services:
  attestation_service:
    image: huawei-ra-attestation_service:latest
    deploy:
      resources:
        limits:
          cpus: '2'    # 限制使用200% CPU时间片（相当于双核的100%利用率）
          memory: 200M   # 硬内存限制为200MB
    env_file: .env
    logging:
      driver: local
      options:
        max-size: "10m"
        max-file: "3"
    build: .
    environment:
      - REDIS_URL=redis://default:${REDIS_PASSWORD}@redis:6379/0
      - MYSQL_DATABASE_URL=mysql://${DB_USER}:${DB_PASSWORD}@mysql:3306/${DB_NAME}?ssl-mode=disabled&charset=utf8mb4&auth-plugin=mysql_native_password
    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy
      zookeeper:
        condition: service_healthy
      kafka:
        condition: service_healthy
      attestation_mock:
        condition: service_started
    networks:
      - app-network  # 统一网络名称
#    restart: always
    ports:
      - "8080:8080"
      - "8081:8081"
    volumes:
      - .:/var/test_docker/app
      - app-logs:/var/test_docker/app/huawei-ra-log/logs/  # 改用命名卷
      - ./config:/app/config:ro  # 配置目录只读挂载（按需添加）
  mysql:
    image: mysql:8.0.41
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
      MYSQL_DATABASE: ${DB_NAME}
      MYSQL_USER: ${DB_USER}
      MYSQL_PASSWORD: ${DB_PASSWORD}
      MYSQL_DEFAULT_AUTHENTICATION_PLUGIN: mysql_native_password  # 强制使用旧认证方式,确保使用兼容性更好的 mysql_native_password 插件
    volumes:
      - mysql_data:/var/lib/mysql
      - ./mysql-init.sql:/docker-entrypoint-initdb.d:ro
    networks:
      - app-network
    command:
      --default-authentication-plugin=mysql_native_password
      --character-set-server=utf8mb4
      --collation-server=utf8mb4_unicode_ci
    healthcheck:
      test: [ "CMD", "mysqladmin", "ping", "-u${MYSQL_USER}", "-p${MYSQL_PASSWORD}", "-h", "localhost" ]
      interval: 15s
      timeout: 10s
      retries: 3
  redis:
    image: redis:6.2.17
    command: redis-server --appendonly yes  # redis-server --requirepass ${REDIS_PASSWORD} --appendonly yes
    volumes:
      - redis_data:/data
    networks:
      - app-network
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
      interval: 10s
  # Zookeeper（Kafka 依赖）
  zookeeper:
    image: zookeeper:3.8  # Apache 官方镜像（国内可拉取）
    networks:
      - app-network
    ports:
      - "2181:2181"
    environment:
      ZOO_4LW_COMMANDS_WHITELIST: "*"  # 允许所有四字命令（包括 stat、ruok 等）
      ZOOKEEPER_CLIENT_PORT: 2181
    healthcheck:
      test: ["CMD-SHELL", "echo srvr | nc 127.0.0.1 2181 | grep -E 'Zookeeper version|Mode'"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
  # Kafka 服务
  kafka:
    image: wurstmeister/kafka:latest  # 社区维护的 Kafka 镜像
    networks:
      - app-network
    depends_on:
      zookeeper:
        condition: service_healthy
    healthcheck:
#      test: ["CMD-SHELL", "kafka-broker-api-versions --bootstrap-server localhost:9092 || exit 1"]
      test: ["CMD-SHELL", "nc -z localhost 9092 || exit 1"]  # 检测9092端口是否可访问
      interval: 20s
      timeout: 10s
      retries: 10
      start_period: 30s
    ports:
      - "9092:9092"          # 容器内访问
      - "29092:29092"        # 宿主机访问（可选）
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: "zookeeper:2181"
      KAFKA_LISTENERS: "INTERNAL://:9092,EXTERNAL://:29092"
      KAFKA_ADVERTISED_LISTENERS: "INTERNAL://kafka:9092,EXTERNAL://localhost:29092"
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: "INTERNAL:PLAINTEXT,EXTERNAL:PLAINTEXT"
      KAFKA_INTER_BROKER_LISTENER_NAME: "INTERNAL"
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
    volumes:
      - kafka-data:/var/lib/kafka/data
  attestation_mock:
    image: attestation_mock
    networks:
      - app-network
    volumes:
      - /var/test_docker/attestation_mock:/var/test_docker/app
    ports:
      - "8082:8082"
volumes:
  mysql_data:
    driver: local
  redis_data:
    driver: local
  app-logs:
    driver: local
  kafka-data:  # Kafka 数据持久化
    driver: local
  cargo-registry:

networks:
  app-network:
    driver: bridge