# Compose deployment for openvox-ca using the published container images.
#
# Quick start:
#   1. Change `--hostname` below to the DNS name agents will use to reach
#      the CA.
#   2. docker compose up -d        (or: podman-compose up -d)
#
# CA state lives in the named volume `ca-data`, so it survives container
# restarts and image upgrades. On first run a new CA is bootstrapped under
# /data and served over HTTPS on port 8140, using the CA's own certificate
# as the TLS server certificate (the server refuses plain HTTP on
# non-loopback addresses). For production, issue a dedicated TLS server
# certificate with `openvox-ca-ctl generate` and point
# --tls-cert/--tls-key at it: that keeps the CA's long-lived signing key
# out of the network-facing listener and presents a certificate that
# matches the server's DNS name.
#
# See docs/container-images.md for the available image tags, and
# docs/configuration.md for the full configuration reference (mTLS,
# storage backends, autosigning, ...).
#
# The compose topologies used by the integration test suites live under
# test/ (test/compose*.yml); they are not deployment examples.

name: openvox-ca

services:
  openvox-ca:
    # `:latest` is deliberately left unpinned so this example tracks the
    # newest release, but a floating tag carries no supply-chain integrity
    # guarantee: two pulls at different times can yield different images.
    # Pin a release tag (e.g. :1.2.3) or a digest for production
    # deployments; a `-alpine` variant of every tag is also published.
    image: ghcr.io/voxpupuli/openvox-ca:latest
    command:
      - --cadir=/data
      - --hostname=puppet.example.com
      - --tls-cert=/data/ca_crt.pem
      - --tls-key=/data/private/ca_key.pem
    # NOTE: autosign is off by default. Only add --autosign-config=true in
    # dev/test environments: it lets any CSR submitter obtain a signed
    # certificate without operator review.
    ports:
      - "8140:8140"
    volumes:
      - ca-data:/data
    restart: unless-stopped
    healthcheck:
      # curl exists in the default image, busybox wget in the -alpine
      # variant; certificate verification is disabled because the CA's own
      # cert does not carry localhost as a SAN.
      test: ["CMD-SHELL", "curl -skf https://localhost:8140/healthz/ready || wget -q --no-check-certificate -O /dev/null https://localhost:8140/healthz/ready"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s

volumes:
  ca-data: