name: pi-durable-assistant

services:
  pi-durable-assistant:
    build: .
    image: pi-durable-assistant:local
    container_name: pi-durable-assistant
    # 进程崩溃后自动拉起，这是“断点恢复”演示的一半
    restart: unless-stopped
    env_file: .env
    # 只绑本机回环；对外请用 nginx 等反向代理，并设置 DEMO_PASSWORD
    ports:
      - "127.0.0.1:${HOST_PORT:-3300}:3000"
    volumes:
      - pi-durable-assistant-data:/data
    mem_limit: 1g
    cpus: 1.0
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true

  # 需要微信时启用 profile；与 Node 共用网络命名空间，
  # wx-bot 仍然只监听 127.0.0.1:18790，不开放额外宿主机端口。
  wx-bot:
    profiles: ["wechat"]
    # 上游官方镜像；原先的构建补丁已全部合入 wx-bot v0.2.0–v0.3.0（见 issue #8）。
    image: ghcr.io/lawrencewzen/wx-bot:0.4.0
    restart: unless-stopped
    env_file: .env
    depends_on:
      - pi-durable-assistant
    network_mode: "service:pi-durable-assistant"
    volumes:
      - ./deploy/wechat/config.json:/etc/wx-bot/config.json:ro
      - wx-bot-state:/state
      - wx-bot-media:/media
    read_only: true
    tmpfs:
      - /tmp
    mem_limit: 256m
    cpus: 0.5
    security_opt:
      - no-new-privileges:true

volumes:
  wx-bot-state:
  wx-bot-media:
  pi-durable-assistant-data: