services:
  ai-gateway:
    image: node:24-alpine
    container_name: ai-gateway
    restart: unless-stopped
    command: ["node", "/app/server.mjs"]
    environment:
      PORT: "8093"
      DATABASE_PATH: /data/vault.db
      MASTER_KEY_FILE: /run/secrets/vault_master_key
      SERVICE_TOKEN_FILE: /run/secrets/portal_gateway_hmac
      PROVIDER_CATALOG_FILE: /app/providers.json
      ADMIN_USERNAME: liooil
    volumes:
      - ./vault.mjs:/app/vault.mjs:ro
      - ./server.mjs:/app/server.mjs:ro
      - ./providers.mjs:/app/providers.mjs:ro
      - ./providers.json:/app/providers.json:ro
      - ./cli.mjs:/app/cli.mjs:ro
      - ./data:/data
      - ./secrets:/run/secrets:ro
    read_only: true
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8093/healthz').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 5s
    networks:
      - homelab_net
    labels:
      - "traefik.enable=false"
      - "xiteng.site.component.ai-gateway.enabled=true"
      - "xiteng.site.component.ai-gateway.name=Key Vault"
      - "xiteng.site.component.ai-gateway.description=按用户保存 Backend Provider 凭据，并提供内置与 Custom Provider Registry。"
      - "xiteng.site.component.ai-gateway.section=infrastructure"
      - "xiteng.site.component.ai-gateway.category=身份与访问"
      - "xiteng.site.component.ai-gateway.access=internal"
      - "xiteng.site.component.ai-gateway.access-label=仅通过 Portal/API 使用"
      - "xiteng.site.component.ai-gateway.icon=KV"
      - "xiteng.site.component.ai-gateway.accent=blue"
      - "xiteng.site.component.ai-gateway.order=220"
      - "xiteng.site.component.ai-gateway.monitor.enabled=true"
      - "xiteng.site.component.ai-gateway.monitor.url=http://ai-gateway:8093/healthz"

networks:
  homelab_net:
    external: true