name: traefik

services:
  traefik:
    container_name: traefik
    env_file:
      - ./secrets/traefik.env
    image: traefik:latest
    restart: unless-stopped
    networks:
      - dns_network
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.cloudflare.acme.dnschallenge=true"
      - "--certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare"
      - "--certificatesresolvers.cloudflare.acme.email=thomas.chatting@icloud.com"
      - "--certificatesresolvers.cloudflare.acme.storage=/acme.json"
      - "--certificatesresolvers.cloudflare.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53"
      - "--providers.file.directory=/etc/traefik/dynamic"
      - "--providers.file.watch=true"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./acme.json:/acme.json
      - ./traefik_config:/etc/traefik/dynamic
    dns:
      - 192.168.0.114

  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    platform: linux/arm64
    env_file:
      - ./secrets/pihole.env
    volumes:
      - './etc-pihole:/etc/pihole'
      - './etc-dnsmasq.d:/etc/dnsmasq.d'
    dns:
      - 8.8.8.8
    shm_size: '128mb'
    networks:
      dns_network:
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - CAP_SYS_NICE
      - CAP_SYS_TIME
    security_opt:
      - seccomp:unconfined
    depends_on:
      - unbound
    ports:
      - '53:53/tcp'
      - '53:53/udp'
      - '67:67/udp'
      - '8082:80'
    environment:
      TZ: 'Europe/London'
      VIRTUAL_HOST: 'pihole.control.thomaschatting.dev'
      VIRTUAL_PORT: 80
      FTLCONF_dns_listeningMode: "ALL"
      FTLCONF_dns_upstreams: "unbound#53"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pihole.rule=Host(`pihole.control.thomaschatting.dev`)"
      - "traefik.http.routers.pihole.entrypoints=websecure"
      - "traefik.http.routers.pihole.tls=true"
      - "traefik.http.routers.pihole.tls.certresolver=cloudflare"
      - "traefik.http.routers.pihole.tls.domains[0].main=control.thomaschatting.dev"
      - "traefik.http.routers.pihole.tls.domains[0].sans=*.control.thomaschatting.dev"
      - "traefik.http.services.pihole.loadbalancer.server.port=80"
    restart: unless-stopped

  unbound:
    container_name: unbound
    image: klutchell/unbound:latest
    volumes:
      - ./unbound:/etc/unbound/custom.conf.d
    restart: unless-stopped
    networks:
      dns_network:

  netbootxyz:
    image: ghcr.io/netbootxyz/netbootxyz
    container_name: netbootxyz
    networks:
      - dns_network
    dns:
      192.168.0.114
    ports:
      - 3000:3000
      - 8083:8081
    environment:
      - MENU_VERSION=3.0.0
      - NGINX_PORT=8081
      - WEB_APP_PORT=3000
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.netboot.rule=Host(`boot.control.thomaschatting.dev`)"
      - "traefik.http.routers.netboot.entrypoints=websecure"
      - "traefik.http.routers.netboot.tls=true"
      - "traefik.http.routers.netboot.tls.certresolver=cloudflare"
      - "traefik.http.services.netboot.loadbalancer.server.port=3000"
    restart: unless-stopped

  watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    restart: unless-stopped
    dns:
      - 192.168.0.114
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - TZ=Europe/London
      - WATCHTOWER_SCHEDULE=0 0 3 * * *
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_LABEL_ENABLE=true
      - DOCKER_API_VERSION=1.44
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

  homepage:
    image: ghcr.io/gethomepage/homepage:latest
    container_name: homepage
    restart: unless-stopped
    networks:
      - dns_network
    environment:
      - HOMEPAGE_ALLOWED_HOSTS=control.thomaschatting.dev,*.control.thomaschatting.dev
    volumes:
      - ./homepage/config:/app/config
      - /var/run/docker.sock:/var/docker.sock:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.homepage.rule=Host(`control.thomaschatting.dev`)"
      - "traefik.http.routers.homepage.entrypoints=websecure"
      - "traefik.http.routers.homepage.tls=true"
      - "traefik.http.routers.homepage.tls.certresolver=cloudflare"
      - "traefik.http.routers.homepage.tls.domains[0].main=control.thomaschatting.dev"
      - "traefik.http.routers.homepage.tls.domains[0].sans=*.control.thomaschatting.dev"
      - "traefik.http.services.homepage.loadbalancer.server.port=3000"
      - "com.centurylinklabs.watchtower.enable=true"
    dns:
      - 192.168.0.114

  knot:
    build:
      context: /home/thomas/docker/knot-docker
    container_name: knot
    restart: unless-stopped
    networks:
      - dns_network
    environment:
      KNOT_SERVER_HOSTNAME: "knot.thomaschatting.dev"
      KNOT_SERVER_OWNER: "did:plc:j4otszsilb7e72lovja3rtcs"
      KNOT_SERVER_PORT: "443"
      APPVIEW_ENDPOINT: "https://tangled.org"
      KNOT_SERVER_LISTEN_ADDR: "0.0.0.0:5555"
      KNOT_SERVER_INTERNAL_LISTEN_ADDR: "127.0.0.1:5444"
      KNOT_SERVER_DB_PATH: "/app/knotserver.db"
      KNOT_REPO_SCAN_PATH: "/home/git/repositories"
    volumes:
      - ./knot/repositories:/home/git/repositories
      - ./knot/app:/app
      - ./knot/keys:/etc/ssh/keys
    ports:
      - "2222:22"       # Git SSH — Traefik can't proxy this, expose directly
    dns:
      - 192.168.0.114
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.knot.rule=Host(`knot.thomaschatting.dev`)"
      - "traefik.http.routers.knot.entrypoints=websecure"
      - "traefik.http.routers.knot.tls=true"
      - "traefik.http.routers.knot.tls.certresolver=cloudflare"
      - "traefik.http.routers.knot.tls.domains[0].main=knot.thomaschatting.dev"
      - "traefik.http.services.knot.loadbalancer.server.port=5555"

  airconnect:
    image: 1activegeek/airconnect:latest
    container_name: airconnect
    network_mode: host
    restart: unless-stopped
    environment:
      - AIRCAST_VAR=kill
      - AIRUPNP_VAR=-l 500:500 -c aac:256 -Z

networks:
  dns_network:
    driver: bridge