bid-doctor/deploy/compose/compose.yaml

# 本地开发与 SaaS 内测期的编排（T4）。
#   只起依赖：  docker compose -f deploy/compose/compose.yaml up -d postgres valkey gotenberg ocr
#   全部起来：  docker compose -f deploy/compose/compose.yaml --profile app up -d --build
# 端口只绑 127.0.0.1；生产环境的密钥从环境变量注入，不写在这里。
name: bid-doctor

services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: bd_owner
      POSTGRES_PASSWORD: ${BD_PG_OWNER_PASSWORD:-dev-owner}
      POSTGRES_DB: bid_doctor
      BD_APP_PASSWORD: ${BD_PG_APP_PASSWORD:-dev-app}
      BD_OPS_PASSWORD: ${BD_PG_OPS_PASSWORD:-dev-ops}
    ports: ["127.0.0.1:${BD_PG_PORT:-54329}:5432"]
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./postgres/init-roles.sh:/docker-entrypoint-initdb.d/10-roles.sh:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U bd_owner -d bid_doctor"]
      interval: 2s
      retries: 30

  valkey:
    image: valkey/valkey:8-alpine
    command: ["valkey-server", "--save", "", "--appendonly", "no"]   # 只存丢了也没关系的数据（AR4）
    ports: ["127.0.0.1:${BD_VALKEY_PORT:-63799}:6379"]
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 2s
      retries: 30

  gotenberg:
    image: gotenberg/gotenberg:8
    command:
      - gotenberg
      - --api-timeout=240s
      - --libreoffice-restart-after=50
    # 转换服务不应访问外网（架构 §3.5）。本地开发要从宿主机访问它，所以放在默认网络；
    # 生产编排（Helm / 生产 compose）用网络策略禁止它的出口流量。
    ports: ["127.0.0.1:${BD_GOTENBERG_PORT:-3109}:3000"]

  # OCR 服务（vision-plan §4.2）：worker 把扫描页、插图发过来，返回文字行和坐标。模型在镜像里，不需要外网
  ocr:
    image: bid-doctor-ocr
    build: { context: ../.., dockerfile: deploy/docker/ocr.Dockerfile }
    ports: ["127.0.0.1:${BD_OCR_PORT:-8029}:8000"]

  migrate:
    profiles: [app]
    image: bid-doctor-server
    build: { context: ../.., dockerfile: deploy/docker/server.Dockerfile }
    command: ["bid-doctor", "migrate"]
    env_file: [{ path: ../../.env, required: false }]
    environment:
      BD_MIGRATE_DATABASE_URL: postgresql+psycopg://bd_owner:${BD_PG_OWNER_PASSWORD:-dev-owner}@postgres:5432/bid_doctor
    depends_on:
      postgres: { condition: service_healthy }

  api:
    profiles: [app]
    image: bid-doctor-server
    command: ["bid-doctor", "api", "--host", "0.0.0.0", "--port", "8000"]
    env_file: [{ path: ../../.env, required: false }]
    environment: &app-env
      BD_DATABASE_URL: postgresql+psycopg://bd_app:${BD_PG_APP_PASSWORD:-dev-app}@postgres:5432/bid_doctor
      BD_MIGRATE_DATABASE_URL: postgresql+psycopg://bd_owner:${BD_PG_OWNER_PASSWORD:-dev-owner}@postgres:5432/bid_doctor
      BD_VALKEY_URL: redis://valkey:6379/0
      BD_GOTENBERG_URL: http://gotenberg:3000
      BD_OCR_PROVIDER: http
      BD_OCR_URL: http://ocr:8000
      BD_STORAGE_DIR: /data/objects
    ports: ["127.0.0.1:${BD_API_PORT:-8009}:8000"]
    volumes: [objects:/data/objects]
    depends_on:
      migrate: { condition: service_completed_successfully }
      valkey: { condition: service_healthy }

  # 运营后台接口（决策 M6-2）：同一镜像的第三种进程，只绑本机回环；IP 白名单放行本机经 Docker 网桥进来的请求
  ops:
    profiles: [app]
    image: bid-doctor-server
    command: ["bid-doctor", "ops", "--host", "0.0.0.0", "--port", "8000"]
    env_file: [{ path: ../../.env, required: false }]
    environment:
      <<: *app-env
      BD_OPS_DATABASE_URL: postgresql+psycopg://bd_ops:${BD_PG_OPS_PASSWORD:-dev-ops}@postgres:5432/bid_doctor
      BD_OPS_ALLOWED_IPS: '["127.0.0.1/32", "172.16.0.0/12"]'
    ports: ["127.0.0.1:${BD_OPS_PORT:-8019}:8000"]
    depends_on:
      migrate: { condition: service_completed_successfully }
      valkey: { condition: service_healthy }

  worker:
    profiles: [app]
    image: bid-doctor-server
    command: ["bid-doctor", "worker"]
    env_file: [{ path: ../../.env, required: false }]
    environment: *app-env
    volumes: [objects:/data/objects]
    depends_on:
      migrate: { condition: service_completed_successfully }
      valkey: { condition: service_healthy }
      ocr: { condition: service_healthy }

volumes:
  pgdata: {}
  objects: {}