keycast/docker-compose.synvya.yml at synvya-staging · Synvya/keycast · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
services:
  postgres:
    image: postgres:16
    container_name: keycast-postgres
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?error}
      POSTGRES_DB: keycast
      POSTGRES_USER: postgres
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped
    networks:
      - synvya

  redis:
    image: redis:7-alpine
    container_name: keycast-redis
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped
    networks:
      - synvya

  migrate:
    build:
      context: ./database
      dockerfile: Dockerfile
    container_name: keycast-migrate
    environment:
      DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD:?error}@postgres:5432/keycast
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - synvya
    restart: "no"

  keycast:
    container_name: keycast
    build:
      context: .
      args:
        - CARGO_FEATURES=aws
    ports:
      - "3000:3000"
    environment:
      DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD:?error}@postgres:5432/keycast
      REDIS_URL: redis://redis:6379
      SERVER_NSEC: ${SERVER_NSEC:?error}
      BUNKER_RELAYS: ${BUNKER_RELAYS:?error}
      ALLOWED_ORIGINS: ${ALLOWED_ORIGINS:?error}
      ALLOWED_PUBKEYS: ${ALLOWED_PUBKEYS:-}
      PORT: 3000
      NODE_ENV: production
      RUST_LOG: ${RUST_LOG:-info}
      # AWS KMS
      KMS_PROVIDER: aws
      AWS_KMS_KEY_ID: ${AWS_KMS_KEY_ID:?error}
      AWS_REGION: ${AWS_REGION:-us-east-1}
      # AWS SES
      EMAIL_PROVIDER: ses
      FROM_EMAIL: ${FROM_EMAIL:[email protected]}
      FROM_NAME: ${FROM_NAME:-Synvya}
      BASE_URL: ${BASE_URL:?error}
      APP_URL: ${APP_URL:?error}
      INVITE_BASE_URL: ${INVITE_BASE_URL:?error}
      # Synvya hosts the password reset page on a different domain
      # (account.synvya.com / account.staging.synvya.com) from the auth host.
      PASSWORD_RESET_BASE_URL: ${PASSWORD_RESET_BASE_URL:?error}
      # Synvya Admin lives on a separate host. The post-claim success page
      # in the keycast claim flow links to this URL so newly-onboarded
      # admins land directly on admin.synvya.com (or staging equivalent).
      ADMIN_BASE_URL: ${ADMIN_BASE_URL:?error}
      DISABLE_EMAILS:
      # Frontend
      VITE_DOMAIN: ${VITE_DOMAIN:-}
      VITE_ALLOWED_PUBKEYS: ${VITE_ALLOWED_PUBKEYS:-}
      VITE_NDK_EXPLICIT_RELAYS: ${VITE_NDK_EXPLICIT_RELAYS:-}
      VITE_NDK_BUNKER_RELAYS: ${VITE_NDK_BUNKER_RELAYS:-}
      # Performance
      SQLX_POOL_SIZE: ${SQLX_POOL_SIZE:-10}
      # Disable keycast web UI in Synvya deployments — users manage identity
      # via Synvya, not via keycast. See issue #24.
      DISABLE_WEB_UI: ${DISABLE_WEB_UI:-true}
      WEB_UI_REDIRECT_URL: ${WEB_UI_REDIRECT_URL:-https://www.synvya.com}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s
    restart: unless-stopped
    networks:
      - synvya


volumes:
  postgres_data:

networks:
  synvya: