networks:
  fips-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24
  gateway-lan:
    driver: bridge
    enable_ipv6: true
    ipam:
      config:
        - subnet: 172.20.1.0/24
        - subnet: fd02::/64

x-fips-common: &fips-common
  image: fips-test:latest
  cap_add:
    - NET_ADMIN
  devices:
    - /dev/net/tun:/dev/net/tun
  sysctls:
    - net.ipv6.conf.all.disable_ipv6=0
  restart: "no"
  env_file:
    - ./generated-configs/npubs.env
  environment:
    - RUST_LOG=info

services:
  # ── Mesh topology ──────────────────────────────────────────────
  node-a:
    <<: *fips-common
    profiles: ["mesh"]
    container_name: fips-node-a
    hostname: node-a
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh/node-a.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.10

  node-b:
    <<: *fips-common
    profiles: ["mesh"]
    container_name: fips-node-b
    hostname: node-b
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh/node-b.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.11

  node-c:
    <<: *fips-common
    profiles: ["mesh"]
    container_name: fips-node-c
    hostname: node-c
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh/node-c.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.12

  node-d:
    <<: *fips-common
    profiles: ["mesh"]
    container_name: fips-node-d
    hostname: node-d
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh/node-d.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.13

  node-e:
    <<: *fips-common
    profiles: ["mesh"]
    container_name: fips-node-e
    hostname: node-e
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh/node-e.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.14

  # ── Mesh-public topology (mesh + external public node) ────────
  pub-a:
    <<: *fips-common
    profiles: ["mesh-public"]
    container_name: fips-node-a
    hostname: node-a
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh-public/node-a.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.10

  pub-b:
    <<: *fips-common
    profiles: ["mesh-public"]
    container_name: fips-node-b
    hostname: node-b
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh-public/node-b.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.11

  pub-c:
    <<: *fips-common
    profiles: ["mesh-public"]
    container_name: fips-node-c
    hostname: node-c
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh-public/node-c.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.12

  pub-d:
    <<: *fips-common
    profiles: ["mesh-public"]
    container_name: fips-node-d
    hostname: node-d
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh-public/node-d.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.13

  pub-e:
    <<: *fips-common
    profiles: ["mesh-public"]
    container_name: fips-node-e
    hostname: node-e
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh-public/node-e.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.14

  # ── Chain topology (A-B-C-D-E) ────────────────────────────────
  chain-a:
    <<: *fips-common
    profiles: ["chain"]
    container_name: fips-node-a
    hostname: node-a
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/chain/node-a.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.10

  chain-b:
    <<: *fips-common
    profiles: ["chain"]
    container_name: fips-node-b
    hostname: node-b
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/chain/node-b.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.11

  chain-c:
    <<: *fips-common
    profiles: ["chain"]
    container_name: fips-node-c
    hostname: node-c
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/chain/node-c.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.12

  chain-d:
    <<: *fips-common
    profiles: ["chain"]
    container_name: fips-node-d
    hostname: node-d
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/chain/node-d.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.13

  chain-e:
    <<: *fips-common
    profiles: ["chain"]
    container_name: fips-node-e
    hostname: node-e
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/chain/node-e.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.14

  # ── Rekey integration test (mesh + aggressive rekey timers) ──
  rekey-a:
    <<: *fips-common
    profiles: ["rekey"]
    container_name: fips-node-a
    hostname: node-a
    environment:
      - RUST_LOG=info,fips::node::handlers::rekey=debug
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/rekey/node-a.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.10

  rekey-b:
    <<: *fips-common
    profiles: ["rekey"]
    container_name: fips-node-b
    hostname: node-b
    environment:
      - RUST_LOG=info,fips::node::handlers::rekey=debug
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/rekey/node-b.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.11

  rekey-c:
    <<: *fips-common
    profiles: ["rekey"]
    container_name: fips-node-c
    hostname: node-c
    environment:
      - RUST_LOG=info,fips::node::handlers::rekey=debug
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/rekey/node-c.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.12

  rekey-d:
    <<: *fips-common
    profiles: ["rekey"]
    container_name: fips-node-d
    hostname: node-d
    environment:
      - RUST_LOG=info,fips::node::handlers::rekey=debug
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/rekey/node-d.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.13

  rekey-e:
    <<: *fips-common
    profiles: ["rekey"]
    container_name: fips-node-e
    hostname: node-e
    environment:
      - RUST_LOG=info,fips::node::handlers::rekey=debug
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/rekey/node-e.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.14

  # ── TCP chain topology (A-B-C) ───────────────────────────────
  tcp-a:
    <<: *fips-common
    profiles: ["tcp-chain"]
    container_name: fips-node-a
    hostname: node-a
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/tcp-chain/node-a.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.10

  tcp-b:
    <<: *fips-common
    profiles: ["tcp-chain"]
    container_name: fips-node-b
    hostname: node-b
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/tcp-chain/node-b.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.11

  tcp-c:
    <<: *fips-common
    profiles: ["tcp-chain"]
    container_name: fips-node-c
    hostname: node-c
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/tcp-chain/node-c.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.12

  # ── Gateway integration test (gateway + server + non-FIPS client) ─
  gw-gateway:
    <<: *fips-common
    profiles: ["gateway"]
    container_name: fips-gw-gateway
    hostname: gw-gateway
    # Privileged required: gateway must enable IPv6 on eth1 (second network,
    # attached after container start) and manage nftables NAT rules.
    privileged: true
    environment:
      - RUST_LOG=info
      - FIPS_TEST_MODE=gateway
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.default.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.all.proxy_ndp=1
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/gateway/node-a.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.10
      gateway-lan:
        ipv4_address: 172.20.1.10
        ipv6_address: fd02::10

  gw-server:
    <<: *fips-common
    profiles: ["gateway"]
    container_name: fips-gw-server
    hostname: gw-server
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/gateway/node-b.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.11

  gw-client:
    image: fips-test-app:latest
    profiles: ["gateway"]
    container_name: fips-gw-client
    hostname: gw-client
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
    volumes:
      - ./configs/gateway-resolv.conf:/etc/resolv.conf:ro
    networks:
      gateway-lan:
        ipv4_address: 172.20.1.20
        ipv6_address: fd02::20
    restart: "no"
    env_file:
      - ./generated-configs/npubs.env