# Production compose for rn-lab-host-01. Deployed by infra/ansible/roles/lab-host/ to
# /opt/rootnode/lab-host/docker-compose.yml, run as a systemd unit
# (rootnode-lab-host.service.j2). Runs exactly one long-lived service: the shared egress proxy
# every student Lab's outbound traffic passes through (platform/egress-proxy/, unchanged since
# Phase 1). Student Lab containers themselves are NOT part of this compose file — they're
# created/destroyed individually by the Provisioner over the remote Docker TLS endpoint
# (dockerd itself, not compose), same mechanism as dev, just remote.

networks:
  rn-egress:
    driver: bridge

services:
  egress-proxy:
    image: "{{ registry }}/rootnode/egress-proxy:{{ image_tag }}"
    restart: unless-stopped
    ports:
      - "3128:3128"   # reachable from every per-Lab Docker network on this host — restricted
                       # to those networks by the Provisioner's per-environment DOCKER-USER
                       # chains, not by a published-port firewall rule (there is no sensible
                       # single source IP to restrict this to; the egress proxy's OWN allowlist
                       # is the actual control, see platform/egress-proxy/allowlist.txt)
    networks: [rn-egress]

  node-exporter:
    image: prom/node-exporter:latest
    restart: unless-stopped
    network_mode: host
    pid: host
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - "--path.procfs=/host/proc"
      - "--path.sysfs=/host/sys"
      - "--path.rootfs=/rootfs"
      - "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    restart: unless-stopped
    privileged: true
    devices:
      - /dev/kmsg
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    ports:
      - "8080:8080"   # scraped remotely by Prometheus on rn-platform-01 — restricted to that
                       # one source IP by the host firewall (rn-lab-host-01.rules), not by
                       # binding to localhost, since Prometheus isn't local on this host.

  promtail:
    image: grafana/promtail:latest
    restart: unless-stopped
    volumes:
      - /opt/rootnode/lab-host/promtail-config.yml:/etc/promtail/config.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/log/journal:/var/log/journal:ro
      - /etc/machine-id:/etc/machine-id:ro
    command: ["-config.file=/etc/promtail/config.yml"]
    # host networking so promtail can reach Loki on rn-platform-01 over the network — this
    # traffic is OUTBOUND from rn-lab-host-01 (log push, client-initiated), which the host
    # firewall's default-ACCEPT OUTPUT chain already allows; nothing new needed there.
    network_mode: host