services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:release@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
    restart: unless-stopped
    depends_on:
      - redis
      - database
    environment:
      DB_HOSTNAME: database
      DB_USERNAME: immich
      DB_PASSWORD: ${IMMICH_DB_PASSWORD}
      DB_DATABASE_NAME: immich
      REDIS_HOSTNAME: redis
      TZ: Europe/Berlin
    volumes:
      - /mnt/user/photos/immich:/usr/src/app/upload
      - /mnt/user/photos/family_archive:/usr/src/app/external
    networks:
      - immich_default
      - frontend_net
    security_opt:
      - no-new-privileges:true
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=frontend_net"
      - "traefik.http.routers.immich.rule=Host(`immich.kaleschke.info`)"
      - "traefik.http.routers.immich.entrypoints=websecure"
      - "traefik.http.routers.immich.tls=true"
      - "traefik.http.routers.immich.tls.certresolver=le"
      - "traefik.http.services.immich.loadbalancer.server.port=2283"

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:release@sha256:a2501141440f10516d329fdfba2c68082e19eb9ba6016c061ac80d23beadf7f3
    restart: unless-stopped
    volumes:
      - model-cache:/cache
    networks:
      - immich_default
    security_opt:
      - no-new-privileges:true

  redis:
    container_name: immich_redis
    image: redis:8.8-alpine@sha256:09160599abd229764c0fb44cb6be640294e1d360a54b19985ab4843dcf2d90f1
    restart: unless-stopped
    networks:
      - immich_default
    security_opt:
      - no-new-privileges:true

  database:
    container_name: immich_postgres
    image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:739cdd626151ff1f796dc95a6591b55a714f341c737e27f045019ceabf8e8c52
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      POSTGRES_USER: immich
      POSTGRES_DB: immich
    volumes:
      - /mnt/user/appdata/immich_postgres:/var/lib/postgresql/data
      - /mnt/user/appdata/secrets/immich_postgres_password.txt:/run/secrets/postgres_password:ro
    networks:
      - immich_default
    security_opt:
      - no-new-privileges:true

volumes:
  model-cache:

networks:
  immich_default:
    name: immich_default
    internal: true
    driver: bridge
  frontend_net:
    external: true