# ============================================================
# lokistack - Development Docker Compose Configuration
# ============================================================
# P0 Fixes:
#   - Non-root kubeconfig mount (/home/lokistack/.kube)
#   - Healthcheck for orchestration visibility
#   - Resource limits to prevent noisy-neighbor
#   - security_opt: no-new-privileges
#   - Log rotation (json-file driver)
#   - Named volumes instead of bind mounts
# P1 Fixes:
#   - Restart policy optimization
#   - Network isolation
# ============================================================

services:
  lokistack:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        TARGETARCH: ${TARGETARCH:-amd64}
    image: lghost/lokistack:latest
    container_name: lokistack
    hostname: lokistack

    # ---- P0: Security options ----
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      # Required for healthcheck (wget) and runtime operations
      - NET_BIND_SERVICE
      # Required for file operations in /app/data
      - CHOWN
      - SETGID
      - SETUID
    read_only: false  # Dev mode needs writable /app/data

    ports:
      - "${SERVER_PORT:-8080}:8080"

    # ---- P0: Named volumes for data persistence ----
    volumes:
      - lokistack-data:/app/data
      # P0: Mount kubeconfig to non-root user directory
      - ${KUBECONFIG_PATH:-${HOME}/.kube}:/home/lokistack/.kube:ro
      # SSH keys for host-based deployments
      - ${SSH_KEY_PATH:-${HOME}/.ssh}:/home/lokistack/.ssh:ro

    # ---- P0: Environment variables (no default secrets) ----
    environment:
      - SERVER_PORT=8080
      - DATA_DIR=/app/data
      # 密钥零输入启动:不设置时 entrypoint 自动生成随机密钥并持久化到数据卷
      # ($DATA_DIR/.secrets.env);需要固定密钥时在 .env / 环境变量里显式提供。
      - "JWT_SECRET=${JWT_SECRET:-}"
      - "ENCRYPTION_KEY=${ENCRYPTION_KEY:-}"
      # KUBECONFIG points to non-root user's .kube directory
      - KUBECONFIG=/home/lokistack/.kube/config

    # ---- P0: Healthcheck ----
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/index.html"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

    # ---- P0: Resource limits ----
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 512M
          pids: 100
        reservations:
          cpus: '0.25'
          memory: 64M

    # ---- P0: Log rotation ----
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"
        labels: "service,image"
        env: "SERVER_PORT,DATA_DIR"

    # ---- P1: Restart policy ----
    restart: unless-stopped
    stop_grace_period: 15s

    networks:
      - lokistack-net

# ---- Named volumes ----
volumes:
  lokistack-data:
    driver: local
    labels:
      - "com.lokistack.description=lokistack data directory"

# ---- Network isolation ----
networks:
  lokistack-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16
    labels:
      - "com.lokistack.description=lokistack internal network"