Initial commit - realms platform

docker-compose.yml

@@ -1,12 +1,10 @@
-version: '3.8'
-
 services:
   postgres:
     image: postgres:16-alpine
     environment:
       POSTGRES_DB: streaming
       POSTGRES_USER: streamuser
-      POSTGRES_PASSWORD: streampass  # Fixed: hardcoded for consistency
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
     volumes:
       - postgres_data:/var/lib/postgresql/data
       - ./database/init.sql:/docker-entrypoint-initdb.d/init.sql
@@ -21,11 +19,11 @@ services:
 
   redis:
     image: redis:7-alpine
-    command: redis-server --appendonly yes
+    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
     volumes:
       - redis_data:/data
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -37,7 +35,7 @@ services:
     ports:
       - "1935:1935"           # RTMP
       - "9999:9999/udp"       # SRT
-      - "8088:8080"           # HLS/LLHLS
+      # HLS/LLHLS now proxied through openresty (removed direct exposure)
       - "8081:8081"           # API (internal)
       - "3333:3333"           # WebRTC Signaling
       - "3478:3478"           # WebRTC ICE
@@ -47,7 +45,7 @@ services:
       - ome_logs:/var/log/ovenmediaengine
     environment:
       OME_API_PORT: 8081
-      OME_API_ACCESS_TOKEN: your-api-token
+      OME_API_ACCESS_TOKEN: ${OME_API_TOKEN}
     networks:
       - backend
       - frontend
@@ -63,12 +61,14 @@ services:
       DB_HOST: postgres
       DB_NAME: streaming
       DB_USER: streamuser
-      DB_PASS: streampass  # Fixed: matching postgres password
+      DB_PASS: ${DB_PASSWORD}
       REDIS_HOST: redis
       REDIS_PORT: 6379
-      JWT_SECRET: your-jwt-secret
+      REDIS_DB: 1
+      REDIS_PASS: ${REDIS_PASSWORD}
+      JWT_SECRET: ${JWT_SECRET}
       OME_API_URL: http://ovenmediaengine:8081
-      OME_API_TOKEN: your-api-token
+      OME_API_TOKEN: ${OME_API_TOKEN}
     volumes:
       - ./backend/config.json:/app/config.json
       - uploads:/app/uploads
@@ -81,46 +81,136 @@ services:
     networks:
       - backend
 
+  chat-service:
+    build: ./chat-service
+    depends_on:
+      redis:
+        condition: service_healthy
+      drogon-backend:
+        condition: service_healthy
+    environment:
+      REDIS_HOST: redis
+      REDIS_PORT: 6379
+      REDIS_DB: 1
+      REDIS_PASS: ${REDIS_PASSWORD}
+      JWT_SECRET: ${JWT_SECRET}
+    volumes:
+      - ./chat-service/config.json:/app/config.json
+    healthcheck:
+      test: ["CMD-SHELL", "curl -s http://localhost:8081/ > /dev/null 2>&1 || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - backend
+
+  nakama:
+    image: registry.heroiclabs.com/heroiclabs/nakama:3.21.1
+    depends_on:
+      postgres:
+        condition: service_healthy
+    entrypoint:
+      - "/bin/sh"
+      - "-c"
+      - |
+        set -e
+        apt-get update >/dev/null 2>&1 && apt-get install -y postgresql-client >/dev/null 2>&1 || true
+        PGPASSWORD=$DB_PASSWORD psql -h postgres -U streamuser -d postgres -tc "SELECT 1 FROM pg_database WHERE datname = 'nakama'" | grep -q 1 || PGPASSWORD=$DB_PASSWORD psql -h postgres -U streamuser -d postgres -c "CREATE DATABASE nakama"
+        /nakama/nakama migrate up --database.address "streamuser:$DB_PASSWORD@postgres:5432/nakama?sslmode=disable"
+        exec /nakama/nakama \
+          --name realms-nakama \
+          --database.address "streamuser:$DB_PASSWORD@postgres:5432/nakama?sslmode=disable" \
+          --socket.server_key "$NAKAMA_SERVER_KEY" \
+          --session.token_expiry_sec 86400 \
+          --runtime.js_entrypoint main.js \
+          --runtime.env "JWT_SECRET=$JWT_SECRET" \
+          --console.username admin \
+          --console.password "$NAKAMA_CONSOLE_PASSWORD" \
+          --logger.level INFO
+    environment:
+      - JWT_SECRET=${JWT_SECRET}
+      - NAKAMA_CONSOLE_PASSWORD=${NAKAMA_CONSOLE_PASSWORD}
+      - NAKAMA_SERVER_KEY=${NAKAMA_SERVER_KEY}
+      - DB_PASSWORD=${DB_PASSWORD}
+    volumes:
+      - ./nakama/modules/build:/nakama/data/modules:ro
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:7350/healthcheck"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - backend
+      - frontend
+
   openresty:
     build: ./openresty
     ports:
       - "80:80"
       - "443:443"
+      - "8088:8088"           # HLS/LLHLS proxy with CORS
     depends_on:
       drogon-backend:
         condition: service_healthy
+      chat-service:
+        condition: service_healthy
       ovenmediaengine:
         condition: service_started
       redis:
         condition: service_healthy
+      nakama:
+        condition: service_started
     environment:
       REDIS_HOST: redis
       REDIS_PORT: 6379
+      REDIS_DB: 1
+      REDIS_PASS: ${REDIS_PASSWORD}
       BACKEND_URL: http://drogon-backend:8080
+      CHAT_URL: http://chat-service:8081
       OME_URL: http://ovenmediaengine:8081
+      JWT_SECRET: ${JWT_SECRET}
     volumes:
       - ./openresty/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf
       - ./openresty/lua:/usr/local/openresty/nginx/lua
+      - ./openresty/conf.d:/usr/local/openresty/nginx/conf/conf.d:ro
       - uploads:/app/uploads:ro  # Mount uploads volume to the same path
+      - letsencrypt_data:/etc/letsencrypt:ro
+      - certbot_webroot:/var/www/certbot:ro
     networks:
       - frontend
       - backend
 
   sveltekit:
-    build: ./frontend
+    build:
+      context: ./frontend
+      args:
+        VITE_NAKAMA_SERVER_KEY: ${NAKAMA_SERVER_KEY}
+        VITE_NAKAMA_HOST: localhost
+        VITE_NAKAMA_PORT: "80"
+        VITE_NAKAMA_USE_SSL: "false"
     depends_on:
       openresty:
         condition: service_started
     environment:
-      # Fixed: Added VITE_ prefix for client-side access
-      VITE_API_URL: http://localhost/api
-      VITE_WS_URL: ws://localhost/ws
-      VITE_STREAM_PORT: 8088
-      # Server-side only variables (no prefix needed)
       NODE_ENV: production
     networks:
       - frontend
 
+  certbot:
+    image: certbot/certbot:latest
+    volumes:
+      - letsencrypt_data:/etc/letsencrypt
+      - certbot_webroot:/var/www/certbot
+      - ./scripts/certbot-entrypoint.sh:/entrypoint.sh:ro
+    entrypoint: ["/bin/sh", "/entrypoint.sh"]
+    environment:
+      - CERTBOT_EMAIL=${CERTBOT_EMAIL:-admin@example.com}
+    networks:
+      - backend
+    restart: unless-stopped
+
 networks:
   frontend:
     driver: bridge
@@ -131,4 +221,6 @@ volumes:
   postgres_data:
   redis_data:
   ome_logs:
-  uploads:  # Named volume for uploads
+  uploads:  # Named volume for uploads
+  letsencrypt_data:  # Let's Encrypt certificates
+  certbot_webroot:   # ACME challenge webroot