docker-compose.prod.yml

# =============================================================================
# Selfhostly Production - Separated Architecture
# =============================================================================
# Domain Separation:
#   1. Frontend (Node.js):  Static files only - no backend logic
#   2. Gateway (Go):        API routing only - no static files
#   3. Backend (Go):        API logic only - no static files
#
# Traffic Flow:
#   Internet → Cloudflared ┬→ Frontend (port 80) → Static HTML/JS/CSS
#                           └→ Gateway (port 8080) → Backend (port 8082) → API logic
#
# Usage:
#   1. Copy .env.prod.example to .env
#   2. Configure Cloudflare Tunnel ingress rules (see docs)
#   3. docker compose -f docker-compose.prod.yml up -d
# =============================================================================

services:
  # =============================================================================
  # Gateway - API Request Router
  # =============================================================================
  # Routes /api/* and /auth/* to appropriate backend nodes
  # Validates JWT tokens, manages node registry
  gateway:
    image: ghcr.io/samsonnegedu/selfhostly-gateway:latest
    container_name: selfhostly-gateway
    environment:
      # Gateway Configuration
      PRIMARY_BACKEND_URL: http://primary:8082
      GATEWAY_API_KEY: ${GATEWAY_API_KEY}
      GATEWAY_LISTEN_ADDRESS: ":8080"
      GATEWAY_REGISTRY_TTL_SEC: "60"

      # Authentication (same as backend for JWT validation)
      AUTH_ENABLED: ${AUTH_ENABLED:-true}
      JWT_SECRET: ${JWT_SECRET}
    networks:
      - selfhostly-network
    restart: unless-stopped
    depends_on:
      primary:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:8080/api/health",
        ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 40s # Give gateway time to start server and connect to primary

  # =============================================================================
  # Frontend - Static File Server (Node.js + serve)
  # =============================================================================
  # Serves web UI only - uses relative URLs for API calls
  # Cloudflare routes requests from same domain:
  #   - / → frontend:80 (static files)
  #   - /api/* → gateway:8080 (API)
  # No authentication, no database, no backend logic
  # Built from: web/Dockerfile
  frontend:
    image: ghcr.io/samsonnegedu/selfhostly-frontend:latest
    container_name: selfhostly-frontend
    networks:
      - selfhostly-network
    restart: unless-stopped
    expose:
      - "80" # Internal port only (accessed via Cloudflared)
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:80/",
        ]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 5s

  # =============================================================================
  # Primary Backend - API Server
  # =============================================================================
  # Same image as secondary, but configured as primary via NODE_IS_PRIMARY=true
  # Handles API logic, authentication, database, container orchestration
  # Not publicly exposed - accessed only via gateway
  primary:
    image: ghcr.io/samsonnegedu/selfhostly-backend:latest
    container_name: selfhostly-primary
    user: 1000:984
    environment:
      # Server Configuration
      SERVER_ADDRESS: ":8082"

      # Database
      DATABASE_PATH: /app/data/selfhostly.db
      APPS_DIR: /app/apps

      # Cloudflare (optional)
      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:-}
      CLOUDFLARE_ACCOUNT_ID: ${CLOUDFLARE_ACCOUNT_ID:-}

      # Authentication
      AUTH_ENABLED: ${AUTH_ENABLED:-true}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
      JWT_SECRET: ${JWT_SECRET}
      AUTH_BASE_URL: ${AUTH_BASE_URL:-https://selfhostly.localnest.de}
      GITHUB_ALLOWED_USERS: ${GITHUB_ALLOWED_USERS:-}
      AUTH_SECURE_COOKIE: ${AUTH_SECURE_COOKIE:-true}

      # Gateway Authentication
      GATEWAY_API_KEY: ${GATEWAY_API_KEY}

      # Node Configuration
      NODE_IS_PRIMARY: "true"
      NODE_ID: ${NODE_ID:-450359e5-52c3-47e8-a256-6ea537528a06}
      NODE_NAME: ${NODE_NAME:-primary}
      NODE_API_ENDPOINT: ${NODE_API_ENDPOINT:-http://primary:8082}
      REGISTRATION_TOKEN: ${REGISTRATION_TOKEN}
    volumes:
      - ${DATA_DIR:-./data}:/app/data
      - ${APPS_DIR:-./apps}:/app/apps
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - selfhostly-network
    restart: unless-stopped
    expose:
      - "8082" # Internal port only (not exposed to host)
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:8082/api/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # =============================================================================
  # Cloudflare Tunnel - Public Internet Access
  # =============================================================================
  # Configure ingress rules to route:
  #   - Frontend routes (/, /login, etc.) → frontend:3000
  #   - API routes (/api/*, /auth/*) → gateway:8080
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: selfhostly-cloudflared
    command: tunnel run
    environment:
      TUNNEL_TOKEN: ${TUNNEL_TOKEN:-}
    networks:
      - selfhostly-network
    restart: unless-stopped
    depends_on:
      gateway:
        condition: service_healthy

networks:
  # Core API network - must match constants.CoreAPINetwork in internal/constants/constants.go
  selfhostly-network:
    name: selfhostly-network # Use exact name, no project prefix
    driver: bridge

volumes:
  selfhostly-data:
  selfhostly-apps: