name: codex-proxy-rs

x-json-logging: &json-logging
  driver: json-file
  options:
    max-size: '10m'
    max-file: '5'

services:
  postgres:
    extends:
      file: config.yaml
      service: postgres-credentials
    image: postgres:18-bookworm@sha256:d9c83446333daec3f0588cc709adb80c26090b7f9f0f7ec8d43c243385d79818
    restart: unless-stopped
    command:
      - postgres
      - -c
      - timezone=Asia/Shanghai
      - -c
      - log_timezone=Asia/Shanghai
    environment:
      TZ: Asia/Shanghai
      POSTGRES_DB: codex_proxy
      POSTGRES_USER: codex_proxy
      POSTGRES_INITDB_ARGS: --auth-local=scram-sha-256 --auth-host=scram-sha-256
    volumes:
      - type: bind
        source: ../.runtime/postgres
        target: /var/lib/postgresql
        bind:
          create_host_path: false
    ports:
      - '127.0.0.1:5432:5432'
    healthcheck:
      test: [CMD-SHELL, pg_isready -U codex_proxy -d codex_proxy]
      interval: 5s
      timeout: 5s
      retries: 10
    security_opt:
      - no-new-privileges:true
    logging: *json-logging

  redis:
    extends:
      file: config.yaml
      service: redis-credentials
    image: redis:8-alpine@sha256:9d317178eceac8454a2284a9e6df2466b93c745529947f0cd42a0fa9609d7005
    restart: unless-stopped
    volumes:
      - type: bind
        source: ../.runtime/redis
        target: /data
        bind:
          create_host_path: false
    ports:
      - '127.0.0.1:6379:6379'
    healthcheck:
      interval: 5s
      timeout: 5s
      retries: 10
    security_opt:
      - no-new-privileges:true
    logging: *json-logging

  codex-proxy-rs:
    image: ${CPR_IMAGE:-ghcr.io/zyycn/codex-proxy-rs:latest}
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      target: runtime
      args:
        CPR_VERSION: ${CPR_VERSION:-}
        CPR_GIT_SHA: ${CPR_GIT_SHA:-unknown}
        CPR_BUILD_TIME: ${CPR_BUILD_TIME:-unknown}
        CPR_BUILD_TYPE: ${CPR_BUILD_TYPE:-release}
    restart: unless-stopped
    user: '10001:10001'
    init: true
    # 关闭是串行两段：HTTP drain（host.drain_timeout_seconds=30s）之后 worker join
    # （host.worker_shutdown_timeout_seconds=30s），宽限期必须大于两者之和。
    stop_grace_period: 75s
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    pids_limit: 256
    ports:
      - '127.0.0.1:8080:8080'
    volumes:
      - type: bind
        source: ../.runtime/data
        target: /app/.runtime/data
        bind:
          create_host_path: false
      - type: bind
        source: ../.runtime/logs
        target: /app/.runtime/logs
        bind:
          create_host_path: false
    configs:
      - source: cpr_config
        target: /app/deploy/config.yaml
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp:size=64m,mode=1777
    healthcheck:
      test: [CMD, curl, -fsS, http://127.0.0.1:8080/healthz]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    environment:
      HOME: /app
      CPR_SERVER_HOST: 0.0.0.0
      CPR_SERVER_PORT: '8080'
      CPR_DATABASE_URL: postgres://codex_proxy@postgres:5432/codex_proxy
      CPR_REDIS_URL: redis://redis:6379/
      CPR_DEPLOYMENT_MODE: docker
      CPR_UPDATE_REPOSITORY: zyycn/codex-proxy-rs
      CPR_GITHUB_API_BASE: https://api.github.com/repos
      CPR_UPDATE_EXE_PATH: /app/bin/codex-proxy-rs
      CPR_WEB_DIST_DIR: /app/web/dist
      CPR_ENABLE_SELF_RESTART: 'true'
    logging: *json-logging

configs:
  cpr_config:
    file: ./config.yaml