# Stealth browser stack for @suaveplan/testing-e2e.
#
# - `cloakserve`: stealth Chromium CDP multiplexer on 127.0.0.1:9222.
#   Use with `connectCloakServe()` from @suaveplan/testing-e2e — one
#   container, many parallel test workers, each seeding its own
#   isolated Chromium identity via fingerprint query params.
# - `cloakbrowser-manager`: optional GUI profile manager on
#   127.0.0.1:8080. Wholly separate from `cloakserve`; spin up only
#   when interactively curating profiles. Set AUTH_TOKEN before
#   exposing beyond localhost.
#
# Usage:
#   docker compose up -d cloakserve              # CDP server only
#   docker compose up -d cloakserve manager      # + profile manager
#   docker compose down                          # tear down
#
# Both services bind to 127.0.0.1. NEVER expose CDP (9222) or the
# manager (8080) directly to the public internet — both grant
# full browser control. Always front with a reverse proxy + auth.

services:
    cloakserve:
        build:
            context: .
            dockerfile: Dockerfile.cloakserve
            args:
                CLOAKBROWSER_TAG: "${CLOAKBROWSER_TAG:-latest}"
        image: suaveplan-cloakserve:local
        container_name: suaveplan-cloakserve
        restart: unless-stopped
        ports:
            - "127.0.0.1:9222:9222"
        environment:
            CLOAKBROWSER_AUTO_UPDATE: "false"
        healthcheck:
            test:
                ["CMD", "curl", "-fsS", "http://localhost:9222/json/version"]
            interval: 30s
            timeout: 5s
            retries: 3
            start_period: 15s

    manager:
        build:
            context: .
            dockerfile: Dockerfile.manager
            args:
                MANAGER_TAG: "${MANAGER_TAG:-latest}"
        image: suaveplan-cloakbrowser-manager:local
        container_name: suaveplan-cloakbrowser-manager
        restart: unless-stopped
        ports:
            - "127.0.0.1:8080:8080"
        volumes:
            - cloakprofiles:/data
        environment:
            AUTH_TOKEN: "${MANAGER_AUTH_TOKEN:-}"
        profiles:
            - manager

volumes:
    cloakprofiles:
        name: suaveplan-cloakprofiles