Warp/Docker/docker-compose.pocketbase.seaweedfs.prod.yml

# Warp on PocketBase with media in SeaweedFS: the homeserver, the admin panel
# and the web client pulled from a registry, plus SeaweedFS as one
# container (`weed server -s3`: master, volume, filer and S3 gateway in one
# process).
#
#   cd Docker
#   cp .env.pocketbase.seaweedfs.prod.example .env      # then edit it
#   docker compose -f docker-compose.pocketbase.seaweedfs.prod.yml up -d
#
# The database stays in /data/pb_data (warp-data); media goes to the bucket
# WARP_PB_S3_BUCKET (default warp) in SeaweedFS (seaweed-data), whose gateway
# has exactly one identity: the homeserver's. For SeaweedFS's admin UI and
# per-role containers, see docker-compose.pocketbase.seaweedfs.split.yml.
# Media stored before S3 was on is not moved into the bucket.
#
# Homeserver http://localhost:8008, admin panel http://localhost:8009, web
# client http://localhost:8080. The S3 gateway (8333) is published on
# loopback, for aws-cli and the like; SEAWEED_S3_BIND=0.0.0.0 exposes it.
#
# This file shares its project and volumes with
# docker-compose.pocketbase.seaweedfs.split.yml: SeaweedFS's data has the
# same layout either way, so switching between the two needs no migration.
#
# Create the first administrator once the server is up:
#
#   docker compose -f docker-compose.pocketbase.seaweedfs.prod.yml exec warp warp create-account --username admin --admin
#
# Nothing is built here: the homeserver, admin panel and web client images
# come from WARP_REGISTRY (default ghcr.io/dariuszjaniak) at tag
# WARP_VERSION (default latest), and SeaweedFS from SEAWEED_IMAGE. Pin
# WARP_VERSION to a release in production, and update with
#
#   docker compose -f docker-compose.pocketbase.seaweedfs.prod.yml pull && docker compose -f docker-compose.pocketbase.seaweedfs.prod.yml up -d

name: warp-pocketbase-seaweedfs

services:
  seaweedfs:
    image: ${SEAWEED_IMAGE:-chrislusf/seaweedfs:4.45}
    restart: unless-stopped
    command: server -dir=/data -s3 -volume.max=0 -master.volumeSizeLimitMB=1024
    environment:
      # With no -s3.config, the gateway takes its single identity from these,
      # which is also what takes it out of its allow-anyone default. The same
      # pair the homeserver signs with.
      AWS_ACCESS_KEY_ID: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
      AWS_SECRET_ACCESS_KEY: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env}
    volumes:
      - seaweed-data:/data
    ports:
      # For aws-cli and the like; the homeserver uses the compose network.
      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
    healthcheck:
      # The gateway answering means master, volume and filer are up too.
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz >/dev/null || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 12
      start_period: 20s

  # Runs once per start and exits. The homeserver never creates its bucket;
  # creating one that exists is a no-op.
  seaweedfs-init:
    image: ${SEAWEED_IMAGE:-chrislusf/seaweedfs:4.45}
    restart: "no"
    depends_on:
      seaweedfs:
        condition: service_healthy
    environment:
      WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
    entrypoint: ["/bin/sh", "-c"]
    command:
      - echo "s3.bucket.create -name $$WARP_PB_S3_BUCKET" | weed shell -master=seaweedfs:9333 >/dev/null

  warp:
    image: ${WARP_REGISTRY:-ghcr.io/dariuszjaniak}/warp:${WARP_VERSION:-latest}
    pull_policy: always
    restart: unless-stopped
    depends_on:
      seaweedfs:
        condition: service_healthy
      seaweedfs-init:
        condition: service_completed_successfully
    # The signing key is created on first start and kept in the volume:
    # losing it means other servers no longer recognise this one.
    entrypoint: ["/bin/sh", "-c"]
    command:
      - test -f /data/signing.key || warp generate-keys --output /data/signing.key; exec warp serve
    env_file: .env
    environment:
      WARP_DB_DRIVER: pocketbase
      WARP_DB_CONNECTION_STRING: /data/pb_data
      # The gateway on the compose network; these override whatever .env
      # says about S3.
      WARP_PB_S3_ENABLED: "true"
      WARP_PB_S3_ENDPOINT: http://seaweedfs:8333
      WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
      WARP_PB_S3_REGION: us-east-1   # SeaweedFS ignores it; the client wants one
      WARP_PB_S3_FORCE_PATH_STYLE: "true"
      WARP_PB_S3_ACCESS_KEY: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
      WARP_PB_S3_SECRET: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env}
    volumes:
      - warp-data:/data
    ports:
      - "${WARP_PORT:-8008}:8008"

  admin:
    image: ${WARP_REGISTRY:-ghcr.io/dariuszjaniak}/warp-admin:${WARP_VERSION:-latest}
    pull_policy: always
    restart: unless-stopped
    depends_on:
      - warp
    env_file: .env
    environment:
      WARP_ADMIN_HOMESERVER: http://warp:8008
    ports:
      - "${WARP_ADMIN_PORT:-8009}:8009"

  web:
    image: ${WARP_REGISTRY:-ghcr.io/dariuszjaniak}/warp-web:${WARP_VERSION:-latest}
    pull_policy: always
    restart: unless-stopped
    depends_on:
      - warp
    env_file: .env
    environment:
      WARP_WEB_HOMESERVER: http://warp:8008
    ports:
      - "${WARP_WEB_PORT:-8080}:8080"

volumes:
  warp-data:
  seaweed-data: