services:
  postgres:
    image: postgres:16-alpine
    container_name: matrix-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_INITDB_ARGS: ${POSTGRES_INITDB_ARGS}
    volumes:
      - /mnt/media/matrix/postgres:/var/lib/postgresql/data
    restart: unless-stopped
    networks:
      - matrix-internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5

  synapse:
    image: matrixdotorg/synapse:latest
    container_name: matrix-synapse
    environment:
      SYNAPSE_SERVER_NAME: ${SERVER_NAME}
      SYNAPSE_REPORT_STATS: "no"
      TZ: ${TZ}
      UID: ${PUID}
      GID: ${PGID}
    volumes:
      - /mnt/media/matrix/synapse/data:/data
      - /mnt/media/matrix/synapse/media:/media
      - ./homeserver.yaml:/data/homeserver.yaml:ro
      - /mnt/media/matrix/bridges/telegram:/data/bridges/telegram:ro
      - /mnt/media/matrix/bridges/whatsapp:/data/bridges/whatsapp:ro
      - /mnt/media/matrix/bridges/googlechat:/data/bridges/googlechat:ro
      - /mnt/media/matrix/bridges/discord:/data/bridges/discord:ro
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - homelab
      - matrix-internal
    labels:
      # Traefik
      traefik.enable: true
      traefik.docker.network: homelab

      # Matrix Client-Server and Federation API (both on same endpoint with .well-known delegation)
      traefik.http.routers.matrix.rule: Host(`${TRAEFIK_HOST}`)
      traefik.http.routers.matrix.entrypoints: websecure
      traefik.http.routers.matrix.tls.certresolver: letsencrypt
      traefik.http.routers.matrix.middlewares: matrix-headers
      traefik.http.services.matrix.loadbalancer.server.port: 8008

      # Headers middleware for Matrix
      traefik.http.middlewares.matrix-headers.headers.customrequestheaders.X-Forwarded-Proto: https
      traefik.http.middlewares.matrix-headers.headers.customresponseheaders.X-Frame-Options: SAMEORIGIN
      traefik.http.middlewares.matrix-headers.headers.customresponseheaders.X-Content-Type-Options: nosniff

      # Homarr Discovery
      homarr.name: Matrix
      homarr.group: Services
      homarr.icon: mdi:matrix

  # Telegram Bridge
  mautrix-telegram:
    image: dock.mau.dev/mautrix/telegram:latest
    container_name: matrix-telegram-bridge
    restart: unless-stopped
    volumes:
      - /mnt/media/matrix/bridges/telegram:/data
    depends_on:
      synapse:
        condition: service_started
    networks:
      - matrix-internal

  # WhatsApp Bridge
  mautrix-whatsapp:
    image: dock.mau.dev/mautrix/whatsapp:latest
    container_name: matrix-whatsapp-bridge
    restart: unless-stopped
    volumes:
      - /mnt/media/matrix/bridges/whatsapp:/data
    depends_on:
      synapse:
        condition: service_started
    networks:
      - matrix-internal

  # Google Chat Bridge
  mautrix-googlechat:
    image: dock.mau.dev/mautrix/googlechat:latest
    container_name: matrix-googlechat-bridge
    restart: unless-stopped
    volumes:
      - /mnt/media/matrix/bridges/googlechat:/data
    depends_on:
      synapse:
        condition: service_started
    networks:
      - matrix-internal

  # Element Web Client
  element-web:
    image: vectorim/element-web:latest
    container_name: matrix-element-web
    restart: unless-stopped
    volumes:
      - ./element-config.json:/app/config.json:ro
    networks:
      - homelab
    labels:
      # Traefik
      traefik.enable: true
      traefik.docker.network: homelab

      # Element Web UI
      traefik.http.routers.element.rule: Host(`chat.fig.systems`)
      traefik.http.routers.element.entrypoints: websecure
      traefik.http.routers.element.tls.certresolver: letsencrypt
      traefik.http.services.element.loadbalancer.server.port: 80

      # Homarr Discovery
      homarr.name: Element
      homarr.group: Services
      homarr.icon: mdi:chat

  # Synapse Admin - Web UI for managing users and rooms
  synapse-admin:
    image: awesometechnologies/synapse-admin:latest
    container_name: matrix-synapse-admin
    restart: unless-stopped
    networks:
      - homelab
    labels:
      # Traefik
      traefik.enable: true
      traefik.docker.network: homelab

      # Synapse Admin UI
      traefik.http.routers.synapse-admin.rule: Host(`admin.matrix.fig.systems`)
      traefik.http.routers.synapse-admin.entrypoints: websecure
      traefik.http.routers.synapse-admin.tls.certresolver: letsencrypt
      traefik.http.services.synapse-admin.loadbalancer.server.port: 80

      # Homarr Discovery
      homarr.name: Matrix Admin
      homarr.group: Services
      homarr.icon: mdi:shield-account

  # Maubot - Modular bot framework
  maubot:
    image: dock.mau.dev/maubot/maubot:latest
    container_name: matrix-maubot
    restart: unless-stopped
    volumes:
      - /mnt/media/matrix/maubot:/data
    depends_on:
      synapse:
        condition: service_started
    networks:
      - homelab
      - matrix-internal
    labels:
      # Traefik
      traefik.enable: true
      traefik.docker.network: homelab

      # Maubot Management UI
      traefik.http.routers.maubot.rule: Host(`maubot.fig.systems`)
      traefik.http.routers.maubot.entrypoints: websecure
      traefik.http.routers.maubot.tls.certresolver: letsencrypt
      traefik.http.services.maubot.loadbalancer.server.port: 29316

      # Homarr Discovery
      homarr.name: Maubot
      homarr.group: Services
      homarr.icon: mdi:robot

  # Mjolnir - Moderation bot
  mjolnir:
    image: matrixdotorg/mjolnir:latest
    container_name: matrix-mjolnir
    restart: unless-stopped
    volumes:
      - /mnt/media/matrix/mjolnir:/data
    depends_on:
      synapse:
        condition: service_started
    networks:
      - matrix-internal

  # Matrix Hookshot - GitHub/GitLab/Jira integration
  hookshot:
    image: halfshot/matrix-hookshot:latest
    container_name: matrix-hookshot
    restart: unless-stopped
    volumes:
      - /mnt/media/matrix/hookshot:/data
    depends_on:
      synapse:
        condition: service_started
    networks:
      - homelab
      - matrix-internal
    labels:
      # Traefik
      traefik.enable: true
      traefik.docker.network: homelab

      # Hookshot Webhooks
      traefik.http.routers.hookshot.rule: Host(`hookshot.fig.systems`)
      traefik.http.routers.hookshot.entrypoints: websecure
      traefik.http.routers.hookshot.tls.certresolver: letsencrypt
      traefik.http.services.hookshot.loadbalancer.server.port: 9000

      # Homarr Discovery
      homarr.name: Matrix Hookshot
      homarr.group: Services
      homarr.icon: mdi:webhook

  # Discord Bridge
  mautrix-discord:
    image: dock.mau.dev/mautrix/discord:latest
    container_name: matrix-discord-bridge
    restart: unless-stopped
    volumes:
      - /mnt/media/matrix/bridges/discord:/data
    depends_on:
      synapse:
        condition: service_started
    networks:
      - matrix-internal

  # Matrix Registration - Token-based registration management
  # DISABLED: zeratax/matrix-registration has been archived and image is no longer available
  # matrix-registration:
  #   image: zeratax/matrix-registration:latest
  #   container_name: matrix-registration
  #   restart: unless-stopped
  #   environment:
  #     MATRIX_REGISTRATION_BASE_URL: https://reg.matrix.fig.systems
  #     MATRIX_REGISTRATION_SERVER_LOCATION: http://synapse:8008
  #     MATRIX_REGISTRATION_SERVER_NAME: ${SERVER_NAME}
  #     MATRIX_REGISTRATION_SHARED_SECRET: ${SYNAPSE_REGISTRATION_SECRET}
  #     MATRIX_REGISTRATION_ADMIN_SECRET: ${MATRIX_REGISTRATION_ADMIN_SECRET}
  #     MATRIX_REGISTRATION_DISABLE_EMAIL_VALIDATION: "false"
  #     MATRIX_REGISTRATION_ALLOW_CORS: "true"
  #   volumes:
  #     - /mnt/media/matrix/registration:/data
  #   depends_on:
  #     synapse:
  #       condition: service_started
  #   networks:
  #     - homelab
  #     - matrix-internal
  #   labels:
  #     # Traefik
  #     traefik.enable: true
  #     traefik.docker.network: homelab
  #
  #     # Matrix Registration UI
  #     traefik.http.routers.matrix-registration.rule: Host(`reg.matrix.fig.systems`)
  #     traefik.http.routers.matrix-registration.entrypoints: websecure
  #     traefik.http.routers.matrix-registration.tls.certresolver: letsencrypt
  #     traefik.http.services.matrix-registration.loadbalancer.server.port: 5000
  #
  #     # Homarr Discovery
  #     homarr.name: Matrix Registration
  #     homarr.group: Services
  #     homarr.icon: mdi:account-plus

networks:
  homelab:
    external: true
  matrix-internal:
    driver: bridge