# Tracearr - PostgreSQL 18 Deployment (Experimental)
#
# WARNING: NEW INSTALLATIONS ONLY
# Do NOT use with existing data volumes. PostgreSQL 18 data format is
# incompatible with PostgreSQL 15/16. Delete or rename old volumes first.
#
# Uses PostgreSQL 18 with TimescaleDB HA image (includes Toolkit extension).
#
# REQUIREMENTS:
#   - ~1GB RAM for Tracearr container
#   - Secrets must be generated manually (see below)
#
# DEPLOY:
#   # 1. Generate secrets
#   echo "JWT_SECRET=$(openssl rand -hex 32)" > .env
#   echo "COOKIE_SECRET=$(openssl rand -hex 32)" >> .env
#
#   # 2. Start
#   docker compose -f docker-compose.pg18.yml up -d
#
# OPTIONAL ENVIRONMENT VARIABLES:
#   PORT=3000              # Host port to publish on (the container always listens on 3000)
#   TZ=America/New_York    # Timezone
#   DB_PASSWORD=tracearr   # Database password
#   LOG_LEVEL=info         # Log level (debug, info, warn, error)

services:
  tracearr:
    image: ghcr.io/connorgallopo/tracearr:latest
    container_name: tracearr
    ports:
      - "${PORT:-3000}:3000"
    environment:
      - NODE_ENV=production
      - HOST=0.0.0.0
      - TZ=${TZ:-UTC}
      - DATABASE_URL=postgres://tracearr:${DB_PASSWORD:-tracearr}@timescale:5432/tracearr
      - REDIS_URL=redis://redis:6379
      - JWT_SECRET=${JWT_SECRET}
      - COOKIE_SECRET=${COOKIE_SECRET}
      # Other origins that may use a signed-in session; * only allows requests without one
      - CORS_ORIGIN=${CORS_ORIGIN:-*}
      # Behind a reverse proxy: true trusts one hop, 2 for two chained proxies, or proxy IPs/CIDRs
      # - TRUST_PROXY=true
      - LOG_LEVEL=${LOG_LEVEL:-info}
      # - DATABASE_POOL_MAX=50  # Database connection pool size (default: 50)
    depends_on:
      timescale:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - tracearr_backups:/data/backup
      - tracearr_images:/data/tracearr/image-cache
    restart: unless-stopped
    networks:
      - tracearr-network

  timescale:
    # TimescaleDB HA with PostgreSQL 18 - pinned for stability
    image: timescale/timescaledb-ha:pg18.4-ts2.29.1
    container_name: tracearr-db
    shm_size: 512mb  # Required for PostgreSQL shared memory (increase for large imports)
    ulimits:
      nofile:
        soft: 65536
        hard: 65536  # TimescaleDB chunks require many file descriptors
    # Cap tuple decompression per DML transaction (migrations and imports grant
    # themselves unlimited per-session, so this stays at the TimescaleDB default)
    # Increase lock table size for large imports (Tautulli imports with many TimescaleDB chunks)
    # max_connections 150 leaves headroom for multi-instance app pools; the app
    # sizes its pool from whatever postgres reports, so this is capacity, not tuning
    command: postgres -c timescaledb.license=timescale -c timescaledb.max_tuples_decompressed_per_dml_transaction=100000 -c max_locks_per_transaction=4096 -c timescaledb.telemetry_level=off -c max_connections=150
    environment:
      - POSTGRES_USER=tracearr
      - POSTGRES_PASSWORD=${DB_PASSWORD:-tracearr}
      - POSTGRES_DB=tracearr
    volumes:
      - timescale_data:/home/postgres/pgdata/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U tracearr"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - tracearr-network

  redis:
    image: redis:8-alpine
    container_name: tracearr-redis
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - tracearr-network

networks:
  tracearr-network:
    driver: bridge

volumes:
  tracearr_backups:
  tracearr_images:
  timescale_data:
  redis_data: