services:
  Plex-Media-Server-GPU:
    hostname: plex
    cap_add:
      - SYS_MODULE
    entrypoint:
      - "/init"
#      - /bin/bash #turn on for DB maintenance
#    command: -c "sleep infinity" #turn on for DB maintenance
    environment:
      - "PUID=0" #1027
      - "PGID=0" #100
      - "VERSION=latest"
      - "ADVERTISE_IP=https://plex.${DOMAIN}:443/"
    networks:
      - traefik_backend
    image: "linuxserver/plex:latest"
    volumes:
      - /volume1/TV Shows:/volume1/TV
      - /volume1/Movies:/volume1/Movies
      - /volume1/docker/Plex Media Server:/config
      - /volume1/Plex-Backups:/Plex-Backups
      - /dev/dri:/dev/dri
      - type: tmpfs
        target: /dev/shm
        tmpfs:
          size: 400000000000
    healthcheck:
      test: curl -fsSS http://localhost:32400/identity > /dev/null || exit 1
      start_period: 900s
      timeout: 10s
      interval: 5s
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.plex.rule=Host(`plex.${DOMAIN}`)
        - traefik.http.routers.plex.tls=true
        - traefik.http.routers.plex.tls.certresolver=letsencrypt
        - traefik.http.routers.plex.entrypoints=websecure
        - traefik.http.services.plex.loadbalancer.server.port=32400
        - traefik.http.services.plex.loadbalancer.server.scheme=https
        - traefik.http.routers.plex.middlewares=crowdsec@file
        - traefik.swarm.network=traefik_backend
        - autoheal=true
      resources:
        limits:
          cpus: '8'
          memory: 4G
      placement:
        constraints:
          - node.labels.block != databases

  Radarr:
    entrypoint:
      - "/init"
    environment:
      - "PUID=0" #1027
      - "PGID=0" #100
      - "TZ=PST"
    image: "linuxserver/radarr:latest"
    hostname: movies
    networks:
      - traefik_backend
      - postgresql_db-backend
    stdin_open: true
    tty: true
    volumes:
      - /volume1/docker/Radarr/config:/config
      - /volume1/Box Office/incomplete:/incomplete
      - /volume1/Box Office/Drop off:/dropoff
      - /volume1/Movies:/movies
    healthcheck:
      test: curl -fSs http://127.0.0.1:7878 > /dev/null || exit 1
      start_period: 90s
      timeout: 5s
      interval: 5s
      retries: 3
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.radarr.rule=Host(`movies.${DOMAIN}`)
        - traefik.http.routers.radarr.tls=true
        - traefik.http.routers.radarr.tls.certresolver=letsencrypt
        - traefik.http.routers.radarr.entrypoints=websecure
        - traefik.http.services.movies.loadbalancer.server.port=7878
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.radarr.middlewares=forwardAuth-authentik@file, crowdsec@file
        - autoheal=true
      resources:
        limits:
          cpus: '2'
          memory: 512M

  Sonarr:
    entrypoint:
      - "/init"
    environment:
      - "TZ=PST"
      - "PUID=0" #1027
      - "PGID=0" #100
    image: "linuxserver/sonarr:latest"
    hostname: tv
    networks:
      - traefik_backend
      - postgresql_db-backend
    volumes:
      - /volume1/Box Office/incomplete:/incomplete
      - /volume1/Box Office/Drop off:/dropoff
      - /volume1/TV Shows:/tv
      - /volume1/docker/Sonarr/config:/config
    healthcheck:
      test: curl -fSs http://127.0.0.1:8989 || exit 1
      start_period: 90s
      timeout: 5s
      interval: 5s
      retries: 3
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.sonarr.rule=Host(`tv.${DOMAIN}`)
        - traefik.http.routers.sonarr.tls=true
        - traefik.http.routers.sonarr.tls.certresolver=letsencrypt
        - traefik.http.routers.sonarr.entrypoints=websecure
        - traefik.http.services.tv.loadbalancer.server.port=8989
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.sonarr.middlewares=forwardAuth-authentik@file, crowdsec@file
        - autoheal=true
      resources:
        limits:
          cpus: '2' # Limit to 0.5 CPU core
          memory: 512M

  TicketBox:
    cap_add:
      - NET_ADMIN
    environment:
      - "ENABLE_PRIVOXY=no"
      - "STRICT_PORT_FORWARD=yes"
      - "PGID=0"
      - "PUID=0"
      - "UMASK=000"
      - "DEBUG=false"
      - "NAME_SERVERS=1.1.1.1"
      - "LAN_NETWORK=192.168.0.0/16,10.0.0.0/8,127.0.0.1/32"
      - "VPN_PROV=custom"
      - "VPN_ENABLED=yes"
      - "DELUGE_ENABLE_WEBUI_PASSWORD=no"
    image: "binhex/arch-delugevpn:latest"
    hostname: ticketbox
    networks:
      - traefik_backend
    volumes:
      - /volume1/Box Office/Pick up:/pickup
      - /volume1/docker/Deluge/config:/config
      - /volume1/Box Office/incomplete:/incomplete
      - /volume1/Box Office/Drop off:/dropoff
      - /dev/net/tun:/dev/net/tun
    healthcheck:
      test: curl -fSs http://127.0.0.1:8112 || exit 1
      start_period: 120s
      timeout: 5s
      interval: 5s
      retries: 3
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.ticketbox.rule=Host(`ticketbox.${DOMAIN}`)
        - traefik.http.routers.ticketbox.tls=true
        - traefik.http.routers.ticketbox.tls.certresolver=letsencrypt
        - traefik.http.routers.ticketbox.entrypoints=websecure
        - traefik.http.services.ticketbox.loadbalancer.server.port=8112
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.ticketbox.middlewares=forwardAuth-authentik@file, crowdsec@file
        - autoheal=true
      resources:
        limits:
          cpus: '2'
          memory: 1G

  Jackett:
    entrypoint:
      - "/init"
    environment:
      - "TZ=PST"
      - "PUID=0" #1027
      - "PGID=0" #100
    image: "linuxserver/jackett:latest"
    hostname: jackett
    networks:
      - traefik_backend
    stdin_open: true
    tty: true
    volumes:
      - /volume1/docker/Jackett/config:/config
      - /volume1/docker/Jackett/downloads:/downloads
    deploy:
      endpoint_mode: dnsrr
      labels:
        - traefik.enable=true
        - traefik.http.routers.jackett-ip.rule=Host(`jackett.${DOMAIN}`) && ClientIP(`10.0.1.0/16`)
        - traefik.http.routers.jackett-auth.rule=Host(`jackett.${DOMAIN}`)
        - traefik.http.routers.jackett-ip.tls=true
        - traefik.http.routers.jackett-auth.tls=true
        - traefik.http.routers.jackett-ip.tls.certresolver=letsencrypt
        - traefik.http.routers.jackett-auth.tls.certresolver=letsencrypt
        - traefik.http.routers.jackett-ip.entrypoints=websecure
        - traefik.http.routers.jackett-auth.entrypoints=websecure
        - traefik.http.services.jackett.loadbalancer.server.port=9117
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.jackett-auth.middlewares=forwardAuth-authentik@file, crowdsec@file
        - autoheal=true
      placement:
         constraints: [node.role == manager]
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

networks:
  postgresql_db-backend:
    external: true
  traefik_backend:
    external: true
  host:
    external: true