services:
  wgdashboard:
    image: donaldzou/wgdashboard:latest
    container_name: wgdashboard
    restart: always
    network_mode: bridge
    ports:
      - 10086:10086
      - 51888:51888/udp
      - 51820:51820/udp
    dns:
      - 1.1.1.1
      - 8.8.8.8
    volumes:
      - wgconf:/etc/wireguard
      - wgdata:/data
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    network_mode: bridge
    ports:
      - 443:80/tcp
    environment:
      - ROCKET_TLS=${VAULTWARDEN_TAILSCALE_CERTS}
      - ADMIN_TOKEN=${VW_ADMIN_TOKEN}
    volumes:
      - vw-data:/data

  duckdns:
    image: lscr.io/linuxserver/duckdns:latest
    container_name: duckdns
    restart: unless-stopped
    network_mode: bridge
    environment:
      - TZ=Europe/London
      - SUBDOMAINS=${DUCKDNS_SUBDOMAIN}
      - TOKEN=${DUCKDNS_TOKEN}
      - LOG_FILE=true
    volumes:
      - duckdns:/config

  npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: npm
    restart: unless-stopped
    network_mode: bridge
    ports:
      - 8080:80
      - 8443:443
      - 81:81
    environment:
      - TZ=Europe/London
      - DB_MYSQL_HOST=npmdb
      - DB_MYSQL_PORT=3306
      - DB_MYSQL_USER=npm
      - DB_MYSQL_PASSWORD=npm
    volumes:
      - npmdata:/data
      - letsencrypt:/etc/letsencrypt
    depends_on:
      - npmdb

  npmdb:
    container_name: maria_for_nginx
    image: yobasystems/alpine-mariadb:latest
    restart: unless-stopped
    network_mode: bridge    
    environment:
      - TZ=Europe/London
      - MYSQL_ROOT_PASSWORD=npm
      - MYSQL_DATABASE=npm
      - MYSQL_USER=npm
      - MYSQL_PASSWORD=npm
    volumes:
      - npmdb:/var/lib/mysql

  adguardhome:
    container_name: adguardhome
    image: adguard/adguardhome:latest
    restart: always
    network_mode: bridge
    ports: 
      - 53:53/tcp
      - 53:53/udp
      - 82:80/tcp
      - 83:3000/tcp  
    volumes:
      - aghconfig:/opt/adguardhome/conf
      - aghwork:/opt/adguardhome/work
    cap_add:
      - NET_ADMIN

  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: unless-stopped
    network_mode: bridge    
    command: tunnel run
    environment:
      - TUNNEL_TOKEN=${CLOUDFLARE_TOKEN}

volumes:
  aghconfig:
    driver: local
  aghwork:
    driver: local
  wgconf:
  wgdata:
  duckdns:
  npmdata:
  letsencrypt:
  npmdb:
  vw-data:

# environment variables:
# NOTE: For VaultWarden create a free Tailscale account and get certs into portainer e.g.
# sudo mkdir /var/lib/docker/volumes/myvpnstack_vw-data/_data/certs
# Also,  docker needs to read the tailscale cert and key so give it 644
# sudo chmod 644 /var/lib/docker/volumes/myvpnstack_vw-data/_data/certs/*

# VAULTWARDEN_TAILSCALE_CERTS={certs=/data/certs/your_machine.your_tailnet_DNS_Name.ts.net.crt,key=/data/certs/your_machine.your_tailnet_DNS_Name.ts.net.key}
# CLOUDFLARE_TOKEN=your_cloudflare_token
# DUCKDNS_TOKEN=your_duckdns_token
# DUCKDNS_SUBDOMAIN=your_duckdns_subdomain_without_duckdns.org