# Overlay for CI and local end-to-end runs. Builds the image from this checkout
# instead of pulling it, and reads throwaway secrets made by ci/make-secrets.sh.
# Adds the throwaway Samba AD DC (deploy/samba/) and the Playwright runner (profile e2e).
#
#   deploy/ci/make-secrets.sh
#   docker compose -p packetstation-ci --env-file deploy/ci/ci.env \
#     -f deploy/compose.yaml -f deploy/compose.ci.yaml up -d --build --wait --wait-timeout 300
#   docker compose -p packetstation-ci --env-file deploy/ci/ci.env \
#     -f deploy/compose.yaml -f deploy/compose.ci.yaml --profile e2e run --rm playwright
#   docker compose -p packetstation-ci --env-file deploy/ci/ci.env \
#     -f deploy/compose.yaml -f deploy/compose.ci.yaml down -v
#
# Never combine this overlay with compose.proxy.yaml.

x-logging: &logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

x-build: &build
  context: ..
  dockerfile: Dockerfile
  args:
    PS_BUILD: ci

services:
  migrate:
    build: *build
    image: ${IMAGE:-packetstation:ci}
    pull_policy: build
    volumes:
      - ci-dc-export:/etc/ssl/pstest:ro    # the DC's CA, LDAP_CA_BUNDLE=/etc/ssl/pstest/ca.pem

  app:
    build: *build
    image: ${IMAGE:-packetstation:ci}
    pull_policy: build
    volumes:
      - ci-dc-export:/etc/ssl/pstest:ro
    # Playwright reaches the app as ps-app, never as "app": "app" is a top-level domain on
    # Chromium's HSTS preload list, so http://app:8000 is forced to TLS and fails.
    networks:
      backend:
        aliases:
          - ps-app
      egress: {}
    depends_on:
      samba-dc:
        condition: service_healthy

  worker:
    build: *build
    image: ${IMAGE:-packetstation:ci}
    pull_policy: build
    volumes:
      - ci-dc-export:/etc/ssl/pstest:ro

  # Throwaway Samba AD DC (PSTEST.LOCAL) so LDAP sign-in runs over real TLS in CI.
  # Built from deploy/samba/. Runs as root, as Samba needs. No published port.
  # The app reaches it as ldaps://dc1.pstest.local:636 on the internal backend network.
  # It writes ca.pem, users.json and seeded to ci-dc-export.
  samba-dc:
    build:
      context: ./samba
    image: packetstation-samba-dc:ci
    pull_policy: build
    hostname: dc1
    networks:
      backend:
        aliases:
          - dc1.pstest.local
    secrets:
      - samba_admin_password
      - ldap_bind_password
    volumes:
      - ci-dc-data:/var/lib/samba
      - ci-dc-export:/export
    # Provisioning sets NT ACLs on sysvol, which needs security.* xattrs and therefore
    # CAP_SYS_ADMIN (verified on docker-1, Samba 4.17: without it the provision step fails).
    cap_add:
      - SYS_ADMIN
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
      interval: 10s
      timeout: 10s
      retries: 30
      start_period: 120s
    restart: "no"
    logging: *logging

  # Playwright runner. Drives the app at http://ps-app:8000 over backend.
  # Also on egress, because npm ci fetches @playwright/test from the public registry
  # and backend is internal. The image tag must match @playwright/test in tests/e2e/package.json.
  playwright:
    image: mcr.microsoft.com/playwright:v1.64.1-noble
    profiles: ["e2e"]
    working_dir: /work/tests/e2e
    environment:
      E2E_BASE_URL: http://ps-app:8000
      E2E_DC_USERS_FILE: /export/users.json
      CI: "true"
    volumes:
      - ../tests/e2e:/work/tests/e2e
      - /work/tests/e2e/node_modules       # anonymous volume: node_modules stays out of the checkout
      - ci-dc-export:/export:ro
    networks:
      backend: {}
      egress: {}
    depends_on:
      app:
        condition: service_healthy
    init: true
    shm_size: 1g
    command: ["sh", "-c", "npm ci --no-audit --no-fund && npx playwright test"]
    logging: *logging

volumes:
  ci-dc-data: {}
  ci-dc-export: {}

secrets:
  samba_admin_password:
    file: ${SECRETS_DIR:?set SECRETS_DIR in the stack env file}/samba_admin_password