infra/stacks/matrix.poneyworld.net/docker-compose.yml

# Le nom de projet ne suit PAS le dossier : les volumes existants sont
# préfixés `matrix_poneyworld_`. Retirer cette ligne ferait repartir Synapse
# sur une base et un magasin de médias vides.
name: matrix_poneyworld

services:
  synapse:
    image: matrixdotorg/synapse:v1.159.0
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    # Forme longue : `depends_on` court n'ordonne que le DÉMARRAGE, sans
    # attendre que la base accepte les connexions.
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    env_file:
      - env_file
    volumes:
      - matrix_data:/data
    networks:
      - default
      - traefik-proxy
      - smtp
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-proxy
      - traefik.http.routers.synapse.entrypoints=web-secure
      - traefik.http.routers.synapse.rule=Host(`synapse.poneyworld.net`)
      - traefik.http.routers.synapse.tls.certresolver=letsencrypt
      - traefik.http.services.synapse.loadbalancer.server.port=8008

  db:
    image: postgres:18.6
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    env_file:
      - env_file
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
      POSTGRES_INITDB_ARGS: --encoding=UTF-8 --lc-collate=C --lc-ctype=C
    volumes:
      - matrix_db:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 15s
      timeout: 3s
      retries: 20
      start_period: 30s
    networks:
      - default
    labels:
      backup.enable: true
      backup.type: postgres

  redis:
    image: valkey/valkey:9.1.1
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 15s
      timeout: 3s
      retries: 20
    networks:
      - default

  nginx:
    image: nginx:1.30.4
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    # `proxy_pass http://synapse:8008` est résolu au CHARGEMENT de la config :
    # sans ce depends_on, nginx s'arrête sur « host not found in upstream » au
    # démarrage de la machine et ne revient que par la boucle `restart`.
    depends_on:
      synapse:
        condition: service_healthy
    volumes:
      - ./nginx/matrix.conf:/etc/nginx/conf.d/matrix.conf:ro
      - ./nginx/www:/var/www/:ro
    networks:
      - default
      - traefik-proxy
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-proxy
      - traefik.http.routers.matrix_nginx.entrypoints=web-secure
      - traefik.http.routers.matrix_nginx.rule=Host(`matrix.poneyworld.net`)
      - traefik.http.routers.matrix_nginx.tls.certresolver=letsencrypt
      - traefik.http.routers.matrix_nginx.middlewares=crowdsec@file
      - traefik.http.services.matrix_nginx.loadbalancer.server.port=80

  web:
    image: vectorim/element-web:v1.12.26
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    volumes:
      - ./element/config.json:/app/config.json:ro
    networks:
      - default
      - traefik-proxy
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-proxy
      - traefik.http.routers.element.entrypoints=web-secure
      - traefik.http.routers.element.rule=Host(`chat.poneyworld.net`)
      - traefik.http.routers.element.tls.certresolver=letsencrypt
      - traefik.http.routers.element.middlewares=crowdsec@file
      - traefik.http.services.element.loadbalancer.server.port=80

  livekit:
    image: livekit/livekit-server:v1.13.5
    command: --config /etc/livekit.yaml
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    environment:
      # `keys:` a été retiré de livekit.yaml : la paire arrive ici, où
      # l'interpolation ${...} de Compose s'applique.
      LIVEKIT_KEYS: "${LIVEKIT_KEY:?}: ${LIVEKIT_SECRET:?}"
    volumes:
      - ./livekit/livekit.yaml:/etc/livekit.yaml:ro
    ports:
      - "7881:7881/tcp"
      - "50100-50200:50100-50200/udp"
    networks:
      - default
      - traefik-proxy
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-proxy
      - traefik.http.routers.livekit.entrypoints=web-secure
      - traefik.http.routers.livekit.rule=Host(`livekit.opytex.org`)
      - traefik.http.routers.livekit.tls.certresolver=letsencrypt
      - traefik.http.services.livekit.loadbalancer.server.port=7880

  lk-jwt:
    image: ghcr.io/element-hq/lk-jwt-service:0.6.0
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    depends_on:
      - livekit
    environment:
      # Pas de LIVEKIT_JWT_BIND : le healthcheck de l'image assemble
      # `http://localhost:` + la valeur, ce qui donne un double deux-points et
      # le fait échouer. Le défaut (:8080) est le seul réglage qui fonctionne.
      LIVEKIT_URL: wss://livekit.opytex.org
      LIVEKIT_KEY: ${LIVEKIT_KEY:?}
      LIVEKIT_SECRET: ${LIVEKIT_SECRET:?}
      LIVEKIT_FULL_ACCESS_HOMESERVERS: matrix.poneyworld.net
    networks:
      - default
      - traefik-proxy
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-proxy
      - traefik.http.routers.lkjwt.entrypoints=web-secure
      - traefik.http.routers.lkjwt.rule=Host(`livekit.opytex.org`) && (PathPrefix(`/sfu/get`) || PathPrefix(`/get_token`) || PathPrefix(`/healthz`))
      - traefik.http.routers.lkjwt.tls.certresolver=letsencrypt
      - traefik.http.services.lkjwt.loadbalancer.server.port=8080

  coturn:
    image: coturn/coturn:4.17.2
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    # Les deux secrets ne peuvent pas venir du fichier de conf : coturn n'y
    # interpole rien et n'offre aucune option `...File`. Voir README.md.
    command:
      - -c
      - /etc/coturn/turnserver.conf
      - --static-auth-secret=${TURN_STATIC_AUTH_SECRET:?}
      - --cli-password=${TURN_CLI_PASSWORD:?}
    volumes:
      - ./coturn/turnserver.conf:/etc/coturn/turnserver.conf:ro
    # `verbose` dans turnserver.conf journalise chaque allocation et chaque
    # permission : sans borne, le fichier json croît sans fin.
    logging:
      driver: "json-file"
      options:
        max-size: "1m"
    # 3478 doit être publié en UDP autant qu'en TCP : un client TURN tente
    # l'UDP en premier. 5349 (TURNS) reste en TCP seul, c'est du TLS.
    ports:
      - "3478:3478"
      - "3478:3478/udp"
      - "5349:5349"
      - "49160-49200:49160-49200/udp"
    networks:
      - default

volumes:
  matrix_data:
    labels:
      backup.enable: true
  matrix_db:

networks:
  traefik-proxy:
    external: true
  smtp:
    external: true