compose.yaml

name: splidly

x-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

services:
  server:
    build:
      context: .
      dockerfile: apps/server/Dockerfile
    restart: unless-stopped
    stop_grace_period: 30s
    init: true
    pids_limit: 200
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=32m
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    logging: *default-logging
    ports:
      - "127.0.0.1:${API_BIND_PORT:-4000}:4000"
    environment:
      NODE_ENV: ${NODE_ENV:-production}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      PORT: "4000"
      DATABASE_URL: postgresql://${POSTGRES_RUNTIME_USER:-splidly_app}:${POSTGRES_RUNTIME_PASSWORD:?Set POSTGRES_RUNTIME_PASSWORD}@postgres:5432/${POSTGRES_DB:-splidly}
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:?Set BETTER_AUTH_SECRET}
      API_PUBLIC_URL: https://${APP_DOMAIN}
      APP_PUBLIC_URL: https://${APP_DOMAIN}
      APP_SCHEME: splidly
      APPLE_SIGN_IN_CLIENT_ID: ${APPLE_SIGN_IN_CLIENT_ID:?Set APPLE_SIGN_IN_CLIENT_ID}
      APPLE_SIGN_IN_KEY_ID: ${APPLE_SIGN_IN_KEY_ID:?Set APPLE_SIGN_IN_KEY_ID}
      APPLE_SIGN_IN_PRIVATE_KEY_PATH: /run/secrets/apple_sign_in_key
      APNS_ENVIRONMENT: ${APNS_ENVIRONMENT:?Set APNS_ENVIRONMENT}
      APNS_KEY_ID: ${APNS_KEY_ID:?Set APNS_KEY_ID}
      APNS_PRIVATE_KEY_PATH: /run/secrets/apns_key
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      FRANKFURTER_URL: http://frankfurter:8080
      IOS_APP_ID: ${IOS_APP_ID:?Set IOS_APP_ID}
      IOS_TEAM_ID: ${IOS_TEAM_ID:?Set IOS_TEAM_ID}
      ANDROID_ENABLED: ${ANDROID_ENABLED:-false}
      ANDROID_PACKAGE: ${ANDROID_PACKAGE:-}
      ANDROID_SHA256_FINGERPRINT: ${ANDROID_SHA256_FINGERPRINT:-}
      IOS_STORE_URL: ${IOS_STORE_URL:?Set IOS_STORE_URL}
      ANDROID_STORE_URL: ${ANDROID_STORE_URL:-}
      LEGAL_NAME: ${LEGAL_NAME:?Set LEGAL_NAME}
      LEGAL_STREET_ADDRESS: ${LEGAL_STREET_ADDRESS:?Set LEGAL_STREET_ADDRESS}
      LEGAL_POSTAL_CODE: ${LEGAL_POSTAL_CODE:?Set LEGAL_POSTAL_CODE}
      LEGAL_LOCALITY: ${LEGAL_LOCALITY:?Set LEGAL_LOCALITY}
      LEGAL_COUNTRY: ${LEGAL_COUNTRY:?Set LEGAL_COUNTRY}
      LEGAL_EMAIL: ${LEGAL_EMAIL:?Set LEGAL_EMAIL}
      LEGAL_PHONE: ${LEGAL_PHONE:-}
      PRIVACY_EMAIL: ${PRIVACY_EMAIL:?Set PRIVACY_EMAIL}
      ABUSE_EMAIL: ${ABUSE_EMAIL:?Set ABUSE_EMAIL}
      BACKUPS_ENABLED: ${BACKUPS_ENABLED:-false}
      EDGE_LOG_RETENTION_DAYS: ${EDGE_LOG_RETENTION_DAYS:?Set EDGE_LOG_RETENTION_DAYS}
      LEGAL_REPRESENTATIVE: ${LEGAL_REPRESENTATIVE:-}
      LEGAL_REGISTRY_NAME: ${LEGAL_REGISTRY_NAME:-}
      LEGAL_REGISTRY_NUMBER: ${LEGAL_REGISTRY_NUMBER:-}
      LEGAL_VAT_ID: ${LEGAL_VAT_ID:-}
    depends_on:
      migrate:
        condition: service_completed_successfully
      frankfurter:
        condition: service_started
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4000/health/ready"]
      interval: 10s
      timeout: 5s
      retries: 10
    secrets:
      - apple_sign_in_key
      - apns_key
    networks: [backend, egress]

  migrate:
    build:
      context: .
      dockerfile: apps/server/Dockerfile
      target: migration
    command:
      - sh
      - -c
      - >-
        ./packages/db/node_modules/.bin/tsx packages/db/src/migrate.ts &&
        ./apps/server/node_modules/.bin/tsx apps/server/src/encrypt-oauth-tokens.ts &&
        ./apps/server/node_modules/.bin/tsx apps/server/src/configure-runtime-database.ts
    restart: "no"
    pids_limit: 100
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=32m
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    logging: *default-logging
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER:-splidly}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-splidly}
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:?Set BETTER_AUTH_SECRET}
      POSTGRES_RUNTIME_USER: ${POSTGRES_RUNTIME_USER:-splidly_app}
      POSTGRES_RUNTIME_PASSWORD: ${POSTGRES_RUNTIME_PASSWORD:?Set POSTGRES_RUNTIME_PASSWORD}
    depends_on:
      postgres:
        condition: service_healthy
    networks: [backend]

  postgres:
    image: postgres:17.10-alpine3.24
    restart: unless-stopped
    stop_grace_period: 60s
    pids_limit: 200
    security_opt:
      - no-new-privileges:true
    logging: *default-logging
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-splidly}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-splidly}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "pg_isready -U ${POSTGRES_USER:-splidly} -d ${POSTGRES_DB:-splidly}",
        ]
      interval: 5s
      timeout: 5s
      retries: 20
    networks: [backend]

  frankfurter:
    image: lineofflight/frankfurter:2.3.5
    restart: unless-stopped
    init: true
    read_only: true
    pids_limit: 100
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=16m
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    logging: *default-logging
    environment:
      DATABASE_URL: sqlite:///data/db.sqlite3
    volumes:
      - frankfurter_data:/data
    depends_on:
      frankfurter-data-init:
        condition: service_completed_successfully
    networks: [backend, egress]

  frankfurter-data-init:
    image: lineofflight/frankfurter:2.3.5
    user: root
    command: ["sh", "-c", "chown -R frankfurter:frankfurter /data"]
    restart: "no"
    logging: *default-logging
    volumes:
      - frankfurter_data:/data

networks:
  egress:
  backend:
    internal: true

volumes:
  postgres_data:
  frankfurter_data:

secrets:
  apple_sign_in_key:
    file: ${APPLE_SIGN_IN_PRIVATE_KEY_FILE:?Set APPLE_SIGN_IN_PRIVATE_KEY_FILE}
  apns_key:
    file: ${APNS_PRIVATE_KEY_FILE:?Set APNS_PRIVATE_KEY_FILE}