version: "3.9"
# Global Common Keys
#>>>>>>> Network
x-net-be: &net-be
  networks:
    - backend_net
x-net-fe: &net-fe
  networks:
    - frontend_net
x-net-socket: &net-socket
  networks:
    - socket_proxy_net
x-net-fe-be: &net-fe-be
  networks:
    - frontend_net
    - backend_net
x-net-be-socket: &net-be-socket
  networks:
    - backend_net
    - socket_proxy_net    
x-net-fe-socket: &net-fe-socket
  networks:
    - frontend_net
    - socket_proxy_net    
x-net-fe-be-socket: &net-fe-be-socket
  networks:
    - frontend_net
    - backend_net
    - socket_proxy_net   
#>>>>>>> Logging
x-logging-loki: &logging-loki
  logging:
    driver: loki
    options:
      loki-url: "http://localhost:3100/loki/api/v1/push"
      max-size: "50m"
      max-file: "2" # I am not using this
      keep-file: "true" # I am not using this
      # loki-external-labels: job=dockerlogs,lever=error
x-logging-json: &logging-json
  logging:
    driver: "json-file"
    options:
      max-size: "10M"
      max-file: "3"
#>>>>>>> Default
x-std-keys: &std-keys
  <<: *logging-json
  restart: unless-stopped
  environment:
    - TZ=$TZ
    - PUID=$PUID
    - PGID=$PGID
  volumes:
    - /etc/timezone:/etc/timezone:ro
    - /etc/localtime:/etc/localtime:ro 
  labels:
    - com.centurylinklabs.watchtower.enable=true
#>>>>>>> Logging Security
x-std-keys-sec: &std-keys-sec
  <<: *std-keys
  security_opt:
    - no-new-privileges:true
x-std-keys-unsec: &std-keys-unsec
  <<: *std-keys
x-std-keys-priv: &std-keys-privil
  <<: *std-keys
  privileged: true
# Secured
x-std-keys-sec-fe: &std-keys-sec-fe
  <<: *std-keys-sec
  <<: *net-fe
x-std-keys-sec-be: &std-keys-sec-be
  <<: *std-keys-sec
  <<: *net-be
x-std-keys-sec-socket: &std-keys-sec-socket
  <<: *std-keys-sec
  <<: *net-socket
x-std-keys-sec-fe-be: &std-keys-sec-fe-be
  <<: *std-keys-sec
  <<: *net-fe-be
x-std-keys-sec-fe-socket: &std-keys-sec-fe-socket
  <<: *std-keys-sec
  <<: *net-fe-socket
x-std-keys-sec-be-socket: &std-keys-sec-be-socket
  <<: *std-keys-sec
  <<: *net-be-socket
x-std-keys-sec-fe-be-socket: &std-keys-sec-fe-be-socket
  <<: *std-keys-sec
  <<: *net-fe-be-socket
# Unsecured
x-std-keys-unsec-fe: &std-keys-unsec-fe
  <<: *std-keys-unsec
  <<: *net-fe
x-std-keys-unsec-be: &std-keys-unsec-be
  <<: *std-keys-unsec
  <<: *net-be
x-std-keys-unsec-socket: &std-keys-unsec-socket
  <<: *std-keys-unsec
  <<: *net-socket
x-std-keys-unsec-fe-be: &std-keys-unsec-fe-be
  <<: *std-keys-unsec
  <<: *net-fe-be
x-std-keys-unsec-fe-socket: &std-keys-unsec-fe-socket
  <<: *std-keys-unsec
  <<: *net-fe-socket
x-std-keys-unsec-be-socket: &std-keys-unsec-be-socket
  <<: *std-keys-unsec
  <<: *net-be-socket
x-std-keys-unsec-fe-be-socket: &std-keys-unsec-fe-be-socket
  <<: *std-keys-unsec
  <<: *net-fe-be-socket
# Privileged
x-std-keys-privil-fe: &std-keys-privil-fe
  <<: *std-keys-privil
  <<: *net-fe
x-std-keys-privil-be: &std-keys-privil-be
  <<: *std-keys-privil
  <<: *net-be
x-std-keys-privil-socket: &std-keys-privil-socket
  <<: *std-keys-privil
  <<: *net-socket
x-std-keys-privil-fe-be: &std-keys-privil-fe-be
  <<: *std-keys-privil
  <<: *net-fe-be
x-std-keys-privil-fe-socket: &std-keys-privil-fe-socket
  <<: *std-keys-privil
  <<: *net-fe-socket
x-std-keys-privil-be-socket: &std-keys-privil-be-socket
  <<: *std-keys-privil
  <<: *net-be-socket
x-std-keys-privil-fe-be-socket: &std-keys-privil-fe-be-socket
  <<: *std-keys-privil
  <<: *net-fe-be-socket
########################### SERVICES ###########################
services:
  loki:
    <<: *std-keys-unsec-fe-be
    image: grafana/loki:latest
    hostname: loki
    container_name: loki
    volumes:
      - $DOCKER_DIR/loki:/etc/loki
      - $DOCKER_DIR/loki/data:/data/loki
      - $DOCKER_DIR/loki/tmp:/tmp/loki
    ports:
      - "3100:3100"
    command: -config.file=/etc/loki/loki-config.yml
#================================================================================
  promtail:
    <<: *std-keys-unsec-be
    image: grafana/promtail:latest
    container_name: promtail
    hostname: promtail
    depends_on:
      - loki
    volumes:
      - /var/log:/logs/var/log
      - /var/lib/docker/containers/:/logs/docker
      - $DOCKER_DIR/promtail:/etc/promtail
      - $LOG_DIR/caddy:/logs/caddy
    command: -config.file=/etc/promtail/promtail-config.yml
#================================================================================
  grafana:
    <<: *std-keys-unsec-fe-be
    image: grafana/grafana:latest
    container_name: grafana
    hostname: grafana
    ports:
      - "3000:3000"
    depends_on:
      - loki
      - promtail
    environment:
      - GF_SERVER_ROOT_URL=https://grafana.noxs.me
    volumes:
      - $DOCKER_DIR/grafana:/var/lib/grafana
#================================================================================
  gatus:
    <<: *std-keys-sec-be
    image: twinproduction/gatus
    ports:
      - 44000:8080
    container_name: gatus
    hostname: gatus
    volumes:
      - $DOCKER_DIR/gatus/config:/config
      - $DOCKER_DIR/gatus/data:/data
      - $DOCKER_DIR/gatus/var/www:/var/www
#================================================================================
  coredns:
    <<: *std-keys-sec-be
    image: coredns/coredns
    container_name: coredns
    hostname: coredns
    command: -conf /data/Corefile
    # ports:
    #   - "53:53/udp"
    #   - "9153:9153/tcp"
    networks:
      backend_net:
        ipv4_address: '192.168.91.254'
    volumes:
      - $DOCKER_DIR/coredns:/data
      # - /etc/coredns/Corefile:/data/Corefile
#================================================================================      
  tailscale:
    <<: *std-keys-privil-be
    container_name: tailscale
    hostname: tailscale
    image: tailscale/tailscale:stable
    dns: 202.61.242.13
    volumes:
      - $DOCKER_DIR/tailscale/var/lib:/var/lib # State data will be stored in this directory
      - /dev/net/tun:/dev/net/tun # Required for tailscale to work
    cap_add: # Required for tailscale to work
      - net_admin
      - sys_module
    command: tailscaled
    # privileged: true
    # restart: unless-stopped
#================================================================================
  hc:
    <<: *std-keys-sec-be
    image: lscr.io/linuxserver/healthchecks:latest
    # image: healthchecks/healthchecks:latest
    dns: 202.61.242.13
    container_name: hc
    hostname: hc
    env_file: hc.env
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
    volumes:
      - $DOCKER_DIR/hc/config:/config
      - $DOCKER_DIR/hc/static/img:/static/img
    ports:
      - 8000:8000
      - 2525:2525 
    # networks:
    #   - mybridge
    restart: unless-stopped
#================================================================================
  headscale:
    <<: *std-keys-unsec-be
    image: headscale/headscale:latest-alpine
    container_name: headscale
    hostname: heascale
    ports:
      - 8080:8080
    volumes:
      - $DOCKER_DIR/headscale/config:/etc/headscale
      - $DOCKER_DIR/headscale/data:/var/lib/headscale
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
    entrypoint: headscale serve
#================================================================================
  # hc_db:
  #   <<: *std-keys-sec-be
  #   image: postgres:12
  #   container_name: hc_db
  #   hostname: hc_db
  #   volumes:
  #     - $DOCKER_DIR/hc_db:/var/lib/postgresql/data
  #   environment:
  #     - POSTGRES_DB=$HC_DB_NAME
  #     - POSTGRES_PASSWORD=$HC_DB_PASSWORD
#================================================================================
  # hc:
  #   <<: *std-keys-sec-be
  #   build:
  #       context: ./healthchecks
  #       dockerfile: docker/Dockerfile
  #   container_name: hc
  #   hostname: hc
  #   environment:
  #     - ALLOWED_HOSTS=localhost
  #     - APPRISE_ENABLED=True
  #     - DB=postgres
  #     - DB_CONN_MAX_AGE=0
  #     - DB_HOST=hc_db
  #     - DB_NAME=$HC_DB_NAME
  #     - DB_PASSWORD=$HC_DB_PASSWORD
  #     - DB_PORT=5432
  #     - DB_SSLMODE=prefer
  #     - DB_TARGET_SESSION_ATTRS=read-write
  #     - DB_USER=postgres
  #     - DEBUG=False
  #     - DEFAULT_FROM_EMAIL=healthchecks@noxs.me
  #     - EMAIL_HOST=$SMTP_SERVER_NAME
  #     - EMAIL_HOST_PASSWORD=$SMTP_USER_NAME
  #     - EMAIL_HOST_USER=$SMTP_USER_PASSWORD
  #     - EMAIL_PORT=$SMTP_SERVER_PORT
  #     - EMAIL_USE_TLS=True
  #     - EMAIL_USE_VERIFICATION=True
  #     - INTEGRATIONS_ALLOW_PRIVATE_IPS=False
  #     - LINENOTIFY_CLIENT_ID=
  #     - LINENOTIFY_CLIENT_SECRET=
  #     - MASTER_BADGE_LABEL=Mychecks
  #     - PAGERTREE_ENABLED=True
  #     - PD_APP_ID=
  #     - PD_ENABLED=True
  #     - PING_BODY_LIMIT=10000
  #     - PING_EMAIL_DOMAIN=localhost
  #     - PING_ENDPOINT=http://localhost:8000/ping/
  #     - REGISTRATION_OPEN=True
  #     - REMOTE_USER_HEADER=
  #     - RP_ID=
  #     - SECRET_KEY=---
  #     - SHELL_ENABLED=True
  #     # - SITE_LOGO_URL=
  #     - SITE_NAME=Noxs Checks
  #     - SITE_ROOT=https://hc.noxs.me
  #     - SLACK_CLIENT_ID=
  #     - SLACK_CLIENT_SECRET=
  #     - SLACK_ENABLED=True
  #     - TELEGRAM_BOT_NAME=ExampleBot
  #     - TELEGRAM_TOKEN=
  #     - USE_PAYMENTS=False
  #     - WEBHOOKS_ENABLED=True
  #   ports:
  #       - "8000:8000"
  #       # Uncomment to enable SMTP on port 25 for incoming email
  #       - "25:25"
  #   depends_on:
  #       - hc_db
  #   command: bash -c 'while !</dev/tcp/db/5432; do sleep 1; done; uwsgi /opt/healthchecks/docker/uwsgi.ini'
