From d02ad13f73b7ac117db6bedea4a7186e2a003da4 Mon Sep 17 00:00:00 2001
From: Elias Renman <elias.renman00@gmail.com>
Date: Thu, 25 Jun 2026 15:00:08 +0200
Subject: [PATCH] Add Telebit Docker Compose setup

---
 .dockerignore      |  2 ++
 .env.example       | 22 +++++++++++++++++
 .gitignore         |  1 +
 Dockerfile         | 21 +++++++++++++++++
 docker-compose.yml | 59 ++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 105 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 .env.example
 create mode 100644 .gitignore
 create mode 100644 Dockerfile
 create mode 100644 docker-compose.yml

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..d371036
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,2 @@
+.env
+.git
diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..3ab6bb4
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,22 @@
+# Build source for https://github.com/therootcompany/telebit.
+TELEBIT_REF=master
+
+# Host port published by Docker. Point external nginx upstreams here.
+TELEBIT_PORT=8085
+
+# Base domain assigned to devices, for example: device-a.devices.example.com.
+DOMAIN=devices.example.com
+
+# Public hostname clients use for the websocket tunnel.
+TUNNEL_DOMAIN=tunnel.example.com
+
+# Public hostname for the management API.
+MGMT_DOMAIN=mgmt.devices.example.com
+
+# Shared JWT secret for relay and management. Use at least 16 random chars.
+SECRET=change-me-to-a-long-random-secret
+
+# Internal postgres password.
+POSTGRES_PASSWORD=change-me-postgres-password
+
+VERBOSE=true
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4c49bd7
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.env
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..ba16d0a
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,21 @@
+FROM golang:1.22-alpine AS builder
+
+ARG TELEBIT_REF=master
+
+RUN apk add --no-cache git
+
+WORKDIR /src
+RUN git clone --depth 1 --branch "${TELEBIT_REF}" https://github.com/therootcompany/telebit.git .
+
+RUN go generate -mod=vendor ./...
+RUN CGO_ENABLED=0 go build -mod=vendor -ldflags="-s -w" -o /out/telebit-relay ./cmd/telebit
+RUN CGO_ENABLED=0 go build -mod=vendor -ldflags="-s -w" -o /out/telebit-mgmt ./cmd/mgmt
+
+FROM alpine:3.20
+
+RUN apk add --no-cache ca-certificates
+
+COPY --from=builder /out/telebit-relay /usr/local/bin/telebit-relay
+COPY --from=builder /out/telebit-mgmt /usr/local/bin/telebit-mgmt
+
+WORKDIR /var/lib/telebit
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..53757ab
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,59 @@
+services:
+  relay:
+    build:
+      context: .
+      args:
+        TELEBIT_REF: ${TELEBIT_REF:-master}
+    image: telebit-go:local
+    command: telebit-relay
+    restart: unless-stopped
+    depends_on:
+      mgmt:
+        condition: service_started
+    environment:
+      SECRET: ${SECRET:?set SECRET in .env}
+      API_HOSTNAME: ${TUNNEL_DOMAIN:?set TUNNEL_DOMAIN in .env}
+      LISTEN: :8085
+      LOCALS: https:${MGMT_DOMAIN:?set MGMT_DOMAIN in .env}:6468
+      AUTH_URL: http://mgmt:6468/api
+      ACME_RELAY_URL: http://mgmt:6468/api/acme-relay
+      VERBOSE: ${VERBOSE:-true}
+    ports:
+      - "${TELEBIT_PORT:-8085}:8085"
+    volumes:
+      - relay-acme:/var/lib/telebit/acme.d
+
+  mgmt:
+    image: telebit-go:local
+    command: telebit-mgmt
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      SECRET: ${SECRET:?set SECRET in .env}
+      DOMAIN: ${DOMAIN:?set DOMAIN in .env}
+      TUNNEL_DOMAIN: ${TUNNEL_DOMAIN:?set TUNNEL_DOMAIN in .env}
+      DB_URL: postgres://postgres:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/postgres?sslmode=disable
+      LISTEN: 0.0.0.0:6468
+    expose:
+      - "6468"
+
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: postgres
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+
+volumes:
+  postgres-data:
+  relay-acme: