Deploy Sally Office on Linux

docker pull sallysuite/sally-office

docker load -i sally-office.tar
docker images        # verify

docker run -d -p 3000:3000 sallysuite/sally-office

project-root/
├── docker-compose.yml          # symlink or copy of *.sqlite.yml / *.postgres.yml
└── nginx-proxy/
    ├── nginx.conf               # section 5
    └── ssl/
        ├── localhost.pem
        └── localhost-key.pem

# SQLite (lightweight)
docker compose up -d -f docker-compose.sqlite.yml
 
# PostgreSQL (production)
docker compose up -d -f docker-compose.postgres.yml

services:
  app:
    image: sally-office:latest
    restart: always
    ports: ["3000:3000"]
    environment:
      NEXTAUTH_URL: "https://localhost"
      DOMAIN_NAME: "https://localhost"
      ADMIN_EMAILS: "admin@sallyoffice.com"
      ADMIN_PASSWORD: "admin123"
      NEXTAUTH_SECRET: "SALLYOFFICE" # change in prod
      NEXT_PUBLIC_VERCEL_ENV: production
      ENABLE_ADMIN_AUTH: "true"
 
  nginx-proxy:
    image: nginx:alpine
    container_name: nginx-proxy
    restart: always
    ports: ["80:80", "443:443"]
    volumes:
      - ./nginx-proxy/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./nginx-proxy/ssl:/etc/nginx/ssl:ro
    depends_on: [app]

services:
  app:
    image: sally-office:latest
    restart: always
    ports: ["3000:3000"]
    depends_on: [db]
    environment:
      NEXTAUTH_URL: "https://localhost"
      DOMAIN_NAME: "https://localhost"
      ADMIN_EMAILS: "admin@sallyoffice.com"
      ADMIN_PASSWORD: "admin123"
      NEXTAUTH_SECRET: "SALLYOFFICE"
      NEXT_PUBLIC_VERCEL_ENV: production
      ENABLE_ADMIN_AUTH: "true"
      POSTGRES_DATABASE: sallyoffice
      POSTGRES_HOST: db
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: passowrd01
      DATABASE_URL: postgres://postgres:passowrd01@db:5432/sallyoffice
 
  db:
    image: postgres:16-alpine
    container_name: postgres-db
    restart: always
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: passowrd01
      POSTGRES_DB: sallyoffice
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports: ["5432:5432"] # remove if internal only
 
  nginx-proxy:
    image: nginx:alpine
    container_name: nginx-proxy
    restart: always
    ports: ["80:80", "443:443"]
    volumes:
      - ./nginx-proxy/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./nginx-proxy/ssl:/etc/nginx/ssl:ro
    depends_on: [app]
 
volumes:
  postgres_data:

# ---------------- HTTP ----------------
server {
    listen 80 default_server;
    server_name _;
    return 301 https://$host$request_uri;
}
 
# ---------------- HTTPS ----------------
server {
    listen 443 ssl http2;
    server_name _;
 
    ssl_certificate      /etc/nginx/ssl/localhost.pem;
    ssl_certificate_key  /etc/nginx/ssl/localhost-key.pem;
    ssl_protocols        TLSv1.2 TLSv1.3;
    ssl_ciphers          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_timeout 1d;
    ssl_session_cache   shared:SSL:50m;
    ssl_session_tickets off;
    # add_header Strict-Transport-Security "max-age=63072000" always;  # enable after testing
 
    # static libs & fonts – cache 1 day
    location ~* ^/(lib|font) {
        proxy_pass http://app:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        expires 1d;
        add_header Cache-Control "public, max-age=86400";
        gzip on;
        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
        gzip_comp_level 6;
        gzip_min_length 1000;
    }
 
    # streaming chat proxy – no buffering
    location /api/chat_proxy {
        proxy_pass http://app:3000;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        chunked_transfer_encoding on;
        proxy_buffering off;
        proxy_cache off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
 
    # default frontend
    location / {
        proxy_pass http://app:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

openssl req -x509 -newkey rsa:4096 -nodes \
  -keyout localhost-key.pem -out localhost.pem -days 365 \
  -subj "/CN=localhost"

# logs
docker compose logs -f app
docker compose logs -f nginx-proxy
 
# restart
docker compose restart
 
# update image
docker compose pull && docker compose up -d