docker-compose.yml

version: '3.7'
services:

    # https://hub.docker.com/r/plexinc/pms-docker
    plex:
        container_name: plex
        image: plexinc/pms-docker:latest
        restart: unless-stopped
        environment:
            PLEX_UID: '${PUID}'
            PLEX_GID: '${PGID}'
            TZ: '${TZ}'
            PLEX_CLAIM: '${PLEX_CLAIM}'
            ADVERTISE_IP: '${ADVERTISE_IP}'
        networks:
            - traefik
        ports:
            - '32400:32400/tcp'
        volumes:
            - '${CONFIG_DIR}/plex:/config'
            - '${MEDIA_DIR}:/media'
            - '/tmp:/tmp'
        labels:
            traefik.enable: true
            traefik.docker.network: traefik
            traefik.http.routers.plex.entrypoints: https
            traefik.http.routers.plex.tls.certresolver: tlschallenge
            traefik.http.routers.plex.rule: Host(`plex.${ACME_DOMAIN}`) || Host(`${ACME_DOMAIN}`)
            traefik.http.services.plex_mediaserver.loadbalancer.server.port: 32400
            traefik.http.services.plex_mediaserver.loadbalancer.server.scheme: http

    # https://hub.docker.com/r/linuxserver/nzbget/
    nzbget:
        container_name: nzbget
        image: linuxserver/nzbget:latest
        restart: unless-stopped
        environment:
            PUID: '${PUID}'
            PGID: '${PGID}'
            TZ: '${TZ}'
        networks:
            - traefik
        volumes:
            - '${CONFIG_DIR}/nzbget:/config'
            - '${DOWNLOADS_DIR}:/downloads'
            - '${MEDIA_DIR}:/media'
        labels:
            traefik.enable: true
            traefik.docker.network: traefik
            traefik.http.routers.nzbget.entrypoints: https
            traefik.http.routers.nzbget.tls.certresolver: tlschallenge
            traefik.http.routers.nzbget.rule: Host(`nzbget.${ACME_DOMAIN}`)

    # https://hub.docker.com/r/linuxserver/sabnzbd/
    sabnzbd:
        container_name: sabnzbd
        image: linuxserver/sabnzbd:latest
        restart: unless-stopped
        environment:
            PUID: '${PUID}'
            PGID: '${PGID}'
            TZ: '${TZ}'
        networks:
            - traefik
        volumes:
            - '${CONFIG_DIR}/sabnzbd:/config'
            - '${DOWNLOADS_DIR}:/downloads'
            - '${MEDIA_DIR}:/media'
        labels:
            traefik.enable: true
            traefik.docker.network: traefik
            traefik.http.routers.sabnzbd.entrypoints: https
            traefik.http.routers.sabnzbd.tls.certresolver: tlschallenge
            traefik.http.routers.sabnzbd.rule: Host(`sabnzbd.${ACME_DOMAIN}`)

    # https://hub.docker.com/r/linuxserver/sonarr/
    sonarr:
        container_name: sonarr
        image: linuxserver/sonarr:latest
        restart: unless-stopped
        environment:
            PUID: '${PUID}'
            PGID: '${PGID}'
            TZ: '${TZ}'
        networks:
            - traefik
        volumes:
            - '${CONFIG_DIR}/sonarr:/config'
            - '${DOWNLOADS_DIR}:/downloads'
            - '${MEDIA_DIR}:/media'
        labels:
            traefik.enable: true
            traefik.docker.network: traefik
            traefik.http.routers.sonarr.entrypoints: https
            traefik.http.routers.sonarr.tls.certresolver: tlschallenge
            traefik.http.routers.sonarr.rule: Host(`sonarr.${ACME_DOMAIN}`)
            traefik.http.routers.sonarr.middlewares: secureheaders, basicauth
        links:
            - hydra
            - nzbget

    # https://hub.docker.com/r/linuxserver/radarr/
    radarr:
        container_name: radarr
        image: linuxserver/radarr:preview
        restart: unless-stopped
        environment:
            PUID: '${PUID}'
            PGID: '${PGID}'
            TZ: '${TZ}'
        networks:
            - traefik
        volumes:
            - '${CONFIG_DIR}/radarr:/config'
            - '${DOWNLOADS_DIR}:/downloads'
            - '${MEDIA_DIR}:/media'
        labels:
            traefik.enable: true
            traefik.docker.network: traefik
            traefik.http.routers.radarr.entrypoints: https
            traefik.http.routers.radarr.tls.certresolver: tlschallenge
            traefik.http.routers.radarr.rule: Host(`radarr.${ACME_DOMAIN}`)
            traefik.http.routers.radarr.middlewares: secureheaders, basicauth
        links:
            - hydra
            - nzbget

    # https://hub.docker.com/r/linuxserver/hydra2/
    hydra:
        container_name: hydra
        image: linuxserver/hydra2:latest
        restart: unless-stopped
        environment:
            PUID: '${PUID}'
            PGID: '${PGID}'
            TZ: '${TZ}'
        networks:
            - traefik
        volumes:
            - '${CONFIG_DIR}/hydra:/config'
            - '${DOWNLOADS_DIR}:/downloads'
        labels:
            traefik.enable: true
            traefik.docker.network: traefik
            traefik.http.routers.hydra.entrypoints: https
            traefik.http.routers.hydra.tls.certresolver: tlschallenge
            traefik.http.routers.hydra.rule: Host(`hydra.${ACME_DOMAIN}`)
            traefik.http.routers.hydra.middlewares: secureheaders, basicauth

   # https://hub.docker.com/r/linuxserver/ombi/
    ombi:
        container_name: ombi
        image: linuxserver/ombi:v4-preview
        restart: unless-stopped
        environment:
            PUID: 1000
            PGID: 1000
            TZ: '${TZ}'
        networks:
            - traefik
        volumes:
            - '${CONFIG_DIR}/ombi:/config'
            - '${DOWNLOADS_DIR}:/downloads'
            - '${MEDIA_DIR}:/media'
        labels:
            traefik.enable: true
            traefik.docker.network: traefik
            traefik.http.routers.ombi.entrypoints: https
            traefik.http.routers.ombi.tls.certresolver: tlschallenge
            traefik.http.routers.ombi.rule: Host(`ombi.${ACME_DOMAIN}`)

   # https://hub.docker.com/r/linuxserver/deluge/
    deluge:
        container_name: deluge
        image: linuxserver/deluge:latest
        restart: unless-stopped
        environment:
            PUID: '${PUID}'
            PGID: '${PGID}'
            TZ: '${TZ}'
        networks:
            - traefik
        volumes:
            - '${CONFIG_DIR}/deluge:/config'
            - '${DOWNLOADS_DIR}:/downloads'
            - '${MEDIA_DIR}:/media'
        labels:
            traefik.enable: true
            traefik.docker.network: traefik
            traefik.http.routers.deluge.entrypoints: https
            traefik.http.routers.deluge.tls.certresolver: tlschallenge
            traefik.http.routers.deluge.rule: Host(`deluge.${ACME_DOMAIN}`)

    # https://hub.docker.com/r/linuxserver/jackett/
    jackett:
        container_name: jackett
        image: linuxserver/jackett:latest
        restart: unless-stopped
        environment:
            PUID: '${PUID}'
            PGID: '${PGID}'
            TZ: '${TZ}'
        networks:
            - traefik
        volumes:
            - '${CONFIG_DIR}/jackett:/config'
            - '${DOWNLOADS_DIR}:/downloads'
        labels:
            traefik.enable: true
            traefik.docker.network: traefik
            traefik.http.routers.jackett.entrypoints: https
            traefik.http.routers.jackett.tls.certresolver: tlschallenge
            traefik.http.routers.jackett.rule: Host(`jackett.${ACME_DOMAIN}`)
            
    # https://hub.docker.com/_/traefik/
    traefik:
        container_name: traefik
        image: traefik:v2.1.0-rc2
        restart: unless-stopped
        environment:
            TZ: '${TZ}'
        networks:
            - traefik
        ports:
            - '80:80/tcp'
            - '443:443/tcp'
        volumes:
            - '/var/run/docker.sock:/var/run/docker.sock:ro'
            - 'traefik:/etc/traefik:rw'
        command:
            - "--log.level=INFO"
            - "--api=true"
            - "--global.sendanonymoususage=false"
            - "--serverstransport.insecureskipverify"
            - "--entrypoints.http.address=:80"
            - "--entrypoints.https.address=:443"
            - "--providers.docker=true"
            - "--providers.docker.exposedbydefault=false"
            - "--certificatesResolvers.tlschallenge.acme.tlschallenge=true"
            - "--certificatesresolvers.tlschallenge.acme.storage=/etc/traefik/acme.json"
            - "--certificatesresolvers.tlschallenge.acme.email=${ACME_EMAIL}"
            # - "--certificatesresolvers.tlschallenge.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
        labels:
            traefik.enable: true
            traefik.docker.network: traefik
            traefik.http.routers.traefik.entrypoints: https
            traefik.http.routers.traefik.tls.certresolver: tlschallenge
            traefik.http.routers.traefik.rule: Host(`traefik.${ACME_DOMAIN}`)
            traefik.http.routers.traefik.middlewares: secureheaders, basicauth
            traefik.http.routers.traefik.service: api@internal
            traefik.http.routers.http.entrypoints: http
            traefik.http.routers.http.rule: HostRegexp(`${ACME_DOMAIN}`, `{subdomain:[a-z]+}.${ACME_DOMAIN}`)
            traefik.http.routers.http.middlewares: redirectscheme
            traefik.http.middlewares.redirectscheme.redirectscheme.scheme: https
            traefik.http.middlewares.basicauth.basicauth.users: ${HTPASSWD}
            traefik.http.middlewares.secureheaders.headers.stsSeconds: 15552000
            traefik.http.middlewares.secureheaders.headers.framedeny: true
            traefik.http.middlewares.secureheaders.headers.sslForceHost: true
            traefik.http.middlewares.secureheaders.headers.sslRedirect: true
            traefik.http.middlewares.secureheaders.headers.stsIncludeSubdomains: true
            traefik.http.middlewares.secureheaders.headers.browserXssFilter: true
            traefik.http.middlewares.secureheaders.headers.contentTypeNosniff: true
            traefik.http.middlewares.secureheaders.headers.forceSTSHeader: true
            traefik.http.middlewares.secureheaders.headers.stsPreload: true
            traefik.http.middlewares.secureheaders.headers.customResponseHeaders.X-Robots-Tag: none
            traefik.http.middlewares.secureheaders.headers.customFrameOptionsValue: SAMEORIGIN

networks:
    traefik:
        name: traefik
        attachable: true

volumes:
    traefik: