From 19759878af9938ac70c002886ad11b6ca7e0f4c1 Mon Sep 17 00:00:00 2001 From: Sammy NIYONIZERA Date: Thu, 27 Aug 2026 23:28:46 +0200 Subject: [PATCH 1/4] chore: add Dokploy compose that builds from this repo Keep preview aligned with upstream Plane while deploying on Dokploy with the same service/volume names so existing data can be reused. --- docker-compose.dokploy.yml | 307 +++++++++++++++++++++++++++++++++++++ 1 file changed, 307 insertions(+) create mode 100644 docker-compose.dokploy.yml diff --git a/docker-compose.dokploy.yml b/docker-compose.dokploy.yml new file mode 100644 index 00000000000..a54dade274a --- /dev/null +++ b/docker-compose.dokploy.yml @@ -0,0 +1,307 @@ +# Dokploy compose for this repo. +# +# Point the EXISTING Dokploy application at this file (keep the same +# Compose project name). Named volumes (`pgdata`, `uploads`, …) are then +# reused and the current database / files / Caddy state keep working. +# A new Dokploy app uses a new project name and starts with empty volumes. +# +# Copy the env vars from the current stack into Dokploy (especially +# SECRET_KEY, POSTGRES_PASSWORD, AWS_* keys, LIVE_SERVER_SECRET_KEY). +# +# DNS collision avoidance for multi-stack Dokploy: +# Internal services renamed with `plane-*` prefix (unique cluster-wide) and +# `links:` on the `proxy` service creates /etc/hosts entries (` +# web`, etc.) — /etc/hosts takes absolute priority over DNS, so the Caddy +# inside proxy (which has `reverse_proxy web:3000`/`api:8000` hardcoded) +# resolves straight to our containers, ignoring any `web`/`api` containers +# from other stacks on the shared Dokploy network. +# +# Images are built from this repo (not pulled from a registry). + +x-db-env: &db-env + PGHOST: ${PGHOST:-plane-db} + PGDATABASE: ${PGDATABASE:-plane} + POSTGRES_USER: ${POSTGRES_USER:-plane} + POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-plane} + POSTGRES_DB: ${POSTGRES_DB:-plane} + POSTGRES_PORT: ${POSTGRES_PORT:-5432} + PGDATA: ${PGDATA:-/var/lib/postgresql/data} + +x-redis-env: &redis-env + REDIS_HOST: ${REDIS_HOST:-plane-redis} + REDIS_PORT: ${REDIS_PORT:-6379} + REDIS_URL: ${REDIS_URL:-redis://plane-redis:6379/} + +x-minio-env: &minio-env + MINIO_ROOT_USER: ${AWS_ACCESS_KEY_ID:-access-key} + MINIO_ROOT_PASSWORD: ${AWS_SECRET_ACCESS_KEY:-secret-key} + +x-aws-s3-env: &aws-s3-env + AWS_REGION: ${AWS_REGION:-} + AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-access-key} + AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-secret-key} + AWS_S3_ENDPOINT_URL: ${AWS_S3_ENDPOINT_URL:-http://plane-minio:9000} + AWS_S3_BUCKET_NAME: ${AWS_S3_BUCKET_NAME:-uploads} + +x-proxy-env: &proxy-env + APP_DOMAIN: ${APP_DOMAIN:-localhost} + FILE_SIZE_LIMIT: ${FILE_SIZE_LIMIT:-5242880} + BUCKET_NAME: ${AWS_S3_BUCKET_NAME:-uploads} + # Caddy proxy: listen address (no upstream default in Caddyfile -> must be set, + # else the `{$SITE_ADDRESS} { ... }` block is keyless and Caddy aborts). + SITE_ADDRESS: ${SITE_ADDRESS:-:80} + # trusted_proxies decides which peers may set X-Forwarded-For/X-Real-IP. Dokploy's + # Traefik upstream always lives on Dokploy's private network, so trust only private + # ranges (Caddy built-in) instead of 0.0.0.0/0 to prevent client-IP spoofing if the + # proxy is ever exposed directly. Override with your real upstream CIDR if needed. + TRUSTED_PROXIES: ${TRUSTED_PROXIES:-private_ranges} + +x-mq-env: &mq-env + RABBITMQ_HOST: ${RABBITMQ_HOST:-plane-mq} + RABBITMQ_PORT: ${RABBITMQ_PORT:-5672} + RABBITMQ_DEFAULT_USER: ${RABBITMQ_USER:-plane} + RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:-plane} + RABBITMQ_DEFAULT_VHOST: ${RABBITMQ_VHOST:-plane} + RABBITMQ_VHOST: ${RABBITMQ_VHOST:-plane} + +x-live-env: &live-env + API_BASE_URL: ${API_BASE_URL:-http://plane-api:8000} + LIVE_SERVER_SECRET_KEY: ${LIVE_SERVER_SECRET_KEY:-dev-only-change-me} + +x-app-env: &app-env + WEB_URL: ${WEB_URL:-http://localhost} + DEBUG: ${DEBUG:-0} + CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost} + GUNICORN_WORKERS: ${GUNICORN_WORKERS:-1} + USE_MINIO: ${USE_MINIO:-1} + DATABASE_URL: ${DATABASE_URL:-postgresql://plane:plane@plane-db/plane} + SECRET_KEY: ${SECRET_KEY:-dev-only-change-me} + AMQP_URL: ${AMQP_URL:-amqp://plane:plane@plane-mq:5672/plane} + API_KEY_RATE_LIMIT: ${API_KEY_RATE_LIMIT:-60/minute} + MINIO_ENDPOINT_SSL: ${MINIO_ENDPOINT_SSL:-0} + LIVE_SERVER_SECRET_KEY: ${LIVE_SERVER_SECRET_KEY:-dev-only-change-me} + WEBHOOK_ALLOWED_IPS: ${WEBHOOK_ALLOWED_IPS:-} + WEBHOOK_ALLOWED_HOSTS: ${WEBHOOK_ALLOWED_HOSTS:-} + +x-api-build: &api-build + context: ./apps/api + dockerfile: Dockerfile.api + args: + DOCKER_BUILDKIT: 1 + +services: + plane-web: + build: + context: . + dockerfile: ./apps/web/Dockerfile.web + args: + DOCKER_BUILDKIT: 1 + restart: unless-stopped + depends_on: + plane-api: + condition: service_started + plane-worker: + condition: service_started + + plane-space: + build: + context: . + dockerfile: ./apps/space/Dockerfile.space + args: + DOCKER_BUILDKIT: 1 + restart: unless-stopped + depends_on: + plane-api: + condition: service_started + plane-worker: + condition: service_started + plane-web: + condition: service_started + + plane-admin: + build: + context: . + dockerfile: ./apps/admin/Dockerfile.admin + args: + DOCKER_BUILDKIT: 1 + restart: unless-stopped + depends_on: + plane-api: + condition: service_started + plane-web: + condition: service_started + + plane-live: + build: + context: . + dockerfile: ./apps/live/Dockerfile.live + args: + DOCKER_BUILDKIT: 1 + restart: unless-stopped + environment: + <<: [*live-env, *redis-env] + depends_on: + plane-api: + condition: service_started + plane-web: + condition: service_started + + plane-api: + build: *api-build + restart: unless-stopped + command: ./bin/docker-entrypoint-api.sh + volumes: + - logs_api:/code/plane/logs + environment: + <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env] + depends_on: + plane-db: + condition: service_healthy + plane-redis: + condition: service_healthy + plane-mq: + condition: service_healthy + plane-migrator: + condition: service_completed_successfully + + plane-worker: + build: *api-build + restart: unless-stopped + command: ./bin/docker-entrypoint-worker.sh + volumes: + - logs_worker:/code/plane/logs + environment: + <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env] + depends_on: + plane-db: + condition: service_healthy + plane-redis: + condition: service_healthy + plane-mq: + condition: service_healthy + plane-migrator: + condition: service_completed_successfully + + plane-beat-worker: + build: *api-build + restart: unless-stopped + command: ./bin/docker-entrypoint-beat.sh + volumes: + - logs_beat-worker:/code/plane/logs + environment: + <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env] + depends_on: + plane-db: + condition: service_healthy + plane-redis: + condition: service_healthy + plane-mq: + condition: service_healthy + plane-migrator: + condition: service_completed_successfully + + plane-migrator: + build: *api-build + restart: on-failure + command: ./bin/docker-entrypoint-migrator.sh + volumes: + - logs_migrator:/code/plane/logs + environment: + <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env] + depends_on: + plane-db: + condition: service_healthy + plane-redis: + condition: service_healthy + + plane-db: + image: postgres:17-alpine + restart: unless-stopped + command: postgres -c 'max_connections=1000' + environment: + <<: *db-env + volumes: + - pgdata:/var/lib/postgresql/data + healthcheck: + test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-plane} -d ${POSTGRES_DB:-plane}"] + interval: 5s + timeout: 5s + retries: 10 + start_period: 10s + + plane-redis: + image: valkey/valkey:7.2.11-alpine + restart: unless-stopped + volumes: + - redisdata:/data + healthcheck: + test: ["CMD-SHELL", "valkey-cli ping | grep -q PONG"] + interval: 5s + timeout: 3s + retries: 5 + start_period: 5s + + plane-mq: + image: rabbitmq:3.13.6-management-alpine + restart: unless-stopped + environment: + <<: *mq-env + volumes: + - rabbitmq_data:/var/lib/rabbitmq + healthcheck: + test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"] + interval: 10s + timeout: 10s + retries: 10 + start_period: 30s + + plane-minio: + image: minio/minio:RELEASE.2025-04-22T22-12-26Z + restart: unless-stopped + command: server /export --console-address ":9090" + environment: + <<: *minio-env + volumes: + - uploads:/export + + proxy: + build: + context: ./apps/proxy + dockerfile: Dockerfile.ce + restart: unless-stopped + expose: + - "80" + environment: + <<: *proxy-env + volumes: + - proxy_config:/config + - proxy_data:/data + links: + - "plane-web:web" + - "plane-api:api" + - "plane-space:space" + - "plane-admin:admin" + - "plane-live:live" + depends_on: + plane-web: + condition: service_started + plane-api: + condition: service_started + plane-space: + condition: service_started + plane-admin: + condition: service_started + plane-live: + condition: service_started + +volumes: + pgdata: + redisdata: + uploads: + rabbitmq_data: + logs_api: + logs_worker: + logs_beat-worker: + logs_migrator: + proxy_config: + proxy_data: From ac5654059a549cd0777143ebebd66f6936ea91b1 Mon Sep 17 00:00:00 2001 From: Sammy NIYONIZERA Date: Fri, 28 Aug 2026 01:54:53 +0200 Subject: [PATCH 2/4] chore: use an external Postgres for the Dokploy compose Stop shipping bundled plane-db so Dokploy can point DATABASE_URL at an external instance, and add an env example without unused APP_RELEASE. --- docker-compose.dokploy.env.example | 91 ++++++++++++++++++++++++++++++ docker-compose.dokploy.yml | 51 ++++++++--------- 2 files changed, 115 insertions(+), 27 deletions(-) create mode 100644 docker-compose.dokploy.env.example diff --git a/docker-compose.dokploy.env.example b/docker-compose.dokploy.env.example new file mode 100644 index 00000000000..7f2374ef04d --- /dev/null +++ b/docker-compose.dokploy.env.example @@ -0,0 +1,91 @@ +# ===== Application ===== +# Public domain Plane is served on. +APP_DOMAIN=task.stagging.kiin.rw +# Full external URL of the instance (used to build links). +WEB_URL=https://task.stagging.kiin.rw +# Browser origins allowed to call the API (CORS). +CORS_ALLOWED_ORIGINS=https://task.stagging.kiin.rw +# Internal URL other services use to reach the API. +API_BASE_URL=http://plane-api:8000 +# Django secret key: signs sessions and tokens. Keep it secret. +SECRET_KEY=dev-only-change-me +# Shared secret between the API and the realtime (live) server. +LIVE_SERVER_SECRET_KEY=dev-only-change-me + +# ===== PostgreSQL (external) ===== +# Bundled plane-db is disabled; point these at your external instance. +# Database user. +POSTGRES_USER=plane +# Database password. +POSTGRES_PASSWORD=plane +# Database name. +POSTGRES_DB=plane +# Port PostgreSQL listens on. +POSTGRES_PORT=5432 +# Host the app and libpq tools connect to (external hostname or IP). +PGHOST=your-external-db-host +# Default database for libpq tools. +PGDATABASE=plane +# Full connection string (composed from the values above). +DATABASE_URL=postgresql://plane:plane@your-external-db-host:5432/plane + +# ===== Redis / Valkey (cache) ===== +# Redis host. +REDIS_HOST=plane-redis +# Redis port. +REDIS_PORT=6379 +# Full Redis connection URL. +REDIS_URL=redis://plane-redis:6379/ + +# ===== RabbitMQ (task queue) ===== +# Broker host. +RABBITMQ_HOST=plane-mq +# Broker port. +RABBITMQ_PORT=5672 +# Broker user. +RABBITMQ_USER=plane +# Broker password. +RABBITMQ_PASSWORD=plane +# Broker virtual host. +RABBITMQ_VHOST=plane +# Full AMQP connection string (composed from the values above). +AMQP_URL=amqp://plane:plane@plane-mq:5672/plane + +# ===== Object storage (MinIO / S3) ===== +# Use the bundled MinIO (1) instead of an external S3 provider (0). +USE_MINIO=1 +# AWS region; leave empty when using MinIO. +AWS_REGION= +# S3 / MinIO access key. +AWS_ACCESS_KEY_ID=access-key +# S3 / MinIO secret key. +AWS_SECRET_ACCESS_KEY=secret-key +# S3 / MinIO endpoint URL. +AWS_S3_ENDPOINT_URL=http://plane-minio:9000 +# Bucket used to store uploads. +AWS_S3_BUCKET_NAME=uploads +# Max upload size in bytes (default 5 MiB). +FILE_SIZE_LIMIT=5242880 +# Set to 1 if the S3 / MinIO endpoint is served over HTTPS. +MINIO_ENDPOINT_SSL=0 + +# ===== Caddy proxy ===== +# Address the in-container Caddy listens on. Required: the proxy +# Caddyfile has no default and an empty value crashes it on boot. +SITE_ADDRESS=:80 +# Peers allowed to set X-Forwarded-For / X-Real-IP. 'private_ranges' +# trusts only Dokploy's private upstream (Traefik) and blocks public +# IP spoofing. Use a narrower CIDR if exposing the proxy directly. +TRUSTED_PROXIES=private_ranges + +# ===== App runtime ===== +# Django debug mode; keep 0 in production. +DEBUG=0 +# Number of Gunicorn workers for the API. +GUNICORN_WORKERS=1 +# Rate limit applied to API-key requests. +API_KEY_RATE_LIMIT=60/minute +# Comma-separated IPs allowed as webhook targets; empty allows all. +WEBHOOK_ALLOWED_IPS= +# Comma-separated hosts allowed as webhook targets; empty allows all. +WEBHOOK_ALLOWED_HOSTS= diff --git a/docker-compose.dokploy.yml b/docker-compose.dokploy.yml index a54dade274a..1d48b80ed49 100644 --- a/docker-compose.dokploy.yml +++ b/docker-compose.dokploy.yml @@ -1,8 +1,9 @@ # Dokploy compose for this repo. # # Point the EXISTING Dokploy application at this file (keep the same -# Compose project name). Named volumes (`pgdata`, `uploads`, …) are then -# reused and the current database / files / Caddy state keep working. +# Compose project name). Named volumes (`uploads`, …) are then reused +# and files / Caddy state keep working. Postgres is external — set +# DATABASE_URL / PGHOST in Dokploy (bundled `plane-db` is commented out). # A new Dokploy app uses a new project name and starts with empty volumes. # # Copy the env vars from the current stack into Dokploy (especially @@ -19,7 +20,7 @@ # Images are built from this repo (not pulled from a registry). x-db-env: &db-env - PGHOST: ${PGHOST:-plane-db} + PGHOST: ${PGHOST} PGDATABASE: ${PGDATABASE:-plane} POSTGRES_USER: ${POSTGRES_USER:-plane} POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-plane} @@ -74,7 +75,7 @@ x-app-env: &app-env CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost} GUNICORN_WORKERS: ${GUNICORN_WORKERS:-1} USE_MINIO: ${USE_MINIO:-1} - DATABASE_URL: ${DATABASE_URL:-postgresql://plane:plane@plane-db/plane} + DATABASE_URL: ${DATABASE_URL} SECRET_KEY: ${SECRET_KEY:-dev-only-change-me} AMQP_URL: ${AMQP_URL:-amqp://plane:plane@plane-mq:5672/plane} API_KEY_RATE_LIMIT: ${API_KEY_RATE_LIMIT:-60/minute} @@ -155,8 +156,6 @@ services: environment: <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env] depends_on: - plane-db: - condition: service_healthy plane-redis: condition: service_healthy plane-mq: @@ -173,8 +172,6 @@ services: environment: <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env] depends_on: - plane-db: - condition: service_healthy plane-redis: condition: service_healthy plane-mq: @@ -191,8 +188,6 @@ services: environment: <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env] depends_on: - plane-db: - condition: service_healthy plane-redis: condition: service_healthy plane-mq: @@ -209,25 +204,27 @@ services: environment: <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env] depends_on: - plane-db: - condition: service_healthy plane-redis: condition: service_healthy - plane-db: - image: postgres:17-alpine - restart: unless-stopped - command: postgres -c 'max_connections=1000' - environment: - <<: *db-env - volumes: - - pgdata:/var/lib/postgresql/data - healthcheck: - test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-plane} -d ${POSTGRES_DB:-plane}"] - interval: 5s - timeout: 5s - retries: 10 - start_period: 10s + # Bundled Postgres — commented out; the app uses an external database + # via DATABASE_URL / PGHOST. Uncomment this block (and `pgdata` under + # volumes, plus depends_on plane-db on api/worker/beat/migrator) to + # run Postgres in-cluster again. + # plane-db: + # image: postgres:17-alpine + # restart: unless-stopped + # command: postgres -c 'max_connections=1000' + # environment: + # <<: *db-env + # volumes: + # - pgdata:/var/lib/postgresql/data + # healthcheck: + # test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-plane} -d ${POSTGRES_DB:-plane}"] + # interval: 5s + # timeout: 5s + # retries: 10 + # start_period: 10s plane-redis: image: valkey/valkey:7.2.11-alpine @@ -295,7 +292,7 @@ services: condition: service_started volumes: - pgdata: + # pgdata: redisdata: uploads: rabbitmq_data: From cb563878e04f0ed8b2b8cace4e839c058c5c4d99 Mon Sep 17 00:00:00 2001 From: Sammy NIYONIZERA Date: Fri, 28 Aug 2026 02:53:20 +0200 Subject: [PATCH 3/4] fix: share one image tag for Dokploy API services MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Compose Bake only tagged one of api/worker/beat/migrator when they shared a build, so deploy failed with "No such image: …-plane-api:latest". --- docker-compose.dokploy.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docker-compose.dokploy.yml b/docker-compose.dokploy.yml index 1d48b80ed49..d0d65e0e182 100644 --- a/docker-compose.dokploy.yml +++ b/docker-compose.dokploy.yml @@ -90,6 +90,11 @@ x-api-build: &api-build args: DOCKER_BUILDKIT: 1 +# Shared tag so api/worker/beat/migrator (identical Dockerfile) resolve after +# Compose Bake. Without this, Bake reports all four "Built" but only one +# project-prefixed tag exists → "No such image: …-plane-api:latest". +x-api-image: &api-image kiin-plane-backend:local + services: plane-web: build: @@ -148,6 +153,7 @@ services: condition: service_started plane-api: + image: *api-image build: *api-build restart: unless-stopped command: ./bin/docker-entrypoint-api.sh @@ -164,6 +170,7 @@ services: condition: service_completed_successfully plane-worker: + image: *api-image build: *api-build restart: unless-stopped command: ./bin/docker-entrypoint-worker.sh @@ -180,6 +187,7 @@ services: condition: service_completed_successfully plane-beat-worker: + image: *api-image build: *api-build restart: unless-stopped command: ./bin/docker-entrypoint-beat.sh @@ -196,6 +204,7 @@ services: condition: service_completed_successfully plane-migrator: + image: *api-image build: *api-build restart: on-failure command: ./bin/docker-entrypoint-migrator.sh From facfcfd2710cf75d1f81eb812698f5cee09914e8 Mon Sep 17 00:00:00 2001 From: Sammy NIYONIZERA Date: Fri, 28 Aug 2026 03:07:43 +0200 Subject: [PATCH 4/4] fix: build the Dokploy backend image only once Bake failed when api/worker/beat/migrator all exported kiin-plane-backend:local in parallel. Only migrator builds; the others reuse that tag. --- docker-compose.dokploy.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docker-compose.dokploy.yml b/docker-compose.dokploy.yml index d0d65e0e182..39126049ab9 100644 --- a/docker-compose.dokploy.yml +++ b/docker-compose.dokploy.yml @@ -90,9 +90,9 @@ x-api-build: &api-build args: DOCKER_BUILDKIT: 1 -# Shared tag so api/worker/beat/migrator (identical Dockerfile) resolve after -# Compose Bake. Without this, Bake reports all four "Built" but only one -# project-prefixed tag exists → "No such image: …-plane-api:latest". +# One image, one Bake export. api/worker/beat/migrator share Dockerfile.api; +# giving all four `build:` + the same tag makes Bake export in parallel and +# fail ("image already exists"). Only migrator builds; the others reuse it. x-api-image: &api-image kiin-plane-backend:local services: @@ -154,7 +154,7 @@ services: plane-api: image: *api-image - build: *api-build + pull_policy: never restart: unless-stopped command: ./bin/docker-entrypoint-api.sh volumes: @@ -171,7 +171,7 @@ services: plane-worker: image: *api-image - build: *api-build + pull_policy: never restart: unless-stopped command: ./bin/docker-entrypoint-worker.sh volumes: @@ -188,7 +188,7 @@ services: plane-beat-worker: image: *api-image - build: *api-build + pull_policy: never restart: unless-stopped command: ./bin/docker-entrypoint-beat.sh volumes: @@ -205,6 +205,7 @@ services: plane-migrator: image: *api-image + pull_policy: build build: *api-build restart: on-failure command: ./bin/docker-entrypoint-migrator.sh