# Gated candidate profile, NOT an announcement of a production-ready or launched network.
# Review docs/mainnet-launch.md before attempting activation.
services:
  mainnet:
    build:
      context: .
      target: runtime
      args:
        WIKIDECK_NETWORK: mainnet
        WIKIDECK_GENESIS_TIME: "${WIKIDECK_GENESIS_TIME:-1793491200}"
    ports:
      - "127.0.0.1:${WIKIDECK_MAINNET_PORT:-3201}:3001"
    environment:
      WIKIDECK_NETWORK: mainnet
      WIKIDECK_GENESIS_TIME: "${WIKIDECK_GENESIS_TIME:-1793491200}"
      PUBLIC_ORIGIN: "${WIKIDECK_MAINNET_ORIGIN:-}"
      WIKIDECK_PEERS: "${WIKIDECK_MAINNET_PEERS:-}"
      WIKIDECK_MAINNET_LAUNCH: "${WIKIDECK_MAINNET_LAUNCH:-}"
      WIKIDECK_MAINNET_RISK_ACK: "${WIKIDECK_MAINNET_RISK_ACK:-}"
      WIKIDECK_ALLOW_PRIVATE_PEERS: "0"
      # Empty by default; set only the actual edge-to-container source IP/CIDR after topology review.
      WIKIDECK_TRUSTED_PROXIES: "${WIKIDECK_TRUSTED_PROXIES:-}"
      # Diagnostics are deliberately disabled here. Never publish an operations port.
    volumes:
      - mainnet-candidate-data:/app/data
    init: true
    restart: "no"
    read_only: true
    tmpfs:
      - /tmp:size=32m,mode=1777,noexec,nosuid
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    pids_limit: 128
    mem_limit: 1g
    cpus: 1.0
    stop_grace_period: 30s

volumes:
  mainnet-candidate-data: