x-arcane:
  icon: bookorbit
  urls:
    - https://bookorbit.app/

services:
  app:
    image: ghcr.io/bookorbit/bookorbit:3.4.0@sha256:99539be044c94f10fa5fba616cb08e1b128deb4996c975d181a950818a8632e4
    container_name: bookorbit-app
    restart: unless-stopped
    init: true
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "3000:3000"
    environment:
      NODE_ENV: production
      PORT: "3000"
      APP_URL: https://books.kais.cloud
      CLIENT_URL: https://books.kais.cloud
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_USER: bookorbit
      POSTGRES_DB: bookorbit
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      JWT_SECRET_FILE: /run/secrets/jwt_secret
      PODCAST_ENCRYPTION_KEY_FILE: /run/secrets/podcast_encryption_key
      SETUP_BOOTSTRAP_TOKEN_FILE: /run/secrets/setup_bootstrap_token
      EMAIL_ENCRYPTION_KEY_FILE: /run/secrets/email_encryption_key
      MIGRATION_ENCRYPTION_KEY_FILE: /run/secrets/migration_encryption_key
      BOOK_REQUEST_ENCRYPTION_KEY_FILE: /run/secrets/book_request_encryption_key
      TZ: Asia/Shanghai
      PUID: "1000"
      PGID: "1000"
      NODE_MAX_OLD_SPACE_SIZE: "2048"
      BOOK_DOCK_PATH: /book-dock
      LIBRARY_BROWSE_ROOT: /books
      DISABLE_LOCAL_AUTH: "false"
    volumes:
      - type: bind
        source: /mnt/truenas/multimedia/books
        target: /books
        bind:
          create_host_path: false
      - type: bind
        source: /mnt/truenas/multimedia/curator/staging/bookorbit
        target: /book-dock
        bind:
          create_host_path: false
      - type: bind
        source: /opt/media-core/appdata/bookorbit/app
        target: /data
        bind:
          create_host_path: false
    secrets:
      - postgres_password
      - jwt_secret
      - podcast_encryption_key
      - setup_bootstrap_token
      - email_encryption_key
      - migration_encryption_key
      - book_request_encryption_key
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - const p=process.env.PORT||3000;fetch('http://127.0.0.1:'+p+'/api/v1/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 60s
    stop_grace_period: 30s
    labels:
      com.getarcaneapp.arcane.icon: bookorbit
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

  postgres:
    image: pgvector/pgvector:pg18@sha256:2358fcba361ed2233a5ed81b5fe4ca779ccb304120ce531a3bf51c0ed7e2bc11
    container_name: bookorbit-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: bookorbit
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      POSTGRES_DB: bookorbit
      PGDATA: /var/lib/postgresql/data/pgdata
      TZ: Asia/Shanghai
    volumes:
      - type: bind
        source: /opt/media-core/appdata/bookorbit/postgres
        target: /var/lib/postgresql/data
        bind:
          create_host_path: false
    secrets:
      - postgres_password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 60s
    labels:
      com.getarcaneapp.arcane.icon: postgres
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

secrets:
  postgres_password:
    file: /opt/media-core/appdata/bookorbit/secrets/postgres_password
  jwt_secret:
    file: /opt/media-core/appdata/bookorbit/secrets/jwt_secret
  podcast_encryption_key:
    file: /opt/media-core/appdata/bookorbit/secrets/podcast_encryption_key
  setup_bootstrap_token:
    file: /opt/media-core/appdata/bookorbit/secrets/setup_bootstrap_token
  email_encryption_key:
    file: /opt/media-core/appdata/bookorbit/secrets/email_encryption_key
  migration_encryption_key:
    file: /opt/media-core/appdata/bookorbit/secrets/migration_encryption_key
  book_request_encryption_key:
    file: /opt/media-core/appdata/bookorbit/secrets/book_request_encryption_key