grist/compose.yaml

services:
  grist:
    image: gristlabs/grist-oss:1.7.2
    networks:
      - proxy
      - internal
    environment:
      - REDIS_URL=redis://${STACK_NAME}_redis:6379
      - GRIST_SUPPORT_ANON
      - GRIST_ANON_PLAYGROUND
      - GRIST_SESSION_SECRET_FILE=/run/secrets/session_secret
      - GRIST_SANDBOX_FLAVOR
      - APP_HOME_URL=https://${DOMAIN}
      - APP_DOC_URL=https://${DOMAIN}
      - GRIST_SINGLE_ORG
      - GRIST_ORG_IN_PATH
      - COOKIE_MAX_AGE
      - GRIST_FORCE_LOGIN
      - GRIST_HIDE_UI_ELEMENTS
      - GRIST_DEFAULT_EMAIL
      - GRIST_SUPPORT_EMAIL
      - GRIST_OIDC_SP_HOST
      - GRIST_OIDC_IDP_ISSUER
      - GRIST_OIDC_IDP_SCOPES
      - GRIST_OIDC_IDP_CLIENT_ID
      - GRIST_OIDC_IDP_CLIENT_SECRET_FILE=/run/secrets/oidc_idp_client_secret
      - GRIST_MAX_UPLOAD_ATTACHMENT_MB
      - GRIST_MAX_UPLOAD_IMPORT_MB
    secrets:
      - session_secret
      - oidc_idp_client_secret
    volumes:
      - grist_data:/persist
    configs:
      - source: entrypoint
        target: /entrypoint.sh
        mode: 0555
    entrypoint: /entrypoint.sh
    depends_on:
      - db
      - redis
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8484"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "caddy=${DOMAIN}"
        - "caddy.reverse_proxy={{upstreams 8484}}"
        - "caddy.tls.on_demand="
        - "backupbot.backup=true"

  redis:
    image: redis:7.2-alpine
    networks:
      - internal
    volumes:
      - 'redis_data:/data'

configs:
  entrypoint:
    file: entrypoint.sh

secrets:
  session_secret:
    external: true
    name: ${STACK_NAME}_session_secret
  oidc_idp_client_secret:
    external: true
    name: ${STACK_NAME}_oidc_idp_client_secret

volumes:
  redis_data:
  grist_data:

networks:
  proxy:
    external: true
  internal: