docker-compose.yml

# Reference deployment for a self-hosted raba instance (TECH_DOC.md §9
# Phase 8). Copy docker/.env.example to .env at the repo root, fill it in,
# then:
#
#   docker compose up -d
#
# The port mappings and RABA_TCP_UDP_PORT_RANGE_* in .env must stay in
# sync -- if you change one, change the other.

services:
  raba:
    build:
      context: .
      dockerfile: docker/Dockerfile
    restart: unless-stopped
    env_file:
      - .env
    ports:
      - "${RABA_HTTPS_PORT:-7222}:${RABA_HTTPS_PORT:-7222}"
      # Plain-HTTP redirect listener (TECH_DOC.md §9 Phase 10) -- optional,
      # only useful if you also want http://<domain> (no explicit port) to
      # redirect to https. Remove this line if you don't need it.
      - "${RABA_HTTP_PORT:-8080}:${RABA_HTTP_PORT:-8080}"
      - "${RABA_TUNNEL_PORT:-4443}:${RABA_TUNNEL_PORT:-4443}"
      - "${RABA_TCP_UDP_PORT_RANGE_START:-20000}-${RABA_TCP_UDP_PORT_RANGE_END:-21000}:${RABA_TCP_UDP_PORT_RANGE_START:-20000}-${RABA_TCP_UDP_PORT_RANGE_END:-21000}"
    volumes:
      - raba-data:/data
      # Only needed if RABA_TLS_CERT_PATH/RABA_TLS_KEY_PATH are set in .env
      # (real cert instead of the self-signed dev cert). Mounted read-only
      # at the SAME absolute path on host and container -- certbot's
      # live/<domain>/fullchain.pem is a symlink into ../../archive/<domain>/,
      # a relative path, so mounting only `live/` would leave it dangling.
      # Mirroring the whole /etc/letsencrypt keeps those symlinks resolvable.
      # No-op (harmless if the host path doesn't exist) when using the dev cert.
      - /etc/letsencrypt:/etc/letsencrypt:ro

volumes:
  raba-data: