docker-compose.yml

# Keep the Compose project name stable across checkout-directory and deployment-platform names. Alloy
# uses the same value below to restrict Docker log discovery to this Kanera deployment.
name: ${COMPOSE_PROJECT_NAME:-kanera}

services:
  postgres:
    image: postgres:18-alpine
    restart: unless-stopped
    # pg_stat_statements must be loaded at server start via shared_preload_libraries; CREATE EXTENSION
    # alone is not enough. track=top records top-level statements (not every nested statement) to keep
    # overhead low. The extension itself is created in docker/postgres/init.sql.
    command:
      - "postgres"
      - "-c"
      - "shared_preload_libraries=pg_stat_statements"
      - "-c"
      - "pg_stat_statements.track=top"
    environment:
      POSTGRES_USER: kanera
      POSTGRES_PASSWORD: kanera
      POSTGRES_DB: kanera
      PGDATA: /var/lib/postgresql/18/docker
    volumes:
      - kanera_pgdata:/var/lib/postgresql
      - ./docker/postgres/init.sql:/docker-entrypoint-initdb.d/00-init.sql:ro,Z
    ports:
      - "${POSTGRES_BIND_IP:-127.0.0.1}:${POSTGRES_BIND_PORT:-5433}:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -p 5432 -U kanera -d kanera"]
      interval: 5s
      timeout: 3s
      retries: 10

  valkey:
    image: valkey/valkey:9.1.0-alpine
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

  # One-shot schema migration. drizzle's migrator takes no advisory lock, so letting every scaled
  # `api` replica run `start:migrate` would race the same DDL on each deploy (crash-loops until one
  # wins). Instead this runs to completion once; api/worker/public-api gate on it via
  # service_completed_successfully and never serve traffic before the schema is ready. On a deploy
  # with no pending migrations it is a fast no-op. Carries only the env drizzle/env validation needs.
  migrate:
    restart: "no"
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    command: ["pnpm", "db:migrate"]
    environment:
      NODE_ENV: production
      DATABASE_URL: postgres://kanera:kanera@postgres:5432/kanera
      REDIS_URL: redis://valkey:6379/0
      DATABASE_SSL: ${DATABASE_SSL:-false}
      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env}
      MEDIA_SIGNING_SECRET: ${MEDIA_SIGNING_SECRET:?set MEDIA_SIGNING_SECRET in .env}
      KANERA_DEPLOYMENT_MODE: ${KANERA_DEPLOYMENT_MODE:-self_hosted}
      SIGNUPS_ENABLED: ${SIGNUPS_ENABLED:-true}
      EMAIL_VERIFICATION_ENABLED: ${EMAIL_VERIFICATION_ENABLED:-false}
      CLOUDFLARE_TURNSTILE_SITE_KEY: ${CLOUDFLARE_TURNSTILE_SITE_KEY:-}
      CLOUDFLARE_TURNSTILE_SECRET_KEY: ${CLOUDFLARE_TURNSTILE_SECRET_KEY:-}
      # Required by env validation only when KANERA_DEPLOYMENT_MODE=hosted; harmless otherwise.
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
      STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:-}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
      STRIPE_PRICE_ID_PRO_MONTHLY: ${STRIPE_PRICE_ID_PRO_MONTHLY:-}
      STRIPE_PRICE_ID_PRO_ANNUAL: ${STRIPE_PRICE_ID_PRO_ANNUAL:-}
    depends_on:
      postgres:
        condition: service_healthy

  api:
    restart: unless-stopped
    # Compose reads this on every deploy/redeploy, so Dokploy keeps the desired
    # API process count without a separate post-deploy `--scale api=N` command.
    scale: ${API_REPLICAS:-2}
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    # Migrations run once in the dedicated `migrate` service (see depends_on); replicas just start.
    command: ["pnpm", "start"]
    environment:
      NODE_ENV: production
      API_PORT: 3000
      API_TRUST_PROXY: ${API_TRUST_PROXY:-false}
      DATABASE_URL: postgres://kanera:kanera@postgres:5432/kanera
      REDIS_URL: redis://valkey:6379/0
      DATABASE_SSL: ${DATABASE_SSL:-false}
      # Capacity tuning. The bundled production Compose default is 20; set PG_POOL_MAX
      # in .env to override it. See "Performance tuning" in DEPLOY.md before raising it.
      NODE_OPTIONS: ${NODE_OPTIONS:-}
      UV_THREADPOOL_SIZE: ${UV_THREADPOOL_SIZE:-16}
      PG_POOL_MAX: ${PG_POOL_MAX:-20}
      PG_CONNECTION_TIMEOUT_MS: ${PG_CONNECTION_TIMEOUT_MS:-5000}
      PG_STATEMENT_TIMEOUT_MS: ${PG_STATEMENT_TIMEOUT_MS:-30000}
      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env}
      MEDIA_SIGNING_SECRET: ${MEDIA_SIGNING_SECRET:?set MEDIA_SIGNING_SECRET in .env}
      SECRETS_ENCRYPTION_KEY: ${SECRETS_ENCRYPTION_KEY:-}
      JWT_ACCESS_TTL: ${JWT_ACCESS_TTL:-15m}
      JWT_REFRESH_TTL_DAYS: ${JWT_REFRESH_TTL_DAYS:-30}
      API_PUBLIC_URL: ${API_PUBLIC_URL:-${WEB_ORIGIN}}
      WEB_ORIGIN: ${WEB_ORIGIN:?set WEB_ORIGIN in .env}
      COOKIE_DOMAIN: ${COOKIE_DOMAIN:?set COOKIE_DOMAIN in .env}
      COOKIE_SECURE: ${COOKIE_SECURE:?set COOKIE_SECURE in .env}
      KANERA_ENVIRONMENT: ${KANERA_ENVIRONMENT:-production}
      KANERA_DEPLOYMENT_MODE: ${KANERA_DEPLOYMENT_MODE:-self_hosted}
      SIGNUPS_ENABLED: ${SIGNUPS_ENABLED:-true}
      EMAIL_VERIFICATION_ENABLED: ${EMAIL_VERIFICATION_ENABLED:-false}
      CLOUDFLARE_TURNSTILE_SITE_KEY: ${CLOUDFLARE_TURNSTILE_SITE_KEY:-}
      CLOUDFLARE_TURNSTILE_SECRET_KEY: ${CLOUDFLARE_TURNSTILE_SECRET_KEY:-}
      ATTACHMENT_MAX_BYTES: ${ATTACHMENT_MAX_BYTES:-104857600}
      HOSTED_FREE_ATTACHMENT_MAX_BYTES: ${HOSTED_FREE_ATTACHMENT_MAX_BYTES:-5242880}
      HOSTED_FREE_STORAGE_QUOTA_BYTES: ${HOSTED_FREE_STORAGE_QUOTA_BYTES:-1073741824}
      HOSTED_PAID_STORAGE_QUOTA_BYTES: ${HOSTED_PAID_STORAGE_QUOTA_BYTES:-214748364800}
      HOSTED_PRO_PRICE_MONTHLY_CENTS: ${HOSTED_PRO_PRICE_MONTHLY_CENTS:-400}
      HOSTED_PRO_PRICE_ANNUAL_CENTS: ${HOSTED_PRO_PRICE_ANNUAL_CENTS:-300}
      HOSTED_FREE_MAX_WORKSPACES: ${HOSTED_FREE_MAX_WORKSPACES:-1}
      HOSTED_FREE_MAX_BOARDS: ${HOSTED_FREE_MAX_BOARDS:-3}
      HOSTED_FREE_MAX_ORG_MEMBERS: ${HOSTED_FREE_MAX_ORG_MEMBERS:-5}
      HOSTED_FREE_MAX_ENABLED_AUTOMATIONS: ${HOSTED_FREE_MAX_ENABLED_AUTOMATIONS:-1}
      HOSTED_TRIAL_DAYS: ${HOSTED_TRIAL_DAYS:-30}
      HOSTED_TRIAL_DEFAULT_SEATS: ${HOSTED_TRIAL_DEFAULT_SEATS:-5}
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
      STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:-}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
      STRIPE_PRICE_ID_PRO_MONTHLY: ${STRIPE_PRICE_ID_PRO_MONTHLY:-}
      STRIPE_PRICE_ID_PRO_ANNUAL: ${STRIPE_PRICE_ID_PRO_ANNUAL:-}
      UPLOADS_DIR: /data/uploads
      S3_ENDPOINT: ${S3_ENDPOINT:-}
      S3_REGION: ${S3_REGION:-}
      S3_BUCKET: ${S3_BUCKET:-}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-}
      S3_PUBLIC_URL_PREFIX: ${S3_PUBLIC_URL_PREFIX:-}
      SLOW_REQUEST_LOG_MS: ${SLOW_REQUEST_LOG_MS:-2500}
      METRICS_ENABLED: ${METRICS_ENABLED:-true}
      METRICS_TOKEN: ${METRICS_TOKEN:-}
      REALTIME_WEBSOCKET_COMPRESSION_ENABLED: ${REALTIME_WEBSOCKET_COMPRESSION_ENABLED:-true}
      REALTIME_WEBSOCKET_COMPRESSION_THRESHOLD_BYTES: ${REALTIME_WEBSOCKET_COMPRESSION_THRESHOLD_BYTES:-1024}
      OPS_ALERTS_ENABLED: ${OPS_ALERTS_ENABLED:-true}
      OPS_ALERT_THROTTLE_MS: ${OPS_ALERT_THROTTLE_MS:-300000}
      ALERT_WEBHOOK_URL: ${ALERT_WEBHOOK_URL:-}
      GITHUB_APP_ID: ${GITHUB_APP_ID:-}
      GITHUB_APP_SLUG: ${GITHUB_APP_SLUG:-}
      GITHUB_APP_PRIVATE_KEY: ${GITHUB_APP_PRIVATE_KEY:-}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_SECURITY: ${SMTP_SECURITY:-starttls}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL:-}
      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-Kanera}
      SMTP_IDENTITY_DOMAIN: ${SMTP_IDENTITY_DOMAIN:-}
      INTERNAL_NOTIFICATION_EMAILS: ${INTERNAL_NOTIFICATION_EMAILS:-}
      SUPERADMIN_EMAILS: ${SUPERADMIN_EMAILS:-}
      SUPPORT_SESSION_TTL_MINUTES: ${SUPPORT_SESSION_TTL_MINUTES:-60}
    volumes:
      - kanera_uploads:/data/uploads
    depends_on:
      migrate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3000/health >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 20s
    expose:
      - "3000"
    # The realtime server holds one file descriptor per connected WebSocket. The default
    # container limit (often 1024) caps concurrent clients far below this app's capacity;
    # raise it so the socket count, not the FD limit, is the ceiling. See DEPLOY.md.
    ulimits:
      nofile:
        soft: 1048576
        hard: 1048576

  # Run exactly ONE worker. It owns all schedulers (digests, overdue, trial-expiry, cleanups,
  # email/push queues) plus the realtime outbox dispatcher and presence reaper. The outbox dispatcher
  # is concurrency-safe (FOR UPDATE SKIP LOCKED), but the schedulers are not — a second replica would
  # double-send emails and notifications. Do not `--scale worker`. See DEPLOY.md "Scaling".
  worker:
    restart: unless-stopped
    # Pinned to one instance (same `scale` convention as `api`). Do not raise this.
    scale: 1
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    command: ["pnpm", "start:worker"]
    environment:
      NODE_ENV: production
      WORKER_PORT: 3003
      DATABASE_URL: postgres://kanera:kanera@postgres:5432/kanera
      REDIS_URL: redis://valkey:6379/0
      DATABASE_SSL: ${DATABASE_SSL:-false}
      NODE_OPTIONS: ${NODE_OPTIONS:-}
      UV_THREADPOOL_SIZE: ${UV_THREADPOOL_SIZE:-16}
      PG_POOL_MAX: ${WORKER_PG_POOL_MAX:-5}
      WORKER_PG_POOL_MAX: ${WORKER_PG_POOL_MAX:-5}
      PG_CONNECTION_TIMEOUT_MS: ${PG_CONNECTION_TIMEOUT_MS:-5000}
      PG_STATEMENT_TIMEOUT_MS: ${PG_STATEMENT_TIMEOUT_MS:-30000}
      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env}
      MEDIA_SIGNING_SECRET: ${MEDIA_SIGNING_SECRET:?set MEDIA_SIGNING_SECRET in .env}
      SECRETS_ENCRYPTION_KEY: ${SECRETS_ENCRYPTION_KEY:-}
      JWT_ACCESS_TTL: ${JWT_ACCESS_TTL:-15m}
      JWT_REFRESH_TTL_DAYS: ${JWT_REFRESH_TTL_DAYS:-30}
      API_PUBLIC_URL: ${API_PUBLIC_URL:-${WEB_ORIGIN}}
      WEB_ORIGIN: ${WEB_ORIGIN:?set WEB_ORIGIN in .env}
      COOKIE_DOMAIN: ${COOKIE_DOMAIN:?set COOKIE_DOMAIN in .env}
      COOKIE_SECURE: ${COOKIE_SECURE:?set COOKIE_SECURE in .env}
      KANERA_ENVIRONMENT: ${KANERA_ENVIRONMENT:-production}
      KANERA_DEPLOYMENT_MODE: ${KANERA_DEPLOYMENT_MODE:-self_hosted}
      SIGNUPS_ENABLED: ${SIGNUPS_ENABLED:-true}
      EMAIL_VERIFICATION_ENABLED: ${EMAIL_VERIFICATION_ENABLED:-false}
      CLOUDFLARE_TURNSTILE_SITE_KEY: ${CLOUDFLARE_TURNSTILE_SITE_KEY:-}
      CLOUDFLARE_TURNSTILE_SECRET_KEY: ${CLOUDFLARE_TURNSTILE_SECRET_KEY:-}
      ATTACHMENT_MAX_BYTES: ${ATTACHMENT_MAX_BYTES:-104857600}
      HOSTED_FREE_ATTACHMENT_MAX_BYTES: ${HOSTED_FREE_ATTACHMENT_MAX_BYTES:-5242880}
      HOSTED_FREE_STORAGE_QUOTA_BYTES: ${HOSTED_FREE_STORAGE_QUOTA_BYTES:-1073741824}
      HOSTED_PAID_STORAGE_QUOTA_BYTES: ${HOSTED_PAID_STORAGE_QUOTA_BYTES:-214748364800}
      HOSTED_PRO_PRICE_MONTHLY_CENTS: ${HOSTED_PRO_PRICE_MONTHLY_CENTS:-400}
      HOSTED_PRO_PRICE_ANNUAL_CENTS: ${HOSTED_PRO_PRICE_ANNUAL_CENTS:-300}
      HOSTED_FREE_MAX_WORKSPACES: ${HOSTED_FREE_MAX_WORKSPACES:-1}
      HOSTED_FREE_MAX_BOARDS: ${HOSTED_FREE_MAX_BOARDS:-3}
      HOSTED_FREE_MAX_ORG_MEMBERS: ${HOSTED_FREE_MAX_ORG_MEMBERS:-5}
      HOSTED_FREE_MAX_ENABLED_AUTOMATIONS: ${HOSTED_FREE_MAX_ENABLED_AUTOMATIONS:-1}
      HOSTED_TRIAL_DAYS: ${HOSTED_TRIAL_DAYS:-30}
      HOSTED_TRIAL_DEFAULT_SEATS: ${HOSTED_TRIAL_DEFAULT_SEATS:-5}
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
      STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:-}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
      STRIPE_PRICE_ID_PRO_MONTHLY: ${STRIPE_PRICE_ID_PRO_MONTHLY:-}
      STRIPE_PRICE_ID_PRO_ANNUAL: ${STRIPE_PRICE_ID_PRO_ANNUAL:-}
      UPLOADS_DIR: /data/uploads
      S3_ENDPOINT: ${S3_ENDPOINT:-}
      S3_REGION: ${S3_REGION:-}
      S3_BUCKET: ${S3_BUCKET:-}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-}
      S3_PUBLIC_URL_PREFIX: ${S3_PUBLIC_URL_PREFIX:-}
      SLOW_REQUEST_LOG_MS: ${SLOW_REQUEST_LOG_MS:-2500}
      METRICS_ENABLED: ${METRICS_ENABLED:-true}
      METRICS_TOKEN: ${METRICS_TOKEN:-}
      OPS_ALERTS_ENABLED: ${OPS_ALERTS_ENABLED:-true}
      OPS_ALERT_THROTTLE_MS: ${OPS_ALERT_THROTTLE_MS:-300000}
      ALERT_WEBHOOK_URL: ${ALERT_WEBHOOK_URL:-}
      GITHUB_APP_ID: ${GITHUB_APP_ID:-}
      GITHUB_APP_SLUG: ${GITHUB_APP_SLUG:-}
      GITHUB_APP_PRIVATE_KEY: ${GITHUB_APP_PRIVATE_KEY:-}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_SECURITY: ${SMTP_SECURITY:-starttls}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL:-}
      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-Kanera}
      SMTP_IDENTITY_DOMAIN: ${SMTP_IDENTITY_DOMAIN:-}
      INTERNAL_NOTIFICATION_EMAILS: ${INTERNAL_NOTIFICATION_EMAILS:-}
      SUPERADMIN_EMAILS: ${SUPERADMIN_EMAILS:-}
      SUPPORT_SESSION_TTL_MINUTES: ${SUPPORT_SESSION_TTL_MINUTES:-60}
    volumes:
      - kanera_uploads:/data/uploads
    depends_on:
      migrate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3003/health >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 20s
    expose:
      - "3003"

  public-api:
    restart: unless-stopped
    scale: ${PUBLIC_API_REPLICAS:-1}
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    command: ["pnpm", "start:public-api"]
    environment:
      NODE_ENV: production
      API_PORT: 3000
      PUBLIC_API_PORT: 3001
      PUBLIC_API_RATE_LIMIT_ENABLED: ${PUBLIC_API_RATE_LIMIT_ENABLED:-true}
      PUBLIC_API_IP_RATE_LIMIT_PER_MINUTE: ${PUBLIC_API_IP_RATE_LIMIT_PER_MINUTE:-60}
      PUBLIC_API_FAILED_KEY_RATE_LIMIT_PER_MINUTE: ${PUBLIC_API_FAILED_KEY_RATE_LIMIT_PER_MINUTE:-10}
      PUBLIC_API_KEY_RATE_LIMIT_PER_MINUTE: ${PUBLIC_API_KEY_RATE_LIMIT_PER_MINUTE:-400}
      PUBLIC_API_UPLOAD_RATE_LIMIT_PER_MINUTE: ${PUBLIC_API_UPLOAD_RATE_LIMIT_PER_MINUTE:-30}
      PUBLIC_API_RATE_LIMIT_WINDOW_MS: ${PUBLIC_API_RATE_LIMIT_WINDOW_MS:-60000}
      PUBLIC_API_TRUST_PROXY: ${PUBLIC_API_TRUST_PROXY:-false}
      DATABASE_URL: postgres://kanera:kanera@postgres:5432/kanera
      REDIS_URL: redis://valkey:6379/0
      DATABASE_SSL: ${DATABASE_SSL:-false}
      # Each public-api process keeps its own DB pool; size it like the app api. See DEPLOY.md.
      NODE_OPTIONS: ${NODE_OPTIONS:-}
      UV_THREADPOOL_SIZE: ${UV_THREADPOOL_SIZE:-16}
      PG_POOL_MAX: ${PG_POOL_MAX:-20}
      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env}
      MEDIA_SIGNING_SECRET: ${MEDIA_SIGNING_SECRET:?set MEDIA_SIGNING_SECRET in .env}
      SECRETS_ENCRYPTION_KEY: ${SECRETS_ENCRYPTION_KEY:-}
      JWT_ACCESS_TTL: ${JWT_ACCESS_TTL:-15m}
      JWT_REFRESH_TTL_DAYS: ${JWT_REFRESH_TTL_DAYS:-30}
      API_PUBLIC_URL: ${API_PUBLIC_URL:-${WEB_ORIGIN}}
      WEB_ORIGIN: ${WEB_ORIGIN:?set WEB_ORIGIN in .env}
      COOKIE_DOMAIN: ${COOKIE_DOMAIN:?set COOKIE_DOMAIN in .env}
      COOKIE_SECURE: ${COOKIE_SECURE:?set COOKIE_SECURE in .env}
      KANERA_ENVIRONMENT: ${KANERA_ENVIRONMENT:-production}
      KANERA_DEPLOYMENT_MODE: ${KANERA_DEPLOYMENT_MODE:-self_hosted}
      SIGNUPS_ENABLED: ${SIGNUPS_ENABLED:-true}
      EMAIL_VERIFICATION_ENABLED: ${EMAIL_VERIFICATION_ENABLED:-false}
      CLOUDFLARE_TURNSTILE_SITE_KEY: ${CLOUDFLARE_TURNSTILE_SITE_KEY:-}
      CLOUDFLARE_TURNSTILE_SECRET_KEY: ${CLOUDFLARE_TURNSTILE_SECRET_KEY:-}
      ATTACHMENT_MAX_BYTES: ${ATTACHMENT_MAX_BYTES:-104857600}
      HOSTED_FREE_ATTACHMENT_MAX_BYTES: ${HOSTED_FREE_ATTACHMENT_MAX_BYTES:-5242880}
      HOSTED_FREE_STORAGE_QUOTA_BYTES: ${HOSTED_FREE_STORAGE_QUOTA_BYTES:-1073741824}
      HOSTED_PAID_STORAGE_QUOTA_BYTES: ${HOSTED_PAID_STORAGE_QUOTA_BYTES:-214748364800}
      HOSTED_PRO_PRICE_MONTHLY_CENTS: ${HOSTED_PRO_PRICE_MONTHLY_CENTS:-400}
      HOSTED_PRO_PRICE_ANNUAL_CENTS: ${HOSTED_PRO_PRICE_ANNUAL_CENTS:-300}
      HOSTED_FREE_MAX_WORKSPACES: ${HOSTED_FREE_MAX_WORKSPACES:-1}
      HOSTED_FREE_MAX_BOARDS: ${HOSTED_FREE_MAX_BOARDS:-3}
      HOSTED_FREE_MAX_ORG_MEMBERS: ${HOSTED_FREE_MAX_ORG_MEMBERS:-5}
      HOSTED_FREE_MAX_ENABLED_AUTOMATIONS: ${HOSTED_FREE_MAX_ENABLED_AUTOMATIONS:-1}
      HOSTED_TRIAL_DAYS: ${HOSTED_TRIAL_DAYS:-30}
      HOSTED_TRIAL_DEFAULT_SEATS: ${HOSTED_TRIAL_DEFAULT_SEATS:-5}
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
      STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:-}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
      STRIPE_PRICE_ID_PRO_MONTHLY: ${STRIPE_PRICE_ID_PRO_MONTHLY:-}
      STRIPE_PRICE_ID_PRO_ANNUAL: ${STRIPE_PRICE_ID_PRO_ANNUAL:-}
      UPLOADS_DIR: /data/uploads
      S3_ENDPOINT: ${S3_ENDPOINT:-}
      S3_REGION: ${S3_REGION:-}
      S3_BUCKET: ${S3_BUCKET:-}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-}
      S3_PUBLIC_URL_PREFIX: ${S3_PUBLIC_URL_PREFIX:-}
      SLOW_REQUEST_LOG_MS: ${SLOW_REQUEST_LOG_MS:-2500}
      METRICS_ENABLED: ${METRICS_ENABLED:-true}
      METRICS_TOKEN: ${METRICS_TOKEN:-}
      OPS_ALERTS_ENABLED: ${OPS_ALERTS_ENABLED:-true}
      OPS_ALERT_THROTTLE_MS: ${OPS_ALERT_THROTTLE_MS:-300000}
      ALERT_WEBHOOK_URL: ${ALERT_WEBHOOK_URL:-}
      GITHUB_APP_ID: ${GITHUB_APP_ID:-}
      GITHUB_APP_SLUG: ${GITHUB_APP_SLUG:-}
      GITHUB_APP_PRIVATE_KEY: ${GITHUB_APP_PRIVATE_KEY:-}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_SECURITY: ${SMTP_SECURITY:-starttls}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL:-}
      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-Kanera}
      SMTP_IDENTITY_DOMAIN: ${SMTP_IDENTITY_DOMAIN:-}
      INTERNAL_NOTIFICATION_EMAILS: ${INTERNAL_NOTIFICATION_EMAILS:-}
      SUPERADMIN_EMAILS: ${SUPERADMIN_EMAILS:-}
      SUPPORT_SESSION_TTL_MINUTES: ${SUPPORT_SESSION_TTL_MINUTES:-60}
    volumes:
      - kanera_uploads:/data/uploads
    depends_on:
      migrate:
        condition: service_completed_successfully
      api:
        condition: service_healthy
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3001/health >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 20s
    expose:
      - "3001"

  mcp:
    restart: unless-stopped
    scale: ${MCP_REPLICAS:-1}
    build:
      context: .
      dockerfile: apps/mcp/Dockerfile
    environment:
      NODE_ENV: production
      KANERA_PUBLIC_API_URL: http://public-api:3001
      MCP_PORT: 3002
      MCP_SERVER_PUBLIC_URL: ${MCP_SERVER_PUBLIC_URL:-}
    depends_on:
      api:
        condition: service_healthy
      public-api:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3002/health >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 10s
    expose:
      - "3002"

  db-backup:
    restart: unless-stopped
    build:
      context: .
      dockerfile: docker/db-backup/Dockerfile
    environment:
      NODE_ENV: production
      DATABASE_URL: ${DATABASE_URL:-postgres://kanera:kanera@postgres:5432/kanera}
      DB_BACKUPS_ENABLED: ${DB_BACKUPS_ENABLED:-false}
      DB_BACKUP_TIMES_UTC: ${DB_BACKUP_TIMES_UTC:-00:15,12:15,16:45}
      DB_BACKUP_RETENTION_DAYS: ${DB_BACKUP_RETENTION_DAYS:-14}
      DB_BACKUP_S3_BUCKET: ${DB_BACKUP_S3_BUCKET:-${S3_BUCKET:-}}
      DB_BACKUP_S3_PREFIX: ${DB_BACKUP_S3_PREFIX:-backups/postgres}
      DB_BACKUP_S3_ENDPOINT: ${DB_BACKUP_S3_ENDPOINT:-${S3_ENDPOINT:-}}
      DB_BACKUP_ENCRYPTION_PASSPHRASE: ${DB_BACKUP_ENCRYPTION_PASSPHRASE:-}
      AWS_ACCESS_KEY_ID: ${DB_BACKUP_S3_ACCESS_KEY_ID:-${S3_ACCESS_KEY_ID:-}}
      AWS_SECRET_ACCESS_KEY: ${DB_BACKUP_S3_SECRET_ACCESS_KEY:-${S3_SECRET_ACCESS_KEY:-}}
      AWS_DEFAULT_REGION: ${DB_BACKUP_S3_REGION:-${S3_REGION:-}}
    depends_on:
      postgres:
        condition: service_healthy

  web:
    restart: unless-stopped
    build:
      context: .
      dockerfile: apps/web/Dockerfile
    depends_on:
      api:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1/health >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 10s
    expose:
      - "80"

  # ---------------------------------------------------------------------------
  # Monitoring stack. All services below are gated behind the `monitoring` Compose
  # profile, so plain `docker compose up` and `pnpm dev` never start them. Enable by
  # setting COMPOSE_PROFILES=monitoring (in .env or the Dokploy environment tab).
  # Everything here is internal-only (expose, not ports) except Grafana, which you
  # attach a Dokploy domain to. See DEPLOY.md / DOKPLOY_DEPLOY.md "Monitoring".
  # ---------------------------------------------------------------------------

  prometheus:
    image: prom/prometheus:v3.12.0
    restart: unless-stopped
    profiles: ["monitoring"]
    # Runs as root so it can both write the scrape token file and own the TSDB volume without a
    # separate chown step. The token is written to a file (not embedded in prometheus.yml) so the
    # secret never lives in the repo; scrape jobs reference it via authorization.credentials_file.
    user: root
    entrypoint:
      - /bin/sh
      - -c
      - |
        if [ -z "$${METRICS_TOKEN}" ]; then
          echo 'METRICS_TOKEN must be set when the monitoring profile is enabled' >&2
          exit 1
        fi
        printf '%s' "$${METRICS_TOKEN}" > /etc/prometheus/metrics_token
        exec /bin/prometheus \
          --config.file=/etc/prometheus/prometheus.yml \
          --storage.tsdb.path=/prometheus \
          --storage.tsdb.retention.time=$${PROMETHEUS_RETENTION:-30d} \
          --storage.tsdb.retention.size=$${PROMETHEUS_RETENTION_SIZE:-5GB} \
          --web.enable-lifecycle
    environment:
      METRICS_TOKEN: ${METRICS_TOKEN:-}
      # Whichever limit is hit first wins. retention.size is a hard disk ceiling for the TSDB: Prometheus
      # drops the oldest blocks once exceeded, so the metrics volume cannot grow unbounded.
      PROMETHEUS_RETENTION: ${PROMETHEUS_RETENTION:-30d}
      PROMETHEUS_RETENTION_SIZE: ${PROMETHEUS_RETENTION_SIZE:-5GB}
    volumes:
      # :Z relabels for SELinux hosts (e.g. Fedora) so the container can read the bind-mounted config;
      # a no-op on non-SELinux hosts. Same convention as the postgres init.sql mount.
      - ./docker/monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro,Z
      - kanera_prometheus_data:/prometheus
    expose:
      - "9090"
    # Published on the WireGuard (wg0) host IP so the Prometheus UI (targets, ad-hoc queries) is
    # reachable over the internal VPN. Defaults to loopback until MONITORING_BIND_IP is set; never
    # bind monitoring UIs to 0.0.0.0 in production. Same convention as the postgres service.
    ports:
      - "${MONITORING_BIND_IP:-127.0.0.1}:${PROMETHEUS_BIND_PORT:-9090}:9090"
    depends_on:
      - api

  grafana:
    image: grafana/grafana:13.0.2
    restart: unless-stopped
    profiles: ["monitoring"]
    environment:
      # Use a default so Compose can parse this file without monitoring vars set.
      # The service only starts when COMPOSE_PROFILES=monitoring, at which point a
      # strong password should be set; the placeholder locks the account to a known
      # value so it's obvious if the var was accidentally omitted.
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-changeme-set-GRAFANA_ADMIN_PASSWORD}
      GF_USERS_ALLOW_SIGN_UP: "false"
      # Same Slack-compatible alert webhook the app's ops alerts use, fed to Grafana's provisioned
      # contact point. Delivered via Grafana's Slack integration, which Slack, Zulip's slack_incoming,
      # Mattermost, etc. all accept.
      # Grafana 13 rejects an empty Slack URL during provisioning. Require a real destination rather
      # than silently sending every firing notification to a dead loopback endpoint.
      ALERT_WEBHOOK_URL: ${ALERT_WEBHOOK_URL:?set ALERT_WEBHOOK_URL in .env when monitoring is enabled}
      # Grafana 13 preinstalls several optional exploration plugins by default. This stack only uses
      # built-in Prometheus/Loki support, so avoid unpinned downloads and extra startup work.
      GF_PLUGINS_PREINSTALL_DISABLED: "true"
      # Set when serving Grafana under a subpath; for a dedicated subdomain leave default.
      GF_SERVER_ROOT_URL: ${GRAFANA_ROOT_URL:-}
    volumes:
      - ./docker/monitoring/grafana/provisioning:/etc/grafana/provisioning:ro,Z
      - ./docker/monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro,Z
      - kanera_grafana_data:/var/lib/grafana
    expose:
      - "3000"
    # Published on the WireGuard (wg0) host IP so the dashboards are reachable over the internal VPN
    # without any public domain. Set MONITORING_BIND_IP to the server's wg0 address; until then it
    # stays on 127.0.0.1 (loopback only). Never bind this to 0.0.0.0 in production.
    ports:
      - "${MONITORING_BIND_IP:-127.0.0.1}:${GRAFANA_BIND_PORT:-3000}:3000"
    depends_on:
      - prometheus
      - loki

  loki:
    image: grafana/loki:3.7.3
    restart: unless-stopped
    profiles: ["monitoring"]
    command: ["-config.file=/etc/loki/local-config.yaml"]
    volumes:
      - ./docker/monitoring/loki-config.yml:/etc/loki/local-config.yaml:ro,Z
      - kanera_loki_data:/loki
    expose:
      - "3100"

  alloy:
    image: grafana/alloy:v1.17.0
    restart: unless-stopped
    profiles: ["monitoring"]
    command:
      - "run"
      - "--server.http.listen-addr=0.0.0.0:12345"
      - "--storage.path=/var/lib/alloy/data"
      - "/etc/alloy/config.alloy"
    environment:
      # Docker discovery is host-wide. Set this explicitly when a deployment platform assigns a
      # project name other than the repository default so unrelated containers are never ingested.
      KANERA_COMPOSE_PROJECT: ${COMPOSE_PROJECT_NAME:-kanera}
    volumes:
      - ./docker/monitoring/alloy/config.alloy:/etc/alloy/config.alloy:ro,Z
      # Read-only access to the Docker socket so Alloy can discover containers and tail their logs.
      # No :z/:Z here — never relabel the host's shared Docker socket.
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - kanera_alloy_data:/var/lib/alloy/data
    expose:
      - "12345"
    depends_on:
      - loki

  postgres-exporter:
    image: quay.io/prometheuscommunity/postgres-exporter:v0.19.1
    restart: unless-stopped
    profiles: ["monitoring"]
    environment:
      DATA_SOURCE_NAME: ${POSTGRES_EXPORTER_DSN:-postgresql://kanera:kanera@postgres:5432/kanera?sslmode=disable}
      # Hide Postgres system databases from dashboards — only the app database is relevant.
      PG_EXPORTER_EXCLUDE_DATABASES: template0,template1,postgres
      PG_EXPORTER_EXTEND_QUERY_PATH: /etc/postgres-exporter/queries.yml
    volumes:
      - ./docker/monitoring/postgres-queries.yml:/etc/postgres-exporter/queries.yml:ro,Z
    expose:
      - "9187"
    depends_on:
      postgres:
        condition: service_healthy

  cadvisor:
    # cAdvisor releases moved from gcr.io to GHCR starting with v0.53.0.
    image: ghcr.io/google/cadvisor:v0.60.3
    restart: unless-stopped
    profiles: ["monitoring"]
    # cAdvisor needs broad read access to the host's cgroup/container state for per-container CPU/mem.
    privileged: true
    command:
      # Prometheus scrapes every 15 seconds, so one-second container housekeeping only adds overhead.
      # Preserve cAdvisor's default metric families so existing/community dashboards remain compatible.
      - "--docker_only=true"
      - "--housekeeping_interval=15s"
      - "--max_housekeeping_interval=30s"
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    expose:
      - "8080"

  node-exporter:
    image: prom/node-exporter:v1.11.1
    restart: unless-stopped
    profiles: ["monitoring"]
    command:
      - "--path.rootfs=/host"
    pid: host
    volumes:
      - /:/host:ro,rslave
    expose:
      - "9100"

  redis-exporter:
    image: oliver006/redis_exporter:v1.86.0
    restart: unless-stopped
    profiles: ["monitoring"]
    environment:
      REDIS_ADDR: ${REDIS_URL:-redis://valkey:6379}
    expose:
      - "9121"
    depends_on:
      valkey:
        condition: service_healthy

volumes:
  kanera_pgdata:
  kanera_uploads:
  kanera_prometheus_data:
  kanera_grafana_data:
  kanera_loki_data:
  kanera_alloy_data: