ctms/docker-compose.yaml

services:
  db:
    image: postgres:15-alpine
    pull_policy: if_not_present
    container_name: ctms_db
    restart: always
    environment:
      POSTGRES_USER: ctms_user
      POSTGRES_PASSWORD: secret_password
      POSTGRES_DB: ctms_db
    volumes:
      # 持久化数据到 Linux 本地，防止重启丢失
      - ./pg_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ctms_user -d ctms_db"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - ctms_net

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
      pull: false
    container_name: ctms_backend
    restart: always
    environment:
      DATABASE_URL: postgresql+asyncpg://ctms_user:secret_password@db/ctms_db
      ENV: ${ENV:-development}
      JWT_SECRET_KEY: ${JWT_SECRET_KEY:-dev-secret}
      FRONTEND_PUBLIC_URL: ${FRONTEND_PUBLIC_URL:-http://localhost:8888}
      LOGIN_RSA_PRIVATE_KEY: ${LOGIN_RSA_PRIVATE_KEY:-}
      LOGIN_RSA_KEY_ID: ${LOGIN_RSA_KEY_ID:-default}
      MONITORING_ACCESS_LOG_RETENTION_DAYS: ${MONITORING_ACCESS_LOG_RETENTION_DAYS:-90}
      MONITORING_METRIC_RETENTION_DAYS: ${MONITORING_METRIC_RETENTION_DAYS:-400}
      MONITORING_RETENTION_INTERVAL_SECONDS: ${MONITORING_RETENTION_INTERVAL_SECONDS:-86400}
      USER_LOGIN_ACTIVITY_RETENTION_DAYS: ${USER_LOGIN_ACTIVITY_RETENTION_DAYS:-180}
      USER_SESSION_ONLINE_SECONDS: ${USER_SESSION_ONLINE_SECONDS:-300}
      TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-127.0.0.1/32,::1/128,172.16.0.0/12,192.168.0.0/16}
      MONITORING_SERVER_PUBLIC_IP: ${MONITORING_SERVER_PUBLIC_IP:-}
      MONITORING_PUBLIC_IP_DISCOVERY_URLS: ${MONITORING_PUBLIC_IP_DISCOVERY_URLS:-https://api64.ipify.org,https://icanhazip.com}
      MONITORING_IP_GEO_FALLBACK_ENABLED: ${MONITORING_IP_GEO_FALLBACK_ENABLED:-true}
      MONITORING_IP_GEO_FALLBACK_API_KEY: ${MONITORING_IP_GEO_FALLBACK_API_KEY:-}
      MONITORING_IP_GEO_FALLBACK_TIMEOUT_SECONDS: ${MONITORING_IP_GEO_FALLBACK_TIMEOUT_SECONDS:-2.5}
      MONITORING_IP_GEO_FALLBACK_CACHE_SECONDS: ${MONITORING_IP_GEO_FALLBACK_CACHE_SECONDS:-604800}
      MONITORING_IP_GEO_FALLBACK_MAX_LOOKUPS: ${MONITORING_IP_GEO_FALLBACK_MAX_LOOKUPS:-10}
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/readyz', timeout=2).read()
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 20s
    networks:
      - ctms_net

  backend-init:
    build:
      context: ./backend
      dockerfile: Dockerfile
      pull: false
    command: python scripts/init_production.py
    environment:
      DATABASE_URL: postgresql+asyncpg://ctms_user:secret_password@db/ctms_db
      ENV: ${ENV:-development}
      JWT_SECRET_KEY: ${JWT_SECRET_KEY:-dev-secret}
      FRONTEND_PUBLIC_URL: ${FRONTEND_PUBLIC_URL:-http://localhost:8888}
      LOGIN_RSA_PRIVATE_KEY: ${LOGIN_RSA_PRIVATE_KEY:-}
      LOGIN_RSA_KEY_ID: ${LOGIN_RSA_KEY_ID:-default}
    depends_on:
      db:
        condition: service_healthy
    profiles: ["init"]
    networks:
      - ctms_net

  nginx:
    build:
      context: .
      dockerfile: nginx/Dockerfile
      pull: false
      args:
        NPM_CONFIG_REGISTRY: ${NPM_CONFIG_REGISTRY:-https://registry.npmmirror.com}
        VITE_RUNTIME_ENV: ${ENV:-production}
        VITE_ALLOW_INSECURE_DEV_LOGIN: ${VITE_ALLOW_INSECURE_DEV_LOGIN:-false}
    container_name: ctms_nginx
    restart: always
    ports:
      - "8888:80"
    volumes:
      - ./nginx/certs:/etc/nginx/certs:ro
      - ./frontend/public/favicon.ico:/usr/share/nginx/html/favicon.ico:ro
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - ctms_net

networks:
  ctms_net:
    driver: bridge