Docker-compose for a peertube production instance

.env

PEERTUBE_DB_USERNAME=postgres_user
PEERTUBE_DB_PASSWORD=postgres_password
PEERTUBE_WEBSERVER_HOSTNAME=domain.tld
# If you need more than one IP as trust_proxy
# pass them as a comma separated array:
PEERTUBE_TRUST_PROXY=["127.0.0.1", "loopback", "172.18.0.0/16"]
#PEERTUBE_SMTP_USERNAME=
#PEERTUBE_SMTP_PASSWORD=
PEERTUBE_SMTP_HOSTNAME=postfix
PEERTUBE_SMTP_PORT=25
PEERTUBE_SMTP_FROM=noreply@domain.tld
PEERTUBE_SMTP_TLS=false
PEERTUBE_SMTP_DISABLE_STARTTLS=false
PEERTUBE_ADMIN_EMAIL=admin@domain.com
PEERTUBE_DOCKER_IMAGE=chocobozzz/peertube:production-stretch
# /!\ Prefer to use the PeerTube admin interface to set the following configurations /!\
#PEERTUBE_SIGNUP_ENABLED=true
#PEERTUBE_TRANSCODING_ENABLED=true
#PEERTUBE_CONTACT_FORM_ENABLED=true

docker-compose.yml

version: "3.3"

services:

  reverse-proxy:
    image: traefik:v2.1
    network_mode: "host"
    command:
      - --providers.docker # Tells Træfik to listen to docker
      - --providers.docker.exposedByDefault=false  # Don't expose containers by default through Traefik
      - --entrypoints.web.address=:80
      - --entrypoints.web-secure.address=:443
      - --certificatesresolvers.cr.acme.httpchallenge=true
      - --certificatesresolvers.cr.acme.httpchallenge.entrypoint=web
      - --certificatesresolvers.cr.acme.email=${PEERTUBE_ADMIN_EMAIL}
      - --certificatesresolvers.cr.acme.storage=/etc/traefik/acme.json
      # If you want to test/debug uncomment the following lines
      #- --log.level=DEBUG
      #- --certificatesresolvers.cr.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
    ports:
      - "80:80"     # The HTTP port
      - "443:443"   # The HTTPS port
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
      #- ./docker-volume/traefik:/etc/traefik
    restart: "always"
    # If you want to use the Traefik dashboard, you should expose it on a
    # subdomain with HTTPS and authentification:
    # https://medium.com/@xavier.priour/secure-traefik-dashboard-with-https-and-password-in-docker-5b657e2aa15f
    # https://github.com/containous/traefik/issues/880#issuecomment-310301168

  peertube:
    # If you don't want to use the official image and build one from sources
    # build:
    #   context: .
    #   dockerfile: ./support/docker/production/Dockerfile.stretch
    image: ${PEERTUBE_DOCKER_IMAGE}
    env_file:
      - .env
    # Traefik labels are suggested as an example for people using Traefik,
    # remove them if you are using another reverse proxy.
    labels: 
      - traefik.enable=true
      - traefik.http.routers.peertube.rule=Host(`${PEERTUBE_WEBSERVER_HOSTNAME}`)
      - traefik.http.services.peertube.loadbalancer.server.port=9000
      - traefik.http.routers.peertube.entrypoints=web-secure
      - traefik.http.routers.peertube.tls.certresolver=cr # Name certificate resolver
      # Redirect http to https
      - traefik.http.routers.peertube-insecure.rule=Host(`${PEERTUBE_WEBSERVER_HOSTNAME}`)
      - traefik.http.routers.peertube-insecure.entrypoints=web
      - traefik.http.routers.peertube-insecure.middlewares=https-only
      - traefik.http.middlewares.https-only.redirectscheme.scheme=https # Apply middleware redirect
    # If you don't want to use a reverse proxy (not suitable for production!)
    # ports:
      # - "80:9000"
    volumes:
      - ./docker-volume/data:/data
      - ./docker-volume/config:/config
    depends_on:
      - postgres
      - redis
      - postfix
    restart: "always"

  postgres:
    image: postgres:10-alpine
    environment:
      POSTGRES_USER: ${PEERTUBE_DB_USERNAME}
      POSTGRES_PASSWORD: ${PEERTUBE_DB_PASSWORD}
      POSTGRES_DB: peertube
    volumes:
      - ./docker-volume/db:/var/lib/postgresql/data
    restart: "always"

  redis:
    image: redis:4-alpine
    volumes:
      - ./docker-volume/redis:/data
    restart: "always"

  postfix:
    image: mwader/postfix-relay
    environment:
      - POSTFIX_myhostname=${PEERTUBE_WEBSERVER_HOSTNAME}
    restart: "always"

networks:
  default:
    ipam:
      driver: default
      config:
      - subnet:  172.18.0.0/16

For those who are behind cloudflare / traefik reverse proxy (or both)
add this directly to environment: of peertube service:

- PEERTUBE_TRUST_PROXY=["127.0.0.1", "loopback", "172.18.0.0/16", "10.0.0.0/16", "173.245.48.0/20", "103.21.244.0/22","103.22.200.0/22","103.31.4.0/22","141.101.64.0/18","108.162.192.0/18","190.93.240.0/20","188.114.96.0/20","197.234.240.0/22","198.41.128.0/17","162.158.0.0/15","104.16.0.0/12","172.64.0.0/13","131.0.72.0/22"]

Here's the updated PEERTUBE_TRUST_PROXY

- PEERTUBE_TRUST_PROXY=["127.0.0.1", "loopback", "172.18.0.0/16", "10.0.0.0/16", "173.245.48.0/20", "103.21.244.0/22","103.22.200.0/22","103.31.4.0/22","141.101.64.0/18","108.162.192.0/18","190.93.240.0/20","188.114.96.0/20","197.234.240.0/22","198.41.128.0/17","162.158.0.0/15","104.16.0.0/13","104.24.0.0/14","172.64.0.0/13","131.0.72.0/22"]

The list of cloudflare ip ranges can be found at
https://www.cloudflare.com/en-gb/ips/