crossdesk-server/compose.yaml

services:
  crossdesk-server:
    build:
      context: .
      dockerfile: docker/dockerfile
    image: "${CROSSDESK_IMAGE:-crossdesk/crossdesk-server:latest}"
    container_name: crossdesk_server
    network_mode: host
    restart: unless-stopped
    stop_grace_period: 20s
    ulimits:
      nofile:
        soft: ${CROSSDESK_NOFILE:-32768}
        hard: ${CROSSDESK_NOFILE:-32768}
    environment:
      EXTERNAL_IP: "${EXTERNAL_IP:?Set EXTERNAL_IP in .env}"
      CROSSDESK_MAX_CONNECTIONS: "${CROSSDESK_MAX_CONNECTIONS:-8192}"
      CROSSDESK_AUTH_WORKERS: "${CROSSDESK_AUTH_WORKERS:-2}"
      CROSSDESK_AUTH_QUEUE_CAPACITY: "${CROSSDESK_AUTH_QUEUE_CAPACITY:-4096}"
      CROSSDESK_AUTH_SOURCE_CAPACITY: "${CROSSDESK_AUTH_SOURCE_CAPACITY:-256}"
      CROSSDESK_AUTH_SOURCE_PER_MINUTE: "${CROSSDESK_AUTH_SOURCE_PER_MINUTE:-60}"
      CROSSDESK_AUTH_TIMEOUT_SECONDS: "${CROSSDESK_AUTH_TIMEOUT_SECONDS:-600}"
      CROSSDESK_LOG_RETENTION_DAYS: "${CROSSDESK_LOG_RETENTION_DAYS:-185}"
      CROSSDESK_OFFLINE_RETENTION_DAYS: "${CROSSDESK_OFFLINE_RETENTION_DAYS:-180}"
      CROSSDESK_RETENTION_INTERVAL_SECONDS: "${CROSSDESK_RETENTION_INTERVAL_SECONDS:-3600}"
      CROSSDESK_SERVER_PORT: "${CROSSDESK_SERVER_PORT:-9099}"
      COTURN_PUBLIC_HOST: "${COTURN_PUBLIC_HOST:-}"
      COTURN_PORT: "${COTURN_PORT:-3478}"
      COTURN_AUTH_SECRET: "${COTURN_AUTH_SECRET:?Set COTURN_AUTH_SECRET in .env}"
      COTURN_CREDENTIAL_TTL_SECONDS: "${COTURN_CREDENTIAL_TTL_SECONDS:-3600}"
      CROSSDESK_ICE_SERVERS: "${CROSSDESK_ICE_SERVERS:-}"
      ADMIN_USERNAME: "${ADMIN_USERNAME:-}"
      ADMIN_PASSWORD: "${ADMIN_PASSWORD:-}"
    volumes:
      - "${CROSSDESK_DATA_DIR:-/var/lib/crossdesk}:/var/lib/crossdesk"
      - "${CROSSDESK_LOG_DIR:-/var/log/crossdesk}:/var/log/crossdesk"
    healthcheck:
      test:
        - CMD-SHELL
        - test -s /var/lib/crossdesk/certs/api.crossdesk.cn.key && test -s /var/lib/crossdesk/certs/api.crossdesk.cn_bundle.crt
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 10s
    logging:
      # Application files have time-based retention. Avoid an unexpired copy
      # in Docker's json-file driver, which only supports size/count rotation.
      driver: none

  coturn:
    image: "${COTURN_IMAGE:-coturn/coturn:4.17.2-r0-debian@sha256:aa68aab64a3b929d57fc2924c98ea447bf996cf8dade2508e7b71eaf23f1f14e}"
    container_name: crossdesk_coturn
    network_mode: host
    restart: unless-stopped
    user: "0:0"
    # The image entrypoint expands arguments through `eval echo`; that turns the
    # required short option `-n` into an empty argument (`echo -n`). Execute
    # turnserver directly so the command array is passed through unchanged.
    entrypoint:
      - turnserver
    depends_on:
      crossdesk-server:
        condition: service_healthy
    volumes:
      - "${CROSSDESK_DATA_DIR:-/var/lib/crossdesk}/certs:/certs:ro"
      - "${CROSSDESK_LOG_DIR:-/var/log/crossdesk}/coturn:/var/log/coturn"
    command:
      - -n
      - "--listening-port=${COTURN_PORT:-3478}"
      - "--listening-ip=${INTERNAL_IP:?Set INTERNAL_IP in .env}"
      - "--relay-ip=${INTERNAL_IP:?Set INTERNAL_IP in .env}"
      - "--external-ip=${EXTERNAL_IP:?Set EXTERNAL_IP in .env}/${INTERNAL_IP:?Set INTERNAL_IP in .env}"
      - "--min-port=${MIN_PORT:-50000}"
      - "--max-port=${MAX_PORT:-60000}"
      - --fingerprint
      - --use-auth-secret
      - --dtls
      - "--static-auth-secret=${COTURN_AUTH_SECRET:?Set COTURN_AUTH_SECRET in .env}"
      - "--realm=${COTURN_REALM:-crossdesk}"
      - "--stateless-nonce-secret=${COTURN_STATELESS_NONCE_SECRET:?Set COTURN_STATELESS_NONCE_SECRET in .env}"
      - --cert=/certs/api.crossdesk.cn_bundle.crt
      - --pkey=/certs/api.crossdesk.cn.key
      - --log-file=/var/log/coturn/turn.log
      - --no-stdout-log
      - "--log-min-level=${COTURN_LOG_LEVEL:-warning}"
      - --new-log-timestamp
      - --cli=false
      - --no-multicast-peers
      - --proc-user=nobody
      - --proc-group=nogroup
    mem_limit: "${COTURN_MEMORY_LIMIT:-512m}"
    pids_limit: 256
    ulimits:
      nofile:
        soft: 524288
        hard: 524288
    logging:
      driver: none