version: "3.9"

services:
  traefik:
    profiles: ["all"]
    image: traefik:3
    container_name: traefik
    restart: always
    depends_on:
      - docker-socket-proxy
#    environment:
#      TRAEFIK_PROVIDERS_DOCKER_ENDPOINT: ${DOCKER_SOCKET_PROXY_HOST}
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
#      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${PROJECT_ROOT}/traefik/letsencrypt:/letsencrypt
      - ${PROJECT_ROOT}/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - ${PROJECT_ROOT}/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
      - ${PROJECT_ROOT}/traefik/certs:/etc/traefik/certs:ro
    healthcheck:
      test: traefik healthcheck --ping

    networks:
      - proxy

  uptime-kuma:
    profiles: ["all"]
    image: louislam/uptime-kuma
    container_name: uptime-kuma
    restart: always
    depends_on:
      - traefik
      - docker-socket-proxy
    environment:
      DOCKER_HOST: ${DOCKER_SOCKET_PROXY_HOST}
    volumes:
      - ${PROJECT_ROOT}/uptime-kuma:/app/data
#      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - proxy
    labels:
      - traefik.enable=true

      # Router
      - traefik.http.routers.kuma.rule=Host(`kuma.lan.ddnsgeek.com`)
      - traefik.http.routers.kuma.entrypoints=websecure
      - traefik.http.routers.kuma.tls=true
      - traefik.http.routers.kuma.tls.certresolver=le
      - traefik.http.routers.kuma.tls.options=mtls-private-admin@file
      # Service -> container port
      - traefik.http.services.kuma.loadbalancer.server.port=3001
#      - traefik.http.routers.kuma.middlewares=default-chain@file
#    ports:
#      - 8080:3001

  portainer-agent:
    profiles: ["all"]
    image: portainer/agent
    restart: always
    depends_on:
      - docker-socket-proxy
    ports:
      - 9001:9001
    container_name: portainer-agent
    environment:
      DOCKER_HOST: ${DOCKER_SOCKET_PROXY_HOST}
    volumes:
 #     - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/volumes:/var/lib/docker/volumes
      - /:/host
    networks:
      - proxy

  crowdsec:
    profiles: ["all"]
    image: crowdsecurity/crowdsec:latest
#    build: ./crowdsec
    container_name: crowdsec
    restart: always
    environment:
      - COLLECTIONS=${CROWDSEC_COLLECTIONS}
    volumes:
      - ${PROJECT_ROOT}/data/logs:/logs:ro
      - ${PROJECT_ROOT}/crowdsec/data:/var/lib/crowdsec/data
      - ${PROJECT_ROOT}/crowdsec/config:/etc/crowdsec
    networks:
      - proxy

  docker-update-exporter:
    profiles: ["all"]
    build: ${REMOTE_PROJECT_ROOT}/docker-exporter
    container_name: docker-update-exporter
    volumes:
#      - /var/run/docker.sock:/var/run/docker.sock
      - ${PROJECT_ROOT}:/compose:ro
#      - ${PROJECT_ROOT}/docker-compose.yml:/compose/docker-compose.yml:ro
      - ${REMOTE_PROJECT_ROOT}/docker-exporter/data:/data:rw
      - ${PROJECT_ROOT}/.docker/config.json:/root/.docker/config.json:ro
    environment:
      LOG_LEVEL: ${DOCKER_EXPORTER_LOG_LEVEL}
      DOCKER_HOST: ${DOCKER_SOCKET_PROXY_HOST}
    ports:
      - "9105:9105"
    restart: unless-stopped
    depends_on:
      - docker-socket-proxy
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:9105/metrics')"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  telegraf:
    profiles: ["monitoring","all","prometheus"]
    image: telegraf:latest
#    group_add:
#      - "123"
#    privileged: true
    container_name: telegraf
    restart: unless-stopped
    depends_on:
      - docker-socket-proxy
#    cap_drop:
#      - ALL
    security_opt:
      - no-new-privileges:true
    volumes:
 #     - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${PROJECT_ROOT}/telegraf.conf:/etc/telegraf/telegraf.conf:ro
    networks:
#      - edge
      - proxy
    ports:
      - 9273:9273
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:9273/metrics || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  docker-socket-proxy:
    profiles: ["monitoring","all","prometheus","prometheus-exporters"]
    image: tecnativa/docker-socket-proxy:latest
    container_name: docker-socket-proxy
    restart: unless-stopped
    environment:
      LOG_LEVEL: ${DOCKER_SOCKET_PROXY_LOG_LEVEL}
      DISTRIBUTION: 1
      CONTAINERS: 1
      EVENTS: 1
      IMAGES: 1
      INFO: 1
      NETWORKS: 1
      PING: 1
      POST: 1
      SERVICES: 1
      TASKS: 1
      VERSION: 1
      VOLUMES: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy


networks:
  proxy:
    name: proxy
    driver: bridge
    ipam:
      config:
        - subnet: 172.21.0.0/16