name: cloud-ip-validator

networks:
  backend:
    name: cloud-ip-validator

volumes:
  control-api-db:
    name: cloud-ip-validator-db

services:
  control-api:
    image: civ-capi
    platform: linux/amd64
    restart: unless-stopped
    networks: [backend]
    ports:
      - "8081:8081"
    volumes:
      - /opt/lvraid/claude/cloud_ip_validator/rxprod-compose/control-api.yaml:/etc/cloud-ip-validator/control-api.yaml:ro
      - /opt/lvraid/claude/cloud_ip_validator/rxprod-compose/capi-db:/var/lib/cloud-ip-validator
    environment:
      OS_AUTH_URL: "${OS_AUTH_URL}"
      OS_PROJECT_ID: "${OS_PROJECT_ID}"
      OS_REGION_NAME: "${OS_REGION_NAME}"
      OS_INTERFACE: "${OS_INTERFACE:-}"
      OS_TOKEN: "${OS_TOKEN:-}"
      OS_USERNAME: "${OS_USERNAME:-}"
      OS_USER_DOMAIN_NAME: "${OS_USER_DOMAIN_NAME:-}"
      OS_PASSWORD: "${OS_PASSWORD:-}"
      # Static bearer tokens (set in .env; empty = that API level is open).
      # Generate with: openssl rand -hex 32
      CONTROL_API_ADMIN_TOKEN: "${CONTROL_API_ADMIN_TOKEN:-}"
      CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:8081/healthz"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s

  admin-dashboard:
    image: civ-adash
    platform: linux/amd64
    restart: unless-stopped
    networks: [backend]
    ports:
      - "8091:8090"
    environment:
      ADMIN_DASHBOARD_CONTROL_API_URL: http://control-api:8081
      # Admin token of control-api + the dashboard login (empty username/
      # password = login disabled).
      ADMIN_DASHBOARD_CONTROL_API_TOKEN: "${ADMIN_DASHBOARD_CONTROL_API_TOKEN:-}"
      ADMIN_DASHBOARD_USERNAME: "${ADMIN_DASHBOARD_USERNAME:-}"
      ADMIN_DASHBOARD_PASSWORD: "${ADMIN_DASHBOARD_PASSWORD:-}"
      ADMIN_DASHBOARD_SESSION_SECRET: "${ADMIN_DASHBOARD_SESSION_SECRET:-}"
    depends_on:
      control-api:
        condition: service_healthy

  prober:
    image: civ-prober
    platform: linux/amd64
    restart: unless-stopped
    networks: [backend]
    cap_add: [NET_RAW]
    environment:
      PROBER_SITE_ID: "${PROBER_SITE_ID}"
      PROBER_CONTROL_API_URL: http://control-api:8081
      CONTROL_API_AGENT_TOKEN: "${CONTROL_API_AGENT_TOKEN:-}"
    depends_on:
      control-api:
        condition: service_healthy