name: lehuo-local

services:
  mysql:
    image: mysql:8.4.8
    restart: unless-stopped
    environment:
      MYSQL_DATABASE: lehuo
      MYSQL_PASSWORD: change-me-local-only
      MYSQL_ROOT_PASSWORD: root-lehuo-2026
      MYSQL_USER: lehuo
      TZ: Asia/Shanghai
    ports:
      - '3306:3306'
    volumes:
      - mysql-data:/var/lib/mysql
    healthcheck:
      test: ['CMD-SHELL', 'mysqladmin ping -h 127.0.0.1 -u root -proot-lehuo-2026 --silent']
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    networks:
      - backend

  redis:
    image: redis:7.4-alpine
    restart: unless-stopped
    command: ['redis-server', '--appendonly', 'yes']
    ports:
      - '6379:6379'
    volumes:
      - redis-data:/data
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend

  api:
    build:
      context: ../..
      dockerfile: apps/api/Dockerfile
    restart: unless-stopped
    environment:
      APP_ENV: demo
      API_PORT: '3000'
      DATABASE_URL: mysql://lehuo:change-me-local-only@mysql:3306/lehuo?allowPublicKeyRetrieval=true&useSSL=false
      REDIS_URL: redis://redis:6379
      SESSION_SECRET: lehuo-local-session-secret-2026
      SESSION_TOKEN_PEPPER: lehuo-local-token-pepper-2026
      AUDIT_IP_HASH_KEY: lehuo-local-audit-key-2026
      FIELD_ENCRYPTION_KEY: eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg=
      OBJECT_STORAGE_ENDPOINT: http://seaweedfs:8333/seaweedfs/s3
      OBJECT_STORAGE_REGION: auto
      OBJECT_STORAGE_BUCKET: lehuo
      OBJECT_STORAGE_ACCESS_KEY: local-dev-key
      OBJECT_STORAGE_SECRET_KEY: local-dev-secret
      OBJECT_STORAGE_FORCE_PATH_STYLE: 'true'
      ADMIN_WEB_ORIGIN: https://www.lhgy.net
      ADMIN_COOKIE_SECURE: 'true'
      AUTH_SESSION_TTL_SECONDS: '86400'
      WECHAT_APP_ID: wx6cfca7c83002d678
      WECHAT_APP_SECRET: 28ba8995b5329fab7e8207edf290ec74
      WECHAT_PRIVATE_KEY_PATH: /app/ssl/private.key
      NOTIFICATION_WORKER_ENABLED: 'false'
      BOOTSTRAP_ADMIN_USERNAME: admin
      BOOTSTRAP_ADMIN_PASSWORD: lehuo@123456
      BOOTSTRAP_ADMIN_DISPLAY_NAME: System Administrator
    ports:
      - '3000:3000'
    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - backend
    read_only: true
    tmpfs:
      - /tmp:size=64m,noexec,nosuid
    security_opt:
      - no-new-privileges:true

  admin-web:
    build:
      context: ../..
      dockerfile: apps/admin-web/Dockerfile
      args:
        VITE_API_BASE_URL: https://www.lhgy.net/api
    restart: unless-stopped
    ports:
      - '5173:80'
    environment:
      ADMIN_WEB_ORIGIN: https://www.lhgy.net
      VITE_API_BASE_URL: https://www.lhgy.net/api
      PUBLIC_HOST: www.lhgy.net
      PUBLIC_WS: wss://www.lhgy.net
    depends_on:
      - api
    networks:
      - backend
      - edge
    volumes:
      - ./nginx.local.conf.template:/etc/nginx/templates/default.conf.template
    tmpfs:
      - /tmp:size=64m,noexec,nosuid
      - /var/cache/nginx:size=32m,noexec,nosuid
      - /var/run:size=4m,noexec,nosuid
      - /var/log/nginx:size=32m,noexec,nosuid
    security_opt:
      - no-new-privileges:true

volumes:
  mysql-data:
  redis-data:

networks:
  backend:
  edge: