# ============================================================
# opsxsql - Docker Compose 部署(单镜像,参照 opsx-loki)
# 安全基线: 非 root / no-new-privileges / 健康检查 / 资源限额 / 日志轮转
# 使用:
#   export SECRET_KEY=$(openssl rand -hex 32)
#   export JWT_SECRET=$(openssl rand -hex 32)   # 可选;不设则生产模式自动生成并持久化
#   docker compose up -d --build
# 访问: http://localhost:9000 (前后端同源,无需单独的前端容器)
# ============================================================

services:
  opsxsql:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        TARGETARCH: ${TARGETARCH:-amd64}
    image: opsxsql:latest
    container_name: opsxsql
    hostname: opsxsql

    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    ports:
      - "${OPSXSQL_PORT:-9000}:9000"

    volumes:
      - opsxsql-data:/app/data

    environment:
      - PORT=9000
      - DB_PATH=/app/data/sqlite3.db
      - DEBUG=${DEBUG:-false}
      # AES 密钥(实例/LDAP 密码加密): 必须外部提供,且部署后不可更换
      - "SECRET_KEY=${SECRET_KEY:?SECRET_KEY is required. Generate: openssl rand -hex 32}"
      # JWT 密钥: 可选;生产模式未提供时自动生成随机密钥并持久化到数据卷
      - JWT_SECRET=${JWT_SECRET:-}
      # 可选：默认账号初始密码。不设置则首次启动生成 16 位随机密码，
      # 写入数据卷 initial-admin-password.txt 并打印到启动日志
      # 获取：docker compose exec opsxsql cat /app/data/initial-admin-password.txt
      - ADMIN_INIT_PASSWORD=${ADMIN_INIT_PASSWORD:-}

    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9000/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 128M

    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"

    restart: unless-stopped
    stop_grace_period: 15s

volumes:
  opsxsql-data:
    driver: local