compose.yml

# FIXME: define a frontend & backend network, and only expose backend services to the frontend (nginx)

networks:
  backend:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.25.0.0/16
          gateway: 172.25.0.1

secrets:
  postgres_password:
    file: secrets/postgres/postgres_password
  synapse_signing_key:
    file: secrets/synapse/signing.key
  hookshot_passkey:
    file: secrets/hookshot/hookshot_passkey
  hookshot_github_key:
    file: secrets/hookshot/hookshot_github_key
  livekit_api_key:
    file: secrets/livekit/livekit_api_key
  livekit_secret_key:
    file: secrets/livekit/livekit_secret_key

services:
  # dependencies for optionally generating default configs + secrets
  generate-synapse-secrets:
    build:
      dockerfile: Dockerfile
    user: $USER_ID:$GROUP_ID
    restart: "no"
    volumes:
      - ${VOLUME_PATH}/data/synapse:/data:rw
      - ${VOLUME_PATH}/init/generate-synapse-secrets.sh:/entrypoint.sh
    env_file: .env
    environment:
      SYNAPSE_CONFIG_DIR: /data
      SYNAPSE_CONFIG_PATH: /data/homeserver.yaml.default
      SYNAPSE_SERVER_NAME: ${DOMAIN}
      SYNAPSE_REPORT_STATS: ${REPORT_STATS}
    entrypoint: "/entrypoint.sh"

  # We are disabled the Matrix Auth Service for now due to the lack of support for the E2EE with bridges
  # generate-mas-secrets:
  #   restart: "no"
  #   image: ghcr.io/element-hq/matrix-authentication-service:latest
  #   user: $USER_ID:$GROUP_ID
  #   volumes:
  #     - ${VOLUME_PATH}/data/mas:/data:rw
  #   # FIXME: stop this regenerating a spurious default config every time
  #   # We can't do the same approach as synapse (unless use a debug image of MAS) as MAS is distroless and has no bash.
  #   command: "config generate -o /data/config.yaml.default"

  # dependency for templating /data-template into /data (having extracted any secrets from any default generated configs)
  init:
    build: init
    user: $USER_ID:$GROUP_ID
    restart: "no"
    volumes:
      - ${VOLUME_PATH}/secrets:/secrets
      - ${VOLUME_PATH}/data:/data
      - ${VOLUME_PATH}/data-template:/data-template
      - ${VOLUME_PATH}/init/init.sh:/init.sh
    command: "/init.sh"
    env_file: .env
    depends_on:
      generate-synapse-secrets:
        condition: service_completed_successfully
      # We are disabled the Matrix Auth Service for now due to the lack of support for the E2EE with bridges
      # generate-mas-secrets:
      #   condition: service_completed_successfully

  nginx:
    image: nginx:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8448:8448"
    # shutdown fast so we can iterate rapidly on compose.yml
    stop_grace_period: 5s
    volumes:
      - ${VOLUME_PATH}/data/nginx/conf.d:/etc/nginx/conf.d
      - ${VOLUME_PATH}/data/nginx/www:/var/www
      - ${VOLUME_PATH}/data/ssl:/etc/nginx/ssl
      # - /etc/letsencrypt/live/${DOMAIN}:/etc/nginx/ssl
    command: '/bin/sh -c ''while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"'''
    networks:
      backend:
        aliases: # so our containers can resolve the LB
          - $DOMAIN
          - $HOMESERVER_FQDN
          - $HOOKSHOT_FQDN
          - $WEB_CLIENT_FQDN
          - $CALL_CLIENT_FQDN
          - $ADMIN_WEB_CLIENT_FQDN
          # We are disabled the Matrix Auth Service for now due to the lack of support for the E2EE with bridges
          # - $MAS_FQDN
    depends_on:
      init:
        condition: service_completed_successfully

  # certbot:
  #   image: certbot/dns-cloudflare:latest
  #   restart: unless-stopped
  #   volumes:
  #     - ${VOLUME_PATH}/data/certbot/conf:/etc/letsencrypt
  #     - ${VOLUME_PATH}/data/certbot/www:/var/www/certbot
  #     - ${VOLUME_PATH}/data/ssl:/data/ssl
  #   entrypoint: "/bin/sh -c 'trap exit TERM; \
  #     while [ -e /etc/letsencrypt/live ]; \
  #     do sleep 30; certbot --webroot -w /var/www/certbot renew; \
  #     cp /etc/letsencrypt/live/$DOMAIN/*.pem /data/ssl; \
  #     sleep 12h & wait $${!}; \
  #     done;'"

  postgres:
    image: postgres:latest
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/data/postgres:/var/lib/postgresql/data:rw
      - ${VOLUME_PATH}/scripts/create-multiple-postgresql-databases.sh:/docker-entrypoint-initdb.d/create-multiple-postgresql-databases.sh
    networks:
      - backend
    environment:
      POSTGRES_MULTIPLE_DATABASES: synapse,mas,mautrix_telegram
      POSTGRES_USER: matrix
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      POSTGRES_INITDB_ARGS: --encoding=UTF8 --locale=C
      PGDATA: /var/lib/postgresql/data/data # otherwise it clashes with .gitkeep in the parent dir
    secrets:
      - postgres_password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U matrix"]
      start_period: "1s"
      interval: "1s"
      timeout: "5s"
    depends_on:
      init:
        condition: service_completed_successfully

  redis:
    image: redis:latest
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      interval: 1s
      timeout: 3s
      retries: 5
    networks:
      - backend

  sydent:
    image: matrixdotorg/sydent:latest
    user: $USER_ID:$GROUP_ID
    environment:
      SYDENT_SERVER_NAME: ${HOMESERVER_FQDN}
    # ports:
    #   - 8090:8090
    volumes:
      - ${VOLUME_PATH}/data/sydent:/data:rw
    networks:
      - backend
    depends_on:
      init:
        condition: service_completed_successfully

  synapse:
    build:
      dockerfile: Dockerfile
    user: $USER_ID:$GROUP_ID
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/data/synapse:/data:rw
      - ${VOLUME_PATH}/data/hookshot/registration.yml:/data/hookshot-registration.yml:ro
      - ${VOLUME_PATH}/data/mautrix-telegram/registration.yaml:/data/mautrix-telegram-registration.yml:ro
      - ${VOLUME_PATH}/data/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
    # ports:
    #   - 8008:8008
    networks:
      - backend
    environment:
      SYNAPSE_CONFIG_DIR: /data
      SYNAPSE_CONFIG_PATH: /data/homeserver.yaml
    secrets:
      - synapse_signing_key
    depends_on:
      redis:
        condition: service_started
      postgres:
        condition: service_healthy
      init:
        condition: service_completed_successfully

  synapse-generic-worker-1:
    build:
      dockerfile: Dockerfile
    user: $USER_ID:$GROUP_ID
    restart: unless-stopped
    entrypoint:
      [
        "/start.py",
        "run",
        "--config-path=/data/homeserver.yaml",
        "--config-path=/data/workers/generic-worker-1.yaml",
      ]
    healthcheck:
      test: ["CMD-SHELL", "curl -fSs http://localhost:8035/health || exit 1"]
      start_period: "5s"
      interval: "15s"
      timeout: "5s"
    networks:
      - backend
    volumes:
      - ${VOLUME_PATH}/data/synapse:/data:rw
      - ${VOLUME_PATH}/data/hookshot/registration.yml:/data/hookshot-registration.yml:ro
      - ${VOLUME_PATH}/data/mautrix-telegram/registration.yaml:/data/mautrix-telegram-registration.yml:ro
      - ${VOLUME_PATH}/data/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
    environment:
      SYNAPSE_WORKER: synapse.app.generic_worker
    # ports:
    #   - 8035:8035
    secrets:
      - synapse_signing_key
    depends_on:
      - synapse

  synapse-federation-sender-and-pusher-1:
    build:
      dockerfile: Dockerfile
    user: $USER_ID:$GROUP_ID
    restart: unless-stopped
    entrypoint:
      [
        "/start.py",
        "run",
        "--config-path=/data/homeserver.yaml",
        "--config-path=/data/workers/federation-sender-and-pusher-1.yaml",
      ]
    healthcheck:
      disable: true
    networks:
      - backend
    volumes:
      - ${VOLUME_PATH}/data/synapse:/data:rw
      - ${VOLUME_PATH}/data/hookshot/registration.yml:/data/hookshot-registration.yml:ro
      - ${VOLUME_PATH}/data/mautrix-telegram/registration.yaml:/data/mautrix-telegram-registration.yml:ro
      - ${VOLUME_PATH}/data/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
    environment:
      SYNAPSE_WORKER: synapse.app.generic_worker
    secrets:
      - synapse_signing_key
    depends_on:
      - synapse

  synapse-federation-sender-and-pusher-2:
    build:
      dockerfile: Dockerfile
    user: $USER_ID:$GROUP_ID
    restart: unless-stopped
    entrypoint:
      [
        "/start.py",
        "run",
        "--config-path=/data/homeserver.yaml",
        "--config-path=/data/workers/federation-sender-and-pusher-2.yaml",
      ]
    healthcheck:
      disable: true
    networks:
      - backend
    volumes:
      - ${VOLUME_PATH}/data/synapse:/data:rw
      - ${VOLUME_PATH}/data/hookshot/registration.yml:/data/hookshot-registration.yml:ro
      - ${VOLUME_PATH}/data/mautrix-telegram/registration.yaml:/data/mautrix-telegram-registration.yml:ro
      - ${VOLUME_PATH}/data/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
    environment:
      SYNAPSE_WORKER: synapse.app.generic_worker
    secrets:
      - synapse_signing_key
    depends_on:
      - synapse

  synapse-stream-writer:
    build:
      dockerfile: Dockerfile
    user: $USER_ID:$GROUP_ID
    restart: unless-stopped
    entrypoint:
      [
        "/start.py",
        "run",
        "--config-path=/data/homeserver.yaml",
        "--config-path=/data/workers/stream-writer.yaml",
      ]
    healthcheck:
      test: ["CMD-SHELL", "curl -fSs http://localhost:8035/health || exit 1"]
      start_period: "5s"
      interval: "15s"
      timeout: "5s"
    networks:
      - backend
    volumes:
      - ${VOLUME_PATH}/data/synapse:/data:rw
      - ${VOLUME_PATH}/data/hookshot/registration.yml:/data/hookshot-registration.yml:ro
      - ${VOLUME_PATH}/data/mautrix-telegram/registration.yaml:/data/mautrix-telegram-registration.yml:ro
      - ${VOLUME_PATH}/data/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
    environment:
      SYNAPSE_WORKER: synapse.app.generic_worker
    # ports:
    #   - 8035:8035
    secrets:
      - synapse_signing_key
    depends_on:
      - synapse

  synapse-app-service:
    build:
      dockerfile: Dockerfile
    user: $USER_ID:$GROUP_ID
    restart: unless-stopped
    entrypoint:
      [
        "/start.py",
        "run",
        "--config-path=/data/homeserver.yaml",
        "--config-path=/data/workers/app-service.yaml",
      ]
    healthcheck:
      disable: true
    networks:
      - backend
    volumes:
      - ${VOLUME_PATH}/data/synapse:/data:rw
      - ${VOLUME_PATH}/data/hookshot/registration.yml:/data/hookshot-registration.yml:ro
      - ${VOLUME_PATH}/data/mautrix-telegram/registration.yaml:/data/mautrix-telegram-registration.yml:ro
      - ${VOLUME_PATH}/data/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
    environment:
      SYNAPSE_WORKER: synapse.app.generic_worker
    # ports:
    #   - 8035:8035
    secrets:
      - synapse_signing_key
    depends_on:
      - synapse

  synapse-background-jobs-1:
    build:
      dockerfile: Dockerfile
    user: $USER_ID:$GROUP_ID
    restart: unless-stopped
    entrypoint:
      [
        "/start.py",
        "run",
        "--config-path=/data/homeserver.yaml",
        "--config-path=/data/workers/background-jobs-1.yaml",
      ]
    healthcheck:
      disable: true
    networks:
      - backend
    volumes:
      - ${VOLUME_PATH}/data/synapse:/data:rw
      - ${VOLUME_PATH}/data/hookshot/registration.yml:/data/hookshot-registration.yml:ro
      - ${VOLUME_PATH}/data/mautrix-telegram/registration.yaml:/data/mautrix-telegram-registration.yml:ro
      - ${VOLUME_PATH}/data/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
    environment:
      SYNAPSE_WORKER: synapse.app.generic_worker
    # ports:
    #   - 8035:8035
    secrets:
      - synapse_signing_key
    depends_on:
      - synapse

  synapse-media-repository-1:
    build:
      dockerfile: Dockerfile
    user: $USER_ID:$GROUP_ID
    restart: unless-stopped
    entrypoint:
      [
        "/start.py",
        "run",
        "--config-path=/data/homeserver.yaml",
        "--config-path=/data/workers/media-repository-1.yaml",
      ]
    healthcheck:
      test: ["CMD-SHELL", "curl -fSs http://localhost:8035/health || exit 1"]
      start_period: "5s"
      interval: "15s"
      timeout: "5s"
    networks:
      - backend
    volumes:
      - ${VOLUME_PATH}/data/synapse:/data:rw
      - ${VOLUME_PATH}/data/hookshot/registration.yml:/data/hookshot-registration.yml:ro
      - ${VOLUME_PATH}/data/mautrix-telegram/registration.yaml:/data/mautrix-telegram-registration.yml:ro
      - ${VOLUME_PATH}/data/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
    environment:
      SYNAPSE_WORKER: synapse.app.generic_worker
    # ports:
    #   - 8035:8035
    secrets:
      - synapse_signing_key
    depends_on:
      - synapse

  synapse-admin:
    image: ghcr.io/etkecc/synapse-admin:latest
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/data/synapse-admin/config.json:/app/config.json:ro
    networks:
      - backend
    # healthcheck:
    #   test: ["CMD", "curl", "-f", "http://localhost"]
    #   interval: 30s
    #   timeout: 10s
    #   retries: 10
    #   start_period: 20s
    depends_on:
      init:
        condition: service_completed_successfully
      synapse:
        condition: service_started

  synapse-admin-cli:
    build:
      dockerfile: Dockerfile.admin-cli
    networks:
      - backend
    volumes:
      - ${VOLUME_PATH}/data/synadm/synadm.yaml:/root/.config/synadm.yaml:rw
    depends_on:
      init:
        condition: service_completed_successfully
      synapse:
        condition: service_started

  # We are disabled the Matrix Auth Service for now due to the lack of support for the E2EE with bridges
  # mas:
  #   image: ghcr.io/element-hq/matrix-authentication-service:latest
  #   restart: unless-stopped
  #   # ports:
  #   #   - 8083:8080
  #   volumes:
  #     - ${VOLUME_PATH}/data/mas:/data:rw
  #     - ${VOLUME_PATH}/data/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
  #   networks:
  #     - backend
  #   # FIXME: do we also need to sync the db?
  #   command: "server --config=/data/config.yaml"
  #   depends_on:
  #     postgres:
  #       condition: service_healthy
  #     init:
  #       condition: service_completed_successfully

  element-web:
    image: vectorim/element-web:latest
    restart: unless-stopped
    # ports:
    #   - 8080:80
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget -q -O /dev/null http://localhost:80/version || exit 1",
        ]
      start_period: "5s"
      interval: "15s"
      timeout: "5s"
    networks:
      - backend
    volumes:
      - ${VOLUME_PATH}/data/element-web/config.json:/app/config.json
    depends_on:
      init:
        condition: service_completed_successfully

  element-call:
    image: ghcr.io/element-hq/element-call:latest-ci
    restart: unless-stopped
    # ports:
    #   - 8082:80
    networks:
      - backend
    volumes:
      - ${VOLUME_PATH}/data/element-call/config.json:/app/config.json
    depends_on:
      init:
        condition: service_completed_successfully

  livekit:
    image: livekit/livekit-server:latest
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/data/livekit/config.yaml:/etc/livekit.yaml
    command: --config /etc/livekit.yaml --node-ip ${LIVEKIT_NODE_IP}
    ports:
      # - 7880:7880 # HTTP listener
      # - 7881:7881 # TCP WebRTC transport, advertised via SDP

      # At least this would allow UDP turn on port 443 for better perf.

      # You can't expose a massive range here as it literally sets up 10,000 userland listeners, which takes forever
      # and will clash with any existing high-numbered ports.
      # So for now, tunnel everything via TCP 7881. FIXME!
      - 50000-50060:50000-50060/tcp # TCP media
      - 50000-50060:50000-50060/udp # UDP media
    networks:
      - backend
    # network_mode: host
    # extra_hosts:
    #   - "backend:127.0.0.1"
    depends_on:
      init:
        condition: service_completed_successfully
      redis:
        condition: service_started

  livekit-jwt:
    build:
      # evil hack to pull in bash so we can run an entrypoint.sh
      # FIXME: it's a bit wasteful; the alternative would be to modify lk-jwt-service to pick up secrets from disk
      # Another alternative would be to factor out secret generation from compose.yml and create an .env up front
      dockerfile_inline: |
        FROM ghcr.io/element-hq/lk-jwt-service:latest-ci AS builder
        FROM alpine:latest
        RUN apk update && apk add bash
        COPY --from=builder /lk-jwt-service /
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/data/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt
      - ${VOLUME_PATH}/scripts/livekit-jwt-entrypoint.sh:/entrypoint.sh
    entrypoint: /entrypoint.sh
    env_file: .env
    deploy:
      restart_policy:
        condition: on-failure
    networks:
      - backend
    secrets:
      - livekit_api_key
      - livekit_secret_key
    depends_on:
      init:
        condition: service_completed_successfully
      livekit:
        condition: service_started

  hookshot:
    image: halfshot/matrix-hookshot:latest
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/data/hookshot:/data:rw
    networks:
      backend:
        ipv4_address: ${HOOKSHOT_IP}
    secrets:
      - hookshot_passkey
      - hookshot_github_key
    depends_on:
      init:
        condition: service_completed_successfully

  # We are disabled the mautrix-telegram bridge due to complexity and too many edge cases to handle
  # It was 35/65 (65% positive) experience, it's fully functional and free to use
  # TODO: Uncomment this block if you want to use the mautrix-telegram bridge
  # mautrix-telegram:
  #   image: dock.mau.dev/mautrix/telegram:v0.15.2
  #   restart: unless-stopped
  #   environment:
  #     MAUTRIX_DIRECT_STARTUP: true
  #   volumes:
  #     - ${VOLUME_PATH}/data/mautrix-telegram:/data
  #   networks:
  #     - backend
  #   depends_on:
  #     init:
  #       condition: service_completed_successfully