name: proxmox-hx-tests

x-test-env: &test-env
  API_URL: http://simulator:8006
  API_USER: ${API_USER:-root@pam}
  API_PASSWORD: ${API_PASSWORD:-secret}
  API_TOKEN: ${API_TOKEN:-root@pam!automation=automation-secret}
  PVE_NODE: ${PVE_NODE:-pve01}
  PVE_STORAGE: ${PVE_STORAGE:-local-lvm}
  PVE_BRIDGE: ${PVE_BRIDGE:-vmbr0}
  API_TIMEOUT: ${API_TIMEOUT:-120}
  TEST_RESOURCE_PREFIX: ${TEST_RESOURCE_PREFIX:-hx}
  PYTHONPATH: /workspace/pulumi-tests/pulumi:/workspace/pulumi-tests
  CONTRACTS_ROOT: /workspace/contracts
  SIMULATION_TIME_SCALE: "10"
  # pulumi-proxmoxve requires https://… endpoints; keep TLS internal to this suite.
  # Host-facing Compose lab stays plain HTTP on :8006 (K8s TLS = Ingress only).
  PROXMOX_VE_ENDPOINT: https://tls-gateway:8443/
  PROXMOX_VE_USERNAME: ${API_USER:-root@pam}
  PROXMOX_VE_PASSWORD: ${API_PASSWORD:-secret}
  PROXMOX_VE_INSECURE: "true"

x-simulator-env: &simulator-env
  DATABASE_URL: postgresql://proxmox:proxmox@postgres:5432/proxmox_simulator
  CONTRACT_SNAPSHOT: /app/contracts/pve-9.2.3.json
  COMPATIBILITY_EVIDENCE: /app/evidence/pve-9.2.3.json
  LOG_LEVEL: INFO
  TICKET_SIGNING_KEY: development-only-signing-key-change-me
  TASK_WORKER_CONCURRENCY: "4"
  SIMULATION_TIME_SCALE: "10"

networks:
  hx:
    driver: bridge

volumes:
  postgres-data:
  pulumi-state:

services:
  postgres:
    image: postgres:17.5-bookworm
    networks: [hx]
    environment:
      POSTGRES_DB: proxmox_simulator
      POSTGRES_USER: proxmox
      POSTGRES_PASSWORD: proxmox
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U proxmox -d proxmox_simulator"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s
    volumes:
      - postgres-data:/var/lib/postgresql/data

  migrate:
    build:
      context: ../..
      target: runtime
    image: proxmox-api-simulator:0.1.0
    networks: [hx]
    environment:
      <<: *simulator-env
    depends_on:
      postgres:
        condition: service_healthy
    entrypoint: ["python"]
    command: ["-m", "app.db.migrate_cli"]
    restart: "no"

  simulator:
    build:
      context: ../..
      target: runtime
    image: proxmox-api-simulator:0.1.0
    networks: [hx]
    environment:
      <<: *simulator-env
    depends_on:
      migrate:
        condition: service_completed_successfully
    command: ["--host", "0.0.0.0", "--port", "8006"]
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8006/health/ready', timeout=2)",
        ]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 15s
    ports:
      - "${HX_SIMULATOR_HOST_PORT:-127.0.0.1:18006}:8006"

  # Internal-only HTTPS for pulumi-proxmoxve (provider rejects http:// endpoints).
  # Not published on host :8006 — lab HTTPS for end users is K8s Ingress.
  tls-gateway:
    image: nginx:1.28.0-alpine
    networks: [hx]
    depends_on:
      simulator:
        condition: service_healthy
    volumes:
      - ../../docker/tls/gateway.conf:/etc/nginx/conf.d/default.conf:ro
      - ../../docker/tls/server.crt:/etc/nginx/tls/server.crt:ro
      - ../../docker/tls/server.key:/etc/nginx/tls/server.key:ro
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget -qO- --no-check-certificate https://127.0.0.1:8443/health/ready || exit 1",
        ]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 5s
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/run
      - /tmp

  seed:
    image: proxmox-api-simulator:0.1.0
    networks: [hx]
    environment:
      <<: *simulator-env
      SEED_PROFILE: ${SEED_PROFILE:-small}
    depends_on:
      simulator:
        condition: service_healthy
    entrypoint: ["python"]
    command: ["-m", "app.simulation.seed_cli"]
    restart: "no"

  pulumi-runner:
    build:
      context: ..
      dockerfile: docker/Dockerfile.pulumi-runner
    image: hx-pulumi-runner:local
    networks: [hx]
    working_dir: /workspace/pulumi-tests
    volumes:
      - ../..:/workspace
      - pulumi-state:/workspace/pulumi-tests/pulumi/.pulumi-state
    environment:
      <<: *test-env
      PULUMI_CONFIG_PASSPHRASE: hx-test-passphrase
      PULUMI_BACKEND_URL: file:///workspace/pulumi-tests/pulumi/.pulumi-state
    depends_on:
      seed:
        condition: service_completed_successfully
      tls-gateway:
        condition: service_healthy
    profiles: [pulumi]
    entrypoint: ["python"]
    command:
      [
        "pulumi/run_suite.py",
        "--report-html",
        "pulumi/reports/report.html",
        "--report-json",
        "pulumi/reports/results.json",
        "--report-junit",
        "pulumi/reports/junit.xml",
      ]

  cleanup:
    build:
      context: ..
      dockerfile: docker/Dockerfile.pulumi-runner
    image: hx-pulumi-runner:local
    networks: [hx]
    working_dir: /workspace/pulumi-tests
    volumes:
      - ../..:/workspace
    environment:
      <<: *test-env
    depends_on:
      simulator:
        condition: service_healthy
    profiles: [cleanup]
    entrypoint: ["python"]
    command: ["tools/cleanup_test_resources.py"]