services:
  douyu-login:
    build:
      context: .
      args:
        # 服务器默认走阿里云镜像；本地测试设为 false。
        USE_CHINA_MIRRORS: ${USE_CHINA_MIRRORS:-true}
    container_name: douyu-login
    restart: unless-stopped
    ports:
      # 保持现有服务端口；可通过 APP_PORT 覆盖。
      - "${APP_PORT:-8000}:8800"
    volumes:
      # 持久化运行时文件和日志，数据库由 mysql-data 卷管理。
      - ./data:/app/data
      - ./logs:/app/logs
    environment:
      - TZ=Asia/Shanghai
      # MySQL 仅在 Compose 内网开放，不映射宿主机端口。
      - DB_HOST=mysql
      - DB_PORT=3306
      - DB_NAME=${MYSQL_DATABASE:-douyu_login}
      - DB_USER=${MYSQL_USER:-douyu_login}
      - DB_PASSWORD=${MYSQL_PASSWORD:?请在 .env 中设置 MYSQL_PASSWORD}
      - DB_POOL_SIZE=${DB_POOL_SIZE:-20}
      - DB_MAX_OVERFLOW=${DB_MAX_OVERFLOW:-20}
      - DB_POOL_TIMEOUT=${DB_POOL_TIMEOUT:-30}
      - DB_POOL_RECYCLE=${DB_POOL_RECYCLE:-1800}
      # JWT 密钥（生产环境务必修改，可用 python -c "import secrets; print(secrets.token_urlsafe(32))" 生成）
      - JWT_SECRET_KEY=${JWT_SECRET_KEY:-}
      # 敏感字段落盘加密密钥（生产环境务必长期保持不变）
      - APP_ENCRYPTION_KEY=${APP_ENCRYPTION_KEY:-}
      # 默认管理员账号密码（仅首次启动建库时生效）
      - ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-admin123}
      # Cookie 安全标志（HTTPS 部署时设为 true）
      - COOKIE_SECURE=${COOKIE_SECURE:-false}
      # CORS 允许的源（逗号分隔）
      - CORS_ORIGINS=${CORS_ORIGINS:-}
      # Worker 已合并到本容器，仅通过回环地址访问。
      - YYB_WORKER_URL=http://127.0.0.1:8810
      - YYB_WORKER_KEY=${YYB_WORKER_KEY:-}
      # 鱼翅直充供应商凭据仅通过容器环境变量注入，不入库、不返回前端。
      - FISH_FIN_RECHARGE_BASE_URL=${FISH_FIN_RECHARGE_BASE_URL:-}
      - FISH_FIN_RECHARGE_APP_ID=${FISH_FIN_RECHARGE_APP_ID:-}
      - FISH_FIN_RECHARGE_APP_KEY=${FISH_FIN_RECHARGE_APP_KEY:-}
      - FISH_FIN_RECHARGE_APP_SECRET=${FISH_FIN_RECHARGE_APP_SECRET:-}
      - FISH_FIN_RECHARGE_TIMEOUT=${FISH_FIN_RECHARGE_TIMEOUT:-20}
      - FISH_FIN_RECHARGE_DEBUG=${FISH_FIN_RECHARGE_DEBUG:-false}
      # Roundcube 邮件验证码读取服务地址（不填则使用代码默认值）
      - MAIL_ROUNDCUBE_URL=${MAIL_ROUNDCUBE_URL:-}
      # 生产容器禁止 reload；开发环境由 dev.sh 单独启动 reload。
      - UVICORN_RELOAD=false
    networks:
      - default
      - order-site-net
    depends_on:
      mysql:
        condition: service_healthy
    # 增加文件描述符限制，避免 "Too many open files" 错误
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8800/api/health'); urllib.request.urlopen('http://127.0.0.1:8810/health')"]
      interval: 30s
      timeout: 5s
      retries: 3

  mysql:
    image: ${MYSQL_IMAGE:-docker.m.daocloud.io/library/mysql:8.4}
    container_name: douyu-login-db
    restart: unless-stopped
    ports:
      # 仅绑定宿主机本地地址，供 ./dev.sh 的本地后端连接，不对外网开放。
      - "${MYSQL_BIND_HOST:-127.0.0.1}:${MYSQL_HOST_PORT:-3307}:3306"
    environment:
      - TZ=Asia/Shanghai
      - MYSQL_DATABASE=${MYSQL_DATABASE:-douyu_login}
      - MYSQL_USER=${MYSQL_USER:-douyu_login}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD:?请在 .env 中设置 MYSQL_PASSWORD}
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:?请在 .env 中设置 MYSQL_ROOT_PASSWORD}
    volumes:
      - mysql-data:/var/lib/mysql
    command:
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_0900_ai_ci
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h localhost -uroot -p$$MYSQL_ROOT_PASSWORD --silent"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s

volumes:
  mysql-data:

networks:
  order-site-net:
    external: true
    name: order_site_default