docker-compose.yaml

# Roomote Coolify template definition.
#
# This file is the maintained source of truth for running Roomote as a
# Coolify Docker Compose resource. Paste its contents into a new
# "Docker Compose Empty" resource in Coolify (see README.md for the full
# walkthrough). `${SERVICE_*}` values use Coolify's magic environment
# variables and are generated or resolved by Coolify at deploy time.
#
# Design notes:
# - Web, api, bullmq, and the db-migrate one-shot use the non-root
#   compatibility image. The controller uses its dedicated non-root image,
#   which is the only control-plane image containing the Docker CLI.
# - Coolify's proxy is the HTTPS edge. There is no bundled Caddy and no
#   `/_roomote-api` path routing: web, api, and minio each get their own
#   public domain through `SERVICE_FQDN_*` declarations, and `TRPC_URL`
#   points at the api origin directly.
# - Coolify magic variables with the same name resolve to the same value
#   across every service in this resource, so shared secrets such as
#   `SERVICE_PASSWORD_MINIO` are safe to reference in more than one place
#   (unlike Railway's per-occurrence `secret()` template function).
# - The Coolify host has a Docker socket, so the `docker` sandbox provider
#   works and is the template default. Only a restricted internal proxy mounts
#   the raw socket; the controller and BullMQ reach their allowed API sections
#   over the docker-api network. Hosted sandboxes
#   (modal/e2b/daytona/blaxel/box/azure) are a config-only swap; see "Task
#   execution" in README.md.
# - No openssl provisioning step. `R_AUTO_GENERATE_KEYS=true` makes
#   Roomote generate the `JOB_AUTH_*`/`PREVIEW_AUTH_*` P-256 keypairs at
#   first boot and persist them encrypted (with `ENCRYPTION_KEY`) in
#   Postgres.
# - The template tracks the mutable `:develop` image alias and contains no
#   version strings. The images bake RELEASE_VERSION; the app derives
#   `DOCKER_WORKER_IMAGE` from it, and the controller reads the worker
#   release version from the VERSION file inside `worker-current.tar.gz`.
#   Production deployments can pin an immutable `v*` tag in the
#   `x-roomote-app-image` anchor.
# - `SETUP_TOKEN` is generated by default because Coolify domains are
#   publicly reachable. Copy it from the resource's environment variables
#   panel to open `/setup`.
# - Live previews stay disabled by default. They need a wildcard domain
#   routed to the optional preview-proxy service; see README.md.

x-roomote-app-image: &roomote-app-image ghcr.io/roocodeinc/roomote-app:develop

# Shared by every app service. Coolify resolves the same magic variable to
# the same generated value in each service of this resource.
x-roomote-shared-env: &roomote-shared-env
  R_APP_ENV: production
  ROOMOTE_DOCKER_LOAD_ENV_FILE: 'false'
  R_AUTO_GENERATE_KEYS: 'true'
  ENCRYPTION_KEY: ${SERVICE_BASE64_64_ENCRYPTIONKEY}
  # Transport secret between API and BullMQ Discord Gateway.
  R_DISCORD_GATEWAY_SECRET: ${SERVICE_PASSWORD_DISCORDGATEWAY}
  ARTIFACT_SIGNING_KEY: ${SERVICE_BASE64_64_ARTIFACTSIGNING}
  DASHBOARD_PASSWORD: ${SERVICE_PASSWORD_DASHBOARD}
  SETUP_TOKEN: ${SERVICE_PASSWORD_SETUPTOKEN}
  S3_ACCESS_KEY_ID: roomote
  S3_SECRET_ACCESS_KEY: ${SERVICE_PASSWORD_MINIO}
  S3_REGION: us-east-1
  S3_BUCKET_ARTIFACTS: roomote-artifacts
  S3_AUTO_CREATE_BUCKET: 'true' # api creates the MinIO bucket at boot
  DEFAULT_COMPUTE_PROVIDER: docker
  DATABASE_URL: postgres://postgres:${SERVICE_PASSWORD_POSTGRES}@postgres:5432/roomote
  REDIS_URL: redis://redis:6379
  R_APP_URL: ${SERVICE_URL_WEB}
  R_PUBLIC_URL: ${SERVICE_URL_WEB}
  R_INSTANCE_ID: ${R_INSTANCE_ID:-}
  TRPC_URL: ${SERVICE_URL_API}
  R_DISCORD_BOT_TOKEN: ${R_DISCORD_BOT_TOKEN:-}
  S3_ENDPOINT: http://minio:9000
  S3_PRESIGN_ENDPOINT: ${SERVICE_URL_MINIO}
  # The Brain (shared memory). Leave the key empty and the gbrain service
  # below still runs but nothing uses it: every Brain code path is gated on
  # this key, so the deployment behaves exactly as if there were no Brain.
  # Fill it in and the deployment provisions its own scoped clients on the
  # next tick. See "Enabling the Brain" in README.md.
  R_BRAIN_OPENROUTER_API_KEY: ${R_BRAIN_OPENROUTER_API_KEY:-}
  R_BRAIN_OPENAI_API_KEY: ${R_BRAIN_OPENAI_API_KEY:-}
  R_BRAIN_GATEWAY_TOKEN: ${SERVICE_PASSWORD_64_BRAINGATEWAY}
  # Which models the Brain runs, in the configured provider's own naming.
  # The synthesis model is free to change; the embedding pair is create-time.
  R_BRAIN_MODEL: ${R_BRAIN_MODEL:-}
  R_BRAIN_EMBEDDING_MODEL: ${R_BRAIN_EMBEDDING_MODEL:-}
  R_BRAIN_EMBEDDING_DIMENSIONS: ${R_BRAIN_EMBEDDING_DIMENSIONS:-}
  R_BRAIN_RERANKER_MODEL: ${R_BRAIN_RERANKER_MODEL:-}
  R_GBRAIN_URL: http://gbrain:8931
  # Roomote uses this only to register its own scoped clients against the
  # Brain. Coolify's SERVICE_PASSWORD_64_* generates an
  # alphanumeric value, which satisfies gbrain's >= 32 characters of
  # [A-Za-z0-9_-]; SERVICE_BASE64_* would not.
  R_GBRAIN_ADMIN_TOKEN: ${SERVICE_PASSWORD_64_GBRAINADMIN}

services:
  postgres:
    image: pgvector/pgvector:0.8.1-pg17@sha256:3e8b3adfd27b5707128f60956f62a793c3c9326ea8cfaf0eab7adccb5d700b21
    restart: unless-stopped
    volumes:
      - pg_data:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${SERVICE_PASSWORD_POSTGRES}
      POSTGRES_DB: roomote
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U "$$POSTGRES_USER" -d "$$POSTGRES_DB"']
      interval: 5s
      timeout: 30s
      retries: 5
      start_period: 30s

  redis:
    image: redis:7-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99
    restart: unless-stopped
    volumes:
      - redis_data:/data
    command: redis-server --appendonly yes
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
      interval: 5s
      timeout: 3s
      retries: 12

  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
    restart: unless-stopped
    command: server /data --console-address ':9001'
    volumes:
      - minio_data:/data
    environment:
      # Declares the public domain for presigned artifact URLs; Coolify
      # routes it to the S3 API on port 9000 (the console on 9001 stays
      # private).
      SERVICE_FQDN_MINIO_9000: ''
      MINIO_ROOT_USER: roomote
      MINIO_ROOT_PASSWORD: ${SERVICE_PASSWORD_MINIO}
    healthcheck:
      # The minio/minio image ships no curl; `mc ready local` is MinIO's
      # documented container healthcheck.
      test: ['CMD', 'mc', 'ready', 'local']
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 20s

  # The Brain: shared memory for this deployment's agents. No published
  # domain and no SERVICE_FQDN_*, so Coolify never routes to it; agents read
  # it through the api service's proxy with their run token. It runs
  # unconditionally because Coolify's compose parser does not honour
  # `profiles`, and idling costs about 370 MB. Delete this service and its
  # corpus volume if the deployment should have no memory.
  gbrain:
    image: ghcr.io/roocodeinc/roomote-gbrain:develop
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - default
    volumes:
      - gbrain_data:/data
    environment:
      GBRAIN_DATABASE_URL: postgres://postgres:${SERVICE_PASSWORD_POSTGRES}@postgres:5432/roomote
      GBRAIN_ADMIN_BOOTSTRAP_TOKEN: ${SERVICE_PASSWORD_64_GBRAINADMIN}
      # The Brain holds no provider key. It calls back into this deployment,
      # which injects whichever provider key an admin configured in Settings,
      # so rotating or switching that key needs no restart here. Setting a
      # provider key below instead makes the Brain call the provider directly.
      OPENAI_BASE_URL: ${GBRAIN_OPENAI_BASE_URL:-http://api:3001/api/brain/inference}
      OPENAI_API_KEY: ${SERVICE_PASSWORD_64_BRAINGATEWAY}
      GBRAIN_RERANKER_MODEL: ${R_BRAIN_RERANKER_MODEL:-}
      # Create-time, and it has to be the container that receives these: the
      # embedding model and its width are decided when the Brain is created,
      # and the gateway must never substitute a different one afterwards.
      # Set both before the first boot, or neither. The synthesis model is
      # the opposite (R_BRAIN_MODEL, applied by the gateway per request).
      GBRAIN_EMBEDDING_MODEL: ${R_BRAIN_EMBEDDING_MODEL:-}
      GBRAIN_EMBEDDING_DIMENSIONS: ${R_BRAIN_EMBEDDING_DIMENSIONS:-}
    healthcheck:
      # The image is bun-based and ships no curl or wget.
      test:
        [
          'CMD-SHELL',
          'bun -e "const r = await fetch(\"http://127.0.0.1:8931/health\"); process.exit(r.ok ? 0 : 1)"',
        ]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 60s

  docker-proxy:
    image: ghcr.io/tecnativa/docker-socket-proxy:v0.4.2@sha256:1f3a6f303320723d199d2316a3e82b2e2685d86c275d5e3deeaf182573b47476
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777
      - /run:rw,noexec,nosuid,nodev,size=4m,mode=755
    cap_drop: [ALL]
    security_opt: ['no-new-privileges:true']
    environment:
      CONTAINERS: '1'
      ALLOW_START: '1'
      EXEC: '1'
      IMAGES: '1'
      NETWORKS: '1'
      VOLUMES: '1'
      POST: '1'
      EVENTS: '0'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks: [docker-api]

  # One-shot Drizzle migration run before the app services start.
  # `exclude_from_hc` is a Coolify-specific field that keeps this exited
  # one-shot container from marking the whole resource unhealthy.
  db-migrate:
    image: *roomote-app-image
    restart: 'no'
    exclude_from_hc: true
    command: db-migrate
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      <<: *roomote-shared-env

  api:
    image: *roomote-app-image
    restart: unless-stopped
    command: api
    networks: [default]
    depends_on:
      redis:
        condition: service_started
      db-migrate:
        condition: service_completed_successfully
    environment:
      # Task workers and GitHub webhooks call this origin directly, so the
      # api domain must be publicly reachable over HTTPS.
      SERVICE_FQDN_API_3001: ''
      <<: *roomote-shared-env
      PORT: 3001
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'curl -fsS --max-time 2 http://127.0.0.1:3001/health/liveness >/dev/null',
        ]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 20s

  web:
    image: *roomote-app-image
    restart: unless-stopped
    command: web
    depends_on:
      api:
        condition: service_started
    environment:
      # This is the app origin users open in the browser.
      SERVICE_FQDN_WEB_3000: ''
      <<: *roomote-shared-env
      PORT: 3000
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'curl -fsS --max-time 2 http://127.0.0.1:3000/health >/dev/null',
        ]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 20s

  controller:
    image: *roomote-app-image
    restart: unless-stopped
    command: controller
    # The controller may be inside a worker spawn when Compose replaces the
    # container; the long grace period lets it finish or fail the spawn.
    stop_grace_period: 7m
    depends_on:
      redis:
        condition: service_started
      db-migrate:
        condition: service_completed_successfully
      api:
        condition: service_started
      docker-proxy:
        condition: service_started
    networks: [default, docker-api]
    environment:
      <<: *roomote-shared-env
      DOCKER_HOST: tcp://docker-proxy:2375
      # The worker release archive is baked into the app image; the
      # controller reads the worker release version from the VERSION file inside
      # the archive. Do not unset: the fallback is GitHub worker releases,
      # which do not exist for develop builds.
      DOCKER_WORKER_RELEASE_PATH: /roomote/releases/worker-current.tar.gz
      # Must match the name of this stack's Docker network (declared at the
      # bottom of this file) so spawned worker containers can reach the
      # stack. Verify with `docker network ls` on the Coolify server.
      #
      # The controller uses this network only to discover the labeled API and
      # optional preview-proxy services. Spawned workers receive per-task
      # networks, so they do not join roomote_default or gain access to its
      # datastores.
      DOCKER_WORKER_NETWORK: roomote_default
      # Keep false unless the host enforces an equivalent storage quota.
      DOCKER_WORKER_ALLOW_UNBOUNDED_DISK: ${DOCKER_WORKER_ALLOW_UNBOUNDED_DISK:-false}
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'curl -fsS --max-time 5 http://api:3001/health/controller >/dev/null',
        ]
      interval: 5s
      timeout: 6s
      retries: 12
      start_period: 20s

  bullmq:
    image: *roomote-app-image
    restart: unless-stopped
    command: bullmq
    # Docker standby retention and the settings "Validate environment" checks
    # run here; both reach Docker through the restricted socket proxy, never
    # the raw socket.
    networks: [default, docker-api]
    depends_on:
      redis:
        condition: service_started
      db-migrate:
        condition: service_completed_successfully
      docker-proxy:
        condition: service_started
    environment:
      <<: *roomote-shared-env
      PORT: 3002
      DOCKER_HOST: tcp://docker-proxy:2375
      DOCKER_WORKER_RELEASE_PATH: /roomote/releases/worker-current.tar.gz
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'curl -fsS --max-time 5 http://127.0.0.1:3002/admin/health >/dev/null',
        ]
      interval: 5s
      timeout: 6s
      retries: 12
      start_period: 20s

  # Optional. Uncomment only when enabling live previews with a wildcard
  # domain routed to this service; everything else works without it. See
  # "Live previews" in README.md.
  # preview-proxy:
  #   image: *roomote-app-image
  #   restart: unless-stopped
  #   command: preview-proxy
  #   networks: [default]
  #   depends_on:
  #     db-migrate:
  #       condition: service_completed_successfully
  #   environment:
  #     SERVICE_FQDN_PREVIEWPROXY_8081: ''
  #     <<: *roomote-shared-env
  #     PORT: 8081
  #     PREVIEW_PROXY_BASE_URL: https://previews.<your-domain>
  #     NEXT_PUBLIC_PREVIEW_PROXY_BASE_URL: https://previews.<your-domain>
  #     PREVIEW_DOMAINS: previews.<your-domain>
  #   healthcheck:
  #     test:
  #       [
  #         'CMD-SHELL',
  #         'curl -fsS --max-time 2 http://127.0.0.1:8081/health >/dev/null',
  #       ]
  #     interval: 5s
  #     timeout: 3s
  #     retries: 12
  #     start_period: 20s

volumes:
  pg_data:
  redis_data:
  minio_data:
  # The Brain's corpus. Back it up like pg_data; losing it is recoverable
  # (task history and integration sources re-ingest) but not free.
  gbrain_data:

networks:
  # Named explicitly so the controller's DOCKER_WORKER_NETWORK value is
  # stable across redeploys. Coolify may attach additional networks of its
  # own; that is fine as long as this one exists.
  default:
    name: roomote_default
    driver: bridge
  docker-api:
    name: roomote_docker_api
    driver: bridge
    internal: true