compose.yaml

include:
  - automation/compose.yaml
  - cloud/compose.yaml
  - media/compose.yaml

# service containers
name: service
services:

  socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    restart: always
    read_only: true
    networks:
      - docker-socket
    env_file:
      - common.env
    environment:
      - LOG_LEVEL=warning
      - CONTAINERS=1
      - EVENTS=1
      - IMAGES=1
      - INFO=1
      - PING=1
      - NETWORKS=1
      - POST=1
      - VERSION=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    healthcheck:
      test: [ "CMD-SHELL", "wget --no-verbose --spider --tries=1 http://localhost:2375/_ping || exit 1" ]
      start_period: 30s
      timeout: 5s
    tmpfs:
      - /run
    labels:
      - dev.quenary.tugtainer.protected=true

  tugtainer:
    image: ghcr.io/quenary/tugtainer:1
    restart: always
    networks:
      - docker-socket
      - default
      - automation
    env_file:
      - common.env
      - ./.config/tugtainer/config.env
      - ./.config/tugtainer/secrets.env
    volumes:
      - /tank/containers/tugtainer:/tugtainer
    expose:
      - 80
    depends_on:
      socket-proxy:
        condition: service_healthy
      pocket-id:
        condition: service_healthy
    labels:
      - traefik.enable=true
      - traefik.http.services.tugtainer.loadbalancer.server.port=80
      - traefik.http.routers.tugtainer.middlewares=secure@file
      - dev.quenary.tugtainer.protected=true

  lldap:
    image: ghcr.io/lldap/lldap:stable-alpine-rootless
    init: true
    restart: always
    read_only: true
    user: 1000:1000
    networks:
      - default
      - cloud
      - media
    env_file:
      - common.env
    environment:
      - LLDAP_LDAP_BASE_DN=dc=viggy96,dc=me
      - LLDAP_JWT_SECRET_FILE=/data/jwt_secret
    volumes:
      - /tank/containers/lldap:/data
    expose:
      - 17170
    labels:
      - traefik.enable=true
      - traefik.http.services.lldap.loadbalancer.server.port=17170
      - traefik.http.routers.lldap.middlewares=private@file

  pocket-id:
    image: ghcr.io/pocket-id/pocket-id:v2-distroless
    init: true
    restart: always
    read_only: true
    user: 1000:1000
    networks:
      - default
      - cloud
      - media
    env_file:
      - common.env
      - ./.config/pocket-id/config.env
      - ./.config/pocket-id/secrets.env
    volumes:
      - /tank/containers/pocket-id:/app/data
    expose:
      - 1411
    depends_on:
      lldap:
        condition: service_healthy
    healthcheck:
      test: [ "CMD", "/app/pocket-id", "healthcheck" ]
      start_period: 10s
      interval: 1m30s
      timeout: 5s
      retries: 2
    labels:
      - traefik.enable=true
      - traefik.http.services.pocket-id.loadbalancer.server.port=1411
      - traefik.http.routers.pocket-id.middlewares=secure@file
      - traefik.http.routers.pocket-id.rule=Host(`id.viggy96.me`)

  traefik:
    image: ghcr.io/traefik/traefik:latest
    init: true
    restart: always
    networks:
      - docker-socket
      - default
      - automation
      - cloud
      - media
    security_opt:
      - no-new-privileges:true
    env_file:
      - common.env
      - ./.config/traefik/secrets.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./.config/traefik/:/etc/traefik
    ports:
      - 80:80/tcp
      - 443:443/tcp
      - 443:443/udp
      - 8883:8883/tcp
    depends_on:
      socket-proxy:
        condition: service_healthy
    healthcheck:
      test: [ "CMD-SHELL", "traefik healthcheck --ping" ]
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.middlewares=private-admin@file
      - traefik.http.routers.traefik.service=api@internal

  www:
    image: ghcr.io/viggy96/resume-website:latest
    init: true
    restart: always
    env_file:
      - common.env
    environment:
      - ENV=production
    expose:
      - 443
    healthcheck:
      test: [ "CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:443/ || exit 1" ]
    labels:
      - traefik.enable=true
      - traefik.http.services.www.loadbalancer.server.port=443
      - traefik.http.middlewares.www-rep.redirectregex.regex=^https://viggy96.me/(.*)
      - traefik.http.middlewares.www-rep.redirectregex.replacement=https://www.viggy96.me/$${1}
      - traefik.http.middlewares.www-rep.redirectregex.permanent=true
      - traefik.http.routers.www.middlewares=www-rep,secure@file

  librespeed:
    image: ghcr.io/librespeed/speedtest:latest
    restart: always
    env_file:
      - common.env
      - www-data.env
    environment:
      - MODE=standalone
      - PASSWORD=
    expose:
      - 8080
    healthcheck:
      test: [ "CMD-SHELL", "curl --silent --show-error --fail http://localhost:8080/ || exit 1" ] 
    labels:
      - traefik.enable=true
      - traefik.http.services.librespeed.loadbalancer.server.port=8080
      - traefik.http.middlewares.librespeed-limit.buffering.maxRequestBodyBytes=10000000000
      - traefik.http.middlewares.librespeed-limit.buffering.memRequestBodyBytes=10000000000
      - traefik.http.middlewares.librespeed-limit.buffering.maxResponseBodyBytes=10000000000
      - traefik.http.middlewares.librespeed-limit.buffering.memResponseBodyBytes=10000000000
      - traefik.http.routers.librespeed.middlewares=librespeed-limit,private@file

networks:
  docker-socket:
    driver: bridge
  automation:
  cloud:
  media: