# Gated candidate profile, NOT an announcement of a production-ready or launched network.
# Keep payments mocked. Review docs/mainnet-launch.md before attempting activation.
services:
  mainnet:
    profiles: [mainnet]
    build:
      context: .
      target: runtime
      args:
        WIKIDECK_NETWORK: mainnet
    ports:
      - "127.0.0.1:${WIKIDECK_MAINNET_PORT:-3201}:3001"
    environment:
      WIKIDECK_NETWORK: mainnet
      WIKIDECK_MARKET_RUNTIME_ENABLED: "${WIKIDECK_MARKET_RUNTIME_ENABLED:-1}"
      WIKIDECK_PAYMENT_MODE: mock
      WIKIDECK_MARKET_ENABLED: "${WIKIDECK_MARKET_ENABLED:-1}"
      WIKIDECK_MARKET_TRADING_ENABLED: "${WIKIDECK_MARKET_TRADING_ENABLED:-1}"
      WIKIDECK_MARKET_HOST_FEE_ADDRESS: "${WIKIDECK_MARKET_HOST_FEE_ADDRESS:-44xHcCdFhW4b951yBHpkTPdLSJ85qTCnFQ8N7m96TtqqRL3dbhzbEH4fe2SJ3a6ESHcNyzCYH5nYJ9ActR1JtkeA7QYGbQv}"
      PUBLIC_ORIGIN: "${WIKIDECK_MAINNET_ORIGIN:-}"
      WIKIDECK_PEERS: "${WIKIDECK_MAINNET_PEERS:-}"
      WIKIDECK_MAINNET_LAUNCH: "${WIKIDECK_MAINNET_LAUNCH:-}"
      WIKIDECK_MAINNET_REVIEW_ACK: "${WIKIDECK_MAINNET_REVIEW_ACK:-}"
      WIKIDECK_ALLOW_PRIVATE_PEERS: "0"
      # Empty by default; set only the actual edge-to-container source IP/CIDR after topology review.
      WIKIDECK_TRUSTED_PROXIES: "${WIKIDECK_TRUSTED_PROXIES:-}"
      # Diagnostics are deliberately disabled here. Never publish an operations port.
      WIKIDECK_MARKET_FEE_BPS: "${WIKIDECK_MARKET_FEE_BPS:-250}"
      WIKIDECK_MARKET_CONFIRMATIONS: "${WIKIDECK_MARKET_CONFIRMATIONS:-10}"
    volumes:
      - mainnet-candidate-data:/app/data
    init: true
    restart: "no"
    read_only: true
    tmpfs:
      - /tmp:size=32m,mode=1777,noexec,nosuid
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    pids_limit: 128
    mem_limit: 1g
    cpus: 1.0
    stop_grace_period: 30s

volumes:
  mainnet-candidate-data: