# Enrollment demo: Go backend + C board (libsodium) + C++ board (OpenSSL) talking over a real
# Mosquitto broker with Dynamic Security. Demo secrets only; no TLS in this spike.
name: crypto-interop-spike

# Settings shared by both boards (YAML anchor, merged into each board below).
x-board-env: &board-env
  BROKER_HOST: broker
  BROKER_PORT: "1883"
  STEP_DELAY: "2"
  # Pinned backend public key (the Ed25519 public half of SIGNING_SEED_HEX below).
  BACKEND_PUBKEY_HEX: 2543b92ff1095511476adc8369db6ddc933665a11978dda1404ee1066ca9559d

# Shared volume: every program writes its log here and the viewer reads it.
volumes:
  logs:

services:
  # Web page with the live view of all programs: http://localhost:8099
  viewer:
    build: ./viewer
    ports:
      # Localhost only by default. The server deployment sets VIEWER_BIND=0.0.0.0 to publish it.
      - "${VIEWER_BIND:-127.0.0.1}:8099:8080"
    environment:
      COMPOSE_PROJECT: crypto-interop-spike
    volumes:
      - logs:/logs
    # The "Run again" button is NOT available here; it needs compose.restart.yaml (Docker socket).

  # Mosquitto with the Dynamic Security plugin. Starts empty; the backend provisions it.
  broker:
    build: ./broker   # eclipse-mosquitto:2.1-alpine with the config and entrypoint baked in
    environment:
      ADMIN_PASSWORD: demo-admin-secret
    healthcheck:
      test: ["CMD-SHELL", "nc -z 127.0.0.1 1883"]
      interval: 2s
      timeout: 2s
      retries: 20

  # Go backend: provisions the broker, then answers enrollment requests. START_DELAY/STEP_DELAY
  # only slow it down so the logs can be followed. SIGNING_SEED_HEX is the backend's Ed25519 key.
  backend:
    build: ./backend
    depends_on:
      viewer:
        condition: service_started
      broker:
        condition: service_healthy
    volumes:
      - logs:/logs
    environment:
      BROKER_URL: tcp://broker:1883
      ADMIN_USER: backend
      ADMIN_PASSWORD: demo-admin-secret
      SERVICE_PASSWORD: demo-service-secret
      SIGNING_SEED_HEX: 404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f
      START_DELAY: "15"
      STEP_DELAY: "2"
      LOG_FILE: /logs/backend.log

  # Simulated board 1 (C + libsodium). Waits START_DELAY seconds, then runs the 10 enrollment steps.
  board-c:
    build: ./board-c
    depends_on:
      - backend
    restart: "no"
    volumes:
      - logs:/logs
    environment:
      <<: *board-env
      LOG_FILE: /logs/board-c.log
      START_DELAY: "20"
      BOARD_MAC: "02:42:ac:11:00:0c"

  # Simulated board 2 (C++ + OpenSSL). Starts later so the two boards do not overlap in the logs.
  board-cpp:
    build: ./board-cpp
    depends_on:
      - backend
    restart: "no"
    volumes:
      - logs:/logs
    environment:
      <<: *board-env
      LOG_FILE: /logs/board-cpp.log
      START_DELAY: "35"
      BOARD_MAC: "02:42:ac:11:00:0d"