compose.yaml

# Standalone deployment: docker compose up
#
#   WAXFLOW_API_KEYS=$(openssl rand -hex 24) docker compose up -d
#
# Mount your audio files under /library and name it as a root; signed URLs and
# the transcode cache persist in the named volumes.
#
# A build that injects a catalog resolver (pid:<ULID> sources) adds its image,
# WAXFLOW_CATALOG_DB, and a catalog mount in an override file you write, then
# layers it on top of this one:
#
#   docker compose -f compose.yaml -f your-catalog.yaml up -d
#
# Mount that catalog read-write even though a resolver opens it read-only: a
# SQLite catalog's WAL readers write read-marks into the -shm sidecar, so the
# daemon's UID (10001) needs write access to the -wal/-shm files beside the
# database, and a read-only mount fails at open.
#
# Exposure note (ADR-0007): this widens the listen address to 0.0.0.0 inside
# the container. Put TLS in front (native tlsCert/tlsKey or a terminating
# reverse proxy) before exposing the published port beyond your LAN.
services:
  waxflow:
    image: ghcr.io/colespringer/waxflow:latest
    environment:
      WAXFLOW_ADDR: 0.0.0.0:4418
      WAXFLOW_ROOTS: lib=/library
      # Fail-closed rule: a non-loopback listen address requires API keys
      # (or an explicit WAXFLOW_ALLOW_UNAUTHENTICATED=true, LAN-only).
      WAXFLOW_API_KEYS: ${WAXFLOW_API_KEYS:?set WAXFLOW_API_KEYS (comma-separated) or override allowUnauthenticated}
    ports:
      - "4418:4418"
    read_only: true
    tmpfs:
      - /tmp
    volumes:
      - waxflow-data:/data
      - waxflow-cache:/cache
      - ${WAXFLOW_LIBRARY:-./library}:/library:ro
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  waxflow-data:
  waxflow-cache: