From 091bfcaef63b4780de6776482d4e188bf2ff1d9c Mon Sep 17 00:00:00 2001
From: Adam French <adam.a.french@outlook.com>
Date: Sun, 29 Mar 2026 20:06:19 +0100
Subject: [PATCH] Add Hasura GraphQL Engine container with nginx proxy

Adds Hasura v2.44.0 service connected to the existing Postgres database,
proxied through nginx at /hasura/ with WebSocket support for the console.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 docker-compose.yml            | 16 ++++++++++++++++
 nginx/entrypoint.sh           |  4 ++--
 nginx/nginx.conf.template     | 15 +++++++++++++++
 nginx/nginx_dev.conf.template | 30 ++++++++++++++++++++++++++++++
 4 files changed, 63 insertions(+), 2 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 484dd81..b7b13dc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -30,6 +30,7 @@ services:
             - backend
             - icecast2
             - gitea
+            - hasura
         networks:
             - app-network
         ports:
@@ -83,6 +84,21 @@ services:
         volumes:
             - dbdata:/var/lib/postgresql/data
 
+    hasura:
+        image: hasura/graphql-engine:v2.44.0
+        container_name: "${HASURA_HOST}"
+        restart: always
+        depends_on:
+            - db
+        networks:
+            - app-network
+        environment:
+            HASURA_GRAPHQL_DATABASE_URL: "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}"
+            HASURA_GRAPHQL_ADMIN_SECRET: "${HASURA_GRAPHQL_ADMIN_SECRET}"
+            HASURA_GRAPHQL_ENABLE_CONSOLE: "true"
+            HASURA_GRAPHQL_DEV_MODE: "true"
+            HASURA_GRAPHQL_ENABLED_LOG_TYPES: "startup, http-log, webhook-log, websocket-log, query-log"
+
     icecast2:
         build:
             context: ./icecast2
diff --git a/nginx/entrypoint.sh b/nginx/entrypoint.sh
index 46f991d..d568544 100755
--- a/nginx/entrypoint.sh
+++ b/nginx/entrypoint.sh
@@ -12,12 +12,12 @@ if [ "$DEV_MODE" = "true" ]; then
       -out "$CERT_DIR/fullchain.pem" \
       -subj "/CN=localhost" 2>/dev/null
   fi
-  envsubst '${DOMAIN} ${BACKEND_HOST} ${BACKEND_PORT} ${BACKEND_ENDPOINT} ${ICECAST_HOST} ${ICECAST_PORT} ${GITEA_HOST} ${GITEA_PORT}' \
+  envsubst '${DOMAIN} ${BACKEND_HOST} ${BACKEND_PORT} ${BACKEND_ENDPOINT} ${ICECAST_HOST} ${ICECAST_PORT} ${GITEA_HOST} ${GITEA_PORT} ${HASURA_HOST} ${HASURA_PORT}' \
     </etc/nginx/nginx_dev.conf.template \
     >/etc/nginx/nginx.conf
 elif [ -f "/etc/letsencrypt/live/$DOMAIN/fullchain.pem" ] && [ -f "/etc/letsencrypt/live/$DOMAIN/privkey.pem" ]; then
   echo "Certificates found. Using production nginx config."
-  envsubst '${DOMAIN} ${BACKEND_HOST} ${BACKEND_PORT} ${BACKEND_ENDPOINT} ${ICECAST_HOST} ${ICECAST_PORT} ${GITEA_HOST} ${GITEA_PORT}' \
+  envsubst '${DOMAIN} ${BACKEND_HOST} ${BACKEND_PORT} ${BACKEND_ENDPOINT} ${ICECAST_HOST} ${ICECAST_PORT} ${GITEA_HOST} ${GITEA_PORT} ${HASURA_HOST} ${HASURA_PORT}' \
     </etc/nginx/nginx.conf.template \
     >/etc/nginx/nginx.conf
 else
diff --git a/nginx/nginx.conf.template b/nginx/nginx.conf.template
index e62e05b..f04be15 100644
--- a/nginx/nginx.conf.template
+++ b/nginx/nginx.conf.template
@@ -197,6 +197,21 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
 
+        location /hasura {
+            return 301 /hasura/;
+        }
+
+        location /hasura/ {
+            proxy_pass http://$HASURA_HOST:$HASURA_PORT/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+
     }
 
 }
diff --git a/nginx/nginx_dev.conf.template b/nginx/nginx_dev.conf.template
index 6d4ab3b..170b537 100644
--- a/nginx/nginx_dev.conf.template
+++ b/nginx/nginx_dev.conf.template
@@ -129,6 +129,21 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
 
+        location /hasura {
+            return 301 /hasura/;
+        }
+
+        location /hasura/ {
+            proxy_pass http://$HASURA_HOST:$HASURA_PORT/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+
     }
 
     server {
@@ -223,6 +238,21 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
 
+        location /hasura {
+            return 301 /hasura/;
+        }
+
+        location /hasura/ {
+            proxy_pass http://$HASURA_HOST:$HASURA_PORT/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+
     }
 
 }