# Server registry example. Copy to a reviewed, untracked operator directory and set absolute host
# paths and Git values in .env. Add a selected Git transport override from this directory.
name: thothii-workspace-registry-server

services:
  core:
    image: thothii-core:local
    build:
      context: ${THT_SOURCE_ROOT:?set THT_SOURCE_ROOT to the absolute ThothII source checkout}
      dockerfile: docker/core.Dockerfile
    env_file:
      - path: ${THT_WORKSPACE_BINDINGS_ENV_FILE:?set THT_WORKSPACE_BINDINGS_ENV_FILE to an absolute THT_WS bindings file}
        required: true
    environment:
      HOST: 0.0.0.0
      PORT: "8787"
      AUTH_MODE: upstream
      THOTH_PUBLIC_EXPOSURE: "true"
      THT_SESSION_STORAGE: postgres
      THT_CONFIG: /app/harness/workspaces/server-sessions.yaml
      THT_SESSION_DB_HOST: ${THT_SESSION_DB_HOST:?set THT_SESSION_DB_HOST}
      THT_SESSION_DB_PORT: ${THT_SESSION_DB_PORT:-5432}
      THT_SESSION_DB_NAME: ${THT_SESSION_DB_NAME:?set THT_SESSION_DB_NAME}
      THT_SESSION_RUNTIME_USER: ${THT_SESSION_RUNTIME_USER:?set THT_SESSION_RUNTIME_USER}
      THT_SESSION_RUNTIME_PASSWORD_FILE: /run/secrets/session_runtime_password
      THT_SESSION_DB_SSLMODE: ${THT_SESSION_DB_SSLMODE:-verify-full}
      THT_SESSION_DB_SSLROOTCERT: /run/secrets/session_ca.pem
      THT_HARNESS_DIR: /app/harness
      THT_BIN: /opt/venv/bin/tht
      SETTINGS_FILE: /data/settings/settings.json
      THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry
      THT_WORKSPACE_GIT_REMOTE: ${THT_WORKSPACE_GIT_REMOTE:-ssh://git@git.example.invalid/platform/thoth-workspaces.git}
      THT_WORKSPACE_GIT_BRANCH: ${THT_WORKSPACE_GIT_BRANCH:-main}
      THT_WORKSPACE_INSTALLATION_ID: ${THT_WORKSPACE_INSTALLATION_ID:-production-1}
      THT_WORKSPACE_GIT_AUTHOR_NAME: ${THT_WORKSPACE_GIT_AUTHOR_NAME:-Thoth Workspace Registry}
      THT_WORKSPACE_GIT_AUTHOR_EMAIL: ${THT_WORKSPACE_GIT_AUTHOR_EMAIL:-thoth-workspace-registry@localhost}
      THT_WORKSPACE_SECRET_ROOTS: /run/secrets
    volumes:
      - ${THT_HOST_DATA_ROOT:-/srv/thothii/data}:/data
      - ${THT_WORKSPACE_REGISTRY_HOST_PATH:-/srv/thothii/workspace-registry}:/data/workspace-registry
      - ${THT_SERVER_WORKSPACE_CONFIG:?set THT_SERVER_WORKSPACE_CONFIG}:/app/harness/workspaces/server-sessions.yaml:ro
    secrets:
      - source: session_runtime_password
        target: session_runtime_password
      - source: session_ca
        target: session_ca.pem
    networks:
      - upstream
    restart: unless-stopped

networks:
  upstream:
    external: true
    name: ${THT_UPSTREAM_NETWORK:-thothii-upstream}

secrets:
  session_runtime_password:
    file: ${THT_SESSION_RUNTIME_PASSWORD_SOURCE:?set THT_SESSION_RUNTIME_PASSWORD_SOURCE}
  session_ca:
    file: ${THT_SESSION_CA_SOURCE:?set THT_SESSION_CA_SOURCE}