name: codex-proxy-rs

x-json-logging: &json-logging
  driver: json-file
  options:
    max-size: '10m'
    max-file: '5'

services:
  postgres:
    extends:
      file: config.yaml
      service: postgres-credentials
    image: postgres:18-bookworm@sha256:bbf83594798e144bff365a9c191c5d779f181fb3135902064ab8ff11918020fc
    restart: unless-stopped
    # 小内存部署可在此调整数据库预算，保留 UTC 参数，详见 README.md#小内存优化
    command:
      - postgres
      - -c
      - timezone=UTC
      - -c
      - log_timezone=UTC
    environment:
      TZ: UTC
      POSTGRES_DB: codex_proxy
      POSTGRES_USER: codex_proxy
      POSTGRES_INITDB_ARGS: --auth-local=scram-sha-256 --auth-host=scram-sha-256
    volumes:
      - type: bind
        source: ../.runtime/postgres
        target: /var/lib/postgresql
        bind:
          create_host_path: false
    ports:
      - '127.0.0.1:5432:5432'
    healthcheck:
      test: [CMD-SHELL, pg_isready -U codex_proxy -d codex_proxy]
      interval: 5s
      timeout: 5s
      retries: 10
    security_opt:
      - no-new-privileges:true
    logging: *json-logging

  redis:
    extends:
      file: config.yaml
      service: redis-credentials
    image: redis:8-alpine@sha256:0bf6577d7774e592b29d093e3ac9390eb91e13d72c21e506afce736de5e0eeb0
    restart: unless-stopped
    volumes:
      - type: bind
        source: ../.runtime/redis
        target: /data
        bind:
          create_host_path: false
    ports:
      - '127.0.0.1:6379:6379'
    healthcheck:
      interval: 5s
      timeout: 5s
      retries: 10
    security_opt:
      - no-new-privileges:true
    logging: *json-logging

  codex-proxy-rs:
    extends:
      file: config.yaml
      service: app-runtime
    image: ${CPR_IMAGE:-ghcr.io/zyycn/codex-proxy-rs:latest}
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      target: runtime
      args:
        CPR_VERSION: ${CPR_VERSION:-}
        CPR_GIT_SHA: ${CPR_GIT_SHA:-unknown}
        CPR_BUILD_TIME: ${CPR_BUILD_TIME:-unknown}
        CPR_BUILD_TYPE: ${CPR_BUILD_TYPE:-release}
    restart: unless-stopped
    user: '10001:10001'
    init: true
    # 不等待存量会话；宽限期需覆盖后台收尾（默认 30s）及进程清理余量
    stop_grace_period: 75s
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    pids_limit: 256
    ports:
      - '127.0.0.1:8080:8080'
    volumes:
      - type: bind
        source: ../.runtime/data
        target: /app/.runtime/data
        bind:
          create_host_path: false
      - type: bind
        source: ../.runtime/logs
        target: /app/.runtime/logs
        bind:
          create_host_path: false
    configs:
      - source: cpr_config
        target: /app/deploy/config.yaml
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp:size=64m,mode=1777
    healthcheck:
      test: [CMD, curl, -fsS, http://127.0.0.1:8080/healthz]
      interval: 30s
      timeout: 5s
      retries: 3
      # 首次升级需回填历史请求，宽限期只容忍启动失败，探测成功后立即转为健康
      start_period: 5m
    environment:
      HOME: /app
      CPR_SERVER_HOST: 0.0.0.0
      CPR_SERVER_PORT: '8080'
      CPR_DATABASE_URL: postgres://codex_proxy@postgres:5432/codex_proxy
      CPR_REDIS_URL: redis://redis:6379/
      CPR_DEPLOYMENT_MODE: docker
      CPR_UPDATE_REPOSITORY: zyycn/codex-proxy-rs
      CPR_GITHUB_API_BASE: https://api.github.com/repos
      CPR_UPDATE_EXE_PATH: /app/bin/codex-proxy-rs
      CPR_WEB_DIST_DIR: /app/web/dist
      CPR_ENABLE_SELF_RESTART: 'true'
    logging: *json-logging

configs:
  cpr_config:
    file: ./config.yaml