services:
  attestation_service:
    image: ra-attestation_service:latest
    deploy:
      resources:
        limits:
          cpus: '2'    # Limit CPU usage to 200% (equivalent to 100% utilization of dual cores)
          memory: 200M   # Hard memory limit of 200MB
    env_file: ../attestation_server/conf/.env
    logging:
      driver: local
      options:
        max-size: "10m"
        max-file: "3"
    build:
      context: ..
      dockerfile: docker/attestation_service/Dockerfile
    environment:
      - REDIS_URL=redis://default:${REDIS_PASSWORD}@redis:6379/0
      - MYSQL_DATABASE_URL=mysql://${DB_USER}:${DB_PASSWORD}@mysql:3306/${DB_NAME}?ssl-mode=required&charset=utf8mb4&auth-plugin=mysql_native_password
    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - app-network  # Unified network name
    #    restart: always
    ports:
      - "8080:8080"
      - "8081:8081"
      - "8443:8443"
    volumes:
      - cargo-registry-cache:/usr/local/cargo/registry
      - .:/var/test_docker/app
      - app-logs:/var/test_docker/app/ra-log/logs/  # Use named volume
      - ./config:/app/config:ro  # Read-only mount for config directory (add as needed)
      - /etc/attestation_server/certs:/etc/attestation_server/certs:ro
  mysql:
    image: mysql:8.0.41
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
      MYSQL_DATABASE: ${DB_NAME}
      MYSQL_USER: ${DB_USER}
      MYSQL_PASSWORD: ${DB_PASSWORD}
      MYSQL_DEFAULT_AUTHENTICATION_PLUGIN: mysql_native_password  # Force use of old authentication method, ensure use of more compatible mysql_native_password plugin
    volumes:
      - mysql_data:/var/lib/mysql
      - ../attestation_server/rdb_sql/mysql/mysql_v1.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
      - app-network
    command:
      --default-authentication-plugin=mysql_native_password
      --character-set-server=utf8mb4
      --collation-server=utf8mb4_unicode_ci
    healthcheck:
      test: [ "CMD", "mysqladmin", "ping", "-u${MYSQL_USER}", "-p${MYSQL_PASSWORD}", "-h", "localhost" ]
      interval: 15s
      timeout: 10s
      retries: 3
  redis:
    image: redis:6.2.17
    command: redis-server --appendonly yes  # redis-server --requirepass ${REDIS_PASSWORD} --appendonly yes
    volumes:
      - redis_data:/data
    networks:
      - app-network
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
      interval: 10s
  key_manager:
    container_name: key_manager
    image: key_manager
    hostname: key_manager # 显式设置主机名
    build:
      context: ..
      dockerfile: docker/key_manager/Dockerfile
    environment:
      KEY_MANAGER_CERT_DIR: /etc/attestation_server/certs
      KEY_MANAGER_CONFIG_DIR: /etc/key_manager/config
      KEY_MANAGER_STATE_DIR: /etc/key_manager/state
      KEY_MANAGER_ENV_FILE: /etc/key_manager/config/.env
      KEY_MANAGER_IMPORT_TEST_DATA: "true"
    networks:
      app-network:
        aliases:
          - key_manager # 添加网络别名
    volumes:
      - /etc/attestation_server/certs:/etc/attestation_server/certs
      - /etc/key_manager/config:/etc/key_manager/config
      - /etc/key_manager/openbao-data:/opt/openbao/data
      - /etc/key_manager/state:/etc/key_manager/state
    ports:
      - "127.0.0.1:8082:8082"
    profiles:
      - keymanager  # 使用 --profile keymanager 启动此服务
volumes:
  mysql_data:
    driver: local
  redis_data:
    driver: local
  app-logs:
    driver: local
  cargo-registry-cache:
    driver: local

networks:
  app-network:
    driver: bridge