Quickstart

name: monospace

services:
  # ---------------------------------------------------------------------------
  # PostgreSQL — system database
  # ---------------------------------------------------------------------------
  postgres:
    image: postgres:17
    restart: unless-stopped
    command: postgres -c 'max_connections=200'
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: monospace
      POSTGRES_DB: monospace
      POSTGRES_HOST_AUTH_METHOD: md5
      POSTGRES_INITDB_ARGS: --auth-host=md5
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d monospace"]
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - monospace

  # ---------------------------------------------------------------------------
  # RabbitMQ — event bus (required for email delivery & webhooks)
  # ---------------------------------------------------------------------------
  rabbitmq:
    image: rabbitmq:3.13-management
    restart: unless-stopped
    environment:
      RABBITMQ_DEFAULT_USER: monospace
      RABBITMQ_DEFAULT_PASS: monospace
    volumes:
      - rabbitmq_data:/var/lib/rabbitmq
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - monospace

  # ---------------------------------------------------------------------------
  # Key generator — ephemeral init container that writes JWT + KMS keys once
  # ---------------------------------------------------------------------------
  keygen:
    image: alpine:3.21
    command:
      - sh
      - -c
      - |
        set -e
        mkdir -p /keys
        # Only generate if keys don't already exist
        if ! [ -f /keys/jwt_private.pem ] || ! [ -f /keys/jwt_public.pem ] || ! [ -f /keys/kms_master.key ]; then
          apk add --no-cache openssl > /dev/null
          openssl genpkey -algorithm ED25519 -out /keys/jwt_private.pem
          openssl pkey -in /keys/jwt_private.pem -pubout -out /keys/jwt_public.pem
          openssl rand -base64 32 | tr -d '\n' > /keys/kms_master.key
          echo "Keys generated."
        else
          echo "Keys already exist, skipping generation."
        fi
        chown 65532:65532 /keys/jwt_private.pem /keys/jwt_public.pem /keys/kms_master.key
        chmod 600 /keys/jwt_private.pem /keys/jwt_public.pem /keys/kms_master.key
    volumes:
      - keys_data:/keys

  # ---------------------------------------------------------------------------
  # Monospace — the application
  # ---------------------------------------------------------------------------
  monospace:
    image: monospace/monospace:v0.0.4
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      keygen:
        condition: service_completed_successfully
    ports:
      - "8100:8100"
    volumes:
      - keys_data:/keys:ro
      - uploads_data:/uploads
    environment:
      # Server
      DIRECTUS_HOST: "0.0.0.0"
      DIRECTUS_PORT: "8100"
      DIRECTUS_BASE_URL: "http://localhost:8100"

      # System database
      DIRECTUS_SYSTEM_DATABASE__PROVIDER: "postgres"
      DIRECTUS_SYSTEM_DATABASE__HOST: "postgres"
      DIRECTUS_SYSTEM_DATABASE__PORT: "5432"
      DIRECTUS_SYSTEM_DATABASE__USER: "postgres"
      DIRECTUS_SYSTEM_DATABASE__PASSWORD: "monospace"
      DIRECTUS_SYSTEM_DATABASE__DBNAME: "monospace"

      # File storage (local, inside the container)
      DIRECTUS_SYSTEM_FILE_STORAGE__PROVIDER: "local"
      DIRECTUS_SYSTEM_FILE_STORAGE__ROOT_PATH: "/uploads"

      # RabbitMQ
      DIRECTUS_RABBITMQ__HOST: "rabbitmq"
      DIRECTUS_RABBITMQ__PORT: "5672"
      DIRECTUS_RABBITMQ__USER: "monospace"
      DIRECTUS_RABBITMQ__PASSWORD: "monospace"
      DIRECTUS_RABBITMQ__VHOST: "/"

      # JWT keys (generated by keygen init container)
      DIRECTUS_JWT_PRIVATE_KEY__FILE: "/keys/jwt_private.pem"
      DIRECTUS_JWT_PUBLIC_KEY__FILE: "/keys/jwt_public.pem"

      # KMS (generated by keygen init container)
      DIRECTUS_KMS__TYPE: "directus"
      DIRECTUS_KMS__MASTER_KEY__FILE: "/keys/kms_master.key"

      # Auth tokens
      DIRECTUS_ACCESS_TOKEN_TTL: "15m"
      DIRECTUS_REFRESH_TOKEN_TTL: "7days"

      # Cookie — disable Secure flag so HTTP works out of the box
      DIRECTUS_COOKIE_SECURE: "false"

      # Default login and password
      DIRECTUS_ADMIN_EMAIL: "admin@example.com"
      DIRECTUS_ADMIN_PASSWORD: "monospace"
    networks:
      - monospace

volumes:
  postgres_data:
  rabbitmq_data:
  keys_data:
  uploads_data:

networks:
  monospace: