compose.yaml

services:
  app:
    build:
      context: .
    depends_on:
      postgres:
        condition: service_healthy
      gateway:
        condition: service_started
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER:-termkit}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/${POSTGRES_DB:-termkit}
      ORIGIN: ${ORIGIN:-https://localhost:3000}
      TERMKIT_INSECURE_LOCAL_HTTP: ${TERMKIT_INSECURE_LOCAL_HTTP:-0}
      APP_SECRET: ${APP_SECRET:?set APP_SECRET in .env}
      BODY_SIZE_LIMIT: ${BODY_SIZE_LIMIT:-55M}
      CREDENTIAL_MASTER_KEY: ${CREDENTIAL_MASTER_KEY:?set CREDENTIAL_MASTER_KEY in .env}
      MICROSOFT_AUTH_ENABLED: ${MICROSOFT_AUTH_ENABLED:-0}
      MICROSOFT_TENANT_ID: ${MICROSOFT_TENANT_ID:-}
      MICROSOFT_CLIENT_ID: ${MICROSOFT_CLIENT_ID:-}
      MICROSOFT_CLIENT_SECRET: ${MICROSOFT_CLIENT_SECRET:-}
      MICROSOFT_REDIRECT_URI: ${MICROSOFT_REDIRECT_URI:-}
      MICROSOFT_SCOPES: ${MICROSOFT_SCOPES:-}
      MICROSOFT_ALLOWED_DOMAINS: ${MICROSOFT_ALLOWED_DOMAINS:-}
      MICROSOFT_ADMIN_EMAILS: ${MICROSOFT_ADMIN_EMAILS:-}
      TERMKIT_IMPORT_SOURCE_SECRET: ${TERMKIT_IMPORT_SOURCE_SECRET:-}
      TERMKIT_SSH_KNOWN_HOSTS_PATH: ${TERMKIT_SSH_KNOWN_HOSTS_PATH:-/var/lib/termkit/ssh-known-hosts.json}
      TERMKIT_SSH_TRUST_ON_FIRST_USE: ${TERMKIT_SSH_TRUST_ON_FIRST_USE:-1}
      TERMKIT_SSH_ALLOW_PRODUCTION_TOFU: ${TERMKIT_SSH_ALLOW_PRODUCTION_TOFU:-1}
      GATEWAY_URL: ${GATEWAY_URL:-http://gateway:7171}
      GATEWAY_PUBLIC_URL: ${GATEWAY_PUBLIC_URL:-https://localhost:3000/gateway}
      GATEWAY_PROVISIONER_KEY: ${GATEWAY_PROVISIONER_KEY:?set GATEWAY_PROVISIONER_KEY in .env}
    ports:
      - '${APP_PORT:-3000}:3000'
    volumes:
      - app-data:/var/lib/termkit
    restart: unless-stopped

  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-termkit}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
      POSTGRES_DB: ${POSTGRES_DB:-termkit}
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U "$${POSTGRES_USER}" -d "$${POSTGRES_DB}"']
      interval: 5s
      timeout: 5s
      retries: 12
    volumes:
      - postgres-data:/var/lib/postgresql/data
    ports:
      - '127.0.0.1:${POSTGRES_PORT:-5432}:5432'
    restart: unless-stopped

  gateway:
    image: devolutions/devolutions-gateway:${DEVOLUTIONS_GATEWAY_TAG:-2026.1.1}
    environment:
      DGW_LISTEN: ${DGW_LISTEN:-0.0.0.0:7171}
      DGW_SUBJECT: ${DGW_SUBJECT:-localhost}
      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: '1'
      WEB_APP_ENABLED: 'true'
      WEB_APP_AUTHENTICATION: None
    expose:
      - '7171'
    ports:
      - '127.0.0.1:${GATEWAY_PORT:-7171}:7171'
    volumes:
      - gateway-data:/var/lib/devolutions-gateway
    restart: unless-stopped

volumes:
  app-data:
  postgres-data:
  gateway-data: