volumes:
  db_storage:
  n8n_storage:
services:
  postgres:
    image: postgres:16
    restart: always
    environment:
      - POSTGRES_USER
      - POSTGRES_PASSWORD
      - POSTGRES_DB
      - POSTGRES_NON_ROOT_USER
      - POSTGRES_NON_ROOT_PASSWORD
    volumes:
      - db_storage:/var/lib/postgresql/data
      - ./init-data.sh:/docker-entrypoint-initdb.d/init-data.sh
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -h localhost -U ${POSTGRES_USER} -d ${POSTGRES_DB}']
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - internal
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
  n8n:
    image: docker.n8n.io/n8nio/n8n:${N8N_VERSION}
    restart: always
    environment:
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=${POSTGRES_DB}
      - DB_POSTGRESDB_USER=${POSTGRES_NON_ROOT_USER}
      - DB_POSTGRESDB_PASSWORD=${POSTGRES_NON_ROOT_PASSWORD}
      - N8N_HOST=${N8N_HOST}
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - N8N_TRUSTED_PROXIES=1
      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
      - N8N_COMMUNITY_PACKAGES_ALLOW_TOOL_USAGE=true
      - EXECUTIONS_DATA_MAX_AGE=72
      - NODE_ENV=production
      - WEBHOOK_URL=https://${N8N_HOST}
      - QUEUE_HEALTH_CHECK_ACTIVE=true
      - NODE_FUNCTION_ALLOW_BUILTIN=crypto
      - EXECUTIONS_DATA_PRUNE
    healthcheck:
      test: ["CMD", "wget", "--no-check-certificate", "--spider", "http://127.0.0.1:5678/healthz"]
      interval: 12s
      timeout: 10s
      retries: 3
      start_period: 15s
    volumes:
      - n8n_storage:/home/node/.n8n
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - internal
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.n8n.rule=Host(`n8n.hyperthrive.io`) && !PathPrefix(`/mcp`)"
      - "traefik.http.routers.n8n.entrypoints=websecure"
      - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"
      - "traefik.http.routers.n8n.service=n8n"
      - "traefik.http.routers.n8n-mcp.rule=Host(`n8n.hyperthrive.io`) && PathPrefix(`/mcp`)"
      - "traefik.http.routers.n8n-mcp.entrypoints=websecure"
      - "traefik.http.routers.n8n-mcp.tls.certresolver=letsencrypt"
      - "traefik.http.routers.n8n-mcp.service=n8n"
      - "traefik.http.routers.n8n-mcp.middlewares=no-buffer@docker"
      - "traefik.http.middlewares.no-buffer.headers.customResponseHeaders.X-Accel-Buffering=no"
      - "traefik.http.middlewares.no-buffer.headers.customResponseHeaders.Cache-Control=no-cache"
      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
      - "traefik.docker.network=traefik"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
networks:
  internal:
  traefik:
    external: true