# Persistent LOCAL testnet sandbox. Separate stack/data from existing single/three-node compose files.
# Invoke this file explicitly. Never combine it with the disposable PostgreSQL test fixture.
services:
  provision:
    build:
      context: .
      dockerfile: deploy/postgres/Dockerfile
    volumes:
      - pg-admin:/secrets/admin
      - pg-owner:/secrets/owner
      - pg-runtime:/secrets/runtime
      - pg-tls:/secrets/tls
    network_mode: none
    read_only: true
    tmpfs: ["/tmp:mode=1777,size=16m"]
    restart: "no"
  database:
    image: wikideck:postgres-sandbox
    build:
      context: .
      dockerfile: deploy/postgres/database.Dockerfile
    depends_on:
      provision:
        condition: service_completed_successfully
    environment:
      POSTGRES_DB: wikideck_custody
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD_FILE: /secrets/admin/password
      POSTGRES_INITDB_ARGS: --auth-host=scram-sha-256
    command: [postgres, -c, ssl=on, -c, ssl_min_protocol_version=TLSv1.2,
      -c, ssl_cert_file=/tls/server.crt, -c, ssl_key_file=/tls/server.key,
      -c, hba_file=/etc/wikideck/pg_hba.conf, -c, log_statement=none,
      -c, log_min_error_statement=panic, -c, log_parameter_max_length_on_error=0]
    volumes:
      - pg-data:/var/lib/postgresql/data
      - pg-admin:/secrets/admin:ro
      - pg-tls:/tls:ro
    networks: [financial]
    healthcheck:
      test: [CMD-SHELL, "pg_isready -U postgres -d wikideck_custody"]
      interval: 3s
      timeout: 3s
      retries: 30
    restart: unless-stopped
    shm_size: 128m
    stop_grace_period: 30s
  migrate:
    image: wikideck:custody-sandbox
    build: {context: ., target: runtime}
    depends_on:
      database:
        condition: service_healthy
    environment:
      WIKIDECK_NETWORK: testnet
      WIKIDECK_LOCAL_PG_BOOTSTRAP: sandbox-only
    command: [node, --experimental-strip-types, scripts/custody-deployment-init.ts]
    volumes:
      - pg-admin:/secrets/admin:ro
      - pg-owner:/secrets/owner:ro
      - pg-runtime:/secrets/runtime:ro
    networks: [financial]
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    restart: "no"
  wikideck:
    image: wikideck:custody-sandbox
    build: {context: ., target: runtime}
    depends_on:
      migrate:
        condition: service_completed_successfully
    ports: ["127.0.0.1:${WIKIDECK_CUSTODY_PORT:-3422}:3001"]
    environment:
      WIKIDECK_NETWORK: testnet
      WIKIDECK_PAYMENT_MODE: mock
      WIKIDECK_MARKET_ENABLED: "${WIKIDECK_MARKET_ENABLED:-1}"
      WIKIDECK_MARKET_TRADING_ENABLED: "${WIKIDECK_MARKET_TRADING_ENABLED:-1}"
      WIKIDECK_MARKET_HOST_FEE_ADDRESS: "${WIKIDECK_MARKET_HOST_FEE_ADDRESS:-44xHcCdFhW4b951yBHpkTPdLSJ85qTCnFQ8N7m96TtqqRL3dbhzbEH4fe2SJ3a6ESHcNyzCYH5nYJ9ActR1JtkeA7QYGbQv}"
      WIKIDECK_CUSTODY_MODE: sandbox
      WIKIDECK_CUSTODY_STORAGE: postgres
      WIKIDECK_CUSTODY_PG_URL_FILE: /secrets/runtime/url
      WIKIDECK_CUSTODY_PG_CA_FILE: /secrets/runtime/ca.crt
      PUBLIC_ORIGIN: "http://127.0.0.1:${WIKIDECK_CUSTODY_PORT:-3422}"
    volumes:
      - custody-node:/app/data
      - pg-runtime:/secrets/runtime:ro
    networks: [financial, web]
    init: true
    restart: unless-stopped
    read_only: true
    tmpfs: ["/tmp:mode=1777,size=32m,noexec,nosuid"]
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    pids_limit: 128
    mem_limit: 1g
    stop_grace_period: 30s
networks:
  financial: {internal: true}
  web: {}
volumes:
  pg-data:
  pg-admin:
  pg-owner:
  pg-runtime:
  pg-tls:
  custody-node: