version: "3.9"
# Global Common Keys
#>>>>>>> Network
x-net-host: &net-host
  network_mode: host
x-net-be: &net-be
  networks:
    - backend_net
x-net-fe: &net-fe
  networks:
    - frontend_net
x-net-socket: &net-socket
  networks:
    - socket_proxy_net
x-net-fe-be: &net-fe-be
  networks:
    - frontend_net
    - backend_net
x-net-be-socket: &net-be-socket
  networks:
    - backend_net
    - socket_proxy_net    
x-net-fe-socket: &net-fe-socket
  networks:
    - frontend_net
    - socket_proxy_net    
x-net-fe-be-socket: &net-fe-be-socket
  networks:
    - frontend_net
    - backend_net
    - socket_proxy_net   
#>>>>>>> Logging
x-logging-loki: &logging-loki
  logging:
    driver: loki
    options:
      loki-url: "http://vmx-mon.tail:3100/loki/api/v1/push"
      loki-pipeline-stages: |
          - regex:
              expression: '(level|lvl|severity)=(?P<level>\w+)'
          - labels:
              level:
      max-size: "50m"
      max-file: "2" # I am not using this
      keep-file: "true" # I am not using this
      # loki-external-labels: job=dockerlogs,lever=error
x-logging-json: &logging-json
  logging:
    driver: "json-file"
    options:
      max-size: "10M"
      max-file: "3"
# >>>>>>> Default
x-std-keys: &std-keys
  <<: *logging-json
  restart: unless-stopped
  environment:
    - TZ=$TZ
    - PUID=$PUID
    - PGID=$PGID
  volumes:
    - /etc/timezone:/etc/timezone:ro
    - /etc/localtime:/etc/localtime:ro 
  labels:
    - com.centurylinklabs.watchtower.enable=true
#>>>>>>> Security
x-std-keys-sec: &std-keys-sec
  <<: *std-keys
  security_opt:
    - no-new-privileges:true
x-std-keys-unsec: &std-keys-unsec
  <<: *std-keys
x-std-keys-priv: &std-keys-privil
  <<: *std-keys
  privileged: true
# **********************************
# Security: Secured
# **********************************
x-std-keys-sec-host: &std-keys-sec-host
  <<: *std-keys-sec
  <<: *net-host
x-std-keys-sec-fe: &std-keys-sec-fe
  <<: *std-keys-sec
  <<: *net-fe
x-std-keys-sec-be: &std-keys-sec-be
  <<: *std-keys-sec
  <<: *net-be
x-std-keys-sec-socket: &std-keys-sec-socket
  <<: *std-keys-sec
  <<: *net-socket
x-std-keys-sec-fe-be: &std-keys-sec-fe-be
  <<: *std-keys-sec
  <<: *net-fe-be
x-std-keys-sec-fe-socket: &std-keys-sec-fe-socket
  <<: *std-keys-sec
  <<: *net-fe-socket
x-std-keys-sec-be-socket: &std-keys-sec-be-socket
  <<: *std-keys-sec
  <<: *net-be-socket
x-std-keys-sec-fe-be-socket: &std-keys-sec-fe-be-socket
  <<: *std-keys-sec
  <<: *net-fe-be-socket
# **********************************
# Security: Unsecured
# **********************************
x-std-keys-unsec-jost: &std-keys-unsec-host
  <<: *std-keys-unsec
  <<: *net-host
x-std-keys-unsec-fe: &std-keys-unsec-fe
  <<: *std-keys-unsec
  <<: *net-fe
x-std-keys-unsec-be: &std-keys-unsec-be
  <<: *std-keys-unsec
  <<: *net-be
x-std-keys-unsec-socket: &std-keys-unsec-socket
  <<: *std-keys-unsec
  <<: *net-socket
x-std-keys-unsec-fe-be: &std-keys-unsec-fe-be
  <<: *std-keys-unsec
  <<: *net-fe-be
x-std-keys-unsec-fe-socket: &std-keys-unsec-fe-socket
  <<: *std-keys-unsec
  <<: *net-fe-socket
x-std-keys-unsec-be-socket: &std-keys-unsec-be-socket
  <<: *std-keys-unsec
  <<: *net-be-socket
x-std-keys-unsec-fe-be-socket: &std-keys-unsec-fe-be-socket
  <<: *std-keys-unsec
  <<: *net-fe-be-socket
# **********************************
# Security: Privileged
# **********************************
x-std-keys-privil-host: &std-keys-privil-host
  <<: *std-keys-privil
  <<: *net-host
x-std-keys-privil-fe: &std-keys-privil-fe
  <<: *std-keys-privil
  <<: *net-fe
x-std-keys-privil-be: &std-keys-privil-be
  <<: *std-keys-privil
  <<: *net-be
x-std-keys-privil-socket: &std-keys-privil-socket
  <<: *std-keys-privil
  <<: *net-socket
x-std-keys-privil-fe-be: &std-keys-privil-fe-be
  <<: *std-keys-privil
  <<: *net-fe-be
x-std-keys-privil-fe-socket: &std-keys-privil-fe-socket
  <<: *std-keys-privil
  <<: *net-fe-socket
x-std-keys-privil-be-socket: &std-keys-privil-be-socket
  <<: *std-keys-privil
  <<: *net-be-socket
x-std-keys-privil-fe-be-socket: &std-keys-privil-fe-be-socket
  <<: *std-keys-privil
  <<: *net-fe-be-socket

services:
  apprise:
    <<: *std-keys-sec-be
    image: lscr.io/linuxserver/apprise-api:latest
    container_name: apprise
    hostname: apprise
    environment:
      - PUID=2222
      - PGID=2222
      - TZ=Europe/Paris
    volumes:
      - $DOCKER_DIR/apprise/config:/config
    ports:
      - 22000:8000
#================================================================================
  caddy:
#    <<: *std-keys-sec-be
    # build:
    #   context: $DOCKER_DIR/caddy
    #   dockerfile: dockerfile
    image: slothcroissant/caddy-cloudflaredns:latest
    container_name: caddy
    ports:
      - 80:80
      - 443:443
    environment:
      - CLOUDFLARE_API_TOKEN=$CF_API_TOKEN
      - CLOUDFLARE_EMAIL=cloudflare.beouioui@spamgourmet.com
      - ACME_AGREE=true
    volumes:
      - $DOCKER_DIR/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - $DOCKER_DIR/caddy/data:/data
      - $DOCKER_DIR/caddy/var/www:/var/www
      - $DOCKER_DIR/caddy/config:/config
      - $LOG_DIR/caddy:/opt/logs/caddy  


#================================================================================
  cloudcmd:
    <<: *std-keys-sec-be
    image: coderaiser/cloudcmd
    container_name: cloudcmd
    # ports:
    #   - 8000:8000
    volumes:
      - $DOCKER_DIR/cloudcmd:/root
      - /:/HOST_DATA
#================================================================================
  coredns:
    <<: *std-keys-sec-be
    image: coredns/coredns
    container_name: coredns
    hostname: coredns
    command: -conf /data/Corefile
    # ports:
    #   - "53:53/udp"
    #   - "9153:9153/tcp"
    networks:
      backend_net:
        ipv4_address: '192.168.82.254'
    volumes:
      - $DOCKER_DIR/coredns/data:/data
      # - /etc/coredns/Corefile:/data/Corefile
#================================================================================
  dozzle:
    <<: *std-keys-unsec-be-socket
    image: amir20/dozzle
    container_name: dozzle
    # ports:
    #   - "8080:8080"
    depends_on:
      - socket-proxy
    environment:
      # - DOZZLE_ADDR=$DOZZLE_PORT
      - DOZZLE_LEVEL=debug #$DOZZEL_LOG_LEVEL
      - DOZZLE_NO_ANALYTICS=true
      - DOZZLE_BASE=/
      - DOZZLE_SHOWALL=true
      - DOZZLE_TAILSIZE=500
      # - DOZZLE_USERNAME=""
      # - DOZZLE_PASSWORD=""
      # - DOZZLE_KEY="" #When using username and password DOZZLE_KEY is required for session management.
      - DOZZLE_FILTER="status=running"
      # DOZZLE_FILTER: "label=log_me" # limits logs displayed to containers with this label
      - DOCKER_HOST=tcp://socket-proxy:2375
#================================================================================
  inotify:
    <<: *std-keys-sec-be
    container_name: inotify
    hostname: inotify
    image: coppit/inotify-command
    volumes:
      - $DOCKER_DIR/inotify/config:/config
      - $SECURED_DIR/inotify/root:/root
      - $DOCKER_DIR/inotify/crontabs:/crontab
      - $OPT_DIR/scripts:/scripts
      - /mnt/hetzner:/watch/hetzner
    environment:
      - UMAP=nobody:99:100
      - GMAP=users:100
#================================================================================
  socket-proxy:
    <<: *std-keys-privil-be-socket
    container_name: socket-proxy
    image: tecnativa/docker-socket-proxy
    ports:
      - "127.0.0.1:2375:2375"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      - LOG_LEVEL=$SOCKET_PROXY_LOG_LEVEL
      ## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.).
      # 0 to revoke access.
      # 1 to grant access.
      ## Granted by Default
      - EVENTS=1
      - PING=1
      - VERSION=1
      ## Revoked by Default
      # Security critical
      - AUTH=0
      - SECRETS=0
      - POST=1 # Watchtower
      - DELETE=1 # Watchtower
        # GET Optons
      - BUILD=0
      - COMMIT=0
      - CONFIGS=1 # Netdata Test
      - CONTAINERS=1 # Traefik, portainer, etc.
      - DISTRIBUTION=0
      - EXEC=1 # Netdata Test
      - IMAGES=1 # Portainer, Watchtower
      - INFO=1 # Portainer
      - NETWORKS=1 # Portainer, Watchtower
      - NODES=1 # Netdata Test
      - PLUGINS=1 # Netdata Test
      - SERVICES=1 # Portainer
      - SESSION=0
      - SWARM=0
      - SYSTEM=1 # Netdata Test
      - TASKS=1 # Portaienr
      - VOLUMES=1 # Portainer
      # POST Options
      - CONTAINERS_CREATE=1 # WatchTower
      - CONTAINERS_START=1 # WatchTower
      - CONTAINERS_UPDATE=1 # WatchTower
      # DELETE Options
      - CONTAINERS_DELETE=1 # WatchTower
      - IMAGES_DELETE=1 # WatchTower
#================================================================================
  watchtower:
    <<: *std-keys-unsec-be-socket
    image: containrrr/watchtower
    container_name: watchtower
    hostname: watchtower
    depends_on:
      - socket-proxy
    environment:
      - DOCKER_HOST=tcp://socket-proxy:2375
      - WATCHTOWER_NOTIFICATIONS=email
      # - WATCHTOWER_NOTIFICATION_EMAIL_FROM=$SMTP_USERNAME
      - WATCHTOWER_NOTIFICATION_EMAIL_TO=$SMTP_RECIPIENT_EMAIL
      # - WATCHTOWER_NOTIFICATION_EMAIL_SERVER=$SMTP_SERVERNAME
      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=$SMTP_SERVER_PORT
      # - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=$SMTP_USERNAME
      # - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=$SMTP_PASSWORD
      - WATCHTOWER_NOTIFICATION_EMAIL_DELAY=2
      - WATCHTOWER_NOTIFICATION_EMAIL_SUBJECTTAG=Watchtower $DOCKER_HOSTNAME
      - REPO_USER=$WATCHTOWER_REPO_USER
      - REPO_PASS=$WATCHTOWER_REPO_PASSWORD
      - WATCHTOWER_MONITOR_ONLY=false
      - WATCHTOWER_NOTIFICATIONS_LEVEL=warn
      - WATCHTOWER_NOTIFICATIONS_HOSTNAME=$DOCKER_HOSTNAME
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_INCLUDE_STOPPED=true
      - WATCHTOWER_REVIVE_STOPPED=false
      - WATCHTOWER_INCLUDE_RESTARTING=false
      - WATCHTOWER_LABEL_ENABLE=false
      - WATCHTOWER_POLL_INTERVAL=86400 #86400   #172800 = 48 hours
      - WATCHTOWER_ROLLING_RESTART=false    # Restart one image at time instead of stopping and starting all at once
      - WATCHTOWER_RUN_ONCE=false
      - WATCHTOWER_WARN_ON_HEAD_FAILURE=never

########################### NETWORKS ###########################
networks:
  mybridge:
    name: mybridge
    driver: bridge
  frontend_net:
    name: frontend_net
    driver: bridge
    ipam:
      config:
        - subnet: $FRONTEND_NET_SUBNET
  backend_net:
    name: backend_net
    driver: bridge
    ipam:
      config:
        - subnet: $BACKEND_NET_SUBNET
  socket_proxy_net:
    name: socket_proxy_net
    driver: bridge
    ipam:
      config:
        - subnet: $SOCKET_PROXY_NET_SUBNET
########################### SECRETS ###########################
secrets:
  authelia_jwt_secret:
    file: $SECRETS_DIR/authelia_jwt_secret
  authelia_session_secret:
    file: $SECRETS_DIR/authelia_session_secret
  authelia_storage_mysql_password:
    file: $SECRETS_DIR/authelia_storage_mysql_password
  authelia_storage_encryption_key:
    file: $SECRETS_DIR/authelia_storage_encryption_key
  authelia_notifier_smtp_password:
    file: $SECRETS_DIR/authelia_notifier_smtp_password
  authelia_duo_api_secret_key:
    file: $SECRETS_DIR/authelia_duo_api_secret_key
  authelia_session_redis_password:
    file: $SECRETS_DIR/authelia_session_redis_password
  authelia_authentication_backend_ldap_password:
    file: $SECRETS_DIR/authelia_authentication_backend_ldap_password
  authelia_oidc_issuer_private_key:
    file: $SECRETS_DIR/authelia_oidc_issuer_private_key
  authelia_oidc_hmac_secret:
    file: $SECRETS_DIR/authelia_oidc_hmac_secret
  bazarr_api_key:
    file: $SECRETS_DIR/bazarr_api_key
  borg_passphrase:
    file: $SECRETS_DIR/borg_passphrase
  cloudflare_api_key:
    file: $SECRETS_DIR/cloudflare_api_key
  cloudflare_email:
    file: $SECRETS_DIR/cloudflare_email
  flame_password:
    file: $SECRETS_DIR/flame_password
  gmail_smtp_password:
    file: $SECRETS_DIR/gmail_smtp_password
  gmail_smtp_username:
    file: $SECRETS_DIR/gmail_smtp_username
  gmail_smtp_servername:
    file: $SECRETS_DIR/gmail_smtp_servername
  google_client_id:
    file: $SECRETS_DIR/google_client_id
  google_client_secret:
    file: $SECRETS_DIR/google_client_secret
  guacamole_db_password:
    file: $SECRETS_DIR/guacamole_db_password
  mariadb_root_password:
    file: $SECRETS_DIR/mariadb_root_password
  oauth_secret:
    file: $SECRETS_DIR/oauth_secret
  pia_username:
    file: $SECRETS_DIR/pia_username
  pia_password:
    file: $SECRETS_DIR/pia_password
  pihole_web_password:
    file: $SECRETS_DIR/pihole_web_password
  postgresdb_password:
    file: $SECRETS_DIR/postgresdb_password
  postgresdb_host:
    file: $SECRETS_DIR/postgresdb_host  
  postgresdb_port:
    file: $SECRETS_DIR/postgresdb_port
  qdirstat_vnc_password:
    file: $SECRETS_DIR/qdirstat_vnc_password
  radarr_api_key:
    file: $SECRETS_DIR/radarr_api_key
  siab_password:
    file: $SECRETS_DIR/siab_password
  sonarr_api_key:
    file: $SECRETS_DIR/sonarr_api_key
  vscode_sudo_password:
    file: $SECRETS_DIR/vscode_sudo_password
  # watchtower_notification_email_server:
  #   file: $SECRETS_DIR/watchtower_notification_email_server
  # watchtower_notification_email_user:
  #   file: $SECRETS_DIR/watchtower_notification_email_user
  # watchtower_notification_email_password:
  #   file: $SECRETS_DIR/watchtower_notification_email_password
