fix: pin PGDATA so the postgres 18 bump upgrades in place

postgres:18 (tracked by pgautoupgrade) relocated the default PGDATA from
/var/lib/postgresql/data to /var/lib/postgresql/18/docker. Since the db volume
is mounted at the legacy path, pg18 would init a fresh empty cluster there and
orphan all existing data (pgautoupgrade never runs the upgrade). Pinning PGDATA
to the legacy path makes pg18 find the existing cluster and upgrade it in place.

.env.sample

@@ -105,7 +105,7 @@ ENABLE_REGISTRATION=false
 SERVE_SERVER_WELLKNOWN=false
 
 # Serve /.well-known/matrix/{server,client} on SERVER_NAME via Traefik.
-# Can be used when SERVER_NAME is other than DOMAIN and SERVER_NAME is served by Traefik.
+# Can be used when SERVER_NAME != DOMAIN and SERVER_NAME is served by Traefik.
 #COMPOSE_FILE="$COMPOSE_FILE:compose.wellknown.yml"
 
 ALLOW_PUBLIC_ROOMS_FEDERATION=false
@@ -149,6 +149,7 @@ ENCRYPTED_BY_DEFAULT=all
 #SESSION_LIFETIME=60d
 #TRACK_PUPPETED_USER_IPS=true
 
+
 ## Room complexity limit (prevents joining large remote rooms that cause DB bloat)
 ## complexity ≈ state_events / 500. Default 100.0 blocks rooms with >50000 state events.
 #ROOM_COMPLEXITY_LIMIT=100.0
@@ -217,7 +218,7 @@ RETENTION_MAX_LIFETIME=4w
 #VERIFY_SSL=false
 #ENABLE_ENCRYPTION=true
 #TELEGRAM_APP_ID=
-#TELEGRAM_BRIDGE_PERMISSIONS="{ \"*\": \"relay\", \"@foo:matrix.example.com\": \"admin\" }"
+#TELEGRAM_BRIDGE_PERMISSIONS="{ \"*\": \"relaybot\", \"@foo:matrix.example.com\": \"admin\" }"
 #TELEGRAM_SYNC_CHANNEL_MEMBERS=true
 #SECRET_TELEGRAM_DB_PASSWORD_VERSION=v1
 #SECRET_TELEGRAM_API_HASH_VERSION=v1
@@ -247,6 +248,7 @@ RETENTION_MAX_LIFETIME=4w
 ## Web Client (Redirect)
 #WEB_CLIENT_LOCATION=https://element-web.example.com
 
+
 ## State compression (reduces database bloat from federation)
 ## Runs synapse_auto_compressor daily, built from source on first start
 #COMPOSE_FILE="$COMPOSE_FILE:compose.compress-state.yml"

compose.discord.yml

@@ -30,7 +30,7 @@ services:
       - internal
 
   discorddb:
-    image: postgres:14-alpine
+    image: postgres:13-alpine
     secrets:
       - discord_db_password
     environment:

compose.mas.yml

@@ -5,7 +5,7 @@ version: "3.8"
 
 services:
   mas:
-    image: ghcr.io/element-hq/matrix-authentication-service:1.19.0
+    image: ghcr.io/element-hq/matrix-authentication-service:1.18.0
     command: ["server", "--config=/etc/mas/config.yaml"]
     environment:
       - DOMAIN

compose.signal.yml

@@ -10,7 +10,7 @@ services:
       - signal-data:/signal-data
 
   signalbridge:
-    image: dock.mau.dev/mautrix/signal:v0.2606.0
+    image: dock.mau.dev/mautrix/signal:v0.8.7
     depends_on:
       - signaldb
     configs:
@@ -35,7 +35,7 @@ services:
       - internal
 
   signaldb:
-    image: postgres:14-alpine
+    image: postgres:13-alpine
     secrets:
       - signal_db_password
     environment:

compose.telegram.yml

@@ -10,7 +10,7 @@ services:
       - telegram-data:/telegram-data
 
   telegrambridge:
-    image: dock.mau.dev/mautrix/telegram:v0.2606.0
+    image: dock.mau.dev/mautrix/telegram:v0.15.3
     depends_on:
       - telegramdb
     configs:
@@ -40,7 +40,7 @@ services:
       - internal
 
   telegramdb:
-    image: postgres:14-alpine
+    image: postgres:13-alpine
     secrets:
       - telegram_db_password
     environment:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   web:
-    image: nginx:1.31.2
+    image: nginx:1.31.1
     networks:
       - proxy
       - internal
@@ -43,7 +43,7 @@ services:
       start_period: 2m
 
   app:
-    image: "matrixdotorg/synapse:v1.155.0"
+    image: "matrixdotorg/synapse:v1.154.0"
     volumes:
       - "data:/data"
     secrets:
@@ -114,7 +114,7 @@ services:
       restart_policy:
         condition: on-failure
       labels:
-        - "coop-cloud.${STACK_NAME}.version=7.2.1+v1.155.0"
+        - "coop-cloud.${STACK_NAME}.version=7.3.0+v1.154.0"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8008/health"]