Vibe Kanban

# Self-hosting: set PUBLIC_BASE_URL to your public URL (e.g. https://kanban.example.com)
# and REMOTE_SERVER_PORTS=0.0.0.0:3000:8081 so the server is reachable from other hosts.
services:
  remote-db:
    image: postgres:16-alpine
    command: [ "postgres", "-c", "wal_level=logical" ]
    environment:
      POSTGRES_DB: remote
      POSTGRES_USER: remote
      POSTGRES_PASSWORD: remote
    volumes:
      - remote-db-data:/var/lib/postgresql/data
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U remote -d remote" ]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 5s
    ports:
      - "5433:5432"

  azurite:
    profiles: ["attachments"]
    image: mcr.microsoft.com/azure-storage/azurite:latest
    command: "azurite-blob --blobHost 0.0.0.0 --blobPort 10000 --loose --skipApiVersionCheck"
    ports:
      - "10000:10000"
    volumes:
      - azurite-data:/data
    healthcheck:
      test: nc 127.0.0.1 10000 -z
      interval: 1s
      retries: 30

  azurite-init:
    profiles: ["attachments"]
    image: mcr.microsoft.com/azure-cli:latest
    depends_on:
      azurite:
        condition: service_healthy
    environment:
      AZURE_STORAGE_CONNECTION_STRING: "DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://azurite:10000/devstoreaccount1;"
    entrypoint: /bin/sh
    command:
      - -c
      - |
        set -e
        az storage container create --name issue-attachments 2>/dev/null || true
        az storage cors add --services b --methods GET PUT POST DELETE OPTIONS --origins '*' --allowed-headers '*' --exposed-headers '*' --max-age 3600
        echo "Azurite CORS configured"

  electric:
    image: electricsql/electric:1.4.13
    working_dir: /app
    restart: on-failure
    environment:
      DATABASE_URL: postgresql://electric_sync:${ELECTRIC_ROLE_PASSWORD:-remote}@remote-db:5432/remote?sslmode=disable
      PG_PROXY_PORT: 65432
      LOGICAL_PUBLISHER_HOST: electric
      AUTH_MODE: insecure
      ELECTRIC_INSECURE: true
      ELECTRIC_MANUAL_TABLE_PUBLISHING: true
      ELECTRIC_USAGE_REPORTING: false
      ELECTRIC_FEATURE_FLAGS: allow_subqueries,tagged_subqueries
    volumes:
      - electric-data:/app/persistent
    depends_on:
      remote-db:
        condition: service_healthy
      remote-server:
        condition: service_healthy

  remote-server:
    build:
      context: ../..
      dockerfile: crates/remote/Dockerfile
      args:
        # Build-time image/frontend args.
        FEATURES: ${FEATURES:-}
        POSTHOG_API_KEY: ${POSTHOG_API_KEY:-}
        POSTHOG_API_ENDPOINT: ${POSTHOG_API_ENDPOINT:-}
        SENTRY_DSN_REMOTE: ${SENTRY_DSN_REMOTE:-}
        VITE_RELAY_API_BASE_URL: ${VITE_RELAY_API_BASE_URL:-http://localhost:8082}
        VITE_PUBLIC_REACT_VIRTUOSO_LICENSE_KEY: ${VITE_PUBLIC_REACT_VIRTUOSO_LICENSE_KEY:-}
      ssh:
        - default
    depends_on:
      remote-db:
        condition: service_healthy
      azurite-init:
        condition: service_completed_successfully
        required: false
    environment:
      RUST_LOG: info,remote=info

      # Core runtime
      SERVER_DATABASE_URL: postgres://remote:remote@remote-db:5432/remote
      SERVER_LISTEN_ADDR: 0.0.0.0:8081
      ELECTRIC_URL: http://electric:3000
      ELECTRIC_ROLE_PASSWORD: ${ELECTRIC_ROLE_PASSWORD:-remote}
      SERVER_PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:3000}
      VIBEKANBAN_REMOTE_JWT_SECRET: ${VIBEKANBAN_REMOTE_JWT_SECRET:?set in .env.remote}

      # Auth 
      # Configure at least one OAuth provider, or set self-host local auth credentials.
      GITHUB_OAUTH_CLIENT_ID: ${GITHUB_OAUTH_CLIENT_ID:-}
      GITHUB_OAUTH_CLIENT_SECRET: ${GITHUB_OAUTH_CLIENT_SECRET:-}
      GOOGLE_OAUTH_CLIENT_ID: ${GOOGLE_OAUTH_CLIENT_ID:-}
      GOOGLE_OAUTH_CLIENT_SECRET: ${GOOGLE_OAUTH_CLIENT_SECRET:-}
      # Self-hosted local auth 
      SELF_HOST_LOCAL_AUTH_EMAIL: ${SELF_HOST_LOCAL_AUTH_EMAIL:-}
      SELF_HOST_LOCAL_AUTH_PASSWORD: ${SELF_HOST_LOCAL_AUTH_PASSWORD:-}

      # Email / notifications (optional)
      LOOPS_EMAIL_API_KEY: ${LOOPS_EMAIL_API_KEY:-}
      # Loops transactional email template IDs (override with your own Loops account templates)
      LOOPS_INVITE_TEMPLATE_ID: ${LOOPS_INVITE_TEMPLATE_ID:-cmhvy2wgs3s13z70i1pxakij9}
      LOOPS_REVIEW_READY_TEMPLATE_ID: ${LOOPS_REVIEW_READY_TEMPLATE_ID:-cmj47k5ge16990iylued9by17}
      LOOPS_REVIEW_FAILED_TEMPLATE_ID: ${LOOPS_REVIEW_FAILED_TEMPLATE_ID:-cmj49ougk1c8s0iznavijdqpo}
      DIGEST_ENABLED: ${DIGEST_ENABLED:-false}

      # Review worker / artifact storage (optional)
      R2_ACCESS_KEY_ID: ${R2_ACCESS_KEY_ID:-}
      R2_SECRET_ACCESS_KEY: ${R2_SECRET_ACCESS_KEY:-}
      R2_REVIEW_ENDPOINT: ${R2_REVIEW_ENDPOINT:-}
      R2_REVIEW_BUCKET: ${R2_REVIEW_BUCKET:-}
      REVIEW_WORKER_BASE_URL: ${REVIEW_WORKER_BASE_URL:-}

      # GitHub App integration (optional)
      GITHUB_APP_ID: ${GITHUB_APP_ID:-}
      GITHUB_APP_PRIVATE_KEY: ${GITHUB_APP_PRIVATE_KEY:-}
      GITHUB_APP_WEBHOOK_SECRET: ${GITHUB_APP_WEBHOOK_SECRET:-}
      GITHUB_APP_SLUG: ${GITHUB_APP_SLUG:-}

      # Billing (optional)
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
      STRIPE_TEAM_SEAT_PRICE_ID: ${STRIPE_TEAM_SEAT_PRICE_ID:-}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
      STRIPE_FREE_SEAT_LIMIT: ${STRIPE_FREE_SEAT_LIMIT:-1}

      # Attachments (optional)
      # Only set these when enabling the attachments profile or using external blob storage.
      AZURE_STORAGE_ACCOUNT_NAME:
      AZURE_STORAGE_ACCOUNT_KEY:
      AZURE_STORAGE_CONTAINER_NAME:
      AZURE_STORAGE_ENDPOINT_URL:
      AZURE_STORAGE_PUBLIC_ENDPOINT_URL:

    ports:
      - "${REMOTE_SERVER_PORTS:-127.0.0.1:3000:8081}"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8081/v1/health"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s

  relay-server:
    profiles: ["relay"]
    build:
      context: ../..
      dockerfile: crates/relay-tunnel/Dockerfile
    depends_on:
      remote-db:
        condition: service_healthy
    environment:
      RUST_LOG: info
      SERVER_DATABASE_URL: postgres://remote:remote@remote-db:5432/remote
      RELAY_LISTEN_ADDR: 0.0.0.0:8082
      VIBEKANBAN_REMOTE_JWT_SECRET: ${VIBEKANBAN_REMOTE_JWT_SECRET:?set in .env.remote}
    ports:
      - "127.0.0.1:8082:8082"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8082/health"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s

volumes:
  remote-db-data:
  electric-data:
  azurite-data: