services:
  # M8 P2:pgvector 镜像与 postgres:17-alpine 数据卷兼容;CREATE EXTENSION vector
  # 由迁移 000024 执行(容器内 gateway 用户即 superuser)。
  postgres:
    image: pgvector/pgvector:pg17
    environment:
      POSTGRES_DB: gateway
      POSTGRES_USER: gateway
      POSTGRES_PASSWORD: gateway
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U gateway -d gateway"]
      interval: 5s
      timeout: 3s
      retries: 20

  redis-critical:
    image: redis:8.2-alpine
    command: ["redis-server", "--appendonly", "yes", "--appendfsync", "everysec", "--maxmemory-policy", "noeviction"]
    volumes:
      - redis-critical-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 20

  redis-cache:
    image: redis:8.2-alpine
    command: ["redis-server", "--maxmemory", "256mb", "--maxmemory-policy", "allkeys-lfu", "--save", ""]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 20

  migrator:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      args:
        VERSION: ${GATEWAY_VERSION:-0.10.0}
    entrypoint: ["gateway-migrator"]
    environment: &gateway-environment
      APP_ENV: local
      HTTP_ADDR: :8080
      DATABASE_URL: postgres://gateway:gateway@postgres:5432/gateway?sslmode=disable
      REDIS_CRITICAL_URL: redis://redis-critical:6379/0
      REDIS_CACHE_URL: redis://redis-cache:6379/0
      GATEWAY_BOOTSTRAP_API_KEY: ${GATEWAY_BOOTSTRAP_API_KEY:-}
      GATEWAY_BOOTSTRAP_API_KEY_ENABLED: ${GATEWAY_BOOTSTRAP_API_KEY_ENABLED:-false}
      # 必须显式设置强随机密钥(openssl rand -base64 32);默认值已被服务
      # 端 ValidateRuntime 拒绝,缺失或使用占位值时容器会拒绝启动。
      CREDENTIAL_MASTER_KEY: ${CREDENTIAL_MASTER_KEY:?CREDENTIAL_MASTER_KEY is required (openssl rand -base64 32)}
      CREDENTIAL_KEK_VERSION: 1
      CREDENTIAL_KEK_KEYRING: ${CREDENTIAL_KEK_KEYRING:-}
      ALLOW_PRIVATE_TOOL_URLS: ${ALLOW_PRIVATE_TOOL_URLS:-false}
      ALLOW_PRIVATE_WEBHOOK_URLS: ${ALLOW_PRIVATE_WEBHOOK_URLS:-false}
      UPSTREAM_BASE_URL: ${UPSTREAM_BASE_URL:-https://api.openai.com}
      UPSTREAM_API_KEY: ${UPSTREAM_API_KEY:-}
      SHADOW_BASE_URL: ${SHADOW_BASE_URL:-}
      SHADOW_API_KEY: ${SHADOW_API_KEY:-}
      SHADOW_SAMPLE_RATE: ${SHADOW_SAMPLE_RATE:-0}
      S3_ENDPOINT: ${S3_ENDPOINT:-http://minio:9000}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-gateway}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-gateway-secret}
      S3_BUCKET: ${S3_BUCKET:-gateway-files}
      S3_REGION: ${S3_REGION:-us-east-1}
      S3_USE_SSL: ${S3_USE_SSL:-false}
      S3_MAX_FILE_BYTES: ${S3_MAX_FILE_BYTES:-134217728}
      # M8 P2:本地 Ollama 向量化(bge-m3)。EMBEDDINGS_ENABLED=false 可整体关闭。
      EMBEDDINGS_ENABLED: ${EMBEDDINGS_ENABLED:-true}
      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-http://ollama:11434}
      EMBEDDING_MODEL: ${EMBEDDING_MODEL:-bge-m3}
      EMBEDDING_DIM: ${EMBEDDING_DIM:-1024}
      EMBEDDING_BATCH_SIZE: ${EMBEDDING_BATCH_SIZE:-64}
      EMBEDDING_TIMEOUT: ${EMBEDDING_TIMEOUT:-120s}
      SCHEDULER_GATEWAY_BASE_URL: ${SCHEDULER_GATEWAY_BASE_URL:-http://gateway-api:8080}
      SCHEDULER_POLL_INTERVAL: ${SCHEDULER_POLL_INTERVAL:-5s}
      SCHEDULER_EXECUTION_TIMEOUT: ${SCHEDULER_EXECUTION_TIMEOUT:-5m}
      SCHEDULER_BATCH_SIZE: ${SCHEDULER_BATCH_SIZE:-10}
      SCHEDULER_MAX_ATTEMPTS: ${SCHEDULER_MAX_ATTEMPTS:-3}
    depends_on:
      postgres:
        condition: service_healthy

  gateway-api:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      args:
        VERSION: ${GATEWAY_VERSION:-0.10.0}
    environment: *gateway-environment
    ports:
      # 仅绑定回环地址:控制台与网关请求都经 admin-web/portal-web 的 nginx
      # 转发,网关端口不需要对外暴露。直接暴露时,攻击者可以绕过 nginx
      # 伪造 X-Forwarded-For 并直连 /metrics 等端点。
      - "127.0.0.1:${GATEWAY_PORT:-8080}:8080"
    depends_on:
      migrator:
        condition: service_completed_successfully
      redis-critical:
        condition: service_healthy
      redis-cache:
        condition: service_healthy
      minio:
        condition: service_started
      # 向量化不阻断 API 启动:ollama 未就绪时 knowledge 入库降级(embedding 置 NULL)。
      ollama:
        condition: service_started
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 1g

  # M8: 对象存储。MinIO 不暴露主机端口,凭据只留在 API 容器内;
  # 上传/下载全部经网关代理。桶由 gateway-api 启动时的 EnsureBucket 兜底创建。
  minio:
    image: minio/minio:latest
    command: ["server", "/data", "--console-address", ":9001"]
    environment:
      MINIO_ROOT_USER: ${S3_ACCESS_KEY_ID:-gateway}
      MINIO_ROOT_PASSWORD: ${S3_SECRET_ACCESS_KEY:-gateway-secret}
    volumes:
      - minio-data:/data
    restart: unless-stopped

  # M8 P2:本地向量化。模型默认 bge-m3(~1.2GB),首次 embed 惰性 pull;
  # 无需对外暴露端口,仅网关容器访问。restart=unless-stopped 以便重启后自愈。
  ollama:
    image: ollama/ollama:latest
    volumes:
      - ollama-models:/root/.ollama
    restart: unless-stopped

  admin-web:
    build:
      context: ..
      dockerfile: deploy/Dockerfile.web
      args:
        APP: admin
    ports:
      - "${ADMIN_PORT:-8081}:80"
    depends_on:
      gateway-api:
        condition: service_started
    restart: unless-stopped

  portal-web:
    build:
      context: ..
      dockerfile: deploy/Dockerfile.web
      args:
        APP: portal
    ports:
      - "${PORTAL_PORT:-8082}:80"
    depends_on:
      gateway-api:
        condition: service_started
    restart: unless-stopped

  outbox-worker:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      args:
        VERSION: ${GATEWAY_VERSION:-0.10.0}
    entrypoint: ["gateway-outbox-worker"]
    environment: *gateway-environment
    depends_on:
      migrator:
        condition: service_completed_successfully
      redis-critical:
        condition: service_healthy
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512m

  maintenance-worker:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      args:
        VERSION: ${GATEWAY_VERSION:-0.10.0}
    entrypoint: ["gateway-maintenance"]
    environment: *gateway-environment
    depends_on:
      migrator:
        condition: service_completed_successfully
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512m

  notification-worker:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      args:
        VERSION: ${GATEWAY_VERSION:-0.10.0}
    entrypoint: ["gateway-notification-worker"]
    environment: *gateway-environment
    depends_on:
      migrator:
        condition: service_completed_successfully
      redis-critical:
        condition: service_healthy
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512m

  scheduler-worker:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      args:
        VERSION: ${GATEWAY_VERSION:-0.10.0}
    entrypoint: ["gateway-scheduler"]
    environment: *gateway-environment
    depends_on:
      migrator:
        condition: service_completed_successfully
      gateway-api:
        condition: service_started
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512m

volumes:
  postgres-data:
  redis-critical-data:
  minio-data:
  ollama-models: