compose.yaml

name: ledger

services:
  app:
    build: .
    restart: unless-stopped
    ports:
      - '3000:3000'
    environment:
      DATABASE_URL: postgres://root:mysecretpassword@db:5432/local
      BLOB_DIR: /data/blobs
      MIGRATIONS_DIR: /app/drizzle
      # adapter-node request body cap; image uploads are validated to 15M in-app.
      BODY_SIZE_LIMIT: 20M
      PUBLIC_ORIGIN: ${PUBLIC_ORIGIN:-http://localhost:3000}
      # adapter-node can't infer the external URL behind a reverse proxy, and
      # without it SvelteKit rejects every form action as cross-origin (403).
      ORIGIN: ${PUBLIC_ORIGIN:-http://localhost:3000}
      # Otherwise getClientAddress() returns the proxy's IP and the rate limiter
      # collapses every user into one bucket. Depth 1 = trust exactly one hop.
      ADDRESS_HEADER: X-Forwarded-For
      XFF_DEPTH: '1'
      POCKET_ID_ISSUER: ${POCKET_ID_ISSUER:-}
      POCKET_ID_CLIENT_ID: ${POCKET_ID_CLIENT_ID:-}
      POCKET_ID_CLIENT_SECRET: ${POCKET_ID_CLIENT_SECRET:-}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-}
      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:-}
      VAPID_SUBJECT: ${VAPID_SUBJECT:-}
      NTFY_SERVER_URL: ${NTFY_SERVER_URL:-}
      NTFY_DEFAULT_TOKEN: ${NTFY_DEFAULT_TOKEN:-}
      # --- Places & barcode lookup (all optional) ---
      # Without these the app still records pins from links and the device; the
      # map draws its graticule fallback and address search stays off. The tile
      # vars are passed through from .env like everything else; the tile cache
      # is pinned to the container path its named volume mounts.
      MAP_TILE_URL: ${MAP_TILE_URL:-}
      MAP_TILE_ATTRIBUTION: ${MAP_TILE_ATTRIBUTION:-}
      GEOCODER_URL: ${GEOCODER_URL:-http://geocoder:8080}
      GEOCODER_EMAIL: ${GEOCODER_EMAIL:-}
      BARCODE_LOOKUP_URL: ${BARCODE_LOOKUP_URL:-}
      TILE_CACHE_DIR: /data/tiles
    volumes:
      - blobs:/data/blobs
      - tiles:/data/tiles
    depends_on:
      db:
        condition: service_healthy

  # Self-hosted geocoder, opt-in: `docker compose --profile geocoder up -d`,
  # with GEOCODER_URL=http://geocoder:8080 in .env. This avoids the problem
  # described in .env.example: the public Nominatim instance's usage policy
  # forbids autocomplete-style querying and will ban your IP. Not started by
  # default, and deliberately unreachable from outside the compose network.
  #
  # The first start imports the extract at NOMINATIM_IMPORT_URL and can take
  # tens of minutes for a country; plan RAM and disk accordingly (a country is
  # single-digit GB of volume). Add FREEZE: 'true' once you're sure you'll
  # never want replication updates; it drops postcodes/wiki data and shrinks
  # the index.
  geocoder:
    image: mediagis/nominatim:4.4
    profiles: ['geocoder', 'full']
    restart: unless-stopped
    environment:
      # Defaults to Monaco, Geofabrik's smallest extract, imported in about a
      # minute, because the image's own default is the *planet* and a
      # household budget does not have a machine for the planet. A forgotten
      # var gets you a working geocoder that finds nothing, not a multi-day
      # import. Point it at your region: https://download.geofabrik.de
      PBF_URL: ${NOMINATIM_IMPORT_URL:-https://download.geofabrik.de/europe/monaco-latest.osm.pbf}
      THREADS: '4'
    volumes:
      - geocoder:/nominatim

  db:
    image: postgres:17
    restart: unless-stopped
    ports:
      # Loopback only: the app reaches the db over the compose network. Publishing
      # on 0.0.0.0 would expose Postgres (with this default password) to the LAN.
      - '127.0.0.1:5432:5432'
    environment:
      POSTGRES_USER: root
      POSTGRES_PASSWORD: mysecretpassword
      POSTGRES_DB: local
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U root -d local']
      interval: 5s
      timeout: 3s
      retries: 10

volumes:
  pgdata:
  blobs:
  # Disposable third-party bytes: map tiles the server re-serves. Safe to
  # delete any time; kept on its own volume so blob backups stay lean.
  tiles:
  # The geocoder's imported extract and index. Profile-gated service, so the
  # volume only fills if you opt in.
  geocoder: