name: ai-gateway

x-backend-build: &backend-build
  context: ..
  dockerfile: deploy/Dockerfile
  args:
    VERSION: ${GATEWAY_VERSION:-0.10.0}

x-gateway-environment: &gateway-environment
  APP_ENV: production
  HTTP_ADDR: :8080
  DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
  REDIS_CRITICAL_URL: ${REDIS_CRITICAL_URL:?REDIS_CRITICAL_URL is required}
  REDIS_CACHE_URL: ${REDIS_CACHE_URL:-}
  GATEWAY_BOOTSTRAP_API_KEY_ENABLED: ${GATEWAY_BOOTSTRAP_API_KEY_ENABLED:-false}
  GATEWAY_BOOTSTRAP_API_KEY: ${GATEWAY_BOOTSTRAP_API_KEY:-}
  CREDENTIAL_MASTER_KEY: ${CREDENTIAL_MASTER_KEY:?CREDENTIAL_MASTER_KEY is required}
  CREDENTIAL_KEK_VERSION: ${CREDENTIAL_KEK_VERSION:-1}
  CREDENTIAL_KEK_KEYRING: ${CREDENTIAL_KEK_KEYRING:-}
  ALLOW_PRIVATE_PROVIDER_URLS: ${ALLOW_PRIVATE_PROVIDER_URLS:-false}
  ALLOW_PRIVATE_TOOL_URLS: ${ALLOW_PRIVATE_TOOL_URLS:-false}
  ALLOW_PRIVATE_WEBHOOK_URLS: ${ALLOW_PRIVATE_WEBHOOK_URLS:-false}
  UPSTREAM_FALLBACK_ENABLED: ${UPSTREAM_FALLBACK_ENABLED:-false}
  UPSTREAM_BASE_URL: ${UPSTREAM_BASE_URL:-https://api.openai.com}
  UPSTREAM_API_KEY: ${UPSTREAM_API_KEY:-}
  SHADOW_BASE_URL: ${SHADOW_BASE_URL:-}
  SHADOW_API_KEY: ${SHADOW_API_KEY:-}
  SHADOW_SAMPLE_RATE: ${SHADOW_SAMPLE_RATE:-0}
  S3_ENDPOINT: ${S3_ENDPOINT:-http://minio:9000}
  S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-gateway}
  S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-}
  S3_BUCKET: ${S3_BUCKET:-gateway-files}
  S3_REGION: ${S3_REGION:-us-east-1}
  S3_USE_SSL: ${S3_USE_SSL:-false}
  S3_MAX_FILE_BYTES: ${S3_MAX_FILE_BYTES:-134217728}

x-backend-service: &backend-service
  image: ai-gateway-go:${GATEWAY_VERSION:-0.10.0}
  build: *backend-build
  environment: *gateway-environment
  read_only: true
  tmpfs:
    - /tmp:size=64m,mode=1777
  cap_drop:
    - ALL
  security_opt:
    - no-new-privileges:true

services:
  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-gateway}
      POSTGRES_USER: ${POSTGRES_USER:-gateway}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 5s
      timeout: 3s
      retries: 30
    restart: unless-stopped

  redis-critical:
    image: redis:8.2-alpine
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
    command:
      - sh
      - -c
      - exec redis-server --requirepass "$${REDIS_PASSWORD}" --appendonly yes --appendfsync everysec --maxmemory-policy noeviction
    volumes:
      - redis-critical-data:/data
    healthcheck:
      test: ["CMD-SHELL", "redis-cli --no-auth-warning -a \"$${REDIS_PASSWORD}\" ping | grep -q PONG"]
      interval: 5s
      timeout: 3s
      retries: 30
    restart: unless-stopped

  redis-cache:
    image: redis:8.2-alpine
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
      REDIS_CACHE_MAXMEMORY: ${REDIS_CACHE_MAXMEMORY:-256mb}
    command:
      - sh
      - -c
      - exec redis-server --requirepass "$${REDIS_PASSWORD}" --maxmemory "$${REDIS_CACHE_MAXMEMORY}" --maxmemory-policy allkeys-lfu --save ""
    healthcheck:
      test: ["CMD-SHELL", "redis-cli --no-auth-warning -a \"$${REDIS_PASSWORD}\" ping | grep -q PONG"]
      interval: 5s
      timeout: 3s
      retries: 30
    restart: unless-stopped

  migrator:
    <<: *backend-service
    entrypoint: ["gateway-migrator"]
    depends_on:
      postgres:
        condition: service_healthy
    restart: "no"

  gateway-api:
    <<: *backend-service
    ports:
      - "${GATEWAY_BIND_IP:-127.0.0.1}:${GATEWAY_PORT:-8080}:8080"
    depends_on:
      migrator:
        condition: service_completed_successfully
      redis-critical:
        condition: service_healthy
      redis-cache:
        condition: service_healthy
      minio:
        condition: service_started
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:8080/readyz"]
      interval: 10s
      timeout: 3s
      retries: 30
      start_period: 10s
    restart: unless-stopped

  admin-web:
    image: ai-gateway-admin:${GATEWAY_VERSION:-0.10.0}
    build:
      context: ..
      dockerfile: deploy/Dockerfile.web
      args:
        APP: admin
    ports:
      - "${WEB_BIND_IP:-127.0.0.1}:${ADMIN_PORT:-8081}:80"
    depends_on:
      gateway-api:
        condition: service_healthy
    restart: unless-stopped

  portal-web:
    image: ai-gateway-portal:${GATEWAY_VERSION:-0.10.0}
    build:
      context: ..
      dockerfile: deploy/Dockerfile.web
      args:
        APP: portal
    ports:
      - "${WEB_BIND_IP:-127.0.0.1}:${PORTAL_PORT:-8082}:80"
    depends_on:
      gateway-api:
        condition: service_healthy
    restart: unless-stopped

  outbox-worker:
    <<: *backend-service
    entrypoint: ["gateway-outbox-worker"]
    depends_on:
      migrator:
        condition: service_completed_successfully
      redis-critical:
        condition: service_healthy
    restart: unless-stopped

  maintenance-worker:
    <<: *backend-service
    entrypoint: ["gateway-maintenance"]
    depends_on:
      migrator:
        condition: service_completed_successfully
    restart: unless-stopped

  notification-worker:
    <<: *backend-service
    entrypoint: ["gateway-notification-worker"]
    depends_on:
      migrator:
        condition: service_completed_successfully
      redis-critical:
        condition: service_healthy
    restart: unless-stopped

  # M8: 对象存储。MinIO 不暴露主机端口,上传/下载全部经网关代理;
  # 桶由 gateway-api 启动时的 EnsureBucket 兜底创建。stateful 服务不做加固。
  minio:
    image: minio/minio:latest
    command: ["server", "/data", "--console-address", ":9001"]
    environment:
      MINIO_ROOT_USER: ${S3_ACCESS_KEY_ID:-gateway}
      MINIO_ROOT_PASSWORD: ${S3_SECRET_ACCESS_KEY:-}
    volumes:
      - minio-data:/data
    restart: unless-stopped

  bootstrap-admin:
    <<: *backend-service
    profiles: ["tools"]
    entrypoint: ["gateway-bootstrap"]
    environment:
      <<: *gateway-environment
      BOOTSTRAP_ADMIN_USERNAME: ${BOOTSTRAP_ADMIN_USERNAME:-admin}
      BOOTSTRAP_ADMIN_PASSWORD: ${BOOTSTRAP_ADMIN_PASSWORD:-}
    depends_on:
      migrator:
        condition: service_completed_successfully
    restart: "no"

volumes:
  postgres-data:
  redis-critical-data:
  minio-data: