name: whatido

services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: whereldo
      POSTGRES_USER: app
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      TZ: Europe/Moscow
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U app -d whereldo"]
      interval: 2s
      timeout: 3s
      retries: 10

  app:
    build:
      context: .
      network: host
    expose:
      - "3003"
      - "3443"
    ports:
      - "3003:3003"
      - "3443:3443"
    environment:
      DATABASE_URL: postgres://app:${DB_PASSWORD}@db:5432/whereldo
      ADMIN_PASSWORD: ${ADMIN_PASSWORD}
      ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}
      BACKUP_UPLOAD_LIMIT_MB: ${BACKUP_UPLOAD_LIMIT_MB:-500}
      AI_MODEL: ${AI_MODEL:-qwen2.5-1.5b-instruct-q4_k_m.gguf}
      AI_PROMPT: ${AI_PROMPT:-}
      AI_REQUEST_TIMEOUT_MS: ${AI_REQUEST_TIMEOUT_MS:-120000}
      NODE_ENV: production
      TZ: Europe/Moscow
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - ./uploads:/app/uploads

  # Публикация через Tailscale (Serve / Funnel) без проброса портов.
  # Приложение доступно по https://whatido.<tailnet>.ts.net
#  tailscale:
#    image: tailscale/tailscale:latest
#    hostname: whatido
#    restart: unless-stopped
#    network_mode: host
#    cap_add:
#      - NET_ADMIN
#      - SYS_MODULE
#    environment:
#      SSL_CERT_FILE: /etc/tailscale/app-certs/cert.pem
#    volumes:
#      - /var/lib/tailscale:/var/lib/tailscale
#      - /dev/net/tun:/dev/net/tun
#      - /lib/modules:/lib/modules:ro
#      - ./certs:/etc/tailscale/app-certs:ro
#      - ./start-tailscale.sh:/start-tailscale.sh:ro
#    command: ["/bin/sh", "/start-tailscale.sh"]
#    depends_on:
#      - app

  # Публикация наружу через Cloudflare Tunnel (cloudflared), Quick Tunnel:
  # случайный публичный URL *.trycloudflare.com, который печатается в логах:
  #   docker compose logs -f cloudflared
  # Сборка из Dockerfile.cloudflared добавляет опциональный WireGuard:
  # если в wg/wg0.conf лежит конфиг — контейнер сначала поднимает VPN и
  # только потом запускает туннель (исход Cloudflare через VPN). Без конфига
  # туннель стартует сразу, как в базовой схеме.
  cloudflared:
    build:
      context: .
      dockerfile: Dockerfile.cloudflared
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    volumes:
      - ./wg:/etc/wireguard:ro
    environment:
      TZ: Europe/Moscow
      CLOUDFLARE_TUNNEL_URL: ${CLOUDFLARE_TUNNEL_URL:-http://app:3003}
    depends_on:
      - app



  text-corrector:
    image: ghcr.io/ggml-org/llama.cpp:server
    container_name: text-corrector
    restart: unless-stopped

    entrypoint: ["/bin/sh", "/start-text-corrector.sh"]

    environment:
      AI_MODEL: ${AI_MODEL:-qwen2.5-1.5b-instruct-q4_k_m.gguf}
      AI_MODEL_REPO: ${AI_MODEL_REPO:-Qwen/Qwen2.5-1.5B-Instruct-GGUF}
      HUGGINGFACE_TOKEN: ${HUGGINGFACE_TOKEN:-}

    volumes:
      - ./models:/models
      - ./start-text-corrector.sh:/start-text-corrector.sh:ro

    ports:
      - "8080:8080"




volumes:
  pgdata: