docker-stack.dev.yml

services:
  tpdapp:
    image: ${TICKET_PILOT_APP_IMAGE:?Set TICKET_PILOT_APP_IMAGE to a private GHCR dev app image}
    environment:
      DATABASE_URL: ${DATABASE_URL:?Set DATABASE_URL to the remote PostgreSQL URL}
      DATABASE_CONNECT_TIMEOUT_SECONDS: ${DATABASE_CONNECT_TIMEOUT_SECONDS:-5}
      DATABASE_POOL_SIZE: ${DATABASE_POOL_SIZE:-5}
      DATABASE_MAX_OVERFLOW: ${DATABASE_MAX_OVERFLOW:-10}
      DATABASE_POOL_TIMEOUT_SECONDS: ${DATABASE_POOL_TIMEOUT_SECONDS:-30}
      DATABASE_POOL_RECYCLE_SECONDS: ${DATABASE_POOL_RECYCLE_SECONDS:-1800}
      DATABASE_UNAVAILABLE_CHECK_INTERVAL_SECONDS: ${DATABASE_UNAVAILABLE_CHECK_INTERVAL_SECONDS:-5}
      APP_HEALTH_MONITOR_INTERVAL_SECONDS: ${APP_HEALTH_MONITOR_INTERVAL_SECONDS:-300}
      APP_HEALTH_DISK_WARNING_FREE_MB: ${APP_HEALTH_DISK_WARNING_FREE_MB:-1000}
      APP_HEALTH_DISK_CRITICAL_FREE_MB: ${APP_HEALTH_DISK_CRITICAL_FREE_MB:-250}
      APP_HEALTH_DB_LATENCY_WARNING_MS: ${APP_HEALTH_DB_LATENCY_WARNING_MS:-250}
      APP_HEALTH_DB_LATENCY_CRITICAL_MS: ${APP_HEALTH_DB_LATENCY_CRITICAL_MS:-1000}
      APP_HEALTH_DB_POOL_WARNING_PERCENT: ${APP_HEALTH_DB_POOL_WARNING_PERCENT:-80}
      APP_HEALTH_DB_POOL_CRITICAL_PERCENT: ${APP_HEALTH_DB_POOL_CRITICAL_PERCENT:-95}
      APP_HOST: 0.0.0.0
      APP_ENV: ${APP_ENV:-development}
      DEV_BUILD: ${DEV_BUILD:-true}
      APP_SECRET_KEY: ${APP_SECRET_KEY:?Set APP_SECRET_KEY}
      APP_USERNAME: ${APP_USERNAME:-admin}
      APP_PASSWORD: ${APP_PASSWORD:?Set APP_PASSWORD}
      ADMIN_CONTACT_EMAIL: ${ADMIN_CONTACT_EMAIL:-}
      NAVIGATION_OFFICE_ADDRESS: ${NAVIGATION_OFFICE_ADDRESS:-}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      APP_SESSION_COOKIE_SECURE: ${APP_SESSION_COOKIE_SECURE:-true}
      APP_SESSION_TIMEOUT_HOURS: ${APP_SESSION_TIMEOUT_HOURS:-12}
      CLOUDFLARE_ACCESS_REQUIRED: ${CLOUDFLARE_ACCESS_REQUIRED:-false}
      CLOUDFLARE_IP_BLOCKING_ENABLED: ${CLOUDFLARE_IP_BLOCKING_ENABLED:-false}
      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:-}
      CLOUDFLARE_ZONE_ID: ${CLOUDFLARE_ZONE_ID:-}
      CLOUDFLARE_IP_BLOCK_ALLOWLIST: ${CLOUDFLARE_IP_BLOCK_ALLOWLIST:-}
      CLOUDFLARE_AUTO_BLOCK_FAILED_LOGIN_ATTEMPTS: ${CLOUDFLARE_AUTO_BLOCK_FAILED_LOGIN_ATTEMPTS:-5}
      LOGIN_LOCAL_LOCKOUT_MINUTES: ${LOGIN_LOCAL_LOCKOUT_MINUTES:-15}
      PASSWORD_RESET_ENABLED: ${PASSWORD_RESET_ENABLED:-false}
      PASSWORD_RESET_TOKEN_TTL_HOURS: ${PASSWORD_RESET_TOKEN_TTL_HOURS:-24}
      PASSWORD_RESET_FAILED_ATTEMPTS_BLOCK_THRESHOLD: ${PASSWORD_RESET_FAILED_ATTEMPTS_BLOCK_THRESHOLD:-3}
      APP_PUBLIC_BASE_URL: ${APP_PUBLIC_BASE_URL:-}
      MAIL_ENABLED: ${MAIL_ENABLED:-false}
      MAIL_FROM_EMAIL: ${MAIL_FROM_EMAIL:-ticketpilot@example.com}
      MAIL_FROM_NAME: ${MAIL_FROM_NAME:-TicketPilot}
      MAIL_MODE: ${MAIL_MODE:-smtp}
      MAIL_SMTP_HOST: ${MAIL_SMTP_HOST:-}
      MAIL_SMTP_PORT: ${MAIL_SMTP_PORT:-587}
      MAIL_SMTP_USERNAME: ${MAIL_SMTP_USERNAME:-}
      MAIL_SMTP_PASSWORD: ${MAIL_SMTP_PASSWORD:-}
      MAIL_SMTP_STARTTLS: ${MAIL_SMTP_STARTTLS:-true}
      MAIL_SMTP_SSL: ${MAIL_SMTP_SSL:-false}
      MAIL_SMTP_TIMEOUT_SECONDS: ${MAIL_SMTP_TIMEOUT_SECONDS:-10}
      MAIL_SMTP2GO_API_KEY: ${MAIL_SMTP2GO_API_KEY:-}
      TURNSTILE_ENABLED: ${TURNSTILE_ENABLED:-true}
      TURNSTILE_SITE_KEY: ${TURNSTILE_SITE_KEY:-}
      TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY:-}
      TURNSTILE_VERIFY_URL: ${TURNSTILE_VERIFY_URL:-https://challenges.cloudflare.com/turnstile/v0/siteverify}
      TURNSTILE_TIMEOUT_SECONDS: ${TURNSTILE_TIMEOUT_SECONDS:-10}
      PUSHOVER_ENABLED: ${PUSHOVER_ENABLED:-false}
      PUSHOVER_USER_KEY: ${PUSHOVER_USER_KEY:-}
      PUSHOVER_APP_KEY: ${PUSHOVER_APP_KEY:-}
      PUSHOVER_API_URL: ${PUSHOVER_API_URL:-https://api.pushover.net/1/messages.json}
      PUSHOVER_TIMEOUT_SECONDS: ${PUSHOVER_TIMEOUT_SECONDS:-10}
      PUSHOVER_REMINDER_INTERVAL_SECONDS: ${PUSHOVER_REMINDER_INTERVAL_SECONDS:-3600}
      WEBAUTHN_RP_NAME: ${WEBAUTHN_RP_NAME:-TicketPilot}
      WEBAUTHN_RP_ID: ${WEBAUTHN_RP_ID:-}
      WEBAUTHN_ORIGIN: ${WEBAUTHN_ORIGIN:-}
      TRANSCRIPTION_PROVIDER: ${TRANSCRIPTION_PROVIDER:-mock}
      MAX_AUDIO_UPLOAD_BYTES: ${MAX_AUDIO_UPLOAD_BYTES:-10485760}
      MAX_BACKUP_RESTORE_BYTES: ${MAX_BACKUP_RESTORE_BYTES:-262144000}
      AUTOMATIC_BACKUPS_ENABLED: ${AUTOMATIC_BACKUPS_ENABLED:-true}
      AUTOMATIC_BACKUP_DIR: ${AUTOMATIC_BACKUP_DIR:-/data/backups}
      FASTER_WHISPER_MODEL: ${FASTER_WHISPER_MODEL:-base.en}
      FASTER_WHISPER_DEVICE: ${FASTER_WHISPER_DEVICE:-cpu}
      FASTER_WHISPER_COMPUTE_TYPE: ${FASTER_WHISPER_COMPUTE_TYPE:-int8}
      FASTER_WHISPER_DOWNLOAD_ROOT: ${FASTER_WHISPER_DOWNLOAD_ROOT:-/models/faster-whisper}
      FASTER_WHISPER_LOCAL_FILES_ONLY: ${FASTER_WHISPER_LOCAL_FILES_ONLY:-false}
      FASTER_WHISPER_LANGUAGE: ${FASTER_WHISPER_LANGUAGE:-en}
      FASTER_WHISPER_BEAM_SIZE: ${FASTER_WHISPER_BEAM_SIZE:-5}
      FASTER_WHISPER_CPU_THREADS: ${FASTER_WHISPER_CPU_THREADS:-8}
      FASTER_WHISPER_INITIAL_PROMPT: ${FASTER_WHISPER_INITIAL_PROMPT:-Use normal written punctuation. When spoken punctuation words such as comma, period, question mark, exclamation point, colon, semicolon, dash, or new paragraph are heard, render punctuation marks and paragraph breaks instead of spelling those words.}
      FASTER_WHISPER_REMOTE_URL: ${FASTER_WHISPER_REMOTE_URL:-}
      FASTER_WHISPER_REMOTE_API_KEY: ${FASTER_WHISPER_REMOTE_API_KEY:-}
      FASTER_WHISPER_REMOTE_TIMEOUT_SECONDS: ${FASTER_WHISPER_REMOTE_TIMEOUT_SECONDS:-120}
      AI_CLEANUP_ENABLED: ${AI_CLEANUP_ENABLED:-false}
      AI_CLEANUP_PROVIDER: ${AI_CLEANUP_PROVIDER:-gemini}
      AI_CLEANUP_TIMEOUT_SECONDS: ${AI_CLEANUP_TIMEOUT_SECONDS:-20}
      AI_CLEANUP_MAX_INPUT_CHARS: ${AI_CLEANUP_MAX_INPUT_CHARS:-12000}
      AI_CLEANUP_REVERT_RETENTION_HOURS: ${AI_CLEANUP_REVERT_RETENTION_HOURS:-24}
      AI_CLEANUP_INSTRUCTIONS: ${AI_CLEANUP_INSTRUCTIONS:-Clean up MSP work-summary notes for an Autotask time entry. Preserve the technical facts, customer impact, ticket context, and any leading Remote or On-Site prefix. Improve grammar, punctuation, capitalization, and readability. Do not invent work, parts, durations, ticket numbers, root causes, customer approvals, or follow-up actions. Return only the cleaned summary text with no markdown, title, explanation, or surrounding quotes.}
      GEMINI_API_KEY: ${GEMINI_API_KEY:-}
      GEMINI_API_BASE: ${GEMINI_API_BASE:-https://generativelanguage.googleapis.com/v1beta/openai/}
      GEMINI_CLEANUP_MODEL: ${GEMINI_CLEANUP_MODEL:-gemini-3.5-flash}
      GROQ_API_KEY: ${GROQ_API_KEY:-}
      GROK_API_KEY: ${GROK_API_KEY:-}
      GROQ_CLEANUP_MODEL: ${GROQ_CLEANUP_MODEL:-}
      GROK_CLEANUP_MODEL: ${GROK_CLEANUP_MODEL:-}
      GROQ_CLEANUP_API_BASE_URL: ${GROQ_CLEANUP_API_BASE_URL:-}
      GROK_CLEANUP_API_BASE_URL: ${GROK_CLEANUP_API_BASE_URL:-}
      OLLAMA_CLEANUP_MODEL: ${OLLAMA_CLEANUP_MODEL:-llama3.1}
      OLLAMA_CLEANUP_API_BASE_URL: ${OLLAMA_CLEANUP_API_BASE_URL:-http://127.0.0.1:11434/api}
      LM_STUDIO_CLEANUP_MODEL: ${LM_STUDIO_CLEANUP_MODEL:-local-model}
      LM_STUDIO_CLEANUP_API_BASE_URL: ${LM_STUDIO_CLEANUP_API_BASE_URL:-http://127.0.0.1:1234/v1}
      LM_STUDIO_API_KEY: ${LM_STUDIO_API_KEY:-}
      AI_HELP_ENABLED: ${AI_HELP_ENABLED:-false}
      AI_HELP_PROVIDER: ${AI_HELP_PROVIDER:-gemini}
      GEMINI_MODEL: ${GEMINI_MODEL:-gemini-3.5-flash}
      AI_HELP_MAX_TOKENS: ${AI_HELP_MAX_TOKENS:-800}
      AI_HELP_TEMPERATURE: ${AI_HELP_TEMPERATURE:-0.2}
      AI_HELP_INSTRUCTIONS: ${AI_HELP_INSTRUCTIONS:-}
      AUTOTASK_PROVIDER: ${AUTOTASK_PROVIDER:-autotask}
      AUTOTASK_BASE_URL: ${AUTOTASK_BASE_URL:-}
      AUTOTASK_USERNAME: ${AUTOTASK_USERNAME:-}
      AUTOTASK_SECRET: ${AUTOTASK_SECRET:-}
      AUTOTASK_API_INTEGRATION_CODE: ${AUTOTASK_API_INTEGRATION_CODE:-}
      AUTOTASK_TIME_ENTRY_TYPE: ${AUTOTASK_TIME_ENTRY_TYPE:-2}
      AUTOTASK_MAX_CONCURRENT_REQUESTS: ${AUTOTASK_MAX_CONCURRENT_REQUESTS:-2}
      AUTOTASK_REQUEST_SLOT_TIMEOUT_SECONDS: ${AUTOTASK_REQUEST_SLOT_TIMEOUT_SECONDS:-30}
      AUTOTASK_STATUS_NEW_ID: ${AUTOTASK_STATUS_NEW_ID:-}
      AUTOTASK_STATUS_IN_PROGRESS_ID: ${AUTOTASK_STATUS_IN_PROGRESS_ID:-}
      AUTOTASK_STATUS_WAITING_CUSTOMER_ID: ${AUTOTASK_STATUS_WAITING_CUSTOMER_ID:-}
      AUTOTASK_STATUS_WAITING_PARTS_ID: ${AUTOTASK_STATUS_WAITING_PARTS_ID:-}
      AUTOTASK_STATUS_MFG_TROUBLE_TICKET_ID: ${AUTOTASK_STATUS_MFG_TROUBLE_TICKET_ID:-}
      AUTOTASK_STATUS_FOLLOW_UP_ID: ${AUTOTASK_STATUS_FOLLOW_UP_ID:-}
      AUTOTASK_STATUS_COMPLETE_ID: ${AUTOTASK_STATUS_COMPLETE_ID:-}
      AUTOTASK_STATUS_CUSTOMER_NOTE_ADDED_ID: ${AUTOTASK_STATUS_CUSTOMER_NOTE_ADDED_ID:-}
    volumes:
      - type: bind
        source: ${TICKET_PILOT_SWARM_STORAGE_PATH:-/mnt/swarm-storage/ticket-pilot-dev}/backups
        target: /data/backups
      - type: bind
        source: ${TICKET_PILOT_SWARM_STORAGE_PATH:-/mnt/swarm-storage/ticket-pilot-dev}/models/faster-whisper
        target: /models/faster-whisper
    networks:
      - ticket_pilot
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health/live', timeout=3).read()\""]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3
    deploy:
      replicas: 1
      restart_policy:
        condition: any
      update_config:
        order: start-first
        failure_action: rollback

  tpdnginx:
    image: ${TICKET_PILOT_NGINX_IMAGE:?Set TICKET_PILOT_NGINX_IMAGE to a private GHCR dev nginx image}
    environment:
      APP_UPSTREAM_HOST: tpdapp
      # Swarm keeps Nginx private to the overlay. Configure the remotely
      # managed tunnel origin as http://tpdnginx:<HTTP_PORT>.
      NGINX_LISTEN_PORT: ${HTTP_PORT:-80}
      NGINX_ACCESS_LOG: ${NGINX_ACCESS_LOG:-/dev/stdout}
      NGINX_ERROR_LOG: ${NGINX_ERROR_LOG:-/dev/stderr warn}
      NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-12m}
      NGINX_RESTORE_MAX_BODY_SIZE: ${NGINX_RESTORE_MAX_BODY_SIZE:-250m}
    networks:
      - ticket_pilot
    healthcheck:
      test: ["CMD-SHELL", "[ -f /var/run/nginx.pid ] && kill -0 \"$$(cat /var/run/nginx.pid)\""]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3
    deploy:
      replicas: 1
      restart_policy:
        condition: any

  cloudflared:
    image: cloudflare/cloudflared:latest
    command: ["tunnel", "--no-autoupdate", "run"]
    environment:
      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN:?Set CLOUDFLARE_TUNNEL_TOKEN}
      TUNNEL_LOGLEVEL: ${CLOUDFLARED_LOG_LEVEL:-info}
    networks:
      - ticket_pilot
    deploy:
      replicas: 1
      placement:
        max_replicas_per_node: 1
      restart_policy:
        condition: any
        delay: 5s
      update_config:
        parallelism: 1
        delay: 10s
        # Stop one connector before replacing it so a two-node cluster can
        # honor max_replicas_per_node while the other replica stays online.
        order: stop-first

networks:
  ticket_pilot:
    driver: overlay