Initial commit

docker/docker-compose.prod.yml

@@ -0,0 +1,68 @@
+# Production template for Unraid. Deployment root per the project spec is
+# /mnt/tank/appdata/notizarr — this file is meant to be COPIED there as
+# docker-compose.yml, alongside a real .env (see ../.env.example), so that
+# ./postgres, ./app, ./backups, ./logs resolve relative to that directory.
+# See docs/phase1/06-docker-unraid-design.md and 07-folder-structure.md.
+#
+# Both variable interpolation (${POSTGRES_USER}, ...) and the container's
+# env_file expect a .env file in the SAME DIRECTORY as this compose file.
+#
+# Two ways to run this:
+#   1. Local prod-like test from a repo checkout: copy ../.env.example to
+#      docker/.env, fill it in, then from docker/:
+#        docker compose -f docker-compose.prod.yml up -d --build
+#   2. Real Unraid deployment: build+tag the image (or let step 1 build it),
+#      then copy this file AND a filled-in .env to
+#      /mnt/tank/appdata/notizarr/ (as docker-compose.yml + .env), and from
+#      that directory: docker compose up -d
+
+services:
+  notizarr-postgres:
+    image: postgres:16-alpine
+    container_name: notizarr-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+    volumes:
+      - ./postgres:/var/lib/postgresql/data
+    networks: [notizarr_internal]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  notizarr:
+    build:
+      context: ..
+      dockerfile: apps/server/Dockerfile
+      target: runtime
+    image: ${NOTIZARR_IMAGE:-notizarr:latest}
+    container_name: notizarr
+    restart: unless-stopped
+    depends_on:
+      notizarr-postgres:
+        condition: service_healthy
+    env_file: .env
+    environment:
+      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@notizarr-postgres:5432/${POSTGRES_DB}
+    ports:
+      # BIND_ADDR_INGEST defaults to 127.0.0.1 on purpose — see .env.example
+      # and docs/phase1/02-threat-model.md. Set it to your LAN IP to let LAN
+      # devices publish; never 0.0.0.0 on a host with any WAN exposure.
+      - "${BIND_ADDR_WEB:-0.0.0.0}:${PORT_WEB:-8080}:8080"
+      - "${BIND_ADDR_INGEST:-127.0.0.1}:${PORT_INGEST:-8081}:8081"
+    volumes:
+      - ./app:/data
+    networks: [notizarr_internal]
+    healthcheck:
+      test: ["CMD", "node", "healthcheck.js"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+
+networks:
+  notizarr_internal: