sqlite.yml

# Example with All Services Connected to SQLite
#
# Prerequisites:
# Add to /etc/hosts:
#   127.0.0.1 docker.internal matrix.docker.internal tom.docker.internal fed.docker.internal smtp.docker.internal

services:
  traefik:
    image: traefik:v2.11
    restart: unless-stopped
    command:
      - '--api.insecure=true'
      - '--api.dashboard=true'
      - '--providers.docker=true'
      - '--providers.docker.exposedbydefault=false'
      - '--entrypoints.web.address=:80'
      - '--entrypoints.websecure.address=:443'
      - '--entrypoints.web.http.redirections.entrypoint.to=websecure'
      - '--entrypoints.web.http.redirections.entrypoint.scheme=https'
      - '--log.level=INFO'
    ports:
      - '80:80'
      - '443:443'
      - '8080:8080'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      default:
        aliases:
          - docker.internal
          - smtp.docker.internal
          - matrix.docker.internal
          - tom.docker.internal
          - fed.docker.internal
    labels:
      # --- REQUIRED: Enable Traefik on itself so it reads the middleware labels ---
      - "traefik.enable=true"

      # --- CORS MIDDLEWARE (FIXED FOR CREDENTIALS) ---
      # Note: When AllowCredentials is true, AllowOrigin cannot be "*"
      - "traefik.http.middlewares.cors-policy.headers.accesscontrolallowmethods=GET,OPTIONS,POST,PUT,DELETE,PATCH"
      - "traefik.http.middlewares.cors-policy.headers.accesscontrolalloworiginlist=https://app.element.io,https://chat.docker.internal,https://tom.docker.internal,https://matrix.docker.internal,https://auth.docker.internal,https://fed.docker.internal"
      - "traefik.http.middlewares.cors-policy.headers.accesscontrolallowheaders=*"
      - "traefik.http.middlewares.cors-policy.headers.accesscontrolallowcredentials=true"
      - "traefik.http.middlewares.cors-policy.headers.accesscontrolmaxage=100"
      - "traefik.http.middlewares.cors-policy.headers.addvaryheader=true"
    healthcheck:
      test: ['CMD-SHELL', 'wget -q --spider http://localhost:8080/api/overview || exit 1']
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 5s

  ldap:
    image: osixia/openldap:1.5.0
    environment:
      LDAP_ORGANISATION: 'Docker'
      LDAP_DOMAIN: 'docker.internal'
      LDAP_ADMIN_PASSWORD: 'admin'
      LDAP_CONFIG_PASSWORD: 'config'
      LDAP_READONLY_USER: 'false'
      LDAP_RFC2307BIS_SCHEMA: 'false'
      LDAP_BACKEND: 'mdb'
      LDAP_TLS: 'false'
      LDAP_LOG_LEVEL: '256'
      LDAP_REMOVE_CONFIG_AFTER_SETUP: 'false'
      DISABLE_CHOWN: 'true'
    volumes:
      - ../ldap/bootstrap:/container/service/slapd/assets/config/bootstrap/ldif/custom
    healthcheck:
      test:
        [
          'CMD-SHELL',
          "ldapsearch -x -b 'dc=docker,dc=internal' -H ldap://localhost || exit 1",
        ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  smtp:
    image: changemakerstudiosus/papercut-smtp:latest
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.smtp.rule=Host(`smtp.docker.internal`)'
      - 'traefik.http.routers.smtp.entrypoints=websecure'
      - 'traefik.http.routers.smtp.tls=true'
      - 'traefik.http.routers.smtp.middlewares=cors-policy'
      - 'traefik.http.services.smtp.loadbalancer.server.port=37408'

  synapse:
    image: matrixdotorg/synapse:v1.119.0
    restart: unless-stopped
    depends_on:
      traefik: { condition: service_healthy }
    volumes:
      - ../synapse/.data:/data
      - ../synapse/hs-config/sqlite.yaml:/data/homeserver.yaml:ro
      - ../synapse/docker.internal.log.config:/data/docker.internal.log.config:ro
      - ../synapse/docker.internal.signing.key:/data/docker.internal.signing.key:ro
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.synapse.rule=Host(`matrix.docker.internal`)'
      - 'traefik.http.routers.synapse.entrypoints=websecure'
      - 'traefik.http.routers.synapse.tls=true'
      - 'traefik.http.routers.synapse.priority=10'
      - 'traefik.http.routers.synapse.middlewares=cors-policy'
      - 'traefik.http.services.synapse.loadbalancer.server.port=8008'
    healthcheck:
      test: ['CMD-SHELL', 'curl -f http://localhost:8008/_matrix/client/versions || exit 1']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  tom:
    image: linagora/tom-server
    build:
      context: ../..
      dockerfile: ./Dockerfile
    depends_on:
      synapse: { condition: service_healthy }
      ldap: { condition: service_healthy }
      smtp: { condition: service_started }
      traefik: { condition: service_healthy }
    volumes:
      - ../synapse/.data:/data
    environment:
      - NODE_TLS_REJECT_UNAUTHORIZED=0

      - SERVER_NAME=docker.internal
      - BASE_URL=http://tom.docker.internal
      - TRUSTED_PROXIES=uniquelocal

      - FEDERATED_IDENTITY_SERVICES=fed.docker.internal

      - DATABASE_ENGINE=sqlite
      - DATABASE_HOST=file:tom?mode=memory&cache=shared

      - USERDB_ENGINE=ldap
      - LDAP_URI=ldap://ldap
      - LDAP_BASE=ou=users,dc=docker,dc=internal
      - LDAP_FILTER=(objectClass=inetOrgPerson)
      # - LDAP_USER=uid=tom,dc=docker,dc=internal  ## Local LDAP is fully readable
      # - LDAP_PASSWORD=T0m_p@Ss                   ## Local LDAP is fully readable

      - MATRIX_INTERNAL_HOST=http://synapse:8008
      - MATRIX_SERVER=matrix.docker.internal
      - MATRIX_DATABASE_ENGINE=sqlite
      - MATRIX_DATABASE_HOST=/data/homeserver.db

      - SMS_API_URL=https://api.octopush.com/v1/public

      - SMTP_SERVER=smtp
      - SMTP_PORT=2525
      - SMTP_SENDER=no-reply@docker.internal

      - LOG_LEVEL=silly
      - LOG_TRANSPORTS=Console

      # - FEATURE_CREATEROOM_PROXY_ENABLED=true
      # - FEATURE_CREATEROOM_PROXY_MAX_RETRIES=3
      # - FEATURE_CREATEROOM_PROXY_NUKE_ROOM=true
      # - FEATURE_CREATEROOM_PROXY_DEFAULT_PRESET=private_chat
      # - FEATURE_CREATEROOM_PROXY_ENCRYPTION=allowed          # allowed | enforced | disabled
      # - FEATURE_CREATEROOM_PROXY_IS_DIRECT_MASK={"ban":100,"invite":100,"kick":100,"redact":100,"state_default":100,"users_default":10,"creator_becomes":10}
      # - FEATURE_CREATEROOM_PROXY_PRESETS=[{"name":"trusted_private_chat","default_visibility":"private","allow_is_direct":true,"users_default":10,"events_default":10,"invite":10,"state_default":100,"kick":10,"ban":10,"redact":10,"notifications":{"room":10},"events":{"m.reaction":10,"m.room.redaction":10,"m.room.pinned_events":10,"org.matrix.msc3401.call":10,"org.matrix.msc3401.call.member":10,"m.room.name":10,"m.room.topic":10,"m.room.avatar":10,"m.room.server_acl":10,"m.room.tombstone":10,"m.room.history_visibility":10,"m.room.power_levels":10,"m.room.encryption":10},"creator_becomes":10},{"name":"private_chat","default_visibility":"private","allow_is_direct":true,"users_default":10,"events_default":10,"invite":10,"state_default":90,"kick":50,"ban":50,"redact":50,"notifications":{"room":10},"events":{"m.reaction":10,"m.room.redaction":10,"m.room.pinned_events":10,"org.matrix.msc3401.call":10,"org.matrix.msc3401.call.member":10,"m.room.name":80,"m.room.topic":80,"m.room.avatar":80,"m.room.server_acl":80,"m.room.tombstone":80,"m.room.history_visibility":80,"m.room.power_levels":80,"m.room.encryption":90},"creator_becomes":90},{"name":"public_chat","default_visibility":"public","allow_is_direct":false,"users_default":10,"events_default":10,"invite":0,"state_default":90,"kick":50,"ban":50,"redact":50,"notifications":{"room":10},"events":{"m.reaction":10,"m.room.redaction":10,"m.room.pinned_events":50,"org.matrix.msc3401.call":50,"org.matrix.msc3401.call.member":10,"m.room.name":80,"m.room.topic":80,"m.room.avatar":80,"m.room.server_acl":80,"m.room.tombstone":80,"m.room.history_visibility":80,"m.room.power_levels":80,"m.room.encryption":100},"creator_becomes":90},{"name":"private_channel","synapse_preset":"private_chat","default_visibility":"private","allow_is_direct":false,"users_default":10,"events_default":80,"invite":50,"state_default":90,"kick":50,"ban":50,"redact":80,"notifications":{"room":80},"events":{"m.reaction":10,"m.room.redaction":80,"m.room.pinned_events":50,"org.matrix.msc3401.call":100,"org.matrix.msc3401.call.member":100,"m.room.name":80,"m.room.topic":80,"m.room.avatar":80,"m.room.server_acl":80,"m.room.tombstone":80,"m.room.history_visibility":90,"m.room.power_levels":50,"m.room.encryption":90},"creator_becomes":90},{"name":"public_channel","synapse_preset":"public_chat","default_visibility":"public","allow_is_direct":false,"users_default":10,"events_default":80,"invite":0,"state_default":90,"kick":50,"ban":50,"redact":80,"notifications":{"room":80},"events":{"m.reaction":10,"m.room.redaction":80,"m.room.pinned_events":50,"org.matrix.msc3401.call":100,"org.matrix.msc3401.call.member":100,"m.room.name":80,"m.room.topic":80,"m.room.avatar":80,"m.room.server_acl":80,"m.room.tombstone":80,"m.room.history_visibility":100,"m.room.power_levels":50,"m.room.encryption":100},"creator_becomes":90}]
    labels:
      - 'traefik.enable=true'

      # Direct access via tom.docker.internal
      - 'traefik.http.routers.tom-direct.rule=Host(`tom.docker.internal`)'
      - 'traefik.http.routers.tom-direct.entrypoints=websecure'
      - 'traefik.http.routers.tom-direct.tls=true'
      - 'traefik.http.routers.tom-direct.priority=110'
      - 'traefik.http.routers.tom-direct.middlewares=cors-policy'

      # Handle .well-known endpoints
      - 'traefik.http.routers.tom-wellknown.rule=(Host(`matrix.docker.internal`) || Host(`docker.internal`)) && PathPrefix(`/.well-known/matrix/client`)'
      - 'traefik.http.routers.tom-wellknown.entrypoints=websecure'
      - 'traefik.http.routers.tom-wellknown.tls=true'
      - 'traefik.http.routers.tom-wellknown.priority=100'
      - 'traefik.http.routers.tom-wellknown.middlewares=cors-policy'

      # Handle Matrix Identity Server API
      - 'traefik.http.routers.tom-identity.rule=Host(`matrix.docker.internal`) && PathPrefix(`/_matrix/identity/v2`)'
      - 'traefik.http.routers.tom-identity.entrypoints=websecure'
      - 'traefik.http.routers.tom-identity.tls=true'
      - 'traefik.http.routers.tom-identity.priority=90'
      - 'traefik.http.routers.tom-identity.middlewares=cors-policy'

      # Handle specific Matrix Client API endpoints (createRoom, profile)
      # - 'traefik.http.routers.tom-matrix-client.rule=Host(`matrix.docker.internal`) && (PathPrefix(`/_matrix/client/v3/createRoom`) || PathPrefix(`/_matrix/client/v3/profile`))'
      # - 'traefik.http.routers.tom-matrix-client.entrypoints=websecure'
      # - 'traefik.http.routers.tom-matrix-client.tls=true'
      # - 'traefik.http.routers.tom-matrix-client.priority=80'
      # - 'traefik.http.routers.tom-matrix-client.middlewares=cors-policy'

      # Service configuration
      - 'traefik.http.services.tom.loadbalancer.server.port=3000'

  fed:
    image: linagora/tom-federated-identity-service
    build:
      context: ../..
      dockerfile: ./packages/federated-identity-service/Dockerfile
    depends_on:
      traefik: { condition: service_healthy }
    environment:
      - NODE_TLS_REJECT_UNAUTHORIZED=0

      - BASE_URL=http://fed.docker.internal
      - SERVER_NAME=docker.internal
      - TRUSTED_PROXIES=uniquelocal
      - TRUSTED_SERVERS_ADDRESSES=172.0.0.0/8

      - DATABASE_ENGINE=sqlite
      - DATABASE_HOST=file:fed?mode=memory&cache=shared

      ## For storing the federated identity raw users
      # - USERDB_ENGINE=ldap
      # - LDAP_URI=ldap://ldap
      # - LDAP_BASE=ou=users,dc=docker,dc=internal
      # - LDAP_FILTER=(objectClass=inetOrgPerson)
      # - LDAP_USER=uid=fed,dc=docker,dc=internal  ## Local LDAP is fully readable
      # - LDAP_PASSWORD=F3d_p@Ss                   ## Local LDAP is fully readable

      - LOG_LEVEL=silly
      - LOG_TRANSPORTS=Console
    labels:
      - 'traefik.enable=true'

      # Direct access via fed.docker.internal
      - 'traefik.http.routers.fed-direct.rule=Host(`fed.docker.internal`)'
      - 'traefik.http.routers.fed-direct.entrypoints=websecure'
      - 'traefik.http.routers.fed-direct.tls=true'
      - 'traefik.http.routers.fed-direct.middlewares=cors-policy'

      # Service configuration
      - 'traefik.http.services.fed.loadbalancer.server.port=3000'