docker-compose.yml

version: '3.8'

services:

  proxz:
    image: traefik:3
    ports:
      - target: 443
        published: 443 
        mode: host
      - target: 80
        published: 80 
        mode: host
      #- target: 25
      #  published: 25
      #  mode: host
      - target: 993
        published: 993
        mode: host
      - target: 465
        published: 465
        mode: host
      - target: 587
        published: 587
        mode: host
      - target: 4190
        published: 4190
        mode: host
    environment:
      - TZ=$TZ
      - CF_DNS_API_TOKEN_FILE=/run/secrets/cloudflare_api_token
      - TRAEFIK_API=true
      - TRAEFIK_GLOBAL_SENDANONYMOUSUSAGE=false
      - TRAEFIK_GLOBAL_CHECKNEWVERSION=false
      - TRAEFIK_SERVERSTRANSPORT_INSECURESKIPVERIFY=true
      - TRAEFIK_ENTRYPOINTS_imap_ADDRESS=:993
      - TRAEFIK_ENTRYPOINTS_imap_PROXYPROTOCOL_TRUSTEDIPS=10.0.0.0/8
      # - TRAEFIK_ENTRYPOINTS_smtp_ADDRESS=:25
      # - TRAEFIK_ENTRYPOINTS_smtp_PROXYPROTOCOL_TRUSTEDIPS=10.0.0.0/8
      - TRAEFIK_ENTRYPOINTS_smtps_ADDRESS=:465
      - TRAEFIK_ENTRYPOINTS_smtps_PROXYPROTOCOL_TRUSTEDIPS=10.0.0.0/8
      - TRAEFIK_ENTRYPOINTS_msa_ADDRESS=:587
      - TRAEFIK_ENTRYPOINTS_msa_PROXYPROTOCOL_TRUSTEDIPS=10.0.0.0/8
      - TRAEFIK_ENTRYPOINTS_sieve_ADDRESS=:4190
      - TRAEFIK_ENTRYPOINTS_sieve_PROXYPROTOCOL_TRUSTEDIPS=10.0.0.0/8
      - TRAEFIK_ENTRYPOINTS_http_ADDRESS=:80
      - TRAEFIK_ENTRYPOINTS_http_HTTP_REDIRECTIONS_ENTRYPOINT_TO=https
      - TRAEFIK_ENTRYPOINTS_https_ADDRESS=:443
      - TRAEFIK_ENTRYPOINTS_https_HTTP_TLS_CERTRESOLVER=letsencrypt
      - TRAEFIK_ENTRYPOINTS_https_HTTP_TLS_DOMAINS_0_MAIN=$domain
      - TRAEFIK_ENTRYPOINTS_https_HTTP_TLS_DOMAINS_0_SANS=*.$domain
      - TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_STORAGE=/etc/certz/acme.json
      - TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_EMAIL=$email
      - TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_DNSCHALLENGE_PROVIDER=cloudflare
      - TRAEFIK_CERTIFICATESRESOLVERS_letsencrypt_ACME_DNSCHALLENGE_RESOLVERS=1.1.1.1:53
      - TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT=false
      - TRAEFIK_PROVIDERS_DOCKER_DEFAULTRULE=Host(`{{ `{{ index .Labels "com.docker.swarm.service.name" | splitList "_" | last }}` }}.$domain`)
      - TRAEFIK_PROVIDERS_FILE_FILENAME=/traefik_file_config.yml
    configs:
      - source: traefik_file_config
        target: /traefik_file_config.yml
    secrets: 
      - cloudflare_api_token
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - certz:/etc/certz
    labels:
      traefik.enable: 'true'
      traefik.http.routers.api.service: 'api@internal'
      
  backup:
    image: azinchen/duplicacy:latest
    environment:
      - TZ=$TZ
      - RUN_JOB_IMMEDIATELY=false
      - BACKUP_CRON=0 1 * * *
      - FILTER_PATTERNS=+git/*;+git-config/*;+uisp/;+uisp/unms/;+uisp/unms/unms-backups/*;+uisp/unms/config-backups/*;-uisp/*;+unifi/;+unifi/backup/*;-unifi/*;-esp/.*
      - STORAGE_URL=$BACKUP_STORAGE_URL
      - SNAPSHOT_ID=$BACKUP_ID
    secrets:
      - duplicacy_preferences
    volumes:
      - backup:/config
      - unifi:/data/unifi
      - uisp:/data/uisp
      - hass:/data/hass
      - esp:/data/esp
      - git:/data/git
      - git-config:/data/git-config
      
  restore:
    image: saspus/duplicacy-web:latest
    environment:
      - TZ=$TZ
      - GRP_ID=3875
      - USR_ID=3875
    volumes:
      - restore:/config
    labels:
      traefik.enable: 'true'
      traefik.http.services.restore.loadbalancer.server.port: 3875
      traefik.http.routers.restore.entrypoints: 'https'

  esp:
    image: esphome/esphome:latest
    command: ["-q", "dashboard", "/config"]
    deploy:
      mode: replicated
      replicas: 0
      restart_policy:
        condition: none
    environment:
      - TZ=$TZ
      - ESPHOME_DASHBOARD_USE_PING=true
    volumes:
      - esp:/config
    labels:
      traefik.enable: 'true'
      traefik.http.services.esp.loadbalancer.server.port: '6052'
      traefik.http.routers.esp.entrypoints: 'https'

  uisp:
    image: nico640/docker-unms:latest
    deploy:
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 0
      restart_policy:
        condition: none
    ports:
      - target: 2055
        published: 2055
        protocol: 'udp'
        mode: 'host'
    environment:
      - TZ=$TZ
      - QUIET_MODE=1
    volumes:
      - uisp:/config
    labels:
      traefik.enable: 'true'
      traefik.http.services.uisp.loadbalancer.server.port: 443
      traefik.http.services.uisp.loadbalancer.server.scheme: 'https'
      traefik.http.routers.uisp.entrypoints: 'https'

  unifi:
    image: jacobalberty/unifi:v8
    user: unifi
    environment:
      - TZ=$TZ
    ports:
      - target: 3478
        published: 3478
        protocol: 'udp'
        mode: 'host'
      - target: 8080
        published: 8080
        mode: 'host'
    volumes:
      - unifi:/unifi/data
      - unifi-log:/unifi/logs
    labels:
      traefik.enable: 'true'
      traefik.http.services.unifi.loadbalancer.server.port: 8443
      traefik.http.services.unifi.loadbalancer.server.scheme: 'https'
      traefik.http.routers.unifi.entrypoints: 'https'

  hass:
    image: homeassistant/raspberrypi4-64-homeassistant:stable
    privileged: true
    environment:
      - TZ=$TZ
    devices:
      - /dev/*:/dev/*
    volumes:
      - hass:/config
    labels:
      traefik.enable: 'true'
      traefik.http.services.hass.loadbalancer.server.port: 8123
      traefik.http.routers.hass.entrypoints: 'https'
      
  dash:
    image: grafana/grafana-oss:latest
    environment:
      - TZ=$TZ
    volumes:
      - grafana:/var/lib/grafana
    labels:
      traefik.enable: 'true'
      traefik.http.routers.dash.entrypoints: 'https'
      
  mon: 
    image: gcr.io/cadvisor/cadvisor:v0.47.1
    deploy:
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 0
      restart_policy:
        condition: none
    environment:
      - TZ=$TZ
    privileged: true
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro 
      - /var/lib/docker/:/mnt/docker:ro
    devices:
      - /dev/kmsg
    labels:
      traefik.enable: 'true'
      traefik.http.routers.mon.entrypoints: 'https'
      
  prom:
    image: prom/prometheus:latest
    deploy:
      endpoint_mode: dnsrr
      mode: replicated
      #replicas: 0
      restart_policy:
        condition: none
    environment:
      - TZ=$TZ
    configs:
      - source: prometheus_config
        target: /etc/prometheus/prometheus.yml
    volumes:
      - prometheus:/prometheus
    labels:
      traefik.enable: 'true'
      traefik.http.routers.prom.entrypoints: 'https'
      
  collectd-exporter:
    image: prom/collectd-exporter:master
    command: --collectd.listen-address=":25826"
    deploy:
      endpoint_mode: dnsrr
      mode: replicated
      #replicas: 0
      restart_policy:
        condition: none
    ports:
      - target: 25826
        published: 25826
        protocol: 'udp'
        mode: 'host'
    environment:
      - TZ=$TZ
        
  speed:
    image: openspeedtest/latest
    environment:
      - TZ=$TZ
    ports:
      - target: 3000
        published: 3000
        mode: 'host'
      - target: 3001
        published: 3001
        mode: 'host'
        
  certdumper:
    image: ghcr.io/kereis/traefik-certs-dumper:latest
    restart: unless-stopped
    depends_on:
      - proxz
    volumes:
      - certz:/traefik:ro
      - mail:/output
    environment:
      - TZ=$TZ
      - DOMAIN=$domain
    
  mail:
    image: stalwartlabs/mail-server:latest
    ports:
      - target: 25
        published: 25 
        mode: host
    labels:
      traefik.enable: 'true'
      
      traefik.http.services.mail.loadbalancer.server.port: 8080
      traefik.http.routers.mail.entrypoints: 'https'

      # traefik.tcp.routers.smtp.rule: HostSNI(`*`)
      # traefik.tcp.routers.smtp.entrypoints: 'smtp'
      # traefik.tcp.routers.smtp.service: 'smtp'
      # traefik.tcp.services.smtp.loadbalancer.server.port: 25
      # traefik.tcp.services.smtp.loadbalancer.proxyProtocol.version: 2

      traefik.tcp.routers.jmap.rule: HostSNI(`*`)
      traefik.tcp.routers.jmap.tls.passthrough: 'true'
      traefik.tcp.routers.jmap.entrypoints: 'https'
      traefik.tcp.routers.jmap.service: 'jmap'
      traefik.tcp.services.jmap.loadbalancer.server.port: 443
      traefik.tcp.services.jmap.loadbalancer.proxyProtocol.version: 2

      traefik.tcp.routers.smtps.rule: HostSNI(`*`)
      traefik.tcp.routers.smtps.tls.passthrough: 'true'
      traefik.tcp.routers.smtps.entrypoints: 'smtps'
      traefik.tcp.routers.smtps.service: 'smtps'
      traefik.tcp.services.smtps.loadbalancer.server.port: 465
      traefik.tcp.services.smtps.loadbalancer.proxyProtocol.version: 2

      traefik.tcp.routers.imaps.rule: HostSNI(`*`)
      traefik.tcp.routers.imaps.tls.passthrough: 'true'
      traefik.tcp.routers.imaps.entrypoints: 'imap'
      traefik.tcp.routers.imaps.service: 'imaps'
      traefik.tcp.services.imaps.loadbalancer.server.port: 993
      traefik.tcp.services.imaps.loadbalancer.proxyProtocol.version: 2
    volumes:
      - mail:/opt/stalwart-mail
      
  users:
    image: lldap/lldap:stable
    deploy:
      endpoint_mode: dnsrr
    ports:
      - target: 3890
        published: 3890
        mode: 'host'
    environment:
      - TZ=$TZ
      - LLDAP_JWT_SECRET_FILE=/run/secrets/LLDAP_JWT_SECRET
      - LLDAP_LDAP_USER_PASS_FILE=/run/secrets/LLDAP_LDAP_USER_PASS
      - LLDAP_LDAP_BASE_DN=$base_dn
    secrets:
      - LLDAP_JWT_SECRET
      - LLDAP_LDAP_USER_PASS
    volumes:
      - users:/data
    labels:
      traefik.enable: 'true'
      traefik.http.routers.users.entrypoints: 'https' 
      traefik.http.services.users.loadbalancer.server.port: 17170
      
  promtail:
    image: grafana/promtail:latest
    deploy:
      endpoint_mode: dnsrr
    environment:
      - TZ=$TZ
    ports:
      - target: 514
        published: 1514
        mode: 'host'
    configs:
      - source: promtail_config
        target: /etc/promtail/config.yml
    volumes:
      - /mnt/docker/containers:/var/lib/docker/containers:ro

  mqtt:
    image: eclipse-mosquitto
    command: mosquitto -c /mosquitto-no-auth.conf
    deploy:
      endpoint_mode: dnsrr
    environment:
      - TZ=$TZ
      
  mqtt_io:
    image: flyte/mqtt-io
    deploy:
      endpoint_mode: dnsrr
      mode: replicated
      replicas: 0
      restart_policy:
        condition: none
    environment:
      - TZ=$TZ
    #configs:
      #- source: mqtt_io_config
      #  target: /config.yml
      
  git:
    image: gitea/gitea:latest-rootless
    deploy:
      endpoint_mode: dnsrr
    environment:
      - TZ=$TZ
    ports:
      - target: 2222
        published: 2222
        mode: 'host'
    volumes:
      - git:/var/lib/gitea
      - git-config:/etc/gitea
    labels:
      traefik.enable: 'true'
      traefik.http.services.git.loadbalancer.server.port: 3000
      traefik.http.routers.git.entrypoints: 'https'
      
  raw:
    image: ghcr.io/izer-xyz/gitea-pages:latest
    environment:
      - TZ=$TZ
      - GITEA_HOST=git:3000
    labels:
      traefik.enable: 'true'
      traefik.http.services.raw.loadbalancer.server.port: 80
      traefik.http.routers.raw.entrypoints: 'https'    
      traefik.http.routers.jmap-client.rule: Host(`m.$domain`)
      traefik.http.routers.jmap-client.entrypoints: 'https' 

volumes:
  certz:
  backup:
  restore:
  esp:
  uisp:
  unifi:
  unifi-log:
    driver_opts:
      type: tmpfs
      device: tmpfs
  hass:
  grafana:
  prometheus:
  mail:
  users:
  git:
  git-config:
  caddy:

configs: 
  traefik_file_config:
    external: true
  prometheus_config:
    external: true
  promtail_config:
    external: true
  syslog_ng_config:
    external: true
  mqtt_io_config:
    external: true

secrets:
  cloudflare_api_token:
    external: true
  duplicacy_preferences:
    external: true
  LLDAP_JWT_SECRET:
    external: true
  LLDAP_LDAP_USER_PASS:
    external: true