x-logging: &default-logging
  driver: json-file
  options:
    max-size: "${DOCKER_LOG_MAX_SIZE:-20m}"
    max-file: "${DOCKER_LOG_MAX_FILES:-3}"

services:
  web:
    build:
      context: .
      dockerfile: Dockerfile.web
    container_name: ${COMPOSE_PROJECT_NAME:-ios_headers}_web
    restart: unless-stopped
    env_file:
      - .env
    environment:
      CLICKHOUSE_HOST: clickhouse
      CLICKHOUSE_NATIVE_PORT: 9000
      REDIS_HOST: redis
      REDIS_PORT: 6379
      MINIO_ENDPOINT: minio:9000
      MINIO_SECURE: "false"
    depends_on:
      clickhouse:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8080/healthz', timeout=3)"]
      interval: 10s
      timeout: 5s
      retries: 20
      start_period: 20s
    mem_limit: 256m
    mem_reservation: 160m
    logging: *default-logging

  nginx:
    image: nginx:1.27-alpine
    container_name: ${COMPOSE_PROJECT_NAME:-ios_headers}_nginx
    restart: unless-stopped
    ports:
      - "${WEB_PORT:-18080}:80"
    entrypoint:
      - /bin/sh
      - -ec
    command:
      - |
        hex="$(awk '$$2=="00000000" {print $$3; exit}' /proc/net/route)"
        if [ -n "$$hex" ] && [ "$${#hex}" -eq 8 ]; then
          o1=$$((16#$$(echo "$$hex" | cut -c7-8)))
          o2=$$((16#$$(echo "$$hex" | cut -c5-6)))
          o3=$$((16#$$(echo "$$hex" | cut -c3-4)))
          o4=$$((16#$$(echo "$$hex" | cut -c1-2)))
          export LOCAL_DEBUG_TRUSTED_ADDR="$$o1.$$o2.$$o3.$$o4"
        fi
        exec /docker-entrypoint.sh nginx -g 'daemon off;'
    environment:
      CDN_ORIGIN_VERIFY_SECRET: ${CDN_ORIGIN_VERIFY_SECRET:-}
      NGINX_ENVSUBST_FILTER: CDN_ORIGIN_VERIFY_SECRET|LOCAL_DEBUG_TRUSTED_ADDR
    volumes:
      - ./nginx/site.conf:/etc/nginx/templates/default.conf.template:ro
      - ./webroot:/webroot:ro
    depends_on:
      web:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost/healthz"]
      interval: 10s
      timeout: 5s
      retries: 20
      start_period: 10s
    mem_limit: 128m
    mem_reservation: 64m
    logging: *default-logging

  frpc:
    image: ghcr.io/fatedier/frpc:v0.61.2
    container_name: ${COMPOSE_PROJECT_NAME:-ios_headers}_frpc
    profiles: ["tunnel"]
    restart: on-failure
    depends_on:
      nginx:
        condition: service_healthy
    environment:
      FRP_SERVER_ADDR: ${FRP_SERVER_ADDR:-}
      FRP_SERVER_PORT: ${FRP_SERVER_PORT:-7000}
      FRP_TOKEN: ${FRP_TOKEN:-}
      FRP_PROXY_NAME: ${FRP_PROXY_NAME:-ios-headers-web}
      FRP_REMOTE_PORT: ${FRP_REMOTE_PORT:-18080}
    entrypoint:
      - /bin/sh
      - -ec
    command:
      - |
        if [ -z "$$FRP_SERVER_ADDR" ]; then
          echo "FRP_SERVER_ADDR is empty; frpc disabled"
          exit 0
        fi
        [ -n "$$FRP_TOKEN" ] || { echo "FRP_TOKEN is required"; exit 1; }
        cat >/tmp/frpc.toml <<EOF
        serverAddr = "$$FRP_SERVER_ADDR"
        serverPort = $${FRP_SERVER_PORT}
        auth.method = "token"
        auth.token = "$$FRP_TOKEN"

        [[proxies]]
        name = "$$FRP_PROXY_NAME"
        type = "tcp"
        localIP = "nginx"
        localPort = 80
        remotePort = $${FRP_REMOTE_PORT}
        EOF
        exec frpc -c /tmp/frpc.toml
    logging: *default-logging

  clickhouse:
    image: clickhouse/clickhouse-server:24.8
    container_name: ${COMPOSE_PROJECT_NAME:-ios_headers}_clickhouse
    restart: unless-stopped
    environment:
      CLICKHOUSE_DB: ${CLICKHOUSE_DB:-ios_headers}
      CLICKHOUSE_USER: ${CLICKHOUSE_USER:-default}
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-}
    volumes:
      - ${STACK_DATA_DIR:-./data}/clickhouse:/var/lib/clickhouse
      - ./clickhouse/init:/docker-entrypoint-initdb.d
      - ./clickhouse/config.d/named_collections.xml:/etc/clickhouse-server/config.d/named_collections.xml:ro
      - ./clickhouse/config.d/system_logs.xml:/etc/clickhouse-server/config.d/system_logs.xml:ro
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    healthcheck:
      test: ["CMD", "clickhouse-client", "--query", "SELECT 1"]
      interval: 10s
      timeout: 5s
      retries: 20
      start_period: 20s
    mem_limit: 4096m
    mem_reservation: 1792m
    logging: *default-logging

  redis:
    image: redis:7-alpine
    container_name: ${COMPOSE_PROJECT_NAME:-ios_headers}_redis
    restart: unless-stopped
    command:
      [
        "redis-server",
        "--appendonly",
        "${REDIS_APPENDONLY:-no}",
        "--maxmemory",
        "${REDIS_MAXMEMORY:-384mb}",
        "--maxmemory-policy",
        "${REDIS_MAXMEMORY_POLICY:-allkeys-lru}",
      ]
    volumes:
      - ${STACK_DATA_DIR:-./data}/redis:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 20
    mem_limit: 128m
    mem_reservation: 96m
    logging: *default-logging

  minio:
    image: minio/minio:latest
    container_name: ${COMPOSE_PROJECT_NAME:-ios_headers}_minio
    restart: unless-stopped
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
      MINIO_BROWSER: "off"
    command: server /data
    volumes:
      - ${STACK_DATA_DIR:-./data}/minio:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 10s
      timeout: 5s
      retries: 20
    mem_limit: 320m
    mem_reservation: 192m
    logging: *default-logging

networks:
  default:
    name: ${COMPOSE_PROJECT_NAME:-ios_headers}_net