docker-compose.yml

services:
  postgres:
    image: pgvector/pgvector:pg18
    restart: unless-stopped
    environment:
      POSTGRES_DB: imcodes
      POSTGRES_USER: imcodes
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U imcodes -d imcodes"]
      interval: 5s
      timeout: 5s
      retries: 5

  server:
    image: ghcr.io/im4codes/imcodes:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:19138:19138"
    environment:
      DATABASE_URL: "postgresql://imcodes:${POSTGRES_PASSWORD}@postgres:5432/imcodes"
      JWT_SIGNING_KEY: "${JWT_SIGNING_KEY}"
      NODE_ENV: production
      PORT: "19138"
      SERVER_URL: "https://${DOMAIN}"
      ALLOWED_ORIGINS: "https://${DOMAIN}"
      WEBAUTHN_RP_ID: "${WEBAUTHN_RP_ID:-${DOMAIN}}"
      DEFAULT_ADMIN_PASSWORD: "${DEFAULT_ADMIN_PASSWORD:-}"
      TRUSTED_PROXIES: "127.0.0.1,172.16.0.0/12,10.0.0.0/8,192.168.0.0/16"
      GITHUB_CLIENT_ID: "${GITHUB_CLIENT_ID:-}"
      GITHUB_CLIENT_SECRET: "${GITHUB_CLIENT_SECRET:-}"
      # Point retention at the named volume below. Unset, the store defaults to
      # <IMCODES_NODE_EXE_DIR>/versions, which lives in the image and is lost on
      # every image replacement.
      IMCODES_NODE_EXE_VERSION_DIR: /var/lib/imcodes/node-exe-versions
      # Other public https origins of THIS deployment (a proxy domain next to DOMAIN), comma separated. Controlled nodes
      # learn them from their authenticated connection and fall back to them when the address they were enrolled with is
      # blocked. A node sends its credential to every listed origin it connects to, so every listed origin MUST reach this
      # same server, pass WebSocket upgrades on /api/server/<id>/ws and keep the ?serverId= routing.
      # Empty = advertise nothing (a node keeps using only its enrolled address).
      IMCODES_PUBLIC_URLS: "${IMCODES_PUBLIC_URLS:-}"
    volumes:
      - node_exe_versions:/var/lib/imcodes/node-exe-versions
    labels:
      - com.centurylinklabs.watchtower.scope=imcodes
    depends_on:
      postgres:
        condition: service_healthy

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - server

  watchtower:
    image: nickfedor/watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      WATCHTOWER_POLL_INTERVAL: 300
      WATCHTOWER_CLEANUP: "true"
      WATCHTOWER_SCOPE: imcodes
    labels:
      - com.centurylinklabs.watchtower.scope=imcodes
    command: --scope imcodes

volumes:
  pgdata:
  caddy_data:
  caddy_config:
  # Retained superseded controlled-node artifacts. Declared explicitly so an
  # upgrade neither renames nor drops it, and kept separate from the image's
  # /app/controlled-node-executables so a new image cannot overwrite retained
  # bytes. Without it, replacing the Server image destroys every retained
  # version and every install code minted against one.
  node_exe_versions: