Install Folio on a Linux server

# Folio on one server, from the published image: the app, PostgreSQL, Redis,
# and (optional) Caddy for automatic HTTPS. Written for install.sh, which also
# creates the .env file next to this one; works by hand too.
#
#   docker compose up -d                  # plain http on FOLIO_PORT
#   docker compose --profile https up -d  # automatic HTTPS for FOLIO_DOMAIN
#
# Nothing in here needs editing. Settings live in .env (see .env.example).
name: folio

services:
  app:
    image: ${FOLIO_IMAGE:-ghcr.io/evergreen-it-dev/folio:latest}
    restart: unless-stopped
    ports:
      # 127.0.0.1 when HTTPS is on (Caddy reaches the app over the compose
      # network); 0.0.0.0 for plain http access by address.
      - '${FOLIO_BIND:-0.0.0.0}:${FOLIO_PORT:-4870}:4870'
    environment:
      NODE_ENV: production
      PORT: '4870'
      DATABASE_URL: postgresql://folio:${POSTGRES_PASSWORD:?run install.sh or set POSTGRES_PASSWORD in .env}@postgres:5432/folio
      REDIS_URL: redis://redis:6379
      PUBLIC_URL: ${PUBLIC_URL:-http://localhost:4870}
      ASSET_BACKEND: local
      # Generated by install.sh. If you start without it, the app creates one
      # on first start and keeps it on the data volume.
      FOLIO_SECRET: ${FOLIO_SECRET:-}
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GOOGLE_ALLOWED_DOMAINS: ${GOOGLE_ALLOWED_DOMAINS:-}
      CURSOR_API_KEY: ${CURSOR_API_KEY:-}
      CURSOR_AGENT_MODEL: ${CURSOR_AGENT_MODEL:-auto}
      CURSOR_AGENT_WORKSPACE_ROOT: /app/data/assistant/workspaces
      CURSOR_AGENT_STATE_DIR: /app/data/assistant/state
    entrypoint: ['/sbin/tini', '--', '/bin/sh', '-c']
    command:
      - |
        set -e
        if [ -z "$$FOLIO_SECRET" ]; then
          secret_file=/app/data/.folio-secret
          if [ ! -s "$$secret_file" ]; then
            umask 077
            node -e "process.stdout.write(require('node:crypto').randomBytes(32).toString('hex'))" > "$$secret_file"
            echo "folio: generated a new secret in $$secret_file"
          fi
          FOLIO_SECRET="$$(cat "$$secret_file")"
          export FOLIO_SECRET
        fi
        exec npx tsx server/index.ts
    volumes:
      # The content itself: git repositories of the spaces, uploaded files.
      - folio-data:/app/data
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - "fetch('http://127.0.0.1:4870/api/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s

  # Not published outside the compose network.
  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: folio
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?run install.sh or set POSTGRES_PASSWORD in .env}
      POSTGRES_DB: folio
    volumes:
      - folio-pg:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U folio -d folio']
      interval: 5s
      timeout: 5s
      retries: 20

  # Transient data only (presence, rate limits): persistence is off on purpose.
  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --save '' --appendonly no

  # Automatic HTTPS. Started only with `--profile https`; needs ports 80 and
  # 443 and a DNS record for FOLIO_DOMAIN pointing at this server.
  caddy:
    image: caddy:2-alpine
    profiles: ['https']
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
    environment:
      FOLIO_DOMAIN: ${FOLIO_DOMAIN:-localhost}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
    depends_on:
      - app

volumes:
  folio-data:
  folio-pg:
  caddy-data:
  caddy-config: