networks:
  # No subnet is requested: docker assigns one from the daemon's address pool.
  # A fixed request is honoured verbatim, so two runs asking for the same range
  # collide on "Pool overlaps" — which is why the generated peer addresses are
  # docker hostnames (host-a … host-f) rather than literal IPs. Docker's
  # embedded DNS is per-network, so the same hostname in two concurrent runs
  # resolves inside each run's own subnet.
  #
  # That removes one of the two obstacles to running this suite twice at once,
  # not both. The compose project name is still fixed, so two runs that do not
  # set COMPOSE_PROJECT_NAME share a project, and the second `up` recreates the
  # first's containers while either `down` removes both. Nothing scopes it for
  # this suite: it is run by hand only, so the caller has to. Do not read the
  # floating subnet as making concurrent bare runs safe.
  acl-net:
    driver: bridge
    labels:
      - "com.corganlabs.fips-ci=1"

x-fips-common: &fips-common
  build:
    # The harness scopes its build context per run and passes it here; the
    # shared directory is the hand-run default. Compose resolves a relative
    # value against THIS file's directory, so the harness must export an
    # absolute path.
    context: ${FIPS_BUILD_CONTEXT:-../docker}
  image: ${FIPS_TEST_IMAGE:-fips-test:latest}
  entrypoint: ["/usr/local/bin/entrypoint.sh"]
  cap_add:
    - NET_ADMIN
  devices:
    - /dev/net/tun:/dev/net/tun
  sysctls:
    - net.ipv6.conf.all.disable_ipv6=0
  restart: "no"
  environment:
    - FIPS_TEST_MODE=default
    - RUST_LOG=info,fips::node=debug
  volumes:
    - ../docker/resolv.conf:/etc/resolv.conf:ro

services:
  service-a:
    <<: *fips-common
    container_name: fips-acl-container-a${FIPS_CI_NAME_SUFFIX:-}
    hostname: host-a
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/hosts:/etc/fips/hosts:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/peers.allow:/etc/fips/peers.allow:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/peers.deny:/etc/fips/peers.deny:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.yaml:/etc/fips/fips.yaml:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.key:/etc/fips/fips.key:ro
    networks:
      - acl-net

  service-b:
    <<: *fips-common
    container_name: fips-acl-container-b${FIPS_CI_NAME_SUFFIX:-}
    hostname: host-b
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/hosts:/etc/fips/hosts:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/peers.allow:/etc/fips/peers.allow:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/peers.deny:/etc/fips/peers.deny:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.yaml:/etc/fips/fips.yaml:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.key:/etc/fips/fips.key:ro
    networks:
      - acl-net

  service-c:
    <<: *fips-common
    container_name: fips-acl-container-c${FIPS_CI_NAME_SUFFIX:-}
    hostname: host-c
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/hosts:/etc/fips/hosts:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/peers.allow:/etc/fips/peers.allow:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/peers.deny:/etc/fips/peers.deny:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/fips.yaml:/etc/fips/fips.yaml:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/fips.key:/etc/fips/fips.key:ro
    networks:
      - acl-net

  service-d:
    <<: *fips-common
    container_name: fips-acl-container-d${FIPS_CI_NAME_SUFFIX:-}
    hostname: host-d
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/hosts:/etc/fips/hosts:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/peers.allow:/etc/fips/peers.allow:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/peers.deny:/etc/fips/peers.deny:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/fips.yaml:/etc/fips/fips.yaml:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/fips.key:/etc/fips/fips.key:ro
    networks:
      - acl-net

  service-e:
    <<: *fips-common
    container_name: fips-acl-container-e${FIPS_CI_NAME_SUFFIX:-}
    hostname: host-e
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-e/hosts:/etc/fips/hosts:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-e/fips.yaml:/etc/fips/fips.yaml:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-e/fips.key:/etc/fips/fips.key:ro
    networks:
      - acl-net

  service-f:
    <<: *fips-common
    container_name: fips-acl-container-f${FIPS_CI_NAME_SUFFIX:-}
    hostname: host-f
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-f/hosts:/etc/fips/hosts:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-f/fips.yaml:/etc/fips/fips.yaml:ro
      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-f/fips.key:/etc/fips/fips.key:ro
    networks:
      - acl-net