services:
  invidious:
    image: quay.io/invidious/invidious:latest
    container_name: invidious
    restart: unless-stopped
    environment:
      INVIDIOUS_CONFIG: |
        db:
          dbname: invidious
          user: kemal
          password: ${INVIDIOUS_DB_PASSWORD}
          host: invidious-db
          port: 5432
        check_tables: true
        invidious_companion:
          - private_url: "http://invidious-companion:8282/companion"
            public_url: "https://inv.${DOMAIN}"
        invidious_companion_key: "${INVIDIOUS_COMPANION_KEY}"
        external_port: 443
        domain: inv.${DOMAIN}
        https_only: true
        hmac_key: "${INVIDIOUS_HMAC_KEY}"
        hsts: false
        log_level: Info
    healthcheck:
      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/api/v1/trending || exit 1
      interval: 30s
      timeout: 5s
      retries: 2
    logging:
      options:
        max-size: "1G"
        max-file: "4"
    depends_on:
      - invidious-db
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 2G
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.invidious.loadbalancer.server.port=3000"
      - "traefik.http.routers.invidious.entrypoints=https"
      - "traefik.http.routers.invidious.rule=Host(`inv.${DOMAIN}`)"
      - "traefik.http.routers.invidious.tls.certresolver=http"
    networks:
      - web
      - default

  invidious-companion:
    image: quay.io/invidious/invidious-companion:latest
    container_name: invidious-companion
    restart: unless-stopped
    environment:
      - SERVER_SECRET_KEY=${INVIDIOUS_COMPANION_KEY}
      - SERVER_BASE_URL=https://inv.${DOMAIN}/companion
    logging:
      options:
        max-size: "1G"
        max-file: "4"
    cap_drop:
      - ALL
    read_only: true
    volumes:
      - companion-cache:/var/tmp/youtubei.js:rw
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 1G
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.invidious-companion.loadbalancer.server.port=8282"
      - "traefik.http.routers.invidious-companion.entrypoints=https"
      - "traefik.http.routers.invidious-companion.rule=Host(`inv.${DOMAIN}`) && PathPrefix(`/companion`)"
      - "traefik.http.routers.invidious-companion.tls.certresolver=http"
    networks:
      - web
      - default

  invidious-db:
    image: postgres:14
    container_name: invidious-db
    restart: unless-stopped
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./config/sql:/config/sql
      - ./docker/init-invidious-db.sh:/docker-entrypoint-initdb.d/init-invidious-db.sh
    environment:
      POSTGRES_DB: invidious
      POSTGRES_USER: kemal
      POSTGRES_PASSWORD: ${INVIDIOUS_DB_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 1G

volumes:
  postgres-data:
  companion-cache:

networks:
  web:
    external: true