services:

postgres:

image: postgres:alpine

restart: unless-stopped

environment:

POSTGRES_DB: ${POSTGRES_DB:-httpsms}

POSTGRES_USER: ${POSTGRES_USER:-httpsms}

# No committed default — the image refuses to initialize with an empty password.

POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in the environment}

volumes:

- postgres:/var/lib/postgresql/data

healthcheck:

test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]

interval: 30s

timeout: 60s

retries: 5

start_period: 5s

redis:

image: redis:latest

command: redis-server

restart: unless-stopped

volumes:

- redis:/var/lib/redis

healthcheck:

test: ["CMD", "redis-cli", "ping"]

interval: 10s

timeout: 5s

retries: 5

api:

build:

context: ./api

restart: unless-stopped

# DANNET/Coolify: no host `ports:` publish — Coolify's Traefik reaches the container over

# the shared proxy network (assign the domain to this service, port 8000, from the Coolify

# UI). Publishing to the host as well is unnecessary and widens the attack surface on a

# shared VPS.

expose:

- '8000'

depends_on:

postgres:

condition: service_healthy

redis:

condition: service_healthy

# DANNET/Coolify: `env_file: ./api/.env` (upstream default) requires a file that only

# exists locally (gitignored, created from api/.env.docker per the README) — it is absent

# from a fresh git checkout, so Coolify's build would fail outright. Forwarded explicitly

# instead, from Coolify's panel env vars (same pattern as OpenWA's compose in this org).

# The binary itself already expects real process env (`--dotenv=false` in api/Dockerfile).

environment:

- ENV=${ENV:-production}

- GCP_PROJECT_ID=${GCP_PROJECT_ID:-}

- USE_HTTP_LOGGER=${USE_HTTP_LOGGER:-true}

- ENTITLEMENT_ENABLED=${ENTITLEMENT_ENABLED:-false}

# No GCP Cloud Tasks needed for self-host — the in-process emulator queue calls itself

# back over HTTP. EVENTS_QUEUE_ENDPOINT must be the public API URL, not localhost.

- EVENTS_QUEUE_TYPE=${EVENTS_QUEUE_TYPE:-emulator}

- EVENTS_QUEUE_NAME=${EVENTS_QUEUE_NAME:-events-production}

- EVENTS_QUEUE_ENDPOINT=${EVENTS_QUEUE_ENDPOINT:-}

- EVENTS_QUEUE_USER_API_KEY=${EVENTS_QUEUE_USER_API_KEY:-}

- EVENTS_QUEUE_USER_ID=${EVENTS_QUEUE_USER_ID:-}

- FIREBASE_CREDENTIALS=${FIREBASE_CREDENTIALS:-}

- SMTP_FROM_NAME=${SMTP_FROM_NAME:-httpSMS}

- SMTP_FROM_EMAIL=${SMTP_FROM_EMAIL:-}

- SMTP_USERNAME=${SMTP_USERNAME:-}

- SMTP_PASSWORD=${SMTP_PASSWORD:-}

- SMTP_HOST=${SMTP_HOST:-}

- SMTP_PORT=${SMTP_PORT:-587}

# Public URL of the WEB app (not this API) — used to build links in outgoing emails.

- APP_URL=${APP_URL:-}

- APP_NAME=${APP_NAME:-httpSMS}

- APP_HOST=

- APP_PORT=8000

- SWAGGER_HOST=${SWAGGER_HOST:-}

- DATABASE_URL=postgresql://${POSTGRES_USER:-httpsms}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-httpsms}

- DATABASE_URL_DEDICATED=postgresql://${POSTGRES_USER:-httpsms}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-httpsms}

- REDIS_URL=redis://@redis:6379

# Optional. Blank falls back to an in-memory attachment store (media lost on restart) —

# the app only supports Google Cloud Storage, not S3-compatible buckets.

- GCS_BUCKET_NAME=${GCS_BUCKET_NAME:-}

- AXIOM_TOKEN=${AXIOM_TOKEN:-}

- AXIOM_DATASET_EVENTS=${AXIOM_DATASET_EVENTS:-}

- AXIOM_DATASET_METRICS=${AXIOM_DATASET_METRICS:-}

# Optional realtime dashboard updates (Pusher). Without these the dashboard just needs a

# manual refresh to see new messages; core SMS delivery via FCM is unaffected.

- PUSHER_APP_ID=${PUSHER_APP_ID:-}

- PUSHER_KEY=${PUSHER_KEY:-}

- PUSHER_SECRET=${PUSHER_SECRET:-}

- PUSHER_CLUSTER=${PUSHER_CLUSTER:-}

- CLOUDFLARE_TURNSTILE_SECRET_KEY=${CLOUDFLARE_TURNSTILE_SECRET_KEY:-}

healthcheck:

test: ['CMD', 'curl', '-f', 'http://localhost:8000/health']

interval: 30s

timeout: 5s

retries: 3

start_period: 10s

web:

build:

context: ./web

# DANNET/Coolify: Nuxt bakes these into the static output at build time (see the ARG/ENV

# block added to web/Dockerfile) — there is no runtime env for a static nginx-served SPA.

# Changing any of these requires a rebuild, not just a redeploy/restart.

args:

API_BASE_URL: ${API_BASE_URL:-}

APP_URL: ${APP_URL:-}

APP_NAME: ${APP_NAME:-httpSMS}

APP_GITHUB_URL: ${APP_GITHUB_URL:-}

APP_DOCUMENTATION_URL: ${APP_DOCUMENTATION_URL:-}

APP_DOWNLOAD_URL: ${APP_DOWNLOAD_URL:-}

APP_ENV: ${ENV:-production}

CHECKOUT_URL: ${CHECKOUT_URL:-}

ENTERPRISE_CHECKOUT_URL: ${ENTERPRISE_CHECKOUT_URL:-}

CLOUDFLARE_TURNSTILE_SITE_KEY: ${CLOUDFLARE_TURNSTILE_SITE_KEY:-}

PUSHER_KEY: ${PUSHER_KEY:-}

PUSHER_CLUSTER: ${PUSHER_CLUSTER:-}

FIREBASE_API_KEY: ${FIREBASE_API_KEY:-}

FIREBASE_AUTH_DOMAIN: ${FIREBASE_AUTH_DOMAIN:-}

FIREBASE_PROJECT_ID: ${FIREBASE_PROJECT_ID:-}

FIREBASE_STORAGE_BUCKET: ${FIREBASE_STORAGE_BUCKET:-}

FIREBASE_MESSAGING_SENDER_ID: ${FIREBASE_MESSAGING_SENDER_ID:-}

FIREBASE_APP_ID: ${FIREBASE_APP_ID:-}

FIREBASE_MEASUREMENT_ID: ${FIREBASE_MEASUREMENT_ID:-}

GITHUB_SHA: ${GITHUB_SHA:-}

restart: unless-stopped

expose:

- '3000'

depends_on:

api:

condition: service_started

volumes:

redis:

postgres: