_REMOVE_TIMER}
      - REMOVE_FAILED=${DECLUTTARR_REMOVE_FAILED}
      - REMOVE_FAILED_IMPORTS=${DECLUTTARR_REMOVE_FAILED_IMPORTS}
      - REMOVE_METADATA_MISSING=${DECLUTTARR_REMOVE_METADATA_MISSING}
      - REMOVE_MISSING_FILES=${DECLUTTARR_REMOVE_MISSING_FILES}
      - REMOVE_ORPHANS=${DECLUTTARR_REMOVE_ORPHANS}
      - REMOVE_SLOW=${DECLUTTARR_REMOVE_SLOW}
      - REMOVE_STALLED=${DECLUTTARR_REMOVE_STALLED}
      - REMOVE_UNMONITORED=${DECLUTTARR_REMOVE_UNMONITORED}
      - RUN_PERIODIC_RESCANS=${DECLUTTARR_RUN_PERIODIC_RESCANS}
      - PERMITTED_ATTEMPTS=${DECLUTTARR_PERMITTED_ATTEMPTS}
      - NO_STALLED_REMOVAL_QBIT_TAG=${DECLUTTARR_REMOVAL_QBIT_TAG}
      - MIN_DOWNLOAD_SPEED=${DECLUTTARR_MIN_DOWNLOAD_SPEED}
      - FAILED_IMPORT_MESSAGE_PATTERNS=${DECLUTTARR_FAILED_IMPORT_MESSAGE_PATTERNS}
      - IGNORED_DOWNLOAD_CLIENTS=${DECLUTTARR_IGNORED_DOWNLOAD_CLIENTS}
    profiles:
      - decluttarr
  homepage:
    image: ghcr.io/gethomepage/homepage:latest
    container_name: homepage
    environment:
      - HOMEPAGE_VAR_TITLE=${HOMEPAGE_VAR_TITLE}
      - HOMEPAGE_VAR_SEARCH_PROVIDER=${HOMEPAGE_VAR_SEARCH_PROVIDER}
      - HOMEPAGE_VAR_HEADER_STYLE=${HOMEPAGE_VAR_HEADER_STYLE}
      - HOMEPAGE_VAR_WEATHER_CITY=${HOMEPAGE_VAR_WEATHER_CITY}
      - HOMEPAGE_VAR_WEATHER_LAT=${HOMEPAGE_VAR_WEATHER_LAT}
      - HOMEPAGE_VAR_WEATHER_LONG=${HOMEPAGE_VAR_WEATHER_LONG}
      - HOMEPAGE_VAR_WEATHER_TIME=${TIMEZONE}
      - HOMEPAGE_VAR_WEATHER_UNIT=${HOMEPAGE_VAR_WEATHER_UNIT}
    volumes:
      - ${CONFIG_ROOT:-.}/homepage:/app/config
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${DATA_ROOT}:/data
    restart: always
    command: [sh, -c, "cp -n /app/config/tpl/*.yaml /app/config && node server.js"]
    labels:
      - traefik.enable=true
      - traefik.http.routers.homepage.rule=(Host(`${HOSTNAME}`) && PathPrefix(`/`))
      - traefik.http.routers.homepage.tls=true
      - traefik.http.routers.homepage.tls.certresolver=myresolver
      - traefik.http.services.homepage.loadbalancer.server.port=3000
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: always
    environment:
      - WATCHTOWER_CLEANUP=true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
  autoheal:
    image: willfarrell/autoheal:latest
    container_name: autoheal
    restart: always
    environment:
      - AUTOHEAL_CONTAINER_LABEL=all
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  gitea:
    image:  docker.gitea.com/gitea:latest
    container_name: gitea
    hostname: gitea
    environment:
      - USER_UID=${USER_ID}
      - USER_GID=${GROUP_ID}
      - TZ=${TIMEZONE}
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=gitea_database:5432
      - GITEA__database__NAME=gitea
      - GITEA__database__USER=gitea
      - GITEA__database__PASSWD=${GITEA_MYSQL_PASSWORD}
      - GITEA__server__ROOT_URL=https://${GITEA_HOSTNAME}/
      - GITEA__server__DOMAIN=${GITEA_HOSTNAME}
      - GITEA__server__HTTP_PORT=3005
      - GITEA__server__SSH_PORT=22
      - GITEA__database__LOG_SQL=false
    volumes:
      - ${DATA_ROOT}/gitea:/data
    ports:
      - "3005:3005"
      - "222:22"
    restart: unless-stopped
    depends_on:
      gitea_database:
        condition: service_healthy
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - traefik.enable=true
      - traefik.http.routers.gitea.rule=Host(`${GITEA_HOSTNAME}`)
      - traefik.http.routers.gitea.tls=true
      - traefik.http.routers.gitea.tls.certresolver=myresolver
      - traefik.http.services.gitea.loadbalancer.server.port=3005
      
  gitea_database:
    image: docker.io/library/postgres:14
    container_name: gitea_database
    restart: always
    environment:
      - POSTGRES_USER=gitea
      - POSTGRES_PASSWORD=${GITEA_MYSQL_PASSWORD}
      - POSTGRES_DB=gitea
    volumes:
      - ${CONFIG_ROOT:-.}/gitea/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "gitea"]
      interval: 10s
      timeout: 5s
      retries: 5

  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    restart: always
    ports:
      - "9000:9000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${DATA_ROOT}/portainer:/data
    labels:
      - traefik.enable=true
      - traefik.http.routers.portainer.rule=(Host(`${PORTAINER_HOSTNAME}`))
      - traefik.http.routers.portainer.tls=true
      - traefik.http.routers.portainer.tls.certresolver=myresolver
      - traefik.http.services.portainer.loadbalancer.server.port=9000

networks:
  default:
    name: docker-compose-nas