services:

  # You can comment this webserver section if you want to use another webserver/proxy or test PeerTube in local
#  webserver:
#    image: chocobozzz/peertube-webserver:latest
    # If you don't want to use the official image and build one from sources:
    # build:
    #   context: .
    #   dockerfile: Dockerfile.nginx
#    env_file:
#      - .env
#    ports:
#     - "8080:80"
#     - "443:443"
#    volumes:
#      - type: bind
        # Switch sources if you downloaded the whole repository
        #source: ../../nginx/peertube
#        source: ./docker-volume/nginx/peertube
#        target: /etc/nginx/conf.d/peertube.template
#      - assets:/var/www/peertube/peertube-latest/client/dist:ro
#      - ./docker-volume/data:/var/www/peertube/storage
#      - certbot-www:/var/www/certbot
#      - ./docker-volume/certbot/conf:/etc/letsencrypt
#    depends_on:
#      - peertube
#    restart: "always"

  # You can comment this certbot section if you want to use another webserver/proxy or test PeerTube in local
#  certbot:
#    container_name: certbot
#    image: certbot/certbot
#    volumes:
#      - ./docker-volume/certbot/conf:/etc/letsencrypt
#      - certbot-www:/var/www/certbot
#    restart: unless-stopped
#    entrypoint: /bin/sh -c "trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot; sleep 12h & wait $${!}; done;"
#    depends_on:
#      - webserver

  peertube:
    # If you don't want to use the official image and build one from sources:
    # build:
    #   context: .
    #   dockerfile: ./support/docker/production/Dockerfile.bookworm
    image: chocobozzz/peertube:production-bookworm
    # Use a static IP for this container because nginx does not handle proxy host change without reload
    # This container could be restarted on crash or until the postgresql database is ready for connection
    networks:
      default:
        ipv4_address: 172.18.0.42
#        ipv6_address: 2001:db8:2::42
    env_file:
      - .env
    environment:
      - TZ=Europe/Moscow

    ports:
     - "1935:1935" # Comment if you don't want to use the live feature
     - "9000:9000" # Uncomment if you use another webserver/proxy or test PeerTube in local, otherwise not suitable for production
    volumes:
      # Remove the following line if you want to use another webserver/proxy or test PeerTube in local
      - assets:/app/client/dist
      - ./docker-volume/data:/data
      - ./docker-volume/config:/config
    depends_on:
      - postgres
      - redis
      - postfix
    restart: "always"

  postgres:
    image: postgres:13-alpine
    env_file:
      - .env
    environment:
      - TZ=Europe/Moscow
    volumes:
      - ./docker-volume/db:/var/lib/postgresql/data
    restart: "always"

  redis:
    image: redis:6-alpine
    environment:
      - TZ=Europe/Moscow
    volumes:
      - ./docker-volume/redis:/data
    restart: "always"

  postfix:
    image: mwader/postfix-relay
    env_file:
      - .env
    environment:
      - TZ=Europe/Moscow
    volumes:
      - ./docker-volume/opendkim/keys:/etc/opendkim/keys
    restart: "always"

networks:
  default:
    enable_ipv6: false
    ipam:
      driver: default
      config:
      - subnet: 172.18.0.0/16
#      - subnet: 2001:db8:2::/64
volumes:
  assets:
  certbot-www:

# Database / Postgres service configuration
POSTGRES_USER=<ИМЯ ПОЛЗОВАТЕЛЯ БАЗЫ ДАННЫХ>
POSTGRES_PASSWORD=<ПАРОЛЬ БАЗЫ ДАННЫХ>
# Postgres database name "peertube"
POSTGRES_DB=peertube
# The database name used by PeerTube will be PEERTUBE_DB_NAME (only if set) *OR* 'peertube'+PEERTUBE_DB_SUFFIX
#PEERTUBE_DB_NAME=<MY POSTGRES DB NAME>
#PEERTUBE_DB_SUFFIX=_prod
# Database username and password used by PeerTube must match Postgres', so they are copied:
PEERTUBE_DB_USERNAME=$POSTGRES_USER
PEERTUBE_DB_PASSWORD=$POSTGRES_PASSWORD
PEERTUBE_DB_SSL=false
# Default to Postgres service name "postgres" in docker-compose.yml
PEERTUBE_DB_HOSTNAME=postgres

# PeerTube server configuration
# If you test PeerTube in local: use "peertube.localhost" and add this domain to your host file resolving on 127.0.0.1
PEERTUBE_WEBSERVER_HOSTNAME=<ДОМЕННОЕ ИМЯ СЕРВЕРА>
# If you just want to test PeerTube on local
PEERTUBE_WEBSERVER_PORT=443
PEERTUBE_WEBSERVER_HTTPS=true
# If you need more than one IP as trust_proxy
# pass them as a comma separated array:
PEERTUBE_TRUST_PROXY=["127.0.0.1", "loopback", "172.18.0.0/16"]

# Generate one using `openssl rand -hex 32`
PEERTUBE_SECRET=<СГЕНЕРИРОВАННЫЙ СЕКРЕТНЫЙ КЛЮЧ>

# E-mail configuration
# If you use a Custom SMTP server
PEERTUBE_SMTP_USERNAME=ИМЯ ПОЛЬЗОВАТЕЛЯ E-MAIL
PEERTUBE_SMTP_PASSWORD=ПАРОЛЬ ОТ ПОЧТЫ
# Default to Postfix service name "postfix" in docker-compose.yml
# May be the hostname of your Custom SMTP server
PEERTUBE_SMTP_HOSTNAME=<АДРЕС ПОЧТОВОГО СЕРВЕРА>
PEERTUBE_SMTP_PORT=587
PEERTUBE_SMTP_FROM=noreply@<MY DOMAIN>
PEERTUBE_SMTP_TLS=false
PEERTUBE_SMTP_DISABLE_STARTTLS=false
PEERTUBE_ADMIN_EMAIL=<ПОЧТОВЫЙ АДРЕС АДМИНА СЕРВЕРА>

# Postfix service configuration
#POSTFIX_myhostname=<MY DOMAIN>
# If you need to generate a list of sub/DOMAIN keys
# pass them as a whitespace separated string <DOMAIN>=<selector>
#OPENDKIM_DOMAINS=<MY DOMAIN>=peertube
# see https://github.com/wader/postfix-relay/pull/18
#OPENDKIM_RequireSafeKeys=no

#PEERTUBE_OBJECT_STORAGE_UPLOAD_ACL_PUBLIC="public-read"
#PEERTUBE_OBJECT_STORAGE_UPLOAD_ACL_PRIVATE="private"

#PEERTUBE_LOG_LEVEL=info

# /!\ Prefer to use the PeerTube admin interface to set the following configurations /!\
#PEERTUBE_SIGNUP_ENABLED=true
#PEERTUBE_TRANSCODING_ENABLED=true
#PEERTUBE_CONTACT_FORM_ENABLED=true

core_module
proxy_module
proxy_http2_module
proxy_wstunnel_module
proxy_http_module
headers_module
remoteip_module
ssl_module
filter_module
reqtimeout_module

<VirtualHost *:80>
	ServerAdmin admin@wildserver.ru
    ServerName video.wildserver.ru
    ServerAlias www.video.wildserver.ru
    CustomLog ${APACHE_LOG_DIR}/video.wildserver.ru.access.log combined
    ErrorLog ${APACHE_LOG_DIR}/video.wildserver.ru.error.log

RewriteEngine on
RewriteCond %{SERVER_NAME} =www.video.wildserver.ru [OR]
RewriteCond %{SERVER_NAME} =video.wildserver.ru
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>
  ServerAdmin admin@wildserver.ru
  ServerName video.wildserver.ru
  ServerAlias www.video.wildserver.ru
    CustomLog ${APACHE_LOG_DIR}/video.wildserver.ru.access.log combined
    ErrorLog ${APACHE_LOG_DIR}/video.wildserver.ru.error.log  

    # SSL настройки
    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/video.wildserver.ru/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/video.wildserver.ru/privkey.pem

    # Заголовки безопасности

    # Защита от понижения протокола с HTTPS на HTTP
    Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
    # Запрещаем встраивание страницы в iframe на других сайтах
    Header always set X-Frame-Options SAMEORIGIN
    # Защита от интерпретации MIME-типа
    Header always set X-Content-Type-Options nosniff
    # Политика реферера: не отправлять информацию на менее защищенные сайты
    Header always set Referrer-Policy no-referrer-when-downgrade
    # Политика безопасности содержимого
    Header always set Content-Security-Policy "default-src https: data: 'unsafe-inline' 'unsafe-eval'"
    # Защита от XSS-атак
    Header always set X-XSS-Protection "1; mode=block"
    # Ограничение использования определенных API
    Header always set Feature-Policy "vibrate 'none'; usermedia 'none'"

    # Обратный прокси
    ProxyPreserveHost On    
    ProxyPass / http://localhost:9000/
    ProxyPassReverse / http://localhost:9000/
    ProxyPassReverse /api/ http://localhost:9000/api/

    # WebSocket прокси
    ProxyPass /socket ws://localhost:9000/socket
    ProxyPassReverse /socket ws://localhost:9000/socket

    # Поддержка больших файлов без ограничений размера
    LimitRequestBody 0

    # Разрешить доступ к PeerTube API
    <Location /api/v1/users/me>
        Header set Access-Control-Allow-Origin "*"
        Header set Access-Control-Allow-Methods "GET, POST, OPTIONS"
        Header set Access-Control-Allow-Headers "Authorization, Content-Type"
    </Location>
</VirtualHost>
</IfModule>

peertube-1  | [video.wildserver.ru:443] 2024-03-27 22:11:27.967 info: Username: root
peertube-1  | [video.wildserver.ru:443] 2024-03-27 22:11:27.967 info: User password: mevevomipewebeki

redis-1 WARNING Memory overcommit must be enabled! Without it, a background save or replication may fail under low memory condition. Being disabled, it can can also cause failures without low memory condition, see https://github.com/jemalloc/jemalloc/issues/1328. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.

redis-1 WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128.

vm.overcommit_memory = 1
net.core.somaxconn=511

peertube-1  | [video.wildserver.ru:443] warn: It seems PeerTube was started (and created some data) with another domain name. This means you will not be able to federate! Please use NODE_CONFIG_DIR=/app/config:/app/support/docker/production/config:/config NODE_ENV=production npm run update-host to fix this.