version: "3.9"

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:release
    restart: unless-stopped
    depends_on:
      - redis
      - database
    environment:
      DB_HOSTNAME: database
      DB_USERNAME: immich
      DB_PASSWORD: ${IMMICH_DB_PASSWORD}
      DB_DATABASE_NAME: immich
      REDIS_HOSTNAME: redis
    volumes:
      - /mnt/user/photos/immich:/usr/src/app/upload
      - /mnt/user/photos/family_archive:/usr/src/app/external
      - /etc/localtime:/etc/localtime:ro
    networks:
      - immich_default
      - frontend_net
    security_opt:
      - no-new-privileges:true
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=frontend_net"
      - "traefik.http.routers.immich.rule=Host(`immich.kaleschke.info`)"
      - "traefik.http.routers.immich.entrypoints=websecure"
      - "traefik.http.routers.immich.tls=true"
      - "traefik.http.routers.immich.tls.certresolver=le"
      - "traefik.http.services.immich.loadbalancer.server.port=2283"

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:release
    restart: unless-stopped
    volumes:
      - model-cache:/cache
    networks:
      - immich_default
    security_opt:
      - no-new-privileges:true

  redis:
    container_name: immich_redis
    image: redis:7
    restart: unless-stopped
    networks:
      - immich_default
    security_opt:
      - no-new-privileges:true

  database:
    container_name: immich_postgres
    image: tensorchord/pgvecto-rs:pg14-v0.2.0
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      POSTGRES_USER: immich
      POSTGRES_DB: immich
    volumes:
      - /mnt/user/appdata/immich_postgres:/var/lib/postgresql/data
      - /mnt/user/appdata/secrets/immich_postgres_password.txt:/run/secrets/postgres_password:ro
    networks:
      - immich_default
    security_opt:
      - no-new-privileges:true

volumes:
  model-cache:

networks:
  immich_default:
    external: true
  frontend_net:
    external: true