docker-compose.yml.backup

# ---------------------------------------------------------------------------
# PRODUCTION MEDIA SERVER — docker-compose.yml
# Hardware: 48 Cores / 125GB RAM / NVIDIA GPU (Dual Xeon E5-2697 v2)
# Engine:   Docker Compose v2.27.0 (Non-Swarm)
# Network:  External media_network
# DB Tier:  pgvector/pg17 → PgBouncer (mandatory entry point :5432)
# Storage:  ZFS media-tank + ssd-cache + backup-tank | rclone VFS 500GB
# ---------------------------------------------------------------------------

# ===========================================================================
# ANCHORS
# ===========================================================================

x-common-env: &common-env
  PUID: ${PUID:-1000}
  PGID: ${PGID:-1000}
  UMASK: ${UMASK:-002}
  TZ: ${TZ:-America/New_York}

x-health-default: &health-default
  interval: 30s
  timeout: 10s
  retries: 3
  start_period: 60s

x-logging-default: &logging-default
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "5"
    compress: "true"

x-restart-policy: &restart-policy
  restart: unless-stopped

# Base for all standard services
x-service-base: &service-base
  <<: *restart-policy
  pull_policy: if_not_present
  networks: [media_network]
  logging: *logging-default
  ulimits:
    nofile:
      soft: 1048576
      hard: 1048576
  stop_grace_period: 90s

# Base specifically for Postgres (larger shm, longer grace)
x-pg-common: &pg-common
  image: pgvector/pgvector:pg17
  pull_policy: if_not_present
  <<: *restart-policy
  networks: [media_network]
  logging: *logging-default
  shm_size: "2g"
  tmpfs:
    - /tmp
  stop_grace_period: 180s

# Shared PgBouncer dependency block (avoids repetition across all Arr services)
x-pgbouncer-dep: &pgbouncer-dep
  db-ready:
    condition: service_completed_successfully
  pgbouncer:
    condition: service_healthy

# Shared dependency for Arr services that also need rclone mount
x-arr-dep: &arr-dep
  db-ready:
    condition: service_completed_successfully
  pgbouncer:
    condition: service_healthy
  rclone:
    condition: service_healthy


services:

  # ===========================================================================
  # 1) CORE DATABASE
  # ===========================================================================

  postgres:
    <<: *pg-common
    container_name: postgres
    environment:
      <<: *common-env
      POSTGRES_USER: ${MASTER_USER}
      POSTGRES_PASSWORD: ${MASTER_PASSWORD}
      POSTGRES_DB: postgres
    volumes:
      - /mnt/media/postgres:/var/lib/postgresql/data
    # Tuned for 48-core / 125GB host running ZFS.
    # ZFS ARC handles caching, so shared_buffers is reduced to prevent double-caching.
    # ZFS Copy-on-Write prevents torn pages, allowing us to disable full_page_writes.
    command: >
      postgres
      -c max_connections=64
      -c shared_buffers=8GB
      -c effective_cache_size=38GB
      -c maintenance_work_mem=2GB
      -c work_mem=64MB
      -c checkpoint_completion_target=0.9
      -c wal_buffers=16MB
      -c min_wal_size=2GB
      -c max_wal_size=16GB
      -c default_statistics_target=100
      -c random_page_cost=1.1
      -c effective_io_concurrency=100
      -c max_worker_processes=24
      -c max_parallel_workers_per_gather=4
      -c max_parallel_workers=16
      -c max_parallel_maintenance_workers=4
      -c shared_preload_libraries=pg_stat_statements
      -c pg_stat_statements.max=10000
      -c pg_stat_statements.track=all
      -c autovacuum_max_workers=6
      -c autovacuum_work_mem=256MB
      -c autovacuum_vacuum_scale_factor=0.05
      -c autovacuum_analyze_scale_factor=0.02
      -c full_page_writes=off
      -c wal_init_zero=off
      -c wal_recycle=off
    deploy:
      resources:
        limits:
          memory: 64G
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "pg_isready -U ${MASTER_USER} -d postgres"]

  pgbouncer:
    <<: *service-base
    container_name: pgbouncer
    image: edoburu/pgbouncer:latest
    environment:
      <<: *common-env
      DB_HOST: postgres
      DB_PORT: 5432
      DB_USER: ${MASTER_USER}
      DB_PASSWORD: ${MASTER_PASSWORD}
      AUTH_TYPE: scram-sha-256
      AUTH_USER: ${MASTER_USER}
      POOL_MODE: transaction
      MAX_CLIENT_CONN: 1000
      DEFAULT_POOL_SIZE: 50
      RESERVE_POOL_SIZE: 10
      SERVER_RESET_QUERY: DISCARD ALL
      # Sonarr/Radarr send extra_float_digits AND application_name on connect.
      # Both must be ignored in transaction mode or PgBouncer rejects the packet.
      IGNORE_STARTUP_PARAMETERS: extra_float_digits,application_name
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    ports:
      - "127.0.0.1:6432:5432"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "pg_isready -h localhost -p 5432 -U ${MASTER_USER}"]

  nginx-db:
    <<: *service-base
    container_name: nginx-db
    image: jc21/mariadb-aria:latest
    environment:
      <<: *common-env
      MYSQL_ROOT_PASSWORD: ${NPM_MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: ${NPM_MYSQL_DATABASE:-npm}
      MYSQL_USER: ${NPM_MYSQL_USER:-npm}
      MYSQL_PASSWORD: ${NPM_MYSQL_PASSWORD}
    volumes:
      - /mnt/media/mysql:/var/lib/mysql
    # O_DIRECT bypasses OS page cache — correct for ZFS ARC-managed storage.
    command: [
      "--skip-innodb-doublewrite",
      "--innodb_flush_method=O_DIRECT",
      "--innodb_use_native_aio=1",
      "--innodb_read_io_threads=16",
      "--innodb_write_io_threads=16"
    ]
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "mysqladmin ping -h localhost -uroot -p${NPM_MYSQL_ROOT_PASSWORD} >/dev/null || exit 1"]

  # Sentinel: confirms DB layer is fully ready before dependent services start.
  db-ready:
    image: alpine:3.20
    container_name: db-ready
    pull_policy: if_not_present
    networks: [media_network]
    logging: *logging-default
    restart: "no"
    depends_on:
      postgres:
        condition: service_healthy
      pgbouncer:
        condition: service_healthy
      nginx-db:
        condition: service_healthy
    command: ["sh", "-c", "echo 'DB layer healthy: postgres + pgbouncer + mariadb'"]

  # ===========================================================================
  # 2) STORAGE & SYNC
  # ===========================================================================

  nzbdav:
    <<: *service-base
    container_name: nzbdav
    image: nzbdav/nzbdav:${NZBDAV_TAG:-latest}
    profiles: [media]
    environment:
      <<: *common-env
      UPGRADE: ${NZBDAV_UPGRADE_TRACK:-0.6.x}
    ports:
      - "3000:3000"
    volumes:
      - /mnt/media/nzbdav/config:/config
      - /mnt:/mnt
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    depends_on:
      db-ready:
        condition: service_completed_successfully
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "wget --spider -q http://localhost:3000 || exit 1"]

  rclone-init:
    image: alpine:3.20
    container_name: rclone-init
    pull_policy: if_not_present
    networks: [media_network]
    logging: *logging-default
    restart: "no"
    profiles: [media]
    volumes:
      - /mnt:/mnt:rshared
    depends_on:
      nzbdav:
        condition: service_healthy
    # Ensures /mnt/nzbdav-data is a clean, empty directory before rclone mounts.
    # If a stale FUSE mount exists, rclone will fail with "mountpoint not empty".
    # This init container forcefully clears any leftover state on every stack start.
    command:
      - sh
      - -c
      - |
        MOUNT=/mnt/nzbdav-data
        echo "Checking $$MOUNT before rclone mount..."
        # Attempt lazy unmount in case a stale FUSE mount is still registered
        umount -l "$$MOUNT" 2>/dev/null && echo "  Stale mount removed." || true
        # Ensure the directory exists and is empty
        mkdir -p "$$MOUNT"
        if [ -n "$$(ls -A "$$MOUNT" 2>/dev/null)" ]; then
          echo "  WARNING: $$MOUNT is not empty after unmount attempt — rclone may fail."
          ls -la "$$MOUNT"
          exit 1
        fi
        echo "  ✅ $$MOUNT is clean and ready for rclone."

  rclone:
    <<: *service-base
    container_name: rclone
    image: rclone/rclone:1.73.1
    profiles: [media]
    cap_add: [SYS_ADMIN]
    devices: [/dev/fuse:/dev/fuse]
    security_opt: ["apparmor:unconfined"]
    ports:
      - "5572:5572"
    volumes:
      - /mnt/media/rclone/config:/config/rclone
      - /mnt:/mnt:rshared
      - /mnt/ssd-cache/rclone/cache-nzbdav:/cache
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    depends_on:
      nzbdav:
        condition: service_healthy
      rclone-init:
        condition: service_completed_successfully
    # VFS cache on ssd-cache: 500GB max, 4h max age, 64MB chunk read-ahead.
    # --vfs-fast-fingerprint + --no-checksum reduce API calls significantly.
    # WARNING: avoid `find`/`du` on /mnt/nzbdav-data — thrashes VFS cache.
    command: >
      mount nzbdav-data: /mnt/nzbdav-data
      --umask=002
      --allow-other
      --links
      --use-cookies
      --rc
      --rc-addr=0.0.0.0:5572
      --rc-no-auth
      --cache-dir=/cache
      --vfs-cache-mode full
      --vfs-cache-max-size ${RCLONE_VFS_CACHE_MAX_SIZE:-500G}
      --vfs-cache-max-age ${RCLONE_VFS_CACHE_MAX_AGE:-4h}
      --buffer-size 32M
      --vfs-read-chunk-size 32M
      --vfs-read-chunk-size-limit 2G
      --dir-cache-time 24h
      --attr-timeout 1h
      --no-modtime
      --no-checksum
      --vfs-fast-fingerprint
      --async-read=true
      --log-level ${RCLONE_LOG_LEVEL:-INFO}
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "mountpoint -q /mnt/nzbdav-data && rclone rc core/version --rc-addr 127.0.0.1:5572 >/dev/null 2>&1 || exit 1"]

  # ===========================================================================
  # 3) INDEXERS & DOWNLOADERS
  # ===========================================================================

  prowlarr:
    <<: *service-base
    container_name: prowlarr
    image: lscr.io/linuxserver/prowlarr:${PROWLARR_TAG:-latest}
    profiles: [media]
    environment:
      <<: *common-env
      PROWLARR__POSTGRES__HOST: pgbouncer
      PROWLARR__POSTGRES__PORT: 5432
      PROWLARR__POSTGRES__MAINDB: ${PROWLARR_DB:-prowlarr_db}
      PROWLARR__POSTGRES__USER: ${PROWLARR_DB_USER:-${MASTER_USER}}
      PROWLARR__POSTGRES__PASSWORD: ${PROWLARR_DB_PASSWORD:-${MASTER_PASSWORD}}
    volumes:
      - /mnt/media/prowlarr:/config
    ports:
      - "9696:9696"
    depends_on: *pgbouncer-dep
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "curl -fsS http://localhost:9696/ >/dev/null || exit 1"]

  # ===========================================================================
  # 4) MEDIA MANAGERS (ARRs)
  # ===========================================================================

  radarr:
    <<: *service-base
    container_name: radarr
    image: lscr.io/linuxserver/radarr:${RADARR_TAG:-latest}
    profiles: [media]
    environment:
      <<: *common-env
      RADARR__POSTGRES__HOST: pgbouncer
      RADARR__POSTGRES__PORT: 5432
      RADARR__POSTGRES__MAINDB: ${RADARR_DB:-radarr_db}
      RADARR__POSTGRES__USER: ${RADARR_DB_USER:-${MASTER_USER}}
      RADARR__POSTGRES__PASSWORD: ${RADARR_DB_PASSWORD:-${MASTER_PASSWORD}}
      RADARR_API_KEY: ${RADARR_API_KEY:-}
    ports:
      - "7878:7878"
    volumes:
      - /mnt/media/radarr/data:/config
      - /mnt:/mnt:rslave
    depends_on: *arr-dep
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "curl -fsS http://localhost:7878/ >/dev/null || exit 1"]

  sonarr:
    <<: *service-base
    container_name: sonarr
    image: lscr.io/linuxserver/sonarr:${SONARR_TAG:-latest}
    profiles: [media]
    environment:
      <<: *common-env
      SONARR__POSTGRES__HOST: pgbouncer
      SONARR__POSTGRES__PORT: 5432
      SONARR__POSTGRES__USER: ${SONARR_DB_USER:-${MASTER_USER}}
      SONARR__POSTGRES__PASSWORD: ${SONARR_DB_PASSWORD:-${MASTER_PASSWORD}}
      SONARR__POSTGRES__MAINDB: ${SONARR_DB:-sonarr}
      SONARR__POSTGRES__LOGDB: ${SONARR_LOG_DB:-sonarr-log}
    ports:
      - "8989:8989"
    volumes:
      - /mnt/media/sonarr/data:/config
      - /mnt:/mnt:rslave
    depends_on: *arr-dep
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "curl -fsS http://localhost:8989/ >/dev/null || exit 1"]

  sonarr-anime:
    <<: *service-base
    container_name: sonarr-anime
    image: lscr.io/linuxserver/sonarr:${SONARR_ANIME_TAG:-latest}
    profiles: [media]
    environment:
      <<: *common-env
      SONARR__POSTGRES__HOST: pgbouncer
      SONARR__POSTGRES__PORT: 5432
      SONARR__POSTGRES__USER: ${SONARR_ANIME_DB_USER:-${MASTER_USER}}
      SONARR__POSTGRES__PASSWORD: ${SONARR_ANIME_DB_PASSWORD:-${MASTER_PASSWORD}}
      SONARR__POSTGRES__MAINDB: ${SONARR_ANIME_DB:-sonarr-anime}
      SONARR__POSTGRES__LOGDB: ${SONARR_ANIME_LOG_DB:-sonarr-anime-log}
    ports:
      - "8990:8989"
    volumes:
      - /mnt/media/sonarranime/data:/config
      - /mnt:/mnt:rslave
    depends_on: *arr-dep
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "curl -fsS http://localhost:8989/ >/dev/null || exit 1"]

#  stash:
#    <<: *service-base
#    container_name: stash
#    image: stashapp/stash:latest
#    profiles: [media]
#    environment:
#      <<: *common-env
#      # Note: Postgres/API variables have been removed. 
#      # Stash uses SQLite by default, which is highly recommended.
#    ports:
#      # Stash defaults to 9999 instead of 6969
#      - "9999:9999"
#    volumes:
#      # The config folder MUST map to /root/.stash in the container
#      - /mnt/media/stash/data:/root/.stash
#      # Specific mount for your media directory
#      - /mnt:/mnt:rslave 
#    # depends_on: *arr-dep # (See note below about removing this)
#    healthcheck:
#      <<: *health-default
#      # Updated the port for the curl check
#      test: ["CMD-SHELL", "curl -fsS http://localhost:9999/ >/dev/null || exit 1"]

#  bookshelf:
#    <<: *service-base
#    container_name: bookshelf
#    # The :hardcover tag forces it to use the working Hardcover.app API
#    image: ghcr.io/pennydreadful/bookshelf:hardcover
#    profiles: [media]
#    environment:
#      <<: *common-env
#      # Bookshelf uses the exact same DB variables as Readarr!
#      READARR__POSTGRES__HOST: pgbouncer
#      READARR__POSTGRES__PORT: 5432
#      READARR__POSTGRES__USER: ${READARR_DB_USER:-${MASTER_USER}}
#      READARR__POSTGRES__PASSWORD: ${READARR_DB_PASSWORD:-${MASTER_PASSWORD}}
#      READARR__POSTGRES__MAINDB: ${READARR_DB:-readarr_main}
#      READARR__POSTGRES__LOGDB: ${READARR_LOG_DB:-readarr_log}
#      READARR__POSTGRES__CACHEDB: ${READARR_CACHE_DB:-readarr_cache}
#      READARR_API_KEY: ${READARR_API_KEY:-}
#    ports:
#      - "8787:8787"
#    volumes:
#      - /mnt/media/bookshelf/data:/config
#      - /mnt:/mnt:rslave
#    depends_on: *arr-dep
#    healthcheck:
#      <<: *health-default
#      test: ["CMD-SHELL", "curl -fsS http://localhost:8787/ >/dev/null || exit 1"]

# ===========================================================================
# 4b) MUSIC DISCOVERY (SoulSync + slskd)
# ===========================================================================

  slskd:
    <<: *service-base
    container_name: slskd
    image: slskd/slskd:latest
    profiles: [media]
    environment:
      <<: *common-env
      SLSKD_REMOTE_CONFIGURATION: "true"
      SLSKD_HTTP_LISTEN_PORT: 5030
      SLSKD_SLSK_LISTEN_PORT: 50300
      SLSKD_SHARED_DIR: /shares/music
      SLSKD_SLSK_USERNAME: ${SLSK_USER}
      SLSKD_SLSK_PASSWORD: ${SLSK_PASS}
      SLSKD_API_KEY: ${SLSKD_API_KEY}
    ports:
      - "5030:5030"
      - "50300:50300"
    volumes:
      - /mnt/media/slskd:/app                           # Config, DB, logs
      - /mnt/media/slskd/downloads:/downloads           # Staging area for raw Soulseek downloads
      - /mnt/music-tank:/shares/music:ro    # Share library back to Soulseek (avoids bans)
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "wget --spider -q http://localhost:5030/ || exit 1"]

  soulsync:
    <<: *service-base
    container_name: soulsync
    image: boulderbadgedad/soulsync:latest
    profiles: [media]
    environment:
      <<: *common-env
    ports:
      - "8008:8008"   # WebUI
      - "8888:8888"   # Spotify OAuth callback
      - "8889:8889"   # Internal callback port
    volumes:
      - /mnt/media/soulsync/config:/app/config          # Config files
      - /mnt/media/soulsync/logs:/app/logs              # Logs
      - /mnt/media/soulsync/data:/app/data                     # ⚠️ Named volume — host path breaks Python modules
      - /mnt/media/slskd/downloads:/app/downloads       # Reads slskd completed downloads (same host path as slskd)
      - /mnt/music-tank:/shares/music:ro    # Organized files drop directly into Emby library
    depends_on:
      slskd:
        condition: service_healthy
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "curl -f -s -m 5 http://localhost:8008/ || wget -q -O /dev/null -T 5 http://localhost:8008/ || exit 1"]

  # ===========================================================================
  # 5) REQUESTS & STATS
  # ===========================================================================

  seerr:
    <<: *service-base
    container_name: seerr
    image: ghcr.io/seerr-team/seerr:${JELLYSEERR_TAG:-latest}
    profiles: [media]
    environment:
      <<: *common-env
      DB_TYPE: postgres
      DB_HOST: pgbouncer
      DB_PORT: 5432
      DB_USER: ${JELLYSEERR_DB_USER:-jellyseerr}
      DB_PASS: ${JELLYSEERR_DB_PASSWORD:-jellyseerr}
      DB_NAME: ${JELLYSEERR_DB:-jellyseerr}
      DB_LOG_QUERIES: "false"
      JWT_SECRET: ${JWT_SECRET:-}
    volumes:
      - /mnt/media/jellyseerr/config:/app/config
    ports:
      - "5055:5055"
    depends_on: *pgbouncer-dep
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "wget --spider -q http://localhost:5055/api/v1/status || exit 1"]

#  jellystat:
#    <<: *service-base
#    container_name: jellystat
#    image: cyfershepard/jellystat:${JELLYSTAT_TAG:-latest}
#    profiles: [media]
#    environment:
#      <<: *common-env
#      POSTGRES_IP: pgbouncer
#      POSTGRES_PORT: 5432
#      POSTGRES_DB: ${JELLYSTAT_DB:-jfstat}
#      POSTGRES_USER: ${JELLYSTAT_DB_USER:-jellystat}
#      POSTGRES_PASSWORD: ${JELLYSTAT_DB_PASSWORD:?JELLYSTAT_DB_PASSWORD must be set in .env}
#      JWT_SECRET: ${JELLYSTAT_JWT_SECRET:?JELLYSTAT_JWT_SECRET must be set in .env}
#    volumes:
#      - /mnt/media/jellystat/backup-data:/app/backend/backup-data
#    ports:
#      - "3002:3000"
#    depends_on: *pgbouncer-dep
#    healthcheck:
#      <<: *health-default
#      test: ["CMD-SHELL", "wget --spider -q http://localhost:3000/ || exit 1"]

  # ===========================================================================
  # 6) MEDIA SERVERS / EDGE
  # ===========================================================================

  emby:
    <<: *service-base
    container_name: emby
    image: emby/embyserver:${EMBY_TAG:-latest}
    profiles: [media]
    runtime: nvidia   # GPU mandatory for hardware transcoding
    environment:
      <<: *common-env
      NVIDIA_VISIBLE_DEVICES: all
      NVIDIA_DRIVER_CAPABILITIES: compute,video,utility
    deploy:
      resources:
        limits:
          cpus: '40'    # Reserve 8 cores for OS + ZFS ARC management
          memory: 32G
    volumes:
      - /mnt/media/embyserver/data:/config
      - /mnt/ssd-cache/emby/cache:/config/cache
      - /mnt/ssd-cache/emby/transcode:/transcode
      - /mnt:/mnt:rslave
    ports:
      - "8096:8096"
    depends_on:
      db-ready:
        condition: service_completed_successfully
      rclone:
        condition: service_healthy
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "wget --spider -q http://localhost:8096/emby/system/info/public || exit 1"]

  nginx:
    <<: *service-base
    container_name: nginx
    image: jc21/nginx-proxy-manager:${NPM_TAG:-latest}
    profiles: [media]
    environment:
      DB_MYSQL_HOST: nginx-db
      DB_MYSQL_PORT: 3306
      DB_MYSQL_USER: ${NPM_MYSQL_USER:-npm}
      DB_MYSQL_PASSWORD: ${NPM_MYSQL_PASSWORD}
      DB_MYSQL_NAME: ${NPM_MYSQL_DATABASE:-npm}
    ports:
      - "80:80"
      - "443:443"
      - "81:81"
    volumes:
      - /mnt/media/nginx/data:/data
      - /mnt/media/nginx/letsencrypt:/etc/letsencrypt
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
    depends_on:
      db-ready:
        condition: service_completed_successfully
      nginx-db:
        condition: service_healthy
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:81/ >/dev/null || exit 1"]

  # ===========================================================================
  # 7) OPS / MONITORING
  # ===========================================================================

  scrutiny:
    <<: *service-base
    container_name: scrutiny
    image: ghcr.io/analogj/scrutiny:${SCRUTINY_TAG:-master-omnibus}
    profiles: [ops]
    cap_add:
      - SYS_RAWIO
    # TODO: Enumerate all ZFS pool drives. Run: lsblk -d -o NAME,SIZE,TYPE | grep disk
    devices:
      - /dev/sdb:/dev/sdb
      - /dev/sdc:/dev/sdc
    ports:
      - "8081:8080"
    volumes:
      - /run/udev:/run/udev:ro
    depends_on:
      db-ready:
        condition: service_completed_successfully
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/api/health >/dev/null || exit 1"]

  netdata:
    restart: unless-stopped
    container_name: netdata
    image: netdata/netdata:${NETDATA_TAG:-stable}
    profiles: [ops]
    hostname: ${NETDATA_HOSTNAME:-media-server}
    network_mode: host
    pid: host
    cap_add:
      - SYS_PTRACE
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    environment:
      <<: *common-env
      NETDATA_CLAIM_TOKEN: ${NETDATA_CLAIM_TOKEN:-}
      NETDATA_CLAIM_URL: ${NETDATA_CLAIM_URL:-https://app.netdata.cloud}
      NETDATA_CLAIM_ROOMS: ${NETDATA_CLAIM_ROOMS:-}
    volumes:
      - netdataconfig:/etc/netdata
      - netdatalib:/var/lib/netdata
      - netdatacache:/var/cache/netdata
      - /:/host/root:ro,rslave
      - /etc/passwd:/host/etc/passwd:ro
      - /etc/group:/host/etc/group:ro
      - /etc/localtime:/etc/localtime:ro
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /etc/os-release:/host/etc/os-release:ro
      - /var/log:/host/var/log:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /run/dbus:/run/dbus:ro

# ===========================================================================
# 8) STATIC WEBSERVER
# ===========================================================================

  webserver:
    <<: *service-base
    container_name: webserver
    image: nginx:alpine
    profiles: [media]
    environment:
      <<: *common-env
    volumes:
      # Maps a local folder to the Nginx default HTML directory
      - /mnt/media/webserver/html:/usr/share/nginx/html:ro
    ports:
      - "7050:80"
    healthcheck:
      <<: *health-default
      test: ["CMD-SHELL", "wget --spider -q http://localhost/ || exit 1"]

# ===========================================================================
# NETWORKS & VOLUMES
# ===========================================================================

networks:
  media_network:
    external: true

volumes:
  netdataconfig:
  netdatalib:
  netdatacache: