name: search

networks:
  services:
    name: services
    external: true

services:
  gluetun:
    image: qmcgaw/gluetun:latest
    restart: unless-stopped
    logging:
      options:
        max-size: 200m
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    networks:
      - services
    ports:
      # so yacy nodes can hit the server
      - 8090:8090
      # so yacy nodes can hit the server via ssl
      - 8443:8443
    volumes:
      - /var/search/gluetun/auth-control-server.toml:/gluetun/auth-control-server.toml:ro
    labels:
      # generic
      - diun.enable=true
      - traefik.enable=true
      # web services
      - traefik.http.routers.yacy.service=yacy
      - traefik.http.services.yacy.loadbalancer.server.port=8090
      - traefik.http.routers.searxng.service=searxng
      - traefik.http.services.searxng.loadbalancer.server.port=8080
      # http
      - "traefik.http.routers.yacy_insecure.entrypoints=web"
      - "traefik.http.routers.yacy_insecure.rule=Host(`yacy.domain.tld`)"
      - "traefik.http.routers.yacy_insecure.middlewares=redirect@file"
      - "traefik.http.routers.searxng_insecure.entrypoints=web"
      - "traefik.http.routers.searxng_insecure.rule=Host(`searxng.domain.tld`)"
      - "traefik.http.routers.searxng_insecure.middlewares=redirect@file"
      # ssl
      - traefik.http.routers.yacy.tls=true
      - "traefik.http.routers.yacy.tls.certresolver=letsencrypt"
      - traefik.http.routers.searxng.tls
      - "traefik.http.routers.searxng.tls.certresolver=letsencrypt"
      # https
      - "traefik.http.routers.yacy.entrypoints=web-secure"
      - "traefik.http.routers.yacy.rule=Host(`yacy.domain.tld`)"
      - "traefik.http.routers.searxng.entrypoints=web-secure"
      - "traefik.http.routers.searxng.rule=Host(`searxng.domain.tld`)"
    environment:
      # api auth
      - HTTP_CONTROL_SERVER_AUTH_CONFIG_FILEPATH=/gluetun/auth-control-server.toml
      # dns
      #- DNS_UPSTREAM_RESOLVERS=google,cloudflare
      #- DNS_UPSTREAM_IPV6=off
      #- DNS_UPSTREAM_RESOLVER_TYPE=doh
      - BLOCK_MALICIOUS=on
      - BLOCK_SURVEILLANCE=on
      # proton vpn
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY="super_secret"
      - SERVER_COUNTRIES=Switzerland
      - UPDATER_PERIOD=24h
      # port forwarding
      #- VPN_PORT_FORWARDING=on
      #- PORT_FORWARD_ONLY=on
      #- VPN_PORT_FORWARDING=on
      # see gluetun docs -- this is essentially a 'cheat' to just forward along to a backend, static port
      # gluetun docs use a web server on port 80 as an example. yacy is pretty much the same @ port 8090
      #- VPN_PORT_FORWARDING_LISTENING_PORT=8090
  yacy:
    image: yacy/yacy_search_server:latest
    restart: unless-stopped
    logging:
      options:
        max-size: 200m
    network_mode: service:gluetun
    volumes:
      - /var/search/yacy/DATA:/opt/yacy_search_server/DATA
    labels:
      - diun.enable=true
      - traefik.enable=false
  searxng:
    image: docker.io/searxng/searxng:latest
    restart: unless-stopped
    logging:
      options:
        max-size: 200m
    network_mode: service:gluetun
    volumes:
      - /var/search/searxng/config/:/etc/searxng/
      - /var/search/searxng/data/:/var/cache/searxng/
    labels:
      - diun.enable=true
      - traefik.enable=false