docker-compose.yml
Rama main · réplica de lectura del repositorio original.
services:
app:
# A published image, pinned to an exact version by the installer, never a
# moving tag. The default here is only what an unconfigured `docker
# compose up` would get; every real install writes SUPAFFI_VERSION into
# .env so an update is a deliberate move from one version to another.
#
# Building from source instead is still supported and is one line in .env:
# COMPOSE_FILE=docker-compose.yml:docker-compose.build.yml
image: ghcr.io/ugolbck/supaffi:${SUPAFFI_VERSION:-latest}
restart: unless-stopped
environment:
DATABASE_URL: postgres://supaffi:${POSTGRES_PASSWORD}@db:5432/supaffi
MASTER_ENCRYPTION_KEY: ${MASTER_ENCRYPTION_KEY} # decrypts Merchant Stripe keys at rest (ADR 0003), generated once at install, never stored in the DB
AUTH_SECRET: ${AUTH_SECRET} # signs Owner session JWTs (Auth.js)
AUTH_TRUST_HOST: "true" # Instance is served on many Merchant domains (ADR 0006), so there is no single AUTH_URL to pin; Caddy's on_demand_tls ask endpoint already gates which domains reach the app
SUPAFFI_DOMAIN: ${SUPAFFI_DOMAIN} # the domain this Instance's own dashboard is served on; a Merchant may not claim it (src/lib/instance.ts)
SUPAFFI_HOST_IP: ${SUPAFFI_HOST_IP:-} # the address the startup banner tells the operator to open, when there is no domain
SUPAFFI_DASHBOARD_PORT: ${SUPAFFI_DASHBOARD_PORT:-3443} # where caddy-dashboard serves it
SUPAFFI_UPDATE_CHECK: ${SUPAFFI_UPDATE_CHECK:-} # off to stop the dashboard reading GitHub's releases page
# Where the onboarding check asks for a Merchant domain's certificate.
# Fetching the domain's own public address from in here goes out to this
# host's IP and back, and many hosts do not route that hairpin, so a
# working site reads as unreachable. Set it when your proxy is not the
# caddy service below; an instance behind someone else's proxy leaves it
# unset and the check falls back to the round trip.
SUPAFFI_PROXY_HOST: ${SUPAFFI_PROXY_HOST:-caddy}
# SUPAFFI_VERSION is deliberately not passed in. It is baked into the
# image at build time, so the version the dashboard reports is the
# version that is actually running rather than whatever .env claims.
ports:
# Loopback by default, which is what proxy-less mode needs: the
# operator's own reverse proxy forwards to 127.0.0.1:3000, and the SSH
# tunnel in the README works with no extra steps. Binding all
# interfaces would be worse than it looks, for the reason spelled out
# on the db service below: Docker's iptables rules land ahead of ufw
# and firewalld, so a published port is internet-reachable on a host
# the operator believes is firewalled. Override deliberately, never by
# accident.
- "${SUPAFFI_APP_BIND:-127.0.0.1:3000}:3000"
depends_on:
db:
condition: service_healthy
db:
image: postgres:18-alpine
restart: unless-stopped
# No published port. Docker writes its own iptables rules ahead of ufw and
# firewalld, so a published 5432 is reachable from the internet even on a
# host the operator believes is firewalled. The app reaches it as db:5432
# over the compose network. For local psql access see
# docker-compose.override.yml.example.
environment:
POSTGRES_USER: supaffi
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
POSTGRES_DB: supaffi
healthcheck:
# The app's entrypoint runs `prisma migrate deploy` before the server
# starts. Waiting only for the container to exist (plain depends_on)
# lets that run before Postgres accepts connections; it usually wins the
# race, which is the worst kind of bug to ship to strangers' machines.
test: ["CMD-SHELL", "pg_isready -U supaffi -d supaffi"]
interval: 3s
timeout: 3s
retries: 20
volumes:
- supaffi_db:/var/lib/postgresql
caddy:
image: caddy:2-alpine
restart: unless-stopped
# Opt-in, because this service takes ports 80 and 443 for itself and a
# server that already runs a reverse proxy has neither to give. The
# installer writes COMPOSE_PROFILES=bundled-proxy into .env for the
# default path; leaving it unset drops this service entirely and the
# operator's own proxy forwards to SUPAFFI_APP_BIND instead.
#
# A profile rather than a second compose file selected with -f: the
# choice then lives in .env, so every command afterwards stays a plain
# `docker compose up -d` / `docker compose logs app`, which is what the
# README and the installer's token grep both rely on.
profiles: ["bundled-proxy"]
environment:
# Compose always materializes this key inside the container, even when
# SUPAFFI_DOMAIN is unset on the host, so Caddy would otherwise see an
# empty string rather than a missing variable. The Caddyfile's
# {$SUPAFFI_DOMAIN:localhost} default only fires on a genuinely absent
# variable, so a present-but-empty value skips it and crashes Caddy on
# startup. The default belongs here too, not just in the Caddyfile.
SUPAFFI_DOMAIN: ${SUPAFFI_DOMAIN:-localhost} # substituted into the named site block in ./Caddyfile before parsing
ports:
- "80:80"
- "443:443"
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile
- supaffi_caddy_data:/data
depends_on:
- app
caddy-dashboard:
image: caddy:2-alpine
restart: unless-stopped
# Always runs, unlike the caddy service above. That one only exists when
# Supaffi owns ports 80 and 443, and the dashboard has to be reachable on
# a server where the operator's own nginx owns them. Compose also rejects
# an empty port entry, so one service cannot publish 80/443 in one
# situation and 3443 in another; two port layouts need two services.
#
# Still behind a profile so a single COMPOSE_PROFILES value in .env
# describes the whole shape of the install. The installer always writes
# dashboard-tls into it.
profiles: ["dashboard-tls"]
environment:
# Defaults repeated here and not left to the Caddyfile alone: Compose
# materializes every key it declares, so an unset host variable would
# reach Caddy as an empty string, which is not the same as absent and
# skips the Caddyfile's own default. That crash-looped the other Caddy
# once already.
SUPAFFI_HOST_IP: ${SUPAFFI_HOST_IP:-127.0.0.1}
SUPAFFI_DASHBOARD_PORT: ${SUPAFFI_DASHBOARD_PORT:-3443}
ports:
# On all interfaces, deliberately, unlike the app's own binding. Being
# reachable from the operator's laptop with no DNS and no proxy is the
# entire point of this service, and the connection is encrypted.
- "${SUPAFFI_DASHBOARD_PORT:-3443}:${SUPAFFI_DASHBOARD_PORT:-3443}"
volumes:
- ./Caddyfile.dashboard:/etc/caddy/Caddyfile
- supaffi_caddy_dashboard_data:/data
depends_on:
- app
volumes:
supaffi_db:
supaffi_caddy_data:
supaffi_caddy_dashboard_data: