docker-compose.yaml

version: '2.1'

x-ssl-service:
  volumes:
    - &dns-ssl-cert
      ./pomerium/certificates/acme-v02.api.letsencrypt.org-directory/${DNS_DOMAIN_NAME}/${DNS_DOMAIN_NAME}.crt:/ssl.crt:ro
    - &dns-ssl-key
      ./pomerium/certificates/acme-v02.api.letsencrypt.org-directory/${DNS_DOMAIN_NAME}/${DNS_DOMAIN_NAME}.key:/ssl.key:ro
    - &autocert
      ./pomerium:/certificates

services:
  adguard:
    container_name: adguard
    image: docker.io/adguard/adguardhome
    volumes:
      - *dns-ssl-cert
      - *dns-ssl-key
      - ./adguard/work:/opt/adguardhome/work
      - ./adguard/conf:/opt/adguardhome/conf
    environment:
      - TZ=${TZ}
    ports:
    # NOTE: if you also want to access adguard via plaintext DNS query,
    # uncomment the lines below.
    # WARNING: Only enable these if you run your server in a LAN.
    #   - 53:53/tcp
    #   - 53:53/udp
    #   - 67:67/udp
      - 853:853/tcp
    networks:
        default:
            ipv4_address: 172.30.1.1

  ouroboros:
    container_name: ouroboros
    image: docker.io/pyouroboros/ouroboros:latest
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - SELF_UPDATE=true
      - CLEANUP=true
      - INTERVAL=3600

  pomerium:
    image: docker.io/pomerium/pomerium:latest
    container_name: pomerium
    restart: unless-stopped
    hostname: ${POMERIUM_DOMAIN_NAME}
    environment:
      - IDP_PROVIDER=google
      - IDP_PROVIDER_URL=https://accounts.google.com
      - IDP_CLIENT_ID=${POMERIUM_CLIENT_ID}
      - IDP_CLIENT_SECRET=${POMERIUM_CLIENT_SECRET}
      - AUTHENTICATE_SERVICE_URL=https://${POMERIUM_DOMAIN_NAME}
      - SHARED_SECRET=${POMERIUM_SHARED_SECRET}
      - COOKIE_SECRET=${POMERIUM_COOKIE_SECRET}
      - AUTOCERT_DIR=/certificates
    volumes:
      - ./pomerium.yaml:/pomerium/config.yaml:ro
      - *autocert
    ports:
      - 443:443
      - 80:80
    sysctls:
      net.ipv6.conf.all.disable_ipv6: 0

  autoheal:
    image: docker.io/willfarrell/autoheal
    container_name: autoheal
    restart: always
    environment:
      - AUTOHEAL_CONTAINER_LABEL=all
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

networks:
    default:
        external:
            name: infra_network