docker-compose.yml

services:
  postgres:
    image: postgres:18
    restart: unless-stopped
    environment:
      POSTGRES_DB: meshinfo
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: password
    # Postgres memory tuning — conservative defaults; size to host via .env (see POSTGRES.md).
    command:
      - "postgres"
      - "-c"
      - "shared_buffers=${PG_SHARED_BUFFERS:-256MB}"
      - "-c"
      - "work_mem=${PG_WORK_MEM:-8MB}"
      - "-c"
      - "maintenance_work_mem=${PG_MAINTENANCE_WORK_MEM:-64MB}"
      - "-c"
      - "effective_cache_size=${PG_EFFECTIVE_CACHE_SIZE:-1GB}"
    # No published port: the app reaches Postgres over the compose network,
    # and docker-published ports bypass host firewalls (ufw). For host access
    # use `docker compose exec postgres psql -U postgres meshinfo`, or map
    # "127.0.0.1:5432:5432" in a docker-compose.override.yml.
    volumes:
      # postgres:18+ stores data in a version-specific subdir; mount the
      # parent (/var/lib/postgresql), not /data. See POSTGRES.md.
      - meshinfo_pgdata:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d meshinfo"]
      interval: 5s
      timeout: 5s
      retries: 20

  mqtt:
    container_name: mqtt
    image: eclipse-mosquitto:latest
    # 1883 stays published on all interfaces by design — mesh gateways on the
    # WAN publish uplinks here. Protect it with broker auth: see the
    # password_file/acl_file notes in mosquitto/config/mosquitto.conf.sample.
    ports:
      - 1883:1883
    volumes:
      - ./mosquitto/data:/mosquitto/data:rw
      - ./mosquitto/config:/mosquitto/config:rw
    restart: unless-stopped

  meshinfo:
    image: ghcr.io/meshaddicts/meshinfo:latest
    volumes:
      - ./config.toml:/app/config.toml
      - ./output:/app/output
      - ./postgres:/app/postgres:ro
      # In-app scheduled pg_dump snapshots land here ([backups] in config.toml).
      - ./backups:/app/backups
    environment:
      - PYTHONUNBUFFERED=1
    # Uncomment if node enrichment fails with "Name or service not known"
    # (some Docker setups don't inherit host DNS for external lookups)
    # dns:
    #   - 1.1.1.1
    #   - 1.0.0.1
    # Localhost-only: caddy is the public entry for the API (/v1, /api, /tiles).
    # Docker-published ports bypass host firewalls, so don't expose 9000 directly.
    ports:
      - 127.0.0.1:9000:9000
    restart: unless-stopped
    # Wait for Postgres readiness, not just container start.
    depends_on:
      postgres:
        condition: service_healthy
      mqtt:
        condition: service_started
    healthcheck:
      test: ["CMD-SHELL", "python3 -c 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen(\"http://localhost:9000/\", timeout=3).status==200 else 1)'"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s

  frontend:
    image: ghcr.io/meshaddicts/meshinfo-spa:latest
    # Localhost-only: caddy is the public entry for the SPA.
    ports:
      - 127.0.0.1:8000:80
    env_file:
      - path: ./frontend/.env
        required: false

    environment:
      NODE_ENV: production
    restart: unless-stopped

  caddy:
    build:
      context: .
      dockerfile: Dockerfile.caddy
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./caddy/data:/data/caddy
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./public/images:/srv/images
      # Maintenance landing page + toggle flag (see scripts/maintenance.sh).
      - ./public/maintenance:/srv/maintenance:ro
    environment:
      - CADDY_AGREE=true
    restart: unless-stopped
    depends_on:
      meshinfo:
        condition: service_healthy
      frontend:
        condition: service_started

  # `docker compose --profile bake run --rm landcover-bake` — see scripts/README-landcover.md.
  landcover-bake:
    profiles: ["bake"]
    build:
      context: .
      dockerfile: Dockerfile.landcover
    volumes:
      - ./output:/app/output

  # `docker compose --profile bake run --rm canopy-bake` — see scripts/README-canopy.md.
  canopy-bake:
    profiles: ["bake"]
    build:
      context: .
      dockerfile: Dockerfile.canopy
    volumes:
      - ./output:/app/output

  # `docker compose --profile bake run --rm building-bake` — see scripts/README-buildings.md.
  building-bake:
    profiles: ["bake"]
    build:
      context: .
      dockerfile: Dockerfile.buildings
    volumes:
      - ./output:/app/output

  # Live network-coverage tile baker (opt-in; CPU-heavy). Start with:
  #   docker compose --profile coverage up -d --build coverage-worker
  # Set [coverage] enabled = true in config.toml so meshinfo serves /tiles/coverage.
  coverage-worker:
    profiles: ["coverage"]
    build:
      context: .
      dockerfile: Dockerfile.coverage
    volumes:
      - ./output:/output
    environment:
      - MESHINFO_URL=http://meshinfo:9000
      - COVERAGE_OUTPUT_DIR=/output/coverage
      - COVERAGE_RECENCY_HOURS=4
      # Single-region deployments need no clip. Set COVERAGE_BBOX="west,south,east,north"
      # only if this instance's DB aggregates multiple disjoint regions.
      # Low-memory hosts: set COVERAGE_DEM_SIZE=4096 and COVERAGE_NODE_OUTPUT=1024.
    # Half-weight CPU so meshinfo/postgres win under contention; for a hard cap
    # on shared hosts add `cpus: N` + COVERAGE_WORKERS=N.
    cpu_shares: 512
    restart: unless-stopped
    depends_on:
      meshinfo:
        condition: service_healthy

volumes:
  meshinfo_pgdata: