compose.yml

services:
  db:
    # Pinned to 16 because bumping it FATALs on an existing volume
    # ("database files are incompatible with server"). Upgrading needs a dump and reload.
    image: postgres:${POSTGRES_IMAGE_TAG:-16-alpine}
    container_name: voltius-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-voltius}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-voltius}
      POSTGRES_DB: ${POSTGRES_DB:-voltius}
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-voltius} -d ${POSTGRES_DB:-voltius}"]
      interval: 2s
      timeout: 5s
      retries: 10

  server:
    image: ghcr.io/voltiusapp/voltius-server:latest
    container_name: voltius-server
    restart: unless-stopped
    ports:
      - "${HOST_PORT:-14372}:8080"
    environment:
      DATABASE_URL: ${DATABASE_URL:-postgres://${POSTGRES_USER:-voltius}:${POSTGRES_PASSWORD:-voltius}@db/${POSTGRES_DB:-voltius}}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required — generate one with `openssl rand -hex 32`}
      PORT: "8080"
      RUST_LOG: ${RUST_LOG:-info}
      # Optional knobs — see .env.example
      RESEND_API_KEY: ${RESEND_API_KEY:-}
      RESEND_WEBHOOK_SECRET: ${RESEND_WEBHOOK_SECRET:-}
      # The server treats an empty string as a value, so these carry its defaults.
      RESEND_FROM: ${RESEND_FROM:-Voltius <noreply@voltius.app>}
      RESEND_LOGO_URL: ${RESEND_LOGO_URL:-https://voltius.app/logo.png}
      VOLTIUS_APP_URL: ${VOLTIUS_APP_URL:-https://app.voltius.app}
      VOLTIUS_MARKETING_URL: ${VOLTIUS_MARKETING_URL:-https://voltius.app}
      CORS_ORIGINS: ${CORS_ORIGINS:-}
      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-}
      TRUSTED_PROXY_IP: ${TRUSTED_PROXY_IP:-}
      TOTP_ENC_KEY: ${TOTP_ENC_KEY:-}
      WEBAUTHN_RP_ID: ${WEBAUTHN_RP_ID:-}
      AUTH_RATE_LIMIT: ${AUTH_RATE_LIMIT:-}
      SYNC_RATE_LIMIT: ${SYNC_RATE_LIMIT:-}
      REGISTRATION_ENABLED: ${REGISTRATION_ENABLED:-}
      TEAM_INVITES_ENABLED: ${TEAM_INVITES_ENABLED:-}
      REGISTER_RATE_LIMIT: ${REGISTER_RATE_LIMIT:-}
      INVITE_RATE_LIMIT: ${INVITE_RATE_LIMIT:-}
      WAITLIST_RATE_LIMIT: ${WAITLIST_RATE_LIMIT:-}
      USER_SEARCH_RATE_LIMIT: ${USER_SEARCH_RATE_LIMIT:-}
      STRANGER_KNOCK_RATE_LIMIT: ${STRANGER_KNOCK_RATE_LIMIT:-}
      SYNC_BLOB_RETENTION_DAYS: ${SYNC_BLOB_RETENTION_DAYS:-}
      USER_PURGE_GRACE_DAYS: ${USER_PURGE_GRACE_DAYS:-}
      TEAM_OBJECTS_MIN_CLIENT_VERSION: ${TEAM_OBJECTS_MIN_CLIENT_VERSION:-}
      # Only needed if you also run the admin dashboard.
      ADMIN_SECRET: ${ADMIN_SECRET:-}
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/health || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    depends_on:
      db:
        condition: service_healthy

volumes:
  pgdata: