# Bloxsmith — Docker Compose deploy.
#
#   docker compose up -d                        # dashboard only (loopback)
#   BIND=0.0.0.0 docker compose up -d           # expose on the LAN (no login — keep vault locked)
#   docker compose --profile secure up -d       # add a TLS + basic-auth reverse proxy
#
# Update: the app only SIGNALS when a newer version exists (banner in the ⋯ menu).
# To apply it, double-click the update script for your OS that ships next to this
# file (update.command on macOS, update.bat on Windows, update.sh on Linux), or run:
#   docker compose pull && docker compose up -d
# Revert: if a new image fails its health check the in-app updater auto-rolls back
# to the previous image (tagged bloxsmith:rollback).
# Copy .env.example to .env to set BIND/PORT/token/auth.

services:
  bloxsmith:
    # ── Image reference ────────────────────────────────────────────────
    # Enterprise: PIN BY DIGEST for a reproducible, signature-verifiable deploy.
    # Replace :latest below with the digest of the tag you trust, e.g.:
    #   image: ghcr.io/holland-built/bloxsmith@sha256:<64-hex-digest>
    # Resolve + verify the digest first:
    #   docker buildx imagetools inspect ghcr.io/holland-built/bloxsmith:latest
    #   cosign verify ghcr.io/holland-built/bloxsmith@sha256:<digest> \
    #     --certificate-identity-regexp 'https://github.com/holland-built/bloxsmith/.+' \
    #     --certificate-oidc-issuer https://token.actions.githubusercontent.com
    # Demo/laptop installs may stay on :latest for convenience.
    image: ghcr.io/holland-built/bloxsmith:latest
    container_name: bloxsmith
    restart: unless-stopped
    ports:
      - "${BIND:-127.0.0.1}:${PORT:-8080}:8080"
    volumes:
      - noc-vault:/vault
    environment:
      INFOBLOX_URL: ${INFOBLOX_URL:-https://csp.infoblox.com}
      # single-key mode (optional) — leave unset to use the in-app encrypted vault
      INFOBLOX_API_KEY: ${INFOBLOX_API_KEY:-}
      # LLM natural-language query box (optional)
      GROQ_API_KEY: ${GROQ_API_KEY:-}
      LLM_API_KEY: ${LLM_API_KEY:-}
      LLM_MODEL: ${LLM_MODEL:-}
      LLM_BASE_URL: ${LLM_BASE_URL:-}
      # vault auto-unlock (optional) — skips passphrase prompt after restarts/updates
      VAULT_PASSPHRASE: ${VAULT_PASSPHRASE:-}
      VAULT_PASSPHRASE_FILE: ${VAULT_PASSPHRASE_FILE:-}
    networks: [noc-net]

  # Opt-in reverse proxy: TLS (self-signed local CA) + basic-auth in front of the
  # dashboard. Use when exposing on an untrusted LAN. Set BIND=127.0.0.1 so the
  # dashboard itself stays loopback-only and all external access goes through Caddy.
  #   docker compose --profile secure up -d
  caddy:
    image: caddy:2
    container_name: noc-caddy
    profiles: [secure]
    restart: unless-stopped
    ports:
      - "${HTTPS_BIND:-0.0.0.0}:${HTTPS_PORT:-8443}:443"
    volumes:
      - ./deploy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
    environment:
      SITE_ADDRESS: ${SITE_ADDRESS:-:443}
      BASIC_AUTH_USER: ${BASIC_AUTH_USER:-admin}
      BASIC_AUTH_HASH: ${BASIC_AUTH_HASH:-}   # docker run caddy caddy hash-password -p 'yourpass'
    networks: [noc-net]

volumes:
  noc-vault:
    name: noc-vault      # fixed volume name; the vault survives docker run ↔ compose switches
  caddy-data:

networks:
  noc-net: