compose.prod.yml

# Generated by bun scripts/generate-app-deployments.ts; edit scripts/templates or the config registry.
# Production deployment template — single host, behind an existing Traefik.
# Before starting apps, enroll OAuth explicitly (repeat the grant on rotation):
# cld --profile operator admin apps keys create oauth --grant oauth:issue --out-dir ./secrets
#
# This file does NOT define `postgres`, `valkey`, `nats-1..3`, or `filegate`.
# Add them yourself (the apps reference `postgres:5432`, `valkey:6379`, and a
# three-node NATS JetStream cluster at `nats-1..3:4222` with max_payload >= 16MB,
# and depend on a `postgres` service with a healthcheck). See README and
# compose.yml for an example.
#
# Configure via .env (see .env.prod.example). Set CLOUD_IMAGE_TAG to a release
# tag (`vX.Y.Z`) or an immutable `sha-<commit>` tag listed in that release's
# release.json. Never deploy `main` or `latest`: they move underneath a running
# installation and break the rollback path.

x-shared-env: &shared-env
  DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
  REDIS_URL: redis://valkey:6379
  NATS_SERVERS: nats://nats-1:4222,nats://nats-2:4222,nats://nats-3:4222
  SYNC_NAMESPACE: ${SYNC_NAMESPACE:-prod}
  # Optional NATS auth/TLS: paths inside the app containers. Mount the files
  # into Core and Gateway and set the paths in .env.
  NATS_CREDS_FILE: ${NATS_CREDS_FILE:-}
  NATS_TLS_CA_FILE: ${NATS_TLS_CA_FILE:-}
  APP_SECRET: ${APP_SECRET}
  APP_URL: https://${CLOUD_HOST}
  CLOUD_IDENTITY_JWKS_ORIGIN: http://app-core:3000
  CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000

x-app-defaults: &app-defaults
  restart: unless-stopped
  networks: [cloud-internal]
  environment: *shared-env

networks:
  cloud-internal:
    driver: bridge
  traefik:
    external: true

services:
  # Gateway — the only service exposed to Traefik.
  gateway:
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-gateway:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}
    networks:
      cloud-internal: {}
      traefik:
        aliases: ["cloud-gateway-${CLOUD_HOST}"]
    environment:
      APP_URL: https://${CLOUD_HOST}
      GATEWAY_INTERNAL_URL: http://cloud-gateway-${CLOUD_HOST}:3000
      APP_SECRET: ${APP_SECRET}
      REDIS_URL: redis://valkey:6379
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      NATS_SERVERS: nats://nats-1:4222,nats://nats-2:4222,nats://nats-3:4222
      SYNC_NAMESPACE: ${SYNC_NAMESPACE:-prod}
      NATS_CREDS_FILE: ${NATS_CREDS_FILE:-}
      NATS_TLS_CA_FILE: ${NATS_TLS_CA_FILE:-}
      # Unset trusts loopback and private networks, which covers Traefik here.
      GATEWAY_TRUSTED_PROXIES: ${GATEWAY_TRUSTED_PROXIES:-}
    # Private HTTP provider/Caddy ask listener; never publish a host port or route it through Traefik.
    expose: ["3001"]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.cloud.rule=Host(`${CLOUD_HOST}`)"
      - "traefik.http.routers.cloud.entrypoints=websecure"
      - "traefik.http.routers.cloud.tls.certresolver=le"
      - "traefik.http.services.cloud.loadbalancer.server.port=3000"
      - "traefik.docker.network=traefik"

  app-gateway-ops:
    secrets:
      - source: gateway-ops-app-key
        target: gateway-ops.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/gateway-ops.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-gateway-ops:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}
    # Diagnostics credentials are stored in Gateway Ops administrator settings.

  # Apps — internal only, reached through the gateway.
  app-core:
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-core:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}
    healthcheck:
      test:
        - CMD
        - bun
        - -e
        - const response = await fetch("http://127.0.0.1:3000/_cloud/ready"); if (!response.ok) process.exit(1)
      interval: 2s
      timeout: 2s
      retries: 90
      start_period: 2s
    environment:
      <<: *shared-env
      OUTGOING_MAIL_ALLOWED_TARGETS: ${OUTGOING_MAIL_ALLOWED_TARGETS:-}
      ADMIN_LOGIN_TOKEN: ${ADMIN_LOGIN_TOKEN:-}
      CLOUD_OAUTH_BROKER_SECRET: ${CLOUD_OAUTH_BROKER_SECRET:-}
      CLOUD_IDENTITY_KEY_ENCRYPTION_KEY: ${CLOUD_IDENTITY_KEY_ENCRYPTION_KEY:?CLOUD_IDENTITY_KEY_ENCRYPTION_KEY is required}
      CLOUD_IDENTITY_NEXT_KEY: ${CLOUD_IDENTITY_NEXT_KEY:-}
      CLOUD_IDENTITY_PREVIOUS_KEY: ${CLOUD_IDENTITY_PREVIOUS_KEY:-}

  app-accounts:
    secrets:
      - source: accounts-app-key
        target: accounts.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/accounts.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-accounts:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-api-docs:
    secrets:
      - source: api-docs-app-key
        target: api-docs.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/api-docs.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-api-docs:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-assistant:
    secrets:
      - source: assistant-app-key
        target: assistant.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/assistant.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    user: bun
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    image: ghcr.io/k2b-dev/cloud-app-assistant:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-capabilities:
    secrets:
      - source: capabilities-app-key
        target: capabilities.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/capabilities.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-capabilities:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  # Chat is unreleased: its image is built and published, but a plain `up`
  # leaves it out. `--profile unreleased` or naming the service starts it,
  # which is for test installations only. Do not start it.
  app-chat:
    secrets:
      - source: chat-app-key
        target: chat.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/chat.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-chat:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}
    profiles: ["unreleased"]

  app-contacts:
    secrets:
      - source: contacts-app-key
        target: contacts.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/contacts.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-contacts:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-dashboard:
    secrets:
      - source: dashboard-app-key
        target: dashboard.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/dashboard.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-dashboard:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-faq:
    secrets:
      - source: faq-app-key
        target: faq.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/faq.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-faq:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-filesv2:
    secrets:
      - source: filesv2-app-key
        target: filesv2.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/filesv2.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-filesv2:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-grids:
    secrets:
      - source: grids-app-key
        target: grids.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/grids.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-grids:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-ipa-hosts:
    secrets:
      - source: ipa-hosts-app-key
        target: ipa-hosts.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/ipa-hosts.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-ipa-hosts:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-mail:
    secrets:
      - source: mail-app-key
        target: mail.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/mail.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-mail:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-notebooks:
    secrets:
      - source: notebooks-app-key
        target: notebooks.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/notebooks.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-notebooks:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-oauth:
    secrets:
      - source: oauth-app-key
        target: oauth.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/oauth.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-oauth:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-pulse:
    secrets:
      - source: pulse-app-key
        target: pulse.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/pulse.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-pulse:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-proxy-auth:
    secrets:
      - source: proxy-auth-app-key
        target: proxy-auth.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/proxy-auth.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-proxy-auth:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  # The mobile app is unreleased: its image is built and published, but it
  # starts only with `--profile unreleased`. Do not start it.
  app-pwa:
    secrets:
      - source: pwa-app-key
        target: pwa.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/pwa.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-pwa:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}
    profiles: ["unreleased"]

  app-quotes:
    secrets:
      - source: quotes-app-key
        target: quotes.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/quotes.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-quotes:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-spaces:
    secrets:
      - source: spaces-app-key
        target: spaces.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/spaces.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-spaces:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-tools:
    secrets:
      - source: tools-app-key
        target: tools.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/tools.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-tools:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-venue:
    secrets:
      - source: venue-app-key
        target: venue.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/venue.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-venue:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

  app-weather:
    secrets:
      - source: weather-app-key
        target: weather.key
    depends_on:
      app-core:
        condition: service_healthy
    environment:
      CLOUD_APP_KEY_FILE: /run/secrets/weather.key
      CLOUD_CORE_INTERNAL_ORIGIN: http://app-core:3000
    <<: *app-defaults
    image: ghcr.io/k2b-dev/cloud-app-weather:${CLOUD_IMAGE_TAG:?CLOUD_IMAGE_TAG is required}

secrets:
  accounts-app-key:
    file: ./secrets/accounts.key
  api-docs-app-key:
    file: ./secrets/api-docs.key
  assistant-app-key:
    file: ./secrets/assistant.key
  capabilities-app-key:
    file: ./secrets/capabilities.key
  chat-app-key:
    file: ./secrets/chat.key
  contacts-app-key:
    file: ./secrets/contacts.key
  dashboard-app-key:
    file: ./secrets/dashboard.key
  faq-app-key:
    file: ./secrets/faq.key
  filesv2-app-key:
    file: ./secrets/filesv2.key
  gateway-ops-app-key:
    file: ./secrets/gateway-ops.key
  grids-app-key:
    file: ./secrets/grids.key
  ipa-hosts-app-key:
    file: ./secrets/ipa-hosts.key
  mail-app-key:
    file: ./secrets/mail.key
  notebooks-app-key:
    file: ./secrets/notebooks.key
  oauth-app-key:
    file: ./secrets/oauth.key
  proxy-auth-app-key:
    file: ./secrets/proxy-auth.key
  pulse-app-key:
    file: ./secrets/pulse.key
  pwa-app-key:
    file: ./secrets/pwa.key
  quotes-app-key:
    file: ./secrets/quotes.key
  spaces-app-key:
    file: ./secrets/spaces.key
  tools-app-key:
    file: ./secrets/tools.key
  venue-app-key:
    file: ./secrets/venue.key
  weather-app-key:
    file: ./secrets/weather.key