docker-compose.yml

# Reference Compose deployment for self-hosting Collectivus.
#
# Pairs the central server (`role: "server"`) with a rendezvous service so the
# `ctvs invite create` -> `ctvs join` flow works end to end. TLS is expected
# to terminate in front of these containers (Caddy / nginx / Traefik); the
# admin port (8788) MUST NOT be exposed to the public internet without one.
#
# Usage:
#   cp .env.example .env
#   # edit .env: set the five COLLECTIVUS_* values
#   docker compose up -d
#   docker compose ps
#
# All secrets are passed via container env (never baked into the inline
# config JSON), so this file is safe to check in. See .env.example for the
# variables compose substitutes at start.

services:
  central:
    image: ghcr.io/hyparam/collectivus:latest
    restart: unless-stopped
    # `--config-env` is parsed by bin/cli.js (see src/cli.js parseArgs). The
    # config JSON itself references `*_env` fields so the secrets stay out
    # of process argv and out of `docker inspect` config dumps.
    command: ["--config-env", "COLLECTIVUS_SERVER_CONFIG"]
    ports:
      - "8788:8788"
    volumes:
      # `/data` matches Dockerfile VOLUME and the inline config's data_dir.
      # The image runs as UID 1000 (`node`); the named volume inherits that
      # ownership on first start.
      - collectivus-server-data:/data
    depends_on:
      - rendezvous
    environment:
      # Inline server config. All secret-like fields use `*_env` so they are
      # resolved at runtime from the container environment, never inlined.
      # `data_dir`/`sink_dir`/`bootstrap_store_path` align with the volume
      # mount above so all server state lives on one persistent volume.
      COLLECTIVUS_SERVER_CONFIG: |
        {
          "version": 1,
          "role": "server",
          "server": {
            "control_plane_listen": "0.0.0.0:8788",
            "public_url": "${COLLECTIVUS_PUBLIC_URL}",
            "data_dir": "/data",
            "sink_dir": "/data/ingested",
            "identity_issuer": {
              "secret_env": "COLLECTIVUS_IDENTITY_SECRET",
              "bootstrap_store_path": "/data/bootstrap.json"
            },
            "admin": { "token_env": "COLLECTIVUS_ADMIN_TOKEN" },
            "enrollment": { "gateway_prefix": "ctvs" },
            "rendezvous": {
              "url_env": "COLLECTIVUS_RENDEZVOUS_URL",
              "registration_token_env": "COLLECTIVUS_RENDEZVOUS_REGISTRATION_TOKEN"
            }
          }
        }
      COLLECTIVUS_ADMIN_TOKEN: ${COLLECTIVUS_ADMIN_TOKEN}
      COLLECTIVUS_IDENTITY_SECRET: ${COLLECTIVUS_IDENTITY_SECRET}
      COLLECTIVUS_RENDEZVOUS_REGISTRATION_TOKEN: ${COLLECTIVUS_RENDEZVOUS_REGISTRATION_TOKEN}
      COLLECTIVUS_RENDEZVOUS_URL: ${COLLECTIVUS_RENDEZVOUS_URL}
      COLLECTIVUS_PUBLIC_URL: ${COLLECTIVUS_PUBLIC_URL}

  rendezvous:
    image: ghcr.io/hyparam/collectivus:latest
    restart: unless-stopped
    # The rendezvous subcommand reads the registration token from this env
    # var (see src/cli/rendezvous.js: REGISTRATION_TOKEN_ENV). Passing it
    # via `--registration-token` on argv would expose it in `ps`/proc lists.
    command: ["rendezvous", "--listen", "0.0.0.0:8789", "--data-dir", "/data/rendezvous"]
    ports:
      - "8789:8789"
    volumes:
      - collectivus-rendezvous-data:/data/rendezvous
    environment:
      COLLECTIVUS_RENDEZVOUS_REGISTRATION_TOKEN: ${COLLECTIVUS_RENDEZVOUS_REGISTRATION_TOKEN}

volumes:
  collectivus-server-data:
  collectivus-rendezvous-data: