# CurrenciCombo sandbox stack — orchestrator + portal + Postgres + Redis.
#
# Usage:
#
#   cp .env.sandbox.example .env.sandbox
#   # edit .env.sandbox as needed
#   docker compose --env-file .env.sandbox up -d
#   curl http://localhost:${ORCHESTRATOR_PORT:-8080}/health
#   curl http://localhost:${ORCHESTRATOR_PORT:-8080}/ready
#   open  http://localhost:${PORTAL_PORT:-3000}/
#
# External blockers from proxmox/scripts/verify/check-external-dependencies.sh
# surface in the orchestrator's boot-time log summary (see PR Y). Leaving
# DBIS_CORE_URL / FIN_SANDBOX_URL / CC_IDENTITY_URL unset is expected in
# the sandbox — the services fall back to deterministic mocks and tag
# the EXT-* blocker id in every log line.
#
# EXT-CHAIN138-CI-RPC is resolved out of the box: CHAIN_138_RPC_URL
# defaults to the public endpoint at https://rpc.public-0138.defi-oracle.io.

services:
  postgres:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-currencicombo}
      POSTGRES_USER: ${POSTGRES_USER:-currencicombo}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-currencicombo}
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-currencicombo} -d ${POSTGRES_DB:-currencicombo}"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    ports:
      - "${REDIS_PORT:-6379}:6379"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5

  orchestrator:
    build:
      context: ./orchestrator
      dockerfile: Dockerfile
    image: currencicombo/orchestrator:local
    ports:
      - "${ORCHESTRATOR_PORT:-8080}:8080"
    environment:
      NODE_ENV: production
      PORT: "8080"
      DATABASE_URL: postgresql://${POSTGRES_USER:-currencicombo}:${POSTGRES_PASSWORD:-currencicombo}@postgres:5432/${POSTGRES_DB:-currencicombo}
      REDIS_URL: redis://redis:6379
      # --- required for signed events (PR O) ---
      EVENT_SIGNING_SECRET: ${EVENT_SIGNING_SECRET}
      # --- API keys (PR M) — comma-separated key:role pairs ---
      ORCHESTRATOR_API_KEYS: ${ORCHESTRATOR_API_KEYS}
      # --- Chain 138 (EXT-CHAIN138-CI-RPC — resolved) ---
      CHAIN_138_RPC_URL: ${CHAIN_138_RPC_URL:-https://rpc.public-0138.defi-oracle.io}
      NOTARY_REGISTRY_ADDRESS: ${NOTARY_REGISTRY_ADDRESS:-}
      ORCHESTRATOR_PRIVATE_KEY: ${ORCHESTRATOR_PRIVATE_KEY:-}
      # --- External blockers (intentionally unset in sandbox) ---
      DBIS_CORE_URL: ${DBIS_CORE_URL:-}
      FIN_SANDBOX_URL: ${FIN_SANDBOX_URL:-}
      CC_IDENTITY_URL: ${CC_IDENTITY_URL:-}
      CC_CONTROLS_MATRIX_URL: ${CC_CONTROLS_MATRIX_URL:-}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:8080/health', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  portal:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        VITE_ORCHESTRATOR_URL: ${VITE_ORCHESTRATOR_URL:-http://localhost:8080}
    image: currencicombo/portal:local
    ports:
      - "${PORTAL_PORT:-3000}:80"
    depends_on:
      orchestrator:
        condition: service_healthy

volumes:
  postgres_data:
  redis_data: