docker-compose.yml

services:
  cloudflare_ddns:
    image: favonia/cloudflare-ddns:1.15.1
    container_name: cloudflare_ddns
    hostname: cloudflare_ddns
    restart: unless-stopped
    environment:
      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN}
      - DOMAINS=${CF_DDNS_DOMAINS}
      - PROXIED=${CF_DDNS_PROXIED}
      - UPDATE_CRON=@every 5m
      - IP6_PROVIDER=none
      - TZ="America/New_York"

  pihole:
    container_name: pihole
    image: pihole/pihole:2026.02.0
    hostname: pihole
    networks:
      macvlan:
        ipv4_address: ${IP_PIHOLE}
      backend_net: {}
    ports:
      - "53:53/tcp"
      - "53:53/udp"
    environment:
      TZ: "America/New_York"
      FTLCONF_webserver_api_password: ${PIHOLE_UI_PASSWORD}
      FTLCONF_dns_listeningMode: "all"
      FTLCONF_dns_upstreams: "${IP_UNBOUND}"
      FTLCONF_dhcp_active: "true"
      FTLCONF_dhcp_start: "${PIHOLE_DHCP_START}"
      FTLCONF_dhcp_end: "${PIHOLE_DHCP_END}"
      FTLCONF_dhcp_router: "${PIHOLE_DHCP_ROUTER}"
      FTLCONF_dhcp_leaseTime: "24h"
      FTLCONF_dhcp_ipv6: "true"
      FTLCONF_dns_etc_dnsmasq_d: "true"
    volumes:
      - "./pihole:/etc/pihole"
      - "./pihole/dnsmasq.d/05-custom-wildcards.conf:/etc/dnsmasq.d/05-custom-wildcards.conf:ro"
    cap_add:
      - NET_ADMIN
      - SYS_TIME
      - SYS_NICE
    restart: unless-stopped
    depends_on:
      unbound:
        condition: service_healthy

  unbound:
    container_name: unbound
    image: "mvance/unbound-rpi:1.22.0"
    hostname: unbound
    command: >
      sh -c "
        if [ ! -f /opt/unbound/etc/unbound/unbound_control.key ]; then
          echo 'Generating Unbound control keys...';
          unbound-control-setup -d /opt/unbound/etc/unbound;
        fi &&
        unbound -d -c /opt/unbound/etc/unbound/unbound.conf
      "
    networks:
      macvlan:
        ipv4_address: ${IP_UNBOUND}
    volumes:
      - "./unbound:/opt/unbound/etc/unbound"
    restart: unless-stopped
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "unbound-control -c /opt/unbound/etc/unbound/unbound.conf status",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  caddy:
    container_name: caddy
    hostname: caddy
    image: ghcr.io/caddybuilds/caddy-cloudflare:2.11.2
    restart: unless-stopped
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"
    networks:
      macvlan:
        ipv4_address: ${IP_CADDY}
      backend_net: {}
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile
      - ./caddy/error-pages:/opt/caddy-error-pages:ro
      - /srv:/srv
      - caddy_data:/data
      - caddy_config:/config
    environment:
      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN}
      - ACME_DNS=cloudflare
      - IP_GRAFANA=${IP_GRAFANA}
      - IP_UPTIME_KUMA=${IP_UPTIME_KUMA}
      - IP_UMAMI_APP=${IP_UMAMI_APP}
      - IP_FIREFLY_APP=${IP_FIREFLY_APP}
      - IP_FIREFLY_IMPORTER=${IP_FIREFLY_IMPORTER}
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--quiet",
          "--spider",
          "--tries=1",
          "http://localhost:8081/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  umami_db:
    image: postgres:18-alpine
    container_name: umami_db
    hostname: umami_db
    restart: unless-stopped
    networks:
      backend_net: {}
    volumes:
      - umami_db_data:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: ${UMAMI_DB_USER}
      POSTGRES_PASSWORD: ${UMAMI_DB_PASSWORD}
      POSTGRES_DB: ${UMAMI_DB_NAME}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${UMAMI_DB_USER} -d ${UMAMI_DB_NAME}"]
      interval: 10s
      timeout: 5s
      retries: 5

  umami_app:
    image: ghcr.io/umami-software/umami:3.0.3
    container_name: umami_app
    hostname: umami_app
    restart: unless-stopped
    networks:
      macvlan:
        ipv4_address: ${IP_UMAMI_APP}
      backend_net: {}
    depends_on:
      umami_db:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql://${UMAMI_DB_USER}:${UMAMI_DB_PASSWORD}@umami_db:5432/${UMAMI_DB_NAME}
      DATABASE_TYPE: postgresql
      APP_SECRET: ${UMAMI_APP_SECRET}
      IGNORE_IP: ${UMAMI_IGNORE_IP}
      TZ: "America/New_York"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget --quiet --spider --tries=1 http://127.0.0.1:3000/api/heartbeat || exit 1",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  prometheus:
    image: prom/prometheus:v3.10.0
    container_name: prometheus
    hostname: prometheus
    restart: unless-stopped
    volumes:
      - ./prometheus/config:/etc/prometheus
      - prometheus_data:/prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.retention.time=30d"
      - "--storage.tsdb.path=/prometheus"
      - "--web.enable-lifecycle"
    networks:
      macvlan:
        ipv4_address: ${IP_PROMETHEUS}
      backend_net: {}
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget --quiet --spider --tries=1 http://localhost:9090/-/healthy || exit 1",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  grafana:
    image: grafana/grafana-oss:12.4.0
    container_name: grafana
    hostname: grafana
    restart: unless-stopped
    volumes:
      - grafana_data:/var/lib/grafana
      - ./grafana/provisioning/datasources:/etc/grafana/provisioning/datasources
      - ./grafana/provisioning/dashboards:/etc/grafana/provisioning/dashboards
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
      - GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH=/etc/grafana/provisioning/dashboards/json/homelab-overview.json
      - TZ="America/New_York"
    networks:
      macvlan:
        ipv4_address: ${IP_GRAFANA}
      backend_net: {}
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget --quiet --spider --tries=1 http://localhost:3000/api/health || exit 1",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  rpi_node_exporter:
    image: prom/node-exporter:v1.10.2
    container_name: rpi_node_exporter
    hostname: rpi_node_exporter
    restart: unless-stopped
    network_mode: host
    pid: host
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - "--path.procfs=/host/proc"
      - "--path.sysfs=/host/sys"
      - "--path.rootfs=/rootfs"
      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget --quiet --spider --tries=1 http://localhost:9100/metrics || exit 1",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  cadvisor:
    image: ghcr.io/google/cadvisor:0.56.2
    container_name: cadvisor
    hostname: cadvisor
    restart: unless-stopped
    devices:
      - /dev/kmsg:/dev/kmsg
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    networks:
      macvlan:
        ipv4_address: ${IP_CADVISOR}
      backend_net: {}

  blackbox_exporter:
    image: prom/blackbox-exporter:v0.28.0
    container_name: blackbox
    hostname: blackbox
    restart: unless-stopped
    volumes:
      - ./blackbox/config:/config
    command:
      - "--config.file=/config/blackbox.yml"
    networks:
      macvlan:
        ipv4_address: ${IP_BLACKBOX}
      backend_net: {}
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget --quiet --spider --tries=1 http://localhost:9115 || exit 1",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  uptime_kuma:
    image: louislam/uptime-kuma:2.2.1
    container_name: uptime_kuma
    hostname: uptime_kuma
    restart: unless-stopped
    volumes:
      - uptime_kuma_data:/app/data
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - TZ="America/New_York"
    networks:
      macvlan:
        ipv4_address: ${IP_UPTIME_KUMA}
      backend_net: {}

  firefly_db:
    image: postgres:18-alpine
    container_name: firefly_db
    hostname: firefly_db
    restart: unless-stopped
    networks:
      backend_net: {}
    volumes:
      - firefly_db_data:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: ${FIREFLY_DB_USER}
      POSTGRES_PASSWORD: ${FIREFLY_DB_PASSWORD}
      POSTGRES_DB: ${FIREFLY_DB_NAME}
    healthcheck:
      test:
        ["CMD-SHELL", "pg_isready -U ${FIREFLY_DB_USER} -d ${FIREFLY_DB_NAME}"]
      interval: 10s
      timeout: 5s
      retries: 5

  firefly_app:
    image: fireflyiii/core:version-6.5.4
    container_name: firefly_app
    hostname: firefly_app
    restart: unless-stopped
    networks:
      macvlan:
        ipv4_address: ${IP_FIREFLY_APP}
      backend_net: {}
    depends_on:
      firefly_db:
        condition: service_healthy
    volumes:
      - firefly_upload:/var/www/html/storage/upload
    environment:
      - APP_KEY=${FIREFLY_APP_KEY}
      - DB_CONNECTION=pgsql
      - DB_HOST=firefly_db
      - DB_PORT=5432
      - DB_DATABASE=${FIREFLY_DB_NAME}
      - DB_USERNAME=${FIREFLY_DB_USER}
      - DB_PASSWORD=${FIREFLY_DB_PASSWORD}
      - TZ="America/New_York"
      - APP_URL=https://firefly.home
      - TRUSTED_PROXIES=**
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/v1/about"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  firefly_importer:
    image: fireflyiii/data-importer:version-2.2.0
    container_name: firefly_importer
    hostname: firefly_importer
    restart: unless-stopped
    networks:
      macvlan:
        ipv4_address: ${IP_FIREFLY_IMPORTER}
      backend_net: {}
    depends_on:
      firefly_app:
        condition: service_healthy
    environment:
      - FIREFLY_III_URL=http://firefly_app:8080
      - VANITY_URL=https://firefly.home
      - APP_URL=https://firefly-import.home
      - FIREFLY_III_ACCESS_TOKEN=${FIREFLY_IMPORTER_TOKEN}
      - TRUSTED_PROXIES=**
      - TZ="America/New_York"

  # Firefly III and the Data Importer both require scheduled tasks.
  # Firefly III (core) needs a daily cron for recurring transactions and cleanups.
  # The Data Importer needs a frequent cron (e.g. every 15 mins) for auto-imports.
  # We use a single, lightweight Alpine container to handle both schedules to save resources.
  firefly_cron:
    image: alpine:3.23
    container_name: firefly_cron
    restart: unless-stopped
    command: >
      sh -c "echo -e \"0 3 * * * wget -qO- http://firefly_app:8080/api/v1/cron/$${FIREFLY_CRON_TOKEN}\n*/15 * * * * wget -qO- http://firefly_importer:8080/autocron\" | crontab - && crond -f -L /dev/stdout"
    networks:
      backend_net: {}
    depends_on:
      firefly_app:
        condition: service_started
      firefly_importer:
        condition: service_started

volumes:
  caddy_data:
  caddy_config:
  prometheus_data:
  grafana_data:
  uptime_kuma_data:
  umami_db_data:
  firefly_db_data:
  firefly_upload:

networks:
  backend_net:
    driver: bridge
  macvlan:
    name: pi0vlan
    driver: macvlan
    driver_opts:
      parent: "${MACVLAN_PARENT_INTERFACE}"
    ipam:
      config:
        - subnet: "${MACVLAN_SUBNET}"
          gateway: "${MACVLAN_GATEWAY}"
          ip_range: "${MACVLAN_IP_RANGE}"
          aux_addresses:
            host_shim_ip: "${MACVLAN_HOST_SHIM_IP}"