bss-stack/docker-compose.yml at main · kir-dev/bss-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
x-authentik-environment: &authentik-environment
  AUTHENTIK_POSTGRESQL__HOST: authentik-db
  AUTHENTIK_POSTGRESQL__NAME: authentik
  AUTHENTIK_POSTGRESQL__USER: authentik
  AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
  AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}

services:
  app:
    build:
      context: .
      target: runtime
    restart: unless-stopped
    container_name: bss-app
    environment:
      NODE_ENV: production
      HOST: 0.0.0.0
      PORT: 3000
      DATABASE_URL: postgresql://bss:${BSS_DB_PASSWORD}@app-db:5432/bss
      BSS_OOB_CONFIG: /app/oob/config.json
    depends_on:
      app-db:
        condition: service_healthy
    ports:
      - '8070:3000'
    volumes:
      - ./oob:/app/oob:ro

  app-db:
    image: postgres:18.4-alpine
    restart: unless-stopped
    container_name: bss-db
    environment:
      POSTGRES_DB: bss
      POSTGRES_USER: bss
      POSTGRES_PASSWORD: ${BSS_DB_PASSWORD}
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U bss -d bss']
      interval: 10s
      timeout: 5s
      retries: 10
    volumes:
      - app_database:/var/lib/postgresql

  # Run manually with:
  # docker compose --profile tools run --rm db-migrate
  db-migrate:
    build:
      context: .
      target: build
    profiles: ['tools']
    command: ['pnpm', 'db:migrate']
    environment:
      DATABASE_URL: postgresql://bss:${BSS_DB_PASSWORD}@app-db:5432/bss
    depends_on:
      app-db:
        condition: service_healthy

    volumes:
      - ./oob:/app/oob

  authentik-db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: authentik
      POSTGRES_USER: authentik
      POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U authentik -d authentik']
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s
    volumes:
      - authentik_database:/var/lib/postgresql/data

  authentik-server:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2026.5.4}
    command: server
    restart: unless-stopped
    shm_size: 512mb
    container_name: bss-authentik
    environment:
      <<: *authentik-environment
    depends_on:
      authentik-db:
        condition: service_healthy
    ports:
      - '8071:9000'
      - '8072:9443'
    volumes:
      - authentik_data:/data
      - authentik_templates:/templates

  authentik-worker:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG:-2026.5.4}
    command: worker
    restart: unless-stopped
    user: root
    shm_size: 512mb
    environment:
      <<: *authentik-environment
    depends_on:
      authentik-db:
        condition: service_healthy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - authentik_data:/data
      - authentik_certs:/certs
      - authentik_templates:/templates
      - ./oob/authentik/blueprints:/blueprints/custom

volumes:
  app_database:
  authentik_database:
  authentik_data:
  authentik_certs:
  authentik_templates: