docker-compose-t2-synology.yml

version: "3.9"

######### IMPORTANT #############
# docker-compose-t2.yml is my main docker compose.
# You will find only a few apps (only those that I run on Synology NAS for my homelab use) in this docker-compose file.
# You can copy-paste services from one docker-compose file in this repo to another to add other apps.

########################### SYSTEM DESCRIPTION
# DOCKER-COMPOSE FOR SYNOLOGY DS918+
# 8 GB RAM, DSM 7.X
# 1x4TB + 3x8TB
# 2x256GB NVMe SSD Read-Write Cache
# Google Drive mounted using Rclone Docker Container for media

# Docker: 20.10.3
# Docker Compose: 2.18.1

########################### NETWORKS
# There is no need to create any networks outside this docker-compose file.
# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please.
# Docker Compose version 3.5 or higher required to define networks this way.

networks:
  t2_proxy:
    name: t2_proxy
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.90.0/24
  default:
    driver: bridge
  socket_proxy:
    name: socket_proxy
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.91.0/24
  dockervlan:
    name: dockervlan
    driver: macvlan
    driver_opts:
      parent: eth1 # using ifconfig
    ipam:
      config:
        - subnet: "192.168.1.0/24"
          ip_range: "192.168.1.25/32"
          gateway: "192.168.1.1"

########################### SECRETS
secrets:
  htpasswd:
    file: $DOCKERDIR/secrets/htpasswd
  cf_email:
    file: $DOCKERDIR/secrets/cf_email
  cf_api_key:
    file: $DOCKERDIR/secrets/cf_api_key
  cf_token:
    file: $DOCKERDIR/secrets/cf_token
  traefik_forward_auth:
    file: $DOCKERDIR/secrets/traefik_forward_auth
  mysql_root_password:
    file: $DOCKERDIR/secrets/mysql_root_password
  plex_claim:
    file: $DOCKERDIR/secrets/plex_claim

########################### SERVICES
services:
  ############################# FRONTENDS

  # Traefik 2 - Reverse Proxy
  # touch (create empty files) traefik.log and acme/acme.json. Set acme.json permissions to 600.
  # touch $DOCKERDIR/appdata/traefik2/acme/acme.json
  # chmod 600 $DOCKERDIR/appdata/traefik2/acme/acme.json
  # touch $DOCKERDIR/logs/synology//traefik.log
  traefik:
    container_name: traefik
    image: traefik:2.10
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    #profiles: ["core", "all"]
    networks:
      t2_proxy:
        ipv4_address: 192.168.90.254 # You can specify a static IP
      socket_proxy:
    command: # CLI arguments
      - --global.checkNewVersion=true
      - --global.sendAnonymousUsage=true
      - --entryPoints.http.address=:80
      - --entryPoints.https.address=:443
      # Allow these IPs to set the X-Forwarded-* headers - Cloudflare IPs: https://www.cloudflare.com/ips/
      - --entrypoints.https.forwardedHeaders.trustedIPs=$CLOUDFLARE_IPS,$LOCAL_IPS
      - --entryPoints.https.proxyProtocol.insecure
      - --entryPoints.https.proxyProtocol.trustedIPs=$LOCAL_IPS
      - --entryPoints.traefik.address=:8080
      # - --entryPoints.ping.address=:8081
      - --api=true
      - --api.insecure=true
      - --api.dashboard=true
      #- --ping=true
      # - --serversTransport.insecureSkipVerify=true
      - --log=true
      - --log.filePath=/logs/traefik.log
      - --log.level=INFO # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
      - --accessLog=true
      - --accessLog.filePath=/logs/access.log
      - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines
      - --accessLog.filters.statusCodes=204-299,400-499,500-599
      - --providers.docker=true
      # - --providers.docker.endpoint=unix:///var/run/docker.sock # Use Docker Socket Proxy instead for improved security
      - --providers.docker.endpoint=tcp://socket-proxy:2375
      # Automatically set Host rule for services
      # - --providers.docker.defaultrule=Host(`{{ index .Labels "com.docker.compose.service" }}.$DOMAINNAME_HOME_SYNOLOGY`)
      - --providers.docker.exposedByDefault=false
      # - --entrypoints.https.http.middlewares=chain-oauth@file
      - --entrypoints.https.http.tls.options=tls-opts@file
      # Add dns-cloudflare as default certresolver for all services. Also enables TLS and no need to specify on individual services
      - --entrypoints.https.http.tls.certresolver=dns-cloudflare
      - --entrypoints.https.http.tls.domains[0].main=$DOMAINNAME_HOME_SYNOLOGY
      - --entrypoints.https.http.tls.domains[0].sans=*.$DOMAINNAME_HOME_SYNOLOGY
      - --providers.docker.network=t2_proxy
      - --providers.docker.swarmMode=false
      - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory
      # - --providers.file.filename=/path/to/file # Load dynamic configuration from a file
      - --providers.file.watch=true # Only works on top level files in the rules folder
      # - --certificatesResolvers.dns-cloudflare.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # LetsEncrypt Staging Server - uncomment when testing
      - --certificatesResolvers.dns-cloudflare.acme.email=$CLOUDFLARE_EMAIL
      - --certificatesResolvers.dns-cloudflare.acme.storage=/acme.json
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.provider=cloudflare
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.delayBeforeCheck=90 # To delay DNS check and reduce LE hitrate
      # - --metrics.prometheus=true
      # - --metrics.prometheus.buckets=0.1,0.3,1.2,5.0
    #healthcheck:
    #  test: ["CMD", "traefik", "healthcheck", "--ping"]
    #  interval: 5s
    #  retries: 3
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
      - target: 8080 # insecure api wont work
        published: 8085
        protocol: tcp
        mode: host
    volumes:
      - $DOCKERDIR/appdata/traefik2/rules/synology:/rules # file provider directory
      # - /var/run/docker.sock:/var/run/docker.sock:ro # Use Docker Socket Proxy instead for improved security
      - $DOCKERDIR/appdata/traefik2/acme/acme.json:/acme.json # cert location - you must create this emtpy file and change permissions to 600
      - $DOCKERDIR/logs/synology/traefik:/logs # for fail2ban or crowdsec
    environment:
      - TZ=$TZ
      - CF_API_EMAIL_FILE=/run/secrets/cf_email
      - CF_API_KEY_FILE=/run/secrets/cf_api_key
      - HTPASSWD_FILE=/run/secrets/htpasswd # HTPASSWD_FILE can be whatever as it is not used/called anywhere.
      - DOMAINNAME_HOME_SYNOLOGY
    secrets:
      - cf_email
      - cf_api_key
      - htpasswd
    labels:
      #- "autoheal=true"
      - "traefik.enable=true"
      # HTTP-to-HTTPS Redirect
      - "traefik.http.routers.http-catchall.entrypoints=http"
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # HTTP Routers
      - "traefik.http.routers.traefik-rtr.entrypoints=https"
      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME_HOME_SYNOLOGY` )"
      ## Services - API
      - "traefik.http.routers.traefik-rtr.service=api@internal"
      ## Healthcheck/ping
      #- "traefik.http.routers.ping.rule=Host(`traefik.$DOMAINNAME_HOME_SYNOLOGY`) && Path(`/ping`)"
      #- "traefik.http.routers.ping.tls=true"
      #- "traefik.http.routers.ping.service=ping@internal"
      ## Middlewares
      #- "traefik.http.routers.traefik-rtr.middlewares=chain-oauth@file"
      - "traefik.http.routers.traefik-rtr.middlewares=chain-oauth@file"

  # Docker Socket Proxy - Security Enchanced Proxy for Docker Socket
  socket-proxy:
    container_name: socket-proxy
    image: tecnativa/docker-socket-proxy
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    #profiles: ["core", "all"]
    networks:
      socket_proxy:
        ipv4_address: 192.168.91.254 # You can specify a static IP    # privileged: true # true for VM. False for unprivileged LXC container.
    ports:
    # - "$ZEROTIER_IP_SYNOLOGY:2375:2375" # Port 2375 should only ever get exposed to the internal network. When possible use this line.
    # I use the next line instead, as I want portainer to manage multiple docker endpoints within my home network.
      - "2375:2375"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      - LOG_LEVEL=info # debug,info,notice,warning,err,crit,alert,emerg
      ## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.).
      # 0 to revoke access.
      # 1 to grant access.
      ## Granted by Default
      - EVENTS=1
      - PING=1
      - VERSION=1
      ## Revoked by Default
      # Security critical
      - AUTH=0
      - SECRETS=0
      - POST=1 # Watchtower
      # Not always needed
      - BUILD=0
      - COMMIT=0
      - CONFIGS=0
      - CONTAINERS=1 # Traefik, portainer, etc.
      - DISTRIBUTION=0
      - EXEC=0
      - IMAGES=1 # Portainer
      - INFO=1 # Portainer
      - NETWORKS=1 # Portainer
      - NODES=0
      - PLUGINS=0
      - SERVICES=1 # Portainer
      - SESSION=0
      - SWARM=0
      - SYSTEM=0
      - TASKS=1 # Portainer
      - VOLUMES=1 # Portainer

  # Google OAuth - Single Sign On using OAuth 2.0
  # https://www.smarthomebeginner.com/google-oauth-with-traefik-docker/
  # Also possible to forward all authentication requests to external service. See middlewares-oauth-external and chain-oauth-external.
  oauth:
    container_name: oauth
    image: thomseddon/traefik-forward-auth:latest
    # image: thomseddon/traefik-forward-auth:2.1-arm # Use this image with Raspberry Pi
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    #profiles: ["core", "all"]
    networks:
      - t2_proxy
    # Allow apps to bypass OAuth. Radarr example below will bypass OAuth if API key is present in the request (eg. from NZB360 mobile app).
    # While this is one way, the recommended way is to bypass authentication using Traefik labels shown in some of the apps later.
    # command: --rule.radarr.action=allow --rule.radarr.rule="Headers(`X-Api-Key`, `$RADARR_API_KEY`)"
    # command: --rule.sabnzbd.action=allow --rule.sabnzbd.rule="HeadersRegexp(`X-Forwarded-Uri`, `$SABNZBD_API_KEY`)"
    environment:
      - CONFIG=/config
      - COOKIE_DOMAIN=$DOMAINNAME_HOME_SYNOLOGY
      - INSECURE_COOKIE=false
      - AUTH_HOST=oauth.$DOMAINNAME_HOME_SYNOLOGY
      - URL_PATH=/_oauth
      - LOG_LEVEL=warn
      - LOG_FORMAT=text
      - LIFETIME=86400 # 1 day
      - DEFAULT_ACTION=auth
      - DEFAULT_PROVIDER=google
    secrets:
      - source: traefik_forward_auth
        target: /config
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.oauth-rtr.tls=true"
      - "traefik.http.routers.oauth-rtr.entrypoints=https"
      - "traefik.http.routers.oauth-rtr.rule=Host(`oauth.$DOMAINNAME_HOME_SYNOLOGY`)"
      ## Middlewares
      - "traefik.http.routers.oauth-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.oauth-rtr.service=oauth-svc"
      - "traefik.http.services.oauth-svc.loadbalancer.server.port=4181"

  # Portainer - WebUI for Containers
  portainer:
    container_name: portainer
    image: portainer/portainer-ee:latest # Use portainer-ce if you do no have a Business Edition license key
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["core", "all"]
    networks:
      - t2_proxy
      - socket_proxy
    # command: -H unix:///var/run/docker.sock # # Use Docker Socket Proxy instead for improved security
    command: -H tcp://socket-proxy:2375
    ports:
      - "9000:9000"
    volumes:
      # - /var/run/docker.sock:/var/run/docker.sock:ro # # Use Docker Socket Proxy instead for improved security
      - $DOCKERDIR/appdata/portainer/data:/data # Change to local directory if you want to save/transfer config locally
    environment:
      - TZ=$TZ
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.portainer-rtr.entrypoints=https"
      - "traefik.http.routers.portainer-rtr.rule=Host(`portainer.$DOMAINNAME_HOME_SYNOLOGY`)"
      ## Middlewares
      - "traefik.http.routers.portainer-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.portainer-rtr.service=portainer-svc"
      - "traefik.http.services.portainer-svc.loadbalancer.server.port=9000"

  # ZeroTier-One - Private Network over Internet
  zerotier:
    image: zerotier/zerotier-synology:latest
    container_name: zerotier
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["core", "all"]
    network_mode: host
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    devices:
      - /dev/net/tun
    volumes:
      - $DOCKERDIR/appdata/zerotier:/var/lib/zerotier-one

  ############################# MEDIA

  # Plex - Media Server
  plex:
    image: plexinc/pms-docker:plexpass
    container_name: plex
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["media", "all"]
    networks:
      - t2_proxy
    ports:
      - "32400:32400/tcp"
      - "3005:3005/tcp"
      - "8324:8324/tcp"
      - "32469:32469/tcp"
      # - "1900:1900/udp" # conflicts with xTeVe and Synology default ports
      - "32410:32410/udp"
      - "32412:32412/udp"
      - "32413:32413/udp"
      - "32414:32414/udp"
      - "33400:33400"
    devices:
      - /dev/dri:/dev/dri # for hardware transcoding
    volumes:
      - $DOCKERDIR/appdata/plex:/config
      - $DOWNLOADSDIR:/downloads
      - $DATADIR1/media:/media
      - $DATADIR2/media:/media2
      - /dev/shm:/transcode
    environment:
      TZ: $TZ
      HOSTNAME: "sPlex"
      PLEX_CLAIM_FILE: /run/secrets/plex_claim
      PLEX_UID: $PUID
      PLEX_GID: $PGID
      ADVERTISE_IP: "http://$SERVER_IP1:32400/,http://$SERVER_IP2:32400,https://splex.$DOMAINNAME_CLOUD_SERVER,https://splex.$DOMAINNAME_HOME_SYNOLOGY,http://$ZEROTIER_IP_SYNOLOGY:32400/"
    secrets:
      - plex_claim
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.plex-rtr.entrypoints=https"
      - "traefik.http.routers.plex-rtr.rule=Host(`splex.$DOMAINNAME_HOME_SYNOLOGY`)"
      ## Middlewares
      - "traefik.http.routers.plex-rtr.middlewares=chain-no-auth@file"
      ## HTTP Services
      - "traefik.http.routers.plex-rtr.service=plex-svc"
      - "traefik.http.services.plex-svc.loadbalancer.server.port=32400"

  # Plex-Sync - For Syncing watched status between plex servers
  plex-sync:
    image: patsissons/plex-sync:develop
    container_name: plex-sync
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["media", "all"]
    networks:
      - default
    environment:
      INITIAL_RUN: "true"
      #DRY_RUN: 0
      CRON_SCHEDULE: "*/30 * * * *"
      SECTION_MAPS: > 
        $HOME_SERVER_PLEX/$HOME_SERVER_PLEX_MOVHOL $SYNOLOGY_PLEX/$SYNOLOGY_PLEX_MOVHOL | 
        $HOME_SERVER_PLEX/$HOME_SERVER_PLEX_SHOTV $SYNOLOGY_PLEX/$SYNOLOGY_PLEX_SHOTV | 
        $HOME_SERVER_PLEX/$HOME_SERVER_PLEX_SHOKID $SYNOLOGY_PLEX/$SYNOLOGY_PLEX_SHOKID |
        $HOME_SERVER_PLEX/$HOME_SERVER_PLEX_MOVKID $SYNOLOGY_PLEX/$SYNOLOGY_PLEX_MOVKID | 
        $HOME_SERVER_PLEX/$HOME_SERVER_PLEX_MOVIND $SYNOLOGY_PLEX/$SYNOLOGY_PLEX_MOVIND | 
        $HOME_SERVER_PLEX/$HOME_SERVER_PLEX_MOVKOL $SYNOLOGY_PLEX/$SYNOLOGY_PLEX_MOVKOL | 
        $HOME_SERVER_PLEX/$HOME_SERVER_PLEX_MOVDOC $SYNOLOGY_PLEX/$SYNOLOGY_PLEX_MOVDOC | 
        $HOME_SERVER_PLEX/$HOME_SERVER_PLEX_SHODOC $SYNOLOGY_PLEX/$SYNOLOGY_PLEX_SHODOC | 
        $HOME_SERVER_PLEX/$HOME_SERVER_PLEX_MOVFOR $SYNOLOGY_PLEX/$SYNOLOGY_PLEX_MOVFOR | 
        $HOME_SERVER_PLEX/$HOME_SERVER_PLEX_SHOFOR $SYNOLOGY_PLEX/$SYNOLOGY_PLEX_SHOFOR | 
        $HOME_SERVER_PLEX/$HOME_SERVER_PLEX_SHOIND $SYNOLOGY_PLEX/$SYNOLOGY_PLEX_SHOIND

  ############################# MEDIA FILE MANAGEMENT

  # Tdarr Server - Library Optimizer
  tdarr:
    image: haveagitgat/tdarr:latest
    container_name: tdarr
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["media", "all"]
    networks:
      - t2_proxy
    ports:
      - 8266:8266
      - 8265:8265
      - 8267:8267 # node port. It should be mapped on this container because  the node container use the network from the main container
    volumes:
      - $DOCKERDIR/appdata/tdarr/server:/app/server
      - $DOCKERDIR/appdata/tdarr/configs:/app/configs
      - $DOCKERDIR/appdata/tdarr/logs:/app/logs
      - $DOWNLOADSDIR/transcode/tdarr:/data/temp
      - $ZDATADIR/Photos/zVideos:/data/media:ro
      - $DATADIR1/media/zvideos:/data/output
    environment:
      TZ: $TZ
      PUID: $PUID
      PGID: $PGID
      serverIP: tdarr # or hostname
      serverPort: 8266
      webUIPort: 8265
      UMASK_SET: 002
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.tdarr-rtr.entrypoints=https"
      - "traefik.http.routers.tdarr-rtr.rule=Host(`tdarr.$DOMAINNAME_HOME_SYNOLOGY`)"
      ## Middlewares
      - "traefik.http.routers.tdarr-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.tdarr-rtr.service=tdarr-svc"
      - "traefik.http.services.tdarr-svc.loadbalancer.server.port=8265"

  # Tdarr Node - Transcoder Node
  tdarr-node1:
    image: haveagitgat/tdarr_node:latest
    container_name: tdarr-node1
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["media", "all"]
    networks:
      - t2_proxy
    devices:
      - /dev/dri:/dev/dri # for hardware transcoding
    environment:
      TZ: $TZ
      PUID: $PUID
      PGID: $PGID
      UMASK_SET: 002
      nodeID: Node1
      nodeIP: tdarr-node1 # or hostname
      nodePort: 8267
      serverIP: tdarr # or hostname
      serverPort: 8266
    volumes:
      - $DOCKERDIR/appdata/tdarr/configs:/app/configs
      - $DOCKERDIR/appdata/tdarr/logs:/app/logs
      - $DOWNLOADSDIR/transcode/tdarr:/data/temp
      - $ZDATADIR/Photos/zVideos:/data/media:ro
      - $DATADIR1/media/zvideos:/data/output

  ############################# FILES

  # Rclone - Google Drive Mount
  # https://github.com/openbridge/ob_bulkstash/issues/19
  # https://github.com/romancin/rclonebrowser-docker
  # https://hub.docker.com/r/d2dyno/rclone-gui
  gdrive:
    container_name: gdrive
    image: rclone/rclone:latest
    security_opt:
      - no-new-privileges:true
      - apparmor:unconfined
    restart: unless-stopped
    # profiles: ["core", "all"]
    networks:
      - t2_proxy
    cap_add:
      - SYS_ADMIN
    command:
      "mount gdrive: /data/gdrive \
      --use-mmap \
      --allow-other \
      --no-modtime \
      --allow-non-empty \
      --dir-cache-time=1000h \
      --buffer-size=128M \
      --umask=002 \
      --uid=1026 \
      --gid=100 \
      --user-agent=ds918 \
      --cache-dir=/data/cache/gdrive \
      --vfs-cache-mode=full \
      --vfs-cache-max-age=336h \
      --vfs-cache-max-size=512G \
      --vfs-read-chunk-size-limit=2G \
      --log-file /config/rclone/logs/gdrive.log \
      --rc \
      --rc-web-gui \
      --rc-addr :5572 \
      --rc-user=$RCLONE_WEBUI_USER \
      --rc-pass=$RCLONE_WEBUI_PASS \
      --log-level=NOTICE"
      #--bwlimit 150M \
      #--bwlimit-file 40M \
    devices:
      - /dev/fuse
    volumes:
      - $DOCKERDIR/appdata/rclone:/config/rclone
      - $DATADIR1/mnt/rclone/gdrive:/data/gdrive:shared
      - $DATADIR1/mnt/rclone/cache/gdrive:/data/cache/gdrive
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro
      - /etc/fuse.conf:/etc/fuse.conf:ro
    environment:
      TZ: $TZ
      PUID: $PUID
      PGID: $PGID
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.rclone-drive-rtr.entrypoints=https"
      - "traefik.http.routers.rclone-drive-rtr.rule=Host(`rclone.$DOMAINNAME_HOME_SYNOLOGY`)"
      ## Middlewares
      - "traefik.http.routers.rclone-drive-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.rclone-drive-rtr.service=rclone-drive-svc"
      - "traefik.http.services.rclone-drive-svc.loadbalancer.server.port=5572"

  # Rclone - Google Drive Mount
  gcrypt:
    container_name: gcrypt
    image: rclone/rclone:latest
    security_opt:
      - no-new-privileges:true
      - apparmor:unconfined
    restart: unless-stopped
    # profiles: ["core", "all"]
    networks:
      - t2_proxy
    cap_add:
      - SYS_ADMIN
    command:
      "mount gcrypt: /data/gcrypt \
      --use-mmap \
      --allow-other \
      --no-modtime \
      --allow-non-empty \
      --dir-cache-time=1000h \
      --buffer-size=128M \
      --uid=1026 \
      --gid=100 \
      --umask=002 \
      --user-agent=ds918 \
      --cache-dir=/data/cache/gcrypt \
      --vfs-cache-mode=full \
      --vfs-cache-max-age=336h \
      --vfs-cache-max-size=512G \
      --vfs-read-chunk-size-limit=2G \
      --log-file /config/rclone/logs/gcrypt.log \
      --log-level=NOTICE"
      #--bwlimit 3M \
      # 3M approxmimately equals 253 GB limit per day
    devices:
      - /dev/fuse
    volumes:
      - $DOCKERDIR/appdata/rclone:/config/rclone
      - $DATADIR1/mnt/rclone/gcrypt:/data/gcrypt:shared
      - $DATADIR1/mnt/rclone/cache/gcrypt:/data/cache/gcrypt
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro
      - /etc/fuse.conf:/etc/fuse.conf:ro
    environment:
      TZ: $TZ
      PUID: $PUID
      PGID: $PGID

  # MergerFS - A featureful union filesystem
  mergerfs:
    container_name: mergerfs
    hostname: mergerfs
    image: hotio/mergerfs:latest
    restart: always
    # depends_on:
    #  - gdrive # if using rclone
    #  - gcrypt # if using rclone
    user: $PUID:$PGID
    command: "/data/media1:/data/media2 \
      /data/media \
      -o rw,\
      use_ino,\
      allow_other,\
      func.getattr=newest,\
      category.action=all,\
      category.create=ff,\
      statfs_ignore=nc,\
      cache.files=auto-full,\
      func.getattr=newest,\
      dropcacheonclose=true,\
      nonempty"
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    devices:
      - /dev/fuse
    environment:
      - TZ=$TZ
    volumes:
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro
      - /etc/fuse.conf:/etc/fuse.conf:shared
      #- $DATADIR:/data:slave # creates local-media and shb-media on host
      - $DATADIR1/test:/data/media1:rshared
      - $DATADIR2/test:/data/media2:rshared
      - $DATADIR1/mnt/media:/data/media:rshared

  ############################# MONITORING

  # Glances - System Information
  glances:
    image: nicolargo/glances:latest-full
    container_name: glances
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["apps", "all"]
    # privileged: true # Only for VM
    # network_mode: host
    networks:
      - t2_proxy
      - socket_proxy
      - default
    ports:
      - "61208:61208"
    pid: host
    volumes:
      - $DOCKERDIR/appdata/glances/glances.conf:/glances/conf/glances.conf # Use this if you want to add a glances.conf file
      - $DATADIR1:/data/data:ro
      - $DOCKERDIR:/data/docker:ro
      # - /var/run/docker.sock:/var/run/docker.sock:ro # Use Docker Socket Proxy instead for improved security
    environment:
      # GLANCES_OPT: "-C /glances/conf/glances.conf --quiet --export influxdb"
      # GLANCES_OPT: "--export influxdb"
      GLANCES_OPT: "-w"
      DOCKER_HOST: tcp://socket-proxy:2375
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.glances-rtr.entrypoints=https"
      - "traefik.http.routers.glances-rtr.rule=Host(`glances.$DOMAINNAME_HOME_SYNOLOGY`)"
      ## Middlewares
      - "traefik.http.routers.glances-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.glances-rtr.service=glances-svc"
      - "traefik.http.services.glances-svc.loadbalancer.server.port=61208"

  ############################# UTILITIES

  # SyncThing - Keep folders in Sync
  syncthing:
    image: lscr.io/linuxserver/syncthing
    container_name: syncthing
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["core", "all"]
    networks:
      - t2_proxy
    ports:
      - "8384:8384"
      - "22000:22000/tcp"
      - "22000:22000/udp"
      - "21027:21027/udp"
    volumes:
      - /volume1:/data/volume1
      - $DOCKERDIR/appdata/syncthing:/config
    environment:
      TZ: $TZ
      PUID: $PUID
      PGID: $PGID
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.syncthing-rtr.entrypoints=https"
      - "traefik.http.routers.syncthing-rtr.rule=Host(`stnas.$DOMAINNAME_HOME_SYNOLOGY`)"
      ## Middlewares
      - "traefik.http.routers.syncthing-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.syncthing-rtr.service=syncthing-svc"
      - "traefik.http.services.syncthing-svc.loadbalancer.server.port=8384"

  # qDirStat - Directory Statistics
  qdirstat:
    image: jlesage/qdirstat:latest
    container_name: qdirstat
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["apps", "all"]
    networks:
      - t2_proxy
    ports:
      - "5800:5800"
    volumes:
      - /volume1:/storage:ro
      - $DOCKERDIR/appdata/qdirstat/config:/config:rw
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      UMASK: 002
      TZ: $TZ
      KEEP_APP_RUNNING: 1
      CLEAN_TMP_DIR: 1
      DISPLAY_WIDTH: 1600
      DISPLAY_HEIGHT: 960
      VNC_PASSWORD: $QDIRSTAT_VNC_PASSWD
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.qdirstat-rtr.entrypoints=https"
      - "traefik.http.routers.qdirstat-rtr.rule=Host(`qdir.$DOMAINNAME_HOME_SYNOLOGY`)"
      ## Middlewares
      - "traefik.http.routers.qdirstat-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.qdirstat-rtr.service=qdirstat-svc"
      - "traefik.http.services.qdirstat-svc.loadbalancer.server.port=5800"

  # VSCode - VSCode Editing
  vscode: 
    image: lscr.io/linuxserver/code-server:latest 
    container_name: vscode
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["core", "all"]
    networks:
      - t2_proxy
    ports:
      - "8443:8443"
    volumes:
      - $DOCKERDIR:/data/docker
      - $DOCKERDIR/appdata/vscode:/config
      - $DATADIR1:/data/data
    environment:
      TZ: $TZ
      PUID: $PUID
      PGID: $PGID
      # DOCKER_HOST: tcp://socket-proxy:2375
      # PASSWORD: $VSCODE_PASSWORD
      # HASHED_PASSWORD: #optional
      # SUDO_PASSWORD: password #optional
      # SUDO_PASSWORD_HASH: #optional
      # PROXY_DOMAIN: code-server.my.domain #optional
      # DEFAULT_WORKSPACE: /config/data/User/Workspaces/AZ.code-workspace #optional
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.vscode-rtr.entrypoints=https"
      - "traefik.http.routers.vscode-rtr.rule=Host(`code.$DOMAINNAME_HOME_SYNOLOGY`)"
      ## Middlewares
      - "traefik.http.routers.vscode-rtr.middlewares=chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.vscode-rtr.service=vscode-svc"
      - "traefik.http.services.vscode-svc.loadbalancer.server.port=8443"

  # AdGuard Home - DNS AdBlocking
  adguardhome:
    container_name: adguardhome
    image: adguard/adguardhome
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["core", "all"]
    networks:
      dockervlan:
        ipv4_address: 192.168.1.25 # IP address inside defined range
    ports:
      - 53/udp 
      - 67/udp 
      - 68/tcp 
      - 68/udp 
      - 80/tcp 
      - 443/tcp 
      - 853/tcp 
      - 3000/tcp 
    volumes:
      - $DOCKERDIR/appdata/adguard/conf:/opt/adguardhome/conf 
      - $DOCKERDIR/appdata/adguard/work:/opt/adguardhome/work 
      - $DOCKERDIR/shared/certs/$DOMAINNAME_HOME_SYNOLOGY:/certs

  ############################# MAINTENANCE

  # Docker-GC - Automatic Docker Garbage Collection
  # Create docker-gc-exclude file
  dockergc:
    image: clockworksoul/docker-gc-cron:latest
    container_name: docker-gc
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["apps", "all"]
    networks:
      - socket_proxy
    volumes:
      # - /var/run/docker.sock:/var/run/docker.sock # Use Docker Socket Proxy instead for improved security
      - $DOCKERDIR/appdata/docker-gc/docker-gc-exclude:/etc/docker-gc-exclude
    environment:
      CRON: 0 0 0 * * ? # Everyday at midnight. Previously 0 0 * * *
      FORCE_IMAGE_REMOVAL: 1
      FORCE_CONTAINER_REMOVAL: 0
      GRACE_PERIOD_SECONDS: 604800
      DRY_RUN: 0
      CLEAN_UP_VOLUMES: 1
      TZ: $TZ
      DOCKER_HOST: tcp://socket-proxy:2375

  # Traefik Certs Dumper - Extract LetsEncrypt Certificates - Traefik2 Compatible
  certdumper:
    container_name: traefik_certdumper
    image: humenius/traefik-certs-dumper:latest
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    # profiles: ["apps", "all"]
    networks:
      - default
    # command: --restart-containers container1,container2,container3
    volumes:
      - $DOCKERDIR/appdata/traefik2/acme:/traefik:ro
      - $DOCKERDIR/shared/certs/$DOMAINNAME_HOME_SYNOLOGY:/output:rw
      # - /var/run/docker.sock:/var/run/docker.sock:ro # Only needed if restarting containers (use Docker Socket Proxy instead)
    environment:
      DOMAIN: $DOMAINNAME_HOME_SYNOLOGY

  # Cloudflare DDNS - Dynamic DNS Updater
  ddns-updater:
    image: qmcgaw/ddns-updater
    container_name: ddns-updater
    restart: unless-stopped
    network_mode: bridge
    ports:
      - 8000:8000/tcp
    volumes:
      - $DOCKERDIR/appdata/ddns-updater:/updater/data # Owned by UID 1000
    environment:
      TZ: $TZ
      PUID: $PUID
      PGID: $PGID
      PERIOD: 12h
      UPDATE_COOLDOWN_PERIOD: 5m
      PUBLICIP_DNS_TIMEOUT: 3s
      HTTP_TIMEOUT: 10s
      # Web UI
      LISTENING_PORT: 8000
      # Backup
      BACKUP_PERIOD: 96h # 0 to disable
      BACKUP_DIRECTORY: /updater/data/backups
      # Other
      LOG_LEVEL: info
      SHOUTRRR_ADDRESSES: $DISCORD_SHOUTRRR_ADDRESS