# 公网测试 overlay。用法（在仓库根目录，由总工执行，本卡不跑）：
#   ./scripts/load-jpush-secret.sh
#   docker compose -f docker-compose.yaml -f deploy/public/docker-compose.public.yaml up -d
# 不要用 shell source/. 加载 .env：JPUSH_PUSH_INTENT 含分号，未加引号时会被拆成命令。
# compose 会自行读取仓库根目录 .env 做变量替换；Master Secret 只经 load-jpush-secret.sh 注入。
#
# 原则：内部端口只绑 127.0.0.1；对外只开 80/443 + LiveKit 媒体 17881/tcp、17882/udp。
# ports 使用 !override，避免与基础 compose 的 0.0.0.0 绑定叠加。
# 回滚：去掉本 overlay，改回 docker compose -f docker-compose.yaml up -d，数据目录 components/ 与 data/ 不动。

services:
  openim-server:
    ports: !override
      - "127.0.0.1:${OPENIM_MSG_GATEWAY_PORT}:10001"
      - "127.0.0.1:${OPENIM_API_PORT}:10002"
    environment:
      - IMENV_OPENIM_PUSH_ENABLE=${OPENIM_PUSH_ENABLE:-jpush}
      - IMENV_OPENIM_PUSH_JPUSH_APPKEY=${JPUSH_APPKEY}
      - IMENV_OPENIM_PUSH_JPUSH_MASTERSECRET=${JPUSH_MASTER_SECRET}
      - IMENV_OPENIM_PUSH_JPUSH_PUSHURL=${JPUSH_PUSH_URL:-https://api.jpush.cn/v3/push}
      - IMENV_OPENIM_PUSH_JPUSH_PUSHINTENT=${JPUSH_PUSH_INTENT}

  minio:
    ports: !override
      - "127.0.0.1:${MINIO_PORT}:9000"
      - "127.0.0.1:${MINIO_CONSOLE_PORT}:9090"

  etcd:
    ports: !override
      - "127.0.0.1:12379:2379"
      - "127.0.0.1:12380:2380"

  livekit:
    command: --config /etc/livekit.yaml --node-ip ${SERVER_IP}
    ports: !override
      - "127.0.0.1:${LIVEKIT_PORT:-17880}:17880"
      - "${LIVEKIT_RTC_TCP_PORT:-17881}:17881"
      - "${LIVEKIT_RTC_UDP_PORT:-17882}:17882/udp"
    volumes:
      - ./config/livekit.public.yaml:/etc/livekit.yaml

  account-server:
    ports: !override
      - "127.0.0.1:${ACCOUNT_PORT:-10010}:10010"

  edge:
    image: nginx:1.27-alpine
    container_name: jxd-edge
    restart: always
    network_mode: host
    volumes:
      - ./deploy/public/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./deploy/public/acme:/var/www/acme:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro
    depends_on:
      - openim-server
      - account-server
      - minio
      - livekit