# Este arquivo docker compose configura todos os serviços que utilizo em produção no meu servidor pessoal
# 
# Informações úteis para administração dos containers:
# - Os containers estão dispostos em ordem alfabéticas neste arquivo
# - No início de cada serviço há um ou mais links para a documentação ou tutoriais de como configurar cada serviço

x-cloudflare-dns: &cloudflare-dns
  dns:
    - 1.1.1.1
    - 1.0.0.1

x-local-dns: &local-dns
  dns:
    - 172.16.0.2

x-timezone-env: &timezone-env
  TZ: ${TIMEZONE}

x-user-permissions: &user-permissions
  PUID: 1000
  PGID: 1000

x-restart: &restart
  restart: unless-stopped

x-docker-socket: &docker-socket
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock

x-calibre-web-env: &calibre-web-env
  DOCKER_MODS: linuxserver/mods:universal-calibre #optional
  OAUTHLIB_RELAX_TOKEN_SCOPE: 1 #optional

x-duplicati-env: &duplicati-env
  DUPLICATI__WEBSERVICE_PASSWORD: ${DUPLICATI__WEBSERVICE_PASSWORD}
  SETTINGS_ENCRYPTION_KEY: ${SETTINGS_ENCRYPTION_KEY}

x-filebrowser-env: &filebrowser-env
  FB_ROOT: /data
  FB_NOAUTH: true

x-freshrss-env: &freshrss-env
  CRON_MIN: '2,32'
  FRESHRSS_INSTALL: |-
    --api-enabled
    --default-user hick
    --language pt-BR
  FRESHRSS_USER: |-
    --api-password ${FRESHRSS_PASSWORD}
    --email ${FRESHRSS_EMAIL}
    --language pt-BR
    --password ${FRESHRSS_PASSWORD}
    --user ${FRESHRSS_USER}

x-librespeed-env: &librespeed-env
  MODE: standalone
  # TITLE: "Teste de Velocidade"
  # TELEMETRY: "false"
  # ENABLE_ID_OBFUSCATION: "false"
  # REDACT_IP_ADDRESSES: "false"
  # PASSWORD:
  # EMAIL:
  # DISABLE_IPINFO: "false"
  # IPINFO_APIKEY: "your api key"
  # DISTANCE: "km"
  # WEBPORT: 8080

x-metube-env: &metube-env
  DEFAULT_THEME: dark

x-pihole-env: &pihole-env
  # Set a password to access the web interface. Not setting one will result in a random password being assigned
  FTLCONF_webserver_api_password: ${PIHOLE_PASSWORD:-pihole-pass}
  # If using Docker's default `bridge` network setting the dns listening mode should be set to 'all'
  FTLCONF_dns_listeningMode: 'all'

x-stirling-pdf-env: &stirling-pdf-env
  LANGS: pt_BR
  DISABLE_ADDITIONAL_FEATURES: 'true'

x-umami-env: &umami-env
  DATABASE_URL: postgresql://umami:umami@umami-db:5432/umami
  DATABASE_TYPE: postgresql
  APP_SECRET: ${UMAMI_SECRET}
  POSTGRES_DB: umami
  POSTGRES_USER: umami
  POSTGRES_PASSWORD: umami
  HOSTNAME: 0.0.0.0

x-vaultwarden-env: &vaultwarden-env
  DOMAIN: "https://server.henriquesebastiao.com:8019"

x-zabbix-env: &zabbix-env
  DB_SERVER_HOST: zabbix-database
  POSTGRES_USER: zabbix
  POSTGRES_PASSWORD: zabbix
  POSTGRES_DB: zabbix
  ZBX_SERVER_HOST: zabbix-server
  PHP_TZ: UTC
  ZBX_HOSTNAME: zabbix-agent

services:

  # https://github.com/linuxserver/docker-calibre-web
  # https://github.com/janeczku/calibre-web
  calibre-web:
    image: linuxserver/calibre-web:0.6.27@sha256:f9c692fba85ade1ce71b98364b860f72855055a59198894cc8c2ea49fc98a840
    container_name: calibre-web
    environment:
      <<: [*timezone-env, *calibre-web-env, *user-permissions]
    volumes:
      - ${BASE}/calibre-web/config:/config
      - ${BASE}/calibre-web/books:/books
    <<: [*local-dns, *restart]

  # https://hub.docker.com/r/cloudflare/cloudflared
  cloudflared:
    image: cloudflare/cloudflared:2026.10.7@sha256:4955524aeaa379e154023d5a027c250f7b35041a2e7e950cf13f144bc9b9c5ba
    container_name: cloudflared
    command: tunnel --no-autoupdate run --token ${CLOUDFLARED_TOKEN}
    <<: [*cloudflare-dns, *restart]
  
  downtify:
    image: ghcr.io/henriquesebastiao/downtify:3.10.0@sha256:8daf035bebbb51042cc26a11732778743b5f389302af4a5c9d435ea736d4fecd
    container_name: downtify
    volumes:
      - ${BASE}/downtify/downloads:/downloads
      - ${BASE}/downtify/data:/data
    <<: [*cloudflare-dns, *restart]

  # https://dozzle.dev/guide/what-is-dozzle
  # https://github.com/amir20/dozzle
  dozzle:
    container_name: dozzle
    image: amir20/dozzle:v11.4.0@sha256:d23d23ce02c8cc96416dfbad4a7de225d01fdc03ad310203d64d580034dd120d
    environment:
      <<: *user-permissions
    volumes:
    - /var/run/docker.sock:/var/run/docker.sock
    - dozzle_data:/data
    <<: [*local-dns, *restart]
  
  # https://github.com/linuxserver/docker-duplicati
  # https://docs.duplicati.com/
  #
  # Diretórios de backups
  # --------------------------------------------
  # Drive                           -> Home Server
  # --------------------------------------------
  # Backups/duplicati/calibre/      -> $HOME/homelab/containers/calibre-web/
  duplicati:
    image: linuxserver/duplicati:2.4.1@sha256:811881130a7d37999440930d62d57e91e0bea1d930b6ba6bb08e381955205c44
    container_name: duplicati
    privileged: true
    volumes:
      - ${BASE}/duplicati/config:/config
      - /home/hick/backups:/backups
      - /:/source:rw
    environment:
      <<: [*timezone-env, *duplicati-env, *user-permissions]
    <<: [*local-dns, *restart]

  # https://filebrowser.org/installation.html
  # https://github.com/filebrowser/filebrowser
  filebrowser:
    image: filebrowser/filebrowser:v2.63.23@sha256:a469ea076d4a1b4b1d86a41d130f2f536cd9da996a2b1fb39c0d7635f9d89b9a
    container_name: filebrowser
    user: "0:0"
    volumes:
      - filebrowser_data:/srv
      - filebrowser_database:/database
      - filebrowser_config:/config
      - /home/hick:/data
    environment:
      <<: *filebrowser-env
    <<: [*local-dns, *restart]
  
  # https://github.com/FreshRSS/FreshRSS#installation
  # https://freshrss.org/
  freshrss:
    image: freshrss/freshrss:1.30.4@sha256:af44385229541bee24aa9148d0ff8f3b40e095373c63a2c0f74e09a27d3c59df
    container_name: freshrss
    volumes:
      - ${BASE}/freshrss/data:/var/www/FreshRSS/data
      - ${BASE}/freshrss/extensions:/var/www/FreshRSS/extensions
    environment:
      <<: [*freshrss-env, *timezone-env, *user-permissions]
    <<: [*local-dns, *restart]

  # https://github.com/glanceapp/glance
  glance:
    container_name: glance
    image: glanceapp/glance:v0.8.7@sha256:bc5a392672c1ec8823c50b61f3bd4b7e5acc34fcbb8477862577b3af1c633875
    volumes:
      - ${BASE}/glance/config:/app/config
      - ${BASE}/glance/assets:/app/assets
      - /etc/localtime:/etc/localtime:ro
      # Optionally, also mount docker socket if you want to use the docker containers widget
      - /var/run/docker.sock:/var/run/docker.sock:ro
    env_file:
      - .env
    environment:
      <<: *user-permissions
    <<: [*cloudflare-dns, *restart]
    # env_file: ${BASE}/glance/.env

  # https://grafana.com/docs/grafana/latest/setup-grafana/installation/docker/
  grafana:
    image: grafana/grafana:13.3.0@sha256:488984b716c0862639f91a698adbe2862677a5a07bad42da5f03f3030883b205
    container_name: grafana
    user: '0'
    volumes:
      - ${BASE}/grafana:/var/lib/grafana
    <<: [*cloudflare-dns, *restart]
  
  immich-server:
    container_name: immich-server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${BASE}/immich/library:/data
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    environment:
      DB_DATA_LOCATION: ${IMMICH_DB_DATA_LOCATION}
      DB_HOSTNAME: ${IMMICH_DB_HOSTNAME}
      REDIS_HOSTNAME: ${IMMICCH_REDIS_HOSTNAME}
    depends_on:
      - immich-redis
      - immich-database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich-machine-learning
    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - immich-model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false

  immich-redis:
    container_name: immich-redis
    image: docker.io/valkey/valkey:9@sha256:3add1a336a920ea54770a001ab6feb3da5fceea96a40373a3a2cd469b815f0b7
    healthcheck:
      test: redis-cli ping | grep -q PONG || exit 1
    restart: always

  immich-database:
    container_name: immich-database
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
    environment:
      POSTGRES_PASSWORD: ${IMMICH_DB_PASSWORD}
      POSTGRES_USER: ${IMMICH_DB_USERNAME}
      POSTGRES_DB: ${IMMICH_DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
      # DB_STORAGE_TYPE: 'HDD'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${IMMICH_DB_DATA_LOCATION}:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always
    healthcheck:
      disable: false

  # https://github.com/librespeed/speedtest-go
  librespeed:
    container_name: librespeed
    image: ghcr.io/librespeed/speedtest:6.3.1@sha256:bc34bf69b6c102b23ab81b6e77beb7cce321fb0d3be33ec6e80edef3e9dd8bab
    environment:
      <<: [*librespeed-env, *user-permissions]
    <<: [*local-dns, *restart]
  
  # https://github.com/alexta69/metube
  metube:
    container_name: metube
    image: ghcr.io/alexta69/metube:2026.11.06@sha256:96dfbf0d5b2944e4ee38f6ce1b34bb0e75a1a3c74eaefd93424ed11284cb72b2
    volumes:
      - ${BASE}/metube/downloads:/downloads
    environment:
      <<: [*metube-env, *user-permissions]
    <<: [*local-dns, *restart]
  
  # # https://docs.n8n.io/hosting/installation/docker/
  # n8n:
  #   image: n8nio/n8n:2.19.5@sha256:b1b0c592735e24acd3cc64db83f94ef4efd8e331e47c6883249cc51cc1bea16b
  #   container_name: n8n
  #   restart: unless-stopped
  #   ports:
  #     - 8027:443
  #   environment:
  #     - GENERIC_TIMEZONE=${TIMEZONE}
  #     - TZ=${TIMEZONE}
  #     - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
  #     - N8N_RUNNERS_ENABLED=true
  #     - N8N_SECURE_COOKIE=${N8N_SECURE_COOKIE}
  #     - N8N_HOST=${N8N_HOST}
  #     - N8N_PORT=${N8N_PORT}
  #     - N8N_PROTOCOL=${N8N_PROTOCOL}
  #   volumes:
  #     - ${BASE}/n8n/data:/home/node/.n8n

  # https://github.com/nextcloud/all-in-one/
  # https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
  nextcloud-aio-mastercontainer:
    image: ghcr.io/nextcloud-releases/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer
    environment:
      # Porta em que o container Apache (gerado pelo AIO) vai escutar no host.
      # O Nginx faz proxy para ela via host.docker.internal:11000
      APACHE_PORT: 11000
      # Liga o Apache a todas as interfaces do host para que o Nginx em container consiga alcançá-lo
      APACHE_IP_BINDING: 0.0.0.0
      # Diretório de dados do Nextcloud no host (ajuste se quiser armazenar em outro volume)
      NEXTCLOUD_DATADIR: ${BASE}/nextcloud/data
      # Pula a validação de porta 443 — o SSL é gerenciado pelo Nginx externo, não pelo AIO
      SKIP_DOMAIN_VALIDATION: true
    volumes:
      # Não altere este path — é exigido pelo mecanismo de backup interno do AIO
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      # Interface de administração do AIO — acesso direto sem passar pelo Nginx
      # Abra https://server.henriquesebastiao.com:8080 para o setup inicial (certificado autoassinado, aceite a exceção)
      - 8080:8080

  # https://nginxproxymanager.com/setup/

  nginx:
    image: nginx:1.31.8-alpine@sha256:785835ea65db4bba6f021acc0f3be91b0fef76a53fe41f8588c6698d2aed0606
    container_name: nginx
    # Permite alcançar containers AIO (nextcloud-aio-apache) que rodam na rede do host
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - '8001:8001' # Pi-hole
      - '8002:8002' # Immich
      - '8003:8003' # Zabbix
      - '8004:8004' # Grafana
      - '8005:8005' # Dozzle
      - '8006:8006' # Umami
      - '8007:8007' # Glance
      - '8008:8008' # Calibre Web
      - '8009:8009' # Metube
      - '8010:8010' # File Browser
      - '8011:8011' # Stirling PDF
      - '8012:8012' # Libre Speed
      - '8013:8013' # Nextcloud
      - '8018:8018' # Duplicati
      - '8019:8019' # Vaultwarden
      - '8020:8020' # Downtify
      - '8021:8021' # Speedtest Tracker
      - '8036:8036' # FreshRSS
    volumes:
      - ${BASE}/nginx/conf.d:/etc/nginx/conf.d:ro
      - ${BASE}/nginx/snippets:/etc/nginx/snippets:ro
      - /home/hick/homelab/letsencrypt:/etc/letsencrypt:ro
    environment:
      <<: [*timezone-env, *user-permissions]
    <<: [*local-dns, *restart]
  
  # https://docs.pi-hole.net/docker/
  pihole:
    container_name: pihole
    image: pihole/pihole:2026.10.1@sha256:30f803ad5dd60ff96cc0a63008a2e9271af481c1b0399a182192b2e91152c1f9
    ports:
      # DNS Ports
      - "53:53/tcp"
      - "53:53/udp"
      # Default HTTP Port
      #- "8001:80/tcp"
      # Default HTTPs Port. FTL will generate a self-signed certificate
      #- "443:443/tcp"
      # Uncomment the line below if you are using Pi-hole as your DHCP server
      #- "67:67/udp"
      # Uncomment the line below if you are using Pi-hole as your NTP server
      #- "123:123/udp"
    environment:
      <<: [*pihole-env, *timezone-env, *user-permissions]
    volumes:
      # For persisting Pi-hole's databases and common configuration file
      - 'pihole_data:/etc/pihole'
      # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true'
      #- './etc-dnsmasq.d:/etc/dnsmasq.d'
    cap_add:
      # See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
      # Required if you are using Pi-hole as your DHCP server, else not needed
      - NET_ADMIN
      - NET_RAW
      # Required if you are using Pi-hole as your NTP client to be able to set the host's system time
      - SYS_TIME
      # Optional, if Pi-hole should get some more processing time
      - SYS_NICE
    <<: [*cloudflare-dns, *restart]
  
  speedtest-tracker:
    image: linuxserver/speedtest-tracker:1.15.1@sha256:14d56d7c4ff0af18f0a09be8494352ba40d23196e78c5f812cee69afaa1edc45
    container_name: speedtest-tracker
    environment:
      DB_CONNECTION: sqlite
      APP_KEY: base64:7MVqhKqatr4m9fsyoYm/WUSE88mWb9qMSA6i+Aa6qpY=
      APP_URL: http://speedtest.local
      APP_TIMEZONE: America/Manaus
      APP_LOCALE: pt-BR
      SPEEDTEST_SERVERS: 33211 # Invinet
      SPEEDTEST_SCHEDULE: 30 * * * * # A cada 30 minutos
      <<: *user-permissions
    volumes:
      - ${BASE}/speedtest/data:/config
      - ${BASE}/speedtest/custom-ssl-keys:/config/keys
    <<: [*local-dns, *restart]

  # https://docs.stirlingpdf.com/Installation/Docker%20Install
  stirling-pdf:
    image: stirlingtools/stirling-pdf:1.6.0@sha256:1f73a8f898fe269cbbccea3be577064dd87fc4334de349fcc5b1afa1bcebf240
    container_name: stirling-pdf
    environment:
      <<: [*stirling-pdf-env, *user-permissions]
    <<: [*local-dns, *restart]

  # https://docs.umami.is/docs/install
  umami:
    image: ghcr.io/umami-software/umami:postgresql-latest@sha256:e69d1a7932e9dab0fc523edc7be1f3a53f3c261f57856fc2167ae74a8fc022e8
    container_name: umami
    environment:
      <<: [*umami-env, *user-permissions]
    env_file:
      - .env
    depends_on:
      umami-db:
        condition: service_healthy
    init: true
    <<: [*local-dns, *restart]
  
  umami-db:
    image: postgres:15-alpine@sha256:f7d23353e1b15400d22ebe31189f4d314b87a4c129cc400c8c2d8d4ca127bf81
    container_name: umami-db
    environment:
      <<: [*umami-env, *user-permissions]
    volumes:
      - umami-db-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U umami -d umami"]
      interval: 5s
      timeout: 5s
      retries: 5
    <<: [*local-dns, *restart]
  
  # https://github.com/louislam/uptime-kuma/wiki
  uptime-kuma:
    image: louislam/uptime-kuma:2.5.9@sha256:e88415a90dd2f7efecdbc18de0490aff292764a3ac471531bf1d0481725591bd
    container_name: uptime-kuma
    volumes:
      - ${BASE}/uptime-kuma/data:/app/data
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - 8026:3001
    environment:
      <<: *user-permissions
    <<: [*local-dns, *restart]
  
  # https://github.com/dani-garcia/vaultwarden
  vaultwarden:
    image: vaultwarden/server:1.37.5@sha256:4fe17f415f90087377d37c755e0ea3cf189dcc6794e49cdd2a9adbb4937d9e1f
    container_name: vaultwarden
    environment:
      <<: [*vaultwarden-env, *user-permissions]
    volumes:
      - ${BASE}/vaultwarden/data/:/data/
    <<: [*local-dns, *restart]

  # https://www.zabbix.com/documentation/current/en/manual/installation/containers  
  zabbix-frontend:
    image: zabbix/zabbix-web-nginx-pgsql:7.4.16-alpine@sha256:898f28064ef8fdac969da0088663b27e2a66c28e5f865ebaf642839106e65fde
    hostname: zabbix-frontend
    container_name: zabbix-frontend
    environment:
      <<: [*zabbix-env, *user-permissions]
    depends_on:
      - zabbix-server
      - zabbix-database
    <<: [*local-dns, *restart]

  zabbix-server:
    image: zabbix/zabbix-server-pgsql:7.4.16-alpine@sha256:546f7cae8f04b287ab4ffd3cc81193f2ea99f2da1d0564217b65d93438f44454
    container_name: zabbix-server
    hostname: zabbix-server
    init: true
    environment:
      <<: [*zabbix-env, *user-permissions]
    ports:
      - 10050:10050
    depends_on:
      - zabbix-database
    <<: [*local-dns, *restart]

  zabbix-agent:
    image: zabbix/zabbix-agent2:7.4.16-alpine@sha256:0719e7814cdb14f0b5a0ad8f77938935004298ffeceb669716385d3af423c733
    container_name: zabbix-agent
    hostname: zabbix-agent
    restart: unless-stopped
    init: true
    environment:
      <<: [*zabbix-env, *user-permissions]
    <<: [*local-dns, *restart]

  zabbix-database:
    image: postgres:13.18-alpine3.20@sha256:77815c1f18ae761b0e503503a494475a03149d7ce544934ccecdbafdb3956c94
    container_name: zabbix-database
    hostname: zabbix-database
    environment:
      <<: [*zabbix-env, *user-permissions]      
    volumes:
      - ${BASE}/zabbix/data:/var/lib/postgresql/data
    <<: [*local-dns, *restart]

volumes:
  dozzle_data:
  filebrowser_data:
  filebrowser_database:
  filebrowser_config:
  immich-model-cache:
  model-cache:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer
  pihole_data:
  umami-db-data: