nullbox/docker-compose.yml at main · dotlabshq/nullbox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
version: "3.9"

# ─── Networks ─────────────────────────────────────────────────────────────────
networks:
  nullbox-internal:
    driver: bridge
  kong-net:
    #external: true     # Shared with Kong API gateway
    name: kong-net

# ─── Volumes ──────────────────────────────────────────────────────────────────
volumes:
  redis-data:
  minio-data:
  nullbox-logs:

# ─── Services ─────────────────────────────────────────────────────────────────
services:

  # ── App ─────────────────────────────────────────────────────────────────────
  app:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
        NEXT_PUBLIC_APP_NAME: nullbox
    image: nullbox:latest
    container_name: nullbox-app
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      # Redis
      REDIS_URL: redis://redis:6379
      REDIS_KEY_PREFIX: nullbox
      # S3 (MinIO in dev, real S3 in prod)
      S3_BUCKET: ${S3_BUCKET:-nullbox-dev}
      S3_REGION: ${S3_REGION:-us-east-1}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-minioadmin}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-minioadmin}
      S3_ENDPOINT: ${S3_ENDPOINT:-http://minio:9000}
      S3_PUBLIC_URL: ${S3_PUBLIC_URL:-http://localhost:9000}
      # App
      NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
      NEXTAUTH_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:?NEXTAUTH_SECRET is required}
      TOKEN_SECRET: ${TOKEN_SECRET:?TOKEN_SECRET is required}
      # Limits
      MAX_FILE_SIZE_MB: ${MAX_FILE_SIZE_MB:-2048}
      MAX_DOWNLOAD_COUNT: ${MAX_DOWNLOAD_COUNT:-100}
      MAX_EXPIRY_DAYS: ${MAX_EXPIRY_DAYS:-30}
      DEFAULT_EXPIRY_DAYS: ${DEFAULT_EXPIRY_DAYS:-7}
      DEFAULT_DOWNLOAD_COUNT: ${DEFAULT_DOWNLOAD_COUNT:-5}
      # Honeypot
      HONEYPOT_ENABLED: ${HONEYPOT_ENABLED:-true}
      HONEYPOT_LOG_FILE: /app/logs/canary.log
      HONEYPOT_WEBHOOK_URL: ${HONEYPOT_WEBHOOK_URL:-}
      # SSO (optional)
      AUTH_GOOGLE_ID: ${AUTH_GOOGLE_ID:-}
      AUTH_GOOGLE_SECRET: ${AUTH_GOOGLE_SECRET:-}
      AUTH_GITHUB_ID: ${AUTH_GITHUB_ID:-}
      AUTH_GITHUB_SECRET: ${AUTH_GITHUB_SECRET:-}
      AUTH_OIDC_ISSUER: ${AUTH_OIDC_ISSUER:-}
      AUTH_OIDC_CLIENT_ID: ${AUTH_OIDC_CLIENT_ID:-}
      AUTH_OIDC_CLIENT_SECRET: ${AUTH_OIDC_CLIENT_SECRET:-}
    volumes:
      - nullbox-logs:/app/logs
    depends_on:
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    networks:
      - nullbox-internal
      - kong-net
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/api/health', r => process.exit(r.statusCode === 200 ? 0 : 1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  # ── Redis ────────────────────────────────────────────────────────────────────
  redis:
    image: redis:7-alpine
    container_name: nullbox-redis
    restart: unless-stopped
    command: >
      redis-server
      --maxmemory 512mb
      --maxmemory-policy allkeys-lru
      --save ""
      --appendonly no
    volumes:
      - redis-data:/data
    networks:
      - nullbox-internal
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3

  # ── MinIO (local S3) ─────────────────────────────────────────────────────────
  # Replace with real S3/R2 credentials in production
  minio:
    image: quay.io/minio/minio:latest
    container_name: nullbox-minio
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${S3_ACCESS_KEY_ID:-minioadmin}
      MINIO_ROOT_PASSWORD: ${S3_SECRET_ACCESS_KEY:-minioadmin}
    volumes:
      - minio-data:/data
    ports:
      - "9000:9000"   # API (only expose in dev)
      - "9001:9001"   # Console (only expose in dev)
    networks:
      - nullbox-internal
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ── MinIO bucket init ────────────────────────────────────────────────────────
  minio-init:
    image: quay.io/minio/mc:latest
    container_name: nullbox-minio-init
    depends_on:
      minio:
        condition: service_healthy
    networks:
      - nullbox-internal
    entrypoint: >
      /bin/sh -c "
        mc alias set local http://minio:9000 ${S3_ACCESS_KEY_ID:-minioadmin} ${S3_SECRET_ACCESS_KEY:-minioadmin};
        mc mb --ignore-existing local/${S3_BUCKET:-nullbox-dev};
        mc anonymous set none local/${S3_BUCKET:-nullbox-dev};
        echo 'Bucket ready.';
        exit 0;
      "
    restart: on-failure