docker-compose.yml

# RTC Agent — 满配 Docker 部署（分布式验证 + 完整可观测性）
# 用途：本地开发主力环境，替代 etc/dev/docker-compose.yml
# 特性：2 Server + Nginx LB + 全套可观测性（Jaeger/Prometheus/Loki/Grafana/Pyroscope）
# 端口：全部使用 2xxxx 段，与外部服务不冲突

name: rtc-agent-full

services:
  # ===========================================================================
  # 基础设施
  # ===========================================================================

  postgres:
    image: pgvector/pgvector:pg17
    container_name: rtc-full-postgres
    environment:
      POSTGRES_USER: rtc_agent
      POSTGRES_PASSWORD: rtc_agent
      POSTGRES_DB: rtc_agent
    ports:
      - "25432:5432"
    volumes:
      - full-postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U rtc_agent"]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: rtc-full-redis
    ports:
      - "26379:6379"
    volumes:
      - full-redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped

  minio:
    build:
      context: .
      dockerfile: Dockerfile.minio
      args:
        MINIO_VERSION: RELEASE.2025-10-15T17-29-55Z
    container_name: rtc-full-minio
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: "${MINIO_ACCESS_KEY:-minioadmin}"
      MINIO_ROOT_PASSWORD: "${MINIO_SECRET_KEY:-minioadmin}"
      # Prometheus metrics 公开访问（无需认证），Prometheus scrape 需要
      MINIO_PROMETHEUS_AUTH_TYPE: "public"
    ports:
      - "29000:9000"   # S3 API
      - "29001:9001"   # MinIO Console
    volumes:
      - full-minio-data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped

  # ===========================================================================
  # 可观测性栈（复用 etc/dev/ 配置）
  # ===========================================================================

  jaeger:
    image: jaegertracing/all-in-one:1.55
    container_name: rtc-full-jaeger
    environment:
      - COLLECTOR_OTLP_ENABLED=true
    ports:
      - "26686:16686"  # Jaeger UI
      - "24317:4317"   # OTLP gRPC
      - "24318:4318"   # OTLP HTTP
    restart: unless-stopped

  prometheus:
    image: prom/prometheus:v2.53.0
    container_name: rtc-full-prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.retention.time=7d"
      - "--web.enable-lifecycle"
    ports:
      - "29090:9090"
    volumes:
      - ./etc/dev/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./etc/dev/prometheus/alerts.yml:/etc/prometheus/alerts.yml:ro
      - full-prometheus-data:/prometheus
    restart: unless-stopped

  loki:
    image: grafana/loki:3.1.0
    container_name: rtc-full-loki
    command: -config.file=/etc/loki/local-config.yaml
    ports:
      - "23100:3100"
    volumes:
      - full-loki-data:/loki
    restart: unless-stopped

  promtail:
    image: grafana/promtail:3.1.0
    container_name: rtc-full-promtail
    command: -config.file=/etc/promtail/config.yml
    volumes:
      - ./etc/dev/promtail/promtail.yml:/etc/promtail/config.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - full-promtail-positions:/tmp
    depends_on:
      - loki
    restart: unless-stopped

  pyroscope:
    image: grafana/pyroscope:1.9.1
    container_name: rtc-full-pyroscope
    command:
      - "server"
      - "--storage.path=/var/lib/pyroscope"
    ports:
      - "24040:4040"
    volumes:
      - full-pyroscope-data:/var/lib/pyroscope
    restart: unless-stopped

  grafana:
    image: grafana/grafana:11.1.0
    container_name: rtc-full-grafana
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=admin
      - GF_USERS_ALLOW_SIGN_UP=false
      # 禁用自带鉴权，允许 Admin Server 通过 iframe 嵌入访问
      - GF_AUTH_ANONYMOUS_ENABLED=true
      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
      - GF_AUTH_BASIC_ENABLED=false
      - GF_AUTH_DISABLE_LOGIN_FORM=true
      # 反向代理子路径配置（Admin Server 在 /api/grafana 反代 Grafana）
      - GF_SERVER_ROOT_URL=http://localhost:8000/api/grafana
      - GF_SERVER_SERVE_FROM_SUB_PATH=true
      # 允许 iframe 嵌入及 CSRF 信任源（dev proxy 和 admin server）
      - GF_SECURITY_ALLOW_EMBEDDING=true
      - GF_SECURITY_CSRF_TRUSTED_ORIGINS=http://localhost:8000,http://localhost:28081
      - GF_SECURITY_CSRF_ENABLED=false
      # 允许的来源（Grafana 11.x origin 检查）
      - GF_SERVER_ALLOWED_ORIGINS=http://localhost:8000 http://localhost:28081
    ports:
      - "23001:3000"
    volumes:
      - ./etc/dev/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources:ro
      - ./etc/dev/grafana/provisioning/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./etc/dev/grafana/dashboards:/var/lib/grafana/dashboards:ro
      - full-grafana-data:/var/lib/grafana
    depends_on:
      - prometheus
      - loki
      - pyroscope
    restart: unless-stopped

  alertmanager:
    image: prom/alertmanager:v0.27.0
    container_name: rtc-full-alertmanager
    command:
      - "--config.file=/etc/alertmanager/alertmanager.yml"
      - "--storage.path=/alertmanager"
    ports:
      - "29093:9093"
    volumes:
      - ./etc/dev/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
      - full-alertmanager-data:/alertmanager
    restart: unless-stopped

  # ===========================================================================
  # OAuth2
  # ===========================================================================

  mock-oauth2:
    build:
      context: .
      dockerfile: Dockerfile.mock-oauth2
    container_name: rtc-full-mock-oauth2
    ports:
      - "20060:10060"
    restart: unless-stopped

  # ===========================================================================
  # 数据库迁移（一次性容器，server 启动前执行）
  # ===========================================================================

  migrate:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: rtc-full-migrate
    entrypoint: ["./rtc-agent", "migrate"]
    volumes:
      - ./etc/config.docker.yaml:/app/etc/config.yaml:ro
    depends_on:
      postgres:
        condition: service_healthy
    restart: "no"

  # ===========================================================================
  # Admin Server（后台管理系统）
  # ===========================================================================

  admin-server:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: rtc-full-admin-server
    command: ["./rtc-agent", "admin", "serve"]
    env_file:
      - .env
    environment:
      DEBUG__ENABLED: "true"
    expose:
      - "8081"
    ports:
      - "28081:8081"
    volumes:
      - ./etc/admin.docker.yaml:/app/etc/admin.yaml:ro
      - full-admin-server-keys:/app/etc/keys  # JWT 密钥对（自动生成）
    depends_on:
      migrate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: unless-stopped

  # ===========================================================================
  # Server 集群（2 实例，验证分布式部署）
  # ===========================================================================

  server-1:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: rtc-full-server-1
    env_file:
      - .env
    environment:
      DEBUG__ENABLED: "true"
      LLM__API_KEY: "${LLM__API_KEY}"
      AUTH__JWT_SECRET: "${AUTH__JWT_SECRET}"
      MINIO_ACCESS_KEY: "${MINIO_ACCESS_KEY}"
      MINIO_SECRET_KEY: "${MINIO_SECRET_KEY}"
      STORAGE__ENCRYPTION__SESSION_TOKEN_KEY: "${OSS3_SESSION_TOKEN_KEY:-}"
    expose:
      - "8888"
    volumes:
      - ./etc/config.docker.yaml:/app/etc/config.yaml:ro
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
      jaeger:
        condition: service_started
      mock-oauth2:
        condition: service_started
    restart: unless-stopped

  server-2:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: rtc-full-server-2
    env_file:
      - .env
    environment:
      DEBUG__ENABLED: "true"
      LLM__API_KEY: "${LLM__API_KEY}"
      AUTH__JWT_SECRET: "${AUTH__JWT_SECRET}"
      MINIO_ACCESS_KEY: "${MINIO_ACCESS_KEY}"
      MINIO_SECRET_KEY: "${MINIO_SECRET_KEY}"
      STORAGE__ENCRYPTION__SESSION_TOKEN_KEY: "${OSS3_SESSION_TOKEN_KEY:-}"
    expose:
      - "8888"
    volumes:
      - ./etc/config.docker.yaml:/app/etc/config.yaml:ro
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
      jaeger:
        condition: service_started
      mock-oauth2:
        condition: service_started
    restart: unless-stopped

  # ===========================================================================
  # 负载均衡
  # ===========================================================================

  nginx:
    image: nginx:1.27-alpine
    container_name: rtc-full-nginx
    ports:
      - "28080:80"
    volumes:
      - ./etc/dev/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - server-1
      - server-2
    restart: unless-stopped

volumes:
  full-postgres-data:
  full-redis-data:
  full-minio-data:
  full-prometheus-data:
  full-loki-data:
  full-pyroscope-data:
  full-grafana-data:
  full-alertmanager-data:
  full-promtail-positions:
  full-admin-server-keys: