docker-compose.yml

x-logging: &logging
  driver: json-file
  options: { max-size: "10m", max-file: "3" }

# Bigger for postfix and dovecot: their logs are the record of an abuse run, and what a host-side fail2ban reads.
# During the 2026-08-31 incident 3x10MB rotated away in about two hours and took the start of the run with it.
x-mail-logging: &mail-logging
  driver: json-file
  options: { max-size: "50m", max-file: "10" }

x-domains: &domains
  DOMAIN: ${DOMAIN}
  MAIL_DOMAIN: ${MAIL_DOMAIN:-${DOMAIN}}

services:
  caddy:
    profiles: ["edge"]
    image: &frontend-image ${EIGEN_FRONTEND_IMAGE:-ghcr.io/eigen-is/eigen/frontend:local}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./caddy-data:/data
      - ./data/certs:/shared-certs
    environment:
      <<: *domains
      CADDY_ACME_EMAIL: "email ${ACME_EMAIL:-admin@${MAIL_DOMAIN:-${DOMAIN}}}"
    command: sh -c "/usr/local/bin/export-certs.sh & caddy run --config /etc/caddy/Caddyfile --adapter caddyfile"
    restart: unless-stopped
    networks: [eigen]
    logging: *logging

  eigen-api:
    image: ${EIGEN_API_IMAGE:-ghcr.io/eigen-is/eigen/api:local}
    user: "1000:1000"
    # A real PID 1: forwards SIGTERM to bun and reaps its ffmpeg/weasyprint children.
    init: true
    # No host port binding — caddy / eigen-static / postfix / dovecot all reach the API via
    # the docker network as `eigen-api:8000`. A host port for debugging: docs/SELF-HOSTING.md.
    volumes:
      - ./data:/app/data
      # Backup artifacts live outside data/ so a wipe of the data directory cannot take them with
      # it. The API creates the folder only when the first backup runs; Docker creates the mount point itself.
      - ./backups:/app/backups
      # For the server backup. ./eigen gives the file group 1000 and mode 0640 before every start. A single-file
      # mount keeps the inode it started with. Configure replaces the file only when a value changes, and env_file
      # then changes this service's environment, so the next start recreates it on the new file.
      - ./.env.production:/app/install/.env.production:ro
    # Lets the API reach a relay on the host (SMTP_RELAY_HOST=host.docker.internal) when Eigen hosts no mail.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    env_file: .env.production
    environment:
      PRODUCTION: 1
      # Conventional production signal for third-party libs that gate on it (e.g. better-auth
      # rate limiting + secure cookies). Set at runtime only — never as a Dockerfile build ENV,
      # which would make `bun install` skip devDependencies. Dev overrides this back (dev compose).
      NODE_ENV: production
      EIGEN_DATA_ROOT: /app/data
      EIGEN_BACKUPS_DIR: /app/backups
      EIGEN_ENV_FILE: /app/install/.env.production
      # Demo-instance mode (hourly wipe + reseed via scripts/demo-reset.sh). Unset on real
      # instances → 0, so the demo entry route + auth guards stay inert.
      EIGEN_DEMO: ${EIGEN_DEMO:-0}
      # Off (0) on a deployment whose COMPOSE_PROFILES omits `mail`, so the apps hide every Mail entry point.
      MAIL_ENABLED: ${MAIL_ENABLED:-1}
      # Hosting mail, the API hands its mail to postfix, which relays through SMTP_RELAY_*. With MAIL_ENABLED=0
      # the API ignores these and sends through SMTP_RELAY_* (from env_file) itself.
      SMTP_HOST: postfix
      SMTP_PORT: 25
      # Loopback plus the docker bridge subnet (same EIGEN_SUBNET the network and postfix use), so
      # Postfix/Dovecot bridge callers are trusted without the whole 172.16/12 range. The API leaves out
      # the subnet's gateway, which a user on the host arrives from (lib/auth/trusted-networks.ts).
      TRUSTED_NETWORKS: "127.0.0.0/8,::1,${EIGEN_SUBNET}"
    restart: unless-stopped
    # On SIGTERM the API gives a running backup job 30 s (SHUTDOWN_JOB_BUDGET_MS, jobs.ts), then
    # drains pending S3 uploads for 20 s (SHUTDOWN_DRAIN_BUDGET_MS, server.ts): 50 s, and room for
    # closing the homes. An upload still in flight past this replays from pending_uploads on boot.
    stop_grace_period: 90s
    # Each open Home costs ~25-30 fds (~6 WAL SQLite DBs × 3 files each + ~10 maildir fs.watch
    # handles). Distro/Docker defaults (often 1024 soft) cap concurrent open homes at ~35, and
    # cross-home fan-outs (e.g. sharing to a large team) then fail with SQLITE_IOERR and
    # silently skip recipients. Pin the limit high — fds are cheap kernel objects.
    ulimits:
      nofile:
        soft: 1048576
        hard: 1048576
    networks: [eigen]
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8000/health"]
      interval: 30s
      timeout: 3s
      retries: 3
    logging: *logging

  eigen-static:
    profiles: ["static"]
    image: *frontend-image
    command: caddy run --config /etc/caddy/Caddyfile.static --adapter caddyfile
    # Long-form bind so EIGEN_STATIC_HOST/PORT substitute cleanly. Avoid the short-form
    # `${IP}:${PORT}:8080` shape — the colon between vars confuses some Compose versions.
    ports:
      - target: 8080
        published: "${EIGEN_STATIC_PORT:-8080}"
        host_ip: "${EIGEN_STATIC_HOST:-127.0.0.1}"
        protocol: tcp
    environment: *domains
    depends_on:
      eigen-api:
        condition: service_healthy
    restart: unless-stopped
    networks: [eigen]
    logging: *logging

  unbound:
    profiles: ["mail"]
    image: ${EIGEN_UNBOUND_IMAGE:-ghcr.io/eigen-is/eigen/unbound:local}
    restart: unless-stopped
    networks:
      eigen:
        ipv4_address: ${EIGEN_UNBOUND_IP}
    healthcheck:
      test: ["CMD", "drill", "@127.0.0.1", "cloudflare.com"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    logging: *logging

  postfix:
    profiles: ["mail"]
    image: ${EIGEN_POSTFIX_IMAGE:-ghcr.io/eigen-is/eigen/postfix:local}
    # IPv4 only. The `eigen` network has no IPv6, so docker-proxy would hand every IPv6 client to the mail services from
    # the gateway's one address, and one of them could lock all of them out of AUTH or hold every connection slot. An
    # IPv6 sender falls back to the A record. See docs/MAIL.md.
    ports:
      - "0.0.0.0:25:25"
      - "0.0.0.0:465:465"
      - "0.0.0.0:587:587"
    dns: ["${EIGEN_UNBOUND_IP}"]
    volumes:
      - ./data/dkim:/data/dkim
      - ./data/certs:/certs:ro
      - postfix-queue:/var/spool/postfix
    environment:
      <<: *domains
      SMTP_RELAY_HOST: ${SMTP_RELAY_HOST:-}
      SMTP_RELAY_PORT: ${SMTP_RELAY_PORT:-}
      SMTP_RELAY_USER: ${SMTP_RELAY_USER:-}
      SMTP_RELAY_PASSWORD: ${SMTP_RELAY_PASSWORD:-}
      # queue-monitor.sh: notify the org owner when the queue backs up (spam-run early warning).
      QUEUE_CHECK_INTERVAL: ${QUEUE_CHECK_INTERVAL:-300}
      QUEUE_ALERT_THRESHOLD: ${QUEUE_ALERT_THRESHOLD:-200}
      QUEUE_ALERT_COOLDOWN: ${QUEUE_ALERT_COOLDOWN:-21600}
      # The docker bridge subnet of the `eigen` network below. entrypoint.sh scopes Postfix `mynetworks` +
      # OpenDKIM `InternalHosts` to loopback plus this value, so eigen-api can submit and get its mail
      # DKIM-signed without trusting the whole 172.16/12 range. Unset → loopback only (fail closed).
      EIGEN_SUBNET: ${EIGEN_SUBNET}
    depends_on:
      eigen-api:
        condition: service_healthy
      dovecot:
        condition: service_started
      unbound:
        condition: service_healthy
    restart: unless-stopped
    networks: [eigen]
    logging: *mail-logging

  dovecot:
    profiles: ["mail"]
    image: ${EIGEN_DOVECOT_IMAGE:-ghcr.io/eigen-is/eigen/dovecot:local}
    # IPv4 only, as postfix's ports.
    ports:
      - "0.0.0.0:993:993"
    volumes:
      - ./data:/data
      - ./data/certs:/certs
    environment: *domains
    depends_on:
      eigen-api:
        condition: service_healthy
    restart: unless-stopped
    networks: [eigen]
    logging: *mail-logging

volumes:
  postfix-queue:

networks:
  eigen:
    driver: bridge
    ipam:
      config:
        # ./eigen setup writes EIGEN_SUBNET, a /24 no other Docker network uses, and EIGEN_UNBOUND_IP inside it. No
        # default and no :?: setup asks Compose for the project, and a local build builds, before it writes them.
        - subnet: ${EIGEN_SUBNET}