name: iboard-021

# 0.2.1 独立验证栈: PG (逻辑复制) + PowerSync + App, 与现网 /app/iboard 完全隔离
# 见 docs/V0.2/离线编辑模块/0.2.1实施方案.md; 端口 13001 (app) / 13002 (powersync), PG 不对外

services:
  pg:
    image: postgres:16-alpine
    restart: unless-stopped
    command: ["postgres", "-c", "wal_level=logical"]
    environment:
      POSTGRES_USER: iboard021
      POSTGRES_PASSWORD: ${PG_PASSWORD:?PG_PASSWORD missing}
      POSTGRES_DB: iboard021
      # initdb 脚本用: 创建 powersync bucket storage 用户
      PS_STORAGE_PASSWORD: ${PS_STORAGE_PASSWORD:?PS_STORAGE_PASSWORD missing}
    volumes:
      - ./data/pg:/var/lib/postgresql/data
      - ./initdb:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U iboard021 -d iboard021"]
      interval: 5s
      timeout: 5s
      retries: 12

  app:
    build:
      context: ../..
      dockerfile: Dockerfile
    restart: unless-stopped
    depends_on:
      pg:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql://iboard021:${PG_PASSWORD}@pg:5432/iboard021
      PORT: "13001"
      JWT_SECRET: ${JWT_SECRET_021:?JWT_SECRET_021 missing}
      POWERSYNC_JWT_SECRET: ${POWERSYNC_JWT_SECRET:?POWERSYNC_JWT_SECRET missing}
      POWERSYNC_URL: ${POWERSYNC_URL:-http://bh.vps.honor3.com:13002}
      OTA_PUBLIC_BASE: ${OTA_PUBLIC_BASE:-http://bh.vps.honor3.com:13001}
      # 0.2.1 验证部署关闭定时任务 (新闻/油价/米家等), 避免重复外呼
      DISABLE_CRON: "1"
    command: ["sh", "-c", "npx prisma migrate deploy && node --experimental-strip-types --no-warnings server/index.js"]
    ports:
      - "13001:13001"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:13001/api/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  # TLS 前置 (自签证书): PowerSync 网页端必须在安全上下文运行 (navigator.locks),
  # 因此浏览器入口统一走 https://bh.vps.honor3.com:13443 (证书接受一次即可, app+sync 同源同证书)
  tls-front:
    image: nginx:alpine
    restart: unless-stopped
    depends_on:
      - app
      - powersync
    volumes:
      - ./tls/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./data/tls:/etc/nginx/certs:ro
    ports:
      - "13443:443"

  powersync:
    image: journeyapps/powersync-service:latest
    restart: unless-stopped
    depends_on:
      pg:
        condition: service_healthy
    command: ["start", "-r", "unified"]
    volumes:
      - ./powersync/service.yaml:/config/service.yaml:ro
      - ./powersync/sync-config.yaml:/config/sync-config.yaml:ro
    environment:
      POWERSYNC_CONFIG_PATH: /config/service.yaml
      # service.yaml 内 !env PS_* 引用 (整值替换; URI 在此组装)
      PS_SOURCE_URI: postgresql://iboard021:${PG_PASSWORD}@pg:5432/iboard021?sslmode=disable
      PS_STORAGE_URI: postgresql://powersync_storage:${PS_STORAGE_PASSWORD}@pg:5432/iboard021?sslmode=disable
      PS_JWT_KEY_B64: ${POWERSYNC_JWT_KEY_B64:?POWERSYNC_JWT_KEY_B64 missing}
    ports:
      - "13002:8080"