nexo/services/core/compose/README.md

Core Compose

This compose file mirrors the current Mattermost-based runtime shape inside the services/core module.

Local Runtime

cd services/core/compose
cp -n .env.example .env
docker compose pull
docker compose up -d

latest is the verified stable pointer for nexo-owned runtime images. When running or updating, you should run docker compose pull && docker compose up -d to fetch the latest stable images.

Runtime state is written to services/core/data/, which is ignored by git. Place push-proxy configuration under services/core/data/push-proxy/config/mattermost-push-proxy.json when FCM smoke testing is needed.

The default host ports are 18065 for core and 18066 for push-proxy so this test deployment can run beside the existing Mattermost service.

The Docker network subnet is fixed to 172.38.0.0/16. Treat this range as reserved for nexo and do not reuse it for other Docker networks.

Secret Boundary

Commit only .env.example. Keep .env, runtime data, logs, push-proxy credentials, certificates, and license files out of git. If a new credential or runtime path is added, first add the example variable or documented path here, then confirm the concrete value or generated file is ignored.

Smoke Checks

Run these checks after docker compose up -d.

curl -fsS "http://localhost:${NEXO_CORE_PORT:-18065}/api/v4/system/ping"
docker compose exec db pg_isready -U mmuser -d mattermost
curl -fsSI "http://localhost:${NEXO_CORE_PORT:-18065}"

The core ping response should report status as OK, Postgres should accept connections for the mattermost database, and the Mattermost app should return an HTTP response from the mapped core port.

For the minimum push-proxy smoke, confirm the service is running and the core service still points at the compose-network DNS name:

docker compose ps push-proxy
docker compose config | rg --fixed-strings \
  "MM_EMAILSETTINGS_PUSHNOTIFICATIONSERVER=http://push-proxy:8066"

FCM/APNS credential validation is not part of the default smoke. Run it only when a real push-proxy config is present outside git.

Remote Parity

The remote development copy lives under ~/docker/services/nexo/compose. Local and remote compose inputs should match unless a work report explicitly records an intentional temporary drift.

cd services/core/compose
sha256sum docker-compose.yml .env.example
ssh <host> 'cd ~/docker/services/nexo/compose && sha256sum docker-compose.yml .env.example'

The two sha256sum outputs should match for both files before remote runtime smoke is treated as equivalent to local compose smoke.