services:
  # Auth is mosquitto's own built-in dynamic-security plugin (see
  # mosquitto.conf + app/internal/dynsec.py) — NOT mosquitto-go-auth, that
  # project is archived upstream (no CVE patches), rejected for a
  # public-internet broker. Stock official image, pinned to an exact patch
  # (not the floating `:2` tag). MOSQUITTO_DYNSEC_PASSWORD seeds the
  # plugin's own one-time "admin" bootstrap client on first boot — read
  # directly by the plugin's C code, no entrypoint scripting needed for it.
  mosquitto:
    image: eclipse-mosquitto:2.1.2-alpine
    restart: unless-stopped
    ports:
      - "1883:1883"
      - "8883:8883"
    environment:
      - MOSQUITTO_DYNSEC_PASSWORD=${MOSQUITTO_DYNSEC_PASSWORD}
    volumes:
      - ./drb-c2-core/mosquitto/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
      - mosquitto_data:/mosquitto/data
      - mosquitto_certs:/mosquitto/certs

  # c2-core takes ALL of its configuration from ./drb-c2-core/.env — there is
  # deliberately no `environment:` block here. An entry in that block wins over
  # env_file, so listing a key here (e.g. AGENT_SERVICE_KEY=${AGENT_SERVICE_KEY})
  # would let an unset top-level .env silently blank out a value the owner had
  # correctly pasted into drb-c2-core/.env. New settings go in
  # drb-c2-core/.env.example and, for the VM, in
  # infra/ansible/roles/deploy/templates/c2-core.env.j2 + vault.yml.
  # AGENT_SERVICE_KEY (server-26#64) is configured that way.
  c2-core:
    image: ${REGISTRY}/c2-core:${TAG:-latest}
    build: ./drb-c2-core
    restart: unless-stopped
    ports:
      - "8888:8000"
    env_file: ./drb-c2-core/.env
    depends_on:
      - mosquitto

  discord-bot:
    image: ${REGISTRY}/discord-bot:${TAG:-latest}
    build: ./drb-server-discord-bot
    restart: unless-stopped
    env_file: ./drb-server-discord-bot/.env
    depends_on:
      - c2-core

  frontend:
    image: ${REGISTRY}/frontend:${TAG:-latest}
    build: ./drb-frontend
    restart: unless-stopped
    ports:
      - "3000:3000"
    env_file: ./drb-frontend/.env
    depends_on:
      - c2-core

volumes:
  # Dev only for both. Prod overrides these to host bind mounts
  # (/opt/drb/mosquitto-data, /opt/drb/mosquitto-certs — the latter fed by
  # the Caddy cert-sync systemd unit) — see docker-compose.prod.yml and
  # infra/ansible/roles/deploy/templates/. mosquitto_data holds
  # dynamic-security.json (node MQTT credentials, see app/internal/dynsec.py)
  # as well as the usual broker persistence state.
  mosquitto_data:
  mosquitto_certs: