docker-compose

version: "3.7"

################# NETWORKS
networks:
  t2_proxy:
    external:
      name: t2_proxy
  default:
    driver: bridge

################# SERVICES
services:
# All services / apps go below this line

# Traefik 2 - Reverse Proxy
  traefik:
    container_name: traefik
    image: traefik:latest  # the chevrotin tag refers to v2.2.x
    restart: unless-stopped
    command: # CLI arguments
      - --global.checkNewVersion=true
      - --global.sendAnonymousUsage=true
      - --entryPoints.http.address=:80
      - --entryPoints.https.address=:443
      - --entryPoints.traefik.address=:8080
      - --api=true
      - --log=true
      - --log.level=DEBUG # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
      - --accessLog=true
      - --accessLog.filePath=/traefik.log
      - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines
      - --accessLog.filters.statusCodes=400-499
      - --providers.docker=true
      - --providers.docker.endpoint=unix:///var/run/docker.sock
      - --providers.docker.defaultrule=Host(`{{ index .Labels "com.docker.compose.service" }}.$DOMAINNAME`)
      - --providers.docker.exposedByDefault=false
      - --providers.docker.network=t2_proxy
      - --providers.docker.swarmMode=false
      - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory.
      - --providers.file.watch=true # Only works on top level files in the rules folder
      - --certificatesResolvers.dns-godaddy.acme.dnsChallenge=true
      - --certificatesResolvers.dns-godaddy.acme.email=michael.wilcoxkelly@outlook.com
      - --certificatesResolvers.dns-godaddy.acme.storage=/acme.json
      - --certificatesResolvers.dns-godaddy.acme.dnsChallenge.provider=godaddy
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
      - target: 8080
        published: 8080
        protocol: tcp
        mode: host
    volumes:
      - ${DOCKERDIR}/production/traefik2/rules:/rules
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${DOCKERDIR}/production/traefik2/acme/acme.json:/acme.json
      - ${DOCKERDIR}/production/traefik2/traefik.log:/traefik.log
      - ${DOCKERDIR}/shared:/shared
    environment:
      - GODADDY_API_KEY=$GODADDY_API_KEY
      - GODADDY_API_SECRET=$GODADDY_API_SECRET
    labels:
      - "traefik.enable=true"
      # HTTP-to-HTTPS Redirect
      - "traefik.http.routers.http-catchall.entrypoints=http"
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # HTTP Routers
      - "traefik.http.routers.traefik-rtr.entrypoints=https"
      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME`)"
      - "traefik.http.routers.traefik-rtr.tls=true"
      - "traefik.http.routers.traefik-rtr.tls.certresolver=dns-godaddy" # Comment out this line after first run of traefik to force the use of wildcard certs
      - "traefik.http.routers.traefik-rtr.tls.domains[0].main=*.$DOMAINNAME"
      - "traefik.http.routers.traefik-rtr.tls.domains[0].sans=$DOMAINNAME"
      ## Services - API
      - "traefik.http.routers.traefik-rtr.service=api@internal"
      ## Middlewares
      - "traefik.http.routers.traefik-rtr.middlewares=chain-basic-auth@file"



  prowlarr:
    container_name: prowlarr
    image: linuxserver/prowlarr:develop
    restart: unless-stopped
    network_mode: service:nordvpn
    depends_on:
      - nordvpn
#    networks:
#      - t2_proxy
    security_opt:
      - no-new-privileges:true
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
    volumes:
      - ${DOCKERDIR}/production/prowlarr:/config
#    ports:
#      - 9696:9696
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.prowlarr-rtr.entrypoints=https"
      - "traefik.http.routers.prowlarr-rtr.rule=Host(`prowlarr.$DOMAINNAME`)"
      - "traefik.http.routers.prowlarr-rtr.tls=true"
      ## Middlewares
      - "traefik.http.routers.prowlarr-rtr.middlewares=chain-no-auth@file"
      ## HTTP Services
      - "traefik.http.routers.prowlarr-rtr.service=prowlarr-svc"
      - "traefik.http.services.prowlarr-svc.loadbalancer.server.port=9696"


  nordvpn:
    image: bubuntux/nordvpn:latest
    container_name: nordvpn
    restart: unless-stopped
#    network_mode: bridge
    networks:
      - t2_proxy
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    ulimits:
        memlock:
          soft: -1
          hard: -1
    environment:
      - USER=${NORDVPN_USER}
      - PASS=${NORDVPN_PASS}
      - CONNECT=United_States
      - PROTOCOL=UDP
      - CATEGORY=P2P
      - NETWORK=192.168.1.0/24
      - OPENVPN_OPTS=--pull-filter ignore "ping-restart" --ping-exit 180
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    ports:
#    qbittorrent
      - 8090:8090
      - 6881:6881
      - 6881:6881/udp
#    radarr-1080p
#     - 7878:7878
#    radarr-4K
#      - 7879:7879
#    radarr-3D
#      - 7880:7880
#    jackett
      - 9117:9117
#    sonarr
#      - 8989:8989
#    nzbhydra2
#      - 5076:5076
#    qbit-seeds
      - 8085:8085
      - 6882:6882
      - 6882:6882/udp
#    prowlarr
      - 9696:9696


  radarr_v3-1080p:
    container_name: radarr_v3-1080p
    image: linuxserver/radarr:latest
    restart: unless-stopped
#    command: -H unix:///var/run/docker.sock
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
#   ports:
#      - "7878:7878"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /etc/localtime:/etc/localtime:ro
      - ${DOCKERDIR}/production/radarr_v3-1080p:/config
      - /media/nacho-media:/nacho-media
      - ${DOCKERDIR}/shared:/shared
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik"
      - "traefik.http.routers.radarr_v3-1080p-rtr.entrypoints=https"
      - "traefik.http.routers.radarr_v3-1080p-rtr.rule=Host(`radarr_v3-1080p.$DOMAINNAME`)"
      - "traefik.http.routers.radarr_v3-1080p-rtr.tls=true"
##       middlewares
      - "traefik.http.routers.radarr_v3-1080p-rtr.middlewares=chain-no-auth@file"
##       HTTP Services
      - "traefik.http.routers.radarr_v3-1080p-rtr.service=radarr_v3-1080p-svc"
      - "traefik.http.services.radarr_v3-1080p-svc.loadbalancer.server.port=7878"