docker-compose.yml

x-default-logging: &default-logging
  driver: json-file
  options:
    max-size: "20m"
    max-file: "3"

services:

  floppy:
    container_name: floppy
    # Image defaults to :latest tag (points to stable release branch)
    # You can also explicitly use :latest, :release, or :dev
    image: ghcr.io/dannyvfilms/floppy
    restart: unless-stopped
    depends_on:
      - floppy-db
      - floppy-redis
    environment:
      - TZ=America/Chicago
      - SECRET=Y11OVHtMVdV0*k#i2nqRhh&rKwQ%QMi9
      - REDIS_URL=redis://floppy-redis:6379
      - DB_HOST=floppy-db
      # These stay "yamtrack" on purpose: renaming the database, role, or
      # password against an existing postgres_data volume breaks the stack.
      # New installs can use any values as long as both services agree.
      - DB_NAME=yamtrack
      - DB_USER=yamtrack
      - DB_PASSWORD=yamtrack
      - DB_PORT=5432
      - ADMIN_ENABLED=True
      # Off by default: otherwise a publicly known demo/demodemo
      # account is provisioned after migrations.
      - DEMO_ACCOUNT_ENABLED=True
      # Keep DEBUG off in production: the debug toolbar slows every request
      # and disables Django's cached template loader.
      - DEBUG=False
      # Web server concurrency: WEB_CONCURRENCY gunicorn worker processes,
      # each serving GUNICORN_THREADS requests concurrently. The defaults
      # (2 workers x 4 threads) prevent one slow request from blocking the UI.
      - WEB_CONCURRENCY=2
      - GUNICORN_THREADS=4
    ports:
      - 8003:8000

  floppy-db:
    image: postgres:16-alpine
    container_name: floppy-db
    environment:
      - POSTGRES_DB=yamtrack
      - POSTGRES_USER=yamtrack
      - POSTGRES_PASSWORD=yamtrack
    volumes:
      - floppy_postgres_data:/var/lib/postgresql/data
    restart: unless-stopped

  floppy-redis:
    container_name: floppy-redis
    image: redis:8-alpine
    restart: unless-stopped
    # Persist to disk so a restart doesn't drop the cache wholesale (#386).
    command: redis-server --appendonly yes
    volumes:
      - floppy_redis_data:/data

  transfer:
    image: kometa-utilities-transfer:local
    build:
      context: ./transfer-service
      dockerfile: Dockerfile
    container_name: transfer
    ports:
      - "8080:8080"
    volumes:
      - transfer-data:/data
      - transfer-tmp:/tmp/transfer
    secrets:
      - virustotal_key
    command:
      - --listener
      - ":8080"
      - --provider
      - local
      - --basedir
      - /data
      - --temp-path
      - /tmp/transfer
      - --purge-days
      - "14"
      - --purge-interval
      - "1"
      - --rate-limit
      - "60"
#      - --web-path
#      - /web/
    restart: unless-stopped
    logging: *default-logging

  anidb-mirror:
    image: ghcr.io/kometa-team/anidb-mirror:latest
    container_name: anidb-mirror
    restart: unless-stopped
    logging: *default-logging
    env_file:
      - ./anidb-service/.env
    environment:
      - UVICORN_WORKERS=1  # Reduce for low-memory systems
      - DB_PATH=/app/database/anidb.db
    volumes:
      - anidb-data:/app/data
      - anidb-db:/app/database
      - ./anidb-service/seed_data:/app/seed_data:ro
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health/ready', timeout=3).read()"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 256M

#   plex-oauth:
#     image: ghcr.io/kometa-team/plex-oauth:latest
#     container_name: plex-oauth
#     restart: unless-stopped
#     logging: *default-logging
#     env_file:
#       - ./plex-oauth/.env
#     environment:
#       - ROOT_PATH=/plex-oauth
#     healthcheck:
#       test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:5000/health/ready', timeout=3).read()"]
#       interval: 15s
#       timeout: 5s
#       retries: 5
#       start_period: 10s
#     deploy:
#       resources:
#         limits:
#           memory: 128M
#         reservations:
#           memory: 64M

  trakt-oauth:
    image: ghcr.io/kometa-team/trakt-oauth:latest
    container_name: trakt-oauth
    restart: unless-stopped
    logging: *default-logging
    env_file:
      - ./trakt-oauth/.env
    environment:
      - ROOT_PATH=/trakt-oauth
      - SECRET_KEY=${TRAKT_SECRET_KEY:-changeme-generate-random-key}
      - TRAKT_REDIRECT_URI=https://utilities.kometa.wiki/trakt-oauth/callback
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:5000/health/ready', timeout=3).read()"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 128M
        reservations:
          memory: 64M

  mal-oauth:
    image: ghcr.io/kometa-team/mal-oauth:latest
    container_name: mal-oauth
    restart: unless-stopped
    logging: *default-logging
    env_file:
      - ./mal-oauth/.env
    environment:
      - ROOT_PATH=/mal-oauth
      - SECRET_KEY=${MAL_SECRET_KEY:-changeme-generate-random-key}
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:5000/health/ready', timeout=3).read()"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 128M
        reservations:
          memory: 64M

#   simkl-oauth:
#     image: ghcr.io/kometa-team/simkl-oauth:latest
#     container_name: simkl-oauth
#     restart: unless-stopped
#     logging: *default-logging
#     environment:
#       - ROOT_PATH=/simkl-oauth
#       - CLIENT_ID=${SIMKL_CLIENT_ID:?SIMKL_CLIENT_ID must be set in .env}
#       - CLIENT_SECRET=${SIMKL_CLIENT_SECRET:?SIMKL_CLIENT_SECRET must be set in .env}
#       - REDIRECT_URI=${SIMKL_REDIRECT_URI:?SIMKL_REDIRECT_URI must be set in .env}
#     healthcheck:
#       test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:5000/health/ready', timeout=3).read()"]
#       interval: 15s
#       timeout: 5s
#       retries: 5
#       start_period: 10s
#     deploy:
#       resources:
#         limits:
#           memory: 128M
#         reservations:
#           memory: 64M

  simkl-service:
    image: ghcr.io/kometa-team/simkl-service:latest
    container_name: simkl-service
    restart: unless-stopped
    logging: *default-logging
    environment:
      - ROOT_PATH=/simkl-service
    volumes:
      - simkl-data:/app/data
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health/ready', timeout=3).read()"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 256M
        reservations:
          memory: 128M

  fider-db:
    restart: always
    logging: *default-logging
    container_name: fider-db
    image: postgres:17
    env_file:
      - ./features-fider/.env
    volumes:
      - fider-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 512M
          pids: 128
        reservations:
          memory: 128M

  features-fider:
    restart: always
    logging: *default-logging
    container_name: features-fider
    image: getfider/fider:stable
    env_file:
      - ./features-fider/.env
    depends_on:
      fider-db:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "./fider ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 512M
          pids: 128
        reservations:
          memory: 128M

  imdb-service:
    image: ghcr.io/kometa-team/imdb-service:latest
    container_name: imdb-service
    restart: unless-stopped
    # PID 1 must reap zombie Chromium/Playwright child processes; without an
    # init process they accumulate as zombies and exhaust the pids cgroup
    # limit below (see docs/incidents/2026-09-03-imdb-thread-exhaustion.md).
    init: true
    logging: *default-logging
    environment:
      - ROOT_PATH=/imdb-service
      - REFRESH_HOUR=3
      - DATA_DIR=/app/data
      - TMP_DIR=/app/data
      - MIN_VOTES_CHART=25000
      - IMDB_ADMIN_TOKEN=${IMDB_ADMIN_TOKEN:-}
      - MIN_FREE_DISK_GB=${MIN_FREE_DISK_GB:-30}
      - DELETE_DATASET_FILES_AFTER_IMPORT=${DELETE_DATASET_FILES_AFTER_IMPORT:-true}
      - PARENTAL_FAILURE_RETENTION_DAYS=${PARENTAL_FAILURE_RETENTION_DAYS:-14}
      - PARENTAL_FAILURE_MAX_MB=${PARENTAL_FAILURE_MAX_MB:-250}
      - PARENTAL_FAILURE_CLEANUP_HOURS=${PARENTAL_FAILURE_CLEANUP_HOURS:-24}
      - CACHE_STATS_TTL_SECONDS=${CACHE_STATS_TTL_SECONDS:-5}
      - IMDB_UPSTREAM_CONCURRENCY=${IMDB_UPSTREAM_CONCURRENCY:-8}

      - PARENTAL_PROXY_ENABLED=${PARENTAL_PROXY_ENABLED:-false}
      - PARENTAL_PROXY_URLS=${PARENTAL_PROXY_URLS:-}
      - PARENTAL_PROXY_RETRY_COUNT=${PARENTAL_PROXY_RETRY_COUNT:-1}
      - PARENTAL_PROXY_BAN_TTL_MINUTES=${PARENTAL_PROXY_BAN_TTL_MINUTES:-30}
      - PARENTAL_BROWSER_MAX_CONTEXTS=${PARENTAL_BROWSER_MAX_CONTEXTS:-8}
      - PARENTAL_BROWSER_IDLE_CLOSE_SECONDS=${PARENTAL_BROWSER_IDLE_CLOSE_SECONDS:-1800}
      - PARENTAL_BROWSER_REAPER_INTERVAL_SECONDS=${PARENTAL_BROWSER_REAPER_INTERVAL_SECONDS:-300}

      - PARENTAL_DECODO_BROWSER_ENABLED=${PARENTAL_DECODO_BROWSER_ENABLED:-false}
      - PARENTAL_DECODO_BROWSER_HOST=${PARENTAL_DECODO_BROWSER_HOST:-gate.decodo.com}
      - PARENTAL_DECODO_BROWSER_PORT=${PARENTAL_DECODO_BROWSER_PORT:-7000}
      - PARENTAL_DECODO_BROWSER_USERNAME=${PARENTAL_DECODO_BROWSER_USERNAME:-}
      - PARENTAL_DECODO_BROWSER_PASSWORD=${PARENTAL_DECODO_BROWSER_PASSWORD:-}
      - PARENTAL_DECODO_BROWSER_COUNTRY=${PARENTAL_DECODO_BROWSER_COUNTRY:-us}
      - PARENTAL_DECODO_BROWSER_SESSION_DURATION_MINUTES=${PARENTAL_DECODO_BROWSER_SESSION_DURATION_MINUTES:-2}

      - PARENTAL_PREFETCH_ENABLED=${PARENTAL_PREFETCH_ENABLED:-true}
      - PARENTAL_PREFETCH_DAILY_BUDGET=${PARENTAL_PREFETCH_DAILY_BUDGET:-750}
      - PARENTAL_PREFETCH_MIN_DELAY_SECONDS=${PARENTAL_PREFETCH_MIN_DELAY_SECONDS:-20}
      - PARENTAL_PREFETCH_MAX_DELAY_SECONDS=${PARENTAL_PREFETCH_MAX_DELAY_SECONDS:-180}

    volumes:
      - imdb-data:/app/data
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health/ready', timeout=3).read()"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 5m
    deploy:
      resources:
        limits:
          cpus: "2.00"
          memory: 1G
          pids: 2048
        reservations:
          memory: 512M

  uptime-kuma:
    image: louislam/uptime-kuma:2
    container_name: uptime-kuma
    restart: unless-stopped
    logging: *default-logging
    volumes:
      - uptime-kuma-data:/app/data
    deploy:
      resources:
        limits:
          memory: 512M
          pids: 512
        reservations:
          memory: 256M

  caddy:
    image: caddy:latest
    container_name: caddy
    restart: unless-stopped
    logging: *default-logging
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./index.html:/var/www/html/index.html
      - ./maintenance.html:/var/www/html/maintenance.html
      - ./floppy-maintenance.html:/var/www/html/floppy-maintenance.html
      - ./translations-maintenance.html:/var/www/html/translations-maintenance.html
      - ./analytics-maintenance.html:/var/www/html/analytics-maintenance.html
      - ./transfer-maintenance.html:/var/www/html/transfer-maintenance.html
      - ./favicon.ico:/var/www/html/favicon.ico
      # Static browser-only Trakt OAuth page (no backend involved)
      - ./trakt-oauth/static:/var/www/html/trakt-oauth:ro
      # Static browser-only MyAnimeList OAuth page (no backend involved)
      - ./mal-oauth/static:/var/www/html/mal-oauth:ro
      # Static browser-only Plex OAuth page (no backend involved)
      - ./plex-oauth/static:/var/www/html/plex-oauth:ro
      # Static browser-only SIMKL OAuth page (PIN flow, no backend involved)
      - ./simkl-oauth/static:/var/www/html/simkl-oauth:ro
      - caddy_data:/data
      - caddy_config:/config
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 256M
          pids: 128
        reservations:
          memory: 64M

  plausible_db:
    # Plausible v2.1.1 was tested against PostgreSQL versions 15 and 16
    # https://github.com/plausible/analytics/blob/v2.1.1/.github/workflows/elixir.yml#L21-L32
    image: postgres:14-alpine
    container_name: plausible_db
    restart: always
    logging: *default-logging
    volumes:
      - db-data:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=postgres
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      start_period: 1m
      interval: 15s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: "1.00"
          memory: 1G
          pids: 256
        reservations:
          memory: 128M

  plausible_events_db:
#    image: clickhouse/clickhouse-server:24.3.3.102-alpine
    image: clickhouse/clickhouse-server:24.12-alpine
    container_name: plausible_events_db
    restart: always
    logging: *default-logging
    volumes:
#      - ./clickhouse/clickhouse-config.xml:/etc/clickhouse-server/config.d/logging.xml:ro
#      - ./clickhouse/clickhouse-user-config.xml:/etc/clickhouse-server/users.d/logging.xml:ro
      - event-data:/var/lib/clickhouse
      - event-logs:/var/log/clickhouse-server
      - ./clickhouse-logs.xml:/etc/clickhouse-server/config.d/logs.xml:ro
      # This makes ClickHouse bind to IPv4 only, since Docker doesn't enable IPv6 in bridge networks by default.
      # Fixes "Listen [::]:9000 failed: Address family for hostname not supported" warnings.
      - ../plausible/clickhouse/ipv4-only.xml:/etc/clickhouse-server/config.d/ipv4-only.xml:ro
      # The following configuration files make ClickHouse consume less resources, which is useful for small setups.
      # https://clickhouse.com/docs/en/operations/tips#using-less-than-16gb-of-ram
      - ../plausible/clickhouse/low-resources.xml:/etc/clickhouse-server/config.d/low-resources.xml:ro
      - ../plausible/clickhouse/default-profile-low-resources-overrides.xml:/etc/clickhouse-server/users.d/default-profile-low-resources-overrides.xml:ro
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    environment:
      - CLICKHOUSE_SKIP_USER_SETUP=1
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget --no-verbose --tries=1 -O - http://127.0.0.1:8123/ping || exit 1",
        ]
      start_period: 1m
      interval: 15s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: "2.00"
          memory: 2G
          pids: 1536
        reservations:
          memory: 512M

  plausible:
    image: ghcr.io/plausible/community-edition:v3.2.0
    user: "999:65533"
    container_name: plausible
    restart: always
    logging: *default-logging
    command: sh -c "/entrypoint.sh db createdb && /entrypoint.sh db migrate && /entrypoint.sh run"
    depends_on:
      plausible_db:
        condition: service_healthy
      plausible_events_db:
        condition: service_healthy
    volumes:
      - plausible-data:/var/lib/plausible
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
    ports:
      - 8002:8000
    env_file:
      - ../plausible/plausible-conf.env
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "-O", "/dev/null", "http://127.0.0.1:8000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 1m
    deploy:
      resources:
        limits:
          cpus: "1.50"
          memory: 1G
          pids: 256
        reservations:
          memory: 256M

  cache:
    image: valkey/valkey:9.0.3
    volumes:
    - redis-data:/data
    command: [valkey-server, --save, '60', '1', --loglevel, warning]
    restart: always
    logging: *default-logging
    read_only: true
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 256M
          pids: 128
        reservations:
          memory: 64M

  database:
    image: postgres:18-alpine
    volumes:
    - postgres-data:/var/lib/postgresql
    env_file:
    - ../weblate/environment
    restart: always
    logging: *default-logging
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: "1.00"
          memory: 1G
          pids: 256
        reservations:
          memory: 128M

  weblate:
    image: weblate/weblate
    depends_on:
      cache:
        condition: service_healthy
      database:
        condition: service_healthy
    ports:
      - 8987:8080
    volumes:
      - weblate-data:/app/data
      - weblate-cache:/app/cache
    env_file:
    - ../weblate/environment
    restart: always
    logging: *default-logging
    read_only: true
    tmpfs:
      - /run
      - /tmp
    healthcheck:
      test: ["CMD-SHELL", "/app/bin/health_check"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 5m
    deploy:
      resources:
        limits:
          cpus: "2.00"
          memory: 3G
          pids: 256
        reservations:
          memory: 1536M

secrets:
  virustotal_key:
    environment: VIRUSTOTAL_KEY

volumes:
  anidb-data:
  imdb-data:
  anidb-db:
  simkl-data:
  uptime-kuma-data:
  fider-db:
    external: true
    name: kometa-utilities_fider-db
  caddy_data:
  caddy_config:
  transfer-data:
  transfer-tmp:
  clamav-socket:
  clamav-db:
  db-data:
    driver: local
  event-data:
  event-logs:
  plausible-data:
  weblate-cache:
    external: true
    name: kometa-utilities_weblate-cache
  weblate-data:
    external: true
    name: kometa-utilities_weblate-data
  postgres-data:
    external: true
    name: kometa-utilities_postgres-data
  redis-data:
    external: true
    name: kometa-utilities_redis-data
  floppy_redis_data:
  floppy_postgres_data: