docker-compose.yml

# ---------------------------------------------------------------------------
# Ardent Forge -- Self-Hosted Docker Composition
#
# Quick start:
#   cp .env.example .env
#   ./scripts/generate-keys.sh
#   docker compose up -d
#
# See docs/self-hosting.md for the full setup guide.
# ---------------------------------------------------------------------------

networks:
  ardent-forge-net:
    driver: bridge

volumes:
  pgdata:
  caddy_data:
  caddy_config:

services:
  # -------------------------------------------------------------------------
  # PostgreSQL -- persistent data store
  # -------------------------------------------------------------------------
  db:
    image: supabase/postgres:15.8.1.060
    restart: unless-stopped
    networks:
      - ardent-forge-net
    volumes:
      - pgdata:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-postgres}
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 10s
      timeout: 5s
      retries: 5

  # -------------------------------------------------------------------------
  # Kong -- API gateway for Supabase services
  # -------------------------------------------------------------------------
  kong:
    image: kong:2.8.1
    restart: unless-stopped
    networks:
      - ardent-forge-net
    depends_on:
      db:
        condition: service_healthy
    environment:
      KONG_DATABASE: 'off'
      KONG_DECLARATIVE_CONFIG: /var/lib/kong/kong.yml
      KONG_DNS_ORDER: LAST,A,CNAME
      KONG_PLUGINS: request-transformer,cors,key-auth,acl,basic-auth
      KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
      KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
      ANON_KEY: ${ANON_KEY}
      SERVICE_ROLE_KEY: ${SERVICE_ROLE_KEY}
    volumes:
      - ./docker/kong/kong.yml:/var/lib/kong/kong.yml:ro
    healthcheck:
      test: ['CMD', 'kong', 'health']
      interval: 10s
      timeout: 5s
      retries: 5

  # -------------------------------------------------------------------------
  # GoTrue -- authentication service
  # -------------------------------------------------------------------------
  auth:
    image: supabase/gotrue:v2.175.0
    restart: unless-stopped
    networks:
      - ardent-forge-net
    depends_on:
      db:
        condition: service_healthy
      migrations:
        condition: service_completed_successfully
    environment:
      GOTRUE_API_HOST: '0.0.0.0'
      GOTRUE_API_PORT: '9999'
      API_EXTERNAL_URL: ${SITE_URL}
      GOTRUE_DB_DRIVER: postgres
      GOTRUE_DB_DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-postgres}?sslmode=disable
      GOTRUE_SITE_URL: ${SITE_URL}
      GOTRUE_URI_ALLOW_LIST: '*'
      GOTRUE_DISABLE_SIGNUP: 'false'
      GOTRUE_JWT_ADMIN_ROLES: service_role
      GOTRUE_JWT_AUD: authenticated
      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
      GOTRUE_JWT_EXP: '3600'
      GOTRUE_JWT_SECRET: ${JWT_SECRET}
      GOTRUE_EXTERNAL_EMAIL_ENABLED: 'true'
      GOTRUE_MAILER_AUTOCONFIRM: 'false'
      GOTRUE_SMTP_HOST: ${SMTP_HOST:-}
      GOTRUE_SMTP_PORT: ${SMTP_PORT:-587}
      GOTRUE_SMTP_USER: ${SMTP_USER:-}
      GOTRUE_SMTP_PASS: ${SMTP_PASS:-}
      GOTRUE_SMTP_SENDER_NAME: ${SMTP_SENDER_EMAIL:-}
      GOTRUE_EXTERNAL_GOOGLE_ENABLED: ${GOOGLE_ENABLED:-false}
      GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOTRUE_EXTERNAL_GOOGLE_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: ${SITE_URL}/auth/v1/callback
    healthcheck:
      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:9999/health']
      interval: 10s
      timeout: 5s
      retries: 5

  # -------------------------------------------------------------------------
  # PostgREST -- RESTful API over PostgreSQL
  # -------------------------------------------------------------------------
  rest:
    image: postgrest/postgrest:v12.2.8
    restart: unless-stopped
    networks:
      - ardent-forge-net
    depends_on:
      db:
        condition: service_healthy
      migrations:
        condition: service_completed_successfully
    environment:
      PGRST_DB_URI: postgres://postgres:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-postgres}
      PGRST_DB_SCHEMA: public,storage,graphql_public
      PGRST_DB_ANON_ROLE: anon
      PGRST_JWT_SECRET: ${JWT_SECRET}
      PGRST_DB_USE_LEGACY_GUCS: 'false'
    healthcheck:
      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:3000/']
      interval: 10s
      timeout: 5s
      retries: 5

  # -------------------------------------------------------------------------
  # Realtime -- WebSocket subscriptions for live updates
  # -------------------------------------------------------------------------
  realtime:
    image: supabase/realtime:v2.34.48
    restart: unless-stopped
    networks:
      - ardent-forge-net
    depends_on:
      db:
        condition: service_healthy
      migrations:
        condition: service_completed_successfully
    environment:
      PORT: '4000'
      DB_HOST: db
      DB_PORT: '5432'
      DB_USER: postgres
      DB_PASSWORD: ${POSTGRES_PASSWORD}
      DB_NAME: ${POSTGRES_DB:-postgres}
      DB_AFTER_CONNECT_QUERY: 'SET search_path TO _realtime'
      DB_ENC_KEY: ${REALTIME_DB_ENC_KEY}
      API_JWT_SECRET: ${JWT_SECRET}
      APP_NAME: realtime
      FLY_ALLOC_ID: fly123 # required by realtime image startup script; value is unused in self-hosted mode
      FLY_APP_NAME: realtime
      SECRET_KEY_BASE: ${REALTIME_SECRET_KEY_BASE}
      ERL_AFLAGS: -proto_dist inet_tcp
      ENABLE_TAILSCALE: 'false'
      DNS_NODES: "''"
      RLIMIT_NOFILE: '65536'
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:4000/']
      interval: 10s
      timeout: 5s
      retries: 5
    command: >
      sh -c "/app/bin/migrate && /app/bin/server"

  # -------------------------------------------------------------------------
  # Supabase Studio -- admin dashboard (optional)
  # Enable with: docker compose --profile studio up -d
  # Or set COMPOSE_PROFILES=studio in your .env
  # -------------------------------------------------------------------------
  studio:
    image: supabase/studio:latest
    profiles: [studio]
    restart: unless-stopped
    networks:
      - ardent-forge-net
    depends_on:
      kong:
        condition: service_healthy
    environment:
      STUDIO_PG_META_URL: http://kong:8000/pg
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      DEFAULT_ORGANIZATION_NAME: 'Ardent Forge'
      DEFAULT_PROJECT_NAME: 'ardent-forge'
      SUPABASE_URL: http://kong:8000
      SUPABASE_PUBLIC_URL: ${SITE_URL}
      SUPABASE_ANON_KEY: ${ANON_KEY}
      SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}
      AUTH_JWT_SECRET: ${JWT_SECRET}
      NEXT_PUBLIC_ENABLE_LOGS: 'false'
    healthcheck:
      test:
        [
          'CMD',
          'node',
          '-e',
          "require('http').get('http://localhost:3000/api/profile', (r) => { process.exit(r.statusCode === 200 ? 0 : 1) })",
        ]
      interval: 10s
      timeout: 5s
      retries: 5

  # -------------------------------------------------------------------------
  # Migration runner -- applies SQL schema, then exits
  # -------------------------------------------------------------------------
  migrations:
    build:
      context: .
      dockerfile: docker/migrations/Dockerfile
    networks:
      - ardent-forge-net
    depends_on:
      db:
        condition: service_healthy
    environment:
      POSTGRES_HOST: db
      POSTGRES_PORT: '5432'
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-postgres}
    restart: on-failure

  # -------------------------------------------------------------------------
  # Web app -- Vite production build served by nginx
  # -------------------------------------------------------------------------
  web:
    build:
      context: .
      dockerfile: docker/web/Dockerfile
      args:
        VITE_SUPABASE_URL: ${SITE_URL}
        VITE_SUPABASE_PUBLISHABLE_KEY: ${ANON_KEY}
    restart: unless-stopped
    networks:
      - ardent-forge-net
    depends_on:
      migrations:
        condition: service_completed_successfully
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:80/']
      interval: 30s
      timeout: 10s
      retries: 3

  # -------------------------------------------------------------------------
  # Caddy -- reverse proxy with automatic TLS
  # -------------------------------------------------------------------------
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    networks:
      - ardent-forge-net
    ports:
      - '${HTTP_PORT:-80}:${HTTP_PORT:-80}'
      - '${HTTPS_PORT:-443}:${HTTPS_PORT:-443}'
    volumes:
      - ./docker/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      web:
        condition: service_healthy
      kong:
        condition: service_healthy
    environment:
      SITE_URL: ${SITE_URL}
      ANON_KEY: ${ANON_KEY}
    healthcheck:
      test:
        [
          'CMD',
          'wget',
          '--no-verbose',
          '--tries=1',
          '--spider',
          'http://localhost:${HTTP_PORT:-80}/',
        ]
      interval: 10s
      timeout: 5s
      retries: 3