compose.yml

services:
  # caddy: reverse proxy
  caddy:
    image: caddy:alpine
    container_name: caddy
    restart: unless-stopped
    network_mode: host # Docker requires network_mode be set to host in order to access the IPv6 public address
    environment:
      - JELLYFIN_PUBLISHED_URL=${JELLYFIN_PUBLISHED_URL} # Published public Jellyfin URL
      - JELLYFIN_PORT=${JELLYFIN_HTTP_PORT} # Internal jellyfin HTTP port, default is normally 8096
      - NAVIDROME_PUBLISHED_URL=${NAVIDROME_PUBLISHED_URL} # Published public NaviDrome URL
      - NAVIDROME_PORT=${NAVIDROME_PORT} # Internal NaviDrome HTTP port, default is normally 4533
      - NEXTCLOUD_PUBLISHED_URL=${NEXTCLOUD_PUBLISHED_URL} # Published public NextCloud URL
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile # Local Caddyfile to map
      - caddy:/certs
      - caddy:/config
      - caddy:/data
      - caddy:/srv

  # nextcloud: file hosting and drive
  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    container_name: nextcloud-aio-mastercontainer
    restart: unless-stopped
    networks: [externalNetwork]
    environment:
      - APACHE_PORT=11000
      - APACHE_IP_BINDING=127.0.0.1
      - NEXTCLOUD_DATADIR=${NEXTCLOUD_DIRECTORY}
      - NEXTCLOUD_UPLOAD_LIMIT=100G
      - NEXTCLOUD_MAX_TIME=12000
      - NEXTCLOUD_MEMORY_LIMIT=16384M # Memory limit, lower if a problem
      - NEXTCLOUD_ENABLE_DRI_DEVICE=true # Disable if /dev/dri doesn't exist
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - ${NEXTCLOUD_DIRECTORY}:/data
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 8080:8080 # NextCloud HTTP Port
      - 8443:8443 # NextCloud HTTPS Port

  # gluetun: vpn
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    restart: unless-stopped
    privileged: true
    cap_add:
      - NET_ADMIN
    environment:
      - VPN_PORT_FORWARDING=on
      - VPN_SERVICE_PROVIDER=custom
      - VPN_PORT_FORWARDING_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - VPN_ENDPOINT_IP=${VPN_ENDPOINT_IP}
      - VPN_ENDPOINT_PORT=${VPN_ENDPOINT_PORT}
      - VPN_DNS_ADDRESS=${VPN_DNS_ADDRESS}
      - WIREGUARD_PUBLIC_KEY=${VPN_WIREGUARD_PUBLIC_KEY}
      - WIREGUARD_PRIVATE_KEY=${VPN_WIREGUARD_PRIVATE_KEY}
      - WIREGUARD_ADDRESSES=${VPN_WIREGUARD_ADDRESSES}
      - UPDATER_PERIOD=24h
      - FIREWALL_OUTBOUND_SUBNETS=172.20.0.0/16,192.168.1.0/24 # Internal LAN network
    volumes:
      - gluetun:/gluetun
    ports:
      - ${QBITTORRENT_WEBUI_PORT}:${QBITTORRENT_WEBUI_PORT} # qBittorrent WebUI
      - ${SONARR_PORT}:${SONARR_PORT} # Sonarr WebUI
      - ${RADARR_PORT}:${RADARR_PORT} # Radarr WebUI
      - ${LIDARR_PORT}:${LIDARR_PORT} # Lidarr WebUI
      - ${DEEMIX_PORT}:${DEEMIX_PORT} # Deemix WebUI
      - ${PROWLARR_PORT}:${PROWLARR_PORT} # Prowlarr WebUI
      - ${FLARESOLVERR_PORT}:${FLARESOLVERR_PORT} # Flaresolverr API
      - 8000:8000 # Gluetun

  # qbittorrent: bittorrent client
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    restart: unless-stopped
    depends_on:
      gluetun:
        condition: service_healthy
    network_mode: service:gluetun
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - TZ=${GLOBAL_TZ}
      - PUID=${GLOBAL_PUID}
      - PGID=${GLOBAL_PGID}
      - UMASK=${GLOBAL_UMASK}
      - WEBUI_PORT=${QBITTORRENT_WEBUI_PORT}
    volumes:
      - qbittorrent:/config
      - ${STORAGE_DIRECTORY}:/storage

  # qbittorrent-natmap: automatically set qbittorrent ports to match gluetun
  qbittorrent-natmap:
    image: ghcr.io/soxfor/qbittorrent-natmap:latest
    container_name: qbittorrent-natmap
    restart: unless-stopped
    depends_on:
      qbittorrent:
        condition: service_started
      gluetun:
        condition: service_healthy
    network_mode: service:gluetun
    environment:
      - QBITTORRENT_USER=${QBITTORRENT_WEBUI_USERNAME}
      - QBITTORRENT_PASS=${QBITTORRENT_WEBUI_PASSWORD}
      - QBITTORRENT_PORT=${QBITTORRENT_WEBUI_PORT}
      - QBITTORRENT_SERVER=${VPN_WIREGUARD_ADDRESSES}
      - VPN_GATEWAY=${VPN_DNS_ADDRESS}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  # jellyfin: media client for tv/movies
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    restart: unless-stopped
    networks: [externalNetwork]
    devices:
      - /dev/dri:/dev/dri # Remove if /dev/dri doesn't exist or
    volumes:
      - jellyfin:/config
      - ${MEDIALIBRARY_DIRECTORY}:/data # Media library folder, for my structure it is /mnt/md0/medialibrary
      - ${MEDIALIBRARY_DIRECTORY}/music:/music:ro # Music read-only
    ports:
      - ${JELLYFIN_HTTP_PORT}:${JELLYFIN_HTTP_PORT} # Jellyfin WebUI port, default is normally 8096
      - ${JELLYFIN_HTTPS_PORT}:${JELLYFIN_HTTPS_PORT} # Jellyfin HTTPS WebUI port, default is normally 8920
      - ${JELLYFIN_DLNA_PORT}:${JELLYFIN_DLNA_PORT}/udp # Jellyfin DLNA port, default is normally 1900
      - ${JELLYFIN_AUTODISCOVERY_PORT}:${JELLYFIN_AUTODISCOVERY_PORT}/udp # Jellyfin Client AutoDiscovery port, default is normally 7359
    environment:
      - TZ=${GLOBAL_TZ}
      - PUID=${GLOBAL_PUID}
      - PGID=${GLOBAL_PGID}
      - UMASK=${GLOBAL_UMASK}
      - DOCKER_MODS=ghcr.io/jumoog/intro-skipper # Allows adding the "skip intro" button to the web UI. Remove if you don't use this plugin

  # navidrome: media client for music
  navidrome:
    image: deluan/navidrome:latest
    container_name: navidrome
    restart: unless-stopped
    networks: [externalNetwork]
    environment:
      - ND_LASTFM_APIKEY=${LASTFM_APIKEY} # Last.fm integration
      - ND_LASTFM_SECRET=${LASTFM_SECRET} # Last.fm integration
      - ND_SPOTIFY_ID=${SPOTIFY_ID} # Spotify artist image integration
      - ND_SPOTIFY_SECRET=${SPOTIFY_SECRET} # Spotify artist image integration
    volumes:
      - navidrome:/data
      - ${MEDIALIBRARY_DIRECTORY}/music:/music:ro # read-only music directory, i like mediadirectory/music
    ports:
      - ${NAVIDROME_PORT}:${NAVIDROME_PORT} # navidrome webui port, defaults to 4533

  # cloudflare-ddns: cloudflare dns updater
  cloudflare-ddns:
    image: favonia/cloudflare-ddns:latest
    container_name: cloudflare-ddns
    restart: unless-stopped
    network_mode: host
    read_only: true
    cap_drop: [all]
    security_opt: [no-new-privileges:true]
    environment:
      - CF_API_TOKEN=${CF_API_TOKEN}
      - DOMAINS=${CF_DOMAINS}
      - PROXIED=${CF_PROXIED}

  # deemix: deemix downloader
  deemix:
    image: codefaux/deemix-for-lidarr
    container_name: deemix
    network_mode: service:gluetun
    restart: unless-stopped
    environment:
      - DEEMIX_SINGLE_USER=true # Only require one server-side config
      - PUID=${GLOBAL_PUID}
      - PGID=${GLOBAL_PGID}
      - TZ=${GLOBAL_TZ}
    volumes:
      - deemix:/deemix-gui/config
      - ${DOWNLOAD_DIRECTORY}/music:/downloads

  # lidarr: music pvr
  lidarr:
    image: ghcr.io/hotio/lidarr:pr-plugins
    container_name: lidarr
    network_mode: service:gluetun
    environment:
      - PUID=${GLOBAL_PUID}
      - PGID=${GLOBAL_PGID}
      - TZ=${GLOBAL_TZ}
    volumes:
      - lidarr:/config
      - ${DOWNLOAD_DIRECTORY}/music:/downloads
      - ${STORAGE_DIRECTORY}:/storage

  # radarr: pvr for movies
  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    restart: unless-stopped
    network_mode: service:gluetun
    depends_on:
      qbittorrent:
        condition: service_started
      gluetun:
        condition: service_healthy
    environment:
      - TZ=${GLOBAL_TZ}
      - PUID=${GLOBAL_PUID}
      - PGID=${GLOBAL_PGID}
      - UMASK=${GLOBAL_UMASK}
    volumes:
      - radarr:/config
      - ${DOWNLOAD_DIRECTORY}:/downloads
      - ${STORAGE_DIRECTORY}:/storage

  # sonarr: pvr for tv
  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    restart: unless-stopped
    network_mode: service:gluetun
    depends_on:
      qbittorrent:
        condition: service_started
      gluetun:
        condition: service_healthy
    environment:
      - TZ=${GLOBAL_TZ}
      - PUID=${GLOBAL_PUID}
      - PGID=${GLOBAL_PGID}
      - UMASK=${GLOBAL_UMASK}
    volumes:
      - sonarr:/config
      - ${DOWNLOAD_DIRECTORY}:/downloads
      - ${STORAGE_DIRECTORY}:/storage

  # prowlarr: pvr indexer
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    restart: unless-stopped
    network_mode: service:gluetun
    depends_on:
      qbittorrent:
        condition: service_started
      gluetun:
        condition: service_healthy
      radarr:
        condition: service_started
      sonarr:
        condition: service_started
      flaresolverr:
        condition: service_started
    environment:
      - TZ=${GLOBAL_TZ}
      - PUID=${GLOBAL_PUID}
      - PGID=${GLOBAL_PGID}
      - UMASK=${GLOBAL_UMASK}
    volumes:
      - prowlarr:/config
      - ${DOWNLOAD_DIRECTORY}:/downloads
      - ${STORAGE_DIRECTORY}:/storage

  # flaresolverr: cloudflare captcha bypasser
  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    restart: unless-stopped
    network_mode: service:gluetun
    depends_on:
      gluetun:
        condition: service_healthy
    cap_drop: [all]
    security_opt: [no-new-privileges:true]
    environment:
      - TZ=${GLOBAL_TZ}
      - PUID=${GLOBAL_PUID}
      - PGID=${GLOBAL_PGID}
      - UMASK=${GLOBAL_UMASK}

  # seedboxapi: automatically set seedbox api for trackers (MAM)
  # If you are not using myanonamouse, you may safely remove this container
  seedboxapi:
    image: myanonamouse/seedboxapi:latest
    container_name: seedboxapi
    network_mode: service:gluetun
    depends_on:
      qbittorrent:
        condition: service_started
      gluetun:
        condition: service_healthy
    environment:
      - DEBUG=1
      - interval=1 # Check every minute
      - mam_id=${MAM_ID} # MyAnonAmouse Session ID
    volumes:
      - seedboxapi:/config

volumes:
  caddy:
    external: true
    name: caddy-volume
  nextcloud_aio_mastercontainer:
    external: true
    name: nextcloud_aio_mastercontainer
  gluetun:
    external: true
    name: gluetun-volume
  qbittorrent:
    external: true
    name: qbittorrent-volume
  jellyfin:
    external: true
    name: jellyfin-volume
  navidrome:
    external: true
    name: navidrome-volume
  deemix:
    external: true
    name: deemix-volume
  lidarr:
    external: true
    name: lidarr-volume
  radarr:
    external: true
    name: radarr-volume
  sonarr:
    external: true
    name: sonarr-volume
  prowlarr:
    external: true
    name: prowlarr-volume
  seedboxapi:
    external: true
    name: seedboxapi-volume

networks:
  externalNetwork:
    external: true
    driver: bridge
    name: external-network
    enable_ipv6: false