services:
  nodedc-module-foundry:
    build:
      context: ..
      dockerfile: Dockerfile
    image: nodedc/module-foundry:local
    restart: unless-stopped
    env_file:
      - ../.env
    environment:
      NODE_ENV: production
      HOST: 0.0.0.0
      PORT: 3333
      FOUNDRY_RUNTIME_DIR: /var/lib/nodedc-module-foundry
      NODEDC_FOUNDRY_AUTH_REQUIRED: "true"
      NODEDC_FOUNDRY_SERVICE_SLUG: module-foundry
      NODEDC_LAUNCHER_BASE_URL: ${NODEDC_LAUNCHER_BASE_URL:?set NODEDC_LAUNCHER_BASE_URL in .env}
      NODEDC_LAUNCHER_INTERNAL_URL: ${NODEDC_LAUNCHER_INTERNAL_URL:?set NODEDC_LAUNCHER_INTERNAL_URL in .env}
      NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:?set the existing NODE.DC internal access value in .env}
      # Ontology remains an internal read-only MCP. The external Codex receives
      # a separate nodedc_ontology entry whose traffic is authenticated by the
      # Foundry agent gateway and forwarded with the server-only platform token.
      NODEDC_ONTOLOGY_CORE_URL: ${NODEDC_ONTOLOGY_CORE_URL:-http://ontology-core:18104}
      # Runner-owned file mount. The secret signs private Gateway requests but
      # never becomes a Foundry env value or browser-visible setting.
      NODEDC_MAP_GATEWAY_ADMIN_SECRET_FILE: /run/nodedc-secrets/map-gateway-admin-secret
      # Browser traffic stays same-origin through Foundry; this private address
      # is used only by the Foundry server.
      NODEDC_MAP_GATEWAY_INTERNAL_URL: ${NODEDC_MAP_GATEWAY_INTERNAL_URL:-http://map-gateway:18103}
      # Platform EDP is never addressed by a browser. A page binding resolves
      # its own opaque reader grant from the read-only directory below.
      NODEDC_EXTERNAL_DATA_PLANE_INTERNAL_URL: ${NODEDC_EXTERNAL_DATA_PLANE_INTERNAL_URL:-http://external-data-plane:18106}
      NODEDC_EXTERNAL_DATA_PLANE_READER_GRANTS_DIR: /run/nodedc-secrets/external-data-plane-reader-grants
      # Foundry has a separate managed-provisioner identity. The private key
      # signs digest-only reader-grant plan/ensure requests and is never used
      # by Engine, n8n, a browser, MCP input or application state.
      NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_PRIVATE_KEY_FILE: /run/nodedc-secrets/foundry-edp-managed-provisioner/private-key.pem
      NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_SERVICE_ID: ${NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_SERVICE_ID:-nodedc-module-foundry}
      NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_KEY_ID: ${NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_KEY_ID:-foundry-edp-managed-provisioner-v1}
      NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_AUDIENCE: ${NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_AUDIENCE:-nodedc-external-data-plane.managed-provisioning.v1}
      # Long-lived L2 credentials are separate revocable workload grants. The
      # directory contains only hashed grant records; opaque values stay in
      # Engine credentials and never enter Foundry env or application state.
      NODEDC_FOUNDRY_BINDING_GRANTS_DIR: /run/nodedc-secrets/foundry-binding-grants
      NODEDC_FOUNDRY_COOKIE_SECURE: "true"
    ports:
      - "${FOUNDRY_HOST_BIND:-172.22.0.222:9920}:3333"
    volumes:
      - nodedc-module-foundry-runtime:/var/lib/nodedc-module-foundry
      - type: bind
        source: /volume1/docker/nodedc-platform/secrets/map-gateway-admin-secret
        target: /run/nodedc-secrets/map-gateway-admin-secret
        read_only: true
      - type: bind
        source: /volume1/docker/nodedc-platform/secrets/external-data-plane-reader-grants
        target: /run/nodedc-secrets/external-data-plane-reader-grants
        read_only: true
        bind:
          create_host_path: false
      - type: bind
        source: /volume1/docker/nodedc-platform/secrets/foundry-binding-grants
        target: /run/nodedc-secrets/foundry-binding-grants
        read_only: true
        bind:
          create_host_path: false
      - type: bind
        source: /volume1/docker/nodedc-platform/secrets/foundry-edp-managed-provisioner/private-key.pem
        target: /run/nodedc-secrets/foundry-edp-managed-provisioner/private-key.pem
        read_only: true
        bind:
          create_host_path: false
    networks:
      - platform-engine
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3333/healthz').then((response) => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 20s
      timeout: 5s
      retries: 5
      start_period: 20s

volumes:
  nodedc-module-foundry-runtime:
    name: nodedc-module-foundry-runtime

networks:
  platform-engine:
    external: true
    name: ${NODEDC_ENGINE_DOCKER_NETWORK:-nodedc-demo_default}