tower/docker-compose.vps.yml

services:
  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: tower
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: tower
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U tower -d tower']
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - dokploy-network
 
  redis:
    image: redis:7-alpine
    command: redis-server --requirepass ${REDIS_PASSWORD}
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    healthcheck:
      test: ['CMD-SHELL', 'redis-cli -a $REDIS_PASSWORD ping']
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - dokploy-network

  # Tailscale sidecar — shares Redis's network namespace so the Redis port
  # becomes reachable on the tailnet as `tower-redis:6379`. Uses only outbound
  # connections, so no OCI Security List / host firewall changes are needed.
  tailscale-redis:
    image: tailscale/tailscale:latest
    hostname: tower-redis
    environment:
      TS_AUTHKEY: ${TS_AUTHKEY}
      TS_STATE_DIR: /var/lib/tailscale
      TS_USERSPACE: 'false'
    volumes:
      - tailscale_redis_state:/var/lib/tailscale
    devices:
      - /dev/net/tun
    cap_add:
      - NET_ADMIN
    depends_on:
      redis:
        condition: service_healthy
    restart: unless-stopped
    network_mode: service:redis

  meilisearch:
    image: getmeili/meilisearch:v1.11
    ports:
      - '7700:7700'
    environment:
      MEILI_NO_ANALYTICS: 'true'
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY}
    volumes:
      - meilisearch_data:/meili_data
    restart: unless-stopped
    networks:
      - dokploy-network
 
  api:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    expose:
      - 3001
    labels:
      - traefik.enable=true
      - traefik.http.routers.tower-api.rule=Host(`${API_DOMAIN}`)
      - traefik.http.routers.tower-api.tls=true
      - traefik.http.routers.tower-api.tls.certresolver=letsencrypt
      - traefik.http.services.tower-api.loadbalancer.server.port=3001
    environment:
      DATABASE_URL: postgresql://tower:${DB_PASSWORD}@postgres:5432/tower
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      MEILI_URL: http://meilisearch:7700
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY}
      JWT_SECRET: ${JWT_SECRET}
      JWT_EXPIRES_IN: ${JWT_EXPIRES_IN:-7d}
      MEMBER_JWT_EXPIRES_IN: ${MEMBER_JWT_EXPIRES_IN:-30d}
      BCRYPT_ROUNDS: ${BCRYPT_ROUNDS:-10}
      NODE_ENV: production
      LOG_LEVEL: ${LOG_LEVEL:-info}
      TOWER_PORTAL_BASE_URL: ${TOWER_PORTAL_BASE_URL}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_SECURE: ${SMTP_SECURE:-false}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASS: ${SMTP_PASS:-}
      SMTP_FROM: ${SMTP_FROM:-noreply@tower.local}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      meilisearch:
        condition: service_started
    restart: unless-stopped
    networks:
      - dokploy-network

  worker:
    build:
      context: .
      dockerfile: apps/worker/Dockerfile
    environment:
      DATABASE_URL: postgresql://tower:${DB_PASSWORD}@postgres:5432/tower
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      MEILI_URL: http://meilisearch:7700
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY}
      JWT_SECRET: ${JWT_SECRET}
      NODE_ENV: production
      LOG_LEVEL: ${LOG_LEVEL:-info}
      WHATSAPP_SESSION_PATH: /app/sessions
      TOWER_PORTAL_BASE_URL: ${TOWER_PORTAL_BASE_URL}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_SECURE: ${SMTP_SECURE:-false}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASS: ${SMTP_PASS:-}
      SMTP_FROM: ${SMTP_FROM:-noreply@tower.local}
    volumes:
      - sessions:/app/sessions
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      api:
        condition: service_started
    restart: unless-stopped
    networks:
      - dokploy-network
 
volumes:
  postgres_data:
  redis_data:
  meilisearch_data:
  sessions:
  tailscale_redis_state:

networks:
  dokploy-network:
    external: true