version: "3.9"

networks:
  proxy:
    external: true
  internal:
    external: false
    driver: bridge

volumes:
  nextcloud:
    name: nextcloud
  nextcloud-data:
    name: nextcloud-data
  nextcloud-config:
    name: nextcloud-config
  mysql8-data:
    name: mysql8-data
  mysql8-backup:
    name: mysql8-backup
  psql14-data:
    name: psql14-data
  psql14-backup:
    name: psql14-backup
  redis-data:
    name: redis-data
  gitea:
    name: gitea
  vault:
    name: vault
  bookstack:
    name: bookstack
  kimai:
    name: kimai
  kimai-var:
    name: kimai-var
  pihole:
    name: pihole
  dnsmasq:
    name: dnsmasq

services:
  traefik:
    image: traefik:v2.5
    container_name: traefik
    restart: unless-stopped
    command:
      - --global.sendAnonymousUsage=false
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.network=proxy
      - --providers.docker.exposedByDefault=false
      - --providers.docker.swarmMode=false
      - --entryPoints.web.address=:80
      - --entryPoints.websecure.address=:443
      - --log=true
      - --log.level=DEBUG
      - --accessLog=true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /${PWD}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=web"
      - "traefik.http.routers.traefik.rule=Host(`traefik.localhost`)"
      - "traefik.http.services.traefik.loadbalancer.server.port=8080"
    networks:
      - proxy

  mysql8:
    image: mysql:8
    container_name: mysql8
    command: --default-authentication-plugin=mysql_native_password
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: "${DB_ROOT_PW}"
    volumes:
      - mysql8-data:/var/lib/mysql
      - mysql8-backup:/var/backups
      - ${PWD}/mysql_databases.sql:/docker-entrypoint-initdb.d/01_create_databases.sql
    networks:
      - internal

  psql14:
    image: postgres:14-alpine
    container_name: psql14
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD: ${DB_ROOT_PW}
    volumes:
      - psql14-data:/var/lib/postgresql/data
      - psql14-backup:/var/backups
      - ${PWD}//postgres_databases.sql:/docker-entrypoint-initdb.d/01_create_databases.sql
    networks:
      - internal

  redis:
    image: redis:alpine
    container_name: redis
    restart: unless-stopped
    volumes:
      - redis-data:/data
    networks:
      - internal

  nextcloud:
    image: nextcloud:22-fpm-alpine
    container_name: nextcloud
    restart: unless-stopped
    volumes:
      - nextcloud:/var/www/html
      - nextcloud-data:/var/www/html/data
      - nextcloud-config:/var/www/html/config
    networks:
      - internal
    environment:
      - MYSQL_DATABASE:nextcloud
      - MYSQL_USER:nextcloud
      - MYSQL_PASSWORD:jX9hKI2POvt1VrjVbBs4
      - MYSQL_HOST:mysql8
      - REDIS_HOST:redis
      - REDIS_HOST_PASSWORD:${REDIS_PW}
      - NEXTCLOUD_ADMIN_USER:${NEXTCLOUD_ADMIN_USER}
      - NEXTCLOUD_ADMIN_PASSWORD:${NEXTCLOUD_ADMIN_PW}
      - NEXTCLOUD_TRUSTED_DOMAINS:cs-nextcloud.ddnss.de nextcloud.localhost
      - VIRTUAL_HOST:nextcloud
    depends_on:
      - psql14
      - redis

  nginx-nc:
    image: nginx:alpine
    container_name: nginx-nc
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nextcloud.entrypoints=web"
      - "traefik.http.routers.nextcloud.rule=Host(`nextcloud.localhost`)"
      - "traefik.http.services.nextcloud.loadbalancer.server.port=80"
    depends_on:
      - nextcloud
    networks:
      - proxy
      - internal
    volumes:
      - nextcloud:/var/www/html
      - ${PWD}/nextcloud.conf:/etc/nginx/conf.d/default.conf

  gitea:
    image: gitea/gitea
    container_name: gitea
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=psql14:5432
      - GITEA__database__NAME=gitea
      - GITEA__database__USER=gitea
      - GITEA__database__PASSWD=sadlkf0234lsdf
    restart: unless-stopped
    volumes:
      - gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    depends_on:
      - psql14
    networks:
      - internal
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.gitea-web.entrypoints=web"
      - "traefik.http.routers.gitea-web.rule=Host(`cs-gitea.ddnss.de`) || Host(`gitea.localhost`)"
      - "traefik.http.services.gitea-web.loadbalancer.server.port=3000"

  vaultwarden:
    image: vaultwarden/server
    restart: unless-stopped
    container_name: vaultwarden
    volumes:
      - vault:/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vaultwarden.entrypoints=web"
      - "traefik.http.routers.vaultwarden.rule=Host(`vault.localhost`)"
      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"
    networks:
      - internal
      - proxy

  bookstack:
    image: linuxserver/bookstack
    restart: unless-stopped
    container_name: bookstack
    depends_on:
      - mysql8
    volumes:
      - bookstack:/config
    environment:
      - PUID=1000
      - GUID=1000
      - APP_URL=http://bookstack.localhost
      - DB_HOST=mysql8
      - DB_USER=bookstack
      - DB_PASS=sdfl39302klsdjf
      - DB_DATABASE=bookstack
    networks:
      - internal
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.bookstack.entrypoints=web"
      - "traefik.http.routers.bookstack.rule=Host(`bookstack.localhost`)"
      - "traefik.http.services.bookstack.loadbalancer.server.port=80"

  nginx-kimai:
    image: nginx:alpine
    container_name: nginx-kimai
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.kimai.entrypoints=web"
      - "traefik.http.routers.kimai.rule=Host(`kimai.localhost`)"
      - "traefik.http.services.kimai.loadbalancer.server.port=80"
    depends_on:
      - kimai
    networks:
      - proxy
      - internal
    volumes:
      - kimai:/opt/kimai/public:ro
      - ${PWD}/kimai.conf:/etc/nginx/conf.d/default.conf

  kimai:
    image: kimai/kimai2
    container_name: kimai
    restart: unless-stopped
    environment:
      - ADMINMAIL=christiansteinle@arcor.de
      - ADMINPASS=ZovJdPamHwSNCGTcOPDb
      - DATABASE_URL=mysql://kimai:xXW5dnQoMpAmdXrQgUgU@mysql8/kimai
      - TRUSTED_HOSTS=kimai.localhost
    networks:
      - internal
    volumes:
      - kimai:/opt/kimai/public
      - kimai-var:/opt/kimai/var

  pihole:
    image: pihole/pihole
    container_name: pihole
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp"
    environment:
      TZ: 'Europe/Berlin'
      WEBPASSWORD: 'sicher123'
    cap_add:
      - NET_ADMIN
    volumes:
      - pihole:/etc/pihole/
      - dnsmasq:/etc/dnsmasq.d
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pihole.entrypoints=web"
      - "traefik.http.routers.pihole.rule=Host(`pihole.localhost`)"
      - "traefik.http.services.pihole.loadbalancer.server.port=80"

# https://sensepost.com/blog/2020/building-a-hipster-aware-pi-home-server/
# https://github.com/chriscrowe/docker-pihole-unbound/blob/master/two-container/docker-compose.yaml