docker-compose.deploy.yml

services:
  mongo-perms:
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/mongodb/mongodb-community-server:8.0.13-ubuntu2204
    restart: "no"
    user: "0:0"
    networks:
      - aigame
    volumes:
      - ${APP_DATA_DIR:-./data}:/work-data
    # 清空 data/ 后自动准备 Mongo 数据目录与 keyfile，并修正权限。
    entrypoint:
      - bash
      - -lc
      - |
        set -euo pipefail

        mkdir -p /work-data/mongo

        if [ -d /work-data/mongodb.key ]; then
          rmdir /work-data/mongodb.key 2>/dev/null || {
            echo '错误：data/mongodb.key 当前是非空目录，请先移除后重试。' >&2
            exit 1
          }
        fi

        if [ ! -f /work-data/mongodb.key ]; then
          python3 -c "from pathlib import Path; import base64, os; path = Path('/work-data/mongodb.key'); path.parent.mkdir(parents=True, exist_ok=True); path.write_text(base64.b64encode(os.urandom(756)).decode() + '\n', encoding='utf-8')"
        fi

        MONGO_UID="$(id -u mongodb)"
        MONGO_GID="$(id -g mongodb)"
        chown -R "$${MONGO_UID}:$${MONGO_GID}" /work-data/mongo
        chown "$${MONGO_UID}:$${MONGO_GID}" /work-data/mongodb.key
        chmod 400 /work-data/mongodb.key

  mongo:
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/mongodb/mongodb-community-server:8.0.13-ubuntu2204
    container_name: mongo
    restart: always
    networks:
      - aigame
    depends_on:
      mongo-perms:
        condition: service_completed_successfully
    ports:
      - '${MONGO_HOST_PORT:-37017}:27017'
    environment:
      - TZ=${TZ:-Asia/Shanghai}
      - MONGODB_INITDB_ROOT_USERNAME=${MONGO_ROOT_USERNAME:-root}
      - MONGODB_INITDB_ROOT_PASSWORD=${MONGO_ROOT_PASSWORD:-password}
    volumes:
      - ${APP_DATA_DIR:-./data}/mongo:/data/db
      - /etc/localtime:/etc/localtime:ro
      - ${APP_DATA_DIR:-./data}/mongodb.key:/etc/mongo/mongodb.key:ro
    command:
      - mongod
      - --replSet
      - ${MONGODB_REPLICA_SET:-rs0}
      - --bind_ip_all
      - --keyFile
      - /etc/mongo/mongodb.key

  mongo-init:
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/mongodb/mongodb-community-server:8.0.13-ubuntu2204
    restart: "no"
    networks:
      - aigame
    depends_on:
      - mongo
    # 自动初始化副本集，确保 deploy 在干净环境中也能直接启动。
    entrypoint:
      - bash
      - -lc
      - |
        set -euo pipefail

        until mongosh --host mongo -u "${MONGO_ROOT_USERNAME:-root}" -p "${MONGO_ROOT_PASSWORD:-password}" --authenticationDatabase admin --quiet --eval 'db.runCommand({ ping: 1 }).ok' | grep -q '^1$'; do
          echo '等待 MongoDB 就绪...'
          sleep 2
        done

        mongosh --host mongo -u "${MONGO_ROOT_USERNAME:-root}" -p "${MONGO_ROOT_PASSWORD:-password}" --authenticationDatabase admin --quiet --eval 'try { rs.status().ok } catch (error) { rs.initiate({ _id: "${MONGODB_REPLICA_SET:-rs0}", members: [{ _id: 0, host: "mongo:27017" }] }) }'

        until mongosh --host mongo -u "${MONGO_ROOT_USERNAME:-root}" -p "${MONGO_ROOT_PASSWORD:-password}" --authenticationDatabase admin --quiet --eval 'rs.status().ok' | grep -q '^1$'; do
          echo '等待 MongoDB 副本集 PRIMARY 就绪...'
          sleep 2
        done

  redis:
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/redis:8.0.3
    container_name: redis
    restart: always
    networks:
      - aigame
    ports:
      - '${REDIS_HOST_PORT:-36379}:6379'
    environment:
      - REDIS_PASSWORD=${REDIS_PASSWORD:-password}
      - TZ=${TZ:-Asia/Shanghai}
    volumes:
      - ${APP_DATA_DIR:-./data}/redis:/data
      - /etc/localtime:/etc/localtime:ro
      - /usr/share/zoneinfo/Asia/Shanghai:/etc/timezone:ro
    command:
      - redis-server
      - --requirepass
      - ${REDIS_PASSWORD:-password}

  minio:
    image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/quay.io/minio/minio:latest
    container_name: minio
    restart: always
    networks:
      - aigame
    ports:
      - '${MINIO_API_HOST_PORT:-39000}:9000'
      - '${MINIO_CONSOLE_HOST_PORT:-39001}:9001'
    environment:
      - MINIO_ROOT_USER=${MINIO_ROOT_USER:-root}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD:-password}
      - TZ=${TZ:-Asia/Shanghai}
    volumes:
      - ${APP_DATA_DIR:-./data}/minio:/data
      - /etc/localtime:/etc/localtime:ro
      - /usr/share/zoneinfo/Asia/Shanghai:/etc/timezone:ro
    command: server /data --console-address ":9001"
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:9000/minio/health/live']
      interval: 30s
      timeout: 20s
      retries: 3

  evaluateapp:
    build:
      context: .
      dockerfile: evaluateapp/docker/evaluateapp.Dockerfile
    container_name: evaluateapp
    restart: always
    networks:
      - aigame
    depends_on:
      - mongo
      - redis
      - minio
    ports:
      - '${EVALUATEAPP_HOST_PORT:-38000}:8000'
    environment:
      - TZ=${TZ:-Asia/Shanghai}
      - WEBAPP_CALLBACK_URL=http://webapp:3000/api/submissions/callback
      # deploy 场景固定使用 Docker 沙箱，避免根目录 `.env` 里的 CHROOT 配置进入容器后失效。
      - SANDBOX_BACKEND=DOCKER
      - DOCKER_IMAGE=self
    env_file:
      - ./.env
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/localtime:/etc/localtime:ro
      - /usr/share/zoneinfo/Asia/Shanghai:/etc/timezone:ro

  webapp:
    build:
      context: ./webapp
      dockerfile: docker/webapp.Dockerfile
    container_name: webapp
    restart: always
    networks:
      - aigame
    depends_on:
      mongo-init:
        condition: service_completed_successfully
      redis:
        condition: service_started
      minio:
        condition: service_started
      evaluateapp:
        condition: service_started
    ports:
      - '${WEBAPP_HOST_PORT:-33000}:3000'
    environment:
      - TZ=${TZ:-Asia/Shanghai}
      - NODE_ENV=production
      - NUXT_PORT=3000
      - MONGODB_URI=mongodb://${MONGO_ROOT_USERNAME:-root}:${MONGO_ROOT_PASSWORD:-password}@mongo:27017/aigame?authSource=admin&replicaSet=${MONGODB_REPLICA_SET:-rs0}
      - REDIS_URL=redis://redis:6379
      - REDIS_PASSWORD=${REDIS_PASSWORD:-password}
      - MINIO_ENDPOINT=minio
      - MINIO_PORT=9000
      - MINIO_ACCESS_KEY=${MINIO_ROOT_USER:-root}
      - MINIO_SECRET_KEY=${MINIO_ROOT_PASSWORD:-password}
      - MINIO_INTERNAL_URL=http://minio:9000
      - MINIO_PUBLIC_URL=http://${PUBLIC_HOST:-localhost}:${MINIO_API_HOST_PORT:-39000}
      - EVALUATE_APP_URL=http://evaluateapp:8000
      - WEBAPP_BASE_URL=http://${PUBLIC_HOST:-localhost}:${WEBAPP_HOST_PORT:-33000}
      - AUTH_ORIGIN=http://${PUBLIC_HOST:-localhost}:${WEBAPP_HOST_PORT:-33000}
      - NUXT_MONGODB_URI=mongodb://${MONGO_ROOT_USERNAME:-root}:${MONGO_ROOT_PASSWORD:-password}@mongo:27017/aigame?authSource=admin&replicaSet=${MONGODB_REPLICA_SET:-rs0}
      - NUXT_REDIS_URL=redis://redis:6379
      - NUXT_REDIS_PASSWORD=${REDIS_PASSWORD:-password}
      - NUXT_MINIO_ENDPOINT=minio
      - NUXT_MINIO_PORT=9000
      - NUXT_MINIO_INTERNAL_URL=http://minio:9000
      - NUXT_MINIO_PUBLIC_URL=http://${PUBLIC_HOST:-localhost}:${MINIO_API_HOST_PORT:-39000}
      - NUXT_EVALUATE_APP_URL=http://evaluateapp:8000
      - NUXT_WEBAPP_BASE_URL=http://${PUBLIC_HOST:-localhost}:${WEBAPP_HOST_PORT:-33000}
      - NUXT_PUBLIC_BASE_URL=http://${PUBLIC_HOST:-localhost}:${WEBAPP_HOST_PORT:-33000}
      - NUXT_PUBLIC_MINIO_PUBLIC_URL=http://${PUBLIC_HOST:-localhost}:${MINIO_API_HOST_PORT:-39000}
    env_file:
      - ./.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /usr/share/zoneinfo/Asia/Shanghai:/etc/timezone:ro

networks:
  aigame: