docker-compose.yml

# SCDMS + SharpCoreDB Server + HAProxy — industry-standard reverse proxy sample.
#
# Topology (identical wiring to samples/docker and samples/yarp):
#   Browser ──HTTPS (cert on HAProxy)──► haproxy ──HTTP──► scdms:8080          (SCDMS web UI)
#   SCDMS   ──gRPC https://<GRPC_HOST>──► haproxy ──gRPC/TLS──► sharpcoredb:5001
#
# All SCDMS ⇄ SharpCoreDB data traffic flows over gRPC. HAProxy does NOT provision TLS
# certificates automatically (unlike Caddy): mount a PEM (private key + certificate) that
# covers the proxy hostnames (dev: localhost; prod: your public certificate).
#
# Usage:
#   cp .env.example .env           # edit domain names + credentials
#   docker compose up -d
#
# haproxy.cfg.tmpl is rendered to /tmp/haproxy.cfg by entrypoint.sh from the
# SCDMS_DOMAIN / GRPC_DOMAIN environment variables.

services:
  haproxy:
    image: haproxy:3.0
    restart: unless-stopped
    # Binding 80/443 as the non-root 'haproxy' user requires the NET_BIND_SERVICE capability.
    cap_add:
      - NET_BIND_SERVICE
    ports:
      - "80:80"
      - "443:443"
    entrypoint: ["/bin/sh", "/usr/local/etc/haproxy/entrypoint.sh"]
    environment:
      - SCDMS_DOMAIN=${SCDMS_DOMAIN:-scdms.example.com}
      - GRPC_DOMAIN=${GRPC_DOMAIN:-scdb.example.com}
    volumes:
      - ./haproxy.cfg.tmpl:/usr/local/etc/haproxy/haproxy.cfg.tmpl:ro
      - ./entrypoint.sh:/usr/local/etc/haproxy/entrypoint.sh:ro
      - ./server-certs:/certs:ro
    depends_on:
      - scdms
      - sharpcoredb
    healthcheck:
      # socat is included in the official image; queries the HAProxy stats socket.
      test: ["CMD-SHELL", "echo 'show info' | socat unix-connect:/var/lib/haproxy/admin.sock stdio >/dev/null 2>&1 || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  scdms:
    image: ghcr.io/mpcoredeveloper/scdms:latest
    # Until the official image is published you can build it locally from this repository:
    #   build:
    #     context: ../..
    #     dockerfile: Dockerfile
    restart: unless-stopped
    environment:
      - SCDMS__EnableHttps=false
      - SCDMS__BindAddress=0.0.0.0
      - SCDMS__DataDirectory=/app/data
      - SCDMS__UseForwardedHeaders=true
      # Default gRPC server, reached through the HAProxy proxy (public cert on the proxy):
      - SCDMS__DefaultServerHost=${GRPC_DOMAIN:-scdb.example.com}
      - SCDMS__DefaultServerPort=443
      - SCDMS__DefaultServerDatabase=master
      - SCDMS__DefaultServerUsername=${SDB_USERNAME:-anonymous}
      - SCDMS__DefaultServerPassword=${SDB_PASSWORD:-}
      - SCDMS__DefaultServerUseSsl=true
      - SCDMS__DefaultServerAutoConnect=true
      # Optional: disable the in-app update check inside a container
      - SCDMS__UpdateCheckEnabled=false
    volumes:
      - scdms-data:/app/data
    healthcheck:
      test: ["CMD", "curl", "-fs", "http://localhost:8080/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

  sharpcoredb:
    image: ghcr.io/mpcoredeveloper/sharpcoredb-server:latest
    # The image is published on every v* tag. To build it from a local SharpCoreDB checkout,
    # uncomment:
    #   build:
    #     context: /path/to/SharpCoreDB
    #     dockerfile: src/SharpCoreDB.Server/Dockerfile
    restart: unless-stopped
    environment:
      - Server__Security__TlsCertificatePath=${SERVER_TLS_CERT_PATH:-/app/certs/server.pfx}
      - Server__Security__JwtSecretKey=${SERVER_JWT_SECRET:-change-me-to-a-random-32-char-secret!}
      - Server__SystemDatabases__Enabled=true
    volumes:
      - sharpcoredb-data:/app/data
      - ./server-certs:/app/certs:ro
    healthcheck:
      test: ["CMD", "curl", "-fsk", "https://localhost:5001/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s

volumes:
  scdms-data:
  sharpcoredb-data: