services:
  aci-configtool:
    # No build: context. The customer package ships a loaded image tar, not
    # source -- install.sh loads images/*.tar before this file is ever used.
    image: aci-configtool-pro:latest
    container_name: aci-configtool
    ports:
      # Host 5009 -> container 5002. The container keeps 5002 internally (same
      # app as the Individual edition); the host side is moved so both can run
      # on one machine without a port clash.
      - "5009:5002"
    environment:
      - ACI_CONTAINER=1
      - LICENSE_FILE_PATH=/app/data/license.dat
      # Windows Docker Desktop has no usable /etc/machine-id to mount, so the
      # host ID is passed in instead. Empty on Linux, where the mounts below
      # supply it. license_check.py has NO generated fallback: if neither this
      # nor a mount provides a value, licensing fails loudly rather than
      # binding to something that lives in a deletable volume.
      - HOST_MACHINE_ID=${HOST_MACHINE_ID:-}
      # TLS: leave unset to use the auto-generated self-signed cert in
      # /app/data/tls. Point at corporate cert/key files to replace it, or
      # set TLS_DISABLE=1 when running behind an external TLS proxy.
      - TLS_CERT=${TLS_CERT:-}
      - TLS_KEY=${TLS_KEY:-}
      - TLS_DISABLE=${TLS_DISABLE:-}
    volumes:
      # One-machine lock: host machine-id, read-only. Present on all systemd
      # Linux. Absent on Docker Desktop -- see HOST_MACHINE_ID above.
      - /etc/machine-id:/host-machine-id:ro
      - /var/lib/dbus/machine-id:/host-dbus-machine-id:ro
      # Persistent storage + license.dat destination (writable).
      # Named volume (not a host bind): the image chowns /app/data to uid 1001,
      # and a named volume inherits that ownership on first mount -- so the app
      # user CAN write license.dat here even with read_only root fs. A host bind
      # (./data) does NOT inherit image ownership and is the usual cause of the
      # silent write failure that shows up as "license invalid / tampered".
      - aci_data:/app/data
      # TLS material ONLY, from the host, read-only. install.sh generates a
      # self-signed cert here on first install and keeps the key at 600. This
      # is a host bind rather than part of the named volume so the installer
      # can write the cert without reaching inside the volume -- and read-only
      # because the app never needs to modify it.
      - ./data/tls:/app/data/tls:ro
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "/app/healthcheck.py"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3

volumes:
  aci_data:
