docker-compose.yml

version: '3.7'
services:
  traefik:
    image: "traefik:v2.6.2"
    container_name: "traefik"
    restart: unless-stopped
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.selfhostedservices.acme.tlschallenge=true"
      - "--certificatesresolvers.selfhostedservices.acme.email=${LE_EMAIL_ADDRESS}"
      - "--certificatesresolvers.selfhostedservices.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  uptime-kuma:
    image: louislam/uptime-kuma:1
    container_name: uptime-kuma
    restart: always
    volumes:
      - uptime-kuma:/app/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.status.rule=Host(`${STATUS_HOSTNAME}`)"
      - "traefik.http.routers.status.entrypoints=websecure"
      - "traefik.http.routers.status.tls.certresolver=selfhostedservices"

  libretranslate:
    image: libretranslate/libretranslate:latest
    restart: unless-stopped
    container_name: libretranslate
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.translate.rule=Host(`${TRANSLATE_HOSTNAME}`)"
      - "traefik.http.routers.translate.entrypoints=websecure"
      - "traefik.http.routers.translate.tls.certresolver=selfhostedservices"
      - "traefik.http.services.translate.loadbalancer.server.port=5000"

  bitwarden:
    image: vaultwarden/server:latest
    container_name: bitwarden
    restart: unless-stopped
    volumes:
       - bitwarden-data:/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.bitwarden.entrypoints=websecure"
      - "traefik.http.routers.bitwarden.rule=Host(`${BITWARDEN_HOSTNAME}`)"
      - "traefik.http.routers.bitwarden.tls.certresolver=selfhostedservices"

  db:
    image: mysql:5.7
    volumes:
      - db_data:/var/lib/mysql
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: ${WP_MYSQL_ROOT_PW}
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: ${WP_MYSQL_PW}
    
  wordpress:
    depends_on:
      - db
    image: wordpress:latest
    volumes:
      - wordpress_data:/var/www/html
    restart: always
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: ${WP_DB_PW}
      WORDPRESS_DB_NAME: wordpress
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.blog.rule=Host(`${WORDPRESS_HOSTNAME}`)"
      - "traefik.http.routers.blog.entrypoints=websecure"
      - "traefik.http.routers.blog.tls.certresolver=selfhostedservices"

  filtron:
    container_name: filtron
    image: dalf/filtron
    restart: always
    command: -listen 0.0.0.0:4040 -api 0.0.0.0:4041 -target searx:8080
    volumes:
      - ./rules.json:/etc/filtron/rules.json:rw
    logging:
      driver: none
    read_only: true
    cap_drop:
      - ALL
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.filtron.rule=Host(`${SEARX_HOSTNAME}`)"
      - "traefik.http.routers.filtron.tls.certresolver=selfhostedservices"
      - "traefik.http.routers.filtron.entrypoints=websecure"
      - "traefik.http.services.filtron.loadbalancer.server.port=4040"
 
  searx:
    container_name: searx
    image: searxng/searxng:latest
    restart: always
    command: ${SEARX_COMMAND:-}
    volumes:
      - ./settings.yml:/etc/searxng/settings.yml:rw
    logging:
      driver: none
    expose:
      - 8080
    environment:
      - BIND_ADDRESS=0.0.0.0:8080
      - BASE_URL=https://${SEARX_HOSTNAME}/
      - MORTY_URL=https://${SEARX_HOSTNAME}/morty/
      - MORTY_KEY=${MORTY_KEY}
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - DAC_OVERRIDE

  morty:
    container_name: morty
    image: dalf/morty
    restart: always
    command: -timeout 6 -ipv6
    environment:
      - MORTY_KEY=${MORTY_KEY}
      - MORTY_ADDRESS=0.0.0.0:3030
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.morty.rule=Host(`${SEARX_HOSTNAME}`) && PathPrefix(`/morty`)"
      - "traefik.http.routers.morty.tls.certresolver=selfhostedservices"
      - "traefik.http.routers.morty.entrypoints=websecure"
      - "traefik.http.services.morty.loadbalancer.server.port=3030"      

  cryptpad:
    image: promasu/cryptpad:nginx
    container_name: cryptpad
    restart: unless-stopped
    environment:
      - CPAD_MAIN_DOMAIN=${PAD_HOSTNAME}
      - CPAD_SANDBOX_DOMAIN=${PAD_HOSTNAME}/sandbox
      # Traefik can't use HTTP2 to communicate with cryptpat_websocket
      # A workaroung is disabling HTTP2 in Nginx
      - CPAD_HTTP2_DISABLE=true

    ulimits:
      nofile:
        soft: 1000000
        hard: 1000000

    volumes:
      - cryptpad-blob:/cryptpad/blob
      - cryptpad-block:/cryptpad/block
      - cryptpad-customize:/cryptpad/customize
      - cryptpad-data:/cryptpad/data
      - cryptpad-datastores:/cryptpad/datastore
      - ./data/config.js:/cryptpad/config/config.js

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pad.rule=Host(`${PAD_HOSTNAME}`)"
      - "traefik.http.routers.pad.entrypoints=websecure"
      - "traefik.http.routers.pad.tls.certresolver=selfhostedservices"

  monerod:
    image: sethsimmons/simple-monerod:latest
    restart: unless-stopped
    container_name: monerod
    volumes:
      - bitmonero:/home/monero/.bitmonero
    ports:
      - 18080:18080
      - 18089:18089
      - 18083:18083
    command: >-
      --rpc-restricted-bind-ip=0.0.0.0
      --rpc-restricted-bind-port=18089
      --public-node
      --no-igd
      --enable-dns-blocklist
      --prune-blockchain
      --zmq-pub=tcp://0.0.0.0:18083
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.monero.rule=Host(`${MONERO_HOSTNAME}`)"
      - "traefik.http.routers.monero.entrypoints=websecure"
      - "traefik.http.routers.monero.tls.certresolver=selfhostedservices"
      - "traefik.http.services.monero.loadbalancer.server.port=18089"
      
  p2pool:
    image: sethsimmons/p2pool:latest
    restart: unless-stopped
    container_name: p2pool
    tty: true
    stdin_open: true
    volumes:
      - p2pool-data:/home/p2pool
      - /dev/hugepages:/dev/hugepages:rw
    ports:
      - 3333:3333
      - 37889:37889
    command: >-
      --wallet "${YOUR_WALLET_ADDRESS}"
      --stratum 0.0.0.0:3333
      --p2p 0.0.0.0:37889
      --loglevel 0
      --addpeers 65.21.227.114:37889,node.sethforprivacy.com:37889
      --host monerod
      --rpc-port 18089

  postgres:
    image: postgres:10
    restart: always
    volumes:
      - postgresdata:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: invidious
      POSTGRES_USER: kemal
      POSTGRES_PASSWORD: ${POSTGRES_PW}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
  
  invidious:
    image: quay.io/invidious/invidious:latest
    restart: always
    depends_on:
      - postgres
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.invidious.rule=Host(`${INVIDIOUS_HOSTNAME}`)"
      - "traefik.http.routers.invidious.entrypoints=websecure"
      - "traefik.http.routers.invidious.tls.certresolver=selfhostedservices"
      - "traefik.http.services.invidious.loadbalancer.server.port=3000"
    environment:
      INVIDIOUS_CONFIG: |
        db:
          dbname: invidious
          user: kemal
          password: ${POSTGRES_PW}
          host: postgres
          port: 5432
          
  wallabag:
    image: wallabag/wallabag:latest
    container_name: wallabag
    restart: unless-stopped
    environment:
      - MYSQL_ROOT_PASSWORD=${WALLABAG_DB_ROOT_PASS}
      - SYMFONY__ENV__DATABASE_DRIVER=pdo_mysql
      - SYMFONY__ENV__DATABASE_HOST=wallabag_db
      - SYMFONY__ENV__DATABASE_PORT=3306
      - SYMFONY__ENV__DATABASE_NAME=wallabag
      - SYMFONY__ENV__DATABASE_USER=wallabag
      - SYMFONY__ENV__DATABASE_PASSWORD=${WALLABAG_DB_PASS}
      - SYMFONY__ENV__DATABASE_CHARSET=utf8mb4
      - SYMFONY__ENV__MAILER_HOST=127.0.0.1
      - SYMFONY__ENV__MAILER_USER=~
      - SYMFONY__ENV__MAILER_PASSWORD=~
      - SYMFONY__ENV__FROM_EMAIL=wallabag@example.com
      - SYMFONY__ENV__DOMAIN_NAME=${WALLABAG_URL}
      - SYMFONY__ENV__SERVER_NAME="Seth's Wallabag Instance"
    volumes:
      - wallabag:/var/www/wallabag/web/assets/images
    healthcheck:
      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost"]
      interval: 1m
      timeout: 3s
    depends_on:
      - wallabag_db
      - redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.wallabag.rule=Host(`${WALLABAG_HOSTNAME}`)"
      - "traefik.http.routers.wallabag.entrypoints=websecure"
      - "traefik.http.routers.wallabag.tls.certresolver=selfhostedservices"
  
  wallabag_db:
    image: mariadb:latest
    container_name: wallabag_db
    restart: unless-stopped
    environment:
      - MYSQL_ROOT_PASSWORD=${WALLABAG_DB_ROOT_PASS}
    volumes:
      - wallabag_db:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
      interval: 1s
      timeout: 3s
      retries: 30

  nitter:
    volumes:
        - ./nitter.conf:/src/nitter.conf
    image: zedeus/nitter:latest
    restart: unless-stopped
    container_name: nitter
    healthcheck:
      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost:8080"]
      interval: 1m
      timeout: 3s
    depends_on:
      - redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nitter.rule=Host(`${NITTER_HOSTNAME}`)"
      - "traefik.http.services.nitter.loadbalancer.server.port=8080"
      - "traefik.http.routers.nitter.entrypoints=websecure"
      - "traefik.http.routers.nitter.tls.certresolver=selfhostedservices"

  teddit:
    image: teddit/teddit:latest
    container_name: teddit
    restart: unless-stopped
    environment:
      - REDIS_HOST=redis
      - DOMAIN=${TEDDIT_HOSTNAME}
      - THEME=dark
      - HTTPS_ENABLED=false
      - REDIRECT_HTTP_TO_HTTPS=false
      - REDIRECT_WWW=false
    healthcheck:
      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost:8080/about"]
      interval: 1m
      timeout: 3s
    depends_on:
      - redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.teddit.rule=Host(`${TEDDIT_HOSTNAME}`)"
      - "traefik.http.services.teddit.loadbalancer.server.port=8080"
      - "traefik.http.routers.teddit.entrypoints=websecure"
      - "traefik.http.routers.teddit.tls.certresolver=selfhostedservices"

  nextcloud:
    image: nextcloud:apache
    container_name: nextcloud
    restart: unless-stopped
    volumes:
      - nextcloud:/var/www/html
    environment:
      - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER}
      - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD}
      - NEXTCLOUD_TRUSTED_DOMAINS=${NEXTCLOUD_HOSTNAME}
      - TRUSTED_PROXIES=172.16.0.0/12
      - OVERWRITEHOST=${NEXTCLOUD_HOSTNAME}
      - OVERWRITEPROTOCOL=https
      - POSTGRES_HOST=nextcloud_db
      - POSTGRES_USER=nextcloud
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=nextcloud
      - REDIS_HOST=redis
    depends_on:
      - nextcloud_db
      - redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.nextcloud.headers.browserXSSFilter=true"
      - "traefik.http.middlewares.nextcloud.headers.contentTypeNosniff=true"
      - "traefik.http.middlewares.nextcloud.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.nextcloud.headers.stsPreload=true"
      - "traefik.http.middlewares.nextcloud.headers.stsSeconds=155520011"
      - "traefik.http.middlewares.nextcloud_redirect.redirectregex.permanent=true"
      - "traefik.http.middlewares.nextcloud_redirect.redirectregex.regex=https://(.*)/.well-known/(card|cal)dav"
      - "traefik.http.middlewares.nextcloud_redirect.redirectregex.replacement=https://$${1}/remote.php/dav/"
      - "traefik.http.routers.nextcloud.entrypoints=websecure"
      - "traefik.http.routers.nextcloud.middlewares=nextcloud,nextcloud_redirect,nextcloud-https"
      - "traefik.http.routers.nextcloud.rule=Host(`${NEXTCLOUD_HOSTNAME}`)"
      - "traefik.http.routers.nextcloud.tls.certresolver=selfhostedservices"
      - "traefik.http.services.nextcloud.loadbalancer.server.port=80"
      - "traefik.http.middlewares.nextcloud.headers.customRequestHeaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.nextcloud-https.redirectscheme.scheme=https"
      - "traefik.http.routers.nextcloud-http.entrypoints=web"
      - "traefik.http.routers.nextcloud-http.rule=Host(`${NEXTCLOUD_HOSTNAME}`)"
      - "traefik.http.routers.nextcloud-http.middlewares=nextcloud-https@docker"

  nextcloud_db:
    image: postgres:alpine
    container_name: nextcloud_db
    restart: unless-stopped
    volumes:
      - nextcloud_db:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=nextcloud
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U nextcloud"]
      interval: 10s
      timeout: 5s
      retries: 5
      
  nextcloud_cron:
    image: nextcloud:apache
    restart: unless-stopped
    volumes:
      - nextcloud:/var/www/html
    entrypoint: /cron.sh

  privatebin:
    image: privatebin/nginx-fpm-alpine:latest
    container_name: privatebin
    restart: unless-stopped
    volumes:
      - privatebin-data:/srv/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.privatebin.rule=Host(`${PRIVATEBIN_HOSTNAME}`)"
      - "traefik.http.services.privatebin.loadbalancer.server.port=8080"
      - "traefik.http.routers.privatebin.entrypoints=websecure"
      - "traefik.http.routers.privatebin.tls.certresolver=selfhostedservices"

  send:
    image: registry.gitlab.com/timvisee/send:latest
    container_name: send
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.send.rule=Host(`${SEND_HOSTNAME}`)"
      - "traefik.http.routers.send.entrypoints=websecure"
      - "traefik.http.routers.send.tls.certresolver=selfhostedservices"
      - "traefik.http.services.send.loadbalancer.server.port=1443"

    environment:
      - NODE_ENV=production
      # Networking
      - VIRTUAL_HOST=${SEND_HOSTNAME}
      - VIRTUAL_PORT=443
      - BASE_URL=https://${SEND_HOSTNAME}
      # Redis
      - REDIS_HOST=redis
      # Storage Limit
      - MAX_FILE_SIZE=2147483648

  explorer:
    image: vdo1138/xmrblocks:latest
    container_name: explorer
    restart: unless-stopped
    volumes:
      - bitmonero:/home/monero/.bitmonero
    command: ["./xmrblocks --enable-json-api --enable-autorefresh-option --enable-emission-monitor --daemon-url=monerod:18089 --enable-pusher"]
    depends_on:
      - monerod
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.explorer.rule=Host(`${EXPLORER_HOSTNAME}`)"
      - "traefik.http.services.explorer.loadbalancer.server.port=8081"
      - "traefik.http.routers.explorer.entrypoints=websecure"
      - "traefik.http.routers.explorer.tls.certresolver=selfhostedservices"

  tor:
    image: goldy/tor-hidden-service:latest
    container_name: tor
    restart: unless-stopped
    links:
      - monerod
      - nitter
      - teddit
      - libretranslate
      - searx
      - invidious
      - p2pool
      - privatebin
      - explorer
    environment:
      MONEROD_TOR_SERVICE_HOSTS: 18089:monerod:18089
      MONEROD_TOR_SERVICE_VERSION: '3'
      NITTER_TOR_SERVICE_HOSTS: 80:nitter:8080
      NITTER_TOR_SERVICE_VERSION: '3'
      TEDDIT_TOR_SERVICE_HOSTS: 80:teddit:8080
      TEDDIT_TOR_SERVICE_VERSION: '3'
      LIBRETRANSLATE_TOR_SERVICE_HOSTS: 80:LIBRETRANSLATE:5000
      LIBRETRANSLATE_TOR_SERVICE_VERSION: '3'
      SEARX_TOR_SERVICE_HOSTS: 80:SEARX:8080
      SEARX_TOR_SERVICE_VERSION: '3'
      P2POOL_TOR_SERVICE_HOSTS: 80:P2POOL:3333
      P2POOL_TOR_SERVICE_VERSION: '3'
      INVIDIOUS_TOR_SERVICE_HOSTS: 80:INVIDIOUS:3000
      INVIDIOUS_TOR_SERVICE_VERSION: '3'
      PASTE_TOR_SERVICE_HOSTS: 80:privatebin:8080
      PASTE_TOR_SERVICE_VERSION: '3'
      EXPLORER_TOR_SERVICE_HOSTS: 80:explorer:8081
      EXPLORER_TOR_SERVICE_VERSION: '3'
      
      TOR_ENABLE_VANGUARDS: 'true'

      VANGUARDS_EXTRA_OPTIONS: |
        [Global]
        enable_cbtverify = True
        loglevel = INFO
    volumes:
      - tor-keys:/var/lib/tor/hidden_service/
  
  conduit:
    image: matrixconduit/matrix-conduit:latest
    restart: unless-stopped
    user: root
    volumes:
        - conduit-data:/var/lib/matrix-conduit/
    environment:
            CONDUIT_SERVER_NAME: ${CONDUIT_HOSTNAME} #Change to root domain if desired
            CONDUIT_DATABASE_PATH: /var/lib/matrix-conduit/
            CONDUIT_DATABASE_BACKEND: rocksdb
            CONDUIT_PORT: 6167
            CONDUIT_MAX_REQUEST_SIZE: 20_000_000 # in bytes, ~20 MB
            CONDUIT_ALLOW_REGISTRATION: 'true'
            CONDUIT_ALLOW_FEDERATION: 'true'
            CONDUIT_TRUSTED_SERVERS: '["matrix.org"]'
            CONDUIT_ADDRESS: 0.0.0.0
            CONDUIT_CONFIG: ''
    labels:
            - "traefik.enable=true"
            - "traefik.http.routers.conduit.rule=Host(`${CONDUIT_HOSTNAME}`)"
            - "traefik.http.routers.conduit.tls=true"
            - "traefik.http.routers.conduit.tls.certresolver=selfhostedservices"
            - "traefik.http.routers.conduit.middlewares=cors-headers@docker"
            - "traefik.http.middlewares.cors-headers.headers.accessControlAllowOriginList=*"
            - "traefik.http.middlewares.cors-headers.headers.accessControlAllowHeaders=Origin, X-Requested-With, Content-Type, Accept, Authorization"
            - "traefik.http.middlewares.cors-headers.headers.accessControlAllowMethods=GET, POST, PUT, DELETE, OPTIONS"

  well-known:
    image: nginx:latest
    restart: unless-stopped
    volumes:
      - ./conduit/wellknown.conf:/etc/nginx/conf.d/matrix.conf
    labels:
            - "traefik.enable=true"
            - "traefik.http.routers.wellknown.rule=Host(`${CONDUIT_HOSTNAME}`) && PathPrefix(`/.well-known/matrix`)"
            - "traefik.http.routers.wellknown.tls=true"
            - "traefik.http.routers.wellknown.tls.certresolver=selfhostedservices"
            - "traefik.http.routers.wellknown.middlewares=cors-headers@docker"
            - "traefik.http.middlewares.cors-headers.headers.accessControlAllowOriginList=*"
            - "traefik.http.middlewares.cors-headers.headers.accessControlAllowHeaders=Origin, X-Requested-With, Content-Type, Accept, Authorization"
            - "traefik.http.middlewares.cors-headers.headers.accessControlAllowMethods=GET, POST, PUT, DELETE, OPTIONS"

  redis:
    image: redis:alpine
    container_name: redis
    restart: unless-stopped
    volumes:
      - redis-data:/var/lib/redis
      - send_redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 1s
      timeout: 3s
      retries: 30

  jellyfin:
    image: jellyfin/jellyfin
    container_name: jellyfin
    restart: "unless-stopped"
    volumes:
      - jellyfin-data:/config
      - jellyfin-data:/cache
      - <LOCAL_DIR_TO_MOVIES>:/movies:ro
    devices:
      - /dev/dri/renderD128:/dev/dri/renderD128
      - /dev/dri/card0:/dev/dri/card0
    environment:
      - JELLYFIN_PublishedServerUrl=https://${JELLYFIN_HOSTNAME}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jellyfin.rule=Host(`${JELLYFIN_HOSTNAME}`)"
      - "traefik.http.routers.jellyfin.entrypoints=websecure"
      - "traefik.http.routers.jellyfin.tls.certresolver=selfhostedservices"
      - "traefik.http.services.jellyfin.loadbalancer.server.port=8096"

  watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"

volumes:
  bitmonero:
  redis-data:
  nextcloud:
  nextcloud_db:
  wallabag:
  wallabag_db:
  tor-keys:
  privatebin-data:
  uptime-kuma:
  p2pool-data:
  postgresdata:
  db_data:
  wordpress_data:
  cryptpad-blob:
  cryptpad-block:
  cryptpad-customize:
  cryptpad-data:
  cryptpad-datastores:
  send_redis-data:
  bitwarden-data:
  data-redis:
  conduit-data:
  jellyfin-data: