networks:
  netlanvas_internal:
    driver: bridge
    ipam:
      config:
        - subnet: ${NETLANVAS_SUBNET:-172.28.1.0/24}

services:
  redis:
    image: redis:alpine
    container_name: netlanvas_redis
    restart: unless-stopped
    networks:
      netlanvas_internal:
        ipv4_address: ${REDIS_INTERNAL_IP:-172.28.1.10}
    command: redis-server --requirepass "SuperSecretRedisPassword123!" --save ""
    # --save "" disables RDB snapshotting entirely. Redis here is
    # purely ephemeral pub/sub-style IPC between netlanvas_core and
    # netlanvas_api (engine tick, TLS SAN publishing) -- nothing
    # stored in it needs to survive a restart (confirmed by the
    # existing graceful fallback when a value is missing, e.g. "No
    # host address published yet"). With no snapshot ever attempted,
    # the MISCONF/stop-writes-on-bgsave-error failure mode can never
    # trigger again, for any reason -- this closes the whole class
    # of problem rather than fixing one specific instance of it.
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "SuperSecretRedisPassword123!", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  netlanvas_core:
    image: netlanvas.com/netlanvas:latest
    container_name: netlanvas_core
    restart: unless-stopped
    network_mode: "host"
    cap_drop:
      - ALL
    cap_add:
      - NET_RAW
      - NET_ADMIN
    security_opt:
      - no-new-privileges:true
    volumes:
      - ./config:/app/config
      - ./db:/app/db
    environment:
      - NETLANVAS_ROLE=POLLER
      - NETLANVAS_VERSION=v3.4
      - TZ=Europe/London
      - PYTHONPATH=/app/src
      - PYTHONUNBUFFERED=1
      - REDIS_HOST=${REDIS_INTERNAL_IP:-172.28.1.10}
      - REDIS_PORT=6379
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    depends_on:
      redis:
        condition: service_healthy

  netlanvas_api:
    image: netlanvas.com/netlanvas:latest
    container_name: netlanvas_api
    restart: unless-stopped
    networks:
      - netlanvas_internal
    volumes:
      - ./config:/app/config
      - ./db:/app/db
      - ./tls:/app/tls
      - ./caddy:/app/caddy
    environment:
      - NETLANVAS_ROLE=API_VIEWER
      - NETLANVAS_VERSION=v3.4
      - TZ=Europe/London
      - PYTHONPATH=/app/src
      - PYTHONUNBUFFERED=1
      - REDIS_HOST=${REDIS_INTERNAL_IP:-172.28.1.10}
      - REDIS_PORT=6379
      - NETLANVAS_TLS_EXTRA_SANS=${NETLANVAS_PUBLIC_ADDR:-}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/healthz"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 15s
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    depends_on:
      redis:
        condition: service_healthy

  caddy:
    image: caddy:2-alpine
    container_name: netlanvas_caddy
    restart: unless-stopped
    networks:
      - netlanvas_internal
    ports:
      - "8899:8899"
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - ./tls:/etc/netlanvas-tls:ro
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    depends_on:
      netlanvas_api:
        condition: service_healthy
