version: '3.8'

# 凭据一律通过 Portainer / 环境变量注入，不再写入本文件。
# 注意：此前提交到 Git 的数据库口令与 JWT 密钥已视为泄漏，必须轮换后再使用。
# JWT_SECRET 至少要 32 个字符，缺失时服务会拒绝启动（src/server/config.ts）。

services:
  ln-bi:
    image: harbor.lnh2e.com/lingniu-v1/ln-bi:main-1.2.0
    network_mode: host
    environment:
      NODE_ENV: "production"
      # 生产必须保持为 0：该开关会绕过全部认证。
      DEV_BYPASS_AUTH: "0"
      DB_HOST: "${DB_HOST:?请注入主业务库地址}"
      DB_PORT: "${DB_PORT:-3306}"
      DB_USER: "${DB_USER:?请注入主业务库只读账号}"
      DB_PASSWORD: "${DB_PASSWORD:?请注入主业务库口令}"
      DB_NAME: "${DB_NAME:-ln_asset_management}"
      # 氢能库未配置时复用主库，因此默认不再单独注入；如需独立只读库再配置。
      HYDROGEN_DB_HOST: "${HYDROGEN_DB_HOST:-}"
      HYDROGEN_DB_PORT: "${HYDROGEN_DB_PORT:-3306}"
      HYDROGEN_DB_USER: "${HYDROGEN_DB_USER:-}"
      HYDROGEN_DB_PASSWORD: "${HYDROGEN_DB_PASSWORD:-}"
      HYDROGEN_DB_NAME: "${HYDROGEN_DB_NAME:-}"
      HYDROGEN_TENANT_ID: "${HYDROGEN_TENANT_ID:-000000}"
      # ECS production accesses OneOS over the private network. Configure the key
      # as a Portainer stack environment variable; never commit it to this file.
      ONEOS_MILEAGE_API_BASE_URL: "${ONEOS_MILEAGE_API_BASE_URL:-http://172.17.111.55:20310}"
      ONEOS_MILEAGE_API_KEY: "${ONEOS_MILEAGE_API_KEY}"
      ONEOS_MILEAGE_API_TIMEOUT_MS: "${ONEOS_MILEAGE_API_TIMEOUT_MS:-20000}"
      SERVER_PORT: "8111"
      EXTERNAL_API_BASE: "https://lnh2e.com"
      BI_AUTH_MODE: "${BI_AUTH_MODE:-sso}"
      BI_AUTH_PASSWORD: "${BI_AUTH_PASSWORD:-}"
      JWT_SECRET: "${JWT_SECRET:?请注入至少 32 字符的随机签名密钥}"
      AMAP_WEB_KEY: "${AMAP_WEB_KEY}"
      AMAP_SECURITY_JS_CODE: "${AMAP_SECURITY_JS_CODE}"
      HEATMAP_DB_HOST: "${HEATMAP_DB_HOST}"
      HEATMAP_DB_PORT: "${HEATMAP_DB_PORT:-36453}"
      HEATMAP_DB_USER: "${HEATMAP_DB_USER}"
      HEATMAP_DB_PASSWORD: "${HEATMAP_DB_PASSWORD}"
      HEATMAP_DB_NAME: "${HEATMAP_DB_NAME:-lingniu_vehicle_data}"
      HEATMAP_DB_SSL: "${HEATMAP_DB_SSL:-false}"
      # 用户反馈截图上传所需；此前缺失会导致反馈上传必然失败。
      OSS_REGION: "${OSS_REGION}"
      OSS_ENDPOINT: "${OSS_ENDPOINT}"
      OSS_BUCKET: "${OSS_BUCKET}"
      OSS_ACCESS_KEY_ID: "${OSS_ACCESS_KEY_ID}"
      OSS_ACCESS_KEY_SECRET: "${OSS_ACCESS_KEY_SECRET}"
      OSS_BASE_DIR: "${OSS_BASE_DIR}"
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
      placement:
        constraints: [node.role == manager]
      labels:
        - portainer.hide=false
        - project=lingniu