version: '3.8'

services:
  mysql:
    image: mysql:8.0
    container_name: one-api-mysql
    restart: always
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=oneapi
    volumes:
      - ./mysql-data:/var/lib/mysql
    networks:
      - ai-network

  one-api:
    image: justsong/one-api:latest
    container_name: one-api
    restart: always
    ports:
      # 3000 已被 NAS 上的 Gitea 容器占用，改用 3001；仅绑定 127.0.0.1，不对局域网/公网暴露
      # 远程管理走 SSH 隧道：ssh -p 2222 -L 3001:127.0.0.1:3001 ericwyuan@192.168.50.64
      - "127.0.0.1:3001:3000"
    volumes:
      - ./one-api-data:/data
    environment:
      - SQL_DSN=root:${MYSQL_ROOT_PASSWORD}@tcp(mysql:3306)/oneapi
      - TZ=Asia/Shanghai
    depends_on:
      - mysql
    networks:
      - ai-network

  lobe-chat:
    image: lobehub/lobe-chat:latest
    container_name: lobe-chat
    restart: always
    # 不发布主机端口：仅 Nginx 通过容器网络访问 lobe-chat:3210
    environment:
      - OPENAI_API_KEY=${ONE_API_TOKEN}
      - OPENAI_PROXY_URL=http://one-api:3000/v1
      - ACCESS_CODE=${LOBE_ACCESS_CODE}
      - DEFAULT_LANG=zh-CN
    depends_on:
      - one-api
    networks:
      - ai-network

  nginx:
    image: nginx:alpine
    container_name: nginx-proxy
    restart: always
    ports:
      # NAS 本机 80/443 已被其他服务占用（DSM/其他容器），改用 8443
      # 甲骨文 frp 隧道（frpc.toml [[proxies]] name=nexusai）将公网专属端口 3210 转发到 NAS 的 8443
      - "8443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./certs:/etc/nginx/certs:ro
    depends_on:
      - lobe-chat
    networks:
      - ai-network

networks:
  ai-network:
    driver: bridge