docker-compose.yaml

version: "3.4"
services:
  sonarr:
    image: ghcr.io/linuxserver/sonarr
    container_name: sonarr
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Paris
      - UMASK_SET=022 #optional
    volumes:
      - ./conf/sonarr/config:/config
      - /data:/data
    hostname: sonarr.DOMAIN
    #ports:
    #  - 8989:8989
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.sonarr.rule=Host(`sonarr.DOMAIN`)"
      - "traefik.http.routers.sonarr.entrypoints=websecure"
      - "traefik.http.routers.sonarr.tls.certresolver=mydnschallenge"
      - "traefik.http.services.sonarr.loadbalancer.server.port=8989"
      - "traefik.http.routers.sonarr.middlewares=traefik-forward-auth"
      - "traefik.docker.network=traefik"
    restart: unless-stopped
    networks:
      - traefik
      - default

  radarr:
    image: ghcr.io/linuxserver/radarr
    container_name: radarr
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Paris
      - UMASK_SET=022 #optional
    volumes:
      - ./conf/radarr/config:/config
      - /data:/data
    hostname: radarr.DOMAIN
    #ports:
    #  - 7878:7878
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.radarr.rule=Host(`radarr.DOMAIN`)"
      - "traefik.http.routers.radarr.entrypoints=websecure"
      - "traefik.http.routers.radarr.tls.certresolver=mydnschallenge"
      - "traefik.http.services.radarr.loadbalancer.server.port=7878"
      - "traefik.http.routers.radarr.middlewares=traefik-forward-auth"
      - "traefik.docker.network=traefik"
    restart: unless-stopped
    networks:
      - traefik
      - default

  nzbget:
    image: linuxserver/nzbget
    container_name: nzbget
    deploy:
        resources:
            limits:
              cpus: "6"
              memory: "4G"    
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Paris
    volumes:
      - ./conf/nzbget/config:/config
      - /data:/data
    #ports:
    #  - 6789:6789
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nzbget.rule=Host(`nzbget.DOMAIN`)"
      - "traefik.http.routers.nzbget.entrypoints=websecure"
      - "traefik.http.routers.nzbget.tls.certresolver=mydnschallenge"
      - "traefik.http.services.nzbget.loadbalancer.server.port=6789"
      - "traefik.docker.network=traefik"
    networks:
      - traefik
      - default
      
  plex:
    image: plexinc/pms-docker:latest
    container_name: plex
    environment:
      - TZ=Europe/Paris
      - PLEX_CLAIM=CLAIMTOKEN
      - ADVERTISE_IP=https://plex.DOMAIN:443
      - PLEX_UID=1000
      - PLEX_GID=1000
      - VERSION=docker
    volumes:
      - ./conf/plex/config:/config
      - /data/ram/plex/transcode:/transcode
      - /data:/data
    devices:
      - /dev/dri
    hostname: plex.DOMAIN
    ports:
     - 32400:32400/tcp
     - 32400:32400/udp
     - 3005:3005/tcp
     - 8324:8324/tcp
     - 32469:32469/tcp
     - 1900:1900/udp
     - 32410:32410/udp
     - 32412:32412/udp
     - 32413:32413/udp
     - 32414:32414/udp
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.plex.rule=Host(`plex.DOMAIN`)"
      - "traefik.http.routers.plex.entrypoints=websecure"
      - "traefik.http.routers.plex.tls.certresolver=mydnschallenge"
      - "traefik.http.services.plex.loadbalancer.server.port=32400"
      - "traefik.docker.network=traefik"
    networks:
      - traefik

  traefik:
    restart: always
    container_name: traefik
    image: traefik:v2.9
    read_only: true
    hostname: traefik.DOMAIN
    environment:
      - X-OVH-TOKEN=TOKEN
    logging:
      driver: "gelf"
      options:
        gelf-address: "udp://gra3.logs.ovh.com:2202"
        labels: "traefik"
        env: "X-OVH-TOKEN"
        mode: "non-blocking"
    ports:
      - "80:80"
      - "443:443"
      #- "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      #- ./traefik.yaml:/traefik.yaml:ro
      - ./conf/traefik/etc/traefik/:/etc/traefik/
      - ./conf/traefik/log/:/var/log/traefik/
    labels:
      - "traefik.http.routers.api.rule=Host(`traefik.DOMAIN`)"
      - "traefik.http.routers.api.service=api@internal"
      #- "traefik.http.routers.api.middlewares=auth"
      #- "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
      - "traefik.enable=true"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.routers.api.tls.certresolver=mydnschallenge"
      - "traefik.docker.network=traefik"
    networks:
      - traefik

  forwardauth:
    image: mesosphere/traefik-forward-auth
    networks:
      - traefik
    environment:
      - SECRET=SEEEEEEEEEEEEEEEECReT
      - PROVIDER_URI=REALM URL
      - CLIENT_ID=CLIENTID
      - CLIENT_SECRET=SECRET
      - LOG_LEVEL=debug
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik"
      - "traefik.http.services.forwardauth.loadbalancer.server.port=4181"
      - "traefik.http.routers.forwardauth.entrypoints=websecure"
      - "traefik.http.routers.forwardauth.rule=Path(`/_oauth`)"
      - "traefik.http.routers.forwardauth.middlewares=traefik-forward-auth"
      - "traefik.http.middlewares.traefik-forward-auth.forwardauth.address=http://forwardauth:4181"
      - "traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=X-Forwarded-User"
      - "traefik.http.middlewares.traefik-forward-auth.forwardauth.trustForwardHeader=true"
      - "traefik.http.routers.traefik-forward-auth.tls=true"
      - "traefik.http.routers.traefik-forward-auth.tls.certresolver=mydnschallenge"

networks:
  traefik:
    external: true