services:
  db:
    image: mariadb:10.11
    environment:
      MYSQL_ROOT_PASSWORD: rootpw
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wp
      MYSQL_PASSWORD: wppw
    volumes:
      - db_data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 5s
      timeout: 5s
      retries: 10

  wordpress:
    build: .
    ports:
      - "8088:80"
    environment:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_USER: wp
      WORDPRESS_DB_PASSWORD: wppw
      WORDPRESS_DB_NAME: wordpress
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - wp_data:/var/www/html

  # Attacker-controlled server hosting the PHP payload
  payload:
    image: python:3.12-slim
    working_dir: /payloads
    volumes:
      - ../payloads:/payloads
    ports:
      - "9999:9999"
    command: python3 -m http.server 9999

volumes:
  db_data:
  wp_data: