docker-compose-arm64v8.yml

version: '3'

services:

  # a DB server; the underlying DB for NextCloud
  postgres:
    image: arm64v8/postgres:12-alpine
    container_name: postgres
    restart: unless-stopped
    ports:
      - 5432:5432
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/postgres:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    logging:
      driver: "none"

  # a key value store; acts as cache for NextCloud
  redis:
    image: arm64v8/redis:6-alpine3.12
    container_name: redis
    command: redis-server --requirepass somedummypass # this is not exposed and used only in this internal network. It is required because of nextcloud
    restart: unless-stopped

  # maintenance processes that must be run regularly in order for Nextcloud to run properly
  # same image used for the actual nextcloud service below
  nextcloud-cron:
    image: nextcloud:21.0.0-fpm-alpine
    restart: unless-stopped
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/nextcloud:/var/www/html
      - /etc/localtime:/etc/localtime:ro
    entrypoint: /cron.sh
    environment:
      - POSTGRES_HOST=postgres
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - REDIS_HOST=redis
      - REDIS_HOST_PASSWORD=somedummypass
    depends_on:
      - postgres
      - redis
    logging:
      driver: "none"

  # a Dropbox alternative, self-hosted
  nextcloud:
    image: nextcloud:21.0.0-fpm-alpine
    container_name: nextcloud
    restart: unless-stopped
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/nextcloud:/var/www/html
      - /etc/localtime:/etc/localtime:ro
    environment:
      - POSTGRES_HOST=postgres
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - REDIS_HOST=redis
      - REDIS_HOST_PASSWORD=somedummypass
    depends_on:
      - postgres
      - redis
      - nextcloud-cron
    logging:
      driver: "none"

  # the actual php server for NextCloud
  nginx-nextcloud-fpm-front:
    build: ./nginx-nextcloud-fpm-front
    container_name: nginx-nextcloud-fpm-front
    restart: unless-stopped
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/nextcloud:/var/www/html:ro
    env_file:
      - nginx-nextcloud-fpm-front.env
    depends_on:
      - nextcloud
    expose:
      - 80
    labels:
      - traefik.enable=true
      - traefik.http.routers.nextcloud.rule=Host(`${NEXTCLOUD_HOST}`)
      - traefik.http.routers.nextcloud.entrypoints=websecure
      - traefik.http.routers.nextcloud.tls.certresolver=myresolver
    logging:
      driver: "none"

  # torrent client
  transmission:
    image: linuxserver/transmission:arm64v8-latest
    container_name: transmission
    restart: unless-stopped
    environment:
      - TZ=Europe/London
      - PUID=0
      - PGID=0
      - USER=${TRANSMISSION_USER}
      - PASS=${TRANSMISSION_PASSWORD}
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/MEDIA:/MEDIA
      - ${DATA_VOLUME_BASE_PATH}/media_services/transmission/config:/config
    ports:
      - 51413:51413
      - 51413:51413/udp
    expose:
      - 9091
    labels:
      - traefik.enable=true
      - traefik.http.routers.transmission.rule=Host(`${TRANSMISSION_HOST}`)
      - traefik.http.routers.transmission.entrypoints=websecure
      - traefik.http.routers.transmission.tls.certresolver=myresolver
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    logging:
      driver: "none"

  # tracker sites proxy for the other two below
  jackett:
    image: linuxserver/jackett:arm64v8-latest
    container_name: jackett
    restart: unless-stopped
    env_file:
      - jackett.env
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/jackett/config:/config
    expose:
      - 9117
    labels:
      - traefik.enable=true
      - traefik.http.routers.jackett.rule=Host(`${JACKETT_HOST}`)
      - traefik.http.routers.jackett.entrypoints=websecure
      - traefik.http.routers.jackett.tls.certresolver=myresolver
    depends_on:
      - flaresolverr
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    logging:
      driver: "none"

  flaresolverr:
    # DockerHub mirror flaresolverr/flaresolverr:latest
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    restart: unless-stopped
    environment:
      - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none}
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    logging:
      driver: "none"

  # to look for TV series
  sonarr:
    image: linuxserver/sonarr:arm64v8-latest
    container_name: sonarr
    restart: unless-stopped
    environment:
      - TZ=Europe/London
      - PUID=0
      - PGID=0
    depends_on:
      - jackett
      - transmission
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/sonarr/config:/config
      - ${DATA_VOLUME_BASE_PATH}/media_services/MEDIA:/MEDIA
    expose:
      - 8989
    labels:
      - traefik.enable=true
      - traefik.http.routers.sonarr.rule=Host(`${SONARR_HOST}`)
      - traefik.http.routers.sonarr.entrypoints=websecure
      - traefik.http.routers.sonarr.tls.certresolver=myresolver
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    logging:
      driver: "none"

  # to look for movies
  radarr:
    image: linuxserver/radarr:arm64v8-latest
    container_name: radarr
    restart: unless-stopped
    environment:
      - TZ=Europe/London
      - PUID=0
      - PGID=0
    depends_on:
      - jackett
      - transmission
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/radarr/config:/config
      - ${DATA_VOLUME_BASE_PATH}/media_services/MEDIA:/MEDIA
    expose:
      - 7878
    labels:
      - traefik.enable=true
      - traefik.http.routers.radarr.rule=Host(`${RADARR_HOST}`)
      - traefik.http.routers.radarr.entrypoints=websecure
      - traefik.http.routers.radarr.tls.certresolver=myresolver
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    logging:
      driver: "none"

  # subtitle download with integration with radarr and sonarr
  bazarr:
    image: linuxserver/bazarr:arm64v8-latest
    container_name: bazarr
    restart: unless-stopped
    environment:
      - TZ=Europe/London
      - PUID=0
      - PGID=0
    depends_on:
      - radarr
      - sonarr
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/bazarr/config:/config
      - ${DATA_VOLUME_BASE_PATH}/media_services/MEDIA:/MEDIA
    expose:
      - 6767
    labels:
      - traefik.enable=true
      - traefik.http.routers.bazarr.rule=Host(`${BAZARR_HOST}`)
      - traefik.http.routers.bazarr.entrypoints=websecure
      - traefik.http.routers.bazarr.tls.certresolver=myresolver
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    logging:
      driver: "none"

  # NFS v4 server
  nfs:
    image: itsthenetwork/nfs-server-alpine:latest-arm
    container_name: nfs
    restart: unless-stopped
    environment:
      - TZ=Europe/London
      - READ_ONLY=true
      - SHARED_DIRECTORY=/media
      - PERMITTED="192.168.0.*"
    ports:
      - 2049:2049
    privileged: true
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/media_services/MEDIA:/media:ro

  # updates your no ip DNS. Useful when you want to use a CNAME for your actual DNS server records... E.g. sub.domain.com -> CNAME -> my.dynamic.noip.com
  rpi-noip:
    image: hypriot/rpi-noip
    container_name: rpi-noip
    restart: unless-stopped
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/noip/config:/usr/local/etc # must supply a valid configuration file inside this folder, otherwise refer to the image on how to build one first.
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    logging:
      driver: "none"

  homeassistant:
    container_name: homeassistant
    image: homeassistant/odroid-n2-homeassistant
    restart: unless-stopped
    network_mode: host
    environment:
      - TZ=Europe/Lisbon
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/homeassistant/config:/config
    labels:
      - traefik.enable=true
      - traefik.http.routers.homeassistant.rule=Host(`${HOMEASSISTANT_HOST}`)
      - traefik.http.routers.homeassistant.entrypoints=websecure
      - traefik.http.routers.homeassistant.tls.certresolver=myresolver
      - traefik.http.services.homeassistant.loadbalancer.server.port=8123 # don't know why this is necessary. other work simply using the "expose" key
    depends_on:
      - postgres
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    logging:
      driver: "none"

  # a youtubedl frontend
  alltube:
    container_name: alltube
    build: ./alltube
    restart: unless-stopped
    expose:
      - 80
    labels:
      - traefik.enable=true
      - traefik.http.routers.alltube.rule=Host(`${ALLTUBE_HOST}`)
      - traefik.http.routers.alltube.entrypoints=websecure
      - traefik.http.routers.alltube.tls.certresolver=myresolver
      - traefik.http.routers.alltube.middlewares=alltube-auth
      - traefik.http.middlewares.alltube-auth.basicauth.usersfile=/basic-auth/alltube_basic_auth_users
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    logging:
      driver: "none"

  # a monitor tool for the containers: https://github.com/google/cadvisor
  cadvisor:
    container_name: cadvisor
    image: unibaktr/cadvisor:latest # FIXME: no official multi-arch images at the time...
    # FIXME: try to lower cpu usage: https://github.com/google/cadvisor/issues/2523
    command:
      - '--housekeeping_interval=60s'
      - '--docker_only'
    restart: unless-stopped
    expose:
      - 8080
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    labels:
      - traefik.enable=true
      - traefik.http.routers.cadvisor.rule=Host(`${CADVISOR_HOST}`)
      - traefik.http.routers.cadvisor.entrypoints=websecure
      - traefik.http.routers.cadvisor.tls.certresolver=myresolver
      - traefik.http.routers.cadvisor.middlewares=cadvisor-auth
      - traefik.http.middlewares.cadvisor-auth.basicauth.usersfile=/basic-auth/cadvisor_basic_auth_users
    logging:
      driver: "none"

  # password manager https://bitwarden.com/
  # this image in not the official one: https://github.com/dani-garcia/bitwarden_rs
  bitwarden:
    container_name: bitwarden
    image: bitwardenrs/server
    restart: unless-stopped
    expose:
      - 80
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/bitwarden/data:/data
    environment:
      ADMIN_TOKEN: '${BITWARDEN_ADMIN_TOKEN}'
      DATABASE_URL: '${BITWARDEN_DATABASE}'
      WEBSOCKET_ENABLED: 'true'  # Required to use websockets
      SIGNUPS_ALLOWED: 'false'   # set to false to disable signups
    labels:
      - traefik.enable=true
      - traefik.http.routers.bitwarden.rule=Host(`${BITWARDEN_HOST}`)
      - traefik.http.routers.bitwarden.entrypoints=websecure
      - traefik.http.routers.bitwarden.tls.certresolver=myresolver
    dns:
      - 1.1.1.1
      - 8.8.8.8
      - 8.8.4.4
    logging:
      driver: "none"

  # https://github.com/traefik/traefik
  # reverse proxy for our services. reads the labels, and adapts the configuration to correctly forward requests
  # according to the host names.
  traefik:
    image: arm64v8/traefik:2.4
    container_name: traefik
    restart: unless-stopped
    command:
      #- --log.level=DEBUG
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.myresolver.acme.tlschallenge=true
      #- --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
      - --certificatesresolvers.myresolver.acme.email=${ACME_EMAIL}
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
    extra_hosts:
      - host.docker.internal:172.17.0.1 # Required to be able to route into "host" network mode containers
    ports:
      - 443:443
      - 8080:8080
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/traefik/letsencrypt:/letsencrypt
      - ${DATA_VOLUME_BASE_PATH}/traefik/basic-auth:/basic-auth
      - /var/run/docker.sock:/var/run/docker.sock:ro

  # like pihole...
  adguardhome:
    image: adguard/adguardhome
    container_name: adguardhome
    restart: unless-stopped
    mac_address: de:92:b8:c6:fe:84
    cap_add:
      - NET_ADMIN
    networks:
      adguardhome_network:
        ipv4_address: 192.168.0.200
    ports:
      - 443/tcp
      - 853/tcp
      - 53/tcp
      - 53/udp
      - 67/udp
      - 68/udp
      - 80/tcp
      - 3000/tcp
    volumes:
      - ${DATA_VOLUME_BASE_PATH}/adguardhome/work:/opt/adguardhome/work
      - ${DATA_VOLUME_BASE_PATH}/adguardhome/conf:/opt/adguardhome/conf

networks:
  adguardhome_network:
    driver: macvlan
    driver_opts:
      parent: eth0
    ipam:
      config:
        - subnet: 192.168.0.0/24
          gateway: 192.168.0.1
          ip_range: 192.168.0.200/32