name: ${NEXUSCRM_L0_PROJECT:-nexuscrm-l0}

# Complete app-blind L0 serving composition. TiDB and Catalog publication are
# external dependencies. L1/L2 services and metadata installation do not run
# in this Compose project.
x-runtime-process: &runtime-process
  user: ${NEXUSCRM_L0_CONTAINER_USER:-10001:10001}
  restart: unless-stopped
  stop_grace_period: 30s
  networks: [l0-private]
  extra_hosts:
    - host.docker.internal:host-gateway

x-worker-environment: &worker-environment
  NEXUSCRM_RUNTIME_WORKER_ADMIN_ADDR: ":9191"
  NEXUSCRM_RUNTIME_WORKER_CONFIG_FILE: /etc/nexuscrm/worker-role.json
  NEXUSCRM_RUNTIME_WORKLOAD_IDENTITY_TOKEN_FILE: /run/secrets/workload.token
  TIDB_TLS_DISABLE: "${NEXUSCRM_L0_TIDB_TLS_DISABLE:-}"

x-runtime-worker: &runtime-worker
  <<: *runtime-process
  profiles: [serving]
  image: ${NEXUSCRM_RUNTIME_WORKER_IMAGE:?set the exact Runtime Worker image}
  env_file:
    - ${NEXUSCRM_L0_DATABASE_ENV_FILE:?set the external TiDB environment file}
  environment: *worker-environment
  healthcheck:
    test: [CMD-SHELL, "wget -qO- http://127.0.0.1:9191/readyz >/dev/null || exit 1"]
    interval: 5s
    timeout: 3s
    retries: 12
    start_period: 5s

services:
  # Metadata-independent deployment mode. This opens the final TLS endpoint
  # but remains unready and rejects every business RPC. A stopped activation
  # replaces it with runtime-api after Catalog publication.
  runtime-bootstrap:
    <<: *runtime-process
    profiles: [bootstrap]
    image: ${NEXUSCRM_RUNTIME_API_IMAGE:?set the exact Runtime API image}
    command: [bootstrap]
    environment:
      NEXUSCRM_RUNTIME_API_ADMIN_ADDR: ":9091"
      NEXUSCRM_RUNTIME_API_GRPC_ADDR: ":9090"
      NEXUSCRM_RUNTIME_API_TLS_CERTIFICATE_FILE: /run/tls/server.crt
      NEXUSCRM_RUNTIME_API_TLS_PRIVATE_KEY_FILE: /run/tls/server.key
    volumes:
      - ${NEXUSCRM_L0_STATE_ROOT:?set the L0 state root}/secrets/tls/server.crt:/run/tls/server.crt:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/tls/server.key:/run/tls/server.key:ro
    ports: ["127.0.0.1:${NEXUSCRM_RUNTIME_API_GRPC_HOST_PORT:-9090}:9090"]
    healthcheck:
      test: [CMD-SHELL, "wget -qO- http://127.0.0.1:9091/livez >/dev/null || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 5s

  runtime-api:
    <<: *runtime-process
    profiles: [serving]
    image: ${NEXUSCRM_RUNTIME_API_IMAGE:?set the exact Runtime API image}
    env_file:
      - ${NEXUSCRM_L0_RUNTIME_ENV_FILE:-/dev/null}
      - ${NEXUSCRM_L0_DATABASE_ENV_FILE:?set the external TiDB environment file}
    environment:
      NEXUSCRM_RUNTIME_API_ADMIN_ADDR: ":9091"
      NEXUSCRM_RUNTIME_API_GRPC_ADDR: ":9090"
      NEXUSCRM_RUNTIME_API_SERVING_CONFIG_FILE: /etc/nexuscrm/serving.json
      NEXUSCRM_RUNTIME_API_SIGNING_KEY_FILE: /run/secrets/signing-keys.json
      NEXUSCRM_RUNTIME_API_TLS_CERTIFICATE_FILE: /run/tls/server.crt
      NEXUSCRM_RUNTIME_API_TLS_PRIVATE_KEY_FILE: /run/tls/server.key
      NEXUSCRM_RUNTIME_WORKLOAD_IDENTITY_TOKEN_FILE: /run/secrets/workload-identities.json
      FILE_STORAGE_ROOT: /var/lib/nexuscrm/files
      FILE_STORAGE_LEGACY_UPLOAD_ROOT: /var/lib/nexuscrm/uploads
      TIDB_TLS_DISABLE: "${NEXUSCRM_L0_TIDB_TLS_DISABLE:-}"
    volumes:
      - ${NEXUSCRM_L0_STATE_ROOT}/config/serving.json:/etc/nexuscrm/serving.json:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/workload-identities.json:/run/secrets/workload-identities.json:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/signing-keys.json:/run/secrets/signing-keys.json:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/tls/server.crt:/run/tls/server.crt:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/tls/server.key:/run/tls/server.key:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/data/catalog:/var/lib/nexuscrm/catalog:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/data/files:/var/lib/nexuscrm/files
      - ${NEXUSCRM_L0_STATE_ROOT}/data/uploads:/var/lib/nexuscrm/uploads
    ports: ["127.0.0.1:${NEXUSCRM_RUNTIME_API_GRPC_HOST_PORT:-9090}:9090"]
    healthcheck:
      test: [CMD-SHELL, "wget -qO- http://127.0.0.1:9091/readyz >/dev/null || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 5s

  worker-audit-history-fanout:
    <<: *runtime-worker
    volumes:
      - ${NEXUSCRM_L0_STATE_ROOT}/config/workers/audit-history-fanout.json:/etc/nexuscrm/worker-role.json:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/workers/audit-history-fanout.token:/run/secrets/workload.token:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/data/catalog:/var/lib/nexuscrm/catalog:ro

  worker-file-upload-lifecycle:
    <<: *runtime-worker
    environment:
      <<: *worker-environment
      FILE_STORAGE_PROVIDER: filesystem
      FILE_STORAGE_ROOT: /var/lib/nexuscrm/files
      FILE_STORAGE_LEGACY_UPLOAD_ROOT: /var/lib/nexuscrm/uploads
    volumes:
      - ${NEXUSCRM_L0_STATE_ROOT}/config/workers/file-upload-lifecycle.json:/etc/nexuscrm/worker-role.json:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/workers/file-upload-lifecycle.token:/run/secrets/workload.token:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/data/catalog:/var/lib/nexuscrm/catalog:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/data/files:/var/lib/nexuscrm/files
      - ${NEXUSCRM_L0_STATE_ROOT}/data/uploads:/var/lib/nexuscrm/uploads

  worker-platform-command:
    <<: *runtime-worker
    volumes:
      - ${NEXUSCRM_L0_STATE_ROOT}/config/workers/platform-command.json:/etc/nexuscrm/worker-role.json:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/workers/platform-command.token:/run/secrets/workload.token:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/data/catalog:/var/lib/nexuscrm/catalog:ro

  worker-record-command-lifecycle:
    <<: *runtime-worker
    volumes:
      - ${NEXUSCRM_L0_STATE_ROOT}/config/workers/record-command-lifecycle.json:/etc/nexuscrm/worker-role.json:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/workers/record-command-lifecycle.token:/run/secrets/workload.token:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/data/catalog:/var/lib/nexuscrm/catalog:ro

  worker-record-event-dispatch:
    <<: *runtime-worker
    environment:
      <<: *worker-environment
      NEXUSCRM_RUNTIME_WORKER_TIMED_FLOW_OWNER_CONFIG_FILE: /etc/nexuscrm/scheduled-flow-owner.json
    volumes:
      - ${NEXUSCRM_L0_STATE_ROOT}/config/workers/record-event-dispatch.json:/etc/nexuscrm/worker-role.json:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/workers/record-event-dispatch.token:/run/secrets/workload.token:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/config/workers/scheduled-flow.json:/etc/nexuscrm/scheduled-flow-owner.json:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/data/catalog:/var/lib/nexuscrm/catalog:ro

  worker-rollup-delta:
    <<: *runtime-worker
    volumes:
      - ${NEXUSCRM_L0_STATE_ROOT}/config/workers/rollup-delta.json:/etc/nexuscrm/worker-role.json:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/workers/rollup-delta.token:/run/secrets/workload.token:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/data/catalog:/var/lib/nexuscrm/catalog:ro

  worker-scheduled-flow:
    <<: *runtime-worker
    volumes:
      - ${NEXUSCRM_L0_STATE_ROOT}/config/workers/scheduled-flow.json:/etc/nexuscrm/worker-role.json:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/secrets/workers/scheduled-flow.token:/run/secrets/workload.token:ro
      - ${NEXUSCRM_L0_STATE_ROOT}/data/catalog:/var/lib/nexuscrm/catalog:ro

networks:
  l0-private:
    name: ${NEXUSCRM_L0_PROJECT:-nexuscrm-l0}-private