docker-compose.yml

services:
  nginx:
    build:
      context: ./nginx
    ports:
      - "${NGINX_BIND:-0.0.0.0}:${NGINX_PORT:-8080}:80"
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./qr:/qr:ro
    depends_on:
      ui:
        condition: service_started
      api:
        condition: service_started
    restart: unless-stopped
  api:
    build:
      context: ./api
    environment:
      DATABASE_URL: ${DATABASE_URL}
      API_KEYS: ${API_KEYS}
      API_KEY_ENCRYPTION_KEY: ${API_KEY_ENCRYPTION_KEY}
      RATE_PROVIDER: ${RATE_PROVIDER:-kraken}
      FOUNDER_PAYMENT_ADDRESS: ${FOUNDER_PAYMENT_ADDRESS}
      FOUNDER_VIEW_KEY: ${FOUNDER_VIEW_KEY}
      DONATIONS_ENABLED: ${DONATIONS_ENABLED:-false}
      OPEN_REGISTRATION: ${OPEN_REGISTRATION:-true}
      ADMIN_API_KEY: ${ADMIN_API_KEY:-}
      QR_STORAGE_DIR: ${QR_STORAGE_DIR:-/qr}
      MONERO_WALLET_RPC_URLS: ${MONERO_WALLET_RPC_URLS:-http://wallet-rpc-reconciler-1:18083,http://wallet-rpc-reconciler-2:18083,http://wallet-rpc-reconciler-3:18083}
      MONERO_WALLET_RPC_USER: ${MONERO_WALLET_RPC_USER}
      MONERO_WALLET_RPC_PASSWORD: ${MONERO_WALLET_RPC_PASSWORD}
      MONERO_WALLET_RPC_WALLET_PASSWORD: ${MONERO_WALLET_RPC_WALLET_PASSWORD}
      MONERO_WALLET_RPC_WALLET_DIR: ${MONERO_WALLET_RPC_WALLET_DIR:-/wallets}
      MONERO_DAEMON_URL: ${MONERO_DAEMON_URL:-http://xmr-node.cakewallet.com:18081}
      GUNICORN_WORKERS: ${GUNICORN_WORKERS:-5}
    volumes:
      - ./qr:/qr
    depends_on:
      db:
        condition: service_healthy
    restart: unless-stopped
  reconciler:
    build:
      context: ./api
    command: ["python", "-m", "app.reconciler"]
    environment:
      DATABASE_URL: ${DATABASE_URL}
      API_KEYS: ${API_KEYS}
      API_KEY_ENCRYPTION_KEY: ${API_KEY_ENCRYPTION_KEY}
      INVOICE_RECONCILE_INTERVAL_SECONDS: ${INVOICE_RECONCILE_INTERVAL_SECONDS}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      MONERO_WALLET_RPC_URLS: ${MONERO_WALLET_RPC_URLS:-http://wallet-rpc-reconciler-1:18083,http://wallet-rpc-reconciler-2:18083,http://wallet-rpc-reconciler-3:18083}
      MONERO_WALLET_RPC_USER: ${MONERO_WALLET_RPC_USER}
      MONERO_WALLET_RPC_PASSWORD: ${MONERO_WALLET_RPC_PASSWORD}
      MONERO_WALLET_RPC_WALLET_PASSWORD: ${MONERO_WALLET_RPC_WALLET_PASSWORD}
      MONERO_WALLET_RPC_WALLET_DIR: ${MONERO_WALLET_RPC_WALLET_DIR:-/wallets}
      MONERO_DAEMON_URL: ${MONERO_DAEMON_URL:-http://xmr-node.cakewallet.com:18081}
    depends_on:
      api:
        condition: service_started
      db:
        condition: service_healthy
    restart: unless-stopped
    # If the webhook target (e.g. your e-commerce API) runs on the same LAN and
    # Docker containers cannot resolve its hostname (NAT hairpinning), uncomment
    # and set extra_hosts to your reverse proxy's LAN IP:
    # extra_hosts:
    #   - "api.example.com:192.168.1.100"
  monerod:
    build:
      context: ./docker/monero
      args:
        MONERO_VERSION: ${MONERO_VERSION:-0.18.4.6}
    image: monero-local:${MONERO_VERSION:-0.18.4.6}
    entrypoint: ["monerod"]
    command:
      [
        "--non-interactive",
        "--rpc-bind-ip",
        "0.0.0.0",
        "--rpc-bind-port",
        "18081",
        "--confirm-external-bind",
        "--prune-blockchain",
        "--data-dir",
        "/data",
        "--log-level",
        "0"
      ]
    volumes:
      - monerod_data:/data
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:18081/get_height >/dev/null || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 10
      start_period: 60s
    restart: unless-stopped
    profiles: ["local-daemon"]
  wallet-rpc-reconciler-1:
    build:
      context: ./docker/monero
      args:
        MONERO_VERSION: ${MONERO_VERSION:-0.18.4.6}
    image: monero-local:${MONERO_VERSION:-0.18.4.6}
    command:
      [
        "monero-wallet-rpc",
        "--non-interactive",
        "--rpc-bind-ip",
        "0.0.0.0",
        "--rpc-bind-port",
        "18083",
        "--confirm-external-bind",
        "--daemon-address",
        "${MONERO_DAEMON_URL:-http://xmr-node.cakewallet.com:18081}",
        "--rpc-login",
        "${MONERO_WALLET_RPC_USER}:${MONERO_WALLET_RPC_PASSWORD}",
        "--wallet-dir",
        "${MONERO_WALLET_RPC_WALLET_DIR:-/wallets}",
        "--password",
        "${MONERO_WALLET_RPC_WALLET_PASSWORD}",
        "--log-level",
        "3"
      ]
    volumes:
      - ./wallets/reconciler:/wallets
    restart: unless-stopped
  wallet-rpc-reconciler-2:
    build:
      context: ./docker/monero
      args:
        MONERO_VERSION: ${MONERO_VERSION:-0.18.4.6}
    image: monero-local:${MONERO_VERSION:-0.18.4.6}
    command:
      [
        "monero-wallet-rpc",
        "--non-interactive",
        "--rpc-bind-ip",
        "0.0.0.0",
        "--rpc-bind-port",
        "18083",
        "--confirm-external-bind",
        "--daemon-address",
        "${MONERO_DAEMON_URL:-http://xmr-node.cakewallet.com:18081}",
        "--rpc-login",
        "${MONERO_WALLET_RPC_USER}:${MONERO_WALLET_RPC_PASSWORD}",
        "--wallet-dir",
        "${MONERO_WALLET_RPC_WALLET_DIR:-/wallets}",
        "--password",
        "${MONERO_WALLET_RPC_WALLET_PASSWORD}",
        "--log-level",
        "3"
      ]
    volumes:
      - ./wallets/reconciler:/wallets
    restart: unless-stopped
  wallet-rpc-reconciler-3:
    build:
      context: ./docker/monero
      args:
        MONERO_VERSION: ${MONERO_VERSION:-0.18.4.6}
    image: monero-local:${MONERO_VERSION:-0.18.4.6}
    command:
      [
        "monero-wallet-rpc",
        "--non-interactive",
        "--rpc-bind-ip",
        "0.0.0.0",
        "--rpc-bind-port",
        "18083",
        "--confirm-external-bind",
        "--daemon-address",
        "${MONERO_DAEMON_URL:-http://xmr-node.cakewallet.com:18081}",
        "--rpc-login",
        "${MONERO_WALLET_RPC_USER}:${MONERO_WALLET_RPC_PASSWORD}",
        "--wallet-dir",
        "${MONERO_WALLET_RPC_WALLET_DIR:-/wallets}",
        "--password",
        "${MONERO_WALLET_RPC_WALLET_PASSWORD}",
        "--log-level",
        "3"
      ]
    volumes:
      - ./wallets/reconciler:/wallets
    restart: unless-stopped
  ui:
    build:
      context: ./ui
      args:
        NEXT_PUBLIC_TURNSTILE_SITE_KEY: ${TURNSTILE_SITE_KEY:-}
        NEXT_PUBLIC_SITE_NAME: ${SITE_NAME:-XMR Checkout}
    environment:
      API_BASE_URL: ${API_BASE_URL:-http://nginx}
      NEXT_PUBLIC_SITE_URL: ${SITE_URL:-http://localhost}
      NEXT_PUBLIC_DONATIONS_ENABLED: ${DONATIONS_ENABLED:-false}
      NEXT_PUBLIC_TURNSTILE_SITE_KEY: ${TURNSTILE_SITE_KEY:-}
      TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY:-}
      RESEND_API_KEY: ${RESEND_API_KEY:-}
      CONTACT_EMAIL: ${CONTACT_EMAIL:-sales@such.software}
      NEXT_PUBLIC_SITE_NAME: ${SITE_NAME:-XMR Checkout}
    depends_on:
      api:
        condition: service_started
    restart: unless-stopped
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 3s
      retries: 10
  db-backup:
    build:
      context: ./docker/pg_backup
    environment:
      POSTGRES_HOST: db
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      BACKUP_RETENTION_DAYS: ${BACKUP_RETENTION_DAYS:-7}
    volumes:
      - ./backups/postgres:/backups
    depends_on:
      db:
        condition: service_healthy
    restart: unless-stopped
    profiles: ["db-backup"]
volumes:
  postgres_data:
  monerod_data: