name: matrix-guide

x-defaults: &defaults
  restart: unless-stopped
  logging:
    driver: json-file
    options:
      max-size: "10m"
      max-file: "3"

services:
  traefik:
    <<: *defaults
    image: traefik:v3@sha256:c549d482c55d7a797398562064f35428cc53e748d84d7190997930e7b31bcc32
    mem_limit: 768m
    mem_reservation: 256m
    pids_limit: 256
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.matrix-federation.address=:8448
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:?Run configure.py}
      - --certificatesresolvers.letsencrypt.acme.storage=/data/acme.json
      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
      - --log.level=INFO
    ports:
      - "80:80"
      - "443:443"
      - "8448:8448"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/traefik:/data
    networks: [proxy]

  postgres:
    <<: *defaults
    image: postgres:15-alpine@sha256:fe0737ba566a2c5b2a28f34433c0a423261900ec17b9bf7ad115e1aae7e57f1b
    mem_limit: 1g
    mem_reservation: 256m
    pids_limit: 256
    environment:
      POSTGRES_USER: synapse
      POSTGRES_DB: synapse
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Run configure.py}
      POSTGRES_INITDB_ARGS: --encoding=UTF-8 --lc-collate=C --lc-ctype=C
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    networks: [database]
    healthcheck:
      test: [CMD-SHELL, "pg_isready -U synapse -d synapse"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 20s

  synapse:
    <<: *defaults
    image: ghcr.io/element-hq/synapse:v1.159.0@sha256:edf259d2b575b669a3e81024918ab8d5cfb7d2fba5a53c9e09695f1abc5645cb
    user: "${SYNAPSE_UID:?Run configure.py}:${SYNAPSE_GID:?Run configure.py}"
    mem_limit: 2g
    mem_reservation: 512m
    pids_limit: 512
    environment:
      SYNAPSE_CONFIG_PATH: /data/homeserver.yaml
    volumes:
      - ./data/synapse:/data
      - ./generated/homeserver.yaml:/data/homeserver.yaml:ro
      - ./generated/log.config:/data/log.config:ro
    ports:
      - "127.0.0.1:8008:8008"
    depends_on:
      postgres:
        condition: service_healthy
    networks: [database, proxy]
    labels:
      - traefik.enable=true
      - traefik.docker.network=${COMPOSE_PROJECT_NAME:-matrix-guide}-proxy
      - traefik.http.routers.matrix.rule=Host(`${MATRIX_HOST:?Run configure.py}`) && !PathPrefix(`/_synapse/admin`)
      - traefik.http.routers.matrix.entrypoints=websecure,matrix-federation
      - traefik.http.routers.matrix.tls=true
      - traefik.http.routers.matrix.tls.certresolver=letsencrypt
      - traefik.http.services.matrix.loadbalancer.server.port=8008

  element:
    <<: *defaults
    image: vectorim/element-web:latest@sha256:7050130b263bbcf0e4ad8da875a2821cd89dc55b2f04e93aaa13f682d013019e
    mem_limit: 128m
    mem_reservation: 32m
    pids_limit: 64
    volumes:
      - ./generated/element.json:/app/config.json:ro
    networks: [proxy]
    labels:
      - traefik.enable=true
      - traefik.docker.network=${COMPOSE_PROJECT_NAME:-matrix-guide}-proxy
      - traefik.http.routers.element.rule=Host(`${ELEMENT_HOST:?Run configure.py}`)
      - traefik.http.routers.element.entrypoints=websecure
      - traefik.http.routers.element.tls=true
      - traefik.http.routers.element.tls.certresolver=letsencrypt
      - traefik.http.services.element.loadbalancer.server.port=80

  coturn:
    <<: *defaults
    image: coturn/coturn:latest@sha256:aa68aab64a3b929d57fc2924c98ea447bf996cf8dade2508e7b71eaf23f1f14e
    mem_limit: 256m
    mem_reservation: 64m
    pids_limit: 128
    network_mode: host
    volumes:
      - ./generated/turnserver.conf:/etc/coturn/turnserver.conf:ro
    command: ["-c", "/etc/coturn/turnserver.conf"]

  livekit:
    <<: *defaults
    image: livekit/livekit-server:v1.10.0@sha256:6ff9c33d21ae1b92b7f5a86bc55890a3e5b8ebe7b8a847349c5ee326e90ac965
    mem_limit: 512m
    mem_reservation: 128m
    pids_limit: 256
    command: ["--config", "/etc/livekit/livekit.yaml"]
    volumes:
      - ./generated/livekit.yaml:/etc/livekit/livekit.yaml:ro
    ports:
      - "7881:7881/tcp"
      - "7882:7882/udp"
    networks: [proxy]
    labels:
      - traefik.enable=true
      - traefik.docker.network=${COMPOSE_PROJECT_NAME:-matrix-guide}-proxy
      - traefik.http.routers.rtc-livekit.rule=Host(`${RTC_HOST:?Run configure.py}`) && !PathPrefix(`/livekit/jwt`)
      - traefik.http.routers.rtc-livekit.entrypoints=websecure
      - traefik.http.routers.rtc-livekit.tls=true
      - traefik.http.routers.rtc-livekit.tls.certresolver=letsencrypt
      - traefik.http.services.rtc-livekit.loadbalancer.server.port=7880

  lk-jwt-service:
    <<: *defaults
    image: ghcr.io/element-hq/lk-jwt-service:0.4.1@sha256:6beec945a59b9b8b02161d29884abc2c1e5af9a376c1a2ccabbec3e26b07cf0c
    mem_limit: 128m
    mem_reservation: 32m
    pids_limit: 64
    environment:
      LIVEKIT_URL: wss://${RTC_HOST:?Run configure.py}
      LIVEKIT_KEY: matrixrtc
      LIVEKIT_SECRET: ${LIVEKIT_SECRET:?Run configure.py}
      LIVEKIT_JWT_BIND: :8080
      LIVEKIT_FULL_ACCESS_HOMESERVERS: ${MATRIX_HOST:?Run configure.py}
    depends_on: [livekit]
    networks: [proxy]
    labels:
      - traefik.enable=true
      - traefik.docker.network=${COMPOSE_PROJECT_NAME:-matrix-guide}-proxy
      - traefik.http.routers.rtc-jwt.rule=Host(`${RTC_HOST:?Run configure.py}`) && PathPrefix(`/livekit/jwt`)
      - traefik.http.routers.rtc-jwt.entrypoints=websecure
      - traefik.http.routers.rtc-jwt.tls=true
      - traefik.http.routers.rtc-jwt.tls.certresolver=letsencrypt
      - traefik.http.middlewares.rtc-jwt-strip.stripprefix.prefixes=/livekit/jwt
      - traefik.http.routers.rtc-jwt.middlewares=rtc-jwt-strip
      - traefik.http.services.rtc-jwt.loadbalancer.server.port=8080

networks:
  database:
    internal: true
  proxy:
    name: ${COMPOSE_PROJECT_NAME:-matrix-guide}-proxy