docker-compose.yml

version: '3.8'

# Tevarn Docker 部署
#
# 安全默认值（2026-07-26 安全加固）：
# - single_user_mode 默认 false：容器间/宿主机访问均非 loopback，必须走真实账号登录
# - 不再注入任何弱默认密钥；未设 TEVARN_JWT_SECRET 时容器首启自动生成随机密钥，
#   持久化到 tevarn_data volume（/app/data/secrets.json，0600）
# - qdrant 不对外暴露端口（仅容器网络内可达）；调试时自行加 ports
# - 环境变量名以 backend/core/config.py 的 Settings 字段为准（env_prefix=TEVARN_）

services:
  tevarn-backend:
    build:
      context: .
      dockerfile: backend/Dockerfile
    ports:
      - "8090:8090"
    environment:
      - TEVARN_APP_PORT=8090
      - TEVARN_DB_URL=sqlite+aiosqlite:////app/data/tevarn.db
      - TEVARN_QDRANT_URL=http://qdrant:6333
      - TEVARN_SINGLE_USER_MODE=${TEVARN_SINGLE_USER_MODE:-false}
      # 生产建议显式设置强随机值；留空则首启自动生成并持久化到 volume
      - TEVARN_JWT_SECRET=${TEVARN_JWT_SECRET:-}
      - TEVARN_SETTINGS_ENCRYPTION_SALT=${TEVARN_SETTINGS_ENCRYPTION_SALT:-}
      # 共享机/非 loopback 场景建议设置桥接令牌（留空 → 回落用户鉴权）
      - TEVARN_BRIDGE_TOKEN=${TEVARN_BRIDGE_TOKEN:-}
    volumes:
      - tevarn_data:/app/data
      - tevarn_logs:/app/logs
    depends_on:
      - qdrant
    restart: unless-stopped
    networks:
      - tevarn

  tevarn-frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
      args:
        # 浏览器侧访问后端的地址（构建期内联）；对外部署改为实际域名/IP
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:8090}
    ports:
      - "3000:3000"
    depends_on:
      - tevarn-backend
    restart: unless-stopped
    networks:
      - tevarn

  qdrant:
    image: qdrant/qdrant:latest
    # 不暴露到宿主机；需要宿主机调试时取消下一行注释
    # ports:
    #   - "6333:6333"
    volumes:
      - qdrant_data:/qdrant/storage
    restart: unless-stopped
    networks:
      - tevarn

  # 可选：PostgreSQL（替代 SQLite）
  postgres:
    image: postgres:15-alpine
    profiles:
      - postgres
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_USER=tevarn
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-tevarn}
      - POSTGRES_DB=tevarn
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
    networks:
      - tevarn

volumes:
  tevarn_data:
  tevarn_logs:
  qdrant_data:
  postgres_data:

networks:
  tevarn:
    driver: bridge