docker-compose.yml

version: "3.3"

services:
  traefik:
    image: "traefik:latest"
    container_name: traefik
    hostname: traefik
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
      - '853:853'
    env_file:
      - ".env"
    command:
      - "--log.level=ERROR"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.dnsovertls.address=:853"
      - "--entrypoints.dns.address=:5053"
      - "--entrypoints.udpdns.address=:5053/udp"
      - "--entrypoints.web.address=:80"
      - "--certificatesresolvers.mytlschallenge.acme.tlschallenge=true"
      - "--certificatesresolvers.mytlschallenge.acme.email=${EMAIL}"
      - "--certificatesresolvers.mytlschallenge.acme.storage=./letsencrypt/acme.json"
    networks:
      dns:
        ipv4_address: 10.0.0.4
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  cloudflared:
    container_name: cloudflared
    hostname: cloudflared
    image: visibilityspots/cloudflared
    restart: unless-stopped
    networks:
      dns:
        ipv4_address: 10.0.0.2

  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    hostname: pihole
    networks:
      dns:
        ipv4_address: 10.0.0.3
    environment:
      PIHOLE_DNS_: 10.0.0.2#5054;10.0.0.2#5054
      PUID: '1000'
      PGID: '1000'
      TZ: 'Asia/Kolkata'
      WEBPASSWORD: '${PASSWORD}'
      DNSSEC: 'true'
    volumes:
      - './etc-pihole/:/etc/pihole/'
      - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
    dns:
      - 1.1.1.1
    restart: unless-stopped
    ports:
      - "5053:53/tcp"
      - "5053:53/udp"
    labels:
      - "traefik.enable=true"

      # web interface
      - "traefik.http.routers.pihole.rule=Host(`pihole.${DOMAIN}`)"
      - "traefik.http.routers.pihole.entrypoints=websecure"
      - "traefik.http.routers.pihole.tls.certresolver=mytlschallenge"
      - "traefik.http.services.pihole.loadbalancer.server.port=80"

      # DNS-over-TLS
      - "traefik.tcp.routers.dnsovertls.rule=HostSNI(`pihole.${DOMAIN}`)"
      - "traefik.tcp.routers.dnsovertls.entrypoints=dnsovertls"
      - "traefik.tcp.routers.dnsovertls.tls.certresolver=mytlschallenge"
      - "traefik.tcp.routers.dnsovertls.service=pihole"

      # Normal DNS coming in on 53 TCP, no TLS
      - "traefik.tcp.routers.dns.rule=HostSNI(`pihole.${DOMAIN}`)"
      - "traefik.tcp.routers.dns.entrypoints=dns"
      - "traefik.tcp.routers.dns.service=pihole"

      # recieves traffic from both the TLS and non-TLS traefik routers
      - "traefik.tcp.services.pihole.loadbalancer.server.port=53"

      # Normal DNS coming in on 53 UDP
      - "traefik.udp.routers.udpdns.entrypoints=udpdns"
      - "traefik.udp.routers.udpdns.service=pihole"
      - "traefik.udp.services.pihole.loadbalancer.server.port=5053"

  wg-easy:
    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    hostname: wg-easy
    environment:
      - WG_HOST=129.146.242.54
      - PASSWORD=pass2300
    volumes:
      - ./config:/etc/wireguard
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.wg.rule=Host(`wireguard.${DOMAIN}`)"
      - "traefik.http.routers.wg.entrypoints=websecure"
      - "traefik.http.routers.wg.tls.certresolver=mytlschallenge"
      - "traefik.http.services.wg.loadbalancer.server.port=51821"
    networks:
      dns:
        ipv4_address: 10.0.0.5

  portainer:
    image: portainer/portainer-ce
    hostname: portainer
    container_name: portainer
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./portainer:/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.rule=Host(`portainer.${DOMAIN}`)"
      - "traefik.http.routers.portainer.entrypoints=web,websecure"
      - "traefik.http.routers.portainer.tls.certresolver=mytlschallenge"
      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
    networks:
      dns:
        ipv4_address: 10.0.0.6

networks:
  dns:
    name: dns
    driver: bridge
    ipam:
     config:
       - subnet: 10.0.0.0/29