docker-compose.yml

volumes:
  n8n_storage:
  ollama_storage:
  qdrant_storage:
  open-webui:
  flowise:
  whisper-models:
  caddy-data:
  caddy-config:
  valkey-data:
  langfuse_postgres_data:
  langfuse_clickhouse_data:
  langfuse_clickhouse_logs:
  langfuse_minio_data:
  libretranslate_models:
  libretranslate_cache:
  libretranslate_db:
  grafana:
  prometheus_data:
  letta_data:
  weaviate_data:
  portainer_data:
  comfyui_data:
  postiz-config:
  postiz-uploads:
  lightrag_data:
  odoo_data:
  baserow_data:
  vikunja-files:
  mysql-leantime-data:
  leantime-public:
  leantime-userfiles:
  leantime-plugins:
  leantime-logs:
  mailpit_data:
  calcom_data:
  snappymail_data:
  jitsi-web:
  jitsi-transcripts:
  jitsi-prosody-config:
  jitsi-prosody-plugins:
  jitsi-jicofo:
  jitsi-jvb:
  vaultwarden_data:
  kopia_config:
  kopia_cache:
  kopia_logs:
  kimai_data:
  kimai_plugins:
  kimai_mysql:
  invoiceninja_public:
  invoiceninja_storage:
  invoiceninja_mysql:
  formbricks_uploads:
  formbricks_postgres:
  metabase_data:
  metabase_postgres:
  nocodb_data:
  easyocr_models:
  stirling_data:
  stirling_configs:
  stirling_logs:
  twenty_data:
  twenty_db_data:
  twenty_redis_data:
  espocrm_data:
  espocrm_db_data:
  mautic_data:
  mautic_db_data:
  mautic_redis_data:
  scriberr_data:
  chatterbox_models:
  perplexica_data:
  perplexica_uploads:
  livekit_data:
  skyvern-artifacts:
  skyvern_postgres_data:
  browser-use-cache:
  n8n-mcp-data:
  gpt_researcher_data:
  ldr_data:
  n8n-runners-data:
  seafile_mysql:
  seafile_data:
  paperless_postgresql:
  paperless_redis:
  paperless_data:
  paperless_media:
  opennotebook_data:
  opennotebook_surreal:
  webhook_tester_redis:
  hoppscotch_postgres:
  uptime-kuma_data:
  airbyte_destination_data:
  paperless-gpt-prompts:
  paperless-ai-data:
  homepage_config:
  outline_redis_data:
  outline_postgres_data:
  outline_minio_data:
  outline_data:
  gitea_postgres_data:
  gitea_data:
  docuseal_postgres_data:
  docuseal_data:
  dex_data:
  codeserver_data:

x-n8n: &service-n8n
  build:
    context: ./n8n
    pull: true
  environment: &service-n8n-env
    DB_POSTGRESDB_DATABASE: postgres
    DB_POSTGRESDB_HOST: postgres
    DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD}
    DB_POSTGRESDB_USER: postgres
    DB_TYPE: postgresdb
    EXECUTIONS_MODE: regular
    LANGCHAIN_API_KEY: ${LANGCHAIN_API_KEY}
    LANGCHAIN_ENDPOINT: ${LANGCHAIN_ENDPOINT}
    LANGCHAIN_TRACING_V2: ${LANGCHAIN_TRACING_V2}
    N8N_BINARY_DATA_MODE: filesystem
    N8N_PAYLOAD_SIZE_MAX: 256
    N8N_COMMUNITY_PACKAGES_ALLOW_TOOL_USAGE: true
    N8N_DIAGNOSTICS_ENABLED: false
    N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
    N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: true
    N8N_METRICS: true
    N8N_PERSONALIZATION_ENABLED: false
    N8N_RUNNERS_ENABLED: true
    N8N_RUNNERS_MODE: external
    N8N_RUNNERS_BROKER_LISTEN_ADDRESS: 0.0.0.0
    N8N_RUNNERS_AUTH_TOKEN: ${N8N_RUNNERS_AUTH_TOKEN}
    N8N_NATIVE_PYTHON_RUNNER: true
    N8N_TRUST_PROXY: true
    N8N_USER_MANAGEMENT_JWT_SECRET: ${N8N_USER_MANAGEMENT_JWT_SECRET}
    NODE_ENV: production
    NODE_FUNCTION_ALLOW_BUILTIN: "*"
    NODE_FUNCTION_ALLOW_EXTERNAL: cheerio,axios,moment,lodash
    QUEUE_BULL_REDIS_HOST: ${REDIS_HOST:-redis}
    QUEUE_BULL_REDIS_PORT: ${REDIS_PORT:-6379}
    QUEUE_HEALTH_CHECK_ACTIVE: true
    WEBHOOK_URL: ${N8N_HOSTNAME:+https://}${N8N_HOSTNAME:-http://localhost:5678}/

x-ollama: &service-ollama
  image: ollama/ollama:latest
  container_name: ollama
  restart: unless-stopped
  environment:
    - OLLAMA_CONTEXT_LENGTH=8192
    - OLLAMA_FLASH_ATTENTION=1
    - OLLAMA_KV_CACHE_TYPE=q8_0
    - OLLAMA_MAX_LOADED_MODELS=2
  volumes:
    - ollama_storage:/root/.ollama

x-init-ollama: &init-ollama
  image: ollama/ollama:latest
  container_name: ollama-pull-llama
  volumes:
    - ollama_storage:/root/.ollama
  entrypoint: /bin/sh
  command:
    - "-c"
    - "sleep 3; OLLAMA_HOST=ollama:11434 ollama pull qwen2.5:7b-instruct-q4_K_M; OLLAMA_HOST=ollama:11434 ollama pull nomic-embed-text"

services:
  flowise:
    image: flowiseai/flowise
    restart: unless-stopped
    container_name: flowise
    profiles: ["flowise"]
    environment:
      - PORT=3001
      - FLOWISE_USERNAME=${FLOWISE_USERNAME}
      - FLOWISE_PASSWORD=${FLOWISE_PASSWORD}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - ~/.flowise:/root/.flowise
    entrypoint: /bin/sh -c "sleep 3; flowise start"

  bolt:
    build:
      context: ./docker/bolt-diy
      dockerfile: Dockerfile
    container_name: bolt
    profiles: ["bolt"]
    # NO command here!
    expose:
      - "5173"
    environment:
      - BOLT_HOSTNAME=${BOLT_HOSTNAME}
      - OLLAMA_API_BASE_URL=http://ollama:11434
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      - GROQ_API_KEY=${GROQ_API_KEY:-}
    volumes:
      - ./bolt-data:/app/data
      - ./shared:/workspace
    restart: unless-stopped
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  openui:
    image: ghcr.io/wandb/openui:latest
    container_name: openui
    profiles: ["openui"]
    restart: unless-stopped
    expose:
      - "7878"
    environment:
      - OLLAMA_HOST=http://ollama:11434
      - OPENAI_API_KEY=${OPENAI_API_KEY:-xxx}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      - GROQ_API_KEY=${GROQ_API_KEY:-}
      - OPENAI_COMPATIBLE_ENDPOINT=${OPENAI_COMPATIBLE_ENDPOINT:-}
    volumes:
      - ./openui-data:/app/data
      - ./shared:/workspace
    extra_hosts:
      - "host.docker.internal:host-gateway"

  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    restart: unless-stopped
    container_name: open-webui
    profiles: ["open-webui"]
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - open-webui:/app/backend/data

  n8n-import:
    <<: *service-n8n
    container_name: n8n-import
    profiles: ["n8n"]
    environment:
      <<: *service-n8n-env
      RUN_N8N_IMPORT: ${RUN_N8N_IMPORT:-false}
    entrypoint: /bin/sh
    command: /scripts/n8n_import_script.sh
    volumes:
      - ./n8n/backup:/backup
      - ./n8n/n8n_import_script.sh:/scripts/n8n_import_script.sh:ro
    depends_on:
      postgres:
        condition: service_healthy

  n8n:
    <<: *service-n8n
    container_name: n8n
    profiles: ["n8n"]
    restart: unless-stopped
    volumes:
      - n8n_storage:/home/node/.n8n
      - ./n8n/backup:/backup
      - ./shared:/data/shared
      - ./media:/data/media      # <-- NEU hinzufügen
      - ./temp:/data/temp        # <-- NEU hinzufügen
    depends_on:
      n8n-import:
        condition: service_completed_successfully

  n8n-worker:
    <<: *service-n8n
    profiles: ["n8n"]
    restart: unless-stopped
    command: worker
    volumes:
      - n8n_storage:/home/node/.n8n
      - ./shared:/data/shared
      - ./media:/data/media      # <-- NEU hinzufügen
      - ./temp:/data/temp        # <-- NEU hinzufügen
    depends_on:
      n8n:
        condition: service_started
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
    deploy:
      replicas: ${N8N_WORKER_COUNT:-1}

  # ============================================================================
  # N8N PYTHON TASK RUNNER - Native Python Execution
  # ============================================================================

  n8n-runner:
    image: n8nio/runners:${N8N_RUNNERS_VERSION}
    container_name: n8n-runner
    profiles: ["n8n"]
    restart: unless-stopped
    environment:
      - N8N_RUNNERS_AUTH_TOKEN=${N8N_RUNNERS_AUTH_TOKEN}
      - N8N_RUNNERS_TASK_BROKER_URI=http://n8n:5679
      - N8N_RUNNERS_MAX_CONCURRENCY=5
      - N8N_RUNNERS_AUTO_SHUTDOWN_TIMEOUT=15
      - N8N_RUNNERS_TASK_TIMEOUT=300
      - NODE_OPTIONS=--max-old-space-size=512
      - GENERIC_TIMEZONE=${GENERIC_TIMEZONE:-Europe/Berlin}
      - N8N_RUNNERS_PYTHON_ALLOW_BUILTIN=*
      - N8N_RUNNERS_PYTHON_ALLOW_EXTERNAL=
    volumes:
      - ./shared:/data/shared
      - ./n8n-task-runners.json:/etc/n8n-task-runners.json:ro
    depends_on:
      n8n:
        condition: service_started
    deploy:
      resources:
        limits:
          memory: 4G
        reservations:
          memory: 1G
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5680/healthz"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  qdrant:
    image: qdrant/qdrant
    container_name: qdrant
    profiles: ["qdrant"]
    restart: unless-stopped
    volumes:
      - qdrant_storage:/qdrant/storage
    environment:
      - QDRANT__SERVICE__API_KEY=${QDRANT_API_KEY}
    expose:
      - "6333"

  neo4j:
    image: neo4j:latest
    container_name: neo4j
    profiles: ["neo4j"]
    restart: unless-stopped
    volumes:
      - ./neo4j/logs:/logs
      - ./neo4j/config:/config
      - ./neo4j/data:/data
      - ./neo4j/plugins:/plugins
    environment:
      - NEO4J_AUTH=${NEO4J_AUTH_USERNAME}/${NEO4J_AUTH_PASSWORD}
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget --no-verbose --tries=1 --spider http://localhost:7474 || exit 1",
        ]
      interval: 5s
      timeout: 3s
      retries: 5
    ulimits:
      nofile:
        soft: 40000
        hard: 40000

  caddy:
    container_name: caddy
    image: docker.io/library/caddy:2-alpine
    ports:
      - "80:80"
      - "443:443"
      - "7687:7687"
    restart: unless-stopped
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-addon:/etc/caddy/addons:ro
      - caddy-data:/data:rw
      - caddy-config:/config:rw
      - ./website:/srv/website
    environment:
      - BASE_DOMAIN=${BASE_DOMAIN}
      - COMFYUI_HOSTNAME=${COMFYUI_HOSTNAME}
      - COMFYUI_PASSWORD_HASH=${COMFYUI_PASSWORD_HASH}
      - COMFYUI_USERNAME=${COMFYUI_USERNAME}
      - BASEROW_HOSTNAME=${BASEROW_HOSTNAME}
      - BASEROW_USERNAME=${BASEROW_USERNAME}
      - BASEROW_PASSWORD_HASH=${BASEROW_PASSWORD_HASH}
      - NOCODB_HOSTNAME=${NOCODB_HOSTNAME}
      - DIFY_HOSTNAME=${DIFY_HOSTNAME}
      - FLOWISE_HOSTNAME=${FLOWISE_HOSTNAME}
      - BOLT_HOSTNAME=${BOLT_HOSTNAME}
      - BOLT_USERNAME=${BOLT_USERNAME}
      - BOLT_PASSWORD_HASH=${BOLT_PASSWORD_HASH}
      - OPENUI_HOSTNAME=${OPENUI_HOSTNAME}
      - GRAFANA_HOSTNAME=${GRAFANA_HOSTNAME}
      - WHISPER_HOSTNAME=${WHISPER_HOSTNAME}
      - LANGFUSE_HOSTNAME=${LANGFUSE_HOSTNAME}
      - LEANTIME_HOSTNAME=${LEANTIME_HOSTNAME}
      - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL:-internal}
      - LETTA_HOSTNAME=${LETTA_HOSTNAME}
      - LIBRETRANSLATE_HOSTNAME=${LIBRETRANSLATE_HOSTNAME}
      - LIBRETRANSLATE_USERNAME=${LIBRETRANSLATE_USERNAME}
      - LIBRETRANSLATE_PASSWORD_HASH=${LIBRETRANSLATE_PASSWORD_HASH}
      - LIGHTRAG_HOSTNAME=${LIGHTRAG_HOSTNAME}
      - ODOO_HOSTNAME=${ODOO_HOSTNAME}
      - ODOO_USERNAME=${ODOO_USERNAME}
      - ODOO_PASSWORD_HASH=${ODOO_PASSWORD_HASH}
      - TWENTY_CRM_HOSTNAME=${TWENTY_CRM_HOSTNAME}
      - ESPOCRM_HOSTNAME=${ESPOCRM_HOSTNAME}
      - MAUTIC_HOSTNAME=${MAUTIC_HOSTNAME}
      - PERPLEXICA_HOSTNAME=${PERPLEXICA_HOSTNAME}
      - PERPLEXICA_USERNAME=${PERPLEXICA_USERNAME}
      - PERPLEXICA_PASSWORD_HASH=${PERPLEXICA_PASSWORD_HASH}
      - N8N_HOSTNAME=${N8N_HOSTNAME}
      - NEO4J_HOSTNAME=${NEO4J_HOSTNAME}
      - PORTAINER_HOSTNAME=${PORTAINER_HOSTNAME}
      - POSTIZ_HOSTNAME=${POSTIZ_HOSTNAME}
      - PROMETHEUS_HOSTNAME=${PROMETHEUS_HOSTNAME}
      - PROMETHEUS_PASSWORD_HASH=${PROMETHEUS_PASSWORD_HASH}
      - PROMETHEUS_USERNAME=${PROMETHEUS_USERNAME}
      - QDRANT_HOSTNAME=${QDRANT_HOSTNAME}
      - RAGAPP_HOSTNAME=${RAGAPP_HOSTNAME}
      - RAGAPP_PASSWORD_HASH=${RAGAPP_PASSWORD_HASH}
      - RAGAPP_USERNAME=${RAGAPP_USERNAME}
      - SEARXNG_HOSTNAME=${SEARXNG_HOSTNAME}
      - SEARXNG_PASSWORD_HASH=${SEARXNG_PASSWORD_HASH}
      - SEARXNG_USERNAME=${SEARXNG_USERNAME}
      - SUPABASE_HOSTNAME=${SUPABASE_HOSTNAME}
      - TTS_AUTH_USER=${TTS_AUTH_USER}
      - TTS_AUTH_PASSWORD_HASH=${TTS_AUTH_PASSWORD_HASH}
      - TTS_HOSTNAME=${TTS_HOSTNAME}
      - SCRIBERR_HOSTNAME=${SCRIBERR_HOSTNAME}
      - VIKUNJA_HOSTNAME=${VIKUNJA_HOSTNAME}
      - WEAVIATE_HOSTNAME=${WEAVIATE_HOSTNAME}
      - WEBUI_HOSTNAME=${WEBUI_HOSTNAME}
      - WHISPER_AUTH_USER=${WHISPER_AUTH_USER}
      - WHISPER_AUTH_PASSWORD_HASH=${WHISPER_AUTH_PASSWORD_HASH}
      - CALCOM_HOSTNAME=${CALCOM_HOSTNAME}
      - JITSI_HOSTNAME=${JITSI_HOSTNAME}
      - VAULTWARDEN_HOSTNAME=${VAULTWARDEN_HOSTNAME}
      - KOPIA_HOSTNAME=${KOPIA_HOSTNAME}
      - KIMAI_HOSTNAME=${KIMAI_HOSTNAME}
      - INVOICENINJA_HOSTNAME=${INVOICENINJA_HOSTNAME}
      - FORMBRICKS_HOSTNAME=${FORMBRICKS_HOSTNAME}
      - METABASE_HOSTNAME=${METABASE_HOSTNAME}
      - STIRLING_HOSTNAME=${STIRLING_HOSTNAME}
      - STIRLING_USERNAME=${STIRLING_USERNAME}
      - CHATTERBOX_HOSTNAME=${CHATTERBOX_HOSTNAME}
      - CHATTERBOX_FRONTEND_HOSTNAME=${CHATTERBOX_FRONTEND_HOSTNAME}
      - LIVEKIT_HOSTNAME=${LIVEKIT_HOSTNAME}
      - N8N_MCP_HOSTNAME=${N8N_MCP_HOSTNAME}
      - GPTR_HOSTNAME=${GPTR_HOSTNAME}
      - GPTR_USERNAME=${GPTR_USERNAME}
      - GPTR_PASSWORD_HASH=${GPTR_PASSWORD_HASH}
      - LDR_HOSTNAME=${LDR_HOSTNAME}
      - LDR_USERNAME=${LDR_USERNAME}
      - LDR_PASSWORD_HASH=${LDR_PASSWORD_HASH}
      - SEAFILE_HOSTNAME=${SEAFILE_HOSTNAME}
      - PAPERLESS_HOSTNAME=${PAPERLESS_HOSTNAME}
      - OPENNOTEBOOK_HOSTNAME=${OPENNOTEBOOK_HOSTNAME}
      - WEBHOOK_TESTER_HOSTNAME=${WEBHOOK_TESTER_HOSTNAME}
      - WEBHOOK_TESTER_USERNAME=${WEBHOOK_TESTER_USERNAME}
      - WEBHOOK_TESTER_PASSWORD_HASH=${WEBHOOK_TESTER_PASSWORD_HASH}
      - HOPPSCOTCH_HOSTNAME=${HOPPSCOTCH_HOSTNAME}
      - UPTIME_KUMA_HOSTNAME=${UPTIME_KUMA_HOSTNAME}
      - AIRBYTE_HOSTNAME=${AIRBYTE_HOSTNAME}
      - PAPERLESS_GPT_HOSTNAME=${PAPERLESS_GPT_HOSTNAME}
      - PAPERLESS_GPT_USERNAME=${PAPERLESS_GPT_USERNAME}
      - PAPERLESS_GPT_PASSWORD_HASH=${PAPERLESS_GPT_PASSWORD_HASH}
      - PAPERLESS_AI_HOSTNAME=${PAPERLESS_AI_HOSTNAME}
      - HOMEPAGE_HOSTNAME=${HOMEPAGE_HOSTNAME}
      - OUTLINE_HOSTNAME=${OUTLINE_HOSTNAME}
      - OUTLINE_S3_HOSTNAME=${OUTLINE_S3_HOSTNAME}
      - OUTLINE_S3_ADMIN_HOSTNAME=${OUTLINE_S3_ADMIN_HOSTNAME}
      - GITEA_HOSTNAME=${GITEA_HOSTNAME}
      - DOCUSEAL_HOSTNAME=${DOCUSEAL_HOSTNAME}
      - DEX_HOSTNAME=${DEX_HOSTNAME}
      - CODESERVER_HOSTNAME=${CODESERVER_HOSTNAME}
      # Mail Services
      - MAILPIT_HOSTNAME=${MAILPIT_HOSTNAME}
      - MAILPIT_USERNAME=${MAILPIT_USERNAME}
      - MAILPIT_PASSWORD_HASH=${MAILPIT_PASSWORD_HASH}
      - MAILSERVER_WEBMAIL_HOSTNAME=${MAILSERVER_WEBMAIL_HOSTNAME}
      - SNAPPYMAIL_HOSTNAME=${SNAPPYMAIL_HOSTNAME}
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    logging:
      driver: "json-file"
      options:
        max-size: "1m"
        max-file: "1"
        
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    profiles: ["cloudflare-tunnel"]
    restart: unless-stopped
    command: tunnel --no-autoupdate run
    environment:
      - TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}
    logging:
      driver: "json-file"
      options:
        max-size: "1m"
        max-file: "1"  

  langfuse-worker:
    image: langfuse/langfuse-worker:3
    restart: always
    profiles: ["langfuse"]
    depends_on: &langfuse-depends-on
      postgres:
        condition: service_healthy
      minio:
        condition: service_healthy
      redis:
        condition: service_healthy
      clickhouse:
        condition: service_healthy
    environment: &langfuse-worker-env
      DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/langfuse
      SALT: ${LANGFUSE_SALT}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
      TELEMETRY_ENABLED: ${TELEMETRY_ENABLED:-true}
      LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES: ${LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES:-true}
      CLICKHOUSE_MIGRATION_URL: ${CLICKHOUSE_MIGRATION_URL:-clickhouse://clickhouse:9000}
      CLICKHOUSE_URL: ${CLICKHOUSE_URL:-http://clickhouse:8123}
      CLICKHOUSE_USER: ${CLICKHOUSE_USER:-clickhouse}
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
      CLICKHOUSE_CLUSTER_ENABLED: ${CLICKHOUSE_CLUSTER_ENABLED:-false}
      LANGFUSE_S3_EVENT_UPLOAD_BUCKET: ${LANGFUSE_S3_EVENT_UPLOAD_BUCKET:-langfuse}
      LANGFUSE_S3_EVENT_UPLOAD_REGION: ${LANGFUSE_S3_EVENT_UPLOAD_REGION:-auto}
      LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID: ${LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID:-minio}
      LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}
      LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT: ${LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT:-http://minio:9000}
      LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE: ${LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE:-true}
      LANGFUSE_S3_EVENT_UPLOAD_PREFIX: ${LANGFUSE_S3_EVENT_UPLOAD_PREFIX:-events/}
      LANGFUSE_S3_MEDIA_UPLOAD_BUCKET: ${LANGFUSE_S3_MEDIA_UPLOAD_BUCKET:-langfuse}
      LANGFUSE_S3_MEDIA_UPLOAD_REGION: ${LANGFUSE_S3_MEDIA_UPLOAD_REGION:-auto}
      LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID: ${LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID:-minio}
      LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}
      LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT: ${LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT:-http://localhost:9090}
      LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE: ${LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE:-true}
      LANGFUSE_S3_MEDIA_UPLOAD_PREFIX: ${LANGFUSE_S3_MEDIA_UPLOAD_PREFIX:-media/}
      LANGFUSE_S3_BATCH_EXPORT_ENABLED: ${LANGFUSE_S3_BATCH_EXPORT_ENABLED:-false}
      LANGFUSE_S3_BATCH_EXPORT_BUCKET: ${LANGFUSE_S3_BATCH_EXPORT_BUCKET:-langfuse}
      LANGFUSE_S3_BATCH_EXPORT_PREFIX: ${LANGFUSE_S3_BATCH_EXPORT_PREFIX:-exports/}
      LANGFUSE_S3_BATCH_EXPORT_REGION: ${LANGFUSE_S3_BATCH_EXPORT_REGION:-auto}
      LANGFUSE_S3_BATCH_EXPORT_ENDPOINT: ${LANGFUSE_S3_BATCH_EXPORT_ENDPOINT:-http://minio:9000}
      LANGFUSE_S3_BATCH_EXPORT_EXTERNAL_ENDPOINT: ${LANGFUSE_S3_BATCH_EXPORT_EXTERNAL_ENDPOINT:-http://localhost:9090}
      LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID: ${LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID:-minio}
      LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}
      LANGFUSE_S3_BATCH_EXPORT_FORCE_PATH_STYLE: ${LANGFUSE_S3_BATCH_EXPORT_FORCE_PATH_STYLE:-true}
      LANGFUSE_INGESTION_QUEUE_DELAY_MS: ${LANGFUSE_INGESTION_QUEUE_DELAY_MS:-}
      LANGFUSE_INGESTION_CLICKHOUSE_WRITE_INTERVAL_MS: ${LANGFUSE_INGESTION_CLICKHOUSE_WRITE_INTERVAL_MS:-}
      REDIS_HOST: ${REDIS_HOST:-redis}
      REDIS_PORT: ${REDIS_PORT:-6379}
      REDIS_AUTH: ${REDIS_AUTH:-LOCALONLYREDIS}
      REDIS_TLS_ENABLED: ${REDIS_TLS_ENABLED:-false}
      REDIS_TLS_CA: ${REDIS_TLS_CA:-/certs/ca.crt}
      REDIS_TLS_CERT: ${REDIS_TLS_CERT:-/certs/redis.crt}
      REDIS_TLS_KEY: ${REDIS_TLS_KEY:-/certs/redis.key}

  langfuse-web:
    image: langfuse/langfuse:3
    restart: always
    profiles: ["langfuse"]
    depends_on: *langfuse-depends-on
    environment:
      <<: *langfuse-worker-env
      NEXTAUTH_URL: https://${LANGFUSE_HOSTNAME}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
      LANGFUSE_INIT_ORG_ID: ${LANGFUSE_INIT_ORG_ID:-organization_id}
      LANGFUSE_INIT_ORG_NAME: ${LANGFUSE_INIT_ORG_NAME:-Organization}
      LANGFUSE_INIT_PROJECT_ID: ${LANGFUSE_INIT_PROJECT_ID:-project_id}
      LANGFUSE_INIT_PROJECT_NAME: ${LANGFUSE_INIT_PROJECT_NAME:-Project}
      LANGFUSE_INIT_PROJECT_PUBLIC_KEY: ${LANGFUSE_INIT_PROJECT_PUBLIC_KEY:-}
      LANGFUSE_INIT_PROJECT_SECRET_KEY: ${LANGFUSE_INIT_PROJECT_SECRET_KEY:-}
      LANGFUSE_INIT_USER_EMAIL: ${LANGFUSE_INIT_USER_EMAIL:-}
      LANGFUSE_INIT_USER_NAME: ${LANGFUSE_INIT_USER_NAME:-}
      LANGFUSE_INIT_USER_PASSWORD: ${LANGFUSE_INIT_USER_PASSWORD:-}
      AUTH_DISABLE_SIGNUP: ${AUTH_DISABLE_SIGNUP:-true}

  clickhouse:
    image: clickhouse/clickhouse-server
    restart: always
    profiles: ["langfuse"]
    user: "101:101"
    environment:
      CLICKHOUSE_DB: default
      CLICKHOUSE_USER: clickhouse
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
    volumes:
      - langfuse_clickhouse_data:/var/lib/clickhouse
      - langfuse_clickhouse_logs:/var/log/clickhouse-server
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://localhost:8123/ping || exit 1
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 1s

  minio:
    image: minio/minio
    restart: always
    profiles: ["langfuse"]
    entrypoint: sh
    # create the 'langfuse' bucket before starting the service
    command: -c 'mkdir -p /data/langfuse && minio server --address ":9000" --console-address ":9001" /data'
    environment:
      MINIO_ROOT_USER: minio
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    volumes:
      - langfuse_minio_data:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 1s
      timeout: 5s
      retries: 5
      start_period: 1s

  postgres:
    container_name: postgres
    image: postgres:${POSTGRES_VERSION:-17}
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 3s
      timeout: 3s
      retries: 10
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: postgres
    volumes:
      - langfuse_postgres_data:/var/lib/postgresql/data

  redis:
    container_name: redis
    image: docker.io/valkey/valkey:8-alpine
    command: valkey-server --save 30 1 --loglevel warning
    restart: unless-stopped
    volumes:
      - valkey-data:/data
    cap_drop:
      - ALL
    cap_add:
      - SETGID
      - SETUID
      - DAC_OVERRIDE
    logging:
      driver: "json-file"
      options:
        max-size: "1m"
        max-file: "1"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 3s
      timeout: 10s
      retries: 10

  # Baserow Database Init - Create database
  baserow-init:
    image: postgres:${POSTGRES_VERSION:-17}
    container_name: baserow-init
    profiles: ["baserow"]
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGPASSWORD: ${POSTGRES_PASSWORD}
    command: >
      sh -c "
      psql -h postgres -U postgres -c \"CREATE DATABASE baserow\" || true &&
      echo 'Baserow database ready'
      "
    restart: "no"

  baserow:
    image: baserow/baserow:1.35.0
    container_name: baserow
    profiles: ["baserow"]
    privileged: true
    restart: unless-stopped
    environment:
      - BASEROW_PUBLIC_URL=https://${BASEROW_HOSTNAME}
      - SECRET_KEY=${BASEROW_SECRET_KEY}
      - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/baserow
      - REDIS_URL=redis://redis:6379
      - DISABLE_VOLUME_CHECK=yes
      # Memory optimization for AI LaunchKit
      - BASEROW_RUN_MINIMAL=yes
      - BASEROW_AMOUNT_OF_WORKERS=1
      # Email configuration (uses existing AI LaunchKit settings)
      - FROM_EMAIL=${EMAIL_FROM}
      - EMAIL_SMTP=${EMAIL_SMTP_HOST}
      - EMAIL_SMTP_HOST=${EMAIL_SMTP_HOST}
      - EMAIL_SMTP_USER=${EMAIL_SMTP_USER}
      - EMAIL_SMTP_PASSWORD=${EMAIL_SMTP_PASSWORD}
      - EMAIL_SMTP_PORT=${EMAIL_SMTP_PORT}
      - EMAIL_SMTP_USE_TLS=${EMAIL_SMTP_USE_TLS}
    volumes:
      - baserow_data:/baserow/data
      - ./shared:/data/shared
    depends_on:
      baserow-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:80/api/_health/ || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5

  # NocoDB Database Init - Create database
  nocodb-init:
    image: postgres:${POSTGRES_VERSION:-17}
    container_name: nocodb-init
    profiles: ["nocodb"]
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGPASSWORD: ${POSTGRES_PASSWORD}
    command: >
      sh -c "
      psql -h postgres -U postgres -c \"CREATE DATABASE nocodb\" || true &&
      echo 'NocoDB database ready'
      "
    restart: "no"

  # NocoDB - Open Source Airtable Alternative
  nocodb:
    image: nocodb/nocodb:latest
    container_name: nocodb
    profiles: ["nocodb"]
    restart: unless-stopped
    volumes:
      - nocodb_data:/usr/app/data
      - ./shared:/data/shared
    environment:
      # Minimal database configuration
      - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/nocodb
      - NC_AUTH_JWT_SECRET=${NOCODB_JWT_SECRET}
      - NC_DISABLE_TELE=true
    depends_on:
      nocodb-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/api/v1/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 40s

  searxng:
    container_name: searxng
    image: docker.io/searxng/searxng:latest
    profiles: ["searxng"]
    restart: unless-stopped
    volumes:
      - ./searxng:/etc/searxng:rw
    environment:
      - SEARXNG_BASE_URL=https://${SEARXNG_HOSTNAME:-localhost}/
      - UWSGI_WORKERS=${SEARXNG_UWSGI_WORKERS:-4}
      - UWSGI_THREADS=${SEARXNG_UWSGI_THREADS:-4}
   # cap_drop:
    #  - ALL  # Temporarily commented out for first run
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    logging:
      driver: "json-file"
      options:
        max-size: "1m"
        max-file: "1"

  ollama-cpu:
    profiles: ["cpu"]
    <<: *service-ollama

  ollama-gpu:
    profiles: ["gpu-nvidia"]
    <<: *service-ollama
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]

  ollama-gpu-amd:
    profiles: ["gpu-amd"]
    <<: *service-ollama
    image: ollama/ollama:rocm
    devices:
      - "/dev/kfd"
      - "/dev/dri"

  ollama-pull-llama-cpu:
    profiles: ["cpu"]
    <<: *init-ollama
    depends_on:
      - ollama-cpu

  ollama-pull-llama-gpu:
    profiles: ["gpu-nvidia"]
    <<: *init-ollama
    depends_on:
      - ollama-gpu

  ollama-pull-llama-gpu-amd:
    profiles: [gpu-amd]
    <<: *init-ollama
    image: ollama/ollama:rocm
    depends_on:
      - ollama-gpu-amd

  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    profiles: ["monitoring"]
    restart: unless-stopped
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    extra_hosts:
      - "host.docker.internal:host-gateway"

  node-exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter
    profiles: ["monitoring"]
    restart: unless-stopped
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - "--path.procfs=/host/proc"
      - "--path.sysfs=/host/sys"
      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
    expose:
      - 9100

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    container_name: cadvisor
    profiles: ["monitoring"]
    restart: unless-stopped
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    expose:
      - 8080

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    profiles: ["monitoring"]
    restart: unless-stopped
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-admin}
      - GF_PROVISIONING_PATH=/etc/grafana/provisioning
    volumes:
      - grafana:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning
      - ./grafana/dashboards:/var/lib/grafana/dashboards # Standard path often used, let's use Grafana's managed dashboards dir
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      - prometheus

  crawl4ai:
    image: unclecode/crawl4ai:latest # Use official image
    container_name: crawl4ai
    profiles: ["crawl4ai"]
    restart: unless-stopped
    shm_size: 1g # Recommended for browser operations
    env_file:
      - .env
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 4G # Increased based on documentation recommendation

  gotenberg:
    image: gotenberg/gotenberg:8
    container_name: gotenberg
    profiles: ["gotenberg"]
    restart: unless-stopped
    environment:
      - DISABLE_GOOGLE_CHROME=false
    healthcheck:
      test: ["CMD", "wget", "-qO", "/dev/null", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  letta:
    image: letta/letta:latest
    container_name: letta
    profiles: ["letta"]
    restart: unless-stopped
    volumes:
      - letta_data:/var/lib/postgresql/data
    environment:
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
      SECURE: ${LETTA_SECURE:-true}
      LETTA_SERVER_PASSWORD: ${LETTA_SERVER_PASSWORD:-}
    extra_hosts:
      - "host.docker.internal:host-gateway"

  weaviate:
    image: cr.weaviate.io/semitechnologies/weaviate:latest
    container_name: weaviate
    profiles: ["weaviate"]
    restart: unless-stopped
    volumes:
      - weaviate_data:/var/lib/weaviate
    environment:
      QUERY_DEFAULTS_LIMIT: 25
      AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED: "false"
      AUTHENTICATION_APIKEY_ENABLED: "true"
      AUTHENTICATION_APIKEY_ALLOWED_KEYS: ${WEAVIATE_API_KEY}
      AUTHENTICATION_APIKEY_USERS: ${WEAVIATE_USERNAME}
      AUTHORIZATION_ENABLE_RBAC: "true"
      AUTHORIZATION_RBAC_ROOT_USERS: ${WEAVIATE_USERNAME}
      PERSISTENCE_DATA_PATH: "/var/lib/weaviate"
      ENABLE_API_BASED_MODULES: "true"
      CLUSTER_HOSTNAME: "node1"
      DEFAULT_VECTORIZER_MODULE: "none"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget -q --spider http://localhost:8080/v1/.well-known/ready || exit 1",
        ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  ragapp:
    image: ragapp/ragapp:latest
    container_name: ragapp
    profiles: ["ragapp"]
    restart: unless-stopped

  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    profiles: ["portainer"]
    restart: unless-stopped
    volumes:
      - portainer_data:/data
      - ${DOCKER_SOCKET_LOCATION:-/var/run/docker.sock}:/var/run/docker.sock

  postiz:
    image: ghcr.io/gitroomhq/postiz-app:latest
    container_name: postiz
    profiles: ["postiz"]
    restart: always
    environment:
      BACKEND_INTERNAL_URL: http://postiz:3000
      DATABASE_URL: "postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres?schema=postiz"
      DISABLE_REGISTRATION: ${POSTIZ_DISABLE_REGISTRATION}
      FRONTEND_URL: ${POSTIZ_HOSTNAME:+https://}${POSTIZ_HOSTNAME}
      IS_GENERAL: "true" # Required for self-hosting.
      JWT_SECRET: ${JWT_SECRET}
      MAIN_URL: ${POSTIZ_HOSTNAME:+https://}${POSTIZ_HOSTNAME}
      NEXT_PUBLIC_BACKEND_URL: ${POSTIZ_HOSTNAME:+https://}${POSTIZ_HOSTNAME}/api
      NEXT_PUBLIC_UPLOAD_DIRECTORY: "/uploads"
      REDIS_URL: "redis://redis:6379"
      STORAGE_PROVIDER: "local"
      UPLOAD_DIRECTORY: "/uploads"
      # Social Media API Settings
      X_API_KEY: ${X_API_KEY}
      X_API_SECRET: ${X_API_SECRET}
      LINKEDIN_CLIENT_ID: ${LINKEDIN_CLIENT_ID}
      LINKEDIN_CLIENT_SECRET: ${LINKEDIN_CLIENT_SECRET}
      REDDIT_CLIENT_ID: ${REDDIT_CLIENT_ID}
      REDDIT_CLIENT_SECRET: ${REDDIT_CLIENT_SECRET}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET}
      BEEHIIVE_API_KEY: ${BEEHIIVE_API_KEY}
      BEEHIIVE_PUBLICATION_ID: ${BEEHIIVE_PUBLICATION_ID}
      THREADS_APP_ID: ${THREADS_APP_ID}
      THREADS_APP_SECRET: ${THREADS_APP_SECRET}
      FACEBOOK_APP_ID: ${FACEBOOK_APP_ID}
      FACEBOOK_APP_SECRET: ${FACEBOOK_APP_SECRET}
      YOUTUBE_CLIENT_ID: ${YOUTUBE_CLIENT_ID}
      YOUTUBE_CLIENT_SECRET: ${YOUTUBE_CLIENT_SECRET}
      TIKTOK_CLIENT_ID: ${TIKTOK_CLIENT_ID}
      TIKTOK_CLIENT_SECRET: ${TIKTOK_CLIENT_SECRET}
      PINTEREST_CLIENT_ID: ${PINTEREST_CLIENT_ID}
      PINTEREST_CLIENT_SECRET: ${PINTEREST_CLIENT_SECRET}
      DRIBBBLE_CLIENT_ID: ${DRIBBBLE_CLIENT_ID}
      DRIBBBLE_CLIENT_SECRET: ${DRIBBBLE_CLIENT_SECRET}
      DISCORD_CLIENT_ID: ${DISCORD_CLIENT_ID}
      DISCORD_CLIENT_SECRET: ${DISCORD_CLIENT_SECRET}
      DISCORD_BOT_TOKEN_ID: ${DISCORD_BOT_TOKEN_ID}
      SLACK_ID: ${SLACK_ID}
      SLACK_SECRET: ${SLACK_SECRET}
      SLACK_SIGNING_SECRET: ${SLACK_SIGNING_SECRET}
      MASTODON_URL: ${MASTODON_URL}
      MASTODON_CLIENT_ID: ${MASTODON_CLIENT_ID}
      MASTODON_CLIENT_SECRET: ${MASTODON_CLIENT_SECRET}
    volumes:
      - postiz-config:/config/
      - postiz-uploads:/uploads/
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

  comfyui:
    image: yanwk/comfyui-boot:cu124-slim
    container_name: comfyui
    profiles: ["comfyui"]
    restart: unless-stopped
    environment:
      - CLI_ARGS=--listen 0.0.0.0 --cpu
    volumes:
      - comfyui_data:/home/runner
    healthcheck:
      test: ["CMD", "wget", "-qO", "/dev/null", "http://localhost:8188"]
      interval: 10s
      timeout: 5s
      retries: 5

  faster-whisper:
    image: fedirz/faster-whisper-server:latest-cpu
    container_name: faster-whisper
    profiles: ["speech"]
    restart: unless-stopped
    expose:
      - "8000"
    environment:
      - WHISPER__MODEL=${WHISPER_MODEL:-Systran/faster-distil-whisper-large-v3}
      - WHISPER__COMPUTE_TYPE=int8
      - WHISPER__DEVICE=cpu
      - WHISPER__CPU_THREADS=4
    volumes:
      - whisper-models:/root/.cache/huggingface
      - ./shared:/data/shared
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  openedai-speech:
    image: ghcr.io/matatonic/openedai-speech-min:latest
    container_name: openedai-speech
    profiles: ["speech"]
    restart: unless-stopped
    expose:
      - "8000"
    volumes:
      - ./openedai-voices:/app/voices
      - ./openedai-config:/app/config
    environment:
      - TTS_HOME=voices
      - HF_HOME=voices

  libretranslate:
    image: libretranslate/libretranslate:v1.6.1
    container_name: libretranslate
    profiles: ["libretranslate"]
    restart: unless-stopped
    environment:
      - LT_HOST=0.0.0.0
      - LT_PORT=5000
      - LT_CHAR_LIMIT=${LIBRETRANSLATE_CHAR_LIMIT:-10000}
      - LT_FRONTEND_LANGUAGE_SOURCE=${LIBRETRANSLATE_DEFAULT_SOURCE:-auto}
      - LT_FRONTEND_LANGUAGE_TARGET=${LIBRETRANSLATE_DEFAULT_TARGET:-en}
      - LT_API_KEYS=${LIBRETRANSLATE_API_KEYS:-false}
      - LT_API_KEYS_DB_PATH=/app/db/api_keys.db
      - LT_THREADS=${LIBRETRANSLATE_THREADS:-4}
      - LT_SUGGESTIONS=${LIBRETRANSLATE_SUGGESTIONS:-false}
      - LT_DISABLE_WEB_UI=${LIBRETRANSLATE_DISABLE_WEB_UI:-false}
      - LT_UPDATE_MODELS=${LIBRETRANSLATE_UPDATE_MODELS:-true}
      - LT_LOAD_ONLY=${LIBRETRANSLATE_LOAD_ONLY:-en,de,fr,es,it,nl,pl,pt,ru}
      - LT_METRICS=${LIBRETRANSLATE_METRICS:-false}
    volumes:
      - libretranslate_models:/home/libretranslate/.local
      - libretranslate_db:/app/db
      - ./shared:/data/shared
    # Removed Healthcheck - does not work reliably with this image
    # healthcheck:
    #   test: ['CMD-SHELL', 'wget -q --spider http://localhost:5000/languages || exit 1']
    #   interval: 30s
    #   timeout: 10s
    #   retries: 5
    #   start_period: 120s

  # ============================================================================
  # SCRIBERR - AI Audio Transcription with Speaker Diarization
  # ============================================================================
  scriberr:
    image: ghcr.io/rishikanthc/scriberr:latest
    container_name: scriberr
    profiles: ["scriberr"]
    restart: unless-stopped
    volumes:
      - scriberr_data:/app/data
      - ./shared/audio:/app/data/uploads  # Shared folder for n8n Integration
    environment:
      # Server Configuration
      - HOST=0.0.0.0
      - PORT=8080
      # Storage Paths
      - DATABASE_PATH=/app/data/scriberr.db
      - UPLOAD_DIR=/app/data/uploads
      - WHISPERX_ENV=/app/data/whisperx-env
      # Optional API Keys for summaries
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      # Whisper Model Configuration
      - WHISPER_MODEL=${SCRIBERR_WHISPER_MODEL:-base}
      # Speaker Diarization
      - ENABLE_SPEAKER_DIARIZATION=${SCRIBERR_SPEAKER_DIARIZATION:-true}
      - MIN_SPEAKERS=${SCRIBERR_MIN_SPEAKERS:-2}
      - MAX_SPEAKERS=${SCRIBERR_MAX_SPEAKERS:-4}
      # Performance Settings
      - WHISPER_THREADS=${SCRIBERR_THREADS:-4}
      - BATCH_SIZE=${SCRIBERR_BATCH_SIZE:-16}
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/api/health || wget -q --spider http://localhost:8080 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  python-runner:
    image: python:3.11-slim
    container_name: python-runner
    profiles: ["python-runner"]
    restart: unless-stopped
    working_dir: /app
    command: /bin/sh -c 'if [ -f /app/requirements.txt ]; then python -m pip install --no-cache-dir -r /app/requirements.txt; fi; python /app/main.py'
    volumes:
      - ./python-runner:/app

  lightrag:
    image: ghcr.io/hkuds/lightrag:latest
    container_name: lightrag
    profiles: ["lightrag"]
    restart: unless-stopped
    volumes:
      - lightrag_data:/app/data/rag_storage
      - ./shared:/app/data/inputs
    environment:
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - LLM_BINDING=openai
      - LLM_BINDING_HOST=https://api.openai.com/v1
      - EMBEDDING_BINDING=openai
      - EMBEDDING_BINDING_HOST=https://api.openai.com/v1
      - LLM_MODEL=gpt-4o-mini
      - EMBEDDING_MODEL=text-embedding-3-small
      - EMBEDDING_DIM=1536
      - WORKSPACE=${LIGHTRAG_WORKSPACE:-default}
      - AUTH_ACCOUNTS=${LIGHTRAG_AUTH_ACCOUNTS}
      - TOKEN_SECRET=${LIGHTRAG_TOKEN_SECRET}
      - TIMEOUT=600

  # Odoo Database Init - Create user and DB
  odoo-init:
    image: postgres:${POSTGRES_VERSION:-17}
    container_name: odoo-init
    profiles: ["odoo"]
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGPASSWORD: ${POSTGRES_PASSWORD}
    command: >
      sh -c "
      psql -h postgres -U postgres -c \"CREATE USER odoo WITH PASSWORD '${ODOO_DB_PASSWORD}' CREATEDB\" || true &&
      psql -h postgres -U postgres -c \"CREATE DATABASE odoo OWNER odoo\" || true &&
      echo 'Odoo user and database ready'
      "
    restart: "no"

  # Odoo Database Schema Init - Create tables
  odoo-schema-init:
    image: odoo:18.0
    container_name: odoo-schema-init
    profiles: ["odoo"]
    depends_on:
      odoo-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    environment:
      - HOST=postgres
      - USER=odoo
      - PASSWORD=${ODOO_DB_PASSWORD}
    command: >
      sh -c "
      odoo --db_host postgres --db_user odoo --db_password ${ODOO_DB_PASSWORD} -d odoo -i base --stop-after-init || 
      echo 'Database already initialized'
      "
    restart: "no"

  # Odoo ERP/CRM System
  odoo:
    image: odoo:18.0
    container_name: odoo
    profiles: ["odoo"]
    restart: unless-stopped
    depends_on:
      odoo-schema-init:  # Waiting for Schema-Init!
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    environment:
      - HOST=postgres
      - USER=odoo
      - PASSWORD=${ODOO_DB_PASSWORD}
    volumes:
      - odoo_data:/var/lib/odoo
      - ./shared:/data/shared:ro
    command: odoo --proxy-mode
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8069/web/login"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ============================================================================
  # TWENTY CRM - Modern Customer Relationship Management
  # ============================================================================
  twenty-crm:
    image: twentycrm/twenty:latest
    container_name: twenty-crm
    profiles: ["twenty-crm"]
    restart: unless-stopped
    volumes:
      - twenty_data:/app/packages/twenty-server/.local-storage
      - ./shared:/data/shared
    environment:
      - NODE_PORT=3000
      - PG_DATABASE_URL=postgresql://${TWENTY_CRM_DB_USER}:${TWENTY_CRM_DB_PASSWORD}@twenty-db:5432/default
      - REDIS_URL=redis://twenty-redis:6379
      - SERVER_URL=https://${TWENTY_CRM_HOSTNAME}
      - APP_SECRET=${TWENTY_CRM_APP_SECRET}
      - STORAGE_TYPE=local
      - DISABLE_DB_MIGRATIONS=false
    depends_on:
      twenty-db:
        condition: service_healthy
      twenty-redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3000/api/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  twenty-db:
    image: postgres:${TWENTY_POSTGRES_VERSION:-16-alpine}
    container_name: twenty-db
    profiles: ["twenty-crm"]
    restart: unless-stopped
    volumes:
      - twenty_db_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=${TWENTY_CRM_DB_PASSWORD}
      - POSTGRES_USER=${TWENTY_CRM_DB_USER}
      - POSTGRES_DB=default
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${TWENTY_CRM_DB_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5

  twenty-redis:
    image: redis:7-alpine
    container_name: twenty-redis
    profiles: ["twenty-crm"]
    restart: unless-stopped
    volumes:
      - twenty_redis_data:/data
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ============================================================================
  # ESPOCRM - Full-Featured Customer Relationship Management
  # ============================================================================
  espocrm:
    image: espocrm/espocrm:latest
    container_name: espocrm
    profiles: ["espocrm"]
    restart: unless-stopped
    volumes:
      - espocrm_data:/var/www/html
      - ./shared:/data/shared
    environment:
      - ESPOCRM_DATABASE_PLATFORM=Mysql
      - ESPOCRM_DATABASE_HOST=espocrm-db
      - ESPOCRM_DATABASE_NAME=${ESPOCRM_DB_NAME}
      - ESPOCRM_DATABASE_USER=${ESPOCRM_DB_USER}
      - ESPOCRM_DATABASE_PASSWORD=${ESPOCRM_DB_PASSWORD}
      - ESPOCRM_ADMIN_USERNAME=${ESPOCRM_ADMIN_USERNAME}
      - ESPOCRM_ADMIN_PASSWORD=${ESPOCRM_ADMIN_PASSWORD}
      - ESPOCRM_SITE_URL=https://${ESPOCRM_HOSTNAME}
    depends_on:
      espocrm-db:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost/index.php || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 180s

  espocrm-db:
    image: mariadb:latest
    container_name: espocrm-db
    profiles: ["espocrm"]
    restart: unless-stopped
    volumes:
      - espocrm_db_data:/var/lib/mysql
    environment:
      - MARIADB_ROOT_PASSWORD=${ESPOCRM_DB_ROOT_PASSWORD}
      - MARIADB_DATABASE=${ESPOCRM_DB_NAME}
      - MARIADB_USER=${ESPOCRM_DB_USER}
      - MARIADB_PASSWORD=${ESPOCRM_DB_PASSWORD}
    command: --max-allowed-packet=64MB
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 20s
      timeout: 10s
      retries: 5
      start_period: 30s

  espocrm-daemon:
    image: espocrm/espocrm:latest
    container_name: espocrm-daemon
    profiles: ["espocrm"]
    restart: unless-stopped
    volumes:
      - espocrm_data:/var/www/html
    entrypoint: docker-daemon.sh
    depends_on:
      - espocrm

  # ============================================
  # MAUTIC - Marketing Automation Platform
  # ============================================
  
  mautic_db:
    image: mariadb:10.11
    container_name: mautic_db
    profiles: ["mautic"]
    restart: unless-stopped
    volumes:
      - mautic_db_data:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=${MAUTIC_DB_ROOT_PASSWORD}
      - MYSQL_DATABASE=mautic
      - MYSQL_USER=${MAUTIC_DB_USER}
      - MYSQL_PASSWORD=${MAUTIC_DB_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h localhost -u root -p${MAUTIC_DB_ROOT_PASSWORD}"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

  mautic_redis:
    image: redis:7-alpine
    container_name: mautic_redis
    profiles: ["mautic"]
    restart: unless-stopped
    volumes:
      - mautic_redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 30s
      timeout: 10s
      retries: 5

  mautic_web:
    image: mautic/mautic:latest    # Changed to latest (6.0)
    container_name: mautic_web
    profiles: ["mautic"]
    restart: unless-stopped
    depends_on:
      mautic_db:
        condition: service_healthy
      mautic_redis:
        condition: service_healthy
    volumes:
      - mautic_data:/var/www/html
      - ./shared:/data/shared
    environment:
      # Database Configuration
      - MAUTIC_DB_HOST=mautic_db
      - MAUTIC_DB_PORT=3306
      - MAUTIC_DB_NAME=mautic
      - MAUTIC_DB_USER=${MAUTIC_DB_USER}
      - MAUTIC_DB_PASSWORD=${MAUTIC_DB_PASSWORD}
      
      # Redis Cache
      - MAUTIC_REDIS_HOST=mautic_redis
      - MAUTIC_REDIS_PORT=6379
      
      # Mautic Configuration
      - MAUTIC_ADMIN_EMAIL=${MAUTIC_ADMIN_EMAIL}
      - MAUTIC_ADMIN_PASSWORD=${MAUTIC_ADMIN_PASSWORD}
      - MAUTIC_TRUSTED_PROXIES=["0.0.0.0/0"]
      - MAUTIC_URL=https://${MAUTIC_HOSTNAME}
      
      # Mail Configuration (using Mailpit)
      - MAUTIC_MAILER_DSN=smtp://mailpit:1025
      
      # Performance Settings
      - PHP_MEMORY_LIMIT=512M
      - PHP_MAX_EXECUTION_TIME=300
      - PHP_UPLOAD_MAX_FILESIZE=50M
      - PHP_POST_MAX_SIZE=50M
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost/s/login || exit 1"]
      interval: 60s
      timeout: 10s
      retries: 5
      start_period: 60s

  mautic_worker:
    image: mautic/mautic:latest    # Changed to latest (6.0)
    container_name: mautic_worker
    profiles: ["mautic"]
    restart: unless-stopped
    depends_on:
      mautic_web:
        condition: service_healthy
    volumes:
      - mautic_data:/var/www/html
      - ./shared:/data/shared
    environment:
      # Same as mautic_web
      - MAUTIC_DB_HOST=mautic_db
      - MAUTIC_DB_PORT=3306
      - MAUTIC_DB_NAME=mautic
      - MAUTIC_DB_USER=${MAUTIC_DB_USER}
      - MAUTIC_DB_PASSWORD=${MAUTIC_DB_PASSWORD}
      - MAUTIC_REDIS_HOST=mautic_redis
      - MAUTIC_REDIS_PORT=6379
    command: >
      sh -c "
        while true; do
          php /var/www/html/bin/console mautic:segments:update --no-interaction
          php /var/www/html/bin/console mautic:campaigns:update --no-interaction
          php /var/www/html/bin/console mautic:campaigns:trigger --no-interaction
          php /var/www/html/bin/console mautic:messages:send --no-interaction
          php /var/www/html/bin/console mautic:webhooks:process --no-interaction
          php /var/www/html/bin/console mautic:reports:scheduler --no-interaction
          php /var/www/html/bin/console mautic:import --no-interaction
          sleep 300
        done
      "

  # Vikunja Database Init - Create database
  vikunja-init:
    image: postgres:${POSTGRES_VERSION:-17}
    container_name: vikunja-init
    profiles: ["vikunja"]
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGPASSWORD: ${POSTGRES_PASSWORD}
    command: >
      sh -c "
      psql -h postgres -U postgres -c \"CREATE DATABASE vikunja\" || true &&
      echo 'Vikunja database ready'
      "
    restart: "no"

  # Task Management - Vikunja
  vikunja:
    image: vikunja/vikunja:latest
    container_name: vikunja
    profiles: ["vikunja"]
    restart: unless-stopped
    environment:
      # Database Configuration (uses existing PostgreSQL)
      - VIKUNJA_DATABASE_TYPE=postgres
      - VIKUNJA_DATABASE_HOST=postgres
      - VIKUNJA_DATABASE_USER=${POSTGRES_USER}
      - VIKUNJA_DATABASE_PASSWORD=${POSTGRES_PASSWORD}
      - VIKUNJA_DATABASE_DATABASE=vikunja
      # Service Configuration
      - VIKUNJA_SERVICE_PUBLICURL=https://${VIKUNJA_HOSTNAME}
      - VIKUNJA_SERVICE_JWTSECRET=${VIKUNJA_JWT_SECRET}
      - VIKUNJA_SERVICE_ENABLEREGISTRATION=true
      - VIKUNJA_SERVICE_ENABLETASKATTACHMENTS=true
      - VIKUNJA_SERVICE_MAXAVATARSIZE=1024
      - VIKUNJA_SERVICE_MAXATTACHMENTSIZE=20971520  # 20MB
      # Optional: Set timezone
      - VIKUNJA_SERVICE_TIMEZONE=${TZ:-UTC}
    volumes:
      - vikunja-files:/app/vikunja/files
      - ./shared:/data/shared
    depends_on:
      vikunja-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:3456/api/v1/info"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  # MySQL - Database for Leantime and other MySQL-based services
  mysql_leantime:
    image: mysql:8.4
    container_name: mysql_leantime
    profiles: ["mysql"]  # This profile is auto-activated when leantime is selected
    restart: unless-stopped
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=leantime
      - MYSQL_USER=leantime
      - MYSQL_PASSWORD=${LEANTIME_DB_PASSWORD}
    volumes:
      - mysql-leantime-data:/var/lib/mysql
    command: --character-set-server=UTF8MB4 --collation-server=UTF8MB4_unicode_ci
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  # Leantime - Full Project Management Suite
  leantime:
    image: leantime/leantime:latest
    container_name: leantime
    profiles: ["leantime"]
    restart: unless-stopped
    environment:
      # Database Configuration
      - LEAN_DB_HOST=mysql_leantime
      - LEAN_DB_USER=leantime
      - LEAN_DB_PASSWORD=${LEANTIME_DB_PASSWORD}
      - LEAN_DB_DATABASE=leantime
      - LEAN_DB_PORT=3306
      # Application Configuration
      - LEAN_APP_URL=https://${LEANTIME_HOSTNAME}
      - LEAN_SITENAME=Leantime
      - LEAN_SESSION_PASSWORD=${LEANTIME_SESSION_PASSWORD}
      - LEAN_SESSION_EXPIRATION=28800  # 8 hours
      - LEAN_DEFAULT_TIMEZONE=${TZ:-UTC}
      # Language & Theme
      - LEAN_LANGUAGE=en-US
      - LEAN_DEFAULT_THEME=default
      # User/Group mapping (optional)
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      # Features
      - LEAN_ENABLE_MENU_TYPE=true
      - LEAN_ENABLE_FOOTER=true
      # Email configuration (using mailserver with auth)
      - LEAN_EMAIL_RETURN=noreply@${DOMAIN}
      - LEAN_EMAIL_USE_SMTP=true
      - LEAN_EMAIL_SMTP_HOSTS=mailserver
      - LEAN_EMAIL_SMTP_PORT=587
      - LEAN_EMAIL_SMTP_AUTH=true
      - LEAN_EMAIL_SMTP_USERNAME=noreply@${DOMAIN}
      - LEAN_EMAIL_SMTP_PASSWORD=UTUyfeicxqtO5LkdcFz21eTaGdT5w39t
      - LEAN_EMAIL_SMTP_AUTO_TLS=true
      - LEAN_EMAIL_SMTP_SECURE=STARTTLS
    volumes:
      - leantime-public:/var/www/html/public/userfiles
      - leantime-userfiles:/var/www/html/userfiles
      - leantime-plugins:/var/www/html/app/Plugins
      - leantime-logs:/var/www/html/storage/logs
      - ./shared:/data/shared
    depends_on:
      mysql_leantime:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  perplexica:
    image: itzcrazykns1337/perplexica:latest
    container_name: perplexica
    profiles: ["perplexica"]
    restart: unless-stopped
    environment:
      - SEARXNG_API_URL=http://searxng:8080
      - DATA_DIR=/home/perplexica
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
    volumes:
      - perplexica_data:/home/perplexica/data
      - perplexica_uploads:/home/perplexica/uploads
      - ./shared:/data/shared
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      - searxng

  calcom:
    build:
      context: ./calcom-docker
      dockerfile: Dockerfile
      args:
        - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/calcom
        - NEXT_PUBLIC_WEBAPP_URL=https://cal.${DOMAIN}
        - NEXT_PUBLIC_API_V2_URL=https://cal.${DOMAIN}/api/v2
        - NEXT_PUBLIC_WEBSITE_URL=https://cal.${DOMAIN}
    container_name: calcom
    profiles: ["calcom"]
    restart: unless-stopped
    environment:
      # Database
      - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/calcom
      - DATABASE_DIRECT_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/calcom
      
      # URLs
      - NEXT_PUBLIC_WEBAPP_URL=https://cal.${DOMAIN}
      - NEXT_PUBLIC_API_V2_URL=https://cal.${DOMAIN}/api/v2
      - NEXT_PUBLIC_WEBSITE_URL=https://cal.${DOMAIN}
      - NEXTAUTH_URL=https://cal.${DOMAIN}
      - CAL_URL=https://cal.${DOMAIN}
      
      # Security
      - NEXTAUTH_SECRET=${CALCOM_NEXTAUTH_SECRET}
      - CALENDSO_ENCRYPTION_KEY=${CALCOM_ENCRYPTION_KEY}
      
      # Email (using AI LaunchKit mail system and smtp-relay)
      - EMAIL_FROM=${EMAIL_FROM}
      - EMAIL_SERVER_HOST=smtp-relay
      - EMAIL_SERVER_PORT=8025
      - EMAIL_SERVER_USER=${SMTP_USER:-}
      - EMAIL_SERVER_PASSWORD=${SMTP_PASSWORD:-}
      - NODE_TLS_REJECT_UNAUTHORIZED=0
      - SEND_FEEDBACK_EMAIL=false
      
      # Features
      - NEXT_PUBLIC_DISABLE_SIGNUP=false
      - TELEMETRY_DISABLED=1
      - NODE_ENV=production
    volumes:
      - calcom_data:/app/data
      - ./shared:/data/shared
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    expose:
      - "3000"
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 300s  # 5 minutes for build

  # ============================================================================
  # MAIL SERVICES
  # Mailpit: Always active mail catcher for development/testing
  # Postal: Optional production mail server (activate via profile)
  # ============================================================================
  
  # Mailpit - Mail Catcher (ALWAYS ACTIVE - NO PROFILE!)
  mailpit:
    image: axllent/mailpit:latest
    container_name: mailpit
    # NO profiles tag - always runs!
    restart: unless-stopped
    volumes:
      - mailpit_data:/data
      - ./shared:/data/shared
    environment:
      MP_DATABASE: /data/mailpit.db
      MP_SMTP_AUTH_ACCEPT_ANY: 1
      MP_SMTP_AUTH_ALLOW_INSECURE: 1
      MP_UI_AUTH_FILE: ${MAILPIT_UI_AUTH_FILE:-}
      MP_MAX_MESSAGES: ${MAILPIT_MAX_MESSAGES:-5000}
    expose:
      - "1025"  # SMTP
      - "8025"  # Web UI
    healthcheck:
      test: ["CMD", "nc", "-z", "localhost", "1025"]
      interval: 30s
      timeout: 10s
      retries: 3

# Docker-Mailserver - Production email server
  mailserver:
    image: ghcr.io/docker-mailserver/docker-mailserver:latest
    container_name: mailserver
    hostname: mail.${BASE_DOMAIN}
    profiles: ["mailserver"]
    restart: unless-stopped
    ports:
      - "25:25"     # SMTP (receiving)
      - "587:587"   # SMTP (submission)
      - "993:993"   # IMAP (optional, nur wenn User Mailboxen brauchen)
    volumes:
      - ./docker-data/dms/mail-data/:/var/mail/
      - ./docker-data/dms/mail-state/:/var/mail-state/
      - ./docker-data/dms/config/:/tmp/docker-mailserver/
      - caddy-data:/certs/:ro  # Uses Caddy's Let's Encrypt Certificates
      - /etc/localtime:/etc/localtime:ro
      - ./shared:/data/shared
    environment:
      # Basic Configuration
      - OVERRIDE_HOSTNAME=mail.${BASE_DOMAIN}
      - LOG_LEVEL=info
      - SUPERVISOR_LOGLEVEL=warn
      
      # Network
      - PERMIT_DOCKER=network
      - NETWORK_INTERFACE=
      
      # Security & SSL (Caddy Zertifikate nutzen)
      - SSL_TYPE=
      - SSL_CERT_PATH=/certs/certificates/acme-v02.api.letsencrypt.org-directory/${BASE_DOMAIN}/${BASE_DOMAIN}.crt
      - SSL_KEY_PATH=/certs/certificates/acme-v02.api.letsencrypt.org-directory/${BASE_DOMAIN}/${BASE_DOMAIN}.key
      
      # Features
      - ENABLE_RSPAMD=1          # Better than SpamAssassin
      - ENABLE_CLAMAV=0          # Disabled by default (saves RAM)
      - ENABLE_FAIL2BAN=1        # Brute-force protection
      - ENABLE_POSTGREY=0        # Greylisting (optional)
      - ENABLE_SASLAUTHD=0       # Not needed for basic setup
      - ENABLE_SPAMASSASSIN=0    # Using Rspamd instead
      - ENABLE_FETCHMAIL=0       # Not needed
      - ENABLE_GETMAIL=0         # Not needed
      - ENABLE_AMAVIS=0          # Not needed with Rspamd
      
      # Mail Settings
      - ONE_DIR=1                # Better for Docker
      - DMS_DEBUG=0
      - POSTMASTER_ADDRESS=postmaster@${BASE_DOMAIN}
      - POSTFIX_MESSAGE_SIZE_LIMIT=20480000  # 20MB
      
    cap_add:
      - NET_ADMIN
      - SYS_PTRACE
    healthcheck:
      test: ["CMD", "ss", "-lnp", "|", "grep", ":25"]
      interval: 30s
      timeout: 10s
      retries: 3
    depends_on:
      - caddy  # For SSL certificates

  # SnappyMail Webmail Client (Latest 2025)
  snappymail:
    image: djmaze/snappymail:latest
    container_name: snappymail
    profiles: ["snappymail"]
    restart: unless-stopped
    volumes:
      - snappymail_data:/var/lib/snappymail
      - ./shared:/data/shared
    environment:
      - UPLOAD_MAX_SIZE=25M
      - PHP_MEMORY_LIMIT=128M
      - TZ=${TZ:-UTC}
    depends_on:
      - mailserver
    expose:
      - "8888"   # Main web interface
      - "9000"   # PHP-FPM (optional)
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8888/"]
      interval: 30s
      timeout: 10s
      retries: 3

  smtp-relay:
    image: alpine/socat
    container_name: smtp-relay
    profiles: ["baserow", "calcom", "leantime"]
    restart: unless-stopped
    command: tcp-listen:8025,fork,reuseaddr tcp-connect:mailserver:25

  # Jitsi Web Frontend
  jitsi-web:
    image: jitsi/web:stable-10008
    container_name: jitsi-web
    profiles: ["jitsi"]
    restart: unless-stopped
    volumes:
      - ./jitsi-web:/config
      - ./jitsi-transcripts:/usr/share/jitsi-meet/transcripts
    environment:
      - ENABLE_LETSENCRYPT=0
      - ENABLE_HTTP_REDIRECT=0
      - DISABLE_HTTPS=1
      - PUBLIC_URL=https://${JITSI_HOSTNAME}
      - XMPP_DOMAIN=${JITSI_XMPP_DOMAIN}
      - XMPP_AUTH_DOMAIN=auth.${JITSI_XMPP_DOMAIN}
      - XMPP_BOSH_URL_BASE=http://jitsi-prosody:5280
      - XMPP_MUC_DOMAIN=muc.${JITSI_XMPP_DOMAIN}
      - XMPP_INTERNAL_MUC_DOMAIN=internal-muc.${JITSI_XMPP_DOMAIN}
      - JICOFO_AUTH_USER=jicofo
      - JVB_WS_DOMAIN=${JITSI_HOSTNAME}
      - JVB_WS_SERVER_ID=jvb1
      - TZ=${TZ}
    depends_on:
      - jitsi-prosody
    expose:
      - "80"

  # Jitsi XMPP Server (Prosody)
  jitsi-prosody:
    image: jitsi/prosody:stable-10008
    container_name: jitsi-prosody
    profiles: ["jitsi"]
    restart: unless-stopped
    expose:
      - "5222"
      - "5347"
      - "5280"
    volumes:
      - ./jitsi-prosody-config:/config
      - ./jitsi-prosody-plugins:/prosody-plugins-custom
    environment:
      - AUTH_TYPE=internal
      - ENABLE_GUESTS=1
      - XMPP_DOMAIN=${JITSI_XMPP_DOMAIN}
      - XMPP_AUTH_DOMAIN=auth.${JITSI_XMPP_DOMAIN}
      - XMPP_GUEST_DOMAIN=guest.${JITSI_XMPP_DOMAIN}
      - XMPP_MUC_DOMAIN=muc.${JITSI_XMPP_DOMAIN}
      - XMPP_INTERNAL_MUC_DOMAIN=internal-muc.${JITSI_XMPP_DOMAIN}
      - JICOFO_COMPONENT_SECRET=${JICOFO_COMPONENT_SECRET}
      - JICOFO_AUTH_USER=jicofo
      - JICOFO_AUTH_PASSWORD=${JICOFO_AUTH_PASSWORD}
      - JVB_AUTH_USER=jvb
      - JVB_AUTH_PASSWORD=${JVB_AUTH_PASSWORD}
      - TZ=${TZ}

  # Jitsi Conference Focus (Jicofo)
  jitsi-jicofo:
    image: jitsi/jicofo:stable-10008
    container_name: jitsi-jicofo
    profiles: ["jitsi"]
    restart: unless-stopped
    volumes:
      - ./jitsi-jicofo:/config
    environment:
      - XMPP_DOMAIN=${JITSI_XMPP_DOMAIN}
      - XMPP_AUTH_DOMAIN=auth.${JITSI_XMPP_DOMAIN}
      - XMPP_INTERNAL_MUC_DOMAIN=internal-muc.${JITSI_XMPP_DOMAIN}
      - XMPP_MUC_DOMAIN=muc.${JITSI_XMPP_DOMAIN}
      - XMPP_SERVER=jitsi-prosody
      - JICOFO_COMPONENT_SECRET=${JICOFO_COMPONENT_SECRET}
      - JICOFO_AUTH_USER=jicofo
      - JICOFO_AUTH_PASSWORD=${JICOFO_AUTH_PASSWORD}
      - JVB_BREWERY_MUC=jvbbrewery
      - TZ=${TZ}
    depends_on:
      - jitsi-prosody

  # Jitsi Video Bridge (JVB) - CRITICAL: Needs UDP Port 10000
  jitsi-jvb:
    image: jitsi/jvb:stable-10008
    container_name: jitsi-jvb
    profiles: ["jitsi"]
    restart: unless-stopped
    ports:
      - "10000:10000/udp"
    volumes:
      - ./jitsi-jvb:/config
    environment:
      - DOCKER_HOST_ADDRESS=${JVB_DOCKER_HOST_ADDRESS}
      - XMPP_AUTH_DOMAIN=auth.${JITSI_XMPP_DOMAIN}
      - XMPP_INTERNAL_MUC_DOMAIN=internal-muc.${JITSI_XMPP_DOMAIN}
      - XMPP_SERVER=jitsi-prosody
      - JVB_AUTH_USER=jvb
      - JVB_AUTH_PASSWORD=${JVB_AUTH_PASSWORD}
      - JVB_BREWERY_MUC=jvbbrewery
      - JVB_PORT=10000
      - JVB_STUN_SERVERS=meet-jit-si-turnrelay.jitsi.net:443
      - PUBLIC_URL=https://${JITSI_HOSTNAME}
      - JVB_WS_DOMAIN=${JITSI_HOSTNAME}
      - JVB_WS_SERVER_ID=jvb1
      - TZ=${TZ}
    depends_on:
      - jitsi-prosody

  # ============================================================================
  # LIVEKIT - Real-time Voice & Video Infrastructure
  # ============================================================================
  
  # LiveKit Server - WebRTC SFU and API
  livekit-server:
    image: livekit/livekit-server:latest
    container_name: livekit-server
    profiles: ["livekit"]
    restart: unless-stopped
    volumes:
      - livekit_data:/data
      - ./livekit/entrypoint.sh:/entrypoint.sh:ro
    environment:
      - LIVEKIT_API_KEY=${LIVEKIT_API_KEY}
      - LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET}
    entrypoint: ["/bin/sh", "/entrypoint.sh"]
    ports:
      - "7880:7880"
      - "7882:7882/tcp"
      - "50000-50100:50000-50100/udp"
    depends_on:
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:7880"]
      interval: 30s
      timeout: 10s
      retries: 5

  livekit-agents:
    image: python:3.11-slim
    container_name: livekit-agents
    profiles: ["livekit"]
    restart: unless-stopped
    working_dir: /app
    volumes:
      - ./livekit-agents:/app
      - ./shared:/data/shared
    environment:
      - LIVEKIT_URL=ws://livekit-server:7880
      - LIVEKIT_API_KEY=${LIVEKIT_API_KEY}
      - LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET}
      - WHISPER_URL=http://faster-whisper:8000
      - TTS_URL=http://openedai-speech:8000
      - OLLAMA_URL=http://ollama:11434
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - OLLAMA_MODEL=${OLLAMA_MODEL}
    depends_on:
      - livekit-server
    command: >
      bash -c "
      pip install livekit-agents livekit-plugins-openai livekit-plugins-silero &&
      python agent.py start
      "

  # ============================================================================
  # UPTIME KUMA - Beautiful Uptime Monitoring
  # ============================================================================
  uptime-kuma:
    image: louislam/uptime-kuma:2
    container_name: uptime-kuma
    profiles: ["uptime-kuma"]
    restart: unless-stopped
    volumes:
      - uptime-kuma_data:/app/data
      - ./shared:/data/shared
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - TZ=${TZ:-Europe/Berlin}
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3001 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s

  # VAULTWARDEN - Self-hosted Password Manager
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    profiles: ["vaultwarden"]
    restart: unless-stopped
    volumes:
      - vaultwarden_data:/data
      - ./shared:/data/shared
    environment:
      - DOMAIN=https://${VAULTWARDEN_HOSTNAME}
      - ADMIN_TOKEN=${VAULTWARDEN_ADMIN_TOKEN}
      - SMTP_HOST=mailpit
      - SMTP_FROM=${EMAIL_FROM:-vault@yourdomain.com}
      - SMTP_FROM_NAME=Vaultwarden
      - SMTP_PORT=1025
      - SMTP_AUTH_MECHANISM=Plain
      - SMTP_SECURITY=off
      - SMTP_TIMEOUT=15
      - SIGNUPS_ALLOWED=false
      - SIGNUPS_DOMAINS_WHITELIST=${SIGNUPS_DOMAINS_WHITELIST:-}
      - SHOW_PASSWORD_HINT=false
      - WEB_VAULT_ENABLED=true
      - WEBSOCKET_ENABLED=true
      - INVITATIONS_ALLOWED=true
      - EMERGENCY_ACCESS_ALLOWED=true
      - SENDS_ALLOWED=true
      - PASSWORD_ITERATIONS=600000
      - ICON_CACHE_TTL=2592000
      - ICON_CACHE_NEGTTL=259200
      - IP_HEADER=X-Forwarded-For
      - LOG_LEVEL=warn
      - EXTENDED_LOGGING=true
      - TZ=${TZ:-UTC}
    expose:
      - "80"
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:80/alive"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  # KOPIA - Fast and Secure Backup
  kopia:
    image: kopia/kopia:latest
    container_name: kopia
    hostname: kopia-server
    profiles: ["kopia"]
    restart: unless-stopped
    volumes:
      - kopia_config:/app/config
      - kopia_cache:/app/cache
      - kopia_logs:/app/logs
      # Mount Docker volumes for backup (read-only)
      - /var/lib/docker/volumes:/data/docker-volumes:ro
      # Mount shared directory for backup (read-only)
      - ./shared:/data/shared:ro
      # Mount AI LaunchKit configuration (read-only)
      - .:/data/ai-launchkit:ro
    environment:
      # Repository encryption password (different from Nextcloud password!)
      - KOPIA_PASSWORD=${KOPIA_PASSWORD}
      # Web UI credentials
      - KOPIA_UI_USERNAME=${KOPIA_UI_USERNAME}
      - KOPIA_UI_PASSWORD=${KOPIA_UI_PASSWORD}
      # Nextcloud WebDAV configuration
      - NEXTCLOUD_WEBDAV_URL=${NEXTCLOUD_WEBDAV_URL}
      - NEXTCLOUD_USERNAME=${NEXTCLOUD_USERNAME}
      - NEXTCLOUD_APP_PASSWORD=${NEXTCLOUD_APP_PASSWORD}
      # Server configuration
      - KOPIA_PERSIST_CREDENTIALS_ON_CONNECT=true
      - TZ=${TZ}
      # Logging
      - KOPIA_LOG_LEVEL=info
    command: >
      server start
      --address=0.0.0.0:51515
      --server-username=${KOPIA_UI_USERNAME}
      --server-password=${KOPIA_UI_PASSWORD}
      --disable-csrf-token-checks
      --insecure
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:51515"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    depends_on:
      - postgres
      - redis

  # ============================================================================
  # KIMAI - Professional Time Tracking
  # ============================================================================
  kimai:
    image: kimai/kimai2:apache
    container_name: kimai
    profiles: ["kimai"]
    restart: unless-stopped
    volumes:
      - kimai_data:/opt/kimai/var/data
      - kimai_plugins:/opt/kimai/var/plugins
      - ./shared:/data/shared
    environment:
      - ADMINMAIL=${KIMAI_ADMIN_EMAIL:-${USER_EMAIL}}
      - ADMINPASS=${KIMAI_ADMIN_PASSWORD}
      - DATABASE_URL=mysql://${KIMAI_DB_USER}:${KIMAI_DB_PASSWORD}@kimai_db:3306/${KIMAI_DB_NAME}?charset=utf8mb4&serverVersion=8.3.0
      - TRUSTED_HOSTS=${KIMAI_HOSTNAME},localhost,127.0.0.1
      - APP_ENV=prod
      - memory_limit=256M
      - MAILER_URL=smtp://${SMTP_HOST:-mailpit}:${SMTP_PORT:-1025}
      - MAILER_FROM=${KIMAI_MAIL_FROM:-kimai@${BASE_DOMAIN}}
      - memory_limit=512M
      - post_max_size=50M
      - upload_max_filesize=50M
    depends_on:
      kimai_db:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8001 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5

  kimai_db:
    image: mysql:8.3
    container_name: kimai_db
    profiles: ["kimai"]
    restart: unless-stopped
    volumes:
      - kimai_mysql:/var/lib/mysql
    environment:
      - MYSQL_DATABASE=${KIMAI_DB_NAME:-kimai}
      - MYSQL_USER=${KIMAI_DB_USER:-kimai}
      - MYSQL_PASSWORD=${KIMAI_DB_PASSWORD}
      - MYSQL_ROOT_PASSWORD=${KIMAI_DB_ROOT_PASSWORD}
    command: --default-storage-engine=innodb --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${KIMAI_DB_ROOT_PASSWORD}"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

  # ============================================================================
  # INVOICE NINJA - Professional Invoicing Platform
  # ============================================================================
  invoiceninja:
    image: invoiceninja/invoiceninja:5
    container_name: invoiceninja
    profiles: ["invoiceninja"]
    restart: unless-stopped
    volumes:
      - invoiceninja_public:/var/www/app/public
      - invoiceninja_storage:/var/www/app/storage
      - ./shared:/data/shared
      - ./invoiceninja-memory.ini:/usr/local/etc/php/conf.d/99-memory.ini:ro
    environment:
      # Application Settings
      - APP_ENV=production
      - APP_DEBUG=false
      - APP_URL=https://${INVOICENINJA_HOSTNAME}
      - APP_KEY=${INVOICENINJA_APP_KEY}
      - APP_CIPHER=AES-256-CBC
      - REQUIRE_HTTPS=false
      - TRUSTED_PROXIES=*
      
      # Database Configuration
      - DB_HOST=invoiceninja_db
      - DB_PORT=3306
      - DB_DATABASE=${INVOICENINJA_DB_NAME:-invoiceninja}
      - DB_USERNAME=${INVOICENINJA_DB_USER:-invoiceninja}
      - DB_PASSWORD=${INVOICENINJA_DB_PASSWORD}
      
      # Initial Admin Account
      - IN_USER_EMAIL=${INVOICENINJA_ADMIN_EMAIL:-${USER_EMAIL}}
      - IN_PASSWORD=${INVOICENINJA_ADMIN_PASSWORD}
      
      # Mail Configuration
      - MAIL_MAILER=smtp
      - MAIL_HOST=${SMTP_HOST:-mailpit}
      - MAIL_PORT=${SMTP_PORT:-1025}
      - MAIL_USERNAME=${SMTP_USER}
      - MAIL_PASSWORD=${SMTP_PASSWORD}
      - MAIL_ENCRYPTION=${SMTP_ENCRYPTION:-null}
      - MAIL_FROM_ADDRESS=${INVOICENINJA_MAIL_FROM:-noreply@${BASE_DOMAIN}}
      - MAIL_FROM_NAME="Invoice Ninja"
      
      # PDF Generation
      - PDF_GENERATOR=snappdf
      - SNAPPDF_EXECUTABLE_PATH=/usr/bin/chromium-browser
      
      # Queue Configuration
      - QUEUE_CONNECTION=database
      - BROADCAST_DRIVER=log
      - CACHE_DRIVER=redis
      - SESSION_DRIVER=redis
      - REDIS_HOST=redis
      - REDIS_PASSWORD=${REDIS_PASSWORD}
      - REDIS_PORT=6379
      
    depends_on:
      invoiceninja_db:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "ps aux | grep php-fpm | grep -v grep || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s

  invoiceninja_db:
    image: mysql:8.3
    container_name: invoiceninja_db
    profiles: ["invoiceninja"]
    restart: unless-stopped
    volumes:
      - invoiceninja_mysql:/var/lib/mysql
    environment:
      - MYSQL_DATABASE=${INVOICENINJA_DB_NAME:-invoiceninja}
      - MYSQL_USER=${INVOICENINJA_DB_USER:-invoiceninja}
      - MYSQL_PASSWORD=${INVOICENINJA_DB_PASSWORD}
      - MYSQL_ROOT_PASSWORD=${INVOICENINJA_DB_ROOT_PASSWORD}
    command: --default-storage-engine=innodb --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${INVOICENINJA_DB_ROOT_PASSWORD}"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

  invoiceninja_nginx:
    image: nginx:alpine
    container_name: invoiceninja_nginx
    profiles: ["invoiceninja"]
    restart: unless-stopped
    volumes:
      - invoiceninja_public:/var/www/app/public:ro
      - invoiceninja_storage:/var/www/app/storage:ro
      - ./invoiceninja-nginx.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      invoiceninja:
        condition: service_healthy

  # ============================================================================
  # FORMBRICKS - Open Source Survey Platform (Typeform Alternative)
  # ============================================================================
  
  # Database Init für Formbricks
  formbricks-init:
    image: postgres:${POSTGRES_VERSION:-17}
    container_name: formbricks-init
    profiles: ["formbricks"]
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGPASSWORD: ${POSTGRES_PASSWORD}
    command: >
      sh -c "
      psql -h postgres -U postgres -c \"CREATE DATABASE formbricks\" || true &&
      echo 'Formbricks database ready'
      "
    restart: "no"

  # ============================================================================
  # FORMBRICKS - Open Source Survey Platform (Typeform Alternative)
  # ============================================================================
  
  # Dedicated PostgreSQL with pgvector for Formbricks
  formbricks_db:
    image: pgvector/pgvector:pg17
    container_name: formbricks_db
    profiles: ["formbricks"]
    restart: unless-stopped
    volumes:
      - formbricks_postgres:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=formbricks
      - POSTGRES_USER=formbricks
      - POSTGRES_PASSWORD=${FORMBRICKS_DB_PASSWORD:-formbricks_secure_password}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U formbricks"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

  formbricks:
    image: formbricks/formbricks:latest
    container_name: formbricks
    profiles: ["formbricks"]
    restart: unless-stopped
    volumes:
      - formbricks_uploads:/home/nextjs/apps/web/uploads
      - ./shared:/data/shared
    environment:
      # Core Configuration
      - WEBAPP_URL=https://${FORMBRICKS_HOSTNAME}
      - NEXTAUTH_URL=https://${FORMBRICKS_HOSTNAME}
      
      # Database - eigene PostgreSQL mit pgvector!
      - DATABASE_URL=postgresql://formbricks:${FORMBRICKS_DB_PASSWORD:-formbricks_secure_password}@formbricks_db:5432/formbricks?schema=public
      - NEXTAUTH_SECRET=${FORMBRICKS_NEXTAUTH_SECRET}
      - ENCRYPTION_KEY=${FORMBRICKS_ENCRYPTION_KEY}
      - CRON_SECRET=${FORMBRICKS_CRON_SECRET}
      - EMAIL_VERIFICATION_DISABLED=1
      - PASSWORD_RESET_DISABLED=0
      - INVITE_DISABLED=0
      - EMAIL_AUTH_DISABLED=0
      - MAIL_FROM=${FORMBRICKS_MAIL_FROM:-noreply@${BASE_DOMAIN}}
      - SMTP_HOST=${SMTP_HOST:-mailpit}
      - SMTP_PORT=${SMTP_PORT:-1025}
      - SMTP_USER=${SMTP_USER:-dummy}
      - SMTP_PASSWORD=${SMTP_PASS:-dummy}
      - SMTP_SECURE_ENABLED=0
      - UPLOADS_DIR=/home/nextjs/apps/web/uploads
      - ASSET_PREFIX_URL=
      - TELEMETRY_DISABLED=1
      - DEFAULT_ORGANIZATION_ID=
      - DEFAULT_ORGANIZATION_ROLE=owner
      - REDIS_URL=redis://redis:6379
      - REDIS_HTTP_URL=redis://redis:6379
      
    depends_on:
      formbricks_db:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:3000/api/v1/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 90s

  # ============================================================================
  # METABASE - Business Intelligence Platform
  # ============================================================================
  metabase:
    image: metabase/metabase:latest
    container_name: metabase
    profiles: ["metabase"]
    restart: unless-stopped
    volumes:
      - metabase_data:/metabase-data
    environment:
      - MB_DB_TYPE=postgres
      - MB_DB_DBNAME=metabase
      - MB_DB_PORT=5432
      - MB_DB_USER=metabase
      - MB_DB_PASS=${METABASE_DB_PASSWORD}
      - MB_DB_HOST=metabase_db
    depends_on:
      metabase_db:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s

  metabase_db:
    image: postgres:${METABASE_POSTGRES_VERSION:-16-alpine}
    container_name: metabase_db
    profiles: ["metabase"]
    restart: unless-stopped
    volumes:
      - metabase_postgres:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=${METABASE_DB_NAME:-metabase}
      - POSTGRES_USER=${METABASE_DB_USER:-metabase}
      - POSTGRES_PASSWORD=${METABASE_DB_PASSWORD}
      - POSTGRES_INITDB_ARGS=--encoding=UTF8 --lc-collate=C --lc-ctype=C
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${METABASE_DB_USER:-metabase}"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

  # ============================================================================
  # OCR BUNDLE - Text Extraction from Images/PDFs
  # ============================================================================
  
  # OCR Bundle - Tesseract (Fast Mode)
  tesseract-ocr:
    image: hertzg/tesseract-server:latest
    container_name: tesseract-ocr
    profiles: ["ocr"]
    restart: unless-stopped
    volumes:
      - ./shared:/tmp
    environment:
      - HTTP_LISTEN_PORT=8884
      - HTTP_UPLOAD_TMPDIR=/tmp
      - POOL_DEFAULT_MAX=${OCR_CPU_CORES:-4}
      - POOL_DEFAULT_IDLETIMEOUTMILLIS=5000
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8884/status"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10s

  # OCR Bundle - EasyOCR (Quality Mode)
  easyocr:
    image: voduytuan/restful-easyocr:latest
    container_name: easyocr
    profiles: ["ocr"]
    restart: unless-stopped
    volumes:
      - easyocr_models:/root/.EasyOCR/model
      - ./shared:/data/shared
    environment:
      - SECRET_KEY=${EASYOCR_SECRET_KEY:-launchkit}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:2000/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 40s  # EasyOCR needs time to load models

  # ============================================================================
  # STIRLING-PDF - Comprehensive PDF Tools Suite
  # ============================================================================
  stirling-pdf:
    image: stirlingtools/stirling-pdf:latest
    container_name: stirling-pdf
    profiles: ["stirling-pdf"]
    restart: unless-stopped
    volumes:
      - stirling_data:/usr/share/tessdata
      - stirling_configs:/configs
      - stirling_logs:/logs
      - ./shared:/data/shared
    environment:
      - SYSTEM_DEFAULTLOCALE=${STIRLING_LOCALE:-de-DE}
      - UI_APPNAME=${STIRLING_APP_NAME:-AI LaunchKit PDF}
      - UI_HOMEDESCRIPTION=${STIRLING_APP_DESC:-PDF-Tools für AI LaunchKit}
      - UI_APPNAMENAVBAR=${STIRLING_APP_NAME:-AI LaunchKit PDF}
      - SECURITY_ENABLELOGIN=${STIRLING_ENABLE_LOGIN:-true}
      - SECURITY_INITIALLOGINUSERNAME=${STIRLING_USERNAME}
      - SECURITY_INITIALLOGINPASSWORD=${STIRLING_PASSWORD}
      - DISABLE_ADDITIONAL_FEATURES=false
      - LANGS=de-DE,en-GB,en-US
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/api/v1/info/status | grep -q 'UP' || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5

  # ============================================
  # TTS Chatterbox - State-of-the-Art Text-to-Speech
  # ============================================
  chatterbox-tts:
    build:
      context: ./chatterbox-frontend
      dockerfile: docker/Dockerfile
    container_name: chatterbox-tts
    profiles: ["tts-chatterbox"]
    restart: unless-stopped
    volumes:
      - chatterbox_models:/app/models
      - ./shared/tts/voices:/app/voice-samples
      - ./shared:/data/shared
    environment:
      - DEVICE=${CHATTERBOX_DEVICE:-cpu}
      - EXAGGERATION=${CHATTERBOX_EXAGGERATION:-0.5}
      - API_KEY=${CHATTERBOX_API_KEY}
      - MAX_LENGTH=${CHATTERBOX_MAX_LENGTH:-500}
      - DEFAULT_VOICE=${CHATTERBOX_DEFAULT_VOICE:-default}
      - MEMORY_CLEANUP_INTERVAL=${CHATTERBOX_MEMORY_CLEANUP:-60}
      - CUDA_CACHE_CLEAR_INTERVAL=${CHATTERBOX_CUDA_CLEANUP:-120}
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:4123/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  # Chatterbox Frontend (Web UI)
  chatterbox-frontend:
    build:
      context: ./chatterbox-frontend/frontend
      dockerfile: Dockerfile
    container_name: chatterbox-frontend
    profiles: ["tts-chatterbox"]
    restart: unless-stopped
    depends_on:
      - chatterbox-tts
    environment:
      - VITE_API_URL=http://chatterbox-tts:5123

  # ============================================================================
  # AI SECURITY SUITE - LLM Protection & GDPR-compliant PII Detection
  # ============================================================================
  
  # LLM Guard - AI Security & Prompt Protection
  llm-guard:
    image: laiyer/llm-guard-api:latest
    container_name: llm-guard
    profiles: ["ai-security"]
    restart: unless-stopped
    environment:
      - AUTH_TOKEN=${LLM_GUARD_TOKEN}
      - LOG_LEVEL=${LLM_GUARD_LOG_LEVEL:-INFO}
      - APP_WORKERS=2
      - CACHE_MAX_SIZE=100
      - CACHE_TTL=3600
      - SCAN_FAIL_FAST=false
    volumes:
      - ./shared:/data/shared
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8000/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 40s

  # Presidio Analyzer - PII Detection (GDPR)
  presidio-analyzer:
    image: mcr.microsoft.com/presidio-analyzer:latest
    container_name: presidio-analyzer
    profiles: ["ai-security"]
    restart: unless-stopped
    environment:
      - PORT=3000
      - ANALYZER_MIN_SCORE=${PRESIDIO_MIN_SCORE:-0.5}
    volumes:
      - ./shared:/data/shared
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:3000/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  # Presidio Anonymizer - Data Anonymization
  presidio-anonymizer:
    image: mcr.microsoft.com/presidio-anonymizer:latest
    container_name: presidio-anonymizer
    profiles: ["ai-security"]
    restart: unless-stopped
    environment:
      - PORT=3000
    volumes:
      - ./shared:/data/shared
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:3000/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Flair NER - German/Multi-language PII Detection
  flair-pii:
    build:
      context: ./dockerfiles/flair-pii
      dockerfile: Dockerfile
    container_name: flair-pii
    profiles: ["ai-security"]
    restart: unless-stopped
    volumes:
      - ./shared:/data/shared
    healthcheck:
      test: ["CMD", "python", "-c", "import requests; requests.get('http://localhost:8000/health').raise_for_status()"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  # ============================================================================
  # BROWSER AUTOMATION SUITE - Browserless + Skyvern + Browser-use
  # ============================================================================
  
  # Browserless - Centralized Chrome Runtime
  browserless:
    image: ghcr.io/browserless/chromium:latest
    container_name: browserless
    profiles: ["browser-suite"]
    restart: unless-stopped
    environment:
      - TOKEN=${BROWSERLESS_TOKEN}
      - CONCURRENT=${BROWSERLESS_CONCURRENT:-10}
      - TIMEOUT=${BROWSERLESS_TIMEOUT:-120000}
      - MAX_QUEUE_LENGTH=${BROWSERLESS_QUEUE:-10}
      - ENABLE_DEBUGGER=${BROWSERLESS_DEBUGGER:-false}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/pressure"]
      interval: 30s
      timeout: 10s
      retries: 3
    expose:
      - "3000"

  # Skyvern - Vision-based Browser Automation
  skyvern-postgres:
    image: postgres:15-alpine
    container_name: skyvern-postgres
    profiles: ["browser-suite"]
    restart: unless-stopped
    environment:
      - POSTGRES_USER=skyvern
      - POSTGRES_PASSWORD=skyvern
      - POSTGRES_DB=skyvern
      - PGDATA=/var/lib/postgresql/data/pgdata
    volumes:
      - skyvern_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U skyvern"]
      interval: 5s
      timeout: 5s
      retries: 5

  skyvern:
    image: public.ecr.aws/skyvern/skyvern:latest
    container_name: skyvern
    profiles: ["browser-suite"]
    restart: unless-stopped
    environment:
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - DATABASE_STRING=postgresql+psycopg://skyvern:skyvern@skyvern-postgres:5432/skyvern
      - SKYVERN_API_KEY=${SKYVERN_API_KEY}
      - BROWSERLESS_URL=ws://browserless:3000?token=${BROWSERLESS_TOKEN}
      - ENABLE_OPENAI=true
      - LOG_LEVEL=INFO
    volumes:
      - ./shared/skyvern-artifacts:/data/artifacts
      - ./shared/skyvern-videos:/data/videos
    depends_on:
      skyvern-postgres:
        condition: service_healthy
      browserless:
        condition: service_started

  # Browser-use - LLM-powered Browser Control
  browser-use:
    image: python:3.11-slim
    container_name: browser-use
    profiles: ["browser-suite"]
    restart: unless-stopped
    working_dir: /workspace
    command: >
      bash -c "
      apt-get update && apt-get install -y curl wget && 
      pip install --no-cache-dir browser-use playwright langchain openai anthropic &&
      playwright install-deps chromium &&
      playwright install chromium &&
      echo 'Browser-use ready - execute via: docker exec browser-use python script.py' &&
      tail -f /dev/null
      "
    environment:
      - BROWSERLESS_URL=ws://browserless:3000?token=${BROWSERLESS_TOKEN}
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
    volumes:
      - ./shared:/workspace
      - browser-use-cache:/root/.cache
    depends_on:
      - browserless

  # ============================================================================
  # N8N-MCP - Model Context Protocol for AI Workflow Generation
  # ============================================================================
  
  # n8n-MCP - Model Context Protocol Server
  n8n-mcp:
    build:
      context: https://github.com/czlonkowski/n8n-mcp.git
      dockerfile: Dockerfile
    container_name: n8n-mcp
    profiles: ["n8n-mcp"]
    restart: unless-stopped
    environment:
      - AUTH_TOKEN=${N8N_MCP_TOKEN}
      - USE_FIXED_HTTP=true
      - N8N_HOST=n8n
      - N8N_API_URL=http://n8n:5678
      - N8N_API_KEY=${N8N_API_KEY}
      - LOG_LEVEL=info
      - MCP_MODE=http
      - PORT=3000
    volumes:
      - n8n-mcp-data:/app/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ============================================================================
  # AI RESEARCH TOOLS - GPT Researcher & Local Deep Research
  # ============================================================================
  
  # GPT Researcher - Autonomous Research Agent (2000+ word reports)
  gpt-researcher:
    image: gptresearcher/gpt-researcher:latest
    container_name: gpt-researcher
    profiles: ["gpt-researcher"]
    restart: unless-stopped
    volumes:
      - gpt_researcher_data:/usr/src/app/outputs
      - ./shared/research:/usr/src/app/my-docs
    environment:
      # OpenAI Configuration (Default)
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - LLM_PROVIDER=openai
      - FAST_LLM=openai:gpt-4o-mini
      - SMART_LLM=openai:gpt-4o-mini  
      - STRATEGIC_LLM=openai:gpt-4o-mini
      - SUMMARY_LLM=openai:gpt-4o-mini

      # ==== Ollama Configuration (Alternative) ====
      # Uncomment these and comment out OpenAI above to use Ollama:
      # - LLM_PROVIDER=ollama
      # - OLLAMA_BASE_URL=http://ollama:11434
      # - FAST_LLM=ollama/qwen2.5:7b-instruct-q4_K_M
      # - SMART_LLM=ollama/qwen2.5:7b-instruct-q4_K_M
      # - STRATEGIC_LLM=ollama/qwen2.5:7b-instruct-q4_K_M
      # - SUMMARY_LLM=ollama/qwen2.5:7b-instruct-q4_K_M

      # Search & Report Configuration  
      - RETRIEVER=${GPTR_RETRIEVER:-searx}
      - SEARX_URL=http://searxng:8080
      - REPORT_FORMAT=${GPTR_REPORT_FORMAT:-APA}
      - MAX_ITERATIONS=${GPTR_MAX_ITERATIONS:-5}
      - TOTAL_WORDS=${GPTR_TOTAL_WORDS:-2000}
      - LANGUAGE=${GPTR_LANGUAGE:-english}
      - DOC_PATH=/usr/src/app/my-docs
      
      # Server Configuration
      - HOST=0.0.0.0
      - PORT=8000
      - BACKEND_WS_MODE=none
    user: root
    ports:
      - "8555:8000"
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8000/api/health || curl -fsS http://localhost:8000 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 40s
    depends_on:
      - searxng

  # GPT Researcher Frontend (NextJS UI)
  gpt-researcher-ui:
    image: gptresearcher/gptr-nextjs:latest
    container_name: gpt-researcher-ui
    profiles: ["gpt-researcher"]
    restart: unless-stopped
    environment:
      - NEXT_PUBLIC_GPTR_API_URL=https://${GPTR_HOSTNAME}
      - CHOKIDAR_USEPOLLING=true
      - LOGGING_LEVEL=INFO
    depends_on:
      - gpt-researcher

  # Local Deep Research - LangChain's Iterative Research System
  local-deep-research:
    build:
      context: https://github.com/langchain-ai/local-deep-researcher.git
      dockerfile: Dockerfile
    container_name: local-deep-research
    profiles: ["local-deep-research"]
    restart: unless-stopped
    volumes:
      - ldr_data:/data
      - ./shared/research:/data/shared
    environment:
      # LLM Configuration (using existing Ollama!) - KORRIGIERT!
      - LLM_PROVIDER=${LDR_LLM_PROVIDER:-ollama}
      - OLLAMA_BASE_URL=http://ollama:11434
      - LOCAL_LLM=${LDR_LOCAL_MODEL:-qwen2.5:7b-instruct-q4_K_M}
      
      # Search Configuration (using existing SearXNG!)
      - SEARCH_API=${LDR_SEARCH_API:-searxng}
      - SEARXNG_URL=http://searxng:8080
      - MAX_WEB_RESEARCH_LOOPS=${LDR_MAX_LOOPS:-5}
      - FETCH_FULL_PAGE=${LDR_FETCH_FULL:-false}
      
      # Optional API Keys
      - TAVILY_API_KEY=${TAVILY_API_KEY:-}
      - PERPLEXITY_API_KEY=${PERPLEXITY_API_KEY:-}
      
      # Data Directory
      - LDR_DATA_DIR=/data
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:2024/health || curl -fsS http://localhost:2024 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    depends_on:
      - searxng

  # ========== SEAFILE STACK ==========
  seafile-db:
    image: mariadb:10.11
    container_name: seafile-mariadb
    profiles: ["seafile"]
    restart: unless-stopped
    environment:
      - MYSQL_ROOT_PASSWORD=${SEAFILE_DB_ROOT_PASSWORD}
      - MYSQL_DATABASE=seafile_db
      - MYSQL_USER=seafile
      - MYSQL_PASSWORD=${SEAFILE_DB_PASSWORD}
    volumes:
      - seafile_mysql:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      interval: 30s
      timeout: 5s
      retries: 5

  seafile:
    image: seafileltd/seafile-mc:latest
    container_name: seafile
    profiles: ["seafile"]
    restart: unless-stopped
    environment:
      - DB_HOST=seafile-db
      - DB_ROOT_PASSWD=${SEAFILE_DB_ROOT_PASSWORD}
      - DB_NAME=seafile_db
      - DB_USER=seafile
      - DB_PASSWORD=${SEAFILE_DB_PASSWORD}
      - SEAFILE_SERVER_LETSENCRYPT=false
      - SEAFILE_ADMIN_EMAIL=${SEAFILE_ADMIN_EMAIL}
      - SEAFILE_ADMIN_PASSWORD=${SEAFILE_ADMIN_PASSWORD}
      - SEAFILE_SERVER_HOSTNAME=${SEAFILE_HOSTNAME}
      - TIME_ZONE=Europe/Berlin
      - FORCE_HTTPS_IN_CONF=true
    volumes:
      - seafile_data:/shared
      - ./shared:/shared/paperless-bridge
      - ./scripts/seafile-init.sh:/init-fix.sh:ro
    depends_on:
      - seafile-db
    healthcheck:
      test: ["CMD-SHELL", "bash /init-fix.sh && curl -f http://localhost:80"]
      interval: 30s
      timeout: 10s
      retries: 5

  # ========== PAPERLESS-NGX STACK ==========
  paperless-redis:
    image: redis:7-alpine
    container_name: paperless-redis
    profiles: ["paperless"]
    restart: unless-stopped
    volumes:
      - paperless_redis:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 30s
      timeout: 3s
      retries: 5

  paperless-db:
    image: postgres:17-alpine
    container_name: paperless-postgres
    profiles: ["paperless"]
    restart: unless-stopped
    environment:
      - POSTGRES_DB=paperless
      - POSTGRES_USER=paperless
      - POSTGRES_PASSWORD=${PAPERLESS_DB_PASSWORD}
    volumes:
      - paperless_postgresql:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U paperless"]
      interval: 30s
      timeout: 5s
      retries: 5

  paperless:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless-ngx
    profiles: ["paperless"]
    restart: unless-stopped
    environment:
      - PAPERLESS_REDIS=redis://paperless-redis:6379
      - PAPERLESS_DBENGINE=postgresql
      - PAPERLESS_DBHOST=paperless-db
      - PAPERLESS_DBNAME=paperless
      - PAPERLESS_DBUSER=paperless
      - PAPERLESS_DBPASS=${PAPERLESS_DB_PASSWORD}
      - PAPERLESS_SECRET_KEY=${PAPERLESS_SECRET_KEY}
      - PAPERLESS_TIME_ZONE=Europe/Berlin
      - PAPERLESS_OCR_LANGUAGE=deu+eng
      - PAPERLESS_ADMIN_USER=${PAPERLESS_ADMIN_EMAIL}
      - PAPERLESS_ADMIN_PASSWORD=${PAPERLESS_ADMIN_PASSWORD}
      - PAPERLESS_ADMIN_MAIL=${PAPERLESS_ADMIN_EMAIL}
      - PAPERLESS_URL=https://${PAPERLESS_HOSTNAME}
      - PAPERLESS_FILENAME_FORMAT={created_year}/{correspondent}/{created_date}_{title}
      - PAPERLESS_CONSUMER_RECURSIVE=true
      - PAPERLESS_CONSUMER_SUBDIRS_AS_TAGS=true
    volumes:
      - paperless_data:/usr/src/paperless/data
      - paperless_media:/usr/src/paperless/media
      - ./shared:/usr/src/paperless/consume/seafile
    depends_on:
      - paperless-db
      - paperless-redis
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000"]
      interval: 30s
      timeout: 10s
      retries: 5

  # ===========================================
  # PAPERLESS-GPT - Superior OCR with Vision LLMs
  # ===========================================
  paperless-gpt:
    image: ghcr.io/icereed/paperless-gpt:latest
    container_name: paperless-gpt
    profiles: ["paperless-ai"]
    restart: unless-stopped
    environment:
      # Paperless Connection
      - PAPERLESS_BASE_URL=http://paperless-ngx:8000
      - PAPERLESS_API_TOKEN=${PAPERLESS_API_TOKEN}
      - PAPERLESS_PUBLIC_URL=https://${PAPERLESS_HOSTNAME}
      
      # Tags Configuration
      - MANUAL_TAG=paperless-gpt
      - AUTO_TAG=paperless-gpt-auto
      - AUTO_OCR_TAG=paperless-gpt-ocr-auto
      
      # ===== DEFAULT: OpenAI Configuration (for CPU VPS) =====
      - LLM_PROVIDER=${PAPERLESS_GPT_LLM_PROVIDER:-openai}
      - LLM_MODEL=${PAPERLESS_GPT_LLM_MODEL:-gpt-4o-mini}
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - LLM_LANGUAGE=${PAPERLESS_GPT_LANGUAGE:-German}
      
      # ===== ALTERNATIVE: Ollama Configuration (uncomment if using Ollama) =====
      # - LLM_PROVIDER=${PAPERLESS_GPT_LLM_PROVIDER:-ollama}
      # - LLM_MODEL=${PAPERLESS_GPT_LLM_MODEL:-qwen2.5:7b}
      # - OLLAMA_HOST=http://ollama:11434
      
      # Vision LLM for OCR (OpenAI by default)
      - OCR_PROVIDER=llm
      - VISION_LLM_PROVIDER=${PAPERLESS_GPT_VISION_PROVIDER:-openai}
      - VISION_LLM_MODEL=${PAPERLESS_GPT_VISION_MODEL:-gpt-4o-mini}
      
      # ===== ALTERNATIVE: Ollama Vision (uncomment if using Ollama) =====
      # - VISION_LLM_PROVIDER=${PAPERLESS_GPT_VISION_PROVIDER:-ollama}
      # - VISION_LLM_MODEL=${PAPERLESS_GPT_VISION_MODEL:-minicpm-v}
      
      - OCR_PROCESS_MODE=image
      - OCR_LIMIT_PAGES=${PAPERLESS_GPT_OCR_LIMIT:-0}
      
      # Auto-generation settings
      - AUTO_GENERATE_TITLE=true
      - AUTO_GENERATE_TAGS=true
      - AUTO_GENERATE_CORRESPONDENTS=true
      - AUTO_GENERATE_CREATED_DATE=true
      
      # Performance
      - TOKEN_LIMIT=${PAPERLESS_GPT_TOKEN_LIMIT:-0}
      - LOG_LEVEL=info
      # - LISTEN_INTERFACE=0.0.0.0:8080
    volumes:
      - paperless-gpt-prompts:/app/prompts
      - ./shared:/data/shared
    depends_on:
      - paperless
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:8080/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5

  # ===========================================
  # PAPERLESS-AI - RAG Chat & Semantic Search
  # ===========================================
  paperless-ai:
    image: clusterzx/paperless-ai:latest
    container_name: paperless-ai
    profiles: ["paperless-ai"]
    restart: unless-stopped
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges=true
    environment:
      - PUID=1000
      - PGID=1000
      - PAPERLESS_AI_PORT=${PAPERLESS_AI_PORT:-3000}
      - RAG_SERVICE_URL=http://paperless-ai:8000
      - RAG_SERVICE_ENABLED=true
    volumes:
      - paperless-ai-data:/app/data
      - ./shared:/data/shared
    depends_on:
      - paperless
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:3000/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5

  # ============================================================================
  # OPEN NOTEBOOK - Privacy-First Alternative zu Google NotebookLM
  # ============================================================================
  
  # Open Notebook - AI-Powered Knowledge Management & Research Platform
  opennotebook:
    image: lfnovo/open_notebook:v1-latest-single
    container_name: opennotebook
    profiles: ["opennotebook"]
    restart: unless-stopped
    environment:
      # AI Provider Keys (mindestens einer erforderlich)
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      - GROQ_API_KEY=${GROQ_API_KEY:-}
      
      # SurrealDB Connection (Embedded Database)
      - SURREAL_URL=ws://localhost:8000/rpc
      - SURREAL_USER=root
      - SURREAL_PASSWORD=root
      - SURREAL_NAMESPACE=open_notebook
      - SURREAL_DATABASE=production
      
      # API_URL for the frontend
      - API_URL=https://${OPENNOTEBOOK_HOSTNAME}

      # Authentication (Native Open Notebook Password)
      - OPEN_NOTEBOOK_PASSWORD=${OPENNOTEBOOK_PASSWORD}
      
    volumes:
      - ./opennotebook/notebook_data:/app/data
      - ./opennotebook/surreal_data:/mydata
      - ./shared:/app/shared
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8502 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

  # ============================================================================
  # WEBHOOK TESTING SUITE - Testing & Debugging Webhooks
  # ============================================================================
  
  # Dedicated Redis for Webhook Tester
  webhook-tester-redis:
    image: redis:7-alpine
    container_name: webhook-tester-redis
    profiles: ["webhook-testing"]
    restart: unless-stopped
    volumes:
      - webhook_tester_redis:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Webhook Tester - Receive and Debug Webhooks
  webhook-tester:
    image: ghcr.io/tarampampam/webhook-tester:2
    container_name: webhook-tester
    profiles: ["webhook-testing"]
    restart: unless-stopped
    environment:
      - AUTO_CREATE_SESSIONS=true
      - STORAGE_DRIVER=redis
      - PUBSUB_DRIVER=redis
      - REDIS_DSN=redis://webhook-tester-redis:6379/0
      - MAX_REQUESTS=100
      - IGNORE_HEADER_PREFIX=X-Forwarded-
      - IGNORE_HEADER_PREFIX=X-Real-
    depends_on:
      webhook-tester-redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # Hoppscotch PostgreSQL Database
  hoppscotch-db:
    image: postgres:17-alpine
    container_name: hoppscotch-db
    profiles: ["webhook-testing"]
    restart: unless-stopped
    volumes:
      - hoppscotch_postgres:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=hoppscotch
      - POSTGRES_USER=hoppscotch
      - POSTGRES_PASSWORD=${HOPPSCOTCH_DB_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U hoppscotch"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  # Hoppscotch Database Migration
  hoppscotch-migrate:
    image: hoppscotch/hoppscotch:latest
    container_name: hoppscotch-migrate
    profiles: ["webhook-testing"]
    environment:
      - DATABASE_URL=postgresql://hoppscotch:${HOPPSCOTCH_DB_PASSWORD}@hoppscotch-db:5432/hoppscotch
    depends_on:
      hoppscotch-db:
        condition: service_healthy
    command: sh -c "pnpx prisma migrate deploy --schema /dist/backend/prisma/schema.prisma"
    restart: "no"

  # Hoppscotch - API Testing Platform (All-in-One)
  hoppscotch:
    image: hoppscotch/hoppscotch:latest
    container_name: hoppscotch
    profiles: ["webhook-testing"]
    restart: unless-stopped
    environment:
      # Database Configuration
      - DATABASE_URL=postgresql://hoppscotch:${HOPPSCOTCH_DB_PASSWORD}@hoppscotch-db:5432/hoppscotch
      - ENABLE_SUBPATH_BASED_ACCESS=false
      
      # Security & Secrets
      - JWT_SECRET=${HOPPSCOTCH_JWT_SECRET}
      - SESSION_SECRET=${HOPPSCOTCH_SESSION_SECRET}
      - REFRESH_TOKEN_SECRET=${HOPPSCOTCH_REFRESH_TOKEN_SECRET}
      - DATA_ENCRYPTION_KEY=${HOPPSCOTCH_DATA_ENCRYPTION_KEY}
      
      # URLs
      - REDIRECT_URL=https://${HOPPSCOTCH_HOSTNAME}
      - WHITELISTED_ORIGINS=https://${HOPPSCOTCH_HOSTNAME}
      - VITE_BASE_URL=https://${HOPPSCOTCH_HOSTNAME}
      - VITE_SHORTCODE_BASE_URL=https://${HOPPSCOTCH_HOSTNAME}
      - VITE_ADMIN_URL=https://${HOPPSCOTCH_HOSTNAME}
      
      # Mail Configuration (nutzt Mailpit)
      - MAILER_SMTP_ENABLE=true
      - MAILER_USE_CUSTOM_CONFIGS=true
      - MAILER_SMTP_HOST=mailpit
      - MAILER_SMTP_PORT=1025
      - MAILER_SMTP_SECURE=false
      - MAILER_SMTP_AUTH=false
      - MAILER_ADDRESS_FROM=hoppscotch@${BASE_DOMAIN}
      
      # Features
      - RATE_LIMIT_TTL=60
      - RATE_LIMIT_MAX=100
      - VITE_ALLOWED_AUTH_PROVIDERS=EMAIL
      
    volumes:
      - ./shared:/data/shared
    depends_on:
      hoppscotch-db:
        condition: service_healthy
      hoppscotch-migrate:
        condition: service_completed_successfully
      mailpit:
        condition: service_started
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:3000/api/health || curl -fsS http://localhost:3000 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  # ============================================================================
  # AIRBYTE DESTINATION - PostgreSQL for synced marketing data
  # ============================================================================
  
  # Destination database for Airbyte synced data
  # Connect Metabase here for analytics dashboards
  airbyte_destination_db:
    image: postgres:17-alpine
    container_name: airbyte_destination_db
    profiles: ["airbyte"]
    restart: unless-stopped
    volumes:
      - airbyte_destination_data:/var/lib/postgresql/data
      - ./scripts/airbyte_init_db.sql:/docker-entrypoint-initdb.d/init.sql:ro
    environment:
      - POSTGRES_USER=airbyte
      - POSTGRES_PASSWORD=${AIRBYTE_DESTINATION_DB_PASSWORD}
      - POSTGRES_DB=marketing_data
    ports:
      - "5433:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U airbyte"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ============================================
  # Homepage - Dashboard
  # ============================================
  homepage:
    image: ghcr.io/gethomepage/homepage:latest
    container_name: homepage
    profiles: ["homepage"]
    restart: unless-stopped
    environment:
      - HOMEPAGE_VAR_TITLE=AI LaunchKit Dashboard
      - HOMEPAGE_VAR_SEARCH_PROVIDER=searxng
      - HOMEPAGE_VAR_HEADER_STYLE=boxed
      - HOMEPAGE_VAR_LAYOUT_STYLE=row
      - HOMEPAGE_VAR_COLOR_PALETTE=slate
      - PUID=1000
      - PGID=999
      - HOMEPAGE_ALLOWED_HOSTS=*
    volumes:
      - ./homepage_config:/app/config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    user: "1000:999"

  # ============================================
  # Outline - Wiki/Dokumentation
  # ============================================
  outline-redis:
    image: redis:7-alpine
    container_name: outline-redis
    profiles: ["outline"]
    restart: unless-stopped
    volumes:
      - outline_redis_data:/data

  outline-postgres:
    image: postgres:17-alpine
    container_name: outline-postgres
    profiles: ["outline"]
    restart: unless-stopped
    environment:
      - POSTGRES_USER=outline
      - POSTGRES_PASSWORD=outline
      - POSTGRES_DB=outline
    volumes:
      - outline_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U outline"]
      interval: 30s
      timeout: 10s
      retries: 3

  outline-minio:
    image: minio/minio:latest
    container_name: outline-minio
    profiles: ["outline"]
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      - MINIO_ROOT_USER=${OUTLINE_MINIO_ROOT_USER}
      - MINIO_ROOT_PASSWORD=${OUTLINE_MINIO_ROOT_PASSWORD}
      - MINIO_BROWSER_REDIRECT_URL=https://${OUTLINE_S3_ADMIN_HOSTNAME}
    volumes:
      - outline_minio_data:/data

  outline:
    image: docker.getoutline.com/outlinewiki/outline:latest
    container_name: outline
    profiles: ["outline"]
    restart: unless-stopped
    command: sh -c "yarn start --env=production-ssl-disabled"
    depends_on:
      - outline-postgres
      - outline-redis
      - outline-minio
      - dex
    environment:
      - NODE_ENV=production
      - SECRET_KEY=${OUTLINE_SECRET_KEY}
      - UTILS_SECRET=${OUTLINE_UTILS_SECRET}
      - DATABASE_URL=postgres://outline:outline@outline-postgres:5432/outline
      - DATABASE_CONNECTION_POOL_MIN=5
      - DATABASE_CONNECTION_POOL_MAX=100
      - PGSSLMODE=disable
      - REDIS_URL=redis://outline-redis:6379
      - URL=https://${OUTLINE_HOSTNAME}
      - PORT=3000
      - FILE_STORAGE=s3
      - FILE_STORAGE_UPLOAD_MAX_SIZE=26214400
      - AWS_ACCESS_KEY_ID=${OUTLINE_MINIO_ROOT_USER}
      - AWS_SECRET_ACCESS_KEY=${OUTLINE_MINIO_ROOT_PASSWORD}
      - AWS_REGION=us-east-1
      - AWS_S3_UPLOAD_BUCKET_URL=https://${OUTLINE_S3_HOSTNAME}
      - AWS_S3_UPLOAD_BUCKET_NAME=outline
      - AWS_S3_FORCE_PATH_STYLE=true
      - AWS_S3_ACL=private
      # OIDC Configuration with Dex (instead of Google/Slack/etc.)
      - OIDC_CLIENT_ID=outline
      - OIDC_CLIENT_SECRET=${OUTLINE_OIDC_CLIENT_SECRET}
      - OIDC_AUTH_URI=https://${DEX_HOSTNAME}/auth
      - OIDC_TOKEN_URI=http://dex:5556/token
      - OIDC_USERINFO_URI=http://dex:5556/userinfo
      - OIDC_DISPLAY_NAME=Login
      - OIDC_SCOPES=openid profile email
      - FORCE_HTTPS=false
      - SECURE_COOKIES=false
      - TRUST_PROXY=true
    volumes:
      - outline_data:/var/lib/outline/data

  # ============================================
  # Gitea - Git Hosting
  # ============================================
  gitea-db:
    image: postgres:17-alpine
    container_name: gitea-db
    profiles: ["gitea"]
    restart: unless-stopped
    environment:
      - POSTGRES_USER=gitea
      - POSTGRES_PASSWORD=gitea
      - POSTGRES_DB=gitea
    volumes:
      - gitea_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U gitea"]
      interval: 30s
      timeout: 10s
      retries: 3

  gitea:
    image: gitea/gitea:latest
    container_name: gitea
    profiles: ["gitea"]
    restart: unless-stopped
    depends_on:
      - gitea-db
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=gitea-db:5432
      - GITEA__database__NAME=gitea
      - GITEA__database__USER=gitea
      - GITEA__database__PASSWD=gitea
    ports:
      - "${GITEA_SSH_PORT:-2222}:22"
    volumes:
      - gitea_data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro

  # ============================================
  # DocuSeal - E-Signatures
  # ============================================
  docuseal-db:
    image: postgres:17-alpine
    container_name: docuseal-db
    profiles: ["docuseal"]
    restart: unless-stopped
    environment:
      - POSTGRES_USER=docuseal
      - POSTGRES_PASSWORD=${DOCUSEAL_DB_PASSWORD}
      - POSTGRES_DB=docuseal
    volumes:
      - docuseal_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U docuseal"]
      interval: 30s
      timeout: 10s
      retries: 3

  docuseal:
    image: docuseal/docuseal:latest
    container_name: docuseal
    profiles: ["docuseal"]
    restart: unless-stopped
    depends_on:
      - docuseal-db
    environment:
      - DATABASE_URL=postgresql://docuseal:${DOCUSEAL_DB_PASSWORD}@docuseal-db:5432/docuseal
      - FORCE_SSL=false
    volumes:
      - docuseal_data:/data

  # Dex - Identity Provider for Outline
  dex:
    image: ghcr.io/dexidp/dex:v2.37.0
    container_name: dex
    profiles: ["outline"]
    restart: unless-stopped
    volumes:
      - ./dex/config.yaml:/etc/dex/config.yaml:ro
      - dex_data:/var/dex
    environment:
      - DEX_FRONTEND_DIR=/srv/dex/web
    command: ["dex", "serve", "/etc/dex/config.yaml"]

  # ===========================================
  # CODE-SERVER - VS Code in the Browser
  # ===========================================
  code-server:
    image: lscr.io/linuxserver/code-server:latest
    container_name: code-server
    profiles: ["code-server"]
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ:-Europe/Berlin}
      - PASSWORD=${CODESERVER_PASSWORD}
      - SUDO_PASSWORD=${CODESERVER_SUDO_PASSWORD}
      - PROXY_DOMAIN=${CODESERVER_HOSTNAME}
      - DEFAULT_WORKSPACE=/config/workspace
    volumes:
      - codeserver_data:/config
      - ./shared:/config/workspace/shared
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8443/healthz || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3