services:
  needle-web:
    image: davidrelich/needle-web:latest
    container_name: needle-web
    restart: unless-stopped
    ports:
      # Direct LAN backend. Never forward this port from the router.
      - "2104:3000/tcp"
      # Dormant until managed HTTPS is enabled. Forward WAN TCP 443 here only then.
      - "${NEEDLE_MANAGED_HTTPS_PORT:-8443}:${NEEDLE_MANAGED_HTTPS_PORT:-8443}/tcp"
    environment:
      - PORT=3000
      - NEEDLE_LIBRARY_ROOTS=/music
      - NEEDLE_SECURE_COOKIES=auto
      # Leave empty unless this backend is private behind an explicitly addressed proxy.
      - NEEDLE_TRUSTED_PROXIES=
      - NEEDLE_ALLOWED_HOSTS=
      - NEEDLE_ALLOWED_ORIGINS=
      - NEEDLE_SETUP_TOKEN=
      - NEEDLE_AUTH_JSON_BODY_LIMIT=16kb
      - NEEDLE_DEFAULT_JSON_BODY_LIMIT=256kb
      - NEEDLE_MEDIUM_JSON_BODY_LIMIT=2mb
      - NEEDLE_ARTIST_IMAGE_JSON_BODY_LIMIT=17mb
      - NEEDLE_JSON_BODY_LIMIT=50mb
      - NEEDLE_MANAGED_CADDY_BIN=/usr/bin/caddy
      - NEEDLE_MANAGED_CADDY_DIR=/app/data/managed-caddy
      - NEEDLE_MANAGED_CADDY_RUNTIME_DIR=/tmp/needle-managed-caddy
      - NEEDLE_MANAGED_HTTPS_PORT=${NEEDLE_MANAGED_HTTPS_PORT:-8443}
      - NEEDLE_STREAMING_DERIVATIVES_ENABLED=true
      - NEEDLE_STREAMING_DERIVATIVE_DIR=/app/data/streaming-cache
      - NEEDLE_STREAMING_LOUDNESS_NORMALIZATION=true
      - NEEDLE_STREAMING_LOUDNESS_MODE=album
      - NEEDLE_STREAMING_TARGET_LUFS=-16
      - NEEDLE_STREAMING_TRUE_PEAK_DB=-1.5
      - NEEDLE_DERIVATIVE_CONCURRENCY=2
      - NEEDLE_DERIVATIVE_MIN_FREE_GB=10
      - NEEDLE_DERIVATIVE_MIN_FREE_PERCENT=10
      - NEEDLE_WRITE_BACK_ENABLED=true
      - NEEDLE_LOG_LEVEL=info
    volumes:
      # Change only the host-side paths on the left.
      - /srv/needle-web/data:/app/data
      # Append :ro and set NEEDLE_WRITE_BACK_ENABLED=false for a read-only server.
      - /media/music:/music