name: cloud-ip-validator

# Base service definitions shared by every environment. Combine with
# docker-compose.override.yml (auto-loaded, dev) or docker-compose.prod.yml
# (prod) — see deploy/docker/RUN.txt for the exact invocations.
#
# Which services actually start is controlled per host via COMPOSE_PROFILES
# in the active .env file, matching the real deployment topology:
#   control-plane  control-api        (one management host)
#   dashboard      admin-dashboard    (optional, anywhere with network access
#                                      to control-api)
#   prober         prober             (one per external test site)
#   validator      validator-agent    (one per validator VM in the cloud)

networks:
  backend:
    name: cloud-ip-validator

volumes:
  control-api-db:
    # Same volume name deploy/docker/RUN.txt's manual `docker run -v
    # cloud-ip-validator-db:...` already uses, so a manual-Docker deployment
    # can adopt compose without losing existing data.
    name: cloud-ip-validator-db

services:
  control-api:
    build:
      context: ../..
      dockerfile: deploy/docker/control-api/Dockerfile
    image: cloud-ip-validator-control-api
    platform: linux/amd64
    profiles: ["control-plane"]
    networks: [backend]
    volumes:
      - control-api-db:/var/lib/cloud-ip-validator
    environment:
      # Static bearer tokens (empty = that API level stays open, with a
      # warning in the log). Generate with `openssl rand -hex 32`.
      CONTROL_API_ADMIN_TOKEN: "${CONTROL_API_ADMIN_TOKEN:-}"
      CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:8080/healthz"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s

  admin-dashboard:
    build:
      context: ../..
      dockerfile: deploy/docker/admin-dashboard/Dockerfile
    image: cloud-ip-validator-admin-dashboard
    platform: linux/amd64
    profiles: ["dashboard"]
    networks: [backend]
    environment:
      ADMIN_DASHBOARD_CONTROL_API_URL: "${ADMIN_DASHBOARD_CONTROL_API_URL:-http://control-api:8080}"
      ADMIN_DASHBOARD_LISTEN_ADDR: "${ADMIN_DASHBOARD_LISTEN_ADDR:-:8090}"
      ADMIN_DASHBOARD_CONTROL_API_TIMEOUT_SECONDS: "${ADMIN_DASHBOARD_CONTROL_API_TIMEOUT_SECONDS:-10}"
      ADMIN_DASHBOARD_LAST_COMPLETED_COUNT: "${ADMIN_DASHBOARD_LAST_COMPLETED_COUNT:-20}"
      ADMIN_DASHBOARD_POLL_INTERVAL_SECONDS: "${ADMIN_DASHBOARD_POLL_INTERVAL_SECONDS:-5}"
      # Admin token of control-api, and the dashboard's own login. Empty
      # username/password = login disabled (warning in the log).
      ADMIN_DASHBOARD_CONTROL_API_TOKEN: "${ADMIN_DASHBOARD_CONTROL_API_TOKEN:-}"
      ADMIN_DASHBOARD_USERNAME: "${ADMIN_DASHBOARD_USERNAME:-}"
      ADMIN_DASHBOARD_PASSWORD: "${ADMIN_DASHBOARD_PASSWORD:-}"
      ADMIN_DASHBOARD_SESSION_SECRET: "${ADMIN_DASHBOARD_SESSION_SECRET:-}"

  prober:
    build:
      context: ../..
      dockerfile: deploy/docker/prober/Dockerfile
    image: cloud-ip-validator-prober
    platform: linux/amd64
    profiles: ["prober"]
    networks: [backend]
    cap_add: [NET_RAW]
    environment:
      PROBER_SITE_ID: "${PROBER_SITE_ID:-}"
      PROBER_CONTROL_API_URL: "${PROBER_CONTROL_API_URL:-http://control-api:8080}"
      PROBER_POLL_INTERVAL_SECONDS: "${PROBER_POLL_INTERVAL_SECONDS:-5}"
      PROBER_TCP_TIMEOUT_SECONDS: "${PROBER_TCP_TIMEOUT_SECONDS:-5}"
      PROBER_ICMP_TIMEOUT_SECONDS: "${PROBER_ICMP_TIMEOUT_SECONDS:-5}"
      PROBER_ICMP_COUNT: "${PROBER_ICMP_COUNT:-3}"
      # Agent token of control-api (same value as on control-api).
      CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"

  validator-agent:
    build:
      context: ../..
      dockerfile: deploy/docker/validator-agent/Dockerfile
    image: cloud-ip-validator-validator-agent
    platform: linux/amd64
    profiles: ["validator"]
    networks: [backend]
    cap_add: [NET_RAW]
    environment:
      VALIDATOR_AGENT_VALIDATOR_ID: "${VALIDATOR_AGENT_VALIDATOR_ID:-}"
      VALIDATOR_AGENT_CONTROL_API_URL: "${VALIDATOR_AGENT_CONTROL_API_URL:-http://control-api:8080}"
      VALIDATOR_AGENT_POLL_INTERVAL_SECONDS: "${VALIDATOR_AGENT_POLL_INTERVAL_SECONDS:-5}"
      VALIDATOR_AGENT_SELF_CHECK_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_SELF_CHECK_TIMEOUT_SECONDS:-10}"
      VALIDATOR_AGENT_SELF_CHECK_METHODS: "${VALIDATOR_AGENT_SELF_CHECK_METHODS:-[ip_echo]}"
      VALIDATOR_AGENT_HTTPS_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_HTTPS_TIMEOUT_SECONDS:-10}"
      VALIDATOR_AGENT_ICMP_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_ICMP_TIMEOUT_SECONDS:-5}"
      VALIDATOR_AGENT_ICMP_COUNT: "${VALIDATOR_AGENT_ICMP_COUNT:-3}"
      VALIDATOR_AGENT_SSH_ENABLED: "${VALIDATOR_AGENT_SSH_ENABLED:-false}"
      VALIDATOR_AGENT_SSH_TIMEOUT_SECONDS: "${VALIDATOR_AGENT_SSH_TIMEOUT_SECONDS:-5}"
      # Agent token of control-api (same value as on control-api).
      CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"