bridge/compose.yml

services:
  # Lux ID Service (Casdoor-based unified authentication)
  lux-id:
    image: casbin/casdoor:latest
    container_name: bridge-lux-id
    ports:
      - "8000:8000"
    environment:
      - RUNNING_IN_DOCKER=true
    volumes:
      - ./config/casdoor/app.conf:/conf/app.conf
      - lux-id-data:/var/lib/casdoor
    networks:
      - bridge-network
    depends_on:
      lux-id-db:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8000"]
      interval: 5s
      timeout: 3s
      retries: 5

  # Lux ID Database (PostgreSQL for Casdoor)
  lux-id-db:
    image: ghcr.io/hanzoai/sql:latest
    container_name: bridge-lux-id-db
    environment:
      - POSTGRES_USER=casdoor
      - POSTGRES_PASSWORD=${CASDOOR_DB_PASSWORD:-changeme}
      - POSTGRES_DB=casdoor
    volumes:
      - lux-id-db-data:/var/lib/postgresql/data
    ports:
      - "5434:5432"
    networks:
      - bridge-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U casdoor"]
      interval: 5s
      timeout: 3s
      retries: 5

  # KMS: use kms.hanzo.ai in production. For local dev, set KMS_TOKEN env var.
  # NATS/Consul removed — MPC uses ZAP p2p consensus.

  # MPC Nodes (3 nodes for 2-of-3 threshold) — ZAP p2p, no NATS/Consul
  mpc-node-0:
    image: ghcr.io/luxfi/mpc:latest
    container_name: bridge-mpc-0
    environment:
      - NODE_ID=mpc-node-0
      - NODE_PORT=6000
      - DATA_DIR=/data/mpc
      - LOG_LEVEL=info
    volumes:
      - mpc-data-0:/data/mpc
    ports:
      - "6000:6000"
    networks:
      - bridge-network
    depends_on:
      postgres:
        condition: service_healthy

  mpc-node-1:
    image: ghcr.io/luxfi/mpc:latest
    container_name: bridge-mpc-1
    environment:
      - NODE_ID=mpc-node-1
      - NODE_PORT=6000
      - DATA_DIR=/data/mpc
      - LOG_LEVEL=info
    volumes:
      - mpc-data-1:/data/mpc
    ports:
      - "6001:6000"
    networks:
      - bridge-network
    depends_on:
      postgres:
        condition: service_healthy

  mpc-node-2:
    image: ghcr.io/luxfi/mpc:latest
    container_name: bridge-mpc-2
    environment:
      - NODE_ID=mpc-node-2
      - NODE_PORT=6000
      - DATA_DIR=/data/mpc
      - LOG_LEVEL=info
    volumes:
      - mpc-data-2:/data/mpc
    ports:
      - "6002:6000"
    networks:
      - bridge-network
    depends_on:
      postgres:
        condition: service_healthy

  # Database
  postgres:
    image: ghcr.io/hanzoai/sql:latest
    container_name: bridge-postgres
    environment:
      - POSTGRES_USER=bridge
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-changeme}
      - POSTGRES_DB=bridge
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./scripts/init.sql:/docker-entrypoint-initdb.d/init.sql
    ports:
      - "5433:5432"
    networks:
      - bridge-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U bridge"]
      interval: 5s
      timeout: 3s
      retries: 5

  # Bridge Server
  bridge-server:
    image: ghcr.io/luxfi/bridge-server:latest
    container_name: bridge-server
    environment:
      - NODE_ENV=development
      - PORT=5000
      - DATABASE_URL=postgresql://bridge:${POSTGRES_PASSWORD:-changeme}@postgres:5432/bridge
      - NODE_ID=bridge-server-0
      - MPC_THRESHOLD=2
      - MPC_TOTAL_NODES=3
      - MPC_KEY_PREFIX=bridge/mpc
      # Lux ID (Casdoor) Authentication
      - AUTH_PROVIDER=casdoor
      - CASDOOR_ENDPOINT=http://lux-id:8000
      - CASDOOR_CLIENT_ID=lux-bridge
      - CASDOOR_CLIENT_SECRET=${CASDOOR_CLIENT_SECRET:-changeme}
      - CASDOOR_ORGANIZATION=lux-network
      - CASDOOR_APPLICATION=bridge
    ports:
      - "5000:5000"
    networks:
      - bridge-network
    depends_on:
      - postgres
      - lux-id
      - mpc-node-0
      - mpc-node-1
      - mpc-node-2
    volumes:
      - ./app/server:/app
      - /app/node_modules
    command: npm run dev

  # Bridge UI — Vite SPA. Local-dev compose mounts host source and runs
  # `pnpm dev` on port 3001 for hot-reload. Built image (ghcr.io/luxfi/
  # bridge-ui:latest) is `ghcr.io/hanzoai/spa` serving prebuilt /dist on
  # port 80 — used by compose.testnet.yml / compose.mainnet.yml / k8s.
  # node:22-alpine matches app/bridge/Dockerfile build stage.
  bridge-ui:
    image: node:22-alpine
    container_name: bridge-ui
    working_dir: /app/app/bridge
    environment:
      # Vite reads these at build/dev time (build-time inline + dev-server pickup).
      - VITE_BRIDGE_API_HOST=http://localhost:5000
      - VITE_BRIDGE_ENV=local
      - VITE_BRIDGE_CLIENT_ID=lux-bridge
      - VITE_BRIDGE_IAM_ORG=lux-network
    ports:
      - "3001:3001"
    networks:
      - bridge-network
    depends_on:
      - bridge-server
      - lux-id
    volumes:
      - ./:/app
      - /app/node_modules
      - /app/app/bridge/node_modules
    command: sh -c "corepack enable && pnpm install --frozen-lockfile || pnpm install; pnpm -C app/bridge dev --host 0.0.0.0 --port 3001"

volumes:
  lux-id-data:
  lux-id-db-data:
  mpc-data-0:
  mpc-data-1:
  mpc-data-2:
  postgres-data:

networks:
  bridge-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16