docker-compose.yml

version: '3.8'
services:

  ingress:
    build: docker/nginx
    depends_on:
      - ingressgen
    restart: on-failure
    container_name: $INGRESS_NAME
    networks:
      ingress:
      dmz:
        ipv4_address: $INGRESS_ADDRESS
    security_opt:
      - no-new-privileges:true
    volumes:
      - ${INGRESS_DATA_PATH}:/etc/nginx/conf.d:ro

  ingressgen:
    build: docker/dockergen
    restart: unless-stopped
    command: -notify-sighup $INGRESS_NAME -watch /etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf
    network_mode: none
    security_opt:
      - no-new-privileges:true
    environment:
      - TARGET_CONTAINER=$INGRESS_NAME
    volumes:
      - ${INGRESS_DATA_PATH}:/etc/nginx/conf.d
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ${INGRESSGEN_TEMPLATE_NGINX_FILE}:/etc/docker-gen/templates/nginx.tmpl:ro

  vpn:
    build: docker/wireguard
    restart: unless-stopped
    networks:
      - dmz
      - test-internal
      - test-internal2
    security_opt:
      - no-new-privileges:true
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - SERVERURL=$VPN_PUBLIC_URL
      - SERVERPORT=$VPN_PUBLIC_PORT
      - PEERS=$VPN_PEERS
      - PEERDNS=auto
      - INTERNAL_SUBNET=$VPN_SUBNET
      - ALLOWEDIPS=$INGRESS_SUBNET
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /lib/modules:/lib/modules
      - ${VPN_DATA_PATH}:/config
      - ${VPN_TEMPLATE_PEER_FILE}:/config/templates/peer.conf:ro
      - ${VPN_TEMPLATE_SERVER_FILE}:/config/templates/server.conf:ro
    ports:
      - "${VPN_PUBLIC_PORT}:51820/udp"
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1

  broker:
    build: docker/mosquitto
    restart: unless-stopped
    networks:
      - automation
      - dmz
    security_opt:
      - no-new-privileges:true
    ports:
      - "1883:1883"
    volumes:
      - ${CONFIG_PATH}/mosquitto/broker.conf:/mosquitto/config/mosquitto.conf:ro

  nodered:
    build: docker/nodered
    depends_on:
      - broker
    restart: unless-stopped
    networks:
      - automation
      - ingress
      # needed to connect to broadcom rm+ pro ir remote
      - egress
    security_opt:
      - no-new-privileges:true
    secrets:
      - nodered_credentials_key
    environment:
      - CREDENTIALS_KEY_FILE=/run/secrets/nodered_credentials_key
      - VIRTUAL_HOST=${NODERED_DOMAIN}
      - VIRTUAL_PORT=1880
    volumes:
      - ${NODERED_DATA}:/data
      - ${NODERED_CONFIG_FLOWS_FILE}:/data/flows.json:ro
      - ${NODERED_CONFIG_SETTINGS_FILE}:/data/settings.js:ro
    user: ${PUID}:${PGID}

  ha:
    build: docker/homeassistant
    depends_on:
      - broker
    restart: unless-stopped
    networks:
      - automation
      - ingress
      - egress
    security_opt:
      - no-new-privileges:true
    environment:
      - TZ=${TZ}
      - EXTERNAL_URL=http://${HOMEASSISTANT_DOMAIN}
      - INTERNAL_URL=http://${HOMEASSISTANT_DOMAIN}
      - TRUSTED_PROXIES=${HOMEASSISTANT_TRUSTED_PROXIES}
      - VIRTUAL_HOST=${HOMEASSISTANT_DOMAIN}
      - VIRTUAL_PORT=8123
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${HOMEASSISTANT_DATA_PATH}:/config
      - ${HOMEASSISTANT_CONFIG_CONFIGURATION_FILE}:/config/configuration.yaml:ro
      - ${HOMEASSISTANT_CONFIG}/configuration:/config/configuration:ro
      - ${HOMEASSISTANT_CONFIG}/energy.json:/config/.storage/energy:ro
      - ${SECRETS_PATH}/ha_secrets.yaml:/config/secrets.yaml:ro

  mongo:
    build: docker/mongo
    restart: unless-stopped
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    secrets:
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGO_INITDB_ROOT_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGO_INITDB_ROOT_PASSWORD_FILE=/run/secrets/mongo_root_password
      - MONGO_INITDB_DATABASE=${MONGO_DATABASE}
    volumes:
      - ${MONGO_DATA_PATH}:/data

  mongo-express:
    build: docker/mongo-express
    depends_on:
      - mongo
    restart: unless-stopped
    networks:
      - automation
      - ingress
    security_opt:
      - no-new-privileges:true
    secrets:
      - mongo_root_username
      - mongo_root_password
      - mongo_express_username
      - mongo_express_password
    environment:
      - TZ=${TZ}
      - VIRTUAL_HOST=${MONGO_EXPRESS_DOMAIN}
      - VIRTUAL_PORT=8081
      - ME_CONFIG_MONGODB_ENABLE_ADMIN=true
      - ME_CONFIG_MONGODB_ADMINUSERNAME_FILE=/run/secrets/mongo_root_username
      - ME_CONFIG_MONGODB_ADMINPASSWORD_FILE=/run/secrets/mongo_root_password
      - ME_CONFIG_BASICAUTH_USERNAME_FILE=/run/secrets/mongo_express_username
      - ME_CONFIG_BASICAUTH_PASSWORD_FILE=/run/secrets/mongo_express_password
    volumes:
      - /etc/localtime:/etc/localtime:ro

  main-power:
    build: docker/modbus-serial
    depends_on:
      - broker
      - mongo
    restart: unless-stopped
    privileged: true
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGODB_URL=mongodb://mongo:27017/${MONGO_DATABASE}?authSource=admin
      - MONGODB_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGODB_PASSWORD_FILE=/run/secrets/mongo_root_password
      - COLLECTION=main
      - CONFIG=/etc/config.js
      - BROKER=mqtt://broker
      - TOPIC=/modbus/main/{name}/reading
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - INFLUXDB_TAGS={"bus":"primary"}
      - INFLUXDB_MEASUREMENT=raw
    volumes:
      - /dev/bus/usb:/dev/bus/usb
      - /dev/serial:/dev/serial
      - ${MAIN_POWER_CONFIG_FILE}:/etc/config.js:ro

  secondary-power:
    build: docker/modbus-serial
    depends_on:
      - broker
      - mongo
    restart: unless-stopped
    privileged: true
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGODB_URL=mongodb://mongo:27017/${MONGO_DATABASE}?authSource=admin
      - MONGODB_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGODB_PASSWORD_FILE=/run/secrets/mongo_root_password
      - COLLECTION=secondary
      - CONFIG=/etc/config.js
      - BROKER=mqtt://broker
      - TOPIC=/modbus/secondary/{name}/reading
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - INFLUXDB_TAGS={"bus":"secondary"}
      - INFLUXDB_MEASUREMENT=raw
    volumes:
      - /dev/bus/usb:/dev/bus/usb
      - /dev/serial:/dev/serial
      - ${SECONDARY_POWER_CONFIG_FILE}:/etc/config.js:ro

  tetriary-power:
    build: docker/modbus-serial
    depends_on:
      - broker
      - mongo
      - influxdb
    restart: unless-stopped
    privileged: true
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGODB_URL=mongodb://mongo:27017/${MONGO_DATABASE}?authSource=admin
      - MONGODB_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGODB_PASSWORD_FILE=/run/secrets/mongo_root_password
      - COLLECTION=tetriary
      - CONFIG=/etc/config.js
      - BROKER=mqtt://broker
      - TOPIC=/modbus/tetriary/{name}/reading
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - INFLUXDB_TAGS={"bus":"tetriary"}
      - INFLUXDB_MEASUREMENT=sdm630raw
    volumes:
      - /dev/bus/usb:/dev/bus/usb
      - /dev/serial:/dev/serial
      - ${TETRIARY_POWER_CONFIG_FILE}:/etc/config.js:ro

  monitoring:
    build: docker/modbus-serial
    depends_on:
      - broker
      - mongo
      - influxdb
    restart: unless-stopped
    privileged: true
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGODB_URL=mongodb://mongo:27017/${MONGO_DATABASE}?authSource=admin
      - MONGODB_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGODB_PASSWORD_FILE=/run/secrets/mongo_root_password
      - COLLECTION=monitoring
      - CONFIG=/etc/config.js
      - BROKER=mqtt://broker
      - TOPIC=/modbus/monitoring/{name}/reading
      - SUBSCRIBE_TOPIC=/modbus/monitoring/{name}/write
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - INFLUXDB_TAGS={"bus":"monitoring"}
      - INFLUXDB_MEASUREMENT=xymd1
    volumes:
      - /dev/bus/usb:/dev/bus/usb
      - /dev/serial:/dev/serial
      - ${CONFIG_PATH}/modbus-serial/monitoring.config.js:/etc/config.js:ro

  monitoring2:
    build: docker/modbus-serial
    depends_on:
      - broker
      - mongo
      - influxdb
    restart: unless-stopped
    privileged: true
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGODB_URL=mongodb://mongo:27017/${MONGO_DATABASE}?authSource=admin
      - MONGODB_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGODB_PASSWORD_FILE=/run/secrets/mongo_root_password
      - COLLECTION=monitoring2
      - CONFIG=/etc/config.js
      - BROKER=mqtt://broker
      - TOPIC=/modbus/monitoring2/{name}/reading
      - SUBSCRIBE_TOPIC=/modbus/monitoring2/{name}/write
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - INFLUXDB_TAGS={"bus":"monitoring2"}
      - INFLUXDB_MEASUREMENT=monitoring2
    volumes:
      - /dev/bus/usb:/dev/bus/usb
      - /dev/serial:/dev/serial
      - ${CONFIG_PATH}/modbus-serial/monitoring2.config.js:/etc/config.js:ro

  dry-switches:
    build: docker/modbus-serial
    depends_on:
      - broker
      - mongo
    restart: unless-stopped
    privileged: true
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGODB_URL=mongodb://mongo:27017/${MONGO_DATABASE}?authSource=admin
      - MONGODB_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGODB_PASSWORD_FILE=/run/secrets/mongo_root_password
      - COLLECTION=dry-switches
      - CONFIG=/etc/config.js
      - BROKER=mqtt://broker
      - TOPIC=/modbus/dry-switches/{name}/reading
      - SUBSCRIBE_TOPIC=/modbus/dry-switches/{name}/write
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - INFLUXDB_TAGS={"bus":"switches"}
      - INFLUXDB_MEASUREMENT=switches
    volumes:
      - /dev/bus/usb:/dev/bus/usb
      - /dev/serial:/dev/serial
      - ${CONFIG_PATH}/modbus-serial/dry-switches.js:/etc/config.js:ro

  solar:
    build: docker/modbus-serial
    depends_on:
      - broker
      - mongo
      - influxdb
    restart: unless-stopped
    privileged: true
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGODB_URL=mongodb://mongo:27017/${MONGO_DATABASE}?authSource=admin
      - MONGODB_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGODB_PASSWORD_FILE=/run/secrets/mongo_root_password
      - COLLECTION=monitoring
      - CONFIG=/etc/config.js
      - BROKER=mqtt://broker
      - TOPIC=/modbus/monitoring/{name}/reading
      - SUBSCRIBE_TOPIC=/modbus/monitoring/{name}/write
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - INFLUXDB_TAGS={"bus":"monitoring"}
      - INFLUXDB_MEASUREMENT=xymd1
    volumes:
      - /dev/bus/usb:/dev/bus/usb
      - /dev/serial:/dev/serial
      - ${CONFIG_PATH}/modbus-serial/solar.config.js:/etc/config.js:ro

  inverter:
    build: docker/modbus-serial
    depends_on:
      - broker
      - mongo
      - influxdb
    restart: unless-stopped
    privileged: true
    networks:
      - automation
      - egress
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGODB_URL=mongodb://mongo:27017/${MONGO_DATABASE}?authSource=admin
      - MONGODB_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGODB_PASSWORD_FILE=/run/secrets/mongo_root_password
      - COLLECTION=inverter
      - CONFIG=/etc/config.js
      - BROKER=mqtt://broker
      - TOPIC=/modbus/inverter/{name}/reading
      - SUBSCRIBE_TOPIC=/modbus/inverter/{name}/write
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - INFLUXDB_TAGS={"bus":"inverter"}
      - INFLUXDB_MEASUREMENT=inverter
    volumes:
      - ${CONFIG_PATH}/modbus-serial/inverter.config.js:/etc/config.js:ro

  influxdb:
    build: docker/influxdb
    restart: unless-stopped
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_admin_user
      - influxdb_admin_password
      - influxdb_user
      - influxdb_user_password
      - influxdb_read_user
      - influxdb_read_user_password
      - influxdb_write_user
      - influxdb_write_user_password
    environment:
      - TZ=${TZ}
      - INFLUXDB_DB=${INFLUXDB_DATABASE}
      - INFLUXDB_HTTP_AUTH_ENABLED=true
      - INFLUXDB_ADMIN_USER_FILE=/run/secrets/influxdb_admin_user
      - INFLUXDB_ADMIN_PASSWORD_FILE=/run/secrets/influxdb_admin_password
      - INFLUXDB_USER_FILE=/run/secrets/influxdb_user
      - INFLUXDB_USER_PASSWORD_FILE=/run/secrets/influxdb_user_password
      - INFLUXDB_READ_USER_FILE=/run/secrets/influxdb_read_user
      - INFLUXDB_READ_USER_PASSWORD_FILE=/run/secrets/influxdb_read_user_password
      - INFLUXDB_WRITE_USER_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_WRITE_USER_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
    volumes:
      - ${INFLUXDB_CONFIG_FILE}:/etc/influxdb/influxdb.conf:ro
      - ./data/influxdb:/var/lib/influxdb
      - /etc/localtime:/etc/localtime:ro

  grafana:
    build:
      context: docker/grafana
      args:
        GF_INSTALL_IMAGE_RENDERER_PLUGIN: 'false'
    depends_on:
      - influxdb
    restart: unless-stopped
    networks:
      - automation
      - ingress
      - egress
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_read_user
      - influxdb_read_user_password
      - telegram_bot_token
      - telegram_chat_id
    environment:
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - INFLUXDB_USER_FILE=/run/secrets/influxdb_read_user
      - INFLUXDB_USER_PASSWORD_FILE=/run/secrets/influxdb_read_user_password
      - TELEGRAM_BOT_TOKEN_FILE=/run/secrets/telegram_bot_token
      - TELEGRAM_CHAT_ID_FILE=/run/secrets/telegram_chat_id
      - TZ=${TZ}
      - VIRTUAL_HOST=grafana.${DOMAIN}
      - VIRTUAL_PORT=3000
    volumes:
      - ${GRAFANA_CONFIG_FILE}:/etc/grafana/grafana.ini:ro
      - ${GRAFANA_CONFIG_PATH}/provisioning:/etc/grafana/provisioning:ro
      - ${GRAFANA_CONFIG_PATH}/dashboards:/var/lib/grafana/dashboards:ro
      - ${GRAFANA_DATA_PATH}:/var/lib/grafana
      - /etc/localtime:/etc/localtime:ro
    user: ${PUID}:${PGID}

  mqtt-mongo-history:
    build: docker/mqtt-mongo
    depends_on:
      - broker
      - mongo
    restart: unless-stopped
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    secrets:
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGODB_URL=mongodb://mongo:27017/${MONGO_DATABASE}?authSource=admin
      - MONGODB_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGODB_PASSWORD_FILE=/run/secrets/mongo_root_password
      - COLLECTION=history
      - BROKER=mqtt://broker
      - TOPIC=/homy/br1/temp
      - MQTT_CLIENT_ID=mqtt-mongo-history

  mqtt-influx-primary:
    build: docker/mqtt-influx
    depends_on:
      - broker
      - influxdb
    restart: unless-stopped
    networks:
      - automation
      - egress
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
    environment:
      - BROKER=mqtt://broker
      - TOPIC=/modbus/main/+/+
      - MQTT_CLIENT_ID=mqtt-influx-primary
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - TAGS={"bus":"primary"}

  mqtt-influx-secondary:
    build: docker/mqtt-influx
    depends_on:
      - broker
      - influxdb
    restart: unless-stopped
    networks:
      - automation
      - egress
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
    environment:
      - BROKER=mqtt://broker
      - TOPIC=/modbus/secondary/+/+
      - MQTT_CLIENT_ID=mqtt-influx-secondary
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - TAGS={"bus":"secondary"}

  mqtt-influx-tetriary:
    build: docker/mqtt-influx
    depends_on:
      - broker
      - influxdb
    restart: unless-stopped
    networks:
      - automation
      - egress
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
    environment:
      - BROKER=mqtt://broker
      - TOPIC=/modbus/tetriary/+/+
      - MQTT_CLIENT_ID=mqtt-influx-tetriary
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - TAGS={"bus":"tetriary"}

  dmx-driver:
    build: docker/dmx-driver
    depends_on:
      - broker
    restart: unless-stopped
    privileged: true
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    environment:
      - BROKER=mqtt://broker
      - DMX_DRIVER=enttec-open-usb-dmx
      - DMX_PORT=/dev/ttyUSB5
      - MQTT_CLIENT_ID=dmx-driver
      - TOPIC=/modbus/dry-switches/mbsl32di1/reading
    volumes:
      - /dev/bus/usb:/dev/bus/usb

  automations:
    build: docker/automations
    depends_on:
      - broker
    restart: unless-stopped
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    environment:
      - BROKER=mqtt://broker
      - CONFIG=/etc/config.js
      - MQTT_CLIENT_ID=automations
      - TZ=${TZ}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /usr/share/zoneinfo:/usr/share/zoneinfo:ro
      - ${CONFIG_PATH}/automations/config.js:/etc/config.js:ro

  features:
    build: docker/automations
    depends_on:
      - broker
    restart: unless-stopped
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    environment:
      - BROKER=mqtt://broker
      - CONFIG=/etc/config.js
      - MQTT_CLIENT_ID=features
      - TZ=${TZ}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /usr/share/zoneinfo:/usr/share/zoneinfo:ro
      - ${CONFIG_PATH}/automations/features.js:/etc/config.js:ro

  ha_discovery:
    build: docker/automations
    depends_on:
      - broker
    restart: unless-stopped
    networks:
      - automation
    security_opt:
      - no-new-privileges:true
    environment:
      - BROKER=mqtt://broker
      - CONFIG=/etc/config.js
      - MQTT_CLIENT_ID=ha_discovery
      - TZ=${TZ}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /usr/share/zoneinfo:/usr/share/zoneinfo:ro
      - ${CONFIG_PATH}/automations/ha_discovery.js:/etc/config.js:ro

  # Manualy run with
  # dc run historian-primary node index.js
  historian-primary:
    build: docker/historian
    depends_on:
      - broker
      - mongo
    restart: 'no'
    networks:
      - automation
      - egress
    security_opt:
      - no-new-privileges:true
    secrets:
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGODB_URL=mongodb://mongo:27017/${MONGO_DATABASE}?authSource=admin
      - MONGODB_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGODB_PASSWORD_FILE=/run/secrets/mongo_root_password
      - BROKER=mqtt://broker
      - TOPIC=/modbus/main/{device}/history
      - MQTT_CLIENT_ID=historian-primary
      - COLLECTION=main

  # Manualy run with
  # dc run historian-secondary node index.js
  historian-secondary:
    build: docker/historian
    depends_on:
      - broker
      - mongo
    restart: 'no'
    networks:
      - automation
      - egress
    security_opt:
      - no-new-privileges:true
    secrets:
      - mongo_root_username
      - mongo_root_password
    environment:
      - MONGODB_URL=mongodb://mongo:27017/${MONGO_DATABASE}?authSource=admin
      - MONGODB_USERNAME_FILE=/run/secrets/mongo_root_username
      - MONGODB_PASSWORD_FILE=/run/secrets/mongo_root_password
      - BROKER=mqtt://broker
      - TOPIC=/modbus/secondary/{device}/history
      - MQTT_CLIENT_ID=historian-secondary
      - COLLECTION=secondary

  telegraf-ovms:
    build: docker/telegraf
    depends_on:
      - influxdb
    restart: unless-stopped
    networks:
      - automation
      - egress
    security_opt:
      - no-new-privileges:true
    secrets:
      - influxdb_write_user
      - influxdb_write_user_password
      - ovms_mqtt_user
      - ovms_mqtt_password
    ulimits:
      memlock: 835584
    environment:
      - INFLUXDB_URL=http://influxdb:8086
      - INFLUXDB_USERNAME_FILE=/run/secrets/influxdb_write_user
      - INFLUXDB_PASSWORD_FILE=/run/secrets/influxdb_write_user_password
      - INFLUXDB_DATABASE=${INFLUXDB_DATABASE}
      - MQTT_USERNAME_FILE=/run/secrets/ovms_mqtt_user
      - MQTT_PASSWORD_FILE=/run/secrets/ovms_mqtt_password
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /usr/share/zoneinfo:/usr/share/zoneinfo:ro
      - ${CONFIG_PATH}/telegraf/ovms.conf:/etc/telegraf/telegraf.conf:ro

  # Manually run with
  # dc run volman
  volman:
    build: docker/volman
    restart: 'no'
    network_mode: none
    security_opt:
      - no-new-privileges:true
    environment:
      - TZ=${TZ}
      - BACKUP_ROOT=/backup
      - VOLUMES_ROOT=/volumes
      - VOLUMES=ha mongo influxdb
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${BACKUP_PATH}:/backup
      - ${HOMEASSISTANT_DATA_PATH}:/volumes/ha
      - ${MONGO_DATA_PATH}:/volumes/mongo
      - ./data/influxdb:/volumes/influxdb

networks:
  # internal for the automation services - mqtt, node red, ah
  automation:
    internal: true
  # ingress proxy and exposed services
  ingress:
    internal: true
  # egress for containers needing access to external networks
  egress:
  # vpn, proxy
  dmz:
    ipam:
      config:
        - subnet: $INGRESS_SUBNET
  # internal networks for testing vpn access
  test-internal:
    internal: true
  test-internal2:
    internal: true

secrets:
  influxdb_admin_user:
    file: ${INFLUXDB_SECRET_ADMIN_USER_FILE}
  influxdb_admin_password:
    file: ${INFLUXDB_SECRET_ADMIN_PASSWORD_FILE}
  influxdb_user:
    file: ${INFLUXDB_SECRET_USER_FILE}
  influxdb_user_password:
    file: ${INFLUXDB_SECRET_USER_PASSWORD_FILE}
  influxdb_read_user:
    file: ${INFLUXDB_SECRET_READ_USER_FILE}
  influxdb_read_user_password:
    file: ${INFLUXDB_SECRET_READ_USER_PASSWORD_FILE}
  influxdb_write_user:
    file: ${INFLUXDB_SECRET_WRITE_USER_FILE}
  influxdb_write_user_password:
    file: ${INFLUXDB_SECRET_WRITE_USER_PASSWORD_FILE}
  mongo_express_password:
    file: ${MONGO_EXPRESS_SECRET_PASSWORD_FILE}
  mongo_express_username:
    file: ${MONGO_EXPRESS_SECRET_USERNAME_FILE}
  mongo_root_password:
    file: ${MONGO_SECRET_ROOT_PASSWORD_FILE}
  mongo_root_username:
    file: ${MONGO_SECRET_ROOT_USERNAME_FILE}
  nodered_credentials_key:
    file: ${NODERED_SECRET_CREDENTIALS_KEY_FILE}
  ovms_mqtt_password:
    file: ${SECRETS_PATH}/ovms_mqtt_password
  ovms_mqtt_user:
    file: ${SECRETS_PATH}/ovms_mqtt_user
  telegram_bot_token:
    file: ${SECRETS_PATH}/telegram_bot_token
  telegram_chat_id:
    file: ${SECRETS_PATH}/telegram_chat_id