askdb/docker-compose.yml at main · mgorabbani/askdb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
services:
  docker-socket-proxy:
    image: tecnativa/docker-socket-proxy:latest
    restart: unless-stopped
    environment:
      # Only enable the minimum API surface askdb needs.
      # Everything else stays locked down by default.
      CONTAINERS: 1
      IMAGES: 1
      NETWORKS: 1
      VOLUMES: 1        # needed: destroy() removes sandbox volumes on connection delete
      EXEC: 0
      SERVICES: 0
      SWARM: 0
      SYSTEM: 0
      PLUGINS: 0
      INFO: 1           # dockerode pings this during client init
      PING: 1           # dockerode pings this during client init
      VERSION: 1        # dockerode reads this during client init
      POST: 1           # required: create/start/stop/remove are POST/DELETE
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    expose:
      - "2375"

  askdb:
    build: .
    image: ghcr.io/mgorabbani/askdb:latest
    restart: unless-stopped
    environment:
      NODE_ENV: production
      PORT: 3100
      SERVE_UI: "1"
      BETTER_AUTH_URL: ${BETTER_AUTH_URL:-https://${DOMAIN}}
      DATABASE_PATH: /app/data/askdb.db
      DOCKER_HOST: tcp://docker-socket-proxy:2375
    env_file:
      - .env
    volumes:
      - askdb-data:/app/data
    extra_hosts:
      - "host.docker.internal:host-gateway"
    expose:
      - "3100"
    depends_on:
      docker-socket-proxy:
        condition: service_started
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3100/api/health >/dev/null || exit 1"]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3

  askdb-proxyless:
    extends: askdb
    profiles: ["proxyless"]
    ports:
      - "127.0.0.1:3100:3100"

  caddy:
    image: caddy:2-alpine
    profiles: ["caddy"]
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    environment:
      # Defaults apply when the caddy profile is not active (e.g. local dev,
      # proxyless install). install.sh writes real values into .env for caddy.
      DOMAIN: ${DOMAIN:-localhost}
      ACME_EMAIL: ${ACME_EMAIL:-admin@localhost}
    volumes:
      - ./deploy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
    depends_on:
      askdb:
        condition: service_healthy

  cloudflared:
    image: cloudflare/cloudflared:latest
    profiles: ["tunnel"]
    restart: unless-stopped
    command: tunnel --no-autoupdate run --token ${CF_TUNNEL_TOKEN:-}
    depends_on:
      askdb:
        condition: service_healthy

volumes:
  askdb-data:
  caddy-data:
  caddy-config: