name: sandbox-credential-injection-demo

services:
  certs:
    build: ./images/certs
    network_mode: none
    volumes:
      - certs:/out

  sandbox:
    build: ./images/sandbox
    cap_add:
      - NET_ADMIN
    healthcheck:
      test: ["CMD-SHELL", "iptables -t nat -C OUTPUT -p tcp --dport 443 -j CREDENTIAL_PROXY"]
      interval: 1s
      timeout: 1s
      retries: 20
    networks:
      demo: {}

  upstream:
    build:
      context: .
      args:
        APP: upstream
    environment:
      DEMO_API_KEY: ${DEMO_API_KEY:-demo-secret}
    volumes:
      - certs:/certs:ro
    networks:
      demo:
        aliases:
          - api.demo.local

  proxy:
    build:
      context: .
      args:
        APP: proxy
    user: "1337:1337"
    network_mode: service:sandbox
    environment:
      DEMO_API_KEY: ${DEMO_API_KEY:-demo-secret}
    volumes:
      - certs:/certs:ro
    depends_on:
      sandbox:
        condition: service_healthy
      upstream:
        condition: service_started
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:18080/healthz"]
      interval: 1s
      timeout: 1s
      retries: 20

  client:
    build: ./images/client
    network_mode: service:sandbox
    volumes:
      - certs:/certs:ro
    depends_on:
      proxy:
        condition: service_healthy

networks:
  demo: {}

volumes:
  certs: {}