# COMPOSE TEMPLATE - DO NOT EDIT MANUALLY
# Generated by set_compose.sh

networks:
  matrix_network:
    name: matrix_network

services:
  # --- CORE SERVICES (Always Included) ---
  matrix-db:
    image: postgres:latest
    container_name: "matrix-db"
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/postgres:/var/lib/postgresql:rw
    networks:
      - matrix_network
    environment:
      POSTGRES_USER: ${PG_USER}
      POSTGRES_PASSWORD: ${PG_PASSWORD}
      POSTGRES_INITDB_ARGS: --encoding=UTF8 --locale=C
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U '${PG_USER}'"]
      start_period: "1s"
      interval: "1s"
      timeout: "5s"

  redis:
    image: redis:latest
    container_name: "matrix-redis"
    restart: unless-stopped
    networks:
      - matrix_network
    command: redis-server --appendonly yes

  synapse:
    image: ghcr.io/element-hq/synapse:latest
    container_name: "synapse"
    user: ${USER_ID}:${GROUP_ID}
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/synapse:/data:rw
    networks:
      - matrix_network
    environment:
      SYNAPSE_CONFIG_DIR: /data
      SYNAPSE_CONFIG_PATH: /data/homeserver.yaml
    depends_on:
      redis:
        condition: service_started
      matrix-db:
        condition: service_healthy
  # [TRAEFIK_LABELS_START]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.synapse.rule=Host(`${HOMESERVER_FQDN}`)"
      - "traefik.http.routers.synapse.entrypoints=websecure"
      - "traefik.http.routers.synapse.tls.certresolver=myresolver"
      - "traefik.http.services.synapse.loadbalancer.server.port=8008"
  # [TRAEFIK_LABELS_END]

  mas:
    image: ghcr.io/element-hq/matrix-authentication-service:latest
    container_name: "mas"
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/mas:/data:rw
    networks:
      - matrix_network
    command: "server --config=/data/config.yaml"
    depends_on:
      matrix-db:
        condition: service_healthy
  # [TRAEFIK_LABELS_START]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.auth.rule=Host(`${MAS_FQDN}`)"
      - "traefik.http.routers.auth.entrypoints=websecure"
      - "traefik.http.routers.auth.tls.certresolver=myresolver"
      - "traefik.http.services.auth.loadbalancer.server.port=8080"
  # [TRAEFIK_LABELS_END]

  # --- OPTIONAL: LIVEKIT RTC STACK ---
  # [LIVEKIT_START]
  livekit:
    image: livekit/livekit-server:latest
    container_name: "livekit"
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/livekit:/etc/livekit
    environment:
      - LIVEKIT_KEYS=access-key=${LIVEKIT_API_KEY},secret=${LIVEKIT_API_SECRET}
      - LIVEKIT_PORT=7880
      - LIVEKIT_WS_PORT=7881
      - LIVEKIT_SERVER_URL=https://${LIVEKIT_FQDN}
    networks:
      - matrix_network
    depends_on:
      - redis
      - matrix-db
    ports:
      - "${LIVEKIT_UDP_RANGE}:${LIVEKIT_UDP_RANGE}/udp"
  # [TRAEFIK_LABELS_START]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rtc.rule=Host(`${LIVEKIT_FQDN}`)"
      - "traefik.http.routers.rtc.entrypoints=websecure"
      - "traefik.http.routers.rtc.tls.certresolver=myresolver"
      - "traefik.http.services.rtc.loadbalancer.server.port=7880"
  # [TRAEFIK_LABELS_END]

  # The JWT Bridge Service
  lk-jwt-service:
    image: ghcr.io/element-hq/lk-jwt-service:latest
    container_name: "lk-jwt-service"
    restart: unless-stopped
    environment:
      - LK_JWT_PORT=8080
      - LIVEKIT_URL=wss://${LIVEKIT_FQDN}
      - LIVEKIT_KEY=${LIVEKIT_API_KEY}
      - LIVEKIT_SECRET=${LIVEKIT_API_SECRET}
      - LIVEKIT_LOCAL_HOMESERVERS=${HOMESERVER_FQDN}
    networks:
      - matrix_network
    depends_on:
      - livekit
  # [TRAEFIK_LABELS_START]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jwt.rule=Host(`${JWT_FQDN}`)"
      - "traefik.http.routers.jwt.entrypoints=websecure"
      - "traefik.http.routers.jwt.tls.certresolver=myresolver"
      - "traefik.http.services.jwt.loadbalancer.server.port=8080"
  # [TRAEFIK_LABELS_END]
  # [LIVEKIT_END]

  # --- OPTIONAL: WEB HOSTED APP ---
  # [ELEMENT_START]
  element-web:
    image: vectorim/element-web:latest
    container_name: "matrix-web-client"
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/element-web:/usr/share/nginx/html:ro
    networks:
      - matrix_network
    environment:
      - ELEMENT_WEB_CONFIG_PATH=/usr/share/nginx/html/config.json
  # [TRAEFIK_LABELS_START]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=Host(`${APP_FQDN}`)"
      - "traefik.http.routers.app.entrypoints=websecure"
      - "traefik.http.routers.app.tls.certresolver=myresolver"
      - "traefik.http.services.app.loadbalancer.server.port=80"
  # [TRAEFIK_LABELS_END]
  # [ELEMENT_END]

  # [CINNY_START]
  cinny:
    image: cinny-web:latest
    container_name: "matrix-web-client"
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/cinny:/usr/share/nginx/html:ro
    networks:
      - matrix_network
  # [TRAEFIK_LABELS_START]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=Host(`${APP_FQDN}`)"
      - "traefik.http.routers.app.entrypoints=websecure"
      - "traefik.http.routers.app.tls.certresolver=myresolver"
      - "traefik.http.services.app.loadbalancer.server.port=80"
  # [TRAEFIK_LABELS_END]
  # [CINNY_END]

  # [FLUFFYCHAT_START]
  fluffy-chat:
    image: kibaek/fluffy-chat:latest
    container_name: "matrix-web-client"
    restart: unless-stopped
    volumes:
      - ${VOLUME_PATH}/fluffy-chat:/usr/share/nginx/html:ro
    networks:
      - matrix_network
  # [TRAEFIK_LABELS_START]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=Host(`${APP_FQDN}`)"
      - "traefik.http.routers.app.entrypoints=websecure"
      - "traefik.http.routers.app.tls.certresolver=myresolver"
      - "traefik.http.services.app.loadbalancer.server.port=80"
  # [TRAEFIK_LABELS_END]
  # [FLUFFYCHAT_END]

  # --- OPTIONAL: REVERSE PROXY ---
  # [NGINX_START]
  nginx:
    image: nginx:latest
    container_name: "matrix-nginx"
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    stop_grace_period: 0s
    volumes:
      - ${VOLUME_PATH}/nginx/conf.d:/etc/nginx/conf.d:ro
    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
    networks:
      matrix_network:
        aliases:
          - ${DOMAIN}
          - ${HOMESERVER_FQDN}
          - ${MAS_FQDN}
          - ${APP_FQDN}
  # [NGINX_END]

  # [TRAEFIK_START]
  traefik:
    image: traefik:latest
    container_name: "traefik"
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${VOLUME_PATH}/traefik:/etc/traefik
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=${PG_USER}@${DOMAIN}"
      - "--certificatesresolvers.myresolver.acme.storage=/etc/traefik/acme.json"
    networks:
      - matrix_network
  # [TRAEFIK_END]