services:
  # WireGuard VPN-Exit -> Hetzner wg2 (dedizierter Tunnel). SABnzbd teilt diesen Netzstack,
  # damit der gesamte Usenet-Traffic ueber die Hetzner-IP rausgeht.
  wireguard:
    image: lscr.io/linuxserver/wireguard:latest
    container_name: sabnzbd-wg
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Berlin
    volumes:
      - /app-config/sabnzbd/wg:/config
      - /lib/modules:/lib/modules:ro
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    ports:
      - 7777:7777          # SABnzbd-WebUI laeuft im Netzstack dieses Containers
    healthcheck:
      test: ["CMD-SHELL", "wg show wg0 | grep -q 'latest handshake' || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    restart: unless-stopped

  sabnzbd:
    image: lscr.io/linuxserver/sabnzbd:latest
    container_name: sabnzbd
    network_mode: "service:wireguard"
    depends_on:
      wireguard:
        condition: service_healthy
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Berlin
    volumes:
      - /app-config/sabnzbd/config:/config
      - usenet:/usenet
      - tdarr:/tdarr
      - chris:/chris
      - /mnt/media:/data
    restart: unless-stopped

volumes:
  usenet:
    name: tdarr_usenet
    driver: local
    driver_opts:
      device: :/usenet
      o: addr=10.2.1.1,nolock,hard,rw
      type: nfs
  tdarr:
    name: tdarr
    driver: local
    driver_opts:
      device: :/tdarr
      o: addr=10.2.1.1,nolock,hard,rw
      type: nfs
  chris:
    name: chris_data
    driver: local
    driver_opts:
      device: :/chris
      o: addr=10.7.1.106,nolock,hard,rw
      type: nfs