# Production Docker Compose - Uses pre-built images from Docker Hub
# Use this when you want to run VibeNVR without building from source

services:
  frontend:
    image: spupuz/vibenvr-frontend:latest
    container_name: vibenvr-frontend
    ports:
      - "${VIBENVR_FRONTEND_PORT:-8080}:80"
    volumes:
      - ${VIBENVR_DATA:-vibenvr_data}:/data
    networks:
      - vibe-network
    environment:
      - TZ=${TZ:-Europe/Rome}
    depends_on:
      - backend
    restart: always
    init: true
    privileged: false # Set to true for Proxmox/OMV/LXC if you see permission errors

  backend:
    image: spupuz/vibenvr-backend:latest
    container_name: vibenvr-backend
    privileged: false # Set to true for Proxmox/OMV/LXC if you see permission errors
    ports:
      - "${VIBENVR_BACKEND_PORT:-5005}:5000"
    volumes:
      - ${VIBENVR_DATA:-vibenvr_data}:/data
      # Custom Storage Profiles (uncomment to enable)
      # - ${VIBENVR_STORAGE_SSD}:/storage/ssd
      # - ${VIBENVR_STORAGE_NAS}:/storage/nas
      # - /etc/localtime:/etc/localtime:ro # Removed for cross-platform compatibility, use TZ

    environment:
      - POSTGRES_USER=${POSTGRES_USER:-vibenvr}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-vibenvrpass}
      - POSTGRES_DB=${POSTGRES_DB:-vibenvr}
      - DATABASE_URL=postgresql://${POSTGRES_USER:-vibenvr}:${POSTGRES_PASSWORD:-vibenvrpass}@db:5432/${POSTGRES_DB:-vibenvr}
      - TZ=${TZ:-Europe/Rome}
      - SECRET_KEY=${SECRET_KEY:-vibe_secure_key_9823748923748923_change_in_prod}
      - WEBHOOK_SECRET=${WEBHOOK_SECRET:-vibe_secure_key_9823748923748923_change_in_prod}
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-}
      - COOKIE_SECURE=${COOKIE_SECURE:-auto}
    depends_on:
      db:
        condition: service_healthy
      engine:
        condition: service_started
    restart: always
    init: true
    entrypoint: [ "/bin/sh", "./entrypoint.sh" ]
    stop_grace_period: 30s
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "com.centurylinklabs.watchtower.depends-on=engine,db"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - vibe-network
    # ─────────────────────────────────────────────────────────────────────────
    # TROUBLESHOOTING: Permission Errors on Proxmox/PVE Kernel, Synology, QNAP
    # ─────────────────────────────────────────────────────────────────────────
    # If you see errors like "PermissionError: [Errno 13] Permission denied"
    # or "could not create Unix socket", try these options in order:
    #
    # Option 1: Disable seccomp and AppArmor
    # security_opt:
    #   - seccomp:unconfined
    #   - apparmor:unconfined
    #
    # Option 2: If Option 1 doesn't work, use privileged mode
    # privileged: true
    # ─────────────────────────────────────────────────────────────────────────

  engine:
    image: spupuz/vibenvr-engine:latest
    container_name: vibenvr-engine
    # Security: engine API is internal only — no host port exposure.
    # Backend communicates via Docker DNS: http://engine:8000
    # Uncomment ONLY for local debugging:
    # ports:
    #   - "5001:8000"
    expose:
      - "8000"
    volumes:
      - ${VIBENVR_DATA:-vibenvr_data}:/var/lib/vibe/recordings
      # Custom Storage Profiles (uncomment to enable)
      # - ${VIBENVR_STORAGE_SSD}:/storage/ssd
      # - ${VIBENVR_STORAGE_NAS}:/storage/nas
      # - /etc/localtime:/etc/localtime:ro # Removed for cross-platform compatibility, use TZ

    environment:
      - BACKEND_URL=http://vibenvr-backend:5000
      - TZ=${TZ:-Europe/Rome}
      # Hardware Acceleration Settings
      - HW_ACCEL=true # Enabled for local GPU usage
      - HW_ACCEL_TYPE=${HW_ACCEL_TYPE:-auto} # auto, nvidia, intel, amd
      - WEBHOOK_SECRET=${WEBHOOK_SECRET:-vibe_secure_key_9823748923748923_change_in_prod}
    # GPU Device Passthrough (uncomment what applies to your system)
    # For Intel/AMD (VAAPI) on Linux:
    devices:
      - /dev/dri:/dev/dri
    # For NVIDIA (requires nvidia-container-toolkit):
    # deploy:
    #   resources:
    #     reservations:
    #       devices:
    #         - driver: nvidia
    #           count: 1
    #           capabilities: [gpu]
    
    # Coral TPU / USB Devices:
    # Note: 'privileged: true' provides access to all host devices (/dev/bus/usb, etc).
    # Hardcoding non-existent device paths in 'devices:' will cause startup failure.
    restart: always
    init: true
    shm_size: '512mb'
    entrypoint: [ "/bin/sh", "./entrypoint.sh" ]
    stop_grace_period: 30s
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "com.centurylinklabs.watchtower.depends-on=db"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    # Fix for Proxmox/pve kernel: socket.socketpair() Permission denied
    security_opt:
      - seccomp:unconfined
      - apparmor:unconfined
    privileged: true
    networks:
      - vibe-network
    # ─────────────────────────────────────────────────────────────────────────
    # TROUBLESHOOTING: Permission Errors on Proxmox/PVE Kernel, Synology, QNAP
    # ─────────────────────────────────────────────────────────────────────────
    # If you see errors like "PermissionError: [Errno 13] Permission denied"
    # or "socket.socketpair() Permission denied", try these options in order:
    #
    # Option 1: Disable seccomp and AppArmor
    # security_opt:
    #   - seccomp:unconfined
    #   - apparmor:unconfined
    #
    # Option 2: If Option 1 doesn't work, use privileged mode
    # privileged: true
    # ─────────────────────────────────────────────────────────────────────────

  db:
    image: postgres:15-alpine
    container_name: vibenvr-db
    restart: always
    init: true
    # Fix for Proxmox/pve kernel: Unix socket Permission denied
    # security_opt:
    #   - seccomp:unconfined
    #   - apparmor:unconfined
    # privileged: true
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-vibenvr}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-vibenvrpass}
      - POSTGRES_DB=${POSTGRES_DB:-vibenvr}
      - TZ=${TZ:-Europe/Rome}
    volumes:
      - ${VIBENVR_DB_DATA:-vibenvr_db_data}:/var/lib/postgresql/data
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U $${POSTGRES_USER:-vibenvr}" ]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 30s
    networks:
      - vibe-network
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    # ─────────────────────────────────────────────────────────────────────────
    # TROUBLESHOOTING: Permission Errors on Proxmox/PVE Kernel, Synology, QNAP
    # ─────────────────────────────────────────────────────────────────────────
    # If you see errors like "could not create Unix socket" or
    # "could not create any Unix-domain sockets", try these options in order:
    #
    # Option 1: Disable seccomp and AppArmor
    # security_opt:
    #   - seccomp:unconfined
    #   - apparmor:unconfined
    #
    # Option 2: If Option 1 doesn't work, use privileged mode
    # privileged: true
    # ─────────────────────────────────────────────────────────────────────────


volumes:
  vibenvr_data:
  vibenvr_db_data:


networks:
  vibe-network:
    driver: bridge