docker-compose.yaml

version: '3.9'
services:
  vpn:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    network_mode: "bridge"
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8000:8000/tcp # Build-in HTTP control header
    # Other services's port
      - ${QBT_WEBUI_PORT}:${QBT_WEBUI_PORT}/tcp   # qbit webui
      - 6767:6767/tcp     # bazarr
      - 8989:8989/tcp     # sonarr
      - 7878:7878/tcp     # radarr
      - 8191:8191/tcp     # flaresolverr
      - 9696:9696/tcp     # prowlarr
      - 8787:8787/tcp     # readarr
      - 7575:7575/tcp     # homarr
    volumes:
      - ./config/gluetun:/gluetun
    environment:
      - DOT=off           # Activate DNS over TLS
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - VPN_SERVICE_PROVIDER=surfshark
      - VPN_TYPE=openvpn
      - OPENVPN_USER=${SS_USER}
      - OPENVPN_PASSWORD=${SS_PASS}
      - UPDATER_PERIOD=24h
      - SERVER_COUNTRIES=${SS_REGION}
      - FIREWALL_OUTBOUND_SUBNETS=${NETWORK_SUBNET}/24
      - HTTPPROXY=on
    sysctls:
      # wg-quick fails to set this without --privileged, so set it here instead if needed
      - net.ipv4.conf.all.src_valid_mark=1
      # May as well disable ipv6. Should be blocked anyway.
      - net.ipv6.conf.default.disable_ipv6=1
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv6.conf.lo.disable_ipv6=1
      # The container has no recovery logic. Use a healthcheck to catch disconnects.
    healthcheck:
      test: ping -c 1 www.google.com || exit 1
      interval: 60s
      timeout: 20s
      retries: 5
    restart: unless-stopped

  # Homepage to all arr tools
  homarr:
    image: ghcr.io/ajnart/homarr:latest
    container_name: homarr
    network_mode: "service:vpn"
    restart: unless-stopped
    volumes:
      - ./config/homarr:/app/data/configs
      - ./config/homarr/icons:/app/public/icons
      - ./config/homarr/data:/data

  # A library / filter system for movies
  radarr:
    container_name: radarr
    network_mode: "service:vpn"
    restart: unless-stopped
    volumes:
      - ./config/radarr:/config
      - ${BASE_DIR}/Movies:/mnt/Movies
      - ${BASE_DIR}/Downloads:/mnt/downloads 
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    image: linuxserver/radarr

  # A library / filter system for TV shows
  sonarr:
    container_name: sonarr
    network_mode: "service:vpn"
    restart: unless-stopped
    volumes:
      - ./config/sonarr:/config
      - ${BASE_DIR}/TVShows:/mnt/TVShows
      - ${BASE_DIR}/Downloads:/mnt/downloads 
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    image: linuxserver/sonarr

  # A tool that enables a single API to search trackers
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    network_mode: "service:vpn"
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ./config/prowlarr:/config
    restart: unless-stopped


  # Tool to download subtitles
  bazarr:
    image: lscr.io/linuxserver/bazarr:latest
    container_name: bazarr
    network_mode: "service:vpn"
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ./config/bazarr:/config
      - ${BASE_DIR}/Movies:/movies
      - ${BASE_DIR}/TVShows:/tv
    restart: unless-stopped

  # A library / Filter for ebooks, comics and etc.
  readarr:
    image: lscr.io/linuxserver/readarr:develop
    container_name: readarr
    network_mode: "service:vpn"
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ./config/readarr:/config
      - ${BASE_DIR}/Books:/mnt/Books
      - ${BASE_DIR}/Downloads:/mnt/downloads
    restart: unless-stopped

  # Some tracker sites can only be used (with Jackett / Prowlarr) using flaresolverr
  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    network_mode: "service:vpn"
    environment:
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - LOG_HTML=${LOG_HTML:-false}
      - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none}
      - TZ=${TZ}
    restart: unless-stopped

  # The qBittorrent client
  qbittorrent:
    image: qbittorrentofficial/qbittorrent-nox:latest
    network_mode: "service:vpn"
    container_name: qbittorrent-nox
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - QBT_WEBUI_PORT=${QBT_WEBUI_PORT}
    stop_grace_period: 30m
    tmpfs:
      - /tmp
    volumes:
      - ./config:/config
      - ./config/gluetun:/config/data_gluetun
      - ${BASE_DIR}/Downloads:/mnt/downloads
    restart: unless-stopped
    depends_on:
      - vpn

  # Nginx proxy manager
  nginx:
    image: 'jc21/nginx-proxy-manager:latest'
    container_name: proxy-manager
    restart: unless-stopped
    ports:
      - 80:80
      - 81:81
      - 443:443
    environment:
      DB_MYSQL_HOST: ${DB_MYSQL_HOST}
      DB_MYSQL_PORT: 3306
      DB_MYSQL_USER: ${DB_USERNAME}
      DB_MYSQL_PASSWORD: ${DB_MYSQL_PWD}
      DB_MYSQL_NAME: ${DB_NAME}
    volumes:
      - ./config/npm/data:/data
      - ./config/npm/letsencrypt:/etc/letsencrypt
    depends_on:
      - proxydb
    networks:
      - nginx-proxy

  # Db to store nginx config
  proxydb:
    image: 'mariadb'
    container_name: proxy-manager-db
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PWD}
      MYSQL_USER: ${DB_USERNAME}
      MYSQL_PASSWORD: ${DB_MYSQL_PWD}
      MYSQL_DATABASE: ${DB_NAME}
      MARIADB_AUTO_UPGRADE: '1'
    volumes:
      - ./config/npm:/var/lib/mysql
    networks:
      - nginx-proxy
  
  # DBMS
  adminer:
    image: adminer
    container_name: adminer
    restart: unless-stopped
    ports:
      - 8080:8080
    environment:
      ADMINER_DEFAULT_SERVER: proxydb
      ADMINER_DESIGN: dracula
    networks:
      - nginx-proxy

  # Searcher for sonarr and radarr
  jellyseerr:
      image: fallenbagel/jellyseerr:latest
      container_name: jellyseerr
      networks:
        - nginx-proxy
      environment:
        - JELLYFIN_TYPE=emby
        - LOG_LEVEL=debug
        - TZ=${TZ}
      ports:
        - 5055:5055
      volumes:
        - ./config/jellyseer:/app/config
      restart: unless-stopped

  # Emby 
  emby:
    image: lscr.io/linuxserver/emby:latest
    container_name: emby
    networks:
      - nginx-proxy
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ./config/emby:/config
      - ${BASE_DIR}/TVShows:/data/tvshows
      - ${BASE_DIR}/Movies:/data/movies
    ports:
      - 8096:8096
    restart: unless-stopped

volumes:
  data:
  letsencrypt:

networks:
  nginx-proxy:
    driver: bridge
    external: true