# ❌ 密码硬编码在 compose.yaml（会进入版本控制）
services:
  db:
    environment:
      POSTGRES_PASSWORD: MyS3cretP@ss!

# ❌ 密码硬编码在 Dockerfile（会进入镜像层）
# FROM postgres:16
# ENV POSTGRES_PASSWORD=MyS3cretP@ss!

services:
  db:
    image: postgres:16-alpine
    secrets:
      - db_password
      - db_user
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
      POSTGRES_USER_FILE: /run/secrets/db_user

secrets:
  db_password:
    file: ./secrets/db_password.txt
  db_user:
    file: ./secrets/db_user.txt

# 创建密钥文件
mkdir -p secrets
echo "MyS3cretP@ss!" > secrets/db_password.txt
echo "admin" > secrets/db_user.txt

# 设置权限
chmod 600 secrets/*.txt

# 容器内默认挂载在 /run/secrets/<secret_name>
docker compose exec db ls /run/secrets/
# db_password
# db_user

# 读取密钥
docker compose exec db cat /run/secrets/db_password
# MyS3cretP@ss!

services:
  app:
    image: myapp:latest
    secrets:
      - source: api_key
        target: /app/config/api_key.txt
        mode: 0400           # 只读权限
        uid: "1000"
        gid: "1000"
      - source: tls_cert
        target: /app/certs/server.crt
        mode: 0444

secrets:
  api_key:
    file: ./secrets/api_key.txt
  tls_cert:
    file: ./secrets/tls.crt

services:
  app:
    image: myapp:latest
    secrets:
      - source: db_password
        target: db_password
    environment:
      # 许多官方镜像支持 _FILE 后缀
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password

  # 支持 _FILE 后缀的常见官方镜像
  # - PostgreSQL: POSTGRES_PASSWORD_FILE
  # - MySQL: MYSQL_ROOT_PASSWORD_FILE, MYSQL_PASSWORD_FILE
  # - Redis: REDIS_PASSWORD_FILE (需确认版本)
  # - WordPress: WORDPRESS_DB_PASSWORD_FILE

# Python — 读取文件中的密钥
def get_secret(secret_name, default=None):
    """从 Docker Secrets 或环境变量读取密钥"""
    secret_path = f"/run/secrets/{secret_name}"
    try:
        with open(secret_path, 'r') as f:
            return f.read().strip()
    except FileNotFoundError:
        return os.environ.get(secret_name.upper(), default)

db_password = get_secret('db_password')
api_key = get_secret('api_key')

// Node.js
const fs = require('fs');

function getSecret(name) {
  try {
    return fs.readFileSync(`/run/secrets/${name}`, 'utf8').trim();
  } catch {
    return process.env[name.toUpperCase()];
  }
}

const dbPassword = getSecret('db_password');

// Go
import "os"

func getSecret(name string) string {
    data, err := os.ReadFile(fmt.Sprintf("/run/secrets/%s", name))
    if err == nil {
        return strings.TrimSpace(string(data))
    }
    return os.Getenv(strings.ToUpper(name))
}

services:
  nginx:
    image: nginx:alpine
    configs:
      - source: nginx_config
        target: /etc/nginx/nginx.conf
        mode: 0444

  app:
    image: myapp:latest
    configs:
      - source: app_config
        target: /app/config.yaml

configs:
  nginx_config:
    file: ./config/nginx.conf
  app_config:
    file: ./config/app.yaml

configs:
  nginx_config:
    content: |
      server {
        listen 80;
        server_name localhost;

        location / {
          proxy_pass http://app:3000;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
        }

        location /health {
          return 200 'OK';
          add_header Content-Type text/plain;
        }
      }

services:
  vault:
    image: hashicorp/vault:latest
    cap_add:
      - IPC_LOCK
    environment:
      VAULT_DEV_ROOT_TOKEN_ID: "root-token"
      VAULT_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
    ports:
      - "8200:8200"

  app:
    image: myapp:latest
    environment:
      VAULT_ADDR: "http://vault:8200"
      VAULT_TOKEN_FILE: /run/secrets/vault_token
    secrets:
      - vault_token
    depends_on:
      - vault

secrets:
  vault_token:
    file: ./secrets/vault_token.txt

services:
  app:
    image: myapp:latest
    environment:
      AWS_REGION: us-east-1
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      # 应用代码中通过 AWS SDK 获取密钥

# 安装 sops
# 使用 age 或 GPG 加密 .env 文件
sops -e .env.production > .env.production.enc

# 在 CI/CD 中解密
# sops -d .env.production.enc > .env.production
# docker compose --env-file .env.production up -d

services:
  nginx:
    image: nginx:alpine
    ports:
      - "443:443"
    secrets:
      - source: tls_cert
        target: /etc/nginx/certs/server.crt
        mode: 0444
      - source: tls_key
        target: /etc/nginx/certs/server.key
        mode: 0400
    configs:
      - source: nginx_ssl_config
        target: /etc/nginx/conf.d/default.conf

secrets:
  tls_cert:
    file: ./certs/server.crt
  tls_key:
    file: ./certs/server.key

configs:
  nginx_ssl_config:
    content: |
      server {
        listen 443 ssl;
        ssl_certificate /etc/nginx/certs/server.crt;
        ssl_certificate_key /etc/nginx/certs/server.key;
        location / {
          proxy_pass http://app:3000;
        }
      }

services:
  app:
    build: ./app
    environment:
      NODE_ENV: ${NODE_ENV:-production}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      DB_HOST: db
      DB_NAME: myapp
      DB_USER: postgres
      # 敏感值通过文件传递
      DB_PASSWORD_FILE: /run/secrets/db_password
      API_KEY_FILE: /run/secrets/api_key
      JWT_SECRET_FILE: /run/secrets/jwt_secret
    secrets:
      - db_password
      - api_key
      - jwt_secret
    configs:
      - source: app_config
        target: /app/config.yaml
    depends_on:
      db:
        condition: service_healthy
    restart: unless-stopped

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    secrets:
      - db_password
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      retries: 5
    restart: unless-stopped

  nginx:
    image: nginx:alpine
    ports:
      - "443:443"
    secrets:
      - source: tls_cert
        target: /etc/nginx/certs/server.crt
        mode: 0444
      - source: tls_key
        target: /etc/nginx/certs/server.key
        mode: 0400
    configs:
      - source: nginx_config
        target: /etc/nginx/conf.d/default.conf
    depends_on:
      - app
    restart: unless-stopped

secrets:
  db_password:
    file: ./secrets/db_password.txt
  api_key:
    file: ./secrets/api_key.txt
  jwt_secret:
    file: ./secrets/jwt_secret.txt
  tls_cert:
    file: ./secrets/tls/server.crt
  tls_key:
    file: ./secrets/tls/server.key

configs:
  app_config:
    file: ./config/app.yaml
  nginx_config:
    file: ./config/nginx.conf

volumes:
  pgdata: