docker-compose-t2-obsolete.yml

version: "3.7"
# THESE ARE APPS I DO NOT USE ANYMORE OR TESTED BUT FOUND TO BE NOT USEFUL TO ME

########################### NETWORKS
networks:
  t2_proxy:
    external:
      name: t2_proxy
  default:
    driver: bridge

########################### SERVICES
services:
  # MiFlora MQTT Daemon - BT to MQTT Daemon for MiFlora Sensors
  miflora:
    image: raymondmm/miflora-mqtt
    container_name: miflora-mqtt
    environment:
      - TZ=$TZ
    network_mode: host
    # user: "0"
    volumes:
      - $USERDIR/docker/miflora-mqtt/config:/config
    restart: unless-stopped

  # Varken - Monitor Plex, Sonarr, Radarr, and Other Data
  varken:
    image: boerderij/varken
    container_name: varken
    restart: unless-stopped
    networks:
      - t2_proxy
    volumes:
      - $USERDIR/docker/varken:/config
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
      VRKN_GLOBAL_SONARR_SERVER_IDS: 1
      VRKN_GLOBAL_RADARR_SERVER_IDS: 1
      VRKN_GLOBAL_LIDARR_SERVER_IDS: "false"
      VRKN_GLOBAL_TAUTULLI_SERVER_IDS: 1
      VRKN_GLOBAL_OMBI_SERVER_IDS: "false"
      VRKN_GLOBAL_SICKCHILL_SERVER_IDS: "false"
      VRKN_GLOBAL_UNIFI_SERVER_IDS: 1
      VRKN_INFLUXDB_URL: $SERVER_IP
      VRKN_INFLUXDB_PORT: 8086
      VRKN_INFLUXDB_SSL: "false"
      VRKN_INFLUXDB_VERIFY_SSL: "false"
      VRKN_INFLUXDB_USERNAME: $VARKEN_USER
      VRKN_INFLUXDB_PASSWORD: $VARKEN_PASS
      VRKN_TAUTULLI_1_URL: $SERVER_IP:$TAUTULLI_PORT
      VRKN_TAUTULLI_1_FALLBACK_IP: 1.1.1.1
      VRKN_TAUTULLI_1_APIKEY: $TAUTULLI_API_KEY
      VRKN_TAUTULLI_1_SSL: "false"
      VRKN_TAUTULLI_1_VERIFY_SSL: "false"
      VRKN_TAUTULLI_1_GET_ACTIVITY: "true"
      VRKN_TAUTULLI_1_GET_ACTIVITY_RUN_SECONDS: 30
      VRKN_TAUTULLI_1_GET_STATS: "true"
      VRKN_TAUTULLI_1_GET_STATS_RUN_SECONDS: 3600
      VRKN_SONARR_1_URL: $SERVER_IP:$SONARR_PORT
      VRKN_SONARR_1_APIKEY: $SONARR_API_KEY
      VRKN_SONARR_1_SSL: "false"
      VRKN_SONARR_1_VERIFY_SSL: "false"
      VRKN_SONARR_1_MISSING_DAYS: 7
      VRKN_SONARR_1_MISSING_DAYS_RUN_SECONDS: 300
      VRKN_SONARR_1_FUTURE_DAYS: 1
      VRKN_SONARR_1_FUTURE_DAYS_RUN_SECONDS: 300
      VRKN_SONARR_1_QUEUE: "true"
      VRKN_SONARR_1_QUEUE_RUN_SECONDS: 300
      VRKN_RADARR_1_URL: $SERVER_IP:$RADARR_PORT
      VRKN_RADARR_1_APIKEY: $RADARR_API_KEY
      VRKN_RADARR_1_SSL: "false"
      VRKN_RADARR_1_VERIFY_SSL: "false"
      VRKN_RADARR_1_QUEUE: "true"
      VRKN_RADARR_1_QUEUE_RUN_SECONDS: 300
      VRKN_RADARR_1_GET_MISSING: "true"
      VRKN_RADARR_1_GET_MISSING_RUN_SECONDS: 300
      VRKN_UNIFI_1_URL: $UNIFI_HOST
      VRKN_UNIFI_1_USERNAME: $UNIFI_USER
      VRKN_UNIFI_1_PASSWORD: $UNIFI_PASS
      VRKN_UNIFI_1_SITE: default
      VRKN_UNIFI_1_USG_NAME: USG
      VRKN_UNIFI_1_SSL: "true"
      VRKN_UNIFI_1_VERIFY_SSL: "false"
      VRKN_UNIFI_1_GET_USG_STATS_RUN_SECONDS: 300

  # xTeve - IPTV proxy for Plex
  xteve:
    image: alturismo/xteve
    container_name: xteve
    restart: unless-stopped
    # network_mode: host
    networks:
      - t2_proxy
    ports:
      - "34400:34400"
      - "1901:1900"
    # user: "0"
    # logging:
    #   options:
    #     max-size: "10m"
    #     max-files: 3
    environment:
      TZ: $TZ
    volumes:
      - $USERDIR/docker/xteve:/config:rw
      - /dev/shm:/tmp/xteve
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.xteve-rtr.entrypoints=https"
      - "traefik.http.routers.xteve-rtr.rule=Host(`xteve.$DOMAINNAME`)"
      - "traefik.http.routers.xteve-rtr.tls=true"
      ## Middlewares
      - "traefik.http.routers.xteve-rtr.middlewares=chain-authelia@file"
      ## HTTP Services
      - "traefik.http.routers.xteve-rtr.service=xteve-svc"
      - "traefik.http.services.xteve-svc.loadbalancer.server.port=34400"

  # Cloud IDE - Editing
  cloud9:
    image: linuxserver/cloud9
    container_name: cloud9
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    ports:
      - "$CLOUD9_PORT:8000"
    volumes:
      - $USERDIR/server/scripts:/code
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
      # PASSWORD: $CLOUD9_PASSWORD
      # USERNAME: $CLOUD9_USERNAME
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.cloud9-rtr.entrypoints=https"
      - "traefik.http.routers.cloud9-rtr.rule=Host(`cloud9.$DOMAINNAME`)"
      - "traefik.http.routers.cloud9-rtr.tls=true"
      ## Middlewares
      - "traefik.http.routers.cloud9-rtr.middlewares=chain-authelia@file"
      ## HTTP Services
      - "traefik.http.routers.cloud9-rtr.service=cloud9-svc"
      - "traefik.http.services.cloud9-svc.loadbalancer.server.port=8000"

  # Cloud Commander - web file manager
  cloudcmd:
    image: coderaiser/cloudcmd
    container_name: cloudcmd
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    volumes:
      - $USERDIR/docker/cloudcmd:/root
      - $USERDIR:/mnt/fs
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.cloudcmd-rtr.entrypoints=https"
      - "traefik.http.routers.cloudcmd-rtr.rule=Host(`cloudcmd.$DOMAINNAME`)"
      - "traefik.http.routers.cloudcmd-rtr.tls=true"
      ## Middlewares
      - "traefik.http.routers.cloudcmd-rtr.middlewares=chain-authelia@file"
      ## HTTP Services
      - "traefik.http.routers.cloudcmd-rtr.service=cloudcmd-svc"
      - "traefik.http.services.cloudcmd-svc.loadbalancer.server.port=8000"

  # VSCode Server - VSCode Editing
  # WARNING: This appears to change permissions of all files to PUID:PGID
  code-server:
    image: linuxserver/code-server:latest
    container_name: code-server
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    ports:
      - "$CODE_SERVER_PORT:8443"
    volumes:
      - $USERDIR/docker/code-server:/config
      - $USERDIR:/home/user
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
      PASSWORD: $VSCODE_PASSWORD
      # SUDO_PASSWORD: $VSCODE_SUDO_PASSWORD
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.code-server-rtr.entrypoints=https"
      - "traefik.http.routers.code-server-rtr.rule=Host(`code.$DOMAINNAME`)"
      - "traefik.http.routers.code-server-rtr.tls=true"
      ## Middlewares
      - "traefik.http.routers.code-server-rtr.middlewares=chain-authelia@file"
      ## HTTP Services
      - "traefik.http.routers.code-server-rtr.service=code-server-svc"
      - "traefik.http.services.code-server-svc.loadbalancer.server.port=8443"

  # qBittorrent - Torrent downloader
  # Needs trailing / if using PathPrefixStrip
  qbittorrent:
    image: linuxserver/qbittorrent:latest
    container_name: qbittorrent
    restart: always
    network_mode: container:transmission-vpn
    security_opt:
      - no-new-privileges:true
    volumes:
      - $USERDIR/docker/qbittorrent:/config
      - $USERDIR/Downloads:/downloads
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
      UMASK_SET: 002
      WEBUI_PORT: 8168
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.qbittorrent-rtr.entrypoints=https"
      - "traefik.http.routers.qbittorrent-rtr.rule=Host(`qbit.$DOMAINNAME`)"
      - "traefik.http.routers.qbittorrent-rtr.tls=true"
      ## Middlewares
      - "traefik.http.routers.qbittorrent-rtr.middlewares=chain-authelia@file"
      ## HTTP Services
      - "traefik.http.routers.qbittorrent-rtr.service=qbittorrent-svc"
      - "traefik.http.services.qbittorrent-svc.loadbalancer.server.port=8168"

  # Cloudflare DDNS - Dynamic DNS Updater
  cloudddns:
    container_name: cloudddns
    restart: always
    image: joshava/cloudflare-ddns
    volumes:
      - $USERDIR/docker/cloudflare-ddns/config.yaml:/app/config.yaml
    environment:
      - PUID=$PUID
      - PGID=$PGID
      - TZ=$TZ

  # SmokePing - Network latency Monitoring
  smokeping:
    image: linuxserver/smokeping:latest
    container_name: smokeping
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    # ports:
    #  - "$SMOKEPING_PORT:80"
    volumes:
      - $DOCKERDIR/smokeping/config:/config
      - $DOCKERDIR/smokeping/data:/data
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.smokeping-rtr.entrypoints=https"
      - "traefik.http.routers.smokeping-rtr.rule=HostHeader(`smokeping.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.smokeping-rtr.middlewares=chain-authelia@file"
      ## HTTP Services
      - "traefik.http.routers.smokeping-rtr.service=smokeping-svc"
      - "traefik.http.services.smokeping-svc.loadbalancer.server.port=80"

  # HA-Dockermon - Manage Docker containers in Home Assistant
  ha-dockermon:
    image: philhawthorne/ha-dockermon:latest
    container_name: ha-dockermon
    restart: unless-stopped
    networks:
      - socket_proxy
    security_opt:
      - no-new-privileges:true
    ports:
      - "$HA_DOCKERMON_PORT:8126"
    volumes:
      - $DOCKERDIR/ha-dockermon:/config
      # - /var/run/docker.sock:/var/run/docker.sock
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
      DOCKER_HOST: tcp://socket-proxy:2375

  # Postgres - Database
  postgres:
    image: postgres
    container_name: postgres
    restart: always
    security_opt:
      - no-new-privileges:true
    volumes:
      - $DOCKERDIR/postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: $STATPING_DB_PASS
      POSTGRES_USER: $STATPING_DB_USER
      POSTGRES_DB: $STATPING_DB

  # UniFi Controller - Managing UniFi Network
  unifi:
    container_name: unifi
    image: jacobalberty/unifi:stable
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    ports:
      - "8080:8080"
      - "8443:8443"
      - "3478:3478/udp"
      - "10001:10001/udp"
      - "6789:6789"
    volumes:
      - ${DOCKERDIR}/unifi:/unifi
    environment:
      UNIFI_UID: $PUID
      UNIFI_GID: $PGID
      TZ: America/New_York
      RUNAS_UID0: "false"
      BIND_PRIV: "false"
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.unifi-rtr.entrypoints=https"
      - "traefik.http.routers.unifi-rtr.rule=HostHeader(`ufi.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.unifi-rtr.middlewares=chain-authelia@file"
      ## HTTP Services
      - "traefik.http.routers.unifi-rtr.service=unifi-svc"
      - "traefik.http.services.unifi-svc.loadbalancer.server.port=8443"

  # Ouroboros - Automatic Docker Container Updates
  ouroboros:
    image: pyouroboros/ouroboros:latest
    container_name: ouroboros
    restart: unless-stopped
    networks:
      - default
      - socket_proxy
    # depends_on:
    #  - socket-proxy
    volumes:
      # - /var/run/docker.sock:/var/run/docker.sock # Use Docker Socket Proxy instead for improved security
      - $DOCKERDIR/ouroboros/config.json:/root/.docker/config.json:ro
    environment:
      TZ: $TZ
      INTERVAL: 86400
      LOG_LEVEL: info
      SELF_UPDATE: "true"
      CLEANUP: "true"
      IGNORE: traefik influxdb hassio_dns homeassistant hassio_supervisor addon_core_check_config addon_62c7908d_autobackup plexms
      NOTIFIERS: "tgram://$TGRAM_BOT_TOKEN/$TGRAM_CHAT_ID/"
      DOCKER_SOCKETS: tcp://socket-proxy:2375 # POST to be enabled on Socket Proxy

  # Docker Socket Proxy - Security Enchanced Proxy for Docker Socket
  socket-proxy:
    container_name: socket-proxy
    image: tecnativa/docker-socket-proxy
    restart: always
    networks:
      # t2_proxy:
      socket_proxy:
        ipv4_address: 192.168.91.254 # You can specify a static IP
    privileged: true
    ports:
      - "2375:2375"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      - LOG_LEVEL=info # debug,info,notice,warning,err,crit,alert,emerg
      ## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.).
      # 0 to revoke access.
      # 1 to grant access.
      ## Granted by Default
      - EVENTS=1
      - PING=1
      - VERSION=1
      ## Revoked by Default
      # Security critical
      - AUTH=0
      - SECRETS=0
      - POST=1 # Ouroboros
      # Not always needed
      - BUILD=0
      - COMMIT=0
      - CONFIGS=0
      - CONTAINERS=1 # Traefik, portainer, etc.
      - DISTRIBUTION=0
      - EXEC=0
      - IMAGES=1 # Portainer
      - INFO=1 # Portainer
      - NETWORKS=1 # Portainer
      - NODES=0
      - PLUGINS=0
      - SERVICES=1 # Portainer
      - SESSION=0
      - SWARM=0
      - SYSTEM=0
      - TASKS=1 # Portaienr
      - VOLUMES=1 # Portainer

  # Traefik - Custom Error Pages
  # Obsoleted because I did not spend any more time on it to customize and don't see the value
  traefik-error-pages:
    container_name: traefik-error-pages
    image: guillaumebriday/traefik-custom-error-pages
    restart: unless-stopped
    networks:
      - t2_proxy
    labels:
      - "traefik.enable=true"
      # HTTP Routers
      - "traefik.http.routers.traefik-error-pages-rtr.entrypoints=https"
      - "traefik.http.routers.traefik-error-pages-rtr.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.traefik-error-pages-rtr.priority=1"
      # Middlewares
      - "traefik.http.routers.traefik-error-pages-rtr.middlewares=traefik-error-pages"
      - "traefik.http.middlewares.traefik-error-pages.errors.service=traefik-error-pages-svc"
      - "traefik.http.middlewares.traefik-error-pages.errors.status=401,403,404,429,500,502,503"
      - "traefik.http.middlewares.traefik-error-pages.errors.query=/{status}.html"
      # HTTP Services
      - "traefik.http.routers.traefik-error-pages-rtr.service=traefik-error-pages-svc"
      - "traefik.http.services.traefik-error-pages-svc.loadbalancer.server.port=80"

  # Ombi - Media Requests
  ombi:
    image: linuxserver/ombi:latest
    container_name: ombi
    restart: unless-stopped
    networks:
      - t2_proxy
    # ports:
    #  - "$OMBI_PORT:3579"
    security_opt:
      - no-new-privileges:true
    volumes:
      - $DOCKERDIR/appdata/ombi:/config
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
      BASE_URL: /ombi #optional
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.ombi-rtr.entrypoints=https"
      - "traefik.http.routers.ombi-rtr.rule=Host(`ombi.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.ombi-rtr.middlewares=chain-no-auth@file"
      ## HTTP Services
      - "traefik.http.routers.ombi-rtr.service=ombi-svc"
      - "traefik.http.services.ombi-svc.loadbalancer.server.port=3579"

  # Emby - Media Server
  embyms:
    image: emby/embyserver:latest
    container_name: embyms
    restart: unless-stopped
    networks:
      - t2_proxy
    devices:
      - /dev/dri:/dev/dri # for harware transcoding
    security_opt:
      - no-new-privileges:true
    ports:
      - "$EMBY_PORT:8096/tcp"
      - "8920:8920/tcp"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - $DOCKERDIR/appdata/embyms:/config
      - /dev/shm:/data/transcode
      - $DATADIR/media:/data/media
      - $DATADIR/Downloads:/data/downloads
    environment:
      TZ: $TZ
      HOSTNAME: "nucEmby"
      UID: $PUID
      GID: $PGID
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.embyms-rtr.entrypoints=https"
      - "traefik.http.routers.embyms-rtr.rule=Host(`nucemby.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.embyms-rtr.middlewares=chain-no-auth@file"
      ## HTTP Services
      - "traefik.http.routers.embyms-rtr.service=embyms-svc"
      - "traefik.http.services.embyms-svc.loadbalancer.server.port=8096"

  # Plex-Sync - For Syncing watched status between plex servers
  plex-sync:
    image: patsissons/plex-sync:develop
    container_name: plex-sync
    security_opt:
      - no-new-privileges:true
    environment:
      INITIAL_RUN: "true"
      # DRY_RUN: 0
      CRON_SCHEDULE: "*/5 * * * *"
      SECTION_MAPS: $SYN_PLEX/$SYN_PLEX_HOLLYWOOD $NUC_PLEX/$NUC_PLEX_HOLLYWOOD | $SYN_PLEX/$SYN_PLEX_TVSHOWS $NUC_PLEX/$NUC_PLEX_TVSHOWS | $SYN_PLEX/$SYN_PLEX_INDIAN $NUC_PLEX/$NUC_PLEX_INDIAN | $SYN_PLEX/$SYN_PLEX_KOLLYWOOD $NUC_PLEX/$NUC_PLEX_KOLLYWOOD | $SYN_PLEX/$SYN_PLEX_DOCMOVIES $NUC_PLEX/$NUC_PLEX_DOCMOVIES | $SYN_PLEX/$SYN_PLEX_DOCSHOWS $NUC_PLEX/$NUC_PLEX_DOCSHOWS | $SYN_PLEX/$SYN_PLEX_KIDSMOVIES $NUC_PLEX/$NUC_PLEX_KIDSMOVIES | $SYN_PLEX/$SYN_PLEX_INTERNATIONAL $NUC_PLEX/$NUC_PLEX_INTERNATIONAL
    restart: unless-stopped

  # SMTP to Telegram - Send SMTP Notifications as Telegram Message
  # Use case: https://github.com/htpcBeginner/docker-traefik/issues/78
  smtp_to_telegram:
    image: kostyaesmukov/smtp_to_telegram
    container_name: smtp_to_telegram
    restart: always
    networks:
      - default
    environment:
      TZ: $TZ
      ST_TELEGRAM_CHAT_IDS: $TGRAM_CHAT_ID
      ST_TELEGRAM_BOT_TOKEN: $TGRAM_BOT_TOKEN
      ST_TELEGRAM_MESSAGE_TEMPLATE: "{subject}\\n{body}"

  # WatchTower - Automatic Docker Container Updates
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: unless-stopped
    networks:
      - socket_proxy
    depends_on:
      - socket-proxy
    environment:
      TZ: $TZ
      WATCHTOWER_CLEANUP: "true"
      WATCHTOWER_REMOVE_VOLUMES: "true"
      WATCHTOWER_INCLUDE_STOPPED: "true"
      WATCHTOWER_NO_STARTUP_MESSAGE: "false"
      WATCHTOWER_SCHEDULE: "0 30 12 * * *" # Everyday at 12:30
      WATCHTOWER_NOTIFICATIONS: shoutrrr
      WATCHTOWER_NOTIFICATION_URL: "telegram://$TGRAM_BOT_TOKEN@telegram?channels=$TGRAM_CHAT_ID"
      WATCHTOWER_NOTIFICATIONS_LEVEL: info
      DOCKER_HOST: tcp://socket-proxy:2375
      DOCKER_API_VERSION: "1.40"

  # Rclone - Google Drive Mount
  # https://github.com/openbridge/ob_bulkstash/issues/19
  # https://github.com/romancin/rclonebrowser-docker
  # https://github.com/romancin/rclonebrowser-docker
  # https://hub.docker.com/r/d2dyno/rclone-gui
  rclone-drive:
    container_name: rclone-drive
    hostname: rclone-drive
    image: rclone/rclone:1.52.3 #1.50.2 # latest v1.53 and above getting 403 DownloadQuotaExceeded error.
    restart: always
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    user: $PUID:$PGID
    command:
      "mount shb-drive: /data/shb-drive \
      --read-only \
      --use-mmap \
      --allow-other \
      --allow-non-empty \
      --dir-cache-time=1000h \
      --poll-interval=15s \
      --uid=1000 \
      --gid=1000 \
      --buffer-size=128M \
      --umask=002 \
      --drive-chunk-size=128M \
      --user-agent=dvm300drive \
      --cache-dir=/data/cache/shb-drive \
      --vfs-cache-mode=full \
      --vfs-cache-max-age=336h \
      --vfs-cache-max-size=768G \
      --vfs-read-chunk-size=16M \
      --vfs-read-chunk-size-limit=256M \
      --log-file /config/rclone/logs/shb-drive.log \
      --log-level NOTICE"
      #--bwlimit 150M \
      #--bwlimit-file 40M \
    devices:
      - /dev/fuse
    volumes:
      - $DOCKERDIR/appdata/rclone:/config/rclone
      - /media/shb-drive:/data/shb-drive:shared
      - /media/hdd1/cache/shb-drive:/data/cache/shb-drive
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro
      - /etc/fuse.conf:/etc/fuse.conf:ro
    environment:
      - TZ=$TZ

  # Rclone - Google Drive Mount
  rclone-crypt:
    container_name: rclone-crypt
    hostname: rclone-crypt
    image: rclone/rclone:1.52.3 #1.50.2 # latest v1.53 and above getting 403 DownloadQuotaExceeded error.
    restart: always
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    user: $PUID:$PGID
    command:
      "mount shb-crypt: /data/shb-crypt \
      --use-mmap \
      --allow-other \
      --allow-non-empty \
      --dir-cache-time=1000h \
      --poll-interval=15s \
      --uid=1000 \
      --gid=1000 \
      --buffer-size=128M \
      --umask=002 \
      --drive-chunk-size=128M \
      --user-agent=dvm300crypt \
      --cache-dir=/data/cache/shb-crypt \
      --vfs-cache-mode=full \
      --vfs-cache-max-age=336h \
      --vfs-cache-max-size=512G \
      --vfs-read-chunk-size=16M \
      --vfs-read-chunk-size-limit=256M \
      --log-file /config/rclone/logs/shb-crypt.log \
      --log-level NOTICE"
      #--bwlimit 3M \
      # 3M approxmimately equals 253 GB limit per day
      # previously buffer 256 buffer 256 chunk size 128 read and limit off
    devices:
      - /dev/fuse
    volumes:
      - $DOCKERDIR/appdata/rclone:/config/rclone
      - /media/shb-crypt:/data/shb-crypt:shared
      - /media/hdd1/cache/shb-crypt:/data/cache/shb-crypt
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro
      - /etc/fuse.conf:/etc/fuse.conf:ro
    environment:
      - TZ=$TZ

  # MergerFS - A featureful union filesystem
  mergerfs:
    container_name: mergerfs
    hostname: mergerfs
    image: hotio/mergerfs:latest
    restart: always
    depends_on:
      - rclone-drive
      - rclone-crypt
    user: $PUID:$PGID
    command: "/data/media-local:/data/media-crypt:/data/media-drive=RO \
      /data/media \
      -o rw,\
      use_ino,\
      allow_other,\
      func.getattr=newest,\
      category.action=all,\
      category.create=ff,\
      statfs_ignore=nc,\
      cache.files=auto-full,\
      func.getattr=newest,\
      dropcacheonclose=true,\
      nonempty"
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    devices:
      - /dev/fuse
    environment:
      - TZ=$TZ
    volumes:
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro
      - /etc/fuse.conf:/etc/fuse.conf:shared
      #- $DATADIR:/data:slave # creates local-media and shb-media on host
      - $DATADIR/local/media:/data/media-local:rshared
      - /media/shb-drive/media:/data/media-drive:rshared
      - /media/shb-crypt/media:/data/media-crypt:rshared
      - $DATADIR/media:/data/media:rshared

  # digikam - Photo Management
  digikam:
    image: ghcr.io/linuxserver/digikam
    container_name: digikam
    restart: unless-stopped
    networks:
      - t2_proxy
    volumes:
      - $DOCKERDIR/appdata/digikam:/config
      - $DATADIR/photos:/data/photos
    #ports:
    #  - 3000:3000
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.digikam-rtr.entrypoints=https"
      - "traefik.http.routers.digikam-rtr.rule=Host(`digikam.$DOMAINNAME0`)"
      ## Middlewares
      - "traefik.http.routers.digikam-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.digikam-rtr.service=digikam-svc"
      - "traefik.http.services.digikam-svc.loadbalancer.server.port=3000"

  # PlexTraktSync
  # Create Trakt Application https://github.com/Taxel/PlexTraktSync
  # Had to run this first before starting compose
  # git clone -b plexmovieagent-fixed https://github.com/Taxel/PlexTraktSync.git /home/USER/docker/apps/
  # sudo docker run -it --name ptsync -v /home/USER/docker/apps/PlexTraktSync:/usr/src/app -e TZ="America/New_York" --restart on-failure:2 twolaw/plextraktsync:latest
  # change permissions of .env and .pytrakt.json to 600 and root:root
  ptsync:
    image: twolaw/plextraktsync:latest
    container_name: ptsync
    restart: unless-stopped
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    environment:
      TZ: $TZ
    volumes:
      - $DOCKERDIR/apps/pts-mafixed:/usr/src/app # plexmovieagent-fixed branch

  # Tiny Media Manager - Media and Metadata Management Tool
  tinymm:
    image: romancin/tinymediamanager:latest
    container_name: tinymm
    restart: "no"
    networks:
      - t2_proxy
    security_opt:
      - no-new-privileges:true
    # ports:
    #   - "$TINYMM_PORT:5800"
    volumes:
      - $DOCKERDIR/appdata/tinymm:/config
      - $DATADIR/media:/data/media
      - $DATADIR/downloads:/data/downloads
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      TZ: $TZ
      UMASK: 002
      KEEP_APP_RUNNING: 1
      CLEAN_TMP_DIR: 1
      DISPLAY_WIDTH: 1600
      DISPLAY_HEIGHT: 960
      VNC_PASSWD: $TINYMM_VNC_PASSWD
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.tinymm-rtr.entrypoints=https"
      - "traefik.http.routers.tinymm-rtr.rule=Host(`tmm.$DOMAINNAME0`)"
      ## Middlewares
      - "traefik.http.routers.tinymm-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.tinymm-rtr.service=tinymm-svc"
      - "traefik.http.services.tinymm-svc.loadbalancer.server.port=5800"

  # SABnzbd - Binary newsgrabber (NZB downloader)
  # Disable SABNnzbd's built-in HTTPS support for traefik proxy to work
  # Needs trailing / if using PathPrefix
  sabnzbd:
    image: linuxserver/sabnzbd:latest
    container_name: sabnzbd
    restart: always
    networks:
      t2_proxy:
        ipv4_address: 192.168.90.116
    security_opt:
      - no-new-privileges:true
    # ports:
    #  - "$SABNZBD_PORT:8080"
    volumes:
      - $DOCKERDIR/appdata/sabnzbd:/config
      - $DATADIR/downloads:/data/downloads
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
      UMASK_SET: 002
    labels:
      - "traefik.enable=true"
      ## HTTP Routers Auth Bypass
      - "traefik.http.routers.sabnzbd-rtr-bypass.entrypoints=https"
      - "traefik.http.routers.sabnzbd-rtr-bypass.rule=Host(`sabnzbd.$DOMAINNAME0`) && Query(`apikey`, `$SABNZBD_API_KEY`)"
      - "traefik.http.routers.sabnzbd-rtr-bypass.priority=100"
      ## HTTP Routers Auth
      - "traefik.http.routers.sabnzbd-rtr.entrypoints=https"
      - "traefik.http.routers.sabnzbd-rtr.rule=Host(`sabnzbd.$DOMAINNAME0`)"
      - "traefik.http.routers.sabnzbd-rtr.priority=99"
      ## Middlewares
      - "traefik.http.routers.sabnzbd-rtr-bypass.middlewares=chain-no-auth@file"
      - "traefik.http.routers.sabnzbd-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.sabnzbd-rtr.service=sabnzbd-svc"
      - "traefik.http.routers.sabnzbd-rtr-bypass.service=sabnzbd-svc"
      - "traefik.http.services.sabnzbd-svc.loadbalancer.server.port=8080"