docker-compose.template.yml

version: '3.8'

services:
  frontend:
    image: ghcr.io/johnr24/colourstream-frontend:latest
    # build:
    #   context: ./frontend
    #   dockerfile: Dockerfile
    container_name: colourstream-frontend
    env_file: 
      - ./frontend/.env # Frontend specific env
    environment:
      VITE_API_URL: https://live.colourstream.${DOMAIN}/api
      VITE_OIDC_AUTH_ENDPOINT: ${OIDC_AUTH_ENDPOINT}
      VITE_WEBRTC_WS_HOST: live.colourstream.${DOMAIN}
      VITE_WEBRTC_WS_PORT: 3334
      VITE_WEBRTC_WS_PROTOCOL: wss
      VITE_WEBRTC_APP_PATH: app
      VITE_VIDEO_URL: https://video.colourstream.${DOMAIN}/join
      VITE_OVENPLAYER_SCRIPT_URL: https://cdn.jsdelivr.net/npm/ovenplayer/dist/ovenplayer.js
      VITE_UPLOAD_ENDPOINT_URL: https://upload.colourstream.${DOMAIN}/files/
      VITE_NAMEFORUPLOADCOMPLETION: ${NAMEFORUPLOADCOMPLETION}
      VITE_ENABLE_DROPBOX: "false"
      VITE_ENABLE_GOOGLE_DRIVE: ${VITE_ENABLE_GOOGLE_DRIVE:-false}
      VITE_GOOGLE_DRIVE_CLIENT_ID: ${VITE_GOOGLE_DRIVE_CLIENT_ID}
      VITE_GOOGLE_DRIVE_API_KEY: ${VITE_GOOGLE_DRIVE_API_KEY}
      VITE_GOOGLE_DRIVE_APP_ID: ${VITE_GOOGLE_DRIVE_APP_ID}
    ports:
      - "3000:3000"
    networks:
      - network
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      
      # Main frontend application - primary domain
      - "traefik.http.routers.frontend.rule=Host(`live.colourstream.${DOMAIN}`)"
      - "traefik.http.routers.frontend.entrypoints=websecure"
      - "traefik.http.routers.frontend.tls=true"
      - "traefik.http.routers.frontend.tls.certresolver=myresolver"
      - "traefik.http.routers.frontend.service=frontend"
      - "traefik.http.services.frontend.loadbalancer.server.port=3000"
      - "traefik.http.routers.frontend.priority=10"  # Lower priority than backend
      
      # Static assets router configuration - primary domain
      - "traefik.http.routers.frontend-static.rule=Host(`live.colourstream.${DOMAIN}`) && (PathPrefix(`/assets`) || PathPrefix(`/static`) || Path(`/favicon.ico`) || Path(`/manifest.json`) || Path(`/robots.txt`) || Path(`/config/runtime-config.js`))"
      - "traefik.http.routers.frontend-static.entrypoints=websecure"
      - "traefik.http.routers.frontend-static.tls=true"
      - "traefik.http.routers.frontend-static.tls.certresolver=myresolver"
      - "traefik.http.routers.frontend-static.service=frontend"
      - "traefik.http.routers.frontend-static.priority=200"
      
      # SPA router configuration - primary domain
      - "traefik.http.routers.frontend-spa.rule=Host(`live.colourstream.${DOMAIN}`) && (PathPrefix(`/admin`) || PathPrefix(`/login`) || PathPrefix(`/room`) || PathPrefix(`/upload`)) && !PathPrefix(`/files`) && !HeadersRegexp(`X-Requested-With`, `XMLHttpRequest`) && !Method(`POST`) && !Method(`PATCH`) && !Method(`HEAD`)"
      - "traefik.http.routers.frontend-spa.entrypoints=websecure"
      - "traefik.http.routers.frontend-spa.tls=true"
      - "traefik.http.routers.frontend-spa.tls.certresolver=myresolver"
      - "traefik.http.routers.frontend-spa.service=frontend"
      - "traefik.http.routers.frontend-spa.middlewares=spa-fallback"
      - "traefik.http.routers.frontend-spa.priority=100"
      
      # Fallback middleware setup - primary domain
      - "traefik.http.middlewares.spa-fallback.replacepathregex.regex=^/(admin|login|room|upload).*"
      - "traefik.http.middlewares.spa-fallback.replacepathregex.replacement=/"
      
      # Root router configuration - primary domain
      - "traefik.http.routers.frontend-root.rule=Host(`live.colourstream.${DOMAIN}`) && Path(`/`) && !PathPrefix(`/files`)"
      - "traefik.http.routers.frontend-root.entrypoints=websecure"
      - "traefik.http.routers.frontend-root.tls=true"
      - "traefik.http.routers.frontend-root.tls.certresolver=myresolver"
      - "traefik.http.routers.frontend-root.service=frontend"
      - "traefik.http.routers.frontend-root.priority=50"
      
      # Upload Portal - upload subdomain
      - "traefik.http.routers.frontend-upload.rule=Host(`upload.colourstream.${DOMAIN}`)"
      - "traefik.http.routers.frontend-upload.entrypoints=websecure"
      - "traefik.http.routers.frontend-upload.tls=true"
      - "traefik.http.routers.frontend-upload.tls.certresolver=myresolver"
      - "traefik.http.routers.frontend-upload.service=frontend"
      - "traefik.http.routers.frontend-upload.priority=10" # Lower priority than tusd for specific paths
      - "traefik.http.routers.frontend-upload.middlewares=upload-spa-fallback"
      
      # SPA fallback middleware for upload portal
      - "traefik.http.middlewares.upload-spa-fallback.replacepathregex.regex=^/portal/.*"
      - "traefik.http.middlewares.upload-spa-fallback.replacepathregex.replacement=/"

  postgres:
    container_name: colourstream-postgres
    image: postgres:17-alpine
    restart: always
    expose:
      - "5432"
    env_file:
      - ./.env
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./postgres/postgresql.conf:/etc/postgresql/postgresql.conf
    command: postgres -c config_file=/etc/postgresql/postgresql.conf
    networks:
      - network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U colourstream"]
      interval: 10s
      timeout: 5s
      retries: 5
    labels:
      - "traefik.enable=false"

  backend:
    image: ghcr.io/johnr24/colourstream-backend:latest
    # build:
    #   context: ./backend
    #   dockerfile: Dockerfile
    restart: always
    expose:
      - 5001
    env_file:
      - ./.env
      - ./backend/.env
    environment:
      NODE_ENV: production
      WEBAUTHN_RP_ID: live.colourstream.${DOMAIN}
      WEBAUTHN_ORIGIN: https://live.colourstream.${DOMAIN}
      DOMAIN: ${DOMAIN}
      VIDEO_DOMAIN: video.colourstream.${DOMAIN}
      FRONTEND_URL: https://live.colourstream.${DOMAIN}
      BASE_PATH: /api
      OME_WEBHOOK_SECRET: ${OME_WEBHOOK_SECRET}
      POSTGRES_USER: colourstream
      POSTGRES_DB: colourstream
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - network
    volumes:
      - ./backend/prisma:/app/prisma
      - ./backend/src:/app/src
      - ./backend/uploads:/app/uploads
      - ./backend/logs:/app/logs
    labels:
      - "traefik.enable=true"
      # API routes with higher priority
      - "traefik.http.routers.backend.rule=Host(`live.colourstream.${DOMAIN}`) && PathPrefix(`/api`)"
      - "traefik.http.routers.backend.entrypoints=websecure"
      - "traefik.http.routers.backend.tls=true"
      - "traefik.http.routers.backend.tls.certresolver=myresolver"
      - "traefik.http.routers.backend.service=backend"
      - "traefik.http.services.backend.loadbalancer.server.port=5001"
      - "traefik.http.routers.backend.middlewares=backend-headers"
      - "traefik.http.routers.backend.priority=300"  # Higher priority than frontend
      
      # Headers for regular API requests
      - "traefik.http.middlewares.backend-headers.headers.accesscontrolallowmethods=GET,OPTIONS,PUT,POST,DELETE"
      - "traefik.http.middlewares.backend-headers.headers.accesscontrolallowheaders=*"
      - "traefik.http.middlewares.backend-headers.headers.accesscontrolalloworiginlist=https://live.colourstream.${DOMAIN},https://upload.colourstream.${DOMAIN},http://localhost:8000"
      - "traefik.http.middlewares.backend-headers.headers.accesscontrolmaxage=100"
      - "traefik.http.middlewares.backend-headers.headers.addvaryheader=true"
      - "traefik.http.middlewares.backend-headers.headers.accesscontrolallowcredentials=true"
      
      # WebSocket routes - updated to handle all WebSocket paths
      - "traefik.http.routers.backend-ws.rule=Host(`live.colourstream.${DOMAIN}`) && PathPrefix(`/api/ws`)"
      - "traefik.http.routers.backend-ws.entrypoints=websecure"
      - "traefik.http.routers.backend-ws.tls=true"
      - "traefik.http.routers.backend-ws.tls.certresolver=myresolver"
      - "traefik.http.routers.backend-ws.service=backend-ws"
      - "traefik.http.services.backend-ws.loadbalancer.server.port=5001"
      - "traefik.http.routers.backend-ws.middlewares=websocket-headers"
      
      # Headers for WebSocket connections - updated with proper WebSocket headers
      - "traefik.http.middlewares.websocket-headers.headers.accesscontrolallowmethods=GET,OPTIONS,PUT,POST,DELETE"
      - "traefik.http.middlewares.websocket-headers.headers.accesscontrolallowheaders=*"
      - "traefik.http.middlewares.websocket-headers.headers.accesscontrolalloworiginlist=*"
      - "traefik.http.middlewares.websocket-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.websocket-headers.headers.customrequestheaders.Connection=Upgrade"
      - "traefik.http.middlewares.websocket-headers.headers.customrequestheaders.Upgrade=websocket"

  traefik:
    image: traefik:v3.3.3
    restart: always
    command:
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=true"
      - "--providers.docker.network=network"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--ping=true"
      - "--ping.entrypoint=websecure"
      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=600s"
      - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=600s"
      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=600s"
      - "--certificatesresolvers.myresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.myresolver.acme.email=${ADMIN_EMAIL}"
      - "--certificatesresolvers.myresolver.acme.storage=/acme.json"
      - "--log.level=DEBUG"
      - "--serversTransport.forwardingTimeouts.dialTimeout=60s"
      - "--serversTransport.forwardingTimeouts.responseHeaderTimeout=600s"
      - "--serversTransport.forwardingTimeouts.idleConnTimeout=600s"
    ports:
      - "80:80"
      - "443:443"
      - "8090:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik/acme.json:/acme.json
    networks:
      - network
    labels:
      - "traefik.enable=true"

  origin:
    image: airensoft/ovenmediaengine:latest #it must come from airensoft! 
    ports:
      - "8081:8081/tcp" # OVT(Origin)1
      - "8082:8082/tcp" # OVT(Origin)2
      - "9000:9000/tcp" # OVT(Origin)
      - "1935:1935/tcp" # RTMP Provider
      - "9999:9999" # SRT
      - "3333:3333" # WebRTC Signaling / LLHLS
      - "3334:3334" # TLS WebRTC Signaling / LLHLS
      - "3478:3478/tcp" # WebRTC TURN
      - "10000-10004:10000-10004/udp" # WebRTC Candidate
    environment:
      # Use domain name instead of IP address for WebRTC ICE candidates
      OME_HOST_IP: "live.colourstream.${DOMAIN}"
      OME_ORIGIN_PORT: "9000"
      OME_RTMP_PROV_PORT: "1935"
      OME_SRT_PROV_PORT: "9999"
      OME_LLHLS_STREAM_PORT: "3332"
      OME_WEBRTC_SIGNALLING_PORT: "3333"
      OME_WEBRTC_SIGNALLING_TLS_PORT: "3334"
      OME_WEBRTC_TCP_RELAY_PORT: "3478"
      OME_WEBRTC_CANDIDATE_PORT: "10002-10004/udp"
      OME_API_PORT: "8081"
      OME_API_TLS_PORT: "8082"
      OME_WEBHOOK_SECRET: ${OME_WEBHOOK_SECRET}
      OME_API_ACCESS_TOKEN: ${OME_API_ACCESS_TOKEN}
    env_file:
      - ./.env
    restart: always
    networks:
      - network
    volumes:
      - ./ovenmediaengine/origin_conf:/opt/ovenmediaengine/bin/origin_conf
      - ./certs/certs/live.colourstream.${DOMAIN}.crt:/opt/ovenmediaengine/bin/cert/cert.crt:ro
      - ./certs/private/live.colourstream.${DOMAIN}.key:/opt/ovenmediaengine/bin/cert/priv.key:ro
    labels:
      - "traefik.enable=true"
      # WebRTC WebSocket for /ws path
      - "traefik.http.routers.ome-webrtc.rule=Host(`video.colourstream.${DOMAIN}`) && PathPrefix(`/ws`)"
      - "traefik.http.routers.ome-webrtc.entrypoints=websecure"
      - "traefik.http.routers.ome-webrtc.tls.certresolver=myresolver"
      - "traefik.http.routers.ome-webrtc.service=ome-webrtc-service"
      - "traefik.http.services.ome-webrtc-service.loadbalancer.server.port=3333"
      - "traefik.http.services.ome-webrtc-service.loadbalancer.server.scheme=ws"
      # WebSocket middleware for WebRTC
      - "traefik.http.middlewares.ome-websocket.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.ome-websocket.headers.customrequestheaders.Connection=Upgrade"
      - "traefik.http.middlewares.ome-websocket.headers.customrequestheaders.Upgrade=websocket"
      - "traefik.http.routers.ome-webrtc.middlewares=ome-websocket"
      
      # WebRTC TLS Signaling for /app path on live domain
      - "traefik.http.routers.ome-webrtc-tls.rule=Host(`live.colourstream.${DOMAIN}`) && PathPrefix(`/app`)"
      - "traefik.http.routers.ome-webrtc-tls.entrypoints=websecure"
      - "traefik.http.routers.ome-webrtc-tls.tls.certresolver=myresolver"
      - "traefik.http.routers.ome-webrtc-tls.service=ome-webrtc-tls-service"
      - "traefik.http.services.ome-webrtc-tls-service.loadbalancer.server.port=3334"
      - "traefik.http.services.ome-webrtc-tls-service.loadbalancer.server.scheme=ws"
      # WebSocket middleware for TLS WebRTC
      - "traefik.http.middlewares.ome-websocket-tls.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.ome-websocket-tls.headers.customrequestheaders.Connection=Upgrade"
      - "traefik.http.middlewares.ome-websocket-tls.headers.customrequestheaders.Upgrade=websocket"
      - "traefik.http.routers.ome-webrtc-tls.middlewares=ome-websocket-tls"
      
      # WebRTC TLS Signaling for /app path on video domain
      - "traefik.http.routers.ome-webrtc-tls-video.rule=Host(`video.colourstream.${DOMAIN}`) && PathPrefix(`/app`)"
      - "traefik.http.routers.ome-webrtc-tls-video.entrypoints=websecure"
      - "traefik.http.routers.ome-webrtc-tls-video.tls.certresolver=myresolver"
      - "traefik.http.routers.ome-webrtc-tls-video.service=ome-webrtc-tls-video-service"
      - "traefik.http.services.ome-webrtc-tls-video-service.loadbalancer.server.port=3334"
      - "traefik.http.services.ome-webrtc-tls-video-service.loadbalancer.server.scheme=ws"
      # WebSocket middleware for TLS WebRTC on video domain
      - "traefik.http.middlewares.ome-websocket-tls-video.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.ome-websocket-tls-video.headers.customrequestheaders.Connection=Upgrade"
      - "traefik.http.middlewares.ome-websocket-tls-video.headers.customrequestheaders.Upgrade=websocket"
      - "traefik.http.routers.ome-webrtc-tls-video.middlewares=ome-websocket-tls-video"

  edge:
    image: airensoft/ovenmediaengine:latest #it must come from airensoft! 
    ports:
      - "4333:3333/tcp" # WebRTC Signaling / LLHLS
      - "3479:3479/tcp" # WebRTC TURN
      - "10005-10009:10005-10009/udp" # WebRTC Candidate
    environment:
      # Also use domain name for edge instead of IP address
      OME_HOST_IP: "live.colourstream.${DOMAIN}"
      DEFAULT_ORIGIN_SERVER: "origin"
      DEFAULT_ORIGIN_PORT: "9000"
      OME_LLHLS_STREAM_PORT: "3330"
      OME_WEBRTC_SIGNALLING_PORT: "3333"
      OME_WEBRTC_SIGNALLING_TLS_PORT: "3334"
      OME_WEBRTC_TCP_RELAY_PORT: "3479"
      OME_WEBRTC_CANDIDATE_PORT: "10005-10009/udp"
      OME_API_ACCESS_TOKEN: ${OME_API_ACCESS_TOKEN}
    env_file:
      - ./.env
    restart: always
    volumes:
      - ./ovenmediaengine/edge_conf:/opt/ovenmediaengine/bin/edge_conf
      - ./ovenmediaengine/edge_conf:/opt/ovenmediaengine/bin/origin_conf
      - ./certs/certs/live.colourstream.${DOMAIN}.crt:/opt/ovenmediaengine/bin/cert/cert.crt:ro
      - ./certs/private/live.colourstream.${DOMAIN}.key:/opt/ovenmediaengine/bin/cert/priv.key:ro
    networks:
      - network

  mirotalk:
    image: mirotalk/p2p:latest
    restart: always
    container_name: colourstream-mirotalk
    hostname: mirotalk
    expose:
      - 3000
    volumes:
      - ./mirotalk/.env:/src/.env:ro
      - ./mirotalk/public:/src/public:ro
      - ./mirotalk/app:/src/app:ro

    environment:
      STUN_SERVER_ENABLED: "true"
      STUN_SERVER_URL: "stun:stun.l.google.com:19302"
      TURN_SERVER_ENABLED: "true"
      TURN_SERVER_URL: "turn:video.colourstream.${DOMAIN}:3480"
      TURN_SERVER_USERNAME: "colourstream"
      OIDC_ENABLED: "false"
      HOST_PROTECTED: "true"
      TRUST_PROXY: "true"
      SEVER_TUNNEL: "false"
      NGROK_ENABLED: "false"
      HTTPS: "false"
      PORT: "3000"
      PROTOCOL: "http"
    env_file:
      - ./.env
      - mirotalk/.env
    networks:
      - network
    labels:
      - "traefik.enable=true"
      # Main route
      - "traefik.http.routers.mirotalk.rule=Host(`video.colourstream.${DOMAIN}`)"
      - "traefik.http.routers.mirotalk.entrypoints=websecure"
      - "traefik.http.routers.mirotalk.tls.certresolver=myresolver"
      - "traefik.http.routers.mirotalk.service=mirotalk-service"
      - "traefik.http.services.mirotalk-service.loadbalancer.server.port=3000"
      
      # WebSocket route for socket.io
      - "traefik.http.routers.mirotalk-ws.rule=Host(`video.colourstream.${DOMAIN}`) && PathPrefix(`/socket.io`)"
      - "traefik.http.routers.mirotalk-ws.entrypoints=websecure"
      - "traefik.http.routers.mirotalk-ws.tls.certresolver=myresolver"
      - "traefik.http.routers.mirotalk-ws.service=mirotalk-ws-service"
      - "traefik.http.services.mirotalk-ws-service.loadbalancer.server.port=3000"
      - "traefik.http.middlewares.sio.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.mirotalk-ws.middlewares=sio"

  coturn:
    image: coturn/coturn
    container_name: colourstream-coturn
    restart: always
    volumes:
      - ./coturn/turnserver.conf:/etc/coturn/turnserver.conf:ro
      - ./certs/certs/video.colourstream.${DOMAIN}.crt:/certs/video.colourstream.${DOMAIN}.crt:ro
      - ./certs/private/video.colourstream.${DOMAIN}.key:/certs/video.colourstream.${DOMAIN}.key:ro
    ports:
      - "3480:3480"
      - "3480:3480/udp"
      - "5350:5350"
      - "5350:5350/udp"
      - "30000-31000:30000-31000/udp"
    networks:
      - network
    labels:
      - "traefik.enable=true"
      - "traefik.tcp.routers.coturn.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.coturn.entrypoints=websecure"
      - "traefik.tcp.routers.coturn.service=coturn"
      - "traefik.tcp.services.coturn.loadbalancer.server.port=3480"

  minio:
    image: minio/minio:latest
    container_name: colourstream-minio
    command: server --console-address ":9001" /data
    environment:
      # Enable CORS
      MINIO_BROWSER: "on"
      MINIO_CORS_ALLOW_ALL: "true"
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
      MINIO_IDENTITY_OPENID_CONFIG_URL: ${MINIO_IDENTITY_OPENID_CONFIG_URL}
      MINIO_IDENTITY_OPENID_CLIENT_ID: ${MINIO_IDENTITY_OPENID_CLIENT_ID}
      MINIO_IDENTITY_OPENID_CLIENT_SECRET: ${MINIO_IDENTITY_OPENID_CLIENT_SECRET}
      MINIO_BROWSER_REDIRECT_URL: ${MINIO_BROWSER_REDIRECT_URL}
      # PocketID-specific OIDC settings
      MINIO_IDENTITY_OPENID_CLAIM_NAME: "groups"
      MINIO_IDENTITY_OPENID_DISPLAY_NAME: "name"
      MINIO_IDENTITY_OPENID_CLAIM_PREFIX: "minio-"
    expose:
      - 9000
      - 9001
    volumes:
      - minio_data:/data
    networks:
      - network
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      # API endpoint
      - "traefik.http.routers.minio-api.rule=Host(`s3.colourstream.${DOMAIN}`)"
      - "traefik.http.routers.minio-api.entrypoints=websecure"
      - "traefik.http.routers.minio-api.tls=true"
      - "traefik.http.routers.minio-api.service=minio-api"
      - "traefik.http.services.minio-api.loadbalancer.server.port=9000"
      - "traefik.http.middlewares.minio-cors-headers.headers.accesscontrolallowheaders=*"
      - "traefik.http.middlewares.minio-cors-headers.headers.accesscontrolalloworiginlist=*"
      - "traefik.http.middlewares.minio-cors-headers.headers.accesscontrolmaxage=3600"
      - "traefik.http.middlewares.minio-cors-headers.headers.addvaryheader=true"
      - "traefik.http.middlewares.minio-cors-headers.headers.accesscontrolallowcredentials=true"
      - "traefik.http.middlewares.minio-cors-headers.headers.customresponseheaders.Access-Control-Expose-Headers=ETag,Content-Length,Content-Type"
      # Console endpoint
      - "traefik.http.routers.minio-console.rule=Host(`s3-console.colourstream.${DOMAIN}`)"
      - "traefik.http.routers.minio-console.entrypoints=websecure"
      - "traefik.http.routers.minio-console.tls=true"
      - "traefik.http.routers.minio-console.tls.certresolver=myresolver"
      - "traefik.http.routers.minio-console.service=minio-console"
      - "traefik.http.services.minio-console.loadbalancer.server.port=9001"
  # Add Uppy Companion service for handling large file uploads
  companion:
    image: transloadit/companion:latest
    restart: unless-stopped
    environment:
      # Core Companion settings
      COMPANION_ALLOW_LOCAL_URLS: "true"
      COMPANION_CLIENT_ORIGINS: "https://upload.colourstream.${DOMAIN},https://live.colourstream.${DOMAIN}"

      # S3 Connection settings using environment variables from .env file
      COMPANION_AWS_KEY: "${S3_ACCESS_KEY}"
      COMPANION_AWS_SECRET: "${S3_SECRET_KEY}"
      COMPANION_AWS_BUCKET: "${S3_BUCKET}"
      COMPANION_AWS_REGION: "${S3_REGION}"
      COMPANION_AWS_ENDPOINT: "${S3_PUBLIC_ENDPOINT}"
      COMPANION_AWS_FORCE_PATH_STYLE: "true"

      # Dropbox integration
      COMPANION_DROPBOX_KEY: "${DROPBOX_KEY}"
      COMPANION_DROPBOX_SECRET: "${DROPBOX_SECRET}"

      # Google Drive integration
      COMPANION_GOOGLE_SECRET: "${GOOGLE_DRIVE_SECRET}"

      # Custom S3 key generator to strip UUIDs from filenames
      # Uses /CLIENT/PROJECT/filename structure for consistent organization
      COMPANION_S3_GET_KEY_NAME: "stripUuid"
      COMPANION_S3_GET_KEY_FROM_NAME: "true"

      # Performance optimizations for large files
      COMPANION_UPLOAD_TIMEOUT: 86400000 # 24 hours in milliseconds
      COMPANION_STREAMING_UPLOAD: "true"
      COMPANION_MAX_FILE_SIZE: "650000000000" # 650GB max file size

      # Required file path setting
      COMPANION_DATADIR: "/data"
      # Redis for session storage (optional, can add later if needed)
      COMPANION_PATH: "/companion"
      COMPANION_DOMAIN: "upload.colourstream.${DOMAIN}"
    env_file:
      - ./.env.companion
    volumes:
      - companion_data:/data
    networks:
      - network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.companion.rule=Host(`upload.colourstream.${DOMAIN}`) && PathPrefix(`/companion`)"
      - "traefik.http.routers.companion.entrypoints=websecure"
      - "traefik.http.routers.companion.tls=true"
      - "traefik.http.routers.companion.tls.certresolver=myresolver"
      - "traefik.http.routers.companion.service=companion"
      - "traefik.http.services.companion.loadbalancer.server.port=3020"

  createbuckets:
    image: minio/mc:latest
    container_name: colourstream-createbuckets
    depends_on:
      - minio
    entrypoint: >
      /bin/sh -c '
      echo "Waiting for MinIO to be ready...";
      sleep 5;
      /usr/bin/mc config host add myminio http://minio:9000 $MINIO_ROOT_USER $MINIO_ROOT_PASSWORD;
      /usr/bin/mc mb --ignore-existing myminio/$S3_BUCKET;
      
      # Set the bucket policy to allow public read/write access
      echo "Setting bucket policy for external access...";
      /usr/bin/mc anonymous set readwrite myminio/$S3_BUCKET;
      
      # Configure CORS for the bucket to allow cross-origin requests
      echo "Setting up CORS configuration for the bucket...";
      echo '{
        "CORSRules": [
          {
            "AllowedHeaders": ["*"],
            "AllowedMethods": ["GET", "PUT", "POST", "DELETE"],
            "AllowedOrigins": ["*"],
            "ExposeHeaders": ["ETag", "Content-Length", "Content-Type"],
            "MaxAgeSeconds": 3600
          }
        ]
      }' > /tmp/cors.json;
      /usr/bin/mc anonymous set-cors /tmp/cors.json myminio/$S3_BUCKET || echo "Failed to set CORS, trying legacy method";
      
      # If the set-cors command fails, try the legacy method
      if [ $? -ne 0 ]; then
        echo "Using legacy method to set CORS...";
        /usr/bin/mc admin config set myminio cors:uploads AllowedOrigins="*" \
                                                          AllowedMethods="GET,PUT,POST,DELETE" \
                                                          AllowedHeaders="*" \
                                                          ExposeHeaders="ETag,Content-Length,Content-Type" \
                                                          MaxAgeSeconds=3600;
        /usr/bin/mc admin service restart myminio;
      fi
      
      echo "CORS configuration completed";
      exit 0;
      '
    networks:
      - network
    restart: "no"

volumes:
  postgres_data:
    name: colourstream_postgres_data
  uploads_data:
    name: colourstream_uploads_data
  organized_data:
    name: colourstream_organized_data
  minio_data:
    name: colourstream_minio_data
  companion_data:
    name: colourstream_companion_data

networks:
  network:
    driver: bridge