docker-compose.tls.yml

# ╔══════════════════════════════════════════════════════════════════════════╗
# ║ DEPLOYMENT — TLS handled by THIS STACK, with automatic certificate renewal ║
# ╚══════════════════════════════════════════════════════════════════════════╝
#
# Use this when this server is reachable from the internet under your domain and
# you want the stack to manage the HTTPS certificate itself (you do NOT run your
# own reverse proxy). The built-in Caddy proxy obtains the certificate and renews
# it automatically before it expires.
#
# Containers: MeteorPointer-DB + MeteorPointer-API (internal) +
#             MeteorPointer-Proxy (Caddy, the only one exposed, on ports 80 + 443).
#
# Requirements:
#   - A public domain pointing to this server (e.g. api.robozor.cz).
#   - Ports 80 and 443 reachable from the internet.
#
# Steps:
#   1) cp .env.example .env  and set the "Common" + "this stack handles TLS" values:
#        DOMAIN=api.robozor.cz
#        ACME_EMAIL=you@robozor.cz     # your e-mail — turns on the real certificate
#   2) docker compose -f docker-compose.tls.yml up -d
#
#   Address to enter in the mobile app (API server URL):  https://api.robozor.cz
#
#   Logs:  docker compose -f docker-compose.tls.yml logs -f proxy
#   Stop:  docker compose -f docker-compose.tls.yml down
#
# (Quick local check without a domain: DOMAIN=localhost and an empty ACME_EMAIL
#  give a self-signed certificate at https://localhost — browsers warn, expected.)

name: meteorpointer

x-api-env: &api-env
  DJANGO_DEBUG: ${DJANGO_DEBUG:-false}
  DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:?set in .env}
  DJANGO_ALLOWED_HOSTS: ${DJANGO_ALLOWED_HOSTS:-localhost,127.0.0.1,api}
  DJANGO_CSRF_TRUSTED_ORIGINS: ${DJANGO_CSRF_TRUSTED_ORIGINS:-}
  DOMAIN: ${DOMAIN:?set DOMAIN in .env (e.g. api.robozor.cz or localhost)}
  ACME_EMAIL: ${ACME_EMAIL:-}
  JWT_SECRET: ${JWT_SECRET:?set in .env}
  POSTGRES_DB: ${POSTGRES_DB:-meteorpointer}
  POSTGRES_USER: ${POSTGRES_USER:-meteorpointer}
  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
  POSTGRES_HOST: db
  POSTGRES_PORT: 5432

services:
  db:
    image: postgres:16-alpine
    container_name: MeteorPointer-DB
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-meteorpointer}
      POSTGRES_USER: ${POSTGRES_USER:-meteorpointer}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
    volumes:
      - meteorpointer_db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-meteorpointer} -d ${POSTGRES_DB:-meteorpointer}"]
      interval: 5s
      timeout: 5s
      retries: 10
    restart: unless-stopped

  api:
    image: ghcr.io/bolidozor/meteorpointer-api:${API_TAG:-latest}
    container_name: MeteorPointer-API
    environment:
      <<: *api-env
    depends_on:
      db:
        condition: service_healthy
    expose:
      - "8000"  # internal only; reached by the proxy over the docker network
    restart: unless-stopped

  proxy:
    image: caddy:2-alpine
    container_name: MeteorPointer-Proxy
    depends_on:
      - api
    environment:
      DOMAIN: ${DOMAIN:?set DOMAIN in .env}
      # empty ACME_EMAIL -> internal self-signed CA; an email -> Let's Encrypt.
      TLS_ARG: ${ACME_EMAIL:-internal}
    ports:
      # Override PROXY_HTTP/PROXY_HTTPS (e.g. 192.168.0.49:443) to bind a
      # specific host IP when :443 is already taken by another service.
      - "${PROXY_HTTP:-80}:80"
      - "${PROXY_HTTPS:-443}:443"
    volumes:
      - ./docker/proxy/Caddyfile:/etc/caddy/Caddyfile:ro
      - meteorpointer_caddy_data:/data
      - meteorpointer_caddy_config:/config
    restart: unless-stopped

volumes:
  meteorpointer_db_data:
  meteorpointer_caddy_data:
  meteorpointer_caddy_config: