services:

  postgres:
    image: postgres:18
    restart: always
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      PGDATA: /var/lib/postgresql/data
    volumes:
      - db_storage:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -h localhost -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10

  n8n:
    image: n8nio/n8n:2.37.10 # keep the version up to date, use only stable releases
    restart: always
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "0.0.0.0:6789:6789" # reachable from whole network, change to "127.0.0.1:6789:6789" if you want to make n8n reachable only from localhost
    extra_hosts:
      - "host.docker.internal:host-gateway" 
    environment:
      N8N_PORT: "6789"
      N8N_PROTOCOL: https
      N8N_SSL_CERT: /certs/flowkit.crt
      N8N_SSL_KEY: /certs/flowkit.key
      N8N_HOST: flowkit.local # or your LAN IP/hostname, no public domain needed
      WEBHOOK_URL: https://flowkit.local:6789/
      N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: "true"
      NODE_ENV: production
      GENERIC_TIMEZONE: ${GENERIC_TIMEZONE}
      TZ: ${GENERIC_TIMEZONE}

      DB_TYPE: postgresdb
      DB_POSTGRESDB_HOST: postgres
      DB_POSTGRESDB_PORT: "5432"
      DB_POSTGRESDB_DATABASE: ${POSTGRES_DB}
      DB_POSTGRESDB_USER: ${POSTGRES_USER}
      DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD}

      N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
      N8N_RESTRICT_FILE_ACCESS_TO: /files
    volumes:
      - n8n_data:/home/node/.n8n
      - ../local-files:/files
      - ../certs:/certs:ro
      - ../workflows:/backup/workflows
      - ../credentials:/backup/credentials

volumes:
  n8n_data:
  db_storage: