scarif/docker-compose.yml

x-logging: &logging
  logging:
    driver: "local"
    options:
      max-size: "5m"
      max-file: "2"

x-firecrawl-service: &firecrawl-service
  image: ghcr.io/mendableai/firecrawl

x-firecrawl-env: &firecrawl-env
  REDIS_URL: redis://redis:6379
  REDIS_RATE_LIMIT_URL: redis://redis:6379
  PLAYWRIGHT_MICROSERVICE_URL: http://playwright:3000/scrape

services:
  # change:
  #   <<: *logging
  #   profiles: ["prod"]
  #   container_name: change
  #   image: node:alpine
  #   build: ./change-game
  #   environment:
  #     - PORT=9000
  #     - VIRTUAL_HOST=rec.${DOMAIN}
  #     - CERT_NAME=${DOMAIN}
  #     - VIRTUAL_PORT=9000
  #   networks:
  #     - nginx
  #   volumes:
  #     - change:/change/public

  foundry:
    profiles: ["prod"]
    <<: *logging
    image: felddy/foundryvtt:release
    volumes:
        - /mnt/tower/foundry:/data
        - /opt/scarif/foundry/patches:/data/patches
    restart: always
    environment:
      - "FOUNDRY_PASSWORD=${FOUNDRY_PASSWORD}"
      - "FOUNDRY_USERNAME=${FOUNDRY_USER}"
      - FOUNDRY_ADMIN_KEY=${FOUNDRY_ADMIN_KEY}
      - FOUNDRY_HOSTNAME=https://rec.${DOMAIN}
      - FOUNDRY_PROXY_PORT=443
      - FOUNDRY_PORT=443
      - FOUNDRY_PROXY_SSL=true
      - FOUNDRY_ROUTE_PREFIX=foundry
      - CONTAINER_CACHE=/data/container_cache
      - CONTAINER_PATCHES=/data/patches
      - FOUNDRY_UID=1000
      - FOUNDRY_GID=1000
      - VIRTUAL_HOST=rec.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=30000
      - VIRTUAL_PATH=/foundry
    networks:
      - nginx

  nextcloud:
    profiles: ["prod", "dev"]
    <<: *logging
    build: ./nextcloud
    image: nextcloud:31-fpm-alpine
    restart: unless-stopped
    user: 1000:1000
    ports:
      - 9000:9000
    volumes:
      - nextcloud:/var/www/html
      - ./nextcloud/redis-session.ini:/usr/local/etc/php/conf.d/redis-session.ini
      - /mnt/tower/stardust:/var/www/html/data
      - /mnt/tower/foundry:/var/www/foundry
    environment:
      - VIRTUAL_HOST=tower.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=9000
      - VIRTUAL_PROTO=fastcgi
      - REDIS_HOST=redis
      - MYSQL_HOST=db
      - MYSQL_PASSWORD=${DB_PASSWORD}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=${DB_USER}
      - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD}
      - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER}
      - MAIL_FROM_ADDRESS=${MAIL_FROM}
      - SMTP_HOST=${MAIL_HOST}
      - SMTP_PORT=${MAIL_PORT}
      - SMTP_USER=${MAIL_USER}
      - SMTP_PASSWORD=${MAIL_PASSWORD}
      - "NEXTCLOUD_TRUSTED_DOMAINS=tower.${DOMAIN} 127.0.0.1"
      - USER_UID=1000
      - USER_GID=1000
      - APACHE_RUN_USER=1000
      - APACHE_RUN_GROUP=1000
    depends_on:
      - db
      - redis
    networks:
      - db
      - redis
      - nginx
    extra_hosts:
      - "tower.${DOMAIN}:${LOCAL_IP}"
      - "office.${DOMAIN}:${LOCAL_IP}" 

  collabora:
    profiles: ["prod", "dev"]
    <<: *logging
    image: collabora/code
    restart: unless-stopped
    cap_add:
      - MKNOD
    environment:
      - VIRTUAL_HOST=office.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=9980
      - "DONT_GEN_SSL_CERT=True"
      - domain=tower.${DOMAIN}
      - cert_domain=office.${DOMAIN}
      - server_name=office.${DOMAIN}
      - username=${COLLABORA_USER}
      - password=${COLLABORA_PASSWORD}
      - "extra_params=-o:ssl.enable=false --o:ssl.termination=true"
      - "dictionaries=de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru ro"
    networks:
      - nginx
    extra_hosts:
      - "tower.${DOMAIN}:${LOCAL_IP}"
      - "office.${DOMAIN}:${LOCAL_IP}"

  gitea:
    profiles: ["prod", "dev"]
    <<: *logging
    image: gitea/gitea:1
    environment:
      - VIRTUAL_HOST=labs.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=3000
      - "APP_NAME=Labs: Where the good stuff happens"
      - RUN_MODE=prod
      - DOMAIN=labs.${DOMAIN}
      - ROOT_URL=https://labs.${DOMAIN}
      - DB_TYPE=mysql
      - DB_HOST=db
      - DB_NAME=gitea
      - DB_USER=${DB_USER}
      - DB_PASSWD=${DB_PASSWORD}
      - USER_UID=1200
      - USER_GID=1200
      - DISABLE_REGISTRATION=true
    restart: always
    volumes:
      - gitea:/data
      - /mnt/tower/labs:/data/git
      - /home/git/.ssh/:/data/git/.ssh/
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "127.0.0.1:2222:22"
    networks:
      - db
      - nginx
    depends_on:
      - db

  librechat:
    image: ghcr.io/danny-avila/librechat-dev-api:latest
    ports:
      - 3080:3080
    networks:
      - nginx
      - redis
      - db
    depends_on:
      - mongodb
      - rag_api
    restart: always
    extra_hosts:
      - "host.docker.internal:host-gateway"
    <<: *logging
    environment:
      - VIRTUAL_HOST=droid.${DOMAIN}
      - VIRTUAL_PORT=3080
      - CERT_NAME=${DOMAIN}
      - HOST=0.0.0.0
      - NODE_ENV=production
      - MONGO_URI=mongodb://${DB_USER}:${DB_PASSWORD}@mongodb:27017/LibreChat?authSource=admin
      - MEILI_HOST=http://meilisearch:7700
      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
      - RAG_PORT=8000
      - RAG_API_URL=http://rag_api:8000
      - SEARXNG_INSTANCE_URL=http://searxng:8080
      - SEARXNG_API_KEY=${SEARXNG_SECRET_KEY}
      - FIRECRAWL_URL=http://firecrawl:3002
      - FIRECRWAL_API_KEY=
      - ALLOW_EMAIL_LOGIN=true
      - ALLOW_REGISTRATION=false
      - ALLOW_SOCIAL_LOGIN=false
      - ALLOW_SOCIAL_REGISTRATION=false
      - ALLOW_PASSWORD_RESET=false
      - ALLOW_ACCOUNT_DELETION=false
      - ALLOW_UNVERIFIED_EMAIL_LOGIN=true
      - CREDS_KEY=${LIBRECHAT_CREDS_KEY}
      - CREDS_IV=${LIBRECHAT_CREDS_IV}
      - JWT_SECRET=${LIBRECHAT_JWT_SECRET}
      - JWT_REFRESH_SECRET=${LIBRECHAT_JWT_REFRESH_SECRET}
      - AIHUBMIX_KEY=${AIHUBMIX_KEY}
      - OPENROUTER_KEY=${OPENROUTER_KEY}
      - IMAGE_GEN_OAI_BASEURL=https://aihubmix.com/v1
      - IMAGE_GEN_OAI_API_KEY=${AIHUBMIX_KEY}
      - IMAGE_GEN_OAI_MODEL=gpt-image-1
      - JINA_API_KEY=${JINA_API_KEY}
    volumes:
      - type: bind
        source: ./librechat/librechat.yaml
        target: /app/librechat.yaml
      - /mnt/tower/stardust/files/chris/.droid/images:/app/client/public/images
      - /mnt/tower/stardust/files/chris/.droid/uploads:/app/uploads
      - /mnt/tower/stardust/files/chris/.droid/logs:/app/logs
      - /mnt/tower/stardust/files/chris/:/files

  searxng:
    image: docker.io/searxng/searxng:latest
    restart: unless-stopped
    networks:
      - nginx
      - redis
    volumes:
      - ./searxng:/etc/searxng:rw
      - searxng:/var/cache/searxng:rw
    environment:
      - SEARXNG_BASE_URL=https://${SEARXNG_HOSTNAME:-localhost}/
      - SEARXNG_SECRET=${SEARXNG_SECRET_KEY}
      - VIRTUAL_HOST=holocron.${DOMAIN}
      - VIRTUAL_PORT=8080
      - CERT_NAME=${DOMAIN}
    <<: *logging

  minecraft:
    profiles: ["prod"]
    <<: *logging
    image: itzg/minecraft-server
    tty: true
    stdin_open: true
    ports:
      - "25565:25565"
    environment:
      - TYPE=VANILLA
      - VERSION=LATEST
      - EULA=TRUE
      - MEMORY=2G
      - RCON_PASSWORD=${MINECRAFT_PASSWORD}
      - MOTD="Scarif Minecraft Server"
      - WHITELIST=${MINECRAFT_WHITELIST}
    volumes:
      - minecraft:/data

  mc-backup:
    profiles: ["prod"]
    <<: *logging
    image: itzg/mc-backup
    depends_on:
      minecraft:
        condition: service_healthy
    environment:
      - RCON_HOST=minecraft
      - RCON_PASSWORD=${MINECRAFT_PASSWORD}
      - INITIAL_DELAY=0
      - BACKUP_INTERVAL=24h
      - PAUSE_IF_NO_PLAYERS=true
      - PLAYERS_ONLINE_CHECK_INTERVAL=10
      - PRUNE_BACKUPS_DAYS=30
    volumes:
      - minecraft:/data:ro
      - /mnt/tower/backups/minecraft:/backups

  navidrome:
    profiles: ["prod"]
    <<: *logging
    image: deluan/navidrome:latest
    restart: unless-stopped
    environment:
      - VIRTUAL_HOST=radio.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - VIRTUAL_PORT=4533
      - ND_SCANSCHEDULE=1h
      - ND_LOGLEVEL=info
      - ND_SESSIONTIMEOUT=24h
      - ND_BASEURL=https://radio.${DOMAIN}
    volumes:
      - navidrome:/data
      - /mnt/tower/stardust/chris/files/Music:/music:ro
    networks:
      - nginx

  pihole:
    profiles: ["prod"]
    <<: *logging
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
    environment:
      - VIRTUAL_HOST=net.${DOMAIN}
      - CERT_NAME=${DOMAIN}
      - TZ="Europe/London"
      - WEBPASSWORD=${PIHOLE_PASSWORD}
    volumes:
      - "/docker/pihole/etc-pihole:/etc/pihole"
      - "/docker/pihole/etc-dnsmasq.d:/etc/dnsmasq.d"
    restart: unless-stopped
    networks:
      - nginx

  jitsi:
    profiles: ["prod"]
    <<: *logging
    image: jitsi/web:stable
    restart: unless-stopped
    volumes:
      - ${CONFIG}/web:/config:Z
      - ${CONFIG}/web/crontabs:/var/spool/cron/crontabs:Z
      - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts:Z
    environment:
      - VIRTUAL_HOST=comms.${DOMAIN}
      - VIRTUAL_PORT=80
      - CERT_NAME=${DOMAIN}
      - AMPLITUDE_ID
      - ANALYTICS_SCRIPT_URLS
      - ANALYTICS_WHITELISTED_EVENTS
      - AUDIO_QUALITY_OPUS_BITRATE
      - AUTO_CAPTION_ON_RECORD
      - BRANDING_DATA_URL
      - CALLSTATS_CUSTOM_SCRIPT_URL
      - CALLSTATS_ID
      - CALLSTATS_SECRET
      - CHROME_EXTENSION_BANNER_JSON
      - CONFCODE_URL
      - CONFIG_EXTERNAL_CONNECT
      - DEFAULT_LANGUAGE
      - DEPLOYMENTINFO_ENVIRONMENT
      - DEPLOYMENTINFO_ENVIRONMENT_TYPE
      - DEPLOYMENTINFO_REGION
      - DEPLOYMENTINFO_SHARD
      - DEPLOYMENTINFO_USERREGION
      - DESKTOP_SHARING_FRAMERATE_MIN
      - DESKTOP_SHARING_FRAMERATE_MAX
      - DIALIN_NUMBERS_URL
      - DIALOUT_AUTH_URL
      - DIALOUT_CODES_URL
      - DISABLE_AUDIO_LEVELS
      - DISABLE_DEEP_LINKING
      - DISABLE_GRANT_MODERATOR
      - DISABLE_HTTPS
      - DISABLE_KICKOUT
      - DISABLE_LOCAL_RECORDING
      - DISABLE_POLLS
      - DISABLE_PRIVATE_CHAT
      - DISABLE_PROFILE
      - DISABLE_REACTIONS
      - DISABLE_REMOTE_VIDEO_MENU
      - DISABLE_START_FOR_ALL
      - DROPBOX_APPKEY
      - DROPBOX_REDIRECT_URI
      - DYNAMIC_BRANDING_URL
      - ENABLE_AUDIO_PROCESSING
      - ENABLE_AUTH
      - ENABLE_BREAKOUT_ROOMS
      - ENABLE_CALENDAR
      - ENABLE_COLIBRI_WEBSOCKET
      - ENABLE_E2EPING
      - ENABLE_FILE_RECORDING_SHARING
      - ENABLE_GUESTS
      - ENABLE_HSTS
      - ENABLE_HTTP_REDIRECT
      - ENABLE_IPV6
      - ENABLE_LETS_ENCRYPT
      - ENABLE_LIPSYNC
      - ENABLE_NO_AUDIO_DETECTION
      - ENABLE_NOISY_MIC_DETECTION
      - ENABLE_OCTO
      - ENABLE_OPUS_RED
      - ENABLE_PREJOIN_PAGE
      - ENABLE_P2P
      - ENABLE_WELCOME_PAGE
      - ENABLE_CLOSE_PAGE
      - ENABLE_LIVESTREAMING
      - ENABLE_LOCAL_RECORDING_NOTIFY_ALL_PARTICIPANT
      - ENABLE_LOCAL_RECORDING_SELF_START
      - ENABLE_RECORDING
      - ENABLE_REMB
      - ENABLE_REQUIRE_DISPLAY_NAME
      - ENABLE_SERVICE_RECORDING
      - ENABLE_SIMULCAST
      - ENABLE_STATS_ID
      - ENABLE_STEREO
      - ENABLE_SUBDOMAINS
      - ENABLE_TALK_WHILE_MUTED
      - ENABLE_TCC
      - ENABLE_TRANSCRIPTIONS
      - ENABLE_XMPP_WEBSOCKET
      - ENABLE_JAAS_COMPONENTS
      - ETHERPAD_PUBLIC_URL
      - ETHERPAD_URL_BASE
      - E2EPING_NUM_REQUESTS
      - E2EPING_MAX_CONFERENCE_SIZE
      - E2EPING_MAX_MESSAGE_PER_SECOND
      - GOOGLE_ANALYTICS_ID
      - GOOGLE_API_APP_CLIENT_ID
      - HIDE_PREMEETING_BUTTONS
      - HIDE_PREJOIN_DISPLAY_NAME
      - HIDE_PREJOIN_EXTRA_BUTTONS
      - INVITE_SERVICE_URL
      - LETSENCRYPT_DOMAIN
      - LETSENCRYPT_EMAIL
      - LETSENCRYPT_USE_STAGING
      - MATOMO_ENDPOINT
      - MATOMO_SITE_ID
      - MICROSOFT_API_APP_CLIENT_ID
      - NGINX_RESOLVER
      - NGINX_WORKER_PROCESSES
      - NGINX_WORKER_CONNECTIONS
      - PEOPLE_SEARCH_URL
      - PREFERRED_LANGUAGE
      - PUBLIC_URL
      - P2P_PREFERRED_CODEC
      - RESOLUTION
      - RESOLUTION_MIN
      - RESOLUTION_WIDTH
      - RESOLUTION_WIDTH_MIN
      - START_AUDIO_MUTED
      - START_AUDIO_ONLY
      - START_BITRATE
      - START_SILENT
      - START_WITH_AUDIO_MUTED
      - START_VIDEO_MUTED
      - START_WITH_VIDEO_MUTED
      - TESTING_CAP_SCREENSHARE_BITRATE
      - TESTING_OCTO_PROBABILITY
      - TOKEN_AUTH_URL
      - TOOLBAR_BUTTONS
      - TRANSLATION_LANGUAGES
      - TRANSLATION_LANGUAGES_HEAD
      - TZ
      - USE_APP_LANGUAGE
      - VIDEOQUALITY_BITRATE_H264_LOW
      - VIDEOQUALITY_BITRATE_H264_STANDARD
      - VIDEOQUALITY_BITRATE_H264_HIGH
      - VIDEOQUALITY_BITRATE_VP8_LOW
      - VIDEOQUALITY_BITRATE_VP8_STANDARD
      - VIDEOQUALITY_BITRATE_VP8_HIGH
      - VIDEOQUALITY_BITRATE_VP9_LOW
      - VIDEOQUALITY_BITRATE_VP9_STANDARD
      - VIDEOQUALITY_BITRATE_VP9_HIGH
      - VIDEOQUALITY_ENFORCE_PREFERRED_CODEC
      - VIDEOQUALITY_PREFERRED_CODEC
      - XMPP_AUTH_DOMAIN
      - XMPP_BOSH_URL_BASE
      - XMPP_DOMAIN
      - XMPP_GUEST_DOMAIN
      - XMPP_MUC_DOMAIN
      - XMPP_RECORDER_DOMAIN
      - XMPP_PORT
      - WHITEBOARD_ENABLED
      - WHITEBOARD_COLLAB_SERVER_PUBLIC_URL
    networks:
      nginx:
      meet.jitsi:

  # XMPP server
  prosody:
    profiles: ["prod"]
    <<: *logging
    image: jitsi/prosody:stable
    restart: unless-stopped
    expose:
      - '${XMPP_PORT:-52222}'
      - '5347'
      - '5280'
    volumes:
      - ${CONFIG}/prosody/config:/config:Z
      - ${CONFIG}/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
    environment:
      - AUTH_TYPE
      - DISABLE_POLLS
      - ENABLE_AUTH
      - ENABLE_AV_MODERATION
      - ENABLE_BREAKOUT_ROOMS
      - ENABLE_END_CONFERENCE
      - ENABLE_GUESTS
      - ENABLE_IPV6
      - ENABLE_LOBBY
      - ENABLE_RECORDING
      - ENABLE_XMPP_WEBSOCKET
      - ENABLE_JAAS_COMPONENTS
      - GC_TYPE
      - GC_INC_TH
      - GC_INC_SPEED
      - GC_INC_STEP_SIZE
      - GC_GEN_MIN_TH
      - GC_GEN_MAX_TH
      - GLOBAL_CONFIG
      - GLOBAL_MODULES
      - JIBRI_RECORDER_USER
      - JIBRI_RECORDER_PASSWORD
      - JIBRI_XMPP_USER
      - JIBRI_XMPP_PASSWORD
      - JICOFO_AUTH_PASSWORD
      - JICOFO_COMPONENT_SECRET
      - JIGASI_XMPP_USER
      - JIGASI_XMPP_PASSWORD
      - JVB_AUTH_USER
      - JVB_AUTH_PASSWORD
      - JWT_APP_ID
      - JWT_APP_SECRET
      - JWT_ACCEPTED_ISSUERS
      - JWT_ACCEPTED_AUDIENCES
      - JWT_ASAP_KEYSERVER
      - JWT_ALLOW_EMPTY
      - JWT_AUTH_TYPE
      - JWT_ENABLE_DOMAIN_VERIFICATION
      - JWT_TOKEN_AUTH_MODULE
      - MATRIX_UVS_URL
      - MATRIX_UVS_ISSUER
      - MATRIX_UVS_AUTH_TOKEN
      - MATRIX_UVS_SYNC_POWER_LEVELS
      - LOG_LEVEL
      - LDAP_AUTH_METHOD
      - LDAP_BASE
      - LDAP_BINDDN
      - LDAP_BINDPW
      - LDAP_FILTER
      - LDAP_VERSION
      - LDAP_TLS_CIPHERS
      - LDAP_TLS_CHECK_PEER
      - LDAP_TLS_CACERT_FILE
      - LDAP_TLS_CACERT_DIR
      - LDAP_START_TLS
      - LDAP_URL
      - LDAP_USE_TLS
      - MAX_PARTICIPANTS
      - PROSODY_RESERVATION_ENABLED
      - PROSODY_RESERVATION_REST_BASE_URL
      - PUBLIC_URL
      - TURN_CREDENTIALS
      - TURN_HOST
      - TURNS_HOST
      - TURN_PORT
      - TURNS_PORT
      - TURN_TRANSPORT
      - TZ
      - XMPP_DOMAIN
      - XMPP_AUTH_DOMAIN
      - XMPP_GUEST_DOMAIN
      - XMPP_MUC_DOMAIN
      - XMPP_INTERNAL_MUC_DOMAIN
      - XMPP_MODULES
      - XMPP_MUC_MODULES
      - XMPP_MUC_CONFIGURATION
      - XMPP_INTERNAL_MUC_MODULES
      - XMPP_RECORDER_DOMAIN
      - XMPP_PORT
    networks:
      meet.jitsi:
        aliases:
          - ${XMPP_SERVER:-xmpp.meet.jitsi}

  # Focus component
  jicofo:
    profiles: ["prod"]
    <<: *logging
    image: jitsi/jicofo:stable
    restart: unless-stopped
    volumes:
      - ${CONFIG}/jicofo:/config:Z
    environment:
      - AUTH_TYPE
      - BRIDGE_AVG_PARTICIPANT_STRESS
      - BRIDGE_STRESS_THRESHOLD
      - ENABLE_AUTH
      - ENABLE_AUTO_OWNER
      - ENABLE_CODEC_VP8
      - ENABLE_CODEC_VP9
      - ENABLE_CODEC_H264
      - ENABLE_OCTO
      - ENABLE_RECORDING
      - ENABLE_SCTP
      - ENABLE_AUTO_LOGIN
      - JICOFO_AUTH_PASSWORD
      - JICOFO_ENABLE_BRIDGE_HEALTH_CHECKS
      - JICOFO_CONF_INITIAL_PARTICIPANT_WAIT_TIMEOUT
      - JICOFO_CONF_SINGLE_PARTICIPANT_TIMEOUT
      - JICOFO_ENABLE_HEALTH_CHECKS
      - JIBRI_BREWERY_MUC
      - JIBRI_REQUEST_RETRIES
      - JIBRI_PENDING_TIMEOUT
      - JIGASI_BREWERY_MUC
      - JIGASI_SIP_URI
      - JVB_BREWERY_MUC
      - MAX_BRIDGE_PARTICIPANTS
      - OCTO_BRIDGE_SELECTION_STRATEGY
      - SENTRY_DSN="${JICOFO_SENTRY_DSN:-0}"
      - SENTRY_ENVIRONMENT
      - SENTRY_RELEASE
      - TZ
      - XMPP_DOMAIN
      - XMPP_AUTH_DOMAIN
      - XMPP_INTERNAL_MUC_DOMAIN
      - XMPP_MUC_DOMAIN
      - XMPP_RECORDER_DOMAIN
      - XMPP_SERVER
      - XMPP_PORT
    depends_on:
      - prosody
    networks:
      meet.jitsi:

  # Video bridge
  jvb:
    profiles: ["prod"]
    <<: *logging
    image: jitsi/jvb:stable
    restart: unless-stopped
    ports:
      - '${JVB_PORT:-10000}:${JVB_PORT:-10000}/udp'
      - '127.0.0.1:${JVB_COLIBRI_PORT:-8080}:8080'
    volumes:
      - ${CONFIG}/jvb:/config:Z
    environment:
      - DOCKER_HOST_ADDRESS
      - ENABLE_COLIBRI_WEBSOCKET
      - ENABLE_OCTO
      - JVB_ADVERTISE_IPS
      - JVB_ADVERTISE_PRIVATE_CANDIDATES
      - JVB_AUTH_USER
      - JVB_AUTH_PASSWORD
      - JVB_BREWERY_MUC
      - JVB_DISABLE_STUN
      - JVB_PORT
      - JVB_MUC_NICKNAME
      - JVB_STUN_SERVERS
      - JVB_OCTO_BIND_ADDRESS
      - JVB_OCTO_REGION
      - JVB_OCTO_RELAY_ID
      - JVB_WS_DOMAIN
      - JVB_WS_SERVER_ID
      - PUBLIC_URL
      - SENTRY_DSN="${JVB_SENTRY_DSN:-0}"
      - SENTRY_ENVIRONMENT
      - SENTRY_RELEASE
      - COLIBRI_REST_ENABLED
      - SHUTDOWN_REST_ENABLED
      - TZ
      - XMPP_AUTH_DOMAIN
      - XMPP_INTERNAL_MUC_DOMAIN
      - XMPP_SERVER
      - XMPP_PORT
    depends_on:
      - prosody
    networks:
      meet.jitsi:
        aliases:
          - jvb.meet.jitsi

  db:
    profiles: ["prod", "dev"]
    <<: *logging
    image: mariadb
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --skip-innodb-read-only-compressed
    environment:
      - MYSQL_ROOT_PASSWORD=${DB_PASSWORD}
      - MYSQL_USER=${DB_USER}
      - MYSQL_PASSWORD=${DB_PASSWORD}
    volumes:
      - db:/var/lib/mysql
      - ./db/init:/docker-entrypoint-initdb.d
    restart: always
    networks:
      - db

  playwright:
    profiles: ["prod", "dev"]
    <<: *logging
    image: ghcr.io/mendableai/playwright-service:latest
    environment:
      PORT: 3000
      BLOCK_MEDIA: true
    networks:
      - playwright

  firecrawl:
    profiles: ["prod", "dev"]
    <<: [*logging, *firecrawl-service]
    environment:
      <<: *firecrawl-env
      HOST: "0.0.0.0"
      PORT: 3002
      FLY_PROCESS_GROUP: app
      ENV: local
      VIRTUAL_HOST: scraper.${DOMAIN}
      CERT_NAME: ${DOMAIN}
      VIRTUAL_PORT: 3002
    depends_on:
      - redis
      - playwright
    ports:
      - "3002:3002"
    networks:
      - redis
      - playwright
    command: [ "pnpm", "run", "start:production" ]

  firecrawl-worker:
    profiles: ["prod", "dev"]
    <<: [*firecrawl-service, *logging]
    environment:
      <<: *firecrawl-env
      FLY_PROCESS_GROUP: worker
    networks:
      - redis
      - playwright
    depends_on:
      - redis
      - playwright
      - firecrawl
    command: [ "pnpm", "run", "workers" ]

  redis:
    profiles: ["prod", "dev"]
    <<: *logging
    image: redis:alpine
    restart: always
    networks:
      - redis

  mongodb:
    profiles: ["prod", "dev"]
    # ports:
    #   - 27018:27017
    image: mongo
    restart: always
    volumes:
      - mongodb:/data/db
    command: mongod
    networks:
      - db
    environment:
      - MONGO_INITDB_ROOT_USERNAME=${DB_USER}
      - MONGO_INITDB_ROOT_PASSWORD=${DB_PASSWORD}
    <<: *logging

  meilisearch:
    profiles: ["prod", "dev"]
    image: getmeili/meilisearch:v1.12.3
    restart: always
    networks:
      - db
    # ports:
    #   - 7700:7700
    environment:
      - MEILI_HOST=http://meilisearch:7700
      - MEILI_NO_ANALYTICS=true
      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
    volumes:
      - meilisearch:/meili_data
    <<: *logging

  vectordb:
    profiles: ["prod", "dev"]
    image: ankane/pgvector:latest
    networks:
      - db
    environment:
      POSTGRES_DB: mydatabase
      POSTGRES_USER: myuser
      POSTGRES_PASSWORD: mypassword
    restart: always
    volumes:
      - pgdata2:/var/lib/postgresql/data
    <<: *logging

  rag_api:
    profiles: ["prod", "dev"]
    image: ghcr.io/danny-avila/librechat-rag-api-dev:latest
    environment:
      - DB_HOST=vectordb
      - RAG_PORT=8000
      - EMBEDDINGS_PROVIDER=huggingface
      - HF_TOKEN=${HF_TOKEN}
    restart: always
    networks:
      - db
    depends_on:
      - vectordb
    <<: *logging

  nginx:
    <<: *logging
    profiles: ["prod", "dev"]
    image: nginxproxy/nginx-proxy
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - /opt/ssl:/etc/nginx/certs:ro
      - ./nginx/vhost.d/labs_location:/etc/nginx/vhost.d/labs.${DOMAIN}_location:ro
      - ./nginx/vhost.d/office:/etc/nginx/vhost.d/office.${DOMAIN}:ro
      - ./nginx/vhost.d/rec:/etc/nginx/vhost.d/rec.${DOMAIN}:ro
      - ./nginx/vhost.d/tower_location_override:/etc/nginx/vhost.d/tower.${DOMAIN}_location_override:ro
      - ./nginx/vhost.d/tower:/etc/nginx/vhost.d/tower.${DOMAIN}:ro
      - ./nginx/conf.d/custom_proxy.conf:/etc/nginx/conf.d/custom_proxy.conf:ro
      - nextcloud:/var/www/html/nextcloud:ro
      - ./christmas:/var/www/html/christmas:ro
      # - tt-rss:/var/www/html/tt-rss:ro
    networks:
      - nginx

  certs:
    profiles: ["dev"]
    image: paulczar/omgwtfssl
    restart: "no"
    volumes:
      - /opt/ssl:/certs
    environment:
      - SSL_SUBJECT=${DOMAIN}
      - CA_SUBJECT=chris@${DOMAIN}
      - SSL_KEY=/certs/${DOMAIN}.key
      - SSL_CSR=/certs/${DOMAIN}.csr
      - SSL_CERT=/certs/${DOMAIN}.crt

volumes:
  db:
  gitea:
  nextcloud:
  foundry:
  navidrome:
  minecraft:
  change:
  mongodb:
  searxng:
  pgdata2:
  meilisearch:

networks:
  db:
  nginx:
  redis:
  meet.jitsi:
  playwright: