memby/docker-compose.yml

name: memby

services:
  server:
    build: ./server
    restart: unless-stopped
    ports:
      # The NAS reverse proxy for https://mserver.sublogue.com targets this fixed
      # port. Keep host and container on 32768 so Docker's published mapping and
      # the process listener cannot drift apart.
      - "${MEMBY_PORT:-32768}:32768"
    environment:
      MEMBY_LISTEN_ADDR: ":32768"
      # INFO keeps Docker logs concise. Temporarily use DEBUG to include successful
      # health checks, maintenance polling and artwork requests.
      MEMBY_LOG_LEVEL: "${MEMBY_LOG_LEVEL:-INFO}"
      MEMBY_LOG_BUFFER_CAPACITY: "${MEMBY_LOG_BUFFER_CAPACITY:-5000}"
      GOMEMLIMIT: "${MEMBY_GOMEMLIMIT:-384MiB}"
      # Local day boundaries and labels for Sonarr and Radarr schedule rows.
      MEMBY_TIMEZONE: "${MEMBY_TIMEZONE:-Pacific/Auckland}"
      # How the gateway reaches Emby.
      MEMBY_EMBY_URL: "${MEMBY_EMBY_URL:?set MEMBY_EMBY_URL in .env}"
      # What the TVs are told to stream from. Only set this when it differs from the
      # address above (video goes device -> Emby directly, never through the gateway).
      MEMBY_EMBY_PUBLIC_URL: "${MEMBY_EMBY_PUBLIC_URL:-}"
      MEMBY_DATABASE_URL: "postgres://memby:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/memby?sslmode=disable"
      MEMBY_REDIS_URL: "redis://redis:6379/0"
      MEMBY_HOME_TTL: "${MEMBY_HOME_TTL:-60s}"
      MEMBY_RECOMMEND_TTL: "${MEMBY_RECOMMEND_TTL:-24h}"
      # Strict per-Emby-user TV allowance. Signing the same physical TV in again
      # replaces its token and does not consume another slot.
      # Unset disables /admin entirely — the library import, maintenance switch and
      # analytics page all live behind it.
      MEMBY_ADMIN_TOKEN: "${MEMBY_ADMIN_TOKEN:-}"
      # CI publishes signed APKs here. The dedicated token does not grant access to the
      # rest of the admin API.
      MEMBY_PUBLIC_URL: "${MEMBY_PUBLIC_URL:-https://mserver.sublogue.com}"
      MEMBY_RELEASE_DIR: "/data/releases"
      MEMBY_RELEASE_PUBLISH_TOKEN: "${MEMBY_RELEASE_PUBLISH_TOKEN:-}"
      # Hourly incremental import: enough for episodes landing through the day, and
      # films appearing weekly ride along.
      MEMBY_SYNC_INTERVAL: "${MEMBY_SYNC_INTERVAL:-1h}"
      MEMBY_SYNC_ON_START: "${MEMBY_SYNC_ON_START:-false}"
      MEMBY_SYNC_USER_ID: "${MEMBY_SYNC_USER_ID:-}"
      MEMBY_SYNC_API_KEY: "${MEMBY_SYNC_API_KEY:-}"
      # Optional read-only Sonarr calendar integration. Both values are required to
      # enable it; the API key remains inside the gateway.
      MEMBY_SONARR_URL: "${MEMBY_SONARR_URL:-}"
      MEMBY_SONARR_API_KEY: "${MEMBY_SONARR_API_KEY:-}"
      MEMBY_SONARR_TTL: "${MEMBY_SONARR_TTL:-5m}"
      # Optional read-only Radarr calendar integration. Only digital release dates
      # appear in the five-day movie row.
      MEMBY_RADARR_URL: "${MEMBY_RADARR_URL:-}"
      MEMBY_RADARR_API_KEY: "${MEMBY_RADARR_API_KEY:-}"
      MEMBY_RADARR_TTL: "${MEMBY_RADARR_TTL:-5m}"
      # Optional Tracearr public API. Memby reads recent playback analytics to rank
      # the dedicated For You area; the token never leaves this container.
      MEMBY_TRACEARR_URL: "${MEMBY_TRACEARR_URL:-}"
      MEMBY_TRACEARR_API_KEY: "${MEMBY_TRACEARR_API_KEY:-}"
      MEMBY_TRACEARR_SERVER_ID: "${MEMBY_TRACEARR_SERVER_ID:-}"
      MEMBY_TRACEARR_SYNC_INTERVAL: "${MEMBY_TRACEARR_SYNC_INTERVAL:-5m}"
      MEMBY_TRACEARR_FULL_INTERVAL: "${MEMBY_TRACEARR_FULL_INTERVAL:-24h}"
      MEMBY_FOR_YOU_MIN_REBUILD_AGE: "${MEMBY_FOR_YOU_MIN_REBUILD_AGE:-24h}"
      MEMBY_FOR_YOU_REFRESH_INTERVAL: "${MEMBY_FOR_YOU_REFRESH_INTERVAL:-24h}"
      MEMBY_FOR_YOU_REBUILD_HOUR: "${MEMBY_FOR_YOU_REBUILD_HOUR:-4}"
    mem_limit: "${MEMBY_SERVER_MEMORY_LIMIT:-512m}"
    volumes:
      - memby-releases:/data/releases
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      # No shell or curl in a distroless image, so probe with the binary's own server
      # via the container's TCP port from the Docker healthcheck's perspective.
      test: ["CMD", "/app/memby-server", "-healthcheck"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: memby
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}"
      POSTGRES_DB: memby
    volumes:
      - memby-postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U memby -d memby"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: ["redis-server", "--save", "", "--appendonly", "no", "--maxmemory", "256mb", "--maxmemory-policy", "allkeys-lru"]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  memby-postgres:
  memby-releases: