docker-compose.yml

name: htmltrust

networks:
  htmltrust:
    driver: bridge

volumes:
  mongo-data:
  wp-db-data:
  wp-1-data:
  wp-2-data:
  wp-3-data:
  wp-4-data:
  wp-5-data:

services:

  mongodb:
    image: mongo:7
    networks:
      - htmltrust
    volumes:
      - mongo-data:/data/db
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.runCommand('ping').ok"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  trust-server:
    build:
      context: ..
      dockerfile: htmltrust-e2e/Dockerfile.trust-server
    networks:
      - htmltrust
    depends_on:
      mongodb:
        condition: service_healthy
    environment:
      MONGO_URI: mongodb://mongodb:27017/htmltrust
      # Overridable per run, e.g.
      #   HTMLTRUST_GENERAL_API_KEY=$(openssl rand -hex 24) \
      #   HTMLTRUST_ADMIN_API_KEY=$(openssl rand -hex 24) docker compose up
      # (or the same two lines in htmltrust-e2e/.env, which compose reads).
      #
      # Scenario loading applies the same environment variables, so callers can
      # replace the checked-in simulation credentials for a run.
      GENERAL_API_KEY: ${HTMLTRUST_GENERAL_API_KEY:-sim_general_key}
      ADMIN_API_KEY: ${HTMLTRUST_ADMIN_API_KEY:-sim_admin_key}
      AUTHOR_API_KEY_PEPPER: ${HTMLTRUST_AUTHOR_API_KEY_PEPPER:-sim_author_api_key_pepper}
      # Signed key URLs must be reachable by a production-policy verifier,
      # which accepts HTTPS only. Nginx proxies this test hostname internally.
      DIRECTORY_BASE_URL: ${HTMLTRUST_DIRECTORY_BASE_URL:-https://trust.htmltrust.test}
      PORT: "3000"
    ports:
      # Loopback only. "3000:3000" publishes on 0.0.0.0, exposing the trust
      # directory API -- including the admin key's endpoints -- to anything
      # that can reach this machine.
      - "127.0.0.1:${HTMLTRUST_TRUST_PORT:-3000}:3000"
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  wp-db:
    image: mariadb:11
    networks:
      - htmltrust
    volumes:
      - wp-db-data:/var/lib/mysql
      # Creates wp1..wp5 and scopes the `wordpress` account to them. See the
      # file for the one-time `docker compose down -v` note.
      - ./wp-db-init.sql:/docker-entrypoint-initdb.d/10-wp-users.sql:ro
    environment:
      # root stays reachable inside the compose network because
      # src/phases/infrastructure.ts and src/smoke-test.ts create the wp*
      # databases with the configured root password. Nothing else uses it,
      # and this service publishes no ports.
      MYSQL_ROOT_PASSWORD: ${WP_DB_ROOT_PASSWORD:-rootpass}
      # The unprivileged account the five WordPress containers connect as.
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: ${WP_DB_PASSWORD:-wp_sim_local_only}
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  wp-1:
    build:
      context: .
      dockerfile: Dockerfile.wordpress
    networks:
      - htmltrust
    depends_on:
      wp-db:
        condition: service_healthy
    environment:
      WORDPRESS_DB_HOST: wp-db
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: ${WP_DB_PASSWORD:-wp_sim_local_only}
      WORDPRESS_DB_NAME: wp1
    volumes:
      - wp-1-data:/var/www/html
      - ../htmltrust-cms-reference/wordpress:/var/www/html/wp-content/plugins/content-signing

  wp-2:
    build:
      context: .
      dockerfile: Dockerfile.wordpress
    networks:
      - htmltrust
    depends_on:
      wp-db:
        condition: service_healthy
    environment:
      WORDPRESS_DB_HOST: wp-db
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: ${WP_DB_PASSWORD:-wp_sim_local_only}
      WORDPRESS_DB_NAME: wp2
    volumes:
      - wp-2-data:/var/www/html
      - ../htmltrust-cms-reference/wordpress:/var/www/html/wp-content/plugins/content-signing

  wp-3:
    build:
      context: .
      dockerfile: Dockerfile.wordpress
    networks:
      - htmltrust
    depends_on:
      wp-db:
        condition: service_healthy
    environment:
      WORDPRESS_DB_HOST: wp-db
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: ${WP_DB_PASSWORD:-wp_sim_local_only}
      WORDPRESS_DB_NAME: wp3
    volumes:
      - wp-3-data:/var/www/html
      - ../htmltrust-cms-reference/wordpress:/var/www/html/wp-content/plugins/content-signing

  wp-4:
    build:
      context: .
      dockerfile: Dockerfile.wordpress
    networks:
      - htmltrust
    depends_on:
      wp-db:
        condition: service_healthy
    environment:
      WORDPRESS_DB_HOST: wp-db
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: ${WP_DB_PASSWORD:-wp_sim_local_only}
      WORDPRESS_DB_NAME: wp4
    volumes:
      - wp-4-data:/var/www/html
      - ../htmltrust-cms-reference/wordpress:/var/www/html/wp-content/plugins/content-signing

  wp-5:
    build:
      context: .
      dockerfile: Dockerfile.wordpress
    networks:
      - htmltrust
    depends_on:
      wp-db:
        condition: service_healthy
    environment:
      WORDPRESS_DB_HOST: wp-db
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: ${WP_DB_PASSWORD:-wp_sim_local_only}
      WORDPRESS_DB_NAME: wp5
    volumes:
      - wp-5-data:/var/www/html
      - ../htmltrust-cms-reference/wordpress:/var/www/html/wp-content/plugins/content-signing

  # Playwright container: runs on demand via `docker compose run playwright`
  # Resolves *.htmltrust.test via Docker DNS, no host state needed
  playwright:
    image: mcr.microsoft.com/playwright:v1.59.1-jammy
    working_dir: /workspace
    volumes:
      - .:/workspace
      - ../htmltrust-browser-reference/build/chromium:/extension:ro
      # npm records sibling file dependencies as relative symlinks. From
      # /workspace/node_modules those links resolve to these root paths.
      - ../htmltrust-browser-client:/htmltrust-browser-client:ro
      - ../htmltrust-canonicalization:/htmltrust-canonicalization:ro
    networks:
      - htmltrust
    environment:
      E2E_DIR: /workspace
      EXTENSION_PATH: /extension
      NPM_CONFIG_CACHE: /tmp/.npm
    # Override default command so the container stays idle; we launch scripts via `docker compose run`
    entrypoint: ["sleep", "infinity"]
    profiles: ["tools"]  # Only starts when explicitly requested

  nginx:
    build:
      context: .
      dockerfile: Dockerfile.nginx
    networks:
      htmltrust:
        aliases:
          - author1.htmltrust.test
          - author2.htmltrust.test
          - author3.htmltrust.test
          - author4.htmltrust.test
          - author5.htmltrust.test
          - author6.htmltrust.test
          - author7.htmltrust.test
          - author8.htmltrust.test
          - author9.htmltrust.test
          - author10.htmltrust.test
          - trust.htmltrust.test
    depends_on:
      - trust-server
      - wp-1
      - wp-2
      - wp-3
      - wp-4
      - wp-5
    ports:
      # Loopback only. This fronts five WordPress installs whose admin
      # credentials are fixed sim values; publishing these ports to the whole
      # network the host is on.
      - "127.0.0.1:${HTMLTRUST_PROXY_PORT:-18080}:80"
      - "127.0.0.1:${HTMLTRUST_TLS_PROXY_PORT:-18443}:443"
    volumes:
      - ./.runtime/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./hugo-sites:/var/www/hugo:ro