name: plakman-v0.11.2

volumes:
  vector-conf: {}

services:
  plakman:
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/pg_password
      SSH_AUTH_SOCK: /var/lib/plakman/ssh-agent.sock
    image: "ghcr.io/plakarkorp/plakman:v0.11.2"
    restart: always
    labels:
      logging.service: plakman
    configs:
      - source: plakman_config
        target: /plakman.yaml
    volumes:
      - /data/plakman_runtime:/var/lib/plakman
      - /data/logs:/logs
      # Bind the entire /data directory to allow the PCP integration to back up the instance.
      - /data:/appliance_data:ro

      # Dedicated volume for ONLY the vector relay fragment, shared with the
      # vector sidecar. Kept separate from the state volume so the sidecar never
      # sees plakman's keys/sockets/FUSE mounts.
      - vector-conf:/var/lib/plakman/vector.d
    entrypoint: /usr/local/bin/plakman -foreground -config /plakman.yaml
    networks: [edge]
    secrets:
      - pg_password
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost/"]
      interval: 10s
      timeout: 3s
      retries: 12
    extra_hosts:
      - "host.docker.internal:host-gateway"
    devices:
      - /dev/fuse
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor=unconfined
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"

  vector:
    image: timberio/vector:latest-alpine
    restart: unless-stopped
    configs:
      - source: vector_config
        target: /etc/vector/vector.toml
    volumes:
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /data/logs:/logs
      # Dedicated volume for ONLY the vector relay fragment, shared with the
      # vector sidecar. Kept separate from the state volume so the sidecar never
      # sees plakman's keys/sockets/FUSE mounts.
      - vector-conf:/etc/vector/conf.d/vector.d

    # Seed a stub before launching so the `*.toml` glob is NEVER empty at
    # startup — an empty glob is a hard startup failure in Vector, and we must
    # not depend on plakman having synced yet. plakman later overwrites this
    # stub (and reverts to an equivalent stub when the relay is disabled).
    # --watch-config then hot-reloads on every change with no restart.
    entrypoint:
      - sh
      - -c
      - |
        d=/etc/vector/conf.d/vector.d
        [ -e "$$d/99-plakman-relay.toml" ] || printf '# vector relay not yet configured\n' > "$$d/99-plakman-relay.toml"
        exec /usr/local/bin/vector --watch-config -c /etc/vector/vector.toml -c "$$d"/*.toml

networks:
  edge:
    name: edge
    driver: bridge

secrets:
  pg_password:
    file: /data/secrets/db_password

configs:
  vector_config:
    content: |
      [sources.docker]
      type = "docker_logs"
      exclude_containers = ["vector"]

      [transforms.add_service]
      type = "remap"
      inputs = ["docker"]
      source = '''
      .service = .label."logging.service"
      del(.label)
      '''
      [sinks.file]
      type = "file"
      inputs = ["add_service"]
      path = "/logs/plakman-logs-%Y-%m-%d.log.gz"
      compression = "gzip"
      encoding.codec = "json"

  plakman_config:
    content: |
      services:
        http:
          listen:
            address: :8080
        database:
          url: postgres://plakman:plakman@postgres:5432/plakman-db
        plakman:
          parentUrl: https://api.plakar.io
          stateDirectory: /var/lib/plakman/
        scheduler:
          plakmanUrl: http://plakman:8080
        janitor:
          plakmanUrl: http://plakman:8080
        executor:
          pkgDir: /var/lib/plakman/pkgs/
          plakmanUrl: http://plakman:8080
          plakletBin: /usr/local/bin/plaklet
          cachedBin: /usr/local/bin/cached
        journal:
          dbStorage: true
          logPath: /var/lib/plakman/journal.log
      api:
        v1:
          mode:
            plakman: true
            plakario: false
          cors: true
          auth:
            emailRedirect: "http://localhost:8080/api/v1/auth/login/email/callback"
