name: iboard-prod

# iBoard 0.2.1 生产栈 (单端口对外)
#   - app       : 3001 对外 (唯一入口), 内部把 /sync 反代到 powersync
#   - pg        : PostgreSQL 16, 仅容器内网 (逻辑复制供同步服务消费)
#   - powersync : 同步服务, 仅容器内网 (不对外暴露端口)
#
# 与旧的生产方式区别: 不再依赖宿主 MySQL, 数据库与同步服务都在栈内;
# 对外只有 3001 一个端口, 域名 https://iboard.honor3.com (NPM 反代) 即可。
#
# 用法 (baihu:/app/iboard-prod):
#   cp deploy/prod/.env.example deploy/prod/.env  # 填密钥
#   docker compose --env-file deploy/prod/.env -f deploy/prod/docker-compose.yml up -d

services:
  pg:
    image: postgres:16-alpine
    restart: unless-stopped
    command: ["postgres", "-c", "wal_level=logical"]
    environment:
      POSTGRES_USER: iboard
      POSTGRES_PASSWORD: ${PG_PASSWORD:?PG_PASSWORD missing}
      POSTGRES_DB: iboard
      PS_STORAGE_PASSWORD: ${PS_STORAGE_PASSWORD:?PS_STORAGE_PASSWORD missing}
    volumes:
      - ./data/pg:/var/lib/postgresql/data
      - ./initdb:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U iboard -d iboard"]
      interval: 5s
      timeout: 5s
      retries: 12

  app:
    image: iboard:latest
    build:
      context: ../..
      dockerfile: Dockerfile
    restart: unless-stopped
    depends_on:
      pg:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql://iboard:${PG_PASSWORD}@pg:5432/iboard
      PORT: "3001"
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET missing}
      POWERSYNC_JWT_SECRET: ${POWERSYNC_JWT_SECRET:?POWERSYNC_JWT_SECRET missing}
      # 客户端拿到的同步地址 = 同域 (经由 app 的 /sync 反代)
      POWERSYNC_URL: ${PUBLIC_URL:-https://iboard.honor3.com}
      # app 内部转发同步请求到内网 powersync
      POWERSYNC_UPSTREAM: http://powersync:8080
      OTA_PUBLIC_BASE: ${PUBLIC_URL:-https://iboard.honor3.com}
      OTA_PACKAGE_DIR: /app/ota-package
      MIHOME_CACHE_DIR: /app/cache
    volumes:
      - ./data/cache:/app/cache
      # OTA 热更包 (CI 构建产物, 由流水线写入宿主 data/ota)
      - ./data/ota:/app/ota-package
    ports:
      - "${HOST_PORT:-3001}:3001"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3001/api/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  powersync:
    image: journeyapps/powersync-service:latest
    restart: unless-stopped
    depends_on:
      pg:
        condition: service_healthy
    command: ["start", "-r", "unified"]
    volumes:
      - ./powersync/service.yaml:/config/service.yaml:ro
      - ./powersync/sync-config.yaml:/config/sync-config.yaml:ro
    environment:
      POWERSYNC_CONFIG_PATH: /config/service.yaml
      PS_SOURCE_URI: postgresql://iboard:${PG_PASSWORD}@pg:5432/iboard?sslmode=disable
      PS_STORAGE_URI: postgresql://powersync_storage:${PS_STORAGE_PASSWORD}@pg:5432/iboard?sslmode=disable
      PS_JWT_KEY_B64: ${POWERSYNC_JWT_KEY_B64:?POWERSYNC_JWT_KEY_B64 missing}