compose.yml

services:
  plausible_db:
    container_name: plausible-db
    image: postgres:16-alpine
    restart: unless-stopped
    volumes:
      - db-data:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=postgres
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      start_period: 1m
    networks:
      - plausible

  plausible_events_db:
    container_name: plausible-events-db
    image: clickhouse/clickhouse-server:24.12-alpine
    restart: unless-stopped
    volumes:
      - event-data:/var/lib/clickhouse
      - event-logs:/var/log/clickhouse-server
      - ./clickhouse/logs.xml:/etc/clickhouse-server/config.d/logs.xml:ro
      # This makes ClickHouse bind to IPv4 only, since Docker doesn't enable IPv6 in bridge networks by default.
      # Fixes "Listen [::]:9000 failed: Address family for hostname not supported" warnings.
      - ./clickhouse/ipv4-only.xml:/etc/clickhouse-server/config.d/ipv4-only.xml:ro
      # The following configuration files make ClickHouse consume less resources, which is useful for small setups.
      # https://clickhouse.com/docs/en/operations/tips#using-less-than-16gb-of-ram
      - ./clickhouse/low-resources.xml:/etc/clickhouse-server/config.d/low-resources.xml:ro
      - ./clickhouse/default-profile-low-resources-overrides.xml:/etc/clickhouse-server/users.d/default-profile-low-resources-overrides.xml:ro
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    environment:
      - CLICKHOUSE_SKIP_USER_SETUP=1
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget --no-verbose --tries=1 -O - http://127.0.0.1:8123/ping || exit 1",
        ]
      start_period: 1m
    networks:
      - plausible

  plausible:
    container_name: plausible
    image: ghcr.io/plausible/community-edition:v3.2.0
    restart: unless-stopped
    command: sh -c "/entrypoint.sh db createdb && /entrypoint.sh db migrate && /entrypoint.sh run"
    depends_on:
      plausible_db:
        condition: service_healthy
      plausible_events_db:
        condition: service_healthy
    volumes:
      - plausible-data:/var/lib/plausible
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
    environment:
      - TMPDIR=/var/lib/plausible/tmp
      # required: https://github.com/plausible/community-edition/wiki/configuration#required
      - BASE_URL=https://plausible.benne.dk
      - SECRET_KEY_BASE=${SECRET_KEY_BASE}
      # optional: https://github.com/plausible/community-edition/wiki/configuration#optional
      # registration: https://github.com/plausible/community-edition/wiki/configuration#registration
      - TOTP_VAULT_KEY
      - DISABLE_REGISTRATION=true
      - ENABLE_EMAIL_VERIFICATION
      # web: https://github.com/plausible/community-edition/wiki/configuration#web
      - HTTP_PORT
      - HTTPS_PORT
      # databases: https://github.com/plausible/community-edition/wiki/configuration#database
      - DATABASE_URL
      - CLICKHOUSE_DATABASE_URL
      # Google: https://github.com/plausible/community-edition/wiki/configuration#google
      - GOOGLE_CLIENT_ID
      - GOOGLE_CLIENT_SECRET
      # geolocation: https://github.com/plausible/community-edition/wiki/configuration#ip-geolocation
      - IP_GEOLOCATION_DB
      - GEONAMES_SOURCE_FILE
      - MAXMIND_LICENSE_KEY
      - MAXMIND_EDITION
      # email: https://github.com/plausible/community-edition/wiki/configuration#email
      - MAILER_ADAPTER
      - MAILER_EMAIL
      - MAILER_NAME
      - SMTP_HOST_ADDR
      - SMTP_HOST_PORT
      - SMTP_USER_NAME
      - SMTP_USER_PWD
      - SMTP_HOST_SSL_ENABLED
      - POSTMARK_API_KEY
      - MAILGUN_API_KEY
      - MAILGUN_DOMAIN
      - MAILGUN_BASE_URI
      - MANDRILL_API_KEY
      - SENDGRID_API_KEY
    labels:
      - "traefik.enable=true"
      - "traefik-tailnet.enable=true"
      - "traefik.http.routers.http-plausible.rule=Host(`plausible.benne.dk`)"
      - "traefik.http.routers.http-plausible.entrypoints=tailnet"
      - "traefik.http.routers.http-plausible.middlewares=plausible-https-redirect"
      - "traefik.http.routers.https-plausible.rule=Host(`plausible.benne.dk`)"
      - "traefik.http.routers.https-plausible.entrypoints=tailnetsecure"
      - "traefik.http.routers.https-plausible.tls=true"
      - "traefik.http.routers.https-plausible.tls.certresolver=powerdns_tailnet"
      - "traefik.http.routers.https-plausible.tls.domains[0].main=plausible.benne.dk"
      - "traefik.http.services.https-plausible.loadbalancer.server.port=8000"
      - "traefik.http.middlewares.plausible-https-redirect.redirectscheme.scheme=https"
    networks:
      - plausible
      - proxy-tailnet

volumes:
  db-data:
  event-data:
  event-logs:
  plausible-data:

networks:
  plausible:
    external: true
  proxy-tailnet:
    external: true