services:
  pipeline:
    build: .
    # Run as the image's non-root `node` user by default (uid 1000 == host
    # `lkattey` here, and the same user Kubernetes runs the image as, so local
    # compose mirrors prod's filesystem ownership). Bind-mounted files (./output,
    # ./.data) therefore stay host-accessible instead of root-owned. On a host
    # whose uid isn't 1000, set HOST_UID/HOST_GID (in .env or the shell) to your
    # numeric uid:gid so the bind mounts match your user.
    user: "${HOST_UID:-node}:${HOST_GID:-node}"
    ports:
      - "${PORT:-13000}:3000"
    # Pass EVERY variable from .env (API keys, OSS, Feishu, SCHEDULES,
    # SCHEDULER_ENABLED, LOG_LEVEL, …) into the container automatically via
    # env_file — no per-variable list to maintain. The previous explicit list
    # silently dropped any var not enumerated, so new knobs set in .env never
    # reached the container. `environment` below only adds container-specific
    # defaults for keys that may be absent from .env, and overrides env_file for
    # those keys.
    env_file:
      - .env
    environment:
      # PIN container's listening port to 3000. `PORT` in .env is the HOST
      # port for the mapping above ("${PORT:-13000}:3000") — it must NOT reach
      # Next.js inside the container, or `next start` reads PORT=13000 and
      # listens on the wrong port, so both the 13000->3000 mapping and the
      # HEALTHCHECK (which probes :3000) miss it → container goes unhealthy
      # and the WebUI is unreachable. `environment` overrides `env_file`, so
      # this neutralizes the PORT leaked by env_file below.
      - PORT=3000
      - OUTPUT_DIR=${OUTPUT_DIR:-/app/output}
      - OUTPUT_RETENTION_DAYS=${OUTPUT_RETENTION_DAYS:-30}
      - TZ=${TZ:-Asia/Shanghai}
      - TIMEZONE=${TIMEZONE:-Asia/Shanghai}
    volumes:
      - ./output:/app/output
      # Bind mount (pre-created as uid 1000 on the host) instead of a named
      # volume: named volumes are root-owned, which the non-root container
      # (uid 1000) below couldn't write to. .data is gitignored.
      - ./.data/pipeline-jobs:/tmp/pipeline-jobs
    # Use public DNS resolvers directly. The container inherits the host's
    # resolver, which can silently fail to resolve some public domains (e.g.
    # open.feishu.cn behind a VPN/proxy) and break the Feishu webhook. Override
    # via DNS_SERVER_1/DNS_SERVER_2 in .env if you need an internal resolver.
    dns:
      - ${DNS_SERVER_1:-223.5.5.5}
      - ${DNS_SERVER_2:-114.114.114.114}
    restart: unless-stopped