docker-compose/docker-compose.yml

version: '3.7'
services:
  traefik:
    container_name: traefik
    image: "traefik"
    restart: unless-stopped
    network_mode: host
    command:
#      - "--log.level=DEBUG"
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.useBindPortIP=true"
      - "--providers.file=true"
      - "--providers.file.directory=/configuration/"
      - "--providers.file.watch=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.secureweb.address=:443"
      - "--metrics"
      - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=PathPrefix(`/traefik`) || PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
      - "traefik.http.middlewares.dashboard.replacepathregex.regex=^/traefik/(.*)"
      - "traefik.http.middlewares.dashboard.replacepathregex.replacement=/dashboard/$$1"
      - "traefik.http.routers.dashboard.middlewares=dashboard"
      - "traefik.http.routers.dashboard.entrypoints=web"
      - "traefik.http.services.dashboard.loadbalancer.server.port=8080"
      - "traefik.http.routers.dashboard.service=api@internal"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/srv/docker/container/traefik/:/configuration"
      - "/srv/docker/container/letsencrypt/etc:/letsencrypt"

  sonarr:
    container_name: sonarr
    image: linuxserver/sonarr
    restart: unless-stopped
    environment:
      - TZ=Australia/Melbourne
      - PUID=500
      - PGID=500
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.sonarr.rule=Host(`son.depaoli.id.au`)"
      - "traefik.http.routers.sonarr.tls=true"
      - "traefik.http.routers.sonarr.entrypoints=secureweb"
    volumes:
      - /srv/docker/container/sonarr/config:/config
      - /export/docker/storage/downloads:/downloads
      - /export/docker/storage/series:/tv

  radarr:
    container_name: radarr
    image: linuxserver/radarr
    restart: unless-stopped
    environment:
      - TZ=Australia/Melbourne
      - PUID=500
      - PGID=500
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.radarr.rule=Host(`rad.depaoli.id.au`)"
      - "traefik.http.routers.radarr.tls=true"
      - "traefik.http.routers.radarr.entrypoints=secureweb"
    volumes:
      - /srv/docker/container/radarr/config:/config
      - /export/docker/storage/downloads:/downloads
      - /export/docker/storage/movies:/movies

  emby:
    container_name: emby
    image:  emby/embyserver
    restart: unless-stopped
    network_mode: host
    environment:
      - UID=500
      - GID=500
      # 44 is video for nvidia driver support / transcoding
      - GIDLIST=44
      - TZ=Australia/Melbourne
    volumes:
      - /srv/docker/container/emby/config:/config
      - /export/docker/storage/transcode:/transcode
      - /export/docker/storage:/data
      - /export/myth/tv:/myth-recordings
    ports:
      - "8096:8096"
      - "8920:8920"
      - "7359:7359/udp" 
      - "1900:1900/udp"  
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.emby.rule=Host(`emby.depaoli.id.au`)"
      - "traefik.http.services.emby.loadbalancer.server.port=8096"
      - "traefik.http.routers.emby.tls=true"
      - "traefik.http.routers.emby.entrypoints=secureweb"
#    devices:
#      - /dev/dri:/dev/dri

  mail:
    image: tvial/docker-mailserver:latest
    hostname: mail
    domainname: depaoli.id.au
    container_name: mail
    ports:
      - "25:25"
      - "465:465"
      - "993:993"
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - /srv/docker/container/mail/data:/var/mail
      - /srv/docker/container/mail/state:/var/mail-state
      - /srv/docker/container/mail/log:/var/log/mail
      - /srv/docker/container/mail/config/:/tmp/docker-mailserver/
      - /srv/docker/container/letsencrypt/etc:/etc/letsencrypt
    environment:
      - ENABLE_SPAMASSASSIN=1
      - ENABLE_CLAMAV=1
      - ENABLE_FAIL2BAN=0
      - ENABLE_POSTGREY=0
      - SPOOF_PROTECTION=1
      - ONE_DIR=1
      - DMS_DEBUG=0
      - ENABLE_LDAP=1
      - LDAP_SERVER_HOST=openldap # your ldap container/IP/ServerName
      - LDAP_SEARCH_BASE=dc=depaoli,dc=id,dc=au
      - LDAP_BIND_DN=cn=admin,dc=depaoli,dc=id,dc=au
      - LDAP_BIND_PW=a_real_admin_pass_word_for_2o20
      - LDAP_QUERY_FILTER_USER=(&(mail=%s)(mailEnabled=TRUE))
      - LDAP_QUERY_FILTER_GROUP=(&(mailGroupMember=%s)(mailEnabled=TRUE))
      - LDAP_QUERY_FILTER_ALIAS=(mailAlias=%s)
      - LDAP_QUERY_FILTER_DOMAIN=(|(&(mail=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailGroupMember=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailalias=*@%s)(objectClass=PostfixBookMailForward)))
      - DOVECOT_PASS_FILTER=(&(objectClass=PostfixBookMailAccount)(uid=%n))
      - DOVECOT_USER_FILTER=(&(objectClass=PostfixBookMailAccount)(uid=%n))
      - ENABLE_SASLAUTHD=1
      - SASLAUTHD_MECHANISMS=ldap
      - SASLAUTHD_LDAP_SERVER=openldap
      - SASLAUTHD_LDAP_BIND_DN=cn=admin,dc=depaoli,dc=id,dc=au
      - SASLAUTHD_LDAP_PASSWORD=a_real_admin_pass_word_for_2o20
      - SASLAUTHD_LDAP_SEARCH_BASE=ou=users,dc=depaoli,dc=id,dc=au
      - SASLAUTHD_LDAP_FILTER=(&(uid=%U)(objectClass=person))
      - POSTMASTER_ADDRESS=postmaster@depaoli.id.au
      - POSTFIX_MESSAGE_SIZE_LIMIT=100000000
      - SSL_TYPE=letsencrypt
    cap_add:
      - NET_ADMIN
      - SYS_PTRACE

  openldap:
    image: osixia/openldap:latest
    container_name: openldap
#    command: "--loglevel debug"
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    environment:
      LDAP_LOG_LEVEL: "256"
      LDAP_ORGANISATION: "Depaoli home ldap"
      LDAP_DOMAIN: "depaoli.id.au"
      LDAP_BASE_DN: ""
      LDAP_ADMIN_PASSWORD: "a_real_admin_pass_word_for_2o20"
      LDAP_CONFIG_PASSWORD: "config"
      LDAP_READONLY_USER: "false"
      LDAP_RFC2307BIS_SCHEMA: "false"
      LDAP_BACKEND: "mdb"
      LDAP_TLS: "true"
      LDAP_TLS_CRT_FILENAME: "cert.pem"
      LDAP_TLS_KEY_FILENAME: "privkey.pem"
      LDAP_TLS_DH_PARAM_FILENAME: "dhparam.pem"
      LDAP_TLS_CA_CRT_FILENAME: "fullchain.pem"

      LDAP_TLS_ENFORCE: "false"
      LDAP_TLS_CIPHER_SUITE: "SECURE256:+SECURE128:-VERS-TLS-ALL:+VERS-TLS1.2:-RSA:-DHE-DSS:-CAMELLIA-128-CBC:-CAMELLIA-256-CBC"
      LDAP_TLS_PROTOCOL_MIN: "3.1"
      LDAP_TLS_VERIFY_CLIENT: "try"
      LDAP_REPLICATION: "false"
      KEEP_EXISTING_CONFIG: "false"
      LDAP_REMOVE_CONFIG_AFTER_SETUP: "true"
      LDAP_SSL_HELPER_PREFIX: "ldap"
    tty: true
    stdin_open: true
    volumes:
      - /srv/docker/container/ldap/var/lib/ldap:/var/lib/ldap
      - /srv/docker/container/ldap/etc/ldap/slapd.d:/etc/ldap/slapd.d
      - /srv/docker/container/ldap/certs/:/container/service/slapd/assets/certs
      - /srv/docker/container/ldap/ldifs/:/ldifs/
    ports:
      - "389:389"
      - "636:636"

  phpldapadmin:
    image: osixia/phpldapadmin:latest
    container_name: phpldapadmin
    environment:
      PHPLDAPADMIN_LDAP_HOSTS: "openldap"
      PHPLDAPADMIN_HTTPS: "false"
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.phpldapadmin.rule=PathPrefix(`/phpldapadmin/`)"
      - "traefik.http.middlewares.stripprefix-phpldapadmin.stripprefix.prefixes=/phpldapadmin"
      - "traefik.http.routers.phpldapadmin.middlewares=stripprefix-phpldapadmin@docker"
      - "traefik.http.routers.phpldapadmin.entrypoints=web"
    depends_on:
      - openldap

  # webmail (server)
  isotope-server:
    image: marcnuri/isotope:server-latest
    container_name: isotope-server
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.isotope-server.rule=Host(`webmail.depaoli.id.au`) && PathPrefix(`/api/`)"
      - "traefik.http.middlewares.stripprefix-isotope-server.stripprefix.prefixes=/api"
      - "traefik.http.routers.isotope-server.middlewares=stripprefix-isotope-server@docker"
      - "traefik.http.routers.isotope-server.entrypoints=secureweb"
      - "traefik.http.routers.isotope-server.tls=true"

  # webmail (client)
  isotope-client:
    image: marcnuri/isotope:client-latest
    container_name: isotope-client
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.isotope-client.rule=Host(`webmail.depaoli.id.au`) && PathPrefix(`/`)"
      - "traefik.http.routers.isotope-client.entrypoints=secureweb"
      - "traefik.http.routers.isotope-client.tls=true"

  portainer:
    container_name: portainer
    image: portainer/portainer
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /srv/docker/container/portainer/data:/data
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.rule=PathPrefix(`/portainer/`)"
      - "traefik.http.middlewares.stripprefix-portainer.stripprefix.prefixes=/portainer"
      - "traefik.http.routers.portainer.middlewares=stripprefix-portainer@docker"
      - "traefik.http.routers.portainer.entrypoints=web"

  plex:
    container_name: plex
    image: plexinc/pms-docker
    restart: unless-stopped
    environment:
      - TZ=Australia/Melbourne
      - PLEX_CLAIM=claim-Mgs3KDD_zM-rheXvz6FJ
      - PLEX_UID=500
      - PLEX_GID=500
    hostname: plex_dp
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - /myth/opt/plex/config:/config
      - /myth/opt/plex/transcode:/transcode
      - /myth/opt/storage:/data
    ports:
      - "32400:32400"
#      - "1900:1900"
      - "3005:3005"
      - "5353:5353"
      - "8324:8324"
      - "32410:32410"
      - "32412:32412"
      - "32413:32413"
      - "32414:32414"
      - "32469:32469"

  ##
  ## remember, need to docker-compose stop hassio && docker-compose rm hassio && docker-compose pull hassio && docker-compose up hassio &
  ##
  hassio:
    image: homeassistant/amd64-hassio-supervisor:2021.06.0
    container_name: hassio_supervisor
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    privileged: true
    restart: always
    entrypoint: ["/bin/bash", "-c", "/scripts/start_hassio.sh"]
    security_opt:
      - seccomp:unconfined
    environment:
      - HOMEASSISTANT_REPOSITORY=homeassistant/qemux86-64-homeassistant
      - SUPERVISOR_SHARE=/srv/docker/container/hassio
      - SUPERVISOR_NAME=hassio_supervisor
      - DBUS_SYSTEM_BUS_ADDRESS=unix:path=/var/run/dbus/system_bus_socket
    volumes:
      - /srv/docker/container/hassio:/data
      - /srv/docker/container/hassio/scripts:/scripts
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket

  sabnzbd:
    image: linuxserver/sabnzbd
    container_name: sabnzbd
    restart: unless-stopped
    environment:
      - PUID=500
      - PGID=500
      - TZ=Australia/Melbourne
    volumes:
      - /srv/docker/container/sabnzbd/:/config
      - /export/docker/storage/downloads:/downloads
      - /export/docker/storage/incomplete-downloads:/incomplete-downloads
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.sabnzbd.rule=PathPrefix(`/sabnzbd/`)"
      - "traefik.http.routers.sabnzbd.entrypoints=web"

# Monitoring
  speedtest-exporter:
    image: jraviles/prometheus_speedtest:latest
    container_name: speedtest-exporter
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    restart: unless-stopped

  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    volumes:
      - /srv/docker/container/prometheus/:/etc/prometheus/
      - /srv/docker/container/prometheus/data:/prometheus
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
      - '--web.enable-lifecycle'
#    links:
#      - cadvisor:cadvisor
#      - alertmanager:alertmanager
#      - node-exporter:node-exporter
#    depends_on:
#      - cadvisor
    restart: always

  node-exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
      - /srv/docker/container/node-exporter/textfile_collector:/var/lib/node_exporter/textfile_collector
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    command:
      - '--path.procfs=/host/proc'
      - '--path.sysfs=/host/sys'
      - --collector.filesystem.ignored-mount-points
      - "^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)"
      - --collector.textfile.directory
      - "/var/lib/node_exporter/textfile_collector"
    restart: always

#  alertmanager:
#    image: prom/alertmanager:latest
#    container_name: alertmanager
#    ports:
#      - 19093:9093
#    labels:
#      - "com.centurylinklabs.watchtower.enable=true"
#    volumes:
#      - /srv/docker/container/alertmanager/:/etc/alertmanager/
#    restart: always
#    command:
#      - '--config.file=/etc/alertmanager/config.yml'
#      - '--storage.path=/alertmanager'

  cadvisor:
    image: google/cadvisor:latest
    container_name: cadvisor
    privileged: true
    command:
      - '--disable_metrics=udp'
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    restart: always

  blackbox_exporter:
    image: prom/blackbox-exporter
    container_name: blackbox-exporter
#    ports:
#      - 9115:9115
    command:
      - '--config.file=/etc/blackboxexporter/config.yml'
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - /srv/docker/container/blackboxexporter/:/etc/blackboxexporter/
    restart: always

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    depends_on:
      - prometheus
    volumes:
      - /srv/docker/container/grafana/grafana.ini:/etc/grafana/grafana.ini
      - /srv/docker/container/grafana/data:/var/lib/grafana
      - /srv/docker/container/grafana/dashboards:/var/lib/grafana/dashboards
      - /srv/docker/container/grafana/grafana/provisioning:/etc/grafana/provisioning
    env_file:
      - /srv/docker/container/grafana/config.monitoring
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.grafana.rule=PathPrefix(`/grafana/`)"
      - "traefik.http.routers.grafana.entrypoints=web"

  pihole:
    container_name: pihole
    image: pihole/pihole:v5.7
    ports:
      - "192.168.0.2:53:53/tcp"
      - "192.168.0.2:53:53/udp"
      - "9999:80"
    environment:
      TZ: 'Australia/Melbourne'
      WEBPASSWORD: 'O701JH&%fDqIw836eTiw1LxzlGw!sn%c'
      DNS1: '127.0.0.1'
      DNS2: '1.1.1.1'
    volumes:
      - '/srv/docker/container/pihole/etc/:/etc/pihole/'
      - '/srv/docker/container/pihole/dnsmasq.d/:/etc/dnsmasq.d/'
    restart: unless-stopped
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.pihole.rule=PathPrefix(`/pihole/`)"
      - "traefik.http.routers.pihole.entrypoints=web"
      - "traefik.http.middlewares.stripprefix-pihole.stripprefix.prefixes=/pihole"
      - "traefik.http.services.pihole.loadbalancer.server.port=80"
      - "traefik.http.routers.pihole.middlewares=stripprefix-pihole@docker"

  bookdb:
    container_name: bookdb
    image: postgres
    restart: always
    environment:
      POSTGRES_PASSWORD: blahdeblah
      POSTGRES_USER: ddp
      POSTGRES_DB: library
      PGPASSWORD: NWNlfa01
    volumes:
      - '/srv/docker/container/bookdb/data:/var/lib/postgresql/data'
      - '/srv/docker/container/bookdb/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d'

  bookdb_web:
    container_name: bookdb_web
    build: '/home/ddp/src/pybook'
    volumes:
      - '/srv/docker/container/letsencrypt/etc:/etc/letsencrypt'
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
      - "traefik.enable=true"
      - "traefik.tcp.routers.bookdb_web-tcp.rule=HostSNI(`book.depaoli.id.au`)"
      - "traefik.tcp.routers.bookdb_web-tcp.tls.passthrough=true"
      - "traefik.tcp.routers.bookdb_web-tcp.entrypoints=secureweb"

  padb:
    container_name: padb
    image: postgres
    restart: always
    environment:
      POSTGRES_PASSWORD: for_now_pa
      POSTGRES_USER: pa
      POSTGRES_DB: pa
      PGPASSWORD: for_now_overall_pg_pass
    ports:
      - '55432:5432'
    volumes:
      - '/srv/docker/container/padb/data:/var/lib/postgresql/data'
      - '/srv/docker/container/padb/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d'

  paweb:
    container_name: paweb
    build: 
      context: '/home/ddp/src/photoassistant'
      args:
        PJM_UID: 500
        PJM_GID: 500
    volumes:
      - '/srv/docker/container/letsencrypt/etc:/etc/letsencrypt'
      - '/export/docker/storage:/export/docker/storage'
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
      - "traefik.enable=true"
      - "traefik.tcp.routers.paweb-tcp.rule=HostSNI(`pa.depaoli.id.au`)"
      - "traefik.tcp.routers.paweb-tcp.tls.passthrough=true"
      - "traefik.tcp.routers.paweb-tcp.entrypoints=secureweb"

  bitwarden_rs:
    container_name: bitwarden
    image: bitwardenrs/server:latest
    volumes:
      - '/srv/docker/container/bitwarden_rs/data:/data'
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.http.routers.bitwarden_rs.rule=Host(`bw.depaoli.id.au`) || Host(`ddphome.asuscomm.com`)"
      - "traefik.http.routers.bitwarden_rs.tls=true"
      - "traefik.http.routers.bitwarden_rs.tls.options=tls12@file"
      - "traefik.http.routers.bitwarden_rs.entrypoints=secureweb"