docker-compose.yml

services:
  outline:
    image: outlinewiki/outline:1.4
    env_file: .env
    # Port 3000 is only accessed via nginx reverse proxy (no host binding needed)
    expose:
      - "3000"
    volumes:
      - ./data:/var/lib/outline/data
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    restart: unless-stopped

  postgres:
    image: postgres:15
    env_file: .env
    environment:
      POSTGRES_USER: outline
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: outline
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./scripts/init-keycloak-db.sql:/docker-entrypoint-initdb.d/init-keycloak-db.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U outline"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  redis:
    image: redis:7
    restart: unless-stopped

  keycloak:
    image: quay.io/keycloak/keycloak:26.0
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: outline
      KC_DB_PASSWORD: ${POSTGRES_PASSWORD}
      KC_HOSTNAME: ${AUTH_DOMAIN:-auth.example.com}
      KC_PROXY_HEADERS: xforwarded
      KC_HTTP_ENABLED: "true"
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
    command: start --import-realm
    volumes:
      - ./keycloak/outline-realm.json:/opt/keycloak/data/import/outline-realm.json:ro
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped

  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./nginx/certs:/etc/letsencrypt:ro
      - ./nginx/www:/var/www/certbot
    depends_on:
      - outline
    restart: unless-stopped

  certbot:
    image: certbot/certbot
    entrypoint: /bin/sh -c "apk add --no-cache curl -q && trap exit TERM; while :; do certbot renew --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh; sleep 12h & wait $${!}; done"
    volumes:
      - ./nginx/certs:/etc/letsencrypt
      - ./nginx/www:/var/www/certbot
      - ./scripts/deploy-hook.sh:/etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    depends_on:
      - nginx
    restart: unless-stopped

volumes:
  postgres-data: