docker-compose.yml

# Usage:
# Dev:  docker compose --profile dev up -d
# Prod: docker compose --profile prod up -d
services:
  # Common services (always included)
  dokploy-postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    ports:
      - "5432:5432"
    environment:
      POSTGRES_USER: dokploy
      POSTGRES_PASSWORD: dokploy_secret
      POSTGRES_DB: dokploy
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U dokploy"]
      interval: 5s
      timeout: 5s
      retries: 5

  dokploy-redis:
    image: redis:7-alpine
    restart: unless-stopped
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5

  dokploy:
    image: dokploy/dokploy:latest
    restart: unless-stopped
    ports:
      - "3020:3000"
    environment:
      - DATABASE_URL=postgresql://dokploy:dokploy_secret@dokploy-postgres:5432/dokploy
      - REDIS_URL=redis://dokploy-redis:6379
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - dokploy_data:/etc/dokploy
    networks:
      - default
      - relaykit-network
    depends_on:
      dokploy-postgres:
        condition: service_healthy
      dokploy-redis:
        condition: service_healthy

  # Traefik - different config per environment
  dokploy-traefik-dev:
    profiles: ["dev"]
    image: traefik:v3.6.7
    restart: unless-stopped
    volumes:
      - dokploy_data:/etc/dokploy:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    entrypoint: ["/bin/sh", "-c", "cp /etc/dokploy/traefik/traefik.yml /tmp/traefik.yml && sed -i '/swarm:/,/watch: true/{d;}' /tmp/traefik.yml && traefik --configFile=/tmp/traefik.yml --log.level=WARN"]
    command: []
    depends_on:
      - dokploy
    networks:
      - default
      - relaykit-network
      - dokploy-network

  dokploy-traefik-prod:
    profiles: ["prod"]
    image: traefik:v3.6.7
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - dokploy_data:/etc/dokploy
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command: --configFile=/etc/dokploy/traefik/traefik.yml
    depends_on:
      - dokploy
    networks:
      - default
      - relaykit-network
      - dokploy-network

  # Caddy - dev only (HTTPS termination with local certs)
  caddy:
    profiles: ["dev"]
    image: caddy:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./dev-certs:/certs:ro
      - ./Caddyfile.dev:/etc/caddy/Caddyfile:ro
    depends_on:
      - dokploy-traefik-dev
    networks:
      - default

  # RelayKit - different config per environment
  relaykit-dev:
    profiles: ["dev"]
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    ports:
      - "4000:4000" # backend api
      - "5173:5173" # frontend
      - "5174:5174" # relay explorer
      - "5175:5175" # blossom explorer
      - "5176:5176" # npanel
      - "5177:5177" # hello world
      - "5178:5178" # grasp explorer
      - "5179:5179" # notif hub
    environment:
      - NODE_ENV=development
      - PORT=4000
      - JWT_SECRET=${JWT_SECRET}
      - RELAYKIT_HOST=${RELAYKIT_HOST:-}
    volumes:
      - ./app:/app
      # Container-private node_modules: the host (macOS) and container (Linux) need different
      # native binaries (esbuild/rollup/swc), so they must not share these dirs via the bind mount.
      - dev_nm_root:/app/node_modules
      - dev_nm_frontend:/app/frontend/node_modules
      - dev_nm_backend:/app/backend/node_modules
      - dev_nm_relay_explorer:/app/apps/relay-explorer/node_modules
      - dev_nm_blossom_explorer:/app/apps/blossom-explorer/node_modules
      - dev_nm_nsite_explorer:/app/apps/nsite-explorer/node_modules
      - dev_nm_grasp_explorer:/app/apps/grasp-explorer/node_modules
      - dev_nm_hello_world:/app/apps/hello-world/node_modules
      - dev_nm_notif_hub:/app/apps/notif-hub/node_modules
      - relaykit_data:/app/.relaykit
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - default
      - dokploy-network
    depends_on:
      dokploy:
        condition: service_started

  relaykit-prod:
    profiles: ["prod"]
    image: ${RELAYKIT_IMAGE:-ghcr.io/samthomson/relaykit:latest}
    restart: unless-stopped
    environment:
      - NODE_ENV=production
      - PORT=4000
      - JWT_SECRET=${JWT_SECRET}
      - RELAYKIT_HOST=${RELAYKIT_HOST:-}
    volumes:
      - relaykit_data:/app/.relaykit
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - default
      - relaykit-network
    labels:
      - "traefik.enable=true"
      # Primary host router: real Let's Encrypt cert for the instance domain (set RELAYKIT_HOST in .env)
      - "traefik.http.routers.relaykit-secure.rule=Host(`${RELAYKIT_HOST}`)"
      - "traefik.http.routers.relaykit-secure.priority=100"
      - "traefik.http.routers.relaykit-secure.entrypoints=websecure"
      - "traefik.http.routers.relaykit-secure.tls.certresolver=letsencrypt"
      # Redirect http→https for the instance domain
      - "traefik.http.routers.relaykit-web.rule=Host(`${RELAYKIT_HOST}`)"
      - "traefik.http.routers.relaykit-web.priority=100"
      - "traefik.http.routers.relaykit-web.entrypoints=web"
      - "traefik.http.routers.relaykit-web.middlewares=relaykit-redirect"
      - "traefik.http.middlewares.relaykit-redirect.redirectscheme.scheme=https"
      # Low priority so Dokploy's per-service routes win; fallback for IP or unknown host (self-signed on https)
      - "traefik.http.routers.relaykit.rule=PathPrefix(`/`)"
      - "traefik.http.routers.relaykit.priority=1"
      - "traefik.http.routers.relaykit.entrypoints=web,websecure"
      - "traefik.http.services.relaykit.loadbalancer.server.port=4000"
    depends_on:
      dokploy:
        condition: service_started
    command: ["sh", "-c", "cd /app/backend && yarn start"]

  hello-world:
    profiles: ["prod"]
    build:
      context: .
      dockerfile: app/apps/hello-world/Dockerfile
    restart: unless-stopped
    volumes:
      - hello_world_data:/data
    networks:
      - default
      - relaykit-network
      - dokploy-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.hello-world-secure.rule=Host(`${RELAYKIT_HOST}`) && PathPrefix(`/apps/hello-world`)"
      - "traefik.http.routers.hello-world-secure.priority=200"
      - "traefik.http.routers.hello-world-secure.entrypoints=websecure"
      - "traefik.http.routers.hello-world-secure.tls.certresolver=letsencrypt"
      - "traefik.http.routers.hello-world-secure.middlewares=hello-world-strip"
      - "traefik.http.routers.hello-world-web.rule=Host(`${RELAYKIT_HOST}`) && PathPrefix(`/apps/hello-world`)"
      - "traefik.http.routers.hello-world-web.priority=200"
      - "traefik.http.routers.hello-world-web.entrypoints=web"
      - "traefik.http.routers.hello-world-web.middlewares=relaykit-redirect"
      - "traefik.http.middlewares.hello-world-strip.stripprefix.prefixes=/apps/hello-world"
      - "traefik.http.services.hello-world.loadbalancer.server.port=3100"

volumes:
  postgres_data:
  redis_data:
  dokploy_data:
  relaykit_data:
  hello_world_data:
  dev_nm_root:
  dev_nm_frontend:
  dev_nm_backend:
  dev_nm_relay_explorer:
  dev_nm_blossom_explorer:
  dev_nm_nsite_explorer:
  dev_nm_grasp_explorer:
  dev_nm_hello_world:
  dev_nm_notif_hub:

networks:
  relaykit-network:
    name: relaykit-network
    driver: bridge
  dokploy-network:
    external: true