Add docker-compose.yml for deploying upaas (closes #223)

The compose file builds the image from this repo, mounts the Docker
socket and HOST_DATA_DIR (passed to upaas as UPAAS_HOST_DATA_DIR),
reads settings from .env, and restarts unless stopped. The port is
published on 127.0.0.1 only, for a TLS-terminating proxy in front.
PORT and UPAAS_DATA_DIR are pinned so .env cannot move upaas off the
port mapping, the healthcheck (busybox wget) or the data mount.

upaas now refuses to start when UPAAS_HOST_DATA_DIR is set to a
relative path; when unset it still falls back to the data directory.

The README's plain-HTTP Compose example becomes a short deploy section
that points at the file. .env is added to .dockerignore.

Model: opus-5-5

README.md

@@ -229,15 +229,17 @@ settings from a `.env` file next to it, which needs at least:
 HOST_DATA_DIR=/srv/upaas/data
 ```
 
-Other settings from [Configuration](#configuration) go in the same file. Then
+Other settings from [Configuration](#configuration) go in the same file, except
-run `docker compose up -d` from the repo root; `docker compose ps` shows the
+`PORT` and `UPAAS_DATA_DIR`: the compose file sets them to 8080 and
-container as healthy once `/health` answers.
+`/var/lib/upaas`, overriding `.env`, to match its port mapping, healthcheck and
+data directory mount. Then run `docker compose up -d` from the repo root;
+`docker compose ps` shows the container as healthy once `/health` answers.
 
 **Important**: `HOST_DATA_DIR` **must** be an **absolute path** on the host. It
 is bind-mounted into the container and passed as `UPAAS_HOST_DATA_DIR` so that
-Docker bind mounts during builds resolve correctly. Relative paths (e.g.
+Docker bind mounts during builds resolve correctly, because the Docker daemon
-`./data`) will break container builds because the Docker daemon resolves paths
+resolves paths on the host, not in the container. upaas refuses to start when
-relative to the host, not the container.
+`UPAAS_HOST_DATA_DIR` is a relative path such as `./data`.
 
 The port is published on `127.0.0.1:8080` only, for a TLS-terminating reverse
 proxy in front of it. Leave `UPAAS_PLAINTEXT_HTTP` unset behind that proxy.

TODO.md

@@ -23,7 +23,8 @@ regress.
 - 2026-09-28: Added `docker-compose.yml` for deploying upaas: settings from
   `.env`, the port published on `127.0.0.1` only for a TLS proxy in front, and a
   healthcheck against `/health`; the README's plain-HTTP Compose example is
-  replaced by a short deploy section (#223).
+  replaced by a short deploy section. upaas now refuses to start when
+  `UPAAS_HOST_DATA_DIR` is set to a relative path (#223).
 
 - 2026-09-23: Apps are now built with BuildKit, so the stages of a multi-stage
   build stay in Docker's size-limited build cache instead of piling up as

docker-compose.yml

@@ -7,6 +7,12 @@ services:
     # Every line of .env is passed to upaas as an environment variable.
     env_file: .env
     environment:
+      # Overrides any PORT in .env, so upaas listens where the port mapping
+      # and healthcheck below expect it.
+      PORT: "8080"
+      # Overrides any UPAAS_DATA_DIR in .env, so the database stays on the
+      # HOST_DATA_DIR mount below instead of inside the container.
+      UPAAS_DATA_DIR: /var/lib/upaas
       # The Docker daemon resolves app bind mounts on the host, so upaas must
       # know the host path of its data directory.
       UPAAS_HOST_DATA_DIR: ${HOST_DATA_DIR:?set HOST_DATA_DIR in .env to an absolute host path}

internal/config/config.go

@@ -32,6 +32,12 @@ const (
 	filePermissions = 0o600
 )
 
+// errHostDataDirNotAbsolute is returned when UPAAS_HOST_DATA_DIR is set to a
+// relative path, which the Docker daemon cannot resolve for app bind mounts.
+var errHostDataDirNotAbsolute = errors.New(
+	"UPAAS_HOST_DATA_DIR must be an absolute path",
+)
+
 // Params contains dependencies for Config.
 type Params struct {
 	fx.In
@@ -124,6 +130,10 @@ func buildConfig(log *slog.Logger, params *Params) (*Config, error) {
 	dataDir := viper.GetString("DATA_DIR")
 	hostDataDir := viper.GetString("HOST_DATA_DIR")
 
+	if hostDataDir != "" && !filepath.IsAbs(hostDataDir) {
+		return nil, fmt.Errorf("%w, got %q", errHostDataDirNotAbsolute, hostDataDir)
+	}
+
 	if hostDataDir == "" {
 		hostDataDir = dataDir
 	}

internal/config/config_test.go

@@ -0,0 +1,33 @@
+package config //nolint:testpackage // tests unexported buildConfig
+
+import (
+	"errors"
+	"log/slog"
+	"testing"
+)
+
+func TestBuildConfigRejectsRelativeHostDataDir(t *testing.T) {
+	t.Setenv("UPAAS_HOST_DATA_DIR", "./data")
+	setupViper("upaas")
+
+	_, err := buildConfig(slog.Default(), &Params{})
+	if !errors.Is(err, errHostDataDirNotAbsolute) {
+		t.Fatalf("expected errHostDataDirNotAbsolute, got %v", err)
+	}
+}
+
+func TestBuildConfigHostDataDirDefaultsToDataDir(t *testing.T) {
+	t.Setenv("UPAAS_DATA_DIR", "./data")
+	t.Setenv("UPAAS_HOST_DATA_DIR", "")
+	t.Setenv("UPAAS_SESSION_SECRET", "test-secret")
+	setupViper("upaas")
+
+	cfg, err := buildConfig(slog.Default(), &Params{})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if cfg.HostDataDir != "./data" {
+		t.Errorf("expected HostDataDir ./data, got %q", cfg.HostDataDir)
+	}
+}