CluPilotCloud/docker-compose.yml

# CluPilot — DEV stack. Everything runs in containers (host has only Docker).
# `app` = php-fpm + nginx + vite (supervisor). reverb/queue reuse the image.
# Ports + UID are env-driven (see .env). No secrets hardcoded here.

services:
  app:
    build:
      context: .
      dockerfile: docker/php/Dockerfile
      args:
        HOST_UID: ${HOST_UID:-1000}
        HOST_GID: ${HOST_GID:-1000}
    image: clupilot-app:dev
    restart: unless-stopped
    volumes:
      - .:/var/www/html
    ports:
      - "${APP_PORT:-80}:80"
      - "${VITE_PORT:-5173}:5173"
    # Laravel reads .env from the bind mount. Do NOT inject it as real env vars
    # (env_file): that would override the test env (phpunit force) and let the
    # test suite run against the dev DB. Only vite needs these at process level.
    environment:
      VITE_HMR_HOST: ${VITE_HMR_HOST:-localhost}
      VITE_PORT: ${VITE_PORT:-5173}
    depends_on:
      mariadb:
        condition: service_healthy
      redis:
        condition: service_started

  reverb:
    image: clupilot-app:dev
    restart: unless-stopped
    command: php artisan reverb:start --host=0.0.0.0 --port=8080
    volumes:
      - .:/var/www/html
    ports:
      - "${REVERB_HOST_PORT:-8080}:8080"
    depends_on:
      - app
      - redis

  queue:
    image: clupilot-app:dev
    restart: unless-stopped
    command: php artisan queue:work redis --tries=3 --timeout=90
    volumes:
      - .:/var/www/html
    depends_on:
      - app
      - redis
      - mariadb

  # Dedicated worker for long-running provisioning steps (own timeout, single try;
  # the DB state machine owns retries). Separate from the fast default queue.
  # It also acts as the WireGuard hub (LocalWireguardHub runs `wg set wg0` here),
  # so it needs NET_ADMIN, the tun device, a persistent wg config, and the WG
  # UDP port published on the host for peers to reach. Set CLUPILOT_WG_ENDPOINT
  # to <vm-public-ip>:${WG_HUB_PORT} and CLUPILOT_WG_HUB_PUBKEY to wg0's key.
  queue-provisioning:
    image: clupilot-app:dev
    restart: unless-stopped
    # Bring up wg0 (from the mounted config, once the operator has installed it)
    # before starting the worker, so LocalWireguardHub can manage peers.
    command: sh -c 'wg-quick up wg0 2>/dev/null || true; exec php artisan queue:work provisioning --queue=provisioning --tries=1 --timeout=2100 --sleep=3'
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    sysctls:
      - net.ipv4.ip_forward=1
    ports:
      - "${WG_HUB_PORT:-51820}:51820/udp"
    volumes:
      - .:/var/www/html
      - wireguard:/etc/wireguard
    depends_on:
      - app
      - redis
      - mariadb

  scheduler:
    image: clupilot-app:dev
    restart: unless-stopped
    command: php artisan schedule:work
    volumes:
      - .:/var/www/html
    depends_on:
      - app
      - redis
      - mariadb

  mariadb:
    image: mariadb:11.4
    restart: unless-stopped
    environment:
      MARIADB_DATABASE: ${DB_DATABASE:-clupilot}
      MARIADB_USER: ${DB_USERNAME:-clupilot}
      MARIADB_PASSWORD: ${DB_PASSWORD}
      MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
    ports:
      # host-side port is separate from DB_PORT (which Laravel uses to reach
      # mariadb:3306 inside the network) so changing it can't break the app.
      - "127.0.0.1:${DB_HOST_PORT:-3306}:3306"
    volumes:
      - db-data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 5s
      timeout: 5s
      retries: 20

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    volumes:
      - redis-data:/data

  # Uptime Kuma bridge: Kuma has no write REST API (monitor CRUD is Socket.IO),
  # so this translates the REST contract CluPilot speaks. Opt-in:
  #   docker compose --profile monitoring up -d kuma-bridge
  # Then set MONITORING_API_URL=http://kuma-bridge:8080 in .env.
  kuma-bridge:
    build:
      context: ./docker/kuma-bridge
    image: clupilot-kuma-bridge:dev
    restart: unless-stopped
    profiles: ["monitoring"]
    environment:
      KUMA_URL: "${KUMA_URL:-}"
      KUMA_USERNAME: "${KUMA_USERNAME:-}"
      KUMA_PASSWORD: "${KUMA_PASSWORD:-}"
      KUMA_TOTP: "${KUMA_TOTP:-}"
      BRIDGE_TOKEN: "${MONITORING_API_TOKEN:-}"

volumes:
  db-data:
  redis-data:
  wireguard: