services:
  iotlcm-sms:
    # 默认使用本地构建的镜像；推到自己的镜像仓库时用 IOTLCM_SMS_IMAGE 指定。
    image: ${IOTLCM_SMS_IMAGE:-iotlcm-sms:latest}
    container_name: iotlcm-sms
    hostname: iotlcm-sms
    restart: always
    environment:
      TZ: Asia/Shanghai
      HTTP_ADDR: :11190
      GRPC_ADDR: :11200
      # 默认凭证来自 config.yaml（只读挂载）；如需临时覆盖可用下面的环境变量。
      # SMS_ACCESS_KEY_ID: ""
      # SMS_ACCESS_KEY_SECRET: ""
      # SMS_SIGN_NAME: "示例签名"
    volumes:
      # 真实凭证文件只放服务器，不提交仓库。
      - ./config.yaml:/app/config/config.yaml:ro
    ports:
      - "11190:11190"
      - "11200:11200"
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--output-document=/dev/null", "http://127.0.0.1:11190/healthz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 5s