compose-files/immich/immich.yml

#
# Pattern C (partial): DB_PASSWORD as Docker secret (_FILE)
# IMMICH_KIOSK_BASICAUTH stays in host immich.env (Traefik label)
#
services:
  immich-server:
    hostname: immich
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    volumes:
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
      - ${BULK_UPLOAD_LOCATION}:/bulk-upload
    networks:
      - traefik_backend
      - postgresql_db-backend
    environment:
      REDIS_HOSTNAME: ${REDIS_HOSTNAME}
      REDIS_PORT: ${REDIS_PORT}
      REDIS_DBINDEX: ${REDIS_DBINDEX}
      DB_PASSWORD_FILE: /run/secrets/immich_db_password
      DB_USERNAME: ${DB_USERNAME}
      DB_DATABASE_NAME: ${DB_DATABASE_NAME}
      DB_HOSTNAME: ${DB_HOSTNAME}
      DB_PORT: ${DB_PORT}
      IMMICH_TRUSTED_PROXIES: ${IMMICH_TRUSTED_PROXIES}
    secrets:
      - immich_db_password
    depends_on:
      - redis
      - database
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.immich.rule=Host(`${IMMICH_TRAEFIK_HOST}`)
        - traefik.http.routers.immich.tls=true
        - traefik.http.routers.immich.tls.certresolver=letsencrypt
        - traefik.http.routers.immich.entrypoints=websecure
        - traefik.http.services.immich.loadbalancer.server.port=2283
        - traefik.swarm.network=traefik_backend
      resources:
        limits:
          cpus: 8
          memory: 8G
      placement:
        constraints:
          - node.labels.block != databases

  immich-machine-learning:
    hostname: immich-ml
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}-openvino
    volumes:
      - model-cache:/cache
      - /dev/dri:/dev/dri
    networks:
      - traefik_backend
      - postgresql_db-backend
    environment:
      REDIS_HOSTNAME: ${REDIS_HOSTNAME}
      REDIS_PORT: ${REDIS_PORT}
      REDIS_DBINDEX: ${REDIS_DBINDEX}
      DB_PASSWORD_FILE: /run/secrets/immich_db_password
      DB_USERNAME: ${DB_USERNAME}
      DB_DATABASE_NAME: ${DB_DATABASE_NAME}
      DB_HOSTNAME: ${DB_HOSTNAME}
      DB_PORT: ${DB_PORT}
    secrets:
      - immich_db_password
    deploy:
      mode: global
      labels:
        - traefik.enable=false
      resources:
        limits:
          cpus: 8
          memory: 8G
      placement:
        constraints:
          - node.hostname != docker-1

  redis:
    hostname: immich-redis
    image: docker.io/redis:6.2-alpine@sha256:2d1463258f2764328496376f5d965f20c6a67f66ea2b06dc42af351f75248792
    networks:
      - traefik_backend
      - postgresql_db-backend
    volumes:
      - ${REDIS_DATA_LOCATION}:/data
    healthcheck:
      test: redis-cli ping || exit 1
    deploy:
      labels:
        - traefik.enable=false
      resources:
        limits:
#          cpus: 2
          memory: 256M
      placement:
        constraints:
          - node.hostname != docker-1

  database:
    stop_grace_period: 60s
    hostname: immich_postgresql
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/immich_db_password
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    secrets:
      - immich_db_password
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    networks:
      - traefik_backend
      - postgresql_db-backend
    healthcheck:
      test: pg_isready --dbname='immich' --username='immich' || exit 1; Chksum="$$(psql --dbname='immich' --username='immich' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
      interval: 5m
      start_interval: 30s
      start_period: 5m
    deploy:
      resources:
        limits:
          cpus: 4
          memory: 2G
      placement:
        constraints:
          - node.labels.block != databases

  immich-kiosk:
    hostname: immich-kiosk
    image: ghcr.io/damongolding/immich-kiosk:latest
    tty: true
    environment:
      LANG: "en_US"
      TZ: "America/Los_Angeles"
    networks:
      - traefik_backend
    volumes:
      - /volume1/docker/immich-kiosk/config.yaml:/config.yaml
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.immich-kiosk.rule=Host(`${IMMICH_KIOSK_HOST}`)
        - traefik.http.routers.immich-kiosk.tls=true
        - traefik.http.routers.immich-kiosk.tls.certresolver=letsencrypt
        - traefik.http.routers.immich-kiosk.entrypoints=websecure
        - traefik.http.services.immich-kiosk.loadbalancer.server.port=3000
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.immich-kiosk.middlewares=immich-kiosk-auth
        - traefik.http.middlewares.immich-kiosk-auth.basicauth.users=${IMMICH_KIOSK_BASICAUTH}
      resources:
        limits:
          cpus: 1
          memory: 256M

volumes:
  model-cache:

secrets:
  immich_db_password:
    external: true

networks:
  postgresql_db-backend:
    external: true
  traefik_backend:
    external: true