version: "3.9"

networks:
  proxy:
    external: true

services:
  baikal:
    image: ckulka/baikal:nginx
    container_name: baikal
    volumes:
      - $CONFDIR/baikal:/var/www/baikal/Specific
    restart: unless-stopped
    depends_on:
      - traefik
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:dav.$DOMAIN"
      traefik.port: "80"
  cgit:
    image: chruth/alpine-cgit
    container_name: cgit
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
    volumes:
      - $SYNCDIR/src:/git
      - $CONFDIR/cgit/cgitrc:/config/cgitrc
      - $CONFDIR/cgit/cgit.css:/app/cgit.css
    restart: unless-stopped
    depends_on:
      - traefik
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:git.$DOMAIN"
      traefik.port: "80"
  changedetection:
    image: dgtlmoon/changedetection.io
    container_name: changedetection
    volumes:
      - $CONFDIR/changedetection:/datastore
    depends_on:
      - traefik
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:diff.$DOMAIN"
      traefik.port: "5000"
  echoip:
    image: mpolden/echoip
    container_name: echoip
    entrypoint: "/opt/echoip/echoip -H X-Real-IP"
    restart: unless-stopped
    depends_on:
      - traefik
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:ip.$DOMAIN"
      traefik.port: "8080"
  h5ai:
    image: awesometic/h5ai
    container_name: h5ai
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
    volumes:
      - $SYNCDIR/pub:/h5ai
    restart: unless-stopped
    depends_on:
      - traefik
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:pub.$DOMAIN"
      traefik.port: "80"
  hugo:
    image: klakegg/hugo
    container_name: hugo
    command: "server --watch=true --minify --source=/src --baseURL=https://$DOMAIN --bind=0.0.0.0 --appendPort=false --buildFuture"
    volumes:
      - $SYNCDIR/src/blog.$DOMAIN:/src
    restart: unless-stopped
    depends_on:
      - traefik
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:$DOMAIN,blog.$DOMAIN,www.$DOMAIN"
      traefik.port: "1313"
  jackett:
    image: linuxserver/jackett
    container_name: jackett
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
    volumes:
      - $CONFDIR/jackett:/config
      - $SYNCDIR:/downloads
    restart: unless-stopped
    depends_on:
      - traefik
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:jack.$DOMAIN"
      traefik.port: "9117"
      traefik.frontend.auth.basic.usersFile: "/app/htpasswd"
  php-dev:
    image: php:apache
    container_name: php-dev
    restart: unless-stopped
    command: bash -c "sed -i 's|33|$PUID|g' /etc/passwd && a2enmod rewrite && apache2-foreground"
    volumes:
      - $SYNCDIR/src/php-dev:/var/www/html
    restart: unless-stopped
    depends_on:
      - traefik
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:dev.$DOMAIN"
      traefik.port: "80"
  postgres:
    image: postgres:alpine
    container_name: postgres
    restart: unless-stopped
    ports:
      - 44432:5432
    environment:
      - POSTGRES_PASSWORD=$DBPASSWORD
    volumes:
      - $CONFDIR/postgres:/var/lib/postgresql/data
  rclone:
    image: rclone/rclone
    container_name: rclone
    user: "$PUID:$PGID"
    read_only: true
    command: "serve http '$RCLONE_REMOTE_MEDIA' --addr '0.0.0.0:8080' -vv"
    volumes:
      - $CONFDIR/rclone:/config/rclone/
    restart: unless-stopped
    depends_on:
      - traefik
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:repo.$DOMAIN"
      traefik.port: "8080"
      traefik.frontend.auth.basic.usersFile: "/app/htpasswd"
  syncthing:
    image: linuxserver/syncthing
    container_name: syncthing
    environment:
      - PGID=$PGID
      - PUID=$PUID
    volumes:
      - $CONFDIR/syncthing:/config
      - $SYNCDIR:/vault
    ports:
      - 22000:22000
      - 21027:21027/udp
    restart: unless-stopped
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:sync.$DOMAIN"
      traefik.port: "8384"
  traefik:
    image: traefik:1.7
    container_name: traefik
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - $CONFDIR/traefik/traefik.toml:/etc/traefik/traefik.toml
      - $CONFDIR/traefik/acme.json:/etc/traefik/acme.json
      - $CONFDIR/traefik:/app/
    ports:
      - 80:80
      - 443:443
    restart: unless-stopped
    networks:
      - proxy
  ttrss:
    image: wangqiru/ttrss
    container_name: ttrss
    restart: unless-stopped
    environment:
      - SELF_URL_PATH=https://rss.$DOMAIN/
      - DB_HOST=$DOMAIN
      - DB_PASS=$DBPASSWORD
      - DB_PORT=44432
      - DB_TYPE=pgsql
      - DB_USER=postgres
    depends_on:
      - postgres
      - traefik
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:rss.$DOMAIN"
      traefik.port: "80"
  vaultwarden:
    image: vaultwarden/server
    container_name: vaultwarden
    volumes:
      - $CONFDIR/vaultwarden:/data
    environment:
      - WEBSOCKET_ENABLED=false
      - SIGNUPS_ALLOWED=false
    ports:
      - 3012:3012
    restart: unless-stopped
    depends_on:
      - traefik
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:pass.$DOMAIN"
      traefik.port: "80"
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
  wireguard:
    image: place1/wg-access-server
    container_name: wireguard
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    environment:
      WG_ADMIN_PASSWORD: $WG_WEBUI_PASS
      WG_WIREGUARD_PRIVATE_KEY: $WG_PRIVKEY
    volumes:
      - $CONFDIR/wireguard:/data
    ports:
      - 51820:51820/udp
    devices:
      - "/dev/net/tun:/dev/net/tun"
    networks:
      - proxy
    labels:
      traefik.frontend.rule: "Host:vpn.$DOMAIN"
      traefik.port: "8000"