services:
  mysql:
    image: mysql:8.0@sha256:7dcddc01f13bab2f15cde676d44d01f61fc9f99fe7785e86196dfc07d358ae2b
    container_name: cars-mysql
    environment:
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
    ports:
      - "127.0.0.1:3306:3306"
    volumes:
      - ./local-data/mysql_data:/var/lib/mysql
    healthcheck:
      test: [ "CMD", "mysqladmin", "ping", "-h", "localhost" ]
      interval: 10s
      timeout: 5s
      retries: 3

  cars-node:
    build: .
    container_name: cars-node
    ports:
      - "7777:7777"
    extra_hosts:
      - "prometheus.localhost:host-gateway"
    environment:
      CARS_NODE_PORT: ${CARS_NODE_PORT}
      MAINNET_PRIVATE_KEY: ${MAINNET_PRIVATE_KEY}
      TESTNET_PRIVATE_KEY: ${TESTNET_PRIVATE_KEY}
      TTN_PRIVATE_KEY: ${TTN_PRIVATE_KEY:-}
      TAAL_API_KEY_MAIN: ${TAAL_API_KEY_MAIN}
      TAAL_API_KEY_TEST: ${TAAL_API_KEY_TEST}
      TTN_STORAGE_URL: ${TTN_STORAGE_URL:-https://staging-storage.babbage.systems}
      TTN_ARCADE_URL: ${TTN_ARCADE_URL:-https://arcade-v2-ttn-us-1.bsvblockchain.tech}
      TTN_CHAINTRACKS_URL: ${TTN_CHAINTRACKS_URL:-}
      TTN_CHAINTRACKS_API_PREFIX: ${TTN_CHAINTRACKS_API_PREFIX:-/chaintracks/v2}
      TTN_ARCADE_API_KEY: ${TTN_ARCADE_API_KEY:-}
      TTN_ARCADE_DEPLOYMENT_ID: ${TTN_ARCADE_DEPLOYMENT_ID:-}
      CARS_NODE_SERVER_BASEURL: ${CARS_NODE_SERVER_BASEURL}
      MYSQL_DATABASE_URL: "mysql://${MYSQL_USER}:${MYSQL_PASSWORD}@mysql:3306/${MYSQL_DATABASE}"
      CARS_PROJECT_DB_MODE: ${CARS_PROJECT_DB_MODE:-shared}
      SHARED_DB_NAMESPACE: ${SHARED_DB_NAMESPACE:-cars-operator-system}
      SHARED_MYSQL_ADMIN_URL: ${SHARED_MYSQL_ADMIN_URL:-}
      SHARED_MYSQL_APP_HOST: ${SHARED_MYSQL_APP_HOST:-shared-mysql-haproxy.cars-operator-system.svc.cluster.local}
      SHARED_MONGO_ADMIN_URL: ${SHARED_MONGO_ADMIN_URL:-}
      SHARED_MONGO_APP_HOSTS: ${SHARED_MONGO_APP_HOSTS:-shared-mongo-0.shared-mongo.cars-operator-system.svc.cluster.local:27017,shared-mongo-1.shared-mongo.cars-operator-system.svc.cluster.local:27017}
      SHARED_MONGO_REPLICA_SET: ${SHARED_MONGO_REPLICA_SET:-rs0}
      LOG_LEVEL: "info"
      KUBECONFIG: ${KUBECONFIG_FILE_PATH}
      DOCKER_REGISTRY: ${DOCKER_REGISTRY}
      CARS_BUILD_CONTROLLER_URL: http://build-controller:7790
      CARS_BUILD_CONTROLLER_TOKEN: ${CARS_BUILD_CONTROLLER_TOKEN}
      CARS_NAMESPACE_LIFECYCLE_URL: http://namespace-lifecycle:7780
      CARS_NAMESPACE_LIFECYCLE_TOKEN: ${CARS_NAMESPACE_LIFECYCLE_TOKEN}
      PROJECT_DEPLOYMENT_DNS_NAME: ${PROJECT_DEPLOYMENT_DNS_NAME} # Where will projects be deployed online?
      CERT_ISSUANCE_EMAIL: ${CERT_ISSUANCE_EMAIL}
      PROMETHEUS_URL: ${PROMETHEUS_URL}
      SENDGRID_API_KEY: ${SENDGRID_API_KEY}
      SYSTEM_FROM_EMAIL: ${SYSTEM_FROM_EMAIL}
    depends_on:
      - mysql
      - build-controller
      - namespace-lifecycle
    volumes:
      - ./local-data/kubeconfig:/kubeconfig
      - cars-scratch:/tmp
    ulimits:
      nofile:
        soft: 1048576
        hard: 1048576
    command:
      - "/wait-for-services.sh"
      - "cars-mysql"
      - "3306"
      - "cars-k3s"
      - "6443"
      - "node"
      - "dist/src/server.js"
    user: "65532:65532"
    read_only: true
    security_opt:
      - no-new-privileges:true

  build-controller:
    build: .
    environment:
      CARS_BUILD_CONTROLLER_TOKEN: ${CARS_BUILD_CONTROLLER_TOKEN}
      DOCKER_REGISTRY: ${DOCKER_REGISTRY}
      HOME: /tmp/home
      XDG_RUNTIME_DIR: /run/user/0
      STORAGE_DRIVER: vfs
      BUILDAH_ISOLATION: chroot
      CARS_BUILD_CONTROLLER_LISTEN_HOST: 0.0.0.0
    command: ["node", "dist/src/build-controller-server.js"]
    read_only: true
    cap_drop: ["ALL"]
    cap_add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID", "SETFCAP", "MKNOD", "SYS_ADMIN", "SYS_CHROOT", "SYS_RESOURCE"]
    security_opt:
      - no-new-privileges:true
      - seccomp=unconfined
      - apparmor=unconfined
    volumes:
      - cars-scratch:/tmp
      - buildah-storage:/var/lib/containers
    tmpfs:
      - /var/tmp
      - /run

  namespace-lifecycle:
    build: .
    environment:
      KUBECONFIG: ${KUBECONFIG_FILE_PATH}
      CARS_NAMESPACE_LIFECYCLE_TOKEN: ${CARS_NAMESPACE_LIFECYCLE_TOKEN}
      CARS_NAMESPACE_LIFECYCLE_LISTEN_PORT: "7780"
    command:
      - "/wait-for-services.sh"
      - "cars-k3s"
      - "6443"
      - "cars-k3s"
      - "6443"
      - "node"
      - "dist/src/namespace-lifecycle-server.js"
    depends_on: [k3s-server]
    user: "65532:65532"
    read_only: true
    security_opt:
      - no-new-privileges:true
    volumes:
      - ./local-data/kubeconfig:/kubeconfig
    tmpfs:
      - /tmp

  k3s-server:
    image: rancher/k3s:v1.34.1-k3s1@sha256:5e0707cfd1239b358ef73f3254bc3eadc027dd30cd5ec6ca41e29e47652a1b8c
    container_name: cars-k3s
    privileged: true
    tmpfs:
      - /run
      - /var/run
    ulimits:
      nproc: 1048576
      nofile:
        soft: 1048576
        hard: 1048576
    command:
      - server
      - "--tls-san=cars-k3s"
      - "--node-name=cars-k3s"
      - "--kubelet-arg=config=/etc/rancher/k3s/kubelet-config.yaml"
    restart: always
    environment:
      K3S_KUBECONFIG_OUTPUT: /output/kubeconfig.yaml
      K3S_KUBECONFIG_MODE: "666" # local demo volume shared with the two non-root CARS processes
      K3S_TOKEN: ${K3S_TOKEN}
    volumes:
      - k3s-server:/var/lib/rancher/k3s
      - ./local-data/kubeconfig:/output
      - ./registries.yaml:/etc/rancher/k3s/registries.yaml:ro
      - ./kubelet-config.yaml:/etc/rancher/k3s/kubelet-config.yaml
    ports:
      - "127.0.0.1:6080:80"
      - "127.0.0.1:6443:443"

  registry:
    image: registry:2@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373
    container_name: cars-registry
    volumes:
      - ./local-data/registry:/var/lib/registry

volumes:
  k3s-server: {}
  cars-scratch: {}
  buildah-storage: {}