docker-compose.yml

services:
  teleflow:
    # Use the prebuilt image from GHCR (built by .github/workflows/ci.yml on push to main).
    # Tag 'latest' tracks the default branch; pin to a specific tag (e.g. :v0.1.0) or
    # sha (e.g. @sha256:...) for reproducible deployments.
    image: ghcr.io/n8n-code/teleflow-backend:latest
    pull_policy: always
    container_name: teleflow-backend
    restart: unless-stopped
    ports:
      - "${PORT:-3000}:3000"
    environment:
      - NODE_ENV=production
      - PORT=3000
      - HOST=0.0.0.0
      - JWT_SECRET=${JWT_SECRET:?JWT_SECRET is required}
      - API_KEY=${API_KEY:?API_KEY is required}
      - DATABASE_URL=file:/app/data/teleflow.db
      - SESSION_ENCRYPTION_KEY=${SESSION_ENCRYPTION_KEY:?SESSION_ENCRYPTION_KEY is required}
      - TELEGRAM_API_ID=${TELEGRAM_API_ID:?TELEGRAM_API_ID is required}
      - TELEGRAM_API_HASH=${TELEGRAM_API_HASH:?TELEGRAM_API_HASH is required}
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - CORS_ORIGIN=${CORS_ORIGIN:-*}
      - RATE_LIMIT_MAX=${RATE_LIMIT_MAX:-100}
      - RATE_LIMIT_WINDOW_MS=${RATE_LIMIT_WINDOW_MS:-60000}
    volumes:
      - teleflow_data:/app/data
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

volumes:
  teleflow_data:
    driver: local