docker-compose-torrent.yml

name: torrent

x-healthcheck-defaults: &healthcheck-defaults
  interval: 60s
  retries: 5
  start_period: 30s
  timeout: 10s

x-limit-downloaders: &limit-downloaders
  deploy:
    resources:
      limits:
        memory: ${DOWNLOADERS_MEMORY}
        cpus: "${DOWNLOADERS_CPUS}"

secrets:
  # qBittorrent's username/password, owned here since qbittorrent is the
  # service that issues them (qbittorrent itself never reads the password
  # from env, but the value is generated/rotated alongside this service).
  # qbittorrent_exporter (docker-compose-observability.yml) and homepage
  # (docker-compose-proxy.yml) each declare an identical copy of this block so
  # every file resolves it standalone; see docs/COMPOSE_CONVENTIONS.md. Keep
  # the `file:` paths identical across all three, compose does not detect a
  # mismatch, it silently uses whichever declaration was included last.
  qbittorrent_username:
    file: ./configs/qbittorrent/secrets/username.txt
    x-podman.relabel: z
  qbittorrent_password:
    file: ./configs/qbittorrent/secrets/password.txt
    x-podman.relabel: z
  # Consumed only by jdownloader2 itself (single consumer, no duplicate
  # needed elsewhere), via patches/jdownloader2/10-webauth.sh.
  jdownloader2_username:
    file: ./configs/jdownloader2/secrets/username.txt
    x-podman.relabel: z
  jdownloader2_password:
    file: ./configs/jdownloader2/secrets/password.txt
    x-podman.relabel: z

services:
  qbittorrent:
    <<: *limit-downloaders
    image: docker.io/linuxserver/qbittorrent:${QBITTORRENT_VERSION}
    container_name: ${CONTAINER_PREFIX}qbittorrent
    depends_on:
      ${VPN_PROVIDER}:
        condition: service_healthy
        restart: true
    profiles: ["${QBITTORRENT_PROFILE}"]
    network_mode: container:${CONTAINER_PREFIX}${VPN_PROVIDER}
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    env_file:
      [
        "${CONFIG_FOLDER}/qbittorrent/.env",
        "${CONFIG_FOLDER}/qbittorrent/.env.secrets",
      ]
    environment:
      [
        "PGID=${QBITTORRENT_GID}",
        "PUID=${QBITTORRENT_UID}",
        "UMASK=${UMASK}",
        "TZ=${TIMEZONE}",
        "WEBUI_PORT=${QBITTORRENT_HTTPS_PORT}",
      ]
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${CERTIFICATES_FOLDER}:/certs:ro,z
      - ${CONFIG_FOLDER}/qbittorrent/config:/config:z
      - ${TORRENTS_FOLDER}:/data/torrents${DATA_VOLUME_FLAGS}
    healthcheck:
      <<: *healthcheck-defaults
      test: curl --fail --insecure https://${GLUETUN_SERVICES_IP}:${QBITTORRENT_HTTPS_PORT}/ || exit 1
  jdownloader2:
    <<: *limit-downloaders
    image: docker.io/jlesage/jdownloader-2:${JDOWNLOADER2_VERSION}
    container_name: ${CONTAINER_PREFIX}jdownloader2
    depends_on:
      ${VPN_PROVIDER}:
        condition: service_healthy
        restart: true
    profiles: ["${JDOWNLOADER2_PROFILE}"]
    network_mode: container:${CONTAINER_PREFIX}${VPN_PROVIDER}
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    env_file:
      [
        "${CONFIG_FOLDER}/jdownloader2/.env",
        "${CONFIG_FOLDER}/jdownloader2/.env.secrets",
      ]
    environment:
      ["USER_ID=${JDOWNLOADER2_UID}", "GROUP_ID=${JDOWNLOADER2_GID}", "TZ=${TIMEZONE}"]
    # This image's own Docker-secrets support (CONT_ENV_<VAR>, documented for
    # jlesage/docker-baseimage) does not work: its Dockerfile pre-declares
    # WEB_AUTHENTICATION_USERNAME/PASSWORD as empty-string env vars, and the
    # loader in /init only sets a variable if it is currently *unset*, so it
    # always finds them already "set" (to "") and silently skips loading the
    # secret (confirmed by source inspection and a live rotation test; same
    # root cause as https://github.com/htpcBeginner/docker-traefik/issues/69,
    # closed "not planned"). patches/jdownloader2/10-webauth.sh replaces the
    # image's own cont-init.d script with one that reads the mounted secret
    # files directly instead. See docs/COMPOSE_CONVENTIONS.md.
    secrets: [jdownloader2_username, jdownloader2_password]
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${CONFIG_FOLDER}/jdownloader2/config:/config:z
      - ${DOWNLOADS_FOLDER}:/data/downloads${DATA_VOLUME_FLAGS}
      - ./patches/jdownloader2/10-webauth.sh:/etc/cont-init.d/10-webauth.sh:ro,z
    healthcheck:
      <<: *healthcheck-defaults
      # SECURE_CONNECTION=1 serves the web UI over https with a self-signed
      # certificate; the login portal answers unauthenticated requests.
      test: curl --fail --silent --insecure https://127.0.0.1:${JDOWNLOADER2_HTTP_PORT}/ || exit 1