notifyd/docker-compose.yml at main · rmzlb/notifyd · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
# notifyd — production docker-compose (Dokploy-ready)
#
# This compose is dual-purpose:
#   - LOCAL DEV: just `docker compose up`, defaults below cover everything.
#     Override DATABASE_URL etc. via a sibling .env file if needed.
#   - DOKPLOY: provide POSTGRES_PASSWORD, ADMIN_API_KEY, JWT_SECRET,
#     RESEND_API_KEY, EMAIL_FROM via the platform UI/API.
#
# notifyd reads config from env vars when /app/notifyd.toml is absent
# (see src/config.rs `from_env`). We deliberately don't mount a TOML so
# the same image works across environments without a config file.
#
# IMPORTANT: notifyd's SSE inbox uses an in-memory broadcast channel
# (tokio::sync::broadcast). DO NOT scale horizontally — pin replicas: 1.

services:
  notifyd:
    build:
      context: .
      dockerfile: Dockerfile
    environment:
      # Required ------------------------------------------------------------
      DATABASE_URL: postgres://notifyd:${POSTGRES_PASSWORD:-notifyd}@notifyd-db:5432/notifyd
      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET (random 32+ chars, used to sign subscriber JWTs)}
      ADMIN_API_KEY: ${ADMIN_API_KEY:?set ADMIN_API_KEY (random 32+ chars, gates /v1/admin/*)}

      # Email connector (Resend) -------------------------------------------
      RESEND_API_KEY: ${RESEND_API_KEY:-}
      EMAIL_FROM: ${EMAIL_FROM:-bonjour@craie.ctrlnz.com}
      EMAIL_FROM_NAME: ${EMAIL_FROM_NAME:-Craie}

      # Web Push / PWA connector ------------------------------------------
      FCM_SERVER_KEY: ${FCM_SERVER_KEY:-}
      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:-}
      VAPID_PRIVATE_KEY_PEM: ${VAPID_PRIVATE_KEY_PEM:-}
      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
      VAPID_SUBJECT: ${VAPID_SUBJECT:-mailto:ops@yourdomain.com}

      # CORS for browsers calling /v1/inbox/*/stream ------------------------
      CORS_ORIGINS: ${CORS_ORIGINS:-https://maisoncraie.com,https://www.maisoncraie.com,https://craie.ctrlnz.com,https://helmai.ai,https://www.helmai.ai}

      # Optional -----------------------------------------------------------
      PORT: "3400"
      RUST_LOG: ${RUST_LOG:-notifyd=info}
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:3400/v1/health | grep -q '\"status\":\"ok\"' || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    depends_on:
      notifyd-db:
        condition: service_healthy
    networks:
      default: {}
      dokploy-network:
        aliases: [notifyd]
    restart: unless-stopped
    deploy:
      replicas: 1   # SSE in-memory; do NOT scale horizontally without LISTEN/NOTIFY rework

  notifyd-db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: notifyd
      POSTGRES_USER: notifyd
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-notifyd}
    volumes:
      - notifyd_pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U notifyd -d notifyd"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    restart: unless-stopped

networks:
  # `default` is the per-stack bridge auto-created by compose; notifyd and
  # its DB use it to talk privately. `dokploy-network` is the shared
  # Traefik/swarm overlay — joining it lets neighbouring stacks (e.g.
  # craie-api) reach notifyd at http://notifyd:3400 via the alias above.
  dokploy-network:
    external: true

volumes:
  notifyd_pgdata: