compose.yaml

configs:
  ts-serve:
    content: |
      {"TCP":{"443":{"HTTPS":true}},
      "Web":{"$${TS_CERT_DOMAIN}:443":
          {"Handlers":{"/":
          {"Proxy":"http://127.0.0.1:3000"}}}},
      "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}}

services:
# Make sure you have updated/checked the .env file with the correct variables.
# All the ${ xx } need to be defined there.
  # Tailscale Sidecar Configuration
  tailscale:
    image: tailscale/tailscale:latest # Image to be used
    container_name: tailscale-${SERVICE} # Name for local container management
    hostname: ${SERVICE} # Name used within your Tailscale environment
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required
      - TS_USERSPACE=false
      - TS_ENABLE_HEALTH_CHECK=true              # Enable healthcheck endpoint: "/healthz"
      - TS_LOCAL_ADDR_PORT=127.0.0.1:41234       # The <addr>:<port> for the healthz endpoint
      #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS
      - TS_AUTH_ONCE=true
    configs:
      - source: ts-serve
        target: /config/serve.json
    volumes:
      - ./config:/config # Config folder used to store Tailscale files - you may need to change the path
      - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path
    devices:
      - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work
    cap_add:
      - net_admin # Tailscale requirement
    #ports:
    #  - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required
    # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below
    #dns:
    #  - ${DNS_SERVER}
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational
      interval: 1m # How often to perform the check
      timeout: 10s # Time to wait for the check to succeed
      retries: 3 # Number of retries before marking as unhealthy
      start_period: 10s # Time to wait before starting health checks
    restart: always

  postgres:
    restart: always
    image: pgvector/pgvector:pg17
    volumes:
      - ./${SERVICE}-data/postgres:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=postgres
  redis:
    restart: always
    image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
    command: valkey-server --appendonly yes
    volumes:
      - ./${SERVICE}-data/redis:/data

  formbricks:
    image: ${IMAGE_URL}
    network_mode: service:tailscale
    container_name: app-${SERVICE}
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ}
      - WEBAPP_URL=${WEBAPP_URL}
      - NEXTAUTH_URL=${NEXTAUTH_URL}
      - DATABASE_URL=${DATABASE_URL}
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      - CRON_SECRET=${CRON_SECRET}
      - REDIS_URL=${REDIS_URL}
      - LOG_LEVEL=${LOG_LEVEL}
      - ENTERPRISE_LICENSE_KEY=${ENTERPRISE_LICENSE_KEY}
      - MAIL_FROM=${MAIL_FROM}
      - MAIL_FROM_NAME=${MAIL_FROM_NAME}
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT}
      - SMTP_USER=${SMTP_USER}
      - SMTP_PASSWORD=${SMTP_PASSWORD}
      - SMTP_AUTHENTICATED=${SMTP_AUTHENTICATED}
      - SMTP_SECURE_ENABLED=${SMTP_SECURE_ENABLED}
      - SMTP_REJECT_UNAUTHORIZED_TLS=${SMTP_REJECT_UNAUTHORIZED_TLS}
      - EMAIL_VERIFICATION_DISABLED=${EMAIL_VERIFICATION_DISABLED}
      - PASSWORD_RESET_DISABLED=${PASSWORD_RESET_DISABLED}
      - EMAIL_AUTH_DISABLED=${EMAIL_AUTH_DISABLED}
      - INVITE_DISABLED=${INVITE_DISABLED}
      - ASSET_PREFIX_URL=${ASSET_PREFIX_URL}
      - UNSPLASH_ACCESS_KEY=${UNSPLASH_ACCESS_KEY}
      - PUBLIC_URL=${PUBLIC_URL}
      - SENTRY_DSN=${SENTRY_DSN}
      - SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN}
      - SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT}
      - S3_ACCESS_KEY=${S3_ACCESS_KEY}
      - S3_SECRET_KEY=${S3_SECRET_KEY}
      - S3_REGION=${S3_REGION}
      - S3_BUCKET_NAME=${S3_BUCKET_NAME}
      - S3_ENDPOINT_URL=${S3_ENDPOINT_URL}
      - S3_FORCE_PATH_STYLE=${S3_FORCE_PATH_STYLE}
      - TURNSTILE_SITE_KEY=${TURNSTILE_SITE_KEY}
      - TURNSTILE_SECRET_KEY=${TURNSTILE_SECRET_KEY}
      - RECAPTCHA_SITE_KEY=${RECAPTCHA_SITE_KEY}
      - RECAPTCHA_SECRET_KEY=${RECAPTCHA_SECRET_KEY}
      - GITHUB_ID=${GITHUB_ID}
      - GITHUB_SECRET=${GITHUB_SECRET}
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
      - AZUREAD_CLIENT_ID=${AZUREAD_CLIENT_ID}
      - AZUREAD_CLIENT_SECRET=${AZUREAD_CLIENT_SECRET}
      - AZUREAD_TENANT_ID=${AZUREAD_TENANT_ID}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
      - OIDC_ISSUER=${OIDC_ISSUER}
      - OIDC_DISPLAY_NAME=${OIDC_DISPLAY_NAME}
      - OIDC_SIGNING_ALGORITHM=${OIDC_SIGNING_ALGORITHM}
      - SAML_DATABASE_URL=${SAML_DATABASE_URL}
      - NOTION_OAUTH_CLIENT_ID=${NOTION_OAUTH_CLIENT_ID}
      - NOTION_OAUTH_CLIENT_SECRET=${NOTION_OAUTH_CLIENT_SECRET}
      - GOOGLE_SHEETS_CLIENT_ID=${GOOGLE_SHEETS_CLIENT_ID}
      - GOOGLE_SHEETS_CLIENT_SECRET=${GOOGLE_SHEETS_CLIENT_SECRET}
      - GOOGLE_SHEETS_REDIRECT_URL=${GOOGLE_SHEETS_REDIRECT_URL}
      - AIRTABLE_CLIENT_ID=${AIRTABLE_CLIENT_ID}
      - SLACK_CLIENT_ID=${SLACK_CLIENT_ID}
      - SLACK_CLIENT_SECRET=${SLACK_CLIENT_SECRET}
      - PRIVACY_URL=${PRIVACY_URL}
      - TERMS_URL=${TERMS_URL}
      - IMPRINT_URL=${IMPRINT_URL}
      - IMPRINT_ADDRESS=${IMPRINT_ADDRESS}
      - RATE_LIMITING_DISABLED=${RATE_LIMITING_DISABLED}
      - AUDIT_LOG_ENABLED=${AUDIT_LOG_ENABLED}
      - AUDIT_LOG_GET_USER_IP=${AUDIT_LOG_GET_USER_IP}
      - AUTH_SKIP_INVITE_FOR_SSO=${AUTH_SKIP_INVITE_FOR_SSO}
      - AUTH_SSO_DEFAULT_TEAM_ID=${AUTH_SSO_DEFAULT_TEAM_ID}
      - USER_MANAGEMENT_MINIMUM_ROLE=${USER_MANAGEMENT_MINIMUM_ROLE}
      - SESSION_MAX_AGE=${SESSION_MAX_AGE}
    volumes:
      - ./${SERVICE}-data/app/config:/config
      - ./${SERVICE}-data/saml-connection:/home/nextjs/apps/web/saml-connection
    depends_on:
      tailscale:
        condition: service_healthy
      postgres:
        condition: service_started
      redis:
        condition: service_started
    restart: always