# path:: mkdir -pv /data/volumes/tokenhub/{data,releases}
# pull:: docker compose -p tokenhub-host --env-file ./tokenhub/env.cfg -f ./tokenhub/stack.host.yml pull
# run::  docker compose -p tokenhub-host --env-file ./tokenhub/env.cfg -f ./tokenhub/stack.host.yml up -d
# disc:: TokenHub（ghcr.io/astaxie/tokenhub-backend）单容器一体部署：
#        镜像内同时跑 Go 后端(:8080) 与 Next.js 管理后台(:3000)，上游 RUN_MODE=all
# disc:: 复用 prod-dbs 项目的 prod-postgres（join 外部网络 prod-dbs_default，service 名 postgres）
# disc:: 需先在 prod-postgres 上建好 tokenhub 库与账号（SQL 模板见 tokenhub/readme.md）
# disc:: 项目名 tokenhub-host；启动前先 up prod-dbs（确保 prod-dbs_default 网络存在）
# disc:: 使用 PostgreSQL 时必须设置 TOKENHUB_SECRET_KEY（≥32 字节稳定值，勿变更）
# disc:: 首次登录 admin：密码为 TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD 或 exec 命令获取（见 readme）
# disc:: 注意：与 newapi/mixapi 同机时 3000/8080 默认端口会冲突，改 env.cfg 端口即可

services:
  tokenhub:
    image: ghcr.io/astaxie/tokenhub-backend:${TOKENHUB_IMAGE_TAG:-latest}
    container_name: tokenhub_host_app
    restart: unless-stopped   # 上游约定：版本面板“立即重启”依赖 restart: unless-stopped
    ports:
      - "${TOKENHUB_BACKEND_PORT:-8080}:8080"
      - "${TOKENHUB_FRONTEND_PORT:-3000}:3000"
    networks:
      - prod-dbs_default   # 加入 prod-dbs 默认网络，用 service 名 postgres 解析 prod-postgres
    volumes:
      - ${Volumes_Path:-/data/volumes/tokenhub}/data:/app/data          # SQLite/备份/生成图片（此处实际存 PG，备 SQLite 回退）
      - ${Volumes_Path:-/data/volumes/tokenhub}/releases:/opt/tokenhub  # 版本面板在线更新/回退的 Release 与模型目录
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    environment:
      TOKENHUB_ENV: ${TOKENHUB_ENV:-prod}
      TOKENHUB_DEPLOYMENT_TYPE: container
      TOKENHUB_MANAGED_UPDATES: "true"
      TOKENHUB_INSTALL_ROOT: /opt/tokenhub
      TOKENHUB_RUN_MODE: all
      TOKENHUB_HTTP_ADDR: :8080
      TZ: Asia/Shanghai
      # 复用 prod-postgres：URL 由 DB_* 组装（密码含 @ : / # % 时需 URL 转义；
      # 后端也支持 TOKENHUB_DB_HOST/DB_USER/DB_PASSWORD/DB_NAME/DB_SSLMODE 拆分字段，可改用之）
      TOKENHUB_DATABASE_URL: postgresql://${DB_USER:-tokenhub}:${DB_PASSWORD}@${DB_HOST:-postgres}:${DB_PORT:-5432}/${DB_NAME:-tokenhub}?sslmode=${DB_SSLMODE:-disable}
      TOKENHUB_SQLITE_BACKUP_DIR: /app/data/backups
      TOKENHUB_MODEL_CATALOG_FILE: /opt/tokenhub/current/catalog/model-catalog.yaml
      TOKENHUB_PROVIDER_CATALOG_FILE: /opt/tokenhub/current/catalog/provider-catalog.json
      TOKENHUB_PUBLIC_BASE_URL: ${TOKENHUB_PUBLIC_BASE_URL:-http://localhost:8080}
      TOKENHUB_API_BASE_URL: ${TOKENHUB_API_BASE_URL:-http://localhost:8080}
      TOKENHUB_RELEASE_REPOSITORY: ${TOKENHUB_RELEASE_REPOSITORY:-astaxie/TokenHub}
      TOKENHUB_TRUSTED_PROXY_CIDRS: ${TOKENHUB_TRUSTED_PROXY_CIDRS:-}
      TOKENHUB_PROVIDER_UPSTREAM_ALLOWED_CIDRS: ${TOKENHUB_PROVIDER_UPSTREAM_ALLOWED_CIDRS:-}
      TOKENHUB_PROVIDER_UPSTREAM_NAT64_PREFIX: ${TOKENHUB_PROVIDER_UPSTREAM_NAT64_PREFIX:-}
      TOKENHUB_PROVIDER_UPSTREAM_ALLOW_LOOPBACK: ${TOKENHUB_PROVIDER_UPSTREAM_ALLOW_LOOPBACK:-false}
      HTTP_PROXY: ${HTTP_PROXY:-}
      HTTPS_PROXY: ${HTTPS_PROXY:-}
      NO_PROXY: ${NO_PROXY:-}
      TOKENHUB_CORS_ALLOWED_ORIGINS: ${TOKENHUB_CORS_ALLOWED_ORIGINS:-http://localhost:3000}
      TOKENHUB_ADMIN_TOKEN: ${TOKENHUB_ADMIN_TOKEN:-change-me-tokenhub-admin-token}
      TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD: ${TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD:-change-me-tokenhub-admin-password}
      TOKENHUB_SECRET_KEY: ${TOKENHUB_SECRET_KEY:-change-me-tokenhub-secret-key}
      TOKENHUB_SEED_DEMO: ${TOKENHUB_SEED_DEMO:-false}
      TOKENHUB_RESOURCE_FAILURE_THRESHOLD: ${TOKENHUB_RESOURCE_FAILURE_THRESHOLD:-3}
      TOKENHUB_RESOURCE_COOLDOWN_SECONDS: ${TOKENHUB_RESOURCE_COOLDOWN_SECONDS:-300}
      TOKENHUB_RESOURCE_COOLDOWN_MAX_SECONDS: ${TOKENHUB_RESOURCE_COOLDOWN_MAX_SECONDS:-3600}
      TOKENHUB_METRICS_ENABLED: ${TOKENHUB_METRICS_ENABLED:-false}
      TOKENHUB_METRICS_TOKEN: ${TOKENHUB_METRICS_TOKEN:-}
      TOKENHUB_METRICS_PROJECT_LABEL: ${TOKENHUB_METRICS_PROJECT_LABEL:-false}
      TOKENHUB_TRACING_ENABLED: ${TOKENHUB_TRACING_ENABLED:-false}
      TOKENHUB_TRACING_ENDPOINT: ${TOKENHUB_TRACING_ENDPOINT:-}
      TOKENHUB_TRACING_HEADERS: ${TOKENHUB_TRACING_HEADERS:-}
      TOKENHUB_TRACING_CAPTURE_PAYLOADS: ${TOKENHUB_TRACING_CAPTURE_PAYLOADS:-false}
      TOKENHUB_TRACING_SAMPLE_RATIO: ${TOKENHUB_TRACING_SAMPLE_RATIO:-1}
      TOKENHUB_TRACING_TIMEOUT_SECONDS: ${TOKENHUB_TRACING_TIMEOUT_SECONDS:-10}
      TOKENHUB_TRACING_QUEUE_SIZE: ${TOKENHUB_TRACING_QUEUE_SIZE:-2048}
      TOKENHUB_UPSTREAM_NON_STREAM_TIMEOUT_SECONDS: ${TOKENHUB_UPSTREAM_NON_STREAM_TIMEOUT_SECONDS:-120}
      TOKENHUB_UPSTREAM_STREAM_IDLE_TIMEOUT_SECONDS: ${TOKENHUB_UPSTREAM_STREAM_IDLE_TIMEOUT_SECONDS:-300}
      TOKENHUB_MAX_JSON_REQUEST_BYTES: ${TOKENHUB_MAX_JSON_REQUEST_BYTES:-8388608}
      TOKENHUB_MAX_MULTIMODAL_REQUEST_BYTES: ${TOKENHUB_MAX_MULTIMODAL_REQUEST_BYTES:-33554432}
      TOKENHUB_IN_FLIGHT_LEASE_TTL_SECONDS: ${TOKENHUB_IN_FLIGHT_LEASE_TTL_SECONDS:-300}
      TOKENHUB_CLUSTER_LOCK_TTL_SECONDS: ${TOKENHUB_CLUSTER_LOCK_TTL_SECONDS:-180}
      # 可选 Redis 计费准入（高并发），复用 dbSer Dev-Redis（172.22.10.205，无密码）示例：
      # TOKENHUB_BILLING_REDIS_URL: redis://172.22.10.205:6379/0
      TOKENHUB_BILLING_REDIS_URL: ${TOKENHUB_BILLING_REDIS_URL:-}
      TOKENHUB_GRACEFUL_SHUTDOWN_SECONDS: ${TOKENHUB_GRACEFUL_SHUTDOWN_SECONDS:-150}
      TOKENHUB_IMAGE_WORKER_CONCURRENCY: ${TOKENHUB_IMAGE_WORKER_CONCURRENCY:-2}
      TOKENHUB_RESPONSE_WORKER_CONCURRENCY: ${TOKENHUB_RESPONSE_WORKER_CONCURRENCY:-2}
      TOKENHUB_RESPONSE_POLL_INTERVAL_MILLIS: ${TOKENHUB_RESPONSE_POLL_INTERVAL_MILLIS:-250}
      TOKENHUB_RESPONSE_JOB_TIMEOUT_SECONDS: ${TOKENHUB_RESPONSE_JOB_TIMEOUT_SECONDS:-300}
      TOKENHUB_RESPONSE_LEASE_TTL_SECONDS: ${TOKENHUB_RESPONSE_LEASE_TTL_SECONDS:-30}
      TOKENHUB_RESPONSE_RESULT_TTL_SECONDS: ${TOKENHUB_RESPONSE_RESULT_TTL_SECONDS:-3600}
      TOKENHUB_RESPONSE_MAX_QUEUED_JOBS: ${TOKENHUB_RESPONSE_MAX_QUEUED_JOBS:-1000}
      TOKENHUB_CACHE_AFFINITY_ENABLED: ${TOKENHUB_CACHE_AFFINITY_ENABLED:-false}
      TOKENHUB_CACHE_AFFINITY_MODELS: ${TOKENHUB_CACHE_AFFINITY_MODELS:-}
      TOKENHUB_CACHE_AFFINITY_ALLOW_USER_SCOPE: ${TOKENHUB_CACHE_AFFINITY_ALLOW_USER_SCOPE:-false}
      TOKENHUB_GUARDRAIL_MODEL_URL: ${TOKENHUB_GUARDRAIL_MODEL_URL:-}
      TOKENHUB_GUARDRAIL_MODEL_API_KEY: ${TOKENHUB_GUARDRAIL_MODEL_API_KEY:-}
      TOKENHUB_GUARDRAIL_MODEL_NAME: ${TOKENHUB_GUARDRAIL_MODEL_NAME:-Qwen/Qwen3Guard-Gen-0.6B}
      TOKENHUB_GUARDRAIL_MODEL_TIMEOUT_SECONDS: ${TOKENHUB_GUARDRAIL_MODEL_TIMEOUT_SECONDS:-10}
      TOKENHUB_FRONTEND_HOST: 0.0.0.0
      TOKENHUB_FRONTEND_PORT: 3000
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - Promise.all([fetch('http://127.0.0.1:8080/healthz'),fetch('http://127.0.0.1:3000')]).then(rs=>process.exit(rs.every(r=>r.ok)?0:1)).catch(()=>process.exit(1))
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s
    stop_grace_period: ${TOKENHUB_STOP_GRACE_PERIOD:-180s}

networks:
  prod-dbs_default:
    # 引用 prod-dbs 项目自动创建的默认网络，不归本 compose 管
    external: true
    name: prod-dbs_default