docker-compose.secure.yml

version: "3.7"

services:
  plex:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.plex.tls.certresolver: prod
      traefik.http.routers.plex.rule: Host(`${PLEX_HOST}`)
      traefik.http.services.plex.loadbalancer.server.port: 32400
      traefik.http.services.plex.loadbalancer.server.scheme: http
    ports:
      - "127.0.0.1:32400:32400/tcp"

  jellyfin:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.jellyfin.tls.certresolver: prod
      traefik.http.routers.jellyfin.rule: Host(`${JELLYFIN_HOST}`)
      traefik.http.services.jellyfin.loadbalancer.server.port: 8096
      traefik.http.services.jellyfin.loadbalancer.server.scheme: http
    ports:
      - "127.0.0.1:8096:8096/tcp"
      - "127.0.0.1:7359:7359/udp"

  nzbhydra:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.nzbhydra.tls.certresolver: prod
      traefik.http.routers.nzbhydra.rule: Host(`${NZBHYDRA_HOST}`)
      traefik.http.routers.nzbhydra.middlewares: hsts-header
    ports:
      - "127.0.0.1:5076:5076/tcp"

  ombi:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.ombi.tls.certresolver: prod
      traefik.http.routers.ombi.rule: Host(`${OMBI_HOST}`)
      traefik.http.routers.ombi.middlewares: hsts-header
    ports:
      - "127.0.0.1:3579:3579/tcp"

  prowlarr:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.prowlarr.tls.certresolver: prod
      traefik.http.routers.prowlarr.rule: Host(`${PROWLARR_HOST}`)
      traefik.http.routers.prowlarr.middlewares: hsts-header, ipallowlist
    ports:
      - "127.0.0.1:9696:9696/tcp"

  nzbget:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.nzbget.tls.certresolver: prod
      traefik.http.routers.nzbget.rule: Host(`${NZBGET_HOST}`)
      traefik.http.routers.nzbget.middlewares: hsts-header, ipallowlist
    ports:
      - "127.0.0.1:6789:6789/tcp"

  sonarr:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.sonarr.tls.certresolver: prod
      traefik.http.routers.sonarr.rule: Host(`${SONARR_HOST}`)
      traefik.http.routers.sonarr.middlewares: hsts-header, ipallowlist
    ports:
      - "127.0.0.1:8989:8989/tcp"

  radarr:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.radarr.tls.certresolver: prod
      traefik.http.routers.radarr.rule: Host(`${RADARR_HOST}`)
      traefik.http.routers.radarr.middlewares: hsts-header, ipallowlist
    ports:
      - "127.0.0.1:7878:7878/tcp"

  duplicati:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.duplicati.tls.certresolver: prod
      traefik.http.routers.duplicati.rule: Host(`${DUPLICATI_HOST}`)
      traefik.http.routers.duplicati.middlewares: hsts-header, basicauth, ipallowlist
    ports:
      - "127.0.0.1:8200:8200/tcp"

  netdata:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.netdata.tls.certresolver: prod
      traefik.http.routers.netdata.rule: Host(`${NETDATA_HOST}`)
      traefik.http.routers.netdata.middlewares: hsts-header, basicauth, ipallowlist
    ports:
      - "127.0.0.1:19999:19999/tcp"

  overseerr:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.overseerr.tls.certresolver: prod
      traefik.http.routers.overseerr.rule: Host(`${OVERSEERR_HOST}`)
      traefik.http.routers.overseerr.middlewares: hsts-header, ipallowlist
    ports:
      - "127.0.0.1:5055:5055/tcp"

  syncthing:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.syncthing.tls.certresolver: prod
      traefik.http.routers.syncthing.rule: Host(`${SYNCTHING_HOST}`)
      traefik.http.routers.syncthing.middlewares: hsts-header, basicauth, ipallowlist
    ports:
      - "127.0.0.1:8384:8384/tcp"
      - "22000:22000/tcp"
      - "22000:22000/udp"
      - "21027:21027/udp"

  # https://hub.docker.com/_/traefik/
  traefik:
    image: traefik:v3.1.4@sha256:6215528042906b25f23fcf51cc5bdda29e078c6e84c237d4f59c00370cb68440
    restart: unless-stopped
    environment:
      TZ: "${TZ}"
    networks:
      - default
    ports:
      - 80:80/tcp
      - 443:443/tcp
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${CONFIG_DIR}/traefik:/etc/traefik:rw
    command:
      - "--log.level=INFO"
      - "--api=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesResolvers.prod.acme.tlschallenge=true"
      - "--certificatesresolvers.prod.acme.storage=/etc/traefik/acme.json"
      - "--certificatesresolvers.prod.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.prod.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
      - "--certificatesResolvers.staging.acme.tlschallenge=true"
      - "--certificatesresolvers.staging.acme.storage=/etc/traefik/acme.json"
      - "--certificatesresolvers.staging.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.staging.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.traefik.tls.certresolver: prod
      traefik.http.routers.traefik.rule: Host(`${TRAEFIK_HOST}`)
      traefik.http.routers.traefik.middlewares: hsts-header, basicauth
      traefik.http.routers.traefik.service: api@internal
      traefik.http.middlewares.test-auth.basicauth.users: "${BASICAUTH_USERS}"
      traefik.http.middlewares.basicauth.basicauth.usersfile: /etc/traefik/.htpasswd
      traefik.http.middlewares.ipallowlist.ipwhitelist.sourcerange: "${IPALLOWLIST}"
      traefik.http.middlewares.hsts-header.headers.customResponseHeaders.Strict-Transport-Security: "max-age=63072000"