apprise-api/compose.yml

@@ -19,6 +19,7 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.apprise.rule=Host(`apprise.nearfuture`)"
       - "traefik.http.routers.apprise.entrypoints=web"
+      - "com.centurylinklabs.watchtower.scope=watch"
 
 networks:
   proxy:

arr/compose.yml

@@ -17,6 +17,7 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.prowlarr.rule=Host(`prowlarr.nearfuture`)"
       - "traefik.http.routers.prowlarr.entrypoints=web"
+      - "com.centurylinklabs.watchtower.scope=watch"
 
   radarr:
     image: lscr.io/linuxserver/radarr:latest
@@ -38,6 +39,7 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.radarr.rule=Host(`radarr.nearfuture`)"
       - "traefik.http.routers.radarr.entrypoints=web"
+      - "com.centurylinklabs.watchtower.scope=watch"
 
   sonarr:
     image: lscr.io/linuxserver/sonarr:latest
@@ -59,28 +61,7 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.sonarr.rule=Host(`sonarr.nearfuture`)"
       - "traefik.http.routers.sonarr.entrypoints=web"
-
+      - "com.centurylinklabs.watchtower.scope=watch"
-  overseerr:
-    image: lscr.io/linuxserver/overseerr:latest
-    container_name: overseerr
-    environment:
-      - PUID=1029
-      - PGID=1000
-      - TZ=Etc/UTC
-    volumes:
-      - /home/fejy/docker/overseerr:/config
-    ports:
-      - 5055:5055
-    restart: unless-stopped
-    networks:
-      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.overseerr.rule=Host(`overseerr.nearfuture`)"
-      - "traefik.http.routers.overseerr.entrypoints=web"
-      - "traefik.http.routers.overseerr-ssl.rule=Host(`overseerr.nearfuture`)"
-      - "traefik.http.routers.overseerr-ssl.entrypoints=websecure"
-      - "traefik.http.routers.overseerr-ssl.tls=true"
 
   lidarr:
     image: lscr.io/linuxserver/lidarr:latest
@@ -102,6 +83,28 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.lidarr.rule=Host(`lidarr.nearfuture`)"
       - "traefik.http.routers.lidarr.entrypoints=web"
+      - "com.centurylinklabs.watchtower.scope=watch"
+
+  seerr:
+    image: ghcr.io/seerr-team/seerr:latest
+    container_name: seerr
+    environment:
+      - TZ=Etc/UTC
+    volumes:
+      - /home/fejy/docker/overseerr:/app/config
+    ports:
+      - 5055:5055
+    restart: unless-stopped
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.overseerr.rule=Host(`overseerr.nearfuture`)"
+      - "traefik.http.routers.overseerr.entrypoints=web"
+      - "traefik.http.routers.overseerr-ssl.rule=Host(`overseerr.nearfuture`)"
+      - "traefik.http.routers.overseerr-ssl.entrypoints=websecure"
+      - "traefik.http.routers.overseerr-ssl.tls=true"
+      - "com.centurylinklabs.watchtower.scope=watch"
 
 networks:
   proxy:

authentik/compose.yml

@@ -0,0 +1,96 @@
+services:
+  postgresql:
+    env_file:
+    - .env
+    environment:
+      POSTGRES_DB: ${PG_DB:-authentik}
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+      - CMD-SHELL
+      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
+    image: docker.io/library/postgres:16-alpine
+    restart: unless-stopped
+    volumes:
+      - /home/fejy/docker/authentik/database:/var/lib/postgresql/data
+    networks:
+      - authentik
+
+  authentik-server:
+    command: server
+    depends_on:
+      postgresql:
+        condition: service_healthy
+    env_file:
+    - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.2-rc2}
+    container_name: authentik-server
+    ports:
+    - 9001:9000
+    - ${COMPOSE_PORT_HTTPS:-9443}:9443
+    restart: unless-stopped
+    shm_size: 512mb
+    volumes:
+    - /home/fejy/docker/authentik/data:/data
+    - /home/fejy/docker/authentik/custom-templates:/templates
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.routers.https-auth.entryPoints=websecure"
+      - "traefik.http.routers.https-auth.rule=Host(`auth.nearfuture.industries`) || HostRegexp(`{subdomain:[a-z0-9-]+}.nearfuture.industries`) && PathPrefix(`/outpost.goauthentik.io/`)"
+      - "traefik.http.routers.https-auth.tls=true"
+      - "traefik.http.routers.https-auth.tls.certresolver=myresolver"
+      - "traefik.http.routers.https-auth.priority=50"
+      - "traefik.http.routers.https-auth.service=https-auth"
+      - "traefik.http.services.https-auth.loadbalancer.server.port=9000"
+      - "com.centurylinklabs.watchtower.scope=watch"  
+    networks:
+      - proxy
+      - authentik
+
+  worker:
+    command: worker
+    depends_on:
+      postgresql:
+        condition: service_healthy
+    env_file:
+    - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.2-rc2}
+    restart: unless-stopped
+    shm_size: 512mb
+    user: root
+    volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
+    - /home/fejy/docker/authentik/data:/data
+    - /home/fejy/docker/authentik/certs:/certs
+    - /home/fejy/docker/authentik/custom-templates:/templates
+    labels:
+      - "com.centurylinklabs.watchtower.scope=watch"
+    networks:
+      - authentik
+
+#volumes:
+  #database:
+    #driver: local
+
+networks:
+  proxy:
+    external: true
+  authentik:

cross-seed/compose.yml

@@ -16,6 +16,8 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.cross-seed.rule=Host(`cross-seed.nearfuture`)"
       - "traefik.http.routers.cross-seed.entrypoints=web"
+      - "com.centurylinklabs.watchtower.scope=watch"
+
   cross-seed2:
     image: ghcr.io/cross-seed/cross-seed:6
     container_name: cross-seed2
@@ -33,6 +35,8 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.cross-seed2.rule=Host(`cross-seed2.nearfuture`)"
       - "traefik.http.routers.cross-seed2.entrypoints=web"
+      - "com.centurylinklabs.watchtower.scope=watch"
+
   cross-seed3:
     image: ghcr.io/cross-seed/cross-seed:6
     container_name: cross-seed3
@@ -50,6 +54,8 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.cross-seed3.rule=Host(`cross-seed3.nearfuture`)"
       - "traefik.http.routers.cross-seed3.entrypoints=web"
+      - "com.centurylinklabs.watchtower.scope=watch"
+
   cross-seed-priv:
     image: ghcr.io/cross-seed/cross-seed:6
     container_name: cross-seed-priv
@@ -67,9 +73,8 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.cross-seed-priv.rule=Host(`cross-seed-priv.nearfuture`)"
       - "traefik.http.routers.cross-seed-priv.entrypoints=web"
-
+      - "com.centurylinklabs.watchtower.scope=watch"
 
 networks:
   proxy:
     external: true
-

excalidraw/compose.yml

@@ -20,8 +20,9 @@ services:
       - "traefik.http.routers.ex-ssl-ext.rule=Host(`excalidraw.nearfuture.industries`)"
       - "traefik.http.routers.ex-ssl-ext.entrypoints=websecure"
       - "traefik.http.routers.ex-ssl-ext.tls=true"
-
+      - "traefik.http.routers.ex-ssl-ext.tls.certresolver=myresolver"
-
+      - "traefik.http.routers.ex-ssl-ext.middlewares=authentik@file"
+      - "com.centurylinklabs.watchtower.scope=watch"
 networks:
   proxy:
     external: true

homepage/compose.yml

@@ -20,6 +20,7 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.homepage.rule=Host(`home.nearfuture`)"
       - "traefik.http.routers.homepage.entrypoints=web"
+      - "com.centurylinklabs.watchtower.scope=watch"
 
 networks:
   proxy:

overseerr/compose.yml

@@ -1,27 +0,0 @@
-services:
-  overseerr:
-    image: lscr.io/linuxserver/overseerr:latest
-    container_name: overseerr
-    environment:
-      - PUID=1029
-      - PGID=1000
-      - TZ=Etc/UTC
-    volumes:
-      - /home/fejy/docker/overseerr:/config
-    ports:
-      - 5055:5055
-    restart: unless-stopped
-    networks:
-      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.overseerr.rule=Host(`overseerr.nearfuture`)"
-      - "traefik.http.routers.overseerr.entrypoints=web"
-      - "traefik.http.routers.overseerr-ssl.rule=Host(`overseerr.nearfuture`)"
-      - "traefik.http.routers.overseerr-ssl.entrypoints=websecure"
-      - "traefik.http.routers.overseerr-ssl.tls=true"
-
-networks:
-  proxy:
-    external: true
-

pirate-ship/compose.yml

@@ -63,6 +63,8 @@ services:
       - "traefik.http.routers.qbit-priv.entrypoints=web"
       - "traefik.http.routers.qbit-priv.service=qbit-priv"
       - "traefik.http.services.qbit-priv.loadbalancer.server.port=8069"
+      # Watchtower
+      - "com.centurylinklabs.watchtower.scope=watch"
 
   qbittorrent:
     image: lscr.io/linuxserver/qbittorrent:latest
@@ -75,7 +77,6 @@ services:
     volumes:
       - /home/fejy/docker/qbittorrent:/config
       - /mnt/LUXURIA/Share:/Share
-      - /mnt/LUXURIA/Private:/Private
       - /mnt/downloads:/downloads/
     network_mode: "service:gluetun"
     depends_on:
@@ -94,7 +95,6 @@ services:
     volumes:
       - /home/fejy/docker/qbittorrent2:/config
       - /mnt/LUXURIA/Share:/Share
-      - /mnt/LUXURIA/Private:/Private
       - /mnt/downloads:/downloads/
     network_mode: "service:gluetun"
     depends_on:
@@ -131,7 +131,7 @@ services:
     volumes:
       - /home/fejy/docker/qbittorrent_priv:/config
       - /mnt/LUXURIA/Share:/mnt/LUXURIA/Share
-      - /mnt/LUXURIA/Private:/mnt/LUXURIA/Private
+      - /mnt/AVARITIA/Private:/mnt/LUXURIA/Private
       - /mnt/downloads:/downloads/
     network_mode: "service:gluetun"
     depends_on:

privatebin/compose.yml

@@ -25,7 +25,7 @@ services:
       - "traefik.http.routers.privatebin-ssl-ext.rule=Host(`privatebin.nearfuture.industries`)"
       - "traefik.http.routers.privatebin-ssl-ext.entrypoints=websecure"
       - "traefik.http.routers.privatebin-ssl-ext.tls=true"
-
+      - "com.centurylinklabs.watchtower.scope=watch"
 
 networks:
   proxy:

prowlarr/compose.yml

@@ -1,25 +0,0 @@
-services:
-  prowlarr:
-    image: lscr.io/linuxserver/prowlarr:latest
-    container_name: prowlarr
-    environment:
-      - PUID=1029
-      - PGID=1000
-      - TZ=Etc/UTC
-    volumes:
-      - /home/fejy/docker/prowlarr/data:/config
-    ports:
-      - 9696:9696
-    restart: unless-stopped
-    networks:
-      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.prowlarr.rule=Host(`prowlarr.nearfuture`)"
-      - "traefik.http.routers.prowlarr.entrypoints=web"
-
-
-networks:
-  proxy:
-    external: true
-

radarr/compose.yml

@@ -1,25 +0,0 @@
-services:
-  radarr:
-    image: lscr.io/linuxserver/radarr:latest
-    container_name: radarr
-    environment:
-      - PUID=1029
-      - PGID=1000
-      - TZ=Etc/UTC
-    volumes:
-      - /home/fejy/docker/radarr:/config
-      - /mnt/LUXURIA/Share:/Share
-    ports:
-      - 7878:7878
-    restart: unless-stopped
-    networks:
-      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.radarr.rule=Host(`radarr.nearfuture`)"
-      - "traefik.http.routers.radarr.entrypoints=web"
-
-networks:
-  proxy:
-    external: true
-

sonarr/compose.yml

@@ -1,25 +0,0 @@
-services:
-  sonarr:
-    image: lscr.io/linuxserver/sonarr:latest
-    container_name: sonarr
-    environment:
-      - PUID=1029
-      - PGID=1000
-      - TZ=Etc/UTC
-    volumes:
-      - /home/fejy/docker/sonarr:/config
-      - /mnt/LUXURIA/Share:/Share
-    ports:
-      - 8989:8989
-    restart: unless-stopped
-    networks:
-      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.sonarr.rule=Host(`sonarr.nearfuture`)"
-      - "traefik.http.routers.sonarr.entrypoints=web"
-
-networks:
-  proxy:
-    external: true
-

tautulli/compose.yml

@@ -17,6 +17,7 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.tautulli.rule=Host(`tautulli.nearfuture`)"
       - "traefik.http.routers.tautulli.entrypoints=web"
+      - "com.centurylinklabs.watchtower.scope=watch"
 
 networks:
   proxy:

thelounge/compose.yml

@@ -0,0 +1,25 @@
+services:
+  thelounge:
+    image: lscr.io/linuxserver/thelounge:latest
+    container_name: thelounge
+    environment:
+      - PUID=1029
+      - PGID=1000
+      - TZ=Etc/UTC
+    volumes:
+      - /home/fejy/docker/thelounge/config:/config
+    ports:
+      - 9000:9000
+    restart: unless-stopped
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.thelounge.rule=Host(`thelounge.nearfuture`)"
+      - "traefik.http.routers.thelounge.entrypoints=web"
+      - "com.centurylinklabs.watchtower.scope=watch"
+
+networks:
+  proxy:
+    external: true
+

traefik/compose.yml

@@ -28,6 +28,7 @@ services:
       - "traefik.http.routers.api.rule=Host(`traefik.nearfuture`)"
       - "traefik.http.routers.api.entrypoints=web"
       - "traefik.http.services.api.loadbalancer.server.port=8080 # The port value doesn't matter"
+      - "com.centurylinklabs.watchtower.scope=watch"
 
 networks:
   proxy:

wastebin/compose.yml

@@ -1,23 +0,0 @@
-services:
-  wastebin:
-    image: 'quxfoo/wastebin:latest'
-    container_name: wastebin
-    environment:
-      - WASTEBIN_DATABASE_PATH=/data/state.db
-    user: "1029:1000"
-    ports:
-      - "9020:8088"
-    volumes:
-      - '/home/fejy/docker/wastebin:/data'
-    labels:    
-      - "traefik.enable=true"
-      - "traefik.http.routers.bin.rule=Host(`bin.nearfuture`)"
-      - "traefik.http.routers.bin.entrypoints=web"
-
-    networks:
-      - proxy
-
-networks:
-  proxy:
-     external: true
-

watchtower/compose.yml

@@ -0,0 +1,12 @@
+version: '3'
+services:
+  watchtower:
+    image: containrrr/watchtower
+    container_name: watchtower
+    #command: --run-once --scope watch
+    command: --cleanup=true --scope watch
+    restart: always
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    labels: [ "com.centurylinklabs.watchtower.scope=watch" ]
+

whisparr/compose.yml

@@ -1,25 +0,0 @@
-services:
-  whisparr:
-    image: ghcr.io/thespad/whisparr:latest
-    container_name: whisparr
-    environment:
-      - PUID=1029
-      - PGID=1000
-      - TZ=Etc/UTC
-    volumes:
-      - /home/fejy/docker/whisparr:/config
-      - /mnt/LUXURIA/Private:/Private
-    ports:
-      - 6969:6969
-    restart: unless-stopped
-    networks:
-      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.whisparr.rule=Host(`whisparr.nearfuture`)"
-      - "traefik.http.routers.whisparr.entrypoints=web"
-
-networks:
-  proxy:
-    external: true
-