docker-compose.yml

services:
  app:
    build:
      context: .
    restart: unless-stopped
    # FASTER_WHISPER_MEMORY_LIMIT caps the app container because local model
    # transcription is the memory-heavy path in this service.
    mem_limit: ${FASTER_WHISPER_MEMORY_LIMIT:-8g}
    environment:
      DATABASE_URL: ${DATABASE_URL:-postgresql+psycopg://${POSTGRES_USER:-job_logger}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}@db:5432/${POSTGRES_DB:-job_logger}}
      DATABASE_CONNECT_TIMEOUT_SECONDS: ${DATABASE_CONNECT_TIMEOUT_SECONDS:-5}
      DATABASE_POOL_SIZE: ${DATABASE_POOL_SIZE:-5}
      DATABASE_MAX_OVERFLOW: ${DATABASE_MAX_OVERFLOW:-10}
      DATABASE_POOL_TIMEOUT_SECONDS: ${DATABASE_POOL_TIMEOUT_SECONDS:-30}
      DATABASE_POOL_RECYCLE_SECONDS: ${DATABASE_POOL_RECYCLE_SECONDS:-1800}
      DATABASE_UNAVAILABLE_CHECK_INTERVAL_SECONDS: ${DATABASE_UNAVAILABLE_CHECK_INTERVAL_SECONDS:-5}
      APP_HEALTH_MONITOR_INTERVAL_SECONDS: ${APP_HEALTH_MONITOR_INTERVAL_SECONDS:-300}
      APP_HEALTH_DISK_WARNING_FREE_MB: ${APP_HEALTH_DISK_WARNING_FREE_MB:-1000}
      APP_HEALTH_DISK_CRITICAL_FREE_MB: ${APP_HEALTH_DISK_CRITICAL_FREE_MB:-250}
      APP_HEALTH_DB_LATENCY_WARNING_MS: ${APP_HEALTH_DB_LATENCY_WARNING_MS:-250}
      APP_HEALTH_DB_LATENCY_CRITICAL_MS: ${APP_HEALTH_DB_LATENCY_CRITICAL_MS:-1000}
      APP_HEALTH_DB_POOL_WARNING_PERCENT: ${APP_HEALTH_DB_POOL_WARNING_PERCENT:-80}
      APP_HEALTH_DB_POOL_CRITICAL_PERCENT: ${APP_HEALTH_DB_POOL_CRITICAL_PERCENT:-95}
      APP_HOST: 0.0.0.0
      APP_ENV: ${APP_ENV:-production}
      DEV_BUILD: ${DEV_BUILD:-false}
      APP_SECRET_KEY: ${APP_SECRET_KEY:?Set APP_SECRET_KEY in .env}
      APP_USERNAME: ${APP_USERNAME:-admin}
      APP_PASSWORD: ${APP_PASSWORD:?Set APP_PASSWORD in .env}
      ADMIN_CONTACT_EMAIL: ${ADMIN_CONTACT_EMAIL:-}
      NAVIGATION_OFFICE_ADDRESS: ${NAVIGATION_OFFICE_ADDRESS:-}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      APP_SESSION_COOKIE_SECURE: ${APP_SESSION_COOKIE_SECURE:-true}
      APP_SESSION_TIMEOUT_HOURS: ${APP_SESSION_TIMEOUT_HOURS:-12}
      CLOUDFLARE_ACCESS_REQUIRED: ${CLOUDFLARE_ACCESS_REQUIRED:-true}
      CLOUDFLARE_IP_BLOCKING_ENABLED: ${CLOUDFLARE_IP_BLOCKING_ENABLED:-false}
      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:-}
      CLOUDFLARE_ZONE_ID: ${CLOUDFLARE_ZONE_ID:-}
      CLOUDFLARE_IP_BLOCK_ALLOWLIST: ${CLOUDFLARE_IP_BLOCK_ALLOWLIST:-}
      CLOUDFLARE_AUTO_BLOCK_FAILED_LOGIN_ATTEMPTS: ${CLOUDFLARE_AUTO_BLOCK_FAILED_LOGIN_ATTEMPTS:-5}
      LOGIN_LOCAL_LOCKOUT_MINUTES: ${LOGIN_LOCAL_LOCKOUT_MINUTES:-15}
      PASSWORD_RESET_ENABLED: ${PASSWORD_RESET_ENABLED:-false}
      PASSWORD_RESET_TOKEN_TTL_HOURS: ${PASSWORD_RESET_TOKEN_TTL_HOURS:-24}
      PASSWORD_RESET_FAILED_ATTEMPTS_BLOCK_THRESHOLD: ${PASSWORD_RESET_FAILED_ATTEMPTS_BLOCK_THRESHOLD:-3}
      APP_PUBLIC_BASE_URL: ${APP_PUBLIC_BASE_URL:-}
      MAIL_ENABLED: ${MAIL_ENABLED:-false}
      MAIL_FROM_EMAIL: ${MAIL_FROM_EMAIL:-joblogger@example.com}
      MAIL_FROM_NAME: ${MAIL_FROM_NAME:-Job Logger}
      MAIL_MODE: ${MAIL_MODE:-smtp}
      MAIL_SMTP_HOST: ${MAIL_SMTP_HOST:-}
      MAIL_SMTP_PORT: ${MAIL_SMTP_PORT:-587}
      MAIL_SMTP_USERNAME: ${MAIL_SMTP_USERNAME:-}
      MAIL_SMTP_PASSWORD: ${MAIL_SMTP_PASSWORD:-}
      MAIL_SMTP_STARTTLS: ${MAIL_SMTP_STARTTLS:-true}
      MAIL_SMTP_SSL: ${MAIL_SMTP_SSL:-false}
      MAIL_SMTP_TIMEOUT_SECONDS: ${MAIL_SMTP_TIMEOUT_SECONDS:-10}
      MAIL_SMTP2GO_API_KEY: ${MAIL_SMTP2GO_API_KEY:-}
      TURNSTILE_ENABLED: ${TURNSTILE_ENABLED:-true}
      TURNSTILE_SITE_KEY: ${TURNSTILE_SITE_KEY:-}
      TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY:-}
      TURNSTILE_VERIFY_URL: ${TURNSTILE_VERIFY_URL:-https://challenges.cloudflare.com/turnstile/v0/siteverify}
      TURNSTILE_TIMEOUT_SECONDS: ${TURNSTILE_TIMEOUT_SECONDS:-10}
      PUSHOVER_ENABLED: ${PUSHOVER_ENABLED:-false}
      PUSHOVER_USER_KEY: ${PUSHOVER_USER_KEY:-}
      PUSHOVER_APP_KEY: ${PUSHOVER_APP_KEY:-}
      PUSHOVER_API_URL: ${PUSHOVER_API_URL:-https://api.pushover.net/1/messages.json}
      PUSHOVER_TIMEOUT_SECONDS: ${PUSHOVER_TIMEOUT_SECONDS:-10}
      WEBAUTHN_RP_NAME: ${WEBAUTHN_RP_NAME:-Job Logger}
      WEBAUTHN_RP_ID: ${WEBAUTHN_RP_ID:-}
      WEBAUTHN_ORIGIN: ${WEBAUTHN_ORIGIN:-}
      TRANSCRIPTION_PROVIDER: ${TRANSCRIPTION_PROVIDER:-mock}
      MAX_AUDIO_UPLOAD_BYTES: ${MAX_AUDIO_UPLOAD_BYTES:-10485760}
      MAX_BACKUP_RESTORE_BYTES: ${MAX_BACKUP_RESTORE_BYTES:-262144000}
      AUTOMATIC_BACKUPS_ENABLED: ${AUTOMATIC_BACKUPS_ENABLED:-true}
      AUTOMATIC_BACKUP_DIR: ${AUTOMATIC_BACKUP_DIR:-/data/backups}
      FASTER_WHISPER_MODEL: ${FASTER_WHISPER_MODEL:-base.en}
      FASTER_WHISPER_DEVICE: ${FASTER_WHISPER_DEVICE:-cpu}
      FASTER_WHISPER_COMPUTE_TYPE: ${FASTER_WHISPER_COMPUTE_TYPE:-int8}
      FASTER_WHISPER_DOWNLOAD_ROOT: ${FASTER_WHISPER_DOWNLOAD_ROOT:-/models/faster-whisper}
      FASTER_WHISPER_LOCAL_FILES_ONLY: ${FASTER_WHISPER_LOCAL_FILES_ONLY:-false}
      FASTER_WHISPER_LANGUAGE: ${FASTER_WHISPER_LANGUAGE:-en}
      FASTER_WHISPER_BEAM_SIZE: ${FASTER_WHISPER_BEAM_SIZE:-5}
      FASTER_WHISPER_CPU_THREADS: ${FASTER_WHISPER_CPU_THREADS:-8}
      FASTER_WHISPER_INITIAL_PROMPT: ${FASTER_WHISPER_INITIAL_PROMPT:-Use normal written punctuation. When spoken punctuation words such as comma, period, question mark, exclamation point, colon, semicolon, dash, or new paragraph are heard, render punctuation marks and paragraph breaks instead of spelling those words.}
      FASTER_WHISPER_REMOTE_URL: ${FASTER_WHISPER_REMOTE_URL:-}
      FASTER_WHISPER_REMOTE_API_KEY: ${FASTER_WHISPER_REMOTE_API_KEY:-}
      FASTER_WHISPER_REMOTE_TIMEOUT_SECONDS: ${FASTER_WHISPER_REMOTE_TIMEOUT_SECONDS:-120}
      AI_CLEANUP_ENABLED: ${AI_CLEANUP_ENABLED:-false}
      AI_CLEANUP_PROVIDER: ${AI_CLEANUP_PROVIDER:-gemini}
      AI_CLEANUP_TIMEOUT_SECONDS: ${AI_CLEANUP_TIMEOUT_SECONDS:-20}
      AI_CLEANUP_MAX_INPUT_CHARS: ${AI_CLEANUP_MAX_INPUT_CHARS:-12000}
      AI_CLEANUP_REVERT_RETENTION_HOURS: ${AI_CLEANUP_REVERT_RETENTION_HOURS:-24}
      AI_CLEANUP_INSTRUCTIONS: ${AI_CLEANUP_INSTRUCTIONS:-Clean up MSP work-summary notes for an Autotask time entry. Preserve the technical facts, customer impact, ticket context, and any leading Remote or On-Site prefix. Improve grammar, punctuation, capitalization, and readability. Do not invent work, parts, durations, ticket numbers, root causes, customer approvals, or follow-up actions. Return only the cleaned summary text with no markdown, title, explanation, or surrounding quotes.}
      GEMINI_API_KEY: ${GEMINI_API_KEY:-}
      GEMINI_API_BASE: ${GEMINI_API_BASE:-https://generativelanguage.googleapis.com/v1beta/openai/}
      GEMINI_CLEANUP_MODEL: ${GEMINI_CLEANUP_MODEL:-gemini-3.5-flash}
      GROQ_API_KEY: ${GROQ_API_KEY:-}
      GROK_API_KEY: ${GROK_API_KEY:-}
      GROQ_CLEANUP_MODEL: ${GROQ_CLEANUP_MODEL:-}
      GROK_CLEANUP_MODEL: ${GROK_CLEANUP_MODEL:-}
      GROQ_CLEANUP_API_BASE_URL: ${GROQ_CLEANUP_API_BASE_URL:-}
      GROK_CLEANUP_API_BASE_URL: ${GROK_CLEANUP_API_BASE_URL:-}
      OLLAMA_CLEANUP_MODEL: ${OLLAMA_CLEANUP_MODEL:-llama3.1}
      OLLAMA_CLEANUP_API_BASE_URL: ${OLLAMA_CLEANUP_API_BASE_URL:-http://host.docker.internal:11434/api}
      LM_STUDIO_CLEANUP_MODEL: ${LM_STUDIO_CLEANUP_MODEL:-local-model}
      LM_STUDIO_CLEANUP_API_BASE_URL: ${LM_STUDIO_CLEANUP_API_BASE_URL:-http://host.docker.internal:1234/v1}
      LM_STUDIO_API_KEY: ${LM_STUDIO_API_KEY:-}
      AI_HELP_ENABLED: ${AI_HELP_ENABLED:-false}
      AI_HELP_PROVIDER: ${AI_HELP_PROVIDER:-gemini}
      GEMINI_MODEL: ${GEMINI_MODEL:-gemini-3.5-flash}
      AI_HELP_MAX_TOKENS: ${AI_HELP_MAX_TOKENS:-800}
      AI_HELP_TEMPERATURE: ${AI_HELP_TEMPERATURE:-0.2}
      AI_HELP_INSTRUCTIONS: ${AI_HELP_INSTRUCTIONS:-}
      AUTOTASK_PROVIDER: ${AUTOTASK_PROVIDER:-autotask}
      AUTOTASK_BASE_URL: ${AUTOTASK_BASE_URL:-}
      AUTOTASK_USERNAME: ${AUTOTASK_USERNAME:-}
      AUTOTASK_SECRET: ${AUTOTASK_SECRET:-}
      AUTOTASK_API_INTEGRATION_CODE: ${AUTOTASK_API_INTEGRATION_CODE:-}
      AUTOTASK_TIME_ENTRY_TYPE: ${AUTOTASK_TIME_ENTRY_TYPE:-2}
      AUTOTASK_MAX_CONCURRENT_REQUESTS: ${AUTOTASK_MAX_CONCURRENT_REQUESTS:-2}
      AUTOTASK_REQUEST_SLOT_TIMEOUT_SECONDS: ${AUTOTASK_REQUEST_SLOT_TIMEOUT_SECONDS:-30}
      AUTOTASK_STATUS_IN_PROGRESS_ID: ${AUTOTASK_STATUS_IN_PROGRESS_ID:-}
      AUTOTASK_STATUS_WAITING_CUSTOMER_ID: ${AUTOTASK_STATUS_WAITING_CUSTOMER_ID:-}
      AUTOTASK_STATUS_WAITING_PARTS_ID: ${AUTOTASK_STATUS_WAITING_PARTS_ID:-}
      AUTOTASK_STATUS_FOLLOW_UP_ID: ${AUTOTASK_STATUS_FOLLOW_UP_ID:-}
      AUTOTASK_STATUS_COMPLETE_ID: ${AUTOTASK_STATUS_COMPLETE_ID:-}
    extra_hosts:
      # Allows the app container to reach same-host Ollama or LM Studio
      # processes through host.docker.internal. Private LAN model servers can
      # be configured directly with their private IP base URLs.
      - "host.docker.internal:host-gateway"
    # The app entrypoint waits briefly for real database connectivity and starts
    # in temporary-service mode if PostgreSQL is unreachable. That keeps remote
    # database deployments and slow local starts from stopping the web process.
    expose:
      # The app is intentionally exposed only to the private Compose network.
      # Nginx is the public-facing internal origin for Cloudflare Tunnel.
      - "8000"
    volumes:
      - faster_whisper_models:/models/faster-whisper
      - automatic_backups:/data/backups
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health/live', timeout=3).read()\""]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3

  nginx:
    build:
      context: ./docker/nginx
    profiles:
      - bundled-edge
    restart: unless-stopped
    environment:
      # APP_UPSTREAM_HOST is the Docker DNS name for the FastAPI service.
      APP_UPSTREAM_HOST: app
      # Compose always uses container port 80. HTTP_PORT controls only the
      # localhost host mapping below; Swarm may change the internal listener.
      NGINX_LISTEN_PORT: 80
      # Standalone Compose keeps Nginx logs on stdout/stderr unless overridden.
      NGINX_ACCESS_LOG: ${NGINX_ACCESS_LOG:-/dev/stdout}
      NGINX_ERROR_LOG: ${NGINX_ERROR_LOG:-/dev/stderr warn}
      # NGINX_CLIENT_MAX_BODY_SIZE bounds compatibility uploads and streamed audio.
      NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-12m}
      # NGINX_RESTORE_MAX_BODY_SIZE applies only to /debug/restore uploads.
      NGINX_RESTORE_MAX_BODY_SIZE: ${NGINX_RESTORE_MAX_BODY_SIZE:-250m}
    # Nginx can start before the app is healthy; Docker health status and the
    # app entrypoint make readiness visible without aborting Portainer stack
    # creation.
    depends_on:
      - app
    ports:
      # Bind Nginx only on localhost so the host-networked Cloudflare Tunnel
      # connector is the intended origin client. HTTP_PORT selects that local
      # tunnel origin port, such as http://127.0.0.1:2082.
      - "127.0.0.1:${HTTP_PORT:-11030}:80"
    healthcheck:
      # Check that the Nginx master process is alive.
      # This avoids failures when the container image does not include wget/curl.
      test: ["CMD-SHELL", "[ -f /var/run/nginx.pid ] && kill -0 \"$$(cat /var/run/nginx.pid)\""]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3

  db:
    image: postgres:16-alpine
    profiles:
      - local-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-job_logger}
      POSTGRES_USER: ${POSTGRES_USER:-job_logger}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-}
    volumes:
      # Keep PostgreSQL data persistent across container rebuilds/recreates.
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\""]
      interval: 10s
      timeout: 5s
      # First-time volume initialization can take longer on small or busy
      # Docker hosts. Give Postgres time to bootstrap before the DB container
      # reports a failing health state.
      start_period: 60s
      retries: 12
    networks:
      default:
        aliases:
          - db

  cloudflared:
    image: cloudflare/cloudflared:latest
    profiles:
      - bundled-edge
    restart: unless-stopped
    # Host networking lets remotely-managed tunnel service URLs use either
    # localhost or this server's LAN/internal IP as the origin address.
    network_mode: "host"
    # The cloudflared image is a distroless runtime without /bin/sh, so the
    # command is passed directly as arguments for the image entrypoint.
    command:
      - tunnel
      - --no-autoupdate
      - run
      - --token
      - ${CLOUDFLARE_TUNNEL_TOKEN:-not-set}
    depends_on:
      - nginx

volumes:
  postgres_data:
  faster_whisper_models:
  automatic_backups: