109 lines
4.6 KiB
YAML
109 lines
4.6 KiB
YAML
# Activepieces — automatiserings-/koppellaag (derden-box, Coolify docker-compose-from-git; infra#77)
|
||
# Topologie volgt het OpnForm-/Miniflux-patroon (runbook opnform-cx33.md §4 gotcha 6):
|
||
# - postgres / redis : ALLEEN op het privé 'default'-net, geen host-poort.
|
||
# - activepieces : op 'default' (PG/Redis) ÉN op 'coolify' (Traefik). Geen 'ports:'.
|
||
# Updaten = tags bumpen → push → Coolify redeploy (geen route B, geen watcher). Zie README.md.
|
||
# Secrets komen uitsluitend uit de Coolify-env (${VAR}); deze compose bevat er geen.
|
||
|
||
services:
|
||
activepieces:
|
||
image: activepieces/activepieces:0.90.4
|
||
restart: unless-stopped
|
||
mem_limit: 1536m # RAM-guardrail derden-box (infra#77); app + embedded worker (WORKER_AND_APP). 1g → 1536m in infra#110 (2026-09-18): OOM-kills bij ~900 MiB idle+flows (2× op één ochtend)
|
||
depends_on:
|
||
postgres:
|
||
condition: service_healthy
|
||
redis:
|
||
condition: service_healthy
|
||
environment:
|
||
# --- identiteit / URL ---
|
||
AP_FRONTEND_URL: ${AP_FRONTEND_URL}
|
||
AP_ENVIRONMENT: prod
|
||
AP_EDITION: ce
|
||
AP_CONTAINER_TYPE: WORKER_AND_APP
|
||
# --- geheimen (Coolify-env; off-box in ~/.config/doc-gen-deploy/activepieces.env) ---
|
||
AP_ENCRYPTION_KEY: ${AP_ENCRYPTION_KEY} # 32 hex; versleutelt de connections — NOOIT roteren zonder migratie
|
||
AP_JWT_SECRET: ${AP_JWT_SECRET}
|
||
# --- database / queue (privé net) ---
|
||
AP_DB_TYPE: POSTGRES
|
||
AP_POSTGRES_HOST: postgres
|
||
AP_POSTGRES_PORT: "5432"
|
||
AP_POSTGRES_DATABASE: activepieces
|
||
AP_POSTGRES_USERNAME: activepieces
|
||
AP_POSTGRES_PASSWORD: ${AP_POSTGRES_PASSWORD}
|
||
AP_REDIS_TYPE: STANDALONE
|
||
AP_REDIS_HOST: redis
|
||
AP_REDIS_PORT: "6379"
|
||
AP_QUEUE_UI_ENABLED: "false"
|
||
# --- uitvoering (docs: production-setup) ---
|
||
AP_EXECUTION_MODE: SANDBOX_CODE_ONLY # V8-isolate per Code-stap, unprivileged (geen CAP_SYS_ADMIN)
|
||
AP_WORKER_CONCURRENCY: "1"
|
||
AP_REUSE_SANDBOX: "true"
|
||
AP_NETWORK_MODE: STRICT # SSRF-guard: flow-code kan geen RFC1918/loopback/metadata bereiken
|
||
AP_FLOW_TIMEOUT_SECONDS: "600"
|
||
AP_TRIGGER_DEFAULT_POLL_INTERVAL: "5"
|
||
AP_EXECUTION_DATA_RETENTION_DAYS: "7" # #77: retentie kort (run-data bevat de verwerkte inhoud)
|
||
AP_PAUSED_FLOW_TIMEOUT_DAYS: "7" # mag de retentie niet overschrijden (validator)
|
||
# --- soevereiniteit / toegang ---
|
||
AP_TELEMETRY_ENABLED: "false" # PostHog (us.i.posthog.com) uit
|
||
AP_ALLOW_OPEN_SIGN_UP: "false" # na de eerste admin alleen op uitnodiging (default, expliciet)
|
||
# --- platform-mail (uitnodigingen e.d.) via Stalwart, 587 = STARTTLS (465 is bij Hetzner dicht) ---
|
||
AP_SMTP_HOST: mail.2487.eu
|
||
AP_SMTP_PORT: "587"
|
||
AP_SMTP_USERNAME: ${AP_SMTP_USERNAME}
|
||
AP_SMTP_PASSWORD: ${AP_SMTP_PASSWORD}
|
||
AP_SMTP_SENDER_EMAIL: ${AP_SMTP_USERNAME} # afzender = auth-account (Stalwart 501-les)
|
||
AP_SMTP_SENDER_NAME: Activepieces
|
||
volumes:
|
||
- activepieces-cache:/usr/src/app/cache # pieces-cache (npm-archieven); herbouwbaar
|
||
expose:
|
||
- "80"
|
||
labels:
|
||
# Traefik moet het 'coolify'-net kiezen (multi-netwerk-service; OpnForm gotcha 8)
|
||
- "traefik.docker.network=coolify"
|
||
# Vaste Traefik-servicenaam (anders = containernaam mét deploy-suffix): de basic-auth-router in het
|
||
# dynamic-bestand op de box (activepieces-auth.yaml) verwijst naar 'activepieces-flows@docker'.
|
||
- "traefik.http.services.activepieces-flows.loadbalancer.server.port=80"
|
||
networks:
|
||
- default
|
||
- coolify
|
||
|
||
postgres:
|
||
image: pgvector/pgvector:0.8.0-pg16 # upstream-keuze (vector-extensie optioneel; postgres 16)
|
||
restart: unless-stopped
|
||
mem_limit: 256m
|
||
environment:
|
||
POSTGRES_DB: activepieces
|
||
POSTGRES_USER: activepieces
|
||
POSTGRES_PASSWORD: ${AP_POSTGRES_PASSWORD}
|
||
volumes:
|
||
- postgres-data:/var/lib/postgresql/data
|
||
healthcheck:
|
||
test: ["CMD", "pg_isready", "-U", "activepieces", "-d", "activepieces"]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 5
|
||
# geen 'networks:' → alleen 'default' (privé)
|
||
|
||
redis:
|
||
image: redis:7.4.11-alpine
|
||
restart: unless-stopped
|
||
mem_limit: 128m
|
||
command: ["redis-server", "--appendonly", "yes", "--maxmemory", "96mb", "--maxmemory-policy", "noeviction"]
|
||
volumes:
|
||
- redis-data:/data
|
||
healthcheck:
|
||
test: ["CMD", "redis-cli", "ping"]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 5
|
||
# geen 'networks:' → alleen 'default' (privé)
|
||
|
||
volumes:
|
||
activepieces-cache:
|
||
postgres-data:
|
||
redis-data:
|
||
|
||
networks:
|
||
coolify:
|
||
external: true
|