docker-compose.yml

# This file is a minimal plug and play working example of a runnable OpenShock stack.
#
# Configuration lives in the .env file next to this compose file. You edit simple
# KEY=value knobs there (host, port, per-service paths, DB password, mail...). This
# file maps those onto the OPENSHOCK__* / PUBLIC_* config the containers read.
#
# Topology: the whole stack runs on ONE host (OPENSHOCK_HOST) and ONE port
# (OPENSHOCK_PORT, default 443), and the services are told apart by path:
# https://host/ -> frontend
# https://host/api/... -> api (OPENSHOCK_API_PATH)
# https://host/gateway/.. -> gateway (OPENSHOCK_GATEWAY_PATH)
# Because everything is one origin, the login cookie is shared with no extra setup.
# Each app owns its path prefix (UsePathBase); Traefik routes by PathPrefix and does
# NOT strip. Shared OPENSHOCK__* config lives in x-openshock-env, merged into each
# service; the `:-default` fallbacks keep the stack booting with almost no config.

# ---------------------------------------------------------------------------
# Shared application config. Every OpenShock service (api, cron, lcg) reads the
# same OPENSHOCK__* schema, so it is defined once here and merged into each
# service with `<<: *openshock-env`. Values come from the knobs in .env; the
# `:-default` fallbacks keep the stack booting with almost no configuration.
# The `${OPENSHOCK_PORT:+:...}` bits append ":port" only when a custom port is set,
# so default (443) deployments keep clean https://host URLs.
# ---------------------------------------------------------------------------
x-openshock-env: &openshock-env
 # Core infrastructure
 OPENSHOCK__DB__CONN: Host=db;Port=5432;Database=${PG_DB:-openshock};Username=${PG_USER:-openshock};Password=${PG_PASS}
 OPENSHOCK__REDIS__HOST: dragonfly

 # Frontend URLs — API uses them for cookies/redirects, Cron for e-mail links.
 # BASEURL/SHORTURL point at the web UI (host + optional port + frontend path).
 # COOKIEDOMAIN is the bare host; since the whole stack is one origin the login
 # cookie is shared with every service automatically.
 OPENSHOCK__FRONTEND__BASEURL: https://${OPENSHOCK_HOST:-openshock.local}${OPENSHOCK_PORT:+:${OPENSHOCK_PORT}}${OPENSHOCK_FRONTEND_PATH:-}
 OPENSHOCK__FRONTEND__SHORTURL: https://${OPENSHOCK_HOST:-openshock.local}${OPENSHOCK_PORT:+:${OPENSHOCK_PORT}}${OPENSHOCK_FRONTEND_PATH:-}
 OPENSHOCK__FRONTEND__COOKIEDOMAIN: ${OPENSHOCK_HOST:-openshock.local}

 # Feature flags
 OPENSHOCK__TURNSTILE__ENABLE: ${OPENSHOCK_TURNSTILE_ENABLE:-false}
 OPENSHOCK__ACCOUNT__REGISTRATIONENABLED: ${OPENSHOCK_REGISTRATION_ENABLED:-true}

 # E-mail (delivered by the Cron service). TYPE is required by the app; leave it
 # as None to run without outbound mail, or set MAIL_TYPE=Smtp / Mailjet in .env
 # and fill in the matching block below.
 OPENSHOCK__MAIL__TYPE: ${MAIL_TYPE:-None}
 OPENSHOCK__MAIL__SENDER__NAME: ${MAIL_SENDER_NAME:-OpenShock}
 OPENSHOCK__MAIL__SENDER__EMAIL: ${MAIL_SENDER_EMAIL:-no-reply@openshock.local}
 # SMTP (used when MAIL_TYPE=Smtp)
 OPENSHOCK__MAIL__SMTP__HOST: ${SMTP_HOST:-}
 OPENSHOCK__MAIL__SMTP__PORT: ${SMTP_PORT:-587}
 OPENSHOCK__MAIL__SMTP__USERNAME: ${SMTP_USERNAME:-}
 OPENSHOCK__MAIL__SMTP__PASSWORD: ${SMTP_PASSWORD:-}
 OPENSHOCK__MAIL__SMTP__ENABLESSL: ${SMTP_ENABLESSL:-true}
 OPENSHOCK__MAIL__SMTP__VERIFYCERTIFICATE: ${SMTP_VERIFYCERTIFICATE:-true}
 # Mailjet (used when MAIL_TYPE=Mailjet)
 OPENSHOCK__MAIL__MAILJET__KEY: ${MAILJET_KEY:-}
 OPENSHOCK__MAIL__MAILJET__SECRET: ${MAILJET_SECRET:-}

# Common scaffolding shared by the OpenShock app services.
x-openshock-svc: &openshock-svc
 restart: unless-stopped
 networks:
 - openshock
 depends_on:
 - db
 - dragonfly
 # /1/health reports whether Postgres and Dragonfly are reachable. Like /metrics it is limited to
 # OPENSHOCK__METRICS__ALLOWEDNETWORKS (private ranges by default), so it is probed from inside the
 # container; the cert is the self-signed one the entrypoint generates, hence no verification.
 # start_period covers the schema-ready wait on boot.
 healthcheck:
 test: ["CMD-SHELL", "wget --no-check-certificate -q -O /dev/null https://localhost/1/health"]
 start_period: 60s
 interval: 15s
 retries: 5
 timeout: 10s

services:

 db: # We need a postgres database, preferably version 18+
 image: postgres:18
 restart: unless-stopped
 container_name: openshock-postgres
 healthcheck:
 test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
 start_period: 20s
 interval: 30s
 retries: 5
 timeout: 5s
 networks:
 - openshock
 environment:
 POSTGRES_PASSWORD: ${PG_PASS:?database password required}
 POSTGRES_USER: ${PG_USER:-openshock}
 POSTGRES_DB: ${PG_DB:-openshock}
 volumes:
 # PG18+ mounts the parent dir (data lives in ./postgres-data/18/docker).
 - ./postgres-data:/var/lib/postgresql

 dragonfly: # Redis-compatible store. Ex = emit expired-key events (used by the app)
 image: ghcr.io/dragonflydb/dragonfly:latest
 command: "--notify_keyspace_events=Ex"
 restart: unless-stopped
 networks:
 - openshock
 volumes:
 - ./dragonfly-data:/data

 api:
 <<: *openshock-svc
 image: ghcr.io/openshock/api:${OPENSHOCK_TAG:-latest}
 environment:
 <<: *openshock-env
 # Path prefix the API is served under. Must match the PathPrefix router below.
 OPENSHOCK__API__PATHBASE: ${OPENSHOCK_API_PATH:-/api}
 labels:
 - "traefik.enable=true"
 - "traefik.http.routers.openshock-api.rule=Host(`${OPENSHOCK_HOST:-openshock.local}`) && PathPrefix(`${OPENSHOCK_API_PATH:-/api}`)"
 - "traefik.http.routers.openshock-api.entrypoints=https"
 - "traefik.http.routers.openshock-api.tls=true"
 - "traefik.http.routers.openshock-api.service=openshock-api"
 - "traefik.http.services.openshock-api.loadbalancer.server.port=80"

 frontend:
 image: ghcr.io/openshock/frontend:${OPENSHOCK_FRONTEND_TAG:-latest}
 restart: unless-stopped
 networks:
 - openshock
 environment:
 PUBLIC_SITE_NAME: OpenShock
 PUBLIC_SITE_URL: https://${OPENSHOCK_HOST:-openshock.local}${OPENSHOCK_PORT:+:${OPENSHOCK_PORT}}${OPENSHOCK_FRONTEND_PATH:-}
 PUBLIC_SITE_SHORT_URL: https://${OPENSHOCK_HOST:-openshock.local}${OPENSHOCK_PORT:+:${OPENSHOCK_PORT}}${OPENSHOCK_FRONTEND_PATH:-}
 PUBLIC_BACKEND_API_URL: https://${OPENSHOCK_HOST:-openshock.local}${OPENSHOCK_PORT:+:${OPENSHOCK_PORT}}${OPENSHOCK_API_PATH:-/api}
 # CSP connect-src allow-list for the gateway; the browser opens wss://host[:port].
 PUBLIC_GATEWAY_CSP_WILDCARD: https://${OPENSHOCK_HOST:-openshock.local}${OPENSHOCK_PORT:+:${OPENSHOCK_PORT}}
 PRIVATE_BACKEND_TLS_INSECURE: ${OPENSHOCK_FRONTEND_TLS_INSECURE:-false}
 labels:
 - "traefik.enable=true"
 # Catch-all for the host; the api/gateway/cron PathPrefix routers are more specific and win.
 - "traefik.http.routers.openshock-frontend.rule=Host(`${OPENSHOCK_HOST:-openshock.local}`)"
 - "traefik.http.routers.openshock-frontend.entrypoints=https"
 - "traefik.http.routers.openshock-frontend.tls=true"
 - "traefik.http.routers.openshock-frontend.service=openshock-frontend"
 - "traefik.http.services.openshock-frontend.loadbalancer.server.port=3000"

 lcg:
 <<: *openshock-svc
 image: ghcr.io/openshock/live-control-gateway:${OPENSHOCK_TAG:-latest}
 environment:
 <<: *openshock-env
 OPENSHOCK__LCG__COUNTRYCODE: ${OPENSHOCK_LCG_COUNTRYCODE:-DE}
 # Public address the gateway advertises to firmware & browsers. PUBLICPATH must
 # match the PathPrefix router below (the app serves under it via UsePathBase).
 OPENSHOCK__LCG__FQDN: ${OPENSHOCK_HOST:-openshock.local}
 OPENSHOCK__LCG__PUBLICPORT: ${OPENSHOCK_PORT:-443}
 OPENSHOCK__LCG__PUBLICPATH: ${OPENSHOCK_GATEWAY_PATH:-/gateway}
 labels:
 - "traefik.enable=true"
 - "traefik.http.routers.openshock-gateway.rule=Host(`${OPENSHOCK_HOST:-openshock.local}`) && PathPrefix(`${OPENSHOCK_GATEWAY_PATH:-/gateway}`)"
 - "traefik.http.routers.openshock-gateway.entrypoints=https"
 - "traefik.http.routers.openshock-gateway.tls=true"
 - "traefik.http.routers.openshock-gateway.service=openshock-gateway"
 - "traefik.http.services.openshock-gateway.loadbalancer.server.port=80"

 cron:
 <<: *openshock-svc
 image: ghcr.io/openshock/cron:${OPENSHOCK_TAG:-latest}
 environment:
 <<: *openshock-env
 labels:
 - "traefik.enable=true"
 - "traefik.http.routers.openshock-cron.rule=Host(`${OPENSHOCK_HOST:-openshock.local}`) && PathPrefix(`/hangfire`)"
 - "traefik.http.routers.openshock-cron.entrypoints=https"
 - "traefik.http.routers.openshock-cron.tls=true"
 - "traefik.http.routers.openshock-cron.service=openshock-cron"
 - "traefik.http.services.openshock-cron.loadbalancer.server.port=80"

 traefik:
 image: traefik:latest
 container_name: traefik
 command:
 #- "--log.level=DEBUG"
 - "--providers.docker=true"
 - "--providers.docker.exposedbydefault=false"
 - "--entryPoints.https.address=:443"
 #- "--api.insecure=true"
 restart: unless-stopped
 networks:
 - openshock
 ports:
 - 80:80
 # Publish the stack port (default 443) onto Traefik's https entrypoint.
 - ${OPENSHOCK_PORT:-443}:443
 #- 8080:8080 # Traefik Web UI (enabled by --api.insecure=true)
 volumes:
 - /etc/localtime:/etc/localtime:ro
 - /var/run/docker.sock:/var/run/docker.sock:ro

networks:
 openshock: