docker-compose1.yml

version: '3'


networks:
  traefik:
    internal: true
  default:
    driver: bridge



services:
  
  watchtower:
    container_name: watchtower
    image: containrrr/watchtower
    restart: always
    command: --label-enable --cleanup --interval 86400 #checks every 24hrs
    #network_mode: none
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      - "com.centurylinklabs.watchtower.enable=true"


  dockerproxy:
    container_name: dockerproxy
    image: tecnativa/docker-socket-proxy
    restart: always    
    ports:
      - 2375
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      CONTAINERS: 1
    networks:
      - traefik
    depends_on:
      - watchtower
    labels:
      - "com.centurylinklabs.watchtower.enable=true"


  portainer:
    container_name: portainer
    image: portainer/portainer:1.24.0
    restart: always
    ports:
      - "9000:9000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /share/Docker/portainer:/data

  
  fail2ban:
    container_name: fail2ban
    image: crazymax/fail2ban:latest
    restart: always
    environment:
      - TZ=${TZ}
      - F2B_DB_PURGE_AGE=30d
      - F2B_LOG_TARGET=/data/fail2ban.log
      - F2B_LOG_LEVEL=INFO
    #  - F2B_IPTABLES_CHAIN=INPUT
      - F2B_IPTABLES_CHAIN=DOCKER-USER
    network_mode: "host"
    #networks:
    #  - default
    #  - traefik
    volumes:
      - ${CONTAINERPATH}/traefik/log:/var/log:ro
    #  - ${CONTAINERPATH}/shared/log:/var/log:ro
      - ${CONTAINERPATH}/fail2ban/data:/data
      - ${CONTAINERPATH}/bitwardenrs:/data:ro
    privileged: true
    cap_add:
      - NET_ADMIN
      - NET_RAW  


  traefik:
    container_name: traefik
    image: traefik:2.2
    restart: always
    security_opt:
      - no-new-privileges:true
    domainname: ${DOMAINNAME}
    depends_on:
     - watchtower
     - dockerproxy
    ports:
      - 80:80
      - 443:443
    networks:
      - default
      - traefik
    volumes:
  #    - /var/run/docker.sock:/var/run/docker.sock:ro <--this is not used per use of dockerproxy above
      - ${CONTAINERPATH}/traefik:/etc/traefik
      - ${CONTAINERPATH}/traefik/log:/var/log
      - ${CONTAINERPATH}/traefik/acme/acme.json:/acme.json
      - ${CONTAINERPATH}/traefik/traefik.yml:/traefik.yml
      - ${CONTAINERPATH}/traefik/dynamic_config.yml:/config.yml:ro
      - ${CONTAINERPATH}/traefik/tmp:/tmp
    environment:
      - NAMECHEAP_API_USER=${NAMECHEAP_API_USER}
      - NAMECHEAP_API_KEY=${NAMECHEAP_API_KEY}
      - TZ=${TZ}
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.entrypoints=web
      - traefik.http.routers.traefik.rule=Host(`traefik.${DOMAINNAME}`)
      - traefik.http.routers.traefik.entrypoints=websecure
      - traefik.http.middlewares.traefik-auth.basicauth.users=${HTTP_USERNAME}:${HTTP_PASSWORD}
      - traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=websecure
      - traefik.http.routers.traefik.middlewares=traefik-https-redirect
      - traefik.http.routers.traefik-secure.entrypoints=websecure
      - traefik.http.routers.traefik-secure.rule=Host(`traefik.${DOMAINNAME}`)      
      - traefik.http.routers.traefik-secure.middlewares=traefik-auth
      - traefik.http.routers.traefik-secure.tls=true
      - traefik.http.routers.traefik-secure.tls.certresolver=namecheap
      - traefik.http.routers.traefik-secure.tls.domains[0].main=${DOMAINNAME}
      - traefik.http.routers.traefik-secure.tls.domains[0].sans=*.${DOMAINNAME}
      - traefik.http.routers.traefik-secure.tls.domains[0].main=${DOMAINNAME2}
      - traefik.http.routers.traefik-secure.service=api@internal


  postgres:
    container_name: postgres
    image: postgres:11
    restart: always
    ports:
      - "5432:5432"
    networks:
      - default 
    environment:
      - TZ=${TZ}
 #     - POSTGRES_DB=${POSTGRES_DB}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    volumes:
      - ${CONTAINERPATH}/postgres/data:/var/lib/postgresql/data
      - ${CONTAINERPATH}/shared:/shared


  mqtt:
    container_name: mqtt
    image: eclipse-mosquitto:latest
    restart: always
    ports:
      - "1883:1883"
   #   - "8883:8883"
      - "9001:9001"
    networks:
      - default
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${CONTAINERPATH}/mosquitto/data:/mosquitto/data
      - ${CONTAINERPATH}/mosquitto/config/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
      - ${CONTAINERPATH}/mosquitto/log:/mosquitto/log
      - ${CONTAINERPATH}/shared:/shared


  nextcloud:
    container_name: nextcloud
    image: nextcloud
    restart: always
    volumes:
      - ${CONTAINERPATH}/nextcloud/www:/var/www/html
    ports:
      - "9443:443"
    networks:
      - default
      - traefik
    environment:
      - TZ=${TZ}
      - POSTGRES_DB=${POSTGRES_DB}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_HOST=postgres
    #  - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER}
    #  - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD}
    #  - NEXTCLOUD_TRUSTED_DOMAINS=${NEXTCLOUD_TRUSTED_DOMAINS}
      - TRUSTED_PROXIES=172.29.4.0/22, 172.29.0.0/22
      - NEXTCLOUD_UPDATE
    depends_on:
      - postgres
      - traefik
    labels:
      - traefik.enable=true
      - traefik.http.routers.nextcloud-http.entrypoints=web
      - traefik.http.routers.nextcloud-http.rule=Host(`nextcloud.${DOMAINNAME}`)
      - traefik.http.routers.nextcloud-https.entrypoints=websecure
      - traefik.http.routers.nextcloud-https.rule=Host(`nextcloud.${DOMAINNAME}`)
      - traefik.http.routers.nextcloud-https.tls=true
      - traefik.http.routers.nextcloud-https.tls.certresolver=default
      - traefik.http.routers.nextcloud-http.middlewares=nextcloud-https@docker
      - traefik.http.middlewares.nextcloud-https.redirectscheme.scheme=https
      - traefik.http.middlewares.nextcloud-https.redirectScheme.permanent=true
      - traefik.http.routers.nextcloud-https.middlewares=nextcloud-caldav@docker
      - traefik.http.middlewares.nextcloud-caldav.redirectregex.permanent=true
      - traefik.http.middlewares.nextcloud-caldav.redirectregex.regex=^https://(.*)/.well-known/(card|cal)dav
      - traefik.http.middlewares.nextcloud-caldav.redirectregex.replacement=https://$${1}/remote.php/dav/


  influxdb:
    container_name: influxdb
    image: influxdb:latest
    #image: influxdb:1.7.4
    restart: always
    ports:
      - "8086:8086"
      - "8089:8089/udp" #used by traefik
    networks:
      - default
    volumes:
      # files cannot be created by docker-compose, it'll make it as a directory instead. Make sure to touch this file first.
      - ${CONTAINERPATH}/influxdb/influxdb.generated.conf:/etc/influxdb/influxdb.generated.conf
      - ${CONTAINERPATH}/influxdb/db:/var/lib/influxdb
      #- ${CONTAINERPATH}/influxdb:/var/lib/influxdb
      #- ${CONTAINERPATH}/shared:/shared
    environment:
      #- INFLUX_GRAPHITE_ENABLED ='true'
      #- INFLUXDB_ADMIN_USER=${INFLUXDB_ADMIN_USER}
      #- INFLUXDB_ADMIN_PASSWORD=${INFLUXDB_ADMIN_PASSWORD}
      - INFLUXDB_DB=${INFLUXDB_DB}
      - INFLUXDB_USER=${INFLUXDB_USER}
      - INFLUXDB_USER_PASSWORD=${INFLUXDB_USER_PASSWORD}
      #Added to be able to receive Traefik metric data
      - INFLUXDB_UDP_ENABLED=true
      - INFLUXDB_UDP_DATABASE=home_assistant
      - TZ=${TZ}


  grafana:
    container_name: grafana
    image: grafana/grafana:latest
#    image: grafana/grafana:6.7.2
    restart: always
    depends_on:
      - influxdb
    #Grafana uses User ID 472
    #user: "472"
    user: ${PUID}
    ports:
      - "3000:3000"
    networks:
      - default
    # to enable persistent storage, you might need to modify user permissions by creating this container in
    # interactive mode and adjusting the permissions from a shell first
    volumes:
      - ${CONTAINERPATH}/grafana:/var/lib/grafana
      - ${CONTAINERPATH}/grafana/grafana.ini:/etc/grafana/grafana.ini:ro
    environment:
      - TZ=${TZ}
      - "GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource,grafana-worldmap-panel,grafana-piechart-panel"
      - allow_embedding=true

 
  homeassistant:
    container_name: home-assistant
    image: homeassistant/home-assistant:0.112.2
    #image: homeassistant/home-assistant:0.111.4
    restart: always
    depends_on:
      - postgres
      - influxdb
      - mqtt
    ports:
      - "8123:8123"
    networks:
      - default
    environment:
      - TZ=${TZ}
    volumes:
      - ${CONTAINERPATH}/homeassistant:/config
      - /var/run/docker.sock:/var/run/docker.sock #used for the docker monitor integration


  nodered:
    container_name: node-red
    #image: nodered/node-red:1.2.7
    image: nodered/node-red:1.2.9
    restart: always
    ports:
      - "1880:1880"
    environment:
      - TZ=${TZ}
    depends_on:
      - homeassistant
    user: root
    volumes:
      - ${CONTAINERPATH}/node-red/user:/data
      - /root/.ssh:/root/.ssh:ro


  calibre-web:
    container_name: calibre-web
    image: technosoft2000/calibre-web
    restart: always
    volumes:
      - ${CONTAINERPATH}/calibre-web/config:/config
      - ${CONTAINERPATH}/calibre-web/app:/app
      - ${CONTAINERPATH}/calibre-web/kindlegen:/kindlegen
      - /share/CACHEDEV1_DATA/Recovery/Syncs/Ares-II/MediaContent/PrintLibrary/CalibreLibrary:/books
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - USE_CONFIG_DIR=true
    ports:
      - "8083:8083"
    networks:
      - traefik
      - default
    labels:
      - traefik.enable=true
      - traefik.http.routers.books-http.entrypoints=web
      - traefik.http.routers.books-http.rule=Host(`books.${DOMAINNAME}`)
      - traefik.http.routers.books-https.entrypoints=websecure
      - traefik.http.routers.books-https.rule=Host(`books.${DOMAINNAME}`)
      - traefik.http.routers.books-https.tls=true
      - traefik.http.routers.books-https.tls.certresolver=default
      - traefik.http.routers.books-http.middlewares=books-https@docker
      - traefik.http.middlewares.books-https.redirectscheme.scheme=https
      - traefik.http.middlewares.books-https.redirectScheme.permanent=true


  kanboard:
    image: kanboard/kanboard:latest
    container_name: kanboard
    restart: always
    ports:
     - "2001:443"
    # - "2001:80" #disable this when traefik is fixed
    networks:
     - traefik
     - default
    volumes:
     - ${CONTAINERPATH}/kanboard/data:/var/www/app/data
     - ${CONTAINERPATH}/kanboard/plugins:/var/www/app/plugins
     - ${CONTAINERPATH}/kanboard/kanboard_ssl:/etc/nginx/ssl
    environment:
      DATABASE_URL: ${DATABASE_URL}
      DEBUG: "true"
    labels:
      - traefik.enable=true
      - traefik.http.routers.kanboard-http.entrypoints=web
      - traefik.http.routers.kanboard-http.rule=Host(`kanboard.${DOMAINNAME}`)
      - traefik.http.routers.kanboard-https.entrypoints=websecure
      - traefik.http.routers.kanboard-https.rule=Host(`kanboard.${DOMAINNAME}`)
      - traefik.http.routers.kanboard-https.tls=true
      - traefik.http.routers.kanboard-https.tls.certresolver=default
      - traefik.http.routers.kanboard-http.middlewares=kanboard-https@docker
      - traefik.http.middlewares.kanboard-https.redirectscheme.scheme=https
      - traefik.http.middlewares.kanboard-https.redirectScheme.permanent=true
      - com.centurylinklabs.watchtower.enable=true