name: upstream-ops

services:
  app:
    image: ghcr.io/owen891/routescope:${IMAGE_TAG:-latest}
    restart: unless-stopped
    command: ["-config", "/app/data/config.yaml"]
    environment:
      TZ: Asia/Shanghai
      SERVER_PORT: 8418
      DATABASE_DRIVER: sqlite
      DATABASE_PATH: /app/data/upstream-ops.db
      SERVER_MODE: ${SERVER_MODE:-release}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      APP_SECRET: ${APP_SECRET:?APP_SECRET is required, set it in .env}
      # 鉴权默认关闭。设 AUTH_ENABLED=true 时 ADMIN_PASSWORD 也必须填，否则后端启动失败。
      AUTH_ENABLED: ${AUTH_ENABLED:-true}
      ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
      AUTH_TOKEN_SECRET: ${AUTH_TOKEN_SECRET:-}
      # 飞书控制通道默认关闭。Secret 推荐写入 ./data/secrets 后通过 *_FILE 只读加载。
      FEISHU_ENABLED: ${FEISHU_ENABLED:-false}
      FEISHU_APP_ID: ${FEISHU_APP_ID:-}
      FEISHU_APP_SECRET_FILE: ${FEISHU_APP_SECRET_FILE:-}
      FEISHU_VERIFICATION_TOKEN_FILE: ${FEISHU_VERIFICATION_TOKEN_FILE:-}
      FEISHU_ENCRYPT_KEY_FILE: ${FEISHU_ENCRYPT_KEY_FILE:-}
      FEISHU_CALLBACK_PATH: ${FEISHU_CALLBACK_PATH:-/callbacks/feishu}
      FEISHU_BIND_CODE_TTL_MINUTES: ${FEISHU_BIND_CODE_TTL_MINUTES:-10}
      FEISHU_BIND_CODE_MAX_ATTEMPTS: ${FEISHU_BIND_CODE_MAX_ATTEMPTS:-5}
    ports:
      - "${HTTP_PORT:-8080}:8418"
    volumes:
      - ./data:/app/data
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O- http://localhost:8418/healthz >/dev/null"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 10s