# 1Panel / docker compose 部署示例。
# 数据库与 Redis 若已有实例，删掉对应 service 并改环境变量指向外部地址即可。
services:
  iam-api:
    build: .
    image: iam-api:0.1.0
    container_name: iam-api
    restart: unless-stopped
    ports:
      - "${IAM_API_PORT:-8900}:8900"
    environment:
      SPRING_PROFILES_ACTIVE: prod
      DB_HOST: mysql
      DB_PORT: "3306"
      DB_NAME: ${DB_NAME:-iam}
      DB_USERNAME: ${DB_USERNAME:-iam}
      DB_PASSWORD: ${DB_PASSWORD:?数据库密码必须设置}
      # Flyway 迁移账号：需要 iam 库的 DDL 权限 + performance_schema.user_variables_by_thread 的 SELECT
      # 不设置这两项会启动失败（application-prod.yml 里故意没有默认值）
      FLYWAY_USER: ${FLYWAY_USER:?Flyway 迁移账号必须设置}
      FLYWAY_PASSWORD: ${FLYWAY_PASSWORD:?Flyway 迁移账号密码必须设置}
      REDIS_HOST: redis
      REDIS_PORT: "6379"
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      # 必填：生产没有默认值，缺失会启动失败
      JWT_SECRET: ${JWT_SECRET:?会话令牌密钥必须设置}
      INTERNAL_KEY: ${INTERNAL_KEY:?内部自证密钥必须设置}
      # 内网自证密钥轮换期可配多值（逗号分隔）由网关处理，此处仅单值
      HEALTH_REDIS_ENABLED: "true"
    volumes:
      # RS256 私钥：宿主机 ./config/iam-jwt.properties 挂进容器，禁止打进镜像
      - ./config:/app/config:ro
      - ./logs:/app/logs
    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy

  mysql:
    image: mysql:8.0
    container_name: iam-mysql
    restart: unless-stopped
    command: --character-set-server=utf8mb4 --collation-server=utf8mb4_general_ci
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?MySQL root 密码必须设置}
      MYSQL_DATABASE: ${DB_NAME:-iam}
      MYSQL_USER: ${DB_USERNAME:-iam}
      MYSQL_PASSWORD: ${DB_PASSWORD:?数据库密码必须设置}
      TZ: Asia/Shanghai
    volumes:
      - iam-mysql-data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      interval: 10s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7-alpine
    container_name: iam-redis
    restart: unless-stopped
    command: >
      sh -c 'if [ -n "$$REDIS_PASSWORD" ]; then
               exec redis-server --appendonly yes --requirepass "$$REDIS_PASSWORD";
             else
               exec redis-server --appendonly yes;
             fi'
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
    volumes:
      - iam-redis-data:/data
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ${REDIS_PASSWORD:+-a $REDIS_PASSWORD} ping | grep PONG"]
      interval: 10s
      timeout: 5s
      retries: 10

volumes:
  iam-mysql-data:
  iam-redis-data: