name: cordum

# Default path: `docker compose pull && docker compose up -d` pulls every
# Cordum service image from ghcr.io/cordum-io/cordum (tag from
# ${CORDUM_VERSION:-latest}) — no source checkout or local build needed.
#
# Contributor path: `docker compose -f docker-compose.yml -f docker-compose.dev.yml up --build`
# overrides every `image:` with a local build from this tree. The Makefile
# target `make dev-up` chains both files for convenience.

services:
  nats:
    image: nats:2.10-alpine
    command: ["-c", "/etc/nats/nats.conf"]
    ports:
      - "4222:4222"
    volumes:
      - ./config/nats.dev-tls.conf:/etc/nats/nats.conf:ro
      - ./certs:/etc/cordum/tls:ro
      - nats_data:/data
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8222/healthz || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  redis:
    image: redis:7-alpine
    command:
      - redis-server
      - --appendonly
      - "yes"
      - --requirepass
      - "${REDIS_PASSWORD:?REDIS_PASSWORD_not_set}"
      - --port
      - "0"
      - --tls-port
      - "6379"
      - --tls-cert-file
      - /etc/cordum/tls/server/tls.crt
      - --tls-key-file
      - /etc/cordum/tls/server/tls.key
      - --tls-ca-cert-file
      - /etc/cordum/tls/ca/ca.crt
      - --tls-auth-clients
      - "no"
    ports:
      - "6379:6379"
    volumes:
      - ./certs:/etc/cordum/tls:ro
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "--tls", "--cacert", "/etc/cordum/tls/ca/ca.crt", "-a", "${REDIS_PASSWORD:?REDIS_PASSWORD_not_set}", "ping"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  context-engine:
    image: ghcr.io/cordum-io/cordum/context-engine:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE: cordum-context-engine
    depends_on:
      redis:
        condition: service_healthy
    environment:
      - REDIS_URL=rediss://:${REDIS_PASSWORD:?REDIS_PASSWORD_not_set}@redis:6379
      - REDIS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - REDIS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - REDIS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - REDIS_TLS_SERVER_NAME=redis
      - CONTEXT_ENGINE_ADDR=:50070
      - CONTEXT_ENGINE_TLS_CERT=/etc/cordum/tls/server/tls.crt
      - CONTEXT_ENGINE_TLS_KEY=/etc/cordum/tls/server/tls.key
    volumes:
      - ./certs:/etc/cordum/tls:ro
    ports:
      - "50400:50070"
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "1.0"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9094/readyz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 15s

  safety-kernel:
    image: ghcr.io/cordum-io/cordum/safety-kernel:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE: cordum-safety-kernel
    depends_on:
      nats:
        condition: service_healthy
    environment:
      - NATS_URL=tls://nats:4222
      - NATS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - NATS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - NATS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - NATS_TLS_SERVER_NAME=nats
      - NATS_TOKEN=${NATS_TOKEN:-cordum-dev-token}
      - REDIS_URL=rediss://:${REDIS_PASSWORD:?REDIS_PASSWORD_not_set}@redis:6379
      - REDIS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - REDIS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - REDIS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - REDIS_TLS_SERVER_NAME=redis
      - SAFETY_KERNEL_ADDR=:50051
      - SAFETY_KERNEL_TLS_CERT=/etc/cordum/tls/server/tls.crt
      - SAFETY_KERNEL_TLS_KEY=/etc/cordum/tls/server/tls.key
      - SAFETY_POLICY_PATH=/etc/cordum/safety.yaml
      - SAFETY_POLICY_RELOAD_INTERVAL=${SAFETY_POLICY_RELOAD_INTERVAL:-60s}
      - CORDUM_POLICY_SIGNING_KEY_ID=${CORDUM_POLICY_SIGNING_KEY_ID:-dev-local}
      - CORDUM_POLICY_DEV_SIGNING_SEED=${CORDUM_POLICY_DEV_SIGNING_SEED:-cordum-local-policy-signing-v1}
      - CORDUM_LICENSE_TOKEN=${CORDUM_LICENSE_TOKEN:-}
      - CORDUM_LICENSE_PUBLIC_KEY=${CORDUM_LICENSE_PUBLIC_KEY:-}
    volumes:
      - ./config/safety.yaml:/etc/cordum/safety.yaml:ro
      - ./config/safety.yaml.sig:/etc/cordum/safety.yaml.sig:ro
      - ./certs:/etc/cordum/tls:ro
    ports:
      - "50051:50051"
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "1.0"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9095/readyz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  scheduler:
    image: ghcr.io/cordum-io/cordum/scheduler:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE: cordum-scheduler
    depends_on:
      nats:
        condition: service_healthy
      redis:
        condition: service_healthy
      safety-kernel:
        condition: service_healthy
    environment:
      # Audit chain runs unconditionally at gateway boot (task-096de016); CORDUM_AUDIT_EXPORT_TYPE now
      # controls external SIEM export only. See docs/deployment/audit-chain.md.
      - NATS_URL=tls://nats:4222
      - NATS_USE_JETSTREAM=1
      - NATS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - NATS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - NATS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - NATS_TLS_SERVER_NAME=nats
      - NATS_TOKEN=${NATS_TOKEN:-cordum-dev-token}
      # CAP runtime profile. Default "compat" keeps legacy unsigned packets,
      # string resource pointers, and configured fail-open modes reachable.
      # "production" selects CAP-PRODUCTION enforcement and refuses to start
      # unless every mandatory dependency is initialized. An unrecognised
      # value fails startup rather than downgrading silently.
      - CORDUM_CAP_PROFILE=${CORDUM_CAP_PROFILE:-compat}
      - CORDUM_SDK_HANDSHAKE=${CORDUM_SDK_HANDSHAKE:-off}
      - CORDUM_HEARTBEAT_MODE=${CORDUM_HEARTBEAT_MODE:-authority}
      - REDIS_URL=rediss://:${REDIS_PASSWORD:?REDIS_PASSWORD_not_set}@redis:6379
      - REDIS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - REDIS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - REDIS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - REDIS_TLS_SERVER_NAME=redis
      - SAFETY_KERNEL_ADDR=safety-kernel:50051
      - SAFETY_KERNEL_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - CONTEXT_ENGINE_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - OUTPUT_POLICY_ENABLED=${OUTPUT_POLICY_ENABLED:-true}
      - POLICY_CHECK_FAIL_MODE=${POLICY_CHECK_FAIL_MODE:-closed}
      - POOL_CONFIG_PATH=/etc/cordum/pools.yaml
      - TIMEOUT_CONFIG_PATH=/etc/cordum/timeouts.yaml
      - JOB_META_TTL=168h
      - WORKER_SNAPSHOT_INTERVAL=5s
      - CORDUM_LICENSE_TOKEN=${CORDUM_LICENSE_TOKEN:-}
      - CORDUM_LICENSE_PUBLIC_KEY=${CORDUM_LICENSE_PUBLIC_KEY:-}
    volumes:
      - ./config/pools.yaml:/etc/cordum/pools.yaml:ro
      - ./config/timeouts.yaml:/etc/cordum/timeouts.yaml:ro
      - ./certs:/etc/cordum/tls:ro
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "1.0"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9090/readyz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  api-gateway:
    image: ghcr.io/cordum-io/cordum/api-gateway:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    read_only: true
    dns:
      - 1.1.1.1
      - 8.8.8.8
    tmpfs:
      - /tmp
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE: cordum-api-gateway
    networks:
      default:
        aliases:
          - cordum-api-gateway
    depends_on:
      nats:
        condition: service_healthy
      redis:
        condition: service_healthy
      scheduler:
        condition: service_healthy
      safety-kernel:
        condition: service_healthy
    environment:
      - NATS_URL=tls://nats:4222
      - NATS_USE_JETSTREAM=1
      - NATS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - NATS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - NATS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - NATS_TLS_SERVER_NAME=nats
      - NATS_TOKEN=${NATS_TOKEN:-cordum-dev-token}
      # CAP runtime profile. Default "compat" keeps legacy unsigned packets,
      # string resource pointers, and configured fail-open modes reachable.
      # "production" selects CAP-PRODUCTION enforcement and refuses to start
      # unless every mandatory dependency is initialized. An unrecognised
      # value fails startup rather than downgrading silently.
      - CORDUM_CAP_PROFILE=${CORDUM_CAP_PROFILE:-compat}
      - CORDUM_SDK_HANDSHAKE=${CORDUM_SDK_HANDSHAKE:-off}
      - CORDUM_HEARTBEAT_MODE=${CORDUM_HEARTBEAT_MODE:-authority}
      - REDIS_URL=rediss://:${REDIS_PASSWORD:?REDIS_PASSWORD_not_set}@redis:6379
      - REDIS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - REDIS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - REDIS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - REDIS_TLS_SERVER_NAME=redis
      - SAFETY_KERNEL_ADDR=safety-kernel:50051
      - SAFETY_KERNEL_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - OUTPUT_POLICY_ENABLED=${OUTPUT_POLICY_ENABLED:-true}
      - CONTEXT_ENGINE_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - GATEWAY_HTTP_TLS_CERT=/etc/cordum/tls/server/tls.crt
      - GATEWAY_HTTP_TLS_KEY=/etc/cordum/tls/server/tls.key
      - GRPC_TLS_CERT=/etc/cordum/tls/server/tls.crt
      - GRPC_TLS_KEY=/etc/cordum/tls/server/tls.key
      - "CORDUM_API_KEY=${CORDUM_API_KEY:?error: CORDUM_API_KEY is not set}"
      - CORDUM_API_KEY_SOURCE=${CORDUM_API_KEY_SOURCE:-compose}
      - CORDUM_API_KEY_SOURCE_FILE=${CORDUM_API_KEY_SOURCE_FILE:-.env}
      # Wired so the gateway's startup-side guard can refuse to boot in
      # production when this flag is on (the dashboard would otherwise
      # serve the API key in plaintext at /config.json). Default `false`
      # — set to `true` only in trusted dev environments.
      - CORDUM_DASHBOARD_EMBED_API_KEY=${CORDUM_DASHBOARD_EMBED_API_KEY:-false}
      - TENANT_ID=default
      # P3a: resolves secret://monday-token for the cordum.monday MCP upstream the
      # gateway fronts (EnvSecretResolver convention secret://monday-token -> MONDAY_TOKEN).
      # Empty by default (fronting fails closed to built-in tools). Set MONDAY_TOKEN in
      # .env for the Monday demo stack; MONDAY_API_TOKEN (the name the demo's own
      # Monday-demo/.env uses) is accepted as a fallback so either name works.
      - MONDAY_TOKEN=${MONDAY_TOKEN:-${MONDAY_API_TOKEN:-}}
      - CORDUM_LICENSE_TOKEN=${CORDUM_LICENSE_TOKEN:-}
      - CORDUM_LICENSE_PUBLIC_KEY=${CORDUM_LICENSE_PUBLIC_KEY:-}
      - CORDUM_POLICY_SIGNING_KEY_ID=${CORDUM_POLICY_SIGNING_KEY_ID:-dev-local}
      - CORDUM_POLICY_DEV_SIGNING_SEED=${CORDUM_POLICY_DEV_SIGNING_SEED:-cordum-local-policy-signing-v1}
      - CORDUM_MCP_DESTRUCTIVE_TOOL_GLOBS=${CORDUM_MCP_DESTRUCTIVE_TOOL_GLOBS:-}
      - CORDUM_TELEMETRY_MODE=off
      # Unset by default — the audit chain engages unconditionally at gateway boot. Set this to
      # webhook|syslog|datadog|cloudwatch to stream events to an external SIEM, or to
      # null|discard|chain-only for an explicit no-op exporter (matches audit-export metrics shape).
      - CORDUM_AUDIT_EXPORT_TYPE=${CORDUM_AUDIT_EXPORT_TYPE:-}
      - AUDIT_TRANSPORT=${AUDIT_TRANSPORT:-nats}
      - CORDUM_AUDIT_CHAIN_FAIL=${CORDUM_AUDIT_CHAIN_FAIL:-permissive}
      # Optional tamper-evident HMAC over the audit chain (core/audit WithHMACKey).
      # Unset = chain runs without HMAC; set a >=32-byte random key to enable
      # hmac_verified>0 on /api/v1/audit/verify (short keys are rejected — BUG-013).
      - CORDUM_AUDIT_HMAC_KEY=${CORDUM_AUDIT_HMAC_KEY:-}
      - CORDUM_AUDIT_EXPORT_WEBHOOK_URL=${CORDUM_AUDIT_EXPORT_WEBHOOK_URL:-}
      - CORDUM_AUDIT_EXPORT_WEBHOOK_SECRET=${CORDUM_AUDIT_EXPORT_WEBHOOK_SECRET:-}
      - CORDUM_AUDIT_EXPORT_SYSLOG_ADDR=${CORDUM_AUDIT_EXPORT_SYSLOG_ADDR:-}
      - CORDUM_AUDIT_EXPORT_DD_API_KEY=${CORDUM_AUDIT_EXPORT_DD_API_KEY:-}
      - CORDUM_AUDIT_EXPORT_DD_SITE=${CORDUM_AUDIT_EXPORT_DD_SITE:-}
      - CORDUM_AUDIT_EXPORT_DD_TAGS=${CORDUM_AUDIT_EXPORT_DD_TAGS:-}
      - CORDUM_AUDIT_EXPORT_CW_LOG_GROUP=${CORDUM_AUDIT_EXPORT_CW_LOG_GROUP:-}
      - CORDUM_AUDIT_EXPORT_CW_LOG_STREAM=${CORDUM_AUDIT_EXPORT_CW_LOG_STREAM:-}
      - API_RATE_LIMIT_RPS=2000
      - API_RATE_LIMIT_BURST=4000
      - REDIS_DATA_TTL=24h
      - JOB_META_TTL=168h
      # User authentication (set CORDUM_USER_AUTH_ENABLED=true to enable)
      - CORDUM_USER_AUTH_ENABLED=${CORDUM_USER_AUTH_ENABLED:-false}
      - CORDUM_ADMIN_USERNAME=${CORDUM_ADMIN_USERNAME:-admin}
      # Required when CORDUM_USER_AUTH_ENABLED=true. Gateway refuses to start if empty.
      - CORDUM_ADMIN_PASSWORD=${CORDUM_ADMIN_PASSWORD:-}
      - CORDUM_ADMIN_EMAIL=${CORDUM_ADMIN_EMAIL:-}
      # OIDC SSO (uncomment to enable browser login and/or bearer-token validation)
      # - CORDUM_OIDC_ENABLED=true
      # - CORDUM_OIDC_ISSUER=https://login.example.com/realms/main
      # - CORDUM_OIDC_AUDIENCE=cordum-api
      # - CORDUM_OIDC_CLIENT_ID=cordum-dashboard
      # - CORDUM_OIDC_CLIENT_SECRET=replace-me
      # - CORDUM_OIDC_REDIRECT_URI=https://gateway.example.com/api/v1/auth/sso/oidc/callback
      # - CORDUM_OIDC_SCOPES=openid,profile,email
      # - CORDUM_OIDC_STATE_TTL=10m
      # - CORDUM_AUTH_REDIRECT_URL=https://dashboard.example.com/login
      # SAML SSO (uncomment and provide cert/key + IdP metadata URL to enable)
      # - CORDUM_SAML_ENABLED=true
      # - CORDUM_SAML_IDP_METADATA_URL=https://idp.example.com/metadata
      # - CORDUM_SAML_BASE_URL=https://gateway.example.com
      # - CORDUM_SAML_ENTITY_ID=https://gateway.example.com/api/v1/auth/sso/saml/metadata
      # - CORDUM_SAML_BINDING=redirect
      # - CORDUM_SAML_RESPONSE_BINDING=post
      # - CORDUM_SAML_ALLOW_IDP_INITIATED=false
      # - CORDUM_SAML_STATE_TTL=10m
      # - CORDUM_AUTH_REDIRECT_URL=https://dashboard.example.com/login
      # - CORDUM_SAML_CERT_PATH=/etc/cordum/saml/tls.crt
      # - CORDUM_SAML_KEY_PATH=/etc/cordum/saml/tls.key
    volumes:
      - ./certs:/etc/cordum/tls:ro
      # - ./certs/saml:/etc/cordum/saml:ro
    ports:
      - "9080:8080"
      - "8081:8081"
      - "9092:9092"
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "1.0"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "--no-check-certificate", "https://127.0.0.1:8081/readyz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  workflow-engine:
    image: ghcr.io/cordum-io/cordum/workflow-engine:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE: cordum-workflow-engine
    depends_on:
      nats:
        condition: service_healthy
      redis:
        condition: service_healthy
      scheduler:
        condition: service_healthy
      safety-kernel:
        condition: service_healthy
    environment:
      - NATS_URL=tls://nats:4222
      - NATS_USE_JETSTREAM=1
      - NATS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - NATS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - NATS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - NATS_TLS_SERVER_NAME=nats
      - NATS_TOKEN=${NATS_TOKEN:-cordum-dev-token}
      - REDIS_URL=rediss://:${REDIS_PASSWORD:?REDIS_PASSWORD_not_set}@redis:6379
      - REDIS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - REDIS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - REDIS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - REDIS_TLS_SERVER_NAME=redis
      - SAFETY_KERNEL_ADDR=safety-kernel:50051
      - SAFETY_KERNEL_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - OUTPUT_POLICY_ENABLED=${OUTPUT_POLICY_ENABLED:-true}
      # CAP runtime profile (see scheduler service for semantics).
      - CORDUM_CAP_PROFILE=${CORDUM_CAP_PROFILE:-compat}
      - WORKFLOW_ENGINE_HTTP_ADDR=:9093
      - WORKFLOW_ENGINE_SCAN_INTERVAL=5s
      - WORKFLOW_ENGINE_RUN_SCAN_LIMIT=200
      - CORDUM_SDK_HANDSHAKE=${CORDUM_SDK_HANDSHAKE:-off}
      - CORDUM_LICENSE_TOKEN=${CORDUM_LICENSE_TOKEN:-}
      - CORDUM_LICENSE_PUBLIC_KEY=${CORDUM_LICENSE_PUBLIC_KEY:-}
      # Service-token signing for internal cancel broadcasts. Under
      # CORDUM_SDK_HANDSHAKE=enforce the workflow-engine mints a control-plane
      # service token (subject "workflow-engine") on its JobCancel broadcasts so
      # peer schedulers admit them; it shares the scheduler/gateway signing key
      # (derived from the dev seed locally). REQUIRED before enabling enforce.
      - CORDUM_POLICY_SIGNING_KEY_ID=${CORDUM_POLICY_SIGNING_KEY_ID:-dev-local}
      - CORDUM_POLICY_DEV_SIGNING_SEED=${CORDUM_POLICY_DEV_SIGNING_SEED:-cordum-local-policy-signing-v1}
    volumes:
      - ./certs:/etc/cordum/tls:ro
    ports:
      - "9093:9093"
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "1.0"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9093/readyz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  dashboard:
    image: ghcr.io/cordum-io/cordum/dashboard:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
      - /var/cache/nginx
      - /var/run
      - /etc/nginx/conf.d:uid=101,gid=101
    build:
      context: ./dashboard
      dockerfile: Dockerfile
    depends_on:
      api-gateway:
        condition: service_healthy
    environment:
      - CORDUM_API_BASE_URL=${CORDUM_API_BASE_URL:-}
      - CORDUM_API_KEY=${CORDUM_API_KEY:-}
      - CORDUM_DASHBOARD_EMBED_API_KEY=${CORDUM_DASHBOARD_EMBED_API_KEY:-false}
      - CORDUM_TENANT_ID=${CORDUM_TENANT_ID:-default}
      - CORDUM_PRINCIPAL_ID=${CORDUM_PRINCIPAL_ID:-}
      - CORDUM_PRINCIPAL_ROLE=${CORDUM_PRINCIPAL_ROLE:-}
      - CORDUM_API_UPSTREAM_SCHEME=https
    volumes:
      - ./certs:/etc/cordum/tls:ro
    ports:
      - "8082:8080"
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: "0.5"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:8080/healthz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  mock-bank-worker:
    profiles: [demo]
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    build:
      context: .
      dockerfile: demo/mock-bank/Dockerfile
    depends_on:
      nats:
        condition: service_healthy
      redis:
        condition: service_healthy
      scheduler:
        condition: service_healthy
    environment:
      - NATS_URL=tls://nats:4222
      - NATS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - NATS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - NATS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - NATS_TLS_SERVER_NAME=nats
      - NATS_TOKEN=${NATS_TOKEN:-cordum-dev-token}
      - REDIS_URL=rediss://:${REDIS_PASSWORD:-cordum-dev}@redis:6379
      - REDIS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - REDIS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - REDIS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - REDIS_TLS_SERVER_NAME=redis
    volumes:
      - ./certs:/etc/cordum/tls:ro
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: "0.5"

  mock-bank-ui:
    profiles: [demo]
    image: nginx:alpine
    depends_on:
      api-gateway:
        condition: service_healthy
    volumes:
      - ./demo/mock-bank:/usr/share/nginx/html:ro
      - ./demo/mock-bank/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - "${MOCK_BANK_UI_PORT:-3000}:80"
    deploy:
      resources:
        limits:
          memory: 64M
          cpus: "0.25"

  # Greeter for the demo-quickstart pack. Subscribes to job.demo-quickstart.greet and
  # echoes "hello, <name>!". Brought up only with `--profile demo` so the
  # default stack stays lean for new users who only want the platform.
  demo-quickstart-worker:
    profiles: [demo]
    image: ghcr.io/cordum-io/cordum/demo-quickstart-worker:${CORDUM_VERSION:-latest}
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    build:
      context: .
      dockerfile: demo/quickstart/Dockerfile
    depends_on:
      nats:
        condition: service_healthy
      redis:
        condition: service_healthy
      scheduler:
        condition: service_healthy
      safety-kernel:
        condition: service_healthy
    environment:
      - NATS_URL=tls://nats:4222
      - NATS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - NATS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - NATS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - NATS_TLS_SERVER_NAME=nats
      - NATS_TOKEN=${NATS_TOKEN:-cordum-dev-token}
      - REDIS_URL=rediss://:${REDIS_PASSWORD:-cordum-dev}@redis:6379
      - REDIS_TLS_CA=/etc/cordum/tls/ca/ca.crt
      - REDIS_TLS_CERT=/etc/cordum/tls/client/tls.crt
      - REDIS_TLS_KEY=/etc/cordum/tls/client/tls.key
      - REDIS_TLS_SERVER_NAME=redis
    volumes:
      - ./certs:/etc/cordum/tls:ro
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: "0.25"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:9091/healthz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 5s

volumes:
  nats_data:
  redis_data: