---
version: "3.8"

services:
  app:
    environment:
      - APP_SERVICES_ENABLED
      - APP_SERVICE_CONFIGS
    volumes:
      - signal-data:/signal-data

  signalbridge:
    image: dock.mau.dev/mautrix/signal:v0.7.5
    depends_on:
      - signaldb
    configs:
      - source: signal_bridge_yaml
        target: /data/config.yaml
    environment:
      - HOMESERVER_DOMAIN
      - HOMESERVER_URL
      - SIGNAL_BRIDGE_PERMISSIONS
      - SIGNAL_ENABLE_ENCRYPTION
      - SIGNAL_DEFAULT_ENCRYPTION=${SIGNAL_DEFAULT_ENCRYPTION:-false}
      - VERIFY_SSL
    secrets:
      - signal_as_token
      - signal_db_password
      - signal_hs_token
      - shared_secret_auth
      - signal_pickle_key
    volumes:
      - signal-data:/data
    networks:
      - internal

  signaldb:
    image: postgres:13-alpine
    secrets:
      - signal_db_password
    environment:
      - LC_COLLATE=C
      - LC_CTYPE=C
      - POSTGRES_DB=signalbridge
      - POSTGRES_INITDB_ARGS="-E \"UTF8\""
      - POSTGRES_PASSWORD_FILE=/run/secrets/signal_db_password
      - POSTGRES_USER=signalbridge
    networks:
      - internal
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "$POSTGRES_USER" ]
    volumes:
      - signal-postgres:/var/lib/postgresql/data
    deploy:
      labels:
        backupbot.backup.pre-hook: "/pg_backup.sh backup"
        backupbot.backup.volumes.signal-postgres.path: "backup.sql"
        backupbot.restore.post-hook: '/pg_backup.sh restore'
    configs:
        - source: pg_backup
          target: /pg_backup.sh
          mode: 0555

configs:
  signal_bridge_yaml:
    name: ${STACK_NAME}_signal_bridge_yaml_${SIGNAL_BRIDGE_YAML_VERSION}
    file: signal_bridge.yaml.tmpl
    template_driver: golang

volumes:
  signal-data:
  signal-postgres:

secrets:
  signal_db_password:
    external: true
    name: ${STACK_NAME}_signal_db_password_${SECRET_SIGNAL_DB_PASSWORD_VERSION}
  signal_as_token:
    external: true
    name: ${STACK_NAME}_signal_as_token_${SECRET_SIGNAL_AS_TOKEN_VERSION}
  signal_hs_token:
    external: true
    name: ${STACK_NAME}_signal_hs_token_${SECRET_SIGNAL_HS_TOKEN_VERSION}
  signal_pickle_key:
    external: true
    name: ${STACK_NAME}_signal_pickle_key_${SECRET_SIGNAL_PICKLE_KEY_VERSION}