memby/docker-compose.yml

name: memby

services:
  server:
    build: ./server
    restart: unless-stopped
    ports:
      # The NAS reverse proxy for https://mserver.sublogue.com targets this fixed
      # port. Keep host and container on 32768 so Docker's published mapping and
      # the process listener cannot drift apart.
      - "${MEMBY_PORT:-32768}:32768"
    environment:
      MEMBY_LISTEN_ADDR: ":32768"
      # INFO keeps Docker logs concise. Temporarily use DEBUG to include successful
      # health checks, maintenance polling and artwork requests.
      MEMBY_LOG_LEVEL: "${MEMBY_LOG_LEVEL:-INFO}"
      MEMBY_LOG_BUFFER_CAPACITY: "${MEMBY_LOG_BUFFER_CAPACITY:-5000}"
      # Structured history is restored into the admin log after a deployment.
      MEMBY_LOG_HISTORY_PATH: "${MEMBY_LOG_HISTORY_PATH:-/data/logs/events.jsonl}"
      # console is one aligned, readable line per event; logfmt and json are for tools.
      MEMBY_LOG_FORMAT: "${MEMBY_LOG_FORMAT:-console}"
      GOMEMLIMIT: "${MEMBY_GOMEMLIMIT:-384MiB}"
      # Local day boundaries and labels for Sonarr and Radarr schedule rows.
      MEMBY_TIMEZONE: "${MEMBY_TIMEZONE:-Pacific/Auckland}"
      # How the gateway reaches Emby.
      MEMBY_EMBY_URL: "${MEMBY_EMBY_URL:?set MEMBY_EMBY_URL in .env}"
      # What the TVs are told to stream from. Only set this when it differs from the
      # address above (video goes device -> Emby directly, never through the gateway).
      MEMBY_EMBY_PUBLIC_URL: "${MEMBY_EMBY_PUBLIC_URL:-}"
      # Where the gateway reads media *bytes* from, which only credits detection does.
      # Blank falls back to MEMBY_EMBY_URL; set it to the LAN address when Emby is on a
      # different host, or every ranged read takes the public route and a buffering proxy
      # turns it into a whole-file read.
      MEMBY_EMBY_MEDIA_URL: "${MEMBY_EMBY_MEDIA_URL:-}"
      MEMBY_DATABASE_URL: "postgres://memby:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/memby?sslmode=disable"
      MEMBY_REDIS_URL: "redis://redis:6379/0"
      MEMBY_HOME_TTL: "${MEMBY_HOME_TTL:-60s}"
      MEMBY_RECOMMEND_TTL: "${MEMBY_RECOMMEND_TTL:-24h}"
      # Complete, schema-validated presentation document. Blank serves bundled-equivalent
      # defaults; downloaded changes are activated by TVs on their next app process.
      MEMBY_REMOTE_CONFIG_JSON: "${MEMBY_REMOTE_CONFIG_JSON:-}"
      # Strict per-Emby-user TV allowance. Signing the same physical TV in again
      # replaces its token and does not consume another slot.
      # Unset disables /admin entirely — the library import, maintenance switch and
      # analytics page all live behind it.
      MEMBY_ADMIN_TOKEN: "${MEMBY_ADMIN_TOKEN:-}"
      # Where the console's own container serves its built assets. Internal to this
      # network: memby-admin is never published, and the gateway proxies /admin to it so
      # the console shares this origin, this cookie and this single ingress. Blank
      # disables the console while leaving the /admin API intact for automation.
      MEMBY_ADMIN_UI_URL: "${MEMBY_ADMIN_UI_URL:-http://memby-admin:80}"
      # CI publishes signed APKs here. The dedicated token does not grant access to the
      # rest of the admin API.
      MEMBY_PUBLIC_URL: "${MEMBY_PUBLIC_URL:-https://mserver.sublogue.com}"
      MEMBY_RELEASE_DIR: "/data/releases"
      # The value is a Compose secret, not a container environment variable. This
      # keeps the release credential out of `docker inspect` while preserving the
      # existing CI/backend publish API.
      MEMBY_RELEASE_PUBLISH_TOKEN_FILE: "/run/secrets/memby_release_publish_token"
      # Hourly incremental import: enough for episodes landing through the day, and
      # films appearing weekly ride along.
      MEMBY_SYNC_INTERVAL: "${MEMBY_SYNC_INTERVAL:-1h}"
      MEMBY_SYNC_ON_START: "${MEMBY_SYNC_ON_START:-false}"
      MEMBY_SYNC_USER_ID: "${MEMBY_SYNC_USER_ID:-}"
      MEMBY_SYNC_API_KEY: "${MEMBY_SYNC_API_KEY:-}"
      # Optional read-only Sonarr calendar integration. Both values are required to
      # enable it; the API key remains inside the gateway.
      MEMBY_SONARR_URL: "${MEMBY_SONARR_URL:-}"
      MEMBY_SONARR_API_KEY: "${MEMBY_SONARR_API_KEY:-}"
      MEMBY_SONARR_TTL: "${MEMBY_SONARR_TTL:-5m}"
      # The webhook Sonarr and Radarr push into, which is how the catalogue learns a file
      # landed rather than waiting for the hourly sweep. Empty is what makes each hook 404,
      # so a token missing *here* is indistinguishable from one never configured at all —
      # every variable the gateway reads has to be named in this list to reach it.
      MEMBY_SONARR_WEBHOOK_TOKEN: "${MEMBY_SONARR_WEBHOOK_TOKEN:-}"
      MEMBY_SONARR_ALERT_WINDOW: "${MEMBY_SONARR_ALERT_WINDOW:-3h}"
      # How long after a webhook the gateway first looks for the file in Emby.
      MEMBY_ARR_INGEST_SETTLE: "${MEMBY_ARR_INGEST_SETTLE:-1m}"
      # Optional read-only Radarr calendar integration. Only digital release dates
      # appear in the five-day movie row.
      MEMBY_RADARR_URL: "${MEMBY_RADARR_URL:-}"
      MEMBY_RADARR_API_KEY: "${MEMBY_RADARR_API_KEY:-}"
      MEMBY_RADARR_TTL: "${MEMBY_RADARR_TTL:-5m}"
      MEMBY_RADARR_WEBHOOK_TOKEN: "${MEMBY_RADARR_WEBHOOK_TOKEN:-}"
      MEMBY_RADARR_ALERT_WINDOW: "${MEMBY_RADARR_ALERT_WINDOW:-3h}"
      # The reachability probe behind the outage bar and its two banners. 0 turns it off.
      MEMBY_EMBY_HEALTH_INTERVAL: "${MEMBY_EMBY_HEALTH_INTERVAL:-60s}"
      # Optional overrides for the recommendation scorer. Blank keeps the built-in weights.
      MEMBY_RECOMMENDATION_WEIGHTS: "${MEMBY_RECOMMENDATION_WEIGHTS:-}"
      # Optional Tracearr public API. Memby reads recent playback analytics to rank
      # the dedicated For You area; the token never leaves this container.
      MEMBY_TRACEARR_URL: "${MEMBY_TRACEARR_URL:-}"
      MEMBY_TRACEARR_API_KEY: "${MEMBY_TRACEARR_API_KEY:-}"
      MEMBY_TRACEARR_SERVER_ID: "${MEMBY_TRACEARR_SERVER_ID:-}"
      MEMBY_TRACEARR_SYNC_INTERVAL: "${MEMBY_TRACEARR_SYNC_INTERVAL:-5m}"
      MEMBY_TRACEARR_FULL_INTERVAL: "${MEMBY_TRACEARR_FULL_INTERVAL:-24h}"
      MEMBY_FOR_YOU_MIN_REBUILD_AGE: "${MEMBY_FOR_YOU_MIN_REBUILD_AGE:-24h}"
      MEMBY_FOR_YOU_REFRESH_INTERVAL: "${MEMBY_FOR_YOU_REFRESH_INTERVAL:-24h}"
      MEMBY_FOR_YOU_REBUILD_HOUR: "${MEMBY_FOR_YOU_REBUILD_HOUR:-4}"
      # Credits detection, which reads the demand the Tracearr settings above import: it
      # scans a few episodes ahead of each viewer rather than the library. Off unless the
      # .env says otherwise, because it is the only thing here that opens a media file.
      MEMBY_CREDITS_ENABLED: "${MEMBY_CREDITS_ENABLED:-false}"
      MEMBY_CREDITS_FFMPEG: "${MEMBY_CREDITS_FFMPEG:-}"
      MEMBY_CREDITS_PREFETCH_EPISODES: "${MEMBY_CREDITS_PREFETCH_EPISODES:-3}"
      MEMBY_CREDITS_MAX_PREFETCH: "${MEMBY_CREDITS_MAX_PREFETCH:-5}"
      MEMBY_CREDITS_QUEUE_LIMIT: "${MEMBY_CREDITS_QUEUE_LIMIT:-20}"
    mem_limit: "${MEMBY_SERVER_MEMORY_LIMIT:-512m}"
    volumes:
      - memby-releases:/data/releases
      - memby-logs:/data/logs
    secrets:
      - memby_release_publish_token
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      # Started, not healthy: the gateway serves televisions and must not wait on the
      # console to come up. A console that is not answering yet is a page that says so.
      memby-admin:
        condition: service_started
    healthcheck:
      # No shell or curl in a distroless image, so probe with the binary's own server
      # via the container's TCP port from the Docker healthcheck's perspective.
      test: ["CMD", "/app/memby-server", "-healthcheck"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  # The operations console: a React application built at image time and served by nginx.
  #
  # Deliberately not published. The household's reverse proxy sends one hostname to the
  # gateway and nothing else, and the admin session is a cookie on that origin — so the
  # gateway proxies /admin here rather than this being a second origin with its own proxy
  # rule, its own CORS allowlist and a cookie relaxed to SameSite=None to survive the
  # crossing. It holds no state and no credentials; replacing it is replacing a directory
  # of files.
  memby-admin:
    build: ./admin-ui
    restart: unless-stopped
    expose:
      - "80"
    read_only: true
    # The only writable paths nginx needs. Everything else in the image is static.
    tmpfs:
      - /var/cache/nginx
      - /var/run
    mem_limit: "${MEMBY_ADMIN_MEMORY_LIMIT:-64m}"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 5s

  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: memby
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}"
      POSTGRES_DB: memby
    volumes:
      - memby-postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U memby -d memby"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: ["redis-server", "--save", "", "--appendonly", "no", "--maxmemory", "256mb", "--maxmemory-policy", "allkeys-lru"]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  memby-postgres:
  memby-releases:
  memby-logs:

secrets:
  memby_release_publish_token:
    file: "${MEMBY_SECRETS_DIR:-./secrets}/memby-release-publish-token"