Add Hasura GraphQL Engine container with nginx proxy

Adds Hasura v2.44.0 service connected to the existing Postgres database,
proxied through nginx at /hasura/ with WebSocket support for the console.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -30,6 +30,7 @@ services:
             - backend
             - icecast2
             - gitea
+            - hasura
         networks:
             - app-network
         ports:
@@ -83,6 +84,21 @@ services:
         volumes:
             - dbdata:/var/lib/postgresql/data
 
+    hasura:
+        image: hasura/graphql-engine:v2.44.0
+        container_name: "${HASURA_HOST}"
+        restart: always
+        depends_on:
+            - db
+        networks:
+            - app-network
+        environment:
+            HASURA_GRAPHQL_DATABASE_URL: "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}"
+            HASURA_GRAPHQL_ADMIN_SECRET: "${HASURA_GRAPHQL_ADMIN_SECRET}"
+            HASURA_GRAPHQL_ENABLE_CONSOLE: "true"
+            HASURA_GRAPHQL_DEV_MODE: "true"
+            HASURA_GRAPHQL_ENABLED_LOG_TYPES: "startup, http-log, webhook-log, websocket-log, query-log"
+
     icecast2:
         build:
             context: ./icecast2

nginx/entrypoint.sh

@@ -12,12 +12,12 @@ if [ "$DEV_MODE" = "true" ]; then
       -out "$CERT_DIR/fullchain.pem" \
       -subj "/CN=localhost" 2>/dev/null
   fi
-  envsubst '${DOMAIN} ${BACKEND_HOST} ${BACKEND_PORT} ${BACKEND_ENDPOINT} ${ICECAST_HOST} ${ICECAST_PORT} ${GITEA_HOST} ${GITEA_PORT}' \
+  envsubst '${DOMAIN} ${BACKEND_HOST} ${BACKEND_PORT} ${BACKEND_ENDPOINT} ${ICECAST_HOST} ${ICECAST_PORT} ${GITEA_HOST} ${GITEA_PORT} ${HASURA_HOST} ${HASURA_PORT}' \
     </etc/nginx/nginx_dev.conf.template \
     >/etc/nginx/nginx.conf
 elif [ -f "/etc/letsencrypt/live/$DOMAIN/fullchain.pem" ] && [ -f "/etc/letsencrypt/live/$DOMAIN/privkey.pem" ]; then
   echo "Certificates found. Using production nginx config."
-  envsubst '${DOMAIN} ${BACKEND_HOST} ${BACKEND_PORT} ${BACKEND_ENDPOINT} ${ICECAST_HOST} ${ICECAST_PORT} ${GITEA_HOST} ${GITEA_PORT}' \
+  envsubst '${DOMAIN} ${BACKEND_HOST} ${BACKEND_PORT} ${BACKEND_ENDPOINT} ${ICECAST_HOST} ${ICECAST_PORT} ${GITEA_HOST} ${GITEA_PORT} ${HASURA_HOST} ${HASURA_PORT}' \
     </etc/nginx/nginx.conf.template \
     >/etc/nginx/nginx.conf
 else

nginx/nginx.conf.template

@@ -197,6 +197,21 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
 
+        location /hasura {
+            return 301 /hasura/;
+        }
+
+        location /hasura/ {
+            proxy_pass http://$HASURA_HOST:$HASURA_PORT/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+
     }
 
 }

nginx/nginx_dev.conf.template

@@ -129,6 +129,21 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
 
+        location /hasura {
+            return 301 /hasura/;
+        }
+
+        location /hasura/ {
+            proxy_pass http://$HASURA_HOST:$HASURA_PORT/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+
     }
 
     server {
@@ -223,6 +238,21 @@ http {
             proxy_set_header X-Forwarded-Proto $scheme;
         }
 
+        location /hasura {
+            return 301 /hasura/;
+        }
+
+        location /hasura/ {
+            proxy_pass http://$HASURA_HOST:$HASURA_PORT/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+
     }
 
 }