docker-compose.yml

---
# Docker Compose Stack
# Home Assistant
# ├─ Database
# └─ (Adminer)
# ESPHome
# zwavejs2mqtt
# avahi (reflector)

version: '3.7'

services:
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:${HOMEASSISTANT_TAG:-latest}
    restart: unless-stopped
    volumes:
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
      - ./data/homeassistant:/config
    depends_on:
      - database
      - mosquitto
    logging:
      driver: "json-file"
      options:
        max-size: "1k"
        max-file: "10"
    devices:
      # P1
      - /dev/ttyUSB-DSRM:/dev/ttyUSB-P1
    networks:
      - default
      - influxdb
      - web
    labels:
      - traefik.enable=true
      - traefik.docker.network=web
      - traefik.http.routers.home.rule=Host(`home.${DOMAIN}`)
      - traefik.http.routers.home.entrypoints=http
      - traefik.http.routers.home.middlewares=redirect@file
      - traefik.http.services.home.loadbalancer.server.port=8123

      - traefik.http.routers.home-secured.rule=Host(`home.${DOMAIN}`)
      - traefik.http.routers.home-secured.entrypoints=https
      - traefik.http.routers.home-secured.tls=true
      - traefik.http.routers.home-secured.tls.certresolver=letsencrypt
      - traefik.http.routers.home-secured.middlewares=hsts@file

  database:
    image: postgres:${POSTGRES_TAG:-latest}
    restart: unless-stopped
    volumes:
      - ./data/database:/var/lib/postgresql/data
    logging:
      driver: "json-file"
      options:
        max-size: "1k"
        max-file: "10"
    networks:
      - default
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}

  # adminer:
  #   image: adminer
  #   restart: unless-stopped
  #   networks:
  #     - default
  #     - web
  #   labels:
  #     - traefik.enable=true
  #     - traefik.docker.network=web
  #     - traefik.http.routers.database-home.rule=Host(`database.home.${DOMAIN}`)
  #     - traefik.http.routers.database-home.entrypoints=http
  #     - traefik.http.routers.database-home.middlewares=ipwhitelist@file
  #     - traefik.http.services.database-home.loadbalancer.server.port=8080

  zwavejs2mqtt:
    image: zwavejs/zwavejs2mqtt:${ZWAVEJS_TAG:-dev}
    restart: unless-stopped
    devices:
      # Aeotec
      - /dev/ttyUSB-ZStick-5G:/dev/ttyAeotec
    volumes:
      - ./data/zwavejs:/usr/src/app/store
    environment:
      - TZ=Europe/Amsterdam
    networks:
      - default
      - web
    expose:
      - 8091
    labels:
      - traefik.enable=true
      - traefik.docker.network=web
      - traefik.http.routers.zwavejs.rule=Host(`zwavejs.${DOMAIN}`)
      - traefik.http.routers.zwavejs.entrypoints=http
      - traefik.http.routers.zwavejs.middlewares=redirect@file
      - traefik.http.services.zwavejs.loadbalancer.server.port=8091

      - traefik.http.routers.zwavejs-secured.rule=Host(`zwavejs.${DOMAIN}`)
      - traefik.http.routers.zwavejs-secured.entrypoints=https
      - traefik.http.routers.zwavejs-secured.tls=true
      - traefik.http.routers.zwavejs-secured.tls.certresolver=letsencrypt
      - traefik.http.routers.zwavejs-secured.middlewares=hsts@file,ipwhitelist@file,authelia@docker

  avahi:
    image: flungo/avahi:latest
    restart: unless-stopped
    network_mode: host
    environment:
      - REFLECTOR_ENABLE_REFLECTOR=yes

  esphome:
    image: esphome/esphome:${ESPHOME_TAG:-latest}
    restart: unless-stopped
    volumes:
      - ./data/esphome:/config
    environment:
      - TZ=Europe/Amsterdam
    networks:
      - web
    labels:
      - traefik.enable=true
      - traefik.docker.network=web
      - traefik.http.routers.esphome.rule=Host(`esphome.${DOMAIN}`)
      - traefik.http.routers.esphome.entrypoints=http
      - traefik.http.routers.esphome.middlewares=redirect@file,ipwhitelist@file
      - traefik.http.services.esphome.loadbalancer.server.port=6052

      - traefik.http.routers.esphome-secured.rule=Host(`esphome.${DOMAIN}`)
      - traefik.http.routers.esphome-secured.entrypoints=https
      - traefik.http.routers.esphome-secured.tls=true
      - traefik.http.routers.esphome-secured.tls.certresolver=letsencrypt
      - traefik.http.routers.esphome-secured.middlewares=hsts@file,ipwhitelist@file,authelia@docker

  zigbee2mqtt:
    image: koenkk/zigbee2mqtt:${ZIGBEE2MQTT_TAG:-latest}
    restart: unless-stopped
    depends_on:
      - mosquitto
    volumes:
      - ./data/zigbee2mqtt:/app/data
    environment:
      - TZ=Europe/Amsterdam
    devices:
      # Make sure this matched your adapter location
      - /dev/ttyUSB-SonoffZigbee:/dev/ttyACM0
    networks:
      - default
      - web
    labels:
      - traefik.enable=true
      - traefik.docker.network=web
      - traefik.http.routers.zigbee2mqtt.rule=Host(`zigbee2mqtt.${DOMAIN}`)
      - traefik.http.routers.zigbee2mqtt.entrypoints=http
      - traefik.http.routers.zigbee2mqtt.middlewares=redirect@file,ipwhitelist@file
      - traefik.http.services.zigbee2mqtt.loadbalancer.server.port=8080

      - traefik.http.routers.zigbee2mqtt-secured.rule=Host(`zigbee2mqtt.${DOMAIN}`)
      - traefik.http.routers.zigbee2mqtt-secured.entrypoints=https
      - traefik.http.routers.zigbee2mqtt-secured.tls=true
      - traefik.http.routers.zigbee2mqtt-secured.tls.certresolver=letsencrypt
      - traefik.http.routers.zigbee2mqtt-secured.middlewares=hsts@file,ipwhitelist@file,authelia@docker

  mosquitto:
    image: eclipse-mosquitto:${MOSQUITTO_TAG:-latest}
    restart: unless-stopped
    volumes:
      - ./data/mosquitto/config:/mosquitto/config:ro
      - ./data/mosquitto/log:/mosquitto/log:rw
      - ./data/mosquitto/data:/mosquitto/data:rw
    networks:
      - default
      - web
    ports:
      - 1883:1883
      - 9001:9001

networks:
  web:
    external: true
  influxdb:
    external: true

# https://www.domoticz.com/wiki/PersistentUSBDevices
# sudo nano /etc/udev/rules.d/99-usb-serial.rules
# SUBSYSTEM=="tty", ATTRS{idVendor}=="1c1f", ATTRS{idProduct}=="0030", SYMLINK+="ttyUSB-ConbeeII"
# SUBSYSTEM=="tty", ATTRS{idVendor}=="0658", ATTRS{idProduct}=="0200", SYMLINK+="ttyUSB-ZStick-5G"
# SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6001", SYMLINK+="ttyUSB-DSRM"
# SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", SYMLINK+="ttyUSB-SonoffZigbee"