Initial commit - realms platform

docker-compose.prod.yml

@@ -0,0 +1,231 @@
+# =============================================================================
+# Realms Production Docker Compose
+# =============================================================================
+# Uses pre-built images from Forgejo registry (qbit.realms.pub)
+# Deployed to /opt/realms/ on production server
+# =============================================================================
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: streaming
+      POSTGRES_USER: streamuser
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+      - ./init.sql:/docker-entrypoint-initdb.d/init.sql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U streamuser -d streaming"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - backend
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - backend
+
+  ovenmediaengine:
+    image: airensoft/ovenmediaengine:latest
+    restart: unless-stopped
+    ports:
+      - "1935:1935"           # RTMP
+      - "9999:9999/udp"       # SRT
+      - "3333:3333"           # WebRTC Signaling
+      - "3334:3334"           # WebRTC Signaling TCP
+      - "3478:3478"           # STUN/TURN
+      - "10000-10009:10000-10009/udp" # WebRTC ICE Candidates
+    volumes:
+      - ./Server.xml:/opt/ovenmediaengine/bin/origin_conf/Server.xml
+      - ome_logs:/var/log/ovenmediaengine
+    environment:
+      OME_API_PORT: 8081
+      OME_API_ACCESS_TOKEN: ${OME_API_TOKEN}
+    networks:
+      - backend
+      - frontend
+
+  drogon-backend:
+    image: qbit.realms.pub/realms/backend:latest
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    environment:
+      DB_HOST: postgres
+      DB_NAME: streaming
+      DB_USER: streamuser
+      DB_PASS: ${DB_PASSWORD}
+      REDIS_HOST: redis
+      REDIS_PORT: 6379
+      REDIS_DB: 1
+      REDIS_PASS: ${REDIS_PASSWORD}
+      JWT_SECRET: ${JWT_SECRET}
+      OME_API_URL: http://ovenmediaengine:8081
+      OME_API_TOKEN: ${OME_API_TOKEN}
+    volumes:
+      - ./config.json:/app/config.json
+      - uploads:/app/uploads
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/api/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - backend
+
+  chat-service:
+    image: qbit.realms.pub/realms/chat-service:latest
+    restart: unless-stopped
+    depends_on:
+      redis:
+        condition: service_healthy
+      drogon-backend:
+        condition: service_healthy
+    environment:
+      REDIS_HOST: redis
+      REDIS_PORT: 6379
+      REDIS_DB: 1
+      REDIS_PASS: ${REDIS_PASSWORD}
+      JWT_SECRET: ${JWT_SECRET}
+    # Config is baked into the Docker image
+    healthcheck:
+      test: ["CMD-SHELL", "curl -s http://localhost:8081/ > /dev/null 2>&1 || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - backend
+
+  nakama:
+    image: registry.heroiclabs.com/heroiclabs/nakama:3.21.1
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+    entrypoint:
+      - "/bin/sh"
+      - "-c"
+      - |
+        set -e
+        apt-get update >/dev/null 2>&1 && apt-get install -y postgresql-client >/dev/null 2>&1 || true
+        PGPASSWORD=$DB_PASSWORD psql -h postgres -U streamuser -d postgres -tc "SELECT 1 FROM pg_database WHERE datname = 'nakama'" | grep -q 1 || PGPASSWORD=$DB_PASSWORD psql -h postgres -U streamuser -d postgres -c "CREATE DATABASE nakama"
+        /nakama/nakama migrate up --database.address "streamuser:$DB_PASSWORD@postgres:5432/nakama?sslmode=disable"
+        exec /nakama/nakama \
+          --name realms-nakama \
+          --database.address "streamuser:$DB_PASSWORD@postgres:5432/nakama?sslmode=disable" \
+          --socket.server_key "$NAKAMA_SERVER_KEY" \
+          --session.token_expiry_sec 86400 \
+          --runtime.env "JWT_SECRET=$JWT_SECRET" \
+          --console.username admin \
+          --console.password "$NAKAMA_CONSOLE_PASSWORD" \
+          --logger.level INFO
+    environment:
+      - JWT_SECRET=${JWT_SECRET}
+      - NAKAMA_CONSOLE_PASSWORD=${NAKAMA_CONSOLE_PASSWORD}
+      - NAKAMA_SERVER_KEY=${NAKAMA_SERVER_KEY}
+      - DB_PASSWORD=${DB_PASSWORD}
+    # Custom modules can be baked into a custom nakama image if needed
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:7350/healthcheck"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - backend
+      - frontend
+
+  openresty:
+    image: qbit.realms.pub/realms/openresty:latest
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+      - "8088:8088"           # HLS/LLHLS proxy with CORS
+    depends_on:
+      drogon-backend:
+        condition: service_healthy
+      chat-service:
+        condition: service_healthy
+      ovenmediaengine:
+        condition: service_started
+      redis:
+        condition: service_healthy
+      nakama:
+        condition: service_started
+    environment:
+      REDIS_HOST: redis
+      REDIS_PORT: 6379
+      REDIS_DB: 1
+      REDIS_PASS: ${REDIS_PASSWORD}
+      BACKEND_URL: http://drogon-backend:8080
+      CHAT_URL: http://chat-service:8081
+      OME_URL: http://ovenmediaengine:8081
+      JWT_SECRET: ${JWT_SECRET}
+    volumes:
+      - uploads:/app/uploads:ro
+      - letsencrypt_data:/etc/letsencrypt:ro
+      - certbot_webroot:/var/www/certbot:ro
+    networks:
+      - frontend
+      - backend
+
+  sveltekit:
+    image: qbit.realms.pub/realms/frontend:latest
+    restart: unless-stopped
+    depends_on:
+      openresty:
+        condition: service_started
+    environment:
+      NODE_ENV: production
+    networks:
+      - frontend
+
+  certbot:
+    image: certbot/certbot:latest
+    restart: unless-stopped
+    volumes:
+      - letsencrypt_data:/etc/letsencrypt
+      - certbot_webroot:/var/www/certbot
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        trap exit TERM
+        while :; do
+          certbot renew --webroot --webroot-path=/var/www/certbot --quiet
+          sleep 12h & wait $$!
+        done
+    networks:
+      - backend
+
+networks:
+  frontend:
+    driver: bridge
+  backend:
+    driver: bridge
+
+volumes:
+  postgres_data:
+  redis_data:
+  ome_logs:
+  uploads:
+  letsencrypt_data:
+  certbot_webroot: