Appwrite 1.7.4 on Coolify

README.md

Deploy Appwrite 1.7.4 with Wildcard SSL on Coolify

Deploy Appwrite 1.7.4 on Coolify using its built-in Traefik proxy for wildcard SSL certificates (*.example.com) via DNS challenge. This enables custom domains for Appwrite Sites and Functions.

What You'll Get

• Main API/Console: back.example.com
• Sites: [site-id].example.com
• Functions: [function-id].example.com
• Wildcard SSL certificates managed by Coolify's Traefik

How It Works

This setup integrates Appwrite with Coolify's existing Traefik proxy instead of using Appwrite's built-in Traefik. Coolify's Traefik handles SSL termination and routing, while Appwrite services are configured with Docker labels for automatic discovery.

graph TD
    A[Internet] -->|DNS: *.example.com| B[Coolify Server]
    B --> C[Coolify's Traefik Proxy<br/>Wildcard SSL *.example.com]
    C -->|back.example.com| D[Appwrite Backend<br/>API + Sites + Functions]
    C -->|back.example.com/console| E[Appwrite Console]
    C -->|back.example.com/v1/realtime| F[Appwrite Realtime]
    C -->|"[id].example.com"| D
    
    subgraph "Appwrite Stack"
        D
        E
        F
        G[Workers & Database]
        D --- G
    end
    
    style C fill:#828,color:#eee,stroke:#333,stroke-width:2px
    style D fill:#559,color:#eee,stroke:#333,stroke-width:2px

Loading

Key Benefits:

• Single wildcard certificate covers all subdomains
• Centralized SSL management through Coolify
• No need for Appwrite's internal Traefik
• Automatic routing via Docker labels

Prerequisites

• Coolify instance with Traefik proxy enabled
• Domain managed by a supported DNS provider
• DNS provider API credentials
• Server's public IP address

Note: Traefik supports 50+ DNS providers including AWS Route53, DigitalOcean, Google Cloud DNS, Azure DNS, and many others. This guide provides templates for Cloudflare and Porkbun as examples.

Quick Start

The deployment process involves 4 main steps:

1. Download and prepare configuration templates
2. Reconfigure Coolify's Traefik for wildcard certificates
3. Create and configure Appwrite resource in Coolify
4. Deploy and verify

Since all templates require customization with your specific values, it's recommended to download and prepare them locally before starting the deployment.

Step 1: Download and Prepare Templates

1.1 Download Required Files

Download these template files to your local machine:

Example templates provided:

• traefik-cloudflare.yml - Traefik configuration for Cloudflare
• traefik-porkbun.yml - Traefik configuration for Porkbun
• appwrite-compose.yml - Docker Compose file
• appwrite.env - Environment variables

For other DNS providers: Use the provided templates as a reference and consult the Traefik DNS providers documentation for specific configuration requirements. Each provider requires different environment variables and configuration parameters.

1.2 Customize Traefik Configuration

Edit your DNS provider configuration file based on your provider.

Tip

Search for [EDIT] in your text editor to quickly find all placeholders that need to be replaced.

Example: Cloudflare configuration (traefik-cloudflare.yml):

# Replace these placeholders:
- CLOUDFLARE_DNS_API_TOKEN=<-[EDIT]- PASTE YOUR CLOUDFLARE API TOKEN HERE ->
- '--certificatesresolvers.letsencrypt.acme.email=<-[EDIT]- YOUR EMAIL HERE ->'
- "traefik.http.routers.traefik-secure.rule=Host(`traefik.<-[EDIT]- YOUR DOMAIN HERE ->`)"
- "traefik.http.routers.traefik-secure.tls.domains[0].main=<-[EDIT]- YOUR DOMAIN HERE ->"
- "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.<-[EDIT]- YOUR DOMAIN HERE ->"

Example: Porkbun configuration (traefik-porkbun.yml):

# Replace these placeholders:
- PORKBUN_API_KEY=<-[EDIT]- PASTE YOUR PORKBUN API TOKEN HERE ->
- PORKBUN_API_SECRET=<-[EDIT]- PASTE YOUR PORKBUN API SECRET HERE ->
- '--certificatesresolvers.letsencrypt.acme.email=<-[EDIT]- YOUR EMAIL HERE ->'
- "traefik.http.routers.traefik-secure.tls.domains[0].main=<-[EDIT]- YOUR DOMAIN HERE ->"
- "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.<-[EDIT]- YOUR DOMAIN HERE ->"
```****

**For other DNS providers:** Configure according to your provider's specific requirements. See the [Coolify Traefik wildcard configuration guide](https://coolify.io/docs/knowledge-base/proxy/traefik/wildcard-certs) for general setup instructions and the [Traefik DNS challenge documentation](https://doc.traefik.io/traefik/https/acme/#providers) for provider-specific environment variables and settings.

### 1.3 Customize Environment Variables

Edit `appwrite.env` and replace all placeholder values.

> [!TIP]
> **💡 Tip:** Search for `[EDIT]` in your text editor to quickly find all placeholders that need to be replaced.

**Critical settings to update:**
```env
# Domain configuration
_APP_DOMAIN=<!-[EDIT]- YOUR DOMAIN ->
_APP_DOMAIN_FUNCTIONS=<!-[EDIT]- YOUR DOMAIN ->
_APP_DOMAIN_SITES=<!-[EDIT]- YOUR DOMAIN ->
_APP_DOMAIN_TARGET_A=<!-[EDIT]- YOUR SERVER PUBLIC IPV4 ->
_APP_DOMAIN_TARGET_CNAME=<!-[EDIT]- YOUR DOMAIN ->

# Security keys (generate 32-character random strings)
_APP_OPENSSL_KEY_V1=<!-[EDIT]- YOUR SUPER SECRET APPWRITE OPENSSL KEY ->
_APP_EXECUTOR_SECRET=<!-[EDIT]- YOUR SUPER SECRET APPWRITE EXECUTOR KEY ->

# Database credentials
_APP_DB_USER=<!-[EDIT]- CREATE A STRONG APPWRITE DB USER ->
_APP_DB_PASS=<!-[EDIT]- CREATE A STRONG APPWRITE DB PASSWORD ->
_APP_DB_ROOT_PASS=<!-[EDIT]- CREATE A STRONG MARIADB ROOT PASSWORD ->

# System email
_APP_SYSTEM_EMAIL_NAME=<!-[EDIT]- EMAIL SENDER NAME ->
_APP_SYSTEM_EMAIL_ADDRESS=<!-[EDIT]- EMAIL SENDER EMAIL ->

# Console hostnames
_APP_CONSOLE_HOSTNAMES=<!-[EDIT]- YOUR DOMAIN ->

Important: Both _APP_DOMAIN_FUNCTIONS and _APP_DOMAIN_SITES should be set to your root domain (e.g., example.com) so that custom sites and functions get direct subdomains like [id].example.com, which are covered by the *.example.com wildcard certificate.

Step 2: Configure DNS Records

Set up these DNS records in your DNS provider:

1. A Record for backend:

   • Name: back
   • Value: YOUR_SERVER_IP
   • Proxy: DNS only (gray cloud in Cloudflare)

2. Wildcard CNAME:

   • Name: *
   • Value: back.example.com
   • Proxy: DNS only (gray cloud in Cloudflare)

Step 3: Reconfigure Coolify's Traefik

1. Access Traefik Configuration

   • Go to Coolify dashboard → Server → Proxy
   • Open the "Configuration file" editor
   

2. Replace Configuration

   • Copy the content from your prepared Traefik configuration file (cloudflare.yml or porkbun.yml)
   • Paste it into the Coolify configuration editor
   • Important: Verify the network name matches your Coolify setup (usually coolify)

3. Save and Restart

   • Save the configuration
   • Restart the proxy
   • Monitor logs for any errors in the restart process

Step 4: Deploy Appwrite in Coolify

Important

The Compose file has variables, so before saving it you need to uncheck the option "Escape special characters"

Tip

Use the "Show Deployable Compose" in the screen above to confirm Coolify is correctly replacing the variables in the docker compose with the values use set in the environment.

1. Create New Resource

   • Go to Server → Resources → Add New → Docker Compose

2. Add Docker Compose Configuration

   • Copy the content from your prepared appwrite-compose.yml
   • Paste it into the Coolify Docker Compose editor

3. Add Environment Variables

   • Go to "Environment Variables" tab
   • Copy the content from your prepared appwrite.env
   • Paste it into the environment variables section

4. Verify Networks

   • Ensure the external network name in the compose file matches Coolify's proxy network
   • Usually coolify - verify this matches your Traefik configuration

5. Deploy

   • Click Deploy
   • Monitor deployment logs in real-time
   • Wait for all services to start successfully

Step 5: Verify Setup

1. Test Console Access

   • Visit https://back.example.com/console
   • You should see the Appwrite setup screen
   • Complete the initial Appwrite configuration

2. Test SSL Certificate

   • Verify the wildcard certificate is working
   • Check that the connection is secure (HTTPS)

3. Test Custom Domains

   • Create a project in Appwrite console
   • Deploy a test site or function
   • Verify custom domain works with HTTPS (e.g., https://[unique-id].example.com)

Troubleshooting

SSL Certificate Issues

• Check Traefik logs: Server → Proxy → Logs
• Verify API credentials: Ensure your DNS provider API token/key has correct permissions
• Check DNS records: Ensure DNS records are not proxied (gray cloud in Cloudflare)
• Test staging: Uncomment the staging ACME server line in Traefik config for testing

Routing Problems

• Verify network name: Check that network name matches between Traefik config and Appwrite stack
• Check Traefik labels: Review Traefik labels in Docker Compose file
• Access Traefik dashboard: If accessible, review routing rules

Appwrite Service Issues

• Check service logs: Monitor individual service logs in Coolify
• Verify environment variables: Ensure all required variables are set correctly
• Database connectivity: Verify database credentials and connectivity
• Resource limits: Check if services have sufficient resources

Common Configuration Errors

• Domain mismatch: Ensure all domain references are consistent
• Network connectivity: Verify services can communicate on the internal network
• Secret keys: Ensure all secret keys are properly generated and set

Network Configuration

The setup uses these networks:

• coolify - Coolify's main proxy network (external)
• appwrite-internal-${COOLIFY_RESOURCE_UUID} - Internal Appwrite services communication
• appwrite-runtimes-${COOLIFY_RESOURCE_UUID} - OpenRuntimes executor network

Important: The ${COOLIFY_RESOURCE_UUID} variable is automatically provided by Coolify to ensure network isolation between different resources.

Security Considerations

• Generate strong secrets: Use proper random generators for _APP_OPENSSL_KEY_V1 and _APP_EXECUTOR_SECRET
• Database security: Use strong, unique passwords for database accounts
• API credentials: Secure your DNS provider API credentials with minimal required permissions
• Network isolation: The setup provides proper network isolation between services
• SSL/TLS: All traffic is encrypted with automatically renewed certificates

References

• Coolify Traefik Configuration
• Traefik DNS Challenge and Providers
• Appwrite Documentation
• Cloudflare API Tokens
• Porkbun API Documentation

appwrite-compose.yml

version: '3.8'
x-logging: &x-logging
  logging:
    driver: json-file
    options:
      max-file: '5'
      max-size: 10m
services:
  appwrite:
    image: 'appwrite/appwrite:1.7.4'
    container_name: appwrite
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
      - coolify
    labels:
      - traefik.enable=true
      - traefik.docker.network=coolify
      - 'traefik.http.routers.appwrite-main-https.rule=Host(`${_APP_DOMAIN}`)'
      - traefik.http.routers.appwrite-main-https.entrypoints=https
      - traefik.http.routers.appwrite-main-https.tls.certresolver=letsencrypt
      - traefik.http.routers.appwrite-main-https.service=appwrite-main-svc
      - 'traefik.http.routers.appwrite-wildcard-https.rule=HostRegexp(`{subdomain:[^.]+}.${_APP_DOMAIN_SITES}`) && !Host(`${_APP_DOMAIN}`)'
      - traefik.http.routers.appwrite-wildcard-https.entrypoints=https
      - traefik.http.routers.appwrite-wildcard-https.tls.certresolver=letsencrypt
      - traefik.http.routers.appwrite-wildcard-https.service=appwrite-main-svc
      - traefik.http.services.appwrite-main-svc.loadbalancer.server.port=80
      - 'traefik.http.routers.appwrite-main-http.rule=Host(`${_APP_DOMAIN}`)'
      - traefik.http.routers.appwrite-main-http.entrypoints=http
      - traefik.http.routers.appwrite-main-http.middlewares=redirect-to-https
    volumes:
      - 'appwrite-uploads:/storage/uploads:rw'
      - 'appwrite-imports:/storage/imports:rw'
      - 'appwrite-cache:/storage/cache:rw'
      - 'appwrite-config:/storage/config:rw'
      - 'appwrite-certificates:/storage/certificates:rw'
      - 'appwrite-functions:/storage/functions:rw'
      - 'appwrite-sites:/storage/sites:rw'
      - 'appwrite-builds:/storage/builds:rw'
    depends_on:
      - appwrite-mariadb
      - appwrite-redis
    environment:
      - _APP_ENV
      - _APP_DOMAIN
      - _APP_DOMAIN_FUNCTIONS
      - _APP_DOMAIN_SITES
      - _APP_OPENSSL_KEY_V1
      - _APP_WORKER_PER_CORE
      - _APP_LOCALE
      - _APP_COMPRESSION_MIN_SIZE_BYTES
      - _APP_CONSOLE_WHITELIST_ROOT
      - _APP_CONSOLE_WHITELIST_EMAILS
      - _APP_CONSOLE_SESSION_ALERTS
      - _APP_CONSOLE_WHITELIST_IPS
      - _APP_CONSOLE_HOSTNAMES
      - _APP_SYSTEM_EMAIL_NAME
      - _APP_SYSTEM_EMAIL_ADDRESS
      - _APP_EMAIL_SECURITY
      - _APP_SYSTEM_RESPONSE_FORMAT
      - _APP_OPTIONS_ABUSE
      - _APP_OPTIONS_ROUTER_PROTECTION
      - _APP_OPTIONS_FORCE_HTTPS
      - _APP_OPTIONS_ROUTER_FORCE_HTTPS
      - _APP_DOMAIN_TARGET_CNAME
      - _APP_DOMAIN_TARGET_AAAA
      - _APP_DOMAIN_TARGET_A
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_SMTP_HOST
      - _APP_SMTP_PORT
      - _APP_SMTP_SECURE
      - _APP_SMTP_USERNAME
      - _APP_SMTP_PASSWORD
      - _APP_USAGE_STATS
      - _APP_STORAGE_LIMIT
      - _APP_STORAGE_PREVIEW_LIMIT
      - _APP_STORAGE_ANTIVIRUS
      - _APP_STORAGE_ANTIVIRUS_HOST
      - _APP_STORAGE_ANTIVIRUS_PORT
      - _APP_STORAGE_DEVICE
      - _APP_STORAGE_S3_ACCESS_KEY
      - _APP_STORAGE_S3_SECRET
      - _APP_STORAGE_S3_REGION
      - _APP_STORAGE_S3_BUCKET
      - _APP_STORAGE_S3_ENDPOINT
      - _APP_STORAGE_DO_SPACES_ACCESS_KEY
      - _APP_STORAGE_DO_SPACES_SECRET
      - _APP_STORAGE_DO_SPACES_REGION
      - _APP_STORAGE_DO_SPACES_BUCKET
      - _APP_STORAGE_BACKBLAZE_ACCESS_KEY
      - _APP_STORAGE_BACKBLAZE_SECRET
      - _APP_STORAGE_BACKBLAZE_REGION
      - _APP_STORAGE_BACKBLAZE_BUCKET
      - _APP_STORAGE_LINODE_ACCESS_KEY
      - _APP_STORAGE_LINODE_SECRET
      - _APP_STORAGE_LINODE_REGION
      - _APP_STORAGE_LINODE_BUCKET
      - _APP_STORAGE_WASABI_ACCESS_KEY
      - _APP_STORAGE_WASABI_SECRET
      - _APP_STORAGE_WASABI_REGION
      - _APP_STORAGE_WASABI_BUCKET
      - _APP_COMPUTE_SIZE_LIMIT
      - _APP_FUNCTIONS_TIMEOUT
      - _APP_SITES_TIMEOUT
      - _APP_COMPUTE_BUILD_TIMEOUT
      - _APP_COMPUTE_CPUS
      - _APP_COMPUTE_MEMORY
      - _APP_FUNCTIONS_RUNTIMES
      - _APP_SITES_RUNTIMES
      - _APP_EXECUTOR_SECRET
      - _APP_EXECUTOR_HOST
      - _APP_LOGGING_CONFIG
      - _APP_MAINTENANCE_INTERVAL
      - _APP_MAINTENANCE_DELAY
      - _APP_MAINTENANCE_START_TIME
      - _APP_MAINTENANCE_RETENTION_EXECUTION
      - _APP_MAINTENANCE_RETENTION_CACHE
      - _APP_MAINTENANCE_RETENTION_ABUSE
      - _APP_MAINTENANCE_RETENTION_AUDIT
      - _APP_MAINTENANCE_RETENTION_AUDIT_CONSOLE
      - _APP_MAINTENANCE_RETENTION_USAGE_HOURLY
      - _APP_MAINTENANCE_RETENTION_SCHEDULES
      - _APP_SMS_PROVIDER
      - _APP_SMS_FROM
      - _APP_GRAPHQL_MAX_BATCH_SIZE
      - _APP_GRAPHQL_MAX_COMPLEXITY
      - _APP_GRAPHQL_MAX_DEPTH
      - _APP_VCS_GITHUB_APP_NAME
      - _APP_VCS_GITHUB_PRIVATE_KEY
      - _APP_VCS_GITHUB_APP_ID
      - _APP_VCS_GITHUB_WEBHOOK_SECRET
      - _APP_VCS_GITHUB_CLIENT_SECRET
      - _APP_VCS_GITHUB_CLIENT_ID
      - _APP_MIGRATIONS_FIREBASE_CLIENT_ID
      - _APP_MIGRATIONS_FIREBASE_CLIENT_SECRET
      - _APP_ASSISTANT_OPENAI_API_KEY
      - _APP_SYSTEM_SECURITY_EMAIL_ADDRESS
      - _APP_EMAIL_CERTIFICATES
      - _APP_COMPUTE_INACTIVE_THRESHOLD
      - _APP_COMPUTE_MAINTENANCE_INTERVAL
      - _APP_COMPUTE_RUNTIMES_NETWORK
      - _APP_DOCKER_HUB_USERNAME
      - _APP_DOCKER_HUB_PASSWORD
      - _APP_DATABASE_SHARED_TABLES
      - _APP_STATS_RESOURCES_INTERVAL
      - _APP_USAGE_AGGREGATION_INTERVAL
  appwrite-console:
    image: 'appwrite/console:6.0.41'
    container_name: appwrite-console
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
      - coolify
    labels:
      - traefik.enable=true
      - traefik.docker.network=coolify
      - 'traefik.http.routers.appwrite-console-https.rule=Host(`${_APP_DOMAIN}`) && PathPrefix(`/console`)'
      - traefik.http.routers.appwrite-console-https.entrypoints=https
      - traefik.http.routers.appwrite-console-https.tls.certresolver=letsencrypt
      - traefik.http.routers.appwrite-console-https.service=appwrite-console-svc
      - traefik.http.services.appwrite-console-svc.loadbalancer.server.port=80
      - 'traefik.http.routers.appwrite-console-http.rule=Host(`${_APP_DOMAIN}`) && PathPrefix(`/console`)'
      - traefik.http.routers.appwrite-console-http.entrypoints=http
      - traefik.http.routers.appwrite-console-http.middlewares=redirect-to-https
  appwrite-realtime:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: realtime
    container_name: appwrite-realtime
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
      - coolify
    labels:
      - traefik.enable=true
      - traefik.docker.network=coolify
      - 'traefik.http.routers.appwrite-realtime-https.rule=Host(`${_APP_DOMAIN}`) && PathPrefix(`/v1/realtime`)'
      - traefik.http.routers.appwrite-realtime-https.entrypoints=https
      - traefik.http.routers.appwrite-realtime-https.tls.certresolver=letsencrypt
      - traefik.http.routers.appwrite-realtime-https.service=appwrite-realtime-svc
      - traefik.http.services.appwrite-realtime-svc.loadbalancer.server.port=80
      - 'traefik.http.routers.appwrite-realtime-http.rule=Host(`${_APP_DOMAIN}`) && PathPrefix(`/v1/realtime`)'
      - traefik.http.routers.appwrite-realtime-http.entrypoints=http
      - traefik.http.routers.appwrite-realtime-http.middlewares=redirect-to-https
    depends_on:
      - appwrite-mariadb
      - appwrite-redis
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPTIONS_ABUSE
      - _APP_OPTIONS_ROUTER_PROTECTION
      - _APP_OPENSSL_KEY_V1
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_USAGE_STATS
      - _APP_LOGGING_CONFIG
  appwrite-worker-audits:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-audits
    container_name: appwrite-worker-audits
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
      - appwrite-mariadb
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_LOGGING_CONFIG
  appwrite-worker-webhooks:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-webhooks
    container_name: appwrite-worker-webhooks
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
      - appwrite-mariadb
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_EMAIL_SECURITY
      - _APP_SYSTEM_SECURITY_EMAIL_ADDRESS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_LOGGING_CONFIG
  appwrite-worker-deletes:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-deletes
    container_name: appwrite-worker-deletes
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
      - appwrite-mariadb
    volumes:
      - 'appwrite-uploads:/storage/uploads:rw'
      - 'appwrite-cache:/storage/cache:rw'
      - 'appwrite-functions:/storage/functions:rw'
      - 'appwrite-sites:/storage/sites:rw'
      - 'appwrite-builds:/storage/builds:rw'
      - 'appwrite-certificates:/storage/certificates:rw'
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_STORAGE_DEVICE
      - _APP_STORAGE_S3_ACCESS_KEY
      - _APP_STORAGE_S3_SECRET
      - _APP_STORAGE_S3_REGION
      - _APP_STORAGE_S3_BUCKET
      - _APP_STORAGE_S3_ENDPOINT
      - _APP_STORAGE_DO_SPACES_ACCESS_KEY
      - _APP_STORAGE_DO_SPACES_SECRET
      - _APP_STORAGE_DO_SPACES_REGION
      - _APP_STORAGE_DO_SPACES_BUCKET
      - _APP_STORAGE_BACKBLAZE_ACCESS_KEY
      - _APP_STORAGE_BACKBLAZE_SECRET
      - _APP_STORAGE_BACKBLAZE_REGION
      - _APP_STORAGE_BACKBLAZE_BUCKET
      - _APP_STORAGE_LINODE_ACCESS_KEY
      - _APP_STORAGE_LINODE_SECRET
      - _APP_STORAGE_LINODE_REGION
      - _APP_STORAGE_LINODE_BUCKET
      - _APP_STORAGE_WASABI_ACCESS_KEY
      - _APP_STORAGE_WASABI_SECRET
      - _APP_STORAGE_WASABI_REGION
      - _APP_STORAGE_WASABI_BUCKET
      - _APP_LOGGING_CONFIG
      - _APP_EXECUTOR_SECRET
      - _APP_EXECUTOR_HOST
      - _APP_MAINTENANCE_RETENTION_ABUSE
      - _APP_MAINTENANCE_RETENTION_AUDIT
      - _APP_MAINTENANCE_RETENTION_AUDIT_CONSOLE
      - _APP_MAINTENANCE_RETENTION_EXECUTION
      - _APP_SYSTEM_SECURITY_EMAIL_ADDRESS
      - _APP_EMAIL_CERTIFICATES
  appwrite-worker-databases:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-databases
    container_name: appwrite-worker-databases
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
      - appwrite-mariadb
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_LOGGING_CONFIG
  appwrite-worker-builds:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-builds
    container_name: appwrite-worker-builds
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
      - appwrite-mariadb
    volumes:
      - 'appwrite-functions:/storage/functions:rw'
      - 'appwrite-sites:/storage/sites:rw'
      - 'appwrite-builds:/storage/builds:rw'
      - 'appwrite-uploads:/storage/uploads:rw'
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_EXECUTOR_SECRET
      - _APP_EXECUTOR_HOST
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_LOGGING_CONFIG
      - _APP_VCS_GITHUB_APP_NAME
      - _APP_VCS_GITHUB_PRIVATE_KEY
      - _APP_VCS_GITHUB_APP_ID
      - _APP_FUNCTIONS_TIMEOUT
      - _APP_SITES_TIMEOUT
      - _APP_COMPUTE_BUILD_TIMEOUT
      - _APP_COMPUTE_CPUS
      - _APP_COMPUTE_MEMORY
      - _APP_COMPUTE_SIZE_LIMIT
      - _APP_OPTIONS_FORCE_HTTPS
      - _APP_OPTIONS_ROUTER_FORCE_HTTPS
      - _APP_DOMAIN
      - _APP_STORAGE_DEVICE
      - _APP_STORAGE_S3_ACCESS_KEY
      - _APP_STORAGE_S3_SECRET
      - _APP_STORAGE_S3_REGION
      - _APP_STORAGE_S3_BUCKET
      - _APP_STORAGE_S3_ENDPOINT
      - _APP_STORAGE_DO_SPACES_ACCESS_KEY
      - _APP_STORAGE_DO_SPACES_SECRET
      - _APP_STORAGE_DO_SPACES_REGION
      - _APP_STORAGE_DO_SPACES_BUCKET
      - _APP_STORAGE_BACKBLAZE_ACCESS_KEY
      - _APP_STORAGE_BACKBLAZE_SECRET
      - _APP_STORAGE_BACKBLAZE_REGION
      - _APP_STORAGE_BACKBLAZE_BUCKET
      - _APP_STORAGE_LINODE_ACCESS_KEY
      - _APP_STORAGE_LINODE_SECRET
      - _APP_STORAGE_LINODE_REGION
      - _APP_STORAGE_LINODE_BUCKET
      - _APP_STORAGE_WASABI_ACCESS_KEY
      - _APP_STORAGE_WASABI_SECRET
      - _APP_STORAGE_WASABI_REGION
      - _APP_STORAGE_WASABI_BUCKET
      - _APP_DOMAIN_SITES
  appwrite-worker-certificates:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-certificates
    container_name: appwrite-worker-certificates
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
      - appwrite-mariadb
    volumes:
      - 'appwrite-config:/storage/config:rw'
      - 'appwrite-certificates:/storage/certificates:rw'
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_DOMAIN
      - _APP_DOMAIN_TARGET_CNAME
      - _APP_DOMAIN_TARGET_AAAA
      - _APP_DOMAIN_TARGET_A
      - _APP_DOMAIN_FUNCTIONS
      - _APP_EMAIL_CERTIFICATES
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_LOGGING_CONFIG
  appwrite-worker-functions:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-functions
    container_name: appwrite-worker-functions
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
      - appwrite-mariadb
      - openruntimes-executor
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_DOMAIN
      - _APP_OPTIONS_FORCE_HTTPS
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_FUNCTIONS_TIMEOUT
      - _APP_SITES_TIMEOUT
      - _APP_COMPUTE_BUILD_TIMEOUT
      - _APP_COMPUTE_CPUS
      - _APP_COMPUTE_MEMORY
      - _APP_EXECUTOR_SECRET
      - _APP_EXECUTOR_HOST
      - _APP_USAGE_STATS
      - _APP_DOCKER_HUB_USERNAME
      - _APP_DOCKER_HUB_PASSWORD
      - _APP_LOGGING_CONFIG
  appwrite-worker-mails:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-mails
    container_name: appwrite-worker-mails
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_SYSTEM_EMAIL_NAME
      - _APP_SYSTEM_EMAIL_ADDRESS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_SMTP_HOST
      - _APP_SMTP_PORT
      - _APP_SMTP_SECURE
      - _APP_SMTP_USERNAME
      - _APP_SMTP_PASSWORD
      - _APP_LOGGING_CONFIG
      - _APP_DOMAIN
      - _APP_OPTIONS_FORCE_HTTPS
  appwrite-worker-messaging:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-messaging
    container_name: appwrite-worker-messaging
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    volumes:
      - 'appwrite-uploads:/storage/uploads:rw'
    depends_on:
      - appwrite-redis
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_LOGGING_CONFIG
      - _APP_SMS_FROM
      - _APP_SMS_PROVIDER
      - _APP_STORAGE_DEVICE
      - _APP_STORAGE_S3_ACCESS_KEY
      - _APP_STORAGE_S3_SECRET
      - _APP_STORAGE_S3_REGION
      - _APP_STORAGE_S3_BUCKET
      - _APP_STORAGE_S3_ENDPOINT
      - _APP_STORAGE_DO_SPACES_ACCESS_KEY
      - _APP_STORAGE_DO_SPACES_SECRET
      - _APP_STORAGE_DO_SPACES_REGION
      - _APP_STORAGE_DO_SPACES_BUCKET
      - _APP_STORAGE_BACKBLAZE_ACCESS_KEY
      - _APP_STORAGE_BACKBLAZE_SECRET
      - _APP_STORAGE_BACKBLAZE_REGION
      - _APP_STORAGE_BACKBLAZE_BUCKET
      - _APP_STORAGE_LINODE_ACCESS_KEY
      - _APP_STORAGE_LINODE_SECRET
      - _APP_STORAGE_LINODE_REGION
      - _APP_STORAGE_LINODE_BUCKET
      - _APP_STORAGE_WASABI_ACCESS_KEY
      - _APP_STORAGE_WASABI_SECRET
      - _APP_STORAGE_WASABI_REGION
      - _APP_STORAGE_WASABI_BUCKET
  appwrite-worker-migrations:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-migrations
    container_name: appwrite-worker-migrations
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    volumes:
      - 'appwrite-imports:/storage/imports:rw'
    depends_on:
      - appwrite-mariadb
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_DOMAIN
      - _APP_DOMAIN_TARGET_CNAME
      - _APP_DOMAIN_TARGET_AAAA
      - _APP_DOMAIN_TARGET_A
      - _APP_EMAIL_SECURITY
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_LOGGING_CONFIG
      - _APP_MIGRATIONS_FIREBASE_CLIENT_ID
      - _APP_MIGRATIONS_FIREBASE_CLIENT_SECRET
  appwrite-task-maintenance:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: maintenance
    container_name: appwrite-task-maintenance
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_DOMAIN
      - _APP_DOMAIN_TARGET_CNAME
      - _APP_DOMAIN_TARGET_AAAA
      - _APP_DOMAIN_TARGET_A
      - _APP_DOMAIN_FUNCTIONS
      - _APP_OPENSSL_KEY_V1
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_MAINTENANCE_INTERVAL
      - _APP_MAINTENANCE_RETENTION_EXECUTION
      - _APP_MAINTENANCE_RETENTION_CACHE
      - _APP_MAINTENANCE_RETENTION_ABUSE
      - _APP_MAINTENANCE_RETENTION_AUDIT
      - _APP_MAINTENANCE_RETENTION_AUDIT_CONSOLE
      - _APP_MAINTENANCE_RETENTION_USAGE_HOURLY
      - _APP_MAINTENANCE_RETENTION_SCHEDULES
  appwrite-task-stats-resources:
    image: 'appwrite/appwrite:1.7.4'
    container_name: appwrite-task-stats-resources
    entrypoint: stats-resources
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
      - appwrite-mariadb
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_USAGE_STATS
      - _APP_LOGGING_CONFIG
      - _APP_DATABASE_SHARED_TABLES
      - _APP_STATS_RESOURCES_INTERVAL
  appwrite-worker-stats-resources:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-stats-resources
    container_name: appwrite-worker-stats-resources
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
      - appwrite-mariadb
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_USAGE_STATS
      - _APP_LOGGING_CONFIG
      - _APP_STATS_RESOURCES_INTERVAL
  appwrite-worker-stats-usage:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: worker-stats-usage
    container_name: appwrite-worker-stats-usage
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-redis
      - appwrite-mariadb
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_USAGE_STATS
      - _APP_LOGGING_CONFIG
      - _APP_USAGE_AGGREGATION_INTERVAL
  appwrite-task-scheduler-functions:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: schedule-functions
    container_name: appwrite-task-scheduler-functions
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-mariadb
      - appwrite-redis
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
  appwrite-task-scheduler-executions:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: schedule-executions
    container_name: appwrite-task-scheduler-executions
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-mariadb
      - appwrite-redis
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
  appwrite-task-scheduler-messages:
    image: 'appwrite/appwrite:1.7.4'
    entrypoint: schedule-messages
    container_name: appwrite-task-scheduler-messages
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    depends_on:
      - appwrite-mariadb
      - appwrite-redis
    environment:
      - _APP_ENV
      - _APP_WORKER_PER_CORE
      - _APP_OPENSSL_KEY_V1
      - _APP_REDIS_HOST
      - _APP_REDIS_PORT
      - _APP_REDIS_USER
      - _APP_REDIS_PASS
      - _APP_DB_HOST
      - _APP_DB_PORT
      - _APP_DB_SCHEMA
      - _APP_DB_USER
      - _APP_DB_PASS
  appwrite-assistant:
    image: 'appwrite/assistant:0.4.0'
    container_name: appwrite-assistant
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    environment:
      - _APP_ASSISTANT_OPENAI_API_KEY
  appwrite-browser:
    image: 'appwrite/browser:0.2.4'
    container_name: appwrite-browser
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
  openruntimes-executor:
    container_name: openruntimes-executor
    hostname: exc1
    <<: *x-logging
    restart: unless-stopped
    stop_signal: SIGINT
    image: 'openruntimes/executor:0.7.14'
    networks:
      - appwrite-network
      - appwrite-runtimes-network
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock'
      - 'appwrite-builds:/storage/builds:rw'
      - 'appwrite-functions:/storage/functions:rw'
      - 'appwrite-sites:/storage/sites:rw'
      - '/tmp:/tmp:rw'
    environment:
      - OPR_EXECUTOR_INACTIVE_TRESHOLD=$_APP_COMPUTE_INACTIVE_THRESHOLD
      - OPR_EXECUTOR_MAINTENANCE_INTERVAL=$_APP_COMPUTE_MAINTENANCE_INTERVAL
      - OPR_EXECUTOR_NETWORK=$_APP_COMPUTE_RUNTIMES_NETWORK
      - OPR_EXECUTOR_DOCKER_HUB_USERNAME=$_APP_DOCKER_HUB_USERNAME
      - OPR_EXECUTOR_DOCKER_HUB_PASSWORD=$_APP_DOCKER_HUB_PASSWORD
      - OPR_EXECUTOR_ENV=$_APP_ENV
      - 'OPR_EXECUTOR_RUNTIMES=${_APP_FUNCTIONS_RUNTIMES},${_APP_SITES_RUNTIMES}'
      - OPR_EXECUTOR_SECRET=$_APP_EXECUTOR_SECRET
      - OPR_EXECUTOR_RUNTIME_VERSIONS=v5
      - OPR_EXECUTOR_LOGGING_CONFIG=$_APP_LOGGING_CONFIG
      - OPR_EXECUTOR_STORAGE_DEVICE=$_APP_STORAGE_DEVICE
      - OPR_EXECUTOR_STORAGE_S3_ACCESS_KEY=$_APP_STORAGE_S3_ACCESS_KEY
      - OPR_EXECUTOR_STORAGE_S3_SECRET=$_APP_STORAGE_S3_SECRET
      - OPR_EXECUTOR_STORAGE_S3_REGION=$_APP_STORAGE_S3_REGION
      - OPR_EXECUTOR_STORAGE_S3_BUCKET=$_APP_STORAGE_S3_BUCKET
      - OPR_EXECUTOR_STORAGE_S3_ENDPOINT=$_APP_STORAGE_S3_ENDPOINT
      - OPR_EXECUTOR_STORAGE_DO_SPACES_ACCESS_KEY=$_APP_STORAGE_DO_SPACES_ACCESS_KEY
      - OPR_EXECUTOR_STORAGE_DO_SPACES_SECRET=$_APP_STORAGE_DO_SPACES_SECRET
      - OPR_EXECUTOR_STORAGE_DO_SPACES_REGION=$_APP_STORAGE_DO_SPACES_REGION
      - OPR_EXECUTOR_STORAGE_DO_SPACES_BUCKET=$_APP_STORAGE_DO_SPACES_BUCKET
      - OPR_EXECUTOR_STORAGE_BACKBLAZE_ACCESS_KEY=$_APP_STORAGE_BACKBLAZE_ACCESS_KEY
      - OPR_EXECUTOR_STORAGE_BACKBLAZE_SECRET=$_APP_STORAGE_BACKBLAZE_SECRET
      - OPR_EXECUTOR_STORAGE_BACKBLAZE_REGION=$_APP_STORAGE_BACKBLAZE_REGION
      - OPR_EXECUTOR_STORAGE_BACKBLAZE_BUCKET=$_APP_STORAGE_BACKBLAZE_BUCKET
      - OPR_EXECUTOR_STORAGE_LINODE_ACCESS_KEY=$_APP_STORAGE_LINODE_ACCESS_KEY
      - OPR_EXECUTOR_STORAGE_LINODE_SECRET=$_APP_STORAGE_LINODE_SECRET
      - OPR_EXECUTOR_STORAGE_LINODE_REGION=$_APP_STORAGE_LINODE_REGION
      - OPR_EXECUTOR_STORAGE_LINODE_BUCKET=$_APP_STORAGE_LINODE_BUCKET
      - OPR_EXECUTOR_STORAGE_WASABI_ACCESS_KEY=$_APP_STORAGE_WASABI_ACCESS_KEY
      - OPR_EXECUTOR_STORAGE_WASABI_SECRET=$_APP_STORAGE_WASABI_SECRET
      - OPR_EXECUTOR_STORAGE_WASABI_REGION=$_APP_STORAGE_WASABI_REGION
      - OPR_EXECUTOR_STORAGE_WASABI_BUCKET=$_APP_STORAGE_WASABI_BUCKET
  appwrite-mariadb:
    image: 'mariadb:10.11'
    container_name: appwrite-mariadb
    <<: *x-logging
    restart: unless-stopped
    networks:
      - appwrite-network
    volumes:
      - 'appwrite-mariadb:/var/lib/mysql:rw'
    environment:
      - 'MYSQL_ROOT_PASSWORD=${_APP_DB_ROOT_PASS}'
      - 'MYSQL_DATABASE=${_APP_DB_SCHEMA}'
      - 'MYSQL_USER=${_APP_DB_USER}'
      - 'MYSQL_PASSWORD=${_APP_DB_PASS}'
      - appwrite-MARIADB_AUTO_UPGRADE=1
    command: 'mysqld --innodb-flush-method=fsync'
  appwrite-redis:
    image: 'redis:7.2.4-alpine'
    container_name: appwrite-redis
    <<: *x-logging
    restart: unless-stopped
    command: >
      redis-server
      --maxmemory            512mb
      --maxmemory-policy     allkeys-lru
      --maxmemory-samples    5
    networks:
      - appwrite-network
    volumes:
      - 'appwrite-redis:/data:rw'
networks:
  coolify:
    name: coolify
    external: true
  appwrite-network:
    name: appwrite-internal-${COOLIFY_RESOURCE_UUID}
    driver: bridge
  appwrite-runtimes-network:
    name: ${_APP_COMPUTE_RUNTIMES_NETWORK}
    driver: bridge
volumes:
  appwrite-mariadb: {  }
  appwrite-redis: {  }
  appwrite-cache: {  }
  appwrite-uploads: {  }
  appwrite-imports: {  }
  appwrite-certificates: {  }
  appwrite-functions: {  }
  appwrite-sites: {  }
  appwrite-builds: {  }
  appwrite-config: {  }

appwrite.env

# Appwrite Environment Variables for Coolify Deployment
# Replace placeholder values with your actual configuration

# --- Core Settings ---
_APP_ENV=production
_APP_WORKER_PER_CORE=6
_APP_LOCALE=en
_APP_COMPRESSION_MIN_SIZE_BYTES=1000

# --- Console Access ---
_APP_CONSOLE_WHITELIST_ROOT=enabled
_APP_CONSOLE_WHITELIST_EMAILS=
_APP_CONSOLE_SESSION_ALERTS=enabled
_APP_CONSOLE_WHITELIST_IPS=
_APP_CONSOLE_HOSTNAMES=<!-[EDIT]- YOUR DOMAIN ->

# --- System Email ---
_APP_SYSTEM_EMAIL_NAME=<!-[EDIT]- EMAIL SENDER NAME ->
_APP_SYSTEM_EMAIL_ADDRESS=<!-[EDIT]- EMAIL SENDER EMAIL ->
# These are only needed if you configure appwrite to generate certificates
_APP_EMAIL_CERTIFICATES=
_APP_EMAIL_SECURITY=

# --- Security Options ---
_APP_SYSTEM_RESPONSE_FORMAT=
_APP_OPTIONS_ABUSE=enabled
_APP_OPTIONS_ROUTER_PROTECTION=enabled
# Coolify's Traefik handles this
_APP_OPTIONS_FORCE_HTTPS=disabled
# Coolify's Traefik handles this
_APP_OPTIONS_ROUTER_FORCE_HTTPS=disabled

# --- CRITICAL: Generate strong, unique 32-character random strings ---
_APP_OPENSSL_KEY_V1=<!-[EDIT]- YOUR SUPER SECRET APPWRITE OPENSSL KEY ->
_APP_EXECUTOR_SECRET=<!-[EDIT]- YOUR SUPER SECRET APPWRITE EXECUTOR KEY ->

# --- Domain Configuration ---
# Main API/Console domain
_APP_DOMAIN=<!-[EDIT]- YOUR DOMAIN ->
# Base for function subdomains (e.g., function-id.example.com)
_APP_DOMAIN_FUNCTIONS=<!-[EDIT]- YOUR DOMAIN ->
# Base for site subdomains (e.g., site-id.example.com)
_APP_DOMAIN_SITES=<!-[EDIT]- YOUR DOMAIN ->

# --- DNS Target (your server's public IP) ---
_APP_DOMAIN_TARGET_A=<!-[EDIT]- YOUR SERVER PUBLIC IPV4 ->
# Optional IPv6
_APP_DOMAIN_TARGET_AAAA=
_APP_DOMAIN_TARGET_CNAME=<!-[EDIT]- YOUR DOMAIN ->

# --- Database Configuration ---
_APP_DB_HOST=appwrite-mariadb
_APP_DB_PORT=3306
_APP_DB_SCHEMA=appwrite
_APP_DB_USER=<!-[EDIT]- CREATE A STRONG APPWRITE DB USER ->
_APP_DB_PASS=<!-[EDIT]- CREATE A STRONG APPWRITE DB PASSWORD ->
_APP_DB_ROOT_PASS=<!-[EDIT]- CREATE A STRONG MARIADB ROOT PASSWORD ->

# --- Redis Configuration ---
_APP_REDIS_HOST=appwrite-redis
_APP_REDIS_PORT=6379
## DO NOT SET A REDIS USER OR PASSWORD
## UNLESS YOU ARE USING AN EXTERNAL REDIS
_APP_REDIS_USER=
_APP_REDIS_PASS=

# --- SMTP Configuration (optional) ---
# e.g., smtp.mailgun.org
_APP_SMTP_HOST=
# e.g., 587
_APP_SMTP_PORT=
# 'tls', 'ssl', or empty
_APP_SMTP_SECURE=tls
_APP_SMTP_USERNAME=
_APP_SMTP_PASSWORD=

# --- Usage Statistics ---
_APP_USAGE_STATS=enabled

# --- Storage Settings ---
# 5GB
_APP_STORAGE_LIMIT=5000000000
# 10MB
_APP_STORAGE_PREVIEW_LIMIT=10000000
_APP_STORAGE_ANTIVIRUS=disabled
_APP_STORAGE_ANTIVIRUS_HOST=appwrite-clamav
_APP_STORAGE_ANTIVIRUS_PORT=3310
# 'local', 's3', 'dospaces', 'backblaze', 'linode', 'wasabi'
_APP_STORAGE_DEVICE=local

# --- S3 Storage (if using S3) ---
_APP_STORAGE_S3_ACCESS_KEY=
_APP_STORAGE_S3_SECRET=
_APP_STORAGE_S3_REGION=
_APP_STORAGE_S3_BUCKET=
_APP_STORAGE_S3_ENDPOINT=

# --- DigitalOcean Spaces (if using DO Spaces) ---
_APP_STORAGE_DO_SPACES_ACCESS_KEY=
_APP_STORAGE_DO_SPACES_SECRET=
_APP_STORAGE_DO_SPACES_REGION=
_APP_STORAGE_DO_SPACES_BUCKET=

# --- Backblaze B2 (if using Backblaze) ---
_APP_STORAGE_BACKBLAZE_ACCESS_KEY=
_APP_STORAGE_BACKBLAZE_SECRET=
_APP_STORAGE_BACKBLAZE_REGION=
_APP_STORAGE_BACKBLAZE_BUCKET=

# --- Linode Object Storage (if using Linode) ---
_APP_STORAGE_LINODE_ACCESS_KEY=
_APP_STORAGE_LINODE_SECRET=
_APP_STORAGE_LINODE_REGION=
_APP_STORAGE_LINODE_BUCKET=

# --- Wasabi (if using Wasabi) ---
_APP_STORAGE_WASABI_ACCESS_KEY=
_APP_STORAGE_WASABI_SECRET=
_APP_STORAGE_WASABI_REGION=
_APP_STORAGE_WASABI_BUCKET=

# --- Functions & Sites ---
# 10MB
_APP_COMPUTE_SIZE_LIMIT=10000000
# 15 minutes
_APP_FUNCTIONS_TIMEOUT=900
# 5 minutes
_APP_SITES_TIMEOUT=300
_APP_COMPUTE_BUILD_TIMEOUT=900
# 0 = unlimited
_APP_COMPUTE_CPUS=0
# 0 = unlimited
_APP_COMPUTE_MEMORY=0
# See the list of all available runtimes at
# https://appwrite.io/docs/products/functions/runtimes
_APP_FUNCTIONS_RUNTIMES=bun-1.1,node-22,go-1.23,python-3.11
_APP_SITES_RUNTIMES=bun-1.1,node-22,go-1.23,python-3.11
_APP_COMPUTE_INACTIVE_THRESHOLD=600
_APP_COMPUTE_MAINTENANCE_INTERVAL=86400
_APP_COMPUTE_RUNTIMES_NETWORK=appwrite-runtimes-${COOLIFY_RESOURCE_UUID}

# --- Executor Settings ---
_APP_EXECUTOR_HOST=http://openruntimes-executor:3000

# --- Logging ---
_APP_LOGGING_CONFIG=

# --- Maintenance Settings ---
# 24 hours
_APP_MAINTENANCE_INTERVAL=86400
# 1 hour
_APP_MAINTENANCE_DELAY=3600
_APP_MAINTENANCE_START_TIME=00:00
# 90 days
_APP_MAINTENANCE_RETENTION_EXECUTION=7776000
# 30 days
_APP_MAINTENANCE_RETENTION_CACHE=2592000
# 30 days
_APP_MAINTENANCE_RETENTION_ABUSE=2592000
# 14 days
_APP_MAINTENANCE_RETENTION_AUDIT=1209600
# 14 days
_APP_MAINTENANCE_RETENTION_AUDIT_CONSOLE=1209600
# 90 days
_APP_MAINTENANCE_RETENTION_USAGE_HOURLY=7776000
# 30 days
_APP_MAINTENANCE_RETENTION_SCHEDULES=2592000

# --- SMS Provider (optional) ---
# e.g., twilio://<ACCOUNT_SID>:<AUTH_TOKEN>@<API_HOST>
_APP_SMS_PROVIDER=
_APP_SMS_FROM=

# --- GraphQL Settings ---
_APP_GRAPHQL_MAX_BATCH_SIZE=10
_APP_GRAPHQL_MAX_COMPLEXITY=1000
_APP_GRAPHQL_MAX_DEPTH=10

# --- GitHub VCS Integration (optional) ---
_APP_VCS_GITHUB_APP_NAME=
_APP_VCS_GITHUB_PRIVATE_KEY=
_APP_VCS_GITHUB_APP_ID=
_APP_VCS_GITHUB_WEBHOOK_SECRET=
_APP_VCS_GITHUB_CLIENT_SECRET=
_APP_VCS_GITHUB_CLIENT_ID=

# --- Firebase Migrations (optional) ---
_APP_MIGRATIONS_FIREBASE_CLIENT_ID=
_APP_MIGRATIONS_FIREBASE_CLIENT_SECRET=

# --- AI Assistant (optional) ---
_APP_ASSISTANT_OPENAI_API_KEY=

# --- Docker Hub (optional, for custom runtimes) ---
_APP_DOCKER_HUB_USERNAME=
_APP_DOCKER_HUB_PASSWORD=

# --- Database Shared Tables ---
_APP_DATABASE_SHARED_TABLES=

# --- Stats Collection in Seconds ---
_APP_STATS_RESOURCES_INTERVAL=1800
_APP_USAGE_AGGREGATION_INTERVAL=3600

traefik-cloudflare.yml

# Configuration options for Cloudflare DNS Challenge
# https://go-acme.github.io/lego/dns/cloudflare/
version: '3.8'
networks:
  coolify:
    external: true
services:
  traefik:
    container_name: coolify-proxy
    image: 'traefik:v2.10' # Or the version Coolify defaults to
    restart: unless-stopped
    environment:
      # -------------------- REQUIRED --------------------
      # You can use either API Token (recommended) or API Key + Email
      # Option 1: API Token (recommended)
      - CLOUDFLARE_DNS_API_TOKEN=<-[EDIT]- PASTE YOUR CLOUDFLARE API TOKEN HERE ->
      # Option 2: API Key + Email (legacy)
      # - CLOUDFLARE_EMAIL=<-[EDIT]- YOUR CLOUDFLARE EMAIL HERE ->
      # - CLOUDFLARE_API_KEY=<-[EDIT]- YOUR CLOUDFLARE GLOBAL API KEY HERE ->
      
      # -------------------- OPTIONAL --------------------
      # API base URL (Default: https://api.cloudflare.com/client/v4)
      - CLOUDFLARE_BASE_URL=https://api.cloudflare.com/client/v4
      # API request timeout in seconds (Default: 30)
      - CLOUDFLARE_HTTP_TIMEOUT=30
      # Time between DNS propagation check in seconds (Default: 2)
      - CLOUDFLARE_POLLING_INTERVAL=2
      # Maximum waiting time for DNS propagation in seconds (Default: 120)
      - CLOUDFLARE_PROPAGATION_TIMEOUT=120
      # The TTL of the TXT record used for the DNS challenge in seconds (Default: 120)
      - CLOUDFLARE_TTL=120
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    networks:
      - coolify
    ports:
      - '80:80'
      - '443:443'
      - '8080:8080'
    healthcheck:
      test: 'wget -qO- http://localhost:80/ping || exit 1'
      interval: 4s
      timeout: 2s
      retries: 5
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock:ro'
      - '/data/coolify/proxy:/traefik'
    command:
      - '--ping=true'
      - '--ping.entrypoint=http'
      - '--api.dashboard=true'
      - '--api.insecure=false'
      - '--entrypoints.http.address=:80'
      - '--entrypoints.https.address=:443'
      - '--entrypoints.http.http.encodequerysemicolons=true'
      - '--entrypoints.https.http.encodequerysemicolons=true'
      - '--providers.docker.exposedbydefault=false'
      - '--providers.file.directory=/traefik/dynamic/'
      - '--providers.file.watch=true'
      - '--providers.docker=true'
      - '--providers.docker.network=coolify'

      # UNCOMMENT BELOW FOR TESTING
      # - '--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory'
      - '--certificatesresolvers.letsencrypt.acme.storage=/traefik/acme.json'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge=true'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.delayBeforeCheck=0'
      - '--certificatesresolvers.letsencrypt.acme.email=<-[EDIT]- YOUR EMAIL HERE ->'
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.entrypoints=http
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.services.traefik.loadbalancer.server.port=8080
      - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
      - traefik.http.middlewares.gzip.compress=true
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.service=api@internal"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik.<-[EDIT]- YOUR DOMAIN HERE ->`)"
      - "traefik.http.routers.traefik-secure.tls.domains[0].main=<-[EDIT]- YOUR DOMAIN HERE ->"
      - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.<-[EDIT]- YOUR DOMAIN HERE ->"

traefik-porkbun.yml

# Configuration options for Porkbun DNS Challenge
# https://go-acme.github.io/lego/dns/porkbun/
version: '3.8'
networks:
  coolify:
    external: true
services:
  traefik:
    container_name: coolify-proxy
    image: 'traefik:v2.10' # Or the version your Coolify is using
    restart: unless-stopped
    environment:
      # -------------------- REQUIRED --------------------
      - PORKBUN_API_KEY=<-[EDIT]- PASTE YOUR PORKBUN API TOKEN HERE ->
      - PORKBUN_API_SECRET=<-[EDIT]- PASTE YOUR PORKBUN API SECRET HERE ->
      
      # -------------------- OPTIONAL --------------------
      # API request timeout in seconds (Default: 30)
      - PORKBUN_HTTP_TIMEOUT=30
      # Time between DNS propagation check in seconds (Default: 10)
      - PORKBUN_POLLING_INTERVAL=10
      # Maximum waiting time for DNS propagation in seconds (Default: 600)
      - PORKBUN_PROPAGATION_TIMEOUT=600
      # The TTL of the TXT record used for the DNS challenge in seconds (Default: 300)
      - PORKBUN_TTL=300

    extra_hosts:
      - 'host.docker.internal:host-gateway'
    networks:
      - coolify
    ports:
      - '80:80'
      - '443:443'
      - '8080:8080'
    healthcheck:
      test: 'wget -qO- http://localhost:80/ping || exit 1'
      interval: 4s
      timeout: 2s
      retries: 5
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock:ro'
      - '/data/coolify/proxy:/traefik'
    command:
      - '--ping=true'
      - '--ping.entrypoint=http'
      - '--api.dashboard=true'
      - '--api.insecure=false'
      - '--entrypoints.http.address=:80'
      - '--entrypoints.https.address=:443'
      - '--entrypoints.http.http.encodequerysemicolons=true'
      - '--entrypoints.https.http.encodequerysemicolons=true'
      - '--providers.docker.exposedbydefault=false'
      - '--providers.file.directory=/traefik/dynamic/'
      - '--providers.file.watch=true'
      - '--providers.docker=true'
      - '--providers.docker.network=coolify'

      # UNCOMMENT BELOW FOR TESTING
      # - '--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory'
      - '--certificatesresolvers.letsencrypt.acme.storage=/traefik/acme.json'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge=true'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=porkbun'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.delayBeforeCheck=0'
      - '--certificatesresolvers.letsencrypt.acme.email=<-[EDIT]- YOUR EMAIL HERE ->'
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.entrypoints=http
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.services.traefik.loadbalancer.server.port=8080
      - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
      - traefik.http.middlewares.gzip.compress=true
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.service=api@internal"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik-secure.tls.domains[0].main=<-[EDIT]- YOUR DOMAIN HERE ->"
      - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.<-[EDIT]- YOUR DOMAIN HERE ->"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik.<-[EDIT]- YOUR DOMAIN HERE ->`)"

Thanks a lot! Working for me ❤️