invidious/docker-compose.yml

x-defaults: &defaults
  volumes:
    - /var/run/redis/redis-server.sock:/invidious/redis-server.sock:rw
  labels:
    - "com.centurylinklabs.watchtower.enable=false"
services: 

  invidious-base:
    <<: *defaults 
    env_file:
      - .env
    profiles: ["base"]
    cpus: 16
    mem_limit: "${INV_MEM_LIMIT}"
    memswap_limit: "${INV_MEM_SWAP}"
    image: invidious-nerdvpn:latest
    build:
      context: build
      dockerfile: docker/Dockerfile 
    restart: "${INV_RESTART_POLICY}"
    environment: &environment
      INVIDIOUS_CONFIG: |
        force_resolve: ipv6
        invidious_companion:
        # IPv6
        - private_url: "http://invidious-companion-1:8282/companion"
          public_url: "https://invidious.nerdvpn.de/companion"
          note: "- LOCATION_HERE"
        - private_url: "http://invidious-companion-2:8282/companion"
          public_url: "https://invidious.nerdvpn.de/companion"
          note: "- LOCATION_HERE"
        - private_url: "http://invidious-companion-3:8282/companion"
          public_url: "https://invidious.nerdvpn.de/companion"
          note: "- LOCATION_HERE"
        - private_url: "http://invidious-companion-4:8282/companion"
          public_url: "https://invidious.nerdvpn.de/companion"
          note: "- LOCATION_HERE"
        - private_url: "http://invidious-companion-5:8282/companion"
          public_url: "https://invidious.nerdvpn.de/companion"
          note: "- LOCATION_HERE"
        - private_url: "http://invidious-companion-6:8282/companion"
          public_url: "https://invidious.nerdvpn.de/companion"
          note: "- LOCATION_HERE"
        - private_url: "http://invidious-companion-7:8282/companion"
          public_url: "https://invidious.nerdvpn.de/companion"
          note: "- LOCATION_HERE"
        - private_url: "http://invidious-companion-8:8282/companion"
          public_url: "https://invidious.nerdvpn.de/companion"
          note: "- LOCATION_HERE"
        invidious_companion_key: ""
        backend_name_prefix: ""
        backend_health_status_page: ""
        modified_source_code_url: "https://git.nerdvpn.de/NerdVPN.de/invidious/"
        hmac_key: 
        db:
          dbname: invidious
          user: invidious
          password: 
          host: 192.42.6.1
          port: 6432
        redis_socket: "/invidious/redis-server.sock"
        redis_db: 4 
        redis_auth: ""
        check_tables: true
        external_port: 443
        domain: "invidious.nerdvpn.de"
        https_only: true
        hsts: true
        pool_size: 100
        #disable_proxy: ["livestreams","local","dash","downloads"]
        log_level: "Error"
        popular_enabled: true
        statistics_enabled: true
        admins: [""]
        enable_user_notifications: false
        channel_threads: 4
        channel_refresh_interval: "120m"
        use_pubsub_feeds: true
        feed_threads: 4
        banner: "${BANNER_MSG}"
        use_innertube_for_captions: true
        default_user_preferences:
          locale: "de"
          region: "DE"
          captions: ["","English","English (auto-generated)"]
          dark_mode: "dark"
          feed_menu: ["Trending", "Subscriptions", "Playlists", "Search"]
          default_home: "Search"
          comments: ["youtube", ""]
          autoplay: true
          continue_autoplay: true
          quality: "hd720"
          quality_dash: "720p"
          unseen_only: true
          local: false
          automatic_instance_redirect: true
          hide_shorts: false
    networks:
      invidious_proxy:

  invidious-companion-1:
    container_name: invidious-companion-1
    cpus: ${COMP_CPU_CORES}
    mem_limit: "${COMP_MEM_LIMIT}"
    memswap_limit: "${COMP_MEM_SWAP}"
    #image: quay.io/invidious/invidious-companion:latest
    image: invidious-companion-nerdvpn:latest
    build:
      context: companion
      dockerfile: Dockerfile 
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    environment:
       - SERVER_SECRET_KEY=
       - PROXY=
       - SERVER_ENABLE_METRICS=false
    restart: unless-stopped
    cap_drop:
      - ALL
    read_only: true
    volumes:
      - /srv/invidious/cache/1:/var/tmp/youtubei.js:rw
    security_opt:
      - no-new-privileges:true
    networks:
      invidious_proxy:
        ipv4_address: 192.42.6.11
  
  invidious-companion-2:
    container_name: invidious-companion-2
    cpus: ${COMP_CPU_CORES}
    mem_limit: "${COMP_MEM_LIMIT}"
    memswap_limit: "${COMP_MEM_SWAP}"
    #image: quay.io/invidious/invidious-companion:latest
    image: invidious-companion-nerdvpn:latest
    build:
      context: companion
      dockerfile: Dockerfile 
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    environment:
       - SERVER_SECRET_KEY=
       - PROXY=
       - SERVER_ENABLE_METRICS=false
    restart: unless-stopped
    cap_drop:
      - ALL
    read_only: true
    volumes:
      - /srv/invidious/cache/2:/var/tmp/youtubei.js:rw
    security_opt:
      - no-new-privileges:true
    networks:
      invidious_proxy:
        ipv4_address: 192.42.6.12
  
  invidious-companion-3:
    container_name: invidious-companion-3
    cpus: ${COMP_CPU_CORES}
    mem_limit: "${COMP_MEM_LIMIT}"
    memswap_limit: "${COMP_MEM_SWAP}"
    #image: quay.io/invidious/invidious-companion:latest
    image: invidious-companion-nerdvpn:latest
    build:
      context: companion
      dockerfile: Dockerfile 
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    environment:
       - SERVER_SECRET_KEY=
       - PROXY=
       - SERVER_ENABLE_METRICS=false
    restart: unless-stopped
    cap_drop:
      - ALL
    read_only: true
    volumes:
      - /srv/invidious/cache/3:/var/tmp/youtubei.js:rw
    security_opt:
      - no-new-privileges:true
    networks:
      invidious_proxy:
        ipv4_address: 192.42.6.13
  
  invidious-companion-4:
    container_name: invidious-companion-4
    cpus: ${COMP_CPU_CORES}
    mem_limit: "${COMP_MEM_LIMIT}"
    memswap_limit: "${COMP_MEM_SWAP}"
    #image: quay.io/invidious/invidious-companion:latest
    image: invidious-companion-nerdvpn:latest
    build:
      context: companion
      dockerfile: Dockerfile 
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    environment:
       - SERVER_SECRET_KEY=
       - PROXY=
       - SERVER_ENABLE_METRICS=false
    restart: unless-stopped
    cap_drop:
      - ALL
    read_only: true
    volumes:
      - /srv/invidious/cache/4:/var/tmp/youtubei.js:rw
    security_opt:
      - no-new-privileges:true
    networks:
      invidious_proxy:
        ipv4_address: 192.42.6.14
  
  invidious-companion-5:
    container_name: invidious-companion-5
    cpus: ${COMP_CPU_CORES}
    mem_limit: "${COMP_MEM_LIMIT}"
    memswap_limit: "${COMP_MEM_SWAP}"
    #image: quay.io/invidious/invidious-companion:latest
    image: invidious-companion-nerdvpn:latest
    build:
      context: companion
      dockerfile: Dockerfile 
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    environment:
       - SERVER_SECRET_KEY=
       - PROXY=
       - SERVER_ENABLE_METRICS=false
    restart: unless-stopped
    cap_drop:
      - ALL
    read_only: true
    volumes:
      - /srv/invidious/cache/5:/var/tmp/youtubei.js:rw
    security_opt:
      - no-new-privileges:true
    networks:
      invidious_proxy:
        ipv4_address: 192.42.6.15
  
  invidious-companion-6:
    container_name: invidious-companion-6
    cpus: ${COMP_CPU_CORES}
    mem_limit: "${COMP_MEM_LIMIT}"
    memswap_limit: "${COMP_MEM_SWAP}"
    #image: quay.io/invidious/invidious-companion:latest
    image: invidious-companion-nerdvpn:latest
    build:
      context: companion
      dockerfile: Dockerfile 
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    environment:
       - SERVER_SECRET_KEY=
       - PROXY=
       - SERVER_ENABLE_METRICS=false
    restart: unless-stopped
    cap_drop:
      - ALL
    read_only: true
    volumes:
      - /srv/invidious/cache/6:/var/tmp/youtubei.js:rw
    security_opt:
      - no-new-privileges:true
    networks:
      invidious_proxy:
        ipv4_address: 192.42.6.16
  
  invidious-companion-7:
    container_name: invidious-companion-7
    cpus: ${COMP_CPU_CORES}
    mem_limit: "${COMP_MEM_LIMIT}"
    memswap_limit: "${COMP_MEM_SWAP}"
    #image: quay.io/invidious/invidious-companion:latest
    image: invidious-companion-nerdvpn:latest
    build:
      context: companion
      dockerfile: Dockerfile 
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    environment:
       - SERVER_SECRET_KEY=
       - PROXY=
       - SERVER_ENABLE_METRICS=false
    restart: unless-stopped
    cap_drop:
      - ALL
    read_only: true
    volumes:
      - /srv/invidious/cache/7:/var/tmp/youtubei.js:rw
    security_opt:
      - no-new-privileges:true
    networks:
      invidious_proxy:
        ipv4_address: 192.42.6.17
  
  invidious-companion-8:
    container_name: invidious-companion-8
    cpus: ${COMP_CPU_CORES}
    mem_limit: "${COMP_MEM_LIMIT}"
    memswap_limit: "${COMP_MEM_SWAP}"
    #image: quay.io/invidious/invidious-companion:latest
    image: invidious-companion-nerdvpn:latest
    build:
      context: companion
      dockerfile: Dockerfile 
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    environment:
       - SERVER_SECRET_KEY=
       - PROXY=
       - SERVER_ENABLE_METRICS=false
    restart: unless-stopped
    cap_drop:
      - ALL
    read_only: true
    volumes:
      - /srv/invidious/cache/8:/var/tmp/youtubei.js:rw
    security_opt:
      - no-new-privileges:true
    networks:
      invidious_proxy:
        ipv4_address: 192.42.6.18
  
  # Example companion for socks5 support
  invidious-companion-socks5:
    profiles: ["disabled"]
    container_name: invidious-companion-socks5
    cpus: ${COMP_CPU_CORES}
    mem_limit: "${INV_MEM_LIMIT}"
    memswap_limit: "${INV_MEM_SWAP}"
    image: quay.io/invidious/invidious-companion:latest
    environment:
       - SERVER_SECRET_KEY=
       - SERVER_ENABLE_METRICS=false
    restart: unless-stopped
    cap_drop:
      - ALL
    read_only: true
    volumes:
      - /srv/invidious/cache/socks5:/var/tmp/youtubei.js:rw
    security_opt:
      - no-new-privileges:true
    #networks:
    #  invidious_proxy:
    #    ipv4_address: 192.42.6.21
    network_mode: "container:invidious-proxy-socks5"
    depends_on:
      - invidious-proxy-1
  
  # Socks5 tunnel for above example companion
  invidious-proxy-socks5:
    profiles: ["disabled"]
    container_name: invidious-proxy-socks5
    restart: unless-stopped
    image: ghcr.io/xjasonlyu/tun2socks:latest
    cpus: 2
    mem_limit: "128m"
    memswap_limit: "320m"
    cap_add:
      - NET_ADMIN
    devices:
        - '/dev/net/tun:/dev/net/tun'
    environment:
      - LOGLEVEL=info
      - TUN=tun0
      - ADDR=198.18.0.1/15
      - MTU=9000
      - PROXY=socks5://1234:5678@domain.tld
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.disable_ipv6=0
    networks:
      invidious_proxy:
        ipv4_address: 192.42.6.200

  invidious:
    <<: *defaults
    env_file:
      - .env
    container_name: invidious
    cpus: ${INV_CPU_CORES}
    mem_limit: "${INV_MEM_LIMIT}"
    memswap_limit: "${INV_MEM_SWAP}"
    image: "${INV_IMAGE}"
    restart: "${INV_RESTART_POLICY}"
    environment:
      <<: *environment
    networks:
      invidious_proxy:
        ipv4_address: 192.42.6.2

  invidious-cache:
    container_name: invidious-cache
    restart: unless-stopped
    cpus: 2
    mem_limit: "1024m"
    memswap_limit: "1024m"
    image: varnish:latest
    user: 10043:10043 # Put uid/gid of your invidious user here
    volumes:
      - /srv/invidious/varnish:/var/lib/varnish
    command: "-a :6081 -T localhost:6082 -f /var/lib/varnish/default.vcl -s file,/var/lib/varnish/varnish_storage.bin,16G -p cli_timeout=15"
    ulimits:
      memlock:
        soft: 1073741824
        hard: 1073741824
    networks:
      invidious_proxy:
        ipv4_address: 192.42.6.3

networks:
  invidious_proxy:
    enable_ipv6: true
    external: true