name: allstarr

services:
  postgres:
    image: postgres:18.4-alpine3.23@sha256:996d0920e4ff9df1fc19dacb904492f3c1ec0ec1cc338f0ad7123be7731c5f5e
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-allstarr}
      POSTGRES_USER: ${POSTGRES_USER:-allstarr}
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
    secrets:
      - postgres_password
    volumes:
      - postgres-data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 20s
    networks:
      - allstarr
    security_opt:
      - no-new-privileges:true

  valkey:
    image: valkey/valkey:8.1.8-alpine3.23@sha256:cfe71288f087704b06be45e270afa7a2abbf820093d6b11a23762081f5ff321d
    restart: unless-stopped
    command:
      - valkey-server
      - --maxmemory
      - ${VALKEY_MAX_MEMORY:-512mb}
      - --maxmemory-policy
      - allkeys-lru
      - --save
      - "60"
      - "1"
      - --appendonly
      - "yes"
    volumes:
      - valkey-data:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 10
      start_period: 10s
    networks:
      - allstarr
    security_opt:
      - no-new-privileges:true

  allstarr:
    image: ${ALLSTARR_IMAGE:-ghcr.io/sopat712/allstarr:3.0.0-beta.1}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
    ports:
      - ${PROXY_BIND_ADDRESS:-0.0.0.0}:${PROXY_PORT:-5274}:8080
      - ${ADMIN_BIND_ADDRESS:-127.0.0.1}:${ADMIN_PORT:-5275}:5275
    extra_hosts:
      - host.docker.internal:host-gateway
    environment:
      ASPNETCORE_ENVIRONMENT: Production
      Backend__Type: ${BACKEND_TYPE:-Subsonic}
      Admin__BindAnyIp: ${ADMIN_BIND_ANY_IP:-false}
      Admin__TrustedSubnets: ${ADMIN_TRUSTED_SUBNETS:-}
      Admin__Containerized: "true"
      Admin__ContainerGateway: auto

      Storage__Provider: Postgres
      Storage__ConnectionString: Host=postgres;Port=5432;Database=${POSTGRES_DB:-allstarr};Username=${POSTGRES_USER:-allstarr};Include Error Detail=false
      Storage__PasswordFile: /run/secrets/postgres_password
      Storage__AutoMigrate: ${STORAGE_AUTO_MIGRATE:-true}
      Storage__BackupDirectory: /app/state/backups
      Storage__EnforceMutationGuard: "true"
      Secrets__KeyRingPath: /run/secrets/allstarr_keyring
      Identity__Mode: ${ALLSTARR_MULTI_USER_MODE:-Hybrid}
      Identity__BackendInstanceId: ${ALLSTARR_BACKEND_INSTANCE_ID:-primary}
      ProviderAccounts__ManagementMode: ${ALLSTARR_PROVIDER_ACCOUNT_MANAGEMENT_MODE:-Hybrid}
      Readiness__RequireSecretKeyRing: "true"
      Readiness__RequiredDirectories__0: /app/state
      Readiness__RequiredDirectories__1: /app/downloads
      Readiness__RequiredDirectories__2: /app/kept

      Redis__ConnectionString: valkey:6379
      Redis__Enabled: ${REDIS_ENABLED:-true}
      Subsonic__Url: ${SUBSONIC_URL:-http://host.docker.internal:4533}
      Subsonic__EnableExternalPlaylists: ${ENABLE_EXTERNAL_PLAYLISTS:-true}
      Jellyfin__Url: ${JELLYFIN_URL:-http://host.docker.internal:8096}
      Jellyfin__ApiKey: ${JELLYFIN_API_KEY:-}
      Jellyfin__UserId: ${JELLYFIN_USER_ID:-}
      Jellyfin__LibraryId: ${JELLYFIN_LIBRARY_ID:-}

      Library__DownloadPath: /app/downloads
      Library__KeptPath: /app/kept
      Cache__GenreDirectory: /app/cache/genres
      Extensions__Directory: /app/state/extensions
      Admin__SessionStorePath: /app/state/admin-sessions.protected
      Diagnostics__EndpointUsageDirectory: /app/state/endpoint-usage

      SpotifyApi__Enabled: ${SPOTIFY_API_ENABLED:-false}
      SpotifyApi__SessionCookie: ${SPOTIFY_API_SESSION_COOKIE:-}
      SpotifyImport__Enabled: ${SPOTIFY_IMPORT_ENABLED:-false}
      SpotifyImport__Playlists: ${SPOTIFY_IMPORT_PLAYLISTS:-}
      Deezer__Arl: ${DEEZER_ARL:-}
      Qobuz__UserAuthToken: ${QOBUZ_USER_AUTH_TOKEN:-}
      Qobuz__UserId: ${QOBUZ_USER_ID:-}
      MusicBrainz__Enabled: ${MUSICBRAINZ_ENABLED:-true}
      Scrobbling__Enabled: ${SCROBBLING_ENABLED:-false}
      Debug__LogAllRequests: ${DEBUG_LOG_ALL_REQUESTS:-false}
    secrets:
      - postgres_password
      - allstarr_keyring
    volumes:
      - allstarr-state:/app/state
      - allstarr-cache:/app/cache
      - ${DOWNLOAD_PATH:-./downloads}:/app/downloads
      - ${KEPT_PATH:-./kept}:/app/kept
      - ${ALLSTARR_ENV_FILE:-./.env}:/app/.env
    tmpfs:
      - /tmp:size=128m,mode=1777
    healthcheck:
      test: ["CMD", "curl", "--fail", "--silent", "http://localhost:8080/health/ready"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    stop_grace_period: 45s
    networks:
      - allstarr
    security_opt:
      - no-new-privileges:true

secrets:
  postgres_password:
    file: ${POSTGRES_PASSWORD_FILE:-./secrets/postgres-password.txt}
  allstarr_keyring:
    file: ${ALLSTARR_KEYRING_FILE:-./secrets/allstarr-keyring.json}

volumes:
  postgres-data:
  valkey-data:
  allstarr-state:
  allstarr-cache:

networks:
  allstarr:
    driver: bridge