name: dataops-enterprise-edge

services:
  edge-gateway:
    build:
      context: ../..
      dockerfile: deploy/edge/Dockerfile.edge
    image: "${EDGE_IMAGE:-dataops-edge:local}"
    pull_policy: "${EDGE_PULL_POLICY:-build}"
    command: ["python", "-m", "app.edge_gateway"]
    user: "${EDGE_RUNTIME_UID:?}:${EDGE_RUNTIME_GID:?}"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    mem_limit: 1g
    cpus: "1.0"
    restart: unless-stopped
    init: true
    stop_grace_period: 30s
    environment:
      EDGE_CONFIG_PATH: "${EDGE_CONFIG_PATH:-/run/edge/config/edge.json}"
      EDGE_CREDENTIAL_FILE: /run/edge/secrets/control-credential
      EDGE_CLIENT_CERTIFICATE_PATH: /run/edge/certificates/client.pem
      EDGE_CLIENT_PRIVATE_KEY_PATH: "${EDGE_CLIENT_PRIVATE_KEY_PATH:-/run/edge/secrets/client.key}"
      EDGE_CA_BUNDLE_PATH: /run/edge/certificates/ca.pem
      EDGE_SERVER_CRL_PATH: "${EDGE_SERVER_CRL_PATH:-/run/edge/certificates/control-plane-server.crl.pem}"
      EDGE_HEALTH_PATH: "${EDGE_HEALTH_PATH:-/run/edge/tmp/health.json}"
      EDGE_RELEASE_SIGNING_KEYS_PATH: /run/edge/signing/release-public-keys.json
      EDGE_TASK_SIGNING_KEYS_PATH: /run/edge/signing/task-public-keys.json
      EDGE_CONTROL_ORIGIN: "${EDGE_CONTROL_ORIGIN:?exact https control origin required}"
      EDGE_PROXY_ORIGIN: "${EDGE_PROXY_ORIGIN:-}"
      EDGE_ALLOWED_CONTROL_HOSTS: "${EDGE_ALLOWED_CONTROL_HOSTS:?exact control hosts required}"
      EDGE_ALLOWED_PROXY_HOSTS: "${EDGE_ALLOWED_PROXY_HOSTS:-}"
      EDGE_LOG_LEVEL: "${EDGE_LOG_LEVEL:-INFO}"
      EDGE_LOG_MAX_BYTES: "${EDGE_LOG_MAX_BYTES:-10485760}"
      EDGE_LOG_BACKUP_COUNT: "${EDGE_LOG_BACKUP_COUNT:-3}"
      EDGE_POLL_INTERVAL_SECONDS: "${EDGE_POLL_INTERVAL_SECONDS:-5}"
    volumes:
      - "${EDGE_CONFIG_DIR:?}:/run/edge/config:ro"
      - "${EDGE_QUEUE_DIR:?}:/var/lib/dataops-edge/queue:rw"
      - "${EDGE_ARTIFACT_DIR:?}:/var/lib/dataops-edge/artifacts:rw"
      - "${EDGE_RELEASE_DIR:?}:/var/lib/dataops-edge/releases:rw"
      - "${EDGE_SECRET_DIR:?}:/run/edge/secrets:ro"
      - "${EDGE_CERTIFICATE_DIR:?}:/run/edge/certificates:ro"
      - "${EDGE_SIGNING_KEY_DIR:?}:/run/edge/signing:ro"
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=64m,mode=1777
      - /run/edge/tmp:rw,noexec,nosuid,nodev,size=16m,mode=0700,uid=${EDGE_RUNTIME_UID:?},gid=${EDGE_RUNTIME_GID:?}
    healthcheck:
      test: ["CMD", "python", "-m", "app.edge_gateway.healthcheck"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - edge-egress

networks:
  edge-egress:
    driver: bridge
    internal: false
    labels:
      dataops.network-contract: "outbound-only; enforce exact egress destinations outside Compose"