# Amberwave – ready-made image. Start: docker compose up -d · Update: docker compose pull && docker compose up -d
# Settings: .env next to this file (template .env.example). Build it yourself instead of the image: docker-compose.build.yml
services:
  db:
    image: mariadb:11
    container_name: ${STACK_NAME:-amberwave}_db
    restart: unless-stopped
    environment:
      # Not set up yet: enter nothing. The database starts with root access only (no password, only in the internal stack network –
      # the port is not published). The setup page creates the database, user and passwords
      # (http://<server>:9950/einrichtung.php) and then gives root a random password.
      # Old/self-built: if DB_ROOT_PASSWORD / DB_NAME / DB_USER / DB_PASSWORD are set in the .env, they apply as before.
      MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: "1"
      MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:-}
      MARIADB_DATABASE: ${DB_NAME:-}
      MARIADB_USER: ${DB_USER:-}
      MARIADB_PASSWORD: ${DB_PASSWORD:-}
    # DB_PUFFER: memory MariaDB keeps for data and indexes (default 512M; for 100,000+ tracks 1G or more)
    command: ["--character-set-server=utf8mb4", "--collation-server=utf8mb4_unicode_ci", "--innodb-buffer-pool-size=${DB_PUFFER:-512M}"]
    volumes:
      # Database on the SSD: DB_DATA_PFAD, otherwise <APPDATA_PFAD>/db (Unraid e.g. /mnt/cache/appdata/amberwave/db)
      - ${DB_DATA_PFAD:-${APPDATA_PFAD:-.}/db}:/var/lib/mysql

  app:
    # Ready-made image with code (update: docker compose pull && docker compose up -d). Runs as PUID/PGID, never as root.
    image: ${AMBERWAVE_IMAGE:-ghcr.io/lfrank95/amberwave:beta}
    container_name: ${STACK_NAME:-amberwave}_app
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    pids_limit: ${APP_PIDS_LIMIT:-256}
    depends_on:
      - db
    # All settings come from the .env (on Unraid: “Edit Stack → ENV File”, located next to this file)
    env_file:
      - .env
    environment:
      DB_HOST: db
      # The folders on the server (host) as Compose resolved them – for the display “What Amberwave set”
      # and the folder check (inside the container Amberwave only sees /musik, /cache, /backups)
      HOST_MUSIK_PFAD: ${MUSIK_PFAD:-./musik}
      HOST_CACHE_PFAD: ${CACHE_PFAD:-${APPDATA_PFAD:-.}/cache}
      HOST_BACKUP_PFAD: ${BACKUP_PFAD:-${SICHERUNG_PFAD:-${APPDATA_PFAD:-.}/backups}}
      HOST_DB_DATA_PFAD: ${DB_DATA_PFAD:-${APPDATA_PFAD:-.}/db}
      HOST_DOWNLOAD_PFAD: ${DOWNLOAD_PFAD:-./downloads}
    volumes:
      # Music collection. Mounted writable, but Amberwave only writes once you allow it in the app
      # (Settings → Library → Music folder). Hard protection: MUSIK_MOUNT_MODUS=ro.
      - ${MUSIK_PFAD:-./musik}:${PFAD_MUSIK:-/musik}:${MUSIK_MOUNT_MODUS:-rw}
      # Finished downloads from SABnzbd (folder of the music category, e.g. /mnt/user/downloads/complete/music).
      # Writable so that Amberwave can delete the original after the import; DOWNLOAD_MOUNT_MODUS=ro = source stays untouched.
      - ${DOWNLOAD_PFAD:-./downloads}:${PFAD_DOWNLOADS:-/downloads}:${DOWNLOAD_MOUNT_MODUS:-rw}
      # Covers, artist images, thumbnails on the SSD (Unraid e.g. /mnt/cache/appdata/amberwave/cache)
      - ${CACHE_PFAD:-${APPDATA_PFAD:-.}/cache}:${PFAD_CACHE:-/cache}
      # Backup before every update (only ever the latest one): BACKUP_PFAD, otherwise SICHERUNG_PFAD, otherwise <APPDATA_PFAD>/backups
      - ${BACKUP_PFAD:-${SICHERUNG_PFAD:-${APPDATA_PFAD:-.}/backups}}:${PFAD_BACKUPS:-/backups}
    ports:
      - "${APP_BIND:-0.0.0.0}:${APP_PORT:-9950}:80"
      # Direct access on the home network (HTTPS with your own Let's Encrypt certificate) – LAN only, no router port forwarding needed
      - "${APP_BIND:-0.0.0.0}:${LOKAL_HTTPS_PORT:-8443}:8443"

  # On the go: Cloudflare Tunnel (cloudflared, Apache-2.0). Amberwave creates the tunnel under Settings › Access & network
  # and writes the token to <CACHE_PFAD>/tunnel/token – until then this container keeps restarting (harmless).
  # No open port on the router needed. TUNNEL_IM_STACK=0 in the .env = no container of its own (an existing
  # cloudflared is reused). Cloudflare terms of use: https://www.cloudflare.com/terms/
  tunnel:
    image: cloudflare/cloudflared:${TUNNEL_IMAGE_TAG:-latest}
    container_name: ${STACK_NAME:-amberwave}_tunnel
    restart: unless-stopped
    deploy:
      replicas: ${TUNNEL_IM_STACK:-1}
    user: "${PUID:-99}:${PGID:-100}"
    command: ["tunnel", "--no-autoupdate", "run", "--token-file", "/tunnel/token"]
    security_opt:
      - no-new-privileges:true
    depends_on:
      - app
    volumes:
      - ${CACHE_PFAD:-${APPDATA_PFAD:-.}/cache}/tunnel:/tunnel:ro