community/docker-compose.quickstart.yaml at main · meith-dev/community · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
# meith-board, deployed by Coolify — quick-start shape.
#
# Coolify builds the image from this repository (Dockerfile.quickstart) rather
# than pulling a prebuilt one, so there is no MEITH_IMAGE to set and no build
# workflow or registry involved: push, point Coolify at this file, set the
# domain, deploy. The trade is a heavier build on the deploy server. For a
# low-spec server or faster deploys, use `docker-compose.yaml` instead — the
# prebuilt path this board runs by default, where the image is built in CI and
# only pulled here. See README.md.
#
# The two secrets and the database password are Coolify's own "magic
# variables": it fills them in on the first deploy and shows them in the panel.
# Requires Coolify v4.0.0-beta.411 or newer.
services:
  postgres:
    image: postgres:18-alpine@sha256:d3e1620b530c944afa6e887d22eb899824da68e19c52024bf98f5220c88a65b2
    restart: unless-stopped
    mem_limit: ${POSTGRES_MEM_LIMIT:-1g}
    cpus: ${POSTGRES_CPUS:-1}
    environment:
      POSTGRES_USER: community
      POSTGRES_PASSWORD: $SERVICE_PASSWORD_POSTGRES
      POSTGRES_DB: community
    volumes:
      - pgdata:/var/lib/postgresql
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U community -d community']
      interval: 10s
      timeout: 5s
      retries: 5

  # Runs to completion, then exits. web waits for it, so the schema is
  # always applied before the first request rather than racing it. Shares the
  # image web builds below — same context and tag, so it is built once.
  migrate:
    build:
      context: .
      dockerfile: Dockerfile.quickstart
    image: meith-board
    environment:
      COMMUNITY_ROLE: migrate
      DATABASE_URL: postgres://community:$SERVICE_PASSWORD_POSTGRES@postgres:5432/community
      AUTH_SECRET: $SERVICE_BASE64_64_AUTH
      TICK_SECRET: $SERVICE_BASE64_64_TICK
    depends_on:
      postgres:
        condition: service_healthy
    restart: 'no'

  web:
    build:
      context: .
      dockerfile: Dockerfile.quickstart
    image: meith-board
    restart: unless-stopped
    mem_limit: ${WEB_MEM_LIMIT:-1g}
    cpus: ${WEB_CPUS:-2}
    # A readiness probe Coolify gates a rolling deploy on: with "Rolling
    # update" enabled on the resource, the new container must answer
    # /api/ready before the old one is retired, so a redeploy swaps in with no
    # gap. Without it Coolify recreates the stack — old removed, then new
    # started — and the board is down while the new web boots.
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3
    environment:
      - SERVICE_FQDN_WEB_3000
      - APP_URL=$SERVICE_URL_WEB
      - DATABASE_URL=postgres://community:$SERVICE_PASSWORD_POSTGRES@postgres:5432/community
      - AUTH_SECRET=$SERVICE_BASE64_64_AUTH
      - TICK_SECRET=$SERVICE_BASE64_64_TICK
      - QUEUE_DRIVER=postgres
      - CACHE_DRIVER=next
      - FILESTORE_DRIVER=local
      # Left unset, mail is configured on the board itself — the installer
      # asks on first run. Set MAIL_DRIVER here and this file wins instead.
      - MAIL_DRIVER=${MAIL_DRIVER:-log}
      - MAIL_SMTP_HOST=${MAIL_SMTP_HOST:-}
      - MAIL_SMTP_PORT=${MAIL_SMTP_PORT:-}
      - MAIL_SMTP_SECURITY=${MAIL_SMTP_SECURITY:-}
      - MAIL_SMTP_USERNAME=${MAIL_SMTP_USERNAME:-}
      - MAIL_SMTP_PASSWORD=${MAIL_SMTP_PASSWORD:-}
      - MAIL_FROM=${MAIL_FROM:-}
    volumes:
      - uploads:/app/.uploads
    depends_on:
      postgres:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully

  # @meith/worker is not published, so there is no compiled worker binary a
  # scaffolded board can run — this drives the tick the alternative way: a
  # small loop calling /api/system/tick.
  worker:
    image: alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
    restart: unless-stopped
    mem_limit: ${WORKER_MEM_LIMIT:-64m}
    cpus: ${WORKER_CPUS:-0.25}
    environment:
      TICK_SECRET: $SERVICE_BASE64_64_TICK
    command:
      - sh
      - -c
      - |
        apk add --no-cache curl >/dev/null
        while true; do
          curl -fsS -m 55 -H "Authorization: Bearer $$TICK_SECRET" \
            http://web:3000/api/system/tick >/dev/null 2>&1 \
            || echo "tick failed at $$(date -Is)"
          sleep 60
        done
    depends_on:
      - web

volumes:
  pgdata:
  uploads: