# Template anonymisé — à adapter, ne JAMAIS commiter de vraies valeurs
# Copier ce fichier en docker-compose.yml et remplacer les variables avant usage.

version: "3.9"

networks:
  proxy-net:
    external: true
  internal-net:
    internal: true

services:

  nginx-proxy-manager:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "81:81"     # interface d'admin, à exposer uniquement via le tunnel
    volumes:
      - ./npm/data:/data
      - ./npm/letsencrypt:/etc/letsencrypt
    networks:
      - proxy-net

  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: unless-stopped
    command: tunnel run
    environment:
      - TUNNEL_TOKEN=__REPLACE_WITH_SECRET__   # à stocker dans un .env, jamais en clair ici
    networks:
      - proxy-net

  authentik-server:
    image: ghcr.io/goauthentik/server:latest
    container_name: authentik-server
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_SECRET_KEY: __REPLACE_WITH_SECRET__
      AUTHENTIK_POSTGRESQL__HOST: authentik-db
      AUTHENTIK_POSTGRESQL__PASSWORD: __REPLACE_WITH_SECRET__
      AUTHENTIK_REDIS__HOST: authentik-redis
    depends_on:
      - authentik-db
      - authentik-redis
    networks:
      - proxy-net
      - internal-net

  authentik-db:
    image: postgres:16-alpine
    container_name: authentik-db
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD: __REPLACE_WITH_SECRET__
      POSTGRES_USER: authentik
      POSTGRES_DB: authentik
    volumes:
      - ./authentik/database:/var/lib/postgresql/data
    networks:
      - internal-net

  authentik-redis:
    image: redis:alpine
    container_name: authentik-redis
    restart: unless-stopped
    networks:
      - internal-net

  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://__REPLACE_WITH_SUBDOMAIN__"
      SIGNUPS_ALLOWED: "false"
    volumes:
      - ./vaultwarden/data:/data
    networks:
      - proxy-net

  nextcloud:
    image: nextcloud:latest
    container_name: nextcloud
    restart: unless-stopped
    volumes:
      - /mnt/data-pool/nextcloud:/var/www/html
    networks:
      - proxy-net
      - internal-net

  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    restart: unless-stopped
    volumes:
      - /mnt/media-pool/library:/media
      - ./jellyfin/config:/config
    networks:
      - proxy-net

  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    environment:
      VPN_SERVICE_PROVIDER: __REPLACE_WITH_PROVIDER__
      VPN_TYPE: wireguard
      WIREGUARD_PRIVATE_KEY: __REPLACE_WITH_SECRET__
    networks:
      - internal-net

  deluge:
    image: linuxserver/deluge:latest
    container_name: deluge
    restart: unless-stopped
    network_mode: "service:gluetun"
    depends_on:
      - gluetun
    volumes:
      - /mnt/media-pool/downloads:/downloads
      - ./deluge/config:/config