# Warp on PocketBase with media in SeaweedFS: the homeserver, the admin panel
# and the web client built from this checkout, plus SeaweedFS as one
# container (`weed server -s3`: master, volume, filer and S3 gateway in one
# process).
#
#   cd Docker
#   cp .env.pocketbase.seaweedfs.example .env      # then edit it
#   docker compose -f docker-compose.pocketbase.seaweedfs.yml up -d --build
#
# The database is PocketBase's, in pb-data; media goes to the bucket
# WARP_PB_S3_BUCKET (default warp) in SeaweedFS (seaweed-data), whose gateway
# has exactly one identity: the homeserver's. For SeaweedFS's admin UI and
# per-role containers, see docker-compose.pocketbase.seaweedfs.split.yml.
# Media stored before S3 was on is not moved into the bucket.
#
# Homeserver http://localhost:8008, admin panel http://localhost:8009, web
# client http://localhost:8080. The S3 gateway (8333) is not published: the
# homeserver reaches it over the compose network.
#
# This file shares its project and volumes with
# docker-compose.pocketbase.seaweedfs.split.yml: SeaweedFS's data has the
# same layout either way, so switching between the two needs no migration.
#
# Create the first administrator once the server is up:
#
#   docker compose -f docker-compose.pocketbase.seaweedfs.yml exec warp warp create-account --username admin --admin
#
# or set WARP_ADMIN_USERNAME and WARP_ADMIN_PASSWORD in .env, and the first
# start creates it.

name: warp-pocketbase-seaweedfs

services:
  seaweedfs:
    image: ${SEAWEED_IMAGE:-chrislusf/seaweedfs:4.45}
    restart: unless-stopped
    command: server -dir=/data -s3 -volume.max=0 -master.volumeSizeLimitMB=1024
    environment:
      # With no -s3.config, the gateway takes its single identity from these,
      # which is also what takes it out of its allow-anyone default. The same
      # pair the homeserver signs with.
      AWS_ACCESS_KEY_ID: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
      AWS_SECRET_ACCESS_KEY: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env}
    volumes:
      - ${SEAWEED_DATA_VOLUME:-seaweed-data}:/data
    healthcheck:
      # The gateway answering means master, volume and filer are up too.
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz >/dev/null || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 12
      start_period: 20s

  # Runs once per start and exits. The homeserver never creates its bucket;
  # creating one that exists is a no-op.
  seaweedfs-init:
    image: ${SEAWEED_IMAGE:-chrislusf/seaweedfs:4.45}
    restart: "no"
    depends_on:
      seaweedfs:
        condition: service_healthy
    environment:
      WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
    entrypoint: ["/bin/sh", "-c"]
    command:
      - echo "s3.bucket.create -name $$WARP_PB_S3_BUCKET" | weed shell -master=seaweedfs:9333 >/dev/null

  # PocketBase, the homeserver's database: Warp's collections, and media in
  # PocketBase's storage, are in the pb-data volume. The image creates the
  # superuser from .env on its first start, and never changes it after: a
  # new password goes in through the admin UI, then into .env. The admin UI
  # is http://localhost:8070/_/ on loopback; WARP_PB_BIND=0.0.0.0 exposes
  # it, behind a reverse proxy only.
  pocketbase:
    image: ${WARP_PB_IMAGE:-tajniak81/pocketbase-docker-root:latest}
    restart: unless-stopped
    environment:
      PB_PORT: "8070"
      PB_ADMIN_EMAIL: ${WARP_PB_SUPERUSER_EMAIL:?set WARP_PB_SUPERUSER_EMAIL in .env}
      PB_ADMIN_PASSWORD: ${WARP_PB_SUPERUSER_PASSWORD:?set WARP_PB_SUPERUSER_PASSWORD in .env}
    volumes:
      - ${WARP_PB_DATA_VOLUME:-pb-data}:/pb/pb_data
    ports:
      - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health >/dev/null || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 10s

  # A host directory in WARP_DATA_VOLUME is created owned by root, and the
  # homeserver runs as UID 10001: hand /data to it before it starts.
  warp-init:
    build:
      context: ..
      dockerfile: Dockerfile
    image: warp:latest
    user: "0"
    entrypoint: ["chown", "-R", "10001:10001", "/data"]
    volumes:
      - ${WARP_DATA_VOLUME:-warp-data}:/data

  warp:
    build:
      context: ..
      dockerfile: Dockerfile
    image: warp:latest
    restart: unless-stopped
    depends_on:
      warp-init:
        condition: service_completed_successfully
      pocketbase:
        condition: service_healthy
      seaweedfs:
        condition: service_healthy
      seaweedfs-init:
        condition: service_completed_successfully
    # The signing key is created on first start and kept in the volume:
    # losing it means other servers no longer recognise this one. With
    # WARP_ADMIN_USERNAME and WARP_ADMIN_PASSWORD in .env, the administrator
    # is created too, on the first start; later starts leave it as it is.
    entrypoint: ["/bin/sh", "-c"]
    command:
      - >-
        test -f /data/signing.key || warp generate-keys --output /data/signing.key || exit 1;
        [ -z "$${WARP_ADMIN_USERNAME:-}" ] || printf '%s\n' "$${WARP_ADMIN_PASSWORD:-}" |
        warp create-account --username "$$WARP_ADMIN_USERNAME" --admin --if-not-exists || exit 1;
        exec warp serve
    env_file: .env
    environment:
      WARP_DB_DRIVER: pocketbase
      WARP_DB_CONNECTION_STRING: http://pocketbase:8070
      # The gateway on the compose network; these override whatever .env
      # says about S3.
      WARP_PB_S3_ENABLED: "true"
      WARP_PB_S3_ENDPOINT: http://seaweedfs:8333
      WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
      # SeaweedFS ignores the region; the client wants one.
      WARP_PB_S3_REGION: ${WARP_PB_S3_REGION:-us-east-1}
      WARP_PB_S3_FORCE_PATH_STYLE: "true"
      WARP_PB_S3_ACCESS_KEY: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
      WARP_PB_S3_SECRET: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env}
    volumes:
      - ${WARP_DATA_VOLUME:-warp-data}:/data
    ports:
      - "${WARP_PORT:-8008}:8008"

  admin:
    build:
      context: ..
      dockerfile: apps/admin/Dockerfile
    image: warp-admin:latest
    restart: unless-stopped
    depends_on:
      - warp
    env_file: .env
    environment:
      WARP_ADMIN_HOMESERVER: http://warp:8008
    ports:
      - "${WARP_ADMIN_PORT:-8009}:8009"

  web:
    build:
      context: ..
      dockerfile: apps/web/Dockerfile
    image: warp-web:latest
    restart: unless-stopped
    depends_on:
      - warp
    env_file: .env
    environment:
      WARP_WEB_HOMESERVER: http://warp:8008
    ports:
      - "${WARP_WEB_PORT:-8080}:8080"

  # Calls: the LiveKit SFU and the LiveKit JWT service (docs/calls.md),
  # started only with the calls profile, COMPOSE_PROFILES=calls in .env.
  # Warp hands browsers the JWT service's URL from
  # WARP_RTC_LIVEKIT_SERVICE_URL, and the JWT service hands them
  # LIVEKIT_PUBLIC_URL; put both behind a TLS proxy. The media does not go
  # through the proxy: forward LIVEKIT_RTC_TCP_PORT and LIVEKIT_RTC_UDP_PORT
  # from the internet to this host.
  livekit:
    image: ${LIVEKIT_IMAGE:-livekit/livekit-server:v1.13.7}
    profiles: [calls]
    restart: unless-stopped
    environment:
      # node_ip is the address LiveKit tells browsers to send media to:
      # LIVEKIT_NODE_IP, or else the public address it finds over STUN.
      LIVEKIT_CONFIG: |
        port: 7880
        bind_addresses: [""]
        rtc:
          tcp_port: ${LIVEKIT_RTC_TCP_PORT:-7881}
          udp_port: ${LIVEKIT_RTC_UDP_PORT:-7882}
          use_external_ip: ${LIVEKIT_USE_EXTERNAL_IP:-true}
          node_ip: "${LIVEKIT_NODE_IP:-}"
        room:
          auto_create: false
        keys:
          "${LIVEKIT_KEY:-warp}": "${LIVEKIT_SECRET:-}"
        logging:
          level: info
    ports:
      - "${LIVEKIT_PORT:-7880}:7880"
      - "${LIVEKIT_RTC_TCP_PORT:-7881}:${LIVEKIT_RTC_TCP_PORT:-7881}"
      - "${LIVEKIT_RTC_UDP_PORT:-7882}:${LIVEKIT_RTC_UDP_PORT:-7882}/udp"

  # Gives a signed-in user a LiveKit token, after checking their OpenID
  # token with the homeserver at https://<server name>: through
  # /.well-known/matrix/server, which Warp serves only with federation on,
  # so with it off the well-known service below serves that file.
  livekit-jwt:
    image: ${LIVEKIT_JWT_IMAGE:-ghcr.io/element-hq/lk-jwt-service:0.8.0}
    profiles: [calls]
    restart: unless-stopped
    depends_on:
      - livekit
    environment:
      LIVEKIT_JWT_BIND: ":8080"
      # The URL handed to browsers, and the one the service creates rooms
      # through.
      LIVEKIT_URL: ${LIVEKIT_PUBLIC_URL:-}
      LIVEKIT_KEY: ${LIVEKIT_KEY:-warp}
      LIVEKIT_SECRET: ${LIVEKIT_SECRET:-}
      # Users of this server may create call rooms on the SFU.
      LIVEKIT_FULL_ACCESS_HOMESERVERS: ${WARP_SERVER_NAME:-localhost}
    ports:
      - "${LIVEKIT_JWT_PORT:-8071}:8080"

  # Serves /.well-known/matrix/server, which Warp serves only with
  # federation on, for the JWT service to find the homeserver by: route
  # that one path to it on the proxy, ahead of /.well-known/matrix/*. It
  # answers WARP_WELL_KNOWN_SERVER_ADDRESS, or <server name>:443, and 404
  # to everything else.
  well-known:
    image: ${WARP_WELL_KNOWN_IMAGE:-caddy:2.10.2-alpine}
    profiles: [calls]
    restart: unless-stopped
    configs:
      - source: well-known
        target: /etc/caddy/Caddyfile
    ports:
      - "${WARP_WELL_KNOWN_PORT:-8072}:8080"

volumes:
  # The homeserver's signing key.
  warp-data:
  # PocketBase's pb_data: the database, and media unless it is in S3.
  pb-data:
  seaweed-data:

configs:
  # The well-known service's Caddyfile.
  well-known:
    content: |
      {
      	admin off
      	auto_https off
      }
      :8080 {
      	handle /.well-known/matrix/server {
      		header Content-Type application/json
      		header Access-Control-Allow-Origin *
      		respond `{"m.server":"${WARP_WELL_KNOWN_SERVER_ADDRESS:-${WARP_SERVER_NAME:-localhost}:443}"}` 200
      	}
      	respond 404
      }