services:
  pipeline:
    build: .
    # The image runs as the non-root `node` user for Kubernetes. For local dev
    # we override back to root so the ./output bind mount keeps working
    # regardless of the host user's uid; Kubernetes sets fsGroup instead.
    user: "0:0"
    ports:
      - "${PORT:-13000}:3000"
    # Pass EVERY variable from .env (API keys, OSS, Feishu, SCHEDULES,
    # SCHEDULER_ENABLED, LOG_LEVEL, …) into the container automatically via
    # env_file — no per-variable list to maintain. The previous explicit list
    # silently dropped any var not enumerated, so new knobs set in .env never
    # reached the container. `environment` below only adds container-specific
    # defaults for keys that may be absent from .env, and overrides env_file for
    # those keys.
    env_file:
      - .env
    environment:
      - OUTPUT_DIR=${OUTPUT_DIR:-/app/output}
      - OUTPUT_RETENTION_DAYS=${OUTPUT_RETENTION_DAYS:-30}
      - TZ=${TZ:-Asia/Shanghai}
      - TIMEZONE=${TIMEZONE:-Asia/Shanghai}
    volumes:
      - ./output:/app/output
      - pipeline-jobs:/tmp/pipeline-jobs
    # Use public DNS resolvers directly. The container inherits the host's
    # resolver, which can silently fail to resolve some public domains (e.g.
    # open.feishu.cn behind a VPN/proxy) and break the Feishu webhook. Override
    # via DNS_SERVER_1/DNS_SERVER_2 in .env if you need an internal resolver.
    dns:
      - ${DNS_SERVER_1:-223.5.5.5}
      - ${DNS_SERVER_2:-114.114.114.114}
    restart: unless-stopped

volumes:
  pipeline-jobs: