astra/owpengram-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

merged from gramsrv upstream

Browse source
This commit is contained in:
onysd 2026-09-01 12:06:31 +03:00
parent 79c64ee916
commit 21a0856587
651 changed files with 54774 additions and 4590 deletions
Download patch file Download diff file Expand all files Collapse all files

100
deploy/docker/.env.example Normal file
View file

@ -0,0 +1,100 @@
# Generated automatically by scripts/new-docker-env.*. Keep the resulting .env
# private and never commit it.
COMPOSE_PROJECT_NAME=gramsrv-main
TELESRV_DEPLOYMENT_PROFILE=main-monolith-v1
TELESRV_IMAGE_PREFIX=ghcr.io/iamxvbaba/gramsrv
TELESRV_IMAGE_TAG=main
TELESRV_SERVER_BUILD_TARGET=server-test
TELESRV_LOG_LEVEL=info
# Build provenance for local builds.
TELESRV_BUILD_COMMIT=unknown
TELESRV_BUILD_BRANCH=main
TELESRV_BUILD_TREE_STATE=unknown
TELESRV_BUILD_DATE=unknown
# The host-network server and admin reach these dependencies through loopback.
POSTGRES_DB=telesrv_main
POSTGRES_USER=telesrv
POSTGRES_PASSWORD=CHANGEME
TELESRV_POSTGRES_HOST_PORT=15432
TELESRV_POSTGRES_DSN=postgres://telesrv:CHANGEME@127.0.0.1:15432/telesrv_main?sslmode=disable
TELESRV_REDIS_HOST_PORT=16379
TELESRV_REDIS_ADDR=127.0.0.1:16379
TELESRV_REDIS_PASSWORD=CHANGEME
# Independent random values generated for each deployment.
TELESRV_ADMIN_API_TOKEN=CHANGEME
TELESRV_ADMIN_UI_PASSWORD=CHANGEME
TELESRV_ADMIN_UI_TOKEN=
TELESRV_ADMIN_SESSION_KEY=CHANGEME
TELESRV_TURN_SECRET=CHANGEME
TELESRV_OTP_WEBHOOK_SECRET=CHANGEME
# Development delivery is accepted automatically on loopback. Internet-facing
# deployments must explicitly opt in or replace it with the webhook provider.
TELESRV_DEV_AUTH_CODE=12345
TELESRV_PHONE_CODE_DELIVERY_PROVIDER=development
TELESRV_ALLOW_INSECURE_DEVELOPMENT_AUTH=false
TELESRV_OTP_WEBHOOK_URL=
TELESRV_OTP_WEBHOOK_TIMEOUT=5s
# The published main test image deliberately contains a public test RSA key so
# fresh test clients share one fingerprint. Existing server_state is preserved.
# Build target "server" plus mode "generated" for a private deployment identity.
TELESRV_RSA_IDENTITY_MODE=test
# Must be a client-reachable IP address, never a DNS name.
TELESRV_ADVERTISE_IP=CHANGEME
TELESRV_SERVER_PORT=2398
TELESRV_DEFAULT_COUNTRY_CODE=CN
TELESRV_PUBLIC_BASE_URL=CHANGEME
TELESRV_PUBLIC_APP_SCHEME=telesrv
TELESRV_PUBLIC_WEB_BASE_URL=CHANGEME
TELESRV_PUBLIC_LINK_PORT=2401
# The monolith owns SFU, TURN, and RTMP. Host mode avoids one Docker mapping per
# TURN relay port. Bridge mode publishes a bounded 64-port compatibility range.
TELESRV_SERVER_HOST_NETWORK=true
TELESRV_SFU_ENABLE=true
TELESRV_SFU_UDP_PORT=12399
TELESRV_SFU_ADVERTISE_IP=CHANGEME
TELESRV_TURN_ENABLE=true
TELESRV_TURN_UDP_PORT=12400
TELESRV_TURN_ADVERTISE_IP=CHANGEME
TELESRV_TURN_RELAY_MIN_PORT=12500
TELESRV_TURN_RELAY_MAX_PORT=12999
TELESRV_TURN_BRIDGE_RELAY_MAX_PORT=12563
TELESRV_CALL_TURN_CREDENTIAL_TTL=6h
TELESRV_CALL_FORCE_RELAY=false
TELESRV_LIVESTREAM_ENABLE=true
TELESRV_LIVESTREAM_RTMP_PORT=2400
TELESRV_LIVESTREAM_RTMP_URL=CHANGEME
# Direct host listeners and their health-probe addresses.
TELESRV_PUBLIC_BIND_IP=127.0.0.1
TELESRV_PUBLIC_LISTEN_HOST=127.0.0.1
TELESRV_LOCAL_BIND_IP=127.0.0.1
TELESRV_LOCAL_LISTEN_HOST=127.0.0.1
TELESRV_SERVER_HEALTH_IP=127.0.0.1
TELESRV_SERVER_HEALTH_URL_HOST=127.0.0.1
TELESRV_ADMIN_API_PORT=2599
TELESRV_ADMIN_BIND_IP=127.0.0.1
TELESRV_ADMIN_LISTEN_HOST=127.0.0.1
TELESRV_ADMIN_HEALTH_IP=127.0.0.1
TELESRV_ADMIN_PORT=2600
# Durable media state. Switching an existing deployment between localfs and S3
# requires the explicit blob migration procedure.
TELESRV_BLOB_BACKEND=localfs
TELESRV_EXTERNAL_MEDIA_ENABLE=true
TELESRV_WEBPAGE_PREVIEW_ENABLE=true
TELESRV_S3_ENDPOINT=
TELESRV_S3_REGION=
TELESRV_S3_BUCKET=
TELESRV_S3_ACCESS_KEY_ID=
TELESRV_S3_SECRET_ACCESS_KEY=
TELESRV_S3_USE_SSL=true
TELESRV_S3_PATH_STYLE=false
TELESRV_S3_CREATE_BUCKET=false

1
deploy/docker/assets/test-server-rsa.pem.b64 Normal file
View file

@ -0,0 +1 @@
LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBeEYvLzBNMCsvNVB6Z2ROYWdUWCtKK2RKZ3I3NVpDVHVpRzhpNHg3WXdtSkYramlPCkdDam03WDdCTENhTWMxK2hPWllETDMrR3ZsZS9BS3lrVzFxb3VhQ0pNVngvSCsybDhMRlhMZWxaMlBMYXdUYjgKQTdCbFRxV3pMM2RiNUJ1Z01OV3ppTDlUdWhSOEluMWJ3S1kwN1FWcFI5aW41empBc0FHTEJrK21HdDBEblZ5TQpmMVhvcDJsTENGTm1tMEY0eWtjQWVhTENDSVBiR1dkZGxpTFk4eEVFaEk0R08ybDFVM2taTXdJT2RPbkFHSkZ0CmdVQW9UZStGSFI2RjFzOWFkQ1ZaQjF0ZUwvaGY5UitXbWVrSnd5Z1Z6ME1ZRUg3eTZVNDlUNDUrL1c3T0Y2WDYKZzBXMGoxdVNTcnNZNHFON3R3eGJUYWQ5emRHWjd5cys5ditQdVFJREFRQUJBb0lCQUFqdXFPOHhkczBmU0xNKwpEdDdUdXVUTHcyODhDcElBa0EwS3FSYVZuNXh2NWVqMHk1blR1blZSRDY1WGJvb003b04xREY0THVmQk1nM2FmClk3WjRFRGFwVTdRNEZkdzQ3aFJkcks1ODc4WkxmYUhPUTNaVGZyZ3VGMUZ3WjNDZnhSQ1RsOS8vZStwNTVnK1gKamlYY0tZb2lkZUI3dlY5cUdIR3BFRTdRTHFrSUVpbk1FV05hQjh1dGN0SDdUWGRXYTRweWZJR2lQckhNTjJ6SApoRjQwSWI3bkpBNmtodHpzTkNEU0Q5WG5ibEVORW9kMUU1Z1JzalE5ZkdzaGRCdHBEc1hyTEJGTDdLTUREb1FtCmN6cnQvS3hsWk1wYnRPZno2dWE1ZUtFQkJUdE51dG1WY3AxcTl5K2NRcFBaem5ZaVJUTCtPSnpWZ2Z1SE9PLzAKZWEyai93RUNnWUVBNkk2ZitFTG84QVA3UTRXMHFzc3VYS3ZIRUYvUkVFZngyTHVlaDBsclVoVlIzSWdqYWtGYwpiVFJsTEVRSzhRTmJEQW1OTXVIckVabmptR3U3bnkzek45NHNsQy95Y0k1cGQ5aFFHVndPMjJlcjlvMitNOXcyCkpwQjRRZjhjOFNLL3BIUU45K2pPdEJ4VjJkcmJmZTBvVW9LRXRZeUQ1Y2J0akZUM3lmZUEyQ0VDZ1lFQTJDdW8KUzg0MWtWcHB4MUt3cEw0aTFmZ0dRUHlrYUtyRDRvR1pyWWd2MkZ4VzU1aS9xNUZjWUw2ZkUzN0phTTFwby9SQgp0bkhnMzVOYW5nL3l1Wlh6NkViNEswQ3lMKzhMdWhDSWI2UHhEdnF5Q1hia1hUd0hTVlJBbkdFTVNOM3phLzdGCkZDSkYxQUJXZzhqbEtSZEEvbFJ3cW84UDhaZ0JlQk1xcEtaaDVKa0NnWUJoQ0ltazI3NDN6MkY2dGdKQk5VL2QKNk9yQllVbHBJcXU5ZytOTWpZelREZ1EvSVNxdHZpSGppdllmOXpBZGlnbm1SdUg4ZGhsUUdjYkdKVVYrMEh4bwpOaktoampQNVZPS2ExODNzRnVZNEU5VERwamJUaXJHcGU2UkIzVUZsTjl1QXNjL1dQZlJwWUYxTjdpeWhLV0FtCnRVRE1RNW9ST09TTEpqVFJ0NHl5SVFLQmdRQ1RmeTVsRXYyd0FQMzk5K2o1YjVhN1luRjU5Q2lHRmtaMERiUDcKR05wMGlZVHVuMlhndmQxSFVhbWZGcnA4blBRQTM4L2FtZGN6RmdzVm9KSWdtVFdFZnJBa2F3OXA3M1NUNzJYNApydWJ6THBFK0xmWmh1MnpKVndpQzZ5RURzeFc5MFdkTmRwa29yMVpZczBIUmlNRmJCK2ljSitOY0dEaWdZb3VOCkxzM0t1UUtCZ1FDVEF4Vk03ek5QZ3NmZnVkWlA3Rk1ueTIwTE1SNitGUW83eFJ6NUVsWWFDVmdYTTFOSDRLL3IKeUZrT0NHaE9ONkkvTVVOQlB4V0xFdVpCUmZ5cmx5M2JwM2o3UjYvaExYNGZOeXc5QjNHUXVWeUNIRDJENHRvZAo2SjVWby9Fc2VxcGVlS2E2Q3YvWTJIVkIwa2ZHdzFWQ0MvZ00wMUw4dWVkM2hzcjJMRDJrQ3c9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=

8
deploy/docker/assets/test-server-rsa.pub Normal file
View file

@ -0,0 +1,8 @@
-----BEGIN RSA PUBLIC KEY-----
MIIBCgKCAQEAxF//0M0+/5PzgdNagTX+J+dJgr75ZCTuiG8i4x7YwmJF+jiOGCjm
7X7BLCaMc1+hOZYDL3+Gvle/AKykW1qouaCJMVx/H+2l8LFXLelZ2PLawTb8A7Bl
TqWzL3db5BugMNWziL9TuhR8In1bwKY07QVpR9in5zjAsAGLBk+mGt0DnVyMf1Xo
p2lLCFNmm0F4ykcAeaLCCIPbGWddliLY8xEEhI4GO2l1U3kZMwIOdOnAGJFtgUAo
Te+FHR6F1s9adCVZB1teL/hf9R+WmekJwygVz0MYEH7y6U49T45+/W7OF6X6g0W0
j1uSSrsY4qN7twxbTad9zdGZ7ys+9v+PuQIDAQAB
-----END RSA PUBLIC KEY-----

63
deploy/docker/compose.bridge-network.yaml Normal file
View file

@ -0,0 +1,63 @@
services:
server:
# Compatibility fallback for hosts without network_mode: host. The bounded
# TURN relay range is published 1:1 to avoid address translation mismatch.
network_mode: !reset null
environment:
TELESRV_LISTEN: 0.0.0.0:${TELESRV_SERVER_PORT:-2398}
TELESRV_PUBLIC_LINK_WEB_ADDR: 0.0.0.0:${TELESRV_PUBLIC_LINK_PORT:-2401}
TELESRV_POSTGRES_DSN: postgres://${POSTGRES_USER:-telesrv}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-telesrv_main}?sslmode=disable
TELESRV_REDIS_ADDR: redis:6379
TELESRV_ADMIN_API_ADDR: 0.0.0.0:${TELESRV_ADMIN_API_PORT:-2599}
TELESRV_TURN_RELAY_MAX_PORT: ${TELESRV_TURN_BRIDGE_RELAY_MAX_PORT:-12563}
TELESRV_SERVER_HEALTH_IP: 127.0.0.1
TELESRV_SERVER_HEALTH_URL_HOST: 127.0.0.1
ports:
- name: mtproto
target: ${TELESRV_SERVER_PORT:-2398}
published: "${TELESRV_SERVER_PORT:-2398}"
host_ip: ${TELESRV_PUBLIC_BIND_IP:-127.0.0.1}
protocol: tcp
- name: public-links
target: ${TELESRV_PUBLIC_LINK_PORT:-2401}
published: "${TELESRV_PUBLIC_LINK_PORT:-2401}"
host_ip: ${TELESRV_LOCAL_BIND_IP:-127.0.0.1}
protocol: tcp
- name: rtmp-ingest
target: ${TELESRV_LIVESTREAM_RTMP_PORT:-2400}
published: "${TELESRV_LIVESTREAM_RTMP_PORT:-2400}"
host_ip: ${TELESRV_PUBLIC_BIND_IP:-127.0.0.1}
protocol: tcp
- name: sfu-media
target: ${TELESRV_SFU_UDP_PORT:-12399}
published: "${TELESRV_SFU_UDP_PORT:-12399}"
host_ip: ${TELESRV_PUBLIC_BIND_IP:-127.0.0.1}
protocol: udp
- name: turn
target: ${TELESRV_TURN_UDP_PORT:-12400}
published: "${TELESRV_TURN_UDP_PORT:-12400}"
host_ip: ${TELESRV_PUBLIC_BIND_IP:-127.0.0.1}
protocol: udp
- "${TELESRV_PUBLIC_BIND_IP:-127.0.0.1}:${TELESRV_TURN_RELAY_MIN_PORT:-12500}-${TELESRV_TURN_BRIDGE_RELAY_MAX_PORT:-12563}:${TELESRV_TURN_RELAY_MIN_PORT:-12500}-${TELESRV_TURN_BRIDGE_RELAY_MAX_PORT:-12563}/udp"
networks:
- data
- control
- outbound
admin:
network_mode: !reset null
environment:
TELESRV_POSTGRES_DSN: postgres://${POSTGRES_USER:-telesrv}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-telesrv_main}?sslmode=disable
TELESRV_ADMIN_API_ADDR: server:${TELESRV_ADMIN_API_PORT:-2599}
TELESRV_ADMIN_UI_ADDR: 0.0.0.0:${TELESRV_ADMIN_PORT:-2600}
TELESRV_ADMIN_HEALTH_IP: 127.0.0.1
ports:
- name: admin-ui
target: ${TELESRV_ADMIN_PORT:-2600}
published: "${TELESRV_ADMIN_PORT:-2600}"
host_ip: ${TELESRV_ADMIN_BIND_IP:-127.0.0.1}
protocol: tcp
networks:
- data
- control
- admin_host_access

228
deploy/docker/compose.yaml Normal file
View file

@ -0,0 +1,228 @@
name: ${COMPOSE_PROJECT_NAME:-gramsrv-main}
x-build-args: &build-args
VCS_REF: ${TELESRV_BUILD_COMMIT:-unknown}
VCS_BRANCH: ${TELESRV_BUILD_BRANCH:-main}
VCS_TREE_STATE: ${TELESRV_BUILD_TREE_STATE:-unknown}
BUILD_DATE: ${TELESRV_BUILD_DATE:-unknown}
x-app: &app
init: true
restart: unless-stopped
read_only: true
user: "10001:10001"
cap_drop:
- ALL
pids_limit: 1024
security_opt:
- no-new-privileges:true
tmpfs:
- /tmp:rw,noexec,nosuid,nodev,size=128m
stop_grace_period: 1m
logging: &app-logging
driver: json-file
options:
max-size: 10m
max-file: "5"
services:
postgres:
image: postgres:17-alpine@sha256:979c4379dd698aba0b890599a6104e082035f98ef31d9b9291ec22f2b13059ca
environment:
POSTGRES_DB: ${POSTGRES_DB:-telesrv_main}
POSTGRES_USER: ${POSTGRES_USER:-telesrv}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in deploy/docker/.env}
POSTGRES_INITDB_ARGS: --data-checksums
TZ: UTC
command:
- postgres
- -c
- max_locks_per_transaction=512
- -c
- shared_preload_libraries=pg_stat_statements
- -c
- pg_stat_statements.track=all
- -c
- track_io_timing=on
shm_size: 256mb
volumes:
- postgres_data:/var/lib/postgresql/data
- ../postgres-init:/docker-entrypoint-initdb.d:ro
ports:
- name: server-host-postgres
target: 5432
published: "${TELESRV_POSTGRES_HOST_PORT:-15432}"
host_ip: 127.0.0.1
protocol: tcp
healthcheck:
test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
interval: 5s
timeout: 3s
retries: 20
start_period: 10s
restart: unless-stopped
stop_grace_period: 1m
logging: *app-logging
networks:
- data
- server_host_access
redis:
image: redis:7-alpine@sha256:8b81dd37ff027bec4e516d41acfbe9fe2460070dc6d4a4570a2ac5b9d59df065
environment:
REDIS_PASSWORD: ${TELESRV_REDIS_PASSWORD:?set TELESRV_REDIS_PASSWORD in deploy/docker/.env}
command:
- sh
- -ec
- exec redis-server --appendonly yes --appendfsync everysec --requirepass "$$REDIS_PASSWORD"
volumes:
- redis_data:/data
ports:
- name: server-host-redis
target: 6379
published: "${TELESRV_REDIS_HOST_PORT:-16379}"
host_ip: 127.0.0.1
protocol: tcp
healthcheck:
test: ["CMD-SHELL", "redis-cli --no-auth-warning -a \"$$REDIS_PASSWORD\" ping | grep -qx PONG"]
interval: 5s
timeout: 3s
retries: 20
start_period: 5s
restart: unless-stopped
stop_grace_period: 30s
logging: *app-logging
networks:
- data
- server_host_access
server:
<<: *app
image: ${TELESRV_IMAGE_PREFIX:-ghcr.io/iamxvbaba/gramsrv}/server:${TELESRV_IMAGE_TAG:-main}
build:
context: ../..
dockerfile: Dockerfile
target: ${TELESRV_SERVER_BUILD_TARGET:-server-test}
args: *build-args
environment:
TELESRV_LOG_LEVEL: ${TELESRV_LOG_LEVEL:-info}
TELESRV_LISTEN: ${TELESRV_PUBLIC_LISTEN_HOST:-127.0.0.1}:${TELESRV_SERVER_PORT:-2398}
TELESRV_ADVERTISE_IP: ${TELESRV_ADVERTISE_IP:?set TELESRV_ADVERTISE_IP in deploy/docker/.env}
TELESRV_DEFAULT_COUNTRY_CODE: ${TELESRV_DEFAULT_COUNTRY_CODE:-CN}
TELESRV_PUBLIC_BASE_URL: ${TELESRV_PUBLIC_BASE_URL:?set TELESRV_PUBLIC_BASE_URL in deploy/docker/.env}
TELESRV_PUBLIC_APP_SCHEME: ${TELESRV_PUBLIC_APP_SCHEME:-telesrv}
TELESRV_PUBLIC_WEB_BASE_URL: ${TELESRV_PUBLIC_WEB_BASE_URL:?set TELESRV_PUBLIC_WEB_BASE_URL in deploy/docker/.env}
TELESRV_PUBLIC_LINK_WEB_ADDR: ${TELESRV_LOCAL_LISTEN_HOST:-127.0.0.1}:${TELESRV_PUBLIC_LINK_PORT:-2401}
TELESRV_POSTGRES_DSN: ${TELESRV_POSTGRES_DSN:?set TELESRV_POSTGRES_DSN in deploy/docker/.env}
TELESRV_REDIS_ADDR: ${TELESRV_REDIS_ADDR:-127.0.0.1:16379}
TELESRV_REDIS_PASSWORD: ${TELESRV_REDIS_PASSWORD:?set TELESRV_REDIS_PASSWORD in deploy/docker/.env}
TELESRV_REDIS_DB: 0
TELESRV_ADMIN_API_ADDR: 127.0.0.1:${TELESRV_ADMIN_API_PORT:-2599}
TELESRV_ADMIN_API_TOKEN: ${TELESRV_ADMIN_API_TOKEN:?set TELESRV_ADMIN_API_TOKEN in deploy/docker/.env}
TELESRV_DEV_AUTH_CODE: ${TELESRV_DEV_AUTH_CODE:-12345}
TELESRV_PHONE_CODE_DELIVERY_PROVIDER: ${TELESRV_PHONE_CODE_DELIVERY_PROVIDER:-development}
TELESRV_OTP_WEBHOOK_URL: ${TELESRV_OTP_WEBHOOK_URL:-}
TELESRV_OTP_WEBHOOK_SECRET: ${TELESRV_OTP_WEBHOOK_SECRET:-}
TELESRV_OTP_WEBHOOK_TIMEOUT: ${TELESRV_OTP_WEBHOOK_TIMEOUT:-5s}
TELESRV_RSA_KEY: /var/lib/telesrv/server_rsa.pem
TELESRV_RSA_IDENTITY_MODE: ${TELESRV_RSA_IDENTITY_MODE:-test}
TELESRV_SFU_ENABLE: ${TELESRV_SFU_ENABLE:-true}
TELESRV_SFU_UDP_PORT: ${TELESRV_SFU_UDP_PORT:-12399}
TELESRV_SFU_ADVERTISE_IP: ${TELESRV_SFU_ADVERTISE_IP:?set TELESRV_SFU_ADVERTISE_IP in deploy/docker/.env}
TELESRV_TURN_ENABLE: ${TELESRV_TURN_ENABLE:-true}
TELESRV_TURN_UDP_PORT: ${TELESRV_TURN_UDP_PORT:-12400}
TELESRV_TURN_ADVERTISE_IP: ${TELESRV_TURN_ADVERTISE_IP:?set TELESRV_TURN_ADVERTISE_IP in deploy/docker/.env}
TELESRV_TURN_SECRET: ${TELESRV_TURN_SECRET:?set TELESRV_TURN_SECRET in deploy/docker/.env}
TELESRV_TURN_RELAY_MIN_PORT: ${TELESRV_TURN_RELAY_MIN_PORT:-12500}
TELESRV_TURN_RELAY_MAX_PORT: ${TELESRV_TURN_RELAY_MAX_PORT:-12999}
TELESRV_CALL_TURN_CREDENTIAL_TTL: ${TELESRV_CALL_TURN_CREDENTIAL_TTL:-6h}
TELESRV_CALL_FORCE_RELAY: ${TELESRV_CALL_FORCE_RELAY:-false}
TELESRV_LIVESTREAM_ENABLE: ${TELESRV_LIVESTREAM_ENABLE:-true}
TELESRV_LIVESTREAM_RTMP_ADDR: :${TELESRV_LIVESTREAM_RTMP_PORT:-2400}
TELESRV_LIVESTREAM_RTMP_URL: ${TELESRV_LIVESTREAM_RTMP_URL:?set TELESRV_LIVESTREAM_RTMP_URL in deploy/docker/.env}
TELESRV_LIVESTREAM_WORK_DIR: /var/lib/telesrv/livestream
TELESRV_LANGPACK_SEED_DIR: /usr/share/telesrv/langpack
TELESRV_BLOB_BACKEND: ${TELESRV_BLOB_BACKEND:-localfs}
TELESRV_BLOB_DIR: /var/lib/telesrv/blobs
TELESRV_BLOB_STAGING_DIR: /var/lib/telesrv/blob-staging
TELESRV_MAPTILE_CACHE_DIR: /var/lib/telesrv/maptiles
TELESRV_EXTERNAL_MEDIA_ENABLE: ${TELESRV_EXTERNAL_MEDIA_ENABLE:-true}
TELESRV_WEBPAGE_PREVIEW_ENABLE: ${TELESRV_WEBPAGE_PREVIEW_ENABLE:-true}
TELESRV_S3_ENDPOINT: ${TELESRV_S3_ENDPOINT:-}
TELESRV_S3_REGION: ${TELESRV_S3_REGION:-}
TELESRV_S3_BUCKET: ${TELESRV_S3_BUCKET:-}
TELESRV_S3_ACCESS_KEY_ID: ${TELESRV_S3_ACCESS_KEY_ID:-}
TELESRV_S3_SECRET_ACCESS_KEY: ${TELESRV_S3_SECRET_ACCESS_KEY:-}
TELESRV_S3_USE_SSL: ${TELESRV_S3_USE_SSL:-true}
TELESRV_S3_PATH_STYLE: ${TELESRV_S3_PATH_STYLE:-false}
TELESRV_S3_CREATE_BUCKET: ${TELESRV_S3_CREATE_BUCKET:-false}
TELESRV_SERVER_PORT: ${TELESRV_SERVER_PORT:-2398}
TELESRV_PUBLIC_LINK_PORT: ${TELESRV_PUBLIC_LINK_PORT:-2401}
TELESRV_SERVER_HEALTH_IP: ${TELESRV_SERVER_HEALTH_IP:-127.0.0.1}
TELESRV_SERVER_HEALTH_URL_HOST: ${TELESRV_SERVER_HEALTH_URL_HOST:-127.0.0.1}
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
volumes:
- server_state:/var/lib/telesrv
network_mode: host
healthcheck:
test:
- CMD-SHELL
- >-
wget -q -O /dev/null "http://$${TELESRV_SERVER_HEALTH_URL_HOST}:$${TELESRV_PUBLIC_LINK_PORT}/healthz"
&& nc -z "$${TELESRV_SERVER_HEALTH_IP}" "$${TELESRV_SERVER_PORT}"
interval: 5s
timeout: 5s
retries: 114
start_period: 30s
admin:
<<: *app
image: ${TELESRV_IMAGE_PREFIX:-ghcr.io/iamxvbaba/gramsrv}/admin:${TELESRV_IMAGE_TAG:-main}
build:
context: ../..
dockerfile: Dockerfile
target: admin
args: *build-args
environment:
TELESRV_POSTGRES_DSN: ${TELESRV_POSTGRES_DSN:?set TELESRV_POSTGRES_DSN in deploy/docker/.env}
TELESRV_ADMIN_API_ADDR: 127.0.0.1:${TELESRV_ADMIN_API_PORT:-2599}
TELESRV_ADMIN_API_TOKEN: ${TELESRV_ADMIN_API_TOKEN:?set TELESRV_ADMIN_API_TOKEN in deploy/docker/.env}
TELESRV_ADMIN_UI_ADDR: ${TELESRV_ADMIN_LISTEN_HOST:-127.0.0.1}:${TELESRV_ADMIN_PORT:-2600}
TELESRV_ADMIN_UI_PASSWORD: ${TELESRV_ADMIN_UI_PASSWORD:?set TELESRV_ADMIN_UI_PASSWORD in deploy/docker/.env}
TELESRV_ADMIN_UI_TOKEN: ${TELESRV_ADMIN_UI_TOKEN:-}
TELESRV_ADMIN_SESSION_KEY: ${TELESRV_ADMIN_SESSION_KEY:?set TELESRV_ADMIN_SESSION_KEY in deploy/docker/.env}
TELESRV_BLOB_BACKEND: ${TELESRV_BLOB_BACKEND:-localfs}
TELESRV_BLOB_DIR: /var/lib/telesrv/blobs
TELESRV_BLOB_STAGING_DIR: /var/lib/telesrv/blob-staging
TELESRV_ADMIN_HEALTH_IP: ${TELESRV_ADMIN_HEALTH_IP:-127.0.0.1}
TELESRV_ADMIN_PORT: ${TELESRV_ADMIN_PORT:-2600}
depends_on:
server:
condition: service_healthy
volumes:
- server_state:/var/lib/telesrv:ro
network_mode: host
healthcheck:
test: ["CMD-SHELL", "nc -z \"$$TELESRV_ADMIN_HEALTH_IP\" \"$$TELESRV_ADMIN_PORT\""]
interval: 5s
timeout: 3s
retries: 12
start_period: 5s
networks:
data:
internal: true
server_host_access:
admin_host_access:
control:
internal: true
outbound:
volumes:
postgres_data:
redis_data:
server_state:

99
deploy/docker/docker-entrypoint.sh Executable file
View file

@ -0,0 +1,99 @@
#!/bin/sh
set -eu
umask 077
command_name="${1##*/}"
require_secret() {
name="$1"
value="$(printenv "$name" 2>/dev/null || true)"
normalized="$(printf '%s' "$value" | tr '[:upper:]' '[:lower:]')"
case "$normalized" in
""|*changeme*|*change-me*|*replace-me*)
echo "telesrv: required secret $name is missing or still uses a placeholder" >&2
exit 64
;;
esac
}
require_value() {
name="$1"
value="$(printenv "$name" 2>/dev/null || true)"
normalized="$(printf '%s' "$value" | tr '[:upper:]' '[:lower:]')"
case "$normalized" in
""|*changeme*|*change-me*|*replace-me*)
echo "telesrv: required setting $name is missing or still uses a placeholder" >&2
exit 64
;;
esac
}
initialize_server_key() {
private_key="${TELESRV_RSA_KEY:-/var/lib/telesrv/server_rsa.pem}"
identity_mode="$(printf '%s' "${TELESRV_RSA_IDENTITY_MODE:-generated}" | tr '[:upper:]' '[:lower:]')"
embedded_private_key=/usr/share/telesrv/keys/test-server-rsa.pem.b64
key_dir=$(dirname -- "$private_key")
mkdir -p "$key_dir"
case "$identity_mode" in
generated) ;;
test)
if [ ! -f "$private_key" ]; then
if [ ! -r "$embedded_private_key" ]; then
echo "telesrv: test RSA identity requested, but this image does not contain the published test key; use the server-test target or set TELESRV_RSA_IDENTITY_MODE=generated" >&2
exit 66
fi
temporary_key="$private_key.tmp.$$"
trap 'rm -f "$temporary_key"' EXIT HUP INT TERM
base64 -d "$embedded_private_key" >"$temporary_key"
chmod 0600 "$temporary_key"
mv "$temporary_key" "$private_key"
trap - EXIT HUP INT TERM
echo "telesrv: WARNING using the published main test RSA identity; its private key is public" >&2
fi
;;
*)
echo "telesrv: TELESRV_RSA_IDENTITY_MODE must be test or generated" >&2
exit 64
;;
esac
if [ -f "$private_key" ]; then
if ! openssl rsa -in "$private_key" -check -noout >/dev/null 2>&1; then
echo "telesrv: $private_key is not a valid RSA private key" >&2
exit 65
fi
chmod 0600 "$private_key"
fi
}
case "$command_name" in
telesrv)
require_value TELESRV_ADVERTISE_IP
require_value TELESRV_PUBLIC_BASE_URL
require_value TELESRV_PUBLIC_WEB_BASE_URL
require_secret TELESRV_POSTGRES_DSN
require_secret TELESRV_REDIS_PASSWORD
require_secret TELESRV_ADMIN_API_TOKEN
require_secret TELESRV_TURN_SECRET
initialize_server_key
;;
telesrv-admin)
require_secret TELESRV_POSTGRES_DSN
require_secret TELESRV_ADMIN_API_TOKEN
require_secret TELESRV_ADMIN_SESSION_KEY
admin_password="$(printenv TELESRV_ADMIN_UI_PASSWORD 2>/dev/null || true)"
admin_token="$(printenv TELESRV_ADMIN_UI_TOKEN 2>/dev/null || true)"
if [ -n "$admin_password" ]; then
require_secret TELESRV_ADMIN_UI_PASSWORD
elif [ -n "$admin_token" ]; then
require_secret TELESRV_ADMIN_UI_TOKEN
else
echo "telesrv: TELESRV_ADMIN_UI_PASSWORD or TELESRV_ADMIN_UI_TOKEN is required" >&2
exit 64
fi
;;
esac
exec "$@"