docker-compose.simple.yml

# Jackpoll — single-host self-host stack (plain `docker compose`).
#
# This is the SIMPLE self-host path: one machine, published host ports, no
# Traefik and no external Swarm secrets. It runs the published GHCR images for
# the frontend + backend plus Postgres, MinIO, Keycloak, Redis and Mailpit.
#
# For a multi-node / TLS / Traefik deployment use docker-compose.swarm.yml
# (Docker Swarm). See SELF_HOSTING.md for the full step-by-step.
#
# Quick start:
#   cp .env.simple.example .env
#   # edit .env and set strong values for every *_PASSWORD / *_SECRET
#   docker compose -f docker-compose.simple.yml up -d
#   # open http://localhost:3000
#
# All secrets are read from .env as plain environment variables — the backend
# accepts them directly (no *_FILE indirection needed on a single host).

x-restart: &restart unless-stopped

services:
  frontend:
    image: ${FRONTEND_IMAGE:-ghcr.io/jackpoll-org/frontend:latest}
    restart: *restart
    environment:
      NODE_ENV: production
      # The Next server (proxy + Server Components) reaches the backend over the
      # compose network. The browser always uses the same-origin /api proxy.
      NEXT_PUBLIC_API_URL: http://backend:8080
      COLLAB_ENABLED: ${COLLAB_ENABLED:-false}
      LIVE_RESULTS_ENABLED: ${LIVE_RESULTS_ENABLED:-true}
    ports:
      - "${FRONTEND_PORT:-3000}:3000"
    depends_on:
      backend:
        condition: service_healthy
    networks: [internal]

  backend:
    image: ${BACKEND_IMAGE:-ghcr.io/jackpoll-org/backend:latest}
    restart: *restart
    environment:
      DB_HOST: postgres
      DB_PORT: "5432"
      DB_NAME: ${DB_NAME:-survey}
      DB_USERNAME: ${DB_USERNAME:-survey}
      DB_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD in .env.selfhost}
      MINIO_URL: http://minio:9000
      MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY:-minioadmin}
      MINIO_SECRET_KEY: ${MINIO_SECRET_KEY:?set MINIO_SECRET_KEY in .env.selfhost}
      MINIO_BUCKET: ${MINIO_BUCKET:-survey}
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_REALM: ${KEYCLOAK_REALM:-survey-school}
      KEYCLOAK_CLIENT_ID: ${KEYCLOAK_CLIENT_ID:-survey-backend}
      KEYCLOAK_CLIENT_SECRET: ${KEYCLOAK_CLIENT_SECRET:?set KEYCLOAK_CLIENT_SECRET in .env.selfhost}
      KEYCLOAK_ADMIN_USERNAME: ${KEYCLOAK_ADMIN_USERNAME:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:?set KEYCLOAK_ADMIN_PASSWORD in .env.selfhost}
      # Email — defaults to the bundled Mailpit (catches all mail, nothing leaves
      # the host). For real delivery set MAIL_HOST/PORT/USERNAME/PASSWORD/TLS.
      MAIL_HOST: ${MAIL_HOST:-mailpit}
      MAIL_PORT: ${MAIL_PORT:-1025}
      MAIL_USERNAME: ${MAIL_USERNAME:-}
      MAIL_PASSWORD: ${MAIL_PASSWORD:-}
      MAIL_TLS: ${MAIL_TLS:-DISABLED}
      MAIL_MOCK: "false"
      MAIL_FROM: ${MAIL_FROM:-Jackpoll <noreply@localhost>}
      APP_BASE_URL: ${APP_BASE_URL:-http://localhost:3000}
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3000}
      SURVEY_SPAM_SECRET: ${SURVEY_SPAM_SECRET:?set SURVEY_SPAM_SECRET in .env.selfhost}
      EMAIL_CODE_SECRET: ${EMAIL_CODE_SECRET:?set EMAIL_CODE_SECRET in .env.selfhost}
      RATE_LIMIT_BACKEND: ${RATE_LIMIT_BACKEND:-redis}
      REDIS_URL: redis://redis:6379
      CLAMAV_ENABLED: ${CLAMAV_ENABLED:-false}
    ports:
      - "${BACKEND_PORT:-8080}:8080"
    depends_on:
      postgres:
        condition: service_healthy
      minio:
        condition: service_healthy
      keycloak:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/q/health/ready"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 40s
    networks: [internal]

  postgres:
    image: postgres:16-alpine
    restart: *restart
    environment:
      POSTGRES_USER: ${DB_USERNAME:-survey}
      POSTGRES_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD in .env.selfhost}
      POSTGRES_DB: ${DB_NAME:-survey}
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USERNAME:-survey} -d ${DB_NAME:-survey}"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 15s
    networks: [internal]

  minio:
    image: minio/minio:latest
    restart: *restart
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY:?set MINIO_SECRET_KEY in .env.selfhost}
    ports:
      - "${MINIO_API_PORT:-9000}:9000"   # S3 API
      - "${MINIO_CONSOLE_PORT:-9001}:9001" # web console
    volumes:
      - miniodata:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 15s
    networks: [internal]

  keycloak:
    image: quay.io/keycloak/keycloak:26.2
    restart: *restart
    # Dev-mode server for a single host: HTTP only + realm import. For a public
    # HTTPS deployment use the Swarm stack (production mode behind Traefik).
    command: start-dev --import-realm
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/${DB_NAME:-survey}
      KC_DB_USERNAME: ${DB_USERNAME:-survey}
      KC_DB_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD in .env.selfhost}
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN_USERNAME:-admin}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:?set KEYCLOAK_ADMIN_PASSWORD in .env.selfhost}
      # The realm import substitutes ${KEYCLOAK_CLIENT_SECRET} into the backend client.
      KEYCLOAK_CLIENT_SECRET: ${KEYCLOAK_CLIENT_SECRET:?set KEYCLOAK_CLIENT_SECRET in .env.selfhost}
      KC_HTTP_ENABLED: "true"
      KC_HEALTH_ENABLED: "true"
      KC_HTTP_PORT: "8080"
      # Public issuer the browser reaches. Defaults to localhost; set to your
      # domain (e.g. https://auth.example.com) when exposing Keycloak publicly.
      KC_HOSTNAME: ${KEYCLOAK_HOSTNAME:-http://localhost:8180}
      KC_HOSTNAME_STRICT: "false"
      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
    ports:
      - "${KEYCLOAK_PORT:-8180}:8080"
    volumes:
      - ./keycloak:/opt/keycloak/data/import
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "echo > /dev/tcp/localhost/8080 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 15
      start_period: 20s
    networks: [internal]

  redis:
    image: redis:7-alpine
    restart: *restart
    command: ["redis-server", "--save", "", "--appendonly", "no"]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 10
      start_period: 5s
    networks: [internal]

  # Catches all outgoing mail so verification / reset emails are visible without
  # a real SMTP server. Web UI on http://localhost:8025. Swap for real SMTP in prod.
  mailpit:
    image: axllent/mailpit:latest
    restart: *restart
    ports:
      - "${MAILPIT_UI_PORT:-8025}:8025"
    networks: [internal]

  # UnifiedPush server (ntfy) so the mobile app can receive push notifications on
  # THIS instance — needed for the F-Droid app (no Google) and usable by the Play
  # app too. In the app, set the push distributor to your ntfy URL
  # (http://localhost:${NTFY_PORT} locally, or https://ntfy.your-domain in prod).
  ntfy:
    image: binwiederhier/ntfy:latest
    restart: *restart
    command: serve
    environment:
      NTFY_BASE_URL: ${NTFY_BASE_URL:-http://localhost:8090}
      NTFY_BEHIND_PROXY: "true"
      NTFY_AUTH_DEFAULT_ACCESS: "read-write"
    volumes:
      - ntfydata:/var/lib/ntfy
    ports:
      - "${NTFY_PORT:-8090}:80"
    networks: [internal]

networks:
  internal:
    driver: bridge

volumes:
  pgdata:
  miniodata:
  ntfydata: