docker-compose.yaml

# Coolify Git Compose deployment for Buzz Relay.
name: buzz-relay

services:
  # Named volumes are root-owned on first creation. Buzz runs as UID 1000 and
  # needs write access to its Git repository volume.
  buzz-git-init:
    image: alpine:3.21
    command:
      - /bin/sh
      - -ec
      - chown -R 1000:1000 /data/git
    volumes:
      - buzz-git-data:/data/git
    restart: "no"
    exclude_from_hc: true

  buzz:
    # Production is pinned to the reviewed upstream revision below. Advance
    # this SHA deliberately after backup and smoke testing; BUZZ_IMAGE_TAG can
    # still provide a temporary rollback override in Coolify.
    image: ghcr.io/block/buzz:${BUZZ_IMAGE_TAG:-sha-571c190}
    pull_policy: always
    environment:
      BUZZ_BIND_ADDR: 0.0.0.0:3000
      BUZZ_HEALTH_PORT: "8080"
      BUZZ_METRICS_PORT: "9102"
      RELAY_URL: ${BUZZ_RELAY_URL:?Set BUZZ_RELAY_URL}
      BUZZ_MEDIA_BASE_URL: ${BUZZ_PUBLIC_URL:?Set BUZZ_PUBLIC_URL}/media
      BUZZ_MEDIA_SERVER_DOMAIN: ${BUZZ_DOMAIN:?Set BUZZ_DOMAIN}
      # Fixes Coolify issue #11044 for macOS, Windows, and Linux Buzz Desktop.
      BUZZ_CORS_ORIGINS: ${BUZZ_PUBLIC_URL:?Set BUZZ_PUBLIC_URL},tauri://localhost,http://tauri.localhost
      DATABASE_URL: postgres://${POSTGRES_USER:-buzz}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-buzz}
      REDIS_URL: redis://:${REDIS_PASSWORD:?Set REDIS_PASSWORD}@redis:6379
      BUZZ_S3_ENDPOINT: ${BUZZ_S3_ENDPOINT:?Set BUZZ_S3_ENDPOINT}
      BUZZ_S3_REGION: ${BUZZ_S3_REGION:-auto}
      BUZZ_S3_ADDRESSING_STYLE: ${BUZZ_S3_ADDRESSING_STYLE:-path}
      BUZZ_S3_ACCESS_KEY: ${BUZZ_S3_ACCESS_KEY:?Set BUZZ_S3_ACCESS_KEY}
      BUZZ_S3_SECRET_KEY: ${BUZZ_S3_SECRET_KEY:?Set BUZZ_S3_SECRET_KEY}
      BUZZ_S3_BUCKET: ${BUZZ_S3_BUCKET:-buzz-media}
      BUZZ_GIT_REPO_PATH: /data/git
      BUZZ_RELAY_PRIVATE_KEY: ${BUZZ_RELAY_PRIVATE_KEY:?Set BUZZ_RELAY_PRIVATE_KEY}
      BUZZ_GIT_HOOK_HMAC_SECRET: ${BUZZ_GIT_HOOK_HMAC_SECRET:?Set BUZZ_GIT_HOOK_HMAC_SECRET}
      BUZZ_AUTO_MIGRATE: "true"
      BUZZ_GIT_CONFORMANCE_PROBE: "true"
      # Advertise the dedicated auth-free pairing sidecar in NIP-11. Buzz
      # Desktop otherwise falls back to this same /pair URL, but advertising it
      # makes the deployment contract explicit for all clients.
      BUZZ_PAIRING_RELAY_URL: "wss://${BUZZ_DOMAIN:?Set BUZZ_DOMAIN}/pair"
      BUZZ_REQUIRE_AUTH_TOKEN: "true"
      BUZZ_REQUIRE_RELAY_MEMBERSHIP: ${BUZZ_REQUIRE_RELAY_MEMBERSHIP:-true}
      BUZZ_ALLOW_NIP_OA_AUTH: "true"
      BUZZ_SERVE_GIT_WEB_GUI: ${BUZZ_SERVE_GIT_WEB_GUI:-false}
      RELAY_OWNER_PUBKEY: ${RELAY_OWNER_PUBKEY:?Set RELAY_OWNER_PUBKEY}
      RUST_LOG: ${RUST_LOG:-buzz_relay=info,buzz_db=info,buzz_auth=info,buzz_pubsub=info,tower_http=info}
    expose:
      - "3000"
    volumes:
      - buzz-git-data:/data/git
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      buzz-git-init:
        condition: service_completed_successfully
    # The Buzz runtime contains bash but intentionally has no curl or wget.
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "bash -ec 'exec 3<>/dev/tcp/127.0.0.1/8080; printf \"GET /_readiness HTTP/1.1\\r\\nHost: 127.0.0.1\\r\\nConnection: close\\r\\n\\r\\n\" >&3; grep -q \"200 OK\" <&3'",
        ]
      interval: 10s
      timeout: 3s
      retries: 12
      start_period: 45s
    restart: unless-stopped

  # Ephemeral NIP-AB device-pairing relay. A phone starts pairing with a fresh
  # key that is not a main-relay member yet, so pairing must not be handled by
  # the authenticated relay above. The official image already ships this
  # separate no-auth, no-persistence binary.
  pair:
    # Keep the pairing sidecar on exactly the same reviewed Buzz revision as
    # the authenticated relay.
    image: ghcr.io/block/buzz:${BUZZ_IMAGE_TAG:-sha-571c190}
    pull_policy: always
    entrypoint: ["/usr/local/bin/buzz-pair-relay"]
    environment:
      BUZZ_PAIR_RELAY_BIND_ADDR: 0.0.0.0:5000
    expose:
      - "5000"
    # The sidecar only speaks WebSocket upgrades and returns HTTP 400 to a
    # normal GET, so readiness is a raw TCP check rather than an HTTP 200.
    healthcheck:
      test: ["CMD-SHELL", "bash -ec 'exec 3<>/dev/tcp/127.0.0.1/5000'"]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 5s
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.buzz-pair.entrypoints=https"
      - "traefik.http.routers.buzz-pair.rule=Host(`${BUZZ_DOMAIN:?Set BUZZ_DOMAIN}`) && Path(`/pair`)"
      - "traefik.http.routers.buzz-pair.priority=1000"
      - "traefik.http.routers.buzz-pair.tls=true"
      - "traefik.http.routers.buzz-pair.tls.certresolver=letsencrypt"
      - "traefik.http.routers.buzz-pair.service=buzz-pair"
      - "traefik.http.services.buzz-pair.loadbalancer.server.port=5000"

  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-buzz}
      POSTGRES_USER: ${POSTGRES_USER:-buzz}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - buzz-postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    command:
      [
        "redis-server",
        "--appendonly",
        "yes",
        "--requirepass",
        "${REDIS_PASSWORD:?Set REDIS_PASSWORD}",
      ]
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?Set REDIS_PASSWORD}
    volumes:
      - buzz-redis-data:/data
    healthcheck:
      test: ["CMD-SHELL", 'redis-cli -a "$${REDIS_PASSWORD}" ping | grep -q PONG']
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 5s
    restart: unless-stopped

volumes:
  buzz-postgres-data:
  buzz-redis-data:
  buzz-git-data: