docker-compose.yml

services:
  migrate:
    image: ghcr.io/kanbn/kan-migrate:latest
    container_name: ${CONTAINER_NAME:-kan-migrate}
    networks:
      - kan-network
    build:
      context: .
      dockerfile: ./apps/web/Dockerfile
      target: migrate
    environment:
      - POSTGRES_URL=${POSTGRES_URL}
    depends_on:
      postgres:
        condition: service_healthy
    restart: "no"

  web:
    image: ghcr.io/kanbn/kan:latest
    container_name: ${CONTAINER_NAME:-kan-web}
    ports:
      - "${WEB_PORT:-3000}:3000"
    networks:
      - kan-network
    build:
      context: .
      dockerfile: ./apps/web/Dockerfile
      target: web
    env_file:
      - .env
    environment:
      # Required environment variables
      - NEXT_PUBLIC_BASE_URL=${NEXT_PUBLIC_BASE_URL}
      - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
      - POSTGRES_URL=${POSTGRES_URL}

      # Redis (optional - for rate limiting)
      - REDIS_URL=${REDIS_URL}

      # Logging (optional - debug, info, warn, error; defaults to debug in dev, info in prod)
      - LOG_LEVEL=${LOG_LEVEL}

      # Admin API key (optional)
      - KAN_ADMIN_API_KEY=${KAN_ADMIN_API_KEY}

      # SMTP (optional)
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT}
      - SMTP_USER=${SMTP_USER}
      - SMTP_PASSWORD=${SMTP_PASSWORD}
      - EMAIL_FROM=${EMAIL_FROM}
      - SMTP_REJECT_UNAUTHORIZED=${SMTP_REJECT_UNAUTHORIZED}

      # Disable email features entirely (optional)
      - NEXT_PUBLIC_DISABLE_EMAIL=${NEXT_PUBLIC_DISABLE_EMAIL}

      # S3 storage (optional)
      - S3_ACCESS_KEY_ID=${S3_ACCESS_KEY_ID}
      - S3_SECRET_ACCESS_KEY=${S3_SECRET_ACCESS_KEY}
      - S3_REGION=${S3_REGION}
      - S3_ENDPOINT=${S3_ENDPOINT}
      - S3_FORCE_PATH_STYLE=${S3_FORCE_PATH_STYLE}
      - S3_AVATAR_UPLOAD_LIMIT=${S3_AVATAR_UPLOAD_LIMIT}
      - NEXT_PUBLIC_STORAGE_URL=${NEXT_PUBLIC_STORAGE_URL}
      - NEXT_PUBLIC_AVATAR_BUCKET_NAME=${NEXT_PUBLIC_AVATAR_BUCKET_NAME}
      - NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME=${NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME}
      - NEXT_PUBLIC_STORAGE_DOMAIN=${NEXT_PUBLIC_STORAGE_DOMAIN}
      - NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS=${NEXT_PUBLIC_USE_VIRTUAL_HOSTED_URLS}

      # White label
      - NEXT_PUBLIC_WHITE_LABEL_HIDE_POWERED_BY=${NEXT_PUBLIC_WHITE_LABEL_HIDE_POWERED_BY}

      # Auth config (optional)
      - NEXT_PUBLIC_ALLOW_CREDENTIALS=${NEXT_PUBLIC_ALLOW_CREDENTIALS}
      - NEXT_PUBLIC_DISABLE_SIGN_UP=${NEXT_PUBLIC_DISABLE_SIGN_UP}

      # API configuration (optional)
      - NEXT_API_BODY_SIZE_LIMIT=${NEXT_API_BODY_SIZE_LIMIT}

      # Integration providers (optional)
      - TRELLO_APP_API_KEY=${TRELLO_APP_API_KEY}
      - TRELLO_APP_SECRET=${TRELLO_APP_SECRET}

      # Generic OIDC provider (optional)
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
      - OIDC_DISCOVERY_URL=${OIDC_DISCOVERY_URL}

      # OAuth providers (optional)
      - BETTER_AUTH_TRUSTED_ORIGINS=${BETTER_AUTH_TRUSTED_ORIGINS}
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
      - BETTER_AUTH_ALLOWED_DOMAINS=${BETTER_AUTH_ALLOWED_DOMAINS}
      - DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID}
      - DISCORD_CLIENT_SECRET=${DISCORD_CLIENT_SECRET}
      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}
      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}
      - GITLAB_CLIENT_ID=${GITLAB_CLIENT_ID}
      - GITLAB_CLIENT_SECRET=${GITLAB_CLIENT_SECRET}
      - GITLAB_ISSUER=${GITLAB_ISSUER}
      - MICROSOFT_CLIENT_ID=${MICROSOFT_CLIENT_ID}
      - MICROSOFT_CLIENT_SECRET=${MICROSOFT_CLIENT_SECRET}
      - TWITTER_CLIENT_ID=${TWITTER_CLIENT_ID}
      - TWITTER_CLIENT_SECRET=${TWITTER_CLIENT_SECRET}
      - KICK_CLIENT_ID=${KICK_CLIENT_ID}
      - KICK_CLIENT_SECRET=${KICK_CLIENT_SECRET}
      - ZOOM_CLIENT_ID=${ZOOM_CLIENT_ID}
      - ZOOM_CLIENT_SECRET=${ZOOM_CLIENT_SECRET}
      - DROPBOX_CLIENT_ID=${DROPBOX_CLIENT_ID}
      - DROPBOX_CLIENT_SECRET=${DROPBOX_CLIENT_SECRET}
      - VK_CLIENT_ID=${VK_CLIENT_ID}
      - VK_CLIENT_SECRET=${VK_CLIENT_SECRET}
      - LINKEDIN_CLIENT_ID=${LINKEDIN_CLIENT_ID}
      - LINKEDIN_CLIENT_SECRET=${LINKEDIN_CLIENT_SECRET}
      - REDDIT_CLIENT_ID=${REDDIT_CLIENT_ID}
      - REDDIT_CLIENT_SECRET=${REDDIT_CLIENT_SECRET}
      - ROBLOX_CLIENT_ID=${ROBLOX_CLIENT_ID}
      - ROBLOX_CLIENT_SECRET=${ROBLOX_CLIENT_SECRET}
      - SPOTIFY_CLIENT_ID=${SPOTIFY_CLIENT_ID}
      - SPOTIFY_CLIENT_SECRET=${SPOTIFY_CLIENT_SECRET}
      - TIKTOK_CLIENT_ID=${TIKTOK_CLIENT_ID}
      - TIKTOK_CLIENT_SECRET=${TIKTOK_CLIENT_SECRET}
      - TIKTOK_CLIENT_KEY=${TIKTOK_CLIENT_KEY}
      - TWITCH_CLIENT_ID=${TWITCH_CLIENT_ID}
      - TWITCH_CLIENT_SECRET=${TWITCH_CLIENT_SECRET}
      - APPLE_CLIENT_ID=${APPLE_CLIENT_ID}
      - APPLE_CLIENT_SECRET=${APPLE_CLIENT_SECRET}
      - APPLE_APP_BUNDLE_IDENTIFIER=${APPLE_APP_BUNDLE_IDENTIFIER}
    depends_on:
      migrate:
        condition: service_completed_successfully
    restart: unless-stopped

  postgres:
    image: postgres:15
    container_name: kan-db
    environment:
      - POSTGRES_DB=kan_db
      - POSTGRES_USER=kan
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    ports:
      - 5432:5432
    volumes:
      - kan_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U kan -d kan_db"]
      interval: 5s
      timeout: 5s
      retries: 10
    restart: unless-stopped
    networks:
      - kan-network

networks:
  kan-network:

volumes:
  kan_postgres_data: