services:
  device-control-core:
    environment:
      DEVICE_MANAGEMENT_API_ENABLED: "true"
      DEVICE_MANAGEMENT_CORE_TOKEN_FILE: /run/nodedc-secrets/management-core-token
    volumes:
      - type: bind
        source: /volume1/docker/nodedc-device-plane/secrets/management-core-token
        target: /run/nodedc-secrets/management-core-token
        read_only: true
        bind:
          create_host_path: false

  device-manager:
    image: nodedc/device-manager:local
    pull_policy: never
    build:
      context: ./services/device-manager
    restart: unless-stopped
    user: "1000:1000"
    read_only: true
    tmpfs:
      - /tmp:size=16m,mode=1777
    environment:
      NODE_ENV: production
      HOST: 0.0.0.0
      PORT: "18122"
      NODEDC_DEVICE_MANAGER_AUTH_REQUIRED: "true"
      NODEDC_DEVICE_MANAGER_COOKIE_SECURE: "true"
      NODEDC_DEVICE_MANAGER_LOCAL_PREVIEW: "false"
      NODEDC_DEVICE_MANAGER_SERVICE_SLUG: device-core
      NODEDC_LAUNCHER_BASE_URL: https://hub.nodedc.ru
      NODEDC_LAUNCHER_INTERNAL_URL: http://launcher:5173
      NODEDC_LAUNCHER_INTERNAL_TOKEN_FILE: /run/nodedc-secrets/device-core-internal-token
      NODEDC_DEVICE_CORE_INTERNAL_URL: http://device-control-core:18120
      NODEDC_DEVICE_CORE_TOKEN_FILE: /run/nodedc-secrets/management-core-token
      NODEDC_DEVICE_MANAGER_PRESENTATION_PATH: /var/lib/nodedc-device-manager/device-manager-presentation.json
      NODEDC_DEVICE_MANAGER_MEDIA_ROOT: /var/lib/nodedc-device-manager/media
    volumes:
      - type: bind
        source: /volume1/docker/nodedc-platform/secrets/device-core-internal-token
        target: /run/nodedc-secrets/device-core-internal-token
        read_only: true
        bind:
          create_host_path: false
      - type: bind
        source: /volume1/docker/nodedc-device-plane/secrets/management-core-token
        target: /run/nodedc-secrets/management-core-token
        read_only: true
        bind:
          create_host_path: false
      - type: bind
        source: /volume1/docker/nodedc-device-plane/data/device-manager
        target: /var/lib/nodedc-device-manager
        read_only: false
        bind:
          create_host_path: false
    expose:
      - "18122"
    networks:
      - device-plane-private
      - platform-edge
    depends_on:
      device-control-core:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - fetch('http://127.0.0.1:18122/healthz').then(r=>r.json()).then(v=>{if(!v.ok||!v.authRequired||!v.deviceCoreConfigured)process.exit(1)}).catch(()=>process.exit(1))
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 10s

networks:
  platform-edge:
    external: true
    name: nodedc-platform_edge