name: codex-proxy-rs

x-json-logging: &json-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

services:
  postgres:
    image: postgres:18-bookworm@sha256:d9c83446333daec3f0588cc709adb80c26090b7f9f0f7ec8d43c243385d79818
    restart: unless-stopped
    command:
      [
        "postgres",
        "-c",
        "timezone=Asia/Shanghai",
        "-c",
        "log_timezone=Asia/Shanghai",
      ]
    environment:
      TZ: Asia/Shanghai
      POSTGRES_DB: codex_proxy
      POSTGRES_USER: codex_proxy
      POSTGRES_PASSWORD: ${CPR_POSTGRES_PASSWORD:?CPR_POSTGRES_PASSWORD must be set in deploy/.env}
      POSTGRES_INITDB_ARGS: --auth-local=scram-sha-256 --auth-host=scram-sha-256
    volumes:
      - postgres-data:/var/lib/postgresql
    ports:
      - "127.0.0.1:5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U codex_proxy -d codex_proxy"]
      interval: 5s
      timeout: 5s
      retries: 10
    security_opt:
      - no-new-privileges:true
    logging: *json-logging

  redis:
    image: redis:8-alpine@sha256:9d317178eceac8454a2284a9e6df2466b93c745529947f0cd42a0fa9609d7005
    restart: unless-stopped
    command:
      [
        "redis-server",
        "--appendonly",
        "yes",
        "--requirepass",
        "${CPR_REDIS_PASSWORD:?CPR_REDIS_PASSWORD must be set in deploy/.env}",
      ]
    volumes:
      - redis-data:/data
    ports:
      - "127.0.0.1:6379:6379"
    healthcheck:
      test:
        [
          "CMD",
          "redis-cli",
          "--no-auth-warning",
          "-a",
          "${CPR_REDIS_PASSWORD:?CPR_REDIS_PASSWORD must be set in deploy/.env}",
          "ping",
        ]
      interval: 5s
      timeout: 5s
      retries: 10
    security_opt:
      - no-new-privileges:true
    logging: *json-logging

  codex-proxy-rs:
    image: ${CPR_IMAGE:-ghcr.io/zyycn/codex-proxy-rs:latest}
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      target: runtime
      args:
        CPR_VERSION: ${CPR_VERSION:-}
        CPR_GIT_SHA: ${CPR_GIT_SHA:-unknown}
        CPR_BUILD_TIME: ${CPR_BUILD_TIME:-unknown}
        CPR_BUILD_TYPE: ${CPR_BUILD_TYPE:-release}
    container_name: codex-proxy-rs
    restart: unless-stopped
    user: "10001:10001"
    init: true
    stop_grace_period: 30s
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    pids_limit: 256
    cpus: "2.0"
    mem_limit: 1g
    ports:
      - "127.0.0.1:8080:8080"
    volumes:
      - ${CPR_CONFIG_FILE:-../.runtime/config.yaml}:/app/config.yaml:ro
      - ${CPR_DATA_DIR:-../.runtime/data}:/app/data
      - ${CPR_LOG_DIR:-../.runtime/logs}:/app/logs
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp:size=64m,mode=1777
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    environment:
      HOME: /app
      XDG_DATA_HOME: /app/data
      CPR_CONFIG_FILE: /app/config.yaml
      CPR_ADMIN_DEFAULT_PASSWORD: ${CPR_ADMIN_DEFAULT_PASSWORD:?CPR_ADMIN_DEFAULT_PASSWORD must be set in deploy/.env}
      CPR_POSTGRES_PASSWORD: ${CPR_POSTGRES_PASSWORD:?CPR_POSTGRES_PASSWORD must be set in deploy/.env}
      CPR_REDIS_PASSWORD: ${CPR_REDIS_PASSWORD:?CPR_REDIS_PASSWORD must be set in deploy/.env}
      CPR_DEPLOYMENT_MODE: docker
      CPR_UPDATE_REPOSITORY: zyycn/codex-proxy-rs
      CPR_UPDATE_CHANNEL: stable
      CPR_UPDATE_TEMP_DIR: /app/data/update-tmp
      CPR_UPDATE_STATE_FILE: /app/data/update-state.json
      CPR_UPDATE_LOCK_FILE: /app/data/update.lock
      CPR_WEB_DIST_DIR: /app/web/dist
      CPR_ENABLE_SELF_RESTART: "true"
    logging: *json-logging

volumes:
  postgres-data:
  redis-data: