docker-compose.dokploy.yml

x-api-image: &api-image
  image: ghcr.io/sovandara1607/unity-runn-api:${IMAGE_TAG:-dev-server}
  pull_policy: always

services:
  postgres:
    image: postgres:16-alpine
    networks: [runn]
    ports:
      - "127.0.0.1:${POSTGRES_TUNNEL_PORT:-15432}:5432"
    restart: unless-stopped
    init: true
    mem_limit: ${POSTGRES_MEMORY_LIMIT:-512m}
    cpus: ${POSTGRES_CPU_LIMIT:-0.75}
    pids_limit: 100
    command:
      - postgres
      - -c
      - max_connections=60
      - -c
      - shared_buffers=128MB
      - -c
      - effective_cache_size=384MB
      - -c
      - work_mem=4MB
      - -c
      - maintenance_work_mem=64MB
      - -c
      - huge_pages=off
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-unity}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in Dokploy}
      POSTGRES_DB: ${POSTGRES_DB:-unity_run_club}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 3s
      retries: 10
      start_period: 15s
    logging: &service-logging
      driver: local
      options:
        max-size: "10m"
        max-file: "3"

  redis:
    image: redis:7-alpine
    networks: [runn]
    ports:
      - "127.0.0.1:${REDIS_TUNNEL_PORT:-16379}:6379"
    restart: unless-stopped
    init: true
    mem_limit: ${REDIS_MEMORY_LIMIT:-128m}
    cpus: ${REDIS_CPU_LIMIT:-0.25}
    pids_limit: 50
    command:
      - redis-server
      - --requirepass
      - ${REDIS_PASSWORD:?Set REDIS_PASSWORD in Dokploy}
      - --maxmemory
      - ${REDIS_MAXMEMORY:-96mb}
      - --maxmemory-policy
      - noeviction
      - --appendonly
      - "yes"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a \"$${REDIS_PASSWORD}\" ping | grep PONG"]
      interval: 10s
      timeout: 3s
      retries: 10
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?Set REDIS_PASSWORD in Dokploy}
    logging: *service-logging

  migrate:
    <<: *api-image
    networks: [runn]
    restart: "no"
    entrypoint: ["./migrate", "up"]
    environment:
      # Migrations run directly against Postgres, bypassing PgBouncer: goose's
      # locking/DDL behavior isn't guaranteed safe through a transaction-pooled
      # connection.
      DATABASE_URL: postgres://${POSTGRES_USER:-unity}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-unity_run_club}?sslmode=disable
    depends_on:
      postgres:
        condition: service_healthy
    logging: *service-logging

  # Sits between the API/worker and Postgres: transaction pooling lets each
  # replica keep a generous local pgx pool (DATABASE_MAX_CONN) while Postgres
  # itself only ever sees PGBOUNCER_DEFAULT_POOL_SIZE real backend
  # connections, regardless of how many API replicas are running.
  pgbouncer:
    image: edoburu/pgbouncer:v1.24.1-p1
    networks: [runn]
    restart: unless-stopped
    init: true
    mem_limit: ${PGBOUNCER_MEMORY_LIMIT:-96m}
    cpus: ${PGBOUNCER_CPU_LIMIT:-0.25}
    pids_limit: 50
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER:-unity}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-unity_run_club}
      LISTEN_PORT: "6432"
      POOL_MODE: transaction
      MAX_CLIENT_CONN: ${PGBOUNCER_MAX_CLIENT_CONN:-1000}
      DEFAULT_POOL_SIZE: ${PGBOUNCER_DEFAULT_POOL_SIZE:-20}
      AUTH_TYPE: scram-sha-256
    expose:
      - "6432"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -p 6432 -U ${POSTGRES_USER:-unity}"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 5s
    logging: *service-logging

  api: &api-service
    <<: *api-image
    networks: [runn]
    restart: unless-stopped
    init: true
    mem_limit: ${API_MEMORY_LIMIT:-384m}
    cpus: ${API_CPU_LIMIT:-1.0}
    pids_limit: 120
    environment: &api-environment
      PROCESS_ROLE: api
      APP_ENV: ${APP_ENV:-staging}
      PORT: "8080"
      METRICS_PORT: "9091"
      LOG_LEVEL: ${LOG_LEVEL:-info}
      DATABASE_URL: postgres://${POSTGRES_USER:-unity}:${POSTGRES_PASSWORD}@pgbouncer:6432/${POSTGRES_DB:-unity_run_club}?sslmode=disable
      DATABASE_PGBOUNCER_COMPAT: "true"
      DATABASE_MAX_CONN: ${DATABASE_MAX_CONN:-20}
      REDIS_ADDR: redis:6379
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      REDIS_DB: ${REDIS_DB:-0}
      REALTIME_INTERNAL_URL: http://realtime:8081
      CORS_ALLOWED_ORIGINS: ${PUBLIC_APP_URL:-https://dev-server.sovandara.lol}
      PUBLIC_APP_URL: ${PUBLIC_APP_URL:-https://dev-server.sovandara.lol}
      UPLOAD_DIR: /app/uploads
      OBJECT_STORAGE_PROVIDER: ${OBJECT_STORAGE_PROVIDER:-local}
      R2_ENDPOINT: ${R2_ENDPOINT:-}
      R2_BUCKET: ${R2_BUCKET:-}
      R2_ACCESS_KEY_ID: ${R2_ACCESS_KEY_ID:-}
      R2_SECRET_ACCESS_KEY: ${R2_SECRET_ACCESS_KEY:-}
      R2_PUBLIC_BASE_URL: ${R2_PUBLIC_BASE_URL:-}
      JWT_SECRET: ${JWT_SECRET:?Set JWT_SECRET in Dokploy}
      ACCESS_TOKEN_TTL: ${ACCESS_TOKEN_TTL:-15m}
      REFRESH_TOKEN_TTL: ${REFRESH_TOKEN_TTL:-720h}
      BCRYPT_COST: ${BCRYPT_COST:-12}
      GOOGLE_OAUTH_CLIENT_ID: ${GOOGLE_OAUTH_CLIENT_ID:-}
      GOOGLE_OAUTH_CLIENT_SECRET: ${GOOGLE_OAUTH_CLIENT_SECRET:-}
      GOOGLE_OAUTH_REDIRECT_URL: ${GOOGLE_OAUTH_REDIRECT_URL:-}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM: ${SMTP_FROM:-}
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
      TELEGRAM_BOT_USERNAME: ${TELEGRAM_BOT_USERNAME:-}
      TELEGRAM_WEBHOOK_SECRET: ${TELEGRAM_WEBHOOK_SECRET:-}
      TELEGRAM_API_BASE_URL: ${TELEGRAM_API_BASE_URL:-https://api.telegram.org}
      REMINDER_WINDOW: ${REMINDER_WINDOW:-24h}
      REMINDER_POLL_INTERVAL: ${REMINDER_POLL_INTERVAL:-15m}
      NOTIFICATION_SWEEP_INTERVAL: ${NOTIFICATION_SWEEP_INTERVAL:-30s}
      NOTIFICATION_MAX_ATTEMPTS: ${NOTIFICATION_MAX_ATTEMPTS:-5}
      PAYMENT_PROVIDER: ${PAYMENT_PROVIDER:-mock}
      MANUAL_PAYMENT_QR_STRING: ${MANUAL_PAYMENT_QR_STRING:-}
      MANUAL_PAYMENT_TTL: ${MANUAL_PAYMENT_TTL:-24h}
      BAKONG_BASE_URL: ${BAKONG_BASE_URL:-}
      BAKONG_TOKEN: ${BAKONG_TOKEN:-}
      BAKONG_ACCOUNT_ID: ${BAKONG_ACCOUNT_ID:-}
      BAKONG_MERCHANT_ID: ${BAKONG_MERCHANT_ID:-}
      BAKONG_ACQUIRING_BANK: ${BAKONG_ACQUIRING_BANK:-}
      BAKONG_MERCHANT_NAME: ${BAKONG_MERCHANT_NAME:-UNITY RUNN CLUB}
      BAKONG_MERCHANT_CITY: ${BAKONG_MERCHANT_CITY:-PHNOM PENH}
      BAKONG_MCC: ${BAKONG_MCC:-5999}
      BAKONG_STORE_LABEL: ${BAKONG_STORE_LABEL:-UNITY RUNN CLUB}
      BAKONG_TERMINAL_LABEL: ${BAKONG_TERMINAL_LABEL:-WEB}
      BAKONG_PAYMENT_TTL: ${BAKONG_PAYMENT_TTL:-10m}
      GOMEMLIMIT: ${API_GO_MEMORY_LIMIT:-256MiB}
      GOMAXPROCS: ${API_GO_MAX_PROCS:-1}
    volumes:
      - event_uploads:/app/uploads
    expose:
      - "8080"
      - "9091"
    depends_on:
      migrate:
        condition: service_completed_successfully
      pgbouncer:
        condition: service_healthy
      redis:
        condition: service_healthy
      realtime:
        condition: service_healthy
    stop_grace_period: 20s
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8080/ready"]
      interval: 30s
      timeout: 3s
      retries: 5
      start_period: 15s
    logging: *service-logging

  api-replica:
    <<: *api-service

  # Exactly one worker: email sweeps are not safe to run concurrently.
  worker:
    <<: *api-service
    environment:
      <<: *api-environment
      PROCESS_ROLE: worker
      DATABASE_MAX_CONN: ${WORKER_DATABASE_MAX_CONN:-10}

  api-gateway:
    image: traefik:v3.7.12
    networks: [runn]
    restart: unless-stopped
    init: true
    mem_limit: ${GATEWAY_MEMORY_LIMIT:-128m}
    cpus: ${GATEWAY_CPU_LIMIT:-0.25}
    pids_limit: 100
    command:
      - --entrypoints.api.address=:8080
      - --entrypoints.health.address=:9090
      - --providers.file.filename=/etc/traefik/api.yml
      - --ping=true
      - --ping.entrypoint=health
      - --accesslog=true
      - --accesslog.format=json
      - --log.format=json
    configs:
      - source: api-load-balancer
        target: /etc/traefik/api.yml
    expose:
      - "8080"
    # Start even if a replica is unhealthy; the gateway checks /ready itself.
    depends_on:
      api:
        condition: service_started
      api-replica:
        condition: service_started
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9090/ping"]
      interval: 10s
      timeout: 3s
      retries: 3
    stop_grace_period: 20s
    logging: *service-logging

  realtime:
    image: ghcr.io/sovandara1607/unity-runn-realtime:${IMAGE_TAG:-dev-server}
    networks: [runn]
    pull_policy: always
    restart: unless-stopped
    init: true
    mem_limit: ${REALTIME_MEMORY_LIMIT:-128m}
    cpus: ${REALTIME_CPU_LIMIT:-0.25}
    pids_limit: 60
    environment:
      PORT: "8081"
      REDIS_HOST: redis
      REDIS_PORT: "6379"
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      REDIS_DB: ${REDIS_DB:-0}
      ALLOWED_ORIGINS: ${PUBLIC_APP_URL:-https://dev-server.sovandara.lol}
      NODE_OPTIONS: --max-old-space-size=${REALTIME_NODE_HEAP_MB:-96}
    expose:
      - "8081"
    depends_on:
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8081/health"]
      interval: 30s
      timeout: 3s
      retries: 5
      start_period: 10s
    logging: *service-logging

  frontend:
    image: ghcr.io/sovandara1607/unity-runn-frontend:${IMAGE_TAG:-dev-server}
    networks: [runn]
    pull_policy: always
    restart: unless-stopped
    init: true
    mem_limit: ${FRONTEND_MEMORY_LIMIT:-512m}
    cpus: ${FRONTEND_CPU_LIMIT:-0.75}
    pids_limit: 120
    environment:
      NODE_ENV: production
      HOSTNAME: 0.0.0.0
      PORT: "3000"
    expose:
      - "3000"
    depends_on:
      api-gateway:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:3000/"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s
    logging: *service-logging

volumes:
  postgres_data:
  redis_data:
  event_uploads:

networks:
  runn:

configs:
  api-load-balancer:
    file: ./deploy/traefik/api.yml