services:
  cn-dns-helper:
    build: /srv/cn-dns-helper
    image: cn-dns-helper:local
    container_name: cn-dns-helper
    restart: unless-stopped
    # ★ 只绑本机回环：外部经 1Panel/openresty 反代进来，容器端口不直接暴露
    ports:
      - "127.0.0.1:8018:8018"
    environment:
      # CF_API_TOKEN：有 Zone/DNS 权限的 Cloudflare token（从 certimate 迁出）
      CF_API_TOKEN: ${CF_API_TOKEN:?}
      # DNS_HELPER_TOKEN：Worker 侧调用本服务的共享密钥，两边必须一致
      DNS_HELPER_TOKEN: ${DNS_HELPER_TOKEN:?}
      BIND_HOST: 0.0.0.0
      BIND_PORT: "8018"
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8018/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s