Doorman/compose.yaml at main · PrimeBuild-pc/Doorman · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
x-app: &app
  build: .
  image: doorman:local
  pull_policy: never
  init: true
  read_only: true
  tmpfs:
    - /tmp:rw,noexec,nosuid,size=64m
  cap_drop: [ALL]
  security_opt: [no-new-privileges:true]
  restart: unless-stopped

x-env: &env
  DATABASE_URL: postgresql://doorman:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}@db:5432/doorman
  DISCORD_BOT_TOKEN: ${DISCORD_BOT_TOKEN:?Set DISCORD_BOT_TOKEN in .env}
  DISCORD_CLIENT_ID: ${DISCORD_CLIENT_ID:?Set DISCORD_CLIENT_ID in .env}
  DISCORD_CLIENT_SECRET: ${DISCORD_CLIENT_SECRET:?Set DISCORD_CLIENT_SECRET in .env}
  AUTH_SECRET: ${AUTH_SECRET:?Set AUTH_SECRET in .env}
  PUBLIC_URL: ${PUBLIC_URL:-http://localhost:3000}
  UPLOADS_DIR: /data/uploads

services:
  db:
    image: postgres:16.10-alpine3.22
    user: postgres
    environment:
      POSTGRES_USER: doorman
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
      POSTGRES_DB: doorman
    volumes:
      - db-data:/var/lib/postgresql/data
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
      - /var/run/postgresql:rw,noexec,nosuid,size=16m,uid=70,gid=70
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U doorman -d doorman -h 127.0.0.1"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s
    restart: unless-stopped

  schema:
    <<: *app
    environment:
      SERVICE: schema
      DATABASE_URL: postgresql://doorman:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}@db:5432/doorman
    depends_on:
      db:
        condition: service_healthy
    restart: "no"

  bot:
    <<: *app
    environment:
      <<: *env
      SERVICE: bot
    volumes:
      - uploads:/data/uploads:ro
    depends_on:
      schema:
        condition: service_completed_successfully

  web:
    <<: *app
    environment:
      <<: *env
      SERVICE: web
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
      - /app/apps/web/.next/cache:rw,noexec,nosuid,size=64m,uid=1000,gid=1000
    volumes:
      - uploads:/data/uploads
    ports:
      - "${DOORMAN_BIND_ADDRESS:-127.0.0.1}:${DOORMAN_PORT:-3000}:3000"
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/auth/login',{redirect:'manual',signal:AbortSignal.timeout(4000)}).then(r=>process.exit(r.status===307?0:1)).catch(()=>process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s
    depends_on:
      schema:
        condition: service_completed_successfully

volumes:
  db-data:
  uploads: