homelab/gateway/docker-compose.yml

name: gateway
secrets:
  JWT_SECRET:
    file: './authelia/secrets/auth/JWT_SECRET'
  SESSION_SECRET:
    file: './authelia/secrets/auth/SESSION_SECRET'
  STORAGE_ENCRYPTION_KEY:
    file: './authelia/secrets/auth/STORAGE_ENCRYPTION_KEY'
  SMTP_USERNAME:
    file: './authelia/secrets/auth/SMTP_USERNAME'
  SMTP_PASSWORD:
    file: './authelia/secrets/auth/SMTP_PASSWORD'
  HMAC_SECRET:
    file: './authelia/secrets/auth/HMAC_SECRET'
  POSTGRES_PASSWORD:
    file: './authelia/secrets/postgres/POSTGRES_PASSWORD'
  REDIS_PASSWORD:
    file: './authelia/secrets/redis/REDIS_PASSWORD'
  OIDC_JWKS_AUTHELIA_PEM:
    file: './authelia/secrets/jwks/rs256.pem'
  OIDC_JWKS_AUTHELIA_CERT:
    file: './authelia/secrets/jwks/rs256.cert'
  IMMICH_CLIENT_SECRET:
    file: './authelia/secrets/clients/IMMICH_CLIENT_SECRET'
  GITEA_CLIENT_SECRET:
    file: './authelia/secrets/clients/GITEA_CLIENT_SECRET'
services:
  authelia:
    image: 'docker.io/authelia/authelia:latest'
    container_name: gateway_authelia
    restart: 'unless-stopped'
    expose:
      - 9091
    depends_on:
      - postgres
      - redis
    secrets:
      - JWT_SECRET
      - SESSION_SECRET
      - STORAGE_ENCRYPTION_KEY
      - SMTP_USERNAME
      - SMTP_PASSWORD
      - POSTGRES_PASSWORD
      - REDIS_PASSWORD
      - HMAC_SECRET
      - OIDC_JWKS_AUTHELIA_PEM
      - OIDC_JWKS_AUTHELIA_CERT
      - IMMICH_CLIENT_SECRET
      - GITEA_CLIENT_SECRET
    environment:
      AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE: /run/secrets/JWT_SECRET
      AUTHELIA_SESSION_SECRET_FILE: /run/secrets/SESSION_SECRET
      AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /run/secrets/STORAGE_ENCRYPTION_KEY
      AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD
      AUTHELIA_SESSION_REDIS_PASSWORD_FILE: /run/secrets/REDIS_PASSWORD
      AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: /run/secrets/HMAC_SECRET
      AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: /run/secrets/SMTP_PASSWORD
      X_AUTHELIA_CONFIG_FILTERS: template
    volumes:
      - ./authelia/config:/config
  postgres:
    image: postgres:17
    container_name: gateway_postgres
    restart: unless-stopped
    secrets:
      - POSTGRES_PASSWORD
    environment:
      POSTGRES_USER: "authelia"
      POSTGRES_PASSWORD_FILE: /run/secrets/POSTGRES_PASSWORD
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
  redis:
    image: redis:7
    container_name: gateway_redis
    restart: unless-stopped
    env_file:
      - ./secrets/redis/.env
    entrypoint: /bin/sh -c
    command: "redis-server --save 60 1 --loglevel warning --requirepass $$REDIS_PASSWORD"
    volumes:
      - ./data/redis:/data
  caddy:
    build:
      context: ./caddy
      target: caddy
    container_name: gateway_caddy
    depends_on:
      - crowdsec
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    env_file:
      - ./secrets/caddy/.env
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile
      - ./dashboard:/var/www/dashboard
      - caddy_data:/data
      - caddy_config:/config
    networks:
      crowdsec:
    security_opt:
      - no-new-privileges=true
  crowdsec:
    image: docker.io/crowdsecurity/crowdsec:latest
    container_name: gateway_crowdsec
    environment:
      - GID=1000
      - COLLECTIONS=crowdsecurity/caddy crowdsecurity/http-cve crowdsecurity/whitelist-good-actors
    env_file:
      - ./secrets/crowdsec/.env
    volumes:
      - ./crowdsec/data:/var/lib/crowdsec/data/
      - ./caddy/crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
      - caddy_logs:/var/log/caddy:ro
    networks:
      crowdsec:
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
  ddns:
    image: timothyjmiller/cloudflare-ddns:latest
    container_name: gateway_cloudflare_ddns
    security_opt:
      - no-new-privileges:true
    network_mode: 'host'
    env_file:
      - ./cloudflare-ddns/secrets/.env
    environment:
      PUID: 1000
      PGID: 1000
    volumes:
      - ./cloudflare-ddns/config.json:/config.json
    restart: unless-stopped
  uptime-kuma:
    image: louislam/uptime-kuma:1
    container_name: gateway_uptime_kuma
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./uptime-kuma/data:/app/data
    ports:
      - 4393:3001
    restart: always
  watchtower:
    image: containrrr/watchtower
    container_name: gateway_watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
volumes:
  caddy_logs:
  caddy_data:
  caddy_config:
networks:
  crowdsec:
    driver: bridge