# Overlay for CI and local end-to-end runs. Builds the image from this checkout
# instead of pulling it, and reads throwaway secrets made by ci/make-secrets.sh.
# Adds the throwaway Samba AD DC (deploy/samba/) and the Playwright runner (profile e2e).
#
#   deploy/ci/make-secrets.sh
#   docker compose -p packetstation-ci --env-file deploy/ci/ci.env \
#     -f deploy/compose.yaml -f deploy/compose.ci.yaml up -d --build --wait --wait-timeout 300
#   docker compose -p packetstation-ci --env-file deploy/ci/ci.env \
#     -f deploy/compose.yaml -f deploy/compose.ci.yaml --profile e2e run --rm playwright
#   docker compose -p packetstation-ci --env-file deploy/ci/ci.env \
#     -f deploy/compose.yaml -f deploy/compose.ci.yaml down -v
#
# The worker reads the synthetic feed and drawings fixtures (FEED_SOURCE=fixture, DRAWING_SOURCE=fixture in
# ci.env) from ../tests/fixtures/generated, mounted at /fixtures. Generate them first:
#   python -m tests.fixtures.generator --out tests/fixtures/generated
#
# Never combine this overlay with compose.proxy.yaml.

x-logging: &logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

x-build: &build
  context: ..
  dockerfile: Dockerfile
  args:
    PS_BUILD: ci

services:
  migrate:
    build: *build
    image: ${IMAGE:-packetstation:ci}
    pull_policy: build
    volumes:
      - ci-dc-export:/etc/ssl/pstest:ro    # the DC's CA, LDAP_CA_BUNDLE=/etc/ssl/pstest/ca.pem

  # The archive share stand-in (Gitea issue 7): a volume at /archive (ARCHIVE_ROOT in ci.env) with the folder
  # /archive/packets owned by uid 10001, so the e2e scenario can save "packets" under File locations.
  archive-init:
    build: *build
    image: ${IMAGE:-packetstation:ci}
    pull_policy: build
    user: "0:0"
    # Once per volume: root may not chmod the folder after it belongs to 10001 (no CAP_FOWNER).
    entrypoint:
      - sh
      - -c
      - test -d /archive/packets || { mkdir /archive/packets && chmod 0750 /archive/packets && chown 10001:10001 /archive/packets; }
    volumes:
      - ci-archive:/archive
    network_mode: none
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
    restart: "no"

  app:
    build: *build
    image: ${IMAGE:-packetstation:ci}
    pull_policy: build
    volumes:
      - ci-dc-export:/etc/ssl/pstest:ro
      - ci-archive:/archive
    # Playwright reaches the app as ps-app, never as "app": "app" is a top-level domain on
    # Chromium's HSTS preload list, so http://app:8000 is forced to TLS and fails.
    networks:
      backend:
        aliases:
          - ps-app
      egress: {}
    depends_on:
      samba-dc:
        condition: service_healthy
      archive-init:
        condition: service_completed_successfully

  worker:
    build: *build
    image: ${IMAGE:-packetstation:ci}
    pull_policy: build
    volumes:
      - ci-dc-export:/etc/ssl/pstest:ro
      - ../tests/fixtures/generated:/fixtures:ro   # synthetic feed and drawings; the scenario switches state
      - ci-archive:/archive
    depends_on:
      archive-init:
        condition: service_completed_successfully

  # Throwaway Samba AD DC (PSTEST.LOCAL) so LDAP sign-in runs over real TLS in CI.
  # Built from deploy/samba/. Runs as root, as Samba needs. No published port.
  # The app reaches it as ldaps://dc1.pstest.local:636 on the internal backend network.
  # It writes ca.pem, users.json and seeded to ci-dc-export.
  samba-dc:
    build:
      context: ./samba
    image: packetstation-samba-dc:ci
    pull_policy: build
    hostname: dc1
    networks:
      backend:
        aliases:
          - dc1.pstest.local
    secrets:
      - samba_admin_password
      - ldap_bind_password
    volumes:
      - ci-dc-data:/var/lib/samba
      - ci-dc-export:/export
    # Provisioning sets NT ACLs on sysvol, which needs security.* xattrs and therefore
    # CAP_SYS_ADMIN (verified on docker-1, Samba 4.17: without it the provision step fails).
    cap_add:
      - SYS_ADMIN
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
      interval: 10s
      timeout: 10s
      retries: 30
      start_period: 120s
    restart: "no"
    logging: *logging

  # Playwright runner. Drives the app at http://ps-app:8000 over backend.
  # Also on egress, because npm ci fetches @playwright/test from the public registry
  # and backend is internal. The image tag must match @playwright/test in tests/e2e/package.json.
  playwright:
    image: mcr.microsoft.com/playwright:v1.64.1-noble
    profiles: ["e2e"]
    working_dir: /work/tests/e2e
    environment:
      E2E_BASE_URL: http://ps-app:8000
      E2E_DC_USERS_FILE: /export/users.json
      E2E_FIXTURE_DIR: /fixtures
      CI: "true"
    volumes:
      - ../tests/e2e:/work/tests/e2e
      - ../tests/fixtures/generated:/fixtures      # read-write: the scenario writes /fixtures/state
      - /work/tests/e2e/node_modules       # anonymous volume: node_modules stays out of the checkout
      - ci-dc-export:/export:ro
    networks:
      backend: {}
      egress: {}
    depends_on:
      app:
        condition: service_healthy
    init: true
    shm_size: 1g
    command: ["sh", "-c", "npm ci --no-audit --no-fund && npx playwright test"]
    logging: *logging

volumes:
  ci-dc-data: {}
  ci-dc-export: {}
  ci-archive: {}

secrets:
  samba_admin_password:
    file: ${SECRETS_DIR:?set SECRETS_DIR in the stack env file}/samba_admin_password