# ============================================================
# 红动未来 - 第三方中间件
# ============================================================
# 启动：docker compose -f deploy/docker-compose-infra-main.yml up -d
# 停止：docker compose -f deploy/docker-compose-infra-main.yml down
# ============================================================

name: redfuture

networks:
  redfuture-net:
    driver: bridge

services:

  # ---- PostgreSQL (pgvector) ----
  postgres:
    image: docker.m.daocloud.io/pgvector/pgvector:pg16
    container_name: postgres
    restart: unless-stopped
    ports:
      - "15432:5432"
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: Bjang09@686^*^
      POSTGRES_DB: postgres
    volumes:
      - ../data/postgres:/var/lib/postgresql/data
      - ./sql/init.sql:/docker-entrypoint-initdb.d/init.sql
      - ./sql/init-replication.sql:/docker-entrypoint-initdb.d/init-replication.sql
    command: ["postgres", "-c", "wal_level=replica", "-c", "max_wal_senders=10", "-c", "max_replication_slots=10", "-c", "hot_standby=on"]
    networks:
      - redfuture-net
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ---- PostgreSQL 自动备份 (每日凌晨 2:00) ----
  postgres-backup:
    image: docker.m.daocloud.io/pgvector/pgvector:pg16
    container_name: postgres-backup
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - /data/pgsql/backup:/backup
    environment:
      PGUSER: postgres
      PGPASSWORD: Bjang09@686^*^
      PGHOST: postgres
      PGPORT: 5432
      BACKUP_DIR: /backup
      RETENTION_DAYS: 7
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        set -e
        mkdir -p "/backup"
        while true; do
          f="backup_$(date +%Y%m%d_%H%M%S).sql.gz"
          echo "[$(date '+%Y-%m-%d %H:%M:%S')] Starting backup: $${f}"
          pg_dumpall -h postgres -U postgres | gzip > "/backup/$${f}"
          echo "[$(date '+%Y-%m-%d %H:%M:%S')] Backup complete"
          find /backup -name "backup_*.sql.gz" -mtime +7 -delete 2>/dev/null || true
          sleep 86400
        done

  # ---- Redis ----
  redis:
    image: docker.m.daocloud.io/redis:7.4.8
    container_name: redis
    restart: unless-stopped
    ports:
      - "6379:6379"
    command: redis-server --requirepass Bjang09@686^*^
    volumes:
      - ../data/redis:/data
    networks:
      - redfuture-net
    healthcheck:
      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ---- Consul ----
  consul:
    image: docker.m.daocloud.io/consul:1.15.4
    container_name: consul
    restart: unless-stopped
    ports:
      - "8500:8500"
    init: true
    command: agent -server -bootstrap -ui -data-dir=/consul/data -bind=0.0.0.0 -client=0.0.0.0
    volumes:
      - ../data/consul:/consul/data
    networks:
      - redfuture-net

  # ---- MinIO ----
  minio:
    image: docker.m.daocloud.io/minio/minio
    container_name: minio
    restart: unless-stopped
    ports:
      - "9000:9000"
      - "9001:9001"
    environment:
      MINIO_ROOT_USER: admin
      MINIO_ROOT_PASSWORD: Bjang09@686^*^
    command: server /data --console-address ":9001"
    volumes:
      - ../data/minio:/data
    networks:
      - redfuture-net

  # ---- MeiliSearch ----
  meilisearch:
    image: docker.m.daocloud.io/getmeili/meilisearch:v1.40.0
    container_name: meilisearch
    restart: unless-stopped
    ports:
      - "7700:7700"
    environment:
      MEILI_MASTER_KEY: wMW7BPM3CLwnEGpPbaoci-HvB8R37wV-5tGIizsDQSQ
    volumes:
      - ../data/meilisearch:/meili_data
    networks:
      - redfuture-net

  # ---- NATS (with JetStream) ----
  nats:
    image: docker.m.daocloud.io/nats:latest
    container_name: nats
    restart: unless-stopped
    ports:
      - "4222:4222"
      - "8222:8222"
    command: -js -sd /data -m 8222
    volumes:
      - ../data/nats:/data
    depends_on:
      redis:
        condition: service_healthy
    networks:
      - redfuture-net

  # ---- Jaeger (All-in-One 分布式追踪) ----
  jaeger:
    image: docker.m.daocloud.io/jaegertracing/all-in-one:latest
    container_name: jaeger
    restart: unless-stopped
    ports:
      - "16686:16686"
      - "4317:4317"
      - "4318:4318"
      - "14250:14250"
    environment:
      COLLECTOR_OTLP_ENABLED: "true"
      COLLECTOR_ZIPKIN_ENABLED: "false"
      LOG_LEVEL: "info"
    networks:
      - redfuture-net

  # ---- Gitea (Git 代码托管) ----
  gitea:
    image: docker.m.daocloud.io/gitea/gitea:latest
    container_name: gitea
    restart: unless-stopped
    ports:
      - "3000:3000"
      - "2222:2222"
    environment:
      USER_UID: 1000
      USER_GID: 1000
      GITEA__server__SSH_PORT: "2222"
    volumes:
      - /data/gitea:/data
    networks:
      - redfuture-net
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3

  # ---- Gitea CI/CD Runner (act_runner) ----
  # host 模式：job 在 runner 容器内直接执行（kubectl/docker 可直接用）
  # k3s 在 121.37.117.181，经宿主机 systemd 服务 k3s-ssh-tunnel.service
  # (ssh -L 16443:127.0.0.1:6443) 隧道访问，故 runner 必须与隧道同网络命名空间
  gitea-runner:
    build:
      context: ./gitea-runner
      dockerfile: Dockerfile
    image: redfuture-runner:latest
    container_name: gitea-runner
    restart: unless-stopped
    network_mode: host
    depends_on:
      gitea:
        condition: service_healthy
    environment:
      GITEA_INSTANCE_URL: http://127.0.0.1:3000
      GITEA_RUNNER_REGISTRATION_TOKEN: 9lGvGJxk7M781IYBWDV0ZuZpXV5RkGKlIpkhRVNs
      GITEA_RUNNER_NAME: gitea-runner
      # host 标签：job 直接在 runner 容器内执行，才能使用挂载的 kubectl/kubeconfig
      GITEA_RUNNER_LABELS: "ubuntu-latest:host"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /data/gitea-runner:/data
      - /data/gitea-runner/bin/kubectl:/usr/local/bin/kubectl
      - /data/gitea-runner/bin/docker:/usr/local/bin/docker
      - /data/gitea-runner/.kube/config:/root/.kube/config
      # dev 宿主机本地 k3s (127.0.0.1:6443)，与 181 集群(16443)分开
      - /etc/rancher/k3s/k3s.yaml:/root/.kube/k3s-dev.yaml
    healthcheck:
      test: ["CMD-SHELL", "test -f /data/.runner"]
      interval: 30s
      timeout: 5s
      retries: 5

  # ---- 本地镜像仓库 (CI 构建产物中转，k3s containerd 拉取) ----
  # 仅绑定 127.0.0.1，供本机 runner push / k3s containerd pull
  registry:
    image: docker.m.daocloud.io/registry:2
    container_name: registry
    restart: unless-stopped
    ports:
      - "127.0.0.1:5000:5000"
    volumes:
      - /data/registry:/var/lib/registry
    networks:
      - redfuture-net

  # ---- Nginx 反向代理 ----
  nginx:
    build:
      context: ./nginx-proxy
      dockerfile: Dockerfile
    container_name: nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    networks:
      - redfuture-net

  # ---- media 运行时基础镜像（ffmpeg/python/node/chromium/hyperframes） ----
  media-deps:
    build:
      context: ../
      dockerfile: deploy/media-deps/Dockerfile
    image: redfuture-media-deps:latest
    container_name: media-deps
    restart: "no"
    networks:
      - redfuture-net