docker-compose.yml

name: nextsearch

x-app-env: &app-env
  APP_NAME: ${APP_NAME:-NextSearch}
  APP_ENV: ${APP_ENV:-production}
  APP_DEBUG: ${APP_DEBUG:-false}
  APP_KEY: ${APP_KEY:?APP_KEY fehlt — siehe .env.example}
  APP_URL: ${APP_URL:-http://localhost:3000}
  ADMIN_NAME: ${ADMIN_NAME:-Administrator}
  ADMIN_EMAIL: ${ADMIN_EMAIL:-admin@example.com}
  ADMIN_PASSWORD: ${ADMIN_PASSWORD:-change-me-please}

  # Backing services default to the bundled containers. Point any host at an
  # external server to use your own — see docs/hosting.md.
  DB_CONNECTION: pgsql
  DB_HOST: ${DB_HOST:-postgres}
  DB_PORT: ${DB_PORT:-5432}
  DB_DATABASE: ${DB_DATABASE:-nextsearch}
  DB_USERNAME: ${DB_USERNAME:-nextsearch}
  DB_PASSWORD: ${DB_PASSWORD:-nextsearch}

  REDIS_HOST: ${REDIS_HOST:-redis}
  REDIS_PORT: ${REDIS_PORT:-6379}
  REDIS_PASSWORD: ${REDIS_PASSWORD:-null}
  # High availability: set these to run against Redis Sentinel instead of a
  # single host (see docs/hosting.md). Empty keeps the single-Redis path.
  REDIS_SENTINELS: ${REDIS_SENTINELS:-}
  REDIS_SENTINEL_SERVICE: ${REDIS_SENTINEL_SERVICE:-mymaster}
  CACHE_STORE: redis
  QUEUE_CONNECTION: redis
  SESSION_DRIVER: redis
  SESSION_SAME_SITE: lax

  # Indexing goes through the native Meilisearch client, not Laravel Scout —
  # there are no SCOUT_* variables on purpose.
  MEILISEARCH_HOST: ${MEILISEARCH_HOST:-http://meilisearch:7700}
  MEILISEARCH_KEY: ${MEILI_MASTER_KEY:?MEILI_MASTER_KEY fehlt}

  FILESYSTEM_DISK: s3
  AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-nextsearch}
  AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-nextsearch-secret}
  AWS_DEFAULT_REGION: ${AWS_DEFAULT_REGION:-us-east-1}
  AWS_BUCKET: ${AWS_BUCKET:-nextsearch}
  # A prefix inside the bucket, so NextSearch lives in a subfolder rather than
  # at the bucket root. Empty = the bucket root.
  AWS_ROOT: ${AWS_ROOT:-}
  AWS_ENDPOINT: ${AWS_ENDPOINT:-http://minio:9000}
  AWS_USE_PATH_STYLE_ENDPOINT: ${AWS_USE_PATH_STYLE_ENDPOINT:-true}

  INDEX_DEFAULT_INTERVAL_MINUTES: ${INDEX_DEFAULT_INTERVAL_MINUTES:-15}
  INDEX_MAX_FILE_SIZE_MB: ${INDEX_MAX_FILE_SIZE_MB:-100}
  INDEX_EXTENSIONS: ${INDEX_EXTENSIONS:-}

  # Only the starting point for the "Neu" tag — an administrator adjusts the
  # shelf life in the interface, and that is not overwritten on restart.
  TAGS_NEW_DURATION_MINUTES: ${TAGS_NEW_DURATION_MINUTES:-10080}
  API_RATE_LIMIT: ${API_RATE_LIMIT:-120}

  # The MCP server under /api/mcp and the OAuth flow in front of it. Both need
  # APP_URL to be the address people actually reach — a client compares it
  # against what it discovered. See docs/mcp.md.
  MCP_ENABLED: ${MCP_ENABLED:-true}
  MCP_SERVER_NAME: ${MCP_SERVER_NAME:-NextSearch}
  MCP_RATE_LIMIT: ${MCP_RATE_LIMIT:-240}
  MCP_MAX_RESULTS: ${MCP_MAX_RESULTS:-25}
  MCP_OAUTH_ENABLED: ${MCP_OAUTH_ENABLED:-true}
  MCP_OAUTH_DYNAMIC_REGISTRATION: ${MCP_OAUTH_DYNAMIC_REGISTRATION:-true}
  MCP_OAUTH_REGISTRATION_RATE_LIMIT: ${MCP_OAUTH_REGISTRATION_RATE_LIMIT:-10}
  MCP_ACCESS_TOKEN_TTL_MINUTES: ${MCP_ACCESS_TOKEN_TTL_MINUTES:-60}
  MCP_REFRESH_TOKEN_TTL_DAYS: ${MCP_REFRESH_TOKEN_TTL_DAYS:-30}

  TIKA_URL: ${TIKA_URL:-http://tika:9998}
  TIKA_TIMEOUT: ${TIKA_TIMEOUT:-300}
  TIKA_OCR_ENABLED: ${TIKA_OCR_ENABLED:-true}
  TIKA_OCR_LANGUAGES: ${TIKA_OCR_LANGUAGES:-deu+eng}

  PREVIEW_ENABLED: ${PREVIEW_ENABLED:-true}
  PREVIEW_OFFICE_ENABLED: ${PREVIEW_OFFICE_ENABLED:-true}
  PREVIEW_WIDTH: ${PREVIEW_WIDTH:-600}
  GOTENBERG_URL: ${GOTENBERG_URL:-http://gotenberg:3000}

x-app-base: &app-base
  build:
    context: .
    dockerfile: docker/app/Dockerfile
  # Local builds tag this. In production, set APP_IMAGE to the published image
  # (mirkohaaser/nextsearch-app:<version>) and `docker compose pull` — no build
  # needed. See docs/hosting.md.
  image: ${APP_IMAGE:-nextsearch/app:local}
  environment: *app-env
  volumes:
    - app_storage:/app/storage
  depends_on:
    postgres:
      condition: service_healthy
    redis:
      condition: service_healthy
    meilisearch:
      condition: service_healthy
  restart: unless-stopped

services:
  # The only service with a published port. Nitro proxies /api to `app`, so the
  # UI and API share an origin and the session cookies work.
  web:
    build:
      context: .
      dockerfile: docker/web/Dockerfile
    # See APP_IMAGE above — WEB_IMAGE is the published web image in production.
    image: ${WEB_IMAGE:-nextsearch/web:local}
    environment:
      NUXT_PUBLIC_APP_NAME: ${APP_NAME:-NextSearch}
      # Where the web container reaches the backend. Read at runtime by the
      # /api proxy, so a split deployment (separate compose files on a shared
      # network) can point this at its own backend alias. See docs/hosting.md.
      NUXT_BACKEND_URL: ${NUXT_BACKEND_URL:-http://app:8080}
      NITRO_PORT: 3000
      NITRO_HOST: 0.0.0.0
    ports:
      - "${APP_PORT:-3000}:3000"
    depends_on:
      app:
        condition: service_healthy
    restart: unless-stopped

  app:
    <<: *app-base
    command: ["app-entrypoint", "serve"]
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/api/health"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 60s

  worker:
    <<: *app-base
    command: ["app-entrypoint", "worker"]
    depends_on:
      app:
        condition: service_healthy
    deploy:
      replicas: ${WORKER_REPLICAS:-2}

  scheduler:
    <<: *app-base
    command: ["app-entrypoint", "scheduler"]
    depends_on:
      app:
        condition: service_healthy

  postgres:
    image: postgres:18.4-alpine
    environment:
      POSTGRES_DB: ${DB_DATABASE:-nextsearch}
      POSTGRES_USER: ${DB_USERNAME:-nextsearch}
      POSTGRES_PASSWORD: ${DB_PASSWORD:-nextsearch}
    volumes:
      # Postgres 18+ legt die Daten in ein versioniertes Unterverzeichnis; das
      # Volume gehört deshalb an /var/lib/postgresql, nicht an /…/data.
      - postgres_data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USERNAME:-nextsearch} -d ${DB_DATABASE:-nextsearch}"]
      interval: 5s
      timeout: 5s
      retries: 20
    restart: unless-stopped

  redis:
    image: redis:8-alpine
    command: ["redis-server", "--appendonly", "yes"]
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped

  meilisearch:
    image: getmeili/meilisearch:v1.50.0
    environment:
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:?MEILI_MASTER_KEY fehlt}
      MEILI_ENV: production
      MEILI_NO_ANALYTICS: "true"
    volumes:
      - meili_data:/meili_data
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:7700/health"]
      interval: 10s
      timeout: 5s
      retries: 20
    restart: unless-stopped

  # Das -full-Tag bringt Tesseract samt Sprachpaketen mit — kein eigener OCR-Container.
  tika:
    image: apache/tika:3.3.1.0-full
    restart: unless-stopped

  # Nur für Vorschaubilder von Office-Dateien. PREVIEW_OFFICE_ENABLED=false
  # macht den Dienst überflüssig.
  gotenberg:
    image: gotenberg/gotenberg:8.34
    command:
      - gotenberg
      - --api-timeout=120s
      - --chromium-disable-javascript=true
      - --chromium-allow-list=file:///tmp/.*
    restart: unless-stopped

  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    command: ["server", "/data", "--console-address", ":9001"]
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-nextsearch}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-nextsearch-secret}
    volumes:
      - minio_data:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 20
    restart: unless-stopped

volumes:
  postgres_data:
  redis_data:
  meili_data:
  minio_data:
  app_storage: