networks:
  networking:
    name: networking
    external: false
  home:
    external: false
    driver: macvlan
    enable_ipv6: true
    driver_opts:
      parent: enp2s0
    ipam:
      config:
        - subnet: 192.168.178.0/24
          gateway: 192.168.178.1
          ip_range: 192.168.178.0/29
        - subnet: fd00::/64
          gateway: fd00::4a5d:35ff:fed9:b94f
          ip_range: fd00::0/80
    name: home
  proxy:
    external: true

volumes:
  pihole:
    name: pihole
  dnsmasq:
    name: dnsmasq
  samba-config:
    name: samba-config

services:
  pihole:
    image: pihole/pihole
    cap_add:
      - NET_ADMIN
    container_name: pihole
    hostname: pihole
    environment:
      ServerIP: 192.168.178.2
      ServerIPv6: fd00::2
      TZ: "Europe/Berlin"
      WEBPASSWORD: "lmaa,dw."
      PIHOLE_DNS_: 192.168.178.3;192.168.178.3
      VIRTUAL_HOST: pihole.fam-steinle.de
      CORS_HOSTS: homer.fam-steinle.de
    mac_address: d0:ca:ab:cd:ef:02
    networks:
      home:
        ipv4_address: 192.168.178.2
        ipv6_address: fd00::2
      proxy:
    ports:
      - "80:80"
      - "443:443"
      - "53:53/tcp"
      - "53:53/udp"
    restart: unless-stopped
    volumes:
      - pihole:/etc/pihole/
      - dnsmasq:/etc/dnsmasq.d/
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pihole.entrypoints=web"
      - "traefik.http.routers.pihole.rule=Host(`pihole.fam-steinle.de`)"
      - "traefik.http.routers.pihole.middlewares=pihole"
      - "traefik.http.middlewares.pihole.redirectscheme.scheme=https"
      - "traefik.http.routers.pihole-secure.entrypoints=websecure"
      - "traefik.http.routers.pihole-secure.rule=Host(`pihole.fam-steinle.de`)"
      - "traefik.http.routers.pihole-secure.middlewares=pihole-secure"
      - "traefik.http.middlewares.pihole-secure.headers.addvaryheader=true"
      - "traefik.http.middlewares.pihole-secure.headers.accesscontrolalloworiginlist=https://homer.fam-steinle.de"
      - "traefik.http.middlewares.pihole-secure.headers.accesscontrolallowheaders=*"
      - "traefik.http.middlewares.pihole-secure.headers.accesscontrolallowmethods=GET,POST,OPTIONS"
      - "traefik.http.routers.pihole-secure.service=pihole-secure"
      - "traefik.http.routers.pihole-secure.tls=true"
      - "traefik.http.routers.pihole-secure.tls.certresolver=myresolver"
      - "traefik.http.services.pihole-secure.loadbalancer.server.port=80"

  unbound:
    image: mvance/unbound
    container_name: unbound
    hostname: unbound
    mac_address: 02:42:c0:a8:b2:04
    networks:
      home:
        ipv4_address: 192.168.178.3
        ipv6_address: fd00::3
    ports:
      - "53:53/tcp"
      - "53:53/udp"
    restart: unless-stopped

  nfs:
    image: gists/nfs-server
    container_name: nfs
    hostname: nfs
    privileged: true
    cap_add:
      - SYS_ADMIN
      - SETPCAP
    networks:
      - networking
    ports:
      - "2049:2049"
    environment:
      NFS_DIR: /nfs-share
      NFS_DOMAIN: 192.168.178.0/24
      NFS_OPTION: rw,sync,no_subtree_check,nohide,no_root_squash,fsid=0
    volumes:
      - /media/backup:/nfs-share
    restart: unless-stopped

  # Exec into container at first start
  # and create the user and the samba password:
  #   adduser USER
  #   smbpasswd -a USER
  samba:
    image: gists/samba-server
    container_name: samba
    hostname: samba
    networks:
      - networking
    ports:
      - "137:137/udp"
      - "138:138/udp"
      - "139:139/tcp"
      - "445:445/tcp"
    environment:
      PUID: 1000
      GUID: 1000
      TZ: Europe/Berlin
      PASSWORD: lmaa,dw.
    restart: unless-stopped
    volumes:
      - ./smb.conf:/etc/samba/smb.conf:ro
      - /media/backup:/mnt

  sftp:
    image: drakkan/sftpgo:alpine-slim
    container_name: sftp
    hostname: sftp
    ports:
      - "2022:2022"
    networks:
      - proxy
    environment:
      SFTPGO_HTTPD__BINDINGS__0__PORT: 8090
    restart: unless-stopped
    volumes:
      - /media/backup/sftp/data:/srv/sftpgo
      - /media/backup/sftp/home:/var/lib/sftpgo
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.sftp.entrypoints=web"
      - "traefik.http.routers.sftp.rule=Host(`sftp.fam-steinle.de`)"
      - "traefik.http.routers.sftp.middlewares=sftp"
      - "traefik.http.middlewares.sftp.redirectscheme.scheme=https"
      - "traefik.http.routers.sftp-secure.entrypoints=websecure"
      - "traefik.http.routers.sftp-secure.rule=Host(`sftp.fam-steinle.de`)"
      - "traefik.http.routers.sftp-secure.service=sftp-secure"
      - "traefik.http.routers.sftp-secure.tls=true"
      - "traefik.http.routers.sftp-secure.tls.certresolver=myresolver"
      - "traefik.http.services.sftp-secure.loadbalancer.server.port=8090"