docker-compose.yaml

networks:
  backend:
    ipam:
      config:
        - subnet: 172.52.0.0/16
secrets:
  WEBPASSWORD:
    file: '/etc/stargate/docker/.secrets/WEBPASSWORD'
services:
  cloudflared:
    command: "tunnel --no-autoupdate run --token ${CLOUDFLARED_TOKEN}"
    container_name: cloudflared
    env_file: .env
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
  dhcphelper:
    cap_add:
      - NET_ADMIN
    container_name: dhcphelper
    environment:
      IP: '172.52.0.10'
    image: homeall/dhcphelper:latest
    network_mode: host
    restart: unless-stopped
  ddns:
    container_name: ddns
    env_file: .env
    environment:
      API_KEY: "${CF_TOKEN}"
      ZONE: "${CF_ZONE}"
      SUBDOMAIN: "*"
      PROXIED: "true"
    image: oznu/cloudflare-ddns:latest
    network_mode: host
    restart: unless-stopped
  docker-socket-proxy:
    container_name: proxy
    environment:
      - CONTAINERS=1
      - POST=0
      - SERVICES=1
      - TASKS=1
    image: ghcr.io/tecnativa/docker-socket-proxy
    ports:
      - 0.0.0.0:2375:2375
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
  node-exporter:
    command: --path.rootfs=/host
    container_name: node-exporter
    image: quay.io/prometheus/node-exporter
    ports:
      - 9100:9100
    restart: unless-stopped
    volumes:
      - /:/host:ro,rslave
  pihole:
    cap_add:
      - NET_ADMIN
    container_name: pihole
    depends_on:
      - dhcphelper
      - traefik
    dns:
      - 1.1.1.1
      - 8.8.8.8
    env_file: .env
    environment:
      WEBPASSWORD_FILE: "/run/secrets/WEBPASSWORD"
    hostname: pihole
    image: pihole/pihole:latest
    labels:
      - homepage.group=Stargate
      - homepage.name=PiHole
      - homepage.icon=pi-hole
      - homepage.href=https://stargate.${DOMAIN}/admin
      - homepage.description=DNS Ad-Blocking and DHCP server
      - homepage.widget.type=pihole
      - homepage.widget.url=http://stargate:81
      - homepage.widget.key=${PIHOLE_API_KEY}
      - traefik.enable=true
      - traefik.http.routers.pihole.entrypoints=websecure
      - traefik.http.routers.pihole.rule=host(`stargate.${DOMAIN}`)
      - traefik.http.routers.pihole.tls=true
      - traefik.http.services.pihole.loadbalancer.server.port=80
      - traefik.http.services.pihole.loadbalancer.server.url=http://127.0.0.1:81
    networks:
      default: {}
      backend:
        ipv4_address: "172.52.0.10"
    ports:
      - 53:53/tcp
      - 53:53/udp
      - 81:80
    restart: unless-stopped
    secrets:
      - WEBPASSWORD
    volumes:
      - /etc/stargate/docker/dnsmasq.d:/etc/dnsmasq.d
      - /etc/stargate/docker/pihole:/etc/pihole
  portainer:
    command: -H unix:///var/run/docker.sock --admin-password "${ADMIN_PASSWORD_HASH}"
    container_name: portainer
    depends_on:
      - traefik
    env_file: .env
    image: portainer/portainer-ce
    labels:
      - homepage.group=Stargate
      - homepage.name=Portainer
      - homepage.icon=portainer
      - homepage.href=https://portainer.stargate.${DOMAIN}
      - homepage.description=Container management
      - homepage.widget.type=portainer
      - homepage.widget.env=1
      - homepage.widget.url=http://stargate:9000
      - homepage.widget.key=${PORTAINER_API_KEY}
      - homepage.widget.fields=["running", "stopped", "total"]
      - traefik.enable=true
      - traefik.http.routers.portainer.entrypoints=websecure
      - traefik.http.routers.portainer.rule=Host(`portainer.stargate.${DOMAIN}`)
      - traefik.http.routers.portainer.tls=true
      - traefik.http.services.portainer.loadbalancer.server.port=9000
    ports:
      - 9000:9000
    volumes:
      - /etc/stargate/docker/portainer:/data
      - /var/run/docker.sock:/var/run/docker.sock
  tailscale:
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    container_name: tailscale
    env_file: .env
    environment:
        TS_EXTRA_ARGS: '--advertise-exit-node'
        TS_HOSTNAME: stargate
        TS_ROUTES: 192.168.31.0/24
        TS_STATE_DIR: /var/lib/tailscale
        TS_USERSPACE: false
    image: tailscale/tailscale:latest
    network_mode: host
    restart: unless-stopped
    volumes:
      - /dev/net/tun:/dev/net/tun
      - /etc/stargate/docker/tailscale:/var/lib/tailscale
  traefik:
    command:
      - --api.dashboard=true
      - --api.insecure=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53
      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/acme.json
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http.tls.certResolver=letsencrypt
      - --entrypoints.websecure.http.tls.domains[0].main=${DOMAIN}
      - --entrypoints.websecure.http.tls.domains[0].sans=*.stargate.${DOMAIN},*.${DOMAIN}
      - --entrypoints.websecure.http.tls=true
      - --log.level=DEBUG
      - --providers.docker.exposedbydefault=true
      - --providers.docker=true
      - --serverstransport.insecureskipverify=true
    container_name: traefik
    env_file: .env
    environment:
      CLOUDFLARE_DNS_API_TOKEN: "${CF_TOKEN}"
      CLOUDFLARE_EMAIL: "${CF_EMAIL}"
      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL: "${CF_EMAIL}"
    extra_hosts:
      - host.docker.internal:172.17.0.1
    image: traefik
    labels:
      - homepage.group=Stargate
      - homepage.name=Traefik
      - homepage.icon=traefik
      - homepage.href=https://traefik.stargate.${DOMAIN}
      - homepage.description=Reverse proxy for exposing apps via HTTPS
      - homepage.widget.type=traefik
      - homepage.widget.url=http://stargate:8080
      - traefik.enable=true
      - traefik.http.routers.dashboard.entrypoints=websecure
      - traefik.http.routers.dashboard.rule=Host(`traefik.stargate.${DOMAIN}`)
      - traefik.http.routers.dashboard.service=api@internal
      - traefik.http.routers.dashboard.tls=true
    networks:
      default: {}
      backend: {}
    ports:
      - 80:80
      - 8080:8080
      - 443:443
    restart: unless-stopped
    volumes:
      - /etc/stargate/docker/letsencrypt/acme.json:/etc/traefik/acme.json
      - /var/run/docker.sock:/var/run/docker.sock
  uptime-kuma:
    container_name: uptime-kuma
    depends_on:
      - traefik
    hostname: uptime-kuma
    image: louislam/uptime-kuma:1
    labels:
      - homepage.group=Stargate
      - homepage.name=Uptime Kuma
      - homepage.icon=uptime-kuma
      - homepage.href=https://status.${DOMAIN}
      - homepage.description=Component Health Tracking and Alerting
      - homepage.widget.type=uptimekuma
      - homepage.widget.url=http://stargate:3001
      - homepage.widget.slug=technis
      - traefik.enable=true
      - traefik.http.routers.uptime-kuma.entrypoints=websecure
      - traefik.http.routers.uptime-kuma.rule=Host(`status.stargate.${DOMAIN}`)
      - traefik.http.routers.uptime-kuma.tls=true
      - traefik.http.services.uptime-kuma.loadbalancer.server.port=3001
    ports:
      - 3001:3001
    restart: unless-stopped
    volumes:
      - /etc/stargate/docker/uptime-kuma:/app/data
  watchtower:
    container_name: watchtower
    env_file: .env
    environment:
      WATCHTOWER_SCHEDULE: "0 0 1 * * *"
      WATCHTOWER_CLEANUP: "true"
      WATCHTOWER_DEBUG: "true"
    image: containrrr/watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock