From 50059ea1b852a4534d44562ebe1294c0aca804a2 Mon Sep 17 00:00:00 2001 From: librelad Date: Tue, 18 Aug 2026 05:28:46 +0100 Subject: [PATCH] rocketchat: add Rocket.Chat with a single-node Mongo replica set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rocket.Chat tails the Mongo oplog for realtime delivery, and a standalone mongod has no oplog — so the database has to be a replica set even with one member. Uses the official mongo image rather than bitnami/mongodb (which upstream's own compose uses) because Bitnami moved its catalog behind a paid registry and the free tags are no longer dependable for a long-lived install. The cost is that rs.initiate() is not automatic, so the post-start hook runs it once — guarded by rs.status() so a reinstall over restored data doesn't re-initiate a live set, and followed by a wait for the member to report itself primary. Mongo runs without auth: enabling it on a replica set also requires a shared keyfile for member-to-member auth, which is a lot of moving parts for a database that is never published outside the docker network. Co-Authored-By: Claude Opus 5 --- containers/rocketchat/docker-compose.yml | 93 +++++++++++++++++++ containers/rocketchat/rocketchat.config | 70 ++++++++++++++ containers/rocketchat/rocketchat.svg | 1 + .../scripts/rocketchat_install_hooks.sh | 79 ++++++++++++++++ 4 files changed, 243 insertions(+) create mode 100644 containers/rocketchat/docker-compose.yml create mode 100644 containers/rocketchat/rocketchat.config create mode 100644 containers/rocketchat/rocketchat.svg create mode 100644 containers/rocketchat/scripts/rocketchat_install_hooks.sh diff --git a/containers/rocketchat/docker-compose.yml b/containers/rocketchat/docker-compose.yml new file mode 100644 index 0000000..f019c33 --- /dev/null +++ b/containers/rocketchat/docker-compose.yml @@ -0,0 +1,93 @@ +networks: + DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA + external: true + +services: + rocketchat-service: #LIBREPORTAL|SERVICE_TAG_1|rocketchat-service + container_name: rocketchat-service + image: rocketchat/rocket.chat:8.7.0 #LIBREPORTAL|ROCKETCHAT_VERSION_TAG|8.7.0 + # The image runs as uid 65533 and writes uploads into /app/uploads, so + # it hits the same rootless bind-mount ownership problem as vikunja and + # mattermost. USER_TAG resolves to whoever actually owns the mounts. + user: "USER_DATA" #LIBREPORTAL|USER_TAG|USER_DATA + # Rocket.Chat exits — rather than waits — when Mongo has no elected + # primary, and on a fresh install the replica set is only initiated by + # the post-start hook. `unless-stopped` is what carries it through those + # first few seconds of crash-looping. + restart: unless-stopped + # GLUETUN_OFF_BEGIN + ports: + - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1 + # GLUETUN_OFF_END + volumes: + - ./uploads:/app/uploads + environment: + - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA + - PORT=PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1 + # ROOT_URL is what Rocket.Chat puts in invite links, OAuth redirect + # URLs and the websocket origin check. Get it wrong and the client + # loads but never connects. + - ROOT_URL=APP_URL_DATA #LIBREPORTAL|APP_URL_TAG|APP_URL_DATA + # ?replicaSet=rs0 is mandatory, not decorative: Rocket.Chat tails + # the Mongo oplog for realtime updates, and the oplog only exists on + # a replica set. Single-node is fine — it just has to be a set. + - MONGO_URL=mongodb://rocketchat-db:27017/rocketchat?replicaSet=rs0 + - MONGO_OPLOG_URL=mongodb://rocketchat-db:27017/local?replicaSet=rs0 + - DEPLOY_METHOD=docker + - OVERWRITE_SETTING_Show_Setup_Wizard=pending + depends_on: + - rocketchat-db + labels: + libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA + libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA + libreportal.backup.db: "mongo:rocketchat-db:mongo_data:" + libreportal.backup.files: "rocketchat-service:/app/uploads:uploads" + traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA + # TRAEFIK_PORT_1_BEGIN + traefik.http.routers.rocketchat-service.entrypoints: web,websecure + traefik.http.routers.rocketchat-service.rule: Host(`DOMAINSUBNAME_DATA_1`) #LIBREPORTAL|DOMAINSUBNAME_TAG_1|DOMAINSUBNAME_DATA_1 + traefik.http.routers.rocketchat-service.tls: true + traefik.http.routers.rocketchat-service.tls.certresolver: production + traefik.http.services.rocketchat-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1 + traefik.http.routers.rocketchat-service.middlewares: MIDDLEWARE_DATA_1 #LIBREPORTAL|MIDDLEWARE_TAG_1|MIDDLEWARE_DATA_1 + # TRAEFIK_PORT_1_END + traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA + healthcheck: + disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA + # GLUETUN_OFF_BEGIN + networks: + DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA + ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1 + # GLUETUN_OFF_END + # GLUETUN_ON_BEGIN + # network_mode: "container:gluetun-service" + # GLUETUN_ON_END + + # Official mongo image rather than bitnami/mongodb (which upstream's own + # compose uses): Bitnami moved its catalog behind a paid registry in 2025 + # and the free tags are no longer dependable for a long-lived install. The + # cost is that the replica set is not auto-initiated, so + # rocketchat_install_post_start runs rs.initiate() once, by hand. + # + # No authentication: enabling it on a replica set additionally requires a + # shared keyfile for member-to-member auth, which is a lot of moving parts + # for a database that is never published outside the docker network. The + # backup driver's mongo path works either way — it adds credential flags + # only when MONGO_INITDB_ROOT_USERNAME is set. + # + # No `user:` override: the entrypoint starts as root, chowns /data/db and + # then drops to the mongodb user. Under rootless Docker container-root is + # the install user on the host, which owns the bind mount, so that works. + rocketchat-db: + image: mongo:8.0 #LIBREPORTAL|ROCKETCHAT_MONGO_VERSION_TAG|8.0 + container_name: rocketchat-db + restart: unless-stopped + command: ["mongod", "--replSet", "rs0", "--bind_ip_all"] + volumes: + - ./mongo_data:/data/db + - ./mongo_config:/data/configdb + environment: + - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA + networks: + DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA + ipv4_address: IP_DATA_2 #LIBREPORTAL|IP_TAG_2|IP_DATA_2 diff --git a/containers/rocketchat/rocketchat.config b/containers/rocketchat/rocketchat.config new file mode 100644 index 0000000..0c16fc2 --- /dev/null +++ b/containers/rocketchat/rocketchat.config @@ -0,0 +1,70 @@ +# +# ============================================================================= +# GENERAL CONFIGURATION +# ============================================================================= +# APP_NAME = name of application for use in scripts +# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is +# BACKUP = if true, include this application in backup operations +# UPDATE_TYPE = auto: new image builds are applied automatically (a recovery snapshot is taken first), manual: only when you press Update +# HEALTHCHECK = if true, default docker health checks for that container will be enabled +# AUTHELIA = if true, use Authelia authentication, if false turned off. +# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote +# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed) +# +CFG_ROCKETCHAT_APP_NAME=rocketchat +CFG_ROCKETCHAT_BACKUP=true +CFG_ROCKETCHAT_BACKUP_STRATEGY=auto +# Manual, not auto. Rocket.Chat runs schema migrations on boot and refuses to +# start if the image is more than one major behind the database — an unattended +# jump across majors can leave the instance down until someone intervenes. +CFG_ROCKETCHAT_UPDATE_TYPE=manual +CFG_ROCKETCHAT_COMPOSE_FILE=default +CFG_ROCKETCHAT_HEALTHCHECK=true +# Rocket.Chat's own accounts back its mobile and desktop clients; forward-auth +# in front of the web port would block those clients from the REST API. +CFG_ROCKETCHAT_AUTHELIA=false +CFG_ROCKETCHAT_HEADSCALE=false +CFG_ROCKETCHAT_MONITORING=false +# +# ============================================================================= +# METADATA +# ============================================================================= +# CATEGORY = application category for grouping +# TITLE = display name for the application +# DESCRIPTION = short description of the application +# LONG_DESCRIPTION = detailed description of the application +# URL = source repository or documentation URL +# ACTIONS = available actions for this application +# +CFG_ROCKETCHAT_CATEGORY="communication" +CFG_ROCKETCHAT_TITLE="Rocket.Chat" +CFG_ROCKETCHAT_DESCRIPTION="Team Chat & Video" +CFG_ROCKETCHAT_LONG_DESCRIPTION="Rocket.Chat is a mature self-hosted chat platform with channels, threads, voice and video, and native mobile and desktop clients. It integrates directly with a Jitsi Meet server for calls, so it pairs with the Jitsi Meet app already in this catalog. Note the free Community edition caps the number of active users — check the current limit before rolling it out to a large group" +CFG_ROCKETCHAT_URL="https://github.com/RocketChat/Rocket.Chat" +CFG_ROCKETCHAT_ACTIONS="configure|install|restart|shutdown|uninstall" +# +# ============================================================================= +# NETWORK CONFIGURATION +# ============================================================================= +# DOMAIN = number of domain from the general config, useful when using multiple domains +# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all +# +CFG_ROCKETCHAT_DOMAIN=1 +CFG_ROCKETCHAT_WHITELIST=false +CFG_ROCKETCHAT_NETWORK=default +# +# ============================================================================= +# PORT CONFIGURATION +# ============================================================================= +# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description +# - app: application name +# - name: service identifier (webui, dns, ssh, etc.) +# - external:internal: port mapping (external can be 'random' for auto-allocation) +# - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running) +# - protocol: 'tcp' or 'udp' +# - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true) +# - traefik: if true, Traefik handles this port (reverse proxy) +# - webui: if true, this port serves the main web interface +# - description: human-readable description of the service +# +CFG_ROCKETCHAT_PORT_1="rocketchat-service|webui|random:3000|public|tcp|false|true|true|Web Interface||rocketchat" diff --git a/containers/rocketchat/rocketchat.svg b/containers/rocketchat/rocketchat.svg new file mode 100644 index 0000000..b47bf01 --- /dev/null +++ b/containers/rocketchat/rocketchat.svg @@ -0,0 +1 @@ + diff --git a/containers/rocketchat/scripts/rocketchat_install_hooks.sh b/containers/rocketchat/scripts/rocketchat_install_hooks.sh new file mode 100644 index 0000000..8cf49ed --- /dev/null +++ b/containers/rocketchat/scripts/rocketchat_install_hooks.sh @@ -0,0 +1,79 @@ +#!/bin/bash + +# Rocket.Chat install hooks. +# +# Rocket.Chat needs its Mongo to be a replica set, because realtime message +# delivery works by tailing the oplog and a standalone mongod has no oplog. The +# official mongo image does not initiate a set on its own, so we do it once here +# after the containers come up. + +rocketchat_install_post_start() +{ + local app_name="$1" + + ((menu_number++)) + echo "" + echo "---- $menu_number. Initiating the MongoDB replica set for $app_name" + echo "" + + # Wait for mongod to answer at all. It has to be listening before + # rs.initiate() can be sent, and on a cold volume the first boot spends a + # while building journal files. + local attempts=0 + while ((attempts < 45)); do + if runFileOp docker exec rocketchat-db mongosh --quiet --eval "db.adminCommand({ping:1}).ok" 2>/dev/null | grep -q 1; then + break + fi + sleep 2 + ((attempts++)) + done + + if ((attempts >= 45)); then + isError "rocketchat-db never started accepting connections — replica set not initiated." + isNotice "Rocket.Chat will keep restarting until it is. Once the database is up, run:" + isNotice " docker exec rocketchat-db mongosh --eval 'rs.initiate({_id:\"rs0\",members:[{_id:0,host:\"rocketchat-db:27017\"}]})'" + return 0 + fi + + # Idempotent: a reinstall over restored data, or a rerun of this hook, finds + # the set already configured and must not re-initiate it — rs.initiate() on + # a live set errors out and would leave the step looking failed. + if runFileOp docker exec rocketchat-db mongosh --quiet --eval "rs.status().ok" 2>/dev/null | grep -q 1; then + isSuccessful "MongoDB replica set rs0 already initiated — leaving it alone." + else + local result + result=$(runFileOp docker exec rocketchat-db mongosh --quiet --eval \ + 'rs.initiate({_id:"rs0",members:[{_id:0,host:"rocketchat-db:27017"}]})' 2>&1) + checkSuccess "Initiating MongoDB replica set rs0" + fi + + # Election of the single member takes a moment. Rocket.Chat exits rather + # than retries if it connects before a primary exists, so wait for the node + # to report itself primary before handing control back. + attempts=0 + while ((attempts < 30)); do + if runFileOp docker exec rocketchat-db mongosh --quiet --eval "db.hello().isWritablePrimary" 2>/dev/null | grep -q true; then + break + fi + sleep 2 + ((attempts++)) + done + + # Restart so Rocket.Chat reconnects immediately instead of waiting out its + # own backoff after the crash-loop it was in while the set was forming. + dockerComposeRestart "$app_name" +} + +rocketchat_install_post() +{ + local app_name="$1" + echo "" + isNotice "Rocket.Chat first run:" + echo "" + echo " Open the web interface and complete the setup wizard — the first" + echo " account you create there becomes the workspace administrator." + echo "" + echo " For voice and video, point Rocket.Chat at your Jitsi Meet server" + echo " under Admin -> Settings -> Video Conference -> Jitsi." + echo "" +}