# 发布链路的「数据面接线」override（不含任何门禁开关）
# 用法：docker compose -f compose.yaml -f compose.release-sim.yaml up -d api release-worker
# 叠加顺序：compose.yaml → 本文件（接线）→ compose.release-gates.yaml（门禁，须人工授权）
# 作用：
#   1) api 拿到生产 WeKnora 凭据引用 →「生产知识库绑定」能读真实生产库列表
#   2) release-worker 拿到发布配置、目标端点别名、归档卷（执行门禁关闭时不加载配置）
services:
  api:
    environment:
      # 凭据只引用 0600 文件（值不入库、不回显）；appconfig 要求两者同时给出
      PRODUCTION_WEKNORA_BASE_URL: https://weknora-test.dobot.cn
      PRODUCTION_WEKNORA_API_KEY_FILE: /run/release-secrets/target_weknora_api_key
      # 整库逻辑备份的目标主机（「系统设置 → 存储与备份」下发 cron 与立即备份都走这里）。
      # 凭据是挂载进来的 0600 ssh 配置 + 私钥；不挂载则页面显示"未接线"，不会报错。
      BACKUP_HOST_SSH_CONFIG: /run/backup-host/ssh_config
      BACKUP_HOST_TARGET: weknora-test
      BACKUP_HOST_SCRIPT_DIR: /opt/weknora-test
      BACKUP_HOST_ROOT: /srv/kb-backups
    volumes:
      - ./secrets/release-sim:/run/release-secrets:ro
      - ./secrets/backup-host:/run/backup-host:ro

  release-worker:
    environment:
      RELEASE_CONFIG_FILE: /run/release-sim/release.sim.json
      PRODUCTION_RELEASE_AUTHORIZER_REF: yaozhanghao
    extra_hosts:
      - "host.docker.internal:host-gateway"
      - "prod-pg:host-gateway"
      - "prod-es:host-gateway"
      - "prod-weknora:host-gateway"
    networks:
      - default
      - weknora-local
    volumes:
      - ./secrets/release-sim:/run/release-secrets:ro
      - ./config/release.sim.json:/run/release-sim/release.sim.json:ro
      - release-bundles:/var/lib/knowledge-governance/release-bundles
      # 发布前快照留档目录（只读）：写目标库之前必须存在覆盖该库的新快照
      # 备份目录契约：本地默认 ./backups，主机上设 KB_BACKUP_ROOT=/srv/kb-backups（见 scripts/backup_layout.sh）
      - ${KB_BACKUP_ROOT:-./backups}/target-kb-snapshots:/var/lib/knowledge-governance/target-kb-snapshots:ro
    read_only: false

volumes:
  release-bundles:
    name: knowledge-governance-release-bundles