docker-compose.example.yml

services:
  dashboard:
    build:
      context: .
      target: runtime
    image: sub2api-dashboard:local
    restart: unless-stopped
    init: true
    ports:
      - '127.0.0.1:3000:3000'
    environment:
      NODE_ENV: production
      HOST: 0.0.0.0
      PORT: 3000
      PUBLIC_ORIGIN: https://dashboard.example.com
      SUB2API_BASE_URL: https://sub2api.example.com
      GROUP_ALLOWLIST_JSON: '[{"slug":"team-a","upstreamId":1,"label":"Team A","platformHint":"Anthropic"}]'
      COOKIE_SECURE: 'true'
      TRUST_PROXY: 'true'
      WEB_DIST: /app/web
      SUB2API_ADMIN_API_KEY: ${SUB2API_ADMIN_API_KEY:?set in an uncommitted .env or secret manager}
      SESSION_COOKIE_KEY: ${SESSION_COOKIE_KEY:?generate a distinct 32-byte base64url value}
      CSRF_HMAC_KEY: ${CSRF_HMAC_KEY:?generate a distinct 32-byte base64url value}
      ACCOUNT_REF_HMAC_KEY: ${ACCOUNT_REF_HMAC_KEY:?generate a distinct 32-byte base64url value}
      SESSION_VAULT_ACTIVE_KEY_ID: v1
      SESSION_VAULT_KEYS_JSON: ${SESSION_VAULT_KEYS_JSON:?JSON keyring with a distinct 32-byte base64url v1 key}
      REDIS_URL: redis://:${DASHBOARD_SESSION_REDIS_PASSWORD:?set a URL-safe base64url Redis password}@dashboard-session-redis:6379
    depends_on:
      dashboard-session-redis:
        condition: service_healthy
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=16m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test:
        [
          'CMD',
          'node',
          '-e',
          "fetch('http://127.0.0.1:3000/health/live').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))",
        ]
      interval: 30s
      timeout: 3s
      start_period: 10s
      retries: 3
  dashboard-session-redis:
    image: redis:7.4-alpine
    restart: unless-stopped
    command:
      [
        'redis-server',
        '--appendonly',
        'yes',
        '--requirepass',
        '${DASHBOARD_SESSION_REDIS_PASSWORD:?set a URL-safe base64url Redis password}',
      ]
    volumes:
      - dashboard-session-redis-data:/data
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'redis-cli -a "$${DASHBOARD_SESSION_REDIS_PASSWORD}" ping | grep -q PONG',
        ]
      interval: 10s
      timeout: 3s
      retries: 5
    environment:
      DASHBOARD_SESSION_REDIS_PASSWORD: ${DASHBOARD_SESSION_REDIS_PASSWORD:?set a strong dedicated Redis password}
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=8m
volumes:
  dashboard-session-redis-data: