x-runtime: &runtime
  build:
    context: .
  image: ${APP_IMAGE:-xiaobai-review-next:preflight}
  init: true
  environment:
    APP_ENV: production
    APP_HOST: 0.0.0.0
    APP_PORT: 8765
    APP_DATA_DIR: /app/data
    APP_DATABASE_PATH: /app/data/xiaobai.db
    APP_PRIVATE_MENTOR_SKILLS_DIR: /app/data/private-mentor-skills
    APP_ENCRYPTION_KEY: ${APP_ENCRYPTION_KEY:?APP_ENCRYPTION_KEY must be set}
    APP_LOG_LEVEL: ${APP_LOG_LEVEL:-INFO}
    APP_TIMEZONE: ${APP_TIMEZONE:-Asia/Shanghai}
  volumes:
    - ${APP_STORAGE_PATH:?APP_STORAGE_PATH must be a dedicated preflight directory}:/app/data
  read_only: true
  tmpfs:
    - /tmp:size=64m,mode=1777
  security_opt:
    - no-new-privileges:true
  cap_drop:
    - ALL

services:
  migration:
    <<: *runtime
    restart: "no"
    command:
      - python
      - -m
      - tools.legacy_migration
      - --source
      - /app/data/legacy-review.db
      - --target
      - /app/data/xiaobai.db
      - --report
      - /app/data/migration-report.json

  web:
    <<: *runtime
    restart: unless-stopped
    ports:
      - "${APP_PUBLISH_PORT:-8876}:8765"
    depends_on:
      migration:
        condition: service_completed_successfully
    stop_grace_period: 30s