Update invidious stack to use companion approach

- Replace inv_sig_helper with invidious-companion for better YouTube API handling
- Add healthcheck for main container
- Add resource limits for all containers
- Add SQL init scripts for fresh database setup
- Update README with invidious secrets documentation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

stacks/invidious/docker-compose.yml

@@ -3,8 +3,6 @@ services:
     image: quay.io/invidious/invidious:latest
     container_name: invidious
     restart: unless-stopped
-    ports:
-      - "3001:3000"
     environment:
       INVIDIOUS_CONFIG: |
         db:
@@ -14,45 +12,81 @@ services:
           host: invidious-db
           port: 5432
         check_tables: true
-        signature_server: inv_sig_helper:12999
-        visitor_data: ${INVIDIOUS_VISITOR_DATA}
-        po_token: ${INVIDIOUS_PO_TOKEN}
+        invidious_companion:
+          - private_url: "http://invidious-companion:8282/companion"
+            public_url: "https://inv.${DOMAIN}"
+        invidious_companion_key: "${INVIDIOUS_COMPANION_KEY}"
+        external_port: 443
+        domain: inv.${DOMAIN}
+        https_only: true
         hmac_key: "${INVIDIOUS_HMAC_KEY}"
+        hsts: false
+        log_level: Info
+    healthcheck:
+      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/api/v1/trending || exit 1
+      interval: 30s
+      timeout: 5s
+      retries: 2
     logging:
       options:
         max-size: "1G"
         max-file: "4"
     depends_on:
       - invidious-db
+    deploy:
+      resources:
+        limits:
+          cpus: '1'
+          memory: 2G
     labels:
       - "traefik.enable=true"
       - "traefik.http.services.invidious.loadbalancer.server.port=3000"
       - "traefik.http.routers.invidious.entrypoints=https"
-      - "traefik.http.routers.invidious.rule=Host(`invid.${DOMAIN}`, `i.${DOMAIN}`)"
+      - "traefik.http.routers.invidious.rule=Host(`inv.${DOMAIN}`)"
       - "traefik.http.routers.invidious.tls.certresolver=http"
     networks:
       - web
       - default
 
-  inv_sig_helper:
-    image: quay.io/invidious/inv-sig-helper:latest
-    container_name: inv-sig-helper
-    command: ["--tcp", "0.0.0.0:12999"]
-    environment:
-      - RUST_LOG=info
+  invidious-companion:
+    image: quay.io/invidious/invidious-companion:latest
+    container_name: invidious-companion
     restart: unless-stopped
+    environment:
+      - SERVER_SECRET_KEY=${INVIDIOUS_COMPANION_KEY}
+      - SERVER_BASE_URL=https://inv.${DOMAIN}/companion
+    logging:
+      options:
+        max-size: "1G"
+        max-file: "4"
     cap_drop:
       - ALL
     read_only: true
+    volumes:
+      - companion-cache:/var/tmp/youtubei.js:rw
     security_opt:
       - no-new-privileges:true
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 1G
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.invidious-companion.loadbalancer.server.port=8282"
+      - "traefik.http.routers.invidious-companion.entrypoints=https"
+      - "traefik.http.routers.invidious-companion.rule=Host(`inv.${DOMAIN}`) && PathPrefix(`/companion`)"
+      - "traefik.http.routers.invidious-companion.tls.certresolver=http"
+    networks:
+      - web
+      - default
 
   invidious-db:
     image: postgres:14
     container_name: invidious-db
     restart: unless-stopped
     volumes:
-      - ./postgres:/var/lib/postgresql/data
+      - postgres-data:/var/lib/postgresql/data
       - ./config/sql:/config/sql
       - ./docker/init-invidious-db.sh:/docker-entrypoint-initdb.d/init-invidious-db.sh
     environment:
@@ -61,6 +95,15 @@ services:
       POSTGRES_PASSWORD: ${INVIDIOUS_DB_PASSWORD}
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 1G
+
+volumes:
+  postgres-data:
+  companion-cache:
 
 networks:
   web: