docker-compose.yml

# FrameComment Docker Compose Configuration
# Video Review & Approval Platform for Filmmakers
#
# Quick Start:
# 1. Copy .env.example to .env and configure your settings
# 2. Run: docker-compose up -d
# 3. Access: http://localhost:4321 (or your configured APP_PORT)
# 4. Login with your ADMIN_EMAIL and ADMIN_PASSWORD from .env
#
# Documentation: https://github.com/DragosOnisei/FrameComment

services:
  postgres:
    image: postgres:18-alpine
    container_name: framecomment-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-framecomment}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
      POSTGRES_DB: ${POSTGRES_DB:-framecomment}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C"
      # Postgres 18+ defaults PGDATA to /var/lib/postgresql/<major>/docker.
      # Pin it to the legacy path so existing /var/lib/postgresql/data mounts
      # keep working out of the box (matches our compose file).
      PGDATA: /var/lib/postgresql/data
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - framecomment-internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-framecomment}"]
      interval: 10s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true

  redis:
    image: redis:8-alpine
    container_name: framecomment-redis
    restart: unless-stopped
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
    volumes:
      - redis-data:/data
    networks:
      - framecomment-internal
    healthcheck:
      test: ["CMD", "redis-cli", "--no-auth-warning", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true

  app:
    image: dragosonisei/framecomment:latest
    container_name: framecomment-app
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      NODE_ENV: production
      TZ: ${TZ:-UTC}
      PUID: ${PUID:-1000}
      PGID: ${PGID:-1000}
      DATABASE_URL: postgresql://${POSTGRES_USER:-framecomment}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-framecomment}?schema=public
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      STORAGE_ROOT: /app/uploads
      ADMIN_EMAIL: ${ADMIN_EMAIL:?ADMIN_EMAIL is required in .env file}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?ADMIN_PASSWORD is required in .env file}
      ADMIN_NAME: ${ADMIN_NAME:-Admin}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:?ENCRYPTION_KEY is required}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:?JWT_REFRESH_SECRET is required}
      SHARE_TOKEN_SECRET: ${SHARE_TOKEN_SECRET:?SHARE_TOKEN_SECRET is required}
      HTTPS_ENABLED: ${HTTPS_ENABLED:-false}
      # S3-compatible storage (optional, default: local)
      STORAGE_PROVIDER: ${STORAGE_PROVIDER:-local}
      S3_ENDPOINT: ${S3_ENDPOINT:-}
      S3_BUCKET: ${S3_BUCKET:-}
      S3_REGION: ${S3_REGION:-us-east-1}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-}
    ports:
      - "${APP_PORT:-4321}:4321"
    volumes:
      - uploads:/app/uploads
    networks:
      - framecomment-internal
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:4321/api/health', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})\""]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 5m

  worker:
    image: dragosonisei/framecomment:latest
    container_name: framecomment-worker
    restart: unless-stopped
    command: npm run worker
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      app:
        condition: service_healthy
    environment:
      NODE_ENV: production
      TZ: ${TZ:-UTC}
      PUID: ${PUID:-1000}
      PGID: ${PGID:-1000}
      # DEBUG_WORKER: "true"  # Uncomment for verbose FFmpeg and worker debug logs
      DATABASE_URL: postgresql://${POSTGRES_USER:-framecomment}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-framecomment}?schema=public
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      STORAGE_ROOT: /app/uploads
      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
      JWT_SECRET: ${JWT_SECRET}
      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET}
      # S3-compatible storage (must match app service)
      STORAGE_PROVIDER: ${STORAGE_PROVIDER:-local}
      S3_ENDPOINT: ${S3_ENDPOINT:-}
      S3_BUCKET: ${S3_BUCKET:-}
      S3_REGION: ${S3_REGION:-us-east-1}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-}
    volumes:
      - uploads:/app/uploads
    networks:
      - framecomment-internal
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "ps aux | grep -v grep | grep -q 'npm run worker' || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 6m

volumes:
  postgres-data:
    driver: local
  redis-data:
    driver: local
  uploads:
    driver: local

networks:
  framecomment-internal:
    driver: bridge