docker-compose.yml

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    command:
      - "--providers.docker=true"  # Enable Docker provider
      - "--providers.docker.exposedbydefault=false"  # Only expose services with explicit labels
      - "--entrypoints.web.address=:80"  # HTTP entrypoint
      - "--api.dashboard=true"  # Enable dashboard
      - "--api.insecure=true"  # Allow HTTP access to the dashboard
      - "--entrypoints.web.forwardedheaders.insecure" # Allow insecure forwarded headers
    ports:
      - "80:80"  # HTTP
      - "8080:8080"  # Dashboard (optional)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro  # Access Docker API
    restart: always
  sonarr:
    image: lscr.io/linuxserver/sonarr
    container_name: sonarr
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONFIG_ROOT:-.}/sonarr:/config
      - ${DATA_ROOT}:/data
    restart: always
    healthcheck:
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:8989/sonarr/ping" ]
      interval: 30s
      retries: 10
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.sonarr.entrypoints=web"
      - "traefik.http.routers.sonarr.rule=PathPrefix(`/sonarr`)"
      - "traefik.http.services.sonarr.loadbalancer.server.port=8989"
  radarr:
    image: lscr.io/linuxserver/radarr
    container_name: radarr
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONFIG_ROOT:-.}/radarr:/config
      - ${DATA_ROOT}:/data
    restart: always
    healthcheck:
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:7878/radarr/ping" ]
      interval: 30s
      retries: 10
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.radarr.entrypoints=web"
      - "traefik.http.routers.radarr.rule=PathPrefix(`/radarr`)"
      - "traefik.http.services.radarr.loadbalancer.server.port=7878"
  bazarr:
    image: lscr.io/linuxserver/bazarr
    container_name: bazarr
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONFIG_ROOT:-.}/bazarr/config:/config
      - ${DATA_ROOT}:/data
    restart: always
    healthcheck:
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:6767/bazarr/ping" ]
      interval: 5s
      retries: 10
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.bazarr.entrypoints=web"
      - "traefik.http.routers.bazarr.rule=PathPrefix(`/bazarr`)"
      - "traefik.http.services.bazarr.loadbalancer.server.port=6767"
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONFIG_ROOT:-.}/prowlarr:/config
    restart: always
    healthcheck:
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:9696/prowlarr/ping" ]
      interval: 30s
      retries: 10
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.prowlarr.entrypoints=web"
      - "traefik.http.routers.prowlarr.rule=PathPrefix(`/prowlarr`)"
      - "traefik.http.services.prowlarr.loadbalancer.server.port=9696"
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:libtorrentv1
    container_name: qbittorrent
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
      - WEBUI_PORT=8080
      - DOCKER_MODS=ghcr.io/gabe565/linuxserver-mod-vuetorrent
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.qbittorrent.entrypoints=web"
      - "traefik.http.routers.qbittorrent.rule=PathPrefix(`/qbittorrent`)"
      - "traefik.http.services.qbittorrent.loadbalancer.server.port=8080"
    volumes:
      - ${CONFIG_ROOT:-.}/qbittorrent:/config
      - ${DOWNLOAD_ROOT}:/data/torrents
    restart: always
    healthcheck:
      # Container may fail if the PIA's token expired, so mark as unhealthy when there is no internet connection
      # see: https://github.com/qdm12/gluetun/issues/641#issuecomment-933856220
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:8080", "https://google.com" ]
      interval: 30s
      retries: 10
    network_mode: "service:vpn"
    depends_on:
      vpn:
        condition: service_healthy
  vpn:
    image: ghcr.io/bubuntux/nordlynx
    container_name: vpn
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - SYS_MODULE
    environment:
      - CONNECT=Sweden
      - PRIVATE_KEY=${NORD_PRIVATE_KEY}
      - NETWORK=192.168.1.0/24  # So it can be accessed within the local network
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.default.disable_ipv6=1
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv6.conf.lo.disable_ipv6=1
      #- "traefik.http.middlewares.qbittorrent-stripprefix.stripprefix.prefixes=/qbittorrent"
    healthcheck:
      test: ping -c 1 www.google.com || exit 1
      interval: 30s
      timeout: 10s
      retries: 3
    restart: always
  unpackerr:
    image: golift/unpackerr:latest
    container_name: unpackerr
    volumes:
      - ${DOWNLOAD_ROOT}:/data/torrents
    restart: always
    user: ${USER_ID}:${GROUP_ID}
    environment:
      - TZ=${TIMEZONE}
      - UN_SONARR_0_URL=http://sonarr:8989/sonarr
      - UN_SONARR_0_API_KEY=${SONARR_API_KEY}
      - UN_RADARR_0_URL=http://radarr:7878/radarr
      - UN_RADARR_0_API_KEY=${RADARR_API_KEY}
    security_opt:
      - no-new-privileges:true
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    deploy:
      resources:
        reservations:
          devices:
          - driver: cdi
            device_ids:
            - nvidia.com/gpu=all
            capabilities: [gpu]
    environment:
      - NVIDIA_VISIBLE_DEVICES=all
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
      - TZ=${TIMEZONE}
      - JELLYFIN_PublishedServerUrl=${HOSTNAME}/jellyfin
    volumes:
      - ${CONFIG_ROOT:-.}/jellyfin:/config
      - ${DATA_ROOT}:/data
    ports:
      - "7359:7359/udp"
      - "1900:1900/udp"
    restart: always
    healthcheck:
      test: [ "CMD", "curl", "--fail", "http://127.0.0.1:8096/jellyfin/health" ]
      interval: 30s
      retries: 10
    labels:
      # Traefik labels
      - "traefik.enable=true"
      - "traefik.http.routers.jellyfin.entrypoints=web"
      - "traefik.http.routers.jellyfin.rule=PathPrefix(`/jellyfin`)"
      - "traefik.http.services.jellyfin.loadbalancer.server.port=8096"
  requestrr:
    image: thomst08/requestrr:latest
    hostname: requestrr
    container_name: requestrr
    ports:
    - 4545:4545
    volumes:
    - ${CONFIG_ROOT:-.}/requestrr:/root/config
    - ${CONFIG_ROOT}/requestrr/DataProtection-Keys:/root/.aspnet/DataProtection-Keys
    environment:
      - PUID=${USER_ID}
      - PGID=${GROUP_ID}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.requestrr.entrypoints=web"
      - "traefik.http.routers.requestrr.rule=PathPrefix(`/requestrr`)"
      - "traefik.http.services.requestrr.loadbalancer.server.port=4545"
    healthcheck:
      test: [ "CMD", "curl", "--fail", "http://localhost:4545" ]
      interval: 30s
      retries: 10
    restart: unless-stopped
  decluttarr:
    image: ghcr.io/manimatter/decluttarr:latest
    container_name: decluttarr
    restart: always
    depends_on:
      qbittorrent:
        condition: service_healthy
    environment:
      TZ: ${TIMEZONE}
      PUID: ${USER_ID}
      PGID: ${GROUP_ID}

      ## General
      # TEST_RUN: True
      # SSL_VERIFICATION: False
      LOG_LEVEL: INFO

      ## Features
      REMOVE_TIMER: 10
      REMOVE_FAILED: True
      REMOVE_FAILED_IMPORTS: True
      REMOVE_METADATA_MISSING: True
      REMOVE_MISSING_FILES: True
      REMOVE_ORPHANS: True
      REMOVE_SLOW: False
      REMOVE_STALLED: True
      REMOVE_UNMONITORED: True
      RUN_PERIODIC_RESCANS: '
        {
        "SONARR": {"MISSING": true, "CUTOFF_UNMET": true, "MAX_CONCURRENT_SCANS": 3, "MIN_DAYS_BEFORE_RESCAN": 7},
        "RADARR": {"MISSING": true, "CUTOFF_UNMET": true, "MAX_CONCURRENT_SCANS": 3, "MIN_DAYS_BEFORE_RESCAN": 7}
        }'

      # Feature Settings
      PERMITTED_ATTEMPTS: 3
      NO_STALLED_REMOVAL_QBIT_TAG: Don't Kill
      MIN_DOWNLOAD_SPEED: 100
      FAILED_IMPORT_MESSAGE_PATTERNS: '
        [
        "Not a Custom Format upgrade for existing",
        "Not an upgrade for existing"
        ]'

      ## Radarr
      RADARR_URL: http://radarr:7878
      RADARR_KEY: ${RADARR_API_KEY}

      ## Sonarr
      SONARR_URL: http://sonarr:8989
      SONARR_KEY: ${SONARR_API_KEY}

      ## qBitorrent
      QBITTORRENT_URL: http://vpn:8080
      QBITTORRENT_USERNAME: ${QBITTORRENT_USERNAME}
      QBITTORRENT_PASSWORD: ${QBITTORRENT_PASSWORD}
  whatsupdocker:
    image: getwud/wud
    container_name: wud
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - 3000:3000
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whatsupdocker.entrypoints=web"
      - "traefik.http.routers.whatsupdocker.rule=PathPrefix(`/whatsupdocker`)"
      - "traefik.http.services.whatsupdocker.loadbalancer.server.port=3000"
  autoheal:
    image: willfarrell/autoheal:latest
    container_name: autoheal
    restart: always
    environment:
      - AUTOHEAL_CONTAINER_LABEL=all
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

networks:
  default:
    name: docker-compose-nas