# Nexus 6.0 — production Compose (1Panel / bare Docker host)
# MySQL / Redis 不在 Compose 内 — 请在宿主机或 1Panel 自行安装
#
# Usage:
#   bash deploy/nexus-1panel.sh install --profile 2c8g
#   docker compose -f docker/docker-compose.prod.yml \
#     --env-file docker/.env.prod --env-file docker/profiles/2c8g.env up -d --build
#
# OpenResty on host proxies https://api.synaglobal.vip → 127.0.0.1:8600

name: nexus-prod

services:
  nexus:
    build:
      context: ..
      dockerfile: Dockerfile.prod
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "127.0.0.1:${NEXUS_PUBLISH_PORT:-8600}:8600"
    environment:
      NEXUS_PERSIST_DIR: /var/lib/nexus
      NEXUS_DOCKER_WRITE_ENV: "1"
      NEXUS_HOST: "0.0.0.0"
      NEXUS_PORT: "8600"
      NEXUS_DEPLOY_PATH: /app
      NEXUS_HOST_ROOT: ${NEXUS_HOST_ROOT:-/opt/nexus}
      # Redis URL 仅来自 /app/.env（安装向导 + entrypoint export_app_env），勿在此注入以免覆盖密码
      NEXUS_1PANEL_DB_HOST: ${NEXUS_1PANEL_DB_HOST:-}
      NEXUS_1PANEL_REDIS_HOST: ${NEXUS_1PANEL_REDIS_HOST:-}
      NEXUS_CORS_ORIGINS: ${NEXUS_CORS_ORIGINS:?set NEXUS_CORS_ORIGINS}
      NEXUS_SECRET_KEY: ${NEXUS_SECRET_KEY:?set NEXUS_SECRET_KEY}
      NEXUS_API_KEY: ${NEXUS_API_KEY:?set NEXUS_API_KEY}
      NEXUS_ENCRYPTION_KEY: ${NEXUS_ENCRYPTION_KEY:?set NEXUS_ENCRYPTION_KEY}
      NEXUS_INSTALL_WIZARD_PENDING: ${NEXUS_INSTALL_WIZARD_PENDING:-0}
      NEXUS_API_BASE_URL: ${NEXUS_API_BASE_URL:?set NEXUS_API_BASE_URL}
      NEXUS_DB_POOL_SIZE: ${NEXUS_DB_POOL_SIZE:-30}
      NEXUS_DB_MAX_OVERFLOW: ${NEXUS_DB_MAX_OVERFLOW:-20}
    volumes:
      - nexus-state:/var/lib/nexus
      - nexus-web-data:/app/web/data
    mem_limit: ${NEXUS_MEM_LIMIT:-2g}
    cpus: ${NEXUS_CPUS:-1.5}
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://127.0.0.1:8600/health | grep -q '^ok' || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 90s
    networks:
      - nexus-internal

networks:
  nexus-internal:
    driver: bridge

volumes:
  nexus-state:
  nexus-web-data: