Warp/Docker/docker-compose.pocketbase.prod.yml

# Warp on PocketBase: the homeserver, the admin panel and the web client,
# each in its own container, pulled from a registry.
#
#   cd Docker
#   cp .env.pocketbase.prod.example .env      # then edit it
#   docker compose -f docker-compose.pocketbase.prod.yml up -d
#
# PocketBase is the homeserver's database, in a container of its own: Warp's
# collections, and media in PocketBase's storage, are in the pb-data volume,
# and the homeserver reaches it at http://pocketbase:8070 as the superuser
# set in .env. Set WARP_PB_S3_* in .env to keep media in an S3 bucket
# instead (docs/configuration.md).
#
# Homeserver http://localhost:8008, admin panel http://localhost:8009, web
# client http://localhost:8080.
#
# Create the first administrator once the server is up:
#
#   docker compose -f docker-compose.pocketbase.prod.yml exec warp warp create-account --username admin --admin
#
# Nothing is built here: the images come from WARP_REGISTRY (default
# 10.2.1.10:5500/admin) at tag WARP_VERSION (default latest). Pin
# WARP_VERSION to a release in production, and update with
#
#   docker compose -f docker-compose.pocketbase.prod.yml pull && docker compose -f docker-compose.pocketbase.prod.yml up -d

name: warp-pocketbase

services:
  # PocketBase, the homeserver's database: Warp's collections, and media in
  # PocketBase's storage, are in the pb-data volume. The image creates the
  # superuser from .env on its first start, and never changes it after: a
  # new password goes in through the admin UI, then into .env. The admin UI
  # is http://localhost:8070/_/ on loopback; WARP_PB_BIND=0.0.0.0 exposes
  # it, behind a reverse proxy only.
  pocketbase:
    image: ${WARP_PB_IMAGE:-tajniak81/pocketbase-docker-root:latest}
    pull_policy: always
    restart: unless-stopped
    environment:
      PB_PORT: "8070"
      PB_ADMIN_EMAIL: ${WARP_PB_SUPERUSER_EMAIL:?set WARP_PB_SUPERUSER_EMAIL in .env}
      PB_ADMIN_PASSWORD: ${WARP_PB_SUPERUSER_PASSWORD:?set WARP_PB_SUPERUSER_PASSWORD in .env}
    volumes:
      - ${WARP_PB_DATA_VOLUME:-pb-data}:/pb/pb_data
    ports:
      - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health >/dev/null || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 10s

  warp:
    image: ${WARP_REGISTRY:-10.2.1.10:5500/admin}/warp:${WARP_VERSION:-latest}
    pull_policy: always
    restart: unless-stopped
    depends_on:
      pocketbase:
        condition: service_healthy
    # The signing key is created on first start and kept in the volume:
    # losing it means other servers no longer recognise this one.
    entrypoint: ["/bin/sh", "-c"]
    command:
      - test -f /data/signing.key || warp generate-keys --output /data/signing.key; exec warp serve
    env_file: .env
    environment:
      WARP_DB_DRIVER: pocketbase
      WARP_DB_CONNECTION_STRING: http://pocketbase:8070
    volumes:
      - ${WARP_DATA_VOLUME:-warp-data}:/data
    ports:
      - "${WARP_PORT:-8008}:8008"

  admin:
    image: ${WARP_REGISTRY:-10.2.1.10:5500/admin}/warp-admin:${WARP_VERSION:-latest}
    pull_policy: always
    restart: unless-stopped
    depends_on:
      - warp
    env_file: .env
    environment:
      WARP_ADMIN_HOMESERVER: http://warp:8008
    ports:
      - "${WARP_ADMIN_PORT:-8009}:8009"

  web:
    image: ${WARP_REGISTRY:-10.2.1.10:5500/admin}/warp-web:${WARP_VERSION:-latest}
    pull_policy: always
    restart: unless-stopped
    depends_on:
      - warp
    env_file: .env
    environment:
      WARP_WEB_HOMESERVER: http://warp:8008
    ports:
      - "${WARP_WEB_PORT:-8080}:8080"

volumes:
  # The homeserver's signing key.
  warp-data:
  # PocketBase's pb_data: the database, and media unless it is in S3.
  pb-data: