# The consumer product on the control-plane VM: one read-only app process over one case's published gold export.
# The host port binds to loopback (or the NetBird interface IP) only, so the VM opens no public app port; NetBird's
# reverse proxy is the only way in. Approvals, runs, live view, spend, evidence and replay are the Ontofill Console's
# (ontofill/console, its own container and NetBird service), not this app's.
name: proveedor-abierto

services:
  investigator:  # the product; the service keeps this name so the VM's container stays proveedor-abierto-investigator-1
    build:
      context: ..
      dockerfile: deploy/Dockerfile
    image: proveedor-abierto-app:local
    restart: unless-stopped
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt: ["no-new-privileges:true"]
    environment:
      # File lake: PA_GOLD_DIR=/lake (mounted below). S3 lake: set PA_GOLD_DIR_IN_CONTAINER to empty in .env and
      # provide lake.yaml (mounted at /config/lake.yaml) plus AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY.
      PA_GOLD_DIR: ${PA_GOLD_DIR_IN_CONTAINER-/lake}
      PA_LAKE_YAML: /config/lake.yaml
      PA_CASE_DIR: /case
      PA_CONSOLE_URL: ${PA_CONSOLE_URL:-}   # optional: empty states link judges to the Ontofill Console /tour
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
      AWS_REGION: ${AWS_REGION:-}
    volumes:
      - ${PA_LAKE_DIR:-../.lake}:/lake:ro
      # read-only: the product cannot write anything. PA_INVESTIGATOR_CASE_HOST_DIR (optional) keeps it on the case
      # that matches its gold (e.g. the synthetic fixture case) until real gold exists; else PA_CASE_HOST_DIR.
      - ${PA_INVESTIGATOR_CASE_HOST_DIR:-${PA_CASE_HOST_DIR:-../case}}:/case:ro
      - ${PA_LAKE_YAML_HOST:-../lake.example.yaml}:/config/lake.yaml:ro
    ports:
      - "${PA_BIND_IP:-127.0.0.1}:${PA_INVESTIGATOR_PORT:-8400}:8400"