services:
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    hostname: home
    networks:
      - traefik_backend
      - postgresql_db-backend
    dns:
      - 127.0.0.11       # Docker embedded DNS first
      - 1.1.1.1          # Public fallback for external resolution
    ports:
       - 8123:8123
    volumes:
      - /volume1/docker/Home Assistant/config:/config
      - /volume1/docker/letsencrypt/certs:/ssl
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/localtime:/etc/localtime:ro
    healthcheck:
      test: "bash -c 'printf \"GET / HTTP/1.1\n\n\" > /dev/tcp/127.0.0.1/8123; exit $$?;'"
      interval: 90s
      retries: 5
      start_period: 5s
      timeout: 15s
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.hass.rule=Host(`home.${DOMAIN}`)
        - traefik.http.routers.hass.tls=true
        - traefik.http.routers.hass.tls.certresolver=letsencrypt
        - traefik.http.routers.hass.entrypoints=websecure
        - traefik.http.services.hass.loadbalancer.server.port=8123
        - traefik.swarm.network=traefik_backend
        - traefik.http.services.hass.loadbalancer.server.scheme=https
        - traefik.http.routers.hass.middlewares=crowdsec@file
        - autoheal=true
      resources:
        limits:
          cpus: '4' # Limit to 0.5 CPU core
          memory: 4G

  frigate-nvr:
    hostname: frigate
    image: ghcr.io/blakeblackshear/frigate:0.17.2
    cap_add:
      - CAP_PERFMON
      - SYS_ADMIN
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /volume1/docker/frigate/config:/config
      - /volume1/docker/frigate/media:/media/frigate
      - /volume1/docker/letsencrypt/certs/certs/nvr.${DOMAIN}.crt:/etc/letsencrypt/live/frigate/fullchain.pem
      - /volume1/docker/letsencrypt/certs/private/nvr.${DOMAIN}.key:/etc/letsencrypt/live/frigate/privkey.pem
      - /dev/dri/renderD128:/dev/dri/renderD128
      - type: tmpfs
        target: /tmp/cache
        tmpfs:
          size: 5000000000
      - type: tmpfs
        target: /dev/shm
        tmpfs:
          size: 15000000000
    environment:
      FRIGATE_RTSP_PASSWORD: "${FRIGATE_RTSP_PASSWORD}"
    networks:
      - traefik_backend
    ports:
      - target: 8555
        published: 8555
        protocol: udp
        mode: ingress
      - target: 8555
        published: 8555
        protocol: tcp
        mode: ingress
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.frigate-auth.rule=Host(`nvr.${DOMAIN}`)
        - traefik.http.routers.frigate-ip.rule=Host(`nvr.${DOMAIN}`) && ClientIP(`10.0.0.0/8`)
        - traefik.http.routers.frigate-auth.tls=true
        - traefik.http.routers.frigate-ip.tls=true
        - traefik.http.routers.frigate-auth.tls.certresolver=letsencrypt
        - traefik.http.routers.frigate-ip.tls.certresolver=letsencrypt
        - traefik.http.routers.frigate-auth.entrypoints=websecure
        - traefik.http.routers.frigate-ip.entrypoints=websecure
        - traefik.http.services.frigate.loadbalancer.server.port=5000
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.frigate-auth.middlewares=forwardAuth-authentik@file, crowdsec@file

  MQTT:
    command:
      - "/usr/sbin/mosquitto"
      - "-c"
      - "/mosquitto/config/mosquitto.conf"
    entrypoint:
      - "/docker-entrypoint.sh"
    image: "public.ecr.aws/docker/library/eclipse-mosquitto:latest"
    stdin_open: true
    tty: true
    hostname: mqtt
    networks:
      - traefik_backend
    volumes:
      - /volume1/docker/MQTT/config:/mosquitto/config
      - /volume1/docker/MQTT/data:/mosquitto/data
      - /volume1/docker/MQTT/log:/mosquitto/log
    deploy:
      endpoint_mode: dnsrr
      labels:
        - traefik.enable=true
        - traefik.tcp.routers.mqtt.entrypoints=mqtt
        - traefik.tcp.routers.mqtt.rule=HostSNI(`*`)
        - traefik.tcp.services.mqtt.loadbalancer.server.port=1883
        - traefik.tcp.routers.mqtt.service=mqtt
        - traefik.swarm.network=traefik_backend

  Zigbee2MQTT:
    command:
      - "/sbin/tini"
      - "--"
      - "node"
      - "index.js"
    entrypoint:
      - "docker-entrypoint.sh"
    environment:
      - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
      - "NODE_ENV=production"
      - "TZ=Pacific/Los_Angeles"
    image: "ghcr.io/koenkk/zigbee2mqtt:latest"
    hostname: zb
    networks:
      - traefik_backend
    healthcheck:
      test: "wget --no-verbose --tries=1 --header 'Host: zigbee2mqtt.koseduhemak.de' --spider http://localhost:8080 || exit 1"
      start_period: 60s
      interval: 5s
      retries: 5
      timeout: 5s
    stdin_open: true
    tty: true
    volumes:
      - /volume1/docker/Zigbee2MQTT/data:/app/data
    working_dir: "/app"
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.zigbee.rule=Host(`zb.${DOMAIN}`)
        - traefik.http.routers.zigbee.tls=true
        - traefik.http.routers.zigbee.tls.certresolver=letsencrypt
        - traefik.http.routers.zigbee.entrypoints=websecure
        - traefik.http.services.zigbee.loadbalancer.server.port=8080
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.zigbee.middlewares=forwardAuth-authentik@file, crowdsec@file
      resources:
        limits:
          cpus: '1'
          memory: 512M

  ESPHome:
    image: ghcr.io/esphome/esphome:latest
    volumes:
      - /volume1/docker/esphome/config:/config
    hostname: esp
    networks:
      - traefik_backend
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.esphome.rule=Host(`esp.${DOMAIN}`)
        - traefik.http.routers.esphome.tls=true
        - traefik.http.routers.esphome.tls.certresolver=letsencrypt
        - traefik.http.routers.esphome.entrypoints=websecure
        - traefik.http.services.esphome.loadbalancer.server.port=6052
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.esphome.middlewares=forwardAuth-authentik@file, crowdsec@file
      resources:
        limits:
          cpus: '10'
          memory: 4G

networks:
  postgresql_db-backend:
    external: true
  traefik_backend:
    external: true
  traefik_frontend:
    external: true
  host:
    name: host
    external: true