#
# WARNING: To install Immich, follow our guide: https://immich.app/docs/install/docker-compose
#
# Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.

# Non-root conversion
#  https://github.com/immich-app/immich/discussions/13124#discussioncomment-11031865
#  https://immich.app/docs/FAQ/#how-can-i-run-immich-as-a-non-root-user

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
#    ports:
#      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false
    user: 5027:5027
    security_opt:
      # Prevent escalation of privileges after the container is started
      - no-new-privileges:true
    cap_drop:
      # Prevent access to raw network traffic
      - NET_RAW
    networks:
      - web_custom  # This network is created manually, not in a docker compose file

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - ${ML_CACHE_LOCATION}:/cache
      - ${ML_CONFIG_LOCATION}:/.config
      - ${ML_DOTCACHE_LOCATION}:/.cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false
    user: 5029:5029
    security_opt:
      # Prevent escalation of privileges after the container is started
      - no-new-privileges:true
    cap_drop:
      # Prevent access to raw network traffic
      - NET_RAW
    networks:
      - web_custom  # This network is created manually, not in a docker compose file
  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
    volumes:
      - ${REDIS_DATA_LOCATION}:/data
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always
    user: 5030:5030
    security_opt:
      # Prevent escalation of privileges after the container is started
      - no-new-privileges:true
    cap_drop:
      # Prevent access to raw network traffic
      - NET_RAW
    networks:
      - web_custom  # This network is created manually, not in a docker compose file
  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:8d292bdb796aa58bbbaa47fe971c8516f6f57d6a47e7172e62754feb6ed4e7b0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
      # DB_STORAGE_TYPE: 'HDD'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always
    user: 5028:5028
    security_opt:
      # Prevent escalation of privileges after the container is started
      - no-new-privileges:true
    cap_drop:
      # Prevent access to raw network traffic
      - NET_RAW
    networks:
      - web_custom  # This network is created manually, not in a docker compose file
networks:
  web_custom:
    external: true