name: rfc-tier1

services:
  gitea:
    image: gitea/gitea:1.22
    environment:
      GITEA__security__INSTALL_LOCK: "true"
      GITEA__server__ROOT_URL: "http://gitea:3000/"
      GITEA__server__HTTP_PORT: "3000"
      GITEA__database__DB_TYPE: "sqlite3"
      GITEA__webhook__ALLOWED_HOST_LIST: "*"
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:3000/api/healthz"]
      interval: 5s
      timeout: 3s
      retries: 30
    ports:
      - "3001:3000"

  gitea-admin-init:
    image: gitea/gitea:1.22
    # The gitea CLI refuses to run as root (loadRunModeFrom [F] "not
    # supposed to be run as root"). Our custom entrypoint bypasses the
    # image's s6 init that normally drops to the git user, so set it here.
    user: git
    depends_on:
      gitea:
        condition: service_healthy
    volumes_from:
      - gitea
    entrypoint: ["/bin/sh", "-c"]
    command:
      - >
        gitea admin user create --admin --username giteaadmin
        --password giteaadmin-pass --email admin@example.test
        --must-change-password=false || true
    restart: "no"

  gitea-seed:
    image: alpine:3.20
    depends_on:
      gitea-admin-init:
        condition: service_completed_successfully
    env_file:
      - .env.tier1
    environment:
      GITEA_ADMIN_USER: giteaadmin
      GITEA_ADMIN_PASSWORD: giteaadmin-pass
      GITEA_BOT_PASSWORD: rfc-bot-pass
      SEED_OUT: /seed/.env.tier1.generated
    volumes:
      - ./seed-gitea.sh:/seed-gitea.sh:ro
      - ./generated:/seed
    entrypoint: ["/bin/sh", "-c"]
    command:
      - apk add --no-cache curl >/dev/null && sh /seed-gitea.sh
    restart: "no"

  backend:
    image: rfc-tier1-backend
    build:
      context: ..
      dockerfile: testing/backend.Dockerfile
    depends_on:
      gitea-seed:
        condition: service_completed_successfully
    env_file:
      - .env.tier1
      - ./generated/.env.tier1.generated
    volumes:
      - backend-data:/data
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/api/health').status==200 else 1)"]
      interval: 5s
      timeout: 3s
      retries: 30

  # Insert a granted deployment-owner user keyed by a known e2e email, so the
  # OTC sign-in path (which provisions only `pending` contributors) yields an
  # owner who can exercise the metadata edit/bulk write paths (SLICE-4/5). The
  # owner identity (gitea_login='owner') matches OWNER_GITEA_LOGIN. Idempotent.
  backend-seed:
    image: rfc-tier1-backend
    depends_on:
      backend:
        condition: service_healthy
    volumes:
      - backend-data:/data
    entrypoint: ["python", "-c"]
    command:
      - |
        import sqlite3
        c = sqlite3.connect("/data/rfc-app.db")
        c.execute("""INSERT INTO users
            (gitea_id, gitea_login, email, display_name, avatar_url, role, permission_state)
            SELECT 9001, 'owner', 'e2e-owner@example.test', 'E2E Owner', '', 'owner', 'granted'
            WHERE NOT EXISTS (SELECT 1 FROM users WHERE email='e2e-owner@example.test' COLLATE NOCASE)""")
        c.commit(); c.close()
        print("backend-seed: owner user ready")
    restart: "no"

  web:
    build:
      context: ..
      dockerfile: testing/web.Dockerfile
    depends_on:
      backend:
        condition: service_healthy
    ports:
      - "8080:80"

  mailpit:
    image: axllent/mailpit:latest
    ports:
      - "8025:8025"
      - "1025:1025"

volumes:
  backend-data: