runtipi/docker-compose.prod.yml

version: '3.7'

services:
  tipi-docker-proxy:
    container_name: tipi-docker-proxy
    image: tecnativa/docker-socket-proxy
    restart: unless-stopped
    networks:
      - socket_proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      POST: 1
      CONTAINERS: 1
      ALLOW_START: 1
      ALLOW_STOP: 1
      IMAGES: 1
      NETWORKS: 1

  tipi-reverse-proxy:
    container_name: tipi-reverse-proxy
    depends_on:
      - tipi-docker-proxy
      - tipi-dashboard
    image: traefik:v2.11
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    command: --providers.docker
    volumes:
      - ./traefik:/root/.config
      - ./traefik/shared:/shared
    networks:
      - tipi_main_network
      - socket_proxy

  tipi-db:
    container_name: tipi-db
    image: postgres:14
    restart: unless-stopped
    stop_grace_period: 1m
    volumes:
      - pgdata:/var/lib/postgresql/data
    ports:
      - 5432:5432
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_USER: tipi
      POSTGRES_DB: tipi
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -d tipi -U tipi']
      interval: 5s
      timeout: 10s
      retries: 120
    networks:
      - tipi_main_network

  tipi-redis:
    container_name: tipi-redis
    image: redis:7.2.0
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD}
    ports:
      - 6379:6379
    volumes:
      - redisdata:/data
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
      interval: 5s
      timeout: 10s
      retries: 120
    networks:
      - tipi_main_network

  tipi-worker:
    build:
      context: .
      dockerfile: ./packages/worker/Dockerfile
      args:
        - SENTRY_DISABLE_AUTO_UPLOAD=true
        - TIPI_VERSION=0.0.0
    container_name: tipi-worker
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:3000/worker-api/healthcheck']
      interval: 5s
      timeout: 10s
      retries: 120
      start_period: 5s
    depends_on:
      tipi-db:
        condition: service_healthy
      tipi-redis:
        condition: service_healthy
      tipi-docker-proxy:
        condition: service_started
    env_file:
      - .env
    environment:
      NODE_ENV: production
      TIPI_VERSION: 0.0.0
      DOCKER_HOST: tcp://tipi-docker-proxy:2375
    volumes:
      - /proc:/host/proc
      - ./.env:/app/.env
      - ./state:/app/state
      - ./repos:/app/repos
      - ./apps:/app/apps
      - ./logs:/app/logs
      - ./traefik:/app/traefik
      - ./user-config:/app/user-config
      - ${STORAGE_PATH:-.}:/storage
    networks:
      - tipi_main_network
      - socket_proxy
    labels:
      traefik.enable: true
      traefik.http.services.worker.loadbalancer.server.port: 3001
      traefik.http.services.worker-api.loadbalancer.server.port: 3000
      traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: https
      # Local ip
      traefik.http.routers.worker.rule: PathPrefix("/worker")
      traefik.http.routers.worker.service: worker
      traefik.http.routers.worker.entrypoints: web
      traefik.http.routers.worker-api.rule: PathPrefix("/worker-api")
      traefik.http.routers.worker-api.service: worker-api
      traefik.http.routers.worker-api.entrypoints: web
      # Local domain
      traefik.http.routers.worker-local-insecure.rule: Host(`${LOCAL_DOMAIN}`) && PathPrefix("/worker")
      traefik.http.routers.worker-local-insecure.entrypoints: web
      traefik.http.routers.worker-local-insecure.service: worker
      traefik.http.routers.worker-local-insecure.middlewares: redirect-to-https
      traefik.http.routers.worker-api-local-insecure.rule: Host(`${LOCAL_DOMAIN}`) && PathPrefix("/worker-api")
      traefik.http.routers.worker-api-local-insecure.entrypoints: web
      traefik.http.routers.worker-api-local-insecure.service: worker-api
      traefik.http.routers.worker-api-local-insecure.middlewares: redirect-to-https
      # secure
      traefik.http.routers.worker-local.rule: Host(`${LOCAL_DOMAIN}`) && PathPrefix("/worker")
      traefik.http.routers.worker-local.entrypoints: websecure
      traefik.http.routers.worker-local.tls: true
      traefik.http.routers.worker-local.service: worker
      traefik.http.routers.worker-api-local.rule: Host(`${LOCAL_DOMAIN}`) && PathPrefix("/worker-api")
      traefik.http.routers.worker-api-local.entrypoints: websecure
      traefik.http.routers.worker-api-local.tls: true

  tipi-dashboard:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        - SENTRY_DISABLE_AUTO_UPLOAD=true
        - TIPI_VERSION=0.0.0
    container_name: tipi-dashboard
    depends_on:
      tipi-db:
        condition: service_healthy
      tipi-redis:
        condition: service_healthy
      tipi-worker:
        condition: service_healthy
    env_file:
      - .env
    environment:
      NODE_ENV: production
      TIPI_VERSION: 0.0.0
    networks:
      - tipi_main_network
    ports:
      - 3000:3000
    volumes:
      - ./.env:/runtipi/.env:ro
      - ./state:/runtipi/state
      - ./repos:/runtipi/repos:ro
      - ./apps:/runtipi/apps
      - ./logs:/app/logs
      - ./traefik:/runtipi/traefik
      - ${STORAGE_PATH:-.}:/app/storage
    labels:
      traefik.enable: true
      traefik.http.services.dashboard.loadbalancer.server.port: 3000
      traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: https
      # Local ip
      traefik.http.routers.dashboard.rule: PathPrefix("/")
      traefik.http.routers.dashboard.service: dashboard
      traefik.http.routers.dashboard.entrypoints: web
      # Local domain
      traefik.http.routers.dashboard-local-insecure.rule: Host(`${LOCAL_DOMAIN}`)
      traefik.http.routers.dashboard-local-insecure.entrypoints: web
      traefik.http.routers.dashboard-local-insecure.service: dashboard
      traefik.http.routers.dashboard-local-insecure.middlewares: redirect-to-https
      # secure
      traefik.http.routers.dashboard-local.rule: Host(`${LOCAL_DOMAIN}`)
      traefik.http.routers.dashboard-local.entrypoints: websecure
      traefik.http.routers.dashboard-local.tls: true
      traefik.http.routers.dashboard-local.service: dashboard

networks:
  tipi_main_network:
    driver: bridge
    name: runtipi_tipi_main_network
  socket_proxy:
    name: runtipi_socket_proxy

volumes:
  pgdata:
  redisdata: