mirror of
https://github.com/simstudioai/sim.git
synced 2026-09-01 14:59:19 +08:00
Waleed
0c25fc4ee1
* fix(auth): resolve CORS errors for self-hosted deployments behind reverse proxies
- auth client now uses browser origin first, falling back to NEXT_PUBLIC_APP_URL
- socket client falls back to page origin when served from non-localhost (assumes /socket.io is proxied)
- add TRUSTED_ORIGINS env var to extend Better Auth trustedOrigins (apex+www, alias hostnames)
- warn at startup when NEXT_PUBLIC_APP_URL is localhost in production
- preprocess empty NEXT_PUBLIC_SOCKET_URL so docker-compose ${VAR:-} works
- migrate remaining uuid/nanoid/randomUUID usages to @sim/utils generateId/generateShortId
- extend generateShortId with optional alphabet param (rejection sampling)
- document TRUSTED_ORIGINS in .env.example, docker-compose.prod.yml, and helm values.yaml
Fixes simstudioai/sim#1243
* fix(auth): address PR review comments
* chore(env): drop unnecessary NEXT_PUBLIC_SOCKET_URL preprocess (skipValidation is true)
* fix(docker): include @sim/utils in migrations image
Migration scripts now import generateId from @sim/utils/id; without copying packages/utils into the image, bun install fails to resolve the workspace dep at build time and the import fails at runtime.
* fix(helm): remove unused NEXT_PUBLIC_SOCKET_URL from realtime sections
The realtime service never reads NEXT_PUBLIC_SOCKET_URL — its env schema
only includes BETTER_AUTH_URL, NEXT_PUBLIC_APP_URL, ALLOWED_ORIGINS,
BETTER_AUTH_SECRET, INTERNAL_API_SECRET, DATABASE_URL, and REDIS_URL.
Remove the dead config from all helm values files and the values schema.
* fix(helm): allow empty NEXT_PUBLIC_SOCKET_URL in values schema
The default in values.yaml is now "" (empty string), which falls back to
the page origin at runtime. The schema previously required a valid URI,
which would reject the default. Mirror the INTERNAL_API_BASE_URL pattern
using anyOf with const "". Also add TRUSTED_ORIGINS to the schema.
* docs(self-hosting): mark NEXT_PUBLIC_SOCKET_URL as optional
The page-origin fallback in getSocketUrl() means self-hosters no longer
need to set NEXT_PUBLIC_SOCKET_URL when realtime is on the same origin
as the app. Update docs to reflect this:
- Remove NEXT_PUBLIC_SOCKET_URL from .env scaffolding examples in
docker.mdx, platforms.mdx, environment-variables.mdx
- Mark the variable as Optional in the env vars table with the new
default behavior described
- Update troubleshooting to point at reverse-proxy /socket.io routing
rather than the env var
- Flip dev docker-compose defaults (local, ollama, devcontainer) from
http://localhost:3002 to empty for consistency with prod.yml; the
in-code localhost fallback handles the dev case identically
Applied across all 6 documentation languages (en/fr/de/ja/es/zh).
* chore: untrack and ignore .claude/scheduled_tasks.lock
102 lines
3.2 KiB
YAML
102 lines
3.2 KiB
YAML
services:
|
|
simstudio:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/app.Dockerfile
|
|
ports:
|
|
- '3000:3000'
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 8G
|
|
environment:
|
|
- NODE_ENV=development
|
|
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
|
|
- BETTER_AUTH_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
|
|
- NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
|
|
- BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-dev-secret-at-least-32-characters-long}
|
|
- ENCRYPTION_KEY=${ENCRYPTION_KEY:-dev-encryption-key-at-least-32-chars}
|
|
- API_ENCRYPTION_KEY=${API_ENCRYPTION_KEY:-}
|
|
- INTERNAL_API_SECRET=${INTERNAL_API_SECRET:-dev-internal-api-secret-min-32-chars}
|
|
- REDIS_URL=${REDIS_URL:-}
|
|
- COPILOT_API_KEY=${COPILOT_API_KEY}
|
|
- SIM_AGENT_API_URL=${SIM_AGENT_API_URL}
|
|
- OLLAMA_URL=${OLLAMA_URL:-http://localhost:11434}
|
|
- SOCKET_SERVER_URL=${SOCKET_SERVER_URL:-http://realtime:3002}
|
|
- NEXT_PUBLIC_SOCKET_URL=${NEXT_PUBLIC_SOCKET_URL:-}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
migrations:
|
|
condition: service_completed_successfully
|
|
realtime:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ['CMD', 'curl', '-fsS', 'http://127.0.0.1:3000']
|
|
interval: 90s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
realtime:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/realtime.Dockerfile
|
|
environment:
|
|
- NODE_ENV=development
|
|
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
|
|
- NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
|
|
- BETTER_AUTH_URL=${BETTER_AUTH_URL:-http://localhost:3000}
|
|
- BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-dev-secret-at-least-32-characters-long}
|
|
- INTERNAL_API_SECRET=${INTERNAL_API_SECRET:-dev-internal-api-secret-min-32-chars}
|
|
- REDIS_URL=${REDIS_URL:-}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
ports:
|
|
- '3002:3002'
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 1G
|
|
healthcheck:
|
|
test: ['CMD', 'curl', '-fsS', 'http://127.0.0.1:3002/health']
|
|
interval: 90s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
migrations:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/db.Dockerfile
|
|
working_dir: /app/packages/db
|
|
environment:
|
|
- DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio}
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
command: ['bun', 'run', 'db:migrate']
|
|
restart: 'no'
|
|
|
|
db:
|
|
image: pgvector/pgvector:pg17
|
|
restart: always
|
|
ports:
|
|
- '${POSTGRES_PORT:-5432}:5432'
|
|
environment:
|
|
- POSTGRES_USER=${POSTGRES_USER:-postgres}
|
|
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
|
|
- POSTGRES_DB=${POSTGRES_DB:-simstudio}
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ['CMD-SHELL', 'pg_isready -U postgres']
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
volumes:
|
|
postgres_data:
|