name: haovp-1panel

x-common-env: &common-env
  TZ: Asia/Shanghai

x-service-env: &service-env
  <<: *common-env
  SPRING_PROFILES_ACTIVE: ha
  NACOS_HOST: nacos
  NACOS_PORT: 8848
  NACOS_USERNAME: ${NACOS_USERNAME:-nacos}
  NACOS_PASSWORD: ${NACOS_PASSWORD:-nacos}
  SPRING_CLOUD_NACOS_DISCOVERY_USERNAME: ${NACOS_USERNAME:-nacos}
  SPRING_CLOUD_NACOS_DISCOVERY_PASSWORD: ${NACOS_PASSWORD:-nacos}
  SPRING_CLOUD_NACOS_CONFIG_USERNAME: ${NACOS_USERNAME:-nacos}
  SPRING_CLOUD_NACOS_CONFIG_PASSWORD: ${NACOS_PASSWORD:-nacos}
  MYSQL_HOST: mysql
  MYSQL_PORT: 3306
  MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
  MYSQL_PASSWORD: ${MYSQL_ROOT_PASSWORD}
  REDIS_PASSWORD: ${REDIS_PASSWORD}
  REDIS_SENTINEL_NODES: redis-sentinel:26379
  SERVICE_AUTH_TOKEN: ${SERVICE_AUTH_TOKEN}
  JWT_EXPIRATION: ${JWT_EXPIRATION:-86400}
  SENTINEL_DASHBOARD_HOST: sentinel
  SENTINEL_DASHBOARD_PORT: 8080

x-backend-build: &backend-build
  context: .
  dockerfile: Dockerfile.service.1panel

services:
  mysql:
    image: mysql:8.0
    container_name: haovp-mysql
    restart: unless-stopped
    environment:
      <<: *common-env
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: video_platform
      MYSQL_USER: ${MYSQL_APP_USER:-video}
      MYSQL_PASSWORD: ${MYSQL_APP_PASSWORD}
    volumes:
      - mysql_data:/var/lib/mysql
      - ./sql/init.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
      - ./sql/nacos-schema.sql:/docker-entrypoint-initdb.d/02-nacos-schema.sql:ro
      - ./sql/03-nacos-config-init.sh:/docker-entrypoint-initdb.d/03-nacos-config-init.sh:ro
      - ./sql/nacos-config-init.sql:/init-sql/nacos-config-init.sql:ro
    command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci --default-authentication-plugin=mysql_native_password
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-uroot", "-p${MYSQL_ROOT_PASSWORD}"]
      interval: 10s
      timeout: 5s
      retries: 15
    networks:
      - haovp-network

  redis:
    image: redis:7.0-alpine
    container_name: haovp-redis
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD} --appendonly yes
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - haovp-network

  redis-sentinel:
    image: redis:7.0-alpine
    container_name: haovp-redis-sentinel
    restart: unless-stopped
    volumes:
      - redis_sentinel_data:/data
      - ./config/redis/sentinel-single.conf:/usr/local/etc/redis/sentinel.conf:ro
    command: sh -c "sed \"s/__REDIS_PASSWORD__/${REDIS_PASSWORD}/g\" /usr/local/etc/redis/sentinel.conf > /data/sentinel.conf && redis-sentinel /data/sentinel.conf"
    depends_on:
      redis:
        condition: service_healthy
    networks:
      - haovp-network

  nacos:
    image: nacos/nacos-server:v2.3.2
    container_name: haovp-nacos
    restart: unless-stopped
    environment:
      <<: *common-env
      MODE: standalone
      SPRING_DATASOURCE_PLATFORM: mysql
      MYSQL_SERVICE_HOST: mysql
      MYSQL_SERVICE_PORT: 3306
      MYSQL_SERVICE_DB_NAME: nacos_config
      MYSQL_SERVICE_USER: root
      MYSQL_SERVICE_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      MYSQL_SERVICE_DB_PARAM: characterEncoding=utf8&connectTimeout=10000&socketTimeout=30000&autoReconnect=true&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
      JVM_XMS: ${NACOS_JVM_XMS:-512m}
      JVM_XMX: ${NACOS_JVM_XMX:-512m}
      NACOS_AUTH_ENABLE: "true"
      NACOS_AUTH_TOKEN: ${NACOS_AUTH_TOKEN}
      NACOS_AUTH_IDENTITY_KEY: serverIdentity
      NACOS_AUTH_IDENTITY_VALUE: security
      PREFER_HOST_MODE: hostname
    ports:
      - "${LOCAL_BIND_ADDR:-127.0.0.1}:${NACOS_HTTP_PORT:-8848}:8848"
    depends_on:
      mysql:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8848/nacos/v1/console/health/liveness"]
      interval: 10s
      timeout: 5s
      retries: 15
    networks:
      - haovp-network

  rmqnamesrv:
    image: apache/rocketmq:5.1.4
    container_name: haovp-rmqnamesrv
    restart: unless-stopped
    command: sh mqnamesrv
    healthcheck:
      test: ["CMD-SHELL", "pgrep -f 'NamesrvStartup' || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 15
      start_period: 30s
    networks:
      - haovp-network

  rmqbroker:
    image: apache/rocketmq:5.1.4
    container_name: haovp-rmqbroker
    user: root
    restart: unless-stopped
    environment:
      NAMESRV_ADDR: rmqnamesrv:9876
      JAVA_OPTS: -Duser.home=/opt
    volumes:
      - ./config/rocketmq/broker-1panel.conf:/home/rocketmq/rocketmq-5.1.4/conf/broker.conf:ro
      - rmqbroker_logs:/home/rocketmq/logs
      - rmqbroker_store:/home/rocketmq/store
    command: sh mqbroker -c /home/rocketmq/rocketmq-5.1.4/conf/broker.conf
    depends_on:
      rmqnamesrv:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "pgrep -f 'BrokerStartup' || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 15
      start_period: 30s
    networks:
      - haovp-network

  minio:
    image: quay.io/minio/minio
    container_name: haovp-minio
    restart: unless-stopped
    environment:
      <<: *common-env
      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY}
      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY}
    volumes:
      - minio_data:/data
    command: server /data --console-address ":9001"
    ports:
      - "${LOCAL_BIND_ADDR:-127.0.0.1}:${MINIO_API_PORT:-9100}:9000"
      - "${LOCAL_BIND_ADDR:-127.0.0.1}:${MINIO_CONSOLE_PORT:-9101}:9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - haovp-network

  minio-init:
    image: minio/mc
    container_name: haovp-minio-init
    restart: "no"
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      mc alias set local http://minio:9000 '${MINIO_ACCESS_KEY}' '${MINIO_SECRET_KEY}' &&
      mc mb --ignore-existing local/${MINIO_BUCKET:-video-platform} &&
      mc anonymous set download local/${MINIO_BUCKET:-video-platform}
      "
    networks:
      - haovp-network

  sentinel:
    build:
      context: ./sentinel-dashboard
      dockerfile: Dockerfile
    container_name: haovp-sentinel
    restart: unless-stopped
    environment:
      <<: *common-env
      SERVER_PORT: 8080
    ports:
      - "${LOCAL_BIND_ADDR:-127.0.0.1}:${SENTINEL_HTTP_PORT:-8880}:8080"
    networks:
      - haovp-network

  video-gateway:
    build:
      <<: *backend-build
      args:
        MODULE: video-gateway
        JAR_PREFIX: video-gateway
    container_name: haovp-video-gateway
    restart: unless-stopped
    environment:
      <<: *service-env
      JWT_SECRET: ${USER_JWT_SECRET}
      USER_JWT_SECRET: ${USER_JWT_SECRET}
      GATEWAY_IGNORE_URLS: /**/auth/login,/**/auth/register,/**/auth/captcha,/**/auth/refresh,/auth/username/**,/content/video/public/**,/content/category/tree,/content/category/list,/content/tag/list,/content/tag/page,/content/danmaku/all/**,/content/danmaku/time,/content/stat/**,/user/profile/public/**,/user/profile/search,/user/follow/following/**,/user/follow/followers/**,/comment/reply/public/**,/comment/public/**,/recommend/home,/recommend/hot/**,/recommend/similar/**,/recommend/tag/**,/admin/auth/captcha,/admin/auth/login
      JAVA_OPTS: ${GATEWAY_JAVA_OPTS:--Xms128m -Xmx256m}
    ports:
      - "${LOCAL_BIND_ADDR:-127.0.0.1}:${GATEWAY_HTTP_PORT:-9000}:9000"
    depends_on:
      nacos:
        condition: service_healthy
      redis-sentinel:
        condition: service_started
    networks:
      - haovp-network

  video-auth:
    build:
      <<: *backend-build
      args:
        MODULE: video-auth
        JAR_PREFIX: video-auth
    container_name: haovp-video-auth
    restart: unless-stopped
    environment:
      <<: *service-env
      JWT_SECRET: ${USER_JWT_SECRET}
      USER_JWT_SECRET: ${USER_JWT_SECRET}
      JAVA_OPTS: ${AUTH_JAVA_OPTS:--Xms128m -Xmx256m}
    depends_on:
      nacos:
        condition: service_healthy
      mysql:
        condition: service_healthy
      redis-sentinel:
        condition: service_started
    networks:
      - haovp-network

  video-user:
    build:
      <<: *backend-build
      args:
        MODULE: video-user
        JAR_PREFIX: video-user
    container_name: haovp-video-user
    restart: unless-stopped
    environment:
      <<: *service-env
      MINIO_HOST: minio
      MINIO_PORT: 9000
      MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY}
      MINIO_SECRET_KEY: ${MINIO_SECRET_KEY}
      MINIO_BUCKET: ${MINIO_BUCKET:-video-platform}
      JWT_SECRET: ${USER_JWT_SECRET}
      USER_JWT_SECRET: ${USER_JWT_SECRET}
      JAVA_OPTS: ${USER_JAVA_OPTS:--Xms128m -Xmx256m}
    depends_on:
      nacos:
        condition: service_healthy
      mysql:
        condition: service_healthy
      redis-sentinel:
        condition: service_started
      minio:
        condition: service_healthy
    networks:
      - haovp-network

  video-content:
    build:
      <<: *backend-build
      args:
        MODULE: video-content
        JAR_PREFIX: video-content
        INSTALL_FFMPEG: "true"
    container_name: haovp-video-content
    restart: unless-stopped
    environment:
      <<: *service-env
      NAMESRV_ADDR: rmqnamesrv:9876
      ROCKETMQ_HOST: rmqnamesrv
      ROCKETMQ_PORT: 9876
      MINIO_HOST: minio
      MINIO_PORT: 9000
      MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY}
      MINIO_SECRET_KEY: ${MINIO_SECRET_KEY}
      MINIO_BUCKET: ${MINIO_BUCKET:-video-platform}
      JWT_SECRET: ${USER_JWT_SECRET}
      USER_JWT_SECRET: ${USER_JWT_SECRET}
      JAVA_OPTS: ${CONTENT_JAVA_OPTS:--Xms256m -Xmx512m}
    depends_on:
      nacos:
        condition: service_healthy
      mysql:
        condition: service_healthy
      redis-sentinel:
        condition: service_started
      rmqbroker:
        condition: service_healthy
      minio:
        condition: service_healthy
    networks:
      - haovp-network

  video-comment:
    build:
      <<: *backend-build
      args:
        MODULE: video-comment
        JAR_PREFIX: video-comment
    container_name: haovp-video-comment
    restart: unless-stopped
    environment:
      <<: *service-env
      JWT_SECRET: ${USER_JWT_SECRET}
      USER_JWT_SECRET: ${USER_JWT_SECRET}
      JAVA_OPTS: ${COMMENT_JAVA_OPTS:--Xms128m -Xmx256m}
    depends_on:
      nacos:
        condition: service_healthy
      mysql:
        condition: service_healthy
      redis-sentinel:
        condition: service_started
    networks:
      - haovp-network

  video-recommend:
    build:
      <<: *backend-build
      args:
        MODULE: video-recommend
        JAR_PREFIX: video-recommend
    container_name: haovp-video-recommend
    restart: unless-stopped
    environment:
      <<: *service-env
      JWT_SECRET: ${USER_JWT_SECRET}
      USER_JWT_SECRET: ${USER_JWT_SECRET}
      JAVA_OPTS: ${RECOMMEND_JAVA_OPTS:--Xms128m -Xmx256m}
    depends_on:
      nacos:
        condition: service_healthy
      mysql:
        condition: service_healthy
      redis-sentinel:
        condition: service_started
    networks:
      - haovp-network

  video-admin:
    build:
      <<: *backend-build
      args:
        MODULE: video-admin
        JAR_PREFIX: video-admin
    container_name: haovp-video-admin
    restart: unless-stopped
    environment:
      <<: *service-env
      JWT_SECRET: ${ADMIN_JWT_SECRET}
      ADMIN_JWT_SECRET: ${ADMIN_JWT_SECRET}
      ADMIN_INIT_PASSWORD: ${ADMIN_INIT_PASSWORD}
      APP_INIT_ADMIN_PASSWORD: ${ADMIN_INIT_PASSWORD}
      JAVA_OPTS: ${ADMIN_JAVA_OPTS:--Xms128m -Xmx256m}
    depends_on:
      nacos:
        condition: service_healthy
      mysql:
        condition: service_healthy
      redis-sentinel:
        condition: service_started
    networks:
      - haovp-network

  frontend-web:
    build:
      context: ../frontend/video-frontend-web
      dockerfile: Dockerfile.1panel
      args:
        VITE_API_BASE_URL: /api
        VITE_MEDIA_BASE_URL: /media/video-platform
    container_name: haovp-frontend-web
    restart: unless-stopped
    ports:
      - "${FRONTEND_BIND_ADDR:-127.0.0.1}:${WEB_HTTP_PORT:-18080}:80"
    depends_on:
      - video-gateway
      - minio
    networks:
      - haovp-network

  frontend-admin:
    build:
      context: ../frontend/video-frontend-admin
      dockerfile: Dockerfile.1panel
      args:
        VITE_API_BASE_URL: /api/admin
        VITE_MEDIA_BASE_URL: /media/video-platform
    container_name: haovp-frontend-admin
    restart: unless-stopped
    ports:
      - "${FRONTEND_BIND_ADDR:-127.0.0.1}:${ADMIN_HTTP_PORT:-18081}:80"
    depends_on:
      - video-gateway
      - minio
    networks:
      - haovp-network

  prometheus:
    image: prom/prometheus:v2.54.1
    container_name: haovp-prometheus
    restart: unless-stopped
    profiles:
      - monitoring
    ports:
      - "${LOCAL_BIND_ADDR:-127.0.0.1}:${PROMETHEUS_HTTP_PORT:-9090}:9090"
    volumes:
      - ./monitoring/prometheus/prometheus.local.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=15d
    networks:
      - haovp-network

  grafana:
    image: grafana/grafana:11.2.0
    container_name: haovp-grafana
    restart: unless-stopped
    profiles:
      - monitoring
    ports:
      - "${LOCAL_BIND_ADDR:-127.0.0.1}:${GRAFANA_HTTP_PORT:-3000}:3000"
    environment:
      <<: *common-env
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD}
      GF_USERS_ALLOW_SIGN_UP: "false"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
    depends_on:
      - prometheus
    networks:
      - haovp-network

  mysqld-exporter:
    image: prom/mysqld-exporter:v0.16.0
    container_name: haovp-mysqld-exporter
    restart: unless-stopped
    profiles:
      - monitoring
    environment:
      MYSQLD_EXPORTER_PASSWORD: ${MYSQL_ROOT_PASSWORD}
    command:
      - --mysqld.address=mysql:3306
      - --mysqld.username=root
    depends_on:
      mysql:
        condition: service_healthy
    networks:
      - haovp-network

  redis-exporter:
    image: oliver006/redis_exporter:v1.62.0
    container_name: haovp-redis-exporter
    restart: unless-stopped
    profiles:
      - monitoring
    environment:
      REDIS_ADDR: redis://redis:6379
      REDIS_PASSWORD: ${REDIS_PASSWORD}
    depends_on:
      redis:
        condition: service_healthy
    networks:
      - haovp-network

  node-exporter:
    image: prom/node-exporter:v1.8.2
    container_name: haovp-node-exporter
    restart: unless-stopped
    profiles:
      - monitoring
    command:
      - --path.procfs=/host/proc
      - --path.sysfs=/host/sys
      - --path.rootfs=/rootfs
      - --collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    networks:
      - haovp-network

networks:
  haovp-network:
    driver: bridge

volumes:
  mysql_data:
  redis_data:
  redis_sentinel_data:
  minio_data:
  rmqbroker_logs:
  rmqbroker_store:
  prometheus_data:
  grafana_data: