docker-compose.traefik.yml

# =============================================================================
# Screen Recorder - Traefik Production Configuration
# =============================================================================
# Usage: docker compose -f docker-compose.traefik.yml up -d
#
# This configuration uses Traefik as reverse proxy with automatic HTTPS.
# Includes MySQL (SSD-optimized) and MinIO (S3-compatible storage).
#
# Access:
#   - Cap App: https://${SERVICE_HOSTNAME}
#   - S3 API: https://${S3_HOSTNAME}
#   - MinIO Console: https://${S3_CONSOLE_HOSTNAME}
# =============================================================================

services:

  # ---------------------------------------------------------------------------
  # Cap Web Application
  # ---------------------------------------------------------------------------
  frontend-server:
    # Option 1: Use pre-built branded image from GHCR
    image: ghcr.io/bauer-group/cs-screenrecorder/frontend:latest
    # Option 2: Use official Cap image from GHCR
    # image: ghcr.io/capsoftware/cap-web:latest
    restart: unless-stopped
    container_name: ${STACK_NAME:-SCREENRECORDER}_APP
    depends_on:
      media-server:
        condition: service_healthy
      mysql-server:
        condition: service_healthy
      minio-setup:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://localhost:3000/api/status').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 15s
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
    environment:
      - TZ=${TIME_ZONE:-Etc/UTC}

      # -- Core Settings --
      - NODE_ENV=${NODE_ENV:-production}
      - WEB_URL=${WEB_URL}
      - NEXTAUTH_URL=${WEB_URL}
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}

      # -- Database (static: cap/cap) --
      - DATABASE_URL=mysql://cap:${DATABASE_PASSWORD}@mysql-server:3306/cap

      # -- Encryption --
      - DATABASE_ENCRYPTION_KEY=${DATABASE_ENCRYPTION_KEY:-}

      # -- S3 Storage (static: bucket=media, user=cap) --
      - CAP_AWS_BUCKET=media
      - CAP_AWS_REGION=${AWS_S3_REGION:-global}
      - CAP_AWS_ACCESS_KEY=cap
      - CAP_AWS_SECRET_KEY=${CAP_AWS_SECRET_KEY}
      - S3_PATH_STYLE=true
      - S3_INTERNAL_ENDPOINT=https://${S3_HOSTNAME}
      - S3_PUBLIC_ENDPOINT=https://${S3_HOSTNAME}
      - CAP_AWS_BUCKET_URL=https://${S3_HOSTNAME}/media

      # -- Video Settings --
      - CAP_VIDEOS_DEFAULT_PUBLIC=${CAP_VIDEOS_DEFAULT_PUBLIC:-false}
      - CAP_ALLOWED_SIGNUP_DOMAINS=${CAP_ALLOWED_SIGNUP_DOMAINS:-}

      # -- Client Download Redirect --
      # URL for /download redirect (default: cap.so, self-hosted: your S3 bucket)
      - CAP_CLIENT_DOWNLOAD_URL=${CAP_CLIENT_DOWNLOAD_URL:-https://cap.so/download}

      # -- Email (Optional: SMTP or Resend) --
      - SMTP_HOST=${SMTP_HOST:-}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_TLS=${SMTP_TLS:-false}
      - SMTP_USER=${SMTP_USER:-}
      - SMTP_PASSWORD=${SMTP_PASSWORD:-}
      - SMTP_FROM=${SMTP_FROM:-}
      - SMTP_FROM_NAME=${SMTP_FROM_NAME:-}
      - RESEND_API_KEY=${RESEND_API_KEY:-}
      - RESEND_FROM_DOMAIN=${RESEND_FROM_DOMAIN:-}

      # -- OAuth (Optional) --
      - AZURE_AD_CLIENT_ID=${AZURE_AD_CLIENT_ID:-}
      - AZURE_AD_CLIENT_SECRET=${AZURE_AD_CLIENT_SECRET:-}
      - AZURE_AD_TENANT_ID=${AZURE_AD_TENANT_ID:-}
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
      - WORKOS_CLIENT_ID=${WORKOS_CLIENT_ID:-}
      - WORKOS_API_KEY=${WORKOS_API_KEY:-}

      # -- AI Features (Optional) --
      - DEEPGRAM_API_KEY=${DEEPGRAM_API_KEY:-}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - GROQ_API_KEY=${GROQ_API_KEY:-}

      # -- Payments (Optional) --
      - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY:-}
      - STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET:-}

      # -- Integrations (Optional) --
      - DISCORD_FEEDBACK_WEBHOOK_URL=${DISCORD_FEEDBACK_WEBHOOK_URL:-}
      - DISCORD_LOGS_WEBHOOK_URL=${DISCORD_LOGS_WEBHOOK_URL:-}
      - TINYBIRD_HOST=${TINYBIRD_HOST:-}
      - TINYBIRD_TOKEN=${TINYBIRD_TOKEN:-}
      - DUB_API_KEY=${DUB_API_KEY:-}
      - INTERCOM_SECRET=${INTERCOM_SECRET:-}
      - POSTHOG_PERSONAL_API_KEY=${POSTHOG_PERSONAL_API_KEY:-}

      # -- CDN (Optional) --
      # CloudFront CDN - Only uncomment if you have a valid CloudFront configuration!
      # Empty values cause "DECODER routines::unsupported" errors.
      # - CAP_CLOUDFRONT_DISTRIBUTION_ID=${CAP_CLOUDFRONT_DISTRIBUTION_ID}
      # - CLOUDFRONT_KEYPAIR_ID=${CLOUDFRONT_KEYPAIR_ID}
      # - CLOUDFRONT_KEYPAIR_PRIVATE_KEY=${CLOUDFRONT_KEYPAIR_PRIVATE_KEY}

      # -- Media Server --
      - MEDIA_SERVER_URL=http://media-server:3456
      - MEDIA_SERVER_WEBHOOK_SECRET=${MEDIA_SERVER_WEBHOOK_SECRET}
      - MEDIA_SERVER_WEBHOOK_URL=http://frontend-server:3000

      # -- Workflows (Optional) --
      - WORKFLOWS_RPC_URL=${WORKFLOWS_RPC_URL:-}
      - WORKFLOWS_RPC_SECRET=${WORKFLOWS_RPC_SECRET:-}

    expose:
      - 3000/tcp
    labels:
      - "traefik.enable=true"

      # HTTP to HTTPS redirect middleware
      - "traefik.http.middlewares.${STACK_NAME:-SCREENRECORDER}-redirect-to-secure.redirectscheme.scheme=https"
      - "traefik.http.middlewares.${STACK_NAME:-SCREENRECORDER}-redirect-to-secure.redirectscheme.permanent=true"

      # HTTP Router (redirect to HTTPS)
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-http.rule=Host(`${SERVICE_HOSTNAME}`)"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-http.entrypoints=web"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-http.middlewares=${STACK_NAME:-SCREENRECORDER}-redirect-to-secure"

      # HTTPS Router
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-https.rule=Host(`${SERVICE_HOSTNAME}`)"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-https.entrypoints=web-secure"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-https.tls=true"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-https.tls.certresolver=letsencrypt"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-https.service=${STACK_NAME:-SCREENRECORDER}"

      # Service
      - "traefik.http.services.${STACK_NAME:-SCREENRECORDER}.loadBalancer.server.port=3000"

    networks:
      local:
      proxy:


  # ---------------------------------------------------------------------------
  # Cap Media Server (Video/Audio Processing)
  # ---------------------------------------------------------------------------
  media-server:
    image: ghcr.io/bauer-group/cs-screenrecorder/mediaserver:latest
    restart: unless-stopped
    container_name: ${STACK_NAME:-SCREENRECORDER}_MEDIASERVER
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3456/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    environment:
      - PORT=3456
    expose:
      - 3456/tcp
    networks:
      local:


  # ---------------------------------------------------------------------------
  # MySQL Database Server
  # ---------------------------------------------------------------------------
  # Tuned for: 4-8 GB RAM, SSD/NVMe storage
  mysql-server:
    image: mysql:${MYSQL_VERSION:-8.4}
    restart: unless-stopped
    container_name: ${STACK_NAME:-SCREENRECORDER}_DATABASE
    command: >
      --max_connections=${DATABASE_POOL_SIZE:-100}
      --innodb_buffer_pool_size=1G
      --innodb_redo_log_capacity=512M
      --innodb_flush_log_at_trx_commit=2
      --innodb_flush_method=O_DIRECT
      --innodb_io_capacity=2000
      --innodb_io_capacity_max=4000
      --innodb_read_io_threads=8
      --innodb_write_io_threads=8
      --innodb_file_per_table=1
      --innodb_open_files=4000
      --table_open_cache=4000
      --table_definition_cache=2000
      --thread_cache_size=50
      --sort_buffer_size=4M
      --read_buffer_size=2M
      --read_rnd_buffer_size=4M
      --join_buffer_size=4M
      --tmp_table_size=64M
      --max_heap_table_size=64M
      --performance_schema=OFF
      --skip-name-resolve
      --log_error_verbosity=2
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${DATABASE_PASSWORD}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    environment:
      - TZ=${TIME_ZONE:-Etc/UTC}
      - MYSQL_DATABASE=cap
      - MYSQL_USER=cap
      - MYSQL_PASSWORD=${DATABASE_PASSWORD}
      - MYSQL_ROOT_PASSWORD=${DATABASE_PASSWORD}
    expose:
      - 3306/tcp
    volumes:
      - 'mysql-data:/var/lib/mysql'
    networks:
      local:


  # ---------------------------------------------------------------------------
  # MinIO Object Storage Server
  # ---------------------------------------------------------------------------
  minio-server:
    image: quay.io/minio/minio:${MINIO_VERSION:-latest}
    restart: unless-stopped
    container_name: ${STACK_NAME:-SCREENRECORDER}_MINIO
    hostname: minio-server
    command: server --address ":9000" --console-address ":9001" /data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 30s
      timeout: 10s
      retries: 4
      start_period: 30s
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    environment:
      - TZ=${TIME_ZONE:-Etc/UTC}
      - MINIO_ROOT_USER=${MINIO_ROOT_USER:-admin}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
      - MINIO_SITE_REGION=${AWS_S3_REGION:-global}
      - MINIO_API_CORS_ALLOW_ORIGIN=*
      - MINIO_DOMAIN=${S3_HOSTNAME}
      - MINIO_BROWSER_REDIRECT=true
      - MINIO_BROWSER_REDIRECT_URL=https://${S3_CONSOLE_HOSTNAME}
    expose:
      - 9000/tcp
      - 9001/tcp
    volumes:
      - 'minio-data:/data'
    labels:
      - "traefik.enable=true"

      # HTTP to HTTPS redirect middleware (defined here for MinIO independence)
      - "traefik.http.middlewares.${STACK_NAME:-SCREENRECORDER}-minio-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.${STACK_NAME:-SCREENRECORDER}-minio-redirect.redirectscheme.permanent=true"

      # MinIO API (S3)
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio-http.rule=Host(`${S3_HOSTNAME}`)"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio-http.entrypoints=web"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio-http.middlewares=${STACK_NAME:-SCREENRECORDER}-minio-redirect"

      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio.rule=Host(`${S3_HOSTNAME}`)"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio.entrypoints=web-secure"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio.tls=true"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio.tls.certresolver=letsencrypt"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio.service=${STACK_NAME:-SCREENRECORDER}-minio"

      - "traefik.http.services.${STACK_NAME:-SCREENRECORDER}-minio.loadBalancer.server.port=9000"

      # MinIO Console
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio-console-http.rule=Host(`${S3_CONSOLE_HOSTNAME}`)"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio-console-http.entrypoints=web"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio-console-http.middlewares=${STACK_NAME:-SCREENRECORDER}-minio-redirect"

      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio-console.rule=Host(`${S3_CONSOLE_HOSTNAME}`)"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio-console.entrypoints=web-secure"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio-console.tls=true"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio-console.tls.certresolver=letsencrypt"
      - "traefik.http.routers.${STACK_NAME:-SCREENRECORDER}-minio-console.service=${STACK_NAME:-SCREENRECORDER}-minio-console"

      - "traefik.http.services.${STACK_NAME:-SCREENRECORDER}-minio-console.loadBalancer.server.port=9001"

    networks:
      local:
      proxy:


  # ---------------------------------------------------------------------------
  # MinIO Setup (creates bucket and service user on first start)
  # ---------------------------------------------------------------------------
  minio-setup:
    image: quay.io/minio/mc:latest
    container_name: ${STACK_NAME:-SCREENRECORDER}_MINIO_SETUP
    depends_on:
      minio-server:
        condition: service_healthy
    environment:
      - MINIO_ROOT_USER=${MINIO_ROOT_USER:-admin}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
      - CAP_AWS_SECRET_KEY=${CAP_AWS_SECRET_KEY}
      - MINIO_REGION=${AWS_S3_REGION:-global}
    entrypoint: /bin/sh
    command:
      - -c
      - |
        set -e

        echo '=== MinIO Setup for Screen Recorder ==='

        echo 'Waiting for MinIO to be ready...'
        until mc alias set minio http://minio-server:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" 2>/dev/null; do
          echo '  MinIO not ready yet, retrying in 2s...'
          sleep 2
        done
        echo 'MinIO is ready!'

        echo 'Ensuring bucket exists...'
        mc mb --ignore-existing minio/media

        echo 'Setting bucket policy to allow public read for video playback...'
        mc anonymous set download minio/media || true

        echo 'Ensuring service user with current password...'
        mc admin user remove minio cap 2>/dev/null || true
        mc admin user add minio cap "$CAP_AWS_SECRET_KEY"

        echo 'Creating bucket access policy for service user...'
        cat > /tmp/cap-policy.json << 'EOF'
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
              ],
              "Resource": "arn:aws:s3:::media/*"
            },
            {
              "Effect": "Allow",
              "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
              ],
              "Resource": "arn:aws:s3:::media"
            }
          ]
        }
        EOF

        mc admin policy info minio cap-policy >/dev/null 2>&1 || \
        mc admin policy create minio cap-policy /tmp/cap-policy.json

        mc admin policy attach minio cap-policy --user cap || true

        echo '=== MinIO Setup Complete ==='
        mc admin user info minio cap || true
        mc ls minio
    networks:
      local:


# =============================================================================
# Volumes
# =============================================================================
volumes:
  # MySQL database storage
  mysql-data:
    driver: local
    name: ${STACK_NAME:-SCREENRECORDER}-database

  # MinIO object storage
  minio-data:
    driver: local
    name: ${STACK_NAME:-SCREENRECORDER}-storage


# =============================================================================
# Networks
# =============================================================================
networks:
  # Internal network for service communication (IPv4 + IPv6)
  local:
    driver: bridge
    name: ${STACK_NAME:-SCREENRECORDER}
    enable_ipv6: true

  # External Traefik proxy network
  proxy:
    name: ${PROXY_NETWORK:-traefik}
    external: true