Self-hosting. Remnawave

services:
    remnawave-db:
        image: postgres:17
        container_name: 'remnawave-db'
        hostname: remnawave-db
        restart: always
        env_file:
            - .env
        environment:
            - POSTGRES_USER=${POSTGRES_USER}
            - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
            - POSTGRES_DB=${POSTGRES_DB}
            - TZ=UTC
        ports:
            - 6767:5432
        volumes:
            - remnawave-db-data:/var/lib/postgresql/data
        networks:
            - remnawave-network
        healthcheck:
            test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}']
            interval: 3s
            timeout: 10s
            retries: 3

    remnawave:
        image: remnawave/backend:dev
        container_name: 'remnawave'
        hostname: remnawave
        restart: always
        ports:
            - 3030:3000
            - 3001:3001
        env_file:
            - .env
        networks:
            - remnawave-network
        depends_on:
            remnawave-db:
                condition: service_healthy
            remnawave-redis:
                condition: service_healthy

    remnawave-subscription-page:
        image: remnawave/subscription-page:latest
        container_name: remnawave-subscription-page
        hostname: remnawave-subscription-page
        restart: always
        environment:
            - REMNAWAVE_PLAIN_DOMAIN=remnawave:3000
            - REQUEST_REMNAWAVE_SCHEME=http
            - SUBSCRIPTION_PAGE_PORT=3010
            - CUSTOM_SUB_PREFIX=sub
            - META_TITLE="Страница подписки"
            - META_DESCRIPTION="Ваша персональная страница подписки на VPN"
        ports:
            - 3010:3010
        networks:
            - remnawave-network

    remnawave-redis:
        image: valkey/valkey:8.0.2-alpine
        container_name: remnawave-redis
        hostname: remnawave-redis
        restart: always
        networks:
            - remnawave-network
        volumes:
            - remnawave-redis-data:/data
        healthcheck:
            test: ['CMD', 'valkey-cli', 'ping']
            interval: 3s
            timeout: 10s
            retries: 3

networks:
    remnawave-network:
        name: remnawave-network
        driver: bridge
        external: false

volumes:
    remnawave-db-data:
        driver: local
        external: false
        name: remnawave-db-data
    remnawave-redis-data:
        driver: local
        external: false
        name: remnawave-redis-data

### APP ###
APP_PORT=3000
METRICS_PORT=3001


### API ###
# Possible values: max (start instances on all cores), number (start instances on number of cores), -1 (start instances on all cores - 1)
# !!! Do not set this value more that physical cores count in your machine !!!
API_INSTANCES=1

### DATABASE ###
# FORMAT: postgresql://{user}:{password}@{host}:{port}/{database}
DATABASE_URL="postgresql://postgres:postgres@remnawave-db:5432/postgres"

### REDIS ###
REDIS_HOST=remnawave-redis
REDIS_PORT=6379

### JWT ###
### CHANGE DEFAULT VALUES ###
JWT_AUTH_SECRET=<secret>
JWT_API_TOKENS_SECRET=<secret>

### TELEGRAM ###
IS_TELEGRAM_NOTIFICATIONS_ENABLED=true
TELEGRAM_BOT_TOKEN=<secret>
TELEGRAM_NOTIFY_USERS_CHAT_ID=<secret>
TELEGRAM_NOTIFY_NODES_CHAT_ID=<secret>
TELEGRAM_NOTIFY_USERS_THREAD_ID=<secret>
TELEGRAM_NOTIFY_NODES_THREAD_ID=<secret>

### FRONT_END ###
FRONT_END_DOMAIN=panel.<domain>.ru

### SUBSCRIPTION PUBLIC DOMAIN ###
### RAW DOMAIN, WITHOUT HTTP/HTTPS, DO NOT PLACE / to end of domain ###
### Used in "profile-web-page-url" response header ###
SUB_PUBLIC_DOMAIN=sub.<domain>.ru/sub

### SWAGGER ###
SWAGGER_PATH=/docs
SCALAR_PATH=/scalar
IS_DOCS_ENABLED=true

### PROMETHEUS ###
### Metrics are available at /metrics
METRICS_USER=user
METRICS_PASS=password

### WEBHOOK ###
WEBHOOK_ENABLED=false
### Only https:// is allowed
WEBHOOK_URL=https://webhook.site/1234567890
### This secret is used to sign the webhook payload, must be exact 64 characters. Only a-z, 0-9, A-Z are allowed.
WEBHOOK_SECRET_HEADER=<secret>

### Database ###
### For Postgres Docker container ###
# NOT USED BY THE APP ITSELF
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
POSTGRES_DB=postgres

Для генерации новых секретных ключей воспользоваться командой:

openssl rand -hex 64

Параметры телеграмм для работы с супер группами доступны с версии 1.5.6 (dev) и являются не обязательными:

NODES_NOTIFY_THREAD_ID
TELEGRAM_ADMIN_THREAD_ID

Для панели применяется в общем виде стандартный шаблон с защитой через authentik:

http:
  routers:
    remnawave:
      rule: "Host(`panel.<domain>.ru`)"
      entrypoints:
        - http   
      middlewares:
        - remnawave-https-redirect
        - authentik
      service: remnawave
          
    remnawave-secure:
      rule: "Host(`panel.<domain>.ru`)"
      entrypoints:
        - https
      middlewares:
        - authentik
      tls: true
      service: remnawave

  middlewares:
    remnawave-https-redirect:
      redirectScheme:
        scheme: https

  services:
    remnawave:
      loadBalancer:
        servers:
          - url: "http://192.168.0.132:3030"

Для страницы подписки защита authentik не используется для свободного доступа пользователей:

http:
  routers:
    sub-remnawave:
      rule: "Host(`sub.<domain>.ru`)"
      entrypoints:
        - http   
      middlewares:
        - sub-remnawave-https-redirect
      service: sub-remnawave
          
    sub-remnawave-secure:
      rule: "Host(`sub.<domain>.ru`)"
      entrypoints:
        - https
      tls: true
      service: sub-remnawave

  middlewares:
    sub-remnawave-https-redirect:
      redirectScheme:
        scheme: https

  services:
    sub-remnawave:
      loadBalancer:
        servers:
          - url: "http://192.168.0.132:3010"