Docker Compose

Overview

Production stack: docker/compose.prod.yml — Postgres, Redis, API, CRDT merge worker, queue worker, UI. Marketing (www) and scheduler are optional (Compose profiles).

Services bind to 127.0.0.1 by default so an upstream reverse proxy can terminate TLS.

Prepare environment files

Copy docker/stack.env.example to docker/stack.env. Set POSTGRES_PASSWORD, APP_KEY, and public URLs (APP_URL, FRONTEND_URL, SESSION_DOMAIN, SANCTUM_STATEFUL_DOMAINS, CORS_ALLOWED_ORIGINS).
Set NOTE_CRDT_MERGE_URL=http://crdt-merge:3000 (default in stack.env.example) so the API calls the internal merge worker instead of Node subprocesses.
Optionally copy api/.env.production.example for reference — production Compose injects env from docker/stack.env via env_file on API services.

Build or pull images

From the repository root:

# Local build (testing)
docker build -f docker/api/Dockerfile -t garrison-api:local .
docker build -f docker/ui/Dockerfile \
  --build-arg VITE_API_URL=https://api.garrison.test \
  --build-arg VITE_WWW_URL=https://www.garrison.test \
  -t garrison-ui:local .
# Optional marketing site:
docker build -f docker/www/Dockerfile -t garrison-www:local .

# Or pull from registry after CI
docker pull registry.example.com/group/garrison/api:latest

Set GARRISON_IMAGE_API and GARRISON_IMAGE_UI in .env.production when using a registry. Set GARRISON_IMAGE_WWW only if you enable the www profile.

Start the stack

docker compose -f docker/compose.prod.yml --env-file docker/stack.env up -d postgres redis migrate crdt-merge api queue ui

The migrate service runs php artisan migrate --force once, then exits. Do not run db:seed in production.

After deploy, run the Production smoke checklist (/up, GraphQL auth, CRDT note push).

Marketing site (optional)

Enable the www service when you want the Astro marketing site in this stack:

docker compose -f docker/compose.prod.yml --profile www --env-file .env.production up -d

Omit --profile www to run only the API, UI, Postgres, Redis, and queue worker.

Reverse proxy

Point your proxy at the published localhost ports (defaults):

Host	Port
`api.garrison.test`	`8080`
`app.garrison.test`	`8081`
`www.garrison.test`	`8082` (only with `--profile www`)

Override with GARRISON_API_PORT, GARRISON_UI_PORT, and GARRISON_WWW_PORT in .env.production.

Upgrade

docker compose -f docker/compose.prod.yml --env-file .env.production pull
docker compose -f docker/compose.prod.yml --env-file .env.production up -d
docker compose -f docker/compose.prod.yml run --rm api php artisan migrate --force

Scheduler (optional)

docker compose -f docker/compose.prod.yml --profile scheduler --env-file .env.production up -d

Backups

Back up the garrison-postgres Docker volume regularly. Test restore on a non-production host before relying on it.