---
version: '3.8'

services:
  bbb-web:
    image: alangecker/bbb-docker-web:v3.0.19
    depends_on:
        - redis
        - etherpad
        - bbb-pads
        - collabora
    # healthcheck:
        # test: wget --no-proxy --no-verbose --tries=1 --spider http://10.7.7.2:8090/bigbluebutton/api || exit 1
        # start_period: 2m
    environment:
      DEV_MODE: ${DEV_MODE:-}
      IGNORE_TLS_CERT_ERRORS: ${IGNORE_TLS_CERT_ERRORS:-true}
      DOMAIN: ${DOMAIN}
      ENABLE_RECORDING: ${ENABLE_RECORDING:-false}
      WELCOME_MESSAGE: ${WELCOME_MESSAGE:-}
      WELCOME_FOOTER: ${WELCOME_FOOTER}
      STUN_SERVER: stun:${STUN_IP}:${STUN_PORT}
      ENABLE_HTTPS_PROXY: ${ENABLE_HTTPS_PROXY:-false}
      # SHARED_SECRET is set via entrypoint.bbb-web.sh
      # TURN_SECRET is set via entrypoint.bbb-web.sh
      ENABLE_LEARNING_DASHBOARD: ${ENABLE_LEARNING_DASHBOARD:-true}
      COLLABORA_URL: ${COLLABORA_URL:-https://collabora:9980/cool}
      # NUMBER_OF_BACKEND_NODEJS_PROCESSES: 2 # look for containers?
    configs:
      - source: entrypoint_bbbweb
        target: /usr/local/bin/docker-entrypoint.sh
        mode: 0555
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    secrets:
       - shared_secret
       - turn_secret
    volumes:
      - bigbluebutton:/var/bigbluebutton
      - vol-freeswitch:/var/freeswitch/meetings
    networks:
      - internal

  # freeswitch (audio input streaming and telco dial-in support)
  freeswitch:
    image: alangecker/bbb-docker-freeswitch:v1.10.12-v3.0.19
    deploy:
      replicas: 1
      endpoint_mode: dnsrr
    cap_add:
      - IPC_LOCK
      - NET_ADMIN
      - NET_RAW
      - NET_BROADCAST
      - SYS_NICE
      - SYS_RESOURCE
    environment:
      DOMAIN: ${DOMAIN}
      EXTERNAL_IPv4: ${EXTERNAL_IPv4}
      # EXTERNAL_IPv6: ${EXTERNAL_IPv6:-::1}
      SIP_IP_ALLOWLIST: ${SIP_IP_ALLOWLIST:-}
      DISABLE_SOUND_MUTED: ${DISABLE_SOUND_MUTED:-false}
      DISABLE_SOUND_ALONE: ${DISABLE_SOUND_ALONE:-false}
      SOUNDS_LANGUAGE: ${SOUNDS_LANGUAGE:-en-us-callie}
      # ESL_PASSWORD is set via entrypoint.freeswitch.sh
    configs:
      - source: entrypoint_freeswitch
        target: /usr/local/bin/docker-entrypoint.sh
        mode: 0555
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    secrets:
      - fsesl_password
    volumes:
      # - ./conf/sip_profiles:/etc/freeswitch/sip_profiles/external
      # - ./conf/dialplan_public:/etc/freeswitch/dialplan/public_docker
      - vol-freeswitch:/var/freeswitch/meetings
    # network_mode: host
    networks:
      - internal
    logging:
      # reduce logs to a minimum, so `docker compose logs -f` still works
      driver: "local"
      options:
        max-size: "10k"
        max-file: "1"
        compress: "false"

  # nginx (webserver gateway for a bunch of things)
  nginx:
    image: alangecker/bbb-docker-nginx:v3.0.19-v5.4.3-1.29
    volumes:
      - bigbluebutton:/var/bigbluebutton
    tmpfs:
     - /tmp
    configs:
      - source: nginx_conf
        target: /etc/nginx/nginx.conf
        mode: 0555
#      - source: beg_conf
#        target: /etc/nginx/bbb/bbb-exporter.nginx
#        mode: 0555
      - source: bhdn_conf # used to be in dev mode
        target: /etc/nginx/bbb/bbb-html5.nginx
        mode: 0555
      - source: wn_conf
        target: /etc/nginx/bbb/webhooks.nginx
        mode: 0555
      - source: wsn_conf
        target: /etc/nginx/bbb/webrtc-sfu.nginx
        mode: 0555
      - source: pres_conf
        target: /www/default.pdf
        mode: 0555
      - source: demo_conf
        target: /etc/nginx/bbb/demo.nginx
        mode: 0555
    networks:
      - proxy
      - internal
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=48087"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.scheme=https"
        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.permanent=true" 
    # extra_hosts:
    #   - "host.docker.internal:10.7.7.1"
    #   - "bbb-web:10.7.7.2"
    #   - "etherpad:10.7.7.4"
    #   - "webrtc-sfu:10.7.7.1"
    #   - "greenlight:10.7.7.21"
    #   - "bbb-graphql-server:10.7.7.31"
    #   - "bbb-graphql-middleware:10.7.7.32"

  # etherpad (collaborative notepad)
  etherpad:
    image: alangecker/bbb-docker-etherpad:2.4.2-s8328b77-p88f3f6b
    depends_on:
      - redis
      - collabora
    environment:
      COLLABORA_URL: ${COLLABORA_URL:-https://collabora:9980/cool}
      # ETHERPAD_API_KEY is set via entrypoint
    configs:
       - source: entrypoint_etherpad
         target: /usr/local/bin/docker-entrypoint.sh
         mode: 0555
    secrets:
       - etherpad_api_key
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    networks:
      - internal
  
  # bbb-pads (bbb etherpad integration)
  bbb-pads:
    image: alangecker/bbb-docker-pads:v1.5.6
    depends_on:
      - redis
      - etherpad
    # environment:
      # ETHERPAD_API_KEY is set via entrypoint
    configs:
       - source: entrypoint_bbbpads
         target: /usr/local/bin/docker-entrypoint.sh
         mode: 0555
    secrets:
       - etherpad_api_key
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    networks:
      - internal

  # redis (caching)
  redis:
    image: redis:8.4-alpine
    #healthcheck:
    #  test: ["CMD", "redis-cli", "ping"]
    #  interval: 1s
    #  timeout: 3s
    #  retries: 30
    networks:
      - internal
  
  bbb-export-annotations:
    image: alangecker/bbb-docker-bbb-export-annotations:v3.0.19
    depends_on:
      - redis
      - etherpad
      - bbb-pads
    networks:
    # need connections to:
    # https://github.com/bigbluebutton/bigbluebutton/blob/v2.7.0/bbb-export-annotations/config/settings.json
    # "bbbWebAPI": "http://127.0.0.1:8090",    -> bbb-web
    # "bbbPadsAPI": "http://127.0.0.1:9002",   -> bbb-pads
      - internal
    volumes:
      - bigbluebutton:/var/bigbluebutton
    tmpfs:
      - /tmp

  # webrtc-sfu (webrtc controller for negotiation and media stream)
  webrtc-sfu:
    image: alangecker/bbb-docker-webrtc-sfu:v2.21.2
    depends_on:
      - redis
      - freeswitch
    ports:
      # mediasoup UDP port range — must match mediasoup.worker.rtcMinPort/rtcMaxPort in webrtc-sfu-config.yaml
      - "24577-24676:24577-24676/udp"
    environment:
      # ESL_PASSWORD is set via entrypoint.webrtc-sfu.sh
      # ip must be 0.0.0.0 (container can't bind to external host IP)
      MS_WEBRTC_LISTEN_IPS: '[{"ip":"${EXTERNAL_IPv4}", "announcedIp":"${EXTERNAL_IPv4}"}]'
    configs:
      - source: entrypoint_webrtcsfu
        target: /usr/local/bin/docker-entrypoint.sh
        mode: 0555
      - source: ws_conf
        target: /etc/bigbluebutton/bbb-webrtc-sfu/production.yml
        mode: 0555
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    volumes:
      - vol-mediasoup:/var/mediasoup
    tmpfs:
      - /var/log/bbb-webrtc-sfu
    secrets:
       - fsesl_password
    # network_mode: host would be needed for mediasoup UDP to work from outside;
    # keeping on overlay network for now so other services can reach it by name.
    #security_opt:
    #  - seccomp:unconfined # allow io_uring access for mediasoup
    ulimits:
      memlock: -1 # allow io_uring_register_buffers to allocate enough ram
    networks:
      - internal


  # fsesl-akka (bbb freeswitch integration)
  fsesl-akka:
    image: alangecker/bbb-docker-fsesl-akka:v3.0.19
    depends_on:
      - redis
      - freeswitch
    # environment:
      # FSESL_PASSWORD is set via entrypoint
    configs:
       - source: entrypoint_fseslakka
         target: /usr/local/bin/docker-entrypoint.sh
         mode: 0555
    secrets:
       - fsesl_password
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    networks:
      - internal
  
  # apps-akka (seems to be an bbb app integration endpoint)
  apps-akka:
    image: alangecker/bbb-docker-apps-akka:v3.0.19
    depends_on:
      - redis
    environment:
      DOMAIN: ${DOMAIN}
      # SHARED_SECRET is set via entrypoint
    volumes:
      - vol-freeswitch:/var/freeswitch/meetings
    configs:
       - source: entrypoint_appsakka
         target: /usr/local/bin/docker-entrypoint.sh
         mode: 0555
       - source: bbbhtml5_conf
         target: /etc/bigbluebutton/bbb-html5.yml
         mode: 0555 
       - source: aa_conf
         target: /etc/bigbluebutton/bbb-apps-akka.conf.tmpl
         mode: 0555
    secrets:
       - shared_secret
       - postgres_password
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    networks:
      - internal

  bbb-graphql-server:
    image: alangecker/bbb-docker-graphql-server:v3.0.19
    depends_on:
      - postgres
      - bbb-web
      - apps-akka
      - bbb-graphql-actions
    secrets:
      - postgres_password
      - hasura_admin_secret
    environment:
      POSTGRES_USER: postgres
      # POSTGRES_PASSWORD and HASURA_GRAPHQL_ADMIN_SECRET are set via entrypoint
    configs:
      - source: entrypoint_graphqlserver
        target: /usr/local/bin/docker-entrypoint.sh
        mode: 0555
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8085/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - internal
  
  bbb-graphql-actions:
    image: alangecker/bbb-docker-graphql-actions:v3.0.19
    depends_on:
      - redis
      - apps-akka
    networks:
      - internal

  bbb-graphql-middleware:
    image: alangecker/bbb-docker-graphql-middleware:v3.0.19
    depends_on:
      - bbb-graphql-server
      - bbb-graphql-actions
      - bbb-web
      - redis
    networks:
      - internal
    # extra_hosts:
    #   - "nginx:10.7.7.1"

  collabora:
    image: collabora/code:latest
    tmpfs:
      - /tmp
    networks:
      - internal
    # disable logging (way to verbose)
    logging:
      driver: none

  # periodic (runs a freeswitch sync and cleans up recordings, has entrypoint but needs no custom things afaik)
  periodic:
    image: alangecker/bbb-docker-periodic:v3.0.0
    depends_on:
      - postgres
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # not sure what prupose this has?
      - bigbluebutton:/var/bigbluebutton # access bbb data
      - vol-mediasoup:/var/mediasoup # not sure what this is?
    tmpfs:
      - /var/log/bigbluebutton
    environment:
      ENABLE_RECORDING: ${ENABLE_RECORDING-false} # set to false for now
      REMOVE_OLD_RECORDING: ${REMOVE_OLD_RECORDING}
      RECORDING_MAX_AGE_DAYS: ${RECORDING_MAX_AGE_DAYS}
    networks:
      - internal

  bbb-webrtc-recorder:
    image: alangecker/bbb-docker-webrtc-recorder:v0.13.1
    depends_on:
      - redis
    volumes:
      - vol-webrtc-recorder:/var/lib/bbb-webrtc-recorder
    networks:
      - internal

  # coturn (TURN server — must use host networking for UDP relay to reach clients)
  coturn:
    image: coturn/coturn:4.8-alpine
    command:
      - "--external-ip=${EXTERNAL_IPv4}/${EXTERNAL_IPv4}"
      - "--external-ip=${EXTERNAL_IPv6:-::1}/${EXTERNAL_IPv6:-::1}"
      - "--allowed-peer-ip=${EXTERNAL_IPv4}"
      - "--relay-ip=${EXTERNAL_IPv4}"
      - "--relay-ip=${EXTERNAL_IPv6:-::1}"
    configs:
      - source: entrypoint_coturn
        target: /usr/local/bin/docker-entrypoint.sh
        mode: 0555
      - source: turnserver_conf
        target: /etc/coturn/turnserver.conf
    secrets:
      - turn_secret
    environment:
      ENABLE_HTTPS_PROXY: "false"
    # volumes:
    #   - "/var/home/thebastard/.abra/recipes/bigbluebutton/cert/cert.pem:/tmp/cert.pem:ro"
    #   - "/var/home/thebastard/.abra/recipes/bigbluebutton/cert/key.pem:/tmp/key.pem:ro"
    # network_mode: host <- mine has this commented out
    network_mode: host
    user: root
    entrypoint: /usr/local/bin/docker-entrypoint.sh

  # greenlight
  greenlight:
    image: bigbluebutton/greenlight:v3.6.3
    depends_on:
      - postgres
      - redis
    environment:
      # DATABASE_URL is being set by entrypoint.greenlight.sh
      REDIS_URL: redis://redis:6379
      BIGBLUEBUTTON_ENDPOINT: https://${DOMAIN}/bigbluebutton/api
      # BIGBLUEBUTTON_SECRET is being set by entrypoint.greenlight.sh
      # SECRET_KEY_BASE is being set by entrypoint.greenlight.sh
      RELATIVE_URL_ROOT: /
    volumes:
       - greenlight_data:/usr/src/app/storage
    configs:
       - source: entrypoint_greenlight
         target: /usr/local/bin/docker-entrypoint.sh
         mode: 0555
    secrets: 
       - postgres_password
       - shared_secret
       - rails_secret
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    networks:
      - internal

  # postgres for greenlight
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_MULTIPLE_DATABASES: bbb_graphql,hasura_app,greenlight
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5
    volumes:
      - "postgres_data:/var/lib/postgresql/data"
    configs:
      - source: initdb_sh
        target: /docker-entrypoint-initdb.d/initdb.sh
        mode: 0555
    secrets:
      - postgres_password
    networks:
      - internal

  netshoot:
    image: nicolaka/netshoot
    entrypoint: /bin/bash
    command: -c "sleep infinity"
    networks:
      - internal

volumes:
  greenlight_data:
  postgres_data:
  bigbluebutton:
  vol-mediasoup:
  vol-freeswitch:
  vol-webrtc-recorder:

configs:
  entrypoint_greenlight:
    name: ${STACK_NAME}_entrypoint_greenlight_${ENTRYPOINT_GREENLIGHT_VERSION}
    file: ./entrypoint.greenlight.sh
  turnserver_conf:
    name: ${STACK_NAME}_turnserver_conf_${TURNSERVER_CONF_VERSION}
    file: ./turnserver.conf
  bbbhtml5_conf:
    name: ${STACK_NAME}_bbbhtml5_conf_${BBBHTML5_CONF_VERSION}
    file: ./bbb-html5.yml
  entrypoint_coturn:
    name: ${STACK_NAME}_entrypoint_coturn_${ENTRYPOINT_COTURN_VERSION}
    file: ./entrypoint.coturn.sh
  entrypoint_appsakka:
    name: ${STACK_NAME}_entrypoint_appsakka_${ENTRYPOINT_APPSAKKA_VERSION}
    file: ./entrypoint.apps-akka.sh
  entrypoint_fseslakka:
    name: ${STACK_NAME}_entrypoint_fseslakka_${ENTRYPOINT_FSESLAKKA_VERSION}
    file: ./entrypoint.fsesl-akka.sh
  entrypoint_webrtcsfu:
    name: ${STACK_NAME}_entrypoint_webrtcsfu_${ENTRYPOINT_WEBRTCSFU_VERSION}
    file: ./entrypoint.webrtc-sfu.sh
  entrypoint_graphqlserver:
    name: ${STACK_NAME}_entrypoint_graphqlserver_${ENTRYPOINT_GRAPHQLSERVER_VERSION}
    file: ./entrypoint.bbb-graphql-server.sh
  initdb_sh:
    name: ${STACK_NAME}_initdb_sh_${INITDB_SH_VERSION}
    file: ./mod/initdb.sh
  entrypoint_bbbpads:
    name: ${STACK_NAME}_entrypoint_bbbpads_${ENTRYPOINT_BBBPADS_VERSION}
    file: ./entrypoint.bbb-pads.sh
  entrypoint_etherpad:
    name: ${STACK_NAME}_entrypoint_etherpad_${ENTRYPOINT_ETHERPAD_VERSION}
    file: ./entrypoint.etherpad.sh
  entrypoint_freeswitch:
    name: ${STACK_NAME}_entrypoint_freeswitch_${ENTRYPOINT_FREESWITCH_VERSION}
    file: ./entrypoint.freeswitch.sh
  entrypoint_bbbweb:
    name: ${STACK_NAME}_entrypoint_bbbweb_${ENTRYPOINT_BBBWEB_VERSION}
    file: ./entrypoint.bbb-web.sh
  aa_conf:
    name: ${STACK_NAME}_aa_conf_${AA_CONF_VERSION}
    file: ./mod/bbb-apps-akka.conf
  beg_conf:
    name: ${STACK_NAME}_beg_conf_${BEG_CONF_VERSION}
    file: ./mod/bbb-exporter.nginx
  bhdn_conf:
    name: ${STACK_NAME}_bhdn_conf_${BHDN_CONF_VERSION}
    file: ./mod/nginx/bbb/bbb-html5.nginx
  brf_conf:
    name: ${STACK_NAME}_brf_conf_${BRF_CONF_VERSION}
    file: ./mod/bbb-resync-freeswitch
  nginx_conf:
    name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
    file: ./mod/nginx.conf
  wn_conf:
    name: ${STACK_NAME}_wn_conf_${WN_CONF_VERSION}
    file: ./mod/webhooks.nginx
  wsn_conf:
    name: ${STACK_NAME}_wsn_conf_${WSN_CONF_VERSION}
    file: ./mod/webrtc-sfu.nginx
  ws_conf:
    name: ${STACK_NAME}_ws_conf_${WS_CONF_VERSION}
    file: ./mod/webrtc-sfu-config.yaml
  demo_conf:
    name: ${STACK_NAME}_demo_conf_${DEMO_CONF_VERSION}
    file: ./mod/nginx/bbb/demo.nginx
  pres_conf: # the default presentation for bbb nginx
    name: ${STACK_NAME}_pres_conf_${PRES_CONF_VERSION}
    file: ./mod/nginx/default.pdf
  freeswitch_ex:
    name: ${STACK_NAME}_freeswitch_ex_${FREESWITCH_EX_VERSION}
    file: ./mod/freeswitch/conf/sip_profiles/external.xml

secrets:
  postgres_password:
    external: true
    name: ${STACK_NAME}_postgres_password_${SECRET_POSTGRES_PASSWORD_VERSION}
  shared_secret:
    external: true
    name: ${STACK_NAME}_shared_secret_${SECRET_SHARED_SECRET_VERSION}
  rails_secret:
    external: true
    name: ${STACK_NAME}_rails_secret_${SECRET_RAILS_SECRET_VERSION}
  turn_secret:
    external: true
    name: ${STACK_NAME}_turn_secret_${SECRET_TURN_SECRET_VERSION}
  fsesl_password:
    external: true
    name: ${STACK_NAME}_fsesl_password_${SECRET_FSESL_PASSWORD_VERSION}
  etherpad_api_key:
    external: true
    name: ${STACK_NAME}_etherpad_api_key_${ETHERPAD_API_KEY_VERSION}
  hasura_admin_secret:
    external: true
    name: ${STACK_NAME}_hasura_admin_secret_${SECRET_HASURA_ADMIN_SECRET_VERSION}

networks:
  proxy:
    external: true
  internal: