docker-compose.yml

version: "3.9"

########################### NETWORKS
# You may customize the network subnet (192.168.89.0/24) below as you please.
# Docker Compose version 3.5 or higher required to define networks this way.

networks:
  default:
    driver: bridge
  npm_proxy:
    name: npm_proxy
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.89.0/24
  # If you decide to use Socket Proxy, you need socket_proxy network as we. See https://www.smarthomebeginner.com/traefik-docker-security-best-practices/#9_Use_a_Docker_Socket_Proxy

########################### EXTENSION FIELDS
# Helps eliminate repetition of sections
# More Info on how to use this: https://github.com/htpcBeginner/docker-traefik/pull/228

# Common environment values
x-environment: &default-tz-puid-pgid
  TZ: $TZ
  PUID: $PUID
  PGID: $PGID

# Keys common to some of the core services that we always to automatically restart on failure
x-common-keys-core: &common-keys-core
  networks:
    - npm_proxy
  security_opt:
    - no-new-privileges:true
  restart: always

# Keys common to some of the dependent services/apps
x-common-keys-apps: &common-keys-apps
  networks:
    - npm_proxy
  security_opt:
    - no-new-privileges:true
  restart: unless-stopped

# Keys common to some of the services in media-services.txt
x-common-keys-media: &common-keys-media
  networks:
    - npm_proxy
  security_opt:
    - no-new-privileges:true
  restart: "no"

########################### SERVICES
services:

  ############################# FRONTENDS

  # Nginx Proxy Manager - Reverse Proxy with LetsEncrypt
  npm:
    <<: *common-keys-core # See EXTENSION FIELDS at the top
    container_name: nginx-proxy-manager
    image: 'jc21/nginx-proxy-manager:latest'
    # For Static IP
    networks:
    # For Static IP
      npm_proxy:
        ipv4_address: 192.168.89.254 # You can specify a static IP
    # For Dynamic IP
    # networks:
    #  - npm_proxy
    ports:
      - '80:80' # Public HTTP Port. Port Forwarding on Router is ON.
      - '443:443' # Public HTTPS Port. Port Forwarding on Router is ON.
      - '81:81' # Admin Web Port. Port Forwarding on Router is OFF. Internal Home Network Access only - 192.168.89.254:81.
    volumes:
      - $DOCKERDIR/appdata/npm/config:/config 
      - $DOCKERDIR/appdata/npm/letsencrypt:/etc/letsencrypt
      - $DOCKERDIR/appdata/npm/data:/data
    environment:
      DB_SQLITE_FILE: "/config/database.sqlite"
      DISABLE_IPV6: 'true'

  # Portainer - WebUI for Containers
  portainer:
    <<: *common-keys-core # See EXTENSION FIELDS at the top
    container_name: portainer
    image: portainer/portainer-ce:latest
    command: -H unix:///var/run/docker.sock # Use Docker Socket Proxy and comment this line out, for improved security.
    # command: -H tcp://socket-proxy:2375 # Use this instead, if you have Socket Proxy enabled.
    networks:
      - npm_proxy
    ports: 
      - "9000:9000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro # Use Docker Socket Proxy and comment this line out, for improved security.
      - $DOCKERDIR/appdata/portainer/data:/data # Change to local directory if you want to save/transfer config locally.
    environment:
      - TZ=$TZ

  # Heimdall - Application Dashboard
  heimdall:
    <<: *common-keys-core # See EXTENSION FIELDS at the top
    image: lscr.io/linuxserver/heimdall
    container_name: heimdall
    ports:
      - "83:80" # 80 to 82 already taken by other services
      # - "444:443" # 443 used by Nginx Proxy Manager. Disabled because we will put Heimdall behind proxy.
    volumes:
      - $DOCKERDIR/appdata/heimdall:/config
    environment:
      <<: *default-tz-puid-pgid

  ############################# DOWNLOADERS
  
  # nzbget - Binary newsgrabber (NZB downloader)
  nzbget:
    <<: *common-keys-apps # See EXTENSION FIELDS at the top
    image: lscr.io/linuxserver/nzbget
    container_name: nzbget
    networks:
      npm_proxy:
        ipv4_address: 192.168.89.216
    ports:
      - "6789:6789"
    volumes:
      - $DOCKERDIR/appdata/nzbget:/config
      - $DATADIR/downloads:/data/downloads
    environment:
      <<: *default-tz-puid-pgid

  # TransmissionBT - Torrent Downloader
  # For Proxmox LXC Containers - https://pve.proxmox.com/wiki/OpenVPN_in_LXC
  transmission-vpn:
    image: haugene/transmission-openvpn:latest
    container_name: transmission-vpn
    restart: unless-stopped
    networks:
      npm_proxy:
        ipv4_address: 192.168.89.169
    ports:
      - "9091:9091"
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - $DOCKERDIR/appdata/transmission-vpn/data:/data
      - $DOCKERDIR/appdata/transmission-vpn/config:/config
      - $DATADIR/downloads:/data/downloads
    environment:
      <<: *default-tz-puid-pgid
      OPENVPN_PROVIDER: FASTESTVPN
      OPENVPN_USERNAME: $FASTEST_USERNAME
      OPENVPN_PASSWORD: $FASTEST_PASSWORD
      LOCAL_NETWORK: "$LOCAL_NETWORK"
      UMASK_SET: 2
      TRANSMISSION_RPC_AUTHENTICATION_REQUIRED: "true"
      TRANSMISSION_RPC_HOST_WHITELIST: "127.0.0.1,$SERVER_IP"
      TRANSMISSION_RPC_PASSWORD: $TRANSMISSION_RPC_PASSWORD
      TRANSMISSION_RPC_USERNAME: $TRANSMISSION_RPC_USERNAME
      TRANSMISSION_UMASK: 002
      TRANSMISSION_RATIO_LIMIT: 1.00
      TRANSMISSION_RATIO_LIMIT_ENABLED: "true"
      TRANSMISSION_ALT_SPEED_DOWN: 40000
      TRANSMISSION_ALT_SPEED_ENABLED: "false"
      TRANSMISSION_ALT_SPEED_UP: 250
      TRANSMISSION_SPEED_LIMIT_DOWN: 80000
      TRANSMISSION_SPEED_LIMIT_DOWN_ENABLED: "true"
      TRANSMISSION_SPEED_LIMIT_UP: 500
      TRANSMISSION_SPEED_LIMIT_UP_ENABLED: "true"
      TRANSMISSION_INCOMPLETE_DIR: /data/downloads/torrents/incomplete
      TRANSMISSION_INCOMPLETE_DIR_ENABLED: "true"
      TRANSMISSION_WATCH_DIR: /data/downloads/torrents
      TRANSMISSION_WATCH_DIR_ENABLED: "true"
      TRANSMISSION_DOWNLOAD_DIR: /data/downloads/torrents
      LOG_TO_STDOUT: "true"

  # qBittorrent - Torrent downloader without VPN
  qbittorrent:
    <<: *common-keys-apps # See EXTENSION FIELDS at the top
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    #network_mode: container:transmission-vpn # Passing network through Transmission Container if VPN is needed.
    ports:
      - "8080:8080"
    volumes:
      - $DOCKERDIR/appdata/qbittorrent:/config
      - $DATADIR/downloads:/data/downloads # Ensure that downloads folder is set to /data/downloads in qBittorrent
    environment:
      <<: *default-tz-puid-pgid
      UMASK_SET: 002

  ############################# PVRS

  # Prowlarr - Indexer Proxy
  prowlarr:
    <<: *common-keys-apps # See EXTENSION FIELDS at the top
    image: ghcr.io/linuxserver/prowlarr:develop
    container_name: prowlarr
    networks:
      npm_proxy:
        ipv4_address: 192.168.89.162
    ports:
      - "9696:9696"
    volumes:
      - $DOCKERDIR/appdata/prowlarr:/config
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      <<: *default-tz-puid-pgid

  # Lidarr - Music Management
  lidarr:
    <<: *common-keys-media # See EXTENSION FIELDS at the top
    image: lscr.io/linuxserver/lidarr:latest
    container_name: lidarr
    networks:
      npm_proxy:
        ipv4_address: 192.168.89.163
    ports:
      - "8686:8686"
    volumes:
      - $DOCKERDIR/appdata/lidarr:/config
      - $DATADIR/downloads:/data/downloads
      - $DATADIR/local/music:/data/media/music
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      <<: *default-tz-puid-pgid

  # Radarr - Movie management
  radarr:
    <<: *common-keys-media # See EXTENSION FIELDS at the top
    image: lscr.io/linuxserver/radarr:nightly # latest was causing "Error parsing column 45"
    container_name: radarr
    networks:
      npm_proxy:
        ipv4_address: 192.168.89.164
    ports:
      - "7878:7878"
    volumes:
      - $DOCKERDIR/appdata/radarr:/config
      - $DATADIR:/data
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      <<: *default-tz-puid-pgid

  # Sonarr - TV Shows management
  sonarr:
    <<: *common-keys-media # See EXTENSION FIELDS at the top
    image: lscr.io/linuxserver/sonarr
    container_name: sonarr
    networks:
      npm_proxy:
        ipv4_address: 192.168.89.167
    ports:
      - "8989:8989"
    volumes:
      - $DOCKERDIR/appdata/sonarr:/config
      - $DATADIR:/data
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      <<: *default-tz-puid-pgid

  # Readarr - Books management
  readarr:
    <<: *common-keys-media # See EXTENSION FIELDS at the top
    image: hotio/readarr:nightly
    container_name: readarr
    ports:
      - "8987:8987"
    volumes:
      - $DOCKERDIR/appdata/readarr:/config
      - $DATADIR:/data
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      <<: *default-tz-puid-pgid
      UMASK: 002
      #ARGS: ""

  ############################# MEDIA

  # Airsonic Advanced - Music Server
  airsonic:
    <<: *common-keys-media # See EXTENSION FIELDS at the top
    image: lscr.io/linuxserver/airsonic-advanced
    container_name: airsonic-advanced
    ports: 
      - "4040:4040"
      - "4041:4041" #UPnp
    volumes:
      - $DOCKERDIR/appdata/airsonic/podcasts:/data/podcasts
      - $DOCKERDIR/appdata/airsonic/playlists:/data/playlists
      - $DOCKERDIR/appdata/airsonic/config:/config
      - $DATADIR/local/music:/data/music
    environment:
      <<: *default-tz-puid-pgid
      JAVA_OPTS: '-Dserver.forward-headers-strategy=native' # Optional - if you use a reverse-proxy

  # Jellyfin - Media Server
  jellyfin:
    <<: *common-keys-media # See EXTENSION FIELDS at the top
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    #devices:
    #  - /dev/dri:/dev/dri # for harware transcoding
    ports:
      - "8096:8096"
      - "8920:8920" # Emby also uses same port if running both
    environment:
      <<: *default-tz-puid-pgid
      UMASK_SET: 022
    volumes:
      - $DOCKERDIR/appdata/jellyfin:/config
      - $DATADIR/downloads:/data/downloads
      - $DATADIR/media:/data/media
      - /dev/shm:/data/transcode # Offload transcoding to RAM if you have enough RAM

  # Plex - Media Server
  plexms:
    <<: *common-keys-media # See EXTENSION FIELDS at the top
    image: plexinc/pms-docker:public
    container_name: plexms
    ports:
      - "32400:32400/tcp"
      - "3005:3005/tcp"
      - "8324:8324/tcp"
      - "32469:32469/tcp"
      # - "1900:1900/udp" # Conflicts with xTeVe and Synology default ports
      - "32410:32410/udp"
      - "32412:32412/udp"
      - "32413:32413/udp"
      - "32414:32414/udp"
      # - "33400:33400" # If you use Plex Web Tools
    #devices:
    #  - /dev/dri:/dev/dri # for harware transcoding
    volumes:
      - $DOCKERDIR/appdata/plexms:/config
      - $DATADIR/media:/media
      - /dev/shm:/transcode
    environment:
      TZ: $TZ
      HOSTNAME: "dockerPlex"
      PLEX_CLAIM_FILE: $PLEX_CLAIM
      PLEX_UID: $PUID
      PLEX_GID: $PGID
      ADVERTISE_IP: http://$SERVER_IP:32400/

  # Tautulli - Plex Stats and Monitoring
  tautulli:
    <<: *common-keys-media # See EXTENSION FIELDS at the top
    image: linuxserver/tautulli:latest
    container_name: tautulli
    ports:
      - "8181:8181"
    volumes:
      - $DOCKERDIR/appdata/tautulli/config:/config
      - $DOCKERDIR/appdata/plexms/Library/Application Support/Plex Media Server/Logs:/logs:ro # For tautulli Plex log viewer
    environment:
      <<: *default-tz-puid-pgid

  # Ombi - Media Requests
  ombi:
    <<: *common-keys-media # See EXTENSION FIELDS at the top
    image: linuxserver/ombi:latest
    container_name: ombi
    ports:
      - "3579:3579"
    volumes:
      - $DOCKERDIR/appdata/ombi:/config
    environment:
      <<: *default-tz-puid-pgid

  ############################# MEDIA FILE MANAGEMENT

  # Bazarr - Subtitle Management
  bazarr:
    <<: *common-keys-media # See EXTENSION FIELDS at the top
    image: lscr.io/linuxserver/bazarr
    container_name: bazarr
    ports:
      - "6767:6767"
    volumes:
      - $DOCKERDIR/appdata/bazarr:/config
      - $DATADIR/media:/data/media
    environment:
      <<: *default-tz-puid-pgid

  # Picard - Music Library Tagging and Management
  picard:
    <<: *common-keys-apps # See EXTENSION FIELDS at the top
    image: mikenye/picard:latest
    container_name: picard
    ports:
      - "5800:5800"
    volumes:
      - $DATADIR:/data:rw
      - $DOCKERDIR/appdata/picard:/config:rw
      - /dev/shm:/dev/shm
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
      UMASK: 002
      DISPLAY_WIDTH: 1600
      DISPLAY_HEIGHT: 960

  # Handbrake - Video Conversion (Transcoding and compression)
  handbrake:
    <<: *common-keys-apps # See EXTENSION FIELDS at the top
    image: jlesage/handbrake:latest
    container_name: handbrake
    ports:
      - "5801:5800"
    volumes:
      - $DATADIR/downloads:/data/downloads
      - $DOCKERDIR/appdata/handbrake/config:/config
      - $DOCKERDIR/appdata/handbrake/watch:/watch
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      UMASK: 002
      TZ: $TZ
      KEEP_APP_RUNNING: 1
      CLEAN_TMP_DIR: 1
      DISPLAY_WIDTH: 1600
      DISPLAY_HEIGHT: 960
      AUTOMATED_CONVERSION_KEEP_SOURCE: 1
      VNC_PASSWORD: $HANDBRAKE_VNC_PASSWD

  ############################# UTILITIES
 
  # Dozzle - Real-time Docker Log Viewer
  dozzle:
    <<: *common-keys-apps # See EXTENSION FIELDS at the top
    image: amir20/dozzle:latest
    container_name: dozzle
    networks:
      - npm_proxy
    ports:
      - "8081:8080" # qBittorrent is using port 8080
    environment:
      DOZZLE_LEVEL: info
      DOZZLE_TAILSIZE: 300
      DOZZLE_FILTER: "status=running"
      # DOZZLE_FILTER: "label=log_me" # limits logs displayed to containers with this label.
      # DOCKER_HOST: tcp://socket-proxy:2375 # Use this instead if you have Socket Proxy enabled.
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # Use Docker Socket Proxy and comment this line for improved security.

  # File Browser - Explorer
  filebrowser:
    <<: *common-keys-core # See EXTENSION FIELDS at the top
    image: filebrowser/filebrowser:s6
    container_name: filebrowser
    ports:
      - "82:80" # 80 and 81 are used by Nginx Proxy Manager
    volumes:
      - $DOCKERDIR/appdata/filebrowser:/config 
      - $USERDIR:/srv
    environment:
      <<: *default-tz-puid-pgid

  ############################# MAINTENANCE

  # Docker-GC - Automatic Docker Garbage Collection
  # Create docker-gc-exclude file
  dockergc:
    <<: *common-keys-apps # See EXTENSION FIELDS at the top
    image: clockworksoul/docker-gc-cron:latest
    container_name: docker-gc
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # Use Docker Socket Proxy and comment this line for improved security.
      - $DOCKERDIR/appdata/docker-gc/docker-gc-exclude:/etc/docker-gc-exclude # Create empty file
    environment:
      CRON: 0 0 0 * * ? # Everyday at midnight. Previously 0 0 * * *
      FORCE_IMAGE_REMOVAL: 1
      FORCE_CONTAINER_REMOVAL: 0
      GRACE_PERIOD_SECONDS: 604800
      DRY_RUN: 0
      CLEAN_UP_VOLUMES: 1
      TZ: $TZ
      # DOCKER_HOST: tcp://socket-proxy:2375 # Use this if you have Socket Proxy enabled.

  # WatchTower - Automatic Docker Container Updates
  watchtower:
    <<: *common-keys-core # See EXTENSION FIELDS at the top
    image: containrrr/watchtower
    container_name: watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      TZ: $TZ
      WATCHTOWER_CLEANUP: "true"
      WATCHTOWER_REMOVE_VOLUMES: "true"
      WATCHTOWER_INCLUDE_STOPPED: "true"
      WATCHTOWER_NO_STARTUP_MESSAGE: "false"
      WATCHTOWER_SCHEDULE: "0 30 12 * * *" # Everyday at 12:30
      # DOCKER_HOST: tcp://socket-proxy:2375 # Use this if you have Socket Proxy enabled.
      DOCKER_API_VERSION: "1.40"