compose.yaml

services:
  ##
  # Database
  #
  postgres:
    image: postgres:15.6-alpine
    env_file: postgres.env
    volumes:
      - "postgres:/var/lib/postgresql/data/"
    restart: unless-stopped

  ##
  # Redis
  #
  redis:
    image: redislabs/redismod
    command: --appendonly yes --loadmodule /usr/lib/redis/modules/redisgraph.so
    volumes:
      - redis:/data/

  ##
  # Reverse proxy
  #
  traefik:
    image: traefik:v3.0
    command: >-
      --log.level=INFO
      --api.dashboard=true
      --providers.docker
      --providers.docker.watch=true
      --providers.docker.exposedbydefault=false
      --entrypoints.websecure.address=:443
      --entrypoints.web.address=:80
      --entrypoints.web.http.redirections.entryPoint.to=websecure
      --serverstransport.insecureskipverify=true
      --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=gandiv5
      --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53
      --certificatesresolvers.letsencrypt.acme.email=florian@floriandejonckheere.be
      --certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/acme/acme.json
    env_file: .env
    environment:
      LEGO_DISABLE_CNAME_SUPPORT: true
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "acme:/etc/traefik/acme/"
    ports:
      - "80:80"
      - "443:443"
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.traefik-tls.redirectscheme.scheme: "https"
      traefik.http.middlewares.traefik-auth.basicauth.users: "${TRAEFIK_AUTH}"

      traefik.http.routers.traefik.rule: "Host(`traefik.dejonckhee.re`)"
      traefik.http.routers.traefik.entrypoints: "web"
      traefik.http.routers.traefik.middlewares: "traefik-tls"

      traefik.http.routers.traefik-tls.rule: "Host(`traefik.dejonckhee.re`)"
      traefik.http.routers.traefik-tls.service: "api@internal"
      traefik.http.routers.traefik-tls.entrypoints: "websecure"
      traefik.http.routers.traefik-tls.middlewares: "traefik-auth"
      traefik.http.routers.traefik-tls.tls: "true"
      traefik.http.routers.traefik-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.traefik.loadbalancer.server.port: "80"

      traefik.http.middlewares.secured.chain.middlewares: "traefik-tls,traefik-auth"

      traefik.frontend.headers.SSLRedirect: true
      traefik.frontend.headers.forceSTSHeader: true
      traefik.frontend.headers.STSSeconds: 15552000
      traefik.frontend.headers.STSIncludeSubdomains: true
      traefik.frontend.headers.STSPreload: true
      traefik.frontend.headers.browserXSSFilter: true
      traefik.frontend.headers.contentTypeNosniff: true
      traefik.frontend.headers.frameDeny: true

  ##
  # Web server
  #
  nginx:
    image: lscr.io/linuxserver/nginx:1.24.0
    depends_on:
      - traefik
    volumes:
      - "http:/srv/http/"
      - "nginx:/config/nginx/"
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.nginx-tls.redirectscheme.scheme: "https"

      traefik.http.middlewares.nginx-redirect.redirectregex.regex: "^(https?://)([^/]*)/(.*)$$"
      traefik.http.middlewares.nginx-redirect.redirectregex.replacement: "$${1}florian.dejonckhee.re/$${3}"

      traefik.http.routers.nginx.rule: "Host(`florian.dejonckhee.re`) || Host(`dejonckhee.re`) || Host(`floriandejonckheere.be`) || Host(`www.floriandejonckheere.be`)"
      traefik.http.routers.nginx.entrypoints: "web"
      traefik.http.routers.nginx.middlewares: "nginx-tls"

      traefik.http.routers.nginx-redirect.rule: "Host(`dejonckhee.re`) || Host(`floriandejonckheere.be`) || Host(`www.floriandejonckheere.be`)"
      traefik.http.routers.nginx-redirect.entrypoints: "websecure"
      traefik.http.routers.nginx-redirect.tls: "true"
      traefik.http.routers.nginx-redirect.tls.domains[0].main: "dejonckhee.re"
      traefik.http.routers.nginx-redirect.tls.domains[0].sans: "floriandejonckheere.be,www.floriandejonckheere.be"
      traefik.http.routers.nginx-redirect.middlewares: "nginx-redirect"
      traefik.http.routers.nginx-redirect.tls.certresolver: "letsencrypt"

      traefik.http.routers.nginx-tls.rule: "Host(`florian.dejonckhee.re`)"
      traefik.http.routers.nginx-tls.entrypoints: "websecure"
      traefik.http.routers.nginx-tls.tls: "true"
      traefik.http.routers.nginx-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.nginx.loadbalancer.server.port: "80"

  ##
  # Container registry
  #
  registry:
    image: registry:2
    environment:
      REGISTRY_HTTP_SECRET: "my_registry_secret"
      REGISTRY_STORAGE_DELETE_ENABLED: "true"
    volumes:
      - registry:/var/lib/registry
    restart: unless-stopped

  registry-ui:
    image: joxit/docker-registry-ui:2.5
    environment:
      DELETE_IMAGES: "true"
      REGISTRY_TITLE: "Private Docker Registry"
      NGINX_PROXY_PASS_URL: "http://registry:5000"
      SINGLE_REGISTRY: "true"
    depends_on:
      - traefik
      - registry
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.registry-tls.redirectscheme.scheme: "https"
      traefik.http.middlewares.registry-auth.basicauth.users: "${REGISTRY_AUTH}"

      traefik.http.routers.registry.rule: "Host(`registry.dejonckhee.re`)"
      traefik.http.routers.registry.entrypoints: "web"
      traefik.http.routers.registry.middlewares: "registry-tls"

      traefik.http.routers.registry-tls.rule: "Host(`registry.dejonckhee.re`)"
      traefik.http.routers.registry-tls.entrypoints: "websecure"
      traefik.http.routers.registry-tls.middlewares: "registry-auth"
      traefik.http.routers.registry-tls.tls: "true"
      traefik.http.routers.registry-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.registry.loadbalancer.server.port: "80"

  ##
  # Password manager
  #
  bitwarden:
    image: vaultwarden/server:1.30.5-alpine
    env_file: bitwarden.env
    depends_on:
      - traefik
      - postgres
    volumes:
      - "bitwarden:/data/"
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.bitwarden-tls.redirectscheme.scheme: "https"

      traefik.http.routers.bitwarden.rule: "Host(`vault.dejonckhee.re`)"
      traefik.http.routers.bitwarden.entrypoints: "web"
      traefik.http.routers.bitwarden.middlewares: "bitwarden-tls"

      traefik.http.routers.bitwarden-tls.rule: "Host(`vault.dejonckhee.re`)"
      traefik.http.routers.bitwarden-tls.entrypoints: "websecure"
      traefik.http.routers.bitwarden-tls.tls: "true"
      traefik.http.routers.bitwarden-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.bitwarden.loadbalancer.server.port: "80"

  ##
  # Res Triviales
  #
  trivial:
    image: ghcr.io/floriandejonckheere/trivial-app:v4.1.0
    env_file: trivial.env
    depends_on:
      - traefik
      - postgres
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.trivial-tls.redirectscheme.scheme: "https"

      traefik.http.routers.trivial.rule: "Host(`trivial.dejonckhee.re`)"
      traefik.http.routers.trivial.entrypoints: "web"
      traefik.http.routers.trivial.middlewares: "trivial-tls"

      traefik.http.routers.trivial-tls.rule: "Host(`trivial.dejonckhee.re`)"
      traefik.http.routers.trivial-tls.entrypoints: "websecure"
      traefik.http.routers.trivial-tls.tls: "true"
      traefik.http.routers.trivial-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.trivial.loadbalancer.server.port: "3000"

  ##
  # Code Red
  #
  codered:
    image: ghcr.io/floriandejonckheere/code-red-app:v0.7.1
    env_file: codered.env
    depends_on:
      - traefik
      - postgres
      - redis
    command: /bin/sh -c "sed -e 's/codered.pm/codered.dejonckhee.re/g' -i config/environments/production.rb; bundle exec puma -C config/puma.rb"
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.codered-tls.redirectscheme.scheme: "https"

      traefik.http.middlewares.codered-redirect.redirectregex.regex: "^(https?://)([^/]*)/(.*)$$"
      traefik.http.middlewares.codered-redirect.redirectregex.replacement: "$${1}codered.dejonckhee.re/$${3}"

      traefik.http.routers.codered.rule: "Host(`codered.dejonckhee.re`)"
      traefik.http.routers.codered.entrypoints: "web"
      traefik.http.routers.codered.middlewares: "codered-tls"

      traefik.http.routers.codered-redirect.rule: "Host(`codered.pm`)"
      traefik.http.routers.codered-redirect.entrypoints: "websecure"
      traefik.http.routers.codered-redirect.tls: "true"
      traefik.http.routers.codered-redirect.tls.domains[0].main: "codered.dejonckhee.re"
      traefik.http.routers.codered-redirect.middlewares: "codered-redirect"
      traefik.http.routers.codered-redirect.tls.certresolver: "letsencrypt"

      traefik.http.routers.codered-tls.rule: "Host(`codered.dejonckhee.re`)"
      traefik.http.routers.codered-tls.entrypoints: "websecure"
      traefik.http.routers.codered-tls.tls: "true"
      traefik.http.routers.codered-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.codered.loadbalancer.server.port: "3000"

  ##
  # Wireguard VPN
  #
  wireguard:
    image: ghcr.io/wg-easy/wg-easy:11
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    env_file: wireguard.env
    volumes:
      - wireguard:/etc/wireguard
    ports:
      - "51820:51820/udp"
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.wireguard-tls.redirectscheme.scheme: "https"

      traefik.http.routers.wireguard.rule: "Host(`vpn.dejonckhee.re`)"
      traefik.http.routers.wireguard.entrypoints: "web"
      traefik.http.routers.wireguard.middlewares: "wireguard-tls"

      traefik.http.routers.wireguard-tls.rule: "Host(`vpn.dejonckhee.re`)"
      traefik.http.routers.wireguard-tls.entrypoints: "websecure"
      traefik.http.routers.wireguard-tls.tls: "true"
      traefik.http.routers.wireguard-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.wireguard.loadbalancer.server.port: "51821"

  ##
  # PairDrop
  #
  pairdrop:
    image: lscr.io/linuxserver/pairdrop:1.10.8
    env_file: pairdrop.env
    volumes:
      - pairdrop:/config
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.pairdrop-tls.redirectscheme.scheme: "https"

      traefik.http.routers.pairdrop.rule: "Host(`pairdrop.dejonckhee.re`)"
      traefik.http.routers.pairdrop.entrypoints: "web"
      traefik.http.routers.pairdrop.middlewares: "pairdrop-tls"

      traefik.http.routers.pairdrop-tls.rule: "Host(`pairdrop.dejonckhee.re`)"
      traefik.http.routers.pairdrop-tls.entrypoints: "websecure"
      traefik.http.routers.pairdrop-tls.tls: "true"
      traefik.http.routers.pairdrop-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.pairdrop.loadbalancer.server.port: "3000"

  ##
  # Change detection
  #
  changedetection:
    image: lscr.io/linuxserver/changedetection.io:0.45.20
    env_file: changedetection.env
    volumes:
      - changedetection:/datastore
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.changedetection-tls.redirectscheme.scheme: "https"
      traefik.http.middlewares.changedetection-auth.basicauth.users: "${CHANGEDETECTION_AUTH}"

      traefik.http.routers.changedetection.rule: "Host(`changedetection.dejonckhee.re`)"
      traefik.http.routers.changedetection.entrypoints: "web"
      traefik.http.routers.changedetection.middlewares: "changedetection-tls"

      traefik.http.routers.changedetection-tls.rule: "Host(`changedetection.dejonckhee.re`)"
      traefik.http.routers.changedetection-tls.entrypoints: "websecure"
      traefik.http.routers.changedetection-tls.middlewares: "changedetection-auth"
      traefik.http.routers.changedetection-tls.tls: "true"
      traefik.http.routers.changedetection-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.changedetection.loadbalancer.server.port: "5000"

  ##
  # Dashboard
  #
  dashboard:
    image: b4bz/homer:v23.10.1
    # Copy dashboard configuration
    volumes:
      - dashboard:/www/assets/
    restart: unless-stopped
    labels:
      traefik.enable: "true"
      traefik.http.middlewares.homer-tls.redirectscheme.scheme: "https"
      traefik.http.middlewares.homer-auth.basicauth.users: "${HOMER_AUTH}"

      traefik.http.routers.homer.rule: "Host(`dashboard.dejonckhee.re`)"
      traefik.http.routers.homer.entrypoints: "web"
      traefik.http.routers.homer.middlewares: "homer-tls"

      traefik.http.routers.homer-tls.rule: "Host(`dashboard.dejonckhee.re`)"
      traefik.http.routers.homer-tls.entrypoints: "websecure"
      traefik.http.routers.homer-tls.middlewares: "homer-auth"
      traefik.http.routers.homer-tls.tls: "true"
      traefik.http.routers.homer-tls.tls.certresolver: "letsencrypt"

      traefik.http.services.homer.loadbalancer.server.port: "8080"

  ##
  # Remote desktop
  #
  rdesktop:
    image: lscr.io/linuxserver/rdesktop:latest
    security_opt:
      - seccomp:unconfined
    env_file: rdesktop.env
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - rdesktop:/config
    ports:
      - 3389:3389
    restart: unless-stopped

volumes:
  acme:
  bitwarden:
  changedetection:
  dashboard:
  http:
  nginx:
  postgres:
  rdesktop:
  redis:
  registry:
  pairdrop:
  wireguard: