version: '3.8'

services:
  synapse-db:
    image: postgres:16-alpine
    container_name: synapse-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: synapse_user
      POSTGRES_PASSWORD: ${SYNAPSE_DB_PASSWORD}
      POSTGRES_DB: synapse-db
    volumes:
      - ./postgres_data:/var/lib/postgresql/data
    networks:
      - matrix-net

  synapse:
    image: matrixdotorg/synapse:latest
    container_name: matrix-synapse
    restart: unless-stopped
    depends_on:
      - synapse-db
    volumes:
      - ./synapse_data:/data
      - ./data:/raw-data
    environment:
      - SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
    # Expose internally or to a reverse proxy. 
    # If using Traefik, omit ports and use labels instead.
    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.matrix.entrypoints=websecure"
      - "traefik.http.routers.matrix.rule=Host(`matrix.riverrooks.dev`)"

      - "traefik.http.routers.matrix.service=matrix-service"
      - "traefik.http.services.matrix-service.loadbalancer.server.port=8008"

      - "traefik.http.routers.matrix.tls=true"
      - "traefik.http.routers.matrix.tls.certresolver=basic"

      - "traefik.http.routers.matrix.middlewares=matrix-raw-path"
      - "traefik.http.routers.matrix.middlewares.matrix-raw-path.plugin.allowEncodedSlash=true"

    networks:
      - matrix-net
      - traefik
  matrix-delegation:
    image: nginx:alpine
    container_name: matrix-delegation
    restart: unless-stopped
    # Generates the file dynamically and starts nginx
    command: >
      /bin/sh -c "mkdir -p /usr/share/nginx/html/.well-known/matrix 
      && echo '{\"m.server\": \"matrix.riverrooks.dev:443\"}' > /usr/share/nginx/html/.well-known/matrix/server 
      && nginx -g 'daemon off;'"
    labels:
      - "traefik.enable=true"
      # Crucial: This intercepts only the specific Matrix path on the root domain
      - "traefik.http.routers.matrix-delegation.rule=Host(`riverrooks.dev`) && PathPrefix(`/.well-known/matrix/server`)"
      - "traefik.http.routers.matrix-delegation.entrypoints=websecure" 
      - "traefik.http.routers.matrix-delegation.tls.certresolver=basic"


networks:
  matrix-net:
    driver: bridge
  traefik:
    external: true