app-catalog-felhom.eu/templates/karakeep/docker-compose.yml

# Karakeep - Könyvjelzők, cikkek és jegyzetek mentése (a korábbi Hoarder)
# Domain: ${SUBDOMAIN}.${DOMAIN}
# Database: SQLite (in the data volume) + Meilisearch (search index) + a headless Chrome (the crawler)
# RAM: ~700M (mem_limit: 2816M total — web 1536M + chrome 768M + meilisearch 512M) | Pi-compatible: No (Chrome + Meilisearch)
#
# Environment variables:
#   DOMAIN            - Your domain (e.g., demo-felhom.eu)
#   NEXTAUTH_SECRET   - Munkamenet-aláíró kulcs (generált)
#   MEILI_MASTER_KEY  - A keresőindex kulcsa (generált; csak a belső hálón használt)
#   OPENAI_API_KEY    - NEM KÖTELEZŐ. Üresen az AI-címkézés KI van kapcsolva (Karakeep: `isConfigured = !!OPENAI_API_KEY ||
#                       !!OLLAMA_BASE_URL`). Ha a háztartás megadja, a könyvjelzők szövege az OpenAI-hoz kerül.
#   SIGNUP_CLOSED     - after_setup (decision 47): the box sets it when the household's first account exists. Karakeep's
#                       DISABLE_SIGNUPS also refuses the FIRST account, so the default here must stay OPEN.
#
# Mirrors upstream's docker/docker-compose.yml (web + karakeep-chrome + meilisearch v1.41.0, MEILI_NO_ANALYTICS),
# pinned, with the new-release check off (it would call api.github.com) and the crawler's own defaults kept: it fetches
# every bookmarked page — that IS the product — and an ad-block list at start (CRAWLER_ENABLE_ADBLOCKER).

services:
  karakeep:
    image: ghcr.io/karakeep-app/karakeep:0.33.2
    container_name: karakeep
    restart: unless-stopped
    environment:
      - TZ=Europe/Budapest
      - DATA_DIR=/data
      - NEXTAUTH_URL=https://${SUBDOMAIN}.${DOMAIN}
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
      - MEILI_ADDR=http://karakeep-meilisearch:7700
      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
      - BROWSER_WEB_URL=http://karakeep-chrome:9222
      - DISABLE_NEW_RELEASE_CHECK=true
      - DISABLE_SIGNUPS=${SIGNUP_CLOSED:-false}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      # App-email (smtp_mapping, tls_mode plaintext → the shim's :2526, which advertises no STARTTLS: Karakeep's mailer
      # has no switch to accept the shim's self-signed certificate). Empty SMTP_HOST = mail OFF; measured 2026-10-01 that a
      # fresh install with these EMPTY boots and signs up (checklist 7.1).
      - SMTP_HOST=${SMTP_HOST:-}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_FROM=${SMTP_FROM:-}
    volumes:
      - karakeep_data:/data
    networks:
      - traefik-public
      - karakeep-internal
    depends_on:
      karakeep-meilisearch:
        condition: service_healthy
    # 1536M (measured 2026-10-01): the web container also runs the crawler workers. Bench 10-minute watch: 79 % of 768M,
    # 51 % of 1024M; on the box, real pages crawled (a Wikipedia article among them) took it to 822 MiB = 80.3 % of 1024M.
    # So the household's ordinary act — saving a heavy page — needs room; the burst is re-measured at 1536M (record 5.2).
    deploy:
      resources:
        limits:
          memory: 1536M
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://127.0.0.1:3000/api/health || curl -fsS http://127.0.0.1:3000/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.karakeep.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.karakeep.entrypoints=websecure"
      - "traefik.http.routers.karakeep.tls=true"
      - "traefik.http.routers.karakeep.tls.certresolver=letsencrypt"
      - "traefik.http.services.karakeep.loadbalancer.server.port=3000"

  karakeep-chrome:
    image: ghcr.io/karakeep-app/karakeep-chrome:151.0.7922.47-r1
    container_name: karakeep-chrome
    restart: unless-stopped
    init: true
    command:
      - --disable-gpu
      - --disable-dev-shm-usage
      - --hide-scrollbars
      - --disable-blink-features=AutomationControlled
      - --window-size=1440,900
    networks:
      - karakeep-internal
    deploy:
      resources:
        limits:
          memory: 768M
    # The image has no wget/curl/node (inspected one tool per run, 2026-10-01) but has bash: ask Chrome's own DevTools
    # endpoint (socat on 9222 → headless-shell on 9223) for its version over a raw HTTP/1.1 request (HTTP/1.0 got no
    # answer — measured 2026-10-01 on the bench).
    healthcheck:
      test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/9222 && printf 'GET /json/version HTTP/1.1\\r\\nHost: 127.0.0.1\\r\\nConnection: close\\r\\n\\r\\n' >&3 && grep -q Browser <&3"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s

  karakeep-meilisearch:
    image: getmeili/meilisearch:v1.41.0
    container_name: karakeep-meilisearch
    restart: unless-stopped
    environment:
      - TZ=Europe/Budapest
      - MEILI_NO_ANALYTICS=true
      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
    volumes:
      - karakeep_meili:/meili_data
    networks:
      - karakeep-internal
    deploy:
      resources:
        limits:
          memory: 512M
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:7700/health || wget -q -O - http://127.0.0.1:7700/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s

volumes:
  karakeep_data:
  karakeep_meili:

networks:
  traefik-public:
    external: true
  karakeep-internal: