docker-compose.yml

services:
  # ==================== Infrastructure ====================

  mysql:
    image: mysql:8.0
    container_name: mate-mysql
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-matecloud123}
      MYSQL_DATABASE: ${MYSQL_DATABASE:-matecloud}
      MYSQL_USER: ${MYSQL_USER:-matecloud}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-matecloud123}
      TZ: Asia/Shanghai
    ports:
      - "3306:3306"
    volumes:
      - mysql-data:/var/lib/mysql
    command:
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_unicode_ci
      - --default-authentication-plugin=mysql_native_password
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - mate-net

  redis:
    image: redis:7-alpine
    container_name: mate-redis
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD:-matecloud123}
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-matecloud123}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - mate-net

  rabbitmq:
    image: rabbitmq:3.13-management
    container_name: mate-rabbitmq
    restart: unless-stopped
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_USER:-matecloud}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASS:-matecloud123}
    ports:
      - "5672:5672"
      - "15672:15672"
    volumes:
      - rabbitmq-data:/var/lib/rabbitmq
    networks:
      - mate-net

  nacos:
    image: nacos/nacos-server:v3.2.1
    container_name: mate-nacos
    restart: unless-stopped
    environment:
      MODE: standalone
      # Nacos 3.x requires NACOS_AUTH_TOKEN even when auth is disabled.
      # Value must be a Base64 string (≥32 chars decoded).
      # 已开启用户鉴权:首启需初始化管理员(POST /nacos/v3/auth/user/admin -d password=...),
      # 之后各服务用 NACOS_USERNAME/PASSWORD 登录。serverIdentity 仍用于 init 脚本/inter-server。
      NACOS_AUTH_ENABLE: "true"
      NACOS_AUTH_TOKEN: ${NACOS_AUTH_TOKEN:-bWF0ZWNsb3VkLW5hY29zLXNlY3JldC1rZXktZm9yLWxvY2FsLWRldg==}
      # serverIdentity 头作为可信服务器身份，init-nacos.sh 调 v3 admin API 时携带，
      # 即使开启鉴权也可放行(参见 deploy/init-nacos.sh)。
      NACOS_AUTH_IDENTITY_KEY: ${NACOS_AUTH_IDENTITY_KEY:-serverIdentity}
      NACOS_AUTH_IDENTITY_VALUE: ${NACOS_AUTH_IDENTITY_VALUE:-security}
    ports:
      - "8848:8848"
      - "9848:9848"
      - "38080:8080"
    volumes:
      - nacos-data:/home/nacos/data
    networks:
      - mate-net

  minio:
    image: minio/minio:latest
    container_name: mate-minio
    restart: unless-stopped
    environment:
      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY:-matecloud}
      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY:-matecloud123}
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - minio-data:/data
    command: server /data --console-address ":9001"
    networks:
      - mate-net

  # ==================== MateCloud Services ====================

  mate-gateway:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        MODULE_PATH: mate-gateway
    container_name: mate-gateway
    restart: unless-stopped
    depends_on:
      - nacos
      - redis
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-dev}
      NACOS_HOST: nacos
      NACOS_PORT: 8848
      # 已开启 Nacos 用户鉴权:各服务用账号密码登录(取自 .env 的 NACOS_USERNAME/PASSWORD)。
      NACOS_USERNAME: ${NACOS_USERNAME:-nacos}
      NACOS_PASSWORD: ${NACOS_PASSWORD:-nacos}
      # NACOS_NAMESPACE 未设置 → 默认 public 命名空间(init-nacos.sh 将配置推送到 public)
      # Infra hosts = compose service names (the mate-infra-dev.yml placeholders
      # default to 127.0.0.1, which inside a container is the container itself).
      MYSQL_HOST: mysql
      REDIS_HOST: redis
      RABBITMQ_HOST: rabbitmq
      MINIO_ENDPOINT: http://minio:9000
      JAVA_OPTS: ${JAVA_OPTS:--Xms256m -Xmx512m}
    ports:
      - "9010:9010"
    networks:
      - mate-net

  mate-auth:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        MODULE_PATH: mate-auth
    container_name: mate-auth
    restart: unless-stopped
    depends_on:
      - nacos
      - redis
      - mysql
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-dev}
      NACOS_HOST: nacos
      NACOS_PORT: 8848
      # 已开启 Nacos 用户鉴权:各服务用账号密码登录(取自 .env 的 NACOS_USERNAME/PASSWORD)。
      NACOS_USERNAME: ${NACOS_USERNAME:-nacos}
      NACOS_PASSWORD: ${NACOS_PASSWORD:-nacos}
      # NACOS_NAMESPACE 未设置 → 默认 public 命名空间(init-nacos.sh 将配置推送到 public)
      # Infra hosts = compose service names (the mate-infra-dev.yml placeholders
      # default to 127.0.0.1, which inside a container is the container itself).
      MYSQL_HOST: mysql
      REDIS_HOST: redis
      RABBITMQ_HOST: rabbitmq
      MINIO_ENDPOINT: http://minio:9000
    ports:
      - "9020:9020"
    networks:
      - mate-net

  mate-system:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        MODULE_PATH: mate-biz/mate-system
    container_name: mate-system
    restart: unless-stopped
    depends_on:
      - nacos
      - redis
      - mysql
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-dev}
      NACOS_HOST: nacos
      NACOS_PORT: 8848
      # 已开启 Nacos 用户鉴权:各服务用账号密码登录(取自 .env 的 NACOS_USERNAME/PASSWORD)。
      NACOS_USERNAME: ${NACOS_USERNAME:-nacos}
      NACOS_PASSWORD: ${NACOS_PASSWORD:-nacos}
      # NACOS_NAMESPACE 未设置 → 默认 public 命名空间(init-nacos.sh 将配置推送到 public)
      # Infra hosts = compose service names (the mate-infra-dev.yml placeholders
      # default to 127.0.0.1, which inside a container is the container itself).
      MYSQL_HOST: mysql
      REDIS_HOST: redis
      RABBITMQ_HOST: rabbitmq
      MINIO_ENDPOINT: http://minio:9000
    ports:
      - "9030:9030"
    networks:
      - mate-net

  # mate-admin: merged into mate-system (RFC-049)

  mate-notice:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        MODULE_PATH: mate-biz/mate-notice
    container_name: mate-notice
    restart: unless-stopped
    depends_on:
      - nacos
      - redis
      - mysql
      - rabbitmq
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-dev}
      NACOS_HOST: nacos
      NACOS_PORT: 8848
      # 已开启 Nacos 用户鉴权:各服务用账号密码登录(取自 .env 的 NACOS_USERNAME/PASSWORD)。
      NACOS_USERNAME: ${NACOS_USERNAME:-nacos}
      NACOS_PASSWORD: ${NACOS_PASSWORD:-nacos}
      # NACOS_NAMESPACE 未设置 → 默认 public 命名空间(init-nacos.sh 将配置推送到 public)
      # Infra hosts = compose service names (the mate-infra-dev.yml placeholders
      # default to 127.0.0.1, which inside a container is the container itself).
      MYSQL_HOST: mysql
      REDIS_HOST: redis
      RABBITMQ_HOST: rabbitmq
      MINIO_ENDPOINT: http://minio:9000
    ports:
      - "9050:9050"
    networks:
      - mate-net

  mate-ai:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        MODULE_PATH: mate-biz/mate-ai
    container_name: mate-ai
    restart: unless-stopped
    depends_on:
      - nacos
      - redis
      - mysql
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-dev}
      NACOS_HOST: nacos
      NACOS_PORT: 8848
      # 已开启 Nacos 用户鉴权:各服务用账号密码登录(取自 .env 的 NACOS_USERNAME/PASSWORD)。
      NACOS_USERNAME: ${NACOS_USERNAME:-nacos}
      NACOS_PASSWORD: ${NACOS_PASSWORD:-nacos}
      # NACOS_NAMESPACE 未设置 → 默认 public 命名空间(init-nacos.sh 将配置推送到 public)
      # Infra hosts = compose service names (the mate-infra-dev.yml placeholders
      # default to 127.0.0.1, which inside a container is the container itself).
      MYSQL_HOST: mysql
      REDIS_HOST: redis
      RABBITMQ_HOST: rabbitmq
      MINIO_ENDPOINT: http://minio:9000
      # ---- mate-ai 专属:Spring AI 模型凭据 + API Key 加密主密钥 ----
      # 在宿主机 .env 设置;留空时 mate-ai-dev.yml 里 ${ANTHROPIC_API_KEY:} 占位会得到空串,
      # 启动后调用 LLM 会报 401。MATE_AI_ENCRYPTION_KEY 留空会回退到 dev fallback(打警告)。
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      DEEPSEEK_API_KEY: ${DEEPSEEK_API_KEY:-}
      MATE_AI_ENCRYPTION_KEY: ${MATE_AI_ENCRYPTION_KEY:-}
    ports:
      - "9060:9060"
    networks:
      - mate-net

  # ---- Monolith mode (opt-in alternative to the microservice stack above) ----
  # auth + system + notice in ONE JVM on port 9010 (same as the gateway, so the
  # frontend needs no change); no Nacos, no Dubbo, no broker.
  # Start with:  docker-compose --profile monolith up -d mysql redis mate-monolith
  # It coexists with the microservice DB: Flyway adopts the existing schema instead
  # of re-running migrations (see DataSourceAutoConfiguration#autoSeedPerServiceHistory).
  mate-monolith:
    profiles: ["monolith"]
    build:
      context: .
      dockerfile: mate-monolith/Dockerfile
    container_name: mate-monolith
    restart: unless-stopped
    depends_on:
      - mysql
      - redis
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-prod}
      # Infra hosts = compose service names (placeholders default to 127.0.0.1,
      # which inside a container would be the container itself).
      MYSQL_HOST: mysql
      REDIS_HOST: redis
      MINIO_ENDPOINT: http://minio:9000
    ports:
      - "${MATE_MONOLITH_PORT:-9010}:9010"
    networks:
      - mate-net

  # ---- Frontend (Vue 3 admin, served by nginx; proxies /api → mate-gateway) ----
  mate-ui:
    build:
      context: mate-ui
      dockerfile: Dockerfile
    container_name: mate-ui
    restart: unless-stopped
    depends_on:
      - mate-gateway
    ports:
      - "${MATE_UI_PORT:-8888}:80"
    networks:
      - mate-net

volumes:
  mysql-data:
  redis-data:
  rabbitmq-data:
  nacos-data:
  minio-data:

networks:
  mate-net:
    driver: bridge