# dagnats has no published image yet (upstream README: "published image
# pending"), so we build it from the pinned upstream ref. The single
# worker binary is built from this repo.
#
# Ports: 4222 NATS, 8080 dagnats HTTP API + console (/console/).
services:
  dagnats:
    build:
      context: .
      dockerfile: Dockerfile.dagnats
    ports:
      # Host ports are overridable: 8080/4222 are common SSH-tunnel targets,
      # and a collision silently points the CLI at the wrong server.
      - "${DAGNATS_NATS_PORT:-4222}:4222"
      - "${DAGNATS_HTTP_PORT:-8080}:8080"
    environment:
      # Loopback is the upstream default (server/nats.go binds 127.0.0.1 in
      # standalone mode); containers need external binds, hence 0.0.0.0 here.
      DAGNATS_HTTP_ADDR: 0.0.0.0:8080
      DAGNATS_NATS_PORT: 4222
      # Forces the embedded NATS bind to 0.0.0.0 (upstream only does this
      # in leaf mode). Points at a deliberately-unused port: solicitation
      # fails/retries in the background, the server itself is unaffected.
      # Replace with a real remote when adopting a leaf topology.
      DAGNATS_LEAF_REMOTES: nats://127.0.0.1:14229
      DAGNATS_DATA_DIR: /data
      # Console is bound to 0.0.0.0 in a container: without one of these it
      # refuses to serve (console_disabled). Password = HTTP basic auth.
      DAGNATS_CONSOLE_PASSWORD: ${DAGNATS_CONSOLE_PASSWORD:-}
    volumes:
      - dagnats-data:/data
    healthcheck:
      # status needs only NATS; exits non-zero when unhealthy. No curl/wget
      # in the slim image by design.
      test: ["CMD", "dagnats", "status"]
      interval: 10s
      timeout: 5s
      retries: 12

  worker:
    build:
      context: .
      dockerfile: Dockerfile.worker
    depends_on:
      dagnats:
        condition: service_healthy
    environment:
      DAGNATS_NATS_URL: nats://dagnats:4222
      DAGNATS_API_URL: http://dagnats:8080
      # Stage 1/2: empty = serve all clients. Stage 3: set CLIENT_ID=acme
      # so the worker loads only env/acme.env (see docs/tenancy-evolution.md).
      CLIENT_ID: ${CLIENT_ID:-}
    env_file:
      - path: .env
        required: false
    # Mount an age-encrypted env file if you use one (decrypted in RAM at
    # container start only when SECRETS_AGE_FILE + AGE_IDENTITY_FILE are set).
    # volumes:
    #   - ~/.secrets:/run/secrets:ro

volumes:
  dagnats-data: