#version: "3.9"

services:
  traefik:
    profiles: ["all"]
    image: traefik:3
    container_name: traefik
    restart: always
    depends_on:
      - docker-socket-proxy
#    environment:
#      TRAEFIK_PROVIDERS_DOCKER_ENDPOINT: ${DOCKER_SOCKET_PROXY_HOST}
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
#      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${DATA_ROOT}/traefik/letsencrypt:/letsencrypt
      - ${PROJECT_ROOT}/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - ${PROJECT_ROOT}/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
      - ${PROJECT_ROOT}/traefik/certs:/etc/traefik/certs:ro
    healthcheck:
      test: traefik healthcheck --ping

    networks:
      - proxy

  uptime-kuma:
    profiles: ["all"]
    image: louislam/uptime-kuma
    container_name: uptime-kuma
    restart: always
    depends_on:
      - traefik
      - docker-socket-proxy
    environment:
      DOCKER_HOST: ${DOCKER_SOCKET_PROXY_HOST}
    volumes:
      - ${DATA_ROOT}/uptime-kuma:/app/data
#      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - proxy
    labels:
      - traefik.enable=true

      # Router
      - traefik.http.routers.kuma.rule=Host(`kuma.lan.ddnsgeek.com`)
      - traefik.http.routers.kuma.entrypoints=websecure
      - traefik.http.routers.kuma.tls=true
      - traefik.http.routers.kuma.tls.certresolver=le
      - traefik.http.routers.kuma.tls.options=mtls-private-admin@file
      # Service -> container port
      - traefik.http.services.kuma.loadbalancer.server.port=3001
#      - traefik.http.routers.kuma.middlewares=default-chain@file
#    ports:
#      - 8080:3001

#  portainer-agent:
#    profiles: ["all"]
#    image: portainer/agent
#    restart: always
#    depends_on:
#      - docker-socket-proxy
#    ports:
#      - 9001:9001
#    container_name: portainer-agent
#    environment:
#      DOCKER_HOST: ${DOCKER_SOCKET_PROXY_HOST}
#    volumes:
#      - /var/run/docker.sock:/var/run/docker.sock
#      - /var/lib/docker/volumes:/var/lib/docker/volumes
#      - /:/host
#    networks:
#      - proxy

  crowdsec:
    profiles: ["all"]
    image: crowdsecurity/crowdsec:latest
#    build: ./crowdsec
    container_name: crowdsec
    restart: always
    environment:
      - COLLECTIONS=${CROWDSEC_COLLECTIONS}
    volumes:
      - ${DATA_ROOT}/crowdsec/logs:/logs:ro
      - ${DATA_ROOT}/crowdsec/data:/var/lib/crowdsec/data
#      - ${PROJECT_ROOT}/crowdsec/config:/etc/crowdsec
      - ${DATA_ROOT}/crowdsec/acquis.d:/etc/crowdsec/acquis.d
      - ${PROJECT_ROOT}/crowdsec/profiles.yaml:/etc/crowdsec/profiles.yaml

    networks:
      - proxy

#  docker-update-exporter:
#    profiles: ["all"]
#    build: ${REMOTE_PROJECT_ROOT}/docker-exporter
#    container_name: docker-update-exporter
#    volumes:
#      - /var/run/docker.sock:/var/run/docker.sock
#      - ${PROJECT_ROOT}:/compose:ro
#      - ${PROJECT_ROOT}/docker-compose.yml:/compose/docker-compose.yml:ro
#      - ${REMOTE_PROJECT_ROOT}/docker-exporter/data:/data:rw
#      - ${PROJECT_ROOT}/.docker/config.json:/root/.docker/config.json:ro
#    environment:
#      LOG_LEVEL: ${DOCKER_EXPORTER_LOG_LEVEL}
#      DOCKER_HOST: ${DOCKER_SOCKET_PROXY_HOST}
#    ports:
#      - "9105:9105"
#    restart: unless-stopped
#    depends_on:
#      - docker-socket-proxy
#    cap_drop:
#      - ALL
#    security_opt:
#      - no-new-privileges:true
#    networks:
#      - proxy
#    healthcheck:
#      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:9105/metrics')"]
#      interval: 30s
#      timeout: 5s
#      retries: 3
#      start_period: 10s

#  telegraf:
#    profiles: ["monitoring","all","prometheus"]
#    image: telegraf:latest
#    group_add:
#      - "123"
#    privileged: true
#    container_name: telegraf
#    restart: unless-stopped
#    depends_on:
#      - docker-socket-proxy
#    cap_drop:
#      - ALL
#    security_opt:
#      - no-new-privileges:true
#    volumes:
 #     - /var/run/docker.sock:/var/run/docker.sock:ro
#      - ${PROJECT_ROOT}/telegraf.conf:/etc/telegraf/telegraf.conf:ro
#    networks:
#      - edge
#      - proxy
#    ports:
#      - 9273:9273
#    healthcheck:
#      test: ["CMD-SHELL", "curl -f http://localhost:9273/metrics || exit 1"]
#      interval: 30s
#      timeout: 5s
#      retries: 3
#      start_period: 10s

  docker-socket-proxy:
    profiles: ["monitoring","all","prometheus","prometheus-exporters"]
    image: tecnativa/docker-socket-proxy:latest
    container_name: docker-socket-proxy
    restart: unless-stopped
    environment:
      LOG_LEVEL: ${DOCKER_SOCKET_PROXY_LOG_LEVEL}
      DISTRIBUTION: 1
      CONTAINERS: 1
      EVENTS: 1
      IMAGES: 1
      INFO: 1
      NETWORKS: 1
      PING: 1
      POST: 1
      AUTH: 1
      EXEC: 1
      SYSTEM: 1
      SERVICES: 1
      SWARM: 1
      NODES: 1
      SECRETS: 1
      TASKS: 1
      VERSION: 1
      VOLUMES: 1
      ALLOW_START: 1     # for better security, set to 0
      ALLOW_STOP: 1      # for better security, set to 0
      ALLOW_RESTARTS: 1  # for better security, set to 0
      BUILD: 0
      COMMIT: 0
      CONFIGS: 0
      DELETE: 1
      DISABLE_IPV6: 0
      PLUGINS: 0
      SESSION: 0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    ports:
      - 2375:2375

  beszel-agent:
    profiles: ["all","beszel"]
    image: henrygd/beszel-agent:latest
    container_name: beszel-agent
    restart: always
    network_mode: host
    volumes:
      - ${DATA_ROOT}/beszel/agent:/var/lib/beszel-agent
      - ${DATA_ROOT}/beszel/socket:/beszel_socket
#      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      LISTEN: /beszel_socket/beszel.sock
      HUB_URL: http://docker.tail13f623.ts.net:8090
      KEY: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG'
      TOKEN: 637a3438-d473-4fbb-88d7-edcc4dfa024a
      DOCKER_HOST: tcp://localhost:2375
    healthcheck:
      test: ['CMD', '/agent', 'health']
      interval: 120s
#    networks:
#      - proxy

networks:
  proxy:
    name: proxy
    driver: bridge
    ipam:
      config:
        - subnet: 172.21.0.0/16