services:
  oa-ai:
    build: .
    container_name: oa-ai
    ports:
      - "6179:3000"
    environment:
      - LDAP_URL=ldap://lldap:3890
      - LDAP_BASE_DN=dc=tlyq,dc=ai
      - LLDAP_ADMIN_PASSWORD=${LLDAP_ADMIN_PASSWORD}
      - JWT_SECRET=${JWT_SECRET:-oa-shared-jwt-secret-tlyq-2026}
      - COOKIE_DOMAIN=.tlyq.ai
      - NODE_ENV=production
      - NODE_TLS_REJECT_UNAUTHORIZED=0
      - HOSTNAME=0.0.0.0
      - TZ=Asia/Shanghai
      - ASSETS_DB_PATH=/data/other-sites/assets/assets.db
      - ISSUE_DB_PATH=/data/other-sites/issue/issue.db
      - RESEND_API_KEY=${RESEND_API_KEY}
      - AUTHELIA_URL=${AUTHELIA_URL:-https://sso.tlyq.ai}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-oa-oidc}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
      - OIDC_REDIRECT_URI=${OIDC_REDIRECT_URI:-https://oa.tlyq.ai/api/auth/callback}
    volumes:
      - ./.next:/app/.next
      - /var/run/docker.sock:/var/run/docker.sock
      # 挂载整个数据目录（非单个文件），确保 SQLite WAL 文件共享
      - /var/lib/docker/volumes/assets-ai_assets-data/_data:/data/other-sites/assets
      - /var/lib/docker/volumes/issue-ai_issue-data/_data:/data/other-sites/issue
    networks:
      - webnet
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://localhost:3000/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 40s
    restart: unless-stopped

networks:
  webnet:
    external: true