services:
  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_DB: gateway
      POSTGRES_USER: gateway
      POSTGRES_PASSWORD: gateway
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U gateway -d gateway"]
      interval: 5s
      timeout: 3s
      retries: 20

  redis-critical:
    image: redis:8.2-alpine
    command: ["redis-server", "--appendonly", "yes", "--appendfsync", "everysec", "--maxmemory-policy", "noeviction"]
    volumes:
      - redis-critical-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 20

  redis-cache:
    image: redis:8.2-alpine
    command: ["redis-server", "--maxmemory", "256mb", "--maxmemory-policy", "allkeys-lfu", "--save", ""]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 20

  migrator:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      args:
        VERSION: ${GATEWAY_VERSION:-0.10.0}
    entrypoint: ["gateway-migrator"]
    environment: &gateway-environment
      APP_ENV: local
      HTTP_ADDR: :8080
      DATABASE_URL: postgres://gateway:gateway@postgres:5432/gateway?sslmode=disable
      REDIS_CRITICAL_URL: redis://redis-critical:6379/0
      REDIS_CACHE_URL: redis://redis-cache:6379/0
      GATEWAY_BOOTSTRAP_API_KEY: ${GATEWAY_BOOTSTRAP_API_KEY:-}
      GATEWAY_BOOTSTRAP_API_KEY_ENABLED: ${GATEWAY_BOOTSTRAP_API_KEY_ENABLED:-false}
      CREDENTIAL_MASTER_KEY: ${CREDENTIAL_MASTER_KEY:-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=}
      CREDENTIAL_KEK_VERSION: 1
      CREDENTIAL_KEK_KEYRING: ${CREDENTIAL_KEK_KEYRING:-}
      ALLOW_PRIVATE_TOOL_URLS: ${ALLOW_PRIVATE_TOOL_URLS:-false}
      ALLOW_PRIVATE_WEBHOOK_URLS: ${ALLOW_PRIVATE_WEBHOOK_URLS:-false}
      UPSTREAM_BASE_URL: ${UPSTREAM_BASE_URL:-https://api.openai.com}
      UPSTREAM_API_KEY: ${UPSTREAM_API_KEY:-}
      SHADOW_BASE_URL: ${SHADOW_BASE_URL:-}
      SHADOW_API_KEY: ${SHADOW_API_KEY:-}
      SHADOW_SAMPLE_RATE: ${SHADOW_SAMPLE_RATE:-0}
      S3_ENDPOINT: ${S3_ENDPOINT:-http://minio:9000}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-gateway}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-gateway-secret}
      S3_BUCKET: ${S3_BUCKET:-gateway-files}
      S3_REGION: ${S3_REGION:-us-east-1}
      S3_USE_SSL: ${S3_USE_SSL:-false}
      S3_MAX_FILE_BYTES: ${S3_MAX_FILE_BYTES:-134217728}
    depends_on:
      postgres:
        condition: service_healthy

  gateway-api:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      args:
        VERSION: ${GATEWAY_VERSION:-0.10.0}
    environment: *gateway-environment
    ports:
      - "${GATEWAY_PORT:-8080}:8080"
    depends_on:
      migrator:
        condition: service_completed_successfully
      redis-critical:
        condition: service_healthy
      redis-cache:
        condition: service_healthy
      minio:
        condition: service_started
    restart: unless-stopped

  # M8: 对象存储。MinIO 不暴露主机端口,凭据只留在 API 容器内;
  # 上传/下载全部经网关代理。桶由 gateway-api 启动时的 EnsureBucket 兜底创建。
  minio:
    image: minio/minio:latest
    command: ["server", "/data", "--console-address", ":9001"]
    environment:
      MINIO_ROOT_USER: ${S3_ACCESS_KEY_ID:-gateway}
      MINIO_ROOT_PASSWORD: ${S3_SECRET_ACCESS_KEY:-gateway-secret}
    volumes:
      - minio-data:/data
    restart: unless-stopped

  admin-web:
    build:
      context: ..
      dockerfile: deploy/Dockerfile.web
      args:
        APP: admin
    ports:
      - "${ADMIN_PORT:-8081}:80"
    depends_on:
      gateway-api:
        condition: service_started
    restart: unless-stopped

  portal-web:
    build:
      context: ..
      dockerfile: deploy/Dockerfile.web
      args:
        APP: portal
    ports:
      - "${PORTAL_PORT:-8082}:80"
    depends_on:
      gateway-api:
        condition: service_started
    restart: unless-stopped

  outbox-worker:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      args:
        VERSION: ${GATEWAY_VERSION:-0.10.0}
    entrypoint: ["gateway-outbox-worker"]
    environment: *gateway-environment
    depends_on:
      migrator:
        condition: service_completed_successfully
      redis-critical:
        condition: service_healthy
    restart: unless-stopped

  maintenance-worker:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      args:
        VERSION: ${GATEWAY_VERSION:-0.10.0}
    entrypoint: ["gateway-maintenance"]
    environment: *gateway-environment
    depends_on:
      migrator:
        condition: service_completed_successfully
    restart: unless-stopped

  notification-worker:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      args:
        VERSION: ${GATEWAY_VERSION:-0.10.0}
    entrypoint: ["gateway-notification-worker"]
    environment: *gateway-environment
    depends_on:
      migrator:
        condition: service_completed_successfully
      redis-critical:
        condition: service_healthy
    restart: unless-stopped

volumes:
  postgres-data:
  redis-critical-data:
  minio-data: