compose.vpn.yaml

services:
  ##
  # Reverse proxy
  #
  traefik:
    image: traefik:v3.0
    command: >-
      --log.level=INFO
      --api.dashboard=true
      --providers.docker
      --providers.docker.watch=true
      --providers.docker.exposedbydefault=false
      --entrypoints.websecure.address=:443
      --entrypoints.web.address=:80
      --entrypoints.web.http.redirections.entryPoint.to=websecure
      --serverstransport.insecureskipverify=true
      --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=gandiv5
      --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53
      --certificatesresolvers.letsencrypt.acme.email=florian@floriandejonckheere.be
      --certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/acme/acme.json
    env_file: .env
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "acme:/etc/traefik/acme/"
    ports:
      - "80:80"
      - "443:443"
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.traefik-tls.redirectscheme.scheme: "https"
      traefik.http.middlewares.traefik-auth.basicauth.users: "${TRAEFIK_AUTH}"

      traefik.http.routers.traefik.rule: "Host(`traefik.vpn.cloud.dejonckhee.re`)"
      traefik.http.routers.traefik.entrypoints: "web"
      traefik.http.routers.traefik.middlewares: "traefik-tls"

      traefik.http.routers.traefik-tls.rule: "Host(`traefik.vpn.cloud.dejonckhee.re`)"
      traefik.http.routers.traefik-tls.service: "api@internal"
      traefik.http.routers.traefik-tls.entrypoints: "websecure"
      traefik.http.routers.traefik-tls.middlewares: "traefik-auth"
      traefik.http.routers.traefik-tls.tls: "true"
      traefik.http.routers.traefik-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.traefik.loadbalancer.server.port: "80"

      traefik.http.middlewares.secured.chain.middlewares: "traefik-tls,traefik-auth"

      traefik.frontend.headers.SSLRedirect: true
      traefik.frontend.headers.forceSTSHeader: true
      traefik.frontend.headers.STSSeconds: 15552000
      traefik.frontend.headers.STSIncludeSubdomains: true
      traefik.frontend.headers.STSPreload: true
      traefik.frontend.headers.browserXSSFilter: true
      traefik.frontend.headers.contentTypeNosniff: true
      traefik.frontend.headers.frameDeny: true

  ##
  # qBittorrent
  #
  qbittorrent:
    image: linuxserver/qbittorrent:4.6.3
    environment:
      PUID: 1000
      PGID: 1000
    volumes:
      - qbittorrent:/config
      - /mnt/box/data:/data
    ports:
      - "0.0.0.0:6881:6881"
      - "0.0.0.0:6881:6881/udp"
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.qbittorrent-tls.redirectscheme.scheme: "https"

      traefik.http.routers.qbittorrent.rule: "Host(`qbittorrent.vpn.cloud.dejonckhee.re`)"
      traefik.http.routers.qbittorrent.entrypoints: "web"
      traefik.http.routers.qbittorrent.middlewares: "qbittorrent-tls"

      traefik.http.routers.qbittorrent-tls.rule: "Host(`qbittorrent.vpn.cloud.dejonckhee.re`)"
      traefik.http.routers.qbittorrent-tls.entrypoints: "websecure"
      traefik.http.routers.qbittorrent-tls.tls: "true"
      traefik.http.routers.qbittorrent-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.qbittorrent.loadbalancer.server.port: "8080"

  ##
  # Gossa
  #
  gossa:
    image: pldubouilh/gossa:v1.0.0
    volumes:
      - /mnt/box/data:/shared
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.gossa-tls.redirectscheme.scheme: "https"
      traefik.http.middlewares.gossa-auth.basicauth.users: "${FILESERVER_AUTH}"

      traefik.http.routers.gossa.rule: "Host(`gossa.vpn.cloud.dejonckhee.re`)"
      traefik.http.routers.gossa.entrypoints: "web"
      traefik.http.routers.gossa.middlewares: "gossa-tls"

      traefik.http.routers.gossa-tls.rule: "Host(`gossa.vpn.cloud.dejonckhee.re`)"
      traefik.http.routers.gossa-tls.entrypoints: "websecure"
      traefik.http.routers.gossa-tls.middlewares: "gossa-auth"
      traefik.http.routers.gossa-tls.tls: "true"
      traefik.http.routers.gossa-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.gossa.loadbalancer.server.port: "8001"

  ##
  # Remote desktop
  #
  rdesktop:
    image: lscr.io/linuxserver/rdesktop:latest
    security_opt:
      - seccomp:unconfined
    env_file: rdesktop.env
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - rdesktop:/config
      - /mnt/box/data:/data
    ports:
      - 3389:3389
    restart: unless-stopped

volumes:
  acme:
  qbittorrent:
  rdesktop: