docker-compose.full.yml

# FlowEngine Portal - Full Stack (Supabase + Coolify + Portal)
# Everything you need to run and deploy n8n instances from one machine.
#
# Quick start:
#   1. cp .env.docker .env
#   2. docker compose -f docker-compose.full.yml up -d
#   3. Open http://localhost:3000 (Portal)
#   4. Open http://localhost:8080 (Coolify - create account on first visit)
#   5. Go to Portal > Settings > Platform > Hosting
#      - Coolify URL: http://coolify:8080
#      - API Token: (copy from Coolify > Settings > API)
#
# Architecture:
#   Portal (Next.js) --> Supabase (Auth + DB)
#                    --> Coolify (deploys n8n containers via Docker)
#
# Coolify manages Docker containers on this same machine.
# It needs Docker socket access to create/manage n8n instances.

services:
  # =============================================
  #  SUPABASE SERVICES
  # =============================================

  # PostgreSQL - Supabase database
  supabase-db:
    image: supabase/postgres:15.8.1.060
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: postgres
      JWT_SECRET: ${JWT_SECRET}
    volumes:
      - supabase_db_data:/var/lib/postgresql/data
      - ./migrations/supabase-schema.sql:/docker-entrypoint-initdb.d/01-schema.sql
      - ./migrations/add_portal_settings.sql:/docker-entrypoint-initdb.d/02-portal-settings.sql
      - ./migrations/seed.sql:/docker-entrypoint-initdb.d/99-seed.sql
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  # GoTrue - Authentication
  supabase-auth:
    image: supabase/gotrue:v2.170.0
    depends_on:
      supabase-db:
        condition: service_healthy
    environment:
      GOTRUE_API_HOST: 0.0.0.0
      GOTRUE_API_PORT: 9999
      API_EXTERNAL_URL: ${API_EXTERNAL_URL:-http://localhost:8000}
      GOTRUE_DB_DRIVER: postgres
      GOTRUE_DB_DATABASE_URL: postgres://supabase_auth_admin:${POSTGRES_PASSWORD}@supabase-db:5432/postgres
      GOTRUE_SITE_URL: ${SITE_URL:-http://localhost:3000}
      GOTRUE_URI_ALLOW_LIST: ${ADDITIONAL_REDIRECT_URLS:-}
      GOTRUE_DISABLE_SIGNUP: ${DISABLE_SIGNUP:-false}
      GOTRUE_JWT_ADMIN_ROLES: service_role
      GOTRUE_JWT_AUD: authenticated
      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
      GOTRUE_JWT_EXP: 3600
      GOTRUE_JWT_SECRET: ${JWT_SECRET}
      GOTRUE_EXTERNAL_EMAIL_ENABLED: true
      GOTRUE_MAILER_AUTOCONFIRM: ${ENABLE_EMAIL_AUTOCONFIRM:-true}
      GOTRUE_SMTP_HOST: ${SMTP_HOST:-}
      GOTRUE_SMTP_PORT: ${SMTP_PORT:-587}
      GOTRUE_SMTP_USER: ${SMTP_USER:-}
      GOTRUE_SMTP_PASS: ${SMTP_PASS:-}
      GOTRUE_SMTP_ADMIN_EMAIL: ${SMTP_FROM:-noreply@localhost}
      GOTRUE_SMTP_SENDER_NAME: ${SMTP_SENDER_NAME:-FlowEngine}
      GOTRUE_MAILER_URLPATHS_INVITE: /auth/callback
      GOTRUE_MAILER_URLPATHS_CONFIRMATION: /auth/callback
      GOTRUE_MAILER_URLPATHS_RECOVERY: /auth/callback
    restart: unless-stopped

  # PostgREST - REST API
  supabase-rest:
    image: postgrest/postgrest:v12.2.8
    depends_on:
      supabase-db:
        condition: service_healthy
    environment:
      PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@supabase-db:5432/postgres
      PGRST_DB_SCHEMAS: public,storage,graphql_public
      PGRST_DB_ANON_ROLE: anon
      PGRST_JWT_SECRET: ${JWT_SECRET}
      PGRST_DB_USE_LEGACY_GUCS: "false"
    restart: unless-stopped

  # Supabase Storage - File uploads
  supabase-storage:
    image: supabase/storage-api:v1.14.3
    depends_on:
      supabase-db:
        condition: service_healthy
    environment:
      ANON_KEY: ${ANON_KEY}
      SERVICE_KEY: ${SERVICE_ROLE_KEY}
      POSTGREST_URL: http://supabase-rest:3000
      PGRST_JWT_SECRET: ${JWT_SECRET}
      DATABASE_URL: postgres://supabase_storage_admin:${POSTGRES_PASSWORD}@supabase-db:5432/postgres
      FILE_SIZE_LIMIT: 52428800
      STORAGE_BACKEND: file
      FILE_STORAGE_BACKEND_PATH: /var/lib/storage
      TENANT_ID: stub
      REGION: stub
      GLOBAL_S3_BUCKET: stub
      IS_MULTITENANT: "false"
    volumes:
      - supabase_storage_data:/var/lib/storage
    restart: unless-stopped

  # Realtime - WebSocket subscriptions
  supabase-realtime:
    image: supabase/realtime:v2.34.18
    depends_on:
      supabase-db:
        condition: service_healthy
    environment:
      PORT: 4000
      DB_HOST: supabase-db
      DB_PORT: 5432
      DB_USER: supabase_admin
      DB_PASSWORD: ${POSTGRES_PASSWORD}
      DB_NAME: postgres
      DB_AFTER_CONNECT_QUERY: "SET search_path TO _realtime"
      DB_ENC_KEY: supabaserealtime
      API_JWT_SECRET: ${JWT_SECRET}
      FLY_ALLOC_ID: fly123
      FLY_APP_NAME: realtime
      SECRET_KEY_BASE: ${JWT_SECRET}
      ERL_AFLAGS: "-proto_dist inet_tcp"
      ENABLE_TAILSCALE: "false"
      DNS_NODES: "''"
    restart: unless-stopped

  # Kong - API Gateway (routes Supabase services)
  supabase-kong:
    image: kong:2.8.1
    ports:
      - "${KONG_HTTP_PORT:-8000}:8000"
    environment:
      KONG_DATABASE: "off"
      KONG_DECLARATIVE_CONFIG: /var/lib/kong/kong.yml
      KONG_DNS_ORDER: LAST,A,CNAME
      KONG_PLUGINS: request-transformer,cors,key-auth,acl,basic-auth
      KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
      KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
    volumes:
      - ./docker/kong-full.yml:/var/lib/kong/kong.yml:ro
    depends_on:
      - supabase-auth
      - supabase-rest
      - supabase-storage
      - supabase-realtime
    restart: unless-stopped

  # =============================================
  #  COOLIFY - Container Deployment Platform
  # =============================================

  # Coolify's own PostgreSQL (separate from Supabase)
  coolify-db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: coolify
      POSTGRES_PASSWORD: ${COOLIFY_DB_PASSWORD:-coolify-secret}
      POSTGRES_DB: coolify
    volumes:
      - coolify_db_data:/var/lib/postgresql/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U coolify"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Coolify Redis
  coolify-redis:
    image: redis:7-alpine
    volumes:
      - coolify_redis_data:/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Coolify Application
  coolify:
    image: ghcr.io/coollabsio/coolify:latest
    ports:
      - "${COOLIFY_PORT:-8080}:8080"
    environment:
      APP_ID: ${COOLIFY_APP_ID:-flowengine-coolify}
      APP_KEY: ${COOLIFY_APP_KEY:-base64:generated-key-here}
      APP_URL: http://localhost:${COOLIFY_PORT:-8080}
      DB_CONNECTION: pgsql
      DB_HOST: coolify-db
      DB_PORT: 5432
      DB_DATABASE: coolify
      DB_USERNAME: coolify
      DB_PASSWORD: ${COOLIFY_DB_PASSWORD:-coolify-secret}
      REDIS_HOST: coolify-redis
      REDIS_PORT: 6379
      SSL_MODE: "off"
      PUSHER_APP_ID: flowengine
      PUSHER_APP_KEY: flowengine
      PUSHER_APP_SECRET: flowengine
      PUSHER_HOST: coolify-soketi
      PUSHER_PORT: 6001
      QUEUE_CONNECTION: redis
      SELF_HOSTED: "true"
    volumes:
      # Docker socket - allows Coolify to manage containers
      - /var/run/docker.sock:/var/run/docker.sock
      - coolify_data:/data/coolify
      - coolify_ssh:/data/coolify/ssh
    depends_on:
      coolify-db:
        condition: service_healthy
      coolify-redis:
        condition: service_healthy
    restart: unless-stopped

  # Coolify Soketi (WebSocket for real-time updates)
  coolify-soketi:
    image: quay.io/soketi/soketi:1.6-16-debian
    environment:
      SOKETI_DEFAULT_APP_ID: flowengine
      SOKETI_DEFAULT_APP_KEY: flowengine
      SOKETI_DEFAULT_APP_SECRET: flowengine
    restart: unless-stopped

  # =============================================
  #  FLOWENGINE PORTAL
  # =============================================

  portal:
    build: .
    ports:
      - "${PORTAL_PORT:-3000}:3000"
    environment:
      NEXT_PUBLIC_SUPABASE_URL: ${API_EXTERNAL_URL:-http://localhost:8000}
      NEXT_PUBLIC_SUPABASE_ANON_KEY: ${ANON_KEY}
      SUPABASE_SERVICE_ROLE_KEY: ${SERVICE_ROLE_KEY}
      NEXT_PUBLIC_APP_URL: ${SITE_URL:-http://localhost:3000}
    depends_on:
      supabase-db:
        condition: service_healthy
      supabase-kong:
        condition: service_started
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

volumes:
  supabase_db_data:
  supabase_storage_data:
  coolify_db_data:
  coolify_redis_data:
  coolify_data:
  coolify_ssh: