compose.server.yml

# Production compose: Postgres + the single API/web container.
# Deployed by scripts/deploy/deploy-over-ssh.mjs (`npm run deploy:prod`).
# Reads secrets/config from .env on the host (auto-loaded by compose; see .env.example).
#
#   docker compose -f compose.server.yml up -d --build
services:
  db:
    image: postgres:16-bookworm
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-persistent}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-persistent}"]
      interval: 10s
      timeout: 5s
      retries: 10
    volumes:
      - persistent-data:/var/lib/postgresql/data

  api:
    build:
      context: .
      dockerfile: Dockerfile
      # Use host networking during the build: the default build bridge resolves
      # registry.npmjs.org to IPv6-only and `npm ci` then can't connect.
      network: host
    container_name: persistent-api
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-persistent}?schema=public
      CLIENT_ORIGIN: ${CLIENT_ORIGIN:?set CLIENT_ORIGIN (the public URL) in .env}
      DEMO_MODE: "false"
      CLOUDFLARE_EMAIL_ACCOUNT_ID: ${CLOUDFLARE_EMAIL_ACCOUNT_ID:-}
      CLOUDFLARE_EMAIL_API_TOKEN: ${CLOUDFLARE_EMAIL_API_TOKEN:-}
      CLOUDFLARE_EMAIL_FROM_EMAIL: ${CLOUDFLARE_EMAIL_FROM_EMAIL:-}
      CLOUDFLARE_EMAIL_FROM_NAME: ${CLOUDFLARE_EMAIL_FROM_NAME:-Persistent}
      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:-}
      VAPID_SUBJECT: ${VAPID_SUBJECT:-mailto:persistent@local}
      FCM_SERVICE_ACCOUNT_FILE: ${FCM_SERVICE_ACCOUNT_FILE:-}
      FCM_PROJECT_ID: ${FCM_PROJECT_ID:-}
    # FCM service-account key, mounted read-only from the host's gitignored
    # .secrets/ (survives `git reset --hard` on deploy). Point
    # FCM_SERVICE_ACCOUNT_FILE in .env at the in-container path on the right.
    volumes:
      - ./.secrets/fcm-service-account.json:/run/secrets/fcm-service-account.json:ro
    # No published host port: the shared `nginx` reverse proxy reaches this
    # container by name (persistent-api:4000) over the external nginx_default
    # network. See nginx.server.example.conf. (Add a `ports` mapping only if you
    # need to hit the API directly on the host.)
    networks:
      - default
      - nginx_default

volumes:
  persistent-data:

networks:
  # The shared reverse-proxy network created by the host's central nginx stack.
  nginx_default:
    external: true