docker-compose.blind-public-test.yml

name: hiverelay-blind-public-test

# Public-test overlay for the split Blind images (release 1.0.0-rc.1.public-test.1).
#  - Images are pinned by image-index digest (multi-arch linux/amd64+linux/arm64);
#    digests are bound in release/blind-public-test/artifact-manifest.json.
#  - Host TCP 443 maps DIRECTLY to the Edge TLS listener (Blind Edge terminates
#    public-CA TLS itself; no HTTP/TCP reverse proxy in front).
#  - The daemon is private: no network, only the shared Unix-socket volume.
#  - Readiness stays zero: all signed assembly inputs remain empty-by-default;
#    without node-scoped sealed material both services fail closed.
#  - Rollback: stop/remove only this project's containers; volumes (roots) are
#    retained. See release/blind-public-test/rollback/.

x-blind-hardening: &blind-hardening
  restart: unless-stopped
  read_only: true
  cap_drop:
    - ALL
  security_opt:
    - no-new-privileges:true
  pids_limit: 256
  stop_grace_period: 20s
  tmpfs:
    - /tmp:rw,noexec,nosuid,nodev,size=64m
  ulimits:
    nofile:
      soft: 8192
      hard: 8192

services:
  # One-shot volume initializer (identical contract to docker-compose.blind.yml):
  # the only root process, killed by the signed 60-second maximum, never loads
  # product code.
  blind-volume-init:
    image: "hiverelay/blind-daemon@sha256:57b7c2b1645b2c728efd761904b40a838b2db6111b0e9957b081d800ccf98f9f"
    restart: "no"
    read_only: true
    user: "0:0"
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
    security_opt:
      - no-new-privileges:true
    pids_limit: 32
    network_mode: none
    stop_grace_period: 1s
    entrypoint: ["/usr/bin/timeout", "--signal=KILL", "59s", "/bin/sh", "-ec"]
    command:
      - |
        test ! -L /run/hiverelay-blind
        test ! -L /data/blind
        mkdir -p -- /run/hiverelay-blind /data/blind
        test -d /run/hiverelay-blind
        test -d /data/blind
        test ! -L /run/hiverelay-blind
        test ! -L /data/blind
        chown 999:997 -- /run/hiverelay-blind /data/blind
        chmod 0750 -- /run/hiverelay-blind
        chmod 0700 -- /data/blind
    volumes:
      - blind-runtime:/run/hiverelay-blind
      - blind-data:/data/blind

  blind-daemon:
    <<: *blind-hardening
    image: "hiverelay/blind-daemon@sha256:57b7c2b1645b2c728efd761904b40a838b2db6111b0e9957b081d800ccf98f9f"
    user: "999:997"
    depends_on:
      blind-volume-init:
        condition: service_completed_successfully
    network_mode: none
    mem_limit: 1g
    cpus: 2.0
    environment:
      HIVERELAY_BLIND_RUNTIME_DIR: /run/hiverelay-blind
      HIVERELAY_BLIND_UNARY_SOCKET: /run/hiverelay-blind/unary.sock
      HIVERELAY_BLIND_STREAM_SOCKET: /run/hiverelay-blind/stream.sock
      HIVERELAY_BLIND_DATA: /data/blind
      # Every production assembly input is explicit and empty-by-default
      # (fail-closed; sealed node material is supplied by the deployment lease).
      HIVERELAY_BLIND_RUNTIME_PROFILE: "${HIVERELAY_BLIND_RUNTIME_PROFILE:-}"
      HIVERELAY_BLIND_ADMISSION_ADAPTER_SCRIPT_FILE: "${HIVERELAY_BLIND_ADMISSION_ADAPTER_SCRIPT_FILE:-}"
      HIVERELAY_BLIND_ADMISSION_ADAPTER_SCRIPT_SHA256: "${HIVERELAY_BLIND_ADMISSION_ADAPTER_SCRIPT_SHA256:-}"
      HIVERELAY_BLIND_DESCRIPTOR_FILES: "${HIVERELAY_BLIND_DESCRIPTOR_FILES:-}"
      HIVERELAY_BLIND_ADMISSION_PARAMETER_FILES: "${HIVERELAY_BLIND_ADMISSION_PARAMETER_FILES:-}"
      HIVERELAY_BLIND_RELAY_SECRET_KEY_FILE: "${HIVERELAY_BLIND_RELAY_SECRET_KEY_FILE:-}"
      HIVERELAY_BLIND_STORE_ROOT: "${HIVERELAY_BLIND_STORE_ROOT:-}"
      HIVERELAY_BLIND_PRIVATE_IPC_REPLAY_ROOT: "${HIVERELAY_BLIND_PRIVATE_IPC_REPLAY_ROOT:-}"
      HIVERELAY_BLIND_INBOX_STORE_ROOT: "${HIVERELAY_BLIND_INBOX_STORE_ROOT:-}"
      HIVERELAY_BLIND_INBOX_CURSOR_KEY_FILE: "${HIVERELAY_BLIND_INBOX_CURSOR_KEY_FILE:-}"
      HIVERELAY_BLIND_CORE_STORE_ROOT: "${HIVERELAY_BLIND_CORE_STORE_ROOT:-}"
      HIVERELAY_BLIND_STORE_MANIFEST_KEY_FILE: "${HIVERELAY_BLIND_STORE_MANIFEST_KEY_FILE:-}"
      HIVERELAY_BLIND_STORE_READER_MODE: "${HIVERELAY_BLIND_STORE_READER_MODE:-}"
      HIVERELAY_BLIND_OWNER_FENCE_TOKEN_HASH_FILE: "${HIVERELAY_BLIND_OWNER_FENCE_TOKEN_HASH_FILE:-}"
      HIVERELAY_BLIND_MAP_GENERATION: "${HIVERELAY_BLIND_MAP_GENERATION:-}"
      HIVERELAY_BLIND_EXPECTED_DESCRIPTOR_SEQUENCE: "${HIVERELAY_BLIND_EXPECTED_DESCRIPTOR_SEQUENCE:-}"
      HIVERELAY_BLIND_EXPECTED_DESCRIPTOR_HASH: "${HIVERELAY_BLIND_EXPECTED_DESCRIPTOR_HASH:-}"
      HIVERELAY_BLIND_ENDPOINT_SUPPORT_BITS: "${HIVERELAY_BLIND_ENDPOINT_SUPPORT_BITS:-}"
      HIVERELAY_BLIND_LAUNCH_TOPOLOGY_HASH: "${HIVERELAY_BLIND_LAUNCH_TOPOLOGY_HASH:-}"
      HIVERELAY_BLIND_ENDPOINT_IDS: "${HIVERELAY_BLIND_ENDPOINT_IDS:-}"
      HIVERELAY_BLIND_EDGE_UID: "998"
      HIVERELAY_BLIND_DAEMON_UID: "999"
      HIVERELAY_BLIND_DAEMON_GID: "997"
      HIVERELAY_BLIND_SHARED_GID: "997"
    volumes:
      - blind-runtime:/run/hiverelay-blind
      - blind-data:/data/blind

  blind-edge:
    <<: *blind-hardening
    image: "hiverelay/blind-edge@sha256:79a4e8e735681497772c06f6c35544bf4d6d77afdd0ed9f06bc6c5b2ae564fe7"
    user: "998:997"
    depends_on:
      blind-daemon:
        condition: service_healthy
        restart: true
    mem_limit: 1g
    cpus: 2.0
    environment:
      HIVERELAY_BLIND_RUNTIME_DIR: /run/hiverelay-blind
      HIVERELAY_BLIND_UNARY_SOCKET: /run/hiverelay-blind/unary.sock
      HIVERELAY_BLIND_STREAM_SOCKET: /run/hiverelay-blind/stream.sock
      # No fallback by design: an omitted signed topology hash or endpoint
      # leaves the edge fail-closed before it opens a public listener.
      HIVERELAY_BLIND_LAUNCH_TOPOLOGY_HASH: "${HIVERELAY_BLIND_LAUNCH_TOPOLOGY_HASH:-}"
      HIVERELAY_BLIND_STREAM_TRANSPORT_PROFILE_HASH: "${HIVERELAY_BLIND_STREAM_TRANSPORT_PROFILE_HASH:-}"
      HIVERELAY_BLIND_HOST: 0.0.0.0
      HIVERELAY_BLIND_PORT: "9100"
      HIVERELAY_BLIND_ENDPOINT_ID: "${HIVERELAY_BLIND_ENDPOINT_ID:-}"
      HIVERELAY_BLIND_DAEMON_UID: "999"
      HIVERELAY_BLIND_DAEMON_GID: "997"
      HIVERELAY_BLIND_SHARED_GID: "997"
      HIVERELAY_BLIND_TLS_KEY: /run/secrets/hiverelay-blind-tls.key
      HIVERELAY_BLIND_TLS_CERT: /run/secrets/hiverelay-blind-tls.crt
      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
    ports:
      # Host TCP 443 -> Edge TLS 9100, direct termination, no proxy in front.
      - "${HIVERELAY_BLIND_BIND:-0.0.0.0}:443:9100"
    volumes:
      - blind-runtime:/run/hiverelay-blind:ro
    secrets:
      - source: blind-tls-key
        target: hiverelay-blind-tls.key
        uid: "998"
        gid: "997"
        mode: 0400
      - source: blind-tls-cert
        target: hiverelay-blind-tls.crt
        uid: "998"
        gid: "997"
        mode: 0444
    networks:
      - blind-public

volumes:
  blind-runtime:
  blind-data:

networks:
  blind-public:

secrets:
  blind-tls-key:
    file: "${HIVERELAY_BLIND_TLS_KEY_FILE:-./deploy/blind/secrets/tls.key}"
  blind-tls-cert:
    file: "${HIVERELAY_BLIND_TLS_CERT_FILE:-./deploy/blind/secrets/tls.crt}"