docker-compose.yml

version: '3.8'

services:

  proxz:
    image: traefik:3
    hostname: proxz
    ports:
      - target: 443
        published: 443 
        mode: host
      - target: 80
        published: 80 
        mode: host
      #- target: 25
      #  published: 25
      #  mode: host
      - target: 993
        published: 993
        mode: host
      - target: 465
        published: 465
        mode: host
      - target: 587
        published: 587
        mode: host
      - target: 4190
        published: 4190
        mode: host
    environment:
      - TZ=$TZ
      - CF_DNS_API_TOKEN_FILE=/run/secrets/cloudflare_api_token
      - TRAEFIK_API=true
      - TRAEFIK_GLOBAL_SENDANONYMOUSUSAGE=false
      - TRAEFIK_GLOBAL_CHECKNEWVERSION=false
      - TRAEFIK_SERVERSTRANSPORT_INSECURESKIPVERIFY=true
      - TRAEFIK_ENTRYPOINTS_imap_ADDRESS=:993
      - TRAEFIK_ENTRYPOINTS_imap_PROXYPROTOCOL_TRUSTEDIPS=10.0.0.0/8
      # - TRAEFIK_ENTRYPOINTS_smtp_ADDRESS=:25
      # - TRAEFIK_ENTRYPOINTS_smtp_PROXYPROTOCOL_TRUSTEDIPS=10.0.0.0/8
      - TRAEFIK_ENTRYPOINTS_smtps_ADDRESS=:465
      - TRAEFIK_ENTRYPOINTS_smtps_PROXYPROTOCOL_TRUSTEDIPS=10.0.0.0/8
      - TRAEFIK_ENTRYPOINTS_msa_ADDRESS=:587
      - TRAEFIK_ENTRYPOINTS_msa_PROXYPROTOCOL_TRUSTEDIPS=10.0.0.0/8
      - TRAEFIK_ENTRYPOINTS_sieve_ADDRESS=:4190
      - TRAEFIK_ENTRYPOINTS_sieve_PROXYPROTOCOL_TRUSTEDIPS=10.0.0.0/8
      - TRAEFIK_ENTRYPOINTS_http_ADDRESS=:80
      - TRAEFIK_ENTRYPOINTS_http_HTTP_REDIRECTIONS_ENTRYPOINT_TO=https
      - TRAEFIK_ENTRYPOINTS_https_ADDRESS=:443
      - TRAEFIK_ENTRYPOINTS_https_HTTP_TLS_CERTRESOLVER=letsencrypt
      - TRAEFIK_ENTRYPOINTS_https_HTTP_TLS_DOMAINS_0_MAIN=$domain
      - TRAEFIK_ENTRYPOINTS_https_HTTP_TLS_DOMAINS_0_SANS=*.$domain
      - TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_STORAGE=/etc/certz/acme.json
      - TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_EMAIL=$email
      - TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_DNSCHALLENGE_PROVIDER=cloudflare
      - TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_DNSCHALLENGE_RESOLVERS=1.1.1.1:53
      - TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT=false
      - TRAEFIK_PROVIDERS_DOCKER_DEFAULTRULE=Host(`{{ `{{ index .Labels "com.docker.swarm.service.name" | splitList "_" | last }}` }}.$domain`)
      - TRAEFIK_PROVIDERS_FILE_FILENAME=/traefik_file_config.yml
    configs:
      - source: traefik_file_config
        target: /traefik_file_config.yml
    secrets: 
      - cloudflare_api_token
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - certz:/etc/certz
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.routers.api.service: 'api@internal'
      
  backup:
    image: azinchen/duplicacy:latest
    hostname: backup
    environment:
      - TZ=$TZ
      - RUN_JOB_IMMEDIATELY=false
      - BACKUP_CRON=0 1 * * *
      - FILTER_PATTERNS=+pics/;+pics/upload/*;+pics/profile/*;+pics/backups/*;+pics/library/*;-pics/*;+git/*;+git-config/*;+uisp/;+uisp/unms/;+uisp/unms/unms-backups/*;+uisp/unms/config-backups/*;-uisp/*;+unifi/;+unifi/backup/*;-unifi/*;-esp/.*
      - STORAGE_URL=$BACKUP_STORAGE_URL
      - SNAPSHOT_ID=$BACKUP_ID
    secrets:
      - duplicacy_preferences
    volumes:
      - backup:/config
      - unifi:/data/unifi
      - uisp:/data/uisp
      - hass:/data/hass
      - esp:/data/esp
      - git:/data/git
      - git-config:/data/git-config
      - pics:/data/pics
      - docs:/data/docs
      
  restore:
    image: saspus/duplicacy-web:latest
    hostname: restore
    environment:
      - TZ=$TZ
      - GRP_ID=3875
      - USR_ID=3875
    volumes:
      - restore:/config
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.services.restore.loadbalancer.server.port: 3875
      traefik.http.routers.restore.entrypoints: 'https'

  esp:
    image: esphome/esphome:latest
    hostname: esp
    command: ["-q", "dashboard", "/config"]
    deploy:
      mode: replicated
      replicas: 0
      restart_policy:
        condition: none
    environment:
      - TZ=$TZ
      - ESPHOME_DASHBOARD_USE_PING=true
    volumes:
      - esp:/config
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.services.esp.loadbalancer.server.port: '6052'
      traefik.http.routers.esp.entrypoints: 'https'

  uisp:
    image: nico640/docker-unms:latest
    hostname: uisp
    deploy:
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 0
      restart_policy:
        condition: none
    ports:
      - target: 2055
        published: 2055
        protocol: 'udp'
        mode: 'host'
    environment:
      - TZ=$TZ
      - QUIET_MODE=1
    volumes:
      - uisp:/config
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.services.uisp.loadbalancer.server.port: 443
      traefik.http.services.uisp.loadbalancer.server.scheme: 'https'
      traefik.http.routers.uisp.entrypoints: 'https'

  unifi:
    image: ghcr.io/jacobalberty/unifi-docker:v9
    hostname: unifi
    user: unifi
    environment:
      - TZ=$TZ
    ports:
      - target: 3478
        published: 3478
        protocol: 'udp'
        mode: 'host'
      - target: 8080
        published: 8080
        mode: 'host'
    volumes:
      - unifi:/unifi/data
      - unifi-log:/unifi/logs
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.services.unifi.loadbalancer.server.port: 8443
      traefik.http.services.unifi.loadbalancer.server.scheme: 'https'
      traefik.http.routers.unifi.entrypoints: 'https'

  hass:
    image: ghcr.io/home-assistant/home-assistant:stable
    hostname: hass
    privileged: true
    environment:
      - TZ=$TZ
    devices:
      - /dev/*:/dev/*
    volumes:
      - hass:/config
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.services.hass.loadbalancer.server.port: 8123
      traefik.http.routers.hass.entrypoints: 'https'
      
  dash:
    image: grafana/grafana-oss:latest
    hostname: dash
    environment:
      - TZ=$TZ
    volumes:
      - grafana:/var/lib/grafana
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.routers.dash.entrypoints: 'https'
      
  mon: 
    image: gcr.io/cadvisor/cadvisor:v0.47.1
    hostname: mon
    deploy:
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 0
      restart_policy:
        condition: none
    environment:
      - TZ=$TZ
    privileged: true
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro 
      - /var/lib/docker/:/mnt/docker:ro
    networks:
      - proxz
    devices:
      - /dev/kmsg
    labels:
      traefik.enable: 'true'
      traefik.http.routers.mon.entrypoints: 'https'
      
  prom:
    image: prom/prometheus:latest
    hostname: prom
    deploy:
      endpoint_mode: dnsrr
      mode: replicated
      #replicas: 0
      restart_policy:
        condition: none
    environment:
      - TZ=$TZ
    configs:
      - source: prometheus_config
        target: /etc/prometheus/prometheus.yml
    volumes:
      - prometheus:/prometheus
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.routers.prom.entrypoints: 'https'
      
  collectd-exporter:
    image: prom/collectd-exporter:master
    hostname: collectd-exporter
    command: --collectd.listen-address=":25826"
    deploy:
      endpoint_mode: dnsrr
      mode: replicated
      #replicas: 0
      restart_policy:
        condition: none
    ports:
      - target: 25826
        published: 25826
        protocol: 'udp'
        mode: 'host'
    environment:
      - TZ=$TZ
        
  speed:
    image: openspeedtest/latest
    hostname: speed
    environment:
      - TZ=$TZ
    ports:
      - target: 3000
        published: 3000
        mode: 'host'
      - target: 3001
        published: 3001
        mode: 'host'
        
  certdumper:
    image: ghcr.io/kereis/traefik-certs-dumper:latest
    hostname: certdumper
    restart: unless-stopped
    depends_on:
      - proxz
    volumes:
      - certz:/traefik:ro
      - mail:/output
    environment:
      - TZ=$TZ
      - DOMAIN=$domain
    
  mail:
    image: stalwartlabs/stalwart:latest
    hostname: mail
    ports:
      - target: 25
        published: 25 
        mode: host
    labels:
      traefik.enable: 'true'
      
      traefik.http.services.mail.loadbalancer.server.port: 8080
      traefik.http.routers.mail.entrypoints: 'https'

      # traefik.tcp.routers.smtp.rule: HostSNI(`*`)
      # traefik.tcp.routers.smtp.entrypoints: 'smtp'
      # traefik.tcp.routers.smtp.service: 'smtp'
      # traefik.tcp.services.smtp.loadbalancer.server.port: 25
      # traefik.tcp.services.smtp.loadbalancer.proxyProtocol.version: 2

      traefik.tcp.routers.jmap.rule: HostSNI(`*`)
      traefik.tcp.routers.jmap.tls.passthrough: 'true'
      traefik.tcp.routers.jmap.entrypoints: 'https'
      traefik.tcp.routers.jmap.service: 'jmap'
      traefik.tcp.services.jmap.loadbalancer.server.port: 443
      traefik.tcp.services.jmap.loadbalancer.proxyProtocol.version: 2

      traefik.tcp.routers.smtps.rule: HostSNI(`*`)
      traefik.tcp.routers.smtps.tls.passthrough: 'true'
      traefik.tcp.routers.smtps.entrypoints: 'smtps'
      traefik.tcp.routers.smtps.service: 'smtps'
      traefik.tcp.services.smtps.loadbalancer.server.port: 465
      traefik.tcp.services.smtps.loadbalancer.proxyProtocol.version: 2

      traefik.tcp.routers.imaps.rule: HostSNI(`*`)
      traefik.tcp.routers.imaps.tls.passthrough: 'true'
      traefik.tcp.routers.imaps.entrypoints: 'imap'
      traefik.tcp.routers.imaps.service: 'imaps'
      traefik.tcp.services.imaps.loadbalancer.server.port: 993
      traefik.tcp.services.imaps.loadbalancer.proxyProtocol.version: 2
    volumes:
      - mail:/opt/stalwart
    networks:
      - proxz
      
  users:
    image: lldap/lldap:stable
    hostname: users
    deploy:
      endpoint_mode: dnsrr
    ports:
      - target: 3890
        published: 3890
        mode: 'host'
    environment:
      - TZ=$TZ
      - LLDAP_JWT_SECRET_FILE=/run/secrets/LLDAP_JWT_SECRET
      - LLDAP_LDAP_USER_PASS_FILE=/run/secrets/LLDAP_LDAP_USER_PASS
      - LLDAP_LDAP_BASE_DN=$base_dn
    secrets:
      - LLDAP_JWT_SECRET
      - LLDAP_LDAP_USER_PASS
    volumes:
      - users:/data
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.routers.users.entrypoints: 'https' 
      traefik.http.services.users.loadbalancer.server.port: 17170
      
  promtail:
    image: grafana/promtail:latest
    hostname: promtail
    deploy:
      endpoint_mode: dnsrr
    environment:
      - TZ=$TZ
    ports:
      - target: 514
        published: 1514
        mode: 'host'
    configs:
      - source: promtail_config
        target: /etc/promtail/config.yml
    volumes:
      - /mnt/docker/containers:/var/lib/docker/containers:ro

  mqtt:
    image: eclipse-mosquitto
    hostname: mqtt
    command: mosquitto -c /mosquitto-no-auth.conf
    deploy:
      endpoint_mode: dnsrr
    environment:
      - TZ=$TZ
      
  mqtt_io:
    image: flyte/mqtt-io
    hostname: mqtt-io
    deploy:
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 0
      restart_policy:
        condition: none
    environment:
      - TZ=$TZ
    #configs:
      #- source: mqtt_io_config
      #  target: /config.yml
      
  git:
    image: gitea/gitea:latest-rootless
    hostname: git
    deploy:
      endpoint_mode: dnsrr
    environment:
      - TZ=$TZ
    ports:
      - target: 2222
        published: 2222
        mode: 'host'
    volumes:
      - git:/var/lib/gitea
      - git-config:/etc/gitea
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.services.git.loadbalancer.server.port: 3000
      traefik.http.routers.git.entrypoints: 'https'
      
  raw:
    image: ghcr.io/izer-xyz/gitea-pages:latest
    hostname: raw
    environment:
      - TZ=$TZ
      - GITEA_HOST=git:3000
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.services.raw.loadbalancer.server.port: 80
      traefik.http.routers.raw.entrypoints: 'https'    
      traefik.http.routers.jmap-client.rule: Host(`m.$domain`)
      traefik.http.routers.jmap-client.entrypoints: 'https' 
      
  dns:
    image: pihole/pihole:latest
    hostname: dns
    ports:
      - target: 53
        published: 53
        mode: 'host'
      - target: 53
        published: 53
        protocol: 'udp'
        mode: 'host'
    environment:
      - TZ=$TZ
      - FTLCONF_dns_interface=eth1
      - FTLCONF_dns_revServers=true,10.0.0.0/8,10.0.0.1,$domain
      - FTLCONF_webserver_domain=dns.$domain
    volumes:
      - pihole:/etc/pihole
      - dnsmasq:/etc/dnsmasq.d
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.services.dns.loadbalancer.server.port: 80
      traefik.http.routers.dns.entrypoints: 'https'

  drop:
    image: lscr.io/linuxserver/pairdrop:latest
    hostname: drop
    environment:
      - PUID=1000 # UID to run the application as
      - PGID=1000 # GID to run the application as
      - WS_FALLBACK=false # Set to true to enable websocket fallback if the peer to peer WebRTC connection is not available to the client.
      - RATE_LIMIT=false # Set to true to limit clients to 1000 requests per 5 min.
      - RTC_CONFIG=false # Set to the path of a file that specifies the STUN/TURN servers.
      - DEBUG_MODE=false # Set to true to debug container and peer connections.
      - TZ=$TZ
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.services.drop.loadbalancer.server.port: 3000
      traefik.http.routers.drop.entrypoints: 'https'
      
  id:
    image: ghcr.io/pocket-id/pocket-id:v1
    hostname: id
    environment:
      - PUID=1001
      - PGID=1001
      - TZ=$TZ
      - APP_URL=https://id.$domain
    volumes:
      - id:/app/data
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.routers.id.entrypoints: 'https'
      traefik.http.services.id.loadbalancer.server.port: 1411

  docs:
    image: ghcr.io/papra-hq/papra:latest
    hostname: docs
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=$TZ
      - AUTH_SECRET=GkjSvfZn1exjcPk3UWdfGfkwji6viPNuAJOA3dVRQ6p0COpy
      - APP_BASE_URL=https://docs.$domain
      - INGESTION_FOLDER_IS_ENABLED=true
      - |- 
        AUTH_PROVIDERS_CUSTOMS=[{
          "providerId": "${domain}",
          "providerName": "${domain}",
          "clientId": "${docs_client_id}",
          "clientSecret": "${docs_client_secret}",
          "type": "oidc",
          "discoveryUrl": "https://id.${domain}/.well-known/openid-configuration",
          "scopes": ["openid", "profile", "email"]
        }]
    volumes:
      - docs:/app/app-data
      - docs-ingest:/app/ingestion
    networks:
      - proxz
    labels:
      traefik.enable: 'true'
      traefik.http.routers.docs.entrypoints: 'https'
      traefik.http.services.docs.loadbalancer.server.port: 1221
      
volumes:
  certz:
  backup:
  restore:
  esp:
  uisp:
  unifi:
  unifi-log:
    driver_opts:
      type: tmpfs
      device: tmpfs
  hass:
  grafana:
  prometheus:
  mail:
  users:
  git:
  git-config:
  caddy:
  pihole:
  dnsmasq:
  id:
  docs:
  docs-ingest:
  pics:

configs: 
  traefik_file_config:
    external: true
  prometheus_config:
    external: true
  promtail_config:
    external: true
  syslog_ng_config:
    external: true
  mqtt_io_config:
    external: true

secrets:
  cloudflare_api_token:
    external: true
  duplicacy_preferences:
    external: true
  LLDAP_JWT_SECRET:
    external: true
  LLDAP_LDAP_USER_PASS:
    external: true

networks:
  proxz:
    driver: overlay