nextfolio/docker-compose.yml at master · JakeMalmrose/nextfolio · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
services:
  postgres:
    # Pinned to 17: the data volume was initialized on 17.x and a silent
    # major-version pull would leave the server unable to start on it
    image: postgres:17
    restart: always
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_USER=nextfolio
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=nextfolio
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - web
    healthcheck:
      test: ["CMD-SHELL", "pg_isready"]
      interval: 10s
      timeout: 5s
      retries: 5

  nextjs:
    build:
      context: .
      dockerfile: Dockerfile.next
    restart: unless-stopped
    ports:
      - "3001:3000"
    networks:
      - web
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgresql://nextfolio:${POSTGRES_PASSWORD}@postgres:5432/nextfolio?schema=public
      - JWT_SECRET=${JWT_SECRET}
      # Cloudflare Tunnel delivers plain HTTP to the container, so auth
      # cookies can't be marked secure; set ALLOW_HTTP_AUTH=true in .env
      - ALLOW_HTTP_AUTH=${ALLOW_HTTP_AUTH}
    depends_on:
      postgres:
        condition: service_healthy

  caddy:
    image: caddy:2
    restart: unless-stopped
    # 443 is NOT published: tailscaled (Tailscale Funnel for draupforge) holds
    # it on the host, and public HTTPS terminates at the Cloudflare Tunnel
    # (ingress -> nextjs:3001), so Caddy only serves plain HTTP locally
    ports:
      - "80:80"
    environment:
      - DOMAIN=malmrose.com
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    networks:
      - web
    depends_on:
      - nextjs
      - pgadmin
      - openwebui

  pgadmin:
    image: dpage/pgadmin4:latest
    restart: unless-stopped
    environment:
      - PGADMIN_DEFAULT_EMAIL=admin@malmrose.com
      - PGADMIN_DEFAULT_PASSWORD=${PGADMIN_DEFAULT_PASSWORD}
      - PGADMIN_CONFIG_SERVER_MODE=False
    volumes:
      - pgadmin_data:/var/lib/pgadmin
    ports:
      - "5050:80"
    networks:
      - web
    depends_on:
      - postgres

  openwebui:
    image: ghcr.io/open-webui/open-webui:main
    restart: unless-stopped
    volumes:
      - open-webui:/app/backend/data
    networks:
      - web
    env_file:
      - .env
    environment:
      # Override the shared .env DATABASE_URL (Prisma-style ?schema=public breaks psycopg2);
      # open-webui keeps its own sqlite in the data volume
      - DATABASE_URL=sqlite:////app/backend/data/webui.db
      - ENABLE_OAUTH_SIGNUP=True
      - ENABLE_LOGIN_FORM=False
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
      - GOOGLE_OAUTH_SCOPE=${GOOGLE_OAUTH_SCOPE}
      - GOOGLE_REDIRECT_URI=${GOOGLE_REDIRECT_URI}
networks:
  web:
    driver: bridge

volumes:
  caddy_data:
    driver: local
  caddy_config:
    driver: local
  open-webui:
    driver: local
  postgres_data:
    driver: local
  pgadmin_data:
    driver: local