docker-compose.coolify.yml

services:
  # 1. Frontend (declared first for Coolify's Compose parser)
  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
      args:
        NODE_IMAGE: ${NEBULYNK_NODE_IMAGE:-node:22.23.1-alpine3.24}
        NGINX_IMAGE: ${NEBULYNK_NGINX_IMAGE:-nginxinc/nginx-unprivileged:1.31-alpine3.23@sha256:6320020c7da8714feab524e02c08c5a1958675c4e68700e93a2fd8970b065786}
        # These URLs are baked into frontend build output
        VITE_API_URL: ${SERVICE_URL_BACKEND}
        VITE_LIVEKIT_URL: ${SERVICE_URL_LIVEKIT}
        VITE_VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
        VITE_AUTH_CSRF_COOKIE_NAME: ${AUTH_CSRF_COOKIE_NAME:-nebulynk_csrf_token}
    depends_on:
      - backend
    restart: always

  # 2. Database (reachable internally as 'postgres')
  postgres:
    image: ${NEBULYNK_POSTGRES_IMAGE:-postgres:17-alpine3.24@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193}
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-nebulynk}
      POSTGRES_USER: ${POSTGRES_USER:-nebulynk}
      # Existing explicit values win. Fresh Coolify resources receive a
      # persistent, editable generated secret instead.
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-${SERVICE_PASSWORD_64_POSTGRES}}
    volumes:
      - nebulynk_postgres_data:/var/lib/postgresql/data
    restart: always

  # 3. Cache (reachable internally as 'redis')
  redis:
    image: ${NEBULYNK_REDIS_IMAGE:-redis:7.4.7-alpine3.21}
    volumes:
      - nebulynk_redis_data:/data
    restart: always

  # 4. Prepare persistent Garage volumes for the unprivileged Garage process.
  garage-volume-init:
    image: alpine:3.21.5
    user: "0:0"
    command: ["sh", "-ec", "chown -R 65532:65532 /var/lib/garage/meta /var/lib/garage/data"]
    volumes:
      - nebulynk_garage_meta:/var/lib/garage/meta
      - nebulynk_garage_data:/var/lib/garage/data
    restart: "no"

  # 5. Object storage (S3, Garage default)
  garage:
    build:
      context: .
      dockerfile: garage.Dockerfile
      args:
        GARAGE_IMAGE: ${NEBULYNK_GARAGE_IMAGE:-dxflrs/garage:v2.3.0}
    depends_on:
      garage-volume-init:
        condition: service_completed_successfully
    command: /garage server --single-node --default-bucket
    environment:
      GARAGE_RPC_SECRET: ${GARAGE_RPC_SECRET:-${SERVICE_HEX_64_GARAGERPC}}
      GARAGE_DEFAULT_ACCESS_KEY: ${STORAGE_S3_ACCESS_KEY:-${SERVICE_USER_S3}}
      GARAGE_DEFAULT_SECRET_KEY: ${STORAGE_S3_SECRET_KEY:-${SERVICE_PASSWORD_64_S3}}
      GARAGE_DEFAULT_BUCKET: ${STORAGE_S3_BUCKET:-nebulynk-files}
    volumes:
      - nebulynk_garage_meta:/var/lib/garage/meta
      - nebulynk_garage_data:/var/lib/garage/data
    expose:
      - "3900" # S3 endpoint, published only through the Coolify proxy
    restart: always

  # 6. LiveKit server (voice/video)
  livekit:
    build:
      context: .
      dockerfile: livekit.Dockerfile
      args:
        LIVEKIT_SERVER_IMAGE: ${NEBULYNK_LIVEKIT_SERVER_IMAGE:-livekit/livekit-server:v1.13.4}
    command: --config /livekit.yaml
    expose:
      - "7880" # API/signalling, published only through the Coolify proxy
    ports:
      - "7881:7881" # TCP
      - "7882:7882/udp" # WebRTC UDP, matching livekit.yaml
    environment:
      LIVEKIT_KEYS: "${LIVEKIT_API_KEY:-${SERVICE_USER_LIVEKIT}}: ${LIVEKIT_API_SECRET:-${SERVICE_PASSWORD_64_LIVEKIT}}"
    restart: always

  livekit-egress:
    build:
      context: .
      dockerfile: livekit-egress.Dockerfile
      args:
        LIVEKIT_EGRESS_IMAGE: ${NEBULYNK_LIVEKIT_EGRESS_IMAGE:-livekit/egress:v1.13.0}
    command: --config /livekit-egress.yaml
    environment:
      EGRESS_CONFIG_FILE: /livekit-egress.yaml
      # Keep these as the single source of truth. Do not duplicate LiveKit
      # credentials or ws_url inside livekit-egress.yaml.
      LIVEKIT_API_KEY: ${LIVEKIT_API_KEY:-${SERVICE_USER_LIVEKIT}}
      LIVEKIT_API_SECRET: ${LIVEKIT_API_SECRET:-${SERVICE_PASSWORD_64_LIVEKIT}}
      LIVEKIT_WS_URL: ${LIVEKIT_WS_URL:-ws://livekit:7880}
      AWS_ACCESS_KEY_ID: ${STORAGE_S3_ACCESS_KEY:-${SERVICE_USER_S3}}
      AWS_SECRET_ACCESS_KEY: ${STORAGE_S3_SECRET_KEY:-${SERVICE_PASSWORD_64_S3}}
      AWS_DEFAULT_REGION: ${STORAGE_S3_REGION:-${MEETING_RECORDINGS_S3_REGION:-us-east-1}}
    depends_on:
      - livekit
      - redis
      - garage
    restart: always

  # 7. Backend API
  backend:
    build:
      context: .
      dockerfile: backend/Dockerfile
      args:
        NODE_IMAGE: ${NEBULYNK_NODE_IMAGE:-node:22.23.1-alpine3.24}
    environment:
      NODE_ENV: production
      # Required production secrets. Backend startup rejects missing or placeholder
      # auth/storage/LiveKit secrets, and AI provider secrets should use a
      # dedicated encryption key instead of falling back to auth.
      JWT_SECRET: ${JWT_SECRET:-${SERVICE_PASSWORD_64_JWT}}
      AI_SECRET_KEY: ${AI_SECRET_KEY:-${SERVICE_PASSWORD_64_AI}}
      # Optional dedicated key for encrypting stored two-factor secrets.
      AUTH_2FA_SECRET_KEY: ${AUTH_2FA_SECRET_KEY:-}
      BACKEND_PORT: ${BACKEND_PORT:-3030}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      MAX_FILE_SIZE: ${MAX_FILE_SIZE:-26214400}
      AUTHENTICATION_RATE_LIMIT_IP_LIMIT: ${AUTHENTICATION_RATE_LIMIT_IP_LIMIT:-}
      AUTH_BROWSER_ACCESS_TOKEN_TTL: ${AUTH_BROWSER_ACCESS_TOKEN_TTL:-15m}
      AUTH_REFRESH_TOKEN_TTL: ${AUTH_REFRESH_TOKEN_TTL:-1d}
      AUTH_REMEMBER_REFRESH_TOKEN_TTL: ${AUTH_REMEMBER_REFRESH_TOKEN_TTL:-30d}
      AUTH_REFRESH_COOKIE_NAME: ${AUTH_REFRESH_COOKIE_NAME:-nebulynk_refresh_session}
      AUTH_CSRF_COOKIE_NAME: ${AUTH_CSRF_COOKIE_NAME:-nebulynk_csrf_token}
      AUTH_COOKIE_DOMAIN: ${AUTH_COOKIE_DOMAIN:-}
      RATE_LIMIT_DRIVER: ${RATE_LIMIT_DRIVER:-redis}
      PASSKEY_RP_ID: ${PASSKEY_RP_ID:-${SERVICE_FQDN_FRONTEND}}
      AI_PROVIDER_BASE_URL_ALLOWLIST: ${AI_PROVIDER_BASE_URL_ALLOWLIST:-}
      # Internal communication in Docker network
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_DB: ${POSTGRES_DB:-nebulynk}
      POSTGRES_USER: ${POSTGRES_USER:-nebulynk}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-${SERVICE_PASSWORD_64_POSTGRES}}
      REDIS_HOST: redis
      # S3-compatible storage (Garage by default)
      STORAGE_S3_ENDPOINT: "http://garage:3900"
      # Signed file URLs must target the S3/API public endpoint.
      STORAGE_S3_PUBLIC_ENDPOINT: ${STORAGE_S3_PUBLIC_ENDPOINT:-${SERVICE_URL_GARAGE}}
      STORAGE_S3_ACCESS_KEY: ${STORAGE_S3_ACCESS_KEY:-${SERVICE_USER_S3}}
      STORAGE_S3_SECRET_KEY: ${STORAGE_S3_SECRET_KEY:-${SERVICE_PASSWORD_64_S3}}
      STORAGE_S3_BUCKET: ${STORAGE_S3_BUCKET:-nebulynk-files}
      STORAGE_S3_REGION: ${STORAGE_S3_REGION:-${MEETING_RECORDINGS_S3_REGION:-us-east-1}}
      MEETING_RECORDINGS_PREFIX: meeting-recordings
      MEETING_RECORDINGS_BUCKET: ${STORAGE_S3_BUCKET:-nebulynk-files}
      MEETING_RECORDINGS_S3_ENDPOINT: "http://garage:3900"
      MEETING_RECORDINGS_EGRESS_S3_ENDPOINT: "http://garage:3900"
      MEETING_RECORDINGS_S3_REGION: ${STORAGE_S3_REGION:-${MEETING_RECORDINGS_S3_REGION:-us-east-1}}
      MEETING_TRANSCRIPT_WAIT_TIMEOUT_MS: ${MEETING_TRANSCRIPT_WAIT_TIMEOUT_MS:-120000}
      # LiveKit
      LIVEKIT_HOST: "http://livekit:7880"
      LIVEKIT_PUBLIC_URL: ${LIVEKIT_PUBLIC_URL:-${SERVICE_URL_LIVEKIT}}
      LIVEKIT_API_KEY: ${LIVEKIT_API_KEY:-${SERVICE_USER_LIVEKIT}}
      LIVEKIT_API_SECRET: ${LIVEKIT_API_SECRET:-${SERVICE_PASSWORD_64_LIVEKIT}}
      # KLIPY GIF API
      KLIPY_API_KEY: ${KLIPY_API_KEY}
      # Web Push (optional)
      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
      VAPID_SUBJECT: ${VAPID_SUBJECT:-mailto:admin@example.com}
      # E-Mail (optional)
      SMTP_HOST: ${SMTP_HOST}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_SECURE: ${SMTP_SECURE:-false}
      SMTP_IGNORE_TLS: ${SMTP_IGNORE_TLS:-false}
      SMTP_USER: ${SMTP_USER}
      SMTP_PASS: ${SMTP_PASS}
      SMTP_FROM: ${SMTP_FROM:-noreply@nebulynk.local}
      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-Nebulynk}
      # URL for CORS
      FRONTEND_URL: ${FRONTEND_URL:-${SERVICE_URL_FRONTEND}}
      # Coolify terminates TLS upstream, so backend cookies must trust forwarded https metadata.
      TRUST_PROXY: ${TRUST_PROXY:-true}
      # Coolify exposes the immutable source revision at runtime. Official
      # update verification keys are embedded in the Nebulynk release.
      NEBULYNK_BUILD_SHA: ${SOURCE_COMMIT:-}
    depends_on:
      - postgres
      - redis
      - garage
      - livekit
      - livekit-egress
    restart: always

volumes:
  nebulynk_postgres_data:
  nebulynk_redis_data:
  nebulynk_garage_meta:
  nebulynk_garage_data: