docker-compose.databases.yaml

x-common-databases: &databases
  postgres:
    image: postgres:17
    container_name: postgres
    <<: *common
    networks:
      - backend
    volumes:
      - config-postgres:/var/lib/postgresql
      - ./postgres:/docker-entrypoint-initdb.d
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DATABASE_USERNAME} -d ${TODO_DATABASE}"]
      <<: *healthcheck
    user: ${PUID}:${PGID}
    environment:
      <<: *env-vars
      POSTGRES_USER: ${DATABASE_USERNAME}
      POSTGRES_PASSWORD: ${DATABASE_PASSWORD}
      POSTGRES_MULTIPLE_DATABASES: vikunja,vaultwarden,outline,auth,speedtest,gitea
      PGDATA: /var/lib/postgresql/17/data
    labels:
      traefik.enable: false

  pgbackups:
    image: prodrigestivill/postgres-backup-local
    container_name: postgres-backups
    <<: *common
    user: ${PUID}:${PGID}
    volumes:
      - config-postgres-backups:/backups
    depends_on:
      - postgres
    environment:
      <<: *env-vars
      POSTGRES_HOST: postgres
      POSTGRES_DB: vikunja,vaultwarden,outline,auth,speedtest,gitea
      POSTGRES_USER: ${DATABASE_USERNAME}
      POSTGRES_PASSWORD: ${DATABASE_PASSWORD}
      POSTGRES_EXTRA_OPTS: --compress=6 --compress=zstd --large-objects
      SCHEDULE: "@daily"
      BACKUP_ON_START: TRUE
      BACKUP_KEEP_DAYS: 7
      BACKUP_KEEP_WEEKS: 4
      BACKUP_KEEP_MONTHS: 6
      BACKUP_SUFFIX: ".sql.zstd"
      HEALTHCHECK_PORT: 8080
    labels:
      traefik.enable: false

  pg-vectors:
    image: tensorchord/pgvecto-rs:pg15-v0.3.0
    container_name: pg-vectors
    <<: *common
    networks:
      - backend
    volumes:
      - config-pg-vectors:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U immich -d immich"]
      <<: *healthcheck
    user: ${PUID}:${PGID}
    environment:
      <<: *env-vars
      POSTGRES_USER: immich
      POSTGRES_PASSWORD: ${DATABASE_PASSWORD}
      POSTGRES_DB: immich
      PGDATA: /var/lib/postgresql/15/data
    labels:
      traefik.enable: false

  #redis:
  #  image: redis
  #  container_name: redis
  #  <<: *common
  #  networks:
  #    - backend
  #  command: ["redis-server", "/data/redis.conf", "--save", "60", "1", "--loglevel", "warning" ]
  #  volumes:
  #    - config-redis:/data
  #  healthcheck:
  #    test: ["CMD", "redis-cli", "ping"]
  #    <<: *healthcheck
  #  labels:
  #    traefik.enable: false

  valkey:
    image: valkey/valkey
    container_name: valkey
    <<: *common
    networks:
      - backend
    command: ["valkey-server", "/data/valkey.conf", "--save", "60", "1", "--loglevel", "warning" ]
    volumes:
      - config-valkey:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      <<: *healthcheck
    labels:
      traefik.enable: false

  minio:
    image: minio/minio
    container_name: minio
    entrypoint: sh
    command: -c 'minio server /data --console-address ":9001"'
    <<: *common
    volumes:
      - config-s3:/data
    environment:
      <<: *env-vars
      MINIO_BROWSER_REDIRECT_URL: "https://minio.${DOMAIN}"
      MINIO_PROMETHEUS_AUTH_TYPE: "public"
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    healthcheck:
      test: timeout 5s bash -c ':> /dev/tcp/127.0.0.1/9000' || exit 1
      <<: *healthcheck
    labels:
      traefik.http.routers.minio.rule: Host(`minio.${DOMAIN}`) && $RESTRICTED
      traefik.http.services.minio.loadbalancer.server.port: 9001
      traefik.http.routers.minio.entryPoints: websecure
      traefik.http.routers.minio.tls: true
      traefik.http.routers.minio.tls.certResolver: letsencrypt
      traefik.http.routers.minio.service: minio
      traefik.http.routers.minioadmin.entryPoints: websecure
      traefik.http.routers.minioadmin.rule: Host(`minioapi.${DOMAIN}`) && $RESTRICTED
      traefik.http.services.minioadmin.loadbalancer.server.port: 9000
      traefik.http.routers.minioadmin.tls: true
      traefik.http.routers.minioadmin.tls.certResolver: letsencrypt
      traefik.http.routers.minioadmin.service: minioadmin

  mosquitto:
    image: eclipse-mosquitto
    container_name: mqtt
    <<: *common
    networks:
      - frontend
    volumes:
      - config-mosquitto:/mosquitto/config
    healthcheck:
      test: ["CMD", "mosquitto_sub", "-t", "$$SYS/#", "-C", "1", "-i", "healthcheck", "-W", "3", "-u", "${FRIGATE_MQTT_USERNAME}", "-P", "${FRIGATE_MQTT_PASSWORD}"]
      <<: *healthcheck
    labels:
      traefik.tcp.routers.mqtt.rule: HostSNI(`mqtt.${DOMAIN}`)
      traefik.tcp.routers.mqtt.entryPoints: mqtts
      traefik.tcp.routers.mqtt.tls: true
      traefik.tcp.routers.mqtt.tls.certResolver: letsencrypt
      traefik.tcp.services.mqtt.loadbalancer.server.port: 1883
      traefik.tcp.routers.mqtt.service: mqtt

  matter:
    image: ghcr.io/home-assistant-libs/python-matter-server:stable
    container_name: matter
    restart: unless-stopped
    <<: *logging
    dns:
      - 192.168.1.1
    environment:
      <<: *env-vars
    # Required for mDNS to work correctly
    network_mode: host
    security_opt:
      - no-new-privileges=true
      # Needed for Bluetooth via dbus
      - apparmor=unconfined
    volumes:
      - config-matter:/data/
      - /run/dbus:/run/dbus:ro
    labels:
      traefik.enable: false