feat(stasks): migrate matrix

stacks/matrix.poneyworld.net/docker-compose.yml

@@ -0,0 +1,155 @@
+# Le nom de projet ne suit PAS le dossier : les volumes existants sont
+# préfixés `matrix_poneyworld_`. Retirer cette ligne ferait repartir Synapse
+# sur une base et un magasin de médias vides.
+name: matrix_poneyworld
+
+services:
+  synapse:
+    image: matrixdotorg/synapse:v1.148.0
+    restart: unless-stopped
+    env_file:
+      - env_file
+    volumes:
+      - matrix_data:/data
+    networks:
+      - default
+      - traefik-proxy
+      - smtp
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-proxy
+      - traefik.http.routers.synapse.entrypoints=web-secure
+      - traefik.http.routers.synapse.rule=Host(`synapse.poneyworld.net`)
+      - traefik.http.routers.synapse.tls.certresolver=letsencrypt
+      - traefik.http.services.synapse.loadbalancer.server.port=8008
+
+  db:
+    image: postgres:18
+    restart: unless-stopped
+    env_file:
+      - env_file
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
+      POSTGRES_INITDB_ARGS: --encoding=UTF-8 --lc-collate=C --lc-ctype=C
+    volumes:
+      - matrix_db:/var/lib/postgresql
+    networks:
+      - default
+    labels:
+      backup.enable: true
+      backup.type: postgres
+
+  redis:
+    image: valkey/valkey:8.1
+    restart: unless-stopped
+    networks:
+      - default
+
+  nginx:
+    image: nginx:latest
+    restart: unless-stopped
+    volumes:
+      - ./nginx/matrix.conf:/etc/nginx/conf.d/matrix.conf:ro
+      - ./nginx/www:/var/www/:ro
+    networks:
+      - default
+      - traefik-proxy
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-proxy
+      - traefik.http.routers.matrix_nginx.entrypoints=web-secure
+      - traefik.http.routers.matrix_nginx.rule=Host(`matrix.poneyworld.net`)
+      - traefik.http.routers.matrix_nginx.tls.certresolver=letsencrypt
+      - traefik.http.services.matrix_nginx.loadbalancer.server.port=80
+
+  web:
+    image: vectorim/element-web:v1.12.11
+    restart: unless-stopped
+    volumes:
+      - ./element/config.json:/app/config.json:ro
+    networks:
+      - default
+      - traefik-proxy
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-proxy
+      - traefik.http.routers.element.entrypoints=web-secure
+      - traefik.http.routers.element.rule=Host(`chat.poneyworld.net`)
+      - traefik.http.routers.element.tls.certresolver=letsencrypt
+      - traefik.http.services.element.loadbalancer.server.port=80
+
+  livekit:
+    image: livekit/livekit-server:latest
+    command: --config /etc/livekit.yaml
+    restart: unless-stopped
+    environment:
+      # `keys:` a été retiré de livekit.yaml : la paire arrive ici, où
+      # l'interpolation ${...} de Compose s'applique.
+      LIVEKIT_KEYS: "${LIVEKIT_KEY:?}: ${LIVEKIT_SECRET:?}"
+    volumes:
+      - ./livekit/livekit.yaml:/etc/livekit.yaml:ro
+    ports:
+      - "7881:7881/tcp"
+      - "50100-50200:50100-50200/udp"
+    networks:
+      - default
+      - traefik-proxy
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-proxy
+      - traefik.http.routers.livekit.entrypoints=web-secure
+      - traefik.http.routers.livekit.rule=Host(`livekit.opytex.org`)
+      - traefik.http.routers.livekit.tls.certresolver=letsencrypt
+      - traefik.http.services.livekit.loadbalancer.server.port=7880
+
+  lk-jwt:
+    image: ghcr.io/element-hq/lk-jwt-service:latest
+    restart: unless-stopped
+    environment:
+      LIVEKIT_JWT_BIND: ":8081"
+      LIVEKIT_URL: wss://livekit.opytex.org
+      LIVEKIT_KEY: ${LIVEKIT_KEY:?}
+      LIVEKIT_SECRET: ${LIVEKIT_SECRET:?}
+      LIVEKIT_FULL_ACCESS_HOMESERVERS: matrix.poneyworld.net
+    networks:
+      - default
+      - traefik-proxy
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-proxy
+      - traefik.http.routers.lkjwt.entrypoints=web-secure
+      - traefik.http.routers.lkjwt.rule=Host(`livekit.opytex.org`) && (PathPrefix(`/sfu/get`) || PathPrefix(`/get_token`) || PathPrefix(`/healthz`))
+      - traefik.http.routers.lkjwt.tls.certresolver=letsencrypt
+      - traefik.http.services.lkjwt.loadbalancer.server.port=8081
+
+  coturn:
+    image: coturn/coturn:4.9
+    restart: unless-stopped
+    # Les deux secrets ne peuvent pas venir du fichier de conf : coturn n'y
+    # interpole rien et n'offre aucune option `...File`. Voir README.md.
+    command:
+      - -c
+      - /etc/coturn/turnserver.conf
+      - --static-auth-secret=${TURN_STATIC_AUTH_SECRET:?}
+      - --cli-password=${TURN_CLI_PASSWORD:?}
+    volumes:
+      - ./coturn/turnserver.conf:/etc/coturn/turnserver.conf:ro
+    # 3478 et 5349 sont publiés en TCP seul, sans /udp. Voir README.md.
+    ports:
+      - "3478:3478"
+      - "5349:5349"
+      - "49160-49200:49160-49200/udp"
+    networks:
+      - default
+
+volumes:
+  matrix_data:
+    labels:
+      backup.enable: true
+  matrix_db:
+
+networks:
+  traefik-proxy:
+    external: true
+  smtp:
+    external: true