docker-compose.yml

# All container config lives here. manage.sh is just a wrapper around docker compose.
# Override defaults via .env or environment variables.
# CRITICAL: All data mounts use bind mounts (~/path), NOT named volumes.
# This ensures the DB and theme are visible on the host filesystem for backup.

services:
  prod:
    build:
      context: .
      args:
        APP_VERSION: ${APP_VERSION:-unknown}
        GIT_COMMIT: ${GIT_COMMIT:-unknown}
        BUILD_TIME: ${BUILD_TIME:-unknown}
    image: corescope:latest
    container_name: corescope-prod
    restart: unless-stopped
    stop_grace_period: 30s
    stop_signal: SIGTERM
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "${PROD_HTTP_PORT:-80}:80"
      - "${PROD_HTTPS_PORT:-443}:443"
      # The bundled broker is plaintext MQTT. PROD_MQTT_BIND is the host
      # interface its port is published on. Leave it EMPTY (the shipped
      # default) and the mapping renders with no host interface at all —
      # byte for byte the mapping this file always had, published on both
      # IPv4 (0.0.0.0) and IPv6 ([::]). Setting it to 0.0.0.0 would NOT be
      # the same thing: an explicit IPv4 host publishes IPv4 only.
      # Set PROD_MQTT_BIND=127.0.0.1 to keep the broker reachable only from
      # the host. The bundled broker is opt-in (#441): unless
      # DISABLE_MOSQUITTO=false, nothing listens behind this mapping. See
      # docs/deployment.md, "Migration — pulling the new Compose file".
      - "${PROD_MQTT_BIND:+${PROD_MQTT_BIND}:}${PROD_MQTT_PORT:-1883}:1883"
    volumes:
      - ./caddy-config/Caddyfile:/etc/caddy/Caddyfile:ro
      - ${PROD_DATA_DIR:-~/meshcore-data}:/app/data
      - caddy-data:/data/caddy
    environment:
      - NODE_ENV=production
      # The bundled mosquitto is opt-in (#441): set DISABLE_MOSQUITTO=false
      # to run it, otherwise point mqttSources in config.json (or
      # MQTT_BROKER) at your own broker.
      - DISABLE_MOSQUITTO=${DISABLE_MOSQUITTO:-true}
      - DISABLE_CADDY=${DISABLE_CADDY:-false}
      # In-process settings — read by the server and the ingestor, not by
      # docker compose. Without these lines a value in .env reaches docker
      # compose and stops there, so the documented "one line in .env" would
      # change nothing in the container (#372). Every one defaults to EMPTY,
      # which every reader ignores: pprofbind skips a blank host or port,
      # LoadConfig skips a blank MQTT_BROKER, and MQTT_SOURCE_STRICT is
      # false unless truthy. An install that never set them is unaffected.
      - MQTT_BROKER=${MQTT_BROKER:-}
      - MQTT_TOPIC=${MQTT_TOPIC:-}
      - MQTT_SOURCE_STRICT=${MQTT_SOURCE_STRICT:-}
      - ENABLE_PPROF=${ENABLE_PPROF:-}
      - PPROF_HOST=${PPROF_HOST:-}
      - PPROF_HOST_SERVER=${PPROF_HOST_SERVER:-}
      - PPROF_HOST_INGESTOR=${PPROF_HOST_INGESTOR:-}
      - PPROF_PORT=${PPROF_PORT:-}
      - PPROF_PORT_SERVER=${PPROF_PORT_SERVER:-}
      - PPROF_PORT_INGESTOR=${PPROF_PORT_INGESTOR:-}
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
      interval: 30s
      timeout: 5s
      retries: 3

volumes:
  # Named volumes for Caddy TLS certificates (not user data — managed by Caddy internally)
  caddy-data: