services:
  dark3proxy:
    container_name: dark3proxy
    image: host60/darkproxy-dark3proxy:v1.0
    build:
      context: ./3proxy/.
    dns:
      - "10.5.0.6"
    dns_search: internal.namespace #namespace used in internal DNS
    volumes:
      - "./3proxy/first-instanse.cfg:/etc/3proxy/first-instanse.cfg"
      - "./3proxy/second-instanse.cfg:/etc/3proxy/second-instanse.cfg"
    secrets:
      - PROXY_USERS
    restart: unless-stopped
    sysctls:
      - "net.ipv6.conf.all.disable_ipv6=0"
    ports:
      - "127.0.0.1:2000:1080" # socks port (localhost only)
      - "127.0.0.1:2002:8161" # 3proxy-eagle web page (localhost only)
    networks:
      darkproxy:
        ipv4_address: 10.5.0.8

  i2pd_yggdrasil:
    container_name: darki2p
    image: host60/i2pd_yggdrasil:v1.3
#    image: i2pd_yggdrasil:latest
    privileged: true
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      # I2P Service Ports
#      - "2827:2827" #   BOB Bridge
#      - "4444:4444" #   HTTP Proxy
#      - "4447:4447" #   SOCKS Proxy
      - "2001:7070" #   Webconsole
#      - "7650:7650" #   I2PControl
#      - "7654:7654" #   I2CP
#      - "7656:7656" #   SAM Bridge (TCP)
      - "10765:10765" #   Main I2P Listener
      # I2P name resolution occurs over the SOCKS proxy; there is no
# separate DNS listener in this build (the `dns` section in i2pd.conf
# is currently disabled because the shipped i2pd release doesn't
# support it).  SOCKS remains on port 4447 and will resolve *.i2p names.
      # mapping to host is possible if desired, e.g. 10853:53/udp
      # Yggdrasil Ports
      - "10654:10654" #   Yggdrasil Listener
    environment:
      tz: /run/secrets/tz
    secrets:
      - tz
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "bash", "-c", "pgrep i2pd && pgrep yggdrasil"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    sysctls:
      - "net.ipv6.conf.all.disable_ipv6=0"
    mac_address: ce:22:b8:0e:6e:78
    networks:
      darkproxy:
        ipv4_address: 10.5.0.2

  tor_yggdrasil:
    image: host60/tor_yggdrasil:v1.0
#    image: tor_yggdrasil:latest
#    container_name: tor_over_yggdrasil
    container_name: darktor
    # platform removed; image is amd64-only
    cap_add:
      - NET_ADMIN  # Required for network tunnel management
    security_opt:
      - no-new-privileges:true  # Security enhancement - prevent privilege esca>
    devices:
      - /dev/net/tun:/dev/net/tun  # TUN device for Yggdrasil network interface
    ports:
#      - "127.0.0.1:9050:9050/tcp"   # SOCKS5 proxy port (Tor) for application-l>
      - "10655:10655/tcp" # Yggdrasil peer connections
    secrets:
      - YGGDRASIL_GENERATE_KEYS
    environment:
      YGGDRASIL_GENERATE_KEYS: /run/secrets/YGGDRASIL_GENERATE_KEYS # Generate new Yggdrasil keys on startup
    restart: unless-stopped  # Auto-restart unless manually stopped
    dns:
      - "10.5.0.6"
    sysctls:
      - "net.ipv6.conf.all.disable_ipv6=0"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.7

  alfis:
    image: cofob/alfis
    # platform removed; image is amd64 only
    container_name: darkalfis
    volumes:
      - darkalfis_data:/storage
    restart: unless-stopped
    stop_grace_period: 10s
    dns:
      - "10.5.0.6"
    sysctls:
      - "net.ipv6.conf.all.disable_ipv6=0"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.3

  coredns:
#    image: darkdns
    image: host60/darkdns:v1.0
    build:
      context: ./PopuraDNS
      dockerfile: Dockerfile
    container_name: darkdns
    restart: unless-stopped
    sysctls:
      - "net.ipv6.conf.all.disable_ipv6=0"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"    # Maximum log file size
        max-file: "3"      # Maximum of 3 rotating log files
    networks:
      darkproxy:
        ipv4_address: 10.5.0.4

  unbound:
    container_name: darkunbound
    image: mvance/unbound:latest
    # platform removed; image is amd64-only
    sysctls:
      - "net.ipv6.conf.all.disable_ipv6=0"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.5
    volumes:
      - type: bind
        read_only: true
        source: ./unbound/unbound.conf
        target: /opt/unbound/etc/unbound/unbound.conf
      - "./unbound/forward-records.conf:/opt/unbound/etc/unbound/forward-records.conf"
      - "./unbound/a-records.conf:/opt/unbound/etc/unbound/a-records.conf"
#    ports:
#    - "5053:5053/tcp"
#    - "5053:5053/udp"
#    healthcheck:
#      disable: true
    restart: unless-stopped

  pihole:
    container_name: darkpihole
    image: pihole/pihole:latest
    platform: linux/arm64
    # For DHCP it is recommended to remove these ports and instead add: network_mode: "host"
    ports:
      # DNS Ports
#      - "53:53/tcp"
#      - "53:53/udp"
     # Default HTTP Port
#      - "80:80/tcp"
      # Default HTTPs Port. FTL will generate a self-signed certificate
#      - "443:443/tcp
      # Uncomment the line below if you are using Pi-hole as your DHCP server
#      - "67:67/udp"
      # Uncomment the line below if you are using Pi-hole as your NTP server
#       - "123:123/udp"
      - "127.0.0.1:2003:80/tcp" # pihole web port (localhost only)
    environment:
      # Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), e.g:
      TZ: 'America/Detroit'
      # WEBPASSWORD: 'set a secure password here or it will be random'
#      FTLCONF_webserver_api_password: 'darkproxy'
      # If using Docker's default `bridge` network setting the dns listening mode should be set to 'all'
#      FTLCONF_dns_listeningMode: 'all'
      PIHOLE_DNS_: 10.5.0.4
      TEMPERATUREUNIT: f
      WEBTHEME: lcars
      WEBPASSWORD_FILE: /run/secrets/PIHOLE_WEBPASSWORD
      FTLCONF_dns_upstreams: coredns
    secrets:
      - PIHOLE_WEBPASSWORD
    # Volumes store your data between container upgrades
    volumes:
     # For persisting Pi-hole's databases and common configuration file
      - './pihole/etc-pihole:/etc/pihole'
     # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true'
      - './pihole/etc-dnsmasq.d:/etc/dnsmasq.d'
    cap_add:
      # See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
      # Required if you are using Pi-hole as your DHCP server, else not needed
      - NET_ADMIN
      # Required if you are using Pi-hole as your NTP client to be able to set the host's system time
#      - SYS_TIME
      # Optional, if Pi-hole should get some more processing time
      - SYS_NICE
    restart: unless-stopped # Recommended but not required (DHCP needs NET_ADMIN)  
    sysctls:
      - "net.ipv6.conf.all.disable_ipv6=0"
    healthcheck:
      test: ["CMD", "dig", "+short", "+norecurse", "+timeout=2", "@127.0.0.1", "google.com"]
      interval: 1m
      timeout: 10s
      retries: 3
      start_period: 30s
    networks:
      darkproxy:
        ipv4_address: 10.5.0.6

  emc:
    image: wg00/emercoin:0.8.4
    platform: linux/arm64
    container_name: darkemer
    volumes:
      - emc_data:/emc
      - /etc/localtime:/etc/localtime:ro
    networks:
      darkproxy:
        ipv4_address: 10.5.0.9
    restart: unless-stopped
    stop_grace_period: 30s

  ensdns:
    build:
      context: ./ensdns
      dockerfile: Dockerfile
    container_name: darkens
    restart: unless-stopped
    environment:
      ENS_RPC_URL: https://ethereum-rpc.publicnode.com
      ENSDNS_TTL: 60
    sysctls:
      - "net.ipv6.conf.all.disable_ipv6=0"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.11

  namecoindns:
    build:
      context: ./namecoindns
      dockerfile: Dockerfile
    container_name: darknamecoin
    restart: unless-stopped
    environment:
      NAMECOIN_DOH_TIMEOUT: 6
      NAMECOIN_DOH_UPSTREAMS: https://dns.google/dns-query,https://cloudflare-dns.com/dns-query
    sysctls:
      - "net.ipv6.conf.all.disable_ipv6=0"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.12

  tailscale:
    build:
      context: ./tailscale
      dockerfile: Dockerfile
    container_name: darkscale
    hostname: darkproxy-exit
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      # ⚠️ Get your own auth key from https://login.tailscale.com/admin/settings/keys
      - TS_AUTHKEY=${TS_AUTHKEY:-tskey-YOUR-AUTH-KEY-HERE}
      - TS_EXTRA_ARGS=--accept-dns=false --advertise-exit-node
      - TS_STATE_DIR=/var/lib/tailscale
    volumes:
      - tailscale_data:/var/lib/tailscale
    networks:
      darkproxy:
        ipv4_address: 10.5.0.10
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv6.conf.all.forwarding=1
    restart: unless-stopped

  # monitoring exporter for 3proxy metrics
  3proxy_exporter:
    container_name: dark3proxy-exporter
    build:
      context: ./monitor
    image: darkproxy-3proxy-exporter:latest
    depends_on:
      - dark3proxy
    networks:
      - darkproxy

  prometheus:
    image: prom/prometheus:latest
    container_name: darkprom
    volumes:
      - ./monitor/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    ports:
      - "127.0.0.1:9090:9090"
    networks:
      - darkproxy

  grafana:
    image: grafana/grafana:latest
    container_name: darkgraf
    ports:
      - "127.0.0.1:2005:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD__FILE=/run/secrets/GRAFANA_ADMIN_PASSWORD
    secrets:
      - GRAFANA_ADMIN_PASSWORD
    volumes:
      - grafana-data:/var/lib/grafana
    networks:
      - darkproxy

volumes:
  darkalfis_data:
    name: darkalfis_data
  emc_data:
    name: emc_data
  tor-data:
    driver: local
  tailscale_data:
    name: tailscale_data
  grafana-data:
    name: grafana-data

networks:
  darkproxy:
#    name: darkproxy
    enable_ipv6: true
    driver: bridge
    ipam:
      config:
        - subnet: 10.5.0.0/16
          gateway: 10.5.0.1
        - subnet: 2001:0BC5::/112
          gateway: 2001:0BC5::1

secrets:
  tz:
    file: ./secrets/tz.txt
  YGGDRASIL_GENERATE_KEYS:
    file: ./secrets/YGGDRASIL_GENERATE_KEYS.txt
  PIHOLE_WEBPASSWORD:
    file: ./secrets/pihole_webpassword.txt
  GRAFANA_ADMIN_PASSWORD:
    file: ./secrets/grafana_admin_password.txt
  PROXY_USERS:
    file: ./secrets/3proxy_users.txt