# Private mock-only pilot profile. Start with a distinct Compose project name;
# this stack intentionally contains no Monero daemon, Wallet-RPC, or observer.
services:
  provision:
    image: wikideck:pilot-provision
    build:
      context: .
      dockerfile: deploy/postgres/Dockerfile
    volumes:
      - pg-admin:/secrets/admin
      - pg-owner:/secrets/owner
      - pg-runtime:/secrets/runtime
      - pg-backup:/secrets/backup
      - pg-tls:/secrets/tls
    network_mode: none
    read_only: true
    tmpfs: ["/tmp:mode=1777,size=16m"]
    restart: "no"
  database:
    image: wikideck:postgres-pilot
    build:
      context: .
      dockerfile: deploy/postgres/database.Dockerfile
    depends_on:
      provision:
        condition: service_completed_successfully
    environment:
      POSTGRES_DB: wikideck_custody
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD_FILE: /secrets/admin/password
      POSTGRES_INITDB_ARGS: --auth-host=scram-sha-256
    command: [postgres, -c, ssl=on, -c, ssl_min_protocol_version=TLSv1.2,
      -c, ssl_cert_file=/tls/server.crt, -c, ssl_key_file=/tls/server.key,
      -c, hba_file=/etc/wikideck/pg_hba.conf, -c, log_statement=none,
      -c, log_min_error_statement=panic, -c, log_parameter_max_length_on_error=0]
    volumes:
      - pg-data:/var/lib/postgresql/data
      - pg-admin:/secrets/admin:ro
      - pg-tls:/tls:ro
    networks: [financial]
    healthcheck:
      test: [CMD-SHELL, "pg_isready -U postgres -d wikideck_custody"]
      interval: 3s
      timeout: 3s
      retries: 30
    restart: unless-stopped
    shm_size: 128m
    stop_grace_period: 30s
  migrate:
    image: wikideck:private-pilot
    build:
      context: .
      target: runtime
      args:
        WIKIDECK_NETWORK: pilot
    depends_on:
      database:
        condition: service_healthy
    environment:
      WIKIDECK_NETWORK: pilot
      WIKIDECK_LOCAL_PG_BOOTSTRAP: sandbox-only
    command: [node, --experimental-strip-types, scripts/custody-deployment-init.ts]
    volumes:
      - pg-admin:/secrets/admin:ro
      - pg-owner:/secrets/owner:ro
      - pg-runtime:/secrets/runtime:ro
      - pg-backup:/secrets/backup:ro
    networks: [financial]
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    restart: "no"
  wikideck:
    image: wikideck:private-pilot
    build:
      context: .
      target: runtime
      args:
        WIKIDECK_NETWORK: pilot
    depends_on:
      migrate:
        condition: service_completed_successfully
    ports: ["127.0.0.1:${WIKIDECK_PILOT_PORT:-3423}:3001"]
    environment:
      WIKIDECK_NETWORK: pilot
      WIKIDECK_PILOT_MODE: private-mock-only
      WIKIDECK_PAYMENT_MODE: mock
      WIKIDECK_MARKET_ENABLED: "${WIKIDECK_MARKET_ENABLED:-1}"
      WIKIDECK_MARKET_TRADING_ENABLED: "${WIKIDECK_MARKET_TRADING_ENABLED:-1}"
      WIKIDECK_MARKET_HOST_FEE_ADDRESS: "${WIKIDECK_MARKET_HOST_FEE_ADDRESS:-44xHcCdFhW4b951yBHpkTPdLSJ85qTCnFQ8N7m96TtqqRL3dbhzbEH4fe2SJ3a6ESHcNyzCYH5nYJ9ActR1JtkeA7QYGbQv}"
      WIKIDECK_CUSTODY_MODE: sandbox
      WIKIDECK_MARKET_RUNTIME_ENABLED: "${WIKIDECK_MARKET_RUNTIME_ENABLED:-1}"
      WIKIDECK_CUSTODY_STORAGE: postgres
      WIKIDECK_CUSTODY_PG_URL_FILE: /secrets/runtime/url
      WIKIDECK_CUSTODY_PG_CA_FILE: /secrets/runtime/ca.crt
      PUBLIC_ORIGIN: "http://127.0.0.1:${WIKIDECK_PILOT_PORT:-3423}"
    volumes:
      - custody-node:/app/data
      - pg-runtime:/secrets/runtime:ro
    networks: [financial, web]
    init: true
    restart: unless-stopped
    read_only: true
    tmpfs: ["/tmp:mode=1777,size=32m,noexec,nosuid"]
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    pids_limit: 128
    mem_limit: 1g
    stop_grace_period: 30s
  daemon-check:
    image: wikideck:private-pilot
    profiles: ["monero-check"]
    build:
      context: .
      target: runtime
      args:
        WIKIDECK_NETWORK: pilot
    entrypoint: [node, --experimental-strip-types, scripts/monero-daemon-check.ts]
    environment:
      WIKIDECK_MONERO_DAEMON_CONFIG_FILE: /run/monero/daemon.json
    volumes:
      - type: bind
        source: "${WIKIDECK_MONERO_DAEMON_CONFIG_HOST:-./private/monero-daemon.json}"
        target: /run/monero/daemon.json
        read_only: true
    networks: [web]
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    pids_limit: 32
    mem_limit: 128m
    restart: "no"
  pilot-observer:
    image: wikideck:private-pilot
    profiles: ["pilot-observer"]
    build:
      context: .
      target: runtime
      args:
        WIKIDECK_NETWORK: pilot
    entrypoint: [node, --experimental-strip-types, scripts/pilot-monero-observe-once.ts]
    environment:
      WIKIDECK_NETWORK: pilot
      WIKIDECK_PILOT_MODE: private-mock-only
      WIKIDECK_PILOT_CUSTODY_OPERATIONS: pilot-observation-only-no-credit
      WIKIDECK_PILOT_CUSTODIAN_ID: "${WIKIDECK_PILOT_CUSTODIAN_ID:-}"
      WIKIDECK_MONERO_WALLET_GENERATION_ID: "${WIKIDECK_MONERO_WALLET_GENERATION_ID:-}"
      WIKIDECK_MONERO_WALLET_FINGERPRINT: "${WIKIDECK_MONERO_WALLET_FINGERPRINT:-}"
      WIKIDECK_PILOT_OBSERVER_PG_URL_FILE: /run/secrets/pilot-observer-db-url
      WIKIDECK_PILOT_OBSERVER_PG_CA_FILE: /run/secrets/pilot-observer-db-ca.crt
      WIKIDECK_MONERO_WALLET_RPC_CONFIG_FILE: /run/monero/wallet-rpc.json
      WIKIDECK_MONERO_MTLS_CONFIG_FILE: /run/monero/mtls.json
      WIKIDECK_PILOT_OBSERVER_MAX_BLOCKS: "${WIKIDECK_PILOT_OBSERVER_MAX_BLOCKS:-5000}"
      WIKIDECK_PILOT_OBSERVER_OVERLAP: "${WIKIDECK_PILOT_OBSERVER_OVERLAP:-100}"
    volumes:
      - type: bind
        source: "${WIKIDECK_PILOT_OBSERVER_PG_URL_HOST:-./private/monero-pilot/observer-db-url}"
        target: /run/secrets/pilot-observer-db-url
        read_only: true
        bind: {create_host_path: false}
      - type: bind
        source: "${WIKIDECK_PILOT_OBSERVER_PG_CA_HOST:-./private/monero-pilot/observer-db-ca.crt}"
        target: /run/secrets/pilot-observer-db-ca.crt
        read_only: true
        bind: {create_host_path: false}
      - type: bind
        source: "${WIKIDECK_PILOT_OBSERVER_WALLET_CONFIG_HOST:-./private/monero-pilot/wallet-rpc.json}"
        target: /run/monero/wallet-rpc.json
        read_only: true
        bind: {create_host_path: false}
      - type: bind
        source: "${WIKIDECK_PILOT_OBSERVER_MTLS_CONFIG_HOST:-./private/monero-pilot/mtls.json}"
        target: /run/monero/mtls.json
        read_only: true
        bind: {create_host_path: false}
      - type: bind
        source: "${WIKIDECK_PILOT_OBSERVER_CLIENT_CERT_HOST:-./private/monero-pilot/observer-client.crt}"
        target: /run/secrets/observer-client.crt
        read_only: true
        bind: {create_host_path: false}
      - type: bind
        source: "${WIKIDECK_PILOT_OBSERVER_CLIENT_KEY_HOST:-./private/monero-pilot/observer-client.key}"
        target: /run/secrets/observer-client.key
        read_only: true
        bind: {create_host_path: false}
      - type: bind
        source: "${WIKIDECK_PILOT_OBSERVER_GATEWAY_CA_HOST:-./private/monero-pilot/gateway-ca.crt}"
        target: /run/secrets/observer-gateway-ca.crt
        read_only: true
        bind: {create_host_path: false}
    networks: [observer-egress]
    read_only: true
    tmpfs: ["/tmp:mode=1777,size=16m,noexec,nosuid"]
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    pids_limit: 32
    mem_limit: 256m
    restart: "no"
networks:
  financial: {internal: true}
  web: {}
  observer-egress: {}
volumes:
  pg-data:
  pg-admin:
  pg-owner:
  pg-runtime:
  pg-backup:
  pg-tls:
  custody-node: