docker-compose.yml

services:
  # The embedded Java backend is intentionally dormant in Lite mode, but the
  # local access plane still needs its durable Ops schema. Run the Ops Flyway
  # history independently so Full and Lite have the same local prerequisite.
  ops-schema-migrator:
    image: flyway/flyway:13.8.0
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |-
        set -eu
        export FLYWAY_PASSWORD="$$(cat /run/secrets/blockchain_mysql_password)"
        exec /flyway/flyway \
          -url="jdbc:mysql://mysql:3306/$${BLOCKCHAIN_MYSQL_DATABASE}?serverTimezone=UTC&characterEncoding=UTF-8&useSSL=false&allowPublicKeyRetrieval=true" \
          -user="$${BLOCKCHAIN_MYSQL_USER}" \
          -locations=filesystem:/flyway/sql \
          -table=flyway_ops_schema_history \
          -baselineOnMigrate=true \
          -baselineVersion=0 \
          -cleanDisabled=true \
          -connectRetries=60 \
          -connectRetriesInterval=2 \
          migrate
    environment:
      - BLOCKCHAIN_MYSQL_DATABASE=${BLOCKCHAIN_MYSQL_DATABASE:-blockchain_services}
      - BLOCKCHAIN_MYSQL_USER=${BLOCKCHAIN_MYSQL_USER:?BLOCKCHAIN_MYSQL_USER must be configured}
    volumes:
      - ./ops-migrations/sql:/flyway/sql:ro
    secrets:
      - blockchain_mysql_password
    depends_on:
      mysql:
        condition: service_healthy
    restart: "no"
    networks:
      - database_backend

  # Blockchain Services - Authentication and wallet operations
  blockchain-services:
    build:
      context: ./blockchain-services
      dockerfile: Dockerfile
    user: "${HOST_UID:-1000}:${HOST_GID:-1000}"
    env_file:
      - ${BLOCKCHAIN_SERVICES_ENV_FILE:-./blockchain-services/.env}  # Blockchain-specific configuration (optional overrides)
    environment:
      # auto => Full when ISSUER is empty, Lite when ISSUER points to an
      # external issuer. Set true/false explicitly for unattended deployments.
      - BLOCKCHAIN_SERVICES_ENABLED=${BLOCKCHAIN_SERVICES_ENABLED:-auto}
      # Server name for URL resolution (WebAuthn rpId, issuer URLs, etc.)
      - SERVER_NAME=${SERVER_NAME}
      - HTTPS_PORT=${HTTPS_PORT:-443}
      # Full Gateway owns the default notification timezone through TZ. Do not
      # inherit a stale notification override from blockchain-services/.env.
      - TZ=${TZ:-UTC}
      - NOTIFICATIONS_MAIL_TIMEZONE=
      - JAVA_TOOL_OPTIONS=-Duser.timezone=${TZ:-UTC}
      # Keep the Gateway's Full/Lite decision visible to the embedded backend
      # when BLOCKCHAIN_SERVICES_ENABLED is left at auto.
      - ISSUER=${ISSUER:-}
      # AES-256 key used by the durable access-code hand-off store.
      # The setup scripts generate this in the Gateway root .env.
      - ACCESS_CODE_ENCRYPTION_KEY=${ACCESS_CODE_ENCRYPTION_KEY:-}
      # Full-only map of canonical host[:non-default-port] gateway IDs to the
      # redeemer credentials accepted by
      # the embedded backend. The setup scripts generate it in the root .env.
      - ACCESS_CODE_REDEEMER_CREDENTIALS_JSON=${ACCESS_CODE_REDEEMER_CREDENTIALS_JSON:-}
      # Full-only map of Lite gateway IDs to reservation projection credentials
      # and their on-chain accessURI scope.
      - RESERVATION_PROJECTION_CREDENTIALS_JSON=${RESERVATION_PROJECTION_CREDENTIALS_JSON:-}
      # Full-only map of canonical host[:non-default-port] gateway IDs to the
      # short-lived session-observer
      # credentials accepted by the embedded backend. The FMU runner signs
      # observer JWTs with the matching per-gateway secret.
      - SESSION_OBSERVER_CREDENTIALS_JSON=${SESSION_OBSERVER_CREDENTIALS_JSON:-}
      # MySQL datasource for persistence (lab_reservations, auth_users)
      - SPRING_DATASOURCE_URL=jdbc:mysql://mysql:3306/${BLOCKCHAIN_MYSQL_DATABASE:-blockchain_services}?serverTimezone=UTC&characterEncoding=UTF-8&useSSL=false&allowPublicKeyRetrieval=true
      - SPRING_DATASOURCE_USERNAME=${BLOCKCHAIN_MYSQL_USER:?BLOCKCHAIN_MYSQL_USER must be configured}
      - SPRING_DATASOURCE_PASSWORD_FILE=/run/secrets/blockchain_mysql_password
      - SPRING_DATASOURCE_PASSWORD=
      - PROVIDER_CONFIG_PATH=/app/data/provider.properties
      - PRIVATE_KEY_PATH=/app/data/keys/private_key.pem
      - PUBLIC_KEY_PATH=/app/data/keys/public_key.pem
      # Marketplace JWKS used to validate Marketplace-issued JWTs.
      - MARKETPLACE_PUBLIC_KEY_URL=${MARKETPLACE_PUBLIC_KEY_URL:-https://www.decentralabs-marketplace.app/.well-known/jwks.json}
      - ADMIN_ACCESS_TOKEN_FILE=/run/secrets/admin_access_token
      - ADMIN_ACCESS_TOKEN=
      - ADMIN_ACCESS_TOKEN_HEADER=${ADMIN_ACCESS_TOKEN_HEADER:-X-Access-Token}
      - ADMIN_ACCESS_TOKEN_COOKIE=${ADMIN_ACCESS_TOKEN_COOKIE:-access_token}
      - ADMIN_ACCESS_TOKEN_REQUIRED=${ADMIN_ACCESS_TOKEN_REQUIRED:-true}
      - LAB_MANAGER_TOKEN_FILE=/run/secrets/lab_manager_token
      - LAB_MANAGER_TOKEN=
      # Do not expose the gateway-to-Ops credential to the backend.
      - OPS_INTERNAL_AUTH_TOKEN=
      - OPS_INTERNAL_AUTH_HEADER=
      - LAB_MANAGER_TOKEN_HEADER=${LAB_MANAGER_TOKEN_HEADER:-X-Lab-Manager-Token}
      - ADMIN_DASHBOARD_LOCAL_ONLY=${ADMIN_DASHBOARD_LOCAL_ONLY:-true}
      - ADMIN_DASHBOARD_ALLOW_PRIVATE=${ADMIN_DASHBOARD_ALLOW_PRIVATE:-true}
      - SECURITY_ALLOW_PRIVATE_NETWORKS=${SECURITY_ALLOW_PRIVATE_NETWORKS:-true}
      - ADMIN_ALLOWED_CIDRS=${ADMIN_ALLOWED_CIDRS:-}
      - LAB_MANAGER_ALLOWED_CIDRS=${LAB_MANAGER_ALLOWED_CIDRS:-}
      - LAB_CONTENT_BASE_PATH=/app/lab-content
      - LAB_METADATA_MAX_BYTES=${LAB_METADATA_MAX_BYTES:-1048576}
      - LAB_METADATA_MAX_CONCURRENT_FETCHES=${LAB_METADATA_MAX_CONCURRENT_FETCHES:-8}
      - LAB_METADATA_HTTP_CONNECT_TIMEOUT_MS=${LAB_METADATA_HTTP_CONNECT_TIMEOUT_MS:-5000}
      - LAB_METADATA_HTTP_READ_TIMEOUT_MS=${LAB_METADATA_HTTP_READ_TIMEOUT_MS:-10000}
      - LAB_METADATA_HTTP_CALL_TIMEOUT_MS=${LAB_METADATA_HTTP_CALL_TIMEOUT_MS:-15000}
      - LAB_METADATA_LOCAL_ENABLED=${LAB_METADATA_LOCAL_ENABLED:-false}
      - LAB_METADATA_LOCAL_ROOT=${LAB_METADATA_LOCAL_ROOT:-/app/lab-metadata-fixtures}
      - FMU_DATA_PATH=/app/fmu-data
      - FMU_STATION_BASE_URL=${FMU_STATION_BASE_URL:-}
      - FMU_STATION_INTERNAL_TOKEN_FILE=/run/secrets/fmu_station_internal_token
      - FMU_STATION_INTERNAL_TOKEN=
      - FMU_STATION_REQUEST_TIMEOUT_MS=${FMU_STATION_REQUEST_TIMEOUT_MS:-5000}
      - FMU_CAPACITY_REQUIRED=${FMU_CAPACITY_REQUIRED:-true}
      - 'SPRING_APPLICATION_JSON={"ethereum":{"gas":{"price":{"default":5},"limit":{"contract":1000000}}}}'
    volumes:
      - ./blockchain-data:/app/data
      - ./lab-content:/app/lab-content
      - ./fmu-data:/app/fmu-data:ro
    depends_on:
      mysql:
        condition: service_healthy
      ops-schema-migrator:
        condition: service_completed_successfully
    secrets:
      - blockchain_mysql_password
      - admin_access_token
      - lab_manager_token
      - fmu_station_internal_token
    # In Lite mode keep the optional container dormant; never start the Java
    # backend or generate a local JWT key. OpenResty selects the remote key.
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        read_secret() {
          variable="$$1"
          path="$$2"
          if [ -r "$$path" ]; then
            value="$$(cat "$$path")"
            export "$$variable=$$value"
          fi
        }
        read_secret SPRING_DATASOURCE_PASSWORD /run/secrets/blockchain_mysql_password
        read_secret ADMIN_ACCESS_TOKEN /run/secrets/admin_access_token
        read_secret LAB_MANAGER_TOKEN /run/secrets/lab_manager_token
        read_secret FMU_STATION_INTERNAL_TOKEN /run/secrets/fmu_station_internal_token
        mode="$${BLOCKCHAIN_SERVICES_ENABLED:-auto}"
        issuer="$${ISSUER:-}"
        server_name="$${SERVER_NAME:-localhost}"
        https_port="$${HTTPS_PORT:-443}"
        local_issuer="https://$${server_name}"
        if [ -n "$$https_port" ] && [ "$$https_port" != "443" ]; then
          local_issuer="https://$${server_name}:$${https_port}"
        fi
        local_issuer="$$local_issuer/auth"
        while [ "$${issuer%/}" != "$$issuer" ]; do issuer="$${issuer%/}"; done
        while [ "$${local_issuer%/}" != "$$local_issuer" ]; do local_issuer="$${local_issuer%/}"; done
        lite_mode=false
        if [ -n "$$issuer" ] && [ "$$issuer" != "$$local_issuer" ]; then
          lite_mode=true
        fi
        if [ "$$mode" = "false" ] || { [ "$$mode" = "auto" ] && [ "$$lite_mode" = "true" ]; }; then
          echo "Embedded blockchain-services disabled (Lite mode); container is dormant."
          while :; do sleep 86400; done
        fi
        exec /app/entrypoint.sh
    healthcheck:
      # Probe Spring readiness; /health remains the detailed operational status consumed by the Gateway.
      test:
        - CMD-SHELL
        - >-
          mode="$${BLOCKCHAIN_SERVICES_ENABLED:-auto}";
          issuer="$${ISSUER:-}";
          server_name="$${SERVER_NAME:-localhost}";
          https_port="$${HTTPS_PORT:-443}";
          local_issuer="https://$${server_name}";
          if [ -n "$$https_port" ] && [ "$$https_port" != "443" ]; then local_issuer="https://$${server_name}:$${https_port}"; fi;
          local_issuer="$$local_issuer/auth";
          while [ "$${issuer%/}" != "$$issuer" ]; do issuer="$${issuer%/}"; done;
          while [ "$${local_issuer%/}" != "$$local_issuer" ]; do local_issuer="$${local_issuer%/}"; done;
          lite_mode=false;
          if [ -n "$$issuer" ] && [ "$$issuer" != "$$local_issuer" ]; then lite_mode=true; fi;
          if [ "$$mode" = "false" ] || { [ "$$mode" = "auto" ] && [ "$$lite_mode" = "true" ]; }; then exit 0; fi;
          code=$$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/actuator/health/readiness);
          [ "$$code" -eq 200 ]
      timeout: 10s
      retries: 5
      interval: 30s
      start_period: 120s
    deploy:
      resources:
        limits:
          memory: 768M
          cpus: '1.0'
        reservations:
          memory: 384M
          cpus: '0.5'
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
        labels: "service=blockchain-services"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    networks:
      - gateway_backend
      - ops_backend
      - database_backend
      - fmu_control
      # Dedicated authentication path for the isolated local FMU runner.
      - fmu_auth

  openresty:
    build:
      context: ./openresty
      dockerfile: Dockerfile
    user: "${HOST_UID:-1000}:${HOST_GID:-1000}"
    ports:
      - "${OPENRESTY_BIND_ADDRESS:-127.0.0.1}:${OPENRESTY_BIND_HTTPS_PORT:-443}:443"
      - "${OPENRESTY_BIND_ADDRESS:-127.0.0.1}:${OPENRESTY_BIND_HTTP_PORT:-80}:80"
    volumes:
      - ./certs:/etc/ssl/private
      - ./certbot/www:/var/www/certbot
      - ./openresty/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf:ro
      - ./openresty/gateway.conf:/etc/openresty/gateway.conf:ro
      - ./openresty/real_ip.d:/etc/openresty/real_ip.d:ro
      - ./openresty/lua:/etc/openresty/lua:ro
      - ./web:/var/www/html:ro
      - ./lab-content:/var/www/lab-content:ro
      # Full mode: expose blockchain-services JWT public key to OpenResty.
      # Lite mode may still have a stale file here, but mode-specific Lua
      # selection never reads it; Lite uses only certs/public_key.pem.
      - ./blockchain-data/keys:/etc/openresty/jwt-keys:ro
      # Durable encrypted FMU mappings survive OpenResty container restarts.
      - ./fmu-access-state:${FMU_ACCESS_STATE_PATH:-/var/lib/openresty/fmu-access}
    tmpfs:
      - /tmp:size=64M,mode=1777
      - /var/run:size=16M,mode=755
    environment:
      - GUAC_ADMIN_USER=${GUAC_ADMIN_USER}
      - GUAC_ADMIN_PASS_FILE=/run/secrets/guac_admin_pass
      - GUACAMOLE_LOGIN_RATE_LIMIT_PER_MINUTE=${GUACAMOLE_LOGIN_RATE_LIMIT_PER_MINUTE:-10}
      - SERVER_NAME=${SERVER_NAME}
      - HTTPS_PORT=${HTTPS_PORT}
      - HTTP_PORT=${HTTP_PORT}
      - ISSUER=${ISSUER}
      # Certbot owns the ACME lineage below certs/live. OpenResty uses this
      # value only to locate the matching lineage during startup fallback.
      - CERTBOT_DOMAINS=${CERTBOT_DOMAINS:-}
      - TLS_RELOAD_INTERVAL_SECONDS=${TLS_RELOAD_INTERVAL_SECONDS:-60}
      - AUTH_ACCESS_CODE_REDEEM_URL=${AUTH_ACCESS_CODE_REDEEM_URL:-}
      - AUTH_ACCESS_CODE_REDEEMER_TOKEN_FILE=/run/secrets/auth_access_code_redeemer_token
      - ACCESS_CODE_ENCRYPTION_KEY=${ACCESS_CODE_ENCRYPTION_KEY:-}
      - FMU_ACCESS_STATE_PATH=${FMU_ACCESS_STATE_PATH:-/var/lib/openresty/fmu-access}
      - API_SESSION_TIMEOUT=${API_SESSION_TIMEOUT:-15}
      - SESSION_OBSERVATION_INGEST_TOKEN_FILE=/run/secrets/session_observation_ingest_token
      - OPS_SESSION_OBSERVATION_INGEST_URL=${OPS_SESSION_OBSERVATION_INGEST_URL:-http://ops-worker:8081/internal/session-observations}
      - OPS_GUACAMOLE_TOKEN_INGEST_URL=${OPS_GUACAMOLE_TOKEN_INGEST_URL:-http://ops-worker:8081/internal/guacamole-token-revocations}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS}
      - AUTO_LOGOUT_ON_DISCONNECT=${AUTO_LOGOUT_ON_DISCONNECT:-true}
      - MARKETPLACE_URL=${MARKETPLACE_URL:-https://www.decentralabs-marketplace.app}
      - ADMIN_ACCESS_TOKEN_FILE=/run/secrets/admin_access_token
      - ADMIN_ACCESS_TOKEN_HEADER=${ADMIN_ACCESS_TOKEN_HEADER:-X-Access-Token}
      - ADMIN_ACCESS_TOKEN_COOKIE=${ADMIN_ACCESS_TOKEN_COOKIE:-access_token}
      - ADMIN_DASHBOARD_LOCAL_ONLY=${ADMIN_DASHBOARD_LOCAL_ONLY:-true}
      - ADMIN_DASHBOARD_ALLOW_PRIVATE=${ADMIN_DASHBOARD_ALLOW_PRIVATE:-true}
      - SECURITY_ALLOW_PRIVATE_NETWORKS=${SECURITY_ALLOW_PRIVATE_NETWORKS:-true}
      - ADMIN_ALLOWED_CIDRS=${ADMIN_ALLOWED_CIDRS:-}
      - ADMIN_TRUST_FORWARDED_IP=${ADMIN_TRUST_FORWARDED_IP:-true}
      - LAB_MANAGER_TOKEN_FILE=/run/secrets/lab_manager_token
      - OPS_INTERNAL_AUTH_TOKEN_FILE=/run/secrets/ops_internal_auth_token
      - OPS_INTERNAL_AUTH_HEADER=${OPS_INTERNAL_AUTH_HEADER:-X-Ops-Internal-Token}
      - LAB_MANAGER_TOKEN_HEADER=${LAB_MANAGER_TOKEN_HEADER}
      - LAB_MANAGER_TOKEN_COOKIE=${LAB_MANAGER_TOKEN_COOKIE}
      - GUACAMOLE_PROVISIONER_TOKEN_FILE=/run/secrets/guacamole_provisioner_token
      - GUACAMOLE_PROVISIONER_TOKEN_HEADER=${GUACAMOLE_PROVISIONER_TOKEN_HEADER:-X-Guacamole-Provisioner-Token}
      - LAB_ADMIN_BACKEND_URL=${LAB_ADMIN_BACKEND_URL:-}
      - LAB_ADMIN_BACKEND_TOKEN_FILE=/run/secrets/lab_admin_backend_token
      - LAB_ADMIN_BACKEND_TOKEN_HEADER=${LAB_ADMIN_BACKEND_TOKEN_HEADER:-X-Lab-Manager-Token}
      - LAB_ADMIN_BACKEND_ALLOW_INSECURE=${LAB_ADMIN_BACKEND_ALLOW_INSECURE:-false}
      - FMU_RUNNER_ENABLED=${FMU_RUNNER_ENABLED:-false}
      - AAS_ENABLED=${AAS_ENABLED:-}
      - BASYX_AAS_URL=${BASYX_AAS_URL:-}
      - AAS_ALLOWED_HOSTS=${AAS_ALLOWED_HOSTS:-}
      - AAS_SERVICE_TOKEN_FILE=/run/secrets/aas_service_token
      - AAS_SERVICE_TOKEN_HEADER=${AAS_SERVICE_TOKEN_HEADER:-Authorization}
      - DEMO_USER=${DEMO_USER:-demo-lab-disabled}
      - DEMO_LAB_ID=${DEMO_LAB_ID:-}
      - DEMO_CONNECTION_ID=${DEMO_CONNECTION_ID:-}
      - DEMO_SESSION_TTL_SECONDS=${DEMO_SESSION_TTL_SECONDS:-600}
      - DEMO_RATE_LIMIT_PER_MINUTE=${DEMO_RATE_LIMIT_PER_MINUTE:-10}
      - DEMO_STATION_TIMEOUT_SECONDS=${DEMO_STATION_TIMEOUT_SECONDS:-15}
      - DEMO_PENDING_LEASE_SECONDS=${DEMO_PENDING_LEASE_SECONDS:-45}
      - JWT_GUAC_IDLE_TIMEOUT_SECONDS=${JWT_GUAC_IDLE_TIMEOUT_SECONDS:-60}
      - JWT_KEY_OVERLAP_SECONDS=${JWT_KEY_OVERLAP_SECONDS:-14400}
      - JWT_KEY_REFRESH_INTERVAL_SECONDS=${JWT_KEY_REFRESH_INTERVAL_SECONDS:-300}
    depends_on:
      guacamole:
        condition: service_healthy
      blockchain-services:
        condition: service_healthy  # Full waits for its JWT key; Lite is dormant/ready
      ops-worker:
        condition: service_started
    secrets:
      - admin_access_token
      - lab_manager_token
      - ops_internal_auth_token
      - guac_admin_pass
      - auth_access_code_redeemer_token
      - session_observation_ingest_token
      - guacamole_provisioner_token
      - aas_service_token
      - lab_admin_backend_token
    healthcheck:
      test: ["CMD", "sh", "-c", "curl -f -k https://localhost:443/ -H 'Host: ${SERVER_NAME}' --connect-timeout 5"]
      timeout: 10s
      retries: 3
      interval: 30s
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: '0.3'
        reservations:
          memory: 64M
          cpus: '0.2'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"
        labels: "service=openresty"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    restart: always
    networks:
      - gateway_public
      - gateway_backend
      - gateway_guacamole
      - guacd_net
      - ops_control
      - fmu_edge
      - fmu_local_edge
      - fmu_aas

  cloudflared:
    image: cloudflare/cloudflared:2024.11.0
    profiles: ["cloudflare"]
    depends_on:
      openresty:
        condition: service_healthy
    command:
      - sh
      - -c
      - |
        set -e
        target="${CLOUDFLARE_TUNNEL_SERVICE:-https://openresty:443}"

        # If we have real certs and a non-localhost hostname, trust TLS; otherwise allow self-signed.
        have_real_cert=false
        if [ -s /certs/fullchain.pem ] && [ -s /certs/privkey.pem ] && [ "${SERVER_NAME:-localhost}" != "localhost" ]; then
          have_real_cert=true
        fi

        args="tunnel --no-autoupdate --protocol http2 --url $${target}"
        if [ "$$have_real_cert" != "true" ]; then
          args="$$args --no-tls-verify"
        fi

        exec cloudflared $$args
    environment:
      - CLOUDFLARE_TUNNEL_SERVICE=${CLOUDFLARE_TUNNEL_SERVICE:-https://openresty:443}
      - SERVER_NAME=${SERVER_NAME}
    volumes:
      - ./certs:/certs:ro
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: '0.25'
        reservations:
          memory: 64M
          cpus: '0.1'
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: unless-stopped
    networks:
      - gateway_public

  cloudflared-token:
    image: cloudflare/cloudflared:2024.11.0
    profiles: ["cloudflare-token"]
    depends_on:
      openresty:
        condition: service_healthy
    command:
      - tunnel
      - --no-autoupdate
      - run
      - --token
      - ${CLOUDFLARE_TUNNEL_TOKEN}
    environment:
      - CLOUDFLARE_TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN:-}
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: '0.25'
        reservations:
          memory: 64M
          cpus: '0.1'
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: unless-stopped
    networks:
      - gateway_public

  certbot:
    image: certbot/certbot:v2.11.0
    profiles: ["certbot"]
    entrypoint: ["certbot"]
    command: ["--version"]
    environment:
      - TLS_CERT_HOSTNAME=${SERVER_NAME:-}
      - TLS_CERT_UID=${HOST_UID:-1000}
      - TLS_CERT_GID=${HOST_GID:-1000}
    volumes:
      - ./certs:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
      - ./certbot/deploy-hook.sh:/usr/local/bin/deploy-hook.sh:ro
    # Usage example:
    # docker compose run --rm --profile certbot certbot certonly --webroot -w /var/www/certbot -d your.domain --email you@example.com --agree-tos --no-eff-email --deploy-hook "sh /usr/local/bin/deploy-hook.sh"

  certbot-renew:
    image: certbot/certbot:v2.11.0
    profiles: ["certbot"]
    restart: unless-stopped
    depends_on:
      certbot-init:
        condition: service_completed_successfully
    entrypoint:
      - /bin/sh
      - -c
      - |
        set -eu
        while true; do
          if ! certbot renew --webroot -w /var/www/certbot --quiet \
              --deploy-hook "sh /usr/local/bin/deploy-hook.sh"; then
            echo "Certbot renewal attempt failed; retrying in 12 hours" >&2
          fi
          sleep 43200
        done
    environment:
      - TLS_CERT_HOSTNAME=${SERVER_NAME:-}
      - TLS_CERT_UID=${HOST_UID:-1000}
      - TLS_CERT_GID=${HOST_GID:-1000}
    volumes:
      - ./certs:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
      - ./certbot/deploy-hook.sh:/usr/local/bin/deploy-hook.sh:ro

  certbot-init:
    image: certbot/certbot:v2.11.0
    profiles: ["certbot"]
    restart: "no"
    depends_on:
      openresty:
        condition: service_started
    entrypoint:
      - /bin/sh
      - -c
      - |
        if [ -z "$$CERTBOT_DOMAINS" ] || [ -z "$$CERTBOT_EMAIL" ]; then
          echo "CERTBOT_DOMAINS or CERTBOT_EMAIL not set; skipping initial cert issuance";
          exit 0;
        fi
        primary_domain=$$(printf '%s' "$$CERTBOT_DOMAINS" | cut -d',' -f1 | tr -d ' ')
        live_cert="/etc/letsencrypt/live/$$primary_domain/fullchain.pem"
        live_key="/etc/letsencrypt/live/$$primary_domain/privkey.pem"
        if [ -s "$$live_cert" ] && [ -s "$$live_key" ] &&
           openssl x509 -in "$$live_cert" -checkend 0 -noout >/dev/null 2>&1 &&
           openssl pkey -in "$$live_key" -noout >/dev/null 2>&1; then
          echo "Valid certificate already present for $$primary_domain; promoting it to the canonical TLS paths"
          RENEWED_LINEAGE="/etc/letsencrypt/live/$$primary_domain" sh /usr/local/bin/deploy-hook.sh
          exit 0
        fi
        domains=""
        for d in $$(printf '%s' "$$CERTBOT_DOMAINS" | tr ',' ' '); do domains="$$domains -d $$d"; done
        staging=""
        if [ "$$CERTBOT_STAGING" = "1" ]; then staging="--staging"; fi
        certbot certonly --non-interactive --agree-tos $$staging --webroot -w /var/www/certbot $$domains -m "$$CERTBOT_EMAIL" --deploy-hook "sh /usr/local/bin/deploy-hook.sh"
    environment:
      - CERTBOT_DOMAINS=${CERTBOT_DOMAINS}
      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
      - CERTBOT_STAGING=${CERTBOT_STAGING:-0}
      - TLS_CERT_HOSTNAME=${SERVER_NAME:-}
      - TLS_CERT_UID=${HOST_UID:-1000}
      - TLS_CERT_GID=${HOST_GID:-1000}
    volumes:
      - ./certs:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
      - ./certbot/deploy-hook.sh:/usr/local/bin/deploy-hook.sh:ro

  mysql:
    image: mysql:8.0.41
    entrypoint: ["/bin/bash", "/usr/local/bin/ensure-user-entrypoint.sh"]
    command: ["mysqld"]
    environment:
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/mysql_root_password
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      BLOCKCHAIN_MYSQL_DATABASE: ${BLOCKCHAIN_MYSQL_DATABASE:-blockchain_services}
      GUACAMOLE_MYSQL_USER: ${GUACAMOLE_MYSQL_USER:?GUACAMOLE_MYSQL_USER must be configured}
      GUACAMOLE_MYSQL_PASSWORD_FILE: /run/secrets/guacamole_mysql_password
      BLOCKCHAIN_MYSQL_USER: ${BLOCKCHAIN_MYSQL_USER:?BLOCKCHAIN_MYSQL_USER must be configured}
      BLOCKCHAIN_MYSQL_PASSWORD_FILE: /run/secrets/blockchain_mysql_password
      OPS_BACKEND_MYSQL_USER: ${OPS_BACKEND_MYSQL_USER:?OPS_BACKEND_MYSQL_USER must be configured}
      OPS_BACKEND_MYSQL_PASSWORD_FILE: /run/secrets/ops_backend_mysql_password
      OPS_GUACAMOLE_MYSQL_USER: ${OPS_GUACAMOLE_MYSQL_USER:?OPS_GUACAMOLE_MYSQL_USER must be configured}
      OPS_GUACAMOLE_MYSQL_PASSWORD_FILE: /run/secrets/ops_guacamole_mysql_password
      GUAC_ADMIN_USER: ${GUAC_ADMIN_USER}
      GUAC_ADMIN_PASS_FILE: /run/secrets/guac_admin_pass
      DEMO_USER: ${DEMO_USER:-demo-lab-disabled}
      DEMO_LAB_ID: ${DEMO_LAB_ID:-}
      DEMO_CONNECTION_ID: ${DEMO_CONNECTION_ID:-}
    secrets:
      - mysql_root_password
      - guacamole_mysql_password
      - blockchain_mysql_password
      - ops_backend_mysql_password
      - ops_guacamole_mysql_password
      - guac_admin_pass
    volumes:
      - mysql_data:/var/lib/mysql
      - ./mysql/ensure-user-entrypoint.sh:/usr/local/bin/ensure-user-entrypoint.sh:ro
      - ./mysql/healthcheck.sh:/usr/local/bin/mysql-healthcheck.sh:ro
      - ./mysql/000-ensure-user.sh:/usr/local/bin/ensure-user.sh:ro
      - ./mysql/001-create-schema.sql:/docker-entrypoint-initdb.d/001-create-schema.sql:ro
    healthcheck:
      test: ["CMD", "bash", "/usr/local/bin/mysql-healthcheck.sh"]
      timeout: 20s
      retries: 10
      interval: 30s
      start_period: 60s  # MySQL needs time to initialize
    deploy:
      resources:
        limits:
          memory: 768M
          cpus: '0.75'
        reservations:
          memory: 384M
          cpus: '0.25'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        labels: "service=mysql"
    security_opt:
      - no-new-privileges:true
    #ports:
    # - "3306:3306"
    restart: always
    networks:
      - database_backend
      - database_guacamole
      - database_ops

  guacamole:
    build:
      context: ./guacamole
      dockerfile: Dockerfile
    depends_on:
      mysql:
        condition: service_healthy
      guacd:
        condition: service_healthy
    environment:
      GUACD_HOSTNAME: guacd
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${GUACAMOLE_MYSQL_USER:?GUACAMOLE_MYSQL_USER must be configured}
      MYSQL_PASSWORD_FILE: /run/secrets/guacamole_mysql_password
      MYSQL_HOSTNAME: mysql
      API_SESSION_TIMEOUT: ${API_SESSION_TIMEOUT:-15}
      BAN_MAX_INVALID_ATTEMPTS: ${BAN_MAX_INVALID_ATTEMPTS:-5}
      BAN_ADDRESS_DURATION: ${BAN_ADDRESS_DURATION:-300}
      BAN_MAX_ADDRESSES: ${BAN_MAX_ADDRESSES:-10485670}
    secrets:
      - guacamole_mysql_password
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/guacamole/"]
      timeout: 10s
      retries: 5
      interval: 30s
      start_period: 120s  # Guacamole needs time to fully start
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '1.0'
        reservations:
          memory: 512M
          cpus: '0.5'
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
        labels: "service=guacamole"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    #ports:
    # - "8080:8080"
    networks:
      - gateway_guacamole
      - database_guacamole
      - guacd_net
      # Ops Worker reconciles Guacamole sessions through the private
      # ops_guacamole edge; keep that path separate from the public gateway.
      - ops_guacamole
  guacd:
    image: guacamole/guacd:1.6.0
    healthcheck:
      test: ["CMD", "nc", "-z", "localhost", "4822"]
      timeout: 10s
      retries: 3
      interval: 30s
      start_period: 30s
    tmpfs:
      - /tmp:size=128M,mode=1777
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'
        reservations:
          memory: 128M
          cpus: '0.2'
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "3"
        labels: "service=guacd"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    #ports:
    # - "4822:4822"
    networks:
      - guacd_net

  ops-worker:
    build:
      context: ./ops-worker
      dockerfile: Dockerfile
      args:
        OPS_UID: ${HOST_UID:-1000}
        OPS_GID: ${HOST_GID:-1000}
    environment:
      - OPS_BIND=0.0.0.0
      - OPS_PORT=8081
      - OPS_CONFIG=/app/hosts.json
      - OPS_DYNAMIC_CONFIG=/app/data/hosts.json
      - OPS_CREDENTIALS_PATH=${OPS_CREDENTIALS_PATH:-/app/data/winrm-credentials.json}
      - OPS_WINRM_TRUST_PATH=${OPS_WINRM_TRUST_PATH:-/app/data/winrm-certificates}
      - OPS_POWER_CONFIG=${OPS_POWER_CONFIG:-/app/data/power-controllers.json}
      - OPS_POWER_CREDENTIALS_PATH=${OPS_POWER_CREDENTIALS_PATH:-/app/data/power-credentials.json}
      - OPS_POWER_STATUS_CACHE_SECONDS=${OPS_POWER_STATUS_CACHE_SECONDS:-5}
      - OPS_SECRETS_KEY_FILE=/run/secrets/ops_secrets_key
      - OPS_POLL_ENABLED=${OPS_POLL_ENABLED:-true}
      - OPS_POLL_INTERVAL=${OPS_POLL_INTERVAL:-60}
      - TZ=${TZ:-UTC}
      - WAKE_OPS_ENABLED=${WAKE_OPS_ENABLED:-true}
      - WAKE_OPS_INTERVAL_SECONDS=${WAKE_OPS_INTERVAL_SECONDS:-60}
      - OPS_RESERVATION_AUTOMATION=${OPS_RESERVATION_AUTOMATION:-true}
      - OPS_RESERVATION_SCAN_INTERVAL=${OPS_RESERVATION_SCAN_INTERVAL:-30}
      - OPS_RESERVATION_START_LEAD=${OPS_RESERVATION_START_LEAD:-120}
      - OPS_RESERVATION_END_DELAY=${OPS_RESERVATION_END_DELAY:-60}
      - OPS_RESERVATION_LOOKBACK=${OPS_RESERVATION_LOOKBACK:-21600}
      - OPS_RESERVATION_RETRY_COOLDOWN=${OPS_RESERVATION_RETRY_COOLDOWN:-60}
      - OPS_RESERVATION_MAX_BATCH=${OPS_RESERVATION_MAX_BATCH:-200}
      - OPS_ALLOWED_COMMANDS=${OPS_ALLOWED_COMMANDS:-prepare-session,release-session,power,session,energy,status-json,recovery,account,service,wol,status}
      - OPS_TIMELINE_MAX_OPS=${OPS_TIMELINE_MAX_OPS:-500}
      - OPS_TIMELINE_DEFAULT_LIMIT=${OPS_TIMELINE_DEFAULT_LIMIT:-100}
      - OPS_TIMELINE_PHASE_LOOKBACK=${OPS_TIMELINE_PHASE_LOOKBACK:-500}
      - SERVER_NAME=${SERVER_NAME}
      - HTTPS_PORT=${HTTPS_PORT}
      - ISSUER=${ISSUER}
      - LAB_MANAGER_TOKEN_FILE=/run/secrets/lab_manager_token
      - LAB_MANAGER_TOKEN_HEADER=${LAB_MANAGER_TOKEN_HEADER:-X-Lab-Manager-Token}
      - LAB_ADMIN_BACKEND_URL=${LAB_ADMIN_BACKEND_URL:-}
      - LAB_ADMIN_BACKEND_TOKEN_FILE=/run/secrets/lab_admin_backend_token
      - LAB_ADMIN_BACKEND_TOKEN_HEADER=${LAB_ADMIN_BACKEND_TOKEN_HEADER:-X-Lab-Manager-Token}
      - LAB_ADMIN_BACKEND_ALLOW_INSECURE=${LAB_ADMIN_BACKEND_ALLOW_INSECURE:-false}
      - LAB_ADMIN_BACKEND_TIMEOUT_SECONDS=${LAB_ADMIN_BACKEND_TIMEOUT_SECONDS:-30}
      - LAB_CATALOG_CACHE_SECONDS=${LAB_CATALOG_CACHE_SECONDS:-15}
      - OPS_INTERNAL_AUTH_TOKEN_FILE=/run/secrets/ops_internal_auth_token
      - OPS_INTERNAL_AUTH_HEADER=${OPS_INTERNAL_AUTH_HEADER:-X-Ops-Internal-Token}
      - GUACAMOLE_PROVISIONER_TOKEN_FILE=/run/secrets/guacamole_provisioner_token
      - GUACAMOLE_PROVISIONER_TOKEN_HEADER=${GUACAMOLE_PROVISIONER_TOKEN_HEADER:-X-Guacamole-Provisioner-Token}
      - RESERVATION_PROJECTION_URL=${RESERVATION_PROJECTION_URL:-}
      - RESERVATION_PROJECTION_GATEWAY_ID=${RESERVATION_PROJECTION_GATEWAY_ID:-}
      - RESERVATION_PROJECTION_TOKEN_FILE=/run/secrets/reservation_projection_token
      - MYSQL_HOSTNAME=mysql
      - OPS_BACKEND_MYSQL_USER=${OPS_BACKEND_MYSQL_USER:?OPS_BACKEND_MYSQL_USER must be configured}
      - OPS_BACKEND_MYSQL_PASSWORD_FILE=/run/secrets/ops_backend_mysql_password
      - OPS_GUACAMOLE_MYSQL_USER=${OPS_GUACAMOLE_MYSQL_USER:?OPS_GUACAMOLE_MYSQL_USER must be configured}
      - OPS_GUACAMOLE_MYSQL_PASSWORD_FILE=/run/secrets/ops_guacamole_mysql_password
      - OPS_MYSQL_DATABASE=${BLOCKCHAIN_MYSQL_DATABASE:-blockchain_services}
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - GUACAMOLE_MYSQL_DATABASE=${MYSQL_DATABASE}
      - ACCESS_AUDIT_URL=${ACCESS_AUDIT_URL:-}
      - NOTIFICATION_SERVICE_ACCESS_TOKEN_FILE=/run/secrets/admin_access_token
      - NOTIFICATION_SERVICE_ENABLED=${NOTIFICATION_SERVICE_ENABLED:-true}
      - NOTIFICATION_SERVICE_URL=${NOTIFICATION_SERVICE_URL:-http://blockchain-services:8080/billing/admin/notifications/send}
      - NOTIFICATION_SERVICE_RECIPIENTS=${NOTIFICATION_SERVICE_RECIPIENTS:-}
      - NOTIFICATION_SERVICE_RETRY_ATTEMPTS=${NOTIFICATION_SERVICE_RETRY_ATTEMPTS:-3}
      - NOTIFICATION_SERVICE_RETRY_BACKOFF_SECONDS=${NOTIFICATION_SERVICE_RETRY_BACKOFF_SECONDS:-5}
      - SESSION_OBSERVER_GATEWAY_ID=${SESSION_OBSERVER_GATEWAY_ID:-}
      - SESSION_OBSERVER_SIGNING_SECRET_FILE=/run/secrets/session_observer_signing_secret
      - SESSION_OBSERVATION_INGEST_TOKEN_FILE=/run/secrets/session_observation_ingest_token
      - GUAC_ADMIN_USER=${GUAC_ADMIN_USER}
      - GUAC_ADMIN_PASS_FILE=/run/secrets/guac_admin_pass
      - DEMO_USER=${DEMO_USER:-demo-lab-disabled}
      - DEMO_LAB_ID=${DEMO_LAB_ID:-}
      - DEMO_CONNECTION_ID=${DEMO_CONNECTION_ID:-}
      - DEMO_HEARTBEAT_MAX_AGE_SECONDS=${DEMO_HEARTBEAT_MAX_AGE_SECONDS:-180}
      - LAB_STATUS_HEARTBEAT_MAX_AGE_SECONDS=${LAB_STATUS_HEARTBEAT_MAX_AGE_SECONDS:-180}
      - LAB_STATUS_TARGET_PROBE_TIMEOUT_SECONDS=${LAB_STATUS_TARGET_PROBE_TIMEOUT_SECONDS:-1.5}
      - LAB_STATUS_TARGET_PROBE_CACHE_SECONDS=${LAB_STATUS_TARGET_PROBE_CACHE_SECONDS:-30}
      - FMU_STATUS_URL=${FMU_STATUS_URL:-http://fmu-runner:8090/health}
      - FMU_STATUS_TIMEOUT_SECONDS=${FMU_STATUS_TIMEOUT_SECONDS:-1.5}
      - FMU_STATUS_CACHE_SECONDS=${FMU_STATUS_CACHE_SECONDS:-15}
      - FMU_STATUS_BACKEND=${FMU_BACKEND_MODE:-station}
      - FMU_STATUS_STATION_HOST=${FMU_STATUS_STATION_HOST:-}
      - FMU_STATUS_STATION_BASE_URL=${FMU_STATUS_STATION_BASE_URL:-${FMU_STATION_BASE_URL:-}}
      - FMU_STATION_INTERNAL_TOKEN_FILE=/run/secrets/fmu_station_internal_token
      - GUAC_API_URL=${GUAC_API_URL:-http://guacamole:8080/guacamole/api}
      - GUACAMOLE_HISTORY_LOOKBACK_SECONDS=${GUACAMOLE_HISTORY_LOOKBACK_SECONDS:-30}
      - GUACAMOLE_HISTORY_RECONCILIATION_RETENTION_SECONDS=${GUACAMOLE_HISTORY_RECONCILIATION_RETENTION_SECONDS:-300}
      - GUACAMOLE_TEMP_USER_CLEANUP_ENABLED=${GUACAMOLE_TEMP_USER_CLEANUP_ENABLED:-true}
      - GUACAMOLE_TEMP_USER_CLEANUP_INTERVAL_SECONDS=${GUACAMOLE_TEMP_USER_CLEANUP_INTERVAL_SECONDS:-900}
      - WINRM_ALLOWED_TRANSPORTS=${WINRM_ALLOWED_TRANSPORTS:-ntlm,kerberos,credssp}
      - WINRM_MANAGEMENT_CIDRS=${WINRM_MANAGEMENT_CIDRS:-}
      - OPS_DISCOVERY_TIMEOUT_SECONDS=${OPS_DISCOVERY_TIMEOUT_SECONDS:-1.5}
      - OPS_DISCOVERY_LABSTATION_PORTS=${OPS_DISCOVERY_LABSTATION_PORTS:-8765,8088}
      - OPS_DISCOVERY_LABSTATION_PATHS=${OPS_DISCOVERY_LABSTATION_PATHS:-/labstation/health,/health}
      - BASYX_AAS_URL=${BASYX_AAS_URL:-http://basyx-aas-server:8081}
      - AAS_ALLOWED_HOSTS=${AAS_ALLOWED_HOSTS:-}
      - AAS_SERVICE_TOKEN_FILE=/run/secrets/aas_service_token
      - AAS_SERVICE_TOKEN_HEADER=${AAS_SERVICE_TOKEN_HEADER:-Authorization}
    volumes:
      - ${OPS_CONFIG_PATH:-./ops-worker/hosts.empty.json}:/app/hosts.json:ro
      - ./ops-data:/app/data
    secrets:
      - admin_access_token
      - lab_manager_token
      - ops_internal_auth_token
      - ops_secrets_key
      - lab_admin_backend_token
      - fmu_station_internal_token
      - session_observer_signing_secret
      - guacamole_provisioner_token
      - reservation_projection_token
      - session_observation_ingest_token
      - guac_admin_pass
      - aas_service_token
      - ops_backend_mysql_password
      - ops_guacamole_mysql_password
    tmpfs:
      - /tmp:size=32M,mode=1777
    read_only: true
    depends_on:
      mysql:
        condition: service_healthy
      ops-schema-migrator:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8081/health').read()"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.4'
        reservations:
          memory: 128M
          cpus: '0.2'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        labels: "service=ops-worker"
    security_opt:
      - no-new-privileges:true
      # Keep Docker's default seccomp profile; do not override it.
    cap_drop:
      - ALL
    restart: always
    networks:
      - ops_control
      - ops_backend
      - database_ops
      - ops_guacamole
      - fmu_aas_ops
      - fmu_status

  # FMU Runner - FMI Co-Simulation execution service
  fmu-runner:
    profiles: ["fmu-runner"]
    build:
      context: ./fmu-runner
      dockerfile: Dockerfile
    # Compose file secrets preserve the host file ownership and mode. The
    # runner is deliberately non-root, so grant it the host secret group
    # instead of making the secret files world-readable.
    group_add:
      - "${HOST_GID:-1000}"
    environment:
      # The production facade is Station-only. Local native execution uses
      # the separate fmu-runner-local profile below, without control secrets.
      - FMU_BACKEND_MODE=station
      - FMU_DATA_PATH=/app/fmu-data
      - FMU_PROXY_RUNTIME_PATH=/app/fmu-proxy-runtime
      - FMU_STATION_BASE_URL=${FMU_STATION_BASE_URL:-}
      - FMU_STATION_INTERNAL_TOKEN_FILE=/run/secrets/fmu_station_internal_token
      - FMU_STATION_REQUEST_TIMEOUT=${FMU_STATION_REQUEST_TIMEOUT:-10}
      - FMU_SESSION_OBSERVATION_MAX_ATTEMPTS=${FMU_SESSION_OBSERVATION_MAX_ATTEMPTS:-3}
      - HISTORY_DB_PATH=/app/data/history.db
      - ISSUER=${ISSUER:-}
      - JWT_ISSUER=${JWT_ISSUER:-}
      - AUTH_JWKS_URL=${AUTH_JWKS_URL:-}
      - JWKS_CACHE_TTL=${JWKS_CACHE_TTL:-300}
      - JWKS_STALE_IF_ERROR_MAX_SECONDS=${JWKS_STALE_IF_ERROR_MAX_SECONDS:-900}
      - JWT_AUDIENCE=${FMU_JWT_AUDIENCE:?FMU_JWT_AUDIENCE must be the exact public FMU URL, e.g. https://gateway.example/fmu}
      - AUTH_SESSION_TICKET_ISSUE_URL=${AUTH_SESSION_TICKET_ISSUE_URL:-http://blockchain-services:8080/auth/fmu/session-ticket/issue}
      - AUTH_SESSION_TICKET_REDEEM_URL=${AUTH_SESSION_TICKET_REDEEM_URL:-http://blockchain-services:8080/auth/fmu/session-ticket/redeem}
      - AUTH_SESSION_TICKET_INTERNAL_TOKEN_FILE=/run/secrets/auth_session_ticket_internal_token
      - ACCESS_AUDIT_URL=${ACCESS_AUDIT_URL:-}
      - FMU_GATEWAY_ID=${FMU_GATEWAY_ID:-}
      - SESSION_OBSERVER_GATEWAY_ID=${SESSION_OBSERVER_GATEWAY_ID:-}
      - SESSION_OBSERVER_SIGNING_SECRET_FILE=/run/secrets/session_observer_signing_secret
      - SERVER_NAME=${SERVER_NAME}
      - MAX_SIMULATION_TIMEOUT=${FMU_MAX_SIMULATION_TIMEOUT:-300}
      - FMU_WORKER_ADDRESS_SPACE_LIMIT=${FMU_WORKER_ADDRESS_SPACE_LIMIT:-2147483648}
      - MAX_CONCURRENT_PER_MODEL=${FMU_MAX_CONCURRENT_PER_MODEL:-10}
      - PROXY_DOWNLOAD_RATE_LIMIT_PER_MINUTE=${FMU_PROXY_DOWNLOAD_RATE_LIMIT_PER_MINUTE:-20}
      - WS_CREATE_RATE_LIMIT_PER_MINUTE=${FMU_WS_CREATE_RATE_LIMIT_PER_MINUTE:-30}
      - FMU_PROXY_GATEWAY_WS_URL=${FMU_PROXY_GATEWAY_WS_URL:-}
      - FMU_PROXY_SIGNING_KEY_FILE=/run/secrets/fmu_proxy_signing_key
      - BASYX_AAS_URL=${BASYX_AAS_URL:-http://basyx-aas-server:8081}
      - AAS_CATALOG_PATH=${AAS_CATALOG_PATH:-/app/data/aasx}
      - AAS_ALLOWED_HOSTS=${AAS_ALLOWED_HOSTS:-}
      - AAS_SERVICE_TOKEN_FILE=/run/secrets/aas_service_token
      - AAS_SERVICE_TOKEN_HEADER=${AAS_SERVICE_TOKEN_HEADER:-Authorization}
    volumes:
      - ./fmu-data:/app/fmu-data:ro
      - ./fmu-proxy-runtime:/app/fmu-proxy-runtime:ro
      - fmu-history:/app/data
    tmpfs:
      - /tmp:size=64M,mode=1777
    read_only: true
    depends_on:
      blockchain-services:
        condition: service_healthy
    secrets:
      - fmu_station_internal_token
      - auth_session_ticket_internal_token
      - session_observer_signing_secret
      - fmu_proxy_signing_key
      - aas_service_token
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8090/health').read()"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '2.0'
        reservations:
          memory: 512M
          cpus: '0.5'
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
        labels: "service=fmu-runner"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    networks:
      - fmu_edge
      - fmu_control
      - fmu_aas
      - fmu_status

  # Explicit development-only local FMU execution. This service deliberately
  # does not receive Station/control-plane/proxy-signing credentials. It
  # receives only the dedicated session-observer credential needed to redeem
  # FMU tickets and record the accepted session. The optional bundled BaSyx
  # connection is limited to the internal fmu_aas network so local tests can
  # publish AAS metadata without exposing the control plane or Lab Station.
  fmu-runner-local:
    profiles: ["fmu-local-dev"]
    build:
      context: ./fmu-runner
      dockerfile: Dockerfile
    environment:
      - FMU_BACKEND_MODE=local
      - FMU_LOCAL_DEV_MODE=true
      - FMU_LOCAL_REALTIME_ENABLED=${FMU_LOCAL_REALTIME_ENABLED:-false}
      - FMU_DATA_PATH=/app/fmu-data
      - FMU_PROXY_RUNTIME_PATH=/app/fmu-proxy-runtime
      # FMPy extracts native FMU binaries here before loading them.
      - TMPDIR=/app/fmu-runtime
      - HISTORY_DB_PATH=/app/data/history.db
      - ISSUER=${ISSUER:-}
      - JWT_ISSUER=${JWT_ISSUER:-}
      - AUTH_JWKS_URL=${AUTH_JWKS_URL:-}
      - JWKS_CACHE_TTL=${JWKS_CACHE_TTL:-300}
      - JWKS_STALE_IF_ERROR_MAX_SECONDS=${JWKS_STALE_IF_ERROR_MAX_SECONDS:-900}
      - JWT_AUDIENCE=${FMU_JWT_AUDIENCE:?FMU_JWT_AUDIENCE must be the exact public FMU URL, e.g. https://gateway.example/fmu}
      - AUTH_SESSION_TICKET_ISSUE_URL=${AUTH_SESSION_TICKET_ISSUE_URL:-http://blockchain-services:8080/auth/fmu/session-ticket/issue}
      - AUTH_SESSION_TICKET_REDEEM_URL=${AUTH_SESSION_TICKET_REDEEM_URL:-http://blockchain-services:8080/auth/fmu/session-ticket/redeem}
      - ACCESS_AUDIT_URL=${ACCESS_AUDIT_URL:-}
      - SESSION_OBSERVER_GATEWAY_ID=${SESSION_OBSERVER_GATEWAY_ID:-}
      - SESSION_OBSERVER_SIGNING_SECRET_FILE=/run/secrets/session_observer_signing_secret
      - SERVER_NAME=${SERVER_NAME}
      - MAX_SIMULATION_TIMEOUT=${FMU_MAX_SIMULATION_TIMEOUT:-300}
      - FMU_WORKER_ADDRESS_SPACE_LIMIT=${FMU_WORKER_ADDRESS_SPACE_LIMIT:-2147483648}
      - MAX_CONCURRENT_PER_MODEL=${FMU_MAX_CONCURRENT_PER_MODEL:-10}
      - PROXY_DOWNLOAD_RATE_LIMIT_PER_MINUTE=${FMU_PROXY_DOWNLOAD_RATE_LIMIT_PER_MINUTE:-20}
      - WS_CREATE_RATE_LIMIT_PER_MINUTE=${WS_CREATE_RATE_LIMIT_PER_MINUTE:-30}
      # Local development supports the bundled AAS profile. External AAS
      # endpoints remain a production/ops-worker concern and fail closed here
      # without an AAS service credential.
      - BASYX_AAS_URL=${BASYX_AAS_URL:-http://basyx-aas-server:8081}
      - AAS_CATALOG_PATH=${AAS_CATALOG_PATH:-/app/data/aasx}
    volumes:
      - ./fmu-data:/app/fmu-data:ro
      - ./fmu-proxy-runtime:/app/fmu-proxy-runtime:ro
      - fmu-local-history:/app/data
    tmpfs:
      - /app/fmu-runtime:exec,size=64M,mode=1777
      - /tmp:size=64M,mode=1777
    read_only: true
    secrets:
      - session_observer_signing_secret
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8090/health').read()"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '2.0'
        reservations:
          memory: 512M
          cpus: '0.5'
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
        labels: "service=fmu-runner-local"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    # Local FMU mode is selected explicitly by setup.sh/setup.bat, but once
    # selected it must survive a Docker daemon or host restart like the
    # production runner does.
    restart: unless-stopped
    networks:
      fmu_local_edge:
        aliases:
          - fmu-runner
      fmu_status:
        aliases:
          - fmu-runner
      # Full-mode local runners need the blockchain-services JWKS endpoint,
      # without joining the broader control-plane networks.
      fmu_auth:
      fmu_aas:

  # BaSyx AAS Server - Asset Administration Shell registry & repository
  # Public read via /aas/ (OpenResty), admin write via /aas-admin/ (lab_manager_admin_access.lua)
  # Only available in Full Gateway instances (one per institution).
  # Start with: docker compose --profile aas up  (or COMPOSE_PROFILES=aas)
  basyx-aas-server:
    image: eclipsebasyx/aas-environment:2.0.0-milestone-04
    profiles: ["aas"]
    environment:
      - BASYX_AASREPOSITORY_FEATURE_MQTT_ENABLED=false
      - BASYX_BACKEND=MongoDB
      - SPRING_DATA_MONGODB_URI=mongodb://${BASYX_MONGO_USER:-aas_app}:${BASYX_MONGO_PASSWORD:-CHANGE_ME}@basyx-mongo:27017/basyx?authSource=basyx
      - SERVER_PORT=8081
    depends_on:
      basyx-mongo:
        condition: service_healthy
    volumes:
      - basyx_aas_data:/data
    healthcheck:
      test: ["CMD", "sh", "-c", "code=$$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8081/shells) && [ $$code -eq 200 ]"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1.0'
        reservations:
          memory: 256M
          cpus: '0.25'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        labels: "service=basyx-aas-server"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    networks:
      - fmu_aas
      - fmu_aas_ops
      - aas_data

  # MongoDB backend for BaSyx AAS Server — persists shells/submodels across restarts.
  # Only used when the 'aas' profile is active.
  basyx-mongo:
    image: mongo:7.0.14
    profiles: ["aas"]
    command: mongod --auth --quiet --logpath /dev/null
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${BASYX_MONGO_ROOT_USER:-basyx_root}
      MONGO_INITDB_ROOT_PASSWORD: ${BASYX_MONGO_ROOT_PASSWORD:-CHANGE_ME}
      BASYX_MONGO_USER: ${BASYX_MONGO_USER:-aas_app}
      BASYX_MONGO_PASSWORD: ${BASYX_MONGO_PASSWORD:-CHANGE_ME}
    volumes:
      - basyx_mongo_data:/data/db
      - ./basyx-mongo/init-user.js:/docker-entrypoint-initdb.d/01-create-aas-user.js:ro
    healthcheck:
      test: ["CMD-SHELL", "test \"$${MONGO_INITDB_ROOT_PASSWORD}\" != CHANGE_ME && test \"$${BASYX_MONGO_PASSWORD}\" != CHANGE_ME && mongosh --quiet --host localhost -u \"$${MONGO_INITDB_ROOT_USERNAME}\" -p \"$${MONGO_INITDB_ROOT_PASSWORD}\" --authenticationDatabase admin --eval \"db.adminCommand('ping').ok\" | grep -q '^1$' && mongosh --quiet --host localhost -u \"$${BASYX_MONGO_USER}\" -p \"$${BASYX_MONGO_PASSWORD}\" --authenticationDatabase basyx --eval \"db.adminCommand('ping').ok\" | grep -q '^1$'"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'
        reservations:
          memory: 64M
    # The official MongoDB entrypoint starts as root and uses gosu to drop
    # privileges to the mongodb user. no-new-privileges and cap_drop: ALL
    # prevent that transition and cause the container to restart endlessly.
    tmpfs:
      - /tmp:size=64M,mode=1777
    restart: always
    networks:
      - aas_data

secrets:
  mysql_root_password:
    file: ./secrets/mysql_root_password
  guacamole_mysql_password:
    file: ./secrets/guacamole_mysql_password
  blockchain_mysql_password:
    file: ./secrets/blockchain_mysql_password
  ops_backend_mysql_password:
    file: ./secrets/ops_backend_mysql_password
  ops_guacamole_mysql_password:
    file: ./secrets/ops_guacamole_mysql_password
  guac_admin_pass:
    file: ./secrets/guac_admin_pass
  admin_access_token:
    file: ./secrets/admin_access_token
  lab_manager_token:
    file: ./secrets/lab_manager_token
  ops_internal_auth_token:
    file: ./secrets/ops_internal_auth_token
  ops_secrets_key:
    file: ./secrets/ops_secrets_key
  auth_access_code_redeemer_token:
    file: ./secrets/auth_access_code_redeemer_token
  session_observation_ingest_token:
    file: ./secrets/session_observation_ingest_token
  guacamole_provisioner_token:
    file: ./secrets/guacamole_provisioner_token
  reservation_projection_token:
    file: ./secrets/reservation_projection_token
  aas_service_token:
    file: ./secrets/aas_service_token
  lab_admin_backend_token:
    file: ./secrets/lab_admin_backend_token
  fmu_station_internal_token:
    file: ./secrets/fmu_station_internal_token
  auth_session_ticket_internal_token:
    file: ./secrets/auth_session_ticket_internal_token
  session_observer_signing_secret:
    file: ./secrets/session_observer_signing_secret
  fmu_proxy_signing_key:
    file: ./secrets/fmu_proxy_signing_key

networks:
  gateway_public:
    driver: bridge
  gateway_backend:
    driver: bridge
    internal: true
  gateway_guacamole:
    driver: bridge
    internal: true
  ops_control:
    driver: bridge
    internal: true
  ops_backend:
    driver: bridge
  ops_guacamole:
    driver: bridge
    internal: true
  guacd_net:
    driver: bridge
  database_backend:
    driver: bridge
    internal: true
  database_guacamole:
    driver: bridge
    internal: true
  database_ops:
    driver: bridge
    internal: true
  fmu_edge:
    driver: bridge
    internal: true
  fmu_control:
    driver: bridge
    internal: true
  fmu_aas:
    driver: bridge
    internal: true
  fmu_aas_ops:
    driver: bridge
    internal: true
  fmu_local_edge:
    driver: bridge
    internal: true
  # Narrow internal path used by Ops Worker to read the runner health signal.
  # The active FMU profile attaches its runner with the stable alias below.
  fmu_status:
    driver: bridge
    internal: true
  # Narrow internal path used only for JWT public-key retrieval by the local
  # FMU profile. It is intentionally separate from fmu_control.
  fmu_auth:
    driver: bridge
    internal: true
  aas_data:
    driver: bridge
    internal: true

volumes:
  mysql_data:
  fmu-history:
  fmu-local-history:
  basyx_mongo_data:
  basyx_aas_data: