feat: geolocate anonymous widget visitors

deploy/docker/docker-compose.dev.yml

@@ -1,6 +1,8 @@
 # GoChat Development Environment
-# Reference: Chatwoot docker-compose.yaml pattern — rails + sidekiq + postgres + redis + mailhog + vite
-# Enhanced with pgvector (for Captain AI vector search), volume mounts, hot reload
+# Reference: Chatwoot docker-compose.yaml pattern — Rails, Sidekiq,
+# PostgreSQL, Redis, Mailhog, and Vite.
+# Enhanced with pgvector for Captain AI vector search, volume mounts,
+# and hot reload.
 
 version: '3.8'
 
@@ -29,7 +31,9 @@ services:
       - "6379:6379"
     volumes:
       - redis_data:/data
-    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
+    command: >-
+      redis-server --appendonly yes --maxmemory 256mb
+      --maxmemory-policy allkeys-lru
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 5s
@@ -63,6 +67,7 @@ services:
       - GOCHAT_ENV=development
       - GOCHAT_DATABASE_DSN=postgres://postgres:postgres@postgres:5432/gochat_dev?sslmode=disable
       - GOCHAT_REDIS_DSN=redis://redis:6379
+      - GOCHAT_GEOIP_DB_PATH=${GOCHAT_GEOIP_DB_PATH:-}
       - SMTP_HOST=mailhog
       - SMTP_PORT=1025
 
@@ -85,6 +90,7 @@ services:
       - GOCHAT_ENV=development
       - GOCHAT_DATABASE_DSN=postgres://postgres:postgres@postgres:5432/gochat_dev?sslmode=disable
       - GOCHAT_REDIS_DSN=redis://redis:6379
+      - GOCHAT_GEOIP_DB_PATH=${GOCHAT_GEOIP_DB_PATH:-}
 
 volumes:
   postgres_data:

deploy/docker/docker-compose.prod.yml

@@ -1,6 +1,7 @@
 name: gochat-production
 
-x-gochat-image: &gochat-image ${GOCHAT_IMAGE_REF:?set GOCHAT_IMAGE_REF to an immutable image digest}
+x-gochat-image: &gochat-image >-
+  ${GOCHAT_IMAGE_REF:?set GOCHAT_IMAGE_REF to an immutable image digest}
 x-postgres-tls-ca: &postgres-tls-ca
   type: bind
   source: ${GOCHAT_DATABASE_TLS_CA_FILE:-/dev/null}
@@ -41,7 +42,8 @@ x-gochat-environment: &gochat-environment
   GOCHAT_SERVER_HOST: 0.0.0.0
   GOCHAT_SERVER_PORT: 3000
   GOCHAT_SERVER_MODE: release
-  GOCHAT_DATABASE_DSN: &gochat-database-dsn ${GOCHAT_DATABASE_DSN:?set an external PostgreSQL DSN with an explicit sslmode}
+  GOCHAT_DATABASE_DSN: &gochat-database-dsn >-
+    ${GOCHAT_DATABASE_DSN:?set GOCHAT_DATABASE_DSN with an explicit sslmode}
   GOCHAT_DATABASE_RUN_MIGRATIONS: "false"
   GOCHAT_DATABASE_MIGRATIONS_PATH: /app/migrations
   GOCHAT_REDIS_DSN: ${GOCHAT_REDIS_DSN:?set an external Redis DSN}
@@ -51,16 +53,27 @@ x-gochat-environment: &gochat-environment
   GOCHAT_JWT_SECRET: ${GOCHAT_JWT_SECRET:?set GOCHAT_JWT_SECRET}
   GOCHAT_JWT_PREVIOUS_SECRETS: ${GOCHAT_JWT_PREVIOUS_SECRETS:-}
   GOCHAT_ENCRYPTION_ENABLED: "true"
-  GOCHAT_ENCRYPTION_CURRENT_KEY_VERSION: ${GOCHAT_ENCRYPTION_CURRENT_KEY_VERSION:-1}
-  GOCHAT_ENCRYPTION_AES_KEY: ${GOCHAT_ENCRYPTION_AES_KEY:?set a base64-encoded 32-byte encryption key}
+  GOCHAT_ENCRYPTION_CURRENT_KEY_VERSION: >-
+    ${GOCHAT_ENCRYPTION_CURRENT_KEY_VERSION:-1}
+  GOCHAT_ENCRYPTION_AES_KEY: >-
+    ${GOCHAT_ENCRYPTION_AES_KEY:?set a base64-encoded 32-byte encryption key}
   GOCHAT_LOG_LEVEL: info
   GOCHAT_LOG_FORMAT: json
   GOCHAT_STORAGE_PROVIDER: local
   GOCHAT_STORAGE_LOCAL_PATH: /app/storage/uploads
+  GOCHAT_GEOIP_DB_PATH: ${GOCHAT_GEOIP_DB_PATH:-}
+x-gochat-geoip: &gochat-geoip
+  type: bind
+  source: ${GOCHAT_GEOIP_DB_FILE:-/dev/null}
+  target: /run/gochat/geoip/GeoLite2-City.mmdb
+  read_only: true
+  bind:
+    create_host_path: false
 
 services:
   meilisearch:
-    image: ${MEILI_IMAGE_REF:-getmeili/meilisearch:v1.13@sha256:bed3fb650e62da53145777204891159242f6ea4ce69e215b36223af4aa64a0ae}
+    image: >-
+      ${MEILI_IMAGE_REF:-getmeili/meilisearch:v1.13@sha256:bed3fb650e62da53145777204891159242f6ea4ce69e215b36223af4aa64a0ae}
     restart: always
     environment:
       MEILI_ENV: production
@@ -69,7 +82,12 @@ services:
     volumes:
       - ./data/meilisearch:/meili_data
     healthcheck:
-      test: ["CMD", "wget", "--no-verbose", "--spider", "http://127.0.0.1:7700/health"]
+      test:
+        - "CMD"
+        - "wget"
+        - "--no-verbose"
+        - "--spider"
+        - "http://127.0.0.1:7700/health"
       interval: 5s
       timeout: 5s
       retries: 20
@@ -94,8 +112,17 @@ services:
       - *postgres-tls-ca
       - *postgres-tls-client-cert
       - *postgres-tls-client-key
+      - *gochat-geoip
     healthcheck:
-      test: ["CMD", "wget", "-q", "-T", "3", "-O", "/dev/null", "http://127.0.0.1:3000/ready"]
+      test:
+        - "CMD"
+        - "wget"
+        - "-q"
+        - "-T"
+        - "3"
+        - "-O"
+        - "/dev/null"
+        - "http://127.0.0.1:3000/ready"
       interval: 10s
       timeout: 5s
       start_period: 15s
@@ -133,6 +160,7 @@ services:
       - *postgres-tls-ca
       - *postgres-tls-client-cert
       - *postgres-tls-client-key
+      - *gochat-geoip
     deploy:
       resources:
         limits:
@@ -162,13 +190,16 @@ services:
     image: *gochat-image
     user: "0:0"
     profiles: ["ops"]
-    entrypoint: ["/usr/local/bin/database-client-entrypoint", "/app/scripts/db_backup.sh"]
+    entrypoint:
+      - /usr/local/bin/database-client-entrypoint
+      - /app/scripts/db_backup.sh
     group_add: ["${GOCHAT_DATABASE_TLS_GID:-65534}"]
     restart: "no"
     environment:
       GOCHAT_DATABASE_DSN: *gochat-database-dsn
       GOCHAT_STORAGE_PATH: /source/storage/uploads
-      GOCHAT_CONNECTOR_BACKUP_FILE: /source/connector/${GOCHAT_CONNECTOR_BACKUP_NAME:-latest.db}
+      GOCHAT_CONNECTOR_BACKUP_FILE: >-
+        /source/connector/${GOCHAT_CONNECTOR_BACKUP_NAME:-latest.db}
       GOCHAT_BACKUP_DIR: /backup/local
       GOCHAT_BACKUP_OFFSITE_DIR: /backup/offsite
       GOCHAT_BACKUP_PASSPHRASE_FILE: /run/secrets/backup-passphrase
@@ -180,7 +211,8 @@ services:
       - ./data/connector-backups:/source/connector:ro
       - ${GOCHAT_BACKUP_DIR:-./data/backups/local}:/backup/local
       - type: bind
-        source: ${GOCHAT_BACKUP_OFFSITE_DIR:?set an existing external off-site mount point}
+        source: >-
+          ${GOCHAT_BACKUP_OFFSITE_DIR:?set GOCHAT_BACKUP_OFFSITE_DIR}
         target: /backup/offsite
         bind:
           create_host_path: false
@@ -196,7 +228,9 @@ services:
     image: *gochat-image
     user: "0:0"
     profiles: ["ops"]
-    entrypoint: ["/usr/local/bin/database-client-entrypoint", "/app/scripts/db_restore.sh"]
+    entrypoint:
+      - /usr/local/bin/database-client-entrypoint
+      - /app/scripts/db_restore.sh
     group_add: ["${GOCHAT_DATABASE_TLS_GID:-65534}"]
     command: ["/backup/offsite/${GOCHAT_RESTORE_BUNDLE:-missing.tar.enc}"]
     restart: "no"
@@ -209,12 +243,14 @@ services:
       - ./data/storage:/restore/storage
       - ./data/connector:/restore/connector
       - type: bind
-        source: ${GOCHAT_BACKUP_OFFSITE_DIR:?set an existing external off-site mount point}
+        source: >-
+          ${GOCHAT_BACKUP_OFFSITE_DIR:?set GOCHAT_BACKUP_OFFSITE_DIR}
         target: /backup/offsite
         read_only: true
         bind:
           create_host_path: false
-      - ${GOCHAT_BACKUP_PASSPHRASE_FILE:-./.secrets/backup-passphrase}:/run/secrets/backup-passphrase:ro
+      - >-
+        ${GOCHAT_BACKUP_PASSPHRASE_FILE:-./.secrets/backup-passphrase}:/run/secrets/backup-passphrase:ro
       - *database-client-entrypoint
       - *postgres-tls-ca
       - *postgres-tls-client-cert
@@ -222,7 +258,8 @@ services:
     logging: *gochat-logging
 
   shangwutong:
-    image: ${SHANGWUTONG_IMAGE_REF:?set SHANGWUTONG_IMAGE_REF to an immutable image digest}
+    image: >-
+      ${SHANGWUTONG_IMAGE_REF:?set SHANGWUTONG_IMAGE_REF}
     restart: always
     stop_grace_period: ${SWT_SHUTDOWN_TIMEOUT:-30s}
     environment:
@@ -238,7 +275,15 @@ services:
       - ./data/connector:/data
       - ./data/connector-backups:/backup
     healthcheck:
-      test: ["CMD", "wget", "-q", "-T", "3", "-O", "/dev/null", "http://127.0.0.1:9100/readyz"]
+      test:
+        - "CMD"
+        - "wget"
+        - "-q"
+        - "-T"
+        - "3"
+        - "-O"
+        - "/dev/null"
+        - "http://127.0.0.1:9100/readyz"
       interval: 30s
       timeout: 5s
       start_period: 15s
@@ -254,7 +299,8 @@ services:
     logging: *gochat-logging
 
   fluentd:
-    image: fluent/fluentd:v1.18-debian-1@sha256:f8d26db76ba06ce96e8d402119675071624dab724af49be40fd34641c347c440
+    image: >-
+      fluent/fluentd:v1.18-debian-1@sha256:f8d26db76ba06ce96e8d402119675071624dab724af49be40fd34641c347c440
     restart: always
     ports:
       - "127.0.0.1:24224:24224"
@@ -264,11 +310,16 @@ services:
       - ./data/fluentd/buffer:/fluentd/buffer
 
   postgres-exporter:
-    image: quay.io/prometheuscommunity/postgres-exporter:v0.17.1@sha256:38606faa38c54787525fb0ff2fd6b41b4cfb75d455c1df294927c5f611699b17
+    image: >-
+      quay.io/prometheuscommunity/postgres-exporter:v0.17.1@sha256:38606faa38c54787525fb0ff2fd6b41b4cfb75d455c1df294927c5f611699b17
     restart: always
-    entrypoint: ["/usr/local/bin/database-client-entrypoint", "/bin/postgres_exporter"]
+    entrypoint:
+      - /usr/local/bin/database-client-entrypoint
+      - /bin/postgres_exporter
     group_add: ["${GOCHAT_DATABASE_TLS_GID:-65534}"]
-    command: ["--config.file=/dev/null", "--extend.query-path=/etc/postgres-exporter/queries.yml"]
+    command:
+      - --config.file=/dev/null
+      - --extend.query-path=/etc/postgres-exporter/queries.yml
     environment:
       DATA_SOURCE_NAME: *gochat-database-dsn
     volumes:
@@ -280,14 +331,16 @@ services:
     logging: *gochat-logging
 
   redis-exporter:
-    image: oliver006/redis_exporter:v1.72.1@sha256:f90cae1e7ecc6ac223d04bdb0c95e084918baced9f81f08c3d01c2f11bff72bf
+    image: >-
+      oliver006/redis_exporter:v1.72.1@sha256:f90cae1e7ecc6ac223d04bdb0c95e084918baced9f81f08c3d01c2f11bff72bf
     restart: always
     environment:
       REDIS_ADDR: ${GOCHAT_REDIS_DSN:?set an external Redis DSN}
     logging: *gochat-logging
 
   blackbox-exporter:
-    image: prom/blackbox-exporter:v0.27.0@sha256:a50c4c0eda297baa1678cd4dc4712a67fdea713b832d43ce7fcc5f9bea05094d
+    image: >-
+      prom/blackbox-exporter:v0.27.0@sha256:a50c4c0eda297baa1678cd4dc4712a67fdea713b832d43ce7fcc5f9bea05094d
     restart: always
     command: ["--config.file=/etc/blackbox_exporter/config.yml"]
     volumes:
@@ -295,15 +348,20 @@ services:
     logging: *gochat-logging
 
   node-exporter:
-    image: prom/node-exporter:v1.9.1@sha256:d00a542e409ee618a4edc67da14dd48c5da66726bbd5537ab2af9c1dfc442c8a
+    image: >-
+      prom/node-exporter:v1.9.1@sha256:d00a542e409ee618a4edc67da14dd48c5da66726bbd5537ab2af9c1dfc442c8a
     restart: always
-    command: ["--collector.disable-defaults", "--collector.textfile", "--collector.textfile.directory=/var/lib/node_exporter/textfile_collector"]
+    command:
+      - --collector.disable-defaults
+      - --collector.textfile
+      - --collector.textfile.directory=/var/lib/node_exporter/textfile_collector
     volumes:
       - ./data/backup-metrics:/var/lib/node_exporter/textfile_collector:ro
     logging: *gochat-logging
 
   cadvisor:
-    image: gcr.io/cadvisor/cadvisor:v0.52.1@sha256:f40e65878e25c2e78ea037f73a449527a0fb994e303dc3e34cb6b187b4b91435
+    image: >-
+      gcr.io/cadvisor/cadvisor:v0.52.1@sha256:f40e65878e25c2e78ea037f73a449527a0fb994e303dc3e34cb6b187b4b91435
     restart: always
     privileged: true
     devices:
@@ -317,15 +375,19 @@ services:
     logging: *gochat-logging
 
   alertmanager:
-    image: prom/alertmanager:v0.28.1@sha256:27c475db5fb156cab31d5c18a4251ac7ed567746a2483ff264516437a39b15ba
+    image: >-
+      prom/alertmanager:v0.28.1@sha256:27c475db5fb156cab31d5c18a4251ac7ed567746a2483ff264516437a39b15ba
     restart: always
-    command: ["--config.file=/etc/alertmanager/alertmanager.yml", "--storage.path=/alertmanager"]
+    command:
+      - --config.file=/etc/alertmanager/alertmanager.yml
+      - --storage.path=/alertmanager
     ports:
       - "127.0.0.1:${ALERTMANAGER_PORT:-9093}:9093"
     volumes:
       - ../prometheus/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
       - type: bind
-        source: ${ALERTMANAGER_WEBHOOK_URL_FILE:-../../.secrets/alertmanager-webhook-url}
+        source: >-
+          ${ALERTMANAGER_WEBHOOK_URL_FILE:-../../.secrets/alertmanager-webhook-url}
         target: /run/secrets/alertmanager-webhook-url
         read_only: true
         bind:
@@ -334,7 +396,8 @@ services:
     logging: *gochat-logging
 
   prometheus:
-    image: prom/prometheus:v3.5.0@sha256:63805ebb8d2b3920190daf1cb14a60871b16fd38bed42b857a3182bc621f4996
+    image: >-
+      prom/prometheus:v3.5.0@sha256:63805ebb8d2b3920190daf1cb14a60871b16fd38bed42b857a3182bc621f4996
     restart: always
     depends_on:
       - alertmanager
@@ -343,11 +406,15 @@ services:
       - node-exporter
       - postgres-exporter
       - redis-exporter
-    command: ["--config.file=/etc/prometheus/prometheus.yml", "--storage.tsdb.path=/prometheus", "--storage.tsdb.retention.time=${PROMETHEUS_RETENTION:-30d}"]
+    command:
+      - --config.file=/etc/prometheus/prometheus.yml
+      - --storage.tsdb.path=/prometheus
+      - --storage.tsdb.retention.time=${PROMETHEUS_RETENTION:-30d}
     ports:
       - "127.0.0.1:${PROMETHEUS_PORT:-9090}:9090"
     volumes:
       - ../prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
-      - ../../backend/configs/prometheus_alerts.yml:/etc/prometheus/rules/gochat.yml:ro
+      - >-
+        ../../backend/configs/prometheus_alerts.yml:/etc/prometheus/rules/gochat.yml:ro
       - ./data/prometheus:/prometheus
     logging: *gochat-logging

deploy/docker/docker-compose.yml

@@ -76,6 +76,7 @@ services:
       - GOCHAT_ENV=development
       - GOCHAT_DATABASE_DSN=postgres://postgres:postgres@postgres:5432/gochat_dev?sslmode=disable
       - GOCHAT_REDIS_DSN=redis://redis:6379
+      - GOCHAT_GEOIP_DB_PATH=${GOCHAT_GEOIP_DB_PATH:-}
     volumes:
       - ../../backend:/app:delegated
 
@@ -96,6 +97,7 @@ services:
       - GOCHAT_DATABASE_DSN=postgres://postgres:postgres@postgres:5432/gochat_dev?sslmode=disable
       - GOCHAT_DATABASE_RUN_MIGRATIONS=false
       - GOCHAT_REDIS_DSN=redis://redis:6379
+      - GOCHAT_GEOIP_DB_PATH=${GOCHAT_GEOIP_DB_PATH:-}
     volumes:
       - ../../backend:/app:delegated
     command: ["worker"]