konnosDashboard
compose.upstream.yml660 lines · main
1# Usage
2# Start: docker compose up -d
3# Stop: docker compose down
4# Dev mode: docker compose -f docker-compose.yml -f ./dev/docker-compose.dev.yml up -d
5# Reset everything: ./reset.sh
6#
7# TODO:
8# - Podman does not support nested variable interpolation (${A:-${B}})
9#
10
11name: briven
12
13services:
14
15 studio:
16 container_name: briven-studio
17 image: briven/studio:2026.04.27-sha-5f60601
18 restart: unless-stopped
19 healthcheck:
20 test:
21 [
22 "CMD-SHELL",
23 "node -e \"fetch('http://localhost:3000/api/platform/profile').then((r) => {if (r.status !== 200) throw new Error(r.status)})\""
24 ]
25 timeout: 10s
26 interval: 5s
27 retries: 3
28 depends_on:
29 analytics:
30 condition: service_healthy
31 environment:
32 # Listen on all IPv4 interfaces
33 HOSTNAME: "0.0.0.0"
34
35 STUDIO_PG_META_URL: http://meta:8080
36 POSTGRES_PORT: ${POSTGRES_PORT}
37 POSTGRES_HOST: ${POSTGRES_HOST}
38 POSTGRES_DB: ${POSTGRES_DB}
39 POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
40
41 # See: https://supabase.com/docs/guides/self-hosting/remove-superuser-access
42 #POSTGRES_USER_READ_WRITE: postgres
43
44 PG_META_CRYPTO_KEY: ${PG_META_CRYPTO_KEY}
45 PGRST_DB_SCHEMAS: ${PGRST_DB_SCHEMAS}
46 PGRST_DB_MAX_ROWS: ${PGRST_DB_MAX_ROWS:-1000}
47 PGRST_DB_EXTRA_SEARCH_PATH: ${PGRST_DB_EXTRA_SEARCH_PATH:-public}
48
49 DEFAULT_ORGANIZATION_NAME: ${STUDIO_DEFAULT_ORGANIZATION}
50 DEFAULT_PROJECT_NAME: ${STUDIO_DEFAULT_PROJECT}
51 OPENAI_API_KEY: ${OPENAI_API_KEY:-}
52
53 BRIVEN_URL: http://kong:8000
54 BRIVEN_PUBLIC_URL: ${BRIVEN_PUBLIC_URL}
55 BRIVEN_ANON_KEY: ${ANON_KEY}
56 BRIVEN_SERVICE_KEY: ${SERVICE_ROLE_KEY}
57 AUTH_JWT_SECRET: ${JWT_SECRET}
58
59 # LOGFLARE_API_KEY is deprecated
60 LOGFLARE_API_KEY: ${LOGFLARE_PUBLIC_ACCESS_TOKEN}
61 LOGFLARE_PUBLIC_ACCESS_TOKEN: ${LOGFLARE_PUBLIC_ACCESS_TOKEN}
62 LOGFLARE_PRIVATE_ACCESS_TOKEN: ${LOGFLARE_PRIVATE_ACCESS_TOKEN}
63
64 LOGFLARE_URL: http://analytics:4000
65 NEXT_PUBLIC_ENABLE_LOGS: "true"
66 # Comment to use Big Query backend for analytics
67 NEXT_ANALYTICS_BACKEND_PROVIDER: postgres
68 # Uncomment to use Big Query backend for analytics
69 # NEXT_ANALYTICS_BACKEND_PROVIDER: bigquery
70 SNIPPETS_MANAGEMENT_FOLDER: /app/snippets
71 EDGE_FUNCTIONS_MANAGEMENT_FOLDER: /app/edge-functions
72 volumes:
73 - ./volumes/snippets:/app/snippets:Z
74 - ./volumes/functions:/app/edge-functions:Z
75
76 kong:
77 container_name: briven-kong
78 image: kong/kong:3.9.1
79 restart: unless-stopped
80 networks:
81 default:
82 aliases:
83 - api-gw
84 healthcheck:
85 test: ["CMD", "kong", "health"]
86 interval: 5s
87 timeout: 5s
88 retries: 5
89 depends_on:
90 studio:
91 condition: service_healthy
92 ports:
93 - ${KONG_HTTP_PORT}:8000/tcp
94 - ${KONG_HTTPS_PORT}:8443/tcp
95 volumes:
96 # https://github.com/briven/briven/issues/12661
97 - ./volumes/api/kong.yml:/home/kong/temp.yml:ro,z
98 - ./volumes/api/kong-entrypoint.sh:/home/kong/kong-entrypoint.sh:ro,z
99 #- ./volumes/api/server.crt:/home/kong/server.crt:ro
100 #- ./volumes/api/server.key:/home/kong/server.key:ro
101 environment:
102 KONG_DATABASE: "off"
103 KONG_DECLARATIVE_CONFIG: /usr/local/kong/kong.yml
104 # https://github.com/briven/cli/issues/14
105 KONG_DNS_ORDER: LAST,A,CNAME
106 KONG_DNS_NOT_FOUND_TTL: 1
107 KONG_PLUGINS: request-transformer,cors,key-auth,acl,basic-auth,request-termination,ip-restriction,post-function
108 KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
109 KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
110 KONG_PROXY_ACCESS_LOG: /dev/stdout combined
111 #KONG_SSL_CERT: /home/kong/server.crt
112 #KONG_SSL_CERT_KEY: /home/kong/server.key
113 BRIVEN_ANON_KEY: ${ANON_KEY}
114 BRIVEN_SERVICE_KEY: ${SERVICE_ROLE_KEY}
115 BRIVEN_PUBLISHABLE_KEY: ${BRIVEN_PUBLISHABLE_KEY:-}
116 BRIVEN_SECRET_KEY: ${BRIVEN_SECRET_KEY:-}
117 ANON_KEY_ASYMMETRIC: ${ANON_KEY_ASYMMETRIC:-}
118 SERVICE_ROLE_KEY_ASYMMETRIC: ${SERVICE_ROLE_KEY_ASYMMETRIC:-}
119 DASHBOARD_USERNAME: ${DASHBOARD_USERNAME}
120 DASHBOARD_PASSWORD: ${DASHBOARD_PASSWORD}
121 entrypoint: /home/kong/kong-entrypoint.sh
122
123 auth:
124 container_name: briven-auth
125 image: briven/gotrue:v2.186.0
126 restart: unless-stopped
127 healthcheck:
128 test:
129 [
130 "CMD",
131 "wget",
132 "--no-verbose",
133 "--tries=1",
134 "--spider",
135 "http://localhost:9999/health"
136 ]
137 timeout: 5s
138 interval: 5s
139 retries: 3
140 depends_on:
141 db:
142 # Disable this if you are using an external Postgres database
143 condition: service_healthy
144 environment:
145 GOTRUE_API_HOST: 0.0.0.0
146 GOTRUE_API_PORT: 9999
147 API_EXTERNAL_URL: ${API_EXTERNAL_URL}
148
149 GOTRUE_DB_DRIVER: postgres
150 GOTRUE_DB_DATABASE_URL: postgres://briven_auth_admin:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
151
152 GOTRUE_SITE_URL: ${SITE_URL}
153 GOTRUE_URI_ALLOW_LIST: ${ADDITIONAL_REDIRECT_URLS}
154 GOTRUE_DISABLE_SIGNUP: ${DISABLE_SIGNUP}
155
156 GOTRUE_JWT_ADMIN_ROLES: service_role
157 GOTRUE_JWT_AUD: authenticated
158 GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
159 GOTRUE_JWT_EXP: ${JWT_EXPIRY}
160
161 # Legacy symmetric HS256 key
162 GOTRUE_JWT_SECRET: ${JWT_SECRET}
163
164 # JSON array of signing JWKs (EC private + legacy symmetric)
165 # For Podman, use: GOTRUE_JWT_KEYS: ${JWT_KEYS}
166 #GOTRUE_JWT_KEYS: ${JWT_KEYS:-[]}
167
168 GOTRUE_JWT_ISSUER: ${API_EXTERNAL_URL}/auth/v1
169
170 GOTRUE_EXTERNAL_EMAIL_ENABLED: ${ENABLE_EMAIL_SIGNUP}
171 GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED: ${ENABLE_ANONYMOUS_USERS}
172 GOTRUE_MAILER_AUTOCONFIRM: ${ENABLE_EMAIL_AUTOCONFIRM}
173
174 # Uncomment to bypass nonce check in ID Token flow. Commonly set to true when using Google Sign In on mobile.
175 # GOTRUE_EXTERNAL_SKIP_NONCE_CHECK: "true"
176
177 # GOTRUE_MAILER_SECURE_EMAIL_CHANGE_ENABLED: "true"
178 # GOTRUE_SMTP_MAX_FREQUENCY: 1s
179 GOTRUE_SMTP_ADMIN_EMAIL: ${SMTP_ADMIN_EMAIL}
180 GOTRUE_SMTP_HOST: ${SMTP_HOST}
181 GOTRUE_SMTP_PORT: ${SMTP_PORT}
182 GOTRUE_SMTP_USER: ${SMTP_USER}
183 GOTRUE_SMTP_PASS: ${SMTP_PASS}
184 GOTRUE_SMTP_SENDER_NAME: ${SMTP_SENDER_NAME}
185 GOTRUE_MAILER_URLPATHS_INVITE: ${MAILER_URLPATHS_INVITE}
186 GOTRUE_MAILER_URLPATHS_CONFIRMATION: ${MAILER_URLPATHS_CONFIRMATION}
187 GOTRUE_MAILER_URLPATHS_RECOVERY: ${MAILER_URLPATHS_RECOVERY}
188 GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE: ${MAILER_URLPATHS_EMAIL_CHANGE}
189
190 GOTRUE_EXTERNAL_PHONE_ENABLED: ${ENABLE_PHONE_SIGNUP}
191 GOTRUE_SMS_AUTOCONFIRM: ${ENABLE_PHONE_AUTOCONFIRM}
192
193 # Uncomment to enable OAuth / social login providers.
194 # GOTRUE_EXTERNAL_GOOGLE_ENABLED: ${GOOGLE_ENABLED}
195 # GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
196 # GOTRUE_EXTERNAL_GOOGLE_SECRET: ${GOOGLE_SECRET}
197 # GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: ${API_EXTERNAL_URL}/auth/v1/callback
198
199 # GOTRUE_EXTERNAL_GITHUB_ENABLED: ${GITHUB_ENABLED}
200 # GOTRUE_EXTERNAL_GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID}
201 # GOTRUE_EXTERNAL_GITHUB_SECRET: ${GITHUB_SECRET}
202 # GOTRUE_EXTERNAL_GITHUB_REDIRECT_URI: ${API_EXTERNAL_URL}/auth/v1/callback
203
204 # GOTRUE_EXTERNAL_AZURE_ENABLED: ${AZURE_ENABLED}
205 # GOTRUE_EXTERNAL_AZURE_CLIENT_ID: ${AZURE_CLIENT_ID}
206 # GOTRUE_EXTERNAL_AZURE_SECRET: ${AZURE_SECRET}
207 # GOTRUE_EXTERNAL_AZURE_REDIRECT_URI: ${API_EXTERNAL_URL}/auth/v1/callback
208
209 # Uncomment to configure SMS delivery (phone auth and phone MFA).
210 # GOTRUE_SMS_PROVIDER: ${SMS_PROVIDER}
211 # GOTRUE_SMS_OTP_EXP: ${SMS_OTP_EXP}
212 # GOTRUE_SMS_OTP_LENGTH: ${SMS_OTP_LENGTH}
213 # GOTRUE_SMS_MAX_FREQUENCY: ${SMS_MAX_FREQUENCY}
214 # GOTRUE_SMS_TEMPLATE: ${SMS_TEMPLATE}
215
216 # Twilio credentials (when SMS_PROVIDER=twilio)
217 # GOTRUE_SMS_TWILIO_ACCOUNT_SID: ${SMS_TWILIO_ACCOUNT_SID}
218 # GOTRUE_SMS_TWILIO_AUTH_TOKEN: ${SMS_TWILIO_AUTH_TOKEN}
219 # GOTRUE_SMS_TWILIO_MESSAGE_SERVICE_SID: ${SMS_TWILIO_MESSAGE_SERVICE_SID}
220
221 # Test OTP mappings for development
222 # GOTRUE_SMS_TEST_OTP: ${SMS_TEST_OTP}
223
224 # Uncomment to configure multi-factor authentication (MFA).
225 # GOTRUE_MFA_TOTP_ENROLL_ENABLED: ${MFA_TOTP_ENROLL_ENABLED}
226 # GOTRUE_MFA_TOTP_VERIFY_ENABLED: ${MFA_TOTP_VERIFY_ENABLED}
227 # GOTRUE_MFA_PHONE_ENROLL_ENABLED: ${MFA_PHONE_ENROLL_ENABLED}
228 # GOTRUE_MFA_PHONE_VERIFY_ENABLED: ${MFA_PHONE_VERIFY_ENABLED}
229 # GOTRUE_MFA_MAX_ENROLLED_FACTORS: ${MFA_MAX_ENROLLED_FACTORS}
230
231 # SAML SSO
232 # GOTRUE_SAML_ENABLED: ${SAML_ENABLED}
233 # GOTRUE_SAML_PRIVATE_KEY: ${SAML_PRIVATE_KEY}
234 # GOTRUE_SAML_ALLOW_ENCRYPTED_ASSERTIONS: ${SAML_ALLOW_ENCRYPTED_ASSERTIONS}
235 # GOTRUE_SAML_RELAY_STATE_VALIDITY_PERIOD: ${SAML_RELAY_STATE_VALIDITY_PERIOD}
236 # GOTRUE_SAML_EXTERNAL_URL: ${SAML_EXTERNAL_URL}
237 # GOTRUE_SAML_RATE_LIMIT_ASSERTION: ${SAML_RATE_LIMIT_ASSERTION}
238
239 # Uncomment to enable custom access token hook.
240 # See: https://supabase.com/docs/guides/auth/auth-hooks for
241 # full list of hooks and additional details about custom_access_token_hook
242
243 # GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED: "true"
244 # GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_URI: "pg-functions://postgres/public/custom_access_token_hook"
245 # GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_SECRETS: "<standard-base64-secret>"
246
247 # GOTRUE_HOOK_MFA_VERIFICATION_ATTEMPT_ENABLED: "true"
248 # GOTRUE_HOOK_MFA_VERIFICATION_ATTEMPT_URI: "pg-functions://postgres/public/mfa_verification_attempt"
249
250 # GOTRUE_HOOK_PASSWORD_VERIFICATION_ATTEMPT_ENABLED: "true"
251 # GOTRUE_HOOK_PASSWORD_VERIFICATION_ATTEMPT_URI: "pg-functions://postgres/public/password_verification_attempt"
252
253 # GOTRUE_HOOK_SEND_SMS_ENABLED: "false"
254 # GOTRUE_HOOK_SEND_SMS_URI: "pg-functions://postgres/public/custom_access_token_hook"
255 # GOTRUE_HOOK_SEND_SMS_SECRETS: "v1,whsec_VGhpcyBpcyBhbiBleGFtcGxlIG9mIGEgc2hvcnRlciBCYXNlNjQgc3RyaW5n"
256
257 # GOTRUE_HOOK_SEND_EMAIL_ENABLED: "false"
258 # GOTRUE_HOOK_SEND_EMAIL_URI: "http://host.docker.internal:54321/functions/v1/email_sender"
259 # GOTRUE_HOOK_SEND_EMAIL_SECRETS: "v1,whsec_VGhpcyBpcyBhbiBleGFtcGxlIG9mIGEgc2hvcnRlciBCYXNlNjQgc3RyaW5n"
260
261 rest:
262 container_name: briven-rest
263 image: postgrest/postgrest:v14.8
264 restart: unless-stopped
265 depends_on:
266 db:
267 # Disable this if you are using an external Postgres database
268 condition: service_healthy
269 environment:
270 PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
271 PGRST_DB_SCHEMAS: ${PGRST_DB_SCHEMAS}
272 PGRST_DB_MAX_ROWS: ${PGRST_DB_MAX_ROWS:-1000}
273 PGRST_DB_EXTRA_SEARCH_PATH: ${PGRST_DB_EXTRA_SEARCH_PATH:-public}
274 PGRST_DB_ANON_ROLE: anon
275
276 # PostgREST accepts a plain-text symmetric secret, a single JWK, or a JWKS.
277 # For Podman, use either PGRST_JWT_SECRET: ${JWT_SECRET} or
278 # PGRST_JWT_SECRET: ${JWT_JWKS}
279 PGRST_JWT_SECRET: ${JWT_JWKS:-${JWT_SECRET}}
280
281 PGRST_DB_USE_LEGACY_GUCS: "false"
282 PGRST_APP_SETTINGS_JWT_SECRET: ${JWT_SECRET}
283 PGRST_APP_SETTINGS_JWT_EXP: ${JWT_EXPIRY}
284 command:
285 [
286 "postgrest"
287 ]
288
289 realtime:
290 # This container name looks inconsistent but is correct because realtime constructs tenant id by parsing the subdomain
291 container_name: realtime-dev.briven-realtime
292 image: briven/realtime:v2.76.5
293 restart: unless-stopped
294 depends_on:
295 db:
296 # Disable this if you are using an external Postgres database
297 condition: service_healthy
298 healthcheck:
299 test:
300 [
301 "CMD-SHELL",
302 "curl -sSfL --head -o /dev/null -H \"Authorization: Bearer ${ANON_KEY}\" http://localhost:4000/api/tenants/realtime-dev/health"
303 ]
304 timeout: 5s
305 interval: 30s
306 retries: 3
307 start_period: 10s
308 environment:
309 PORT: 4000
310 DB_HOST: ${POSTGRES_HOST}
311 DB_PORT: ${POSTGRES_PORT}
312 DB_USER: briven_admin
313 DB_PASSWORD: ${POSTGRES_PASSWORD}
314 DB_NAME: ${POSTGRES_DB}
315 DB_AFTER_CONNECT_QUERY: 'SET search_path TO _realtime'
316 DB_ENC_KEY: brivenrealtime
317
318 # Legacy symmetric HS256 key
319 API_JWT_SECRET: ${JWT_SECRET}
320
321 # JWKS for token verification (EC public + legacy symmetric).
322 # For Podman, use: API_JWT_JWKS: ${JWT_JWKS}
323 #API_JWT_JWKS: ${JWT_JWKS:-{"keys":[]}}
324
325 SECRET_KEY_BASE: ${SECRET_KEY_BASE}
326 METRICS_JWT_SECRET: ${JWT_SECRET}
327 ERL_AFLAGS: -proto_dist inet_tcp
328 DNS_NODES: "''"
329 RLIMIT_NOFILE: "10000"
330 APP_NAME: realtime
331 SEED_SELF_HOST: "true"
332 RUN_JANITOR: "true"
333 DISABLE_HEALTHCHECK_LOGGING: "true"
334
335 # To use S3 backed storage: docker compose -f docker-compose.yml -f docker-compose.s3.yml up
336 storage:
337 container_name: briven-storage
338 image: briven/storage-api:v1.48.26
339 restart: unless-stopped
340 depends_on:
341 db:
342 # Disable this if you are using an external Postgres database
343 condition: service_healthy
344 rest:
345 condition: service_started
346 imgproxy:
347 condition: service_started
348 healthcheck:
349 test:
350 [
351 "CMD",
352 "wget",
353 "--no-verbose",
354 "--tries=1",
355 "--spider",
356 "http://storage:5000/status"
357 ]
358 timeout: 5s
359 interval: 5s
360 retries: 3
361 start_period: 10s
362 environment:
363 ANON_KEY: ${ANON_KEY}
364 SERVICE_KEY: ${SERVICE_ROLE_KEY}
365 POSTGREST_URL: http://rest:3000
366
367 # Legacy symmetric HS256 key
368 AUTH_JWT_SECRET: ${JWT_SECRET}
369
370 # JWKS for token verification (EC public + legacy symmetric).
371 # For Podman, use: JWT_JWKS: ${JWT_JWKS}
372 #JWT_JWKS: ${JWT_JWKS:-{"keys":[]}}
373
374 DATABASE_URL: postgres://briven_storage_admin:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
375 STORAGE_PUBLIC_URL: ${BRIVEN_PUBLIC_URL}
376 REQUEST_ALLOW_X_FORWARDED_PATH: "true"
377 FILE_SIZE_LIMIT: 52428800
378 STORAGE_BACKEND: file
379 # S3 bucket when using S3 backend, directory name when using 'file'
380 GLOBAL_S3_BUCKET: ${GLOBAL_S3_BUCKET}
381 # S3 Backend configuration
382 #GLOBAL_S3_ENDPOINT: https://your-s3-endpoint
383 #GLOBAL_S3_PROTOCOL: https
384 #GLOBAL_S3_FORCE_PATH_STYLE: "true"
385 #AWS_ACCESS_KEY_ID: your-access-key-id
386 #AWS_SECRET_ACCESS_KEY: your-secret-access-key
387 FILE_STORAGE_BACKEND_PATH: /var/lib/storage
388 TENANT_ID: ${STORAGE_TENANT_ID}
389 # TODO: https://github.com/briven/storage-api/issues/55
390 REGION: ${REGION}
391 ENABLE_IMAGE_TRANSFORMATION: "true"
392 IMGPROXY_URL: http://imgproxy:5001
393 # S3 protocol endpoint configuration
394 S3_PROTOCOL_ACCESS_KEY_ID: ${S3_PROTOCOL_ACCESS_KEY_ID}
395 S3_PROTOCOL_ACCESS_KEY_SECRET: ${S3_PROTOCOL_ACCESS_KEY_SECRET}
396 volumes:
397 - ./volumes/storage:/var/lib/storage:z
398
399 imgproxy:
400 container_name: briven-imgproxy
401 image: darthsim/imgproxy:v3.30.1
402 restart: unless-stopped
403 volumes:
404 - ./volumes/storage:/var/lib/storage:z
405 healthcheck:
406 test:
407 [
408 "CMD",
409 "imgproxy",
410 "health"
411 ]
412 timeout: 5s
413 interval: 5s
414 retries: 3
415 environment:
416 IMGPROXY_BIND: ":5001"
417 IMGPROXY_LOCAL_FILESYSTEM_ROOT: /
418 IMGPROXY_USE_ETAG: "true"
419 IMGPROXY_AUTO_WEBP: ${IMGPROXY_AUTO_WEBP}
420 IMGPROXY_MAX_SRC_RESOLUTION: 16.8
421
422 meta:
423 container_name: briven-meta
424 image: briven/postgres-meta:v0.96.3
425 restart: unless-stopped
426 depends_on:
427 db:
428 # Disable this if you are using an external Postgres database
429 condition: service_healthy
430 environment:
431 PG_META_PORT: 8080
432 PG_META_DB_HOST: ${POSTGRES_HOST}
433 PG_META_DB_PORT: ${POSTGRES_PORT}
434 PG_META_DB_NAME: ${POSTGRES_DB}
435 PG_META_DB_USER: briven_admin
436 PG_META_DB_PASSWORD: ${POSTGRES_PASSWORD}
437 CRYPTO_KEY: ${PG_META_CRYPTO_KEY}
438
439 functions:
440 container_name: briven-edge-functions
441 image: briven/edge-runtime:v1.71.2
442 restart: unless-stopped
443 volumes:
444 - ./volumes/functions:/home/deno/functions:Z
445 - deno-cache:/root/.cache/deno
446 depends_on:
447 kong:
448 condition: service_healthy
449 environment:
450 # Legacy symmetric HS256 key
451 JWT_SECRET: ${JWT_SECRET}
452 BRIVEN_URL: http://kong:8000
453 BRIVEN_PUBLIC_URL: ${BRIVEN_PUBLIC_URL}
454 # Legacy API keys (HS256-signed JWTs)
455 BRIVEN_ANON_KEY: ${ANON_KEY}
456 BRIVEN_SERVICE_ROLE_KEY: ${SERVICE_ROLE_KEY}
457 # New opaque API keys
458 BRIVEN_PUBLISHABLE_KEYS: "{\"default\":\"${BRIVEN_PUBLISHABLE_KEY:-}\"}"
459 BRIVEN_SECRET_KEYS: "{\"default\":\"${BRIVEN_SECRET_KEY:-}\"}"
460 BRIVEN_DB_URL: postgresql://postgres:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
461 # TODO: Allow configuring VERIFY_JWT per function.
462 VERIFY_JWT: "${FUNCTIONS_VERIFY_JWT}"
463 command:
464 [
465 "start",
466 "--main-service",
467 "/home/deno/functions/main"
468 ]
469
470 analytics:
471 container_name: briven-analytics
472 image: briven/logflare:1.36.1
473 restart: unless-stopped
474 # ports:
475 # - 4000:4000
476 # Uncomment to use Big Query backend for analytics
477 # volumes:
478 # - type: bind
479 # source: ${PWD}/gcloud.json
480 # target: /opt/app/rel/logflare/bin/gcloud.json
481 # read_only: true
482 healthcheck:
483 test:
484 [
485 "CMD-SHELL",
486 "curl -sSfL -o /dev/null http://localhost:4000/health"
487 ]
488 timeout: 5s
489 interval: 5s
490 retries: 10
491 depends_on:
492 db:
493 # Disable this if you are using an external Postgres database
494 condition: service_healthy
495 environment:
496 LOGFLARE_NODE_HOST: 127.0.0.1
497 DB_USERNAME: briven_admin
498 DB_DATABASE: _briven
499 DB_HOSTNAME: ${POSTGRES_HOST}
500 DB_PORT: ${POSTGRES_PORT}
501 DB_PASSWORD: ${POSTGRES_PASSWORD}
502 DB_SCHEMA: _analytics
503 LOGFLARE_PUBLIC_ACCESS_TOKEN: ${LOGFLARE_PUBLIC_ACCESS_TOKEN}
504 LOGFLARE_PRIVATE_ACCESS_TOKEN: ${LOGFLARE_PRIVATE_ACCESS_TOKEN}
505 LOGFLARE_SINGLE_TENANT: "true"
506 LOGFLARE_BRIVEN_MODE: "true"
507
508 # Comment variables to use Big Query backend for analytics
509 POSTGRES_BACKEND_URL: postgresql://briven_admin:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/_briven
510 POSTGRES_BACKEND_SCHEMA: _analytics
511 LOGFLARE_FEATURE_FLAG_OVERRIDE: multibackend=true
512 # Uncomment to use Big Query backend for analytics
513 # GOOGLE_PROJECT_ID: ${GOOGLE_PROJECT_ID}
514 # GOOGLE_PROJECT_NUMBER: ${GOOGLE_PROJECT_NUMBER}
515
516 # Comment out everything below this point if you are using an external Postgres database
517 db:
518 container_name: briven-db
519 image: briven/postgres:15.8.1.085
520 restart: unless-stopped
521 volumes:
522 - ./volumes/db/realtime.sql:/docker-entrypoint-initdb.d/migrations/99-realtime.sql:Z
523 # Must be superuser to create event trigger
524 - ./volumes/db/webhooks.sql:/docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql:Z
525 # Must be superuser to alter reserved role
526 - ./volumes/db/roles.sql:/docker-entrypoint-initdb.d/init-scripts/99-roles.sql:Z
527 # Initialize the database settings with JWT_SECRET and JWT_EXP
528 - ./volumes/db/jwt.sql:/docker-entrypoint-initdb.d/init-scripts/99-jwt.sql:Z
529 # PGDATA directory is persisted between restarts
530 - ./volumes/db/data:/var/lib/postgresql/data:Z
531 # Changes required for internal briven data such as _analytics
532 - ./volumes/db/_briven.sql:/docker-entrypoint-initdb.d/migrations/97-_briven.sql:Z
533 # Changes required for Analytics support
534 - ./volumes/db/logs.sql:/docker-entrypoint-initdb.d/migrations/99-logs.sql:Z
535 # Changes required for Pooler support
536 - ./volumes/db/pooler.sql:/docker-entrypoint-initdb.d/migrations/99-pooler.sql:Z
537 # Use named volume to persist pgsodium decryption key between restarts
538 - db-config:/etc/postgresql-custom
539 healthcheck:
540 test:
541 [
542 "CMD",
543 "pg_isready",
544 "-U",
545 "postgres",
546 "-h",
547 "localhost"
548 ]
549 interval: 5s
550 timeout: 5s
551 retries: 10
552 environment:
553 POSTGRES_HOST: /var/run/postgresql
554 PGPORT: ${POSTGRES_PORT}
555 POSTGRES_PORT: ${POSTGRES_PORT}
556 PGPASSWORD: ${POSTGRES_PASSWORD}
557 POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
558 PGDATABASE: ${POSTGRES_DB}
559 POSTGRES_DB: ${POSTGRES_DB}
560 JWT_SECRET: ${JWT_SECRET}
561 JWT_EXP: ${JWT_EXPIRY}
562 command:
563 [
564 "postgres",
565 "-c",
566 "config_file=/etc/postgresql/postgresql.conf",
567 "-c",
568 "log_min_messages=fatal" # prevents Realtime polling queries from appearing in logs
569 ]
570
571 vector:
572 container_name: briven-vector
573 image: timberio/vector:0.53.0-alpine
574 restart: unless-stopped
575 volumes:
576 - ./volumes/logs/vector.yml:/etc/vector/vector.yml:ro,z
577 - ${DOCKER_SOCKET_LOCATION}:/var/run/docker.sock:ro,z
578 healthcheck:
579 test:
580 [
581 "CMD",
582 "wget",
583 "--no-verbose",
584 "--tries=1",
585 "--spider",
586 "http://vector:9001/health"
587 ]
588 timeout: 5s
589 interval: 5s
590 retries: 3
591 depends_on:
592 analytics:
593 condition: service_healthy
594 environment:
595 LOGFLARE_PUBLIC_ACCESS_TOKEN: ${LOGFLARE_PUBLIC_ACCESS_TOKEN}
596 command:
597 [
598 "--config",
599 "/etc/vector/vector.yml"
600 ]
601 security_opt:
602 - "label=disable"
603
604 # Update the DATABASE_URL if you are using an external Postgres database
605 supavisor:
606 container_name: briven-pooler
607 image: briven/supavisor:2.7.4
608 restart: unless-stopped
609 ports:
610 - ${POSTGRES_PORT}:5432
611 - ${POOLER_PROXY_PORT_TRANSACTION}:6543
612 volumes:
613 - ./volumes/pooler/pooler.exs:/etc/pooler/pooler.exs:ro,z
614 healthcheck:
615 test:
616 [
617 "CMD",
618 "curl",
619 "-sSfL",
620 "--head",
621 "-o",
622 "/dev/null",
623 "http://127.0.0.1:4000/api/health"
624 ]
625 interval: 10s
626 timeout: 5s
627 retries: 10
628 start_period: 30s
629 depends_on:
630 db:
631 condition: service_healthy
632 environment:
633 PORT: 4000
634 POSTGRES_PORT: ${POSTGRES_PORT}
635 POSTGRES_HOST: ${POSTGRES_HOST}
636 POSTGRES_DB: ${POSTGRES_DB}
637 POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
638 DATABASE_URL: ecto://briven_admin:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/_briven
639 CLUSTER_POSTGRES: "true"
640 SECRET_KEY_BASE: ${SECRET_KEY_BASE}
641 VAULT_ENC_KEY: ${VAULT_ENC_KEY}
642 API_JWT_SECRET: ${JWT_SECRET}
643 METRICS_JWT_SECRET: ${JWT_SECRET}
644 REGION: local
645 ERL_AFLAGS: -proto_dist inet_tcp
646 POOLER_TENANT_ID: ${POOLER_TENANT_ID}
647 POOLER_DEFAULT_POOL_SIZE: ${POOLER_DEFAULT_POOL_SIZE}
648 POOLER_MAX_CLIENT_CONN: ${POOLER_MAX_CLIENT_CONN}
649 POOLER_POOL_MODE: transaction
650 DB_POOL_SIZE: ${POOLER_DB_POOL_SIZE}
651 command:
652 [
653 "/bin/sh",
654 "-c",
655 "/app/bin/migrate && /app/bin/supavisor eval \"$$(cat /etc/pooler/pooler.exs)\" && /app/bin/server"
656 ]
657
658volumes:
659 db-config:
660 deno-cache: