compose.yaml

# Docker Compose config file for OpenProject deployment
#
# Based on https://github.com/opf/openproject-deploy

networks:
  frontend:
  backend:

volumes:
  pgdata:
  opdata:
  certs:
  vhost:
  html:
  acme:

x-op-image: &image
  image: openproject/community:13
x-op-restart-policy: &restart_policy
  restart: unless-stopped
x-op-common-env: &common_env
  OPENPROJECT_HTTPS: "${OPENPROJECT_HTTPS:-true}"
  OPENPROJECT_HOST__NAME: "${SERVER_HOSTNAME:-localhost:8080}"
  OPENPROJECT_HSTS: "${OPENPROJECT_HSTS:-true}"
  RAILS_CACHE_STORE: "memcache"
  OPENPROJECT_CACHE__MEMCACHE__SERVER: "cache:11211"
  OPENPROJECT_RAILS__RELATIVE__URL__ROOT: "${OPENPROJECT_RAILS__RELATIVE__URL__ROOT:-}"
  DATABASE_URL: "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db/openproject?pool=5&encoding=unicode&reconnect=true"
  RAILS_MIN_THREADS: 1
  RAILS_MAX_THREADS: 5
  # Enable enterprise edition features
  OPENPROJECT_EE__MANAGER__VISIBLE: "${OPENPROJECT_EE__MANAGER__VISIBLE:-false}"
  # Disable password-based login
  OPENPROJECT_DISABLE__PASSWORD__LOGIN: "${OPENPROJECT_DISABLE__PASSWORD__LOGIN:-true}"
  # Microsoft 365 / Entra ID authentication support
  OPENPROJECT_OPENID__CONNECT_ENTRA_DISPLAY__NAME: "Microsoft 365"
  OPENPROJECT_OPENID__CONNECT_ENTRA_HOST: "login.microsoftonline.com"
  OPENPROJECT_OPENID__CONNECT_ENTRA_IDENTIFIER: "${ENTRA_CLIENT_ID}"
  OPENPROJECT_OPENID__CONNECT_ENTRA_SECRET: "${ENTRA_CLIENT_SECRET}"
  OPENPROJECT_OPENID__CONNECT_ENTRA_AUTHORIZATION__ENDPOINT: "https://login.microsoftonline.com/${ENTRA_TENANT_ID}/oauth2/v2.0/authorize"
  OPENPROJECT_OPENID__CONNECT_ENTRA_TOKEN__ENDPOINT: "https://login.microsoftonline.com/${ENTRA_TENANT_ID}/oauth2/v2.0/token"
  OPENPROJECT_OPENID__CONNECT_ENTRA_USERINFO__ENDPOINT: "https://graph.microsoft.com/oidc/userinfo"
  OPENPROJECT_OPENID__CONNECT_ENTRA_PROMPT: "select_account"
  # We want to use username & password authentication for SMTP
  SMTP_AUTHENTICATION: "login"
  # We don't want to receive e-mail replies and parse them
  IMAP_ENABLED: "false"
  SERVER_HOSTNAME:
x-op-app: &app
  <<: [*image, *restart_policy]
  environment:
    <<: *common_env
  volumes:
    - "${OPDATA:-opdata}:/var/openproject/assets"
x-op-web-env: &web_env
  <<: *common_env
  VIRTUAL_HOST: ${SERVER_HOSTNAME}
  VIRTUAL_PORT: 8080
  LETSENCRYPT_HOST: ${SERVER_HOSTNAME}
x-op-web-app: &web_app
  <<: [*image, *restart_policy]
  environment:
    <<: *web_env
  volumes:
    - "${OPDATA:-opdata}:/var/openproject/assets"

services:
  db:
    image: postgres:13
    <<: *restart_policy
    stop_grace_period: "3s"
    volumes:
      - "pgdata:/var/lib/postgresql/data"
    environment:
      POSTGRES_USER:
      POSTGRES_PASSWORD:
      POSTGRES_DB: openproject
    networks:
      - backend

  cache:
    image: memcached
    <<: *restart_policy
    networks:
      - backend

  seeder:
    <<: *app
    command: "./docker/prod/seeder"
    restart: on-failure
    networks:
      - backend

  worker:
    <<: *app
    command: "./docker/prod/worker"
    networks:
      - backend
    depends_on:
      - db
      - cache
      - seeder

  cron:
    <<: *app
    command: "./docker/prod/cron"
    networks:
      - backend
    depends_on:
      - db
      - cache
      - seeder

  web:
    <<: *web_app
    command: "./docker/prod/web"
    networks:
      - frontend
      - backend
    depends_on:
      - db
      - cache
      - seeder
    labels:
      - autoheal=true
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health_checks/default"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 30s
    ports:
      - "8080:8080"

  autoheal:
    image: willfarrell/autoheal:1.2.0
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      AUTOHEAL_CONTAINER_LABEL: autoheal
      AUTOHEAL_START_PERIOD: 600
      AUTOHEAL_INTERVAL: 30
    networks:
      - backend

  nginx-proxy:
    image: nginxproxy/nginx-proxy
    <<: *restart_policy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - certs:/etc/nginx/certs
      - vhost:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
    depends_on:
      - web
    networks:
      - frontend
    labels:
      - "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy"

  nginx-proxy-acme:
    image: nginxproxy/acme-companion
    <<: *restart_policy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - certs:/etc/nginx/certs
      - vhost:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - acme:/etc/acme.sh
    depends_on:
      - nginx-proxy
      - web
    networks:
      - frontend
    environment:
      DEFAULT_EMAIL: ${LETSENCRYPT_EMAIL}