docker-compose.yml

version: "3.3"

services:
  traefik:
    image: traefik
    restart: always
    container_name: traefik
    ports:
      - 80:80
      - 443:443
      - 8080:8080 # traefik dashboard
    command:
      - --api.insecure=true
      - --api.dashboard=false
      - --api.debug=true
      - --log.level=DEBUG
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=default
      - --entrypoints.web.address=:80
      - --entrypoints.websecured.address=:443
      - --entrypoints.web.http.redirections.entryPoint.to=websecured
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --certificatesresolvers.myresolver.acme.tlschallenge=true
      - --certificatesresolvers.myresolver.acme.email=${SSL_ACME_EMAIL}
      - --certificatesresolvers.myresolver.acme.storage=etc/traefik/acme/acme.json
      - --certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${CONTAINERS}/traefik:/etc/traefik/acme
    networks:
      default:
        ipv4_address: 172.20.50.1
    labels:
      - traefik.enable=true
      - traefik.http.routers.api.rule=Host(`traefik.${DOMAIN}`)
      - traefik.http.routers.api.service=api@internal

  vpn:
    image: dperson/openvpn-client
    container_name: vpn
    cap_add:
      - net_admin
    environment:
      - DNS=${VPN_DNS}
      - TZ=${TIMEZONE}
    networks:
      default:
        ipv4_address: 172.20.50.2
    read_only: false
    tmpfs:
      - /run
      - /tmp
    restart: unless-stopped
    security_opt:
      - label:disable
    stdin_open: true
    tty: true
    volumes:
      - /dev/net:/dev/net:z
      - ${CONTAINERS}/openvpn:/vpn
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      #
      # Exposed containers
      # See more @ https://community.containo.us/t/docker-compose-with-network-mode-service-service-name/3395
      #
      - traefik.http.routers.deluge.entrypoints=websecured
      - traefik.http.routers.deluge.tls.certresolver=myresolver
      - traefik.http.routers.deluge.rule=Host(`deluge.${DOMAIN}`)
    ports:
      - 8112:8112 # Deluge

  plex:
    devices:
      # Enables Hardware Transcoding if available
      - /dev/dri:/dev/dri

  calibre:
    image: linuxserver/calibre
    container_name: calibre
    networks:
      default:
        ipv4_address: 172.20.2.1
    ports:
      - 9080:8080
      - 9081:8081
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.calibre.rule=Host(`calibre.${DOMAIN}`)
      - traefik.http.routers.calibre.entrypoints=websecured
      - traefik.http.routers.calibre.tls.certresolver=myresolver
      - traefik.http.services.calibre.loadbalancer.server.port=8080
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
      - GUAC_USER=${CALIBRE_USERNAME}
      - GUAC_PASS=${CALIBRE_PASSWORD}
    volumes:
      - ${CONTAINERS}/calibre:/config
    restart: unless-stopped

  calibre-web:
    image: linuxserver/calibre-web
    container_name: calibre-web
    networks:
      default:
        ipv4_address: 172.20.2.6
    ports:
      - 8083:8083
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.calibreweb.rule=Host(`calibre-web.${DOMAIN}`)
      - traefik.http.routers.calibreweb.entrypoints=websecured
      - traefik.http.routers.calibreweb.tls.certresolver=myresolver
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
      - DOCKER_MODS=linuxserver/calibre-web:calibre
    volumes:
      - ${CONTAINERS}/calibre-web:/config
      - ${CONTAINERS}/calibre:/books
    restart: unless-stopped

  deluge:
    image: linuxserver/deluge
    container_name: deluge
    network_mode: service:vpn
    depends_on:
      - vpn
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.deluge.rule=Host(`deluge.${DOMAIN}`)
      - traefik.http.routers.deluge.entrypoints=websecured
      - traefik.http.routers.deluge.tls.certresolver=myresolver
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONTAINERS}/deluge/config:/config
      - ${DOWNLOADS}/torrents:/downloads
      - ./themes/deluge/${DELUGE_THEME}.css:/usr/lib/python3/dist-packages/deluge/ui/web/themes/css/xtheme-gray.css
    restart: unless-stopped

  deluge:
    image: linuxserver/deluge
    container_name: deluge
    networks:
      default:
        ipv4_address: 172.20.1.7
    ports: 
      - 8112:8112
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.deluge.rule=Host(`deluge.${DOMAIN}`)
      - traefik.http.routers.deluge.entrypoints=websecured
      - traefik.http.routers.deluge.tls.certresolver=myresolver
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONTAINERS}/deluge/config:/config
      - ${DOWNLOADS}/torrents:/downloads
      - ./themes/deluge/${DELUGE_THEME}.css:/usr/lib/python3/dist-packages/deluge/ui/web/themes/css/xtheme-gray.css
    restart: unless-stopped

  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    network_mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${HOME}/.docker/config.json:/config.json
    command: --label-enable --cleanup --schedule "0 0 4 * * *"

  plex:
    image: linuxserver/plex
    container_name: plex
    networks:
      default:
        ipv4_address: 172.20.1.1
    ports:
      - 32400:32400/tcp
      - 32400:32400/udp
      - 3005:3005/tcp
      - 8324:8324/tcp
      - 32469:32469/tcp
      - 1900:1900/udp
      - 32410:32410/udp
      - 32412:32412/udp
      - 32413:32413/udp
      - 32414:32414/udp
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.plex.rule=Host(`plex.${DOMAIN}`)
      - traefik.http.routers.plex.entrypoints=websecured
      - traefik.http.services.plex.loadbalancer.server.port=32400
      - traefik.http.routers.plex.tls.certresolver=myresolver
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - VERSION=docker
      - ADVERTISE_IP="https://plex.${DOMAIN}:443"
    volumes:
      - ${CONTAINERS}/plex/config:/config
      - ${DATA}:/data
    restart: unless-stopped

  sonarr:
    image: linuxserver/sonarr
    container_name: sonarr
    networks:
      default:
        ipv4_address: 172.20.1.2
    ports:
      - 8989:8989
    depends_on:
      - sabnzbd
      - jackett
      - nzbhydra2
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.sonarr.rule=Host(`sonarr.${DOMAIN}`)
      - traefik.http.routers.sonarr.entrypoints=websecured
      - traefik.http.routers.sonarr.tls.certresolver=myresolver
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONTAINERS}/sonarr/config:/config
      - ${CONTAINERS}/sonarr/empty:/downloads # Not used
      - ${DATA}:/data
    restart: unless-stopped

  radarr:
    image: linuxserver/radarr
    container_name: radarr
    networks:
      default:
        ipv4_address: 172.20.1.3
    ports:
      - 7878:7878
    depends_on:
      - sabnzbd
      - jackett
      - nzbhydra2
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.radarr.rule=Host(`radarr.${DOMAIN}`)
      - traefik.http.routers.radarr.entrypoints=websecured
      - traefik.http.routers.radarr.tls.certresolver=myresolver
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONTAINERS}/radarr/config:/config
      - ${CONTAINERS}/radarr/empty:/downloads # Not used
      - ${DATA}:/data
    restart: unless-stopped

  bazarr:
    image: linuxserver/bazarr
    container_name: bazarr
    networks:
      default:
        ipv4_address: 172.20.1.4
    ports:
      - 6767:6767
    depends_on:
      - sonarr
      - radarr
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.bazarr.rule=Host(`bazarr.${DOMAIN}`)
      - traefik.http.routers.bazarr.entrypoints=websecured
      - traefik.http.routers.bazarr.tls.certresolver=myresolver
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONTAINERS}/bazarr/config:/config
      - ${DATA}:/data
    restart: unless-stopped

  jackett:
    image: linuxserver/jackett
    container_name: jackett
    networks:
      default:
        ipv4_address: 172.20.1.5
    ports:
      - 9117:9117
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.jackett.rule=Host(`jackett.${DOMAIN}`)
      - traefik.http.routers.jackett.entrypoints=websecured
      - traefik.http.routers.jackett.tls.certresolver=myresolver
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
      - AUTO_UPDATE=true
    volumes:
      - ${CONTAINERS}/jackett/config:/config
    restart: unless-stopped

  nzbhydra2:
    image: linuxserver/nzbhydra2
    container_name: nzbhydra2
    networks:
      default:
        ipv4_address: 172.20.1.6
    ports:
      - 5076:5076
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.nzbhydra.rule=Host(`nzbhydra.${DOMAIN}`)
      - traefik.http.routers.nzbhydra.entrypoints=websecured
      - traefik.http.routers.nzbhydra.tls.certresolver=myresolver
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONTAINERS}/nzbhydra2/config:/config
      - ${DOWNLOADS}/nzbhydra2:/downloads
    restart: unless-stopped

  sabnzbd:
    image: linuxserver/sabnzbd
    container_name: sabnzbd
    networks:
      default:
        ipv4_address: 172.20.1.8
    ports:
      - 9050:8080
      - 9051:9090
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.sabnzbd.rule=Host(`sabnzbd.${DOMAIN}`)
      - traefik.http.routers.sabnzbd.entrypoints=websecured
      - traefik.http.routers.sabnzbd.tls.certresolver=myresolver
      - traefik.http.services.sabnzbd.loadbalancer.server.port=8080
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONTAINERS}/sabnzbd/config:/config
      - ${DOWNLOADS}/usenet:/downloads
    restart: unless-stopped

  portainer:
    image: portainer/portainer-ce
    container_name: portainer
    networks:
      default:
        ipv4_address: 172.20.2.2
    ports:
      - 9000:9000
      - 8000:8000
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.portainer.rule=Host(`portainer.${DOMAIN}`)
      - traefik.http.routers.portainer.entrypoints=websecured
      - traefik.http.routers.portainer.tls.certresolver=myresolver
      - traefik.http.services.portainer.loadbalancer.server.port=9000
    restart: always
    command: -H unix:///var/run/docker.sock
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${CONTAINERS}/portainer:/data

  portainer_agent:
    image: portainer/agent
    container_name: portainer-agent
    networks:
      default:
        ipv4_address: 172.20.2.3
    ports:
      - 9001:9001
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/volumes:/var/lib/docker/volumes
    restart: always
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=false

  organizr:
    image: organizrtools/organizr-v2:${ORGANIZR_TAG}
    container_name: organizr
    networks:
      default:
        ipv4_address: 172.20.2.4
    ports:
      - 9983:80
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.orzanizr.rule=Host(`organizr.${DOMAIN}`) || Host(`mediabox.${DOMAIN}`)
      - traefik.http.routers.orzanizr.entrypoints=websecured
      - traefik.http.routers.orzanizr.tls.certresolver=myresolver
      - traefik.http.services.organizr.loadbalancer.server.port=80
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONTAINERS}/organizr:/config
    restart: unless-stopped

  duplicati:
    image: linuxserver/duplicati
    container_name: duplicati
    networks:
      default:
        ipv4_address: 172.20.2.5
    ports:
      - 8200:8200
    labels:
      - com.centurylinklabs.duplicati.enable=true
      - traefik.enable=true
      - traefik.http.routers.duplicati.rule=Host(`duplicati.${DOMAIN}`)
      - traefik.http.routers.duplicati.entrypoints=websecured
      - traefik.http.routers.duplicati.tls.certresolver=myresolver
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TIMEZONE}
    volumes:
      - ${CONTAINERS}/duplicati/config:/config
      - ${CONTAINERS}/duplicati/backups:/backups
      - /:/source
    restart: unless-stopped

networks:
  default:
    ipam:
      driver: default
      config:
        - subnet: 172.20.0.0/16

gistfile1.txt

#
# Docker stack name
#
COMPOSE_PROJECT_NAME=mediabox

#
# User & Group ID
#
PUID=1000
PGID=1000

#
# Custom domain and certificates
#
DOMAIN=example.com
SSL_ACME_EMAIL=you@mail.com

#
# VPN DNS (e.g: https://support.nordvpn.com/General-info/1047409702/What-are-your-DNS-server-addresses.htm)
#
VPN_DNS=103.86.96.100

#
# See [this reddit post](https://www.reddit.com/r/usenet/wiki/docker#wiki_the_best_docker_setup) 
#   for recommendations on how to organize your media depending on your setup.
#
# My disks layout:
#
# data
# ├── 2tb
# │   └── media
# │       ├── movies
# │       ├── pictures
# │       └── tv
# ├── extra
# │   └── media
# │       ├── movies
# │       └── tv
# └── ssd
#     └── mediabox
#         ├── containers
#         ├── downloads
#         └── repo
#
# containers : Storing them inside an external disk might be a good idea if you plan to run this on multiple machines using the same media library.
# downloads  : directory. It will hold incomplete and completed downloads. If you're using an external HDD to store your media files, 
#                           it might be a good idea to keep downloads (until moved by Sonarr/Radarr, and if you have enough space) in an SSD disk partition.
#                           This aims to avoid constant write ops on the external HDD.
#
DATA=/data
CONTAINERS=/data/ssd/mediabox/containers
DOWNLOADS=/data/ssd/mediabox/downloads

#
# Calibre credentials
# PASSWORD => md5 hash for the calibre desktop gui.
#
CALIBRE_USERNAME=yourusername
CALIBRE_PASSWORD=8543a52ww3456g6785725427b20f87d2

# 
#    The latest tag will get you the original Organizr v2 image.
#    The php-fpm tag includes the implementation of a socket connection for PHP-FPM instead of an HTTP connection. It also includes the PM changes for the www.conf file that we recommend to users that are just getting started. One thing to note is that, if you mounted the /etc/php7/php-fpm.d/ directory for the container to your Host, you MUST recreate your container WITHOUT that mount. You will also want to remove the /path/to/Org/config/php directory from your Docker Host as that can cause issues as well. This is designed as a drop-in to get PHP-FPM working without having to mount extra directories, etc.
#    The plex tag will get you the original Organizr v2 image, but with some changes found in the plex-theme branch of the GitHub repo to accommodate the Plex Theme for Organizr v2 by Burry.
#    The armhf tag is an adaptation of the php-fpm image for ArmHF platforms like the RaspberryPi.
#    The arm64 tag is an adaptation of the php-fpm image for Arm64 platforms like the ASRock64.
#    The dev- equivalent tags pull from the v2-develop branch of the GitHub repository instead of the main v2-master branch.
#
ORGANIZR_TAG=latest

#
# Thanks to https://github.com/gilbN/theme.park
# See themes/deluge for more options (e.g: aquamarine, dark, plex)
#
DELUGE_THEME=darker

#
# Your local timezone
#
TIMEZONE=America/Argentina/Buenos_Aires