docker-compose.yml

version: "3.8"

# common variables
x-common-variables: &common-variables
  PUID: "${PUID}"
  PGID: "${PGID}"
  TZ: "${TIMEZONE}"

# logging common
x-logging-common: &logging-common
  driver: fluentd

# logging options
x-logging-options: &logging-options
  fluentd-address: ${MACHINE_IP:-localhost}:24224
  fluentd-async-connect: "true"

# minio common
x-minio-common: &minio-common
  image: pixelchrome/minio-arm
  command: server --console-address ":9001" http://minio{1...2}/data{1...2}
  expose:
    - "9000"
    - "9001"
  environment:
    MINIO_ROOT_USER: ${MINIO_ROOT_USER}
    MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY}
    MINIO_SECRET_KEY: ${MINIO_SECRET_KEY}
  healthcheck:
    test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
    interval: 30s
    timeout: 20s
    retries: 3

services:
  traefik:
    image: traefik
    container_name: traefik
    restart: always
    depends_on:
      - fluent-bit
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80/tcp"
      - "443:443/tcp"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "traefik:/etc/traefik/"
      - "/etc/keys/ssl:/etc/traefik/certs"
      - "./provision/traefik/config/dynamic_config.yml:/etc/traefik/config/dynamic_config.yml"
    environment:
      <<: *common-variables
    command:
      - "--global.checknewversion=true"
      - "--global.sendanonymoususage=false"
      - "--api.dashboard=true"

      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.file.directory=/etc/traefik/config"
      - "--providers.file.watch=true"
      - "--entrypoints.dnstcp.address=:53/tcp"
      - "--entrypoints.dnsudp.address=:53/udp"

      - "--entrypoints.http.address=:80/tcp"

      - "--entrypoints.http.http.redirections.entryPoint.to=https"
      - "--entrypoints.http.http.redirections.entryPoint.scheme=https"

      - "--entrypoints.https.address=:443/tcp"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=https"
      - "traefik.http.routers.traefik.tls=true"

      - "traefik.http.routers.traefik.rule=Host(`traefik.${DOMAIN}`)"
      - "traefik.http.routers.traefik.service=api@internal"
    logging:
      <<: *logging-common
      options:
        <<: *logging-options
        tag: traefik.logs

  netatalk:
    image: dubodubonduponey/netatalk:v1
    container_name: netatalk
    hostname: netatalk
    restart: unless-stopped
    depends_on:
      - fluent-bit
    ports:
      - "548:548"
    volumes:
      # - ./provision/netatalk/afp.conf:/data/afp.conf:ro
      - ${DATA_PATH}/timemachine:/media/timemachine
      - ${DATA_PATH}/study:/media/share
    environment:
      <<: *common-variables
      UIDS: "${PUID}"
      GIDS: "${PGID}"
      USERS: "${AFP_USER}"
      PASSWORDS: "${AFP_PASSWORD}"
      NAME: rpi
      AVAHI_NAME: rpi
    cap_add:
      - NET_BIND_SERVICE
      - CHOWN
      - FOWNER
      - SETUID
      - SETGID
      - DAC_OVERRIDE
    cap_drop:
      - ALL
    network_mode: host
    logging:
      <<: *logging-common
      options:
        <<: *logging-options
        tag: netatalk.logs

  consul:
    image: consul
    container_name: consul
    depends_on:
      - fluent-bit
    restart: always
    ports:
      - "8500:8500"
      - "8600:8600/tcp"
      - "8600:8600/udp"
    command: "agent -config-file=/consul/config/server.json"
    volumes:
      - "./provision/consul/config/server.json:/consul/config/server.json"
      - "consul-data:/consul/data/"
    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.consul.entrypoints=https"
      - "traefik.http.routers.consul.tls=true"

      - "traefik.http.routers.consul.service=consul"

      - "traefik.http.routers.consul.rule=Host(`consul.${DOMAIN}`)"
      - "traefik.http.services.consul.loadbalancer.server.port=8500"
    logging:
      <<: *logging-common
      options:
        <<: *logging-options
        tag: consul.logs

  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    depends_on:
      - traefik
      - fluent-bit
    environment:
      <<: *common-variables
      WEBPASSWORD: "${PIHOLE_PASSWORD}"
      ServerIP: "${PIHOLE_IP}"
      VIRTUAL_HOST: pihole.${DOMAIN}
    # Volumes store your data between container upgrades
    volumes:
      - "${APPDATA_PATH}/pihole/etc/pihole/:/etc/pihole/"
      - "${APPDATA_PATH}/pihole/etc/dnsmasq.d/:/etc/dnsmasq.d/"
      - "./provision/pihole/etc-pihole/custom.list:/etc/pihole/custom.list"
    cap_add:
      - NET_ADMIN
    restart: unless-stopped
    dns:
      - 127.0.0.1
      - 8.8.8.8
      - 1.1.1.1
    ulimits:
      nofile:
        soft: 512
        hard: 1024
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pihole.entrypoints=https"
      - "traefik.http.routers.pihole.tls=true"
      - "traefik.http.routers.pihole.rule=Host(`pihole.${DOMAIN}`)"
      - "traefik.http.routers.pihole.middlewares=pihole-prefix"
      - "traefik.http.middlewares.pihole-prefix.addPrefix.prefix=/admin"
      - "traefik.http.services.pihole.loadbalancer.server.port=80"
      - "traefik.http.services.pihole.loadbalancer.passHostHeader=true"

      - "traefik.tcp.routers.dnstcp.entrypoints=dnstcp"
      - "traefik.tcp.routers.dnstcp.rule=HostSNI(`*`)"
      - "traefik.tcp.services.pihole.loadbalancer.server.port=53"

      - "traefik.udp.routers.dnsudp.entrypoints=dnsudp"
      - "traefik.udp.services.pihole.loadbalancer.server.port=53"
    logging:
      <<: *logging-common
      options:
        <<: *logging-options
        tag: pihole.logs

  jellyfin:
    image: linuxserver/jellyfin
    container_name: jellyfin
    volumes:
      - ${APPDATA_PATH}/jellyfin/config:/config
      - ${APPDATA_PATH}/jellyfin/cache:/cache
      - ${MEDIA_PATH}/Films:/movies
      - ${MEDIA_PATH}/Series:/episodes
      - ${MEDIA_PATH}/Anime:/animes
      - ${MEDIA_PATH}/Cartoons:/cartoons
      - ${MEDIA_PATH}/Documentary:/documentary
      - ${MEDIA_PATH}/Music:/music
    network_mode: "host"
    depends_on:
      - traefik
      - pihole
      - fluent-bit
    ports:
      # for some reason jellyfin app doesn't work with traefik proxy, open port directly for local mobile clients
      - "8096:8096"
      - "7359:7359/udp"
    environment:
      <<: *common-variables
    restart: unless-stopped
    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.jellyfin.entrypoints=https"
      - "traefik.http.routers.jellyfin.tls=true"

      - "traefik.http.routers.jellyfin.service=jellyfin"

      - "traefik.http.routers.jellyfin.rule=Host(`jellyfin.${DOMAIN}`)"
      - "traefik.http.services.jellyfin.loadbalancer.server.port=8096"
    logging:
      <<: *logging-common
      options:
        <<: *logging-options
        tag: jellyfin.logs

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    hostname: grafana_server
    depends_on:
      - traefik
      - fluent-bit
    environment:
      <<: *common-variables
      GF_SECURITY_ADMIN_USER: "${GRAFANA_SECURITY_ADMIN_USER}"
      GF_SECURITY_ADMIN_PASSWORD: "${GRAFANA_SECURITY_ADMIN_PASSWORD}"
      GF_USERS_ALLOW_SIGN_UP: "${GRAFANA_USERS_ALLOW_SIGN_UP}"
    volumes:
      - "grafana:/var/lib/grafana/"
      - "./provision/grafana/configs/datasources:/etc/grafana/provisioning/datasources"
      - "./provision/grafana/configs/dashboards:/etc/grafana/provisioning/dashboards"
    restart: unless-stopped
    ports:
      - "3000:3000"
    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.grafana.entrypoints=https"
      - "traefik.http.routers.grafana.tls=true"
      - "traefik.http.routers.grafana.rule=Host(`grafana.${DOMAIN}`)"

      - "traefik.http.routers.grafana.service=grafana"

      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
    logging:
      <<: *logging-common
      options:
        <<: *logging-options
        tag: grafana.logs

  loki:
    image: grafana/loki
    container_name: loki
    volumes:
      - ./provision/loki/:/etc/loki/
    command: -config.file=/etc/loki/loki.yml
    ports:
      - "3100:3100"

  fluent-bit:
    image: fluent/fluent-bit
    container_name: fluent-bit
    depends_on:
      - loki
    ports:
      - "24224:24224"
      - "24224:24224/udp"
      - "2020:2020"
    configs:
      - source: fluent-bit
        target: /fluent-bit/etc/fluent-bit.conf
      - source: fluent-bit-parsers
        target: /fluent-bit/etc/parsers.conf

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent
    container_name: qbittorrent
    depends_on:
      - traefik
      - fluent-bit
    environment:
      <<: *common-variables
      WEBUI_PORT: 8081
    volumes:
      - ${APPDATA_PATH}/qbittorrent/config:/config
      - ${DOWNLOAD_PATH}:/downloads
    ports:
      - "6881:6881"
      - "6881:6881/udp"
      - "8081:8081"
    restart: unless-stopped
    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.qbittorrent.entrypoints=https"
      - "traefik.http.routers.qbittorrent.tls=true"
      - "traefik.http.routers.qbittorrent.rule=Host(`qbittorrent.${DOMAIN}`)"

      - "traefik.http.routers.qbittorrent.service=qbittorrent"

      - "traefik.http.services.qbittorrent.loadbalancer.server.port=8081"
    logging:
      <<: *logging-common
      options:
        <<: *logging-options
        tag: qbittorrent.logs

  minio1:
    <<: *minio-common
    hostname: minio1
    container_name: minio1
    volumes:
      - minio1-data1:/data1
      - minio1-data2:/data2

  minio2:
    <<: *minio-common
    hostname: minio2
    container_name: minio2
    volumes:
      - minio2-data1:/data1
      - minio2-data2:/data2

  nginx:
    image: nginx:1.19.2-alpine
    container_name: minio-nginx
    hostname: nginx
    volumes:
      - ./provision/minio/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
    ports:
      - "9000:9000"
      - "9001:9001"
    depends_on:
      - traefik
      - fluent-bit
      - minio1
      - minio2
    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.minio.entrypoints=https"
      - "traefik.http.routers.minio.tls=true"
      - "traefik.http.routers.minio.rule=Host(`minio.${DOMAIN}`)"

      - "traefik.http.routers.minio.service=minio"

      - "traefik.http.services.minio.loadbalancer.server.port=9000"
    logging:
      <<: *logging-common
      options:
        <<: *logging-options
        tag: minio-nginx.logs

volumes:
  traefik:
    name: traefik
  grafana:
    name: grafana
  consul-data:
    name: consul-data
    driver_opts:
      type: none
      device: ${CONSUL_DATA_PATH}/data
      o: bind
  minio1-data1:
    driver_opts:
      type: none
      device: ${MINIO_DATA_PATH}/data1-1
      o: bind
  minio1-data2:
    driver_opts:
      type: none
      device: ${MINIO_DATA_PATH}/data1-2
      o: bind
  minio2-data1:
    driver_opts:
      type: none
      device: ${MINIO_DATA_PATH}/data2-1
      o: bind
  minio2-data2:
    driver_opts:
      type: none
      device: ${MINIO_DATA_PATH}/data2-2
      o: bind

configs:
  fluent-bit:
    name: ${FLUENT_BIT_CONFIG_NAME:-fluent-bit-conf}
    file: ./provision/fluent-bit/fluent-bit.conf
  fluent-bit-parsers:
    name: fluent-bit-parsers
    file: ./provision/fluent-bit/parsers.conf