docker-compose.yml

# Obsidian LiveSync - CouchDB Backend
# Designed for Raspberry Pi (ARM64) + Tailscale
#
# Usage:
#   1. cp .env.example .env && edit .env
#   2. docker compose up -d
#   3. ./scripts/couchdb-init.sh   (first time only)
#   4. sudo tailscale serve --bg --https 6984 http://127.0.0.1:5984

services:
  couchdb:
    image: couchdb:${COUCHDB_IMAGE_TAG:-3.4.3}
    container_name: obsidian-couchdb
    restart: unless-stopped

    environment:
      - COUCHDB_USER=${COUCHDB_USER:?Set COUCHDB_USER in .env}
      - COUCHDB_PASSWORD=${COUCHDB_PASSWORD:?Set COUCHDB_PASSWORD in .env}
      - COUCHDB_SECRET=${COUCHDB_SECRET:-}

    volumes:
      - ${COUCHDB_DATA_PATH:-./couchdb-data}:/opt/couchdb/data
      - ./couchdb/local.ini:/opt/couchdb/etc/local.d/001-livesync.ini

    # Localhost only; tailscale serve (port 6984) handles external HTTPS access
    ports:
      - "127.0.0.1:5984:5984"

    healthcheck:
      test: ["CMD-SHELL", "bash -c '</dev/tcp/127.0.0.1/5984' || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s

    # Drop all caps except the 5 the entrypoint needs (chown/chmod, write
    # docker.ini, then setpriv to uid 5984). No :ro on local.ini — entrypoint
    # chowns config files and crashes if read-only (couchdb-docker#192, #204).
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETUID
      - SETGID

    # Give CouchDB time to flush writes on slow SD card before SIGKILL
    stop_grace_period: 30s

    deploy:
      resources:
        limits:
          memory: ${COUCHDB_MEM_LIMIT:-512m}
        reservations:
          memory: 128m

    # Keep CouchDB logs and Erlang temp files in RAM to reduce SD card writes
    tmpfs:
      - /opt/couchdb/var/log:size=10m,uid=5984,gid=5984
      - /tmp:size=50m

    logging:
      driver: json-file
      options:
        max-size: "5m"
        max-file: "2"