docker-compose.no-ssl.yml

# Reverse-proxy mode: SSL is terminated by an external proxy (Traefik, Nginx, Caddy, etc.)
# The web container listens on plain HTTP on LISTEN_PORT (default: 80).
# No acme container — certificate management is handled by the external proxy.
#
# Usage: set COMPOSE_FILE=docker-compose.no-ssl.yml in .env, then `docker compose up -d`.

x-fewohbee-environment: &fewohbee-environment
    TZ: ${TZ}
    DB_SERVER_VERSION: 13.0.2-MariaDB
    LOCALE: ${LOCALE}
    PUBLIC_BASE_URI: ${PUBLIC_BASE_URI:-}
    APP_SECRET: ${APP_SECRET:?see .env.dist}
    REDIS_IDX: ${REDIS_IDX}
    REDIS_SYSTEM_IDX: ${REDIS_SYSTEM_IDX:-${REDIS_IDX}}
    REDIS_SESSION_IDX: ${REDIS_SESSION_IDX:-${REDIS_IDX}}
    REDIS_HOST: ${REDIS_HOST}
    REDIS_PORT: ${REDIS_PORT:-6379}
    REDIS_PREFIX: ${REDIS_PREFIX:-fewohbee_}
    SESSION_MAX_LIFETIME: ${SESSION_MAX_LIFETIME:-1440}
    USE_PASSWORD_BLACKLIST: ${USE_PASSWORD_BLACKLIST}
    DATABASE_URL: ${DATABASE_URL:?see .env.dist}
    MAIL_ENABLED: ${MAIL_ENABLED:-true}
    MAILER_DSN: ${MAILER_DSN}
    FROM_MAIL: ${FROM_MAIL}
    FROM_NAME: ${FROM_NAME}
    RETURN_PATH: ${RETURN_PATH}
    MAIL_COPY: ${MAIL_COPY}
    TRUSTED_PROXIES: ${TRUSTED_PROXIES}
    FRAME_ANCESTORS: ${FRAME_ANCESTORS:-}
    HEALTH_TOKEN: ${HEALTH_TOKEN:-}
    STORAGE_ADAPTER: ${STORAGE_ADAPTER:-local}
    GEO_DATABASE_URL: ${GEO_DATABASE_URL:-}

services:
    web:
        image: ghcr.io/developeregrem/fewohbee-nginx:${FEWOHBEE_VERSION:-latest}
        depends_on:
            db:
                condition: service_healthy
            php:
                condition: service_started
        ports:
            - ${LISTEN_PORT:-80}:80
        volumes:
            - uploads-export:/var/www/html/public/resources/images/export
            - uploads-roomcat:/var/www/html/public/resources/images/room-categories
        environment:
            - HOST_NAME=${HOST_NAME:?see .env.dist}
            - PHP_FPM_HOST=php:9000
            - REVERSE_PROXY=true
        networks:
            - internal-network
        healthcheck:
            test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/health/live || exit 1"]
            interval: 10s
            timeout: 3s
            retries: 5
            start_period: 30s
            start_interval: 2s
        restart: always

    # One-shot init container: migrates user uploads from the legacy
    # feb-data volume (runtime git-clone era) into the new dedicated volumes.
    # Idempotent — touches a .migrated marker on success and exits fast on
    # subsequent runs. Runs on every `compose up`, so it works with any tool
    # (Portainer, plain `docker compose`, Windows users without bash scripts).
    uploads-migration:
        image: alpine:latest
        restart: "no"
        volumes:
            - feb-data:/legacy:ro
            - uploads-export:/new-export
            - uploads-roomcat:/new-roomcat
            - uploads-fonts:/new-fonts
        command: >
            sh -c '
            if [ -f /new-export/.migrated ]; then
                echo "uploads-migration: already completed";
            else
                if [ -d /legacy/fewohbee/public/resources/images/export ]; then
                    echo "uploads-migration: copying legacy uploads ...";
                    cp -aT /legacy/fewohbee/public/resources/images/export/. /new-export/ 2>/dev/null || true;
                    cp -aT /legacy/fewohbee/public/resources/images/room-categories/. /new-roomcat/ 2>/dev/null || true;
                    echo "uploads-migration: done. Legacy feb-data volume kept for rollback.";
                else
                    echo "uploads-migration: no legacy uploads found, fresh install";
                fi;
                touch /new-export/.migrated /new-roomcat/.migrated;
            fi;
            chown -R 82:82 /new-export /new-roomcat /new-fonts;
            '
        networks:
            - internal-network

    php:
        image: ghcr.io/developeregrem/fewohbee-phpfpm:${FEWOHBEE_VERSION:-latest}
        depends_on:
            db:
                condition: service_healthy
            uploads-migration:
                condition: service_completed_successfully
        volumes:
            - uploads-export:/var/www/html/public/resources/images/export
            - uploads-roomcat:/var/www/html/public/resources/images/room-categories
            - uploads-fonts:/var/www/html/var/storage/fonts
        networks:
            - internal-network
        environment:
            <<: *fewohbee-environment
            RELYING_PARTY_ID: ${RELYING_PARTY_ID}
            RELYING_PARTY_NAME: ${RELYING_PARTY_NAME}
            PASSKEY_ENABLED: ${PASSKEY_ENABLED}
            OIDC_ENABLED: ${OIDC_ENABLED:-false}
            OIDC_ISSUER: ${OIDC_ISSUER:-}
            OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
            OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
            OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email}
            OIDC_BUTTON_LABEL: ${OIDC_BUTTON_LABEL:-}
            OIDC_USER_MATCHING: ${OIDC_USER_MATCHING:-email}
            OIDC_REQUIRE_VERIFIED_EMAIL: ${OIDC_REQUIRE_VERIFIED_EMAIL:-true}
            OIDC_ENFORCE: ${OIDC_ENFORCE:-false}
            OIDC_END_SESSION: ${OIDC_END_SESSION:-false}
            MCP_ENABLED: ${MCP_ENABLED:-false}
            MCP_ALLOW_INSECURE_HTTP: ${MCP_ALLOW_INSECURE_HTTP:-false}
            RUN_MIGRATIONS: "true"
        healthcheck:
            test: ["CMD-SHELL", "pgrep -f 'php-fpm: master' > /dev/null || exit 1"]
            interval: 10s
            timeout: 3s
            retries: 5
            start_period: 60s
            start_interval: 2s
        restart: always

    cron:
        image: ghcr.io/developeregrem/fewohbee-cli:${FEWOHBEE_VERSION:-latest}
        depends_on:
            db:
                condition: service_healthy
            php:
                condition: service_healthy
        volumes:
            - uploads-export:/var/www/html/public/resources/images/export:ro
            - uploads-fonts:/var/www/html/var/storage/fonts:ro
        networks:
            - internal-network
        environment: *fewohbee-environment
        restart: always

    db:
        image: mariadb:13.0
        restart: always
        volumes:
             - db-vol:/var/lib/mysql:cached
             - db-backup-vol:/dbbackup:cached
        environment:
            MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD:?see .env.dist}
            MARIADB_USER: ${MARIADB_USER:?see .env.dist}
            MARIADB_PASSWORD: ${MARIADB_PASSWORD:?see .env.dist}
            MARIADB_DATABASE: ${MARIADB_DATABASE:?see .env.dist}
            MYSQL_BACKUP_PASSWORD: ${MYSQL_BACKUP_PASSWORD}
            MYSQL_BACKUP_USER: ${MYSQL_BACKUP_USER}
            MARIADB_AUTO_UPGRADE: ${MARIADB_AUTO_UPGRADE:-1}
        healthcheck:
            test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
            start_period: 40s
            interval: 10s
            timeout: 5s
            retries: 15
        networks:
            - internal-network

    redis:
        image: redis:alpine
        restart: always
        volumes:
             - redis-vol:/data/
        networks:
            - internal-network

networks:
    internal-network:
        driver: bridge

volumes:
    redis-vol:
    db-vol:
    db-backup-vol:
    uploads-export:
    uploads-roomcat:
    uploads-fonts:
    # Legacy volume — only referenced by uploads-migration. Empty on fresh
    # installs, contains the pre-migration code+uploads tree on upgrades.
    feb-data: