services:
  control-plane:
    image: ${WXAGENT_CONTROL_PLANE_IMAGE:?set image tag}
    restart: unless-stopped
    read_only: true
    user: "65532:65532"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=16m
    ports:
      - "${CONTROL_PLANE_BIND:-127.0.0.1:18090}:8090"
    volumes:
      - control-plane-data:/data
    secrets:
      - node_tokens
      - web_users
      - tls_cert
      - tls_key
      - client_ca
      - revoked_client_certificates
    environment:
      WXAGENT_CONTROL_PLANE_ADDR: 0.0.0.0:8090
      WXAGENT_CONTROL_PLANE_DATA: /data/control-plane-data.json
      WXAGENT_CONTROL_PLANE_BACKUP_DIR: /data/backups
      WXAGENT_CONTROL_PLANE_BACKUP_COUNT: "7"
      WXAGENT_CONTROL_PLANE_BACKUP_INTERVAL: 5m
      WXAGENT_CONTROL_PLANE_TASK_RETENTION: 720h
      WXAGENT_CONTROL_PLANE_EVENT_RETENTION: 720h
      WXAGENT_CONTROL_PLANE_AUDIT_RETENTION: 2160h
      WXAGENT_CONTROL_PLANE_TLS_CERT_FILE: /run/secrets/tls_cert
      WXAGENT_CONTROL_PLANE_TLS_KEY_FILE: /run/secrets/tls_key
      WXAGENT_MTLS_CLIENT_CA_FILE: /run/secrets/client_ca
      WXAGENT_MTLS_REQUIRE_NODE_CERT: "true"
      WXAGENT_MTLS_REVOKED_CERTS_FILE: /run/secrets/revoked_client_certificates
      WXAGENT_NODE_TOKENS_FILE: /run/secrets/node_tokens
      WXAGENT_WEB_USERS_FILE: /run/secrets/web_users

secrets:
  node_tokens:
    file: ./secrets/node-tokens.json
  web_users:
    file: ./secrets/web-users.json
  tls_cert:
    file: ./secrets/server.crt
  tls_key:
    file: ./secrets/server.key
  client_ca:
    file: ./secrets/client-ca.crt
  revoked_client_certificates:
    file: ./secrets/revoked-client-certificates.txt

volumes:
  control-plane-data: