docker-compose.yml

# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
# Shared fragments (YAML anchors)
# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

x-logging: &default-logging
  driver: "json-file"
  options:
    max-size: "50m"
    max-file: "5"

x-backend-env: &backend-env
  TZ: ${TZ:-Asia/Taipei}
  PUID: ${PUID:-1042}
  PGID: ${PGID:-1042}
  DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-vault}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-vault}

x-backend-depends: &backend-depends
  postgres:
    condition: service_healthy
  redis:
    condition: service_healthy

# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

services:
  nginx:
    build: ./nginx
    ports:
      - "${HTTP_PORT:-35689}:80"
    environment:
      - NGINX_CLIENT_MAX_BODY_SIZE=${NGINX_CLIENT_MAX_BODY_SIZE:-100m}
    volumes:
      - app_data:/data:ro
    depends_on:
      api:
        condition: service_healthy
      pwa:
        condition: service_healthy
    networks:
      - frontend
    security_opt: ["no-new-privileges:true"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1/nginx-health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 256M
        reservations:
          memory: 128M
    logging: *default-logging

  api:
    build:
      context: ./backend
      args:
        APP_VERSION: ${APP_VERSION:-dev}
    command: uvicorn main:app --host 0.0.0.0 --port 8000 --proxy-headers --forwarded-allow-ips='172.16.0.0/12,192.168.0.0/16,10.0.0.0/8'
    # user: managed by entrypoint.sh via gosu (PUID/PGID, default 1042:1042)
    stop_grace_period: 30s
    environment:
      <<: *backend-env
    env_file: "${JYZROX_ENV_FILE:-.env}"
    volumes:
      - app_data:/data
      - ./config/gallery-dl:/home/appuser/.config/gallery-dl
      - gallery_dl_venv:/opt/gallery-dl:ro
    depends_on:
      <<: *backend-depends
    networks:
      - frontend
      - backend
    security_opt: ["no-new-privileges:true"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "wget -qO /dev/null http://localhost:8000/api/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          memory: 512M
    logging: *default-logging

  worker:
    build:
      context: ./backend
      args:
        APP_VERSION: ${APP_VERSION:-dev}
    command: python -m worker
    # user: managed by entrypoint.sh via gosu (PUID/PGID, default 1042:1042)
    stop_grace_period: 55s
    environment:
      <<: *backend-env
      WORKER_CONCURRENCY_INTERACTIVE: ${WORKER_CONCURRENCY_INTERACTIVE:-6}
      WORKER_CONCURRENCY_INGEST: ${WORKER_CONCURRENCY_INGEST:-4}
      WORKER_CONCURRENCY_RENDER: ${WORKER_CONCURRENCY_RENDER:-2}
    env_file: "${JYZROX_ENV_FILE:-.env}"
    volumes:
      - app_data:/data
      # host: chown 1042:1042 ./config/gallery-dl && chmod 750 ./config/gallery-dl
      - ./config/gallery-dl:/home/appuser/.config/gallery-dl
      - gallery_dl_venv:/opt/gallery-dl
    depends_on:
      <<: *backend-depends
    networks:
      - frontend
      - backend
    security_opt: ["no-new-privileges:true"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "python3 -c 'import os,signal; os.kill(1, 0)' || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          memory: 512M
    logging: *default-logging

  pwa:
    build:
      context: ./pwa
      args:
        APP_VERSION: ${APP_VERSION:-dev}
    environment:
      - TZ=${TZ:-Asia/Taipei}
      - NODE_ENV=production
      - NEXT_TELEMETRY_DISABLED=1
    depends_on:
      - api
    networks:
      - frontend
    security_opt: ["no-new-privileges:true"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 512M
        reservations:
          memory: 256M
    logging: *default-logging

  tagger:
    build: ./tagger
    environment:
      - TZ=${TZ:-Asia/Taipei}
      - TAG_MODEL_NAME=${TAG_MODEL_NAME:-SmilingWolf/wd-swinv2-tagger-v3}
      - ONNX_PROVIDERS=${ONNX_PROVIDERS:-CPUExecutionProvider}
    volumes:
      - app_data:/data:ro
      - tagger_models:/app/models
    networks:
      - backend
    security_opt: ["no-new-privileges:true"]
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "wget -qO /dev/null http://localhost:8100/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 3G
        reservations:
          memory: 1G
    profiles:
      - tagging
    logging: *default-logging

  postgres:
    image: postgres:18-alpine
    command: >
      postgres
      -c password_encryption=scram-sha-256
      -c log_connections=on
      -c log_disconnections=on
    env_file: "${JYZROX_ENV_FILE:-.env}"
    volumes:
      - postgres_data:/var/lib/postgresql
      - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER:-vault} -d $${POSTGRES_DB:-vault} && psql -U $${POSTGRES_USER:-vault} -d $${POSTGRES_DB:-vault} -c 'SELECT 1' -q -t"]
      interval: 30s
      timeout: 5s
      retries: 10
    networks:
      - backend
    security_opt: ["no-new-privileges:true"]
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          memory: 512M
    logging: *default-logging

  redis:
    image: redis:8-alpine
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD} --maxmemory ${REDIS_MAXMEMORY:-768mb} --maxmemory-policy allkeys-lru --auto-aof-rewrite-percentage 100 --auto-aof-rewrite-min-size 64mb
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "--no-auth-warning", "ping"]
      interval: 30s
      timeout: 3s
      retries: 5
    networks:
      - backend
    security_opt: ["no-new-privileges:true"]
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 1G
        reservations:
          memory: 256M
    logging: *default-logging

volumes:
  app_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${JYZROX_DATA_ROOT}/data
  postgres_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${JYZROX_DATA_ROOT}/postgres
  redis_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${JYZROX_DATA_ROOT}/redis
  tagger_models:
  gallery_dl_venv:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${JYZROX_DATA_ROOT}/gallery-dl-venv

networks:
  frontend:
    name: jyzrox_frontend
  backend:
    name: jyzrox_backend
    internal: true