docker-compose.yml

### -> NETWORKS
networks:
  traefik_proxy:
    external: true
  nextcloud:
    driver: bridge
  default:
    driver: bridge

### -> SERVICES
services:
  # -> Traefik - Reverse proxy
  # Create traefik.log and acme/acme.json then set it permissions to 600
  # touch $DOCKERDIR/appdata/traefik2/acme/acme.json
  # chmod 600 $DOCKERDIR/appdata/traefik2/acme/acme.json
  # touch $DOCKERDIR/logs/cloudserver/traefik.log
  # touch $DOCKERDIR/logs/cloudserver/acess.log
  traefik:
    container_name: traefik
    image: traefik:latest
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "core", "all" ]
    command:
      - --global.checkNewVersion=true
      - --global.sendAnonymousUsage=true
      - --entryPoints.http.address=:80
      - --entryPoints.https.address=:443
      - --entryPoints.secure.address=:9999
      # Allow these IPs to set the X-Forwarded-* headers - Cloudflare IPs: https://www.cloudflare.com/ips/
      - --entrypoints.https.forwardedHeaders.trustedIPs=$CLOUDFLARE_IPS,$LOCAL_IPS
      - --entryPoints.traefik.address=:8080
      # - --entryPoints.ping.address=:8081
      - --api=true
      # - --api.insecure=true
      - --api.dashboard=true
      #- --ping=true
      # - --serversTransport.insecureSkipVerify=true
      - --log=true
      # - --log.filePath=/logs/traefik.log
      - --log.level=INFO # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
      - --accessLog=true
      - --accessLog.filePath=/logs/access.log
      - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines
      - --accessLog.filters.statusCodes=204-299,400-499,500-599
      - --providers.docker=true
      - --providers.docker.endpoint=unix:///var/run/docker.sock # Use Docker Socket Proxy instead for improved security
      # - --providers.docker.endpoint=tcp://socket-proxy:2375
      # Automatically set Host rule for services
      # - --providers.docker.defaultrule=Host(`{{ index .Labels "com.docker.compose.service" }}.$DOMAINNAME_CLOUD_SERVER`)
      - --providers.docker.exposedByDefault=false
      # - --entrypoints.https.http.middlewares=chain-oauth@file
      - --entrypoints.https.http.tls.options=tls-opts@file
      # Add dns-cloudflare as default certresolver for all services. Also enables TLS and no need to specify on individual services
      - --entrypoints.https.http.tls.certresolver=dns-cloudflare
      - --entrypoints.https.http.tls.domains[0].main=$DOMAINNAME_CLOUD_SERVER
      - --entrypoints.https.http.tls.domains[0].sans=*.$DOMAINNAME_CLOUD_SERVER
      # - --entrypoints.https.http.tls.domains[1].main=$DOMAINNAME2 # Pulls main cert for second domain
      # - --entrypoints.https.http.tls.domains[1].sans=*.$DOMAINNAME2 # Pulls wildcard cert for second domain
      - --providers.docker.network=traefik_proxy
      - --providers.docker.swarmMode=false
      - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory
      # - --providers.file.filename=/path/to/file # Load dynamic configuration from a file
      - --providers.file.watch=true # Only works on top level files in the rules folder
      # - --certificatesResolvers.dns-cloudflare.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # LetsEncrypt Staging Server - uncomment when testing
      - --certificatesResolvers.dns-cloudflare.acme.email=$CLOUDFLARE_EMAIL
      - --certificatesResolvers.dns-cloudflare.acme.storage=/acme.json
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.provider=cloudflare
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.delayBeforeCheck=90 # To delay DNS check and reduce LE hitrate
    networks:
      traefik_proxy:
        ipv4_address: 192.168.90.254
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
      - target: 9999
        published: 9999
        protocol: tcp
        mode: host
      # - target: 8080
      #   published: 8080
      #   protocol: tcp
      #   mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - $DOCKERDIR/appdata/traefik2/rules:/rules
      - $DOCKERDIR/appdata/traefik2/acme/acme.json:/acme.json
      - $DOCKERDIR/appdata/traefik2/logs:/logs
      - $DOCKERDIR/shared:/shared
    environment:
      - CF_API_EMAIL=$CLOUDFLARE_EMAIL
      - CF_API_KEY=$CLOUDFLARE_API_KEY
      - PUID=$PUID
      - PGID=$PGID
      - DOMAINNAME_CLOUD_SERVER
    labels:
      - "traefik.enable=true"
      # HTTP-to-HTTPS Redirect
      - "traefik.http.routers.http-catchall.entrypoints=http"
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # HTTP Routers
      - "traefik.http.routers.traefik-rtr.entrypoints=https"
      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME_CLOUD_SERVER`)"
      - "traefik.http.routers.traefik-rtr.tls=true"
      # - "traefik.http.routers.traefik-rtr.tls.certresolver=dns-cloudflare" # Comment out this line after first run of traefik to force the use of wildcard certs
      - "traefik.http.routers.traefik-rtr.tls.domains[0].main=$DOMAINNAME_CLOUD_SERVER"
      - "traefik.http.routers.traefik-rtr.tls.domains[0].sans=*.$DOMAINNAME_CLOUD_SERVER"
      # - "traefik.http.routers.traefik-rtr.tls.domains[1].main=$SECONDDOMAINNAME" # Pulls main cert for second domain
      # - "traefik.http.routers.traefik-rtr.tls.domains[1].sans=*.$SECONDDOMAINNAME" # Pulls wildcard cert for second domain
      ## Services - API
      - "traefik.http.routers.traefik-rtr.service=api@internal"
      ## Middlewares
      - "traefik.http.routers.traefik-rtr.middlewares=chain-oauth@file"

  # -> Traefik-Forward-Auth - Google Oauth forwarder to enable oauth middleware on Traefik
  oauth:
    container_name: oauth
    image: thomseddon/traefik-forward-auth:latest # image: thomseddon/traefik-forward-auth:2.1-arm -> Use this one if you're running a raspberryPi
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "core", "all" ]
    networks:
      - traefik_proxy
    environment:
      - CLIENT_ID=$GOOGLE_CLIENT_ID
      - CLIENT_SECRET=$GOOGLE_CLIENT_SECRET
      - SECRET=$OAUTH_SECRET
      - COOKIE_DOMAIN=$DOMAINNAME_CLOUD_SERVER
      - INSECURE_COOKIE=false
      - AUTH_HOST=oauth.$DOMAINNAME_CLOUD_SERVER
      - URL_PATH=/_oauth
      - WHITELIST=$WHITELISTED_OAUTH_EMAILS
      - LOG_LEVEL=info
      - LOG_FORMAT=text
      - LIFETIME=2592000 # 30 days
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.oauth-rtr.entrypoints=https"
      - "traefik.http.routers.oauth-rtr.rule=Host(`oauth.$DOMAINNAME_CLOUD_SERVER`)"
      - "traefik.http.routers.oauth-rtr.tls=true"
      ## HTTP Services
      - "traefik.http.routers.oauth-rtr.service=oauth-svc"
      - "traefik.http.services.oauth-svc.loadbalancer.server.port=4181"
      ## Middlewares
      - "traefik.http.routers.oauth-rtr.middlewares=chain-oauth@file"

  # -> Portainer - For Docker container management
  portainer:
    container_name: portainer
    image: portainer/portainer-ce:latest
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "core", "all" ]
    networks:
      - traefik_proxy
    # ports:
    #   - 9000:9000
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - $DOCKERDIR/appdata/portainer/data:/data
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.portainer-rtr.entrypoints=https"
      - "traefik.http.routers.portainer-rtr.rule=Host(`portainer.$DOMAINNAME_CLOUD_SERVER`)"
      - "traefik.http.routers.portainer-rtr.tls=true"
      ## Middlewares
      #      - "traefik.http.routers.portainer-rtr.middlewares=chain-no-auth@file" # No Authentication
      #      - "traefik.http.routers.portainer-rtr.middlewares=chain-basic-auth@file" # Basic Authentication
      - "traefik.http.routers.portainer-rtr.middlewares=chain-oauth@file" # Google OAuth 2.0
      ## HTTP Services
      - "traefik.http.routers.portainer-rtr.service=portainer-svc"
      - "traefik.http.services.portainer-svc.loadbalancer.server.port=9000"

  # -> Cloudflare Companion - Automatic CNAME DNS Creation
  cf-companion:
    container_name: cf-companion
    image: tiredofit/traefik-cloudflare-companion:latest
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "core", "all" ]
    networks:
      - traefik_proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      TIMEZONE: $TZ
      TRAEFIK_VERSION: 2
      CF_EMAIL: $CLOUDFLARE_EMAIL # Same as traefik
      CF_TOKEN: $CLOUDFLARE_API_KEY # Same as traefik
      TARGET_DOMAIN: $DOMAINNAME_CLOUD_SERVER
      DOMAIN1: $DOMAINNAME_CLOUD_SERVER
      DOMAIN1_ZONE_ID: $CLOUDFLARE_ZONEID # Copy from Cloudflare Overview page
      DOMAIN1_PROXIED: "TRUE"
    labels:
      # Add hosts specified in rules here to force cf-companion to create the CNAMEs
      # Since cf-companion creates CNAMEs based on host rules, this a workaround for non-docker/external apps
      - "traefik.http.routers.cf-companion-rtr.rule=HostHeader(`pihole.$DOMAINNAME_CLOUD_SERVER`) || HostHeader(`proxmox.$DOMAINNAME_CLOUD_SERVER`) || HostHeader(`truenas.$DOMAINNAME_CLOUD_SERVER`)"

  # -> Homarr - Main Dashboard for services
  homarr:
    container_name: homarr
    image: ghcr.io/ajnart/homarr:latest
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "apps", "all" ]
    networks:
      - traefik_proxy
    volumes:
      - $DOCKERDIR/appdata/homarr/data/configs:/app/data/configs
      - $DOCKERDIR/appdata/homarr/data/icons:/app/public/icons
      - $DOCKERDIR/appdata/homarr/data/img:/app/public/img
      - /var/run/docker.sock:/var/run/docker.sock:ro
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.homarr-rtr.entrypoints=https"
      - "traefik.http.routers.homarr-rtr.rule=Host(`home.$DOMAINNAME_CLOUD_SERVER`,`homarr.$DOMAINNAME_CLOUD_SERVER`)"
      - "traefik.http.routers.homarr-rtr.tls=true"
      ## Middlewares
      - "traefik.http.routers.homarr-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.homarr-rtr.service=homarr-svc"
      - "traefik.http.services.homarr-svc.loadbalancer.server.port=7575"

  # -> Jellyfin - Mediaserver
  jellyfin:
    container_name: 'jellyfin'
    image: jellyfin/jellyfin
    user: 1000:1000
    restart: unless-stopped
    profiles: [ "apps", "all" ]
    network_mode: 'host'
    volumes:
      - $DOCKERDIR/appdata/jellyfin/config:/config
      - $DOCKERDIR/appdata/jellyfin/cache:/cache
      - $MEDIADIR/media:/media
    devices:
      - /dev/nvidia-caps:/dev/nvidia-caps
      - /dev/nvidia0:/dev/nvidia0
      - /dev/nvidiactl:/dev/nvidiactl
      - /dev/nvidia-modeset:/dev/nvidia-modeset
      - /dev/nvidia-uvm:/dev/nvidia-uvm
      - /dev/nvidia-uvm-tools:/dev/nvidia-uvm-tools
    runtime: nvidia
    deploy:
      resources:
        reservations:
          devices:
            - capabilities: [ gpu ]
    labels:
      - 'traefik.enable=true'
      ## HTTP Router
      - 'traefik.http.routers.jellyfin.entryPoints=secure'
      - 'traefik.http.routers.jellyfin.rule=Host(`jellyfin.$DOMAINNAME_CLOUD_SERVER`)'
      ## TLS config
      - 'traefik.http.routers.jellyfin.tls=true'
      - 'traefik.http.routers.jellyfin.tls.domains=jellyfin.$DOMAINNAME_CLOUD_SERVER'
      ## Middleware
      - 'traefik.http.routers.jellyfin.middlewares=jellyfin-mw'
      - 'traefik.http.middlewares.jellyfin-mw.headers.customResponseHeaders.X-Robots-Tag=noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex'
      - 'traefik.http.middlewares.jellyfin-mw.headers.SSLRedirect=true'
      - 'traefik.http.middlewares.jellyfin-mw.headers.SSLHost=jellyfin.$DOMAINNAME_CLOUD_SERVER:9999'
      - 'traefik.http.middlewares.jellyfin-mw.headers.SSLForceHost=true'
      - 'traefik.http.middlewares.jellyfin-mw.headers.STSSeconds=315360000'
      - 'traefik.http.middlewares.jellyfin-mw.headers.STSIncludeSubdomains=true'
      - 'traefik.http.middlewares.jellyfin-mw.headers.STSPreload=true'
      - 'traefik.http.middlewares.jellyfin-mw.headers.forceSTSHeader=true'
      - 'traefik.http.middlewares.jellyfin-mw.headers.frameDeny=true'
      - 'traefik.http.middlewares.jellyfin-mw.headers.contentTypeNosniff=true'
      - 'traefik.http.middlewares.jellyfin-mw.headers.browserXSSFilter=true'
      - "traefik.http.middlewares.jellyfin-mw.headers.customFrameOptionsValue='allow-from https://$DOMAINNAME_CLOUD_SERVER'"
      ## HTTP Service
      - 'traefik.http.routers.jellyfin.service=jellyfin-svc@file'
      - 'traefik.http.services.jellyfin-svc.loadBalancer.server.port=8096'
      - 'traefik.http.services.jellyfin-svc.loadBalancer.passHostHeader=true'
      ## Redirection of HTTP on port 9999 to HTTPS on port 9999 (consistent protocol)
      - 'traefik.http.routers.jellyfin-insecure.entryPoints=secure'
      - 'traefik.http.routers.jellyfin-insecure.rule=Host(`jellyfin.$DOMAINNAME_CLOUD_SERVER`)'
      - 'traefik.http.routers.jellyfin-insecure.middlewares=jellyfin-insecure-mw'
      - 'traefik.http.middlewares.jellyfin-insecure-mw.redirectscheme.scheme=https'
      - 'traefik.http.middlewares.jellyfin-insecure-mw.redirectscheme.port=9999'
      - 'traefik.http.middlewares.jellyfin-insecure-mw.redirectscheme.permanent=false'
      - 'traefik.http.routers.jellyfin-insecure.service=noop@internal'

  # jDownloader - Download management
  jdownloader:
    image: jlesage/jdownloader-2:latest
    container_name: jdownloader
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "downloaders", "all" ]
    networks:
      - traefik_proxy
    ports:
      - "$PORT_JDOWN:5800"
    volumes:
      - $MEDIADIR/downloads:/data/downloads
      - $DOCKERDIR/appdata/jdownloader:/config
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
      UMASK: 2
      KEEP_APP_RUNNING: 1
      CLEAN_TMP_DIR: 1
      DISPLAY_WIDTH: 1600
      DISPLAY_HEIGHT: 960
      VNC_PASSWORD: $JDOWN_VNC_PASSWD
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.jdownloader-rtr.entrypoints=https"
      - "traefik.http.routers.jdownloader-rtr.rule=Host(`jdown.$DOMAINNAME_CLOUD_SERVER`)"
      ## Middlewares
      - "traefik.http.routers.jdownloader-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.jdownloader-rtr.service=jdownloader-svc"
      - "traefik.http.services.jdownloader-svc.loadbalancer.server.port=5800"

  # TransmissionBT - Torrent VPN Downloader
  transmission-vpn:
    image: haugene/transmission-openvpn:latest
    container_name: transmission-vpn
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "downloaders", "all" ]
    networks:
      traefik_proxy:
        ipv4_address: 192.168.90.169
    ports:
      - "$PORT_TRANS:9091"
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    # dns:
    #   - 1.1.1.1
    #   - 1.0.0.1
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - $DOCKERDIR/appdata/transmission-vpn/data:/data
      - $DOCKERDIR/appdata/transmission-vpn/config:/config
      - $MEDIADIR/downloads:/data/downloads
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
      CREATE_TUN_DEVICE: true
      OPENVPN_PROVIDER: NORDVPN
      OPENVPN_USERNAME: $NORD_USERNAME
      OPENVPN_PASSWORD: $NORD_PASSWORD
      # NORDVPN_COUNTRY: BR
      NORDVPN_PROTOCOL: tcp
      NORDVPN_CATEGORY: legacy_p2p
      LOCAL_NETWORK: "$LOCAL_NETWORK"
      UMASK_SET: 2
      # These transmission settings are not needed as /data/transmission-home/settings.json is persistent
      TRANSMISSION_RPC_AUTHENTICATION_REQUIRED: "true"
      TRANSMISSION_RPC_HOST_WHITELIST: "127.0.0.1,$SERVER_IP"
      TRANSMISSION_RPC_PASSWORD: $TRANSMISSION_RPC_PASSWORD
      TRANSMISSION_RPC_USERNAME: $TRANSMISSION_RPC_USERNAME
      TRANSMISSION_UMASK: 2
      TRANSMISSION_RATIO_LIMIT: 1.0
      TRANSMISSION_RATIO_LIMIT_ENABLED: "true"
      TRANSMISSION_ALT_SPEED_DOWN: 2000
      TRANSMISSION_ALT_SPEED_ENABLED: "false"
      TRANSMISSION_ALT_SPEED_UP: 100
      TRANSMISSION_SPEED_LIMIT_DOWN: 10000
      TRANSMISSION_SPEED_LIMIT_DOWN_ENABLED: "true"
      TRANSMISSION_SPEED_LIMIT_UP: 500
      TRANSMISSION_SPEED_LIMIT_UP_ENABLED: "true"
      TRANSMISSION_INCOMPLETE_DIR: /data/downloads/torrents/incomplete
      TRANSMISSION_INCOMPLETE_DIR_ENABLED: "true"
      TRANSMISSION_WATCH_DIR: /data/downloads/torrents
      TRANSMISSION_WATCH_DIR_ENABLED: "true"
      TRANSMISSION_DOWNLOAD_DIR: /data/downloads/torrents
      LOG_TO_STDOUT: "true"
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.transmission-vpn-rtr.entrypoints=https"
      - "traefik.http.routers.transmission-vpn-rtr.rule=Host(`trans.$DOMAINNAME_CLOUD_SERVER`)"
      ## Middlewares
      - "traefik.http.routers.transmission-vpn-rtr.middlewares=middlewares-rate-limit@file"
      ## HTTP Services
      - "traefik.http.routers.transmission-vpn-rtr.service=transmission-vpn-svc"
      - "traefik.http.services.transmission-vpn-svc.loadbalancer.server.port=9091"

  # qBittorrent - Torrent downloader
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "downloaders", "all" ]
    networks:
      - traefik_proxy
    # network_mode: container:transmission-vpn
    ports:
      - "$PORT_QBIT:8080"
    volumes:
      - $DOCKERDIR/appdata/qbittorrent/config:/config
      - $MEDIADIR/downloads:/data/downloads
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
      UMASK_SET: 2
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.qbittorrent-rtr.entrypoints=https"
      - "traefik.http.routers.qbittorrent-rtr.rule=Host(`qbit.$DOMAINNAME_CLOUD_SERVER`)"
      ## Middlewares
      - "traefik.http.routers.qbittorrent-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.qbittorrent-rtr.service=qbittorrent-svc"
      - "traefik.http.services.qbittorrent-svc.loadbalancer.server.port=8080"

  # nzbget - Binary newsgrabber (NZB downloader)
  nzbget:
    image: lscr.io/linuxserver/nzbget
    container_name: nzbget
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "downloaders", "all" ]
    networks:
      traefik_proxy:
        ipv4_address: 192.168.90.216
    ports:
      - "$PORT_NZBGET:6789"
    volumes:
      - $DOCKERDIR/appdata/nzbget/config:/config
      - $MEDIADIR/usenet:/data/usenet
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
    labels:
      - "traefik.enable=true"
      ## HTTP Routers Auth Bypass
      - "traefik.http.routers.nzbget-rtr-bypass.entrypoints=https"
      - "traefik.http.routers.nzbget-rtr-bypass.priority=100"
      ## HTTP Routers Auth
      - "traefik.http.routers.nzbget-rtr.entrypoints=https"
      - "traefik.http.routers.nzbget-rtr.rule=Host(`nzbget.$DOMAINNAME_CLOUD_SERVER`)"
      - "traefik.http.routers.nzbget-rtr.priority=99"
      ## Middlewares
      - "traefik.http.routers.nzbget-rtr-bypass.middlewares=chain-no-auth@file"
      - "traefik.http.routers.nzbget-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.nzbget-rtr.service=nzbget-svc"
      - "traefik.http.routers.nzbget-rtr-bypass.service=nzbget-svc"
      - "traefik.http.services.nzbget-svc.loadbalancer.server.port=6789"

  # Prowlarr - Torrent proxy
  prowlarr:
    image: ghcr.io/linuxserver/prowlarr:develop
    container_name: prowlarr
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "media", "all" ]
    networks:
      traefik_proxy:
        ipv4_address: 192.168.90.162
    ports:
      - "$PORT_PROWLARR:9696"
    volumes:
      - $DOCKERDIR/appdata/prowlarr/config:/config
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.prowlarr-rtr.entrypoints=https"
      - "traefik.http.routers.prowlarr-rtr.rule=Host(`prowlarr.$DOMAINNAME_CLOUD_SERVER`)"
      ## Middlewares
      - "traefik.http.routers.prowlarr-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.prowlarr-rtr.service=prowlarr-svc"
      - "traefik.http.services.prowlarr-svc.loadbalancer.server.port=9696"

  # Radarr - Movie management
  radarr:
    image: lscr.io/linuxserver/radarr:nightly # latest was causing "Error parsing column 45"
    container_name: radarr
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "media", "all" ]
    networks:
      traefik_proxy:
        ipv4_address: 192.168.90.164
    ports:
      - "$PORT_RADARR:7878"
    volumes:
      - $DOCKERDIR/appdata/radarr/config:/config
      - $MEDIADIR:/data
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
    labels:
      - "traefik.enable=true"
      ## HTTP Routers Auth Bypass
      - "traefik.http.routers.radarr-rtr-bypass.entrypoints=https"
      - "traefik.http.routers.radarr-rtr-bypass.rule=Host(`radarr.$DOMAINNAME_CLOUD_SERVER`) && (Headers(`X-Api-Key`, `$API_KEY_RADARR`) || Query(`apikey`, `$API_KEY_RADARR`))"
      #- "traefik.http.routers.radarr-rtr-bypass.rule=Headers(`traefik-auth-bypass-key`, `$TRAEFIK_AUTH_BYPASS_KEY`)" # Bypass Auth for LunaSea on iOS
      - "traefik.http.routers.radarr-rtr-bypass.priority=100"
      ## HTTP Routers Auth
      - "traefik.http.routers.radarr-rtr.entrypoints=https"
      - "traefik.http.routers.radarr-rtr.rule=Host(`radarr.$DOMAINNAME_CLOUD_SERVER`)"
      - "traefik.http.routers.radarr-rtr.priority=99"
      ## Middlewares
      - "traefik.http.routers.radarr-rtr-bypass.middlewares=chain-no-auth@file"
      - "traefik.http.routers.radarr-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.radarr-rtr.service=radarr-svc"
      - "traefik.http.routers.radarr-rtr-bypass.service=radarr-svc"
      - "traefik.http.services.radarr-svc.loadbalancer.server.port=7878"

  # Sonarr - TV Shows management
  sonarr:
    image: lscr.io/linuxserver/sonarr
    container_name: sonarr
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "media", "all" ]
    networks:
      traefik_proxy:
        ipv4_address: 192.168.90.167
    ports:
      - "$PORT_SONARR:8989"
    volumes:
      - $DOCKERDIR/appdata/sonarr:/config
      - $MEDIADIR:/data
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
    labels:
      - "traefik.enable=true"
      ## HTTP Routers Auth Bypass
      - "traefik.http.routers.sonarr-rtr-bypass.entrypoints=https"
      - "traefik.http.routers.sonarr-rtr-bypass.rule=Host(`sonarr.$DOMAINNAME_CLOUD_SERVER`) && (Headers(`X-Api-Key`, `$API_KEY_SONARR`) || Query(`apikey`, `$API_KEY_SONARR`))"
      #- "traefik.http.routers.sonarr-rtr-bypass.rule=Headers(`traefik-auth-bypass-key`, `$TRAEFIK_AUTH_BYPASS_KEY`)" # Bypass Auth for LunaSea on iOS
      - "traefik.http.routers.sonarr-rtr-bypass.priority=100"
      ## HTTP Routers Auth
      - "traefik.http.routers.sonarr-rtr.entrypoints=https"
      - "traefik.http.routers.sonarr-rtr.rule=Host(`sonarr.$DOMAINNAME_CLOUD_SERVER`)"
      - "traefik.http.routers.sonarr-rtr.priority=99"
      ## Middlewares
      - "traefik.http.routers.sonarr-rtr-bypass.middlewares=chain-no-auth@file"
      - "traefik.http.routers.sonarr-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.sonarr-rtr.service=sonarr-svc"
      - "traefik.http.routers.sonarr-rtr-bypass.service=sonarr-svc"
      - "traefik.http.services.sonarr-svc.loadbalancer.server.port=8989"
  # Bazarr - Subtitle Management
  bazarr:
    image: lscr.io/linuxserver/bazarr
    container_name: bazarr
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "media", "all" ]
    networks:
      - traefik_proxy
    ports:
      - "$PORT_BAZARR:6767"
    volumes:
      - $DOCKERDIR/appdata/bazarr:/config
      - $MEDIADIR/media:/data/media
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
    labels:
      - "traefik.enable=true"
      ## HTTP Routers Auth
      - "traefik.http.routers.bazarr-rtr.entrypoints=https"
      - "traefik.http.routers.bazarr-rtr.rule=Host(`bazarr.$DOMAINNAME_CLOUD_SERVER`)"
      ## Middlewares
      - "traefik.http.routers.bazarr-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.bazarr-rtr.service=bazarr-svc"
      - "traefik.http.services.bazarr-svc.loadbalancer.server.port=6767"
  # Jellyseer - Manager
  jellyseerr:
    image: fallenbagel/jellyseerr:latest
    container_name: jellyseerr
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: [ "media", "all" ]
    networks:
      - traefik_proxy
    environment:
      LOG_LEVEL: debug
      TZ: $TZ
    ports:
      - "$PORT_JELLYSEER:5055"
    volumes:
      - $DOCKERDIR/appdata/jellyseer:/app/config
    labels:
      - "traefik.enable=true"
      ## HTTP Routers Auth
      - "traefik.http.routers.jellyseer-rtr.entrypoints=https"
      - "traefik.http.routers.jellyseer-rtr.rule=Host(`jellyseer.$DOMAINNAME_CLOUD_SERVER`)"
      ## Middlewares
      - "traefik.http.routers.jellyseer-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.jellyseer-rtr.service=jellyseer-svc"
      - "traefik.http.services.jellyseer-svc.loadbalancer.server.port=5055"