compose.yaml

services:
  app:
    build:
      context: .
    image: paperbrain:local
    restart: unless-stopped
    init: true
    depends_on:
      database:
        condition: service_healthy
    environment:
      NODE_ENV: production
      PORT: 3000
      DATABASE_URL: postgresql://${POSTGRES_USER:-app}:${POSTGRES_PASSWORD:-ChangeMe}@database:5432/${POSTGRES_DB:-app}
      DATABASE_SSL: "false"
      SESSION_SECRET: ${SESSION_SECRET:?Set SESSION_SECRET in .env; use `openssl rand -hex 32`}
      STORAGE_PATH: /data
      MAX_UPLOAD_SIZE_MB: ${MAX_UPLOAD_SIZE_MB:-100}
      CONVERSION_TIMEOUT_SECONDS: ${CONVERSION_TIMEOUT_SECONDS:-300}
      COOKIE_SECURE: ${COOKIE_SECURE:-false}
      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
    ports:
      - "${APP_PORT:-3000}:3000"
    volumes:
      - book_storage:/data
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/health/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    security_opt:
      - no-new-privileges:true

  database:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-app}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ChangeMe}
      POSTGRES_USER: ${POSTGRES_USER:-app}
    healthcheck:
      test: ["CMD", "pg_isready", "-d", "${POSTGRES_DB:-app}", "-U", "${POSTGRES_USER:-app}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    ports:
      - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
    volumes:
      - database_data:/var/lib/postgresql/data
    security_opt:
      - no-new-privileges:true

volumes:
  book_storage:
  database_data: