# Commit-ambiguity failure injection for the JPA platform (design §39).
#
# The suite needs a proxy rather than a kill switch because the scenario that matters cannot be
# produced any other way. Stopping the container, killing the process, or closing the client socket
# all break *before* the server commits — the easy case, where the transaction rolled back and the
# use case may simply be re-run. The hard case is a commit the server completed whose
# acknowledgement never came back, and it only exists if you can cut the return path while leaving
# the forward path intact.
#
# That is what CommitAmbiguityProxy does with a downstream-only toxic, and it is the one scenario
# that distinguishes a platform that reports completion-unknown from one that retries a write which
# already succeeded.
#
# Ordinary contract runs use Testcontainers and do not need this file; it exists for reproducing a
# failure scenario by hand.

services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: jpa_failure
      POSTGRES_USER: jpa_failure
      POSTGRES_PASSWORD: jpa_failure
    # No published port: the suite must reach PostgreSQL only through the proxy, or the injected
    # fault can be bypassed by connecting directly and the test passes without testing anything.
    expose:
      - "5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U jpa_failure -d jpa_failure"]
      interval: 2s
      timeout: 3s
      retries: 30

  toxiproxy:
    image: ghcr.io/shopify/toxiproxy:2.11.0
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      # 8474 is the control API the suite drives; 8666 is the proxied PostgreSQL port.
      - "8474:8474"
      - "8666:8666"
    command: ["-host", "0.0.0.0"]