services:
  gluetun:
    image: ghcr.io/qdm12/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - "3000:3000"
      - "8282:8282"
    volumes:
      - /docker/gluetun/data:/gluetun
    environment:
      - VPN_SERVICE_PROVIDER=windscribe
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=<PRIVATE_KEY>
      - WIREGUARD_PRESHARED_KEY=<PRESHARED_KEY>
      - WIREGUARD_ADDRESSES=<IP_RANGE>
      - SERVER_REGIONS="Albania"
      - WIREGUARD_ENDPOINT_PORT=443
      - TZ=<TIMEZONE>
    networks:
      gluetun_network:

  invidious:
    image: quay.io/invidious/invidious:master
    restart: unless-stopped
    # ports:
      # - "3000:3000"
    environment:
      INVIDIOUS_CONFIG: |
        db:
          dbname: invidious
          user: kemal
          password: kemal
          host: 172.80.0.22
          port: 5432
        invidious_companion:
        - private_url: "http://localhost:8282"
          public_url: "<LOCAL_SERVER_HOSTNAME>"
        invidious_companion_key: "<KEY>"
        hmac_key: "<KEY>"
        check_tables: true
        domain: <DOMAIN>
        https_only: false
        default_user_preferences:
          local: true
    healthcheck:
      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/api/v1/trending || exit 1
      interval: 10s
      timeout: 5s
      retries: 2
    logging:
      options:
        max-size: "1G"
        max-file: "4"
    network_mode: "container:gluetun"
    depends_on:
      invidious-db:
        condition: service_started
      gluetun:
        condition: service_healthy

  companion:
    image: quay.io/invidious/invidious-companion:latest
    environment:
       - SERVER_SECRET_KEY=<SECRET_KEY>
    restart: unless-stopped
    # ports:
      # - "127.0.0.1:8282:8282"
    logging:
      options:
        max-size: "1G"
        max-file: "4"
    cap_drop:
      - ALL
    read_only: true
    volumes:
      - companioncache:/var/tmp/youtubei.js:rw
    security_opt:
      - no-new-privileges:true
    network_mode: "container:gluetun"
    depends_on:
      invidious-db:
        condition: service_started
      gluetun:
        condition: service_healthy
      invidious:
        condition: service_healthy

  invidious-db:
    image: docker.io/library/postgres:14
    restart: unless-stopped
    volumes:
      - postgresdata:/var/lib/postgresql/data
      - ./config/sql:/config/sql
      - ./docker/init-invidious-db.sh:/docker-entrypoint-initdb.d/init-invidious-db.sh
    environment:
      POSTGRES_DB: invidious
      POSTGRES_USER: kemal
      POSTGRES_PASSWORD: kemal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
    networks:
      gluetun_network:
        ipv4_address: 172.80.0.22
    depends_on:
      gluetun:
        condition: service_healthy

volumes:
  postgresdata:
  companioncache:

networks:
  gluetun_network:
    external: true