223 lines
8.5 KiB
YAML
223 lines
8.5 KiB
YAML
# Mastodon using Docker named volumes. All runtime env vars are passed through (no env_file).
|
|
# Komodo / your orchestration should inject the environment variables listed below into each container.
|
|
services:
|
|
db:
|
|
image: postgres:14-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: mastodon_production
|
|
POSTGRES_USER: mastodon
|
|
# Komodo must provide DB_PASSWORD in the environment for this service
|
|
POSTGRES_PASSWORD: "${DB_PASSWORD}"
|
|
volumes:
|
|
- db-data:/var/lib/postgresql/data
|
|
|
|
redis:
|
|
image: redis:6-alpine
|
|
restart: unless-stopped
|
|
command: ["redis-server", "--appendonly", "yes"]
|
|
volumes:
|
|
- redis-data:/data
|
|
|
|
init:
|
|
image: ghcr.io/mastodon/mastodon:latest
|
|
depends_on:
|
|
- db
|
|
- redis
|
|
restart: "no"
|
|
volumes:
|
|
- public-system:/mastodon/public/system
|
|
- public-assets:/mastodon/public/assets
|
|
- public-packs:/mastodon/public/packs
|
|
- mastodon-log:/mastodon/log
|
|
environment:
|
|
- RAILS_ENV=production
|
|
- LOCAL_DOMAIN=${LOCAL_DOMAIN}
|
|
- LOCAL_HTTPS=${LOCAL_HTTPS}
|
|
- DB_HOST=${DB_HOST}
|
|
- DB_PORT=${DB_PORT}
|
|
- DB_NAME=${DB_NAME}
|
|
- DB_USER=${DB_USER}
|
|
- DB_PASS=${DB_PASS}
|
|
- DB_PASSWORD=${DB_PASSWORD}
|
|
- REDIS_URL=${REDIS_URL}
|
|
- SECRET_KEY_BASE=${SECRET_KEY_BASE}
|
|
- OTP_SECRET=${OTP_SECRET}
|
|
- VAPID_PUBLIC_KEY=${VAPID_PUBLIC_KEY}
|
|
- VAPID_PRIVATE_KEY=${VAPID_PRIVATE_KEY}
|
|
- ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=${ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY}
|
|
- ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=${ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY}
|
|
- ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=${ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT}
|
|
- SMTP_SERVER=${SMTP_SERVER}
|
|
- SMTP_PORT=${SMTP_PORT}
|
|
- SMTP_LOGIN=${SMTP_LOGIN}
|
|
- SMTP_PASSWORD=${SMTP_PASSWORD}
|
|
- SMTP_FROM_ADDRESS=${SMTP_FROM_ADDRESS}
|
|
- STREAMING_ENABLED=${STREAMING_ENABLED}
|
|
- RAILS_SERVE_STATIC_FILES=${RAILS_SERVE_STATIC_FILES}
|
|
command: >
|
|
bash -lc "
|
|
set -euo pipefail
|
|
|
|
echo '== Mastodon init job starting'
|
|
|
|
# 1) Verify ActiveRecord encryption keys. If missing, generate and print them and exit so operator can set them.
|
|
if [ -z \"${ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY:-}\" ] || [ -z \"${ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY:-}\" ] || [ -z \"${ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT:-}\" ]; then
|
|
echo 'ActiveRecord encryption keys are NOT set. Running bin/rails db:encryption:init to generate keys...'
|
|
bin/rails db:encryption:init || true
|
|
echo '======================================================='
|
|
echo 'The above command generated the ACTIVE_RECORD encryption keys. Copy them into Komodo (use these exact env names):'
|
|
echo ' ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY'
|
|
echo ' ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY'
|
|
echo ' ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT'
|
|
echo ''
|
|
echo 'After adding those to Komodo, re-run this init job (docker-compose run --rm --no-deps init).'
|
|
echo 'Exiting with code 1 to ensure you capture and persist the keys in your secret store.'
|
|
exit 1
|
|
fi
|
|
|
|
echo 'ActiveRecord encryption keys present. Continuing initialization...'
|
|
|
|
# 2) Wait for DB to accept connections (retry loop)
|
|
echo 'Waiting for Postgres to be ready...'
|
|
attempt=0
|
|
until bundle exec rails db:version >/dev/null 2>&1; do
|
|
attempt=$((attempt+1))
|
|
if [ \"$attempt\" -gt 60 ]; then
|
|
echo 'Timed out waiting for Postgres (60 attempts). Check DB connectivity and env vars.' >&2
|
|
exit 2
|
|
fi
|
|
echo \"Postgres not ready yet (attempt $attempt). Sleeping 2s...\"
|
|
sleep 2
|
|
done
|
|
echo 'Postgres is ready.'
|
|
|
|
# 3) Prepare DB (create/migrate as needed)
|
|
echo 'Running rails db:prepare (create DB / migrate if needed)...'
|
|
bundle exec rails db:prepare
|
|
|
|
# 4) Generate VAPID keys if not provided
|
|
if [ -z \"${VAPID_PUBLIC_KEY:-}\" ] || [ -z \"${VAPID_PRIVATE_KEY:-}\" ]; then
|
|
echo 'VAPID keys (VAPID_PUBLIC_KEY/VAPID_PRIVATE_KEY) are missing. Generating...'
|
|
bundle exec rake mastodon:webpush:generate_vapid_key || true
|
|
echo '======================================================='
|
|
echo 'If VAPID keys were printed above, copy them into Komodo as VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY and re-run this init job (or continue to start services if you accept missing VAPID keys).'
|
|
else
|
|
echo 'VAPID keys present.'
|
|
fi
|
|
|
|
# 5) Install JS deps and precompile assets
|
|
echo 'Installing javascript dependencies (yarn)...'
|
|
if command -v yarn >/dev/null 2>&1; then
|
|
yarn install --check-files --production=false
|
|
else
|
|
echo 'yarn not found in image; skipping yarn install (ensure assets are available in the image or build them externally).'
|
|
fi
|
|
|
|
echo 'Precompiling rails assets...'
|
|
RAILS_ENV=production bundle exec rails assets:precompile
|
|
|
|
echo 'Init job complete. You can now start web/sidekiq/streaming services.'
|
|
"
|
|
|
|
web:
|
|
image: ghcr.io/mastodon/mastodon:latest
|
|
depends_on:
|
|
- db
|
|
- redis
|
|
restart: unless-stopped
|
|
volumes:
|
|
- public-system:/mastodon/public/system
|
|
- public-assets:/mastodon/public/assets
|
|
- public-packs:/mastodon/public/packs
|
|
- mastodon-log:/mastodon/log
|
|
ports:
|
|
- "3000:3000"
|
|
environment:
|
|
- RAILS_ENV=production
|
|
- LOCAL_DOMAIN=${LOCAL_DOMAIN}
|
|
- LOCAL_HTTPS=${LOCAL_HTTPS}
|
|
- PORT=${PORT}
|
|
- STREAMING_PORT=${STREAMING_PORT}
|
|
- DB_HOST=${DB_HOST}
|
|
- DB_PORT=${DB_PORT}
|
|
- DB_NAME=${DB_NAME}
|
|
- DB_USER=${DB_USER}
|
|
- DB_PASS=${DB_PASS}
|
|
- DB_PASSWORD=${DB_PASSWORD}
|
|
- REDIS_URL=${REDIS_URL}
|
|
- SECRET_KEY_BASE=${SECRET_KEY_BASE}
|
|
- OTP_SECRET=${OTP_SECRET}
|
|
- VAPID_PUBLIC_KEY=${VAPID_PUBLIC_KEY}
|
|
- VAPID_PRIVATE_KEY=${VAPID_PRIVATE_KEY}
|
|
- ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=${ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY}
|
|
- ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=${ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY}
|
|
- ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=${ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT}
|
|
- SMTP_SERVER=${SMTP_SERVER}
|
|
- SMTP_PORT=${SMTP_PORT}
|
|
- SMTP_LOGIN=${SMTP_LOGIN}
|
|
- SMTP_PASSWORD=${SMTP_PASSWORD}
|
|
- SMTP_FROM_ADDRESS=${SMTP_FROM_ADDRESS}
|
|
- STREAMING_ENABLED=${STREAMING_ENABLED}
|
|
- RAILS_SERVE_STATIC_FILES=${RAILS_SERVE_STATIC_FILES}
|
|
command: bash -lc "RAILS_ENV=production bundle exec puma -C config/puma.rb"
|
|
|
|
sidekiq:
|
|
image: ghcr.io/mastodon/mastodon:latest
|
|
depends_on:
|
|
- db
|
|
- redis
|
|
restart: unless-stopped
|
|
volumes:
|
|
- public-system:/mastodon/public/system
|
|
- mastodon-log:/mastodon/log
|
|
environment:
|
|
- RAILS_ENV=production
|
|
- LOCAL_DOMAIN=${LOCAL_DOMAIN}
|
|
- DB_HOST=${DB_HOST}
|
|
- DB_PORT=${DB_PORT}
|
|
- DB_NAME=${DB_NAME}
|
|
- DB_USER=${DB_USER}
|
|
- DB_PASS=${DB_PASS}
|
|
- DB_PASSWORD=${DB_PASSWORD}
|
|
- REDIS_URL=${REDIS_URL}
|
|
- SECRET_KEY_BASE=${SECRET_KEY_BASE}
|
|
- VAPID_PUBLIC_KEY=${VAPID_PUBLIC_KEY}
|
|
- VAPID_PRIVATE_KEY=${VAPID_PRIVATE_KEY}
|
|
- ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=${ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY}
|
|
- ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=${ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY}
|
|
- ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=${ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT}
|
|
- SMTP_SERVER=${SMTP_SERVER}
|
|
- SMTP_PORT=${SMTP_PORT}
|
|
- SMTP_LOGIN=${SMTP_LOGIN}
|
|
- SMTP_PASSWORD=${SMTP_PASSWORD}
|
|
- SMTP_FROM_ADDRESS=${SMTP_FROM_ADDRESS}
|
|
command: bash -lc "RAILS_ENV=production bundle exec sidekiq"
|
|
|
|
streaming:
|
|
image: ghcr.io/mastodon/mastodon:latest
|
|
depends_on:
|
|
- redis
|
|
restart: unless-stopped
|
|
volumes:
|
|
- mastodon-log:/mastodon/log
|
|
ports:
|
|
- "4000:4000"
|
|
environment:
|
|
- RAILS_ENV=production
|
|
- LOCAL_DOMAIN=${LOCAL_DOMAIN}
|
|
- PORT=${STREAMING_PORT}
|
|
- REDIS_URL=${REDIS_URL}
|
|
- ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=${ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY}
|
|
- ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=${ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY}
|
|
- ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=${ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT}
|
|
- STREAMING_ENABLED=${STREAMING_ENABLED}
|
|
command: bash -lc "NODE_ENV=production ./bin/streaming"
|
|
|
|
volumes:
|
|
db-data:
|
|
redis-data:
|
|
public-system:
|
|
public-assets:
|
|
public-packs:
|
|
mastodon-log: |