# Jellyseerr - Média igénylés kezelő Jellyfin/Plex integrációval
# Domain: ${SUBDOMAIN}.${DOMAIN}
# Database: None (file-based)
# RAM: ~100M (mem_limit: 384M) | Pi-compatible: Yes
#
# Environment variables:
#   DOMAIN          - Your domain (e.g., demo-felhom.eu)

services:
  seerr:
    # Seerr v3 (2026-10-28, felhom.eu R-1317): Jellyseerr and Overseerr merged into `ghcr.io/seerr-team/seerr`. v3 runs as
    # `node` (UID 1000) and needs /app/config owned by it; a Jellyseerr volume is owned by root. So the container STARTS
    # as root only to hand /app/config to 1000, then runs Seerr as `node` through busybox `su` (no root process stays;
    # measured on the bench: root PID 1 is docker-init, Seerr is `node`). `init: true` is upstream's own requirement
    # (the image has no init). Seerr migrates Jellyseerr's settings and database by itself on the first start.
    image: ghcr.io/seerr-team/seerr:v3.5.1
    container_name: seerr
    restart: unless-stopped
    init: true
    user: "0:0"
    entrypoint: ["/bin/sh", "-c", "chown -R 1000:1000 /app/config && exec su node -s /bin/sh -c 'exec docker-entrypoint.sh npm start'"]
    environment:
      - TZ=Europe/Budapest
    volumes:
      - seerr_config:/app/config
    networks:
      - traefik-public
    deploy:
      resources:
        limits:
          memory: 384M
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:5055/api/v1/status"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.seerr.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
      # R-753: this app reads the LEFTMOST X-Forwarded-For entry, which a stranger writes once traefik keeps the
      # tunnel's chain — so its chain is removed here (it then reads traefik's X-Real-Ip or peer; never forgeable).
      - "traefik.http.middlewares.seerr-xff.headers.customrequestheaders.X-Forwarded-For="
      - "traefik.http.routers.seerr.middlewares=seerr-xff"
      - "traefik.http.routers.seerr.entrypoints=websecure"
      - "traefik.http.routers.seerr.tls=true"
      - "traefik.http.routers.seerr.tls.certresolver=letsencrypt"
      - "traefik.http.services.seerr.loadbalancer.server.port=5055"

volumes:
  seerr_config:

networks:
  traefik-public:
    external: true