docker-compose.yml

# Concat 'homeassistant' and 'other' docker-compose files
version: '3.2'
services:
    homeassistant:
        container_name: homeassistant
        image: ghcr.io/home-assistant/home-assistant:stable
        labels:
            - com.centurylinklabs.watchtower.monitor-only=true
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.assist.entrypoints=websecure
            - traefik.http.routers.assist.tls=true
            - traefik.http.routers.assist.rule=Host(`assist.domain.com`)
            - traefik.http.services.assist.loadbalancer.server.port=8123
            - traefik.http.routers.assist.service=assist
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.http.routers.assist_local.tls=true
            - traefik.http.routers.assist_local.tls.certResolver=le-home
            - traefik.http.routers.assist_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.assist_local.rule=Host(`assist.home.domain.com`)
            - traefik.http.routers.assist_local.service=assist
        volumes:
            - /opt/homeassistant:/config
            - /var/run/docker.sock:/var/run/docker.sock
            - /home/aneisch/symlinks_for_rsync/hass-docker-ssh:/root/.ssh:ro
            - /tmp/radar.gif:/tmp/radar.gif
            - /sys/class/hwmon/hwmon1/temp1_input:/sys/class/thermal/thermal_zone0/temp:ro
            - /etc/localtime:/etc/localtime:ro
            - /frigate-drive:/frigate
            - /opt/frigate:/etc/frigate:ro
            - /frigate:/frigate_disk:ro
        devices:
            - /dev/zigbee
            - /dev/usb_modem_sim7080g:/dev/cellular_modem
        environment:
            - TZ=America/Chicago
        network_mode: host
        restart: always
        logging:
            driver: none

    mariadb:
        container_name: mariadb
        image: 'mariadb:latest'
        user: '99'
        ports:
            - '127.0.0.1:3306:3306' # Expose localhost only for Home Assistant
        volumes:
            - /opt/mariadb:/var/lib/mysql
        environment:
            - MYSQL_ROOT_PASSWORD=PASSWORD
            - MYSQL_USER=homeassistant
            - MYSQL_PASSWORD=homeassistant
            - MYSQL_DATABASE=homeassistant
            - TZ=America/Chicago
        restart: always

    mosquitto:
        container_name: mosquitto
        image: eclipse-mosquitto:latest
        user: '99'
        environment:
            - TZ=America/Chicago
        healthcheck:
            test: "mosquitto_sub -E -t '#'"
            interval: 60s
            timeout: 10s
            retries: 5
        volumes:
            - '/opt/mosquitto/config:/mosquitto/config:ro'
            - '/opt/mosquitto/log:/mosquitto/log'
            - '/opt/mosquitto/data:/mosquitto/data'
        ports:
            - '1883:1883'
            - '8883:8883'
        restart: always

    influxdb:
        container_name: influxdb
        #image: influxdb
        image: influxdb:1.8.4-alpine
        user: '99'
        volumes:
            - '/opt/influxdb:/var/lib/influxdb'
            - '/opt/influxdb/conf:/etc/influxdb'
        ports:
            - '127.0.0.1:8086:8086' # Expose localhost only for Home Assistant
        restart: always
        environment:
            - TZ=America/Chicago

    nodered:
        container_name: nodered
        image: nodered/node-red:latest
        user: '99'
        volumes:
            - /opt/nodered:/data
            - /etc/localtime:/etc/localtime:ro
        environment:
            - TZ=America/Chicago
        ports:
            - '25:25'
        restart: always
        labels:
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.nodered.entrypoints=websecure
            - traefik.http.routers.nodered.tls=true
            - traefik.http.routers.nodered.rule=Host(`nodered.domain.com`)
            - traefik.http.services.nodered.loadbalancer.server.port=1880
            - traefik.http.routers.nodered.service=nodered
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.http.routers.nodered_local.tls=true
            - traefik.http.routers.nodered_local.tls.certResolver=le-home
            - traefik.http.routers.nodered_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.nodered_local.rule=Host(`nodered.home.domain.com`)
            - traefik.http.routers.nodered_local.service=nodered

    appdaemon:
        container_name: appdaemon
        image: acockburn/appdaemon:dev
        healthcheck:
            test: "curl -sf http://localhost:8888"
            interval: 60s
            timeout: 10s
            retries: 5
        volumes:
            - /etc/localtime:/etc/localtime:ro
            - /opt/appdaemon:/conf
            # Mount directory of appdaemon apps installed by HACS
            - /opt/homeassistant/appdaemon/apps:/conf/apps/hacs
        environment:
            - TZ=America/Chicago
        ports:
            - '127.0.0.1:8888:8888' # Expose localhost only for Home Assistant rest_command
        restart: always
        labels:
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.appdaemon.entrypoints=websecure
            - traefik.http.routers.appdaemon.tls=true
            - traefik.http.routers.appdaemon.rule=Host(`appdaemon.domain.com`)
            - traefik.http.services.appdaemon.loadbalancer.server.port=8888
            - traefik.http.routers.appdaemon.service=appdaemon
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.http.routers.appdaemon_local.tls=true
            - traefik.http.routers.appdaemon_local.tls.certResolver=le-home
            - traefik.http.routers.appdaemon_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.appdaemon_local.rule=Host(`appdaemon.home.domain.com`)
            - traefik.http.routers.appdaemon_local.service=appdaemon

    thermostat_api_server:
        container_name: thermostat_api_server
        restart: always
        image: ghcr.io/aneisch/thermostat_api_server:latest
        volumes:
            - /etc/localtime:/etc/localtime:ro
        ports:
            - '8080:8080'
        environment:
            - THERMOSTAT_SERIAL=THERMOSTAT_SERIAL
            - MQTT_SERVER=10.0.1.22
            - TZ=America/Chicago
            - LOG_LEVEL=INFO
        depends_on:
            - mosquitto

    zwavejs:
        container_name: zwavejs
        image: zwavejs/zwavejs2mqtt:latest
        #image: zwavejs/zwavejs2mqtt:sha-0a723f9 # 2.4.1
        restart: always
        stop_signal: SIGINT
        devices:
            - '/dev/zwave:/dev/zwave'
        volumes:
            - /opt/zwavejs:/usr/src/app/store
        ports:
            #- '8091:8091' # port for web interface
            - '127.0.0.1:3000:3000' # port for zwave-js websocket server expose localhost only for Home Assistant
        environment:
            - TZ=America/Chicago
        labels:
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.zwavejs.entrypoints=websecure
            - traefik.http.routers.zwavejs.tls=true
            - traefik.http.routers.zwavejs.rule=Host(`zwavejs.domain.com`)
            - traefik.http.services.zwavejs.loadbalancer.server.port=8091
            - traefik.http.routers.zwavejs.service=zwavejs
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.http.routers.zwavejs_local.tls=true
            - traefik.http.routers.zwavejs_local.tls.certResolver=le-home
            - traefik.http.routers.zwavejs_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.zwavejs_local.rule=Host(`zwavejs.home.domain.com`)
            - traefik.http.routers.zwavejs_local.service=zwavejs

    cellular_message_relay_sim7080g:
        container_name: cellular_message_relay_sim7080g
        restart: always
        image: ghcr.io/aneisch/cellular_message_relay:sim7080g
        #image: cellular_message_relay:sim7080g
        ports:
            - '127.0.0.1:9998:9999' # Expose localhost only for Home Assistant
        environment:
            - SIM_KEY=SIM_KEY
            - HOST=HOSTIP
            - PORT=11111
            - POWER_TOGGLE_WEBHOOK=http://10.0.1.22:8123/api/webhook/xxx
            - TZ=America/Chicago
        volumes:
            - /etc/localtime:/etc/localtime:ro
        devices:
            - /dev/usb_modem_sim7080g:/dev/cellular_modem

    plex:
        container_name: plex
        image: plexinc/pms-docker:latest
        volumes:
            - '/opt/plex/db/:/config'
            - '/opt/plex/transcode/:/transcode'
            - '/plex/:/data'
        environment:
            - TZ=America/Chicago
            - PLEX_CLAIM=REDACT
            - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
            - TERM=xterm
            - LANG=C.UTF-8
            - LC_ALL=C.UTF-8
            - CHANGE_CONFIG_DIR_OWNERSHIP=true
            - HOME=/config
        network_mode: host
        restart: "no"
        labels:
            # HTTP Local Only
            - traefik.enable=true
            - traefik.http.services.plex.loadbalancer.server.port=32400
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.http.routers.plex_local.tls=true
            - traefik.http.routers.plex_local.tls.certResolver=le-home
            - traefik.http.routers.plex_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.plex_local.rule=Host(`plex.home.domain.com`)
            - traefik.http.routers.plex_local.service=plex

    portainer:
        container_name: portainer
        #image: portainer/portainer
        image: portainer/portainer-ce
        volumes:
            - '/var/run/docker.sock:/var/run/docker.sock'
            - '/opt/portainer:/data'
        #ports:
        #    - '9000:9000'
        environment:
            - TZ=America/Chicago
            - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
        restart: "no"
        labels:
            - sablier.enable=true
            - sablier.group=default
            # Route via Sablier: See dynamic.yaml in Traefik
            # # HTTPS for CF
            # - traefik.enable=true
            # - traefik.http.routers.portainer.entrypoints=websecure
            # - traefik.http.routers.portainer.tls=true
            # - traefik.http.routers.portainer.rule=Host(`portainer.domain.com`)
            # - traefik.http.services.portainer.loadbalancer.server.port=9000
            # - traefik.http.routers.portainer.service=portainer
            # # HTTPS Local Only (with 80-->443 redirect)
            # - traefik.http.routers.portainer_local.tls=true
            # - traefik.http.routers.portainer_local.tls.certResolver=le-home
            # - traefik.http.routers.portainer_local.tls.domains[0].main=*.home.domain.com
            # - traefik.http.routers.portainer_local.rule=Host(`portainer.home.domain.com`)
            # - traefik.http.routers.portainer_local.service=portainer

    grafana:
        container_name: grafana
        #image: grafana/grafana:6.4.5
        image: grafana/grafana
        #user: '99'
        volumes:
            - /opt/grafana:/var/lib/grafana
        #ports:
        #    - '3000:3000'
        environment:
            - GF_SECURITY_ALLOW_EMBEDDING=true
            #- GF_SECURITY_COOKIE_SAMESITE=none
            - GF_INSTALL_PLUGINS=neocat-cal-heatmap-panel
        restart: "no"
        labels:
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.grafana.entrypoints=websecure
            - traefik.http.routers.grafana.tls=true
            - traefik.http.routers.grafana.rule=Host(`grafana.domain.com`)
            - traefik.http.services.grafana.loadbalancer.server.port=3000
            - traefik.http.routers.grafana.service=grafana

    esphome:
        container_name: esphome
        # This is a custom build for now. Based on https://github.com/esphome/esphome/pull/671
        #image: esphome-dev
        #image: esphome/esphome:2021.10.3
        image: esphome/esphome
        environment:
            - TZ=America/Chicago
        volumes:
            - /opt/esphome/:/config:rw
            # Use local time for logging timestamps
            #- /etc/localtime:/etc/localtime:ro
        network_mode: host
        restart: "no"
        labels:
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.esphome.entrypoints=websecure
            - traefik.http.routers.esphome.tls=true
            - traefik.http.routers.esphome.rule=Host(`esphome.domain.com`)
            - traefik.http.services.esphome.loadbalancer.server.port=6052
            - traefik.http.routers.esphome.service=esphome
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.http.routers.esphome_local.tls=true
            - traefik.http.routers.esphome_local.tls.certResolver=le-home
            - traefik.http.routers.esphome_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.esphome_local.rule=Host(`esphome.home.domain.com`)
            - traefik.http.routers.esphome_local.service=esphome

    433_mqtt:
        # Connected to NUC, antenna in attic
        container_name: 433_mqtt
        image: ghcr.io/aneisch/rtl_433_mqtt:latest
        user: '99'
        labels:
            - com.centurylinklabs.watchtower.enable=false
        restart: 'always'
        environment:
            - TZ=America/Chicago
        devices:
            - '/dev/bus/usb:/dev/bus/usb'
        volumes:
            # Config file for setting overrides
            - '/opt/433_mqtt/433_mqtt_attic.conf:/etc/rtl_433/rtl_433.conf'

    bitwarden:
        container_name: bitwarden
        image: vaultwarden/server:alpine
        user: '99'
        volumes:
            - /opt/bw-data/:/data/
            - /etc/localtime:/etc/localtime:ro
        environment:
            - DISABLE_ADMIN_TOKEN=true
            - SIGNUPS_VERIFY=true
            - SIGNUPS_ALLOWED=false
            - INVITATIONS_ALLOWED=true
            - LOG_FILE=/data/bitwarden.log
            - LOG_LEVEL=error
            - EXTENDED_LOGGING=true
            - DOMAIN=REDACT
            - SMTP_HOST=smtp.gmail.com
            - SMTP_FROM=REDACT
            - SMTP_FROM_NAME='Bitwarden Password Manager'
            - SMTP_SSL=true
            - SMTP_USERNAME=REDACT
            - SMTP_PASSWORD=REDACT
            - ROCKET_PORT=1024
            - DUO_IKEY=
            - DUO_SKEY=
            - DUO_HOST=
            - TZ=America/Chicago
            - PUSH_ENABLED=true
            - PUSH_INSTALLATION_ID=
            - PUSH_INSTALLATION_KEY=
        #ports:
        #    - '8777:1024'
        #    - '3012:3012'
        logging:
            driver: none
        restart: always
        labels:
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.vault.entrypoints=websecure
            - traefik.http.routers.vault.tls=true
            - traefik.http.routers.vault.rule=Host(`vault.domain.com`)
            - traefik.http.services.vault.loadbalancer.server.port=1024
            - traefik.http.routers.vault.service=vault

    vaultwarden-backup:
        image: ttionya/vaultwarden-backup:latest
        container_name: vaultwarden-backup
        restart: always
        environment:
            CRON: '00 03 * * *'
            ZIP_ENABLE: 'TRUE'
            ZIP_PASSWORD: 'PASSWORD'
            ZIP_TYPE: 'zip'
            BACKUP_KEEP_DAYS: 30
            TIMEZONE: 'America/Chicago'
        volumes:
            - /opt/bw-data:/bitwarden/data/
            - /opt/vaultwarden-backup/:/config/

    vscode:
        container_name: vscode
        image: ghcr.io/hassio-addons/vscode/amd64:stable
        restart: always
        volumes:
            - '/opt/vscode/data:/data/vscode'
            - '/opt/homeassistant/:/config/homeassistant'
            - '/opt/appdaemon/:/config/appdaemon'
            - '/opt/docker-compose/:/config/docker-compose'
            - '/opt/github:/config/github_projects'
            - '/opt/frigate:/config/frigate'
            - '/home/aneisch/.backup:/config/homeassistant-git'
            - '/opt/terraform:/config/terraform'
            - '/opt/traefik:/config/traefik'
            - '/opt/vscode/run:/etc/s6-overlay/s6-rc.d/init-user/run'
        environment:
            - TZ=America/Chicago
        labels:
            #- sablier.enable=true
            #- sablier.group=default
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.vscode.entrypoints=websecure
            - traefik.http.routers.vscode.tls=true
            - traefik.http.routers.vscode.rule=Host(`vscode.domain.com`)
            - traefik.http.services.vscode.loadbalancer.server.port=1337
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.http.routers.vscode_local.tls=true
            - traefik.http.routers.vscode_local.tls.certResolver=le-home
            - traefik.http.routers.vscode_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.vscode_local.rule=Host(`vscode.home.domain.com`)
            - traefik.http.routers.vscode_local.service=vscode

    watchtower:
        container_name: watchtower
        image: containrrr/watchtower:latest
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
            - /etc/localtime:/etc/localtime:ro
        #restart: always
        restart: 'no'
        environment:
            - WATCHTOWER_CLEANUP=true
            - WATCHTOWER_NO_STARTUP_MESSAGE=true
            - WATCHTOWER_NOTIFICATIONS_LEVEL=info
            - WATCHTOWER_INCLUDE_STOPPED=true
            - WATCHTOWER_NOTIFICATIONS=email
            - WATCHTOWER_NOTIFICATION_EMAIL_FROM=REDACT
            - WATCHTOWER_NOTIFICATION_EMAIL_TO=REDACT
            - WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.gmail.com
            - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587
            - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=REDACT
            - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=REDACT
            - WATCHTOWER_NOTIFICATION_EMAIL_DELAY=2
            - WATCHTOWER_NOTIFICATION_EMAIL_SUBJECTTAG=NUC
        #command: --schedule "00 00 12 * * *"
        command: --run-once

    adguard:
        container_name: adguard
        image: adguard/adguardhome:latest
        user: '99'
        #logging:
        #    driver: none
        volumes:
            - /etc/localtime:/etc/localtime:ro
            - /opt/adguard:/opt/adguardhome/conf
            - /opt/adguard/work:/opt/adguardhome/work
        ports:
            - 53:5353/tcp
            - 53:5353/udp
            - "127.0.0.1:8088:8080" # Expose localhost only for Home Assistant
        environment:
            - TZ=America/Chicago
        restart: 'always'
        labels:
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.adguard.entrypoints=websecure
            - traefik.http.routers.adguard.tls=true
            - traefik.http.routers.adguard.rule=Host(`adguard.domain.com`)
            - traefik.http.services.adguard.loadbalancer.server.port=8080
            - traefik.http.routers.adguard.service=adguard
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.http.routers.adguard_local.tls=true
            - traefik.http.routers.adguard_local.tls.certResolver=le-home
            - traefik.http.routers.adguard_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.adguard_local.rule=Host(`adguard.home.domain.com`)
            - traefik.http.routers.adguard_local.service=adguard

    tailscale:
        container_name: tailscale
        volumes:
            - '/var/lib:/var/lib'
            - '/dev/net/tun:/dev/net/tun'
        environment:
            - TS_ROUTES=10.0.0.0/24,10.0.1.0/24
        network_mode: host
        privileged: true
        image: tailscale/tailscale
        entrypoint: tailscaled

    nginx:
        #image: nginx:latest
        image: trafex/php-nginx
        container_name: nginx
        restart: 'always'
        volumes:
            #- /opt/nginx:/usr/share/nginx/html:ro
            - /opt/nginx:/var/www/html:ro #php version
        labels:
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.nginx.entrypoints=websecure
            - traefik.http.routers.nginx.tls=true
            - traefik.http.routers.nginx.rule=Host(`heatmap.domain.com`)
            - traefik.http.services.nginx.loadbalancer.server.port=8080
            - traefik.http.routers.nginx.service=nginx

    traefik:
        container_name: traefik
        image: traefik:v3.0
        restart: always
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
            - /opt/traefik/:/etc/traefik/
            - /opt/traefik/certs:/opt/certs:ro
        ports:
            #- 8889:8080 # dashboard
            - 80:80/tcp
            - 443:443/udp
            - 443:443/tcp
        extra_hosts:
            - "host.docker.internal:host-gateway"
        labels:
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.traefik_https.rule=Host(`traefik.domain.com`)
            - traefik.http.routers.traefik_https.entrypoints=websecure
            - traefik.http.routers.traefik_https.tls=true
            - traefik.http.routers.traefik_https.service=api@internal
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.http.routers.traefik_local.tls=true
            - traefik.http.routers.traefik_local.tls.certResolver=le-home
            - traefik.http.routers.traefik_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.traefik_local.rule=Host(`traefik.home.domain.com`)
            - traefik.http.routers.traefik_local.service=api@internal
        environment:
            - CF_DNS_API_TOKEN=SECRET

    cloudflared:
        container_name: cloudflared
        image: cloudflare/cloudflared:latest
        restart: 'always'
        network_mode: host
        environment:
            - TZ=America/Chicago
        volumes:
            - /opt/cloudflared/:/home/nonroot/.cloudflared/
        command: tunnel run nuc

    signal-rest-api:
        container_name: signal-rest-api
        image: bbernhard/signal-cli-rest-api:latest
        restart: 'always'
        environment:
            - MODE=native
            - TZ=America/Chicago
            - AUTO_RECEIVE_SCHEDULE=31 * * * *
        ports:
            - "127.0.0.1:8800:8080"  # Expose localhost only for Home Assistant
            #- "8808:8080" 
        volumes:
            - "/opt/signal-rest-api:/home/.local/share/signal-cli" 
        labels:
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.enable=true # Disabled
            - traefik.http.services.signal_local.loadbalancer.server.port=8080
            - traefik.http.routers.signal_local.service=signal_local
            - traefik.http.routers.signal_local.tls=true
            - traefik.http.routers.signal_local.tls.certResolver=le-home
            - traefik.http.routers.signal_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.signal_local.rule=Host(`signal.home.domain.com`)

    apcupsd:
        container_name: apcupsd
        image: gersilex/apcupsd
        ports:
            - '127.0.0.1:3551:3551' # Expose localhost only for Home Assistant
        volumes:
            - /opt/apcupsd/apcupsd.conf:/etc/apcupsd/apcupsd.conf
        devices:
            - '/dev/ups_monitor_large:/dev/usb/hiddev0'
        restart: always

    secret:
        container_name: secret
        image: secret_container
        labels:
            - com.centurylinklabs.watchtower.enable=false
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.container.entrypoints=websecure
            - traefik.http.routers.container.tls=true
            - traefik.http.routers.container.rule=Host(`container.domain.com`)
            - traefik.http.services.container.loadbalancer.server.port=9999
            - traefik.http.routers.container.service=container
        environment:
            - FTP_USERNAME=MyUser
            - FTP_PASSWORD=MyPAss
            - NOTIFICATIONS_WEBHOOK_URL="N/A"
            - WORKSHEET_NAME=2024
            - TZ=America/Chicago
        volumes:
            # db and previously_processed_files.txt
            - /opt/secret/data/:/data/
            - /opt/secret/secret.log:/var/log/secret.log
            # Place credential for Google Sheet API
            - /opt/secret/secret-container-update-sheet-38d0e5112f58.json:/home/secret/.config/gspread/service_account.json
        restart: always

    sqliteweb:
        container_name: sqliteweb
        image: tomdesinto/sqliteweb
        restart: "no"
        volumes:
            - /opt/secret/data/secret.db:/db/secret.db
        environment:
            - TZ=America/Chicago
        command: secret.db
        labels:
            - com.centurylinklabs.watchtower.enable=false
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.sqliteweb.entrypoints=websecure
            - traefik.http.routers.sqliteweb.tls=true
            - traefik.http.routers.sqliteweb.rule=Host(`sqliteweb.domain.com`)
            - traefik.http.services.sqliteweb.loadbalancer.server.port=8080
            - traefik.http.routers.sqliteweb.service=sqliteweb

    vrs:
        container_name: vrs
        restart: 'always'
        image: mikenye/virtualradarserver
        # ports:
        #     - '1234:8080'
        environment:
            - USERNAME=aneisch
            - PASSWORD=PASSWORD
            - TZ=America/Chicago
        volumes:
            - /opt/vrs/config:/config
        labels:
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.vrs.entrypoints=websecure
            - traefik.http.middlewares.vrs-redirect.redirectregex.regex=^https://vrs.domain.com/$$
            - traefik.http.middlewares.vrs-redirect.redirectregex.replacement=https://vrs.domain.com/VirtualRadar/desktop.html
            - traefik.http.middlewares.vrs-redirect-admin.redirectregex.regex=^https://vrs.domain.com/admin$$
            - traefik.http.middlewares.vrs-redirect-admin.redirectregex.replacement=https://vrs.domain.com/VirtualRadar/WebAdmin/DatabaseWriterPluginOptions.html
            - "traefik.http.middlewares.vrs.chain.middlewares=vrs-redirect@docker,vrs-redirect-admin@docker" # combine the two in a chain
            - "traefik.http.routers.vrs.middlewares=vrs@docker" # apply the chain
            - traefik.http.routers.vrs.tls=true
            - traefik.http.routers.vrs.rule=Host(`vrs.domain.com`)
            - traefik.http.services.vrs.loadbalancer.server.port=8080
            - traefik.http.routers.vrs.service=vrs

    macos:
        container_name: macos
        restart: 'always'
        image: sickcodes/docker-osx:naked
        labels:
            - com.centurylinklabs.watchtower.enable=false
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.bb.entrypoints=websecure
            - traefik.http.routers.bb.tls=true
            - traefik.http.routers.bb.rule=Host(`bb.domain.com`)
            - traefik.http.services.bb.loadbalancer.server.port=1234
            - traefik.http.routers.bb.service=bb
        ports:
            - 50922:10022
            - 127.0.0.1:1234:1234 # Bluebubbles API
            - 5999:5999 # vnc
        volumes:
            - /tmp/.X11-unix:/tmp/.X11-unix
            - /opt/macos/mac.qcow2:/image # Backed up on nas /Backup/home-assistant/
        # networks:
        #     - macos_network
        environment:
            - DISPLAY=${DISPLAY:-:0.0}
            - GENERATE_SPECIFIC=true
            - DEVICE_MODEL=iMacPro1,1
            - SERIAL=SERIAL
            - BOARD_SERIAL=BOARD
            - UUID=UUID
            - MAC_ADDRESS=MAC
            - EXTRA=-display none -vnc 0.0.0.0:99,password-secret=secvnc0 -object secret,id=secvnc0,data=vncpass
            - TZ=America/Chicago
            - ADDITIONAL_PORTS=hostfwd=tcp::1234-:1234,
        devices:
            - /dev/kvm
        user: root

    frigate:
        container_name: frigate
        privileged: true
        restart: always
        image: ghcr.io/blakeblackshear/frigate:stable
        #image: ghcr.io/blakeblackshear/frigate:0.13.0-beta7
        shm_size: "256mb"
        devices:
            - /dev/bus/usb:/dev/bus/usb
            - /dev/dri/renderD128
        volumes:
            - /etc/localtime:/etc/localtime:ro
            - /opt/frigate/:/config
            - /frigate:/media/frigate
        ports:
            # Two below needed for Home Assistant
            - "127.0.0.1:5000:5000" # Expose localhost only for Home Assistant
            - "127.0.0.1:8554:8554" # Expose localhost only for Home Assistant
            # Two below needed for 2way stream
            - "8555:8555/tcp"
            - "8555:8555/udp"
            - "127.0.0.1:1984:1984" # Expose localhost only for Home Assistant (go2rtc)
        labels:
            # HTTPS for CF
            - traefik.enable=true
            - traefik.http.routers.frigate.entrypoints=websecure
            - traefik.http.routers.frigate.tls=true
            - traefik.http.routers.frigate.rule=Host(`frigate.domain.com`)
            - traefik.http.services.frigate.loadbalancer.server.port=5000
            - traefik.http.routers.frigate.service=frigate
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.http.routers.frigate_local.tls=true
            - traefik.http.routers.frigate_local.tls.certResolver=le-home
            - traefik.http.routers.frigate_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.frigate_local.rule=Host(`frigate.home.domain.com`)
            - traefik.http.routers.frigate_local.service=frigate
            # Go2rtc Local
            - traefik.http.services.go2rtc.loadbalancer.server.port=1984
            - traefik.http.routers.go2rtc_local.service=go2rtc
            - traefik.http.routers.go2rtc_local.tls=true
            - traefik.http.routers.go2rtc_local.tls.certResolver=le-home
            - traefik.http.routers.go2rtc_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.go2rtc_local.rule=Host(`go2rtc.home.domain.com`)
        environment:
            - PLUS_API_KEY=secret
            - TZ=America/Chicago

    codeproject:
        container_name: codeproject
        restart: 'always'
        image: codeproject/ai-server
        ports:
            - 32168:32168
        volumes:
            - /opt/codeproject/config:/etc/codeproject/ai
            #- /opt/codeproject/modules:/app/preinstalled-modules/ObjectDetectionYolo/custom-models/
            - /opt/codeproject/NETmodules:/app/preinstalled-modules/ObjectDetectionYOLOv5Net/custom-models/
            - /opt/codeproject/modules:/app/preinstalled-modules/ObjectDetectionYOLOv5-6.2/custom-models/
        labels:
            - traefik.enable=true
            - traefik.http.services.codeproject.loadbalancer.server.port=32168
            # HTTPS Local Only (with 80-->443 redirect)
            - traefik.http.routers.codeproject_local.tls=true
            - traefik.http.routers.codeproject_local.tls.certResolver=le-home
            - traefik.http.routers.codeproject_local.tls.domains[0].main=*.home.domain.com
            - traefik.http.routers.codeproject_local.rule=Host(`codeproject.home.domain.com`)
            - traefik.http.routers.codeproject_local.service=codeproject
            - traefik.http.routers.codeproject_local.middlewares=codeproject_local_redirect
            - traefik.http.middlewares.codeproject_local_redirect.redirectregex.regex=^https://codeproject.home.domain.com/(.*)
            - traefik.http.middlewares.codeproject_local_redirect.redirectregex.replacement=http://10.0.1.22:32168/$${1}
            - traefik.http.middlewares.codeproject_local_redirect.redirectregex.permanent=true

    auto-southwest:
        image: jdholtz/auto-southwest-check-in:develop
        container_name: auto-southwest
        restart: 'unless-stopped'
        privileged: true
        network_mode: host
        volumes:
            - /opt/southwest/config.json:/app/config.json
        entrypoint:
            - "python3"
            - "-u"
            - "southwest.py"
            - "--verbose"

    mealie:
        image: ghcr.io/mealie-recipes/mealie:latest
        container_name: mealie
        # ports:
        #     - "9925:9000" # 
        volumes:
            - /opt/mealie:/app/data/
        environment:
            #- ALLOW_SIGNUP=true
            - PUID=1000
            - PGID=1000
            - TZ=America/Chicago
            #- MAX_WORKERS=1
            #- WEB_CONCURRENCY=1
            - BASE_URL=https://mealie.domain.com
        restart: always
        labels:
            - sablier.enable=true
            - sablier.group=default
            # Route via Sablier: See dynamic.yaml in Traefik
            # HTTPS for CF
            # - traefik.enable=true
            # - traefik.http.routers.recipes.entrypoints=websecure
            # - traefik.http.routers.recipes.tls=true
            # - traefik.http.routers.recipes.rule=Host(`recipes.domain.com`)
            # - traefik.http.services.recipes.loadbalancer.server.port=9000
            # - traefik.http.routers.recipes.service=recipes
            # # HTTPS Local Only (with 80-->443 redirect)
            # - traefik.http.routers.recipes_local.tls=true
            # - traefik.http.routers.recipes_local.tls.certResolver=le-home
            # - traefik.http.routers.recipes_local.tls.domains[0].main=*.home.domain.com
            # - traefik.http.routers.recipes_local.rule=Host(`recipes.home.domain.com`)
            # - traefik.http.routers.recipes_local.service=recipes

    librespeed:
        image: linuxserver/librespeed
        container_name: librespeed
        environment:
            - TZ=America/Chicago
        restart: 'no'
        labels:
            - sablier.enable=true
            - sablier.group=default
            # Route via Sablier: See dynamic.yaml in Traefik
            # - traefik.enable=true
            # - traefik.http.services.librespeed.loadbalancer.server.port=80
            # - traefik.http.routers.librespeed.entrypoints=websecure
            # - traefik.http.routers.librespeed.tls=true
            # - traefik.http.routers.librespeed.rule=Host(`librespeed.domain.com`)
            # - traefik.http.routers.librespeed.service=librespeed
            # # HTTPS Local Only (with 80-->443 redirect)
            # - traefik.http.routers.librespeed_local.service=librespeed
            # - traefik.http.routers.librespeed_local.tls=true
            # - traefik.http.routers.librespeed_local.tls.certResolver=le-home
            # - traefik.http.routers.librespeed_local.tls.domains[0].main=*.home.domain.com
            # - traefik.http.routers.librespeed_local.rule=Host(`librespeed.home.domain.com`)

    sablier:
        image: acouvreur/sablier:1.6.0
        container_name: sablier
        restart: 'always'
        command:
            - start
            - --provider.name=docker
        volumes:
            - '/var/run/docker.sock:/var/run/docker.sock'

# networks:
#     macos_network:
#         driver: bridge