docker-compose.dev.yml

# Development stack.
#
# Windows Docker Desktop 拉取 Docker Hub 镜像失败时，可在
# Settings -> Docker Engine 的 JSON 中加入（这是 Docker daemon 配置，不能写成 Compose 字段）：
#   "registry-mirrors": ["https://docker.m.daocloud.io"]
# 保存后点击 Apply & restart，再执行 `docker compose -f docker-compose.dev.yml pull`。
# 若现有 JSON 已有其他配置，请只合并 registry-mirrors 字段，不要覆盖整个文件。
# 镜像地址也可通过 .env 中的 *_IMAGE 变量覆盖，示例见 .env.dev.example。
#
# Core services (postgres, redis, minio, itsm-init, itsm-backend, itsm-frontend)
# start with a plain `docker compose -f docker-compose.dev.yml up -d` — no
# --profile flag required.
#
# Optional components stay behind profiles:
#   --profile ai          adds Ollama (local LLM)
#   --profile monitoring  adds Prometheus + Grafana
#
# The `dev` profile is still accepted for backwards compatibility but is no
# longer needed. Previously every core service carried `profiles: ["dev"]`,
# which made the intuitive command silently start nothing at all and report
# success — please do not reintroduce it on the core services.
#
# =============================================================================
# 网络加速配置（解决 Docker Hub 镜像拉取超时问题）
# =============================================================================
# Windows/macOS/Linux 用户如果遇到以下错误：
#   "failed to resolve reference docker.io/library/redis:7-alpine: ... dialing registry-1.docker.io:443 connection timed out"
#
# 解决方案：在 Docker Desktop 设置中添加镜像加速器
#
# 方法1：Docker Desktop 图形界面（推荐）
#   - 打开 Docker Desktop → Settings → Docker Engine
#   - 在右侧编辑器中添加 "registry-mirrors" 配置（见下方 JSON 示例）
#   - 点击 Apply & Restart
#
# 方法2：手动修改 daemon.json
#   - Linux:   sudo vim /etc/docker/daemon.json
#   - macOS:   vim ~/.docker/daemon.json
#   - Windows:  打开 %USERPROFILE%\.docker\daemon.json（如不存在则创建）
#
#   {
#     "registry-mirrors": [
#       "https://docker.1ms.run",
#       "https://docker.xuanyuan.me"
#     ]
#   }
#
#   阿里云用户可登录 https://cr.console.aliyun.com/cn-hangzhou/instances/mirrors
#   获取专属加速地址，格式如：https://your-id.mirror.aliyuncs.com
#
# 常用加速器（任选一个或组合使用）：
#   - Docker 官方加速：https://docker.1ms.run
#   - DaoCloud 镜像：https://docker.xuanyuan.me
#   - 中科大镜像：https://docker.mirrors.ustc.edu.cn
#   - 网易镜像：https://hub-mirror.c.163.com
#   - 七牛云：https://docker.mirrors.qiniu.com
#
# 方法3：如果加速器仍然超时，可直接拉取镜像到本地（适用于内网环境）
#   docker pull pgvector/pgvector:pg17
#   docker pull redis:7-alpine
#   docker pull minio/minio:latest
#   docker pull ollama/ollama:latest
#   docker pull prom/prometheus:latest
#   docker pull grafana/grafana:10.1.0
#
# =============================================================================

services:
  # BuildKit 共享缓存（加速增量编译）
  # 在 docker desktop 设置中启用 BuildKit，或者设置 DOCKER_BUILDKIT=1 环境变量

  # PostgreSQL 数据库（开发环境）
  # 本机 Homebrew PostgreSQL 默认占用 5432，开发容器改为发布到 55432。
  # 后端使用 `postgres:5432`（容器网络主机名），因此 8090/3000 等对外端口不受影响。
  # 集成测试可通过 `host=localhost port=55432` 直接连接容器内的真实 PG。
  postgres:
    # pgvector 暂保留官方镜像；Docker Hub 连通性由 daemon registry mirror 解决。
    image: ${POSTGRES_IMAGE:-pgvector/pgvector:pg17}
    container_name: itsm-postgres-dev
    hostname: postgres
    environment:
      POSTGRES_DB: itsm
      POSTGRES_USER: itsm_user
      POSTGRES_PASSWORD: dev123
    ports:
      - "55432:5432"
    volumes:
      - postgres_dev_data:/var/lib/postgresql/data
    networks:
      - itsm-dev-network
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U itsm_user -d itsm" ]
      interval: 5s
      timeout: 3s
      retries: 10
    restart: unless-stopped
  # Redis 缓存（开发环境）
  redis:
    # 国内网络默认使用 DaoCloud 代理；可通过 REDIS_IMAGE 切回官方源。
    image: ${REDIS_IMAGE:-m.daocloud.io/docker.io/library/redis:7-alpine}
    container_name: itsm-redis-dev
    hostname: redis
    ports:
      - "6379:6379"
    volumes:
      - redis_dev_data:/data
    networks:
      - itsm-dev-network
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped
  # MinIO 对象存储（开发环境，可选）
  minio:
    # 国内网络默认使用 DaoCloud 代理；可通过 MINIO_IMAGE 切回官方源。
    image: ${MINIO_IMAGE:-m.daocloud.io/docker.io/minio/minio:latest}
    container_name: itsm-minio-dev
    hostname: minio
    command: server /data --console-address ":9001"
    ports:
      - "9000:9000"
      - "9001:9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin123
    volumes:
      - minio_dev_data:/data
    networks:
      - itsm-dev-network
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:9000/minio/health/live" ]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
  # ITSM 后端服务（开发环境）
  itsm-init:
    build:
      context: ./itsm-backend
      dockerfile: Dockerfile
      args:
        - BUILDKIT_INLINE_CACHE=1
        - HTTP_PROXY=
        - HTTPS_PROXY=
        - http_proxy=
        - https_proxy=
    container_name: itsm-init-dev
    hostname: init
    command: ["./main"]
    environment:
      - DATABASE_URL=postgres://itsm_user:dev123@postgres:5432/itsm?sslmode=disable
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_USER=itsm_user
      - DB_PASSWORD=dev123
      - DB_NAME=itsm
      - DB_SSLMODE=disable
      - REDIS_URL=redis://redis:6379
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - REDIS_PASSWORD=
      - REDIS_DB=0
      - JWT_SECRET=dev-secret-key-change-in-production-minimum-32-characters-long
      - LOG_LEVEL=debug
      # 显式声明开发环境：避免 DEPLOYMENT_MODE=private 被默认判定为生产环境，触发 DEFAULT_JWT_SECRET fail-closed
      - ENV=development
      - DEPLOYMENT_MODE=${DEPLOYMENT_MODE:-private}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-dev12345678!}
      - ITSM_BOOTSTRAP_ONLY=true
      - ITSM_AUTO_MIGRATE=true
      - ITSM_AUTO_SEED=true
      - HTTP_PROXY=
      - HTTPS_PROXY=
      - http_proxy=
      - https_proxy=
      - NO_PROXY=
      - no_proxy=
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - itsm-dev-network
    restart: "no"
  # ITSM 后端服务（开发环境）
  itsm-backend:
    build:
      context: ./itsm-backend
      dockerfile: Dockerfile
      args:
        - BUILDKIT_INLINE_CACHE=1
        - HTTP_PROXY=
        - HTTPS_PROXY=
        - http_proxy=
        - https_proxy=
    container_name: itsm-backend-dev
    hostname: backend
    environment:
      # 数据库配置
      - DATABASE_URL=postgres://itsm_user:dev123@postgres:5432/itsm?sslmode=disable
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_USER=itsm_user
      - DB_PASSWORD=dev123
      - DB_NAME=itsm
      - DB_SSLMODE=disable

      # Redis 配置
      - REDIS_URL=redis://redis:6379
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - REDIS_PASSWORD=
      - REDIS_DB=0

      # 服务配置
      - GIN_MODE=debug
      - SERVER_ENV=development
      # 显式声明开发环境（凭据守卫优先读 ENV），避免 dev JWT 触发 fail-closed
      - ENV=development
      - DEPLOYMENT_MODE=${DEPLOYMENT_MODE:-private}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-dev12345678!}
      # schema 迁移由独立 itsm-init 容器（ITSM_BOOTSTRAP_ONLY=true）完成；
      # web 进程禁止 AUTO_MIGRATE/AUTO_SEED（ValidateWebStartupConfig fail-closed）
      - ITSM_AUTO_MIGRATE=false
      - ITSM_AUTO_SEED=false

      # JWT 配置
      - JWT_SECRET=dev-secret-key-change-in-production-minimum-32-characters-long
      - JWT_EXPIRE_TIME=900
      - JWT_REFRESH_EXPIRE_TIME=604800

      # 日志配置
      - LOG_LEVEL=debug
      - LOG_PATH=/app/logs

      # WebSocket upgrader 默认只允许 same-origin。前端在 3000 端口直连后端 8090,
      # 必须显式放行 origin,否则握手返回 403。
      - WEBSOCKET_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000,http://0.0.0.0:3000

      # 对象存储
      - MINIO_ENDPOINT=http://minio:9000
      - MINIO_ROOT_USER=minioadmin
      - MINIO_ROOT_PASSWORD=minioadmin123
      - MINIO_BUCKET=itsm-uploads

      # LLM 配置（默认开发用本地模型，可由 .env 覆盖）
      - LLM_PROVIDER=${LLM_PROVIDER:-ollama}
      - LLM_MODEL=${LLM_MODEL:-llama2}
      - LLM_API_KEY=${LLM_API_KEY:-}
      - LLM_ENDPOINT=${LLM_ENDPOINT:-http://host.docker.internal:11434}
      # 或者使用本地运行的 Ollama 容器:
      # - OLLAMA_BASE_URL=http://ollama:11434

      # Guidance sidecar 地址：开发指向 itsm-ai-service 的受限分诊端点 /triage
      - GUIDANCE_URL=${GUIDANCE_URL:-http://itsm-ai-service:8000}

      # 其他
      - ENABLE_SWAGGER=true
      - ENABLE_CORS=true
      # CORS 白名单：开发环境允许前端 3000 以及常用调试端口；避免 TRAE 代理导致的 ERR_FAILED
      - ITSM_CORS_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000,http://0.0.0.0:3000
      # GIN_MODE=debug -> gin.Mode() != release -> default echo reqOrigin; kept as defense in depth
      - GIN_MODE=debug

      # 清除代理（避免 Docker Desktop 代理干扰容器内请求）
      - HTTP_PROXY=
      - HTTPS_PROXY=
      - http_proxy=
      - https_proxy=
      - NO_PROXY=
      - no_proxy=
    ports:
      - "8090:8090"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      itsm-init:
        condition: service_completed_successfully
    volumes:
      - ./logs:/app/logs
      - ./uploads:/app/uploads
    networks:
      - itsm-dev-network
    healthcheck:
      test:
        [
          "CMD",
          "sh",
          "-c",
          "http_proxy= https_proxy= HTTP_PROXY= HTTPS_PROXY= wget --no-verbose --tries=1 --spider http://localhost:8090/api/v1/health",
        ]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  # Guidance sidecar（受限 JSON 生成）。复用 itsm-ai-service：POST /triage 提供
  # 与后端 GuidanceClient 兼容的分类响应。开发环境直连 ollama 本地模型。
  itsm-ai-service:
    build:
      context: ./itsm-ai-service
      dockerfile: Dockerfile
    container_name: itsm-ai-service-dev
    hostname: ai-service
    environment:
      - SERVICE_HOST=0.0.0.0
      - SERVICE_PORT=8000
      - LOG_LEVEL=info
      - CORS_ORIGINS=http://localhost:3000,http://itsm-frontend:3000
      - LLM_PROVIDER=${LLM_PROVIDER:-ollama}
      - LLM_MODEL=${LLM_MODEL:-llama2}
      - LLM_BASE_URL=${LLM_ENDPOINT:-http://ollama:11434/v1}
      - LLM_API_KEY=${LLM_API_KEY:-}
      - LLM_TIMEOUT=120
    expose:
      - "8000"
    networks:
      - itsm-dev-network
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/health').status==200 else 1)"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    restart: unless-stopped

  # ITSM 前端服务（开发环境）
  itsm-frontend:
    build:
      context: ./itsm-frontend
      dockerfile: Dockerfile
      target: runner
      args:
        - NODE_ENV=development
        - HTTP_PROXY=
        - HTTPS_PROXY=
        - http_proxy=
        - https_proxy=
    container_name: itsm-frontend-dev
    hostname: frontend
    environment:
      - NODE_ENV=development
      - ITSM_BACKEND_URL=http://backend:8090
      # 使用同源代理模式：浏览器请求 /api/v1/... 通过 Next.js 代理路由转发到后端
      # 这样避免了跨域 cookie (SameSite=Lax) 和 CORS 预检问题
      # - NEXT_PUBLIC_API_URL=http://localhost:8090
      - NEXT_PUBLIC_ENABLE_AI=true
      - NEXT_PUBLIC_ENABLE_SWAGGER=true
      # WebSocket 必须绕过 Next.js BFF(BFF 用 fetch,无法升级 WS 协议)
      - NEXT_PUBLIC_WS_URL=ws://localhost:8090/api/v1/ws/notifications
      # dev server 启用 Turbopack（webpack 在 Docker VM 冷编译 /login 实测 89.5s）；
      # 置 0 可回退 webpack。不影响 next build（build 固定 NEXT_DISABLE_TURBOPACK=1）
      - NEXT_DEV_TURBOPACK=${NEXT_DEV_TURBOPACK:-1}

      # 清除代理
      - HTTP_PROXY=
      - HTTPS_PROXY=
      - http_proxy=
      - https_proxy=
      - NO_PROXY=
      - no_proxy=
    ports:
      - "3000:3000"
      - "9229:9229" # Node.js debug 端口
    depends_on:
      itsm-backend:
        condition: service_healthy
    networks:
      - itsm-dev-network
    volumes:
      - ./itsm-frontend:/app
      # node_modules 用命名卷而非匿名卷：匿名卷随容器删除即丢，每次重建
      # 都要重新从 /opt/deps 复制 950MB 依赖（1-2 分钟）。命名卷持久保留，
      # entrypoint 的 sentinel 文件使其跳过重复复制。
      - itsm_frontend_node_modules_dev:/app/node_modules
      # .next 同理用命名卷：保留 dev 编译缓存，容器重启/重建后页面无需全部冷编译
      - itsm_frontend_next_cache_dev:/app/.next
    restart: unless-stopped
  # Ollama（本地 LLM 服务，可选）
  ollama:
    image: ${OLLAMA_IMAGE:-ollama/ollama:latest}
    container_name: itsm-ollama-dev
    hostname: ollama
    ports:
      - "11434:11434"
    volumes:
      - ollama_dev_data:/root/.ollama
    networks:
      - itsm-dev-network
    restart: unless-stopped
    profiles: [ "ai" ]
    # 首次启动后需要拉取模型:
    # docker exec itsm-ollama-dev ollama pull llama2

    # Prometheus（监控，可选）
  prometheus:
    image: ${PROMETHEUS_IMAGE:-prom/prometheus:latest}
    container_name: itsm-prometheus-dev
    hostname: prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_dev_data:/prometheus
    networks:
      - itsm-dev-network
    restart: unless-stopped
    profiles: [ "monitoring" ]

  # Grafana（监控面板，可选）
  grafana:
    # Pinned to the same version as monitoring/docker-compose.monitoring.yml —
    # "latest" made the two stacks drift apart.
    image: ${GRAFANA_IMAGE:-grafana/grafana:10.1.0}
    container_name: itsm-grafana-dev
    hostname: grafana
    ports:
      - "3001:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-admin123}
    volumes:
      - grafana_dev_data:/var/lib/grafana
      # provisioning/ = provider + datasource configs
      # dashboards/   = dashboard JSONs, loaded via provider.yml `options.path`
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
    networks:
      - itsm-dev-network
    restart: unless-stopped
    profiles: [ "monitoring" ]

volumes:
  postgres_dev_data:
    driver: local
  redis_dev_data:
    driver: local
  minio_dev_data:
    driver: local
  ollama_dev_data:
    driver: local
  prometheus_dev_data:
    driver: local
  grafana_dev_data:
    driver: local
  itsm_frontend_node_modules_dev:
    driver: local
  itsm_frontend_next_cache_dev:
    driver: local

networks:
  itsm-dev-network:
    driver: bridge