docker-compose.template.yml

services:
  frontend:
    image: ghcr.io/chaos-dotcom/colourstream-frontend:latest
    # build:
    #   context: ./frontend
    #   dockerfile: Dockerfile
    container_name: colourstream-frontend
    env_file: 
      - ./frontend/.env # Frontend specific env
    environment:
      VITE_API_URL: https://live.colourstream.${DOMAIN}/api
      VITE_OIDC_AUTH_ENDPOINT: ${OIDC_AUTH_ENDPOINT}
      VITE_WEBRTC_WS_HOST: live.colourstream.${DOMAIN}
      VITE_WEBRTC_WS_PORT: 3334
      VITE_WEBRTC_WS_PROTOCOL: wss
      VITE_WEBRTC_APP_PATH: app
      VITE_VIDEO_URL: https://video.colourstream.${DOMAIN}/join
      VITE_OVENPLAYER_SCRIPT_URL: https://cdn.jsdelivr.net/npm/ovenplayer/dist/ovenplayer.js
      VITE_UPLOAD_ENDPOINT_URL: https://upload.colourstream.${DOMAIN}/files/
      VITE_NAMEFORUPLOADCOMPLETION: ${NAMEFORUPLOADCOMPLETION}
      VITE_ENABLE_DROPBOX: "false"
      VITE_ENABLE_GOOGLE_DRIVE: ${VITE_ENABLE_GOOGLE_DRIVE:-false}
      VITE_GOOGLE_DRIVE_CLIENT_ID: ${VITE_GOOGLE_DRIVE_CLIENT_ID}
      VITE_GOOGLE_DRIVE_API_KEY: ${VITE_GOOGLE_DRIVE_API_KEY}
      VITE_GOOGLE_DRIVE_APP_ID: ${VITE_GOOGLE_DRIVE_APP_ID}
    ports:
      - "3000:3000"
    networks:
      - network
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      
      # Main frontend application - primary domain
      - "traefik.http.routers.frontend.rule=Host(`live.colourstream.${DOMAIN}`)"
      - "traefik.http.routers.frontend.entrypoints=websecure"
      - "traefik.http.routers.frontend.tls=true"
      - "traefik.http.routers.frontend.tls.certresolver=myresolver"
      - "traefik.http.routers.frontend.service=frontend"
      - "traefik.http.services.frontend.loadbalancer.server.port=3000"
      - "traefik.http.routers.frontend.priority=10"  # Lower priority than backend
      
      # Static assets router configuration - primary domain
      - "traefik.http.routers.frontend-static.rule=Host(`live.colourstream.${DOMAIN}`) && (PathPrefix(`/assets`) || PathPrefix(`/static`) || Path(`/favicon.ico`) || Path(`/manifest.json`) || Path(`/robots.txt`) || Path(`/config/runtime-config.js`))"
      - "traefik.http.routers.frontend-static.entrypoints=websecure"
      - "traefik.http.routers.frontend-static.tls=true"
      - "traefik.http.routers.frontend-static.tls.certresolver=myresolver"
      - "traefik.http.routers.frontend-static.service=frontend"
      - "traefik.http.routers.frontend-static.priority=200"
      
      # SPA router configuration - primary domain
      - "traefik.http.routers.frontend-spa.rule=Host(`live.colourstream.${DOMAIN}`) && (PathPrefix(`/admin`) || PathPrefix(`/login`) || PathPrefix(`/room`) || PathPrefix(`/upload`)) && !PathPrefix(`/files`) && !HeadersRegexp(`X-Requested-With`, `XMLHttpRequest`) && !Method(`POST`) && !Method(`PATCH`) && !Method(`HEAD`)"
      - "traefik.http.routers.frontend-spa.entrypoints=websecure"
      - "traefik.http.routers.frontend-spa.tls=true"
      - "traefik.http.routers.frontend-spa.tls.certresolver=myresolver"
      - "traefik.http.routers.frontend-spa.service=frontend"
      - "traefik.http.routers.frontend-spa.middlewares=spa-fallback"
      - "traefik.http.routers.frontend-spa.priority=100"
      
      # Fallback middleware setup - primary domain
      - "traefik.http.middlewares.spa-fallback.replacepathregex.regex=^/(admin|login|room|upload).*"
      - "traefik.http.middlewares.spa-fallback.replacepathregex.replacement=/"
      
      # Root router configuration - primary domain
      - "traefik.http.routers.frontend-root.rule=Host(`live.colourstream.${DOMAIN}`) && Path(`/`) && !PathPrefix(`/files`)"
      - "traefik.http.routers.frontend-root.entrypoints=websecure"
      - "traefik.http.routers.frontend-root.tls=true"
      - "traefik.http.routers.frontend-root.tls.certresolver=myresolver"
      - "traefik.http.routers.frontend-root.service=frontend"
      - "traefik.http.routers.frontend-root.priority=50"
      
      # Upload Portal - upload subdomain
      - "traefik.http.routers.frontend-upload.rule=Host(`upload.colourstream.${DOMAIN}`)"
      - "traefik.http.routers.frontend-upload.entrypoints=websecure"
      - "traefik.http.routers.frontend-upload.tls=true"
      - "traefik.http.routers.frontend-upload.tls.certresolver=myresolver"
      - "traefik.http.routers.frontend-upload.service=frontend"
      - "traefik.http.routers.frontend-upload.priority=10" # Lower priority than tusd for specific paths
      - "traefik.http.routers.frontend-upload.middlewares=upload-spa-fallback"
      
      # SPA fallback middleware for upload portal
      - "traefik.http.middlewares.upload-spa-fallback.replacepathregex.regex=^/portal/.*"
      - "traefik.http.middlewares.upload-spa-fallback.replacepathregex.replacement=/"

  postgres:
    container_name: colourstream-postgres
    image: postgres:17-alpine
    restart: always
    expose:
      - "5432"
    env_file:
      - ./.env
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./postgres/postgresql.conf:/etc/postgresql/postgresql.conf
    command: postgres -c config_file=/etc/postgresql/postgresql.conf
    networks:
      - network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U colourstream"]
      interval: 10s
      timeout: 5s
      retries: 5
    labels:
      - "traefik.enable=false"

  backend:
    image: ghcr.io/chaos-dotcom/colourstream-backend:latest
    # build:
    #   context: ./backend
    #   dockerfile: Dockerfile
    restart: always
    expose:
      - 5001
    env_file:
      - ./.env
      - ./backend/.env
    environment:
      NODE_ENV: production
      WEBAUTHN_RP_ID: live.colourstream.${DOMAIN}
      WEBAUTHN_ORIGIN: https://live.colourstream.${DOMAIN}
      DOMAIN: ${DOMAIN}
      VIDEO_DOMAIN: video.colourstream.${DOMAIN}
      FRONTEND_URL: https://live.colourstream.${DOMAIN}
      BASE_PATH: /api
      OME_WEBHOOK_SECRET: ${OME_WEBHOOK_SECRET}
      POSTGRES_USER: colourstream
      POSTGRES_DB: colourstream
      TUSD_DATA_DIR: /srv/tusd-data # Directory Tusd uses (matches volume mount)
      TUS_ORGANIZED_DIR: /app/organized # Directory for final local files (matches volume mount)
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - network
    volumes:
      - ./backend/prisma:/app/prisma
      - ./backend/src:/app/src
      # The ./backend/uploads mount is removed as it's redundant for the Tusd workflow.
      # Files are processed directly within the shared ./tusd-data volume.
      - ./backend/logs:/app/logs
      - /Volumes/Backup3/tusd-data:/srv/tusd-data # Mount the *same* host path as tusd service uses for its data
    labels:
      - "traefik.enable=true"
      # API routes with higher priority
      - "traefik.http.routers.backend.rule=Host(`live.colourstream.${DOMAIN}`) && PathPrefix(`/api`)"
      - "traefik.http.routers.backend.entrypoints=websecure"
      - "traefik.http.routers.backend.tls=true"
      - "traefik.http.routers.backend.tls.certresolver=myresolver"
      - "traefik.http.routers.backend.service=backend"
      - "traefik.http.services.backend.loadbalancer.server.port=5001"
      - "traefik.http.routers.backend.middlewares=backend-headers"
      - "traefik.http.routers.backend.priority=300"  # Higher priority than frontend
      
      # Headers for regular API requests
      - "traefik.http.middlewares.backend-headers.headers.accesscontrolallowmethods=GET,OPTIONS,PUT,POST,DELETE"
      - "traefik.http.middlewares.backend-headers.headers.accesscontrolallowheaders=*"
      - "traefik.http.middlewares.backend-headers.headers.accesscontrolalloworiginlist=https://live.colourstream.${DOMAIN},https://upload.colourstream.${DOMAIN},https://tusd.colourstream.${DOMAIN},http://localhost:8000"
      - "traefik.http.middlewares.backend-headers.headers.accesscontrolmaxage=100"
      - "traefik.http.middlewares.backend-headers.headers.addvaryheader=true"
      - "traefik.http.middlewares.backend-headers.headers.accesscontrolallowcredentials=true"
      
      # WebSocket routes - updated to handle all WebSocket paths
      - "traefik.http.routers.backend-ws.rule=Host(`live.colourstream.${DOMAIN}`) && PathPrefix(`/api/ws`)"
      - "traefik.http.routers.backend-ws.entrypoints=websecure"
      - "traefik.http.routers.backend-ws.tls=true"
      - "traefik.http.routers.backend-ws.tls.certresolver=myresolver"
      - "traefik.http.routers.backend-ws.service=backend-ws"
      - "traefik.http.services.backend-ws.loadbalancer.server.port=5001"
      - "traefik.http.routers.backend-ws.middlewares=websocket-headers"
      
      # Headers for WebSocket connections - updated with proper WebSocket headers
      - "traefik.http.middlewares.websocket-headers.headers.accesscontrolallowmethods=GET,OPTIONS,PUT,POST,DELETE"
      - "traefik.http.middlewares.websocket-headers.headers.accesscontrolallowheaders=*"
      - "traefik.http.middlewares.websocket-headers.headers.accesscontrolalloworiginlist=*"
      - "traefik.http.middlewares.websocket-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.websocket-headers.headers.customrequestheaders.Connection=Upgrade"
      - "traefik.http.middlewares.websocket-headers.headers.customrequestheaders.Upgrade=websocket"

  traefik:
    image: traefik:v3.4.1
    restart: always
    command:
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=true"
      - "--providers.docker.network=network"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--ping=true"
      - "--ping.entrypoint=websecure"
      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=600s"
      - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=600s"
      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=600s"
      # --- Enable HTTP/3 on websecure entrypoint ---
      - "--entrypoints.websecure.http3"
      # --- End HTTP/3 ---
      - "--certificatesresolvers.myresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.myresolver.acme.email=${ADMIN_EMAIL}"
      - "--certificatesresolvers.myresolver.acme.storage=/acme.json"
      - "--log.level=DEBUG"
      - "--accesslog=true" # Enable access logs
      - "--accesslog.format=json" # Use JSON format for detailed logs
      - "--serversTransport.forwardingTimeouts.dialTimeout=60s"
      - "--serversTransport.forwardingTimeouts.responseHeaderTimeout=600s"
      - "--serversTransport.forwardingTimeouts.idleConnTimeout=600s"
    ports:
      - "80:80"
      - "443:443/tcp" # Explicitly TCP
      - "443:443/udp" # Add UDP for HTTP/3
      - "8090:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik/acme.json:/acme.json
    networks:
      - network
    labels:
      - "traefik.enable=true"

  origin:
    image: airensoft/ovenmediaengine:latest #it must come from airensoft! 
    ports:
      - "8081:8081/tcp" # OVT(Origin)1
      - "8082:8082/tcp" # OVT(Origin)2
      - "9002:9000/tcp" # OVT(Origin)
      - "1935:1935/tcp" # RTMP Provider
      - "9999:9999" # SRT
      - "3333:3333" # WebRTC Signaling / LLHLS
      - "3334:3334" # TLS WebRTC Signaling / LLHLS
      - "10000-10004:10000-10004/udp" # WebRTC Candidate
    environment:
      # Use domain name instead of IP address for WebRTC ICE candidates
      OME_HOST_IP: "live.colourstream.${DOMAIN}"
      OME_ORIGIN_PORT: "9000"
      OME_RTMP_PROV_PORT: "1935"
      OME_SRT_PROV_PORT: "9999"
      OME_LLHLS_STREAM_PORT: "3332"
      OME_WEBRTC_SIGNALLING_PORT: "3333"
      OME_WEBRTC_SIGNALLING_TLS_PORT: "3334"
      OME_WEBRTC_TCP_RELAY_PORT: "3478"
      OME_WEBRTC_CANDIDATE_PORT: "10002-10004/udp"
      OME_API_PORT: "8081"
      OME_API_TLS_PORT: "8082"
      OME_WEBHOOK_SECRET: ${OME_WEBHOOK_SECRET}
      OME_API_ACCESS_TOKEN: ${OME_API_ACCESS_TOKEN}
    env_file:
      - ./.env
    restart: always
    networks:
      - network
    volumes:
      - ./ovenmediaengine/origin_conf:/opt/ovenmediaengine/bin/origin_conf
      - ./certs/certs/live.colourstream.${DOMAIN}.crt:/opt/ovenmediaengine/bin/cert/cert.crt:ro
      - ./certs/private/live.colourstream.${DOMAIN}.key:/opt/ovenmediaengine/bin/cert/priv.key:ro
    labels:
      - "traefik.enable=true"
      # WebRTC WebSocket for /ws path
      - "traefik.http.routers.ome-webrtc.rule=Host(`video.colourstream.${DOMAIN}`) && PathPrefix(`/ws`)"
      - "traefik.http.routers.ome-webrtc.entrypoints=websecure"
      - "traefik.http.routers.ome-webrtc.tls.certresolver=myresolver"
      - "traefik.http.routers.ome-webrtc.service=ome-webrtc-service"
      - "traefik.http.services.ome-webrtc-service.loadbalancer.server.port=3333"
      - "traefik.http.services.ome-webrtc-service.loadbalancer.server.scheme=ws"
      # WebSocket middleware for WebRTC
      - "traefik.http.middlewares.ome-websocket.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.ome-websocket.headers.customrequestheaders.Connection=Upgrade"
      - "traefik.http.middlewares.ome-websocket.headers.customrequestheaders.Upgrade=websocket"
      - "traefik.http.routers.ome-webrtc.middlewares=ome-websocket"
      
      # WebRTC TLS Signaling for /app path on live domain
      - "traefik.http.routers.ome-webrtc-tls.rule=Host(`live.colourstream.${DOMAIN}`) && PathPrefix(`/app`)"
      - "traefik.http.routers.ome-webrtc-tls.entrypoints=websecure"
      - "traefik.http.routers.ome-webrtc-tls.tls.certresolver=myresolver"
      - "traefik.http.routers.ome-webrtc-tls.service=ome-webrtc-tls-service"
      - "traefik.http.services.ome-webrtc-tls-service.loadbalancer.server.port=3334"
      - "traefik.http.services.ome-webrtc-tls-service.loadbalancer.server.scheme=ws"
      # WebSocket middleware for TLS WebRTC
      - "traefik.http.middlewares.ome-websocket-tls.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.ome-websocket-tls.headers.customrequestheaders.Connection=Upgrade"
      - "traefik.http.middlewares.ome-websocket-tls.headers.customrequestheaders.Upgrade=websocket"
      - "traefik.http.routers.ome-webrtc-tls.middlewares=ome-websocket-tls"
      
      # WebRTC TLS Signaling for /app path on video domain
      - "traefik.http.routers.ome-webrtc-tls-video.rule=Host(`video.colourstream.${DOMAIN}`) && PathPrefix(`/app`)"
      - "traefik.http.routers.ome-webrtc-tls-video.entrypoints=websecure"
      - "traefik.http.routers.ome-webrtc-tls-video.tls.certresolver=myresolver"
      - "traefik.http.routers.ome-webrtc-tls-video.service=ome-webrtc-tls-video-service"
      - "traefik.http.services.ome-webrtc-tls-video-service.loadbalancer.server.port=3334"
      - "traefik.http.services.ome-webrtc-tls-video-service.loadbalancer.server.scheme=ws"
      # WebSocket middleware for TLS WebRTC on video domain
      - "traefik.http.middlewares.ome-websocket-tls-video.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.ome-websocket-tls-video.headers.customrequestheaders.Connection=Upgrade"
      - "traefik.http.middlewares.ome-websocket-tls-video.headers.customrequestheaders.Upgrade=websocket"
      - "traefik.http.routers.ome-webrtc-tls-video.middlewares=ome-websocket-tls-video"

  edge:
    image: airensoft/ovenmediaengine:latest #it must come from airensoft! 
    ports:
      - "4333:3333/tcp" # WebRTC Signaling / LLHLS
      - "3479:3479/tcp" # WebRTC TURN
      - "10005-10009:10005-10009/udp" # WebRTC Candidate
    environment:
      # Also use domain name for edge instead of IP address
      OME_HOST_IP: "live.colourstream.${DOMAIN}"
      DEFAULT_ORIGIN_SERVER: "origin"
      DEFAULT_ORIGIN_PORT: "9000"
      OME_LLHLS_STREAM_PORT: "3330"
      OME_WEBRTC_SIGNALLING_PORT: "3333"
      OME_WEBRTC_SIGNALLING_TLS_PORT: "3334"
      OME_WEBRTC_TCP_RELAY_PORT: "3479"
      OME_WEBRTC_CANDIDATE_PORT: "10005-10009/udp"
      OME_API_ACCESS_TOKEN: ${OME_API_ACCESS_TOKEN}
    env_file:
      - ./.env
    restart: always
    volumes:
      - ./ovenmediaengine/edge_conf:/opt/ovenmediaengine/bin/edge_conf
      - ./ovenmediaengine/edge_conf:/opt/ovenmediaengine/bin/origin_conf
      - ./certs/certs/live.colourstream.${DOMAIN}.crt:/opt/ovenmediaengine/bin/cert/cert.crt:ro
      - ./certs/private/live.colourstream.${DOMAIN}.key:/opt/ovenmediaengine/bin/cert/priv.key:ro
    networks:
      - network

  mirotalk:
    image: mirotalk/p2p:latest
    restart: always
    container_name: colourstream-mirotalk
    hostname: mirotalk
    expose:
      - 3000
    volumes:
      - ./mirotalk/.env:/src/.env:ro
      - ./mirotalk/public:/src/public:ro
      - ./mirotalk/app:/src/app:ro

    environment:
      STUN_SERVER_ENABLED: "true"
      STUN_SERVER_URL: "stun:stun.l.google.com:19302"
      TURN_SERVER_ENABLED: "true"
      TURN_SERVER_URL: "turn:video.colourstream.${DOMAIN}:3480"
      TURN_SERVER_USERNAME: "colourstream"
      OIDC_ENABLED: "false"
      HOST_PROTECTED: "true"
      TRUST_PROXY: "true"
      SEVER_TUNNEL: "false"
      NGROK_ENABLED: "false"
      HTTPS: "false"
      PORT: "3000"
      PROTOCOL: "http"
    env_file:
      - ./.env
      - mirotalk/.env
    networks:
      - network
    labels:
      - "traefik.enable=true"
      # Main route
      - "traefik.http.routers.mirotalk.rule=Host(`video.colourstream.${DOMAIN}`)"
      - "traefik.http.routers.mirotalk.entrypoints=websecure"
      - "traefik.http.routers.mirotalk.tls.certresolver=myresolver"
      - "traefik.http.routers.mirotalk.service=mirotalk-service"
      - "traefik.http.services.mirotalk-service.loadbalancer.server.port=3000"
      
      # WebSocket route for socket.io
      - "traefik.http.routers.mirotalk-ws.rule=Host(`video.colourstream.${DOMAIN}`) && PathPrefix(`/socket.io`)"
      - "traefik.http.routers.mirotalk-ws.entrypoints=websecure"
      - "traefik.http.routers.mirotalk-ws.tls.certresolver=myresolver"
      - "traefik.http.routers.mirotalk-ws.service=mirotalk-ws-service"
      - "traefik.http.services.mirotalk-ws-service.loadbalancer.server.port=3000"
      - "traefik.http.middlewares.sio.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.sio.headers.customrequestheaders.Connection=Upgrade" # Add Connection header
      - "traefik.http.middlewares.sio.headers.customrequestheaders.Upgrade=websocket" # Add Upgrade header
      - "traefik.http.routers.mirotalk-ws.middlewares=sio"
  # Add Uppy Companion service for handling large file uploads
  companion:
    image: transloadit/companion:latest
    container_name: colourstream-companion
    restart: always
    expose:
      - 3020
    environment:
      # Companion Core Settings
      COMPANION_PORT: 3020
      COMPANION_DOMAIN: "companion.colourstream.${DOMAIN}" # Subdomain for Companion
      COMPANION_PROTOCOL: "https"
      COMPANION_SECRET: "${COMPANION_SECRET}" # Must match Uppy config if used
      COMPANION_DATADIR: "/companion-data"
      # URL for Companion to notify the backend upon upload completion
      COMPANION_UPLOAD_URLS: "https://live.colourstream.${DOMAIN}/api/upload/s3-callback" # Adjust if your backend callback URL is different
      # Allow uploads from the frontend domains
      COMPANION_CLIENT_ORIGINS: "https://live.colourstream.${DOMAIN},https://upload.colourstream.${DOMAIN}"
      # Metadata fields to forward to S3 and potentially the backend callback
      COMPANION_METADATA_FIELDS: "name,type,token,clientCode,projectName" # Metadata Companion might still handle for other providers

      # --- AWS S3 Provider Settings Removed ---
      # Backend handles S3 signing directly for multipart uploads via @uppy/aws-s3 plugin
      # Companion only needs credentials for providers it directly handles (e.g., Dropbox, Google Drive)
      # COMPANION_PROVIDER_AWS_KEY: "${S3_ACCESS_KEY}"
      # COMPANION_PROVIDER_AWS_SECRET: "${S3_SECRET_KEY}"
      # COMPANION_PROVIDER_AWS_BUCKET: "${S3_BUCKET}"
      # COMPANION_PROVIDER_AWS_ENDPOINT: "${S3_PUBLIC_ENDPOINT}"
      # COMPANION_PROVIDER_AWS_REGION: "${S3_REGION}"
      # COMPANION_PROVIDER_AWS_USE_PATH_STYLE: "true"

      # Optional: Dropbox Provider Settings (Companion still needed for this)
      COMPANION_DROPBOX_KEY: "${DROPBOX_KEY}"
      COMPANION_DROPBOX_SECRET: "${DROPBOX_SECRET}"

      # Optional: Google Drive Provider Settings
      COMPANION_GOOGLE_KEY: "${GOOGLE_DRIVE_CLIENT_ID}" # Use the client ID as the key
      COMPANION_GOOGLE_SECRET: "${GOOGLE_DRIVE_CLIENT_SECRET}" # Use the client secret

      # Enable Debugging if needed
      DEBUG: "companion*" 
    volumes:
      - companion_data:/companion-data
    networks:
      - network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.companion.rule=Host(`companion.colourstream.${DOMAIN}`)"
      - "traefik.http.routers.companion.entrypoints=websecure"
      - "traefik.http.routers.companion.tls=true"
      - "traefik.http.routers.companion.tls.certresolver=myresolver"
      - "traefik.http.routers.companion.service=companion"
      - "traefik.http.services.companion.loadbalancer.server.port=3020"
  tusd:
     image: tusproject/tusd:latest
     container_name: colourstream-tusd # Added container name for clarity
     restart: unless-stopped # Restart policy
     volumes:
       - /Volumes/Backup3/tusd-data:/srv/tusd-data # Map a local directory for file storage
       - ./certs/certs/tusd.colourstream.${DOMAIN}.crt:/etc/tusd/tusd.crt:ro # Mount the TLS certificate
       - ./certs/private/tusd.colourstream.${DOMAIN}.key:/etc/tusd/tusd.key:ro # Mount the TLS key
     entrypoint: /usr/local/bin/tusd # Explicitly set the entrypoint
     ports:
      - "1080:1080" # Map tusd port to host
     command: # Use YAML list format for command arguments
       - "-port=1080"
       - "-upload-dir=/srv/tusd-data"
       - "-tls-certificate=/etc/tusd/tusd.crt"
       - "-tls-key=/etc/tusd/tusd.key"
       # --- Use single HTTP hook endpoint ---
       - "-hooks-http=http://backend:5001/api/upload/hook-progress"
       # Forward necessary headers for the HTTP hook
       - "-hooks-http-forward-headers=Upload-Concat,Upload-Defer-Length,Upload-Length,Upload-Metadata,Upload-Offset,Tus-Resumable"
       # Specify which events trigger hooks (all sent to the same URL)
       - "-hooks-enabled-events=post-create,post-receive,post-finish,post-terminate"
       - "-enable-h2c" # This might conflict with TLS, review if needed
       - "-disable-download=true" # Disable direct downloads, handled by backend
     networks: # Added network definition
       - network
     labels:
      - "traefik.enable=false"
  coturn:
    image: coturn/coturn
    container_name: colourstream-coturn
    network_mode: "host"
    user: "root"
    restart: unless-stopped
    volumes:
      - ./coturn/turnserver.conf:/etc/coturn/turnserver.conf:ro
      - ./certs/certs/video.colourstream.${DOMAIN}.crt:/etc/turnserver.pem
      - ./certs/private/video.colourstream.${DOMAIN}.key:/etc/turnserver.key
volumes:
  postgres_data:
    name: colourstream_postgres_data
  # uploads_data and organized_data removed as bind mounts are used instead
  companion_data: # Ensure this volume is defined
    name: colourstream_companion_data

networks:
  network:
    driver: bridge