docker-compose.yml

services:
  postgres:
    image: postgres:16-alpine
    volumes:
      - pg_data:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-nodeskclaw}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-nodeskclaw}
      POSTGRES_DB: ${POSTGRES_DB:-nodeskclaw}
      TZ: ${TZ:-Asia/Shanghai}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-nodeskclaw}"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  nodeskclaw-backend:
    image: nodesk-center-cn-beijing.cr.volces.com/public/nodeskclaw-backend:${DESKCLAW_VERSION}
    build:
      context: .
      dockerfile: nodeskclaw-backend/Dockerfile
      args:
        PIP_INDEX_URL: ${PIP_INDEX_URL:-}
        PIP_TRUSTED_HOST: ${PIP_TRUSTED_HOST:-}
        APT_MIRROR: ${APT_MIRROR:-}
    depends_on:
      postgres:
        condition: service_healthy
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - type: bind
        source: .
        target: /host-config
        read_only: true
      - type: volume
        source: shared_files
        target: /data/shared-files
    environment:
      DATABASE_URL: ${DATABASE_URL:-postgresql+asyncpg://nodeskclaw:nodeskclaw@postgres:5432/nodeskclaw}
      DATABASE_NAME_SUFFIX: ""
      LLM_PROXY_URL: ${LLM_PROXY_URL:-http://localhost:${LLM_PROXY_PORT:-4511}}
      LLM_PROXY_INTERNAL_URL: http://llm-proxy:8080
      LLM_ATTRIBUTION_SECRET: ${LLM_ATTRIBUTION_SECRET:-}
      NODESKCLAW_EDITION: ce
      # 本地共享文件存储目录（S3 未配置时使用，命名卷持久化）
      LOCAL_STORAGE_DIR: /data/shared-files
      # AI 员工回连后端地址，必须为 K8s Pod 可达的外部地址
      AGENT_API_BASE_URL: ${AGENT_API_BASE_URL:-http://localhost:4510/api/v1}
      AGENT_FILE_DOWNLOAD_BASE_URL: ${AGENT_FILE_DOWNLOAD_BASE_URL:-}
      S3_ENDPOINT: ${S3_ENDPOINT:-}
      S3_REGION: ${S3_REGION:-}
      S3_BUCKET: ${S3_BUCKET:-}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-}
      S3_KEY_PREFIX: ${S3_KEY_PREFIX:-}
      UPLOAD_STORAGE_BACKEND: ${UPLOAD_STORAGE_BACKEND:-auto}
      UPLOAD_GATEWAY_PROXY_BODY_SIZE_MB: ${UPLOAD_GATEWAY_PROXY_BODY_SIZE_MB:-50}
      UPLOAD_PROXY_READ_TIMEOUT_SECONDS: ${UPLOAD_PROXY_READ_TIMEOUT_SECONDS:-300}
      UPLOAD_PROXY_SEND_TIMEOUT_SECONDS: ${UPLOAD_PROXY_SEND_TIMEOUT_SECONDS:-300}
      UPLOAD_CHAT_ATTACHMENT_MAX_MB: ${UPLOAD_CHAT_ATTACHMENT_MAX_MB:-20}
      UPLOAD_CHAT_ATTACHMENT_MAX_COUNT: ${UPLOAD_CHAT_ATTACHMENT_MAX_COUNT:-5}
      UPLOAD_CHAT_ATTACHMENT_RETENTION_DAYS: ${UPLOAD_CHAT_ATTACHMENT_RETENTION_DAYS:-90}
      UPLOAD_SHARED_FILE_MAX_MB: ${UPLOAD_SHARED_FILE_MAX_MB:-200}
      UPLOAD_LARGE_FILE_MAX_MB: ${UPLOAD_LARGE_FILE_MAX_MB:-2048}
      UPLOAD_CHUNKED_UPLOAD_THRESHOLD_MB: ${UPLOAD_CHUNKED_UPLOAD_THRESHOLD_MB:-50}
      UPLOAD_CHUNK_SIZE_MB: ${UPLOAD_CHUNK_SIZE_MB:-8}
      UPLOAD_WORKSPACE_QUOTA_MB: ${UPLOAD_WORKSPACE_QUOTA_MB:-10240}
      UPLOAD_BLOCKED_EXTENSIONS: ${UPLOAD_BLOCKED_EXTENSIONS:-.exe,.bat,.cmd,.sh}
      UPLOAD_ALLOWED_CONTENT_TYPES: ${UPLOAD_ALLOWED_CONTENT_TYPES:-}
      UPLOAD_SECURITY_SCAN_MODE: ${UPLOAD_SECURITY_SCAN_MODE:-metadata_only}
      UPLOAD_SCANNER_PROVIDER: ${UPLOAD_SCANNER_PROVIDER:-none}
      UPLOAD_SCANNER_ENDPOINT: ${UPLOAD_SCANNER_ENDPOINT:-}
      UPLOAD_SCANNER_TIMEOUT_SECONDS: ${UPLOAD_SCANNER_TIMEOUT_SECONDS:-60}
      UPLOAD_SCANNER_MAX_RETRIES: ${UPLOAD_SCANNER_MAX_RETRIES:-3}
      UPLOAD_SCANNER_MAX_FILE_MB: ${UPLOAD_SCANNER_MAX_FILE_MB:-2048}
      UPLOAD_SCANNER_FAIL_CLOSED: ${UPLOAD_SCANNER_FAIL_CLOSED:-true}
      DEBUG: ${DEBUG:-true}
      JWT_SECRET: ${JWT_SECRET:-change-me-in-production}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-change-me-32-bytes-base64-key__=}
      INIT_ADMIN_ACCOUNT: ${INIT_ADMIN_ACCOUNT:-admin}
      TZ: ${TZ:-Asia/Shanghai}
    ports:
      - "${BACKEND_PORT:-4510}:8000"
    restart: unless-stopped

  llm-proxy:
    image: nodesk-center-cn-beijing.cr.volces.com/public/nodeskclaw-llm-proxy:${DESKCLAW_VERSION}
    build:
      context: nodeskclaw-llm-proxy
      args:
        PIP_INDEX_URL: ${PIP_INDEX_URL:-}
        PIP_TRUSTED_HOST: ${PIP_TRUSTED_HOST:-}
        NPM_REGISTRY: ${NPM_REGISTRY:-}
        APT_MIRROR: ${APT_MIRROR:-}
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ${CODEX_HOME_DIR:-$HOME/.codex}:/root/.codex
    environment:
      DATABASE_URL: ${DATABASE_URL:-postgresql+asyncpg://nodeskclaw:nodeskclaw@postgres:5432/nodeskclaw}
      LLM_ATTRIBUTION_SECRET: ${LLM_ATTRIBUTION_SECRET:-}
      CODEX_HOME: /root/.codex
      TZ: ${TZ:-Asia/Shanghai}
    ports:
      - "${LLM_PROXY_PORT:-4511}:8080"
    restart: unless-stopped

  portal:
    image: nodesk-center-cn-beijing.cr.volces.com/public/nodeskclaw-portal:${DESKCLAW_VERSION}
    build:
      context: nodeskclaw-portal
      args:
        NPM_REGISTRY: ${NPM_REGISTRY:-}
        ALPINE_MIRROR: ${ALPINE_MIRROR:-}
    depends_on:
      - nodeskclaw-backend
    environment:
      TZ: ${TZ:-Asia/Shanghai}
    ports:
      - "${PORTAL_PORT:-80}:80"
    restart: unless-stopped

volumes:
  pg_data:
  shared_files: