docker-compose.yml

---
x-env: &env
  PUID: ${PUID}
  PGID: ${PGID}
  TZ: ${TZ}
  # UMASK: 022

services:
  adguardhome:
    image: adguard/adguardhome
    container_name: adguardhome
    ports:
      - 53:53/tcp # plain DNS
      - 53:53/udp # plain DNS
    expose:
      - 3000
    networks:
      macvlan:
        ipv4_address: 192.168.10.15
      frontend:
        ipv4_address:  172.20.0.98
      backend: # for access from sync
    environment:
      <<: *env
    volumes:
      - ./adguardhome/work:/opt/adguardhome/work
      - ./adguardhome/conf:/opt/adguardhome/conf
      - /etc/localtime:/etc/localtime:ro
    restart: unless-stopped

  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    container_name: homeassistant
    depends_on:
      - mqtt
      - zigbee2mqtt
    expose:
      - 8123 # UI
    networks:
      frontend:
        ipv4_address: 172.20.0.201 # static ip for NUT. Allowlisted on Synology NAS, access to mqtt
      macvlan:
        ipv4_address: 192.168.10.16 # enable homekit & WOL functionality
    environment:
      <<: *env
    volumes:
      - ./homeassistant:/config
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock
    restart: always

  mqtt:
    container_name: mqtt
    networks:
      - frontend
    environment:
      <<: *env
    image: eclipse-mosquitto
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./mqtt/data:/mosquitto
    command: mosquitto -c /mosquitto-no-auth.conf

  zigbee2mqtt:
    image: koenkk/zigbee2mqtt
    user: ${PUID}:${PGID}
    container_name: zigbee2mqtt
    privileged: true
    networks:
      iot_macvlan:
        ipv4_address: 192.168.30.101
      frontend: # expose ui, connect to mqtt
    expose:
      - 8080 # frontend port
    environment:
      <<: *env
      Z2M_WATCHDOG: default # been needing to restart container
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./zigbee2mqtt/data:/app/data

  plex:
    image: ghcr.io/linuxserver/plex
    container_name: plex
    restart: unless-stopped
    ports:
      # Source: https://support.plex.tv/articles/201543147-what-network-ports-do-i-need-to-allow-through-my-firewall/
      #- 1900:1900/udp   # access to the Plex DLNA Server # NOTE: already in use
      - 32400:32400/tcp # access to the Plex Media Server
      - 32410:32410/udp # current GDM network discovery
      - 32412:32412/udp # current GDM network discovery
      - 32413:32413/udp # current GDM network discovery
      - 32414:32414/udp # current GDM network discovery
      - 32469:32469/tcp # access to the Plex DLNA Server
    networks:
      - frontend
      - backend
    environment:
      VERSION: docker
      PLEX_CLAIM: ${PLEX_CLAIM}
      <<: *env
    volumes:
      - ./plex/database:/config
      - ./plex/transcode:/transcode
      - ${DOCKER_MEDIA_DIR}:/data
    devices:
      - /dev/dri:/dev/dri # Synology w/ Intel CPU for hardware encoding

  # NOTE: this is a once-off task and runs using cron in synology "Tasks" section
  plextraktsync:
    image: ghcr.io/taxel/plextraktsync
    command: sync
    container_name: plextraktsync
    networks:
      - backend
    volumes:
      - ./plextraktsync:/app/config
    depends_on:
      - plex
    environment:
      <<: *env

  # NOTE: this is a once-off task and runs using cron in synology "Tasks" section
  kometa:
    image: kometateam/kometa
    container_name: kometa
    command: --run
    networks:
      - backend
    restart: "no"
    environment:
      PMM_NO_MISSING: 'true'
    volumes:
      - ./plex-meta-manager:/config
    depends_on:
      - plex

  radarr:
    image: ghcr.io/linuxserver/radarr
    container_name: radarr
    expose:
      - 7878
    restart: unless-stopped
    networks:
      - frontend
      - backend
    environment:
      <<: *env
    volumes:
      - ./radarr:/config
      - ${DOCKER_DATA_DIR}:/data

  sonarr:
    image: ghcr.io/linuxserver/sonarr
    networks:
      - frontend
      - backend
    container_name: sonarr
    expose:
      - 8989
    environment:
      <<: *env
    restart: unless-stopped
    volumes:
      - ./sonarr:/config
      - ${DOCKER_DATA_DIR}:/data

  readarr:
    image: lscr.io/linuxserver/readarr:develop
    networks:
      - frontend
      - backend
    container_name: readarr
    expose:
      - 8787  # web UI
    environment:
      <<: *env
    restart: unless-stopped
    volumes:
      - ./readarr:/config
      - ${DOCKER_DATA_DIR}:/data

  tautulli:
    image: ghcr.io/linuxserver/tautulli
    networks:
      - frontend
    container_name: tautulli
    restart: unless-stopped
    volumes:
      - ./tautulli:/config
    environment:
      <<: *env
    expose:
      - 8181 # UI

  bazarr: # subtitles
    image: lscr.io/linuxserver/bazarr
    networks:
      - frontend
    container_name: bazarr
    environment:
      <<: *env
      # UMASK: # reset this, for some reason it prevents start
    expose:
      - 6767
    restart: unless-stopped
    volumes:
      - ./bazarr:/config
      - ${DOCKER_MEDIA_DIR}:/data/media

  gluetun:
    image: qmcgaw/gluetun
    networks:
      - frontend
    container_name: gluetun
    restart: always
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - ./gluetun:/gluetun
    environment:
      <<: *env
      VPN_SERVICE_PROVIDER: mullvad
      VPN_TYPE: wireguard
      WIREGUARD_PRIVATE_KEY: ${GLUETUN_WIREGUARD_PRIVATE_KEY}
      WIREGUARD_ADDRESSES: ${GLUETUN_WIREGUARD_ADDRESSES}
      SERVER_CITIES: ${GLUETUN_CITIES}
      DOT: 'off' # turn off local unbound in favor of adguardhome
      # DNS_ADDRESS: 172.20.0.200 # TODO: try disable this and DNS_KEEP_NAMESERVER on, see https://github.com/qdm12/gluetun-wiki/blob/3c3cfccf06045767d50d58efae22fbafe95b2ab2/setup/options/dns.md?plain=1#L9
      DNS_KEEP_NAMESERVER: on
    expose:
      - 9091 # transmission UI
      - 9696 # Prowlarr
      - 8000 # http control server, used by homepage
    labels:
      - com.centurylinklabs.watchtower.enable=false
    security_opt:
      - no-new-privileges:true

  transmission:
    image: ghcr.io/linuxserver/transmission
    container_name: transmission
    restart: unless-stopped
    network_mode: "service:gluetun"
    environment:
      USER: ${TRANSMISSION_USERNAME}
      PASS: ${TRANSMISSION_PASSWORD}
      <<: *env
    volumes:
      - ./transmission:/config
      - ${DOCKER_TORRENTS_DIR}:/data/downloads/torrents
      - ${DOCKER_TORRENTS_DIR}/watch:/watch

  caddy:
    build:
      context: .
      dockerfile: caddy.Dockerfile
      network: host
    container_name: caddy
    ports:
      - 443:443
      - 80:80
    expose:
      - 2019 # admin port
      - 443 # all the https
    networks:
      - frontend
    restart: unless-stopped
    environment:
      <<: *env
      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
      CLOUDFLARE_ZONE_TOKEN: ${CLOUDFLARE_ZONE_TOKEN}
      CROWDSEC_API_KEY: ${CROWDSEC_API_KEY}
      NAS_IP: ${STATIC_IP}
      SLZB06M_IP: ${SLZB06M_IP}
      TLS_EMAIL: ${CADDY_TLS_EMAIL}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy/config:/config
      - ./caddy/data:/data
    healthcheck:
      test: ["CMD", "caddy", "version"]

  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/localtime:/etc/localtime:ro
    expose:
      - 8080 # https://containrrr.dev/watchtower/metrics/
    environment:
      WATCHTOWER_NOTIFICATIONS: shoutrrr
      WATCHTOWER_NOTIFICATION_URL: ${DISCORD_NOTIFICATION_URL}
      WATCHTOWER_REMOVE_VOLUMES: true
      WATCHTOWER_CLEANUP: true
      WATCHTOWER_INCLUDE_STOPPED: true
      WATCHTOWER_REVIVE_STOPPED: true
      WATCHTOWER_SCHEDULE: 0 0 2 * * *
      WATCHTOWER_HTTP_API_METRICS: true
      WATCHTOWER_HTTP_API_TOKEN: ${WATCHTOWER_API_TOKEN}
      WATCHTOWER_MONITOR_ONLY: true # so many broken upgrades!

  huginn-postgres:
    image: postgres:14.6-alpine
    container_name: huginn-postgres
    restart: unless-stopped
    volumes:
      - ./huginn-postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    networks:
      - backend

  huginn:
    image: ghcr.io/huginn/huginn
    container_name: huginn
    restart: unless-stopped
    expose:
      - 3000
    networks:
      - frontend
      - backend
    environment:
      TIMEZONE: ${HUGINN_TIMEZONE}
      EMAIL_FROM_ADDRESS: ${HUGINN_EMAIL_FROM_ADDRESS}
      SMTP_DOMAIN: ${HUGINN_SMTP_DOMAIN}
      SMTP_PASSWORD: ${HUGINN_SMTP_PASSWORD}
      INVITATION_CODE: ${HUGINN_INVITATION_CODE}
      SMTP_USER_NAME: ${SMTP_USER_NAME}
      SMTP_SERVER: ${SMTP_SERVER}
      SMTP_PORT: 465
      SMTP_SSL: 'true'
      SMTP_AUTHENTICATION: plain
      ENABLE_INSECURE_AGENTS: 'true' # trust all users
      DATABASE_ADAPTER: postgresql
      DATABASE_USERNAME: postgres
      DATABASE_PASSWORD: ${POSTGRES_PASSWORD}
      DATABASE_HOST: huginn-postgres
    depends_on:
      - huginn-postgres

  prowlarr:
    image: ghcr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    network_mode: "service:gluetun"
    restart: unless-stopped
    environment:
      <<: *env
    volumes:
      - ./prowlarr:/config

  recyclarr:
    image: ghcr.io/recyclarr/recyclarr
    container_name: recyclarr
    restart: unless-stopped
    user: ${PUID}:${PGID}
    networks:
      - backend
    volumes:
      - ./recyclarr:/config
    environment:
      <<: *env
      RECYCLARR_CREATE_CONFIG: "true"
      CRON_SCHEDULE: "@daily"
      RADARR_API_KEY: ${RADARR_API_KEY}
      RADARR_BASE_URL: http://radarr:7878
      SONARR_API_KEY: ${SONARR_API_KEY}
      SONARR_BASE_URL: http://sonarr:8989



  # NOTE: this is a once-off task and runs using cron in synology "Tasks" section
  adguardhome-sync:
    image: ghcr.io/bakito/adguardhome-sync
    container_name: adguardhome-sync
    command: run
    environment:
      LOG_LEVEL: "info"
      ORIGIN_URL: "http://192.168.1.1:3000"
      ORIGIN_USERNAME: ${ADGUARD_HOME_ORIGIN_USERNAME}
      ORIGIN_PASSWORD: ${ADGUARD_HOME_ORIGIN_PASSWORD}
      REPLICA_URL: "http://adguardhome:3000"
      REPLICA_USERNAME: ${ADGUARD_HOME_REPLICA_USERNAME}
      REPLICA_PASSWORD: ${ADGUARD_HOME_REPLICA_PASSWORD}
      CRON: "" # run only once (triggers via Synology tasks)
      RUN_ON_START: true
      API_PORT: 0 # Disable sync API server
      FEATURES_DNS_SERVER_CONFIG: false # replica needs to point to Unbound on router IP, not localhost
    networks:
      - backend

  acestream-http-proxy:
    image: ghcr.io/martinbjeldbak/acestream-http-proxy
    container_name: acestream-http-proxy
    ports:
      - '6878:6878'
    networks:
      - frontend

  esphome:
    container_name: esphome
    image: ghcr.io/esphome/esphome
    volumes:
      - ./esphome/config:/config
      - /etc/localtime:/etc/localtime:ro
    restart: always
    privileged: true
    expose:
      - 6052 # UI
    environment:
      ESPHOME_DASHBOARD_USE_PING: true
    networks:
      - frontend

  epicgames-freegames:
    image: ghcr.io/claabs/epicgames-freegames-node
    container_name: epicgames-freegames
    restart: unless-stopped
    expose:
      - 3000
    volumes:
      # Setting the web portal URL is not supported using env variables,
      # mount volume and manually set in config
      - ./epicgames-freegames/config:/usr/app/config
    environment:
      <<: *env
      EMAIL: ${SMTP_USER_NAME}
      SMTP_HOST: ${SMTP_SERVER}
      SMTP_PORT: 465
      EMAIL_SENDER_ADDRESS: epicgames@martinbjeldbak.com
      EMAIL_SENDER_NAME: Epic Games Captcha
      EMAIL_RECIPIENT_ADDRESS: ${SMTP_USER_NAME}
      SMTP_SECURE: true
      SMTP_USERNAME: ${SMTP_USER_NAME}
      SMTP_PASSWORD: ${HUGINN_SMTP_PASSWORD}
      RUN_ON_STARTUP: true
      CRON_SCHEDULE: 0 0,6,12,18 * * * # (every six hours)
    networks:
      - frontend

  #invidious:
  #  container_name: invidious
  #  image: quay.io/invidious/invidious:latest
  #  restart: unless-stopped
  #  expose:
  #    - 3000
  #  environment:
  #    INVIDIOUS_CONFIG: |
  #      database_url: postgres://postgres:kba.tft.DRE8tnt4cvy@db:5432/postgres
  #      check_tables: true
  #      hmac_key: CK2jJrAvaeeQABNXdCD7
  #      admins: ["martinbjeldbak"]
  #      domain: invidious.local.martinbjeldbak.com
  #      external_port: 443
  #      use_innertube_for_captions: true
  #      default_user_preferences:
  #        region: AU
  #        captions: ["English", "Danish", "Burmese"]
  #        save_player_pos: true
  #  healthcheck:
  #    test: wget -nv --tries=1 --spider http://127.0.0.1:3000/api/v1/comments/jNQXAC9IVRw || exit 1
  #    interval: 30s
  #    timeout: 5s
  #    retries: 2
  #  logging:
  #    options:
  #      max-size: "1G"
  #      max-file: "4"
  #  depends_on:
  #    - db
  #  networks:
  #    - frontend
  #    - backend

  # scrypted:
  #   container_name: scrypted
  #   restart: unless-stopped
  #   image: ghcr.io/koush/scrypted
  #   environment:
  #     SCRYPTED_NVR_VOLUME: /nvr
  #     SCRYPTED_WEBHOOK_UPDATE_AUTHORIZATION: Bearer ${SCRYPTED_BEARER_TOKEN}
  #     SCRYPTED_WEBHOOK_UPDATE: http://localhost:10444/v1/update
  #   volumes:
  #     - ./scrypted/nvr:/nvr
  #     - ./scrypted/volume:/server/volume
  #   logging:
  #       driver: "json-file"
  #       options:
  #           max-size: "10m"
  #           max-file: "10"
  #   labels:
  #       - "com.centurylinklabs.watchtower.scope=scrypted"
  #   networks:
  #     macvlan:
  #       ipv4_address: 192.168.10.17
  #     frontend:
  #   expose:
  #     - 10443 # scrypted https
  #     - 11080 # scrypted http (used by Caddy)
  #     - 31797 # homekit port Pan/Tilt

  overseerr:
    container_name: overseerr
    image: sctx/overseerr
    restart: unless-stopped
    environment:
      <<: *env
    networks:
      - frontend
    expose:
      - 5055
    volumes:
      - ./overseerr/config:/app/config

  plex-auto-languages:
    image: remirigal/plex-auto-languages
    container_name: plex-auto-languages
    environment:
      <<: *env
      PLEX_TOKEN: ${PLEX_TOKEN}
      PLEX_URL: http://plex:32400
    networks:
      - backend
    volumes:
      - ./plex-auto-languages/config:/config

  homepage:
    image: ghcr.io/gethomepage/homepage
    container_name: homepage
    expose:
      - 3000
    networks:
      - frontend
      - backend
    volumes:
      - ./homepage/config:/app/config
    environment:
      <<: *env
      HOMEPAGE_VAR_SONARR_API_KEY: ${SONARR_API_KEY}
      HOMEPAGE_VAR_PLEX_TOKEN: ${PLEX_TOKEN}
      HOMEPAGE_VAR_TAUTULLI_API_KEY: ${TAUTULLI_API_KEY}
      HOMEPAGE_VAR_HOMEASSISTANT_ACCESS_TOKEN: ${HOMEASSISTANT_ACCESS_TOKEN}
      HOMEPAGE_VAR_OPENWEATHERMAP_API_KEY: ${OPENWEATHERMAP_API_KEY}
      HOMEPAGE_VAR_ADGUARD_HOME_ORIGIN_USERNAME: ${ADGUARD_HOME_ORIGIN_USERNAME}
      HOMEPAGE_VAR_ADGUARD_HOME_ORIGIN_PASSWORD: ${ADGUARD_HOME_ORIGIN_PASSWORD}
      HOMEPAGE_VAR_ADGUARD_HOME_REPLICA_USERNAME: ${ADGUARD_HOME_REPLICA_USERNAME}
      HOMEPAGE_VAR_ADGUARD_HOME_REPLICA_PASSWORD: ${ADGUARD_HOME_REPLICA_PASSWORD}
      HOMEPAGE_VAR_BAZARR_API_KEY: ${BAZARR_API_KEY}
      HOMEPAGE_VAR_CROWDSEC_USERNAME: ${CROWDSEC_USERNAME}
      HOMEPAGE_VAR_CROWDSEC_PASSWORD: ${CROWDSEC_PASSWORD}
      HOMEPAGE_VAR_SYNOLOGY_STATS_USERNAME: ${SYNOLOGY_STATS_USERNAME}
      HOMEPAGE_VAR_SYNOLOGY_STATS_PASSWORD: ${SYNOLOGY_STATS_PASSWORD}
      HOMEPAGE_VAR_OPNSENSE_HOMEPAGE_USERNAME: ${OPNSENSE_HOMEPAGE_USERNAME}
      HOMEPAGE_VAR_OPNSENSE_HOMEPAGE_PASSWORD: ${OPNSENSE_HOMEPAGE_PASSWORD}
      HOMEPAGE_VAR_OVERSEERR_API_KEY: ${OVERSEERR_API_KEY}
      HOMEPAGE_VAR_PROWLARR_API_KEY: ${PROWLARR_API_KEY}
      HOMEPAGE_VAR_RADARR_API_KEY: ${RADARR_API_KEY}
      HOMEPAGE_VAR_TAILSCALE_DEVICE_ID: ${TAILSCALE_DEVICE_ID}
      HOMEPAGE_VAR_TAILSCALE_API_KEY: ${TAILSCALE_API_KEY}
      HOMEPAGE_VAR_TRANSMISSION_USERNAME: ${TRANSMISSION_USERNAME}
      HOMEPAGE_VAR_TRANSMISSION_PASSWORD: ${TRANSMISSION_PASSWORD}
      HOMEPAGE_VAR_UNIFI_USERNAME: ${UNIFI_USERNAME}
      HOMEPAGE_VAR_UNIFI_PASSWORD: ${UNIFI_PASSWORD}
      HOMEPAGE_VAR_UPTIME_ROBOT_HOME_INTERNET_API_KEY: ${UPTIME_ROBOT_HOME_INTERNET_API_KEY}
      HOMEPAGE_VAR_WATCHTOWER_API_TOKEN: ${WATCHTOWER_API_TOKEN}
      HOMEPAGE_VAR_PAPERLESS_KEY: ${PAPERLESS_KEY}
      HOMEPAGE_VAR_ROMM_USERNAME: ${ROMM_USERNAME}
      HOMEPAGE_VAR_ROMM_PASSWORD: ${ROMM_PASSWORD}
      HOMEPAGE_VAR_CALIBRE_WEB_USERNAME: ${CALIBRE_WEB_USERNAME}
      HOMEPAGE_VAR_CALIBRE_WEB_PASSWORD: ${CALIBRE_WEB_PASSWORD}
    restart: unless-stopped

  dockerproxy:
    image: ghcr.io/tecnativa/docker-socket-proxy
    container_name: dockerproxy
    environment:
      - CONTAINERS=1 # Allow access to viewing containers
      - SERVICES=1 # Allow access to viewing services (necessary when using Docker Swarm)
      - TASKS=1 # Allow access to viewing tasks (necessary when using Docker Swarm)
      - POST=0 # Disallow any POST operations (effectively read-only)
    networks:
      - backend
    expose:
      - 2375
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro # Mounted as read-only
    restart: unless-stopped

  speedtest-tracker:
    container_name: speedtest-tracker
    image: lscr.io/linuxserver/speedtest-tracker
    environment:
      <<: *env
      APP_KEY: ${SPEEDTEST_TRACKER_APP_KEY}
      APP_URL: https://speedtest.local.martinbjeldbak.com
      APP_TIMEZONE: ${TZ}
      DISPLAY_TIMEZONE: ${TZ}
      SPEEDTEST_SCHEDULE: "0 * * * *" # every hour
      SPEEDTEST_SERVERS: "25134,14670,12491,13275,60412,18714"
      DB_CONNECTION: sqlite
      MAIL_MAILER: smtp
      MAIL_HOST: ${SMTP_SERVER}
      MAIL_PORT: 465
      MAIL_USERNAME: ${SMTP_USER_NAME}
      MAIL_PASSWORD: ${HUGINN_SMTP_PASSWORD}
      MAIL_ENCRYPTION: 'ssl'
      MAIL_FROM_ADDRESS: "speedtest-tracker@martinbjeldbak.com"
      MAIL_FROM_NAME: "Speedtest Tracker"
    expose:
      - 80 # http
      - 443 # https
    restart: unless-stopped
    networks:
      - frontend     
    volumes:
      - ./speedtest-tracker/config:/config

  peanut-eaton-5e-1100i:
    image: brandawg93/peanut
    container_name: peanut-eaton-5e-1100i
    restart: unless-stopped
    expose:
      - 8080 # web UI
    networks:
      frontend:
        ipv4_address: 172.20.0.202 # static ip for NUT. Allowlisted on Synology NAS
    environment:
      NUT_HOST: 172.20.0.1
      NUT_PORT: 3493
      WEB_PORT: 8080

  scrutiny-influxdb:
    image: influxdb:2.2
    container_name: scrutiny-influxdb
    restart: unless-stopped
    expose:
      - 8086
    volumes:
      - ./scrutiny/influxdb:/var/lib/influxdb2
    networks:
      - backend
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8086/health"]
      interval: 5s
      timeout: 10s
      retries: 20

  scrutiny-web:
    image: ghcr.io/analogj/scrutiny:master-web
    container_name: scrutiny-web
    expose:
      - 8080 # web ui
    volumes:
      - ./scrutiny/config:/opt/scrutiny/config
    networks:
      - frontend     
      - backend
    environment:
      SCRUTINY_WEB_INFLUXDB_HOST: 'scrutiny-influxdb'
    restart: unless-stopped
    depends_on:
      scrutiny-influxdb:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/health"]
      interval: 5s
      timeout: 10s
      retries: 20
      start_period: 10s

  scrutiny-collector:
    image: ghcr.io/analogj/scrutiny:master-collector
    container_name: scrutiny-collector
    restart: unless-stopped
    cap_add:
      - SYS_RAWIO
      - SYS_ADMIN
    volumes:
      - '/run/udev:/run/udev:ro'
      - ./scrutiny/config:/opt/scrutiny/config
    networks:
      - backend
    environment:
      COLLECTOR_API_ENDPOINT: 'http://scrutiny-web:8080'
      COLLECTOR_HOST_ID: 'synology-ds-920'
    depends_on:
      scrutiny-web:
        condition: service_healthy
    devices:
      - "/dev/nvme0n1"
      - "/dev/sata1"
      - "/dev/sata2"
      - "/dev/sata3"
      - "/dev/sata4"

  paperless:
    container_name: paperless
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    restart: unless-stopped
    networks:
      - frontend
      - backend
    expose:
      - 8000 # UI
    security_opt:
      - no-new-privileges:true
    depends_on:
      - paperless-postgres
      - paperless-redis
      - tika
      - gotenberg
    volumes:
      - ./paperless/paperless:/usr/src/paperless/data # container data
      - ./paperless/paperless:/usr/src/paperless/media # documents
      - ./paperless/paperless:/usr/src/paperless/export # backups
      - ${PAPERLESS_INBOX_PATH}:/usr/src/paperless/consume # watch folder
    environment:
      USERMAP_UID: $PUID
      USERMAP_GID: $PGID
      PAPERLESS_URL: https://paperless.local.martinbjeldbak.com
      PAPERLESS_TIME_ZONE: $TZ
      PAPERLESS_OCR_LANGUAGES: dan
      PAPERLESS_OCR_LANGUAGE: dan+eng
      PAPERLESS_ENABLE_UPDATE_CHECK: "true"
      PAPERLESS_REDIS: redis://paperless-redis:6379
      PAPERLESS_DBHOST: paperless-postgres
      PAPERLESS_DBNAME: paperless
      PAPERLESS_DBUSER: paperless
      PAPERLESS_DBPASS: $PAPERLESS_POSTGRES_PASSWORD
      PAPERLESS_FILENAME_FORMAT: "{created_year}/{correspondent}/{created} {title}"
      PAPERLESS_TIKA_ENABLED: 1
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
      PAPERLESS_OCR_USER_ARGS: '{"invalidate_digital_signatures": true}'

  paperless-postgres:
    container_name: paperless-postgres
    image: postgres:16
    restart: unless-stopped
    networks:
      - backend
    volumes:
      - ./paperless/postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: paperless
      POSTGRES_PASSWORD: $PAPERLESS_POSTGRES_PASSWORD

  paperless-redis:
    image: redis:7-alpine
    container_name: paperless-redis
    restart: unless-stopped
    volumes:
      - ./paperless/redis:/data
    networks:
      - backend

  gotenberg:
    image: gotenberg/gotenberg:8.9
    container_name: gotenberg
    restart: unless-stopped
    networks:
      - backend
    expose:
      - 3000
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
    # https://github.com/gotenberg/gotenberg/issues/577#issuecomment-2249616949
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
      - "--libreoffice-auto-start=true"
      - "--libreoffice-start-timeout=301s"
      - "--api-timeout=900s"
      - "--log-level=debug"

  tika:
    image: ghcr.io/paperless-ngx/tika
    container_name: tika
    networks:
      - backend
    expose:
      - 9999
    restart: unless-stopped

  romm:
    image: rommapp/romm:latest
    container_name: romm
    restart: unless-stopped
    user: ${PUID}:${PGID}
    networks:
      - frontend 
      - backend
    environment:
      <<: *env
      DB_HOST: romm-db
      DB_NAME: romm
      DB_USER: romm-user
      DB_PASSWD: ${ROMM_DB_USER_PASSWORD}
      ROMM_AUTH_SECRET_KEY: ${ROMM_AUTH_SECRET_KEY}
      IGDB_CLIENT_ID: ${IGDB_CLIENT_ID}
      IGDB_CLIENT_SECRET: ${IGDB_CLIENT_SECRET}
      MOBYGAMES_API_KEY: ${MOBYGAMES_API_KEY}
      STEAMGRIDDB_API_KEY: ${STEAMGRIDDB_API_KEY}
      ROMM_AUTH_USERNAME: ${ROMM_USERNAME}
      ROMM_AUTH_PASSWORD: ${ROMM_PASSWORD}
    volumes:
     - ./romm/resources:/romm/resources # Resources fetched from IGDB (covers, screenshots, etc.)
     - ./romm/redis:/redis-data # Cached data for background tasks
     - ${DOCKER_DATA_DIR}/emulators:/romm/library
     - ./romm/assets:/romm/assets # Uploaded saves, states, etc.
     - ./romm/config:/romm/config # Path where config.yml is stored
    expose:
     - 8080
    depends_on:
     - romm-db

  romm-db:
    image: mariadb:latest
    container_name: romm-db
    restart: unless-stopped
    user: ${PUID}:${PGID}
    environment:
      MYSQL_ROOT_PASSWORD: ${ROMM_DB_ROOT_PASSWORD}
      MYSQL_DATABASE: romm
      MYSQL_USER: romm-user
      MYSQL_PASSWORD: ${ROMM_DB_USER_PASSWORD}
    volumes:
      - ./romm/database:/var/lib/mysql
    networks:
      - backend

  icloudpd-n:
    container_name: icloudpd-n
    image: icloudpd/icloudpd
    environment:
      TZ: ${TZ}
    networks:
      - frontend
    expose:
      - 8080 # web ui
    volumes:
      - ${N_PHOTO_VOLUME}/icloudpd:/data
      # NOTE: if reauth needed (every ~2 months), run sudo docker-compose run icloudpd-n icloudpd --username ${ICLOUD_N_USERNAME} --password ${ICLOUD_N_PASSWORD} --auth-only
      - ./icloudpd/n/cookies:/root/.pyicloud # so we don't need to keep reauthing
    command: >
       icloudpd
       --directory /data
       --username ${ICLOUD_N_USERNAME}
       --password ${ICLOUD_N_PASSWORD}
       --password-provider webui
       --mfa-provider webui
       --watch-with-interval 3600

  dawarich-redis:
    image: redis:7.0-alpine
    container_name: dawarich-redis
    command: redis-server
    networks:
      - backend
    volumes:
      - ./dawarich/shared:/var/shared/redis
    restart: always
  dawarich-postgres:
    image: postgres:16
    container_name: dawarich-postgres
    restart: always
    networks:
      - backend
    volumes:
      - ./dawarich/postgres:/var/lib/postgresql/data
      - ./dawarich/shared:/var/shared
    environment:
      POSTGRES_USER: dawarich
      POSTGRES_PASSWORD: $DAWARICH_POSTGRES_PASSWORD
  dawarich:
    image: freikin/dawarich
    container_name: dawarich
    volumes:
      - ./dawarich/gemcache:/usr/local/bundle/gems
      - ./dawarich/public:/var/app/public
    networks:
      - frontend
      - backend
    expose:
      - 3000
    stdin_open: true
    tty: true
    entrypoint: dev-entrypoint.sh
    command: ['bin/dev']
    restart: on-failure
    environment:
      RAILS_ENV: development
      REDIS_URL: redis://dawarich-redis:6379/0
      DATABASE_HOST: dawarich-postgres
      DATABASE_USERNAME: dawarich
      DATABASE_PASSWORD: $DAWARICH_POSTGRES_PASSWORD
      DATABASE_NAME: dawarich_development
      MIN_MINUTES_SPENT_IN_CITY: 60
      APPLICATION_HOST: localhost
      APPLICATION_HOSTS: localhost,dawarich.local.martinbjeldbak.com,dawarich.martinbjeldbak.com
      TIME_ZONE: $TZ
      APPLICATION_PROTOCOL: http
      REVERSE_GEOCODING_ENABLED: true
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "5"
    depends_on:
      - dawarich-postgres
      - dawarich-redis
  dawarich-sidekiq:
    image: freikin/dawarich
    container_name: dawarich-sidekiq
    volumes:
      - ./dawarich/gemcache:/usr/local/bundle/gems
      - ./dawarich/public:/var/app/public
    networks:
      - backend
    stdin_open: true
    tty: true
    entrypoint: dev-entrypoint.sh
    command: ['sidekiq']
    restart: on-failure
    environment:
      RAILS_ENV: development
      REDIS_URL: redis://dawarich-redis:6379/0
      DATABASE_HOST: dawarich-postgres
      DATABASE_USERNAME: dawarich
      DATABASE_PASSWORD: $DAWARICH_POSTGRES_PASSWORD
      DATABASE_NAME: dawarich_development
      APPLICATION_HOST: localhost
      APPLICATION_HOSTS: localhost
      BACKGROUND_PROCESSING_CONCURRENCY: 10
      APPLICATION_PROTOCOL: http
      REVERSE_GEOCODING_ENABLED: true
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "5"
    depends_on:
      - dawarich-postgres
      - dawarich-redis
      - dawarich
  dozzle:
    container_name: dozzle
    image: amir20/dozzle
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    expose:
      - 8080
    networks:
      - frontend

  unpackerr:
    image: golift/unpackerr
    container_name: unpackerr
    volumes:
      - ${DOCKER_DATA_DIR}:/data
    restart: unless-stopped
    user: ${PUID}:${PGID}
    networks:
      - backend
    environment:
      - TZ=${TZ}
      ## Global Settings
      - UN_DEBUG=false
      - UN_QUIET=false
      - UN_ERROR_STDERR=false
      - UN_ACTIVITY=false
      - UN_LOG_QUEUES=1m
      - UN_LOG_FILE=/data/unpackerr.log
      - UN_LOG_FILES=10
      - UN_LOG_FILE_MB=10
      - UN_INTERVAL=2m
      - UN_START_DELAY=1m
      - UN_RETRY_DELAY=5m
      - UN_MAX_RETRIES=3
      - UN_PARALLEL=1
      - UN_FILE_MODE=0644
      - UN_DIR_MODE=0755
      ## Folder Settings
      - UN_FOLDERS_INTERVAL=1s
      - UN_FOLDERS_BUFFER=20000
      ## Sonarr Settings
      - UN_SONARR_0_URL=http://sonarr:8989
      - UN_SONARR_0_API_KEY=${SONARR_API_KEY}
      - UN_SONARR_0_PATHS_0=/downloads
      - UN_SONARR_0_PROTOCOLS=torrent
      - UN_SONARR_0_TIMEOUT=10s
      - UN_SONARR_0_DELETE_DELAY=5m
      - UN_SONARR_0_DELETE_ORIG=false
      - UN_SONARR_0_SYNCTHING=false
      ## Radarr Settings
      - UN_RADARR_0_URL=http://radarr:7878
      - UN_RADARR_0_API_KEY=${RADARR_API_KEY}
      - UN_RADARR_0_PATHS_0=/downloads
      - UN_RADARR_0_PROTOCOLS=torrent
      - UN_RADARR_0_TIMEOUT=10s
      - UN_RADARR_0_DELETE_DELAY=5m
      - UN_RADARR_0_DELETE_ORIG=false
      - UN_RADARR_0_SYNCTHING=false

  lubelogger:
    image: ghcr.io/hargata/lubelogger
    container_name: lubelogger
    restart: unless-stopped
    user: ${PUID}:${PGID}
    depends_on:
      - lubelogger-postgres
    volumes:
      - ./lubelogger/config:/App/config
      - ./lubelogger/data:/App/data
      - ./lubelogger/translations:/App/wwwroot/translations
      - ./lubelogger/documents:/App/wwwroot/documents
      - ./lubelogger/images:/App/wwwroot/images
      - ./lubelogger/temp:/App/wwwroot/temp
      - ./lubelogger/log:/App/log
      - ./lubelogger/keys:/root/.aspnet/DataProtection-Keys
    # expose port and/or use serving via traefik
    expose:
      - 8080 # ui
    networks:
      - frontend
      - backend
    environment:
      <<: *env
      POSTGRES_CONNECTION: Host=lubelogger-postgres:5432;Username=lubelogger;Password=$LUBELOGGER_POSTGRES_PASSWORD;Database=lubelogger;

  lubelogger-postgres:
    container_name: lubelogger-postgres
    image: postgres:17
    restart: unless-stopped
    user: ${PUID}:${PGID}
    networks:
      - backend
    volumes:
      - ./lubelogger/init.sql:/docker-entrypoint-initdb.d/init.sql
      - ./lubelogger/postgres:/var/lib/postgresql/data
      - /etc/localtime:/etc/localtime:ro
    environment:
      POSTGRES_DB: lubelogger
      POSTGRES_USER: lubelogger
      POSTGRES_PASSWORD: $LUBELOGGER_POSTGRES_PASSWORD

  syncthing:
    image: ghcr.io/linuxserver/syncthing
    container_name: syncthing
    networks:
      frontend:
      macvlan:
        ipv4_address: 192.168.10.18 # for discovery
    hostname: ${HOSTNAME}
    environment:
      <<: *env
    volumes:
      - ./syncthing/config:/config
      - ${SYNCTHING_DATA_DIR_1}:/data
    expose:
      - 8384  # web UI
      - 22000/tcp  # listening port (TCP)
      - 22000/udp  # listening port (UDP)
      - 21027/udp  # protocol discovery
    restart: unless-stopped
    healthcheck:
      test: curl -fkLsS -m 2 127.0.0.1:8384/rest/noauth/health | grep -o --color=never OK || exit 1
      interval: 1m
      timeout: 10s

  calibre:
    image: lscr.io/linuxserver/calibre
    container_name: calibre
    networks:
      - frontend
    environment:
      <<: *env
    volumes:
      - ./calibre/config:/config
      - ${DOCKER_DATA_DIR}:/data
    expose:
      - 8080 # UI
      - 8181 # UI (HTTPS), not used
      - 8081 # Content Server UI
    restart: unless-stopped

  calibre-web:
    image: lscr.io/linuxserver/calibre-web
    container_name: calibre-web
    networks:
      - frontend
    environment:
      <<: *env
      DOCKER_MODS: lscr.io/linuxserver/mods:universal-calibre-v7.16.0  # synology on 4.4 kernel, see https://github.com/linuxserver/docker-calibre-web/issues/306
      OAUTHLIB_RELAX_TOKEN_SCOPE: 1 #optional
    volumes:
      - ${DOCKER_DATA_DIR}/media/books:/books
      - ./calibre-web/config:/config
    expose:
      - 8083  # UI
    restart: unless-stopped

networks:
  backend:
  iot_macvlan:
    name: iot_macvlan
    driver: macvlan
    enable_ipv6: false
    driver_opts:
      parent: eth1
    ipam:
      config:
        - subnet: 192.168.30.0/24
          gateway: 192.168.30.1
  macvlan:
    name: docker_macvlan
    driver: macvlan
    enable_ipv6: false
    driver_opts:
      parent: eth0
    ipam:
      config:
        - subnet: 192.168.10.0/24
          gateway: 192.168.10.1
  frontend:
    name: docker_frontend
    driver: bridge
    enable_ipv6: false
    ipam:
      config:
        - subnet: 172.20.0.0/24 # subnet for all containers
          gateway: 172.20.0.1