compose.yml

# a Compose file always starts with the version number.
# The version can be '3.9' but here we do not know
# what is the minimal required version: we just specify all versions '3'.
version: '3'

networks:
  quid-db-network:
    internal: true
  outside-network:
    internal: false

# Simple rule: a service is a container.
# A container usually runs a database, a backend server, a reverse-proxy...
# The following two "services" are the Quid container and its Postgres database.
services:

  # The name of this service is "quid" (but it can be anything else).
  quid:
    container_name: quid # Good practice: container_name = service name.
    image: quid
    build:
      context: . # Search the Dockerfile in the "." local directory.
      args:
        - uid=6606 # "uid" and "gid" to run Quid in non-root mode.
        - gid=6606
    depends_on:
      db:
        condition: service_healthy
    user: "6606:6606" # "uid:gid" to run quid in non-root mode.
    environment:
      - QUID_KEY=9362e8246661bd2c05c3bf1c14b86ac8
      - QUID_ADMIN_USR=admin
      - QUID_ADMIN_PWD=myAdminPassword # Please change this password
      - POSTGRES_USER=pguser # Must be the same POSTGRES_USER used by container "db".
      - POSTGRES_PASSWORD=myDBpwd # Please change this password
      - POSTGRES_DB=quid
      - DB_HOST=db # "db" is the "container_name" of the Postgres container.
      - ALLOWED_ORIGINS=http://localhost:8090/
    command: -v -dev
    # Quid listens on port 8090 by default.
    # To connect from the machine (outside the compose),
    # we bind 8090 to an available host port (here the same port number).
    # The syntax is [host-port]:[port-in-the-container]
    # This is different from the "expose" attribute of the Postgres container.
    ports:
      - 8090:8090
    networks:
      - quid-db-network # to access the database
      - outside-network # to be accessed from outside the compose

  # The Postgres service is named "db", its "container_name" is also "db".
  db:
    container_name: db
    # Official Postgres image v14, based on Alpine (Alpine images are smaller).
    # see: https://index.docker.io/_/postgres
    # doc: https://github.com/docker-library/docs/blob/master/postgres/README.md
    image: docker.io/postgres:14-alpine
    # Quid waits for DB being ready using the following healthcheck
    # see: https://github.com/peter-evans/docker-compose-healthcheck/issues/16#issuecomment-1073039761
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"
        ]
      interval: 2s
      timeout: 1s
      retries: 3
    # Postgres listens on port 5432 by default.
    # This port must be exposed to allow connection from another service (inside the same network).
    # The exposed port is only exposed within the internal network (only accessible by Quid).
    # The exposed port is not accessible from outside the host.
    expose:
      - 5432
    environment:
      # The following environment variables are used by:
      # - the Postgres server,
      # - the docker-entrypoint-initdb.d/init-user-db.sh
      # - and the previous healthcheck.
      # The docker-entrypoint-initdb.d/init-user-db.sh script
      # is run on first launch only to create the user and the database.
      # These variables should be duplicated for the Quid container.
      - POSTGRES_USER=pguser
      - POSTGRES_PASSWORD=myDBpwd
      - POSTGRES_DB=quid
    volumes:
      # Script to create user, database, permission at first launch.
      # doc: https://github.com/docker-library/docs/blob/master/postgres/README.md#initialization-scripts
      - ./docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d
    networks:
      # The database is not accessible from Internet
      # and the database cannot access the web.
      # (no analytics/telemetry, no exposed backdoor...)
      - quid-db-network