# 生产/试运行部署:app(单容器:API + worker(io 组)+ worker:agent + web 静态,单端口 4380)+ postgres
# + camofox(浏览器服务,原站视图 / Agent 浏览器能力用;只在内网,不映射端口;挂了不影响 app)。
# 用法(详见 docs/runbook/deploy.md):
#   cp docker/compose.env.example .env.deploy # 按注释生成 SECRET_MASTER_KEY / POSTGRES_PASSWORD
#   docker compose --env-file .env.deploy up -d --build
#   docker compose logs app | grep -i setup  # 首次启动打印一次性 setup token
# 开发只起数据库用 docker-compose.dev.yml。
# 不要自带浏览器:.env.deploy 里 CAMOFOX_REPLICAS=0 + BROWSER_ENABLED=false;接自有 camofox:改 BROWSER_PROVIDER_URL
# (见 docs/runbook/browser.md §1)。
name: umt

x-logging: &logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

services:
  postgres:
    image: postgres:18.6-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873
    restart: unless-stopped
    # 内存参数按 4C/8G 机器给 PG 3G 设定(CACHE-2);机器不同按 docs/runbook/storage.md「PG 参数」调整,
    # 改 .env 里的 PG_* 后 docker compose up -d postgres 重建生效
    command:
      - postgres
      - -c
      - shared_buffers=${PG_SHARED_BUFFERS:-2GB}
      - -c
      - effective_cache_size=${PG_EFFECTIVE_CACHE_SIZE:-5GB}
      - -c
      - work_mem=${PG_WORK_MEM:-32MB}
      - -c
      - maintenance_work_mem=${PG_MAINTENANCE_WORK_MEM:-256MB}
      - -c
      - max_wal_size=${PG_MAX_WAL_SIZE:-2GB}
      # 库(约 200 MB)整个在 shared_buffers / 页缓存里,随机读不比顺序读贵多少;缺省 4 是机械盘的估值
      - -c
      - random_page_cost=${PG_RANDOM_PAGE_COST:-1.1}
      # 语句统计(运行状态页「数据库语句统计」);改了要重建 postgres 容器才生效,见 docs/runbook/storage.md
      - -c
      - shared_preload_libraries=pg_stat_statements
      - -c
      - pg_stat_statements.track=top
    mem_limit: ${PG_MEM_LIMIT:-3g}
    deploy:
      resources:
        limits:
          memory: ${PG_MEM_LIMIT:-3g}
    # 并行查询的动态共享内存走 /dev/shm,Docker 缺省 64MB 不够
    shm_size: 512mb
    environment:
      POSTGRES_USER: umt
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?请设置 POSTGRES_PASSWORD}
      POSTGRES_DB: umt
    volumes:
      # PG 18 使用新卷;旧 PG 16 卷保留,升级必须先导出/恢复,见 runbook。
      - umt-pg18-data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U umt -d umt"]
      interval: 5s
      timeout: 3s
      retries: 20
    stop_grace_period: 30s
    logging: *logging

  # 浏览器服务:camofox-browser(jo-inc v1.18.0,commit f94c81b)。缺省镜像 = 浏览器桌面(docker/browser-desktop:
  # linuxserver baseimage-selkies Wayland 桌面 + 有头 camofox,原站视图"桌面模式"看到的就是 Agent 驱动的同一个 Firefox);
  # 它从固定镜像 camofox-browser:1.18.0(docker/camofox)复制 camofox,所以要先构建该镜像(见 docs/runbook/browser.md §1.1、§8)。
  # 切换纯截图镜像:CAMOFOX_IMAGE=camofox-browser:1.18.0(同一个卷,登录状态通用;原站视图自动回退截图模式)。
  # 端口一律不映射:9377(camofox API)与 3000(Selkies)只给 app;桌面画面只经 app 的 /api/v1/browser/desktop/* 反代。
  camofox:
    build:
      context: docker/browser-desktop
      args:
        APT_MIRROR: ${APT_MIRROR:-}
        APT_HTTPS_PROXY: ${APT_HTTPS_PROXY:-}
    image: ${CAMOFOX_IMAGE:-umt-browser-desktop:1.18.0}
    restart: unless-stopped
    deploy:
      # 0 = 不起浏览器服务(同时设 BROWSER_ENABLED=false)
      replicas: ${CAMOFOX_REPLICAS:-1}
    environment:
      CAMOFOX_PORT: "9377"
      # 设置后除 /health 外全部接口要求 Authorization: Bearer <key>;app 用同一个值。
      # 桌面镜像还用它派生 Selkies 的控制 / 只读口令(app 用同一算法注入),不设则桌面模式不可用
      CAMOFOX_ACCESS_KEY: ${CAMOFOX_ACCESS_KEY:-}
      # 登录状态(cookies + localStorage)按 userId 存这里,随卷持久化(两个镜像同一路径)
      CAMOFOX_PROFILE_DIR: /root/.camofox/profiles
      # 上游缺省把崩溃报告发到它的中继服务;这里关掉
      CAMOFOX_CRASH_REPORT_ENABLED: "false"
      # 不装缺省扩展(uBlock Origin):每次启动浏览器都要从 addons.mozilla.org 下载,内网 / 国内网络下失败重试拖慢启动
      CAMOFOX_DISABLE_DEFAULT_ADDONS: "true"
      # 无请求多久回收会话(回收时落盘登录状态,下次打开恢复)/ 浏览器空闲多久退出(省内存,下次请求再启动)
      SESSION_TIMEOUT_MS: ${CAMOFOX_SESSION_TIMEOUT_MS:-1800000}
      BROWSER_IDLE_TIMEOUT_MS: ${CAMOFOX_BROWSER_IDLE_TIMEOUT_MS:-300000}
      MAX_SESSIONS: ${CAMOFOX_MAX_SESSIONS:-8}
      CAMOFOX_LOCALE: ${CAMOFOX_LOCALE:-}
      CAMOFOX_TIMEZONE: ${CAMOFOX_TIMEZONE:-}
      # ── 以下只对桌面镜像生效(旧镜像忽略)──
      TZ: ${TZ:-Asia/Shanghai}
      # 桌面里浏览器进程的运行用户(登录状态目录启动时 chown 给它)
      PUID: ${CAMOFOX_PUID:-1000}
      PGID: ${CAMOFOX_PGID:-1000}
      TITLE: 原站视图
      # 分辨率锁定(浏览器窗口最大化铺满,无标题栏);DPI 锁 96 保证 DPR = 1
      SELKIES_MANUAL_WIDTH: ${BROWSER_DESKTOP_WIDTH:-1280}
      SELKIES_MANUAL_HEIGHT: ${BROWSER_DESKTOP_HEIGHT:-900}
      SELKIES_SCALING_DPI: "96|locked"
      # 纯 CPU 编码:帧率上限 30;有 GPU 时挂 /dev/dri 自动启用硬编
      SELKIES_FRAMERATE: ${BROWSER_DESKTOP_FRAMERATE:-24,8-30}
      # 只允许文本剪贴板;音频、麦克风、摄像头、手柄、文件传输、打印、命令、共享一律关闭
      SELKIES_ENABLE_BINARY_CLIPBOARD: "false|locked"
      SELKIES_AUDIO_ENABLED: "false|locked"
      SELKIES_MICROPHONE_ENABLED: "false|locked"
      SELKIES_WEBCAM_ENABLED: "false|locked"
      SELKIES_GAMEPAD_ENABLED: "false|locked"
      SELKIES_FILE_TRANSFERS: ""
      SELKIES_PRINTING_ENABLED: "false|locked"
      SELKIES_COMMAND_ENABLED: "false|locked"
      SELKIES_ENABLE_SHARING: "false|locked"
      SELKIES_UI_SIDEBAR_SHOW_FILES: "false"
      SELKIES_UI_SIDEBAR_SHOW_APPS: "false"
      SELKIES_UI_SIDEBAR_SHOW_SHARING: "false"
      SELKIES_UI_SIDEBAR_SHOW_GAMEPADS: "false"
      SELKIES_UI_SIDEBAR_SHOW_WEBCAM: "false"
      SELKIES_UI_SIDEBAR_SHOW_AUDIO_SETTINGS: "false"
      # 容器内输入法(备选;缺省用访问者本机输入法):fcitx5 = 启动 fcitx5(拼音 + mozc,Ctrl+Space 切换)
      UMT_DESKTOP_IME: ${BROWSER_DESKTOP_IME:-}
    volumes:
      - umt-camofox:/root/.camofox
    # Firefox 多进程需要较大的 /dev/shm(上游 Makefile 用 2g)
    shm_size: 2gb
    # 桌面镜像另有 labwc + Selkies + nginx 常驻(实测见 runbook §8);纯截图旧镜像 2g 足够
    mem_limit: ${CAMOFOX_MEM_LIMIT:-3g}
    healthcheck:
      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:9377/health"]
      interval: 30s
      timeout: 5s
      start_period: 30s
      retries: 3
    # 桌面镜像由 s6 逐级停止,camofox 关机要落盘登录状态
    stop_grace_period: 30s
    logging: *logging

  # 可选 HTTPS 入口(profile tls):桌面模式的视频解码(WebCodecs)与剪贴板只在 HTTPS(或 localhost)下可用。
  # 已有反代(nginx / Caddy / Traefik)终结 TLS 时不需要它。配置见 docker/browser-desktop/Caddyfile:
  #   TLS_DOMAIN 不设 = 自签(Caddy 内部 CA);TLS_DOMAIN=域名 + TLS_ISSUER=邮箱 = ACME 自动证书
  #   docker compose --profile tls up -d
  caddy:
    image: caddy:2.11.4-alpine@sha256:6aeddd44c3078b0f9a35206472a11420648a79c184603ef95957d0a20044cb2b
    profiles: ["tls"]
    restart: unless-stopped
    depends_on:
      - app
    environment:
      # 空 = https://(任意主机名,自签按需签发)
      TLS_DOMAIN: ${TLS_DOMAIN:-https://}
      TLS_ISSUER: ${TLS_ISSUER:-internal}
    ports:
      - "${TLS_BIND:-0.0.0.0}:${TLS_PORT:-443}:443"
    volumes:
      - ./docker/browser-desktop/Caddyfile:/etc/caddy/Caddyfile:ro
      - umt-caddy:/data
    logging: *logging

  app:
    build:
      context: .
      args:
        APP_VERSION: ${APP_VERSION:-}
        SOURCE_REVISION: ${SOURCE_REVISION:-}
        APT_MIRROR: ${APT_MIRROR:-}
    image: uhd-media-tool:${APP_VERSION:-latest}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      # 只要求已启动,不等健康:浏览器服务挂了 app 照常运行,界面标"浏览器不可用"
      camofox:
        condition: service_started
        required: false
    environment:
      NODE_ENV: production
      DATABASE_URL: postgres://umt:${POSTGRES_PASSWORD}@postgres:5432/umt
      SECRET_MASTER_KEY: ${SECRET_MASTER_KEY:?请设置 SECRET_MASTER_KEY(openssl rand -hex 32)}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      # 运行用户:DATA_DIR 由 entrypoint chown 成它;媒体库/下载目录需对它可读写
      PUID: ${PUID:-10001}
      PGID: ${PGID:-10001}
      BACKUP_KEEP: ${BACKUP_KEEP:-14}
      # worker 并发:io 组(文件 / 网络 / 维护三条道)与 agent 组(runAgent/resolveDecision)分池
      # io worker 三条道的并发(WK-1):不设 = 用 设置 → 自动化 → 高级 里的值(缺省 文件 2 / 网络 4 / 维护 1);
      # 设了就以环境变量为准。旧 WORKER_CONCURRENCY 映射到网络道。
      WORKER_CONCURRENCY: ${WORKER_CONCURRENCY:-}
      WORKER_FILE_CONCURRENCY: ${WORKER_FILE_CONCURRENCY:-}
      WORKER_NETWORK_CONCURRENCY: ${WORKER_NETWORK_CONCURRENCY:-}
      WORKER_MAINTENANCE_CONCURRENCY: ${WORKER_MAINTENANCE_CONCURRENCY:-}
      WORKER_AGENT_CONCURRENCY: ${WORKER_AGENT_CONCURRENCY:-2}
      # 手动按路径整理时递归遍历的文件数上限
      ORGANIZE_WALK_MAX_FILES: ${ORGANIZE_WALK_MAX_FILES:-5000}
      # 浏览器服务:缺省指向上面的 camofox;接自有实例改成它的地址与访问凭据;false = 停用
      BROWSER_PROVIDER_URL: ${BROWSER_PROVIDER_URL:-http://camofox:9377}
      BROWSER_ACCESS_KEY: ${BROWSER_ACCESS_KEY:-${CAMOFOX_ACCESS_KEY:-}}
      BROWSER_ENABLED: ${BROWSER_ENABLED:-true}
      # 桌面接管 / 人工接管 / 智能体正在用的会话每隔多久保活一次(camofox 标签页空闲 5 分钟回收);0 = 关闭
      BROWSER_KEEPALIVE_MS: ${BROWSER_KEEPALIVE_MS:-120000}
      # 原站视图桌面模式的上游(桌面镜像的 Selkies);缺省由 BROWSER_PROVIDER_URL 推出(端口换 3000)
      BROWSER_DESKTOP_URL: ${BROWSER_DESKTOP_URL:-}
      # 出站代理(HTTP_PROXY/HTTPS_PROXY)在 override 里给(见 docs/runbook/deploy.md「容器经宿主代理」)。
      # Deno 按主机名匹配 NO_PROXY、不会因解析到内网 IP 而直连:同 compose 网络的服务名(postgres、camofox、
      # 下载器 qbittorrent 等)必须列在这里,否则连下载器也会绕到代理上失败。自有下载器服务名不同就改 UMT_NO_PROXY。
      NO_PROXY: ${UMT_NO_PROXY:-localhost,127.0.0.1,::1,postgres,camofox,proxy-relay,qbittorrent,qbittorrent-nox,qb,transmission,deluge,aria2,alist,openlist,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}
    ports:
      - "${UMT_BIND:-0.0.0.0}:${UMT_PORT:-4380}:4380"
    volumes:
      # 应用数据:agent-sessions/ backups/ exports/ tmp/
      - umt-data:/data
      # 媒体库根与下载缓存目录按需挂载(容器内路径 = 控制台里登记的库根 / 路径映射 local 前缀):
      # - /srv/media:/media
      # - /srv/downloads:/downloads
    stop_grace_period: 15s
    logging: *logging

volumes:
  umt-pg18-data:
  umt-data:
  umt-camofox:
  umt-caddy:

networks:
  # 固定网段(属于 172.16.0.0/12),便于宿主防火墙按网段放行容器到宿主的代理/中继端口
  default:
    ipam:
      config:
        - subnet: ${UMT_SUBNET:-172.30.0.0/24}