Initial commit

docker/docker-compose.prod.yml

@@ -0,0 +1,68 @@
+# Production template for Unraid. Deployment root per the project spec is
+# /mnt/tank/appdata/notizarr — this file is meant to be COPIED there as
+# docker-compose.yml, alongside a real .env (see ../.env.example), so that
+# ./postgres, ./app, ./backups, ./logs resolve relative to that directory.
+# See docs/phase1/06-docker-unraid-design.md and 07-folder-structure.md.
+#
+# Both variable interpolation (${POSTGRES_USER}, ...) and the container's
+# env_file expect a .env file in the SAME DIRECTORY as this compose file.
+#
+# Two ways to run this:
+#   1. Local prod-like test from a repo checkout: copy ../.env.example to
+#      docker/.env, fill it in, then from docker/:
+#        docker compose -f docker-compose.prod.yml up -d --build
+#   2. Real Unraid deployment: build+tag the image (or let step 1 build it),
+#      then copy this file AND a filled-in .env to
+#      /mnt/tank/appdata/notizarr/ (as docker-compose.yml + .env), and from
+#      that directory: docker compose up -d
+
+services:
+  notizarr-postgres:
+    image: postgres:16-alpine
+    container_name: notizarr-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+    volumes:
+      - ./postgres:/var/lib/postgresql/data
+    networks: [notizarr_internal]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  notizarr:
+    build:
+      context: ..
+      dockerfile: apps/server/Dockerfile
+      target: runtime
+    image: ${NOTIZARR_IMAGE:-notizarr:latest}
+    container_name: notizarr
+    restart: unless-stopped
+    depends_on:
+      notizarr-postgres:
+        condition: service_healthy
+    env_file: .env
+    environment:
+      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@notizarr-postgres:5432/${POSTGRES_DB}
+    ports:
+      # BIND_ADDR_INGEST defaults to 127.0.0.1 on purpose — see .env.example
+      # and docs/phase1/02-threat-model.md. Set it to your LAN IP to let LAN
+      # devices publish; never 0.0.0.0 on a host with any WAN exposure.
+      - "${BIND_ADDR_WEB:-0.0.0.0}:${PORT_WEB:-8080}:8080"
+      - "${BIND_ADDR_INGEST:-127.0.0.1}:${PORT_INGEST:-8081}:8081"
+    volumes:
+      - ./app:/data
+    networks: [notizarr_internal]
+    healthcheck:
+      test: ["CMD", "node", "healthcheck.js"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+
+networks:
+  notizarr_internal:

docker/docker-compose.yml

@@ -0,0 +1,87 @@
+# Dev stack: hot-reload container + Postgres, for local development on this
+# machine. NOT what gets deployed to Unraid — see docker-compose.prod.yml
+# and docs/phase1/06-docker-unraid-design.md for that.
+#
+# Run from the repo root:
+#   docker compose -f docker/docker-compose.yml up -d
+#
+# Reads a .env file from the repo root (Compose's default project
+# directory, since that's the CWD the command above is run from) — copy
+# .env.example to .env there and fill in real values first.
+#
+# Host ports are overridable (Unraid boxes commonly already have something
+# on 8080/5432) — e.g.:
+#   HOST_PORT_WEB=18080 HOST_PORT_INGEST=18081 HOST_PORT_PG=15432 \
+#     docker compose -f docker/docker-compose.yml up -d
+# or put those in the same .env file so you don't have to repeat them.
+#
+# IMPORTANT: whenever a package.json dependency changes, `--build` alone is
+# not enough — Compose reuses the OLD container's anonymous node_modules
+# volumes by default instead of repopulating them from the rebuilt image.
+# Use:
+#   docker compose -f docker/docker-compose.yml up -d --build --force-recreate -V
+# (-V / --renew-anon-volumes forces those volumes to be recreated from the
+# new image; it does not touch the named notizarr_dev_pgdata volume below.)
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    container_name: notizarr-postgres-dev
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-notizarr}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      POSTGRES_DB: ${POSTGRES_DB:-notizarr}
+    ports:
+      - "127.0.0.1:${HOST_PORT_PG:-15432}:5432"
+    volumes:
+      - notizarr_dev_pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-notizarr} -d ${POSTGRES_DB:-notizarr}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  notizarr:
+    build:
+      context: ..
+      dockerfile: apps/server/Dockerfile
+      target: dev
+    container_name: notizarr-dev
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      NODE_ENV: development
+      PORT_WEB: "8080"
+      PORT_INGEST: "8081"
+      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:?set PUBLIC_BASE_URL in .env}
+      DATABASE_URL: postgres://${POSTGRES_USER:-notizarr}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/${POSTGRES_DB:-notizarr}
+      LOG_LEVEL: ${LOG_LEVEL:-debug}
+      AUTH_MODE: ${AUTH_MODE:-disabled}
+      INGESTION_ALLOWED_CIDRS: ${INGESTION_ALLOWED_CIDRS:-0.0.0.0/0}
+      # Apple's push service (web.push.apple.com) rejects VAPID JWTs whose
+      # `sub` claim isn't a real mailto:/https: value with a 403 — the
+      # config.ts fallback (mailto:admin@localhost) trips exactly that.
+      VAPID_SUBJECT: ${VAPID_SUBJECT:?set VAPID_SUBJECT in .env}
+    ports:
+      - "${HOST_PORT_WEB:-18080}:8080"
+      - "${HOST_PORT_INGEST:-18081}:8081"
+    volumes:
+      - ..:/workspace
+      # Anonymous volumes over node_modules so the bind mount above doesn't
+      # shadow the dependencies installed into the image at build time.
+      - /workspace/node_modules
+      - /workspace/apps/server/node_modules
+      - /workspace/apps/web/node_modules
+      - /workspace/packages/shared/node_modules
+    healthcheck:
+      test: ["CMD", "node", "apps/server/healthcheck.js"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+
+volumes:
+  notizarr_dev_pgdata: