docker-compose.yml

services:
  web:
    # 国内请使用：swr.cn-north-4.myhuaweicloud.com/ddn-k8s/ghcr.io/zhongruan0522/antihub-web:latest
    # image: ghcr.io/${IMAGE_OWNER:-zhongruan0522}/antihub-web:${IMAGE_TAG:-latest}
    build: ./AntiHub
    image: antihub-web:local
    container_name: antihub-web
    environment:
      NODE_ENV: production
      # Cookie 协议（影响 Set-Cookie 的 Secure 属性）：默认 HTTPS；用 IP 直连（HTTP）时改成 HTTP
      COOKIE_HTTP: ${COOKIE_HTTP:-HTTPS}
      # 可选：覆盖 web 容器内部访问 backend 的地址（容器内通常用 http://antihub-backend:8000）
      BACKEND_INTERNAL_URL: ${BACKEND_INTERNAL_URL:-}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      - backend
    ports:
      - "${WEB_PORT:-3000}:3000"
    restart: unless-stopped

  backend:
    # 国内请使用：swr.cn-north-4.myhuaweicloud.com/ddn-k8s/ghcr.io/zhongruan0522/antihub-backend:latest
    # image: ghcr.io/${IMAGE_OWNER:-zhongruan0522}/antihub-backend:${IMAGE_TAG:-latest}
    build: ./AntiHub-Backend
    image: antihub-backend:local
    container_name: antihub-backend
    command: ["sh", "-c", "alembic upgrade heads && exec uvicorn app.main:app --host 0.0.0.0 --port 8000"]
    environment:
      APP_ENV: production
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      DEBUG_LOG: ${DEBUG_LOG:-false}
      USAGE_LOG_REDACT_HEADERS: ${USAGE_LOG_REDACT_HEADERS:-true}

      # 外部依赖（由你自己提供/维护）
      DATABASE_URL: ${DATABASE_URL:-postgresql+asyncpg://${POSTGRES_USER:-antihub}:${POSTGRES_PASSWORD:-please-change-me}@postgres:5432/${POSTGRES_DB:-antihub}}

      # Redis：默认使用 compose 自带 redis；如你有现成的 Redis，可在 .env 里覆盖
      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}

      # Codex（可选）
      CODEX_SUPPORTED_MODELS: ${CODEX_SUPPORTED_MODELS:-}
      CODEX_API_BASE_URL: ${CODEX_API_BASE_URL:-https://chatgpt.com/backend-api/codex}
      CODEX_PROXY_URL: ${CODEX_PROXY_URL:-}

      # Kiro（可选）
      KIRO_IDE_VERSION: ${KIRO_IDE_VERSION:-0.9.2}
      KIRO_PROXY_URL: ${KIRO_PROXY_URL:-}

      # Antigravity OAuth（可选）
      ANTIGRAVITY_OAUTH_CLIENT_ID: ${ANTIGRAVITY_OAUTH_CLIENT_ID:-1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com}
      ANTIGRAVITY_OAUTH_CLIENT_SECRET: ${ANTIGRAVITY_OAUTH_CLIENT_SECRET:-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}
      ANTIGRAVITY_OAUTH_REDIRECT_URI: ${ANTIGRAVITY_OAUTH_REDIRECT_URI:-http://localhost:51121/oauth-callback}
      ANTIGRAVITY_OAUTH_SCOPE: ${ANTIGRAVITY_OAUTH_SCOPE:-https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/cclog https://www.googleapis.com/auth/experimentsandconfigs}

      # Gemini CLI OAuth（可选）
      GEMINI_CLI_OAUTH_CLIENT_ID: ${GEMINI_CLI_OAUTH_CLIENT_ID:-681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com}
      GEMINI_CLI_OAUTH_CLIENT_SECRET: ${GEMINI_CLI_OAUTH_CLIENT_SECRET:-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}
      GEMINI_CLI_OAUTH_REDIRECT_URI: ${GEMINI_CLI_OAUTH_REDIRECT_URI:-http://localhost:8085/oauth2callback}
      GEMINI_CLI_OAUTH_SCOPE: ${GEMINI_CLI_OAUTH_SCOPE:-https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile}

      # 加密密钥（用于存储各类上游凭证/Key；必须是 Fernet key）
      PLUGIN_API_ENCRYPTION_KEY: ${PLUGIN_API_ENCRYPTION_KEY}

      # 旧 plugin DB 自动迁移（可选）
      # - 新部署：保持 PLUGIN_API_BASE_URL 为空即可（不会触发迁移判断）
      # - 升级/迁移：指向 “Env Exporter” 服务（容器内通常为 http://plugin-env:8045）
      PLUGIN_API_BASE_URL: ${PLUGIN_API_BASE_URL:-}
      PLUGIN_ENV_EXPORT_TOKEN: ${PLUGIN_ENV_EXPORT_TOKEN:-}
      # 兼容：如你已有旧部署的 PLUGIN_ADMIN_API_KEY，也可复用作为迁移助手鉴权 Token
      PLUGIN_ADMIN_API_KEY: ${PLUGIN_ADMIN_API_KEY:-}

      # 需要你自己配置的密钥/回调（外部可见）
      JWT_SECRET_KEY: ${JWT_SECRET_KEY}
      JWT_ALGORITHM: HS256
      JWT_EXPIRE_HOURS: ${JWT_EXPIRE_HOURS:-24}
      REFRESH_TOKEN_EXPIRE_DAYS: ${REFRESH_TOKEN_EXPIRE_DAYS:-7}

      # ZAI TTS（可选）
      ZAI_TTS_BASE_URL: ${ZAI_TTS_BASE_URL:-https://audio.z.ai}
      # 非流式音频文件最多保留数量（容器重启会清空 storage/tts）
      ZAI_TTS_FILE_KEEP_COUNT: ${ZAI_TTS_FILE_KEEP_COUNT:-10}

      # 管理员账号配置（首次启动时自动创建）
      # ZAI Image (optional)
      ZAI_IMAGE_BASE_URL: ${ZAI_IMAGE_BASE_URL:-https://image.z.ai}
      ZAI_IMAGE_USER_AGENT: ${ZAI_IMAGE_USER_AGENT:-}

      ADMIN_USERNAME: ${ADMIN_USERNAME:-}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}

    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    ports:
      - "127.0.0.1:${BACKEND_PORT:-8000}:8000"
    restart: unless-stopped

  postgres:
    image: postgres:18.1-alpine
    container_name: antihub-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-antihub}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-please-change-me}
      POSTGRES_DB: ${POSTGRES_DB:-antihub}
    ports:
      - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
    volumes:
      - antihub_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-antihub} -d ${POSTGRES_DB:-antihub}"]
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: antihub-redis
    command: redis-server --appendonly yes
    volumes:
      - antihub_redis_data:/data
    restart: unless-stopped

volumes:
  antihub_redis_data:
  antihub_postgres_data: