docker-compose.yml

x-logging: &default-logging
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "3"

services:


  tailscale:
    image: tailscale/tailscale:v1.98.4
    container_name: tailscale
    restart: unless-stopped
    logging: *default-logging
    environment:
      - TS_AUTHKEY=${TAILSCALE_AUTH_KEY}
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=false
      - TS_HOSTNAME=pi-docker-ts
      - TS_ROUTES=10.8.1.0/24
      - TS_EXTRA_ARGS=${TS_EXTRA_ARGS}
      - TS_DEBUG_FIREWALL_MODE=nftables
    volumes:
      - ${TAILSCALE_PATH}:/var/lib/tailscale
      - /lib/modules:/lib/modules:ro
    devices:
      - /dev/net/tun:/dev/net/tun
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv6.conf.all.forwarding=1
      - net.ipv4.conf.all.src_valid_mark=1
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - SYS_MODULE
    healthcheck:
      test: ["CMD-SHELL", "tailscale status && ip addr show dev tailscale0"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    networks:
      wg-easy:
        ipv4_address: 10.8.1.48
  pihole:
    image: pihole/pihole:2026.06.0
    network_mode: service:tailscale
    container_name: pihole
    restart: unless-stopped
    logging: *default-logging
    env_file:
      - pihole.env
    environment:
      - FTLCONF_webserver_api_password=${PIHOLE__WEBPASSWORD}
      - TZ=${DEFAULT_TZ}
      - FTLCONF_dns_upstreams=127.0.0.1#5053
      - FTLCONF_dns_listeningMode=ALL
      - FTLCONF_dns_queryLogging=false
      - FTLCONF_webserver_port=8080
      - FTLCONF_files_database=/pihole-db/pihole-FTL.db
      - FTLCONF_misc_check_disk=0
    cap_add:
      - SYS_NICE
      - SYS_TIME
    healthcheck:
      test: ["CMD", "dig", "+short", "@127.0.0.1", "pi.hole", "||", "exit", "1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - ${PIHOLE_ETC_PATH}:/etc/pihole
      - ${PIHOLE_ETC_DNSMASQ_PATH}:/etc/dnsmasq.d
      - ./pihole-db:/pihole-db
    depends_on:
      - tailscale
  dnscrypt-proxy:
    image: klutchell/dnscrypt-proxy:2.1.16
    network_mode: service:tailscale
    container_name: dnscrypt-proxy
    restart: unless-stopped
    logging: *default-logging
    volumes:
      - ./dnscrypt-proxy/dnscrypt-proxy.toml:/config/dnscrypt-proxy.toml
    depends_on:
      - tailscale
  caddy:
    image: ghcr.io/caddybuilds/caddy-cloudflare:2.11.4
    container_name: caddy
    network_mode: service:tailscale
    user: 1000:1000 # should be owner of volumes
    restart: unless-stopped
    logging: *default-logging
    depends_on:
      - tailscale
    cap_add:
      - NET_ADMIN
    environment:
      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN}
    # ports:
    #   - "80:80"
    #   - "443:443"
    #   - "443:443/udp"
    healthcheck:
      test: ["CMD-SHELL", "nc -z 127.0.0.1 80 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ${CADDY_SITE_PATH}:/srv
      - ${CADDY_DATA_PATH}:/data
      - ${CADDY_CONFIG_PATH}:/config
      # - ${TAILSCALE_TMP_PATH}/tailscaled.sock:/var/run/tailscale/tailscaled.sock
    # networks:
    #   wg-easy:
    #     ipv4_address: 10.8.1.5


  filebrowser:
    image: filebrowser/filebrowser:v2.63.17
    container_name: filebrowser
    logging: *default-logging
    volumes:
      - ${FILEBROWSER_ROOT_PATH}:/srv
      - ${FILEBROWSER_DB_FILE_PATH}:/database/filebrowser.db
      - ${FILEBROWSER_CONFIG_SETTING_FILE_PATH}:/config/settings.json
    environment:
      - PUID=1000
      - PGID=1000
      - FB_DATABASE=/database/filebrowser.db
      - FB_CONFIG=/config/settings.json
      - FB_ADDR=0.0.0.0
      - FB_PORT=80
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:80/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    # ports:
    #   - 8080:80
    restart: unless-stopped
    dns:
      - 10.8.1.48
      - 1.1.1.1
      - 8.8.8.8
    networks:
      wg-easy:
        ipv4_address: 10.8.1.34



  transmission:
    image: lscr.io/linuxserver/transmission:4.1.3-r0-ls352
    container_name: transmission
    restart: unless-stopped
    logging: *default-logging
    # network_mode: "service:gluetun"
    healthcheck:
      test: ["CMD", "nc", "-z", "127.0.0.1", "9091"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - ${TRANSMISSION_CONFIG_SOURCE}:/config
      - ${TRANSMISSION_DOWNLOAD_SOURCE}:/downloads
      - ${TRANSMISSION_WATCH_SOURCE}:/watch
    environment:
      - PGID=1000
      - PUID=1000
      - TZ=${DEFAULT_TZ}
      # - DOCKER_MODS=linuxserver/mods:transmission-floodui
      # - DOCKER_MODS=linuxserver/mods:transmission-transmissionic
      - USER=${TRANSMISSION_USERNAME}
      - PASS=${TRANSMISSION_PASSWORD}
    dns:
      - 10.8.1.48
      - 1.1.1.1
      - 8.8.8.8
    networks:
      wg-easy:
        ipv4_address: 10.8.1.23




  immich-redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
    logging: *default-logging
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always
    volumes:
      - ${IMMICH_REDIS_DATA_PATH}:/data
    networks:
      wg-easy:
        ipv4_address: 10.8.1.9

  homepage:
    image: ghcr.io/gethomepage/homepage:v1.13.2
    container_name: homepage
    extra_hosts:
      - "dash.pi.rahulja.in:10.8.1.48"
      - "pihole.pi.rahulja.in:10.8.1.48"
      - "immich.pi.rahulja.in:10.8.1.48"
      - "homepage.pi.rahulja.in:10.8.1.48"
    restart: unless-stopped
    logging: *default-logging
    env_file:
      - .env
    environment:
      - PUID=1000
      - PGID=985
      - HOMEPAGE_ALLOWED_HOSTS=homepage.pi.rahulja.in,dash.pi.rahulja.in
      - TZ=${DEFAULT_TZ}
    volumes:
      - ${HOMEPAGE_CONFIG_PATH}:/app/config
      - /var/run/docker.sock:/var/run/docker.sock # Optional, for docker integration
      - /mnt/usb:/storage:ro
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/host:ro
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    dns:
      - 10.8.1.48
      - 1.1.1.1
      - 8.8.8.8
    # ports:
    #   - 3000:3000
    networks:
      wg-easy:
        ipv4_address: 10.8.1.57

  firefly:
    image: fireflyiii/core:version-6.6.5
    hostname: firefly
    container_name: firefly
    restart: always
    logging: *default-logging
    volumes:
      - ${FIREFLY_UPLOAD_PATH}:/var/www/html/storage/upload
      - ${FIREFLY_DB_PATH}:/var/www/html/storage/database
    environment:
      - SITE_OWNER=me@rahulja.in
      - TRUSTED_PROXIES=**
      - AUDIT_LOG_LEVEL=emergency
      - DB_CONNECTION=sqlite
      - CACHE_DRIVER=redis
      - SESSION_DRIVER=redis
      - REDIS_HOST=immich-redis
      - REDIS_PORT=6379
      - ENABLE_EXCHANGE_RATES=true
      - ENABLE_EXTERNAL_RATES=true
      - APP_URL=https://firefly.pi.rahulja.in
      - APP_KEY=${FIREFLY_APP_KEY}
      - STATIC_CRON_TOKEN=${FIREFLY_STATIC_CRON_TOKEN}
      - TZ=${DEFAULT_TZ}
    depends_on:
      - immich-redis
    dns:
      - 10.8.1.48
      - 1.1.1.1
      - 8.8.8.8
    networks:
      wg-easy:
        ipv4_address: 10.8.1.43

  firefly-importer:
    image: fireflyiii/data-importer:version-2.3.3
    hostname: firefly-importer
    container_name: firefly-importer
    restart: always
    logging: *default-logging
    depends_on:
      - firefly
      - immich-redis
    environment:
      - FIREFLY_III_URL=http://firefly:8080
      - VANITY_URL=https://firefly.pi.rahulja.in
      - LOG_LEVEL=info
      - TRUSTED_PROXIES=**
      - CACHE_DRIVER=redis
      - SESSION_DRIVER=redis
      - REDIS_HOST=immich-redis
      - REDIS_PORT=6379
      - TZ=${DEFAULT_TZ}
    dns:
      - 10.8.1.48
      - 1.1.1.1
      - 8.8.8.8
    networks:
      wg-easy:
        ipv4_address: 10.8.1.44

  firefly-cron:
    image: alpine:3.18
    container_name: firefly-cron
    restart: always
    logging: *default-logging
    depends_on:
      - firefly
    environment:
      - TZ=${DEFAULT_TZ}
      - STATIC_CRON_TOKEN=${FIREFLY_STATIC_CRON_TOKEN}
    command: ["sh", "-c", "apk add --no-cache tzdata && \
      (ln -s /usr/share/zoneinfo/$$TZ /etc/localtime || true) && \
      echo \"0 3 * * * wget -qO- http://firefly:8080/api/v1/cron/$$STATIC_CRON_TOKEN;echo\" \
      | crontab - && \
      crond -f -L /dev/stdout"]
    networks:
      wg-easy:
        ipv4_address: 10.8.1.45


  portainer:
    image: portainer/portainer-ce:2.39.4
    container_name: portainer
    hostname: portainer
    restart: unless-stopped
    logging: *default-logging
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${PORTAINER_DATA_PATH}:/data
    dns:
      - 10.8.1.48
      - 1.1.1.1
    networks:
      wg-easy:
        ipv4_address: 10.8.1.59


# Booked 10.8.1.2 - 10.8.1.59 # remember to add to .env of local dns pihole


networks:
  wg-easy:
    driver: bridge
    ipam:
      config:
        - subnet: 10.8.1.0/24