# Standalone compose for prometheus.x on the Hephaestus VPS.
#
# The service attaches to Hephaestus's existing docker network
# (hephaestus_default), so Hephaestus's Caddy can route prometheus.x to
# `prometheus:3700` with no changes to Hephaestus itself other than one new
# block in its Caddyfile.
#
# One volume (`data`) holds the SQLite DB, the service's ed25519 signing
# key, uploads that passed scan, and the snapshot build output. Env lives
# in an .env file alongside this one; the ones below are the defaults and
# can be overridden.

name: prometheus

services:
  prometheus:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
    image: prometheus:latest
    restart: unless-stopped
    depends_on:
      clamav:
        condition: service_healthy
    environment:
      BNS_NETWORK: chipnet
      CLAMD_HOST: clamav
      CLAMD_PORT: "3310"
      ADMIN_PUBLISHER: ${ADMIN_PUBLISHER:-}
      VIRUSTOTAL_API_KEY: ${VIRUSTOTAL_API_KEY:-}
      PAYMENT_REQUIRED: ${PAYMENT_REQUIRED:-}
      PROMETHEUS_PAYMENT_ADDRESS: ${PROMETHEUS_PAYMENT_ADDRESS:-}
      PROMETHEUS_LISTING_FEE_USD: ${PROMETHEUS_LISTING_FEE_USD:-1}
      BNS_GATEWAY: ${BNS_GATEWAY:-}
      # Sia-backed storage: when set, scan-clean uploads are pushed to the
      # hosted s3d and the submit UI pre-fills the download URL. All four
      # must be set for storage to turn on; otherwise publishers host
      # their own binaries. See service/storage.js for defaults.
      PROMETHEUS_S3_ENDPOINT: ${PROMETHEUS_S3_ENDPOINT:-}
      PROMETHEUS_S3_ACCESS_KEY: ${PROMETHEUS_S3_ACCESS_KEY:-}
      PROMETHEUS_S3_SECRET: ${PROMETHEUS_S3_SECRET:-}
      PROMETHEUS_S3_BUCKET: ${PROMETHEUS_S3_BUCKET:-bns}
      PROMETHEUS_S3_PREFIX: ${PROMETHEUS_S3_PREFIX:-prometheus-storage/}
      PROMETHEUS_PUBLIC_BASE: ${PROMETHEUS_PUBLIC_BASE:-}
    volumes:
      - data:/data
    networks:
      - prometheus-internal
      - hephaestus
    expose:
      - "3700"
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--spider", "http://127.0.0.1:3700/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s

  # ClamAV runs as a sibling container on an internal network — only
  # Prometheus can reach it. First start downloads ~250 MB of signatures via
  # freshclam into a volume; subsequent starts reuse it.
  clamav:
    image: clamav/clamav:stable
    restart: unless-stopped
    environment:
      CLAMAV_NO_MILTERD: "true"
    volumes:
      - clamav-sigs:/var/lib/clamav
      # Overlay our clamd.conf so the stream/file/scan size limits are
      # raised from the image defaults (25 MB / 100 MB / 400 MB) to the
      # 2 GiB cap Prometheus itself enforces. Without this a 100-MB APK
      # scan comes back as "INSTREAM size limit exceeded".
      - ./clamd.conf:/etc/clamav/clamd.conf:ro
    networks:
      - prometheus-internal
    expose:
      - "3310"
    healthcheck:
      test: ["CMD-SHELL", "clamdcheck.sh || clamdscan --ping 2>/dev/null || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 10
      # Signature download on first start can take a few minutes.
      start_period: 5m

volumes:
  data:
  clamav-sigs:

networks:
  # Internal: only Prometheus + clamav. Clamd never exposed off this network.
  prometheus-internal:
    driver: bridge
  # External: shared with Hephaestus so its Caddy can route prometheus.x.
  hephaestus:
    external: true
    name: hephaestus_default