docker-compose.prod.yml

# Production Docker Compose for phpMyFAQ
#
# Every service is gated behind a Compose profile, so only the components you
# choose are started:
#
#   web server     apache | frankenphp
#   database       mariadb | postgres
#   search engine  elasticsearch | opensearch        (optional)
#
# Copy .env.production.example to .env, set COMPOSE_PROFILES and the
# passwords, then run:
#
#   docker compose -f docker-compose.prod.yml up -d
#
# With PMF_DB_* and PMF_ADMIN_PASSWORD set, the container installs phpMyFAQ on
# first start. Otherwise open http://<host>/setup/ and use the service name
# (mariadb or postgres) as the database host. See docs/deployment.md.

# Shared by both web server variants: PHP settings, headless installation, search engine
x-phpmyfaq-environment: &phpmyfaq-environment
  PMF_TIMEZONE: ${PMF_TIMEZONE:-UTC}
  PMF_MEMORY_LIMIT: ${PMF_MEMORY_LIMIT:-512M}
  PHP_UPLOAD_MAX_FILESIZE: ${PHP_UPLOAD_MAX_FILESIZE:-64M}
  PHP_POST_MAX_SIZE: ${PHP_POST_MAX_SIZE:-64M}
  # Reverse proxies whose X-Forwarded-* headers are trusted (see .env.production.example)
  TRUSTED_PROXIES: ${TRUSTED_PROXIES:-}
  # Headless installation on first start (optional, see .env.production.example)
  PMF_DB_TYPE: ${PMF_DB_TYPE:-mysqli}
  PMF_DB_HOST: ${PMF_DB_HOST:-}
  PMF_DB_PORT: ${PMF_DB_PORT:-}
  PMF_DB_NAME: ${PMF_DB_NAME:-phpmyfaq}
  PMF_DB_USER: ${PMF_DB_USER:-phpmyfaq}
  PMF_DB_PASS: ${PMF_DB_PASS:-}
  PMF_ADMIN_USER: ${PMF_ADMIN_USER:-admin}
  PMF_ADMIN_PASSWORD: ${PMF_ADMIN_PASSWORD:-}
  PMF_BASE_URL: ${PMF_BASE_URL:-http://localhost}
  # Search engine (optional)
  ELASTICSEARCH_BASE_URI: ${ELASTICSEARCH_BASE_URI:-}
  OPENSEARCH_BASE_URI: ${OPENSEARCH_BASE_URI:-}

x-phpmyfaq-depends-on: &phpmyfaq-depends-on
  mariadb:
    condition: service_healthy
    required: false
  postgres:
    condition: service_healthy
    required: false
  elasticsearch:
    condition: service_healthy
    required: false
  opensearch:
    condition: service_healthy
    required: false

services:
  # ========================================
  # Web server (choose one profile)
  # ========================================

  apache:
    profiles: ['apache']
    image: ${PMF_IMAGE:-ghcr.io/thorsten/phpmyfaq}:${PMF_VERSION:-latest}
    container_name: phpmyfaq-apache
    restart: unless-stopped
    environment:
      <<: *phpmyfaq-environment
    volumes:
      - phpmyfaq_config:/var/www/html/content/core/config
      - phpmyfaq_data:/var/www/html/content/core/data
      - phpmyfaq_logs:/var/www/html/content/core/logs
      - phpmyfaq_attachments:/var/www/html/content/user/attachments
      - phpmyfaq_images:/var/www/html/content/user/images
    ports:
      # Plain HTTP; terminate TLS in a reverse proxy (see docs/deployment.md)
      - '${PMF_HTTP_PORT:-80}:80'
    networks:
      - phpmyfaq
    depends_on:
      <<: *phpmyfaq-depends-on
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 1G

  frankenphp:
    profiles: ['frankenphp']
    image: ${PMF_IMAGE:-ghcr.io/thorsten/phpmyfaq}:${PMF_VERSION:-latest}-frankenphp
    container_name: phpmyfaq-frankenphp
    restart: unless-stopped
    environment:
      <<: *phpmyfaq-environment
      # ":80" serves plain HTTP. A public host name enables automatic HTTPS
      # (Let's Encrypt) and HTTP/3; ports 80 and 443 must then be reachable.
      SERVER_NAME: ${SERVER_NAME:-:80}
    volumes:
      - phpmyfaq_config:/var/www/html/content/core/config
      - phpmyfaq_data:/var/www/html/content/core/data
      - phpmyfaq_logs:/var/www/html/content/core/logs
      - phpmyfaq_attachments:/var/www/html/content/user/attachments
      - phpmyfaq_images:/var/www/html/content/user/images
      - caddy_data:/data
      - caddy_config:/config
    ports:
      - '${PMF_HTTP_PORT:-80}:80'
      - '${PMF_HTTPS_PORT:-443}:443'
      - '${PMF_HTTPS_PORT:-443}:443/udp'
    networks:
      - phpmyfaq
    depends_on:
      <<: *phpmyfaq-depends-on
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 1G

  # ========================================
  # Database (choose one profile)
  # ========================================

  mariadb:
    profiles: ['mariadb']
    image: mariadb:11.8
    container_name: phpmyfaq-mariadb
    restart: unless-stopped
    environment:
      MARIADB_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?set MYSQL_ROOT_PASSWORD in .env}
      MARIADB_DATABASE: ${MYSQL_DATABASE:-phpmyfaq}
      MARIADB_USER: ${MYSQL_USER:-phpmyfaq}
      MARIADB_PASSWORD: ${MYSQL_PASSWORD:?set MYSQL_PASSWORD in .env}
    volumes:
      - mariadb_data:/var/lib/mysql
    networks:
      - phpmyfaq
    healthcheck:
      test: ['CMD', 'healthcheck.sh', '--connect', '--innodb_initialized']
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
    # The database is only reachable on the internal network; never publish
    # its port in production.

  postgres:
    profiles: ['postgres']
    image: postgres:17-alpine
    container_name: phpmyfaq-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-phpmyfaq}
      POSTGRES_USER: ${POSTGRES_USER:-phpmyfaq}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
      POSTGRES_INITDB_ARGS: --encoding=UTF8 --lc-collate=C --lc-ctype=C
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - phpmyfaq
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U "$${POSTGRES_USER}" -d "$${POSTGRES_DB}"']
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G

  # ========================================
  # Search engine (optional, choose one profile)
  # ========================================

  elasticsearch:
    profiles: ['elasticsearch']
    image: elasticsearch:8.16.5
    container_name: phpmyfaq-elasticsearch
    restart: unless-stopped
    environment:
      - cluster.name=phpmyfaq-cluster
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      # The cluster is only reachable on the internal network
      - xpack.security.enabled=false
      - 'ES_JAVA_OPTS=${ES_JAVA_OPTS:--Xms1g -Xmx1g}'
    # phpMyFAQ's index mapping uses the ICU analysis plugin
    command:
      [
        'sh',
        '-c',
        './bin/elasticsearch-plugin list | grep -q analysis-icu || ./bin/elasticsearch-plugin install --batch analysis-icu && ./bin/elasticsearch',
      ]
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - elasticsearch_data:/usr/share/elasticsearch/data
    networks:
      - phpmyfaq
    healthcheck:
      test: ['CMD-SHELL', 'curl -fs http://localhost:9200/_cluster/health || exit 1']
      interval: 15s
      timeout: 5s
      retries: 20
      start_period: 60s
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G

  opensearch:
    profiles: ['opensearch']
    image: opensearchproject/opensearch:2.19.2
    container_name: phpmyfaq-opensearch
    restart: unless-stopped
    environment:
      - cluster.name=phpmyfaq-cluster
      - node.name=phpmyfaq
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - DISABLE_INSTALL_DEMO_CONFIG=true
      # The cluster is only reachable on the internal network
      - DISABLE_SECURITY_PLUGIN=true
      - DISABLE_PERFORMANCE_ANALYZER_AGENT=true
      - 'OPENSEARCH_JAVA_OPTS=${OPENSEARCH_JAVA_OPTS:--Xms1g -Xmx1g}'
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - opensearch_data:/usr/share/opensearch/data
    networks:
      - phpmyfaq
    healthcheck:
      test: ['CMD-SHELL', 'curl -fs http://localhost:9200/_cluster/health || exit 1']
      interval: 15s
      timeout: 5s
      retries: 20
      start_period: 60s
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G

networks:
  phpmyfaq:
    driver: bridge

volumes:
  # phpMyFAQ: everything the application writes. Back these up.
  phpmyfaq_config:
  phpmyfaq_data:
  phpmyfaq_logs:
  phpmyfaq_attachments:
  phpmyfaq_images:
  # FrankenPHP: certificates and Caddy state
  caddy_data:
  caddy_config:
  # Databases and search indexes
  mariadb_data:
  postgres_data:
  elasticsearch_data:
  opensearch_data: