name: conseqa

services:
  conseqa:
    image: ghcr.io/devrajsinh-jhala/conseqa-runner@sha256:37fe678130cbb12140e0388a7afc140f07fba072a0e8d5b1d77d4ee94e7350aa
    environment:
      CONSEQA_HOST: 0.0.0.0
      CONSEQA_PORT: 4319
      CONSEQA_DATA_DIR: /var/lib/conseqa
      CONSEQA_SPOOL_DIR: /var/lib/conseqa/spool
      CONSEQA_CONTRACTS_DIR: /opt/conseqa/contracts
      CONSEQA_SPOOL_KEY: ${CONSEQA_SPOOL_KEY:?Run install.mjs to generate an independent key}
      CONSEQA_SPOOL_KEY_ID: ${CONSEQA_SPOOL_KEY_ID:?Set a stable key identifier}
      CONSEQA_REDACTION_KEY: ${CONSEQA_REDACTION_KEY:?Set an independent redaction key}
      CONSEQA_SIDECAR_TOKEN: ${CONSEQA_SIDECAR_TOKEN:?Set a sidecar token}
      CONSEQA_ADMIN_TOKEN: ${CONSEQA_RUNNER_ADMIN_TOKEN:?Set a different admin token}
      # The published host port is loopback-only; admin requests cross the Docker bridge.
      CONSEQA_ALLOW_REMOTE_ADMIN: "true"
      CONSEQA_CLOUD_URL: ${CONSEQA_INGEST_ENDPOINT:-}
      CONSEQA_CLOUD_API_KEY: ${CONSEQA_ENVIRONMENT_KEY:-}
      CONSEQA_RUNTIME_INSTANCE_TTL_MS: 90000
      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318
      CONSEQA_COLLECTOR_HEALTH_URL: http://otel-collector:13133
    ports:
      - 127.0.0.1:4319:4319
    volumes:
      - conseqa-data:/var/lib/conseqa
      - conseqa-spool:/var/lib/conseqa/spool
      - conseqa-contracts:/opt/conseqa/contracts
    networks: [agent-private]
    restart: unless-stopped
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]

  otel-collector:
    build:
      context: .
      dockerfile: collector.Dockerfile
    user: "10001:10001"
    profiles: [cloud]
    command: ["--config=/etc/otelcol-contrib/config.yaml"]
    environment:
      CONSEQA_INGEST_ENDPOINT: ${CONSEQA_INGEST_ENDPOINT:-http://127.0.0.1:9}
      CONSEQA_ENVIRONMENT_KEY: ${CONSEQA_ENVIRONMENT_KEY:-local-cloud-sync-disabled}
    ports:
      - 127.0.0.1:4317:4317
      - 127.0.0.1:4318:4318
      - 127.0.0.1:13133:13133
    volumes:
      - ./otel-collector.yaml:/etc/otelcol-contrib/config.yaml:ro
      - otel-queue:/var/lib/otelcol/file-storage
    networks: [agent-private]
    restart: unless-stopped
    security_opt: [no-new-privileges:true]
    cap_drop: [ALL]

networks:
  agent-private:
    internal: false

volumes:
  conseqa-data:
  conseqa-spool:
  conseqa-contracts:
  otel-queue: