docker-compose.yml

services:
  telegram-backup:
    image: drumsergio/telegram-archive:latest
    container_name: telegram-backup
    restart: unless-stopped
    command: ["python", "-m", "src", "schedule"]

    environment:
      # Telegram Credentials (required)
      TELEGRAM_API_ID: ${TELEGRAM_API_ID}
      TELEGRAM_API_HASH: ${TELEGRAM_API_HASH}
      TELEGRAM_PHONE: ${TELEGRAM_PHONE}
      SESSION_NAME: ${SESSION_NAME:-telegram_backup}

      # Schedule (cron format)
      SCHEDULE: ${SCHEDULE:-0 */6 * * *}

      # Backup Configuration
      BACKUP_PATH: /data/backups
      DOWNLOAD_MEDIA: ${DOWNLOAD_MEDIA:-true}
      MAX_MEDIA_SIZE_MB: ${MAX_MEDIA_SIZE_MB:-100}
      BATCH_SIZE: ${BATCH_SIZE:-100}
      CHECKPOINT_INTERVAL: ${CHECKPOINT_INTERVAL:-1}
      # DEDUPLICATE_MEDIA: ${DEDUPLICATE_MEDIA:-true}
      # PRIORITY_CHAT_IDS: ${PRIORITY_CHAT_IDS:-}
      # SKIP_MEDIA_CHAT_IDS: ${SKIP_MEDIA_CHAT_IDS:-}
      # SKIP_MEDIA_DELETE_EXISTING: ${SKIP_MEDIA_DELETE_EXISTING:-true}
      # STATS_CALCULATION_HOUR: ${STATS_CALCULATION_HOUR:-3}

      # =======================================================================
      # CHAT FILTERING - Choose ONE mode:
      # =======================================================================
      # MODE 1 (Simple): Set CHAT_IDS to backup ONLY specific chats
      #   CHAT_IDS: "-100123456,-100789012"  # Only these chats, nothing else
      #
      # MODE 2 (Default): Use CHAT_TYPES to backup by type
      #   CHAT_TYPES: "private,groups,channels"  # All chats of these types
      # =======================================================================
      CHAT_IDS: ${CHAT_IDS:-}
      CHAT_TYPES: ${CHAT_TYPES-private,groups,channels}

      # Granular Filtering (only used in type-based mode)
      GLOBAL_INCLUDE_CHAT_IDS: ${GLOBAL_INCLUDE_CHAT_IDS:-}
      GLOBAL_EXCLUDE_CHAT_IDS: ${GLOBAL_EXCLUDE_CHAT_IDS:-}
      PRIVATE_INCLUDE_CHAT_IDS: ${PRIVATE_INCLUDE_CHAT_IDS:-}
      PRIVATE_EXCLUDE_CHAT_IDS: ${PRIVATE_EXCLUDE_CHAT_IDS:-}
      GROUPS_INCLUDE_CHAT_IDS: ${GROUPS_INCLUDE_CHAT_IDS:-}
      GROUPS_EXCLUDE_CHAT_IDS: ${GROUPS_EXCLUDE_CHAT_IDS:-}
      CHANNELS_INCLUDE_CHAT_IDS: ${CHANNELS_INCLUDE_CHAT_IDS:-}
      CHANNELS_EXCLUDE_CHAT_IDS: ${CHANNELS_EXCLUDE_CHAT_IDS:-}

      # Database Configuration (v3.0+)
      # Option 1: DATABASE_URL (takes priority)
      DATABASE_URL: ${DATABASE_URL:-}
      # Option 2: Individual settings
      DB_TYPE: ${DB_TYPE:-sqlite}
      DB_PATH: ${DB_PATH:-/data/backups/telegram_backup.db}
      # PostgreSQL settings (when DB_TYPE=postgresql or using DATABASE_URL)
      POSTGRES_HOST: ${POSTGRES_HOST:-postgres}
      POSTGRES_PORT: ${POSTGRES_PORT:-5432}
      POSTGRES_USER: ${POSTGRES_USER:-telegram}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-}
      POSTGRES_DB: ${POSTGRES_DB:-telegram_backup}

      # Real-time Listener
      # ENABLE_LISTENER is the master switch — when false, all LISTEN_* vars are ignored
      ENABLE_LISTENER: ${ENABLE_LISTENER:-false}
      # Granular listener controls (only apply when ENABLE_LISTENER=true):
      # LISTEN_EDITS: ${LISTEN_EDITS:-true}
      # LISTEN_DELETIONS: ${LISTEN_DELETIONS:-true}
      # LISTEN_NEW_MESSAGES: ${LISTEN_NEW_MESSAGES:-true}
      # LISTEN_NEW_MESSAGES_MEDIA: ${LISTEN_NEW_MESSAGES_MEDIA:-false}
      # LISTEN_CHAT_ACTIONS: ${LISTEN_CHAT_ACTIONS:-true}

      # Mass operation protection (only applies when ENABLE_LISTENER=true)
      # MASS_OPERATION_THRESHOLD: ${MASS_OPERATION_THRESHOLD:-10}
      # MASS_OPERATION_WINDOW_SECONDS: ${MASS_OPERATION_WINDOW_SECONDS:-30}
      # MASS_OPERATION_BUFFER_DELAY: ${MASS_OPERATION_BUFFER_DELAY:-2.0}

      # Batch sync alternative (expensive — prefer ENABLE_LISTENER instead)
      SYNC_DELETIONS_EDITS: ${SYNC_DELETIONS_EDITS:-false}
      VERIFY_MEDIA: ${VERIFY_MEDIA:-false}

      # Logging
      LOG_LEVEL: ${LOG_LEVEL:-INFO}

    volumes:
      # Persistent data storage
      - ./data:/data
    networks:
      - telegram-network
    # Security hardening
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    # Uncomment to use PostgreSQL
    # depends_on:
    #   postgres:
    #     condition: service_healthy
    # Optional: Resource limits
    # deploy:
    #   resources:
    #     limits:
    #       cpus: '1.0'
    #       memory: 1G
    #     reservations:
    #       cpus: '0.5'
    #       memory: 512M

  telegram-viewer:
    image: drumsergio/telegram-archive-viewer:latest
    container_name: telegram-viewer
    restart: unless-stopped
    ports:
      - "8000:8000"
    environment:
      BACKUP_PATH: /data/backups

      # Authentication (recommended — set both to enable)
      VIEWER_USERNAME: ${VIEWER_USERNAME:-}
      VIEWER_PASSWORD: ${VIEWER_PASSWORD:-}
      AUTH_SESSION_DAYS: ${AUTH_SESSION_DAYS:-30}

      # Display
      VIEWER_TIMEZONE: ${VIEWER_TIMEZONE:-Europe/Madrid}
      SHOW_STATS: ${SHOW_STATS:-true}
      # Restrict viewer to specific chats (optional)
      # DISPLAY_CHAT_IDS: ${DISPLAY_CHAT_IDS:-}

      # Security
      # CORS_ORIGINS: comma-separated allowed origins (default: * = allow all)
      # CORS_ORIGINS: ${CORS_ORIGINS:-*}
      # SECURE_COOKIES: auto-detect from protocol; override with true/false
      # SECURE_COOKIES: ${SECURE_COOKIES:-}

      # Notifications
      # PUSH_NOTIFICATIONS: ${PUSH_NOTIFICATIONS:-basic}
      # VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:-}
      # VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
      # VAPID_CONTACT: ${VAPID_CONTACT:-mailto:admin@example.com}

      # Database Configuration — MUST MATCH telegram-backup service!
      # If viewer shows no data, ensure these match the backup container
      DATABASE_URL: ${DATABASE_URL:-}
      DB_TYPE: ${DB_TYPE:-sqlite}
      DB_PATH: ${DB_PATH:-/data/backups/telegram_backup.db}
      POSTGRES_HOST: ${POSTGRES_HOST:-postgres}
      POSTGRES_PORT: ${POSTGRES_PORT:-5432}
      POSTGRES_USER: ${POSTGRES_USER:-telegram}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-}
      POSTGRES_DB: ${POSTGRES_DB:-telegram_backup}

      # Logging
      LOG_LEVEL: ${LOG_LEVEL:-INFO}

    volumes:
      # SQLite needs write access for WAL journal files (.db-wal, .db-shm).
      # Use :ro only if you are using PostgreSQL as the database backend.
      - ./data:/data
    networks:
      - telegram-network
    # Security hardening
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    # Uncomment to use PostgreSQL
    # depends_on:
    #   postgres:
    #     condition: service_healthy

  # Example: Restricted Channel Viewer (optional)
  # Use this to share specific channels publicly with authentication
  # telegram-channel-viewer:
  #   image: drumsergio/telegram-archive-viewer:latest
  #   container_name: telegram-channel-viewer
  #   restart: unless-stopped
  #   ports:
  #     - "8001:8000"
  #   environment:
  #     BACKUP_PATH: /data/backups
  #     DISPLAY_CHAT_IDS: 224091347,123456789  # Comma-separated chat IDs
  #     VIEWER_USERNAME: public_viewer
  #     VIEWER_PASSWORD: secure_password_here
  #   volumes:
  #     - ./data:/data
  #   networks:
  #     - telegram-network

  # ================================
  # PostgreSQL Database (Optional)
  # ================================
  # Uncomment to use PostgreSQL instead of SQLite
  # Also set DB_TYPE=postgresql in your .env file
  #
  # postgres:
  #   image: postgres:18-alpine
  #   container_name: telegram-postgres
  #   restart: unless-stopped
  #   environment:
  #     POSTGRES_USER: ${POSTGRES_USER:-telegram}
  #     POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
  #     POSTGRES_DB: ${POSTGRES_DB:-telegram_backup}
  #   volumes:
  #     - postgres_data:/var/lib/postgresql
  #   networks:
  #     - telegram-network
  #   healthcheck:
  #     test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-telegram} -d ${POSTGRES_DB:-telegram_backup}"]
  #     interval: 10s
  #     timeout: 5s
  #     retries: 5

networks:
  telegram-network:
    driver: bridge

# Uncomment for PostgreSQL persistent storage
# volumes:
#   postgres_data: