x-logging: &logging
  logging:
    driver: "local"
    options:
      max-size: "5m"
      max-file: "2"

services:

  ###################################
  #             FOUNDRY             #
  # https://rec.scarif.space/foundy #
  ###################################
  foundry:
    profiles: ["prod"]
    <<: *logging
    image: felddy/foundryvtt:release
    volumes:
        - /mnt/tower/containers/foundry:/data
        - ./foundry/patches:/data/patches
    restart: always
    environment:
      - "FOUNDRY_PASSWORD=${FOUNDRY_PASSWORD}"
      - "FOUNDRY_USERNAME=${FOUNDRY_USER}"
      - FOUNDRY_ADMIN_KEY=${FOUNDRY_ADMIN_KEY}
      - FOUNDRY_HOSTNAME=https://rec.${DOMAIN}
      - FOUNDRY_PROXY_PORT=443
      - FOUNDRY_PORT=443
      - FOUNDRY_PROXY_SSL=true
      - FOUNDRY_ROUTE_PREFIX=foundry
      - CONTAINER_CACHE=/data/container_cache
      - CONTAINER_PATCHES=/data/patches
      - FOUNDRY_UID=1000
      - FOUNDRY_GID=1000
      - VIRTUAL_HOST=rec.${DOMAIN}
      - LETSENCRYPT_HOST=rec.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=30000
      - VIRTUAL_PATH=/foundry
    networks:
      - nginx

  ###################################
  #            NEXTCLOUD            #
  #   https://tower.scarif.space    #
  ###################################
  nextcloud:
    profiles: ["prod", "dev"]
    <<: *logging
    build: ./nextcloud
    image: nextcloud:33-fpm-alpine
    restart: unless-stopped
    user: 1000:1000
    ports:
      - 9000:9000
    volumes:
      - /mnt/tower/containers/nextcloud:/var/www/html
      - ./nextcloud/redis-session.ini:/usr/local/etc/php/conf.d/redis-session.ini
      - /mnt/tower/stardust:/var/www/html/data
      - /mnt/tower/foundry:/var/www/foundry
    environment:
      - VIRTUAL_HOST=tower.${DOMAIN}
      - LETSENCRYPT_HOST=tower.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=9000
      - VIRTUAL_PROTO=fastcgi
      - REDIS_HOST=redis
      - MYSQL_HOST=db
      - MYSQL_PASSWORD=${DB_PASSWORD}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=${DB_USER}
      - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD}
      - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER}
      - MAIL_FROM_ADDRESS=${MAIL_FROM}
      - SMTP_HOST=${MAIL_HOST}
      - SMTP_PORT=${MAIL_PORT}
      - SMTP_USER=${MAIL_USER}
      - SMTP_PASSWORD=${MAIL_PASSWORD}
      - "NEXTCLOUD_TRUSTED_DOMAINS=tower.${DOMAIN} 127.0.0.1"
      - USER_UID=1000
      - USER_GID=1000
      - APACHE_RUN_USER=1000
      - APACHE_RUN_GROUP=1000
    depends_on:
      - db
      - redis
    networks:
      - db
      - redis
      - nginx
    extra_hosts:
      - "tower.${DOMAIN}:${LOCAL_IP}"
      - "office.${DOMAIN}:${LOCAL_IP}" 

  collabora:
    profiles: ["prod", "dev"]
    <<: *logging
    image: collabora/code
    restart: unless-stopped
    cap_add:
      - MKNOD
    environment:
      - VIRTUAL_HOST=office.${DOMAIN}
      - LETSENCRYPT_HOST=office.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=9980
      - "DONT_GEN_SSL_CERT=True"
      - domain=tower.${DOMAIN}
      - "aliasgroup1=https://tower.${DOMAIN}"
      - cert_domain=office.${DOMAIN}
      - server_name=office.${DOMAIN}
      - username=${COLLABORA_USER}
      - password=${COLLABORA_PASSWORD}
      - "extra_params=-o:ssl.enable=false --o:ssl.termination=true"
      - "dictionaries=de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru ro"
    networks:
      - nginx
    extra_hosts:
      - "tower.${DOMAIN}:${LOCAL_IP}"
      - "office.${DOMAIN}:${LOCAL_IP}"

  ###################################
  #           VAULTWARDEN           #
  #   https://vault.scarif.space    #
  ###################################
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    environment:
      - "DOMAIN=https://vault.${DOMAIN}"
      - VIRTUAL_HOST=vault.${DOMAIN}
      - LETSENCRYPT_HOST=vault.${DOMAIN}
      - VIRTUAL_PORT=80
      - SIGNUPS_ALLOWED=false
    networks:
      - nginx
    volumes:
      - /mnt/tower/containers/vaultwarden:/data/

  ###################################
  #              GITEA              #
  #    https://labs.scarif.space    #
  ###################################
  gitea:
    profiles: ["prod", "dev"]
    <<: *logging
    image: gitea/gitea:1
    environment:
      - VIRTUAL_HOST=labs.${DOMAIN}
      - LETSENCRYPT_HOST=labs.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=3000
      - "APP_NAME=Labs: Where the good stuff happens"
      - RUN_MODE=prod
      - DOMAIN=labs.${DOMAIN}
      - ROOT_URL=https://labs.${DOMAIN}
      - DB_TYPE=mysql
      - DB_HOST=db
      - DB_NAME=gitea
      - DB_USER=${DB_USER}
      - DB_PASSWD=${DB_PASSWORD}
      - USER_UID=1200
      - USER_GID=1200
      - DISABLE_REGISTRATION=true
    restart: always
    volumes:
      - /mnt/tower/containers/gitea:/data
      - /mnt/tower/labs:/data/git
      - /home/git/.ssh/:/data/git/.ssh/
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "127.0.0.1:2222:22"
    networks:
      - db
      - nginx
    depends_on:
      - db
      
  ###################################
  #          AUDIOBOOKSHELF         #
  #    https://echo.scarif.space    #
  ###################################
  audiobookshelf:
    image: ghcr.io/advplyr/audiobookshelf:latest
    volumes:
      - /mnt/tower/stardust/chris/files/Library/Audiobooks:/audiobooks
      - /mnt/tower/stardust/chris/files/Library/Podcasts:/podcasts
      - /mnt/tower/containers/audiobookshelf/config:/config
      - /mnt/tower/containers/audiobookshelf:/metadata
    environment:
      - TZ=Europe/London
      - VIRTUAL_HOST=echo.${DOMAIN}
      - LETSENCRYPT_HOST=echo.${DOMAIN}
      - VIRTUAL_PORT=80
    networks:
      - nginx

  ###################################
  #              GROCY              #
  #  https://supplies.scarif.space  #
  ###################################
  grocy:
    image: lscr.io/linuxserver/grocy:latest
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
      - CURRENCY=GBP
      - DEFAULT_LOCALE=en_GB
      - VIRTUAL_HOST=supplies.${DOMAIN}
      - LETSENCRYPT_HOST=supplies.${DOMAIN}
      - VIRTUAL_PORT=80
    volumes:
      - /mnt/tower/containers/grocy:/config
      - ./grocy/config-dist.php:/config/config-dist.php
    restart: unless-stopped
    networks:
      - nginx

  ###################################
  #             HOMEBOX             #
  #   https://assets.scarif.space   #
  ###################################
  homebox:
    image: ghcr.io/sysadminsmedia/homebox:latest
    restart: always
    environment:
      - HBOX_LOG_LEVEL=info
      - HBOX_LOG_FORMAT=text
      - HBOX_WEB_MAX_UPLOAD_SIZE=20
      - HBOX_OPTIONS_ALLOW_ANALYTICS=false
      - HBOX_AUTH_API_KEY_PEPPER=${HOMEBOX_API_KEY_PEPPER}
      - HBOX_OPTIONS_ALLOW_REGISTRATION=true
      - VIRTUAL_HOST=assets.${DOMAIN}
      - LETSENCRYPT_HOST=assets.${DOMAIN}
      - VIRTUAL_PORT=7745
    volumes:
      - /mnt/tower/containers/homebox:/data/
    networks:
      - nginx

  ###################################
  #             SEARXNG             #
  #  https://holocron.scarif.space  #
  ###################################
  searxng:
    image: docker.io/searxng/searxng:latest
    restart: unless-stopped
    networks:
      - nginx
      - redis
    volumes:
      - ./searxng:/etc/searxng:rw
      - /mnt/tower/containers/searxng:/var/cache/searxng:rw
    environment:
      - SEARXNG_BASE_URL=https://${SEARXNG_HOSTNAME:-localhost}/
      - SEARXNG_SECRET=${SEARXNG_SECRET_KEY}
      - VIRTUAL_HOST=holocron.${DOMAIN}
      - LETSENCRYPT_HOST=holocron.${DOMAIN}
      - VIRTUAL_PORT=8080
      - CERT_NAME=${DOMAIN}
    <<: *logging

  ###################################
  #           MINECRAFT             #
  ###################################
  minecraft:
    profiles: ["prod"]
    <<: *logging
    image: itzg/minecraft-server
    tty: true
    stdin_open: true
    ports:
      - "25565:25565"
    environment:
      - TYPE=VANILLA
      - VERSION=LATEST
      - EULA=TRUE
      - MEMORY=2G
      - RCON_PASSWORD=${MINECRAFT_PASSWORD}
      - MOTD="Scarif Minecraft Server"
      - WHITELIST=${MINECRAFT_WHITELIST}
    volumes:
      - /mnt/tower/containers/minecraft:/data

  mc-backup:
    profiles: ["prod"]
    <<: *logging
    image: itzg/mc-backup
    depends_on:
      minecraft:
        condition: service_healthy
    environment:
      - RCON_HOST=minecraft
      - RCON_PASSWORD=${MINECRAFT_PASSWORD}
      - INITIAL_DELAY=0
      - BACKUP_INTERVAL=24h
      - PAUSE_IF_NO_PLAYERS=true
      - PLAYERS_ONLINE_CHECK_INTERVAL=10
      - PRUNE_BACKUPS_DAYS=30
    volumes:
      - /mnt/tower/containers/minecraft:/data
      - /mnt/tower/containers/minecraft/backup:/backups

  ###################################
  #            NAVIDROME            #
  #    https://radio.scarif.space   #
  ###################################
  navidrome:
    profiles: ["prod"]
    <<: *logging
    image: deluan/navidrome:latest
    restart: unless-stopped
    environment:
      - VIRTUAL_HOST=radio.${DOMAIN}
      - LETSENCRYPT_HOST=radio.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=4533
      - ND_SCANSCHEDULE=1h
      - ND_LOGLEVEL=info
      - ND_SESSIONTIMEOUT=24h
      - ND_BASEURL=https://radio.${DOMAIN}
    volumes:
      - /mnt/tower/containers/navidrome:/data
      - /mnt/tower/stardust/chris/files/Library/Music:/music:ro
    networks:
      - nginx

  ###################################
  #             PIHOLE              #
  #     https://net.scarif.space    #
  ###################################
  pihole:
    profiles: ["prod"]
    <<: *logging
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
    environment:
      - VIRTUAL_HOST=net.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - TZ="Europe/London"
      - WEBPASSWORD=${PIHOLE_PASSWORD}
    volumes:
      - "/mnt/tower/containers/pihole/etc-pihole:/etc/pihole"
      - "./pihole/etc-dnsmasq.d:/etc/dnsmasq.d"
    restart: unless-stopped
    networks:
      - nginx

  ###################################
  #            DAWARICH             #
  #     https://map.scarif.space    #
  ###################################
  dawarich_app:
    image: freikin/dawarich:latest
    volumes:
      - /mnt/tower/containers/dawarich/public:/var/app/public
      - /mnt/tower/containers/dawarich/watched:/var/app/tmp/imports/watched
      - /mnt/tower/containers/dawarich/storage:/var/app/storage
      - /mnt/tower/containers/dawarich/data:/dawarich_db_data
    networks:
      - dawarich
      - redis
      - nginx
    stdin_open: true
    tty: true
    entrypoint: web-entrypoint.sh
    command: ['bin/rails', 'server', '-p', '3000', '-b', '::']
    restart: unless-stopped
    environment:
      VIRTUAL_HOST: maps.${DOMAIN}
      VIRTUAL_PORT: 3000
      LETSENCRYPT_HOST: maps.${DOMAIN}
      RAILS_ENV: ${RAILS_ENV:-production}
      PUID: ${PUID:-1000}
      PGID: ${PGID:-1000}
      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
      DATABASE_HOST: ${DATABASE_HOST:-dawarich_db}
      DATABASE_PORT: ${DATABASE_PORT:-5432}
      DATABASE_USERNAME: ${DATABASE_USERNAME:-postgres}
      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
      DATABASE_NAME: ${DATABASE_NAME:-dawarich_development}
      APPLICATION_HOSTS: maps.${DOMAIN},localhost,::1,127.0.0.1
      TIME_ZONE: ${TIME_ZONE:-Europe/London}
      APPLICATION_PROTOCOL: ${APPLICATION_PROTOCOL:-http}
      PROMETHEUS_EXPORTER_ENABLED: ${PROMETHEUS_EXPORTER_ENABLED:-false}
      SECRET_KEY_BASE: ${DAWARICH_SECRET_KEY}
      RAILS_LOG_TO_STDOUT: ${RAILS_LOG_TO_STDOUT:-true}
      SELF_HOSTED: ${SELF_HOSTED:-true}
      STORE_GEODATA: ${STORE_GEODATA:-true}
      WEB_CONCURRENCY: ${WEB_CONCURRENCY:-1}
    <<: *logging
    depends_on:
      - dawarich_db
      - redis
    deploy:
      resources:
        limits:
          cpus: ${APP_CPU_LIMIT:-0.50}
          memory: ${APP_MEMORY_LIMIT:-4G}

  dawarich_sidekiq:
    image: freikin/dawarich:latest
    volumes:
      - /mnt/tower/containers/dawarich/public:/var/app/public
      - /mnt/tower/containers/dawarich/watched:/var/app/tmp/imports/watched
      - /mnt/tower/containers/dawarich/storage:/var/app/storage
    networks:
      - dawarich
      - redis
    stdin_open: true
    tty: true
    entrypoint: sidekiq-entrypoint.sh
    command: ['sidekiq']
    restart: unless-stopped
    environment:
      RAILS_ENV: ${RAILS_ENV:-production}
      ### To run under a non-root user, set PUID/PGID here (do NOT use `user:`).
      # PUID: ${PUID:-1000}
      # PGID: ${PGID:-1000}
      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
      DATABASE_HOST: ${DATABASE_HOST:-dawarich_db}
      DATABASE_PORT: ${DATABASE_PORT:-5432}
      DATABASE_USERNAME: ${DATABASE_USERNAME:-postgres}
      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
      DATABASE_NAME: ${DATABASE_NAME:-dawarich_development}
      APPLICATION_HOSTS: maps.${DOMAIN},localhost,::1,127.0.0.1
      BACKGROUND_PROCESSING_CONCURRENCY: ${BACKGROUND_PROCESSING_CONCURRENCY:-3}
      APPLICATION_PROTOCOL: ${APPLICATION_PROTOCOL:-http}
      PROMETHEUS_EXPORTER_ENABLED: ${PROMETHEUS_EXPORTER_ENABLED:-false}
      SECRET_KEY_BASE: ${DAWARICH_SECRET_KEY}
      RAILS_LOG_TO_STDOUT: ${RAILS_LOG_TO_STDOUT:-true}
      SELF_HOSTED: ${SELF_HOSTED:-true}
      STORE_GEODATA: ${STORE_GEODATA:-true}
    <<: *logging
    depends_on:
      - dawarich_db
      - redis
      - dawarich_app

  dawarich_db:
    image: postgis/postgis:17-3.5-alpine
    shm_size: 1G
    volumes:
      - /mnt/tower/containers/dawarich/db:/var/lib/postgresql/data
    networks:
      - dawarich
    <<: *logging
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-password}
      POSTGRES_DB: ${POSTGRES_DB:-dawarich_development}
    restart: always

  ###################################
  #              SURE               #
  #  https://credits.scarif.space   #
  ###################################

  sure_app:
    image: ghcr.io/we-promise/sure:stable
    volumes:
      - /mnt/tower/containers/sure:/rails/storage
    restart: unless-stopped
    <<: *logging
    environment:
      VIRTUAL_HOST: credits.${DOMAIN}
      VIRTUAL_PORT: 3000
      LETSENCRYPT_HOST: credits.${DOMAIN}
      POSTGRES_USER: ${POSTGRES_USER:-sure_user}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-sure_password}
      POSTGRES_DB: ${POSTGRES_DB:-sure_production}
      SECRET_KEY_BASE: ${SURE_SECRET_KEY}
      SELF_HOSTED: "true"
      RAILS_FORCE_SSL: "false"
      RAILS_ASSUME_SSL: "false"
      DB_HOST: sure_db
      DB_PORT: 5432
      REDIS_URL: redis://redis:6379/1
    depends_on:
      - sure_db
      - redis
    networks:
      - sure
      - nginx
      - redis

  sure_worker:
    image: ghcr.io/we-promise/sure:stable
    command: bundle exec sidekiq
    <<: *logging
    volumes:
      - /mnt/tower/containers/sure:/rails/storage
    restart: unless-stopped
    depends_on:
      - sure_db
      - redis
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-sure_user}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-sure_password}
      POSTGRES_DB: ${POSTGRES_DB:-sure_production}
      SECRET_KEY_BASE: ${SURE_SECRET_KEY}
      SELF_HOSTED: "true"
      RAILS_FORCE_SSL: "false"
      RAILS_ASSUME_SSL: "false"
      DB_HOST: sure_db
      DB_PORT: 5432
      REDIS_URL: redis://redis:6379/1
    networks:
      - sure
      - redis

  sure_db:
    image: postgres:16
    <<: *logging
    restart: unless-stopped
    volumes:
      - /mnt/tower/containers/sure/db:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-sure_user}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-sure_password}
      POSTGRES_DB: ${POSTGRES_DB:-sure_production}
    networks:
      - sure

  ###################################
  #              WOLF               #
  ###################################
  wolf:
    image: ghcr.io/games-on-whales/wolf:stable
    <<: *logging
    environment:
      - NVIDIA_DRIVER_VOLUME_NAME=nvidia-driver-vol
    volumes:
      - /mnt/tower/containers/wolf/etc/wolf/:/etc/wolf:rw
      - ./wolf/config.toml:/etc/wolf/cfg/config.toml:ro
      - /var/run/docker.sock:/var/run/docker.sock:rw
      - /dev/:/dev/:rw
      - /run/udev:/run/udev:rw
      - nvidia-driver-vol:/usr/nvidia:rw
    devices:
      - /dev/dri
      - /dev/uinput
      - /dev/uhid
      - /dev/nvidia-uvm
      - /dev/nvidia-uvm-tools
      - /dev/nvidia-caps/nvidia-cap1
      - /dev/nvidia-caps/nvidia-cap2
      - /dev/nvidiactl
      - /dev/nvidia0
      - /dev/nvidia-modeset
    device_cgroup_rules:
      - 'c 13:* rmw'
    network_mode: host
    restart: unless-stopped
    
  ###################################
  #            JELLYFIN             #
  #  https://media.scarif.space   #
  ###################################
  jellyfin:
    image: jellyfin/jellyfin
    <<: *logging
    ports:
      - 8096:8096/tcp
      - 7359:7359/udp
    volumes:
      - ./jellyfin/config:/config
      - /mnt/tower/containers/jellyfin/cache:/cache
      - type: bind
        source: /mnt/tower/stardust/chris/files/Library/Movies
        target: /movies
      - type: bind
        source: /mnt/tower/stardust/chris/files/Library/Shows
        target: /shows
    restart: 'unless-stopped'
    # Optional - alternative address used for autodiscovery
    environment:
      - JELLYFIN_PublishedServerUrl=http://media.${DOMAIN}
      - VIRTUAL_HOST=media.${DOMAIN}
      - VIRTUAL_PORT=8096
      - LETSENCRYPT_HOST=media.${DOMAIN}
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    networks:
      - nginx

  ###################################
  #           PHOTOPRISM            #
  #  https://holo.scarif.space      #
  ###################################
  photoprism:
    image: photoprism/photoprism:latest
    <<: *logging
    # restart: unless-stopped
    stop_grace_period: 15s
    depends_on:
      - db
    security_opt:
      - seccomp:unconfined
      - apparmor:unconfined
    ports:
      - "2342:2342"
    environment:
      PHOTOPRISM_ADMIN_USER: "${PHOTOPRISM_USER}"
      PHOTOPRISM_ADMIN_PASSWORD: "${PHOTOPRISM_PASSWORD}"
      PHOTOPRISM_AUTH_MODE: "password"
      PHOTOPRISM_DISABLE_TLS: "true"
      PHOTOPRISM_DEFAULT_TLS: "false"
      PHOTOPRISM_SITE_URL: "http://holo.${DOMAIN}"
      PHOTOPRISM_SITE_TITLE: "Holo"
      PHOTOPRISM_SITE_CAPTION: "Photo library"
      PHOTOPRISM_READONLY: "false"
      PHOTOPRISM_EXPERIMENTAL: "true"
      PHOTOPRISM_DISABLE_CHOWN: "false"
      PHOTOPRISM_DISABLE_WEBDAV: "true"
      PHOTOPRISM_DISABLE_MCP: "true"
      PHOTOPRISM_SIDECAR_YAML: "true"
      PHOTOPRISM_BACKUP_ALBUMS: "true"
      PHOTOPRISM_BACKUP_DATABASE: "false"
      PHOTOPRISM_INDEX_SCHEDULE: "@every 3h"
      PHOTOPRISM_UPLOAD_LIMIT: 50000
      PHOTOPRISM_ORIGINALS_LIMIT: 50000
      PHOTOPRISM_HTTP_COMPRESSION: "zstd,gzip"
      PHOTOPRISM_DATABASE_DRIVER: "sqlite"
      PHOTOPRISM_INIT: "https tensorflow"
      OLLAMA_BASE_URL: "http://ollama:11434"
      OLLAMA_API_KEY: ""
      PHOTOPRISM_FFMPEG_ENCODER: "nvidia"
      PHOTOPRISM_FFMPEG_BITRATE: "64"
      NVIDIA_VISIBLE_DEVICES: "all"
      NVIDIA_DRIVER_CAPABILITIES: "all"
      PHOTOPRISM_UID: 1000
      PHOTOPRISM_GID: 1000
      PHOTOPRISM_UMASK: 0000
      VIRTUAL_HOST: "holo.${DOMAIN}"
      VIRTUAL_PORT: 2342
      LETSENCRYPT_HOST: "holo.${DOMAIN}"
    user: "1000:1000"
    devices:
     - "/dev/dri:/dev/dri"
    working_dir: "/photoprism" # do not change or remove
    volumes:
      - "/mnt/tower/stardust/chris/files/Memories:/photoprism/originals"
      - "/mnt/tower/stardust/chris/files/Unsorted/Memories:/photoprism/import"
      - "/mnt/tower/containers/photoprism/storage:/photoprism/storage"
      - "./photoprism/vision.yml:/photoprism/storage/config/vision.yml:ro"
    networks:
      - nginx
      - db
      - ollama
    deploy:
      resources:
        reservations:
          devices:
            - driver: "nvidia"
              capabilities: [ gpu ]
              count: "all"

  ###################################
  #            UTILITIES            #
  ###################################
  db:
    profiles: ["prod", "dev"]
    <<: *logging
    image: mariadb
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --skip-innodb-read-only-compressed
    environment:
      - MYSQL_ROOT_PASSWORD=${DB_PASSWORD}
      - MYSQL_USER=${DB_USER}
      - MYSQL_PASSWORD=${DB_PASSWORD}
    volumes:
      - /mnt/tower/containers/db:/var/lib/mysql
      - ./db/init:/docker-entrypoint-initdb.d
    restart: always
    networks:
      - db

  redis:
    profiles: ["prod", "dev"]
    <<: *logging
    image: redis:alpine
    restart: always
    networks:
      - redis

  mongodb:
    <<: *logging
    profiles: ["prod", "dev"]
    image: mongo
    restart: always
    volumes:
      - /mnt/tower/containers/mongodb:/data/db
    command: mongod
    networks:
      - db
    environment:
      - MONGO_INITDB_ROOT_USERNAME=${DB_USER}
      - MONGO_INITDB_ROOT_PASSWORD=${DB_PASSWORD}

  rsync-backup:
    <<: *logging
    build: ./backup
    volumes:
      - /mnt/tower:/data:ro
      - /mnt/backup/tower:/backup
      - ./backup/crontab.txt:/etc/crontabs/root:ro
      - ./backup/exclude.txt:/config/exclude.txt:ro
    restart: unless-stopped

  ## Ollama Large-Language Model Runner (optional)
  ## run "ollama pull [name]:[version]" to download a vision model
  ## listed at <https://ollama.com/search?c=vision>, for example:
  ## docker compose exec ollama ollama pull gemma4:latest
  ollama:
    image: ollama/ollama:latest
    <<: *logging
    restart: unless-stopped
    stop_grace_period: 15s
    # ports:
    #  - "11434:11434"
    environment:
      OLLAMA_HOST: "0.0.0.0:11434"
      OLLAMA_MODELS: "/root/.ollama"
      OLLAMA_MAX_QUEUE: "100"
      OLLAMA_NUM_PARALLEL: "1"
      OLLAMA_MAX_LOADED_MODELS: "1"
      OLLAMA_LOAD_TIMEOUT: "5m"
      OLLAMA_KEEP_ALIVE: "5m"
      OLLAMA_CONTEXT_LENGTH: "4096"
      OLLAMA_MULTIUSER_CACHE: "false"
      OLLAMA_NOPRUNE: "false"
      OLLAMA_NOHISTORY: "true"
      OLLAMA_FLASH_ATTENTION: "true"
      OLLAMA_KV_CACHE_TYPE: "f16"
      OLLAMA_SCHED_SPREAD: "false"
      DO_NOT_TRACK: "true"
      HF_HUB_DISABLE_TELEMETRY: "1"
      OLLAMA_NO_CLOUD: "1"           # uncomment to disable Ollama Cloud models/features
      ## NVIDIA GPU Hardware Acceleration (see https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html):
      NVIDIA_VISIBLE_DEVICES: "all"
      NVIDIA_DRIVER_CAPABILITIES: "compute,utility"
    volumes:
      - "ollama:/root/.ollama"
    networks:
      - ollama
    ## NVIDIA GPU Hardware Acceleration (see https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html):
    deploy:
      resources:
        reservations:
          devices:
            - driver: "nvidia"
              capabilities: [ gpu ]
              count: "all"

  nginx:
    <<: *logging
    profiles: ["prod", "dev"]
    image: nginxproxy/nginx-proxy
    restart: always
    ports:
      - "80:80"
      - "443:443"
    labels:
      - "com.github.nginx-proxy.nginx"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - /opt/ssl:/etc/nginx/certs:ro
      - html:/usr/share/nginx/html
      - vhost:/etc/nginx/vhost.d
      - ./nginx/vhost.d/labs_location:/etc/nginx/vhost.d/labs.${DOMAIN}_location:ro
      - ./nginx/vhost.d/office:/etc/nginx/vhost.d/office.${DOMAIN}:ro
      - ./nginx/vhost.d/rec:/etc/nginx/vhost.d/rec.${DOMAIN}:ro
      - ./nginx/vhost.d/tower_location_override:/etc/nginx/vhost.d/tower.${DOMAIN}_location_override:ro
      - ./nginx/vhost.d/tower:/etc/nginx/vhost.d/tower.${DOMAIN}:ro
      - ./nginx/vhost.d/assets:/etc/nginx/vhost.d/assets.${DOMAIN}:ro
      - ./nginx/conf.d/custom_proxy.conf:/etc/nginx/conf.d/custom_proxy.conf:ro
      - /mnt/tower/containers/nextcloud:/var/www/html/nextcloud:ro
      - ./christmas:/var/www/html/christmas:ro
    networks:
      - nginx

  acme-companion:
    <<: *logging
    profiles: ["prod"]
    image: nginxproxy/acme-companion
    restart: always
    environment:
      - DEFAULT_EMAIL=stoffles@gmail.com
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /opt/ssl:/etc/nginx/certs:rw
      - acme:/etc/acme.sh
      - vhost:/etc/nginx/vhost.d:rw
      - html:/usr/share/nginx/html:rw
    depends_on:
      - nginx
    networks:
      - nginx

  certs:
    profiles: ["dev"]
    image: paulczar/omgwtfssl
    restart: "no"
    volumes:
      - /opt/ssl:/certs
    environment:
      - SSL_SUBJECT=${DOMAIN}
      - CA_SUBJECT=chris@${DOMAIN}
      - SSL_KEY=/certs/${DOMAIN}.key
      - SSL_CSR=/certs/${DOMAIN}.csr
      - SSL_CERT=/certs/${DOMAIN}.crt

volumes:
  html:
  vhost:
  acme:
  ollama:
  nvidia-driver-vol:
    external: true

networks:
  db:
  nginx:
  redis:
  sure:
  dawarich:
  meet.jitsi:
  ollama: