core2026_docker/compose.yaml

name: ${COMPOSE_PROJECT_NAME:-sammo-public}

services:
  postgres:
    image: postgres:18.4-bookworm
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-sammo}
      POSTGRES_USER: ${POSTGRES_USER:-sammo}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
      TZ: ${TZ:-Asia/Seoul}
    volumes:
      - postgres-data:/var/lib/postgresql
    healthcheck:
      test: [CMD-SHELL, 'pg_isready -U "$${POSTGRES_USER}" -d "$${POSTGRES_DB}"']
      interval: 5s
      timeout: 5s
      retries: 24
      start_period: 10s
    restart: unless-stopped

  redis:
    image: redis:8.2.7-bookworm
    entrypoint: [/usr/local/bin/sammo-redis-entrypoint]
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?set REDIS_PASSWORD in .env}
    volumes:
      - redis-data:/data
      - ./runtime/redis-entrypoint.sh:/usr/local/bin/sammo-redis-entrypoint:ro
    healthcheck:
      test: [CMD-SHELL, 'REDISCLI_AUTH="$${REDIS_PASSWORD}" redis-cli ping 2>/dev/null | grep -q PONG']
      interval: 5s
      timeout: 5s
      retries: 24
      start_period: 5s
    restart: unless-stopped

  builder:
    build:
      context: .
      dockerfile: runtime/Dockerfile
    entrypoint: [/usr/bin/tini, --, node, /opt/sammo/release-builder.mjs]
    environment:
      CI: 'true'
      NODE_OPTIONS: ${BUILDER_NODE_OPTIONS:---max-old-space-size=3072}
      PROFILE_FRONTEND_BUILD_NODE_OPTIONS: ${PROFILE_FRONTEND_BUILD_NODE_OPTIONS:---max-old-space-size=3072}
      RAYON_NUM_THREADS: ${BUILDER_RAYON_NUM_THREADS:-2}
      RELEASE_TURBO_CONCURRENCY: ${RELEASE_TURBO_CONCURRENCY:-1}
      TURBO_CACHE_DIR: /srv/builder-cache/turbo
      XDG_DATA_HOME: /srv/builder-cache/xdg
      RELEASE_BUILDER_PORT: '15100'
      TZ: ${TZ:-Asia/Seoul}
    volumes:
      - core-source:/srv/core
      - builder-cache:/srv/builder-cache
    healthcheck:
      test: [CMD, curl, --fail, --silent, http://127.0.0.1:15100/healthz]
      interval: 5s
      timeout: 5s
      retries: 24
      start_period: 5s
    mem_limit: ${BUILDER_MEMORY_LIMIT:-4g}
    memswap_limit: ${BUILDER_MEMORY_SWAP_LIMIT:-4g}
    cpus: ${BUILDER_CPU_LIMIT:-4}
    pids_limit: ${BUILDER_PIDS_LIMIT:-256}
    stop_grace_period: 15s
    restart: unless-stopped

  runtime:
    build:
      context: .
      dockerfile: runtime/Dockerfile
    environment:
      DOMAIN: ${DOMAIN:?set DOMAIN in .env}
      PUBLIC_SCHEME: ${PUBLIC_SCHEME:-https}
      ACME_EMAIL: ${ACME_EMAIL:?set ACME_EMAIL in .env}
      CORE_SOURCE_MODE: clone
      CORE_REPOSITORY_URL: ${CORE_REPOSITORY_URL:?set CORE_REPOSITORY_URL in .env}
      CORE_BOOTSTRAP_REF: ${CORE_BOOTSTRAP_REF:-main}
      CORE_REPOSITORY_USERNAME: ${CORE_REPOSITORY_USERNAME:-}
      CORE_REPOSITORY_TOKEN: ${CORE_REPOSITORY_TOKEN:-}
      CORE_SSH_PRIVATE_KEY_BASE64: ${CORE_SSH_PRIVATE_KEY_BASE64:-}
      CORE_SSH_KNOWN_HOSTS_BASE64: ${CORE_SSH_KNOWN_HOSTS_BASE64:-}
      NODE_OPTIONS: ${RUNTIME_NODE_OPTIONS:---max-old-space-size=1536}
      TURN_DAEMON_NODE_OPTIONS: ${TURN_DAEMON_NODE_OPTIONS:---max-old-space-size=1536}
      RAYON_NUM_THREADS: ${RUNTIME_RAYON_NUM_THREADS:-1}
      POSTGRES_HOST: postgres
      POSTGRES_PORT: '5432'
      POSTGRES_DB: ${POSTGRES_DB:-sammo}
      POSTGRES_USER: ${POSTGRES_USER:-sammo}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
      GATEWAY_DB_SCHEMA: public
      REDIS_HOST: redis
      REDIS_PORT: '6379'
      REDIS_DB: '0'
      REDIS_PASSWORD: ${REDIS_PASSWORD:?set REDIS_PASSWORD in .env}
      GAME_TOKEN_SECRET: ${GAME_TOKEN_SECRET:?set GAME_TOKEN_SECRET in .env}
      GATEWAY_BOOTSTRAP_TOKEN: ${GATEWAY_BOOTSTRAP_TOKEN:?set GATEWAY_BOOTSTRAP_TOKEN in .env}
      INITIAL_ADMIN_USERNAME: ${INITIAL_ADMIN_USERNAME:?set INITIAL_ADMIN_USERNAME in .env}
      INITIAL_ADMIN_PASSWORD: ${INITIAL_ADMIN_PASSWORD:?set INITIAL_ADMIN_PASSWORD in .env}
      INITIAL_ADMIN_DISPLAY_NAME: ${INITIAL_ADMIN_DISPLAY_NAME:-Administrator}
      BOOTSTRAP_PROFILES: ${BOOTSTRAP_PROFILES:-gateway,che,kwe,pwe,twe,nya,pya,hwe}
      KAKAO_REST_KEY: ${KAKAO_REST_KEY:?set KAKAO_REST_KEY in .env}
      KAKAO_ADMIN_KEY: ${KAKAO_ADMIN_KEY:-}
      KAKAO_REDIRECT_URI: ${PUBLIC_SCHEME:-https}://${DOMAIN:?set DOMAIN in .env}/gateway/oauth/callback
      GATEWAY_PUBLIC_URL: ${PUBLIC_SCHEME:-https}://${DOMAIN:?set DOMAIN in .env}/gateway/
      GATEWAY_USER_ICON_DIR: /srv/data/user-icons
      GATEWAY_USER_ICON_PUBLIC_URL: ${IMAGE_PUBLIC_URL:-https://sam-image.hided.net}/icons
      GATEWAY_IMAGE_UPLOAD_URL: ${IMAGE_SERVICE_URL:-https://sam-image.hided.net}
      GATEWAY_IMAGE_UPLOAD_SECRET_FILE: /run/secrets/image_upload_core2026_secret
      GATEWAY_SHARED_ICON_PUBLIC_URL: ${IMAGE_PUBLIC_URL:-https://sam-image.hided.net}/icons
      GAME_IMAGE_UPLOAD_URL: ${IMAGE_SERVICE_URL:-https://sam-image.hided.net}
      GAME_IMAGE_UPLOAD_SECRET_FILE: /run/secrets/image_upload_core2026_secret
      GAME_CONTENT_IMAGE_PUBLIC_URL: ${IMAGE_PUBLIC_URL:-https://sam-image.hided.net}/uploads/core2026
      IMAGE_SYNC_URL: ${IMAGE_SERVICE_URL:-https://sam-image.hided.net}
      IMAGE_SYNC_SECRET_FILE: /run/secrets/image_sync_core2026_secret
      GATEWAY_LOCAL_REGISTRATION_ENABLED: ${GATEWAY_LOCAL_REGISTRATION_ENABLED:-true}
      GATEWAY_ADMIN_LOCAL_ACCOUNT_ENABLED: ${GATEWAY_ADMIN_LOCAL_ACCOUNT_ENABLED:-true}
      GATEWAY_LOCAL_ACCOUNT_GRACE_DAYS: ${GATEWAY_LOCAL_ACCOUNT_GRACE_DAYS:-7}
      GATEWAY_LEGACY_PASSWORD_GLOBAL_SALT: ${GATEWAY_LEGACY_PASSWORD_GLOBAL_SALT:-}
      WEB_PUSH_ENABLED: ${WEB_PUSH_ENABLED:-false}
      WEB_PUSH_VAPID_SUBJECT: ${WEB_PUSH_VAPID_SUBJECT:-}
      WEB_PUSH_VAPID_PUBLIC_KEY: ${WEB_PUSH_VAPID_PUBLIC_KEY:-}
      WEB_PUSH_VAPID_PRIVATE_KEY_FILE: /run/secrets/web_push_vapid_private_key
      WEB_PUSH_POLL_INTERVAL_MS: ${WEB_PUSH_POLL_INTERVAL_MS:-1000}
      WEB_PUSH_OUTBOX_POLL_MS: ${WEB_PUSH_OUTBOX_POLL_MS:-1000}
      GATEWAY_API_HOST: 0.0.0.0
      GATEWAY_API_PORT: '15001'
      GATEWAY_FRONTEND_PORT: '15000'
      FRONTEND_SERVE_MODE: static
      FRONTEND_ARTIFACT_ROOT: /srv/frontend-artifacts
      FRONTEND_SHARED_ASSET_PUBLIC_PATH: /gateway/profile-assets
      FRONTEND_READINESS_ORIGIN: http://caddy
      RELEASE_BUILDER_URL: http://builder:15100
      RELEASE_BUILD_NODE_OPTIONS: ${BUILDER_NODE_OPTIONS:---max-old-space-size=3072}
      GATEWAY_TRPC_PATH: /gateway/api/trpc
      CORE_NAVIGATION_CONFIG_FILE: /srv/data/navigation.json
      GATEWAY_INTERNAL_API_URL: http://127.0.0.1:15001
      GATEWAY_REDIS_PREFIX: sammo:gateway
      GATEWAY_WORKSPACE_ROOT: /srv/core/repository
      GATEWAY_WORKTREE_ROOT: /srv/core/profile-worktrees
      RELEASE_CONTROLLER_WORKSPACE_ROOT: /srv/core/repository
      RELEASE_CONTROLLER_WORKTREE_ROOT: /srv/core/release-worktrees
      GATEWAY_ACTIVE_RELEASE_GIT_REF: refs/sammo/active-gateway
      GATEWAY_BASE_PATH: /gateway
      VITE_APP_BASE_PATH: /gateway
      VITE_GATEWAY_API_URL: /gateway/api/trpc
      VITE_GAME_API_URL_TEMPLATE: /{profile}/api/trpc
      VITE_GAME_WEB_URL_TEMPLATE: /{profile}/
      VITE_IMAGE_PUBLIC_URL: ${IMAGE_PUBLIC_URL:-https://sam-image.hided.net}
      VITE_GATEWAY_USER_ICON_BASE_URL: ${IMAGE_PUBLIC_URL:-https://sam-image.hided.net}/icons
      VITE_PREVIEW_ALLOWED_HOSTS: ${DOMAIN:?set DOMAIN in .env}
      PM2_HOME: /srv/data/pm2
      TZ: ${TZ:-Asia/Seoul}
    volumes:
      - core-source:/srv/core
      - runtime-data:/srv/data
      - frontend-artifacts:/srv/frontend-artifacts
      - ${IMAGE_UPLOAD_CORE2026_SECRET_FILE:?set IMAGE_UPLOAD_CORE2026_SECRET_FILE in .env}:/run/secrets/image_upload_core2026_secret:ro
      - ${IMAGE_SYNC_CORE2026_SECRET_FILE:?set IMAGE_SYNC_CORE2026_SECRET_FILE in .env}:/run/secrets/image_sync_core2026_secret:ro
    secrets:
      - web_push_vapid_private_key
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      builder:
        condition: service_healthy
    healthcheck:
      test: [CMD, curl, --fail, --silent, http://127.0.0.1:15001/healthz]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 5m
    mem_limit: ${RUNTIME_MEMORY_LIMIT:-4g}
    memswap_limit: ${RUNTIME_MEMORY_SWAP_LIMIT:-4g}
    cpus: ${RUNTIME_CPU_LIMIT:-4}
    pids_limit: ${RUNTIME_PIDS_LIMIT:-512}
    stop_grace_period: 30s
    restart: unless-stopped

  caddy:
    image: caddy:2.10.2-alpine
    environment:
      DOMAIN: ${DOMAIN:?set DOMAIN in .env}
      SITE_ADDRESS: ${CADDY_SITE_ADDRESS:-${DOMAIN:?set DOMAIN in .env}}
      ACME_EMAIL: ${ACME_EMAIL:?set ACME_EMAIL in .env}
    ports:
      - ${HTTP_PORT:-80}:80
      - ${HTTPS_PORT:-443}:443
      - ${HTTPS_PORT:-443}:443/udp
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - ./data/image:/srv/image:ro
      - frontend-artifacts:/srv/frontend-artifacts:ro
      - caddy-data:/data
      - caddy-config:/config
    depends_on:
      runtime:
        condition: service_healthy
    restart: unless-stopped

secrets:
  web_push_vapid_private_key:
    file: ${WEB_PUSH_VAPID_PRIVATE_KEY_FILE:-./secrets/web_push_vapid_private_key.example}

volumes:
  postgres-data:
  redis-data:
  core-source:
  runtime-data:
  frontend-artifacts:
  builder-cache:
  caddy-data:
  caddy-config: