# 叠加 deploy/docker-compose.yml；使用 scripts/orbit-local.py 固定项目和私密配置。
services:
  credential-key-init:
    image: mysql:8.4
    restart: "no"
    user: "0:0"
    entrypoint: ["/bin/sh", "-ec"]
    command: ["cp /source/credential-keys.json /keys/credential-keys.json.tmp && chown 65532:65532 /keys /keys/credential-keys.json.tmp && chmod 700 /keys && chmod 600 /keys/credential-keys.json.tmp && mv /keys/credential-keys.json.tmp /keys/credential-keys.json"]
    volumes:
      - ${ORBIT_LOCAL_DIRECTORY}/credential-keys.json:/source/credential-keys.json:ro
      - orbit-keys:/keys
  archive-init:
    image: mysql:8.4
    restart: "no"
    user: "0:0"
    entrypoint: ["/bin/sh", "-ec"]
    command: ["chown 65532:65532 /archives && chmod 700 /archives"]
    volumes:
      - orbit-archives:/archives

  bootstrap:
    profiles: ["tools"]
    image: ${ORBIT_IMAGE}
    user: ${ORBIT_LOCAL_USER}
    entrypoint: ["/usr/local/bin/orbit-admin"]
    command: ["verify"]
    environment:
      ORBIT_MYSQL_DSN: "root:${ORBIT_DB_ROOT_PASSWORD}@tcp(mysql:3306)/${ORBIT_DB_NAME}?parseTime=true&multiStatements=true"
      ORBIT_CREDENTIAL_KEY_FILE: /run/local/credential-keys.json
    volumes:
      - ${ORBIT_LOCAL_DIRECTORY}:/run/local

  orbit:
    build:
      context: ..
      dockerfile: Dockerfile
      args:
        VERSION: ${ORBIT_BUILD_VERSION}
        REVISION: ${ORBIT_BUILD_REVISION}
        BUILD_TIME: ${ORBIT_BUILD_TIME}
    depends_on:
      credential-key-init:
        condition: service_completed_successfully
      archive-init:
        condition: service_completed_successfully
    environment:
      ORBIT_CONSOLE_APPLICATION_ADMIN: admin
      ORBIT_CREDENTIAL_KEY_FILE: /run/orbit-keys/credential-keys.json
      ORBIT_ARCHIVE_ROOT: /var/lib/orbit/archives
      ORBIT_ARCHIVE_STORAGE_ID: ${ORBIT_ARCHIVE_STORAGE_ID}
      ORBIT_ARCHIVE_MAX_BYTES: 1073741824
      ORBIT_ARCHIVE_TICK_INTERVAL: 10s
    volumes:
      - orbit-archives:/var/lib/orbit/archives
      - orbit-keys:/run/orbit-keys:ro
    networks:
      default:
      services:
        aliases: [orbit-test]

networks:
  default:
    ipam:
      config:
        - subnet: ${ORBIT_TEST_BACKEND_SUBNET:-10.253.240.0/24}
  services:
    name: orbit-test-services
    ipam:
      config:
        - subnet: ${ORBIT_TEST_SERVICES_SUBNET:-10.253.241.0/24}

volumes:
  orbit-keys:
  orbit-archives: