version: "3.8"

services:
  ops-mcp:
    build:
      context: .
      dockerfile: Dockerfile
    image: ops-mcp:latest
    container_name: ops-mcp
    restart: unless-stopped
    ports:
      - "${OPS_MCP_PORT:-8080}:8080"
    environment:
      - OPS_MCP_ENV=${OPS_MCP_ENV:-prod}
      # 数据库密码通过环境变量注入，不写在配置文件里
      - OPS_MCP_DATABASES_MAIN_DB_DSN=postgres://ops_readonly:${DB_PASSWORD}@db:5432/ops?sslmode=disable&default_transaction_read_only=on
      - JWT_SECRET=${JWT_SECRET}
    volumes:
      # 只读挂载 Docker socket，允许查询容器信息但无法执行写操作
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # 挂载自定义配置文件（可选）
      - ./config/prod.yaml:/config/prod.yaml:ro
    # 安全加固
    read_only: true
    tmpfs:
      - /tmp:size=10M,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    # 健康检查
    healthcheck:
      test: ["CMD", "/server", "-env=prod"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  # 可选：本地开发用的 PostgreSQL
  db:
    image: postgres:17-alpine
    container_name: ops-mcp-db
    restart: unless-stopped
    environment:
      - POSTGRES_USER=ops_readonly
      - POSTGRES_PASSWORD=${DB_PASSWORD:-devpassword}
      - POSTGRES_DB=ops
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    profiles:
      - dev
      - full

volumes:
  pgdata: