x-logging: &logging
  logging:
    driver: "local"
    options:
      max-size: "5m"
      max-file: "2"

#x-firecrawl-service: &firecrawl-service
#  image: ghcr.io/mendableai/firecrawl
#
#x-firecrawl-env: &firecrawl-env
#  REDIS_URL: redis://redis:6379
#  REDIS_RATE_LIMIT_URL: redis://redis:6379
#  PLAYWRIGHT_MICROSERVICE_URL: http://playwright:3000/scrape

services:

  foundry:
    profiles: ["prod"]
    <<: *logging
    image: felddy/foundryvtt:release
    volumes:
        - /mnt/tower/containers/foundry:/data
        - ./foundry/patches:/data/patches
    restart: always
    environment:
      - "FOUNDRY_PASSWORD=${FOUNDRY_PASSWORD}"
      - "FOUNDRY_USERNAME=${FOUNDRY_USER}"
      - FOUNDRY_ADMIN_KEY=${FOUNDRY_ADMIN_KEY}
      - FOUNDRY_HOSTNAME=https://rec.${DOMAIN}
      - FOUNDRY_PROXY_PORT=443
      - FOUNDRY_PORT=443
      - FOUNDRY_PROXY_SSL=true
      - FOUNDRY_ROUTE_PREFIX=foundry
      - CONTAINER_CACHE=/data/container_cache
      - CONTAINER_PATCHES=/data/patches
      - FOUNDRY_UID=1000
      - FOUNDRY_GID=1000
      - VIRTUAL_HOST=rec.${DOMAIN}
      - LETSENCRYPT_HOST=rec.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=30000
      - VIRTUAL_PATH=/foundry
    networks:
      - nginx

  nextcloud:
    profiles: ["prod", "dev"]
    <<: *logging
    build: ./nextcloud
    image: nextcloud:33-fpm-alpine
    restart: unless-stopped
    user: 1000:1000
    ports:
      - 9000:9000
    volumes:
      - /mnt/tower/containers/nextcloud:/var/www/html
      - ./nextcloud/redis-session.ini:/usr/local/etc/php/conf.d/redis-session.ini
      - /mnt/tower/stardust:/var/www/html/data
      - /mnt/tower/foundry:/var/www/foundry
    environment:
      - VIRTUAL_HOST=tower.${DOMAIN}
      - LETSENCRYPT_HOST=tower.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=9000
      - VIRTUAL_PROTO=fastcgi
      - REDIS_HOST=redis
      - MYSQL_HOST=db
      - MYSQL_PASSWORD=${DB_PASSWORD}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=${DB_USER}
      - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD}
      - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER}
      - MAIL_FROM_ADDRESS=${MAIL_FROM}
      - SMTP_HOST=${MAIL_HOST}
      - SMTP_PORT=${MAIL_PORT}
      - SMTP_USER=${MAIL_USER}
      - SMTP_PASSWORD=${MAIL_PASSWORD}
      - "NEXTCLOUD_TRUSTED_DOMAINS=tower.${DOMAIN} 127.0.0.1"
      - USER_UID=1000
      - USER_GID=1000
      - APACHE_RUN_USER=1000
      - APACHE_RUN_GROUP=1000
    depends_on:
      - db
      - redis
    networks:
      - db
      - redis
      - nginx
    extra_hosts:
      - "tower.${DOMAIN}:${LOCAL_IP}"
      - "office.${DOMAIN}:${LOCAL_IP}" 

  collabora:
    profiles: ["prod", "dev"]
    <<: *logging
    image: collabora/code
    restart: unless-stopped
    cap_add:
      - MKNOD
    environment:
      - VIRTUAL_HOST=office.${DOMAIN}
      - LETSENCRYPT_HOST=office.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=9980
      - "DONT_GEN_SSL_CERT=True"
      - domain=tower.${DOMAIN}
      - "aliasgroup1=https://tower.${DOMAIN}"
      - cert_domain=office.${DOMAIN}
      - server_name=office.${DOMAIN}
      - username=${COLLABORA_USER}
      - password=${COLLABORA_PASSWORD}
      - "extra_params=-o:ssl.enable=false --o:ssl.termination=true"
      - "dictionaries=de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru ro"
    networks:
      - nginx
    extra_hosts:
      - "tower.${DOMAIN}:${LOCAL_IP}"
      - "office.${DOMAIN}:${LOCAL_IP}"

  gitea:
    profiles: ["prod", "dev"]
    <<: *logging
    image: gitea/gitea:1
    environment:
      - VIRTUAL_HOST=labs.${DOMAIN}
      - LETSENCRYPT_HOST=labs.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=3000
      - "APP_NAME=Labs: Where the good stuff happens"
      - RUN_MODE=prod
      - DOMAIN=labs.${DOMAIN}
      - ROOT_URL=https://labs.${DOMAIN}
      - DB_TYPE=mysql
      - DB_HOST=db
      - DB_NAME=gitea
      - DB_USER=${DB_USER}
      - DB_PASSWD=${DB_PASSWORD}
      - USER_UID=1200
      - USER_GID=1200
      - DISABLE_REGISTRATION=true
    restart: always
    volumes:
      - /mnt/tower/containers/gitea:/data
      - /mnt/tower/labs:/data/git
      - /home/git/.ssh/:/data/git/.ssh/
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "127.0.0.1:2222:22"
    networks:
      - db
      - nginx
    depends_on:
      - db
      
  audiobookshelf:
    image: ghcr.io/advplyr/audiobookshelf:latest
    volumes:
      - /mnt/tower/stardust/chris/files/Library/Audiobooks:/audiobooks
      - /mnt/tower/stardust/chris/files/Library/Podcasts:/podcasts
      - /mnt/tower/containers/audiobookshelf/config:/config
      - /mnt/tower/containers/audiobookshelf:/metadata
    environment:
      - TZ=Europe/London
      - VIRTUAL_HOST=echo.${DOMAIN}
      - LETSENCRYPT_HOST=echo.${DOMAIN}
      - VIRTUAL_PORT=80
    networks:
      - nginx

  grocy:
    image: lscr.io/linuxserver/grocy:latest
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
      - CURRENCY=GBP
      - DEFAULT_LOCALE=en_GB
      - VIRTUAL_HOST=supplies.${DOMAIN}
      - LETSENCRYPT_HOST=supplies.${DOMAIN}
      - VIRTUAL_PORT=80
    volumes:
      - /mnt/tower/containers/grocy:/config
      - ./grocy/config-dist.php:/config/config-dist.php
    restart: unless-stopped
    networks:
      - nginx

  homebox:
    image: ghcr.io/sysadminsmedia/homebox:latest
    restart: always
    environment:
      - HBOX_LOG_LEVEL=info
      - HBOX_LOG_FORMAT=text
      - HBOX_WEB_MAX_UPLOAD_SIZE=10
      # Please consider allowing analytics to help us improve Homebox (basic computer information, no personal data)
      - HBOX_OPTIONS_ALLOW_ANALYTICS=false
      # Use a strong random string for the pepper in production, it will be used to hash API keys and make them more secure
      - HBOX_AUTH_API_KEY_PEPPER=${HOMEBOX_API_KEY_PEPPER}
      - HBOX_OPTIONS_ALLOW_REGISTRATION=true
      - VIRTUAL_HOST=assets.${DOMAIN}
      - LETSENCRYPT_HOST=assets.${DOMAIN}
      - VIRTUAL_PORT=7745
    volumes:
      - /mnt/tower/containers/homebox:/data/
    networks:
      - nginx

  searxng:
    image: docker.io/searxng/searxng:latest
    restart: unless-stopped
    networks:
      - nginx
      - redis
    volumes:
      - ./searxng:/etc/searxng:rw
      - /mnt/tower/containers/searxng:/var/cache/searxng:rw
    environment:
      - SEARXNG_BASE_URL=https://${SEARXNG_HOSTNAME:-localhost}/
      - SEARXNG_SECRET=${SEARXNG_SECRET_KEY}
      - VIRTUAL_HOST=holocron.${DOMAIN}
      - LETSENCRYPT_HOST=holocron.${DOMAIN}
      - VIRTUAL_PORT=8080
      - CERT_NAME=${DOMAIN}
    <<: *logging

  minecraft:
    profiles: ["prod"]
    <<: *logging
    image: itzg/minecraft-server
    tty: true
    stdin_open: true
    ports:
      - "25565:25565"
    environment:
      - TYPE=VANILLA
      - VERSION=LATEST
      - EULA=TRUE
      - MEMORY=2G
      - RCON_PASSWORD=${MINECRAFT_PASSWORD}
      - MOTD="Scarif Minecraft Server"
      - WHITELIST=${MINECRAFT_WHITELIST}
    volumes:
      - /mnt/tower/containers/minecraft:/data

  mc-backup:
    profiles: ["prod"]
    <<: *logging
    image: itzg/mc-backup
    depends_on:
      minecraft:
        condition: service_healthy
    environment:
      - RCON_HOST=minecraft
      - RCON_PASSWORD=${MINECRAFT_PASSWORD}
      - INITIAL_DELAY=0
      - BACKUP_INTERVAL=24h
      - PAUSE_IF_NO_PLAYERS=true
      - PLAYERS_ONLINE_CHECK_INTERVAL=10
      - PRUNE_BACKUPS_DAYS=30
    volumes:
      - /mnt/tower/containers/minecraft:/data
      - /mnt/backups/minecraft:/backups

  navidrome:
    profiles: ["prod"]
    <<: *logging
    image: deluan/navidrome:latest
    restart: unless-stopped
    environment:
      - VIRTUAL_HOST=radio.${DOMAIN}
      - LETSENCRYPT_HOST=radio.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=4533
      - ND_SCANSCHEDULE=1h
      - ND_LOGLEVEL=info
      - ND_SESSIONTIMEOUT=24h
      - ND_BASEURL=https://radio.${DOMAIN}
    volumes:
      - /mnt/tower/containers/navidrome:/data
      - /mnt/tower/stardust/chris/files/Library/Music:/music:ro
    networks:
      - nginx

  pihole:
    profiles: ["prod"]
    <<: *logging
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
    environment:
      - VIRTUAL_HOST=net.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - TZ="Europe/London"
      - WEBPASSWORD=${PIHOLE_PASSWORD}
    volumes:
      - "/docker/pihole/etc-pihole:/etc/pihole"
      - "/docker/pihole/etc-dnsmasq.d:/etc/dnsmasq.d"
    restart: unless-stopped
    networks:
      - nginx

  # jitsi:
  #   profiles: ["prod"]
  #   <<: *logging
  #   image: jitsi/web:stable
  #   restart: unless-stopped
  #   volumes:
  #     - ${CONFIG}/web:/config:Z
  #     - ${CONFIG}/web/crontabs:/var/spool/cron/crontabs:Z
  #     - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts:Z
  #   environment:
  #     - VIRTUAL_HOST=comms.${DOMAIN}
  #     - LETSENCRYPT_HOST=comms.${DOMAIN}
  #     - VIRTUAL_PORT=80
  #     - CERT_NAME=${DOMAIN}
  #     - ENABLE_AUTH=1
  #     - ENABLE_GUESTS=1
  #     - ENABLE_PREJOIN_PAGE=1
  #     - ENABLE_WELCOME_PAGE=1
  #     - ENABLE_CLOSE_PAGE=1
  #     - ENABLE_NOISY_MIC_DETECTION=1
  #     - ETHERPAD_TITLE="Video Chat"
  #     - ETHERPAD_DEFAULT_PAD_TEXT="Welcome to Web Chat!\n\n"
  #     - ETHERPAD_SKIN_NAME="colibris"
  #     - ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background full-width-editor"
  #     - XMPP_BOSH_URL_BASE=https://xmpp.meet.jitsi:5280
  #     - XMPP_AUTH_DOMAIN
  #     - XMPP_MUC_DOMAIN
  #     - XMPP_GUEST_DOMAIN
  #     - XMPP_RECORDER_DOMAIN
  #   networks:
  #     nginx:
  #     meet.jitsi:
  #
  # prosody:
  #   profiles: ["prod"]
  #   <<: *logging
  #   image: jitsi/prosody:stable
  #   restart: unless-stopped
  #   expose:
  #     - '${XMPP_PORT:-52222}'
  #     - '5347'
  #     - '5280'
  #   volumes:
  #     - ${CONFIG}/prosody/config:/config:Z
  #     - ${CONFIG}/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
  #   environment:
  #     - ENABLE_NOISY_MIC_DETECTION=1
  #     - ENABLE_AUTH=1
  #     - ENABLE_GUESTS=1
  #     - ENABLE_LOBBY=1
  #     - XMPP_DOMAIN
  #     - XMPP_AUTH_DOMAIN
  #     - XMPP_MUC_DOMAIN
  #     - XMPP_INTERNAL_MUC_DOMAIN
  #     - XMPP_GUEST_DOMAIN
  #     - JVB_AUTH_USER
  #     - JIGASI_XMPP_USER=jigasi
  #     - XMPP_RECORDER_DOMAIN
  #     - JIBRI_RECORDER_USER=recorder
  #     - JIBRI_XMPP_USER=jibri
  #     - JICOFO_AUTH_PASSWORD=
  #   networks:
  #     meet.jitsi:
  #       aliases:
  #         - ${XMPP_SERVER:-xmpp.meet.jitsi}
  #
  # # Focus component
  # jicofo:
  #   profiles: ["prod"]
  #   <<: *logging
  #   image: jitsi/jicofo:stable
  #   restart: unless-stopped
  #   volumes:
  #     - ${CONFIG}/jicofo:/config:Z
  #   depends_on:
  #     - prosody
  #   environment:
  #     - ENABLE_AUTH=1
  #     - XMPP_DOMAIN
  #     - XMPP_MUC_DOMAIN
  #     - XMPP_INTERNAL_MUC_DOMAIN
  #     - JVB_BREWERY_MUC
  #     - JIGASI_BREWERY_MUC=jigasibrewery
  #     - XMPP_RECORDER_DOMAIN
  #     - JIBRI_BREWERY_MUC=jibribrewery
  #     - JIBRI_PENDING_TIMEOUT=90
  #     - JICOFO_AUTH_PASSWORD=
  #   networks:
  #     meet.jitsi:
  #
  # # Video bridge
  # jvb:
  #   profiles: ["prod"]
  #   <<: *logging
  #   image: jitsi/jvb:stable
  #   restart: unless-stopped
  #   ports:
  #     - '${JVB_PORT:-10000}:${JVB_PORT:-10000}/udp'
  #     - '127.0.0.1:${JVB_COLIBRI_PORT:-8080}:8080'
  #   volumes:
  #     - ${CONFIG}/jvb:/config:Z
  #   depends_on:
  #     - prosody
  #   environment:
  #     - DOCKER_HOST_ADDRESS=${LOCAL_IP}
  #     - XMPP_SERVER
  #     - XMPP_AUTH_DOMAIN
  #     - XMPP_INTERNAL_MUC_DOMAIN
  #     - JVB_BREWERY_MUC
  #     - JVB_AUTH_USER
  #     - JVB_STUN_SERVERS=meet-jit-si-turnrelay.jitsi.net:443
  #     - JVB_PORT
  #   networks:
  #     meet.jitsi:
  #       aliases:
  #         - jvb.meet.jitsi

  db:
    profiles: ["prod", "dev"]
    <<: *logging
    image: mariadb
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --skip-innodb-read-only-compressed
    environment:
      - MYSQL_ROOT_PASSWORD=${DB_PASSWORD}
      - MYSQL_USER=${DB_USER}
      - MYSQL_PASSWORD=${DB_PASSWORD}
    volumes:
      - /mnt/tower/containers/db:/var/lib/mysql
      - ./db/init:/docker-entrypoint-initdb.d
    restart: always
    networks:
      - db

  redis:
    profiles: ["prod", "dev"]
    <<: *logging
    image: redis:alpine
    restart: always
    networks:
      - redis

  mongodb:
    profiles: ["prod", "dev"]
    image: mongo
    restart: always
    volumes:
      - /mnt/tower/containers/mongodb:/data/db
    command: mongod
    networks:
      - db
    environment:
      - MONGO_INITDB_ROOT_USERNAME=${DB_USER}
      - MONGO_INITDB_ROOT_PASSWORD=${DB_PASSWORD}
    <<: *logging

  nginx:
    <<: *logging
    profiles: ["prod", "dev"]
    image: nginxproxy/nginx-proxy
    restart: always
    ports:
      - "80:80"
      - "443:443"
    labels:
      - "com.github.nginx-proxy.nginx"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - /opt/ssl:/etc/nginx/certs:ro
      - html:/usr/share/nginx/html
      - vhost:/etc/nginx/vhost.d
      - ./nginx/vhost.d/labs_location:/etc/nginx/vhost.d/labs.${DOMAIN}_location:ro
      - ./nginx/vhost.d/office:/etc/nginx/vhost.d/office.${DOMAIN}:ro
      - ./nginx/vhost.d/rec:/etc/nginx/vhost.d/rec.${DOMAIN}:ro
      - ./nginx/vhost.d/tower_location_override:/etc/nginx/vhost.d/tower.${DOMAIN}_location_override:ro
      - ./nginx/vhost.d/tower:/etc/nginx/vhost.d/tower.${DOMAIN}:ro
      - ./nginx/conf.d/custom_proxy.conf:/etc/nginx/conf.d/custom_proxy.conf:ro
      - /mnt/tower/containers/nextcloud:/var/www/html/nextcloud:ro
      - ./christmas:/var/www/html/christmas:ro
    networks:
      - nginx

  acme-companion:
    <<: *logging
    profiles: ["prod"]
    image: nginxproxy/acme-companion
    restart: always
    environment:
      - DEFAULT_EMAIL=stoffles@gmail.com
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /opt/ssl:/etc/nginx/certs:rw
      - acme:/etc/acme.sh
      - vhost:/etc/nginx/vhost.d:rw
      - html:/usr/share/nginx/html:rw
    depends_on:
      - nginx
    networks:
      - nginx

  certs:
    profiles: ["dev"]
    image: paulczar/omgwtfssl
    restart: "no"
    volumes:
      - /opt/ssl:/certs
    environment:
      - SSL_SUBJECT=${DOMAIN}
      - CA_SUBJECT=chris@${DOMAIN}
      - SSL_KEY=/certs/${DOMAIN}.key
      - SSL_CSR=/certs/${DOMAIN}.csr
      - SSL_CERT=/certs/${DOMAIN}.crt

volumes:
  html:
  vhost:
  acme:

networks:
  db:
  nginx:
  redis:
  meet.jitsi: