---
version: "3.8"

services:
  app:
    environment:
      - APP_SERVICES_ENABLED
      - APP_SERVICE_CONFIGS
    volumes:
      - signal-data:/signal-data

  signald:
    image: docker.io/signald/signald:0.23.2-non-root
    networks:
      - internal
    volumes:
      - signald-data:/signald

  signalbridge:
    image: dock.mau.dev/mautrix/signal:v0.4.3
    depends_on:
      - signaldb
    configs:
      - source: signal_bridge_yaml
        target: /data/config.yaml
    environment:
      - HOMESERVER_DOMAIN
      - HOMESERVER_URL
      - SIGNAL_BRIDGE_PERMISSIONS
      - SIGNAL_ENABLE_ENCRYPTION
      - VERIFY_SSL
    secrets:
      - signal_as_token
      - signal_db_password
      - signal_hs_token
      - shared_secret_auth
    volumes:
      - signal-data:/data
      - signald-data:/signald
    networks:
      - internal

  signaldb:
    image: postgres:13-alpine
    secrets:
      - signal_db_password
    environment:
      - LC_COLLATE=C
      - LC_CTYPE=C
      - POSTGRES_DB=signalbridge
      - POSTGRES_INITDB_ARGS="-E \"UTF8\""
      - POSTGRES_PASSWORD_FILE=/run/secrets/signal_db_password
      - POSTGRES_USER=signalbridge
    networks:
      - internal
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "$POSTGRES_USER" ]
    volumes:
      - signal-postgres:/var/lib/postgresql/data

configs:
  signal_bridge_yaml:
    name: ${STACK_NAME}_signal_bridge_yaml_${SIGNAL_BRIDGE_YAML_VERSION}
    file: signal_bridge.yaml.tmpl
    template_driver: golang

volumes:
  signald-data:
  signal-data:
  signal-postgres:

secrets:
  signal_db_password:
    external: true
    name: ${STACK_NAME}_signal_db_password_${SECRET_SIGNAL_DB_PASSWORD_VERSION}
  signal_as_token:
    external: true
    name: ${STACK_NAME}_signal_as_token_${SECRET_SIGNAL_AS_TOKEN_VERSION}
  signal_hs_token:
    external: true
    name: ${STACK_NAME}_signal_hs_token_${SECRET_SIGNAL_HS_TOKEN_VERSION}