services:
  synapse:
    image: matrixdotorg/synapse:v1.128.0
    restart: unless-stopped
    depends_on:
      init:
        condition: service_completed_successfully
        restart: true
      postgres:
        condition: service_healthy
        restart: true
    secrets:
      - signing_key
    environment:
      UID: 2016 # synapse
      GID: 2016 # synapse
      SYNAPSE_SERVER_NAME: smonk.ing
      SYNAPSE_REPORT_STATS: no
      SYNAPSE_HTTP_PORT: 8008
      SYNAPSE_CONFIG_DIR: /data
      SYNAPSE_CONFIG_PATH: /data/homeserver.yml
      SYNAPSE_DATA_DIR: /data
      SYNAPSE_WORKER: synapse.app.homeserver
      TZ: UTC
    volumes:
      - synapse_data:/data:rw
      - ./config/homeserver.yml:/data/homeserver.yml:ro
      - ./config/log_config.yml:/data/log_config.yml:ro
    networks:
      - synapse_network
    dns:
      - 9.9.9.9         # Quad9
      - 149.112.112.112 # Quad9
    ports:
      - 8008:8008
    labels:
      diun.enable: "true"
      diun.watch_repo: "true"
      diun.include_tags: "latest"

  postgres:
    image: docker.io/postgres:17.4
    user: 2016:2016 # synapse:synapse
    restart: unless-stopped
    depends_on:
      init:
        condition: service_completed_successfully
        restart: true
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U synapse -d synapse"]
      interval: 10s
      retries: 5
      start_period: 30s
      timeout: 10s
    secrets:
      - postgres_password
    environment:
      PGDATA: /var/lib/postgresql/data/pgdata
      POSTGRES_DB: synapse
      POSTGRES_USER: synapse
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      POSTGRES_INITDB_ARGS: --encoding=UTF-8 --lc-collate=C --lc-ctype=C
    volumes:
      - postgres_data:/var/lib/postgresql/data:rw
    networks:
      - synapse_network
    labels:
      diun.enable: "true"
      diun.watch_repo: "true"
      diun.include_tags: "latest"

  init:
    image: busybox:1.37.0
    user: root:root
    command: /init.sh
    restart: no
    network_mode: none
    volumes:
      - ./init.sh:/init.sh:ro
      # Used for resolving user and group names in the init script
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro
      # Mount all named volumes so they can be initialised
      - synapse_data:/synapse_data:rw
      - postgres_data:/postgres_data:rw
    labels:
      diun.enable: "true"
      diun.watch_repo: "true"
      diun.include_tags: "latest"

secrets:
  signing_key:
    environment: SIGNING_KEY
  postgres_password:
    environment: POSTGRES_PASSWORD

volumes:
  synapse_data:
  postgres_data:

networks:
  synapse_network:
    driver: bridge