docker-compose.yml

name: quickchat

x-logging: &default-logging
  driver: json-file
  options:
    max-size: "50m"
    max-file: "3"

services:
  quickchat:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        VERSION: ${QUICKCHAT_VERSION:-dev}
        REVISION: ${QUICKCHAT_REVISION:-unknown}
    image: quickchat:latest
    restart: unless-stopped
    user: "65532:65532"
    environment:
      - QUICKCHAT_ADDR=:8080
      - QUICKCHAT_DATA=/data
      - QUICKCHAT_ROOM_TTL=${QUICKCHAT_ROOM_TTL:-168h}
      - QUICKCHAT_MAX_FILE=${QUICKCHAT_MAX_FILE:-67108864}
      - QUICKCHAT_ICE_SERVERS=${QUICKCHAT_ICE_SERVERS:-}
      - QUICKCHAT_PPROF=${QUICKCHAT_PPROF:-}
      - QUICKCHAT_TRUSTED_PROXY=true
      - LIVEKIT_INTERNAL_URL=http://livekit:7880
      - LIVEKIT_API_KEY=${LIVEKIT_API_KEY:?}
      - LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET:?}
      - TZ=${TZ:-UTC}
    volumes:
      - quickchat-data:/data
    tmpfs:
      - /tmp:size=64m,mode=1777
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    expose:
      - "8080"
    networks:
      - web
    labels:
      - traefik.enable=true
      - traefik.docker.network=quickchat-web
      - traefik.http.routers.quickchat.rule=Host(`${QUICKCHAT_DOMAIN:?}`)
      - traefik.http.routers.quickchat.entrypoints=websecure
      - traefik.http.routers.quickchat.tls.certresolver=le
      - traefik.http.services.quickchat.loadbalancer.server.port=8080
    healthcheck:
      test: ["CMD", "/quickchat", "healthcheck"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 256M
    logging: *default-logging

  # bundled livekit server so the stack is all in one. the app proxies
  # its signaling under /rtc on the main domain; media rides dedicated
  # ports. on a vps, open 7881/tcp and 7882/udp in the firewall.
  livekit:
    image: livekit/livekit-server:v1.13.10@sha256:89ca9ce0791e18d6e03bf6e2c49ceb27e1c754eae8bd50c989386c1a5963791a
    restart: unless-stopped
    user: "65532:65532"
    environment:
      LIVEKIT_KEYS: "${LIVEKIT_API_KEY:?}: ${LIVEKIT_API_SECRET:?}"
      # advertise the public ip via stun by default. To pin it, set
      # LIVEKIT_USE_EXTERNAL_IP=false and LIVEKIT_NODE_IP=<ip>.
      NODE_IP: "${LIVEKIT_NODE_IP:-}"
      LIVEKIT_CONFIG: |
        port: 7880
        rtc:
          tcp_port: 7881
          udp_port: 7882
          use_external_ip: ${LIVEKIT_USE_EXTERNAL_IP:-true}
      TZ: ${TZ:-UTC}
      HOME: /tmp
    ports:
      - "7881:7881"
      - "7882:7882/udp"
    tmpfs:
      - /tmp:size=64m,mode=1777
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    expose:
      - "7880"
    networks:
      - web
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 512M
    logging: *default-logging

  traefik:
    image: docker.io/library/traefik:v3.7.15@sha256:0f6150202bc1fed72a7bd2107460eaa510e5b8a905f3fdb5b84f2c8619c33368
    restart: unless-stopped
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=quickchat-web
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.le.acme.tlschallenge=true
      - --certificatesresolvers.le.acme.email=${ACME_EMAIL:?}
      - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      # traefik only needs read access to the docker API. For a stricter
      # setup, front the socket with wollomatic/socket-proxy and point
      # providers.docker.endpoint at it instead.
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-certs:/letsencrypt
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:size=32m,mode=1777
    networks:
      - web
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 128M
    logging: *default-logging

networks:
  web:
    driver: bridge

volumes:
  quickchat-data:
  traefik-certs: