| 1 | services: |
| 2 | nginx: |
| 3 | image: nginx:stable-alpine |
| 4 | depends_on: |
| 5 | - portal |
| 6 | - portal-frontend |
| 7 | - portal-api |
| 8 | ports: |
| 9 | - "${HTTP_PORT:-80}:80" |
| 10 | - "${HTTPS_PORT:-443}:443" |
| 11 | environment: |
| 12 | PORTAL_URL: ${PORTAL_URL:-https://localhost} |
| 13 | NGINX_CERT_FILE: ${NGINX_CERT_FILE:-/etc/nginx/certs/fullchain.pem} |
| 14 | NGINX_CERT_KEY: ${NGINX_CERT_KEY:-/etc/nginx/certs/privatekey.pem} |
| 15 | volumes: |
| 16 | - ./nginx.conf.template:/etc/nginx/templates/nginx.conf.template:ro |
| 17 | - ./.portal-certs:/etc/nginx/certs:ro |
| 18 | command: |
| 19 | - /bin/sh |
| 20 | - -c |
| 21 | - | |
| 22 | portal_host="$${PORTAL_URL#*://}" |
| 23 | portal_host="$${portal_host%%/*}" |
| 24 | portal_host="$${portal_host%%:*}" |
| 25 | export PORTAL_HOST="$${portal_host:-localhost}" |
| 26 | |
| 27 | export NGINX_CERT_FILE="$${NGINX_CERT_FILE:-/etc/nginx/certs/fullchain.pem}" |
| 28 | export NGINX_CERT_KEY="$${NGINX_CERT_KEY:-/etc/nginx/certs/privatekey.pem}" |
| 29 | envsubst '$$PORTAL_HOST $$NGINX_CERT_FILE $$NGINX_CERT_KEY' \ |
| 30 | < /etc/nginx/templates/nginx.conf.template \ |
| 31 | > /etc/nginx/nginx.conf |
| 32 | |
| 33 | until [ -s "$$NGINX_CERT_FILE" ] && [ -s "$$NGINX_CERT_KEY" ]; do |
| 34 | echo "waiting for TLS certificate files: $$NGINX_CERT_FILE and $$NGINX_CERT_KEY" |
| 35 | sleep 1 |
| 36 | done |
| 37 | exec nginx -g 'daemon off;' |
| 38 | restart: unless-stopped |
| 39 | |
| 40 | # Optional: uncomment to enable auto-generated thumbnails for tunnel apps. |
| 41 | # See docs/src/routes/deployment/+page.md for details. |
| 42 | # headless-shell: |
| 43 | # image: chromedp/headless-shell:stable |
| 44 | # restart: unless-stopped |
| 45 | |
| 46 | portal-api: |
| 47 | image: ghcr.io/gosuda/portal-api:2 |
| 48 | build: |
| 49 | context: ./frontend |
| 50 | dockerfile: Dockerfile |
| 51 | target: api |
| 52 | depends_on: |
| 53 | - portal |
| 54 | # Uncomment with the headless-shell service above to enable generated screenshots. |
| 55 | # - headless-shell |
| 56 | environment: |
| 57 | PORT: 8081 |
| 58 | PORTAL_API_BASE_URL: https://portal:4017 |
| 59 | LANDING_PAGE_ENABLED: ${LANDING_PAGE_ENABLED:-false} |
| 60 | PORTAL_FRONTEND_STATE_PATH: /frontend-state/state.json |
| 61 | # Leave empty to disable generated screenshots without removing the service. |
| 62 | HEADLESS_SHELL_URL: ${HEADLESS_SHELL_URL:-} |
| 63 | # HEADLESS_SHELL_URL: ${HEADLESS_SHELL_URL:-ws://headless-shell:9222} |
| 64 | volumes: |
| 65 | - ./.portal-certs/frontend-state:/frontend-state |
| 66 | restart: unless-stopped |
| 67 | |
| 68 | portal-frontend: |
| 69 | image: ghcr.io/gosuda/portal-frontend:2 |
| 70 | build: |
| 71 | context: ./frontend |
| 72 | dockerfile: Dockerfile |
| 73 | depends_on: |
| 74 | - portal |
| 75 | - portal-api |
| 76 | restart: unless-stopped |
| 77 | |
| 78 | portal: |
| 79 | image: ghcr.io/gosuda/portal:2 |
| 80 | build: |
| 81 | context: . |
| 82 | dockerfile: Dockerfile |
| 83 | stop_grace_period: 30s |
| 84 | ports: |
| 85 | - "${WIREGUARD_PORT:-51820}:${WIREGUARD_PORT:-51820}/udp" |
| 86 | # Uncomment for UDP backhaul, public UDP lease ports, and raw TCP lease ports as needed. |
| 87 | # - "443:443/udp" |
| 88 | # - "${MIN_PORT:-40000}-${MAX_PORT:-40009}:${MIN_PORT:-40000}-${MAX_PORT:-40009}/udp" |
| 89 | # - "${MIN_PORT:-40000}-${MAX_PORT:-40009}:${MIN_PORT:-40000}-${MAX_PORT:-40009}" |
| 90 | # Uncomment with PPROF_ENABLED=true and PPROF_ADDR=:6060 to inspect pprof from the host. |
| 91 | # - "${PPROF_PORT:-6060}:${PPROF_PORT:-6060}" |
| 92 | environment: |
| 93 | # Public routing, discovery, and relay identity persistence |
| 94 | PORTAL_URL: ${PORTAL_URL:-https://localhost} |
| 95 | BOOTSTRAPS: ${BOOTSTRAPS:-} |
| 96 | DISCOVERY: ${DISCOVERY:-false} |
| 97 | IDENTITY_PATH: ${IDENTITY_PATH:-/portal-certs} |
| 98 | |
| 99 | API_PORT: 4017 |
| 100 | SNI_PORT: 443 |
| 101 | WIREGUARD_PORT: ${WIREGUARD_PORT:-51820} |
| 102 | |
| 103 | # Shared lease port range. |
| 104 | MIN_PORT: ${MIN_PORT:-40000} |
| 105 | MAX_PORT: ${MAX_PORT:-40009} |
| 106 | UDP_ENABLED: ${UDP_ENABLED:-false} |
| 107 | TCP_ENABLED: ${TCP_ENABLED:-false} |
| 108 | |
| 109 | # Admin/auth configuration. |
| 110 | ADMIN_TOKEN: ${ADMIN_TOKEN:-} |
| 111 | X402_ENABLED: ${X402_ENABLED:-true} |
| 112 | X402_TESTNET: ${X402_TESTNET:-true} |
| 113 | X402_PAY_TO: ${X402_PAY_TO:-} |
| 114 | TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-true} |
| 115 | TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-} |
| 116 | |
| 117 | # Optional diagnostics; keep loopback unless the pprof port is protected. |
| 118 | PPROF_ENABLED: ${PPROF_ENABLED:-false} |
| 119 | PPROF_ADDR: ${PPROF_ADDR:-127.0.0.1:6060} |
| 120 | |
| 121 | # TLS/ACME materials and DNS automation |
| 122 | ACME_DNS_PROVIDER: ${ACME_DNS_PROVIDER:-} |
| 123 | ENS_GASLESS_ENABLED: ${ENS_GASLESS_ENABLED:-false} |
| 124 | CLOUDFLARE_TOKEN: ${CLOUDFLARE_TOKEN:-} |
| 125 | GCP_PROJECT_ID: ${GCP_PROJECT_ID:-} |
| 126 | GCP_MANAGED_ZONE: ${GCP_MANAGED_ZONE:-} |
| 127 | GOOGLE_APPLICATION_CREDENTIALS: ${GOOGLE_APPLICATION_CREDENTIALS:-} |
| 128 | HETZNER_API_TOKEN: ${HETZNER_API_TOKEN:-} |
| 129 | AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-} |
| 130 | AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-} |
| 131 | AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-} |
| 132 | AWS_REGION: ${AWS_REGION:-} |
| 133 | AWS_DEFAULT_REGION: ${AWS_DEFAULT_REGION:-} |
| 134 | AWS_HOSTED_ZONE_ID: ${AWS_HOSTED_ZONE_ID:-} |
| 135 | AWS_DNSSEC_KMS_KEY_ARN: ${AWS_DNSSEC_KMS_KEY_ARN:-} |
| 136 | VULTR_API_KEY: ${VULTR_API_KEY:-} |
| 137 | NJALLA_TOKEN: ${NJALLA_TOKEN:-} |
| 138 | volumes: |
| 139 | - ./.portal-certs:${IDENTITY_PATH:-/portal-certs} |
| 140 | # Uncomment when using a Google Cloud service account file for gcloud automation. |
| 141 | # - ./gcp-dns.json:/run/secrets/gcp-dns.json:ro |
| 142 | restart: unless-stopped |