docker-compose.yml

networks:
  proxy:
    driver: bridge
  metrics:
    driver: bridge
  ai:
    driver: bridge
  ttrss:
    driver: bridge

secrets:
  gf_admin_password:
    file: ./secrets/gf_admin_password.txt

services:
  # Reverse Proxy
  caddy:
    image: caddy:latest
    container_name: caddy
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - proxy
      - metrics

  # Homelab Dashboard
  heimdall:
    image: lscr.io/linuxserver/heimdall:latest
    container_name: heimdall
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
    volumes:
      - /home/vitor/.config/heimdall:/config
    restart: unless-stopped
    networks:
      - proxy

  # Services
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - JELLYFIN_PublishedServerUrl=192.168.0.5 #optional
    volumes:
      - /home/vitor/.config/jellyfin:/config
      - /home/vitor/media:/media
    ports:
      - 7359:7359/udp #optional - local network discovery
      - 1900:1900/udp #optional - DLNA
    restart: unless-stopped
    networks:
      - proxy

  # Home Automation
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    container_name: homeassistant
    environment:
      - TZ=Etc/UTC
    volumes:
      - ./homeassistant/config:/config
      - /run/dbus:/run/dbus:ro
    network_mode: host
    restart: unless-stopped
    privileged: true

  avahi:
    build: ./avahi
    container_name: avahi
    network_mode: host
    restart: unless-stopped
    privileged: true
    volumes:
      - /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket

  # Docker container metrics
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    container_name: cadvisor
    privileged: true
    devices:
      - /dev/kmsg
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    restart: unless-stopped
    networks:
      - metrics

  # Metrics
  prometheus:
    image: prom/prometheus
    container_name: prometheus
    volumes:
      - "./prometheus.yml:/etc/prometheus/prometheus.yml"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: unless-stopped
    ports:
      - 9090:9090
      - 9393:9393
    networks:
      - metrics

  grafana:
    image: grafana/grafana
    container_name: grafana
    hostname: grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD__FILE=/run/secrets/gf_admin_password
    restart: unless-stopped
    networks:
      - proxy
      - metrics
    secrets:
      - gf_admin_password

  # Workflow Automation
  n8n:
    image: n8nio/n8n
    container_name: n8n
    restart: unless-stopped
    ports:
      - 5678:5678
    environment:
      - WEBHOOK_URL=${N8N_WEBHOOK_URL}
      - N8N_PROTOCOL=https
      - N8N_PROXY_HOPS=1
    volumes:
      - n8n_data:/home/node/.n8n
    networks:
      - proxy
      - ai

  # AI Assistant — Claude Code acessível via SSH
  ai:
    build: ./ai
    container_name: ai
    restart: unless-stopped
    ports:
      - 2222:22
    environment:
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - SSH_PASSWORD=${AI_SSH_PASSWORD}
    volumes:
      - ai_home:/home/claude
      - ./ai/authorized_keys:/tmp/authorized_keys:ro
    networks:
      - ai

  # File Sync
  syncthing:
    image: syncthing/syncthing
    container_name: syncthing
    hostname: syncthing
    environment:
      - PUID=1000
      - PGID=1000
    volumes:
      - /home/vitor/notebooks:/var/syncthing
    ports:
      - 8384:8384
      - 22000:22000/tcp
      - 22000:22000/udp
      - 21027:21027/udp
    restart: unless-stopped
    networks:
      - proxy

  # RSS Reader (Tiny Tiny RSS)
  ttrss:
    image: wangqiru/ttrss:latest
    container_name: ttrss
    restart: unless-stopped
    environment:
      - SELF_URL_PATH=${TTRSS_SELF_URL_PATH}
      - DB_HOST=ttrss-db
      - DB_NAME=ttrss
      - DB_USER=postgres
      - DB_PASS=${TTRSS_DB_PASSWORD}
    volumes:
      - ttrss_cache:/var/www/cache
    depends_on:
      - ttrss-db
    networks:
      - proxy
      - ttrss

  ttrss-db:
    image: postgres:16-alpine
    container_name: ttrss-db
    restart: unless-stopped
    environment:
      - POSTGRES_DB=ttrss
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=${TTRSS_DB_PASSWORD}
    volumes:
      - ttrss_db:/var/lib/postgresql/data
    networks:
      - ttrss

  # Cloudflare Tunnel — public access without opening router ports
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: unless-stopped
    command: tunnel --no-autoupdate run
    environment:
      - TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - proxy

volumes:
  caddy_data:
  caddy_config:
  n8n_data:
  ai_home:
  ttrss_db:
  ttrss_cache: