# opsx-licence Docker 部署（单容器：管理后台 + /api）
# 用法:
#   cp .env.example .env   # 填 JWT / Waffo
#   docker compose up -d --build
#   # 或旧版: docker-compose up -d --build
# 署名 Logan.Li

services:
  opsx-licence:
    image: opsx-licence:${VERSION:-latest}
    build:
      context: .
      dockerfile: Dockerfile
    container_name: opsx-licence
    restart: unless-stopped
    ports:
      - "${HOST_PORT:-9001}:9001"
    env_file:
      - .env
    environment:
      TZ: Asia/Shanghai
      PORT: "9001"
      GIN_MODE: ${GIN_MODE:-release}
      DB_DRIVER: sqlite
      DB_NAME: /data/db.sqlite3
      # 机密字段信封加密主密钥（64 位 hex=32 字节）：双节点必须一致；缺失则启动失败 // Logan.Li
      OPSLIC_MASTER_KEY: ${OPSLIC_MASTER_KEY:-}
      # 经 nginx 反代的节点填其内网 CIDR（逗号分隔）；直连节点留空=不信任任何代理头 // Logan.Li
      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-}
    volumes:
      - licence_data:/data
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:9001/readyz"]
      interval: 15s
      timeout: 3s
      retries: 5
      start_period: 15s

  # SQLite 每日备份 sidecar（保留最近 7 份） // Logan.Li
  backup:
    image: alpine:3.20
    container_name: opsx-licence-backup
    restart: unless-stopped
    volumes:
      - licence_data:/data:ro
      - ./backups:/backups
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        apk add --no-cache sqlite >/dev/null 2>&1 || true
        while true; do
          ts=$$(date +%Y%m%d-%H%M%S)
          if [ -f /data/db.sqlite3 ]; then
            if command -v sqlite3 >/dev/null 2>&1; then
              sqlite3 /data/db.sqlite3 ".backup '/backups/db-$$ts.sqlite3'"
            else
              cp /data/db.sqlite3 /backups/db-$$ts.sqlite3
            fi
            ls -t /backups/db-*.sqlite3 2>/dev/null | tail -n +8 | xargs -r rm -f
            echo "[backup] done $$ts"
          fi
          sleep 86400
        done

volumes:
  licence_data: