version: "3"
services:
  vpn:
    image: thrnz/docker-wireguard-pia
    restart: always 
    container_name: vpn
    volumes:
      # Auth token is stored here
      - './pia/data:/pia'
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    ports:
      - '127.0.0.1:8030:3000/tcp' 
    environment:
      - LOC=nl_amsterdam
      - USER=CENSORED
      - PASS=CENSORED
      - KEEPALIVE=25
      - VPNDNS=1.1.1.1
      - FIREWALL=1
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.default.disable_ipv6=1
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv6.conf.lo.disable_ipv6=1
    healthcheck:
      test: ping -c 1 1.1.1.1 || exit 1
      interval: 30s
      timeout: 10s

  invidious:
    image: quay.io/invidious/invidious:latest
    container_name: invidious
    restart: always
    network_mode: "service:vpn"
    environment:
      INVIDIOUS_CONFIG: |
        db:
          dbname: invidious
          user: kemal
          password: kemal
          host: localhost
          port: 5432
        check_tables: true
        external_port: 443
        domain: invidious.protokolla.fi
        https_only: true 
        statistics_enabled: true 
        disable_proxy: false # do not allow DASH => save bandwidth a lot
        hmac_key: CENSORED
        banner: "<p>Sorry for the downtime. Videos didn't load for a day because our IP was banned. Everything is working fine now.</p>"
    healthcheck:
      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/api/v1/comments/jNQXAC9IVRw || exit 1
      interval: 30s
      timeout: 5s
      retries: 2
    logging:
      options:
        max-size: "1G"
        max-file: "4"
    depends_on:
      - invidious-db

  invidious-db:
    image: docker.io/library/postgres:14
    restart: unless-stopped
    network_mode: "service:vpn"
    container_name: invidious_db
    volumes:
      - ./data/postgresql:/var/lib/postgresql/data
      - ./config/sql:/config/sql
      - ./docker/init-invidious-db.sh:/docker-entrypoint-initdb.d/init-invidious-db.sh
    environment:
      POSTGRES_DB: invidious
      POSTGRES_USER: kemal
      POSTGRES_PASSWORD: kemal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]