services:
  postgres:
    image: docker.io/library/postgres:16-alpine
    restart: unless-stopped
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${PG_PASS:?required}

  redis:
    image: docker.io/library/redis:7-alpine
    restart: unless-stopped
    volumes:
      - redis_data:/data

  authentik-server:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2026.5.3}
    command: server
    restart: unless-stopped
    ports:
      - "${PORT_HTTP:-9000}:9000"
      - "${PORT_HTTPS:-9443}:9443"
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-authentik-secret-key}
      AUTHENTIK_POSTGRESQL__HOST: postgres
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-postgres}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:-postgres}
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_REDIS__PORT: 6379
    volumes:
      - authentik_data:/data
      - ./authentik/templates:/templates
    depends_on:
      postgres:
        condition: service_started
      redis:
        condition: service_started

  authentik-worker:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2026.5.3}
    command: worker
    restart: unless-stopped
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-authentik-secret-key}
      AUTHENTIK_POSTGRESQL__HOST: postgres
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-postgres}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS:-postgres}
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_REDIS__PORT: 6379
    volumes:
      - authentik_data:/data
      - ./authentik/templates:/templates
    depends_on:
      postgres:
        condition: service_started
      redis:
        condition: service_started

  homarr:
    image: ghcr.io/homarr-labs/homarr:latest
    restart: unless-stopped
    ports:
      - "${PORT_HOMARR:-7575}:7575"
    environment:
      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-1502ee91fadf86c4c99a9bc1a66ce17ac9ab3a148edbe4084b4af496031ae10d}
      - HOMARR__POSTGRES_ENABLED=true
      - HOMARR__POSTGRES_HOST=postgres
      - HOMARR__POSTGRES_PORT=5432
      - HOMARR__POSTGRES_USER=${PG_USER:-postgres}
      - HOMARR__POSTGRES_PASSWORD=${PG_PASS:?required}
      - HOMARR__POSTGRES_DATABASE=homarr
    volumes:
      - homarr_data:/app/data
    depends_on:
      postgres:
        condition: service_started

  audiobookshelf:
    image: ghcr.io/advplyr/audiobookshelf:latest
    restart: unless-stopped
    ports:
      - "${PORT_ABS:-13378}:80"
    volumes:
      - abs_config:/config
      - abs_metadata:/metadata
      - ./audiobooks:/audiobooks:ro
      - ./podcasts:/podcasts:ro
    depends_on: []

  kanboard:
    image: kanboard/kanboard:latest
    restart: unless-stopped
    ports:
      - "${PORT_KANBOARD:-8090}:80"
    environment:
      - DATABASE_URL=postgres://postgres:postgres@postgres:5432/kanboard?sslmode=disable
    volumes:
      - kanboard_data:/var/www/app/data
    depends_on:
      postgres:
        condition: service_started

  forgejo:
    image: codeberg.org/forgejo/forgejo:1.20.2-0
    restart: unless-stopped
    ports:
      - "${PORT_FORGEJO_HTTP:-3000}:3000"
      - "${PORT_FORGEJO_SSH:-2222}:22"
    volumes:
      - forgejo_data:/data
    environment:
      - USER_UID=1000
      - USER_GID=100
      - FORGEJO__database__DB_TYPE=postgres
      - FORGEJO__database__HOST=postgres:5432
      - FORGEJO__database__NAME=forgejo
      - FORGEJO__database__USER=postgres
      - FORGEJO__database__PASSWD=postgres
      - FORGEJO__actions__ENABLED=true
      - FORGEJO__server__DOMAIN=neon-64gb
      - FORGEJO__server__HTTP_PORT=3000
      - FORGEJO__server__ROOT_URL=http://localhost:3000
    depends_on:
      postgres:
        condition: service_started

  webhook:
    image: docker.io/library/python:3.13-alpine
    command: python3 /app/webhook_receiver.py
    restart: unless-stopped
    ports:
      - "${PORT_WEBHOOK:-8080}:8080"
    environment:
      - WEBHOOK_SECRET=${WEBHOOK_SECRET:-auto-pipeline-secret}
      - WEBHOOK_PORT=8080
    volumes:
      - "${PIPELINE_DIR:-/home/allaun/SilverSight}/scripts/auto:/app:ro"
    depends_on: []

  caddy:
    image: docker.io/library/caddy:2-alpine
    restart: unless-stopped
    ports:
      - "${PORT_CADDY_HTTP:-9090}:80"
      - "${PORT_CADDY_HTTPS:-9091}:443"
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
    depends_on:
      - authentik-server
      - homarr
      - audiobookshelf

volumes:
  postgres_data:
  redis_data:
  authentik_data:
  homarr_data:
  abs_config:
  abs_metadata:
  kanboard_data:
  forgejo_data:
  caddy_data: