compose.yaml

x-app-env: &app-env
  ALERT_DELIVERY_FAILURE_RATE_THRESHOLD: ${ALERT_DELIVERY_FAILURE_RATE_THRESHOLD:-}
  ALERT_DELIVERY_MIN_ATTEMPTS: ${ALERT_DELIVERY_MIN_ATTEMPTS:-}
  ALERT_DELIVERY_SWEEP_ENABLED: ${ALERT_DELIVERY_SWEEP_ENABLED:-}
  ALERT_DELIVERY_SWEEP_INTERVAL: ${ALERT_DELIVERY_SWEEP_INTERVAL:-}
  ALERT_DELIVERY_WINDOW_HOURS: ${ALERT_DELIVERY_WINDOW_HOURS:-}
  ALERT_DIGEST_FLUSH_ENABLED: ${ALERT_DIGEST_FLUSH_ENABLED:-}
  ALERT_DIGEST_FLUSH_INTERVAL: ${ALERT_DIGEST_FLUSH_INTERVAL:-}
  ALERT_FIRE_SPIKE_MIN: ${ALERT_FIRE_SPIKE_MIN:-}
  ALERT_FIRE_SPIKE_MULTIPLIER: ${ALERT_FIRE_SPIKE_MULTIPLIER:-}
  ALERT_HEALTH_INTERVAL: ${ALERT_HEALTH_INTERVAL:-}
  AUDIT_IP_HMAC_SECRET: ${AUDIT_IP_HMAC_SECRET:-}
  AUDIT_RETENTION_DAYS: ${AUDIT_RETENTION_DAYS:-}
  AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
  AWS_DEFAULT_REGION: ${AWS_DEFAULT_REGION:-}
  AWS_REGION: ${AWS_REGION:-}
  AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
  AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-}
  BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:-}
  BETTER_AUTH_SECRETS: ${BETTER_AUTH_SECRETS:-}
  BETTER_AUTH_URL: "${BETTER_AUTH_URL:?Set BETTER_AUTH_URL to the public app origin in .env}"
  BISIBILITY_API_ANON_RATE_LIMIT_PER_MINUTE: ${BISIBILITY_API_ANON_RATE_LIMIT_PER_MINUTE:-}
  BISIBILITY_API_KEY_RATE_LIMIT_PER_MINUTE: ${BISIBILITY_API_KEY_RATE_LIMIT_PER_MINUTE:-}
  BISIBILITY_CLIENT_IP_HEADER: ${BISIBILITY_CLIENT_IP_HEADER:-}
  BISIBILITY_CLIENT_IP_XFF_DEPTH: ${BISIBILITY_CLIENT_IP_XFF_DEPTH:-}
  BISIBILITY_PROVIDER_RATE_LIMIT_DATAFORSEO_PER_MINUTE: ${BISIBILITY_PROVIDER_RATE_LIMIT_DATAFORSEO_PER_MINUTE:-}
  BISIBILITY_PROVIDER_RATE_LIMIT_DATAFORSEO_WINDOW_SECONDS: ${BISIBILITY_PROVIDER_RATE_LIMIT_DATAFORSEO_WINDOW_SECONDS:-}
  BISIBILITY_PROVIDER_RATE_LIMIT_DISABLED: ${BISIBILITY_PROVIDER_RATE_LIMIT_DISABLED:-}
  BISIBILITY_PROVIDER_RATE_LIMIT_GA4_PER_MINUTE: ${BISIBILITY_PROVIDER_RATE_LIMIT_GA4_PER_MINUTE:-}
  BISIBILITY_PROVIDER_RATE_LIMIT_GA4_WINDOW_SECONDS: ${BISIBILITY_PROVIDER_RATE_LIMIT_GA4_WINDOW_SECONDS:-}
  BISIBILITY_PROVIDER_RATE_LIMIT_GSC_PER_MINUTE: ${BISIBILITY_PROVIDER_RATE_LIMIT_GSC_PER_MINUTE:-}
  BISIBILITY_PROVIDER_RATE_LIMIT_GSC_WINDOW_SECONDS: ${BISIBILITY_PROVIDER_RATE_LIMIT_GSC_WINDOW_SECONDS:-}
  BISIBILITY_PROVIDER_RATE_LIMIT_SERPAPI_PER_MINUTE: ${BISIBILITY_PROVIDER_RATE_LIMIT_SERPAPI_PER_MINUTE:-}
  BISIBILITY_PROVIDER_RATE_LIMIT_SERPAPI_WINDOW_SECONDS: ${BISIBILITY_PROVIDER_RATE_LIMIT_SERPAPI_WINDOW_SECONDS:-}
  BISIBILITY_SECRETS_KEY: "${BISIBILITY_SECRETS_KEY:?Set BISIBILITY_SECRETS_KEY in .env. Generate one with: openssl rand -base64 32}"
  BISIBILITY_SECRETS_KEYS_RETIRED: ${BISIBILITY_SECRETS_KEYS_RETIRED:-}
  DATABASE_URL: "${DATABASE_URL:?Set DATABASE_URL in .env}"
  DATABASE_APPLICATION_NAME: ${DATABASE_APPLICATION_NAME:-bisibility-ssr}
  DATABASE_CONNECT_TIMEOUT_MS: ${DATABASE_CONNECT_TIMEOUT_MS:-5000}
  DATABASE_IDLE_TIMEOUT_MS: ${DATABASE_IDLE_TIMEOUT_MS:-10000}
  DATABASE_POOL_MAX: ${DATABASE_POOL_MAX:-3}
  DATAFORSEO_LOGIN: ${DATAFORSEO_LOGIN:-}
  DATAFORSEO_PASSWORD: ${DATAFORSEO_PASSWORD:-}
  DATA_REGION: ${DATA_REGION:-}
  DEMO_FIXED_OTP: ${DEMO_FIXED_OTP:-}
  DEMO_INSTANCE_INSECURE_AUTH_ACK: ${DEMO_INSTANCE_INSECURE_AUTH_ACK:-}
  DEPLOYMENT_ENV: ${DEPLOYMENT_ENV:-production}
  DEPLOYMENT_MODE: ${DEPLOYMENT_MODE:-self-host}
  DIRECT_URL: "${DIRECT_URL:?Set DIRECT_URL in .env}"
  EMAIL_ALERTS_FROM: ${EMAIL_ALERTS_FROM:-}
  EMAIL_DAILY_BUDGET_BULK: ${EMAIL_DAILY_BUDGET_BULK:-}
  EMAIL_DAILY_BUDGET_TRANSACTIONAL: ${EMAIL_DAILY_BUDGET_TRANSACTIONAL:-}
  EMAIL_FOUNDER_FROM: ${EMAIL_FOUNDER_FROM:-}
  EMAIL_FOUNDER_NAME: ${EMAIL_FOUNDER_NAME:-}
  EMAIL_FROM: ${EMAIL_FROM:-}
  EMAIL_PROVIDER: ${EMAIL_PROVIDER:-}
  GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
  GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
  GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
  GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
  INTERNAL_PROBE_TOKEN: ${INTERNAL_PROBE_TOKEN:-}
  LEGAL_CONTACT_EMAIL: ${LEGAL_CONTACT_EMAIL:-}
  LEGAL_OPERATOR_NAME: ${LEGAL_OPERATOR_NAME:-}
  LEGAL_PRIVACY_URL: ${LEGAL_PRIVACY_URL:-}
  LEGAL_TERMS_URL: ${LEGAL_TERMS_URL:-}
  OPS_EVENTS_ENABLED: ${OPS_EVENTS_ENABLED:-}
  OPS_HEARTBEAT_CRON: ${OPS_HEARTBEAT_CRON:-}
  OPS_HEARTBEAT_TZ: ${OPS_HEARTBEAT_TZ:-}
  OPS_NOTIFY_MODE: ${OPS_NOTIFY_MODE:-}
  OPS_SLACK_INCLUDE_NAMES: ${OPS_SLACK_INCLUDE_NAMES:-}
  OPS_SLACK_WEBHOOK_URL: ${OPS_SLACK_WEBHOOK_URL:-}
  OPS_THROTTLE_MINUTES: ${OPS_THROTTLE_MINUTES:-}
  RANK_CHECK_DISPATCHER_ENABLED: ${RANK_CHECK_DISPATCHER_ENABLED:-}
  RANK_CHECK_RAW_RETENTION_DAYS: ${RANK_CHECK_RAW_RETENTION_DAYS:-}
  RANK_CHECK_SCHEDULER_MODE: ${RANK_CHECK_SCHEDULER_MODE:-}
  REDIS_TLS_CA_B64: ${REDIS_TLS_CA_B64:-}
  REDIS_URL: ${REDIS_URL:-redis://redis:6379}
  RESEND_API_KEY: ${RESEND_API_KEY:-}
  SCHEDULER_DRIVER: none
  SERPAPI_API_KEY: ${SERPAPI_API_KEY:-}
  SES_CONFIGURATION_SET: ${SES_CONFIGURATION_SET:-}
  SES_REGION: ${SES_REGION:-}
  SITE_URL: "${SITE_URL:?Set SITE_URL to the public app origin in .env}"
  SLACK_CLIENT_ID: ${SLACK_CLIENT_ID:-}
  SLACK_CLIENT_SECRET: ${SLACK_CLIENT_SECRET:-}
  SMTP_URL: ${SMTP_URL:-}
  TRAFFIC_SNAPSHOT_RETENTION_DAYS: ${TRAFFIC_SNAPSHOT_RETENTION_DAYS:-}
  WEBHOOK_ALLOW_PRIVATE_NETWORK: ${WEBHOOK_ALLOW_PRIVATE_NETWORK:-}
  WORKER_SCHEMA_GUARD: ${WORKER_SCHEMA_GUARD:-}

services:
  db-migrations:
    image: ${BISIBILITY_IMAGE:-docker.io/corgicorner/bisibility:0.27.0}
    pull_policy: ${BISIBILITY_PULL_POLICY:-missing}
    command: >
      sh -c 'npm run db:migrate
      && if [ "$$DEMO_FIXED_OTP" = "1" ]; then node --experimental-strip-types prisma/seed.ts; fi'
    environment: *app-env
    depends_on:
      postgres:
        condition: service_healthy

  app:
    image: ${BISIBILITY_IMAGE:-docker.io/corgicorner/bisibility:0.27.0}
    pull_policy: ${BISIBILITY_PULL_POLICY:-missing}
    restart: unless-stopped
    ports:
      - "127.0.0.1:${APP_HOST_PORT:-3000}:3000"
    environment: *app-env
    depends_on:
      db-migrations:
        condition: service_completed_successfully
      redis:
        condition: service_started

  postgres:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_USER: bisibility
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}"
      POSTGRES_DB: bisibility
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U bisibility -d bisibility"]
      interval: 5s
      timeout: 5s
      retries: 10
    volumes:
      - postgres-data:/var/lib/postgresql/data

  redis:
    image: valkey/valkey:8-alpine
    restart: unless-stopped

volumes:
  postgres-data: