networks:
  fips-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24

x-fips-common: &fips-common
  image: fips-test:latest
  cap_add:
    - NET_ADMIN
  devices:
    - /dev/net/tun:/dev/net/tun
  sysctls:
    - net.ipv6.conf.all.disable_ipv6=0
  restart: "no"
  env_file:
    - ./generated-configs/npubs.env
  environment:
    - RUST_LOG=info

services:
  # ── Mesh topology ──────────────────────────────────────────────
  node-a:
    <<: *fips-common
    profiles: ["mesh"]
    container_name: fips-node-a
    hostname: node-a
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh/node-a.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.10

  node-b:
    <<: *fips-common
    profiles: ["mesh"]
    container_name: fips-node-b
    hostname: node-b
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh/node-b.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.11

  node-c:
    <<: *fips-common
    profiles: ["mesh"]
    container_name: fips-node-c
    hostname: node-c
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh/node-c.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.12

  node-d:
    <<: *fips-common
    profiles: ["mesh"]
    container_name: fips-node-d
    hostname: node-d
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh/node-d.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.13

  node-e:
    <<: *fips-common
    profiles: ["mesh"]
    container_name: fips-node-e
    hostname: node-e
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh/node-e.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.14

  # ── Mesh-public topology (mesh + external public node) ────────
  pub-a:
    <<: *fips-common
    profiles: ["mesh-public"]
    container_name: fips-node-a
    hostname: node-a
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh-public/node-a.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.10

  pub-b:
    <<: *fips-common
    profiles: ["mesh-public"]
    container_name: fips-node-b
    hostname: node-b
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh-public/node-b.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.11

  pub-c:
    <<: *fips-common
    profiles: ["mesh-public"]
    container_name: fips-node-c
    hostname: node-c
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh-public/node-c.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.12

  pub-d:
    <<: *fips-common
    profiles: ["mesh-public"]
    container_name: fips-node-d
    hostname: node-d
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh-public/node-d.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.13

  pub-e:
    <<: *fips-common
    profiles: ["mesh-public"]
    container_name: fips-node-e
    hostname: node-e
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/mesh-public/node-e.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.14

  # ── Chain topology (A-B-C-D-E) ────────────────────────────────
  chain-a:
    <<: *fips-common
    profiles: ["chain"]
    container_name: fips-node-a
    hostname: node-a
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/chain/node-a.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.10

  chain-b:
    <<: *fips-common
    profiles: ["chain"]
    container_name: fips-node-b
    hostname: node-b
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/chain/node-b.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.11

  chain-c:
    <<: *fips-common
    profiles: ["chain"]
    container_name: fips-node-c
    hostname: node-c
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/chain/node-c.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.12

  chain-d:
    <<: *fips-common
    profiles: ["chain"]
    container_name: fips-node-d
    hostname: node-d
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/chain/node-d.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.13

  chain-e:
    <<: *fips-common
    profiles: ["chain"]
    container_name: fips-node-e
    hostname: node-e
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/chain/node-e.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.14

  # ── Rekey integration test (mesh + aggressive rekey timers) ──
  rekey-a:
    <<: *fips-common
    profiles: ["rekey"]
    container_name: fips-node-a
    hostname: node-a
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/rekey/node-a.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.10

  rekey-b:
    <<: *fips-common
    profiles: ["rekey"]
    container_name: fips-node-b
    hostname: node-b
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/rekey/node-b.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.11

  rekey-c:
    <<: *fips-common
    profiles: ["rekey"]
    container_name: fips-node-c
    hostname: node-c
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/rekey/node-c.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.12

  rekey-d:
    <<: *fips-common
    profiles: ["rekey"]
    container_name: fips-node-d
    hostname: node-d
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/rekey/node-d.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.13

  rekey-e:
    <<: *fips-common
    profiles: ["rekey"]
    container_name: fips-node-e
    hostname: node-e
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/rekey/node-e.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.14

  # ── TCP chain topology (A-B-C) ───────────────────────────────
  tcp-a:
    <<: *fips-common
    profiles: ["tcp-chain"]
    container_name: fips-node-a
    hostname: node-a
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/tcp-chain/node-a.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.10

  tcp-b:
    <<: *fips-common
    profiles: ["tcp-chain"]
    container_name: fips-node-b
    hostname: node-b
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/tcp-chain/node-b.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.11

  tcp-c:
    <<: *fips-common
    profiles: ["tcp-chain"]
    container_name: fips-node-c
    hostname: node-c
    volumes:
      - ../docker/resolv.conf:/etc/resolv.conf:ro
      - ./generated-configs/tcp-chain/node-c.yaml:/etc/fips/fips.yaml:ro
    networks:
      fips-net:
        ipv4_address: 172.20.0.12