docker-compose.yml

version: "3.6"
services:

  traefik:
    hostname: traefik
    image: $DOCKER_IMAGE_TRAEFIKT
    container_name: traefik
    restart: unless-stopped
    domainname: ${FQSN}
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
#    dns:
#      - ${HOST_IP}
#      - 8.8.8.8
    environment:
      - DUCKDNS_TOKEN=${DUCKDNS_TOKEN}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/traefik/traefik.yml:/etc/traefik/traefik.yml
      - ./config/traefik/providers/:/etc/traefik/providers/
      - ./config/traefik/auth/:/etc/traefik/auth/
      - ./config/traefik/acme.json:/etc/traefik/acme.json
      - ./config/traefik/logs/:/etc/traefik/logs/
    labels:
#      - "traefik.enable=true"
#      - "traefik.http.services.traefik-service.loadbalancer.server.port=8080"

      - "traefik.http.routers.traefik.rule=Host(`${FQSN}`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.tls=true"

#      - "traefik.http.routers.traefik.middlewares=auth"
#      - "traefik.http.middlewares.auth.basicauth.users=${AUTH_BASIC}"
#      - "traefik.http.middlewares.auth.basicauth.removeheader=true"
    extra_hosts:
      - host.docker.internal:172.17.0.1

  fail2ban-docker:
    image: $DOCKER_IMAGE_FAIL2BAN
    network_mode: host
    container_name: fail2ban-docker
    environment:
      - TZ
      - F2B_IPTABLES_CHAIN=DOCKER-USER
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - ./config/homeassistant/home-assistant.log:/var/logs/homeassistant/home-assistant.log:ro
      - ./config/traefik/logs/:/var/logs/traefik/:ro
      - ./config/fail2ban/docker:/data
    restart: unless-stopped

  fail2ban-input:
    image: $DOCKER_IMAGE_FAIL2BAN
    network_mode: host
    container_name: fail2ban-input
    environment:
      - TZ
      - F2B_IPTABLES_CHAIN=INPUT
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - /var/log:/var/log:ro
      - ./config/fail2ban/input:/data
    restart: unless-stopped

  homeassistant:
    container_name: homeassistant
    restart: unless-stopped
    image: $DOCKER_IMAGE_HOMEASSISTANT
    volumes:
      - ./config/homeassistant/:/config/
      - /etc/localtime:/etc/localtime:ro
    privileged: true
    environment:
      - PUID
      - PGID
      - TZ
    network_mode: host
#    networks:
#      traefik_proxy:
    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.homeassistant.rule=Host(`${FQSN}`)"
      - "traefik.http.routers.homeassistant.entrypoints=websecure"
      - "traefik.http.routers.blog.tls=true"

#      - "traefik.http.routers.homeassistant.tls=true"
      - "traefik.http.services.homeassistant.loadbalancer.server.port=8123"

  appdaemon:
    container_name: appdaemon
    network_mode: host
    build:
      context: ./config/appdaemon
      dockerfile: Dockerfile
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./config/appdaemon/:/conf/
    restart: unless-stopped

  postgres:
    container_name: postgres
    image: $DOCKER_IMAGE_POSTGRES
    network_mode: host
    restart: unless-stopped
    volumes:
      - database_data:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: $POSTGRES_USER
      POSTGRES_PASSWORD: $POSTGRES_PASSWORD
      POSTGRES_DB: postgres

  mosquitto:
    image: $DOCKER_IMAGE_MOSQUITTO
    container_name: mosquitto
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./config/mosquitto/config/:/mosquitto/config/
      - ./config/mosquitto/data/:/mosquitto/data/
    ports:
      - "1883:1883"
      - "9001:9001"
    restart: unless-stopped

  duckdns:
    image: $DOCKER_IMAGE_DUCKDNS
    container_name: duckdns
    environment:
      - TZ
      - SUBDOMAINS=$DUCKDNS_SUBDOMAIN
      - TOKEN=$DUCKDNS_TOKEN
    restart: unless-stopped

  deconz:
    image: $DOCKER_IMAGE_DECONZ
    container_name: deconz
    network_mode: host
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./config/deconz:/root/.local/share/dresden-elektronik/deCONZ
    devices:
      - /dev/ttyACM0
    environment:
      - DECONZ_WEB_PORT=1080
      - DECONZ_WS_PORT=1443
      - DEBUG_INFO=1
      - DEBUG_APS=0
      - DEBUG_ZCL=0
      - DEBUG_ZDP=0
      - DEBUG_OTAU=0
      - DECONZ_DEVICE=/dev/ttyACM0


# sudo systemctl stop systemd-resolved
# nano /etc/systemd/resolved.conf
#  sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
#[Resolve]
#DNS=8.8.8.8
#DNSStubListener=no
  pihole:
    image: ${DOCKER_IMAGE_PIHOLE}
    container_name: pihole
    restart: unless-stopped
#    network_mode: host
    cap_add:
      - CAP_NET_BIND_SERVICE
#      - CAP_NET_RAW  # DHCP
#      - CAP_NET_ADMIN  # DHCP
    dns:
      - 127.0.0.1
      - 1.1.1.1
    ports:
      - '0.0.0.0:53:53/tcp'
      - '0.0.0.0:53:53/udp'
      - '0.0.0.0:8888:8888'
##      - '0.0.0.0:67:67/udp'  # DHCP
##      - '0.0.0.0:8053:80/tcp'
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./config/pihole/data/:/etc/pihole/
      - ./config/pihole/dnsmasqd/:/etc/dnsmasq.d/
      - ./config/pihole/log/:/var/log/pihole/
    environment:
      - PUID
      - PGID
      - ServerIP=${HOST_IP}
#      - PROXY_LOCATION=pihole
#      - VIRTUAL_HOST=${FQSN}
      - VIRTUAL_PORT=8888
      - WEB_PORT=8888
      - WEBPASSWORD=${PI_HOLE_PASSWORD}
    extra_hosts:
      # Resolve to nothing domains (terminate connection)
      - "nw2master.bioware.com nwn2.master.gamespy.com:0.0.0.0"
      # LAN hostnames for other docker containers
      - "${FQSN}:${HOST_IP}"
#      - "pihole pihole.${FQSN}:${HOST_IP}"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pihole.rule=HostRegexp(`{any:.+}`)"
      - "traefik.http.routers.pihole.entrypoints=web, websecure"
      - "traefik.http.routers.pihole.priority=1"
      - "traefik.http.services.pihole.loadbalancer.server.port=8888"

volumes:
  database_data:
    name: database_data


#networks:
#  traefik_proxy:
#    external:
#      name: traefik_proxy
#  default:
#    driver: bridge