# =============================================================================
# prod-smoke — a production-shaped runtime, for evidence, on a laptop.
#
# Not "production Compose". What it is for is proving that the prod profile's fail-closed validators
# can be satisfied at all: TLS on the JDBC URL, a schema Flyway owns, JSON logging, secret
# references rather than values. A prod lane that only ever gets as far as `config` proves the file
# parses, which was never the thing in doubt.
#
# The credentials here are generated per run by the lane wrapper. Nothing local is reused: a
# prod-smoke that borrows the local MinIO password is a prod-smoke that tests the local setup.
# =============================================================================

services:
  app:
    environment:
      # Explicit, not inherited. A Compose profile selects services and says nothing about which
      # environment the application believes it is in.
      SPRING_PROFILES_ACTIVE: "prod"
      TZ: "UTC"
      # verify-full, which is the point: PostgreSqlTransportSecurityValidator refuses anything less,
      # and that refusal is the behaviour this lane exists to satisfy rather than bypass.
      APP_DATASOURCE_URL: "jdbc:postgresql://db:5432/${POSTGRES_DB:-ca_skeleton}?sslmode=verify-full&sslrootcert=/run/secrets/postgres-ca"
      APP_DATASOURCE_USERNAME: "${APP_DATASOURCE_USERNAME:-ca_skeleton}"
      # The password is deliberately absent here. An `environment:` entry beats `env_file:`, so
      # declaring it as "${APP_DATASOURCE_PASSWORD:-}" read the host shell rather than the lane's
      # generated file and injected an empty string — which the prod env validator then refused, for
      # the right reason, about a value the lane had actually supplied.
      APP_DATASOURCE_DDL_AUTO: "validate"
      APP_LOG_JSON_ENABLED: "true"
      APP_SECURITY_JWT_ISSUER: "http://keycloak:8080/realms/ca-skeleton"
      APP_SECURITY_JWT_AUDIENCE: "ca-skeleton-api"
    networks:
      - caskeleton-infra

networks:
  caskeleton-infra:
    external: false