Initial Commit

2026-05-20 10:28:49 +01:00
parent a5b3ddd701
commit 784cca8b27
14 changed files with 1035 additions and 3 deletions
@@ -0,0 +1,241 @@
+# COMPOSE TEMPLATE - DO NOT EDIT MANUALLY
+# Generated by set_compose.sh
+
+networks:
+  matrix_network:
+    name: matrix_network
+
+services:
+  # --- CORE SERVICES (Always Included) ---
+  matrix-db:
+    image: postgres:latest
+    container_name: "matrix-db"
+    restart: unless-stopped
+    volumes:
+      - ${VOLUME_PATH}/postgres:/var/lib/postgresql:rw
+    networks:
+      - matrix_network
+    environment:
+      POSTGRES_USER: ${PG_USER}
+      POSTGRES_PASSWORD: ${PG_PASSWORD}
+      POSTGRES_INITDB_ARGS: --encoding=UTF8 --locale=C
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U '${PG_USER}'"]
+      start_period: "1s"
+      interval: "1s"
+      timeout: "5s"
+
+  redis:
+    image: redis:latest
+    container_name: "matrix-redis"
+    restart: unless-stopped
+    networks:
+      - matrix_network
+    command: redis-server --appendonly yes
+
+  synapse:
+    image: ghcr.io/element-hq/synapse:latest
+    container_name: "synapse"
+    user: ${USER_ID}:${GROUP_ID}
+    restart: unless-stopped
+    volumes:
+      - ${VOLUME_PATH}/synapse:/data:rw
+    networks:
+      - matrix_network
+    environment:
+      SYNAPSE_CONFIG_DIR: /data
+      SYNAPSE_CONFIG_PATH: /data/homeserver.yaml
+    depends_on:
+      redis:
+        condition: service_started
+      matrix-db:
+        condition: service_healthy
+  # [TRAEFIK_LABELS_START]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.synapse.rule=Host(`${HOMESERVER_FQDN}`)"
+      - "traefik.http.routers.synapse.entrypoints=websecure"
+      - "traefik.http.routers.synapse.tls.certresolver=myresolver"
+      - "traefik.http.services.synapse.loadbalancer.server.port=8008"
+  # [TRAEFIK_LABELS_END]
+
+  mas:
+    image: ghcr.io/element-hq/matrix-authentication-service:latest
+    container_name: "mas"
+    restart: unless-stopped
+    volumes:
+      - ${VOLUME_PATH}/mas:/data:rw
+    networks:
+      - matrix_network
+    command: "server --config=/data/config.yaml"
+    depends_on:
+      matrix-db:
+        condition: service_healthy
+  # [TRAEFIK_LABELS_START]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.auth.rule=Host(`${MAS_FQDN}`)"
+      - "traefik.http.routers.auth.entrypoints=websecure"
+      - "traefik.http.routers.auth.tls.certresolver=myresolver"
+      - "traefik.http.services.auth.loadbalancer.server.port=8000"
+  # [TRAEFIK_LABELS_END]
+
+  # --- OPTIONAL: LIVEKIT RTC STACK ---
+  # [LIVEKIT_START]
+  livekit:
+    image: livekit/livekit-server:latest
+    container_name: "livekit"
+    restart: unless-stopped
+    volumes:
+      - ${VOLUME_PATH}/livekit:/etc/livekit
+    environment:
+      - LIVEKIT_KEYS=access-key=${LIVEKIT_API_KEY},secret=${LIVEKIT_API_SECRET}
+      - LIVEKIT_PORT=7880
+      - LIVEKIT_WS_PORT=7881
+      - LIVEKIT_SERVER_URL=https://${LIVEKIT_FQDN}
+    networks:
+      - matrix_network
+    depends_on:
+      - redis
+      - matrix-db
+    ports:
+      - "${LIVEKIT_UDP_RANGE}:${LIVEKIT_UDP_RANGE}/udp"
+  # [TRAEFIK_LABELS_START]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.rtc.rule=Host(`${LIVEKIT_FQDN}`)"
+      - "traefik.http.routers.rtc.entrypoints=websecure"
+      - "traefik.http.routers.rtc.tls.certresolver=myresolver"
+      - "traefik.http.services.rtc.loadbalancer.server.port=7880"
+  # [TRAEFIK_LABELS_END]
+
+  # The JWT Bridge Service
+  lk-jwt-service:
+    image: ghcr.io/element-hq/lk-jwt-service:latest
+    container_name: "lk-jwt-service"
+    restart: unless-stopped
+    environment:
+      - LK_JWT_PORT=8080
+      - LIVEKIT_URL=wss://${LIVEKIT_FQDN}
+      - LIVEKIT_KEY=${LIVEKIT_API_KEY}
+      - LIVEKIT_SECRET=${LIVEKIT_API_SECRET}
+      - LIVEKIT_LOCAL_HOMESERVERS=${HOMESERVER_FQDN}
+    networks:
+      - matrix_network
+    depends_on:
+      - livekit
+  # [TRAEFIK_LABELS_START]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.jwt.rule=Host(`${JWT_FQDN}`)"
+      - "traefik.http.routers.jwt.entrypoints=websecure"
+      - "traefik.http.routers.jwt.tls.certresolver=myresolver"
+      - "traefik.http.services.jwt.loadbalancer.server.port=8080"
+  # [TRAEFIK_LABELS_END]
+  # [LIVEKIT_END]
+
+  # --- OPTIONAL: WEB HOSTED APP ---
+  # [ELEMENT_START]
+  element-web:
+    image: vectorim/element-web:latest
+    container_name: "matrix-web-client"
+    restart: unless-stopped
+    volumes:
+      - ${VOLUME_PATH}/element-web:/usr/share/nginx/html:ro
+    networks:
+      - matrix_network
+    environment:
+      - ELEMENT_WEB_CONFIG_PATH=/usr/share/nginx/html/config.json
+  # [TRAEFIK_LABELS_START]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.app.rule=Host(`${APP_FQDN}`)"
+      - "traefik.http.routers.app.entrypoints=websecure"
+      - "traefik.http.routers.app.tls.certresolver=myresolver"
+      - "traefik.http.services.app.loadbalancer.server.port=80"
+  # [TRAEFIK_LABELS_END]
+  # [ELEMENT_END]
+
+  # [CINNY_START]
+  cinny:
+    image: cinny-web:latest
+    container_name: "matrix-web-client"
+    restart: unless-stopped
+    volumes:
+      - ${VOLUME_PATH}/cinny:/usr/share/nginx/html:ro
+    networks:
+      - matrix_network
+  # [TRAEFIK_LABELS_START]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.app.rule=Host(`${APP_FQDN}`)"
+      - "traefik.http.routers.app.entrypoints=websecure"
+      - "traefik.http.routers.app.tls.certresolver=myresolver"
+      - "traefik.http.services.app.loadbalancer.server.port=80"
+  # [TRAEFIK_LABELS_END]
+  # [CINNY_END]
+
+  # [FLUFFYCHAT_START]
+  fluffy-chat:
+    image: kibaek/fluffy-chat:latest
+    container_name: "matrix-web-client"
+    restart: unless-stopped
+    volumes:
+      - ${VOLUME_PATH}/fluffy-chat:/usr/share/nginx/html:ro
+    networks:
+      - matrix_network
+  # [TRAEFIK_LABELS_START]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.app.rule=Host(`${APP_FQDN}`)"
+      - "traefik.http.routers.app.entrypoints=websecure"
+      - "traefik.http.routers.app.tls.certresolver=myresolver"
+      - "traefik.http.services.app.loadbalancer.server.port=80"
+  # [TRAEFIK_LABELS_END]
+  # [FLUFFYCHAT_END]
+
+  # --- OPTIONAL: REVERSE PROXY ---
+  # [NGINX_START]
+  nginx:
+    image: nginx:latest
+    container_name: "matrix-nginx"
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    stop_grace_period: 0s
+    volumes:
+      - ${VOLUME_PATH}/nginx/conf.d:/etc/nginx/conf.d:ro
+    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
+    networks:
+      matrix_network:
+        aliases:
+          - ${DOMAIN}
+          - ${HOMESERVER_FQDN}
+          - ${MAS_FQDN}
+          - ${APP_FQDN}
+  # [NGINX_END]
+
+  # [TRAEFIK_START]
+  traefik:
+    image: traefik:latest
+    container_name: "traefik"
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ${VOLUME_PATH}/traefik:/etc/traefik
+    command:
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.websecure.address=:443"
+      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
+      - "--certificatesresolvers.myresolver.acme.email=${PG_USER}@${DOMAIN}"
+      - "--certificatesresolvers.myresolver.acme.storage=/etc/traefik/acme.json"
+    networks:
+      - matrix_network
+  # [TRAEFIK_END]