docker-compose.prod.yml

# Production-flavoured stack for a single-host deployment.
#
# Usage:
#   docker compose -f docker-compose.prod.yml --env-file .env.prod pull
#   docker compose -f docker-compose.prod.yml --env-file .env.prod up -d
#
# Required env (see .env.prod.example):
#   OPENCLOCKWORK_VERSION
#   POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB
#   DATABASE_URL  (must match the postgres credentials above)
#   JWT_SECRET, ERP_API_KEY, CRON_API_KEY, API_CORS_ORIGINS

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - openclockwork-db-data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}']
      interval: 10s
      timeout: 5s
      retries: 10

  api:
    image: ghcr.io/patrickschiller/openclockwork-api:${OPENCLOCKWORK_VERSION}
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      NODE_ENV: production
      API_PORT: 3000
      # Wall-clock timezone for core-time + off-hours reasoning.
      TZ: ${TZ:-Europe/Berlin}
      DATABASE_URL: ${DATABASE_URL}
      JWT_SECRET: ${JWT_SECRET}
      ERP_API_KEY: ${ERP_API_KEY}
      CRON_API_KEY: ${CRON_API_KEY}
      API_CORS_ORIGINS: ${API_CORS_ORIGINS}
      STORAGE_BACKEND: ${STORAGE_BACKEND:-local}
      ATTACHMENTS_DIR: ${ATTACHMENTS_DIR:-/app/data/attachments}
      AZURE_BLOB_ACCOUNT: ${AZURE_BLOB_ACCOUNT:-}
      AZURE_BLOB_CONTAINER: ${AZURE_BLOB_CONTAINER:-}
    volumes:
      - openclockwork-attachments:/app/data/attachments
    # Apply pending migrations on container start, then hand off to the API.
    # Idempotent: prisma skips already-applied migrations.
    command:
      [
        'sh',
        '-c',
        './node_modules/.bin/prisma migrate deploy && node dist/main.js',
      ]
    expose:
      - '3000'

  web:
    image: ghcr.io/patrickschiller/openclockwork-web:${OPENCLOCKWORK_VERSION}
    restart: unless-stopped
    depends_on:
      - api
    ports:
      - '${WEB_PORT:-8080}:8080'

volumes:
  openclockwork-db-data:
    name: ${OPENCLOCKWORK_DB_VOLUME:-openclockwork-db-data-prod}
  openclockwork-attachments:
    name: ${OPENCLOCKWORK_ATTACHMENTS_VOLUME:-openclockwork-attachments-prod}