compose.yaml

name: nekiro

services:
  nacos:
    image: "nacos/nacos-server:v2.5.1@sha256:8987908cb94ed5f9d30522a64493d35732a6c05f216d667a7addb022f3d92e80"
    environment:
      MODE: standalone
      NACOS_AUTH_ENABLE: "false"
    networks:
      - platform-internal
      - local-access
    ports:
      - "127.0.0.1:${NACOS_PORT:?NACOS_PORT must be set and non-empty}:8848"
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8848/nacos/v1/console/health/readiness"]
      interval: 5s
      timeout: 5s
      retries: 24
      start_period: 20s

  nacos-bootstrap:
    image: "curlimages/curl:8.16.0@sha256:463eaf6072688fe96ac64fa623fe73e1dbe25d8ad6c34404a669ad3ce1f104b6"
    environment:
      NACOS_BINDING_CONTENT: '{"schemaVersion":"1","revision":"stack-bootstrap-1","targets":[]}'
    command:
      - sh
      - -eu
      - -c
      - |
        curl -fsS -X POST http://nacos:8848/nacos/v1/console/namespaces \
          --data-urlencode customNamespaceId=nekiro \
          --data-urlencode namespaceName=nekiro \
          --data-urlencode 'namespaceDesc=NeKiro Stack acceptance'
        curl -fsS -X POST 'http://nacos:8848/nacos/v1/cs/configs?dataId=router.nacos-bindings&group=NEKIRO&tenant=nekiro' \
          --data-urlencode content=$$NACOS_BINDING_CONTENT
    depends_on:
      nacos:
        condition: service_healthy
    networks:
      - platform-internal
    restart: "no"

  nacos-secure:
    profiles: ["router-nacos-secure"]
    image: "${NEKIRO_NACOS_SECURE_PROXY_IMAGE:?NEKIRO_NACOS_SECURE_PROXY_IMAGE must be set to the prepared immutable image}"
    command: ["serve"]
    environment:
      NEKIRO_NACOS_FIXTURE_TLS_ROOT: "/var/run/nekiro-nacos-tls"
      NEKIRO_NACOS_FIXTURE_HTTP_LISTEN: "0.0.0.0:9443"
      NEKIRO_NACOS_FIXTURE_HTTP_UPSTREAM: "http://nacos:8848"
      NEKIRO_NACOS_FIXTURE_GRPC_LISTEN: "0.0.0.0:9848"
      NEKIRO_NACOS_FIXTURE_GRPC_UPSTREAM: "nacos:9848"
      NEKIRO_NACOS_FIXTURE_STATUS_LISTEN: "0.0.0.0:9090"
    volumes:
      - "${NEKIRO_E2E_TLS_ROOT:?NEKIRO_E2E_TLS_ROOT must be set and non-empty}:/var/run/nekiro-nacos-tls:ro"
    ports:
      - "127.0.0.1:${NEKIRO_E2E_NACOS_ROUTER_HTTP_PORT:?NEKIRO_E2E_NACOS_ROUTER_HTTP_PORT must be set and non-empty}:9443"
      - "127.0.0.1:${NEKIRO_E2E_NACOS_ROUTER_GRPC_PORT:?NEKIRO_E2E_NACOS_ROUTER_GRPC_PORT must be set and non-empty}:9848"
      - "127.0.0.1:${NEKIRO_E2E_NACOS_FIXTURE_STATUS_PORT:?NEKIRO_E2E_NACOS_FIXTURE_STATUS_PORT must be set and non-empty}:9090"
    depends_on:
      nacos:
        condition: service_healthy
    networks:
      - platform-internal
      - local-access
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:9090/readyz"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 5s

  postgres:
    image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
    environment:
      POSTGRES_USER: "${POSTGRES_USER:?POSTGRES_USER must be set and non-empty}"
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set and non-empty}"
      POSTGRES_DB: "${POSTGRES_DB:?POSTGRES_DB must be set and non-empty}"
    ports:
      - "127.0.0.1:${POSTGRES_PORT:?POSTGRES_PORT must be set and non-empty}:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - platform-internal
      - local-access
    healthcheck:
      test:
        - CMD-SHELL
        - pg_isready --username "$${POSTGRES_USER}" --dbname "$${POSTGRES_DB}"
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s

  control-plane-migrate:
    image: "${NEKIRO_CONTROL_PLANE_IMAGE:?NEKIRO_CONTROL_PLANE_IMAGE must be set to the prepared immutable image}"
    command: ["migrate", "up"]
    environment:
      NEKIRO_DATABASE_URL: "${NEKIRO_COMPOSE_DATABASE_URL:?NEKIRO_COMPOSE_DATABASE_URL must be set and non-empty}"
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - platform-internal
    restart: "no"

  control-plane:
    image: "${NEKIRO_CONTROL_PLANE_IMAGE:?NEKIRO_CONTROL_PLANE_IMAGE must be set to the prepared immutable image}"
    environment:
      NEKIRO_DATABASE_URL: "${NEKIRO_COMPOSE_DATABASE_URL:?NEKIRO_COMPOSE_DATABASE_URL must be set and non-empty}"
      NEKIRO_LISTEN_ADDRESS: "0.0.0.0:8080"
      NEKIRO_AUTH_MODE: "development-static"
      NEKIRO_CORS_ALLOWED_ORIGINS: "${NEKIRO_CORS_ALLOWED_ORIGINS:?NEKIRO_CORS_ALLOWED_ORIGINS must be set and non-empty}"
      NEKIRO_PUBLIC_AGENT_ORIGIN: "${NEKIRO_PUBLIC_AGENT_ORIGIN:?NEKIRO_PUBLIC_AGENT_ORIGIN must be set and non-empty}"
      NEKIRO_ENDPOINT_CHALLENGE_TTL_SECONDS: "${NEKIRO_ENDPOINT_CHALLENGE_TTL_SECONDS:?NEKIRO_ENDPOINT_CHALLENGE_TTL_SECONDS must be set and non-empty}"
      NEKIRO_ENDPOINT_VERIFICATION_TIMEOUT_MS: "${NEKIRO_ENDPOINT_VERIFICATION_TIMEOUT_MS:?NEKIRO_ENDPOINT_VERIFICATION_TIMEOUT_MS must be set and non-empty}"
      NEKIRO_ENDPOINT_ALLOWED_PRIVATE_HOSTS_JSON: "${NEKIRO_ENDPOINT_ALLOWED_PRIVATE_HOSTS_JSON:?NEKIRO_ENDPOINT_ALLOWED_PRIVATE_HOSTS_JSON must be set and non-empty}"
      NEKIRO_DEV_AUTH_PRINCIPALS_JSON: "${NEKIRO_DEV_AUTH_PRINCIPALS_JSON:?NEKIRO_DEV_AUTH_PRINCIPALS_JSON must be set and non-empty}"
      NEKIRO_INTERNAL_AUTH_MODE: "development-static"
      NEKIRO_INTERNAL_DEV_AUTH_PRINCIPALS_JSON: "${NEKIRO_INTERNAL_DEV_AUTH_PRINCIPALS_JSON:?NEKIRO_INTERNAL_DEV_AUTH_PRINCIPALS_JSON must be set and non-empty}"
      NEKIRO_ROUTER_INTERNAL_URL: "http://a2a-router:8081/internal/v1/invocations"
      NEKIRO_ROUTER_INTERNAL_BEARER_TOKEN: "${NEKIRO_ROUTER_INTERNAL_BEARER_TOKEN:?NEKIRO_ROUTER_INTERNAL_BEARER_TOKEN must be set and non-empty}"
      NEKIRO_CONTROL_PLANE_INTERNAL_REQUEST_MAX_BYTES: "${NEKIRO_CONTROL_PLANE_INTERNAL_REQUEST_MAX_BYTES:?NEKIRO_CONTROL_PLANE_INTERNAL_REQUEST_MAX_BYTES must be set and non-empty}"
      NEKIRO_GATEWAY_INVOCATION_REQUEST_MAX_BYTES: "${NEKIRO_GATEWAY_INVOCATION_REQUEST_MAX_BYTES:?NEKIRO_GATEWAY_INVOCATION_REQUEST_MAX_BYTES must be set and non-empty}"
      NEKIRO_GATEWAY_SSE_EVENT_MAX_BYTES: "${NEKIRO_GATEWAY_SSE_EVENT_MAX_BYTES:?NEKIRO_GATEWAY_SSE_EVENT_MAX_BYTES must be set and non-empty}"
      NEKIRO_GATEWAY_METADATA_RESPONSE_MAX_BYTES: "${NEKIRO_GATEWAY_METADATA_RESPONSE_MAX_BYTES:?NEKIRO_GATEWAY_METADATA_RESPONSE_MAX_BYTES must be set and non-empty}"
      NEKIRO_GATEWAY_INVOCATION_DEADLINE_MS: "${NEKIRO_GATEWAY_INVOCATION_DEADLINE_MS:?NEKIRO_GATEWAY_INVOCATION_DEADLINE_MS must be set and non-empty}"
    ports:
      - "127.0.0.1:${CONTROL_PLANE_PORT:?CONTROL_PLANE_PORT must be set and non-empty}:8080"
    depends_on:
      control-plane-migrate:
        condition: service_completed_successfully
    networks:
      - platform-internal
      - local-access
    healthcheck:
      test: ["CMD", "/control-plane", "healthcheck", "http://127.0.0.1:8080/readyz"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 5s

  a2a-router-migrate:
    image: "${NEKIRO_A2A_ROUTER_IMAGE:?NEKIRO_A2A_ROUTER_IMAGE must be set to the prepared immutable image}"
    command: ["migrate", "up"]
    environment:
      NEKIRO_DATABASE_URL: "${NEKIRO_COMPOSE_DATABASE_URL:?NEKIRO_COMPOSE_DATABASE_URL must be set and non-empty}"
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - platform-internal
    restart: "no"

  a2a-router:
    image: "${NEKIRO_A2A_ROUTER_IMAGE:?NEKIRO_A2A_ROUTER_IMAGE must be set to the prepared immutable image}"
    command: ["serve"]
    environment:
      NEKIRO_ROUTER_LISTEN_ADDRESS: "0.0.0.0:8081"
      NEKIRO_ROUTER_SERVICE_PRINCIPALS_JSON: "${NEKIRO_ROUTER_SERVICE_PRINCIPALS_JSON:?NEKIRO_ROUTER_SERVICE_PRINCIPALS_JSON must be set and non-empty}"
      NEKIRO_ROUTER_AGENT_PRINCIPALS_JSON: "${NEKIRO_ROUTER_AGENT_PRINCIPALS_JSON:?NEKIRO_ROUTER_AGENT_PRINCIPALS_JSON must be set and non-empty}"
      NEKIRO_DATABASE_URL: "${NEKIRO_COMPOSE_DATABASE_URL:?NEKIRO_COMPOSE_DATABASE_URL must be set and non-empty}"
      NEKIRO_CONTROL_PLANE_RESOLVE_URL: "http://control-plane:8080/internal/v1/resolve-agent"
      NEKIRO_CONTROL_PLANE_VERSION_URL: "http://control-plane:8080/internal/v1/resolve-installed-version"
      NEKIRO_CONTROL_PLANE_SERVICE_TOKEN: "${NEKIRO_CONTROL_PLANE_SERVICE_TOKEN:?NEKIRO_CONTROL_PLANE_SERVICE_TOKEN must be set and non-empty}"
      NEKIRO_ROUTER_INTERNAL_REQUEST_LIMIT_BYTES: "${NEKIRO_ROUTER_INTERNAL_REQUEST_LIMIT_BYTES:?NEKIRO_ROUTER_INTERNAL_REQUEST_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_ROUTER_AGENT_REQUEST_LIMIT_BYTES: "${NEKIRO_ROUTER_AGENT_REQUEST_LIMIT_BYTES:?NEKIRO_ROUTER_AGENT_REQUEST_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_ROUTER_CONTROL_PLANE_RESPONSE_LIMIT_BYTES: "${NEKIRO_ROUTER_CONTROL_PLANE_RESPONSE_LIMIT_BYTES:?NEKIRO_ROUTER_CONTROL_PLANE_RESPONSE_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_ROUTER_AGENT_RESPONSE_LIMIT_BYTES: "${NEKIRO_ROUTER_AGENT_RESPONSE_LIMIT_BYTES:?NEKIRO_ROUTER_AGENT_RESPONSE_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_ROUTER_A2A_EVENT_LIMIT_BYTES: "${NEKIRO_ROUTER_A2A_EVENT_LIMIT_BYTES:?NEKIRO_ROUTER_A2A_EVENT_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_ROUTER_SSE_EVENT_LIMIT_BYTES: "${NEKIRO_ROUTER_SSE_EVENT_LIMIT_BYTES:?NEKIRO_ROUTER_SSE_EVENT_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_ROUTER_RESOLUTION_DEADLINE_MS: "${NEKIRO_ROUTER_RESOLUTION_DEADLINE_MS:?NEKIRO_ROUTER_RESOLUTION_DEADLINE_MS must be set and non-empty}"
      NEKIRO_ROUTER_AGENT_DEADLINE_MS: "${NEKIRO_ROUTER_AGENT_DEADLINE_MS:?NEKIRO_ROUTER_AGENT_DEADLINE_MS must be set and non-empty}"
      NEKIRO_ROUTER_AGENT_CREDENTIAL_ISSUER: "${NEKIRO_ROUTER_AGENT_CREDENTIAL_ISSUER:?NEKIRO_ROUTER_AGENT_CREDENTIAL_ISSUER must be set and non-empty}"
      NEKIRO_ROUTER_AGENT_CREDENTIAL_KEY_ID: "${NEKIRO_ROUTER_AGENT_CREDENTIAL_KEY_ID:?NEKIRO_ROUTER_AGENT_CREDENTIAL_KEY_ID must be set and non-empty}"
      NEKIRO_ROUTER_AGENT_CREDENTIAL_PRIVATE_KEY_BASE64URL: "${NEKIRO_ROUTER_AGENT_CREDENTIAL_PRIVATE_KEY_BASE64URL:?NEKIRO_ROUTER_AGENT_CREDENTIAL_PRIVATE_KEY_BASE64URL must be set and non-empty}"
      NEKIRO_ROUTER_AGENT_CREDENTIAL_TTL_SECONDS: "${NEKIRO_ROUTER_AGENT_CREDENTIAL_TTL_SECONDS:?NEKIRO_ROUTER_AGENT_CREDENTIAL_TTL_SECONDS must be set and non-empty}"
      NEKIRO_ROUTER_INSTANCE_ROUTING_MODE: "${NEKIRO_ROUTER_INSTANCE_ROUTING_MODE:?NEKIRO_ROUTER_INSTANCE_ROUTING_MODE must be set and non-empty}"
      NEKIRO_ROUTER_NACOS_API_ORIGIN: "http://nacos:8848/nacos"
      NEKIRO_ROUTER_NACOS_NAMESPACE_ID: "nekiro"
      NEKIRO_ROUTER_NACOS_CONFIG_GROUP: "NEKIRO"
      NEKIRO_ROUTER_NACOS_AUTH_MODE: "none"
      NEKIRO_ROUTER_NACOS_RESPONSE_LIMIT_BYTES: "${NEKIRO_ROUTER_NACOS_RESPONSE_LIMIT_BYTES:?NEKIRO_ROUTER_NACOS_RESPONSE_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_ROUTER_NACOS_REQUEST_TIMEOUT_MS: "${NEKIRO_ROUTER_NACOS_REQUEST_TIMEOUT_MS:?NEKIRO_ROUTER_NACOS_REQUEST_TIMEOUT_MS must be set and non-empty}"
      NEKIRO_ROUTER_NACOS_OBSERVE_ENABLED: "true"
      NEKIRO_ROUTER_NACOS_GRPC_TARGET: "nacos:9848"
      NEKIRO_ROUTER_NACOS_GRPC_CLIENT_IP: "172.28.0.10"
      NEKIRO_ROUTER_NACOS_GRPC_REQUEST_TIMEOUT_MS: "${NEKIRO_ROUTER_NACOS_GRPC_REQUEST_TIMEOUT_MS:?NEKIRO_ROUTER_NACOS_GRPC_REQUEST_TIMEOUT_MS must be set and non-empty}"
      NEKIRO_ROUTER_NACOS_PENDING_CHANGES: "${NEKIRO_ROUTER_NACOS_PENDING_CHANGES:?NEKIRO_ROUTER_NACOS_PENDING_CHANGES must be set and non-empty}"
      NEKIRO_ROUTER_NACOS_MAX_OBSERVATIONS: "${NEKIRO_ROUTER_NACOS_MAX_OBSERVATIONS:?NEKIRO_ROUTER_NACOS_MAX_OBSERVATIONS must be set and non-empty}"
      NEKIRO_ROUTER_NACOS_GRPC_TRANSPORT_SECURITY: "insecure"
      NEKIRO_ROUTER_CONFIG_CENTER_FILE_ROOT: "/var/lib/nekiro/config"
      NEKIRO_ROUTER_CONFIG_CENTER_MAX_PAYLOAD_BYTES: "${NEKIRO_ROUTER_CONFIG_CENTER_MAX_PAYLOAD_BYTES:?NEKIRO_ROUTER_CONFIG_CENTER_MAX_PAYLOAD_BYTES must be set and non-empty}"
      NEKIRO_ROUTER_INSTANCE_DIRECTORY_KEY: "${NEKIRO_ROUTER_INSTANCE_DIRECTORY_KEY:?NEKIRO_ROUTER_INSTANCE_DIRECTORY_KEY must be set and non-empty}"
      NEKIRO_ROUTER_INSTANCE_PORT_NAME: "${NEKIRO_ROUTER_INSTANCE_PORT_NAME:?NEKIRO_ROUTER_INSTANCE_PORT_NAME must be set and non-empty}"
    volumes:
      - "${NEKIRO_ROUTER_CONFIG_CENTER_ROOT:?NEKIRO_ROUTER_CONFIG_CENTER_ROOT must be set and non-empty}:/var/lib/nekiro/config"
    ports:
      - "127.0.0.1:${A2A_ROUTER_PORT:?A2A_ROUTER_PORT must be set and non-empty}:8081"
    depends_on:
      a2a-router-migrate:
        condition: service_completed_successfully
      control-plane:
        condition: service_healthy
      nacos-bootstrap:
        condition: service_completed_successfully
    networks:
      platform-internal:
        ipv4_address: 172.28.0.10
      local-access:
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8081/readyz"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 5s

  runtime-b:
    image: "${NEKIRO_RUNTIME_B_IMAGE:?NEKIRO_RUNTIME_B_IMAGE must be set to the prepared immutable image}"
    environment:
      RUNTIME_B_LISTEN_ADDR: "0.0.0.0:8092"
      RUNTIME_B_AGENT_ID: "runtime-b"
      RUNTIME_B_INSTANCE_ID: "runtime-b-primary"
      RUNTIME_B_REGISTRATION_MODE: "disabled"
      RUNTIME_B_ROUTER_URL: "http://a2a-router:8081"
      RUNTIME_B_ROUTER_TOKEN: "${RUNTIME_B_ROUTER_TOKEN:?RUNTIME_B_ROUTER_TOKEN must be set and non-empty}"
      RUNTIME_B_TARGET_AGENT_ID: "runtime-a"
      RUNTIME_B_TARGET_CAPABILITY: "runtime.echo"
      RUNTIME_B_RESPONSE_LIMIT_BYTES: "${RUNTIME_B_RESPONSE_LIMIT_BYTES:?RUNTIME_B_RESPONSE_LIMIT_BYTES must be set and non-empty}"
      RUNTIME_B_EVENT_LIMIT_BYTES: "${RUNTIME_B_EVENT_LIMIT_BYTES:?RUNTIME_B_EVENT_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_AGENT_CHALLENGE_DIRECTORY: "/tmp/nekiro-challenges"
      NEKIRO_AGENT_ROUTER_ISSUER: "${NEKIRO_AGENT_ROUTER_ISSUER:?NEKIRO_AGENT_ROUTER_ISSUER must be set and non-empty}"
      NEKIRO_AGENT_ROUTER_AUDIENCE: "http://runtime-b:8092"
      NEKIRO_AGENT_ROUTER_KEY_ID: "${NEKIRO_AGENT_ROUTER_KEY_ID:?NEKIRO_AGENT_ROUTER_KEY_ID must be set and non-empty}"
      NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL: "${NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL:?NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL must be set and non-empty}"
    depends_on:
      a2a-router:
        condition: service_healthy
    networks:
      - platform-internal
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8092/readyz"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 5s

  runtime-b-directory:
    profiles: ["runtime-registration"]
    image: "${NEKIRO_RUNTIME_B_IMAGE:?NEKIRO_RUNTIME_B_IMAGE must be set to the prepared immutable image}"
    environment:
      RUNTIME_B_LISTEN_ADDR: "0.0.0.0:8092"
      RUNTIME_B_AGENT_ID: "runtime-b"
      RUNTIME_B_INSTANCE_ID: "runtime-b-directory"
      RUNTIME_B_REGISTRATION_MODE: "nacos"
      RUNTIME_B_AGENT_CARD_VERSION: "${RUNTIME_B_AGENT_CARD_VERSION:-}"
      RUNTIME_B_RELEASE_ID: "${RUNTIME_B_RELEASE_ID:-}"
      RUNTIME_B_CARD_DIGEST: "${RUNTIME_B_CARD_DIGEST:-}"
      RUNTIME_B_CANONICAL_ENDPOINT: "${RUNTIME_B_CANONICAL_ENDPOINT:-}"
      RUNTIME_B_AUDIENCE: "${RUNTIME_B_AUDIENCE:-}"
      RUNTIME_B_NACOS_API_ORIGIN: "https://host.docker.internal:${NEKIRO_E2E_NACOS_MTLS_PORT:?NEKIRO_E2E_NACOS_MTLS_PORT must be set and non-empty}/nacos"
      RUNTIME_B_NACOS_NAMESPACE_ID: "nekiro"
      RUNTIME_B_NACOS_GROUP_NAME: "NEKIRO"
      RUNTIME_B_NACOS_SERVICE_NAME: "runtime-b"
      RUNTIME_B_NACOS_CLUSTER_NAME: "DEFAULT"
      RUNTIME_B_NACOS_PORT_NAME: "a2a"
      RUNTIME_B_NACOS_ADVERTISED_IP: "172.28.0.12"
      RUNTIME_B_NACOS_ADVERTISED_PORT: "8092"
      RUNTIME_B_NACOS_WEIGHT: "1"
      RUNTIME_B_NACOS_HEARTBEAT_INTERVAL_MS: "2000"
      RUNTIME_B_NACOS_HEARTBEAT_TIMEOUT_MS: "5000"
      RUNTIME_B_NACOS_IP_DELETE_TIMEOUT_MS: "10000"
      RUNTIME_B_NACOS_REQUEST_TIMEOUT_MS: "3000"
      RUNTIME_B_NACOS_AUTH_MODE: "none"
      RUNTIME_B_NACOS_TLS_CA_FILE: "/var/run/nekiro-nacos-tls/ca.pem"
      RUNTIME_B_NACOS_TLS_SERVER_NAME: "nacos.internal"
      RUNTIME_B_NACOS_TLS_CLIENT_CERT_FILE: "/var/run/nekiro-nacos-tls/client.pem"
      RUNTIME_B_NACOS_TLS_CLIENT_KEY_FILE: "/var/run/nekiro-nacos-tls/client-key.pem"
      RUNTIME_B_ROUTER_URL: "http://a2a-router:8081"
      RUNTIME_B_ROUTER_TOKEN: "${RUNTIME_B_ROUTER_TOKEN:?RUNTIME_B_ROUTER_TOKEN must be set and non-empty}"
      RUNTIME_B_TARGET_AGENT_ID: "runtime-a"
      RUNTIME_B_TARGET_CAPABILITY: "runtime.echo"
      RUNTIME_B_RESPONSE_LIMIT_BYTES: "${RUNTIME_B_RESPONSE_LIMIT_BYTES:?RUNTIME_B_RESPONSE_LIMIT_BYTES must be set and non-empty}"
      RUNTIME_B_EVENT_LIMIT_BYTES: "${RUNTIME_B_EVENT_LIMIT_BYTES:?RUNTIME_B_EVENT_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_AGENT_CHALLENGE_DIRECTORY: "/tmp/nekiro-challenges"
      NEKIRO_AGENT_ROUTER_ISSUER: "${NEKIRO_AGENT_ROUTER_ISSUER:?NEKIRO_AGENT_ROUTER_ISSUER must be set and non-empty}"
      NEKIRO_AGENT_ROUTER_AUDIENCE: "http://runtime-b:8092"
      NEKIRO_AGENT_ROUTER_KEY_ID: "${NEKIRO_AGENT_ROUTER_KEY_ID:?NEKIRO_AGENT_ROUTER_KEY_ID must be set and non-empty}"
      NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL: "${NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL:?NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL must be set and non-empty}"
    depends_on:
      a2a-router:
        condition: service_healthy
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - "${NEKIRO_E2E_TLS_ROOT:?NEKIRO_E2E_TLS_ROOT must be set and non-empty}:/var/run/nekiro-nacos-tls:ro"
    networks:
      platform-internal:
        ipv4_address: 172.28.0.12
      local-access:
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8092/readyz"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 5s

  runtime-b-watch-replacement:
    profiles: ["watch-refresh"]
    image: "${NEKIRO_RUNTIME_B_IMAGE:?NEKIRO_RUNTIME_B_IMAGE must be set to the prepared immutable image}"
    environment:
      RUNTIME_B_LISTEN_ADDR: "0.0.0.0:8092"
      RUNTIME_B_AGENT_ID: "runtime-b"
      RUNTIME_B_INSTANCE_ID: "runtime-b-primary"
      RUNTIME_B_REGISTRATION_MODE: "nacos"
      RUNTIME_B_AGENT_CARD_VERSION: "${RUNTIME_B_AGENT_CARD_VERSION:-}"
      RUNTIME_B_RELEASE_ID: "${RUNTIME_B_RELEASE_ID:-}"
      RUNTIME_B_CARD_DIGEST: "${RUNTIME_B_CARD_DIGEST:-}"
      RUNTIME_B_CANONICAL_ENDPOINT: "${RUNTIME_B_CANONICAL_ENDPOINT:-}"
      RUNTIME_B_AUDIENCE: "${RUNTIME_B_AUDIENCE:-}"
      RUNTIME_B_NACOS_API_ORIGIN: "https://host.docker.internal:${NEKIRO_E2E_NACOS_MTLS_PORT:?NEKIRO_E2E_NACOS_MTLS_PORT must be set and non-empty}/nacos"
      RUNTIME_B_NACOS_NAMESPACE_ID: "nekiro"
      RUNTIME_B_NACOS_GROUP_NAME: "NEKIRO"
      RUNTIME_B_NACOS_SERVICE_NAME: "runtime-b"
      RUNTIME_B_NACOS_CLUSTER_NAME: "DEFAULT"
      RUNTIME_B_NACOS_PORT_NAME: "a2a"
      RUNTIME_B_NACOS_ADVERTISED_IP: "172.28.0.13"
      RUNTIME_B_NACOS_ADVERTISED_PORT: "8092"
      RUNTIME_B_NACOS_WEIGHT: "1"
      RUNTIME_B_NACOS_HEARTBEAT_INTERVAL_MS: "2000"
      RUNTIME_B_NACOS_HEARTBEAT_TIMEOUT_MS: "5000"
      RUNTIME_B_NACOS_IP_DELETE_TIMEOUT_MS: "10000"
      RUNTIME_B_NACOS_REQUEST_TIMEOUT_MS: "3000"
      RUNTIME_B_NACOS_AUTH_MODE: "none"
      RUNTIME_B_NACOS_TLS_CA_FILE: "/var/run/nekiro-nacos-tls/ca.pem"
      RUNTIME_B_NACOS_TLS_SERVER_NAME: "nacos.internal"
      RUNTIME_B_NACOS_TLS_CLIENT_CERT_FILE: "/var/run/nekiro-nacos-tls/client.pem"
      RUNTIME_B_NACOS_TLS_CLIENT_KEY_FILE: "/var/run/nekiro-nacos-tls/client-key.pem"
      RUNTIME_B_ROUTER_URL: "http://a2a-router:8081"
      RUNTIME_B_ROUTER_TOKEN: "${RUNTIME_B_ROUTER_TOKEN:?RUNTIME_B_ROUTER_TOKEN must be set and non-empty}"
      RUNTIME_B_TARGET_AGENT_ID: "runtime-a"
      RUNTIME_B_TARGET_CAPABILITY: "runtime.echo"
      RUNTIME_B_RESPONSE_LIMIT_BYTES: "${RUNTIME_B_RESPONSE_LIMIT_BYTES:?RUNTIME_B_RESPONSE_LIMIT_BYTES must be set and non-empty}"
      RUNTIME_B_EVENT_LIMIT_BYTES: "${RUNTIME_B_EVENT_LIMIT_BYTES:?RUNTIME_B_EVENT_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_AGENT_CHALLENGE_DIRECTORY: "/tmp/nekiro-challenges"
      NEKIRO_AGENT_ROUTER_ISSUER: "${NEKIRO_AGENT_ROUTER_ISSUER:?NEKIRO_AGENT_ROUTER_ISSUER must be set and non-empty}"
      NEKIRO_AGENT_ROUTER_AUDIENCE: "http://runtime-b:8092"
      NEKIRO_AGENT_ROUTER_KEY_ID: "${NEKIRO_AGENT_ROUTER_KEY_ID:?NEKIRO_AGENT_ROUTER_KEY_ID must be set and non-empty}"
      NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL: "${NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL:?NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL must be set and non-empty}"
    depends_on:
      a2a-router:
        condition: service_healthy
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - "${NEKIRO_E2E_TLS_ROOT:?NEKIRO_E2E_TLS_ROOT must be set and non-empty}:/var/run/nekiro-nacos-tls:ro"
    networks:
      platform-internal:
        ipv4_address: 172.28.0.13
      local-access:
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8092/readyz"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 5s

  runtime-a:
    image: "${NEKIRO_RUNTIME_A_IMAGE:?NEKIRO_RUNTIME_A_IMAGE must be set to the prepared immutable image}"
    environment:
      RUNTIME_A_LISTEN_ADDR: "0.0.0.0:8091"
      RUNTIME_A_AGENT_ID: "runtime-a"
      RUNTIME_A_INSTANCE_ID: "runtime-a-primary"
      RUNTIME_A_REGISTRATION_MODE: "disabled"
      RUNTIME_A_ROUTER_URL: "http://a2a-router:8081"
      RUNTIME_A_ROUTER_TOKEN: "${RUNTIME_A_ROUTER_TOKEN:?RUNTIME_A_ROUTER_TOKEN must be set and non-empty}"
      RUNTIME_A_TARGET_AGENT_ID: "runtime-b"
      RUNTIME_A_TARGET_CAPABILITY: "runtime.echo"
      RUNTIME_A_RESPONSE_LIMIT_BYTES: "${RUNTIME_A_RESPONSE_LIMIT_BYTES:?RUNTIME_A_RESPONSE_LIMIT_BYTES must be set and non-empty}"
      RUNTIME_A_EVENT_LIMIT_BYTES: "${RUNTIME_A_EVENT_LIMIT_BYTES:?RUNTIME_A_EVENT_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_AGENT_CHALLENGE_DIRECTORY: "/tmp/nekiro-challenges"
      NEKIRO_AGENT_ROUTER_ISSUER: "${NEKIRO_AGENT_ROUTER_ISSUER:?NEKIRO_AGENT_ROUTER_ISSUER must be set and non-empty}"
      NEKIRO_AGENT_ROUTER_AUDIENCE: "http://runtime-a:8091"
      NEKIRO_AGENT_ROUTER_KEY_ID: "${NEKIRO_AGENT_ROUTER_KEY_ID:?NEKIRO_AGENT_ROUTER_KEY_ID must be set and non-empty}"
      NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL: "${NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL:?NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL must be set and non-empty}"
    depends_on:
      a2a-router:
        condition: service_healthy
      runtime-b:
        condition: service_healthy
    networks:
      platform-internal:
        ipv4_address: 172.28.0.11
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8091/readyz"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 5s

  runtime-a-directory:
    profiles: ["runtime-registration"]
    image: "${NEKIRO_RUNTIME_A_IMAGE:?NEKIRO_RUNTIME_A_IMAGE must be set to the prepared immutable image}"
    environment:
      RUNTIME_A_LISTEN_ADDR: "0.0.0.0:8091"
      RUNTIME_A_AGENT_ID: "runtime-a"
      RUNTIME_A_INSTANCE_ID: "runtime-a-primary"
      RUNTIME_A_REGISTRATION_MODE: "nacos"
      RUNTIME_A_AGENT_CARD_VERSION: "${RUNTIME_A_AGENT_CARD_VERSION:-}"
      RUNTIME_A_RELEASE_ID: "${RUNTIME_A_RELEASE_ID:-}"
      RUNTIME_A_CARD_DIGEST: "${RUNTIME_A_CARD_DIGEST:-}"
      RUNTIME_A_CANONICAL_ENDPOINT: "${RUNTIME_A_CANONICAL_ENDPOINT:-}"
      RUNTIME_A_AUDIENCE: "${RUNTIME_A_AUDIENCE:-}"
      RUNTIME_A_NACOS_API_ORIGIN: "https://host.docker.internal:${NEKIRO_E2E_NACOS_TLS_PORT:?NEKIRO_E2E_NACOS_TLS_PORT must be set and non-empty}/nacos"
      RUNTIME_A_NACOS_NAMESPACE_ID: "nekiro"
      RUNTIME_A_NACOS_GROUP_NAME: "NEKIRO"
      RUNTIME_A_NACOS_SERVICE_NAME: "runtime-a"
      RUNTIME_A_NACOS_CLUSTER_NAME: "DEFAULT"
      RUNTIME_A_NACOS_PORT_NAME: "a2a"
      RUNTIME_A_NACOS_ADVERTISED_IP: "172.28.0.14"
      RUNTIME_A_NACOS_ADVERTISED_PORT: "8091"
      RUNTIME_A_NACOS_WEIGHT: "1"
      RUNTIME_A_NACOS_HEARTBEAT_INTERVAL_MS: "2000"
      RUNTIME_A_NACOS_HEARTBEAT_TIMEOUT_MS: "5000"
      RUNTIME_A_NACOS_IP_DELETE_TIMEOUT_MS: "10000"
      RUNTIME_A_NACOS_REQUEST_TIMEOUT_MS: "3000"
      RUNTIME_A_NACOS_AUTH_MODE: "none"
      RUNTIME_A_NACOS_TLS_CA_FILE: "/var/run/nekiro-nacos-tls/ca.pem"
      RUNTIME_A_NACOS_TLS_SERVER_NAME: "nacos.internal"
      RUNTIME_A_ROUTER_URL: "http://a2a-router:8081"
      RUNTIME_A_ROUTER_TOKEN: "${RUNTIME_A_ROUTER_TOKEN:?RUNTIME_A_ROUTER_TOKEN must be set and non-empty}"
      RUNTIME_A_TARGET_AGENT_ID: "runtime-b"
      RUNTIME_A_TARGET_CAPABILITY: "runtime.echo"
      RUNTIME_A_RESPONSE_LIMIT_BYTES: "${RUNTIME_A_RESPONSE_LIMIT_BYTES:?RUNTIME_A_RESPONSE_LIMIT_BYTES must be set and non-empty}"
      RUNTIME_A_EVENT_LIMIT_BYTES: "${RUNTIME_A_EVENT_LIMIT_BYTES:?RUNTIME_A_EVENT_LIMIT_BYTES must be set and non-empty}"
      NEKIRO_AGENT_CHALLENGE_DIRECTORY: "/tmp/nekiro-challenges"
      NEKIRO_AGENT_ROUTER_ISSUER: "${NEKIRO_AGENT_ROUTER_ISSUER:?NEKIRO_AGENT_ROUTER_ISSUER must be set and non-empty}"
      NEKIRO_AGENT_ROUTER_AUDIENCE: "http://runtime-a:8091"
      NEKIRO_AGENT_ROUTER_KEY_ID: "${NEKIRO_AGENT_ROUTER_KEY_ID:?NEKIRO_AGENT_ROUTER_KEY_ID must be set and non-empty}"
      NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL: "${NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL:?NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL must be set and non-empty}"
    depends_on:
      a2a-router:
        condition: service_healthy
      runtime-b:
        condition: service_healthy
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - "${NEKIRO_E2E_TLS_ROOT:?NEKIRO_E2E_TLS_ROOT must be set and non-empty}:/var/run/nekiro-nacos-tls:ro"
    networks:
      platform-internal:
        ipv4_address: 172.28.0.14
      local-access:
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8091/readyz"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 5s

volumes:
  postgres-data:

networks:
  platform-internal:
    internal: true
    ipam:
      config:
        - subnet: 172.28.0.0/24
  local-access: