compose.dev.yml

name: cdnfoundry-dev

x-bounded-logging: &bounded-logging
  driver: json-file
  options: { max-size: "10m", max-file: "3" }

x-core-env: &core-env
  APP_ENV: local
  APP_DEBUG: "true"
  APP_KEY: base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
  APP_URL: http://localhost:8080
  DB_CONNECTION: pgsql
  DB_HOST: control-db
  DB_PORT: 5432
  DB_DATABASE: cdnf
  DB_USERNAME: cdnf
  DB_PASSWORD: cdnf-dev-only
  CACHE_STORE: redis
  SESSION_DRIVER: redis
  QUEUE_CONNECTION: redis
  REDIS_HOST: redis
  REDIS_CLIENT: predis
  GEOIP_DATABASE: /mmdb/GeoLite2-City.mmdb
  ACME_ENABLED: "true"
  ACME_DIRECTORY_URL: https://pebble:14000/dir
  ACME_VERIFY_TLS: "false"
  ACME_CONTACT_EMAIL: admin@example.test
  ACME_INITIAL_JITTER_SECONDS: "1"
  ACME_DNS_PROBE_SERVER: dnsdist
  EDGE_IDENTITY_CA_CERTIFICATE: /run/dev-pki/edge-identity-ca.crt
  EDGE_IDENTITY_CA_PRIVATE_KEY: /run/dev-pki/edge-identity-ca.key
  CLICKHOUSE_URL: http://clickhouse:8123
  CLICKHOUSE_DATABASE: cdnf
  CLICKHOUSE_USER: cdnf
  CLICKHOUSE_PASSWORD: cdnf-dev-only
  PROMETHEUS_URL: http://prometheus:9090
  METRICS_TOKEN_FILE: /run/dev-metrics/metrics-token
  RESTIC_REPOSITORY: /app/storage/app/restic
  RESTIC_PASSWORD_FILE: /run/dev-backup/restic-password
  LOG_CHANNEL: stderr
  LOG_STACK: stderr
  LOG_STDERR_FORMATTER: App\Logging\OperationalJsonFormatter
  GRAFANA_EXPLORE_URL: ${GRAFANA_EXPLORE_URL:-http://localhost:3000/explore?left=%7B%22datasource%22:%22loki%22%7D}

x-core: &core
  logging: *bounded-logging
  build:
    context: ./core
    target: development
  environment: *core-env
  volumes:
    - ./core:/app
    - ./docs:/docs
    - ./tests:/tests:ro
    - ./AGENTS.md:/AGENTS.md:ro
    - ./.agents:/.agents:ro
    - core-vendor:/app/vendor
    # Runtime storage is initialized by the entrypoint. Disabling Docker's
    # automatic copy-up prevents concurrent core workers from racing while a
    # brand-new shared volume is populated.
    - type: volume
      source: core-storage
      target: /app/storage
      volume:
        nocopy: true
    - core-bootstrap-cache:/app/bootstrap/cache
    - mmdb:/mmdb:ro
    - dev-pki:/run/dev-pki:ro
    - ./docker/prometheus/dev-metrics-token:/run/dev-metrics/metrics-token:ro
    - ./docker/backup/dev-restic-password:/run/dev-backup/restic-password:ro
  depends_on:
    dev-pki: { condition: service_completed_successfully }
    vendor-init: { condition: service_completed_successfully }
    control-db: { condition: service_healthy }
    redis: { condition: service_healthy }
  networks: [control, telemetry, dns]
  restart: unless-stopped

x-dev-cell-env: &dev-cell-env
  EDGE_STATUS_TOKEN: ${CDNF_DEV_EDGE_STATUS_TOKEN:-cdnf-dev-edge-status-only}
  GEOIP_DATABASE: /mmdb/GeoLite2-City.mmdb

x-dev-cell: &dev-cell
  logging: *bounded-logging
  build:
    context: .
    dockerfile: docker/openresty/Dockerfile
  tmpfs:
    - /var/lib/nginx/tmp:rw,noexec,nosuid,size=64m
  mem_limit: 512m
  cpus: 0.5
  pids_limit: 128
  ulimits: { nofile: { soft: 65536, hard: 65536 } }
  sysctls: { net.ipv4.tcp_syncookies: "1" }
  networks: [edge]
  depends_on:
    dev-pki: { condition: service_completed_successfully }
    origin-http: { condition: service_started }
    mmdb-updater: { condition: service_healthy }
  restart: unless-stopped
  healthcheck:
    test: [CMD, wget, -qO-, http://127.0.0.1:8080/healthz]
    interval: 10s
    timeout: 3s
    retries: 10
    start_period: 120s

services:
  dev-pki:
    logging: *bounded-logging
    build:
      context: .
      dockerfile: docker/dev-pki/Dockerfile
    volumes: [dev-pki:/pki]
    restart: "no"

  vendor-init:
    logging: *bounded-logging
    build:
      context: ./core
      target: development
    entrypoint: [sh, -c]
    # Keep the live dependency tree usable while one-off Compose commands refresh it.
    # Packages are overlaid first; authoritative Composer metadata is published last.
    command:
      - >-
        find /opt/cdnf-vendor -mindepth 1 -maxdepth 1 -type d ! -name composer
        -exec cp -a {} /target/ \; &&
        find /opt/cdnf-vendor -mindepth 1 -maxdepth 1 -type f
        -exec cp -a {} /target/ \; &&
        mkdir -p /target/composer &&
        cp -a /opt/cdnf-vendor/composer/. /target/composer/
    volumes: [core-vendor:/target]
    restart: "no"

  core:
    logging: *bounded-logging
    <<: *core
    healthcheck:
      test: [CMD, php, -r, "exit(@fsockopen('127.0.0.1', 9000) ? 0 : 1);"]
      interval: 10s
      timeout: 3s
      retries: 10

  web:
    logging: *bounded-logging
    image: nginx:1.30.3-alpine
    ports: ["8080:8080"]
    volumes:
      - ./core:/app:ro
      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      core: { condition: service_healthy }
    networks: [control, ingress]
    restart: unless-stopped
    healthcheck:
      test: [CMD, wget, -qO-, http://127.0.0.1:8080/api/health]
      interval: 10s
      timeout: 3s
      retries: 10

  edge-control:
    logging: *bounded-logging
    image: nginx:1.30.3-alpine
    ports: ["${CDNF_DEV_EDGE_CONTROL_BIND:-127.0.0.1:9443}:8443"]
    volumes:
      - ./core:/app:ro
      - ./docker/nginx/edge-control.conf:/etc/nginx/conf.d/default.conf:ro
      - dev-pki:/run/secrets:ro
    depends_on:
      dev-pki: { condition: service_completed_successfully }
      core: { condition: service_healthy }
    networks: [control, ingress]
    restart: unless-stopped
    healthcheck:
      test: [CMD, wget, --no-check-certificate, -qO-, https://127.0.0.1:8443/healthz]
      interval: 10s
      timeout: 3s
      retries: 10

  horizon:
    logging: *bounded-logging
    <<: *core
    command: [php, artisan, horizon]
    networks: [control, dns]

  scheduler:
    logging: *bounded-logging
    <<: *core
    command: [php, artisan, schedule:work]

  migrate:
    logging: *bounded-logging
    <<: *core
    command: [php, artisan, migrate, --force]
    restart: "no"

  control-db:
    logging: *bounded-logging
    image: postgres:18.4-alpine
    environment:
      POSTGRES_DB: cdnf
      POSTGRES_USER: cdnf
      POSTGRES_PASSWORD: cdnf-dev-only
    volumes: [control-db:/var/lib/postgresql]
    networks: [control]
    healthcheck:
      test: [CMD-SHELL, "pg_isready -U cdnf -d cdnf"]
      interval: 5s
      timeout: 3s
      retries: 20

  redis:
    logging: *bounded-logging
    image: valkey/valkey:9.1.0-alpine
    command: [valkey-server, --appendonly, "yes", --maxmemory, 512mb, --maxmemory-policy, noeviction]
    volumes: [redis:/data]
    networks: [control]
    healthcheck:
      test: [CMD, valkey-cli, ping]
      interval: 5s
      timeout: 3s
      retries: 20

  pdns-db:
    logging: *bounded-logging
    image: postgres:18.4-alpine
    environment:
      POSTGRES_DB: pdns
      POSTGRES_USER: pdns
      POSTGRES_PASSWORD: pdns-dev-only
    volumes:
      - pdns-db:/var/lib/postgresql
      - ./docker/postgres/pdns-schema.sql:/docker-entrypoint-initdb.d/10-schema.sql:ro
    networks: [dns]
    healthcheck:
      test: [CMD-SHELL, "pg_isready -U pdns -d pdns"]
      interval: 5s
      timeout: 3s
      retries: 20

  pdns-auth:
    logging: *bounded-logging
    image: powerdns/pdns-auth-51:5.1.3
    volumes:
      - ./docker/pdns/pdns.conf:/etc/powerdns/pdns.conf:ro
      - ./docker/pdns/geoip-zones.yml:/etc/powerdns/geoip-zones.yml:ro
      - mmdb:/mmdb:ro
    depends_on:
      pdns-db: { condition: service_healthy }
      mmdb-updater: { condition: service_healthy }
    networks: [dns]
    restart: unless-stopped
    healthcheck:
      test: [CMD, pdns_control, rping]
      interval: 5s
      timeout: 3s
      retries: 20

  pdns-migrate:
    logging: *bounded-logging
    image: postgres:18.4-alpine
    command: [psql, -v, ON_ERROR_STOP=1, -h, pdns-db, -U, pdns, -d, pdns, -f, /migrations/2026_07_17_000001_add_powerdns_metadata_tables.sql]
    environment: { PGPASSWORD: pdns-dev-only }
    volumes: [./docker/postgres/pdns-migrations:/migrations:ro]
    depends_on:
      pdns-db: { condition: service_healthy }
    networks: [dns]
    restart: "no"

  dnsdist:
    logging: *bounded-logging
    image: powerdns/dnsdist-21:2.1.0
    ports: ["1053:53/udp", "1053:53/tcp"]
    volumes: [./docker/dnsdist/dnsdist.conf:/etc/dnsdist/dnsdist.conf:ro]
    depends_on:
      pdns-auth: { condition: service_healthy }
    networks: [dns]
    restart: unless-stopped
    healthcheck:
      test: [CMD, python3, -c, "import urllib.request; assert urllib.request.urlopen('http://127.0.0.1:8083/metrics', timeout=2).read(1)"]
      interval: 10s
      timeout: 3s
      retries: 10

  pebble:
    logging: *bounded-logging
    image: ghcr.io/letsencrypt/pebble@sha256:ddf230642b1a584f519f32e347de1b05a6e4c1f6c35c1863b33effeab5f78199
    command: [-dnsserver, dnsdist:53]
    environment:
      PEBBLE_VA_NOSLEEP: "1"
      PEBBLE_WFE_NONCEREJECT: "0"
      PEBBLE_AUTHZREUSE: "0"
    depends_on:
      dnsdist: { condition: service_started }
    networks: [control, dns]
    restart: unless-stopped

  clickhouse:
    logging: *bounded-logging
    image: clickhouse/clickhouse-server:26.3.12.3-alpine
    environment:
      CLICKHOUSE_DB: cdnf
      CLICKHOUSE_USER: cdnf
      CLICKHOUSE_PASSWORD: cdnf-dev-only
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
      GRAFANA_CLICKHOUSE_PASSWORD: cdnf-grafana-dev-only
    volumes:
      - clickhouse:/var/lib/clickhouse
      - ./docker/clickhouse/init.sql:/docker-entrypoint-initdb.d/10-init.sql:ro
      - ./docker/clickhouse/config.d/prometheus.xml:/etc/clickhouse-server/config.d/prometheus.xml:ro
      - ./docker/clickhouse/users.d/grafana.xml:/etc/clickhouse-server/users.d/grafana.xml:ro
    networks: [telemetry]
    healthcheck:
      test: [CMD, wget, -qO-, http://127.0.0.1:8123/ping]
      interval: 10s
      timeout: 3s
      retries: 20

  vector:
    logging: *bounded-logging
    image: timberio/vector:0.55.0-alpine
    environment:
      CLICKHOUSE_ENDPOINT: http://clickhouse:8123
      CLICKHOUSE_USER: cdnf
      CLICKHOUSE_PASSWORD: cdnf-dev-only
    volumes:
      - ./docker/vector/vector.yaml:/etc/vector/vector.yaml:ro
      - vector-data:/vector-data-dir
    networks: [telemetry, edge, dns]
    restart: unless-stopped

  loki-data-init:
    logging: *bounded-logging
    image: alpine:3.22
    command: [chown, "10001:10001", /loki]
    volumes: [loki-data:/loki]
    restart: "no"

  loki:
    logging: *bounded-logging
    image: grafana/loki:3.7.8@sha256:1107dd5274e0ada47e42472b7a7e71f3b2a2fe878878108f3e2f9e51528f0193
    command: [-config.file=/etc/loki/loki.yml, -config.expand-env=true]
    ports: ["127.0.0.1:3100:3100"]
    environment:
      LOKI_RETENTION_PERIOD: 168h
      LOKI_MAX_QUERY_LENGTH: 168h
    volumes: [./docker/loki/loki.yml:/etc/loki/loki.yml:ro, loki-data:/loki]
    depends_on:
      loki-data-init: { condition: service_completed_successfully }
    networks: [telemetry]
    restart: unless-stopped
    healthcheck: { disable: true }

  log-collector:
    logging: *bounded-logging
    image: timberio/vector:0.55.0-debian@sha256:a4be1111b40303524aae2ffb02cd59cef2a4e9753bd13d265bf0233e921828d9
    container_name: cdnfoundry-log-collector
    command: [--config, /etc/vector/operational.yaml]
    environment:
      LOG_ENVIRONMENT: development
      LOG_ROLE: development
      LOG_HOST: ${LOG_HOST:-development}
      LOG_COLLECTOR_ID: ${LOG_COLLECTOR_ID:-development-01}
      LOG_BUFFER_BYTES: "268435488"
      LOG_METRICS_ADDRESS: 0.0.0.0:9599
      LOKI_ENDPOINT: http://loki:3100
    volumes:
      - ./docker/vector/operational.yaml:/etc/vector/operational.yaml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - operational-vector-data:/vector-data-dir
    depends_on:
      loki: { condition: service_started }
    ports: ["127.0.0.1:9599:9599"]
    networks: [telemetry]
    restart: unless-stopped
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    mem_limit: 256m
    cpus: 0.25
    pids_limit: 96

  prometheus:
    logging: *bounded-logging
    image: prom/prometheus:v3.12.0
    ports: ["9090:9090"]
    volumes:
      - ./docker/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./docker/prometheus/telemetry-alerts.yml:/etc/prometheus/telemetry-alerts.yml:ro
      - ./docker/prometheus/alerts.test.yml:/etc/prometheus/alerts.test.yml:ro
      - ./docker/prometheus/control-targets.dev.yml:/etc/prometheus/control-targets.yml:ro
      - ./docker/prometheus/node-targets.dev.yml:/etc/prometheus/node-targets.yml:ro
      - ./docker/prometheus/dns-targets.dev.yml:/etc/prometheus/dns-targets.yml:ro
      - ./docker/prometheus/edge-targets.dev.yml:/etc/prometheus/edge-targets.yml:ro
      - ./docker/prometheus/operational-log-targets.dev.yml:/etc/prometheus/operational-log-targets.yml:ro
      - ./docker/prometheus/dev-metrics-token:/run/secrets/metrics-token:ro
      - prometheus:/prometheus
    networks: [telemetry, control, dns]

  grafana-control-db-provision:
    logging: *bounded-logging
    image: postgres:18.4-alpine
    environment:
      PGHOST: control-db
      PGPORT: 5432
      PGDATABASE: cdnf
      PGUSER: cdnf
      PGPASSWORD: cdnf-dev-only
      GRAFANA_POSTGRES_PASSWORD: cdnf-grafana-dev-only
    volumes:
      - ./docker/grafana/postgres:/provision:ro
    command: [sh, /provision/provision.sh]
    depends_on:
      control-db: { condition: service_healthy }
    networks: [control]
    restart: "no"

  grafana-plugins-init:
    logging: *bounded-logging
    image: alpine:3.22.6@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
    command:
      - sh
      - -ec
      - if [ -f /plugins/grafana-clickhouse-datasource/plugin.json ]; then echo present; exit 0; fi; wget -qO /tmp/plugin.zip 'https://grafana.com/api/plugins/grafana-clickhouse-datasource/versions/4.21.3/download?os=linux&arch=amd64' && echo '53c0602214e7ca1af1733962779293587386b0b9a8c544ecead80b819e5f560b  /tmp/plugin.zip' | sha256sum -c - && unzip -q /tmp/plugin.zip -d /plugins && rm /tmp/plugin.zip
    volumes: [grafana-plugins:/plugins]
    networks: [telemetry, control]
    restart: "no"
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]

  grafana:
    logging: *bounded-logging
    image: grafana/grafana:12.4.11@sha256:3ea272e5cab64a4a62240c682e2c62433b25614d956d44c299a10cb6994f6f2e
    ports: ["127.0.0.1:3000:3000"]
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: cdnf-grafana-dev-only
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_AUTH_ANONYMOUS_ENABLED: "false"
      GF_PLUGINS_PREINSTALL_DISABLED: "true"
      GF_ANALYTICS_CHECK_FOR_UPDATES: "false"
      GF_ANALYTICS_CHECK_FOR_PLUGIN_UPDATES: "false"
      GF_ANALYTICS_REPORTING_ENABLED: "false"
      GF_PATHS_PLUGINS: /var/lib/grafana/plugins
      GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH: /var/lib/grafana/dashboards/system-command-center.json
      GRAFANA_CLICKHOUSE_HOST: clickhouse
      GRAFANA_CLICKHOUSE_PORT: 9000
      GRAFANA_CLICKHOUSE_PROTOCOL: native
      GRAFANA_CLICKHOUSE_SECURE: "false"
      GRAFANA_CLICKHOUSE_USER: cdnf_grafana
      GRAFANA_CLICKHOUSE_PASSWORD: cdnf-grafana-dev-only
      GRAFANA_POSTGRES_HOST: control-db
      GRAFANA_POSTGRES_PORT: 5432
      GRAFANA_POSTGRES_DATABASE: cdnf
      GRAFANA_POSTGRES_USER: cdnf_grafana
      GRAFANA_POSTGRES_PASSWORD: cdnf-grafana-dev-only
      GRAFANA_POSTGRES_SSLMODE: disable
      GRAFANA_LOKI_URL: http://loki:3100
    volumes:
      - grafana-data:/var/lib/grafana
      - grafana-plugins:/var/lib/grafana/plugins:ro
      - ./docker/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./docker/grafana/dashboards:/var/lib/grafana/dashboards:ro
    depends_on:
      grafana-plugins-init: { condition: service_completed_successfully }
      clickhouse: { condition: service_healthy }
      grafana-control-db-provision: { condition: service_completed_successfully }
      prometheus: { condition: service_started }
      loki: { condition: service_started }
    networks: [telemetry, control]
    restart: unless-stopped
    healthcheck:
      test: [CMD, wget, -qO-, http://127.0.0.1:3000/api/health]
      interval: 10s
      timeout: 3s
      retries: 20

  node-exporter:
    logging: *bounded-logging
    image: prom/node-exporter:v1.10.2
    command: [--path.procfs=/host/proc, --path.sysfs=/host/sys, --path.rootfs=/host/root, --collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)]
    pid: host
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/host/root:ro,rslave
    networks: [telemetry]
    read_only: true
    restart: unless-stopped

  alertmanager:
    logging: *bounded-logging
    image: prom/alertmanager:v0.32.1
    ports: ["9093:9093"]
    volumes: [./docker/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro]
    networks: [telemetry]

  origin-http:
    logging: *bounded-logging
    image: nginx:1.30.3-alpine
    command: [sh, -c, "dd if=/dev/zero of=/tmp/large-object bs=1048576 count=2 >/dev/null 2>&1 && dd if=/dev/zero of=/tmp/graceful-object bs=8192 count=1 >/dev/null 2>&1 && dd if=/dev/zero of=/tmp/single-flight-object bs=2048 count=1 >/dev/null 2>&1 && exec nginx -g 'daemon off;'"]
    tmpfs: [/tmp:size=4m]
    volumes: [./docker/nginx/origin.conf:/etc/nginx/conf.d/default.conf:ro]
    networks: [edge]

  origin-https:
    logging: *bounded-logging
    build:
      context: ./docker/nginx
      dockerfile: Dockerfile.origin-https
    command:
      - sh
      - -c
      - >-
        mkdir -p /run/origin &&
        openssl req -x509 -newkey rsa:2048 -nodes -days 1
        -subj /CN=origin-https
        -addext subjectAltName=DNS:origin-https
        -keyout /run/origin/tls.key -out /run/origin/tls.crt >/dev/null 2>&1 &&
        exec nginx -g 'daemon off;'
    tmpfs: [/run/origin]
    volumes: [./docker/nginx/origin-https.conf:/etc/nginx/conf.d/default.conf:ro]
    networks: [edge]

  edge-a:
    logging: *bounded-logging
    build:
      context: .
      dockerfile: docker/openresty/Dockerfile
    environment:
      EDGE_CELL_NAME: cell-01
      EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-01.json
      EDGE_STATUS_TOKEN: ${CDNF_DEV_EDGE_STATUS_TOKEN:-cdnf-dev-edge-status-only}
      GEOIP_DATABASE: /mmdb/GeoLite2-City.mmdb
    volumes:
      - dev-pki:/run/edge:ro
      - edge-a-state:/var/lib/cdnfoundry/runtime:ro
      - mmdb:/mmdb:ro
      - edge-a-cell-01-cache:/var/cache/nginx
    tmpfs:
      - /var/lib/nginx/tmp:rw,noexec,nosuid,size=64m
    mem_limit: 512m
    cpus: 1
    pids_limit: 128
    ulimits: { nofile: { soft: 65536, hard: 65536 } }
    sysctls: { net.ipv4.tcp_syncookies: "1" }
    networks: [edge, gateway-shared-a]
    depends_on:
      dev-pki: { condition: service_completed_successfully }
      origin-http: { condition: service_started }
      mmdb-updater: { condition: service_healthy }
    restart: unless-stopped
    healthcheck:
      test: [CMD, wget, -qO-, http://127.0.0.1:8080/healthz]
      interval: 10s
      timeout: 3s
      retries: 10
      start_period: 120s

  edge-a-quarantine:
    logging: *bounded-logging
    build:
      context: .
      dockerfile: docker/openresty/Dockerfile
    environment:
      EDGE_CELL_NAME: cell-02
      EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-02.json
      EDGE_STATUS_TOKEN: ${CDNF_DEV_EDGE_STATUS_TOKEN:-cdnf-dev-edge-status-only}
      GEOIP_DATABASE: /mmdb/GeoLite2-City.mmdb
    volumes:
      - dev-pki:/run/edge:ro
      - edge-a-state:/var/lib/cdnfoundry/runtime:ro
      - mmdb:/mmdb:ro
      - edge-a-cell-02-cache:/var/cache/nginx
    tmpfs:
      - /var/lib/nginx/tmp:rw,noexec,nosuid,size=64m
    mem_limit: 256m
    cpus: 0.5
    pids_limit: 96
    ulimits: { nofile: { soft: 65536, hard: 65536 } }
    sysctls: { net.ipv4.tcp_syncookies: "1" }
    networks: [edge, gateway-quarantine-a]
    depends_on:
      dev-pki: { condition: service_completed_successfully }
      origin-http: { condition: service_started }
      mmdb-updater: { condition: service_healthy }
    restart: unless-stopped

  edge-a-cell-03: &edge-a-extra-cell
    <<: *dev-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-03, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-03.json }
    volumes: [dev-pki:/run/edge:ro, edge-a-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-a-cell-03-cache:/var/cache/nginx]

  edge-a-cell-04:
    logging: *bounded-logging
    <<: *edge-a-extra-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-04, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-04.json }
    volumes: [dev-pki:/run/edge:ro, edge-a-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-a-cell-04-cache:/var/cache/nginx]

  edge-a-cell-05:
    logging: *bounded-logging
    <<: *edge-a-extra-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-05, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-05.json }
    volumes: [dev-pki:/run/edge:ro, edge-a-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-a-cell-05-cache:/var/cache/nginx]

  edge-a-cell-06:
    logging: *bounded-logging
    <<: *edge-a-extra-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-06, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-06.json }
    volumes: [dev-pki:/run/edge:ro, edge-a-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-a-cell-06-cache:/var/cache/nginx]

  edge-a-cell-07:
    logging: *bounded-logging
    <<: *edge-a-extra-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-07, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-07.json }
    volumes: [dev-pki:/run/edge:ro, edge-a-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-a-cell-07-cache:/var/cache/nginx]

  edge-a-cell-08:
    logging: *bounded-logging
    <<: *edge-a-extra-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-08, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-08.json }
    volumes: [dev-pki:/run/edge:ro, edge-a-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-a-cell-08-cache:/var/cache/nginx]

  edge-agent-a:
    logging: *bounded-logging
    build: ./edge-agent
    environment:
      EDGE_CONTROL_URL: https://edge-control:8443
      EDGE_CONTROL_CA_CERTIFICATE: /run/dev-pki/edge-server-ca.crt
      EDGE_ID: ${CDNF_DEV_EDGE_A_ID:-}
      EDGE_BOOTSTRAP_TOKEN: ${CDNF_DEV_EDGE_A_BOOTSTRAP_TOKEN:-}
      EDGE_STATE_DIR: /var/lib/cdnfoundry/agent
      EDGE_RUNTIME_DIR: /var/lib/cdnfoundry/runtime
      EDGE_GATEWAY_STATUS_URL: http://edge-gateway-a:9105/metrics
      EDGE_GATEWAY_ADDRESSES: '["172.28.10.10","fd00:cd0f:10::10"]'
      EDGE_CELL_TARGETS: '{"cell-01":{"http":"edge-a:8081","https":"edge-a:8444"},"cell-02":{"http":"edge-a-quarantine:8081","https":"edge-a-quarantine:8444"},"cell-03":{"http":"edge-a-cell-03:8081","https":"edge-a-cell-03:8444"},"cell-04":{"http":"edge-a-cell-04:8081","https":"edge-a-cell-04:8444"},"cell-05":{"http":"edge-a-cell-05:8081","https":"edge-a-cell-05:8444"},"cell-06":{"http":"edge-a-cell-06:8081","https":"edge-a-cell-06:8444"},"cell-07":{"http":"edge-a-cell-07:8081","https":"edge-a-cell-07:8444"},"cell-08":{"http":"edge-a-cell-08:8081","https":"edge-a-cell-08:8444"}}'
      EDGE_CELL_ASSIGNMENTS: '{"cell-01":"shared-default","cell-02":"quarantine-default","cell-03":"","cell-04":"","cell-05":"","cell-06":"","cell-07":"","cell-08":""}'
      EDGE_CELL_STATUS_URLS: http://edge-a:9080/passive-failures,http://edge-a-quarantine:9080/passive-failures,http://edge-a-cell-03:9080/passive-failures,http://edge-a-cell-04:9080/passive-failures,http://edge-a-cell-05:9080/passive-failures,http://edge-a-cell-06:9080/passive-failures,http://edge-a-cell-07:9080/passive-failures,http://edge-a-cell-08:9080/passive-failures
      EDGE_STATUS_TOKEN: ${CDNF_DEV_EDGE_STATUS_TOKEN:-cdnf-dev-edge-status-only}
    volumes:
      - edge-a-agent-state:/var/lib/cdnfoundry/agent
      - edge-a-state:/var/lib/cdnfoundry/runtime
      - dev-pki:/run/dev-pki:ro
    networks: [control, edge, gateway-status]
    depends_on:
      edge-control: { condition: service_healthy }
      edge-a: { condition: service_healthy }
      edge-a-quarantine: { condition: service_started }
      edge-a-cell-03: { condition: service_healthy }
      edge-a-cell-04: { condition: service_healthy }
      edge-a-cell-05: { condition: service_healthy }
      edge-a-cell-06: { condition: service_healthy }
      edge-a-cell-07: { condition: service_healthy }
      edge-a-cell-08: { condition: service_healthy }
    restart: unless-stopped
    read_only: true
    tmpfs: [/tmp]
    mem_limit: 128m
    cpus: 0.25
    pids_limit: 64

  edge-gateway-a:
    logging: *bounded-logging
    build: ./edge-gateway
    environment:
      GATEWAY_CONFIG_FILE: /var/lib/cdnfoundry/runtime/current/gateway.json
      GATEWAY_STATE_DIR: /var/lib/cdnfoundry/gateway-state
      GATEWAY_METRICS_ADDRESS: 0.0.0.0:9105
      GATEWAY_MAX_CONNECTIONS: 4096
    volumes:
      - edge-a-state:/var/lib/cdnfoundry/runtime:ro
      - edge-a-gateway-state:/var/lib/cdnfoundry/gateway-state
    ports: ["8081:80", "8444:443"]
    networks:
      gateway-shared-a:
        ipv4_address: 172.28.10.10
        ipv6_address: fd00:cd0f:10::10
      gateway-quarantine-a:
        ipv4_address: 172.28.11.10
      gateway-status: {}
      telemetry: {}
    depends_on:
      edge-a: { condition: service_healthy }
      edge-a-quarantine: { condition: service_started }
      edge-gateway-a-state-init: { condition: service_completed_successfully }
    restart: unless-stopped
    read_only: true
    tmpfs: [/tmp]
    mem_limit: 128m
    cpus: 0.5
    pids_limit: 96
    ulimits: { nofile: { soft: 65536, hard: 65536 } }
    cap_drop: [ALL]
    cap_add: [NET_BIND_SERVICE]

  edge-gateway-a-state-init:
    logging: *bounded-logging
    image: alpine:3.22
    command: [chown, "10101:10101", /state]
    volumes: [edge-a-gateway-state:/state]
    restart: "no"

  edge-b:
    logging: *bounded-logging
    build:
      context: .
      dockerfile: docker/openresty/Dockerfile
    environment:
      EDGE_CELL_NAME: cell-01
      EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-01.json
      EDGE_STATUS_TOKEN: ${CDNF_DEV_EDGE_STATUS_TOKEN:-cdnf-dev-edge-status-only}
      GEOIP_DATABASE: /mmdb/GeoLite2-City.mmdb
    volumes:
      - dev-pki:/run/edge:ro
      - edge-b-state:/var/lib/cdnfoundry/runtime:ro
      - mmdb:/mmdb:ro
      - edge-b-cell-01-cache:/var/cache/nginx
    tmpfs:
      - /var/lib/nginx/tmp:rw,noexec,nosuid,size=64m
    mem_limit: 512m
    cpus: 1
    pids_limit: 128
    ulimits: { nofile: { soft: 65536, hard: 65536 } }
    sysctls: { net.ipv4.tcp_syncookies: "1" }
    networks: [edge, gateway-shared-b]
    depends_on:
      dev-pki: { condition: service_completed_successfully }
      origin-http: { condition: service_started }
      mmdb-updater: { condition: service_healthy }
    restart: unless-stopped
    healthcheck:
      test: [CMD, wget, -qO-, http://127.0.0.1:8080/healthz]
      interval: 10s
      timeout: 3s
      retries: 10
      start_period: 120s

  edge-b-quarantine:
    logging: *bounded-logging
    build:
      context: .
      dockerfile: docker/openresty/Dockerfile
    environment:
      EDGE_CELL_NAME: cell-02
      EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-02.json
      EDGE_STATUS_TOKEN: ${CDNF_DEV_EDGE_STATUS_TOKEN:-cdnf-dev-edge-status-only}
      GEOIP_DATABASE: /mmdb/GeoLite2-City.mmdb
    volumes:
      - dev-pki:/run/edge:ro
      - edge-b-state:/var/lib/cdnfoundry/runtime:ro
      - mmdb:/mmdb:ro
      - edge-b-cell-02-cache:/var/cache/nginx
    tmpfs:
      - /var/lib/nginx/tmp:rw,noexec,nosuid,size=64m
    mem_limit: 256m
    cpus: 0.5
    pids_limit: 96
    ulimits: { nofile: { soft: 65536, hard: 65536 } }
    sysctls: { net.ipv4.tcp_syncookies: "1" }
    networks: [edge, gateway-quarantine-b]
    depends_on:
      dev-pki: { condition: service_completed_successfully }
      origin-http: { condition: service_started }
      mmdb-updater: { condition: service_healthy }
    restart: unless-stopped

  edge-b-cell-03: &edge-b-extra-cell
    <<: *dev-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-03, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-03.json }
    volumes: [dev-pki:/run/edge:ro, edge-b-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-b-cell-03-cache:/var/cache/nginx]

  edge-b-cell-04:
    logging: *bounded-logging
    <<: *edge-b-extra-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-04, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-04.json }
    volumes: [dev-pki:/run/edge:ro, edge-b-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-b-cell-04-cache:/var/cache/nginx]

  edge-b-cell-05:
    logging: *bounded-logging
    <<: *edge-b-extra-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-05, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-05.json }
    volumes: [dev-pki:/run/edge:ro, edge-b-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-b-cell-05-cache:/var/cache/nginx]

  edge-b-cell-06:
    logging: *bounded-logging
    <<: *edge-b-extra-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-06, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-06.json }
    volumes: [dev-pki:/run/edge:ro, edge-b-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-b-cell-06-cache:/var/cache/nginx]

  edge-b-cell-07:
    logging: *bounded-logging
    <<: *edge-b-extra-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-07, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-07.json }
    volumes: [dev-pki:/run/edge:ro, edge-b-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-b-cell-07-cache:/var/cache/nginx]

  edge-b-cell-08:
    logging: *bounded-logging
    <<: *edge-b-extra-cell
    environment: { <<: *dev-cell-env, EDGE_CELL_NAME: cell-08, EDGE_RUNTIME_FILE: /var/lib/cdnfoundry/runtime/current/cell-08.json }
    volumes: [dev-pki:/run/edge:ro, edge-b-state:/var/lib/cdnfoundry/runtime:ro, mmdb:/mmdb:ro, edge-b-cell-08-cache:/var/cache/nginx]

  edge-agent-b:
    logging: *bounded-logging
    build: ./edge-agent
    environment:
      EDGE_CONTROL_URL: https://edge-control:8443
      EDGE_CONTROL_CA_CERTIFICATE: /run/dev-pki/edge-server-ca.crt
      EDGE_ID: ${CDNF_DEV_EDGE_B_ID:-}
      EDGE_BOOTSTRAP_TOKEN: ${CDNF_DEV_EDGE_B_BOOTSTRAP_TOKEN:-}
      EDGE_STATE_DIR: /var/lib/cdnfoundry/agent
      EDGE_RUNTIME_DIR: /var/lib/cdnfoundry/runtime
      EDGE_GATEWAY_STATUS_URL: http://edge-gateway-b:9105/metrics
      EDGE_GATEWAY_ADDRESSES: '["172.28.20.10"]'
      EDGE_CELL_TARGETS: '{"cell-01":{"http":"edge-b:8081","https":"edge-b:8444"},"cell-02":{"http":"edge-b-quarantine:8081","https":"edge-b-quarantine:8444"},"cell-03":{"http":"edge-b-cell-03:8081","https":"edge-b-cell-03:8444"},"cell-04":{"http":"edge-b-cell-04:8081","https":"edge-b-cell-04:8444"},"cell-05":{"http":"edge-b-cell-05:8081","https":"edge-b-cell-05:8444"},"cell-06":{"http":"edge-b-cell-06:8081","https":"edge-b-cell-06:8444"},"cell-07":{"http":"edge-b-cell-07:8081","https":"edge-b-cell-07:8444"},"cell-08":{"http":"edge-b-cell-08:8081","https":"edge-b-cell-08:8444"}}'
      EDGE_CELL_ASSIGNMENTS: '{"cell-01":"shared-default","cell-02":"quarantine-default","cell-03":"","cell-04":"","cell-05":"","cell-06":"","cell-07":"","cell-08":""}'
      EDGE_CELL_STATUS_URLS: http://edge-b:9080/passive-failures,http://edge-b-quarantine:9080/passive-failures,http://edge-b-cell-03:9080/passive-failures,http://edge-b-cell-04:9080/passive-failures,http://edge-b-cell-05:9080/passive-failures,http://edge-b-cell-06:9080/passive-failures,http://edge-b-cell-07:9080/passive-failures,http://edge-b-cell-08:9080/passive-failures
      EDGE_STATUS_TOKEN: ${CDNF_DEV_EDGE_STATUS_TOKEN:-cdnf-dev-edge-status-only}
    volumes:
      - edge-b-agent-state:/var/lib/cdnfoundry/agent
      - edge-b-state:/var/lib/cdnfoundry/runtime
      - dev-pki:/run/dev-pki:ro
    networks: [control, edge, gateway-status]
    depends_on:
      edge-control: { condition: service_healthy }
      edge-b: { condition: service_healthy }
      edge-b-quarantine: { condition: service_started }
      edge-b-cell-03: { condition: service_healthy }
      edge-b-cell-04: { condition: service_healthy }
      edge-b-cell-05: { condition: service_healthy }
      edge-b-cell-06: { condition: service_healthy }
      edge-b-cell-07: { condition: service_healthy }
      edge-b-cell-08: { condition: service_healthy }
    restart: unless-stopped
    read_only: true
    tmpfs: [/tmp]
    mem_limit: 128m
    cpus: 0.25
    pids_limit: 64

  edge-gateway-b:
    logging: *bounded-logging
    build: ./edge-gateway
    environment:
      GATEWAY_CONFIG_FILE: /var/lib/cdnfoundry/runtime/current/gateway.json
      GATEWAY_STATE_DIR: /var/lib/cdnfoundry/gateway-state
      GATEWAY_METRICS_ADDRESS: 0.0.0.0:9105
      GATEWAY_MAX_CONNECTIONS: 4096
    volumes:
      - edge-b-state:/var/lib/cdnfoundry/runtime:ro
      - edge-b-gateway-state:/var/lib/cdnfoundry/gateway-state
    ports: ["8082:80", "8445:443"]
    networks:
      gateway-shared-b:
        ipv4_address: 172.28.20.10
      gateway-quarantine-b:
        ipv4_address: 172.28.21.10
      gateway-status: {}
      telemetry: {}
    depends_on:
      edge-b: { condition: service_healthy }
      edge-b-quarantine: { condition: service_started }
      edge-gateway-b-state-init: { condition: service_completed_successfully }
    restart: unless-stopped
    read_only: true
    tmpfs: [/tmp]
    mem_limit: 128m
    cpus: 0.5
    pids_limit: 96
    ulimits: { nofile: { soft: 65536, hard: 65536 } }
    cap_drop: [ALL]
    cap_add: [NET_BIND_SERVICE]

  edge-gateway-b-state-init:
    logging: *bounded-logging
    image: alpine:3.22
    command: [chown, "10101:10101", /state]
    volumes: [edge-b-gateway-state:/state]
    restart: "no"

  poweradmin:
    logging: *bounded-logging
    image: poweradmin/poweradmin:4.3.3
    ports: ["9191:80"]
    environment:
      DB_TYPE: pgsql
      DB_HOST: pdns-db
      DB_PORT: 5432
      DB_NAME: pdns
      DB_USER: pdns
      DB_PASS: pdns-dev-only
      PA_CREATE_ADMIN: "true"
      PA_ADMIN_USERNAME: ${POWERADMIN_ADMIN_USERNAME:-admin}
      PA_ADMIN_PASSWORD: ${POWERADMIN_ADMIN_PASSWORD:-poweradmin-dev-only}
      PA_ADMIN_EMAIL: admin@example.test
      PA_ADMIN_FULLNAME: CDNFoundry Developer
      DNS_NS1: ns1.cdnf.test
      DNS_NS2: ns2.cdnf.test
      DNS_HOSTMASTER: hostmaster.cdnf.test
    depends_on:
      pdns-db: { condition: service_healthy }
    networks: [dns]
    restart: unless-stopped

  mmdb-updater:
    logging: *bounded-logging
    build:
      context: ./docker/mmdb-updater
    environment:
      MMDB_PROVIDER: ${MMDB_PROVIDER:-dbip-jsdelivr}
      MMDB_TARGET_FILE: ${MMDB_TARGET_FILE:-GeoLite2-City.mmdb}
      MMDB_DOWNLOAD_INTERVAL_SECONDS: ${MMDB_DOWNLOAD_INTERVAL_SECONDS:-86400}
      MMDB_DOWNLOAD_RETRIES: ${MMDB_DOWNLOAD_RETRIES:-5}
    volumes: [mmdb:/mmdb]
    networks: [telemetry]
    restart: unless-stopped
    healthcheck:
      test: [CMD, test, -s, /mmdb/GeoLite2-City.mmdb]
      interval: 30s
      timeout: 3s
      retries: 10
      start_period: 90s

networks:
  control: { internal: true }
  ingress: {}
  dns: {}
  edge: {}
  gateway-shared-a:
    internal: true
    enable_ipv6: true
    ipam:
      config:
        - subnet: 172.28.10.0/24
        - subnet: fd00:cd0f:10::/64
  gateway-quarantine-a:
    internal: true
    ipam: { config: [{ subnet: 172.28.11.0/24 }] }
  gateway-shared-b:
    internal: true
    ipam: { config: [{ subnet: 172.28.20.0/24 }] }
  gateway-quarantine-b:
    internal: true
    ipam: { config: [{ subnet: 172.28.21.0/24 }] }
  gateway-status: { internal: true }
  telemetry: {}

volumes:
  core-vendor: {}
  core-storage: {}
  core-bootstrap-cache: {}
  control-db: {}
  redis: {}
  pdns-db: {}
  clickhouse: {}
  vector-data: {}
  operational-vector-data: {}
  loki-data: {}
  prometheus: {}
  grafana-data: {}
  grafana-plugins:
  mmdb: {}
  dev-pki: {}
  edge-a-state: {}
  edge-a-agent-state: {}
  edge-a-gateway-state: {}
  edge-b-state: {}
  edge-b-agent-state: {}
  edge-b-gateway-state: {}
  edge-a-cell-01-cache: {}
  edge-a-cell-02-cache: {}
  edge-a-cell-03-cache: {}
  edge-a-cell-04-cache: {}
  edge-a-cell-05-cache: {}
  edge-a-cell-06-cache: {}
  edge-a-cell-07-cache: {}
  edge-a-cell-08-cache: {}
  edge-b-cell-01-cache: {}
  edge-b-cell-02-cache: {}
  edge-b-cell-03-cache: {}
  edge-b-cell-04-cache: {}
  edge-b-cell-05-cache: {}
  edge-b-cell-06-cache: {}
  edge-b-cell-07-cache: {}
  edge-b-cell-08-cache: {}