compose.yaml

services:
  postgresql:
    image: pgvector/pgvector:pg17
    container_name: mortise-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      TZ: ${TZ}
    healthcheck:
      test: [ 'CMD-SHELL', 'pg_isready -U ${POSTGRES_USER}' ]
      interval: 5s
      timeout: 5s
      retries: 5
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    volumes:
      - ./app/postgresql/data:/var/lib/postgresql/data
      - ./app/postgresql/logs:/var/log/postgresql
      - ./config/postgresql.conf:/etc/postgresql/postgresql.conf:ro
      - ./config/pg_hba.conf:/etc/postgresql/pg_hba.conf:ro
    command:
      - "postgres"
      - "-c"
      - "config_file=/etc/postgresql/postgresql.conf"
    networks:
      - mortise-net

  redis:
    image: 'redis:7.0.8'
    container_name: mortise-redis
    restart: unless-stopped
    sysctls:
      - net.core.somaxconn=1024
    healthcheck:
      test: [ 'CMD', 'redis-cli', '-a', '${REDIS_PASSWORD}', 'ping' ]
      interval: 5s
      timeout: 5s
      retries: 5
    ports:
      - "${REDIS_PORT:-6379}:6379"
    volumes:
      - ./app/redis:/data
    command:
      - /bin/sh
      - -c
      - redis-server --requirepass ${REDIS_PASSWORD} --appendonly yes
    environment:
      TZ: ${TZ}
    networks:
      - mortise-net

  logto:
    image: svhd/logto:1.24.1
    container_name: mortise-logto
    restart: unless-stopped
    ports:
      - '${LOGTO_PORT:-3001}:3001'
      - '${LOGTO_ADMIN_PORT:-3002}:3002'
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      INTEGRATION_TEST: ${LOGTO_INTEGRATION_TEST}
      TRUST_PROXY_HEADER: ${LOGTO_TRUST_PROXY_HEADER}
      DB_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@mortise-postgres:5432/${LOGTO_DB_NAME}
      ENDPOINT: ${LOGTO_ENDPOINT}
      ADMIN_ENDPOINT: ${LOGTO_ADMIN_ENDPOINT}
      # 自签名证书需要配置 NODE_EXTRA_CA_CERTS
      NODE_EXTRA_CA_CERTS: /usr/local/share/ca-certificates/logto-rootCA.crt
    # 自签名证书需要挂载到容器中
    volumes:
      - ./config/rootCA.pem:/usr/local/share/ca-certificates/logto-rootCA.crt:ro
    extra_hosts:
      # 将域名映射到宿主机 IP
      - "${LOGTO_AUTH_HOST}:${LOGTO_HOST_IP}"
      - "${LOGTO_ADMIN_HOST}:${LOGTO_HOST_IP}"
    entrypoint: ['sh', '-c', 'npm run cli db seed -- --swe && npm start']
    networks:
      - mortise-net

  rustfs-perms:
    image: busybox:1.36
    container_name: mortise-rustfs-perms
    command:
      - /bin/sh
      - -c
      - mkdir -p /data /logs && chown -R 10001:10001 /data /logs
    volumes:
      - ./app/rustfs/data:/data
      - ./app/rustfs/logs:/logs
    restart: "no"
    networks:
      - mortise-net

  rustfs:
    image: rustfs/rustfs:latest
    container_name: mortise-rustfs
    restart: unless-stopped
    depends_on:
      rustfs-perms:
        condition: service_completed_successfully
    ports:
      - '${RUSTFS_PORT:-9000}:9000'
      - '${RUSTFS_CONSOLE_PORT:-9001}:9001'
    environment:
      TZ: ${TZ}
      RUSTFS_CONSOLE_ENABLE: 'true'
      RUSTFS_CONSOLE_ADDRESS: ':9001'
      RUSTFS_ACCESS_KEY: ${RUSTFS_ACCESS_KEY}
      RUSTFS_SECRET_KEY: ${RUSTFS_SECRET_KEY}
      RUSTFS_OBS_LOG_DIRECTORY: /logs
    volumes:
      - ./app/rustfs/data:/data
      - ./app/rustfs/logs:/logs
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:9000/health >/dev/null 2>&1 && wget -qO- http://localhost:9001/rustfs/console/health >/dev/null 2>&1 || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 30
    command: ["--access-key","${RUSTFS_ACCESS_KEY}","--secret-key","${RUSTFS_SECRET_KEY}","/data"]
    networks:
      - mortise-net

  rustfs-init:
    image: minio/mc:latest
    container_name: mortise-rustfs-init
    depends_on:
      rustfs:
        condition: service_healthy
    volumes:
      - ./config/bucket.config.json:/bucket.config.json:ro
    entrypoint: /bin/sh
    command: -c '
        set -eux;
        mc alias set rustfs "http://rustfs:9000" "${RUSTFS_ACCESS_KEY}" "${RUSTFS_SECRET_KEY}";
        mc mb "rustfs/${RUSTFS_BUCKET:-mortise}" --ignore-existing;
        mc anonymous set-json "/bucket.config.json" "rustfs/${RUSTFS_BUCKET:-mortise}" || true;
      '
    restart: "no"
    networks:
      - mortise-net

  nginx:
    image: 'nginx:latest'
    container_name: mortise-nginx
    restart: unless-stopped
    ports:
      - '${NGINX_HTTP_PORT:-80}:80'
      - '${NGINX_HTTPS_PORT:-443}:443'
    depends_on:
      - logto
    volumes:
      - ./config/nginx/nginx.conf.template:/etc/nginx/nginx.conf.template:ro
      - ./config/nginx/certs:/etc/nginx/certs:ro
    environment:
      TZ: ${TZ}
      BACKEND_HOST: ${BACKEND_HOST}
      BACKEND_PORT: ${BACKEND_PORT}
      FRONTEND_HOST: ${FRONTEND_HOST}
      FRONTEND_PORT: ${FRONTEND_PORT}
    command: >
      /bin/sh -c "envsubst '$$BACKEND_HOST $$BACKEND_PORT $$FRONTEND_HOST $$FRONTEND_PORT'
      < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf
      && nginx -g 'daemon off;'"
    networks:
      - mortise-net

  # ── EMQX MQTT Broker（AIoT 可选，按需启用） ──
  emqx:
    image: emqx/emqx:5.8
    container_name: mortise-emqx
    restart: unless-stopped
    profiles:
      - aiot
    environment:
      TZ: ${TZ}
      EMQX_NAME: mortise
      EMQX_HOST: 0.0.0.0
      # Dashboard 默认账号
      EMQX_DASHBOARD__DEFAULT_USERNAME: ${EMQX_DASHBOARD_USER:-admin}
      EMQX_DASHBOARD__DEFAULT_PASSWORD: ${EMQX_DASHBOARD_PASS:-public}
    ports:
      # MQTT TCP
      - "${EMQX_MQTT_PORT:-1883}:1883"
      # MQTT SSL/TLS
      - "${EMQX_MQTTS_PORT:-8883}:8883"
      # MQTT WebSocket
      - "${EMQX_WS_PORT:-8083}:8083"
      # MQTT WebSocket SSL
      - "${EMQX_WSS_PORT:-8084}:8084"
      # Dashboard & REST API
      - "${EMQX_DASHBOARD_PORT:-18083}:18083"
    volumes:
      - emqx-data:/opt/emqx/data
      - emqx-log:/opt/emqx/log
    healthcheck:
      test: ["CMD", "emqx", "ctl", "status"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - mortise-net

volumes:
  emqx-data:
  emqx-log:

networks:
  mortise-net:
    driver: bridge