Buzz Relay

mkdir buzz-git-data && chown 1000:1000 buzz-git-data

# Filename: /srv/buzz.example.com/docker-compose.yaml
# Deploy Buzz replay behind traefik

name: buzz-example-com

services:
  relay:
    image: ${BUZZ_IMAGE:-ghcr.io/block/buzz:main}
    container_name: buzz-relay.example.com
    restart: always

    env_file:
      - .env

    environment:
      BUZZ_BIND_ADDR: 0.0.0.0:3000
      BUZZ_HEALTH_PORT: "8080"
      BUZZ_METRICS_PORT: "9102"
      DATABASE_URL: postgres://${POSTGRES_USER:-buzz}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-buzz}
      REDIS_URL: redis://:${REDIS_PASSWORD:?set REDIS_PASSWORD}@redis:6379
      BUZZ_S3_ENDPOINT: http://minio:9000
      # Docker DNS resolves `minio`, not arbitrary `<bucket>.minio` hosts.
      BUZZ_S3_ADDRESSING_STYLE: path
      BUZZ_S3_ACCESS_KEY: ${BUZZ_S3_ACCESS_KEY:?set BUZZ_S3_ACCESS_KEY}
      BUZZ_S3_SECRET_KEY: ${BUZZ_S3_SECRET_KEY:?set BUZZ_S3_SECRET_KEY}
      BUZZ_S3_BUCKET: ${BUZZ_S3_BUCKET:-buzz-media}
      BUZZ_GIT_REPO_PATH: /data/git
      BUZZ_AUTO_MIGRATE: ${BUZZ_AUTO_MIGRATE:-false}
      BUZZ_GIT_CONFORMANCE_PROBE: ${BUZZ_GIT_CONFORMANCE_PROBE:-true}

    volumes:
      - ./buzz-git-data:/data/git

    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully

    # Probe /_readiness over /dev/tcp because the runtime image has bash but no curl/wget/socat.
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "bash -ec 'exec 3<>/dev/tcp/127.0.0.1/8080; printf \"GET /_readiness HTTP/1.1\\r\\nHost: 127.0.0.1\\r\\nConnection: close\\r\\n\\r\\n\" >&3; grep -q \"200 OK\" <&3'",
        ]
      interval: 10s
      timeout: 3s
      retries: 12
      start_period: 30s

    labels:
      - traefik.enable=true

      - traefik.http.routers.buzz.rule=Host(`buzz.example.com`)
      - traefik.http.routers.buzz.entrypoints=https
      - traefik.http.routers.buzz.tls=true
      - traefik.http.routers.buzz.tls.certresolver=lets-encrypt
      - traefik.http.routers.buzz.service=buzz
      - traefik.http.services.buzz.loadbalancer.server.port=3000

  pair:
    image: ${BUZZ_IMAGE:-ghcr.io/block/buzz:main}
    container_name: buzz-pair-relay.example.com
    restart: always

    environment:
      BUZZ_PAIR_RELAY_BIND_ADDR: 0.0.0.0:5000

    entrypoint:
      - /usr/local/bin/buzz-pair-relay

    labels:
      - traefik.enable=true

      - traefik.http.routers.pair.rule=Host(`pair.buzz.example.com`)
      - traefik.http.routers.pair.entrypoints=https
      - traefik.http.routers.pair.tls=true
      - traefik.http.routers.pair.tls.certresolver=lets-encrypt
      - traefik.http.routers.pair.service=pair
      - traefik.http.services.pair.loadbalancer.server.port=5000

  postgres:
    image: postgres:17-alpine
    container_name: buzz-postgres.example.com
    restart: unless-stopped

    environment:
      POSTGRES_DB: ${POSTGRES_DB:-buzz}
      POSTGRES_USER: ${POSTGRES_USER:-buzz}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
      PGDATA: /var/lib/postgresql/data/pgdata

    volumes:
      - ./buzz-postgres-data:/var/lib/postgresql/data

    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s

  redis:
    image: redis:7-alpine
    container_name: buzz-redis.example.com
    restart: unless-stopped

    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD:?set REDIS_PASSWORD}"]

    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?set REDIS_PASSWORD}

    volumes:
      - ./buzz-redis-data:/data

    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a \"${REDIS_PASSWORD}\" ping | grep -q PONG"]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 5s

  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    container_name: buzz-minio.example.com
    restart: unless-stopped

    command: server /data --console-address ":9001"

    environment:
      MINIO_ROOT_USER: ${BUZZ_S3_ACCESS_KEY:?set BUZZ_S3_ACCESS_KEY}
      MINIO_ROOT_PASSWORD: ${BUZZ_S3_SECRET_KEY:?set BUZZ_S3_SECRET_KEY}

    volumes:
      - ./buzz-minio-data:/data

    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:9000/minio/health/live"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s

  minio-init:
    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
    restart: "no"

    depends_on:
      minio:
        condition: service_healthy

    environment:
      BUZZ_S3_ACCESS_KEY: ${BUZZ_S3_ACCESS_KEY:?set BUZZ_S3_ACCESS_KEY}
      BUZZ_S3_SECRET_KEY: ${BUZZ_S3_SECRET_KEY:?set BUZZ_S3_SECRET_KEY}
      BUZZ_S3_BUCKET: ${BUZZ_S3_BUCKET:-buzz-media}

    entrypoint: >
      /bin/sh -euc '
        mc alias set local http://minio:9000 "${BUZZ_S3_ACCESS_KEY}" "${BUZZ_S3_SECRET_KEY}"
        mc mb --ignore-existing "local/${BUZZ_S3_BUCKET}"
        mc anonymous set none "local/${BUZZ_S3_BUCKET}"
      '

# Buzz production Docker Compose environment.
# Copy to .env and replace every CHANGE_ME value before running.
# The bootstrap script should generate this file for normal users.

# Image published by the public image pipeline. Use `:main` for pre-release testing. Pin `:sha-<7>` or a semver release tag for production.
BUZZ_IMAGE=ghcr.io/block/buzz:main

# Public host name. Used by compose.caddy.yml and URL-derived settings below.
BUZZ_DOMAIN=buzz.example.com
RELAY_URL=wss://buzz.example.com
BUZZ_MEDIA_BASE_URL=https://buzz.example.com/media
BUZZ_MEDIA_SERVER_DOMAIN=buzz.example.com
BUZZ_CORS_ORIGINS=https://buzz.example.com

BUZZ_PAIRING_RELAY_URL=wss://pair.buzz.example.com

# BUZZ_PUBKEY_ALLOWLIST=true

# Production defaults. Closed relay mode requires RELAY_OWNER_PUBKEY and a stable relay key.
BUZZ_REQUIRE_AUTH_TOKEN=true
BUZZ_REQUIRE_RELAY_MEMBERSHIP=true
BUZZ_ALLOW_NIP_OA_AUTH=true
BUZZ_AUTO_MIGRATE=true
BUZZ_GIT_CONFORMANCE_PROBE=true
RUST_LOG=buzz_relay=info,buzz_db=info,buzz_auth=info,buzz_pubsub=info,tower_http=info

# Owner identity. Set to a 64-character hex Nostr pubkey.
RELAY_OWNER_PUBKEY=

# Stable secrets. Generate once, keep in .env, and back up securely.
# Generate BUZZ_RELAY_PRIVATE_KEY, BUZZ_GIT_HOOK_HMAC_SECRET with: openssl rand -hex 32
BUZZ_RELAY_PRIVATE_KEY=
BUZZ_GIT_HOOK_HMAC_SECRET=
POSTGRES_DB=buzz
POSTGRES_USER=buzz
POSTGRES_PASSWORD=CHANGE_ME
REDIS_PASSWORD=CHANGE_ME
BUZZ_S3_ACCESS_KEY=CHANGE_ME
BUZZ_S3_SECRET_KEY=CHANGE_ME
BUZZ_S3_BUCKET=buzz-media
# Bundled MinIO uses path-style URLs; deploy/compose/compose.yml pins this.
BUZZ_S3_ADDRESSING_STYLE=path

# Optional host ports. Base compose publishes the relay directly on BUZZ_HTTP_PORT.
BUZZ_HTTP_PORT=3000