services:
  Plex-Media-Server-GPU:
    hostname: plex
    cap_add:
      - SYS_MODULE
    entrypoint:
      - "/init"
#      - /bin/bash #turn on for DB maintenance
#    command: -c "sleep infinity" #turn on for DB maintenance
    environment:
      - "PUID=0" #1027
      - "PGID=0" #100
      - "VERSION=latest"
      - "ADVERTISE_IP=https://plex.${DOMAIN}:443/"
    networks:
      - traefik_backend
#    ports:
#     Plex External Ports
#      - target: 32400
#        published: 32401
#        protocol: tcp
#        mode: host
#      - "1900/udp"
#      - "3005/tcp"
#      - "32400/tcp"
#      - "32410/udp"
#      - "32412/udp"
#      - "32413/udp"
#      - "32414/udp"
#      - "32469/tcp"
#      - "5353/udp"
#      - "8324/tcp"
    image: "linuxserver/plex:latest"
#    restart: "always"
#    logging:
#      driver: "db"
#      options: {}
#    network_mode: "host"
#   restart: "always"
#    stdin_open: true
#    tty: true
    volumes:
#      - /volume1/Podcasts:/volume1/Podcasts
      - /volume1/TV Shows:/volume1/TV
      - /volume1/Movies:/volume1/Movies
#      - /volume1/Music:/volume1/Music
      - /volume1/docker/Plex Media Server:/config
      - /volume1/Plex-Backups:/Plex-Backups
      - /dev/dri:/dev/dri
      - type: tmpfs
        target: /dev/shm
        tmpfs:
          size: 40000000000
    healthcheck:
      test: curl -fsSS http://localhost:32400/identity > /dev/null || exit 1
      start_period: 900s
      timeout: 10s
      interval: 5s
#      retries: 3
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.plex.rule=Host(`plex.${DOMAIN}`)
        - traefik.http.routers.plex.tls=true
        - traefik.http.routers.plex.tls.certresolver=letsencrypt
        - traefik.http.routers.plex.entrypoints=websecure
        - traefik.http.services.plex.loadbalancer.server.port=32400
        - traefik.http.services.plex.loadbalancer.server.scheme=https
#        - traefik.http.routers.plex.middlewares=forward-header
#        - traefik.http.middlewares.forward-header.forwardauth.trustForwardHeader=true
        - traefik.http.routers.plex.middlewares=crowdsec@file
        - traefik.swarm.network=traefik_backend
        - autoheal=true
      resources:
        limits:
          cpus: '8'
          memory: 4G
      placement:
        constraints:
          - node.labels.block != databases

  Radarr:
    entrypoint:
      - "/init"
    environment:
      - "PUID=0" #1027
      - "PGID=0" #100
      - "TZ=PST"
    image: "linuxserver/radarr:latest"
#    restart: "always"
    hostname: movies
    networks:
      - traefik_backend
      - postgresql_db-backend
#    ports:
#      - target: 7878
#        published: 7878
#        protocol: tcp
#        mode: bridge
#      - target: 8787
#        published: 8787
#        protocol: tcp
#        mode: bridge
#    expose:
#      - "7878" # This exposes port 5432 internally.
    stdin_open: true
    tty: true
    volumes:
      - /volume1/docker/Radarr/config:/config
      - /volume1/Box Office/incomplete:/incomplete
      - /volume1/Box Office/Drop off:/dropoff
      - /volume1/Movies:/movies
    healthcheck:
      test: curl -fSs http://127.0.0.1:7878 > /dev/null || exit 1
      start_period: 90s
      timeout: 5s
      interval: 5s
      retries: 3
    deploy:
#      endpoint_mode: dnsrr
      labels:
        - traefik.enable=true
        - traefik.http.routers.radarr.rule=Host(`movies.${DOMAIN}`)
        - traefik.http.routers.radarr.tls=true
        - traefik.http.routers.radarr.tls.certresolver=letsencrypt
        - traefik.http.routers.radarr.entrypoints=websecure
        - traefik.http.services.movies.loadbalancer.server.port=7878
#        - traefik.http.services.movies.loadbalancer.server.scheme=https
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.radarr.middlewares=forwardAuth-authentik@file, crowdsec@file
        - autoheal=true
      resources:
        limits:
          cpus: '2'
          memory: 512M

  Sonarr:
    entrypoint:
      - "/init"
    environment:
      - "TZ=PST"
      - "PUID=0" #1027
      - "PGID=0" #100
    image: "linuxserver/sonarr:latest"
    hostname: tv
    networks:
      - traefik_backend
      - postgresql_db-backend
#    ports:
#      - target: 8989
#        published: 8989
#        protocol: tcp
#        mode: overlay
#      - target: 9898
#        published: 9898
#        protocol: tcp
#        mode: bridge
#    expose:
#      - "8989" # This exposes port 8989 internally.
    volumes:
      - /volume1/Box Office/incomplete:/incomplete
      - /volume1/Box Office/Drop off:/dropoff
      - /volume1/TV Shows:/tv
      - /volume1/docker/Sonarr/config:/config
    healthcheck:
      test: curl -fSs http://127.0.0.1:8989 || exit 1
      start_period: 90s
      timeout: 5s
      interval: 5s
      retries: 3
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.sonarr.rule=Host(`tv.${DOMAIN}`)
        - traefik.http.routers.sonarr.tls=true
        - traefik.http.routers.sonarr.tls.certresolver=letsencrypt
        - traefik.http.routers.sonarr.entrypoints=websecure
        - traefik.http.services.tv.loadbalancer.server.port=8989
#        - traefik.http.services.tv.loadbalancer.server.scheme=https
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.sonarr.middlewares=forwardAuth-authentik@file, crowdsec@file
        - autoheal=true
      resources:
        limits:
          cpus: '2' # Limit to 0.5 CPU core
          memory: 512M

  TicketBox:
    cap_add:
      - NET_ADMIN
    environment:
      - "ENABLE_PRIVOXY=no"
      - "STRICT_PORT_FORWARD=yes"
      - "PGID=0"
      - "PUID=0"
      - "UMASK=000"
      - "DEBUG=false"
      - "NAME_SERVERS=1.1.1.1"
      - "LAN_NETWORK=192.168.0.0/16,10.0.0.0/8,127.0.0.1/32"
      - "VPN_PROV=custom"
      - "VPN_ENABLED=yes"
      - "DELUGE_ENABLE_WEBUI_PASSWORD=no"
    image: "binhex/arch-delugevpn:latest"
    hostname: ticketbox
    networks:
      - traefik_backend
#    ports:
#      - target: 58846
#        published: 58846
#       protocol: tcp
#        mode: host
#      - target: 58946
#        published: 58946
#        protocol: tcp
#        mode: host
#      - target: 58946
#        published: 58946
#        protocol: udp
#        mode: host
#      - target: 8112
#        published: 8112
#        protocol: tcp
#        mode: host
#      - target: 8118
#        published: 8118
#        protocol: tcp
#        mode: host
#    stdin_open: true
#    tty: true
    volumes:
      - /volume1/Box Office/Pick up:/pickup
      - /volume1/docker/Deluge/config:/config
      - /volume1/Box Office/incomplete:/incomplete
      - /volume1/Box Office/Drop off:/dropoff
      - /dev/net/tun:/dev/net/tun
    healthcheck:
      test: curl -fSs http://127.0.0.1:8112 || exit 1
      start_period: 120s
      timeout: 5s
      interval: 5s
      retries: 3
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.ticketbox.rule=Host(`ticketbox.${DOMAIN}`)
        - traefik.http.routers.ticketbox.tls=true
        - traefik.http.routers.ticketbox.tls.certresolver=letsencrypt
        - traefik.http.routers.ticketbox.entrypoints=websecure
        - traefik.http.services.ticketbox.loadbalancer.server.port=8112
#        - traefik.http.services.ticketbox.loadbalancer.server.scheme=https
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.ticketbox.middlewares=forwardAuth-authentik@file, crowdsec@file
        - autoheal=true
      resources:
        limits:
          cpus: '2'
          memory: 1G

  Jackett:
    entrypoint:
      - "/init"
    environment:
      - "TZ=PST"
      - "PUID=0" #1027
      - "PGID=0" #100
    image: "linuxserver/jackett:latest"
    hostname: jackett
#    restart: "always"
    networks:
      - traefik_backend
#    ports:
#      - target: 9117
#        published: 9117
#        protocol: tcp
#        mode: ingress
    stdin_open: true
    tty: true
    volumes:
      - /volume1/docker/Jackett/config:/config
      - /volume1/docker/Jackett/downloads:/downloads
#    healthcheck:
#      test: curl -fSs http://127.0.0.1:9117
#      timeout: 5s
#      interval: 5s
#      retries: 3
    deploy:
      endpoint_mode: dnsrr
      labels:
        - traefik.enable=true
#        - traefik.frontend.passHostHeader=true
        - traefik.http.routers.jackett-ip.rule=Host(`jackett.${DOMAIN}`) && ClientIP(`10.0.1.0/16`)
        - traefik.http.routers.jackett-auth.rule=Host(`jackett.${DOMAIN}`)
        - traefik.http.routers.jackett-ip.tls=true
        - traefik.http.routers.jackett-auth.tls=true
        - traefik.http.routers.jackett-ip.tls.certresolver=letsencrypt
        - traefik.http.routers.jackett-auth.tls.certresolver=letsencrypt
        - traefik.http.routers.jackett-ip.entrypoints=websecure
        - traefik.http.routers.jackett-auth.entrypoints=websecure
        - traefik.http.services.jackett.loadbalancer.server.port=9117
#        - traefik.http.services.jackett.loadbalancer.server.scheme=https
        - traefik.swarm.network=traefik_backend
#        - traefik.http.middlewares.jackett-socket.headers.customrequestheaders.X-Forwarded-Proto=https
        - traefik.http.routers.jackett-auth.middlewares=forwardAuth-authentik@file, crowdsec@file
        - autoheal=true
      placement:
         constraints: [node.role == manager]
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

networks:
  postgresql_db-backend:
    external: true
  traefik_backend:
    external: true
  host:
    external: true