docker-compose.yml

version: "3.9"

# ── Nexus Hosting — self-hosted stack ──────────────────────────────────────
#
# Usage:
#   cp .env.example .env          # fill in secrets
#   docker compose up -d          # start everything
#   docker compose logs -f app    # follow app logs
#
# The app will be available at http://localhost:8080

services:

  # ── Redis (shared rate-limit + session store) ─────────────────────────────
  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --maxmemory 256mb --maxmemory-policy allkeys-lru --save ""
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
    networks:
      - nexus

  # ── PostgreSQL ─────────────────────────────────────────────────────────────
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB:       ${POSTGRES_DB:-nexus}
      POSTGRES_USER:     ${POSTGRES_USER:-nexus}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
    volumes:
      - db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-nexus} -d ${POSTGRES_DB:-nexus}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - nexus

  # ── MinIO (S3-compatible object storage) ───────────────────────────────────
  # Remove this block and point OBJECT_STORAGE_* at an external provider if you
  # already have S3 / Cloudflare R2 / Backblaze B2 available.
  minio:
    image: minio/minio:latest
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER:     ${MINIO_ROOT_USER:-nexus}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
    volumes:
      - minio_data:/data
    ports:
      - "9000:9000"   # S3 API
      - "9001:9001"   # MinIO console
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - nexus

  # ── DB migration job (runs once, then exits) ───────────────────────────────
  migrate:
    build:
      context: .
      target: deps          # only needs deps stage — no full build required
    command: >
      sh -c "pnpm --filter @workspace/db run push"
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER:-nexus}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-nexus}
    depends_on:
      db:
        condition: service_healthy
    networks:
      - nexus
    restart: "no"

  # ── API + frontend server ──────────────────────────────────────────────────
  app:
    build:
      context: .
      target: runner
    restart: unless-stopped
    ports:
      - "${PORT:-8080}:8080"
    environment:
      NODE_ENV: production
      PORT: 8080

      # ── Database ───────────────────────────────────────────────────────────
      DATABASE_URL: postgresql://${POSTGRES_USER:-nexus}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-nexus}

      # ── Object storage (MinIO — swap for S3/R2 as needed) ─────────────────
      # When using MinIO locally, set these.  For external providers see docs.
      OBJECT_STORAGE_ENDPOINT:    http://minio:9000
      OBJECT_STORAGE_ACCESS_KEY:  ${MINIO_ROOT_USER:-nexus}
      OBJECT_STORAGE_SECRET_KEY:  ${MINIO_ROOT_PASSWORD}
      OBJECT_STORAGE_BUCKET:      ${OBJECT_STORAGE_BUCKET:-nexus-sites}
      DEFAULT_OBJECT_STORAGE_BUCKET_ID: ${OBJECT_STORAGE_BUCKET:-nexus-sites}
      PRIVATE_OBJECT_DIR:         private
      PUBLIC_OBJECT_SEARCH_PATHS: public

      # ── Auth ──────────────────────────────────────────────────────────────
      # ISSUER_URL: Your OIDC provider issuer URL (Authentik, Keycloak, Auth0, Dex, etc.)
      ISSUER_URL:  ${ISSUER_URL}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}

      # ── Node identity ─────────────────────────────────────────────────────
      NODE_NAME:            ${NODE_NAME:-My NexusHosting Node}
      NODE_REGION:          ${NODE_REGION:-self-hosted}
      OPERATOR_NAME:        ${OPERATOR_NAME:-Node Operator}
      OPERATOR_EMAIL:       ${OPERATOR_EMAIL:-admin@example.com}
      STORAGE_CAPACITY_GB:  ${STORAGE_CAPACITY_GB:-100}
      BANDWIDTH_CAPACITY_GB: ${BANDWIDTH_CAPACITY_GB:-1000}

      # Public domain/hostname where this node is reachable from other nodes.
      PUBLIC_DOMAIN: ${PUBLIC_DOMAIN}

      ALLOWED_ORIGINS: ${ALLOWED_ORIGINS:-}

      # ── Redis (shared rate limiting + cache) ─────────────────────────────
      REDIS_URL: redis://redis:6379

      # ── Low-resource mode (uncomment for Raspberry Pi / small VMs) ───────
      # LOW_RESOURCE: "true"

      # ── Security ──────────────────────────────────────────────────────────
      COOKIE_SECRET:  ${COOKIE_SECRET}         # Required — random 32+ char string
      METRICS_TOKEN:  ${METRICS_TOKEN:-}       # Optional — bearer token for /metrics

      # ── Email notifications (SMTP) ────────────────────────────────────────
      SMTP_HOST:       ${SMTP_HOST:-}
      SMTP_PORT:       ${SMTP_PORT:-587}
      SMTP_SECURE:     ${SMTP_SECURE:-false}
      SMTP_USER:       ${SMTP_USER:-}
      SMTP_PASS:       ${SMTP_PASS:-}
      EMAIL_FROM:      ${EMAIL_FROM:-noreply@example.com}
      EMAIL_FROM_NAME: ${EMAIL_FROM_NAME:-NexusHosting}

      # ── TLS / ACME ────────────────────────────────────────────────────────
      ACME_ENABLED:     ${ACME_ENABLED:-false}
      ACME_EMAIL:       ${ACME_EMAIL:-}
      ACME_STAGING:     ${ACME_STAGING:-false}
      ACME_CERT_DIR:    ${ACME_CERT_DIR:-/etc/certs}
      ACME_CHALLENGE_TYPE: ${ACME_CHALLENGE_TYPE:-http}

      # ── Site health monitoring ────────────────────────────────────────────
      ENABLE_SITE_HEALTH_CHECKS:      ${ENABLE_SITE_HEALTH_CHECKS:-false}
      SITE_HEALTH_CHECK_INTERVAL_MS:  ${SITE_HEALTH_CHECK_INTERVAL_MS:-600000}

      # ── Data retention ────────────────────────────────────────────────────
      ANALYTICS_RETENTION_DAYS:  ${ANALYTICS_RETENTION_DAYS:-90}
      FORM_RETENTION_DAYS:       ${FORM_RETENTION_DAYS:-365}
      AUDIT_LOG_RETENTION_DAYS:  ${AUDIT_LOG_RETENTION_DAYS:-365}

    depends_on:
      db:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
      minio:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/api/health/live || exit 1"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3
    networks:
      - nexus

  # ── Rust static site proxy ──────────────────────────────────────────────────
  # Handles all site-serving traffic (Host-header routing → S3 streaming).
  # Requires a pre-built binary at ./crates/nexus-proxy/target/release/nexus-proxy
  # Build with: cd crates/nexus-proxy && cargo build --release
  #
  # To run WITHOUT the Rust proxy (TypeScript-only), comment this service out
  # and update the Caddyfile to route all traffic to app:8080.
  proxy:
    build:
      context: crates/nexus-proxy
      dockerfile: Dockerfile
    restart: unless-stopped
    ports:
      - "8090:8090"       # Site-serving port (Caddy routes site traffic here)
      - "9091:9091"       # Prometheus metrics
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER:-nexus}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-nexus}

      OBJECT_STORAGE_ENDPOINT:   http://minio:9000
      OBJECT_STORAGE_ACCESS_KEY: ${MINIO_ROOT_USER:-nexus}
      OBJECT_STORAGE_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      OBJECT_STORAGE_BUCKET:     ${OBJECT_STORAGE_BUCKET:-nexus-sites}
      OBJECT_STORAGE_REGION:     auto

      REDIS_URL:     redis://redis:6379
      COOKIE_SECRET: ${COOKIE_SECRET}

      PROXY_LISTEN_ADDR:   0.0.0.0:8090
      METRICS_LISTEN_ADDR: 0.0.0.0:9091
      PROXY_API_URL:       http://app:8080

      NODE_REGION:          ${NODE_REGION:-self-hosted}
      ENABLE_GEO_ROUTING:   ${ENABLE_GEO_ROUTING:-false}

      # LOW_RESOURCE: "true"   # Uncomment for Raspberry Pi / small VMs

    depends_on:
      app:
        condition: service_healthy
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8090/api/health/live 2>/dev/null || wget -qO- http://localhost:9091/metrics > /dev/null 2>&1 || exit 1"]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3
    networks:
      - nexus

volumes:
  db_data:
  minio_data:
  redis_data:

networks:
  nexushosting:
    driver: bridge