docker-compose.yml

services:
  polder:
    build:
      context: .
      args:
        # Embeds the web app from client/; set POLDER_WEB=none for an API-only image.
        WEB: ${POLDER_WEB:-client}
    image: polder-server:latest
    restart: unless-stopped
    ports:
      - "6060:6060"
    volumes:
      - ./config:/config
      - ./data:/data
    # Match the owner of ./config and ./data on the host.
    user: "${POLDER_UID:-1000}:${POLDER_GID:-1000}"
    environment:
      POLDER_DB_DRIVER: ${POLDER_DB_DRIVER:-sqlite}
      POLDER_DB_DSN: ${POLDER_DB_DSN:-}
      # Set one of these two for a document editor; see the collabora and eurooffice services.
      POLDER_COLLABORA_URL: ${POLDER_COLLABORA_URL:-}
      POLDER_EURO_OFFICE_URL: ${POLDER_EURO_OFFICE_URL:-}
      POLDER_WOPI_URL: ${POLDER_WOPI_URL:-http://polder:6060}
      # How videos and photos are decoded for previews: auto picks any GPU passed through below and
      # otherwise uses the CPU. Force one with vaapi (Intel, AMD), qsv (Intel Quick Sync), cuda
      # (NVIDIA) or none.
      POLDER_VIDEO_HWACCEL: ${POLDER_VIDEO_HWACCEL:-auto}
      # Only needed with several GPUs, such as /dev/dri/renderD129 for vaapi or qsv, or 1 for cuda.
      POLDER_VIDEO_HWACCEL_DEVICE: ${POLDER_VIDEO_HWACCEL_DEVICE:-}
    # GPU decoding for previews, on Linux hosts. Uncomment the block for your GPU.
    #
    # Intel (Quick Sync) and AMD: pass the render devices, and the group that may use them, which
    # `getent group render | cut -d: -f3` prints on the host (some distributions use video instead).
    # devices:
    #   - /dev/dri:/dev/dri
    # group_add:
    #   - "${POLDER_RENDER_GID:?set POLDER_RENDER_GID to the host's render group id}"
    #
    # NVIDIA: install the NVIDIA Container Toolkit on the host
    # (https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html), then:
    # deploy:
    #   resources:
    #     reservations:
    #       devices:
    #         - driver: nvidia
    #           count: all
    #           capabilities: [gpu]

  # Optional PostgreSQL: `docker compose --profile postgres up -d` with
  # POLDER_DB_DRIVER=postgres and
  # POLDER_DB_DSN=postgres://polder:change-me@postgres:5432/polder?sslmode=disable
  postgres:
    profiles: ["postgres"]
    image: postgres:18
    restart: unless-stopped
    environment:
      POSTGRES_DB: polder
      POSTGRES_USER: polder
      POSTGRES_PASSWORD: change-me
    volumes:
      - ./postgres:/var/lib/postgresql
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "polder", "-d", "polder"]
      interval: 10s
      retries: 10

  # Optional document editor Collabora: `docker compose --profile office up -d` with
  # POLDER_COLLABORA_URL=http://collabora:9980. Clients reach it through Polder, so it has no port
  # of its own. Polder also has it draw thumbnails of documents that carry none. Set
  # COLLABORA_SSL_TERMINATION=true when Polder is served over https.
  collabora:
    profiles: ["office"]
    image: collabora/code:latest
    restart: unless-stopped
    cap_add:
      - MKNOD
    environment:
      # The only server allowed to hand Collabora files.
      aliasgroup1: ${POLDER_WOPI_URL:-http://polder:6060}
      extra_params: >-
        --o:ssl.enable=false
        --o:ssl.termination=${COLLABORA_SSL_TERMINATION:-false}
        --o:admin_console.enable=false
        --o:welcome.enable=false

  # Optional document editor Euro-Office: `docker compose --profile eurooffice up -d` with
  # POLDER_EURO_OFFICE_URL=http://eurooffice. Like Collabora, clients reach it through Polder
  # (under /eurooffice/), and it draws thumbnails of documents that carry none. It takes the
  # protocol clients use from Polder, so https needs nothing extra here.
  eurooffice:
    profiles: ["eurooffice"]
    image: ghcr.io/euro-office/documentserver:latest
    restart: unless-stopped
    environment:
      # Polder talks to it over WOPI, which is off by default.
      WOPI_ENABLED: "true"
      # Polder's address on the compose network is a private one.
      ALLOW_PRIVATE_IP_ADDRESS: "true"
      # Only used inside Euro-Office; at least 32 characters.
      JWT_SECRET: ${EURO_OFFICE_JWT_SECRET:-change-me-to-a-secret-of-32-characters}