devops/hostinger/prod-stack.yaml

version: '3.8'

networks:
  public:
    external: true
  internal:
    external: true


volumes:
  postgres-data:
    driver: local
  redis-data:
    driver: local
  bee-data:
    driver: local
  pss-key:
    driver: local


services:

  frontend:
    image: ghcr.io/token-for-token/hosted-gateway-frontend:main
    networks:
      - public
    deploy:
      replicas: 2
      update_config:
        parallelism: 1
        order: start-first
      resources:
        limits:
          memory: 256M
        reservations:
          memory: 128M
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=public"
        - "traefik.constraint-label=public"
        - "traefik.http.routers.frontend.rule=Host(`t4t-gateway.com`) || Host(`www.t4t-gateway.com`)"
        - "traefik.http.routers.frontend.entrypoints=websecure"
        - "traefik.http.routers.frontend.tls.certresolver=le"
        - "traefik.http.services.frontend.loadbalancer.server.port=3000"
        - "traefik.http.routers.frontend.middlewares=redirect-to-https"
    logging:
      driver: loki
      options:
        loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"


  api:
    image: ghcr.io/token-for-token/hosted-gateway:main
    command: ["bun", "run", "src/api.ts"]
    env_file:
      - .env
    environment:
      DATABASE_URL: postgresql://hosted:hosted@postgres:5432/hosted_gateway?schema=public
      REDIS_HOST: redis
      REDIS_PORT: 6379
      BEE_API_URL: http://bee:1633
      HOSTED_GATEWAY_PORT: 8080
      PSS_KEY_PATH: /data/pss.key
    volumes:
      # Shared PSS key file — all replicas use the same identity so providers'
      # PSS replies can be decrypted regardless of which replica handled the
      # initial request.
      - pss-key:/data
    networks:
      - public
      - internal
    deploy:
      replicas: 2
      update_config:
        parallelism: 1
        order: start-first
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 512M
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=public"
        - "traefik.constraint-label=public"
        - "traefik.http.routers.api.rule=Host(`api.t4t-gateway.com`)"
        - "traefik.http.routers.api.entrypoints=websecure"
        - "traefik.http.routers.api.tls.certresolver=le"
        - "traefik.http.services.api.loadbalancer.server.port=8080"
        - "traefik.http.routers.api.middlewares=redirect-to-https"
    logging:
      driver: loki
      options:
        loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"


  worker:
    image: ghcr.io/token-for-token/hosted-gateway:main
    command: ["bun", "run", "src/worker.ts"]
    env_file:
      - .env
    environment:
      DATABASE_URL: postgresql://hosted:hosted@postgres:5432/hosted_gateway?schema=public
      REDIS_HOST: redis
      REDIS_PORT: 6379
      BEE_API_URL: http://bee:1633
      PSS_KEY_PATH: /data/pss.key
    volumes:
      - pss-key:/data
    networks:
      - internal
    deploy:
      replicas: 1
      update_config:
        parallelism: 1
        order: start-first
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 512M
    logging:
      driver: loki
      options:
        loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"


  prisma:
    image: ghcr.io/token-for-token/hosted-gateway:main
    # ln -sf /bin/true /usr/local/bin/xdg-open  → Prisma 7's studio CLI hard-
    # codes a browser-launch via xdg-open and bubbles the spawn-ENOENT to
    # process exit. There's no --browser flag any more, so stub it out.
    command: ["sh", "-c", "ln -sf /bin/true /usr/local/bin/xdg-open && bunx prisma migrate deploy && bunx prisma studio --port 5555"]
    env_file:
      - .env
    environment:
      DATABASE_URL: postgresql://hosted:hosted@postgres:5432/hosted_gateway?schema=public
    networks:
      - internal
      - public
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 256M
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=public"
        - "traefik.constraint-label=public"
        - "traefik.http.routers.prisma.rule=Host(`prisma.t4t-gateway.com`)"
        - "traefik.http.routers.prisma.entrypoints=websecure"
        - "traefik.http.routers.prisma.tls.certresolver=le"
        - "traefik.http.services.prisma.loadbalancer.server.port=5555"
        - "traefik.http.routers.prisma.middlewares=admin-auth"
    logging:
      driver: loki
      options:
        loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"


  postgres:
    image: postgres:16
    networks:
      - internal
    environment:
      POSTGRES_USER: hosted
      POSTGRES_PASSWORD: hosted
      POSTGRES_DB: hosted_gateway
    volumes:
      - postgres-data:/var/lib/postgresql/data
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 512M
    logging:
      driver: loki
      options:
        loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"


  redis:
    image: redis:7
    networks:
      - internal
    volumes:
      - redis-data:/data
    deploy:
      resources:
        limits:
          memory: 128M
        reservations:
          memory: 64M
    logging:
      driver: loki
      options:
        loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"


  bee:
    # Pinned to 2.8.0 — matches the homelab Bee. Both speak the v15
    # handshake. Homelab uses a fresh data dir + --target-neighborhood
    # to keep the same swarmOverlay as its on-chain provider registration.
    image: ethersphere/bee:2.8.0
    # NOTE: BEE_BLOCKCHAIN_RPC_ENDPOINT env var is silently ignored — pass
    # the flag explicitly. Without it Bee logs "chain backend disabled".
    command:
      - start
      - --blockchain-rpc-endpoint=https://rpc.gnosischain.com
    env_file:
      - .env
    environment:
      BEE_API_ADDR: ":1633"
      BEE_P2P_ADDR: ":1634"
      # Tell Bee its public-facing libp2p address so the autonat check
      # passes and peers learn to dial our node back. Without this Bee
      # advertises only docker-bridge IPs (172.x / 127.0.0.1) and stays
      # marked "Private" — PSS forwarding gets blackholed.
      BEE_NAT_ADDR: "195.35.25.26:1634"
      BEE_VERBOSITY: "info"
      BEE_FULL_NODE: "true"
      BEE_SWAP_ENABLE: "true"
      BEE_NETWORK_ID: "1"
      BEE_WELCOME_MESSAGE: "t4t-gateway"
      BEE_DATA_DIR: /home/bee/.bee
      # Pin homelab_bee as a static peer so the libp2p connection survives
      # routing-table churn. Without this, PSS chunks the homelab pushes
      # toward us are landing at random ff-prefix peers (e.g. ff7adaed)
      # instead of prod_bee at ff896a93, so the gateway never receives
      # provider ack/deliver envelopes.
      BEE_STATIC_NODES: "/dns4/bee.ffaerber.duckdns.org/tcp/1634/p2p/QmZTZyeQhFBMtta9XhtHUoLE3EtDKrzv76uoQX9h9SowQC"
    volumes:
      - bee-data:/home/bee/.bee
    ports:
      # libp2p P2P — must be reachable from the public internet so other Bee
      # nodes can dial back. Without this, the node only outbound-dials and
      # can't sustain enough peers for PSS routing.
      - "1634:1634"
    networks:
      - internal
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
      resources:
        limits:
          memory: 1024M
        reservations:
          memory: 512M
    logging:
      driver: loki
      options:
        loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"


  postgres-exporter:
    image: quay.io/prometheuscommunity/postgres-exporter:latest
    networks:
      - internal
    environment:
      DATA_SOURCE_NAME: "postgresql://hosted:hosted@postgres:5432/hosted_gateway?sslmode=disable"
    deploy:
      resources:
        limits:
          memory: 128M
        reservations:
          memory: 64M
    logging:
      driver: loki
      options:
        loki-url: "https://loki.t4t-gateway.com/loki/api/v1/push"