docker-compose.yml

## HEADS UP!
# You should read this compose file IN FULL before deploying!
# Not setting environment variables properly could cause performance/stability issues or severe security vulnerabilities!
# Read https://discordtickets.app/self-hosting/configuration so that you know what everything means! It's worth it!
#
# This stack now REQUIRES a Temporal cluster (all async/scheduled work runs on it).
# For local/dev the Temporal frontend is reached insecurely (TEMPORAL_TLS_ENABLED=false).
# For production, terminate the frontend with mTLS and set the TEMPORAL_TLS_* paths
# (mount your certs) + TEMPORAL_ADDRESS/PORT to your secured Temporal frontend.

services:
  mysql:
    image: mysql:8
    restart: unless-stopped
    hostname: mysql
    networks:
      - discord-tickets
    volumes:
      - tickets-mysql:/var/lib/mysql
    environment:
      MYSQL_DATABASE: tickets
      MYSQL_PASSWORD: insecure # change this to a secure password
      MYSQL_ROOT_PASSWORD: insecure # change this to a (different) secure password
      MYSQL_USER: tickets
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "127.0.0.1", "--silent"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 60s # allow time for first-run init / version upgrades

  # --- Temporal cluster (self-hosted) -------------------------------------
  temporal-postgresql:
    image: postgres:16
    restart: unless-stopped
    hostname: temporal-postgresql
    networks:
      - discord-tickets
    volumes:
      - temporal-postgresql:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: temporal
      POSTGRES_PASSWORD: temporal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U temporal"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 20s

  temporal:
    image: temporalio/auto-setup:1.25.2
    restart: unless-stopped
    hostname: temporal
    depends_on:
      temporal-postgresql:
        condition: service_healthy
    networks:
      - discord-tickets
    ports:
      - 7233:7233 # frontend gRPC (secure this / put mTLS in front for production)
    environment:
      DB: postgres12
      DB_PORT: 5432
      POSTGRES_USER: temporal
      POSTGRES_PWD: temporal
      POSTGRES_SEEDS: temporal-postgresql
    # auto-setup provisions the schema and default namespace on first run, which
    # takes 20-60s. Without this the bot only waited for the container to
    # *start*, so it reliably raced Temporal on a cold boot.
    healthcheck:
      test: ["CMD", "temporal", "operator", "namespace", "describe", "--address", "temporal:7233", "default"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s

  temporal-ui:
    image: temporalio/ui:2.31.2
    restart: unless-stopped
    depends_on:
      - temporal
    networks:
      - discord-tickets
    ports:
      - 8233:8080 # Temporal Web UI -> http://localhost:8233
    environment:
      TEMPORAL_ADDRESS: temporal:7233
      TEMPORAL_CORS_ORIGINS: http://localhost:8233

  bot:
    image: ghcr.io/gelhaus-solutions/discordtickets-revamped:latest # Or use :main for development builds
    depends_on:
      mysql:
        condition: service_healthy
      temporal:
        condition: service_healthy
    restart: unless-stopped
    hostname: bot
    # An init process to reap the Prisma query engine's children, and enough
    # grace for the shutdown sequence in src/index.js (20s) to drain the
    # Temporal worker before Docker sends SIGKILL. The default 10s cut it short.
    init: true
    stop_grace_period: 45s
    networks:
      - discord-tickets
    ports:
      - 8169:8169
    volumes:
      # The whole data directory, not just user/: .env, user/ and logs/ live
      # side by side (DT_DATA_DIR=/home/container in the image) and are all
      # state worth keeping across a recreate.
      - tickets-bot:/home/container
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
      # For production mTLS, mount your Temporal client certs read-only, e.g.:
      # - ./certs:/home/container/certs:ro
    tty: true
    stdin_open: true
    # Please refer to the documentation:
    # https://discordtickets.app/self-hosting/configuration/#environment-variables
    environment:
      DB_CONNECTION_URL: mysql://tickets:insecure@mysql/tickets # change `insecure` to the MYSQL_PASSWORD you set above
      DISABLE_ENCRYPTION: "false"
      DISCORD_SECRET: # required
      DISCORD_TOKEN: # required
      ENCRYPTION_KEY: # required
      DB_PROVIDER: mysql
      HTTP_EXTERNAL: http://127.0.0.1:8169 # change this to your server's external IP (or domain)
      HTTP_HOST: 0.0.0.0
      # Optional: an address the container can reach itself on without going
      # back out through your reverse proxy (e.g. http://127.0.0.1:8169). Only
      # needed if you want the dashboard's server-side API calls to use a
      # specific address; they fall back to HTTP_HOST:HTTP_PORT on loopback.
      HTTP_INTERNAL:
      HTTP_PORT: 8169
      HTTP_TRUST_PROXY: "false" # set to true if you're using a reverse proxy
      INVALIDATE_TOKENS:
      OVERRIDE_ARCHIVE: null
      PUBLIC_BOT: "false"
      PUBLISH_COMMANDS: "false"
      # Comma-separated Discord user IDs with operator rights: bot settings for
      # every guild, any transcript, and service API keys. Set it to YOUR id —
      # it used to default to someone else's.
      SUPER:
      # IMPORTANT: You should read https://discordtickets.app/self-hosting/configuration/#super before continuing!
      CPU_LIMIT: # optional: cap the worker thread pool (defaults to the number of available cores)
      # Secret used to sign dashboard JWTs. If left empty it is derived from
      # ENCRYPTION_KEY via HKDF and the bot logs a warning on every start;
      # set it to an independent random value (`npm run keygen`) instead.
      JWT_SECRET:
      # Houston-compatible endpoint for anonymous usage stats. Leave empty to
      # report nothing (this fork does not post to upstream's stats server).
      STATS_URL:
      # --- Sentry (optional) ---
      # Nothing is sent anywhere unless SENTRY_DSN is set. Every rate below
      # tolerates an empty value and falls back to its default.
      SENTRY_DSN: # leave empty to disable error reporting entirely
      SENTRY_ENVIRONMENT: # defaults to NODE_ENV
      SENTRY_RELEASE: # defaults to discord-tickets@<version>+<build id>
      SENTRY_SAMPLE_RATE: "0.1"
      SENTRY_PROFILING_RATE: "1.0"
      SENTRY_LOGGING: "false"
      SENTRY_LOG_LEVEL: info
      SENTRY_METRICS: "true"
      # Discord user IDs and IPs belong to your members, not to you.
      SENTRY_SEND_PII: "false"
      # Dashboard (browser). Served to every visitor, so it is a separate DSN.
      # Replay masks all text and blocks all media, but still records staff
      # activity on pages that show ticket transcripts — enable deliberately.
      PUBLIC_SENTRY_DSN:
      PUBLIC_SENTRY_TRACES_RATE: "0"
      PUBLIC_SENTRY_REPLAY_SESSION_RATE: "0"
      PUBLIC_SENTRY_REPLAY_ERROR_RATE: "0"
      # --- Transcript storage (optional) ---
      # Transcripts are written to /home/container/user/transcripts, which is
      # inside the tickets-bot volume above, and the database holds only a
      # reference. They are therefore NOT in a database dump — back the volume
      # up as well.
      #
      # Set STORAGE_DRIVER=s3 (and uncomment the minio service at the bottom of
      # this file, or point these at a real bucket) only if you need it.
      STORAGE_DRIVER: local
      S3_BUCKET:
      S3_ENDPOINT: # e.g. http://minio:9000
      S3_REGION: us-east-1
      S3_PREFIX:
      S3_FORCE_PATH_STYLE: "true" # required by MinIO and most self-hosted gateways
      # Leave both empty to use the AWS SDK credential chain (instance roles).
      S3_ACCESS_KEY_ID:
      S3_SECRET_ACCESS_KEY:
      # --- Temporal ---
      TEMPORAL_ADDRESS: temporal # host/IP of the Temporal frontend
      TEMPORAL_PORT: 7233
      TEMPORAL_NAMESPACE: default
      TEMPORAL_TASK_QUEUE: discord-tickets
      TEMPORAL_DEPLOYMENT_NAME: discord-tickets
      TEMPORAL_TLS_ENABLED: "false" # set true + the paths below for production mTLS
      # TEMPORAL_TLS_CERT_PATH: /home/container/certs/client.pem
      # TEMPORAL_TLS_KEY_PATH: /home/container/certs/client.key
      # TEMPORAL_TLS_CA_PATH: /home/container/certs/ca.pem
      # TEMPORAL_TLS_SERVER_NAME: temporal.your-domain.example

  # --- Object storage (optional) ------------------------------------------
  # Only needed if you set STORAGE_DRIVER=s3 above. Uncomment this service and
  # the tickets-minio volume, then set on the bot:
  #   S3_ENDPOINT: http://minio:9000
  #   S3_BUCKET: discord-tickets
  #   S3_ACCESS_KEY_ID / S3_SECRET_ACCESS_KEY to match the credentials here
  # The bucket is not created for you: visit the console on :9001 and add it.
  #
  # minio:
  #   image: quay.io/minio/minio
  #   restart: unless-stopped
  #   hostname: minio
  #   command: server /data --console-address ":9001"
  #   networks:
  #     - discord-tickets
  #   ports:
  #     - 9001:9001 # web console; the bot reaches :9000 over the compose network
  #   environment:
  #     MINIO_ROOT_USER: minioadmin # change this
  #     MINIO_ROOT_PASSWORD: minioadmin # change this
  #   volumes:
  #     - tickets-minio:/data
  #   healthcheck:
  #     test: ["CMD", "mc", "ready", "local"]
  #     interval: 5s
  #     timeout: 5s
  #     retries: 20

networks:
  discord-tickets:

volumes:
  tickets-mysql:
  tickets-bot:
  # tickets-minio:
  temporal-postgresql: