docker-compose.yml

# ──────────────────────────────────────────────
# AgentHub Hub Server — Docker Compose 开发环境
# ──────────────────────────────────────────────
# 启动完整 Hub 技术栈：PostgreSQL 16 + Redis 7 + Hub Server。
#
# 快速开始：
#   cp .env.example .env              # 首次：复制环境变量（已提供默认值）
#   ./scripts/dev/dev-up.sh               # 一键启动全部服务
#   ./scripts/dev/dev-down.sh             # 停止并清理
#
# 仅启动基础设施（自己用 go run 启动 Hub Server）：
#   docker compose up -d postgres redis
#   cd hub-server && go run ./cmd/server-hub
#
# 服务端口：
#   Hub Server API:  http://localhost:8080
#   Hub Admin/metrics: http://localhost:6060
#   PostgreSQL:       localhost:5432
#   Redis:            localhost:6379
#
# 默认仅绑定 127.0.0.1，避免开发密码和管理端口暴露到局域网。
# 如确需远程调试，显式设置 AGENTHUB_BIND_HOST=0.0.0.0 并自行加防火墙。
# ──────────────────────────────────────────────

services:
  # ── PostgreSQL 16 ──────────────────────────
  postgres:
    image: postgres:16-alpine
    container_name: agenthub-postgres
    restart: unless-stopped
    mem_limit: ${AGENTHUB_POSTGRES_MEM_LIMIT:-512m}
    cpus: ${AGENTHUB_POSTGRES_CPUS:-1.0}
    pids_limit: ${AGENTHUB_POSTGRES_PIDS_LIMIT:-256}
    environment:
      POSTGRES_DB: ${AGENTHUB_DB_NAME:-agenthub}
      POSTGRES_USER: ${AGENTHUB_DB_USER:-agenthub}
      POSTGRES_PASSWORD: ${AGENTHUB_DB_PASSWORD:?请设置 AGENTHUB_DB_PASSWORD（开发环境可设为 dev_password）}
    ports:
      - "${AGENTHUB_BIND_HOST:-127.0.0.1}:${AGENTHUB_DB_PORT:-5432}:5432"
    volumes:
      - pg_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${AGENTHUB_DB_USER:-agenthub} -d ${AGENTHUB_DB_NAME:-agenthub}"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s
    networks:
      - agenthub-net
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # ── Redis 7 ────────────────────────────────
  redis:
    image: redis:7-alpine
    container_name: agenthub-redis
    restart: unless-stopped
    mem_limit: ${AGENTHUB_REDIS_CONTAINER_MEM_LIMIT:-256m}
    cpus: ${AGENTHUB_REDIS_CPUS:-0.5}
    pids_limit: ${AGENTHUB_REDIS_PIDS_LIMIT:-128}
    command: >
      redis-server
      --appendonly yes
      --appendfsync everysec
      --maxmemory 256mb
      --maxmemory-policy allkeys-lru
      --save 900 1
      --save 300 10
    ports:
      - "${AGENTHUB_BIND_HOST:-127.0.0.1}:${AGENTHUB_REDIS_PORT:-6379}:6379"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 5s
    networks:
      - agenthub-net
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # ── Hub Server ─────────────────────────────
  hub-server:
    build:
      # Dockerfile 要求 build context 为仓库根（COPY go.work/pkg/edge-server），
      # 不能用 ./hub-server，否则 docker compose up --build 必然失败。
      context: .
      dockerfile: hub-server/deployments/Dockerfile
    container_name: agenthub-hub
    restart: unless-stopped
    mem_limit: ${AGENTHUB_HUB_MEM_LIMIT:-512m}
    cpus: ${AGENTHUB_HUB_CPUS:-2.0}
    pids_limit: ${AGENTHUB_HUB_PIDS_LIMIT:-512}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      # 数据库
      AGENTHUB_DB_HOST: postgres
      AGENTHUB_DB_PORT: "5432"
      AGENTHUB_DB_USER: ${AGENTHUB_DB_USER:-agenthub}
      AGENTHUB_DB_PASSWORD: ${AGENTHUB_DB_PASSWORD:?请设置 AGENTHUB_DB_PASSWORD}
      AGENTHUB_DB_NAME: ${AGENTHUB_DB_NAME:-agenthub}
      AGENTHUB_DB_SSLMODE: ${AGENTHUB_DB_SSLMODE:-disable}
      # Redis
      AGENTHUB_REDIS_HOST: redis
      AGENTHUB_REDIS_PORT: "6379"
      AGENTHUB_REDIS_PASSWORD: ""
      AGENTHUB_REDIS_DB: "0"
      AGENTHUB_REDIS_POOL_SIZE: "100"
      AGENTHUB_REDIS_MIN_IDLE_CONNS: "10"
      # 安全硬化（与 deployments/production 对齐，防开发/生产鉴权行为漂移）：
      # AUTH_FAIL_CLOSED 让已撤销 access JWT 在 Redis 故障时无法回魂；
      # RATE_LIMIT_FAIL_OPEN=false 让非鉴权限流在 Redis 故障时也 fail-closed。
      AGENTHUB_AUTH_FAIL_CLOSED: ${AGENTHUB_AUTH_FAIL_CLOSED:-true}
      AGENTHUB_RATE_LIMIT_FAIL_OPEN: ${AGENTHUB_RATE_LIMIT_FAIL_OPEN:-false}
      # JWT
      AGENTHUB_JWT_SECRET: ${AGENTHUB_JWT_SECRET:?请设置 AGENTHUB_JWT_SECRET（开发环境可设为 dev-secret-change-in-production-min-length-32）}
      AGENTHUB_JWT_ACCESS_TTL: ${AGENTHUB_JWT_ACCESS_TTL:-15m}
      AGENTHUB_JWT_REFRESH_TTL: ${AGENTHUB_JWT_REFRESH_TTL:-720h}
      # 服务
      AGENTHUB_SERVER_PORT: "8080"
      AGENTHUB_LOG_LEVEL: ${AGENTHUB_LOG_LEVEL:-}
      # Legacy alias: still forwarded so existing .env files keep working.
      AGENTHUB_SERVER_LOG_LEVEL: ${AGENTHUB_SERVER_LOG_LEVEL:-}
      AGENTHUB_SERVER_ADMIN_PORT: "6060"
      AGENTHUB_UPLOAD_DIR: ${AGENTHUB_UPLOAD_DIR:-./uploads}
      AGENTHUB_UPLOAD_MAX_SIZE: ${AGENTHUB_UPLOAD_MAX_SIZE:-10485760}
      # TokenDance ID OIDC. Values stay empty in local dev unless the operator
      # has registered an AgentHub OAuth client in TokenDance ID.
      # Web dev owns browser callbacks on 5174. Desktop/Tauri uses the
      # http://127.0.0.1/callback loopback policy for dynamic callback ports;
      # do not register Desktop port 5173 as a Web callback.
      # Run hub-server/scripts/setup-tokendance-oidc.sh to register the client,
      # then set the CLIENT_ID and CLIENT_SECRET below.
      AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-http://localhost:3000}
      AGENTHUB_TOKENDANCE_ID_JWKS_URI: ${AGENTHUB_TOKENDANCE_ID_JWKS_URI:-}
      AGENTHUB_TOKENDANCE_ID_CLIENT_ID: ${AGENTHUB_TOKENDANCE_ID_CLIENT_ID:-}
      AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET: ${AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET:-}
      AGENTHUB_TOKENDANCE_ID_REDIRECT_URI: ${AGENTHUB_TOKENDANCE_ID_REDIRECT_URI:-http://127.0.0.1/callback}
      AGENTHUB_TOKENDANCE_ID_ALLOWED_REDIRECT_URIS: ${AGENTHUB_TOKENDANCE_ID_ALLOWED_REDIRECT_URIS:-http://127.0.0.1/callback,http://localhost:5174/auth/tokendance/callback,http://127.0.0.1:5174/auth/tokendance/callback}
    ports:
      - "${AGENTHUB_BIND_HOST:-127.0.0.1}:${AGENTHUB_SERVER_PORT:-8080}:8080"
      - "${AGENTHUB_BIND_HOST:-127.0.0.1}:${AGENTHUB_SERVER_ADMIN_PORT:-6060}:6060"
    volumes:
      - uploads_data:/app/uploads
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64M
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 15s
    networks:
      - agenthub-net
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  pg_data:
    name: agenthub_pg_data
  redis_data:
    name: agenthub_redis_data
  uploads_data:
    name: agenthub_uploads

networks:
  agenthub-net:
    name: agenthub-net
    driver: bridge