# =============================================================================
# Torrent Stack - Docker Compose
# =============================================================================

networks:
  caddy_net:
    external: true
  tdarr-net:
    driver: bridge
  default:
    name: portainer_network

volumes:
  meilisearch:
  karakeep-data:
  caddy_config:
  caddy_data:
    external: true
  myspeed:
    external: true
  portainer_data:

# =============================================================================
# Key ordering per service:
#   image → container_name → env_file → networks/network_mode → cap_add
#   → ports → volumes → environment → labels → healthcheck
#   → extra_hosts → devices → pid → restart
# =============================================================================

services:
  # ---------------------------------------------------------------------------
  # VPN & Download
  # ---------------------------------------------------------------------------

  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    ports:
      - 8888:8000/tcp
      - ${QBITTORRENT_PORT}:${QBITTORRENT_PORT}
      - ${PROWLARR_PORT}:${PROWLARR_PORT}
      - ${SONARR_PORT}:${SONARR_PORT}
      - ${RADARR_PORT}:${RADARR_PORT}
      - ${LIDARR_PORT}:${LIDARR_PORT}
    volumes:
      - ./gluetun-data:/tmp/gluetun:rw
    environment:
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - HTTP_CONTROL_SERVER=ON
      - HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE='{"auth":"apikey","apikey":"${GLUETUN_KEY}"}'
      - WIREGUARD_PRIVATE_KEY=${VPN_PRIVATE_KEY}
      - WIREGUARD_MTU=1280
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_PROVIDER=protonvpn
      - SERVER_COUNTRIES=Netherlands
      - NETWORK_LOCAL_ADDRESSES=192.168.50.0/24,172.16.0.0/12
      - FIREWALL_OUTBOUND_SUBNETS=192.168.50.0/24
      - TZ=${TIMEZONE}
      - DNS_UPSTREAM_RESOLVER_TYPE=doh
    healthcheck:
      test: wget --spider -q http://1.1.1.1 || exit 1
      interval: 30s
      timeout: 15s
      retries: 3
      start_period: 1m
    extra_hosts:
      - "host.docker.internal:host-gateway"
    devices:
      - /dev/net/tun:/dev/net/tun
    restart: always

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: "container:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    volumes:
      - ./qbittorrent:/config
      - ${DISK1}:${DISK1}
      - ${DISK2}:${DISK2}
      - ./gluetun-data:/tmp/gluetun
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    environment:
      - PUID=${HOST_PUID:-1000}
      - PGID=${HOST_PGID:-1000}
      - TZ=${TIMEZONE}
      - WEBUI_PORT=${QBITTORRENT_PORT}
    labels:
      - "autoheal=true"
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q https://1.1.1.1 || exit 1"]
      interval: 1m
      timeout: 10s
      retries: 3
      start_period: 30s
    restart: unless-stopped

  port-updater:
    image: curlimages/curl:latest
    container_name: port-updater
    network_mode: "container:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    volumes:
      - ./gluetun-data:/tmp/gluetun:ro
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        trap 'exit 0' SIGTERM;
        while true; do
          while [ ! -s /tmp/gluetun/forwarded_port ]; do
            echo "Waiting for Gluetun to provide a port..."
            sleep 5
          done

          read -r PORT_VAL < /tmp/gluetun/forwarded_port;
          CLEAN_PORT=$$(echo "$$PORT_VAL" | tr -d '\r\n ');

          if [ -n "$$CLEAN_PORT" ]; then
            echo "Updating qBit to port: $$CLEAN_PORT";
            sleep 10;
            curl -s -X POST -d "json={\"listen_port\":$$CLEAN_PORT}" http://localhost:${QBITTORRENT_PORT}/api/v2/app/setPreferences;
            sleep 3600 & wait $$!;
          else
            sleep 10
          fi
        done
    labels:
      - "autoheal=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f https://1.1.1.1 || exit 1"]
      interval: 1m
      timeout: 10s
      retries: 3
      start_period: 30s
    restart: always

  # ---------------------------------------------------------------------------
  # *arr Stack
  # ---------------------------------------------------------------------------

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    network_mode: "container:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    volumes:
      - ./prowlarr:/config
      - ./notify.sh:/notify.sh:ro
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    environment:
      - PUID=${HOST_PUID:-1000}
      - PGID=${HOST_PGID:-1000}
      - TZ=${TIMEZONE}
    labels:
      - "autoheal=true"
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q https://google.com || exit 1"]
      interval: 5m
      timeout: 60s
      retries: 3
      start_period: 30s
    restart: always

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    network_mode: "container:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    volumes:
      - /var/lib/sonarr:/config
      - ${DISK1}:${DISK1}
      - ${DISK2}:${DISK2}
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    environment:
      - PUID=${HOST_PUID:-1000}
      - PGID=${HOST_PGID:-1000}
      - TZ=${TIMEZONE}
    labels:
      - "autoheal=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://1.1.1.1 || exit 1"]
      interval: 5m
      timeout: 60s
      retries: 3
      start_period: 60s
    restart: always

  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    network_mode: "container:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    volumes:
      - /var/lib/radarr:/config
      - ${DISK1}:${DISK1}
      - ${DISK2}:${DISK2}
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    environment:
      - PUID=${HOST_PUID:-1000}
      - PGID=${HOST_PGID:-1000}
      - TZ=${TIMEZONE}
    labels:
      - "autoheal=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://1.1.1.1 || exit 1"]
      interval: 1m
      timeout: 10s
      retries: 3
      start_period: 30s
    restart: always

  lidarr:
    image: lscr.io/linuxserver/lidarr:latest
    container_name: lidarr
    network_mode: "container:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    volumes:
      - ./lidarr:/music
      - /var/lib/lidarr:/config
      - ${DISK1}:${DISK1}
      - ${DISK2}:${DISK2}
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    environment:
      - PUID=${HOST_PUID:-1000}
      - PGID=${HOST_PGID:-1000}
      - TZ=${TIMEZONE}
    labels:
      - "autoheal=true"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://1.1.1.1 || exit 1"]
      interval: 1m
      timeout: 10s
      retries: 3
      start_period: 30s
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Media
  # ---------------------------------------------------------------------------

  tautulli:
    image: ghcr.io/tautulli/tautulli
    container_name: tautulli
    networks:
      - caddy_net
    ports:
      - ${TAUTULLI_PORT}:${TAUTULLI_PORT}
    volumes:
      - ./tautulli:/config
    environment:
      - PUID=${HOST_PUID:-1000}
      - PGID=${HOST_PGID:-1000}
      - TZ=${TIMEZONE}
    restart: unless-stopped

  tdarr:
    image: haveagitgat/tdarr:latest
    container_name: tdarr
    networks:
      - tdarr-net
    ports:
      - ${TDARR_PORT}:${TDARR_PORT}
      - ${TDARR_NODE_PORT}:${TDARR_NODE_PORT}
    volumes:
      - ./tdarr/server:/app/server
      - ./tdarr/configs:/app/configs
      - ./tdarr/temp:/temp
      - ${DISK1}:${DISK1}
      - ${DISK2}:${DISK2}
    environment:
      - TZ=${TIMEZONE}
      - PUID=${HOST_PUID:-1000}
      - PGID=${HOST_PGID:-100}
      - UMASK_SET=002
      - serverIP=0.0.0.0
    restart: unless-stopped

  tdarr-node:
    image: haveagitgat/tdarr_node:latest
    container_name: tdarr-node
    networks:
      - tdarr-net
    volumes:
      - ./tdarr/configs:/app/configs
      - ./tdarr/logs:/app/logs
      - ./tdarr/temp:/temp
      - ${DISK1}:${DISK1}
      - ${DISK2}:${DISK2}
    environment:
      - TZ=${TIMEZONE}
      - PUID=${HOST_PUID:-1000}
      - PGID=${HOST_PGID:-1000}
      - nodeID=${TDARR_NODE_ID}
      - nodeIP=0.0.0.0
      - serverIP=tdarr
      - serverPort=${TDARR_NODE_PORT}
    devices:
      - /dev/dri/:/dev/dri/
    restart: unless-stopped

  seerr:
    image: ghcr.io/seerr-team/seerr:latest
    container_name: seerr
    networks:
      - caddy_net
    ports:
      - ${SEERR_PORT}:${SEERR_PORT}
    volumes:
      - ./seerr:/app/config
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    environment:
      - LOG_LEVEL=debug
      - TZ=America/Los_Angeles
      - PUID=${HOST_PUID:-1000}
      - PGID=${HOST_PGID:-1000}
    labels:
      - "autoheal=true"
    init: true
    working_dir: "/app"
    healthcheck:
      test: ["CMD-SHELL", "wget --spider -q http://1.1.1.1 || exit 1"]
      interval: 1m
      timeout: 10s
      retries: 3
      start_period: 60s
    restart: unless-stopped

  seerr-anubis:
    image: ghcr.io/techarohq/anubis:latest
    container_name: seerr_anubis
    networks:
      - caddy_net
    environment:
      - BIND=:55055
      - TARGET=http://seerr:${SEERR_PORT}
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Monitoring
  # ---------------------------------------------------------------------------

  homepage:
    image: ghcr.io/gethomepage/homepage:latest
    container_name: homepage
    networks:
      - caddy_net
    ports:
      - ${HOMEPAGE_PORT}:${HOMEPAGE_PORT}
    volumes:
      - ./homepage:/app/config
      - ./homepage/images:/app/public/images
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./gluetun-data:/tmp/gluetun:ro
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    environment:
      - "HOMEPAGE_ALLOWED_HOSTS=gethomepage.dev,${LOCAL_IPV4}:${HOMEPAGE_PORT},${SERVER_NAME}:${HOMEPAGE_PORT},${SERVER_NAME}.${TAILNET_NAME}:${HOMEPAGE_PORT}"
      - "HOMEPAGE_VAR_DISK1=${DISK1}"
      - "HOMEPAGE_VAR_DISK2=${DISK2}"
      - "HOMEPAGE_VAR_DISK3=${DISK3}"
      - "HOMEPAGE_VAR_WEB_PROTOCOL=${WEB_PROTOCOL}"
      - "HOMEPAGE_VAR_LOCAL_IPV4=${LOCAL_IPV4}"
      - "HOMEPAGE_VAR_SERVER_NAME=${SERVER_NAME}"
      - "HOMEPAGE_VAR_PLEX_KEY=${PLEX_KEY}"
      - "HOMEPAGE_VAR_PROWLARR_KEY=${PROWLARR_KEY}"
      - "HOMEPAGE_VAR_RADARR_KEY=${RADARR_KEY}"
      - "HOMEPAGE_VAR_SONARR_KEY=${SONARR_KEY}"
      - "HOMEPAGE_VAR_LIDARR_KEY=${LIDARR_KEY}"
      - "HOMEPAGE_VAR_TAUTULLI_KEY=${TAUTULLI_KEY}"
      - "HOMEPAGE_VAR_SEERR_KEY=${SEERR_KEY}"
      - "HOMEPAGE_VAR_QBITTORRENT_KEY=${QBITTORRENT_KEY}"
      - "HOMEPAGE_VAR_TAILSCALE_KEY=${TAILSCALE_KEY}"
      - "HOMEPAGE_VAR_TAILSCALE_DEVICE_KEY=${TAILSCALE_DEVICE_KEY}"
      - "HOMEPAGE_VAR_PLEX_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${PLEX_PORT}"
      - "HOMEPAGE_VAR_QBITTORRENT_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${QBITTORRENT_PORT}"
      - "HOMEPAGE_VAR_PROWLARR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${PROWLARR_PORT}"
      - "HOMEPAGE_VAR_SONARR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${SONARR_PORT}"
      - "HOMEPAGE_VAR_RADARR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${RADARR_PORT}"
      - "HOMEPAGE_VAR_LIDARR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${LIDARR_PORT}"
      - "HOMEPAGE_VAR_TAUTULLI_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${TAUTULLI_PORT}"
      - "HOMEPAGE_VAR_TDARR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${TDARR_PORT}"
      - "HOMEPAGE_VAR_HOMEPAGE_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${HOMEPAGE_PORT}"
      - "HOMEPAGE_VAR_GLANCES_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${GLANCES_PORT}"
      - "HOMEPAGE_VAR_SEERR_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${SEERR_PORT}"
      - "HOMEPAGE_VAR_MYSPEED_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${MYSPEED_PORT}"
      - "HOMEPAGE_VAR_TERMIX_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${TERMIX_PORT}"
      - "HOMEPAGE_VAR_ODYSSEUS_ADDRESS=${WEB_PROTOCOL}://${LOCAL_IPV4}:${ODYSSEUS_PORT}"
      - "HOMEPAGE_VAR_PLEX_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${PLEX_PORT}"
      - "HOMEPAGE_VAR_QBITTORRENT_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${QBITTORRENT_PORT}"
      - "HOMEPAGE_VAR_PROWLARR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${PROWLARR_PORT}"
      - "HOMEPAGE_VAR_SONARR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${SONARR_PORT}"
      - "HOMEPAGE_VAR_RADARR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${RADARR_PORT}"
      - "HOMEPAGE_VAR_LIDARR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${LIDARR_PORT}"
      - "HOMEPAGE_VAR_TAUTULLI_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${TAUTULLI_PORT}"
      - "HOMEPAGE_VAR_TDARR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${TDARR_PORT}"
      - "HOMEPAGE_VAR_HOMEPAGE_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${HOMEPAGE_PORT}"
      - "HOMEPAGE_VAR_GLANCES_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${GLANCES_PORT}"
      - "HOMEPAGE_VAR_SEERR_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${SEERR_PORT}"
      - "HOMEPAGE_VAR_MYSPEED_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${MYSPEED_PORT}"
      - "HOMEPAGE_VAR_TERMIX_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${TERMIX_PORT}"
      - "HOMEPAGE_VAR_ODYSSEUS_HOST=${WEB_PROTOCOL}://${SERVER_NAME}:${ODYSSEUS_PORT}"
      - TZ=${TIMEZONE}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: always

  glances:
    image: nicolargo/glances:latest-full
    container_name: glances
    network_mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/os-release:/etc/os-release:ro
      - /:/host:ro
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    environment:
      - GLANCES_OPT=-w
      - PUID=${HOST_PUID:-1000}
      - PGID=${HOST_PGID:-1000}
      - TZ=${TIMEZONE}
    devices:
      - /dev/dri:/dev/dri
    pid: host
    restart: unless-stopped

  autoheal:
    image: willfarrell/autoheal:latest
    container_name: autoheal
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    environment:
      - AUTOHEAL_CONTAINER_LABEL=all
      - AUTOHEAL_INTERVAL=30
      - AUTOHEAL_START_PERIOD=60
    restart: always

  myspeed:
    image: germannewsmaker/myspeed
    container_name: myspeed
    ports:
      - ${MYSPEED_PORT}:${MYSPEED_PORT}/tcp
    volumes:
      - myspeed:/myspeed/data
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    environment:
      - TZ=${TIMEZONE}
    restart: unless-stopped

  scrutiny:
    image: ghcr.io/analogj/scrutiny:nightly-omnibus
    container_name: scrutiny
    cap_add:
      - SYS_RAWIO
    ports:
      - ${SCRUTINY_PORT:-54321}:8080
      - ${SCRUTINY_ADMIN_PORT:-12345}:8086
    volumes:
      - /run/udev:/run/udev:ro
      - ./config:/opt/scrutiny/config
      - ./influxdb:/opt/scrutiny/influxdb
    devices:
      - /dev/nvme0n1
      - /dev/sda
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Infrastructure
  # ---------------------------------------------------------------------------

  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    cap_add:
      - NET_ADMIN
    network_mode: host
    ports:
      - 53:53/tcp
      - 53:53/udp
      - 67:67/udp
      - 6060:6060/tcp
    volumes:
      - ./etc-pihole:/etc/pihole
      - ./etc-dnsmasq.d:/etc/dnsmasq.d
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    environment:
      - TZ=America/Los_Angeles
      - WEBPASSWORD=password123
      - FTLCONF_misc_etc_dnsmasq_d=true
    restart: unless-stopped

  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    command: tunnel --no-autoupdate run --token ${CLOUDFLARED_KEY}
    restart: always

  portainer:
    image: portainer/portainer-ce:lts
    container_name: portainer
    ports:
      - ${PORTAINER_PORT}:${PORTAINER_PORT}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    restart: always

  caddy:
    image: caddy:latest
    container_name: caddy
    networks:
      - caddy_net
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile
      - ./caddy/site:/srv
      - ./caddy/caddy_data:/data
      - ./caddy/caddy_config:/config
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Karakeep
  # ---------------------------------------------------------------------------

  karakeep:
    image: ghcr.io/karakeep-app/karakeep:${KARAKEEP_VERSION:-release}
    container_name: karakeep
    env_file:
      - .env
    ports:
      - 4621:3000
    volumes:
      - karakeep-data:/data
    environment:
      - MEILI_ADDR=http://meilisearch:7700
      - BROWSER_WEB_URL=http://chrome:9222
      - DATA_DIR=/data
    restart: unless-stopped

  chrome:
    image: gcr.io/zenika-hub/alpine-chrome:124
    container_name: karakeep-chromebrowser
    command:
      - --no-sandbox
      - --disable-gpu
      - --disable-dev-shm-usage
      - --remote-debugging-address=0.0.0.0
      - --remote-debugging-port=9222
      - --hide-scrollbars
      - --disable-blink-features=AutomationControlled
      - --window-size=1440,900
    restart: unless-stopped

  meilisearch:
    image: getmeili/meilisearch:v1.41.0
    container_name: karakeep-meilisearch
    env_file:
      - .env
    volumes:
      - meilisearch:/meili_data
    environment:
      - MEILI_NO_ANALYTICS="true"
    restart: unless-stopped