# MinIO S3 对象存储配置
# 仅内网访问 (Tailscale): http://100.64.0.2:9000 (S3 API) 和 http://100.64.0.2:9001 (Console)
# 公网文件上传下载通过 Supabase Storage API: https://amiap.hzau.edu.cn/supa/storage/v1/

services:
  minio:
    image: minio/minio
    ports:
      # 仅绑定到 Tailscale IP，内网访问
      - "100.64.0.2:9000:9000"  # S3 API (内网)
      - "100.64.0.2:9001:9001"  # Console (内网)
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
      # 启用浏览器访问
      MINIO_BROWSER: "on"
      # 内网访问，不需要公网 URL
      MINIO_SERVER_URL: "http://100.64.0.2:9000"
      # 控制台内网访问
      MINIO_BROWSER_REDIRECT_URL: "http://100.64.0.2:9001"
      # 禁用文件凭证，使用环境变量
      MINIO_ROOT_USER_FILE: ""
      MINIO_ROOT_PASSWORD_FILE: ""
    command: server --console-address ":9001" /data
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:9000/minio/health/live" ]
      interval: 2s
      timeout: 10s
      retries: 5
    volumes:
      - /vol1/1000/s3:/data:z
    networks:
      - default
    # 不再配置 Traefik labels，仅内网访问

  minio-createbucket:
    image: minio/mc
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      /usr/bin/mc alias set supa-minio http://minio:9000 ${MINIO_ROOT_USER} ${MINIO_ROOT_PASSWORD};
      /usr/bin/mc mb supa-minio/stub;
      exit 0;
      "

networks:
  default:
    name: supabase_default
    external: true