docker-compose.light.yml

# Light deployment: the minimal two-service stack (frontend + SQLite api) with
# no optional services (no Postgres, S3-compatible store, or backup config). Runs with zero
# env — `docker compose -f docker-compose.light.yml up -d` — but every value can
# still be overridden from a .env file or the shell if you want to.
services:
  frontend:
    image: ghcr.io/xiao-villamor/printstash-frontend:${PRINTSTASH_VERSION:-latest}
    container_name: printstash-frontend
    restart: unless-stopped
    ports:
      - "3000:3000"
    # nginx must allow request bodies up to the configured upload limit, or large
    # uploads fail with 413 before reaching the api.
    environment:
      NGINX_CLIENT_MAX_BODY_SIZE: ${VAULT_MAX_REQUEST_MB:-528}m
    networks:
      - printstash_net
    depends_on:
      api:
        condition: service_healthy

  api:
    image: ghcr.io/xiao-villamor/printstash-api-lite:${PRINTSTASH_VERSION:-latest}
    container_name: printstash-api
    restart: unless-stopped
    expose:
      - "8000"
    environment:
      VAULT_DATA_DIR: /data/files
      VAULT_THUMB_DIR: /data/thumbs
      VAULT_STAGING_DIR: /data/staging
      VAULT_BACKUP_DIR: /data/backups
      # DB path must always point at the persistent volume (see docker-compose.yml).
      VAULT_DB_URL: sqlite:////data/db/printstash.sqlite
      # Optional. The placeholder below is public, so the API never signs with it:
      # on first boot it generates a real secret and persists it (see 0.8.4). Set
      # this explicitly (`openssl rand -hex 32`) only to manage the value
      # yourself, e.g. to keep it across a rebuild of the database.
      # Do not set it to an empty string; that is taken as a deliberate choice
      # and skips the generated secret.
      VAULT_JWT_SECRET: ${VAULT_JWT_SECRET:-changeme_jwt_secret_please_change}
      VAULT_SETUP_MODE: ${VAULT_SETUP_MODE:-trusted_network}
      VAULT_SETUP_ALLOWED_HOSTS: ${VAULT_SETUP_ALLOWED_HOSTS:-}
      VAULT_SECRETS_KEY: ${VAULT_SECRETS_KEY:-}
      VAULT_SESSION_COOKIE_SECURE: ${VAULT_SESSION_COOKIE_SECURE:-false}
      VAULT_ACCESS_TOKEN_EXPIRE_MINUTES: ${VAULT_ACCESS_TOKEN_EXPIRE_MINUTES:-60}
      VAULT_REMEMBER_ME_DAYS: ${VAULT_REMEMBER_ME_DAYS:-2}
      VAULT_OIDC_ENABLED: ${VAULT_OIDC_ENABLED:-false}
      VAULT_OIDC_ISSUER_URL: ${VAULT_OIDC_ISSUER_URL:-}
      VAULT_OIDC_CLIENT_ID: ${VAULT_OIDC_CLIENT_ID:-}
      VAULT_OIDC_CLIENT_SECRET: ${VAULT_OIDC_CLIENT_SECRET:-}
      VAULT_OIDC_SCOPES: ${VAULT_OIDC_SCOPES:-openid profile email groups}
      VAULT_OIDC_USERNAME_CLAIM: ${VAULT_OIDC_USERNAME_CLAIM:-preferred_username}
      VAULT_OIDC_GROUPS_CLAIM: ${VAULT_OIDC_GROUPS_CLAIM:-groups}
      VAULT_OIDC_ADMIN_GROUPS: ${VAULT_OIDC_ADMIN_GROUPS:-printstash-admins}
      VAULT_OIDC_DISPLAY_NAME: ${VAULT_OIDC_DISPLAY_NAME:-Single sign-on}
      VAULT_OIDC_REDIRECT_URI: ${VAULT_OIDC_REDIRECT_URI:-}
      VAULT_OIDC_ALLOW_INSECURE_HTTP: ${VAULT_OIDC_ALLOW_INSECURE_HTTP:-false}
      VAULT_MAX_UPLOAD_MB: ${VAULT_MAX_UPLOAD_MB:-512}
      VAULT_PORTABLE_MANIFEST_MAX_MB: ${VAULT_PORTABLE_MANIFEST_MAX_MB:-128}
      VAULT_STAGING_MAX_PENDING: ${VAULT_STAGING_MAX_PENDING:-32}
      VAULT_STAGING_MAX_ACTIVE_PER_USER: ${VAULT_STAGING_MAX_ACTIVE_PER_USER:-4}
      VAULT_STAGING_MAX_GB: ${VAULT_STAGING_MAX_GB:-4}
      VAULT_STAGING_MIN_FREE_GB: ${VAULT_STAGING_MIN_FREE_GB:-1}
      VAULT_INGEST_WORKER_COUNT: ${VAULT_INGEST_WORKER_COUNT:-2}
      VAULT_MEDIA_WORKER_TIMEOUT_SECONDS: ${VAULT_MEDIA_WORKER_TIMEOUT_SECONDS:-180}
      VAULT_SQLITE_SYNCHRONOUS: ${VAULT_SQLITE_SYNCHRONOUS:-NORMAL}
      VAULT_LOG_LEVEL: ${VAULT_LOG_LEVEL:-INFO}
      # Safe because this API service is supervised by restart: unless-stopped.
      VAULT_RESTART_ENABLED: ${VAULT_RESTART_ENABLED:-true}
      # Set these to the host uid/gid when using bind mounts. The image keeps
      # the secure 10001:10001 defaults when they are omitted.
      PUID: "${PUID:-10001}"
      PGID: "${PGID:-10001}"
      TZ: UTC
      # See docker-compose.yml for what this does and when to set it.
      FORWARDED_ALLOW_IPS: ${FORWARDED_ALLOW_IPS:-}
    volumes:
      - printstash_data:/data/files
      - printstash_thumbs:/data/thumbs
      - printstash_db:/data/db
      - printstash_staging:/data/staging
      - printstash_backups:/data/backups
    networks:
      - printstash_net
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8000/api/v1/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    # No command override: the image entrypoint runs DB migrations on every start
    # then launches the server. Overriding it can silently skip migrations (#29).

networks:
  printstash_net:
    driver: bridge

volumes:
  printstash_data:
  printstash_thumbs:
  printstash_db:
  printstash_staging:
  printstash_backups: