compose.yaml

x-app: &app
  image: '${APP_IMAGE:?APP_IMAGE must be an immutable image tag or digest}'
  # Compose pulls once per service, all at once; configurator pulls for everyone.
  pull_policy: never
  restart: unless-stopped
  # frappe_restic refuses to start runtime services during a deployment or restore.
  entrypoint:
    - bash
    - /home/frappe/frappe-bench/apps/frappe_restic/frappe_restic/bin/runtime-guard.sh
    - /usr/local/bin/entrypoint.sh
  volumes:
    - sites:/home/frappe/frappe-bench/sites
    - logs:/home/frappe/frappe-bench/logs

x-job: &job
  image: '${APP_IMAGE:?APP_IMAGE must be an immutable image tag or digest}'
  pull_policy: never
  # Coolify leaves services that never restart out of the health status.
  restart: 'no'
  entrypoint: [bash, -c]
  volumes:
    - sites:/home/frappe/frappe-bench/sites
    - logs:/home/frappe/frappe-bench/logs

# Every process that runs backups needs the repository settings.
x-restic: &restic
  RESTIC_OFFSITE_BACKUP_ENABLED: '${RESTIC_OFFSITE_BACKUP_ENABLED:-0}'
  RESTIC_REPOSITORY: '${RESTIC_REPOSITORY:-}'
  RESTIC_PASSWORD: '${RESTIC_PASSWORD:-}'
  AWS_ACCESS_KEY_ID: '${AWS_ACCESS_KEY_ID:-}'
  AWS_SECRET_ACCESS_KEY: '${AWS_SECRET_ACCESS_KEY:-}'
  RESTIC_BACKUP_UPTIME_KUMA_URL: '${RESTIC_BACKUP_UPTIME_KUMA_URL:-}'

services:
  db:
    image: mariadb:11.8.9
    restart: unless-stopped
    stop_grace_period: 2m
    deploy:
      mode: replicated
      replicas: '${ENABLE_DB:?Set ENABLE_DB to 0 for an external database or 1 for the Compose database}'
    command:
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_unicode_ci
      - --skip-character-set-client-handshake
    environment:
      MARIADB_ROOT_PASSWORD: '${DB_ROOT_PASSWORD:?DB_ROOT_PASSWORD is required}'
      # Upgrades the system tables only when the data volume is from an older MariaDB,
      # after backing them up; also creates the users the healthcheck needs.
      MARIADB_AUTO_UPGRADE: '1'
    volumes:
      - db-data:/var/lib/mysql
    healthcheck:
      test: [CMD, healthcheck.sh, --connect, --innodb_initialized]
      interval: 5s
      timeout: 5s
      retries: 60
      start_period: 30s

  redis-cache:
    image: redis:8.6.7-alpine
    restart: unless-stopped
    healthcheck:
      test: [CMD, redis-cli, ping]
      interval: 5s
      timeout: 5s
      retries: 20

  redis-queue:
    image: redis:8.6.7-alpine
    restart: unless-stopped
    volumes:
      - redis-queue-data:/data
    healthcheck:
      test: [CMD, redis-cli, ping]
      interval: 5s
      timeout: 5s
      retries: 20

  configurator:
    <<: *job
    pull_policy: missing
    depends_on:
      redis-cache:
        condition: service_healthy
      redis-queue:
        condition: service_healthy
    environment:
      DB_HOST: '${DB_HOST:-db}'
      DB_PORT: '${DB_PORT:-3306}'
    command:
      - |
        set -Eeuo pipefail
        wait-for-it -t 180 "$${DB_HOST}:$${DB_PORT}"
        wait-for-it -t 120 redis-cache:6379
        wait-for-it -t 120 redis-queue:6379

        ls -1 apps > sites/apps.txt
        bench set-config -g db_host "$${DB_HOST}"
        bench set-config -gp db_port "$${DB_PORT}"
        bench set-config -g redis_cache redis://redis-cache:6379
        bench set-config -g redis_queue redis://redis-queue:6379
        bench set-config -g redis_socketio redis://redis-queue:6379
        bench set-config -gp socketio_port 9000
        # /usr/bin/chromium-headless-shell is a wrapper script; stopping it leaves the browser running.
        bench set-config -g chromium_path /usr/lib/chromium/chromium-headless-shell

  # Creates the site on empty volumes. A restore creates it from the snapshot instead.
  create-site:
    <<: *job
    depends_on:
      configurator:
        condition: service_completed_successfully
    environment:
      SITE_NAME: '${SITE_NAME:?SITE_NAME is required}'
      SITE_OPERATION: '${SITE_OPERATION:-migrate}'
      ADMIN_PASSWORD: '${ADMIN_PASSWORD:-}'
      DB_ROOT_PASSWORD: '${DB_ROOT_PASSWORD:?DB_ROOT_PASSWORD is required}'
    command:
      - |
        set -Eeuo pipefail
        if [[ "$${SITE_OPERATION}" == restore ]]; then
            echo "Restore requested; the restore creates $${SITE_NAME}."
        elif [[ -f "sites/$${SITE_NAME}/site_config.json" ]]; then
            echo "$${SITE_NAME} exists."
        else
            bench new-site \
              --mariadb-user-host-login-scope='%' \
              --admin-password="$${ADMIN_PASSWORD:?ADMIN_PASSWORD is required for a new site}" \
              --db-root-username=root \
              --db-root-password="$${DB_ROOT_PASSWORD}" \
              "$${SITE_NAME}"
        fi

  # Backs up, then migrates the site; or restores it with SITE_OPERATION=restore.
  site-operation:
    <<: *job
    # A restore runs once per hostname, so redeploying the same snapshot does nothing.
    hostname: 'restore-${RESTIC_RESTORE_SNAPSHOT:-none}'
    entrypoint:
      - /usr/local/bin/entrypoint.sh
      - bash
      - /home/frappe/frappe-bench/apps/frappe_restic/frappe_restic/bin/migrate-site.sh
    depends_on:
      create-site:
        condition: service_completed_successfully
    environment:
      <<: *restic
      SITE_NAME: '${SITE_NAME:?SITE_NAME is required}'
      SITE_OPERATION: '${SITE_OPERATION:-migrate}'
      RESTIC_RESTORE_SNAPSHOT: '${RESTIC_RESTORE_SNAPSHOT:-}'
      RESTIC_DEPLOYMENT_BACKUP_UPTIME_KUMA_URL: '${RESTIC_DEPLOYMENT_BACKUP_UPTIME_KUMA_URL:-}'
      DB_ROOT_PASSWORD: '${DB_ROOT_PASSWORD:?DB_ROOT_PASSWORD is required}'

  # Installs every app in the image that the site does not have yet.
  install-apps:
    <<: *job
    depends_on:
      site-operation:
        condition: service_completed_successfully
    environment:
      SITE_NAME: '${SITE_NAME:?SITE_NAME is required}'
    command:
      - |
        set -Eeuo pipefail
        installed() { bench --site "$${SITE_NAME}" list-apps --format json | jq -r '.[][]'; }
        current="$$(installed)"
        while read -r app; do
            grep -qx "$${app}" <<< "$${current}" && continue
            bench --site "$${SITE_NAME}" install-app "$${app}"
            # Installing an app also installs the apps it requires.
            current="$$(installed)"
        done < sites/apps.txt

  backend:
    <<: *app
    # A custom entrypoint drops the image's default command.
    command: [start.sh]
    depends_on:
      install-apps:
        condition: service_completed_successfully
    environment: *restic
    healthcheck:
      # Checks that the site answers, not just that the port is open.
      test: [CMD, curl, -fsS, -o, /dev/null, -H, 'X-Frappe-Site-Name: ${SITE_NAME}', 'http://127.0.0.1:8000/api/method/ping']
      <<: &health
        interval: 10s
        timeout: 5s
        retries: 3
        start_period: 60s

  websocket:
    <<: *app
    command: [node, /home/frappe/frappe-bench/apps/frappe/socketio.js]
    depends_on:
      install-apps:
        condition: service_completed_successfully
    healthcheck:
      test: [CMD, curl, -fsS, -o, /dev/null, 'http://127.0.0.1:9000/socket.io/?EIO=4&transport=polling']
      <<: *health

  frontend:
    <<: *app
    command: [nginx-entrypoint.sh]
    expose:
      - "8080"
    depends_on:
      backend:
        condition: service_healthy
      websocket:
        condition: service_healthy
    environment:
      BACKEND: backend:8000
      FRAPPE_SITE_NAME_HEADER: '${SITE_NAME:?SITE_NAME is required}'
      SOCKETIO: websocket:9000
      # Only the proxy reaches this unpublished port, so trust the client IP it appends to
      # X-Forwarded-For. Publishing the port would let clients choose their own IP.
      UPSTREAM_REAL_IP_ADDRESS: 0.0.0.0/0
    healthcheck:
      # Through nginx to the site.
      test: [CMD, curl, -fsS, -o, /dev/null, 'http://127.0.0.1:8080/api/method/ping']
      <<: *health

  queue-default:
    <<: *app
    command: [bench, worker, --queue, default]
    depends_on:
      install-apps:
        condition: service_completed_successfully
    environment: *restic

  queue-short:
    <<: *app
    command: [bench, worker, --queue, short]
    depends_on:
      install-apps:
        condition: service_completed_successfully
    environment: *restic

  queue-long:
    <<: *app
    command: [bench, worker, --queue, long]
    depends_on:
      install-apps:
        condition: service_completed_successfully
    environment: *restic

  scheduler:
    <<: *app
    command: [bench, schedule]
    depends_on:
      install-apps:
        condition: service_completed_successfully
    environment: *restic

volumes:
  db-data: null
  redis-queue-data: null
  sites: null
  logs: null