docker-compose.postgres.yml

services:
  sync:
    container_name: opentubex-sync
    image: ghcr.io/opentubex/sync-server:latest-postgres
    build:
      context: .
      args:
        - "DATABASE_BACKEND=postgres"
    environment:
      - "DATABASE_URL=postgres://postgres:${POSTGRES_PASSWORD:?generate one with: openssl rand -hex 32}@db/opentubex-sync"
      # REQUIRED. Generate with `openssl rand -hex 32` and put it in a .env file
      # next to this compose file. The server refuses to start on a placeholder
      # value or anything shorter than 32 bytes.
      - "SECRET_KEY=${SECRET_KEY:?generate one with: openssl rand -hex 32}"
      # Set to the same value as SECRET_KEY. Keeping it separate is what allows
      # SECRET_KEY to be rotated later without locking out every account.
      - "USERNAME_SECRET=${USERNAME_SECRET:?set this to the same value as SECRET_KEY}"
      # These files publish to 127.0.0.1, i.e. behind a reverse proxy, where
      # every request arrives from the proxy and all clients would otherwise
      # share one rate limit bucket. Remove this if exposing the port directly.
      - "TRUST_FORWARDED_FOR=true"
      - "ALLOW_REGISTRATION=true"
      - "VALIDATE_SUBMITTED_METADATA=true"
    # Or use a configuration file:
    # volumes:
    #   - ./config.toml:/app/config.toml
    ports:
      - "127.0.0.1:8080:8080"
    depends_on:
      - db
    restart: unless-stopped

  db:
    image: postgres:18
    container_name: opentubex-sync-postgres
    environment:
      - "POSTGRES_USER=postgres"
      - "POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?generate one with: openssl rand -hex 32}"
      - "POSTGRES_DB=opentubex-sync"
    volumes:
      - ./data:/var/lib/postgresql
    restart: unless-stopped