docker-compose.yml

services:
  # DEV ONLY: Uses trusted dealer key generation (generate_with_dealer).
  # Production deployments MUST use the DKG ceremony (dkg_coordinator + dkg_participant).
  # See README section "Production Key Generation" for the ceremony procedure.
  certgen:
    build:
      context: .
      dockerfile: Dockerfile
    command:
      [
        "/bin/sh",
        "-lc",
        "set -e; \
         if [ -f /certs/ca_cert.pem ]; then echo 'certs already exist, skipping'; exit 0; fi; \
         keygen --threshold=2 --signers=3 --output-dir=/keys; \
         certgen ca --output-dir /certs --common-name arcmint-internal-ca; \
         certgen server --output-dir /certs --common-name signer-1 --san-dns signer-1 --san-ip 127.0.0.1 --ca-cert /certs/ca_cert.pem --ca-key /certs/ca_key.pem; \
         certgen server --output-dir /certs --common-name signer-2 --san-dns signer-2 --san-ip 127.0.0.1 --ca-cert /certs/ca_cert.pem --ca-key /certs/ca_key.pem; \
         certgen server --output-dir /certs --common-name signer-3 --san-dns signer-3 --san-ip 127.0.0.1 --ca-cert /certs/ca_cert.pem --ca-key /certs/ca_key.pem; \
         certgen server --output-dir /certs --common-name coordinator --san-dns coordinator --san-ip 127.0.0.1 --ca-cert /certs/ca_cert.pem --ca-key /certs/ca_key.pem; \
         certgen server --output-dir /certs --common-name gateway --san-dns gateway --san-ip 127.0.0.1 --ca-cert /certs/ca_cert.pem --ca-key /certs/ca_key.pem; \
         certgen server --output-dir /certs --common-name lnd --san-dns lnd --san-ip 127.0.0.1 --ca-cert /certs/ca_cert.pem --ca-key /certs/ca_key.pem; \
         certgen server --output-dir /certs --common-name lnd-2 --san-dns lnd-2 --san-ip 127.0.0.1 --ca-cert /certs/ca_cert.pem --ca-key /certs/ca_key.pem; \
         certgen client --output-dir /certs --common-name arcmint-coordinator --ca-cert /certs/ca_cert.pem --ca-key /certs/ca_key.pem; \
         certgen client --output-dir /certs --common-name arcmint-gateway --ca-cert /certs/ca_cert.pem --ca-key /certs/ca_key.pem",
      ]
    volumes:
      - frost-keys:/keys
      - tls-certs:/certs
    restart: "no"

  signer-1:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE_BIN: arcmint-federation
    environment:
      FEDERATION_PORT: "7001"
      FEDERATION_DB: /var/lib/arcmint/federation.db?mode=rwc
      FROST_KEY_FILE: /keys/signer_1_key.json
      FROST_PUBKEY_FILE: /keys/public_key.json
      SIGNER_ID: "1"
      COORDINATOR_SECRET: ${COORDINATOR_SECRET}
      BIND_ADDR: "0.0.0.0"
      TLS_CERT_FILE: /certs/signer-1_cert.pem
      TLS_KEY_FILE: /certs/signer-1_key.pem
      TLS_CA_FILE: /certs/ca_cert.pem
      COORDINATOR_CN: arcmint-coordinator
    volumes:
      - signer1-db:/var/lib/arcmint
      - frost-keys:/keys:ro
      - tls-certs:/certs:ro
    depends_on:
      certgen:
        condition: service_completed_successfully
    ports:
      - "${SIGNER1_PORT:-7001}:7001"
      - "9001:7001"
    healthcheck:
      test: ["CMD", "curl", "-k", "--cacert", "/certs/ca_cert.pem", "--cert", "/certs/arcmint-coordinator_cert.pem", "--key", "/certs/arcmint-coordinator_key.pem", "-f", "https://localhost:7001/health"]
      interval: 5s
      timeout: 3s
      retries: 10

  signer-2:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE_BIN: arcmint-federation
    environment:
      FEDERATION_PORT: "7002"
      FEDERATION_DB: /var/lib/arcmint/federation.db?mode=rwc
      FROST_KEY_FILE: /keys/signer_2_key.json
      FROST_PUBKEY_FILE: /keys/public_key.json
      SIGNER_ID: "2"
      COORDINATOR_SECRET: ${COORDINATOR_SECRET}
      BIND_ADDR: "0.0.0.0"
      TLS_CERT_FILE: /certs/signer-2_cert.pem
      TLS_KEY_FILE: /certs/signer-2_key.pem
      TLS_CA_FILE: /certs/ca_cert.pem
      COORDINATOR_CN: arcmint-coordinator
    volumes:
      - signer2-db:/var/lib/arcmint
      - frost-keys:/keys:ro
      - tls-certs:/certs:ro
    depends_on:
      certgen:
        condition: service_completed_successfully
    ports:
      - "${SIGNER2_PORT:-7002}:7002"
      - "9002:7002"
    healthcheck:
      test: ["CMD", "curl", "-k", "--cacert", "/certs/ca_cert.pem", "--cert", "/certs/arcmint-coordinator_cert.pem", "--key", "/certs/arcmint-coordinator_key.pem", "-f", "https://localhost:7002/health"]
      interval: 5s
      timeout: 3s
      retries: 10

  signer-3:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE_BIN: arcmint-federation
    environment:
      FEDERATION_PORT: "7003"
      FEDERATION_DB: /var/lib/arcmint/federation.db?mode=rwc
      FROST_KEY_FILE: /keys/signer_3_key.json
      FROST_PUBKEY_FILE: /keys/public_key.json
      SIGNER_ID: "3"
      COORDINATOR_SECRET: ${COORDINATOR_SECRET}
      BIND_ADDR: "0.0.0.0"
      TLS_CERT_FILE: /certs/signer-3_cert.pem
      TLS_KEY_FILE: /certs/signer-3_key.pem
      TLS_CA_FILE: /certs/ca_cert.pem
      COORDINATOR_CN: arcmint-coordinator
    volumes:
      - signer3-db:/var/lib/arcmint
      - frost-keys:/keys:ro
      - tls-certs:/certs:ro
    depends_on:
      certgen:
        condition: service_completed_successfully
    ports:
      - "${SIGNER3_PORT:-7003}:7003"
      - "9003:7003"
    healthcheck:
      test: ["CMD", "curl", "-k", "--cacert", "/certs/ca_cert.pem", "--cert", "/certs/arcmint-coordinator_cert.pem", "--key", "/certs/arcmint-coordinator_key.pem", "-f", "https://localhost:7003/health"]
      interval: 5s
      timeout: 3s
      retries: 10

  coordinator:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE_BIN: coordinator
    environment:
      COORDINATOR_PORT: "7000"
      SIGNER_URLS: "https://signer-1:7001,https://signer-2:7002,https://signer-3:7003"
      FROST_PUBKEY_FILE: /keys/public_key.json
      COORDINATOR_SECRET: ${COORDINATOR_SECRET}
      GATEWAY_RESOLVE_URL: "https://gateway:7002/resolve"
      ANCHOR_INTERVAL_SECS: "600"
      COORDINATOR_TLS_CERT: /certs/coordinator_cert.pem
      COORDINATOR_TLS_KEY: /certs/coordinator_key.pem
      GATEWAY_CLIENT_CA: /certs/ca_cert.pem
      COORDINATOR_CLIENT_CERT: /certs/arcmint-coordinator_cert.pem
      COORDINATOR_CLIENT_KEY: /certs/arcmint-coordinator_key.pem
      INTERNAL_CA_FILE: /certs/ca_cert.pem
      GATEWAY_CN: arcmint-gateway
      OPERATOR_SECRET: ${OPERATOR_SECRET}
      BIND_ADDR: "0.0.0.0"
      LND_HOST: lnd
      LND_PORT: "10009"
      LND_TLS_CERT: /certs/ca_cert.pem
      LND_MACAROON: /root/.lnd/data/chain/bitcoin/regtest/admin.macaroon
      BITCOIN_NETWORK: regtest
      BITCOIN_RPC_URL: ${BITCOIN_RPC_URL:-http://bitcoind:18443}
      BITCOIN_RPC_USER: ${BITCOIN_RPC_USER}
      BITCOIN_RPC_PASS: ${BITCOIN_RPC_PASS}
      BITCOIN_WALLET_NAME: ${BITCOIN_WALLET_NAME:-anchor}
      ANCHOR_WALLET_WIF: ${ANCHOR_WALLET_WIF}
      ANCHOR_CHANGE_ADDRESS: ${ANCHOR_CHANGE_ADDRESS}
      ANCHOR_FEE_TARGET_BLOCKS: ${ANCHOR_FEE_TARGET_BLOCKS:-3}
      ANCHOR_INTERVAL_BLOCKS: ${ANCHOR_INTERVAL_BLOCKS:-6}
      ANCHOR_MIN_CONFIRMATIONS: ${ANCHOR_MIN_CONFIRMATIONS:-1}
      COORDINATOR_DB: /data/coordinator.db?mode=rwc
      RUST_BACKTRACE: 1
      RUST_LOG: debug
    volumes:
      - coordinator-data:/data
      - frost-keys:/keys:ro
      - tls-certs:/certs:ro
      - lnd-data:/root/.lnd:ro
    depends_on:
      certgen:
        condition: service_completed_successfully
      lnd-init:
        condition: service_completed_successfully
      lnd-channel-setup:
        condition: service_completed_successfully
    ports:
      - "${COORDINATOR_PORT:-7000}:7000"
      - "9004:7000"
    healthcheck:
      test: ["CMD", "curl", "-k", "--cert", "/certs/arcmint-coordinator_cert.pem", "--key", "/certs/arcmint-coordinator_key.pem", "-f", "https://localhost:7000/health"]
      interval: 10s
      timeout: 5s
      retries: 10

  dkg-coordinator:
    profiles: ["dkg"]
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE_BIN: dkg_coordinator
    environment:
      DKG_PORT: "${DKG_PORT:-7100}"
      DKG_OPERATOR_TOKENS: ${DKG_OPERATOR_TOKENS}
      DKG_TLS_CERT: /certs/dkg_coordinator_cert.pem
      DKG_TLS_KEY: /certs/dkg_coordinator_key.pem
      DKG_CA_FILE: /certs/ca_cert.pem
    volumes:
      - tls-certs:/certs:ro
      - dkg-output:/output
    depends_on:
      certgen:
        condition: service_completed_successfully
    ports:
      - "${DKG_PORT:-7100}:${DKG_PORT:-7100}"
    restart: "no"

  gateway:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE_BIN: arcmint-gateway
    environment:
      GATEWAY_PORT: "7002"
      GATEWAY_DB: /var/lib/arcmint/gateway.db?mode=rwc
      GATEWAY_SECRET: ${GATEWAY_SECRET}
      FEDERATION_SECRET: ${FEDERATION_SECRET}
      GATEWAY_CLIENT_CERT: /certs/arcmint-gateway_cert.pem
      GATEWAY_CLIENT_KEY: /certs/arcmint-gateway_key.pem
      INTERNAL_CA_FILE: /certs/ca_cert.pem
      TLS_CERT_FILE: /certs/gateway_cert.pem
      TLS_KEY_FILE: /certs/gateway_key.pem
      ACME_DOMAIN: ""
      OPERATOR_SECRET: ${OPERATOR_SECRET}
      BIND_ADDR: "0.0.0.0"
    volumes:
      - gateway-db:/var/lib/arcmint
      - tls-certs:/certs:ro
    depends_on:
      coordinator:
        condition: service_healthy
    ports:
      - "${GATEWAY_PORT:-7004}:7002"
      - "9005:7002"
    healthcheck:
      test: ["CMD", "curl", "-k", "--cacert", "/certs/ca_cert.pem", "-f", "https://localhost:7002/health"]
      interval: 5s
      timeout: 3s
      retries: 10

  merchant:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE_BIN: arcmint-merchant
    environment:
      MERCHANT_PORT: "7003"
      MERCHANT_DB: /var/lib/arcmint/merchant.db?mode=rwc
      COORDINATOR_URL: "https://coordinator:7000"
      FROST_PUBKEY_FILE: /keys/public_key.json
      TLS_CERT_FILE: /certs/coordinator_cert.pem
      TLS_KEY_FILE: /certs/coordinator_key.pem
      INTERNAL_CA_FILE: /certs/ca_cert.pem
      OPERATOR_SECRET: ${OPERATOR_SECRET}
      BIND_ADDR: "0.0.0.0"
    volumes:
      - merchant-db:/var/lib/arcmint
      - frost-keys:/keys:ro
      - tls-certs:/certs:ro
    depends_on:
      coordinator:
        condition: service_healthy
    ports:
      - "${MERCHANT_PORT:-7005}:7003"
      - "9006:7003"
    healthcheck:
      test: ["CMD", "curl", "-k", "--cacert", "/certs/ca_cert.pem", "-f", "https://localhost:7003/health"]
      interval: 5s
      timeout: 3s
      retries: 10

  arcmint-adversary:
    profiles: ["adversary"]
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE_BIN: arcmint-adversary
    environment:
      COORDINATOR_URL: "https://coordinator:7000"
      GATEWAY_URL: "https://gateway:7002"
      MERCHANT_URL: "https://merchant:7003"
      SIGNER_URLS: "https://signer-1:7001,https://signer-2:7002,https://signer-3:7003"
      TLS_CA_FILE: /certs/ca_cert.pem
    volumes:
      - tls-certs:/certs:ro
      - adversary-output:/adversary-output
    depends_on:
      coordinator:
        condition: service_healthy
      gateway:
        condition: service_healthy
      merchant:
        condition: service_healthy
    command: >
      arcmint-adversary
      --coordinator-url ${COORDINATOR_URL:-https://coordinator:7000}
      --gateway-url ${GATEWAY_URL:-https://gateway:7002}
      --merchant-url ${MERCHANT_URL:-https://merchant:7003}
      --signer-urls ${SIGNER_URLS:-https://signer-1:7001,https://signer-2:7002,https://signer-3:7003}
      --ca-cert /certs/ca_cert.pem
      --output /adversary-output/report.json
      run-all

  bitcoind:
    image: lncm/bitcoind:v26.0
    restart: unless-stopped
    volumes:
      - bitcoind-data:/data/.bitcoin
    environment:
      - BITCOIN_NETWORK=regtest
    command: >
      -regtest
      -rpcuser=${BITCOIN_RPC_USER}
      -rpcpassword=${BITCOIN_RPC_PASS}
      -rpcallowip=0.0.0.0/0
      -rpcbind=0.0.0.0
      -zmqpubrawblock=tcp://0.0.0.0:28332
      -zmqpubrawtx=tcp://0.0.0.0:28333
      -fallbackfee=0.0002
      -txindex=1
    healthcheck:
      test: ["CMD", "bitcoin-cli", "-regtest", "-rpcuser=${BITCOIN_RPC_USER}", "-rpcpassword=${BITCOIN_RPC_PASS}", "getblockchaininfo"]
      interval: 10s
      timeout: 5s
      retries: 10
    ports:
      - "18443:18443"

  lnd:
    image: lightninglabs/lnd:v0.17.4-beta
    restart: unless-stopped
    depends_on:
      bitcoind:
        condition: service_healthy
      certgen:
        condition: service_completed_successfully
    volumes:
      - lnd-data:/root/.lnd
      - lnd-init:/lnd-init
      - tls-certs:/certs:ro
    environment:
      - BITCOIN_NETWORK=regtest
    command: >
      --bitcoin.active
      --bitcoin.regtest
      --bitcoin.node=bitcoind
      --bitcoind.rpchost=bitcoind:18443
      --bitcoind.rpcuser=${BITCOIN_RPC_USER}
      --bitcoind.rpcpass=${BITCOIN_RPC_PASS}
      --bitcoind.zmqpubrawblock=tcp://bitcoind:28332
      --bitcoind.zmqpubrawtx=tcp://bitcoind:28333
      --rpclisten=0.0.0.0:10009
      --restlisten=0.0.0.0:8080
      --noseedbackup
      --debuglevel=info
      --tlscertpath=/certs/lnd_cert.pem
      --tlskeypath=/certs/lnd_key.pem
    healthcheck:
      test: ["CMD", "lncli", "--network=regtest", "--rpcserver=lnd:10009", "--tlscertpath=/certs/lnd_cert.pem", "getinfo"]
      interval: 10s
      timeout: 5s
      retries: 20
    ports:
      - "8080:8080"

  lnd-2:
    image: lightninglabs/lnd:v0.17.4-beta
    restart: unless-stopped
    depends_on:
      bitcoind:
        condition: service_healthy
      certgen:
        condition: service_completed_successfully
    volumes:
      - lnd-2-data:/root/.lnd
      - tls-certs:/certs:ro
    environment:
      - BITCOIN_NETWORK=regtest
    command: >
      --bitcoin.active
      --bitcoin.regtest
      --bitcoin.node=bitcoind
      --bitcoind.rpchost=bitcoind:18443
      --bitcoind.rpcuser=${BITCOIN_RPC_USER}
      --bitcoind.rpcpass=${BITCOIN_RPC_PASS}
      --bitcoind.zmqpubrawblock=tcp://bitcoind:28332
      --bitcoind.zmqpubrawtx=tcp://bitcoind:28333
      --rpclisten=0.0.0.0:10009
      --restlisten=0.0.0.0:8080
      --noseedbackup
      --debuglevel=info
      --tlscertpath=/certs/lnd-2_cert.pem
      --tlskeypath=/certs/lnd-2_key.pem
    healthcheck:
      test: ["CMD", "lncli", "--network=regtest", "--rpcserver=lnd-2:10009", "--tlscertpath=/certs/lnd-2_cert.pem", "getinfo"]
      interval: 10s
      timeout: 5s
      retries: 20

  lnd-init:
    image: lightninglabs/lnd:v0.17.4-beta
    restart: "no"
    depends_on:
      lnd:
        condition: service_healthy
    volumes:
      - lnd-data:/root/.lnd
      - lnd-init:/lnd-init
      - tls-certs:/certs:ro
    entrypoint:
      - /bin/sh
      - -c
      - |
        set -e
        # Wait for lnd to be ready (although depends_on helps)
        sleep 5
        lncli --network=regtest --rpcserver=lnd:10009 --tlscertpath=/certs/ca_cert.pem --macaroonpath=/root/.lnd/data/chain/bitcoin/regtest/admin.macaroon newaddress p2wkh > /lnd-init/address.txt
        ADDR=$$(grep "address" /lnd-init/address.txt | cut -d'"' -f4)
        echo "Funding LND wallet at: $$ADDR"
        
        # Loop until funding succeeds (wallet must be created and have funds)
        while :; do
            # Try to send 1 BTC.
            # We grep for "error":null to confirm success.
            OUTPUT=$$(curl -s --user ${BITCOIN_RPC_USER}:${BITCOIN_RPC_PASS} --data-binary "{\"jsonrpc\":\"1.0\",\"id\":\"fund\",\"method\":\"sendtoaddress\",\"params\":[\"$$ADDR\",1.0]}" -H 'content-type: text/plain;' http://bitcoind:18443/)
            echo "Attempting funding: $$OUTPUT"
            if echo "$$OUTPUT" | grep -q '"error":null'; then
                 echo "Funding successful."
                 break
            fi
            echo "Funding failed (waiting for wallet/funds)... sleeping 5s"
            sleep 5
        done

        # Mine 1 block to confirm
        curl --user ${BITCOIN_RPC_USER}:${BITCOIN_RPC_PASS} --data-binary "{\"jsonrpc\":\"1.0\",\"id\":\"mine\",\"method\":\"generatetoaddress\",\"params\":[1,\"$$ADDR\"]}" -H 'content-type: text/plain;' http://bitcoind:18443/
        sleep 3
        echo "LND init complete"

  lnd-channel-setup:
    image: lightninglabs/lnd:v0.17.4-beta
    restart: "no"
    depends_on:
      lnd:
        condition: service_healthy
      lnd-2:
        condition: service_healthy
      lnd-init:
        condition: service_completed_successfully
    volumes:
      - lnd-data:/root/.lnd
      - lnd-2-data:/lnd-2
      - tls-certs:/certs:ro
    entrypoint:
      - /bin/sh
      - -c
      - |
        set -e
        # Wait for lnd-2 to be ready and get its pubkey
        echo "Fetching lnd-2 pubkey..."
        # We need to wait a bit more for lnd-2 to be fully ready to accept RPC
        sleep 10
        LND2_PUBKEY=$$(lncli --network=regtest --rpcserver=lnd-2:10009 --tlscertpath=/certs/lnd-2_cert.pem --macaroonpath=/lnd-2/data/chain/bitcoin/regtest/admin.macaroon getinfo | grep identity_pubkey | cut -d'"' -f4)
        echo "LND-2 Pubkey: $$LND2_PUBKEY"
        
        # Connect to lnd-2 first
        echo "Connecting to lnd-2..."
        lncli --network=regtest --rpcserver=lnd:10009 --tlscertpath=/certs/ca_cert.pem --macaroonpath=/root/.lnd/data/chain/bitcoin/regtest/admin.macaroon connect $$LND2_PUBKEY@lnd-2:9735 || echo "Connection already exists or failed, proceeding..."
        
        # Check if channel already exists
        ACTIVE=$$(lncli --network=regtest --rpcserver=lnd:10009 --tlscertpath=/certs/ca_cert.pem --macaroonpath=/root/.lnd/data/chain/bitcoin/regtest/admin.macaroon listchannels | grep -c channel_point || true)
        if [ "$$ACTIVE" -gt "0" ]; then
          echo "Channel already active, skipping open"
        else
          echo "Opening channel to lnd-2..."
          lncli --network=regtest --rpcserver=lnd:10009 --tlscertpath=/certs/ca_cert.pem --macaroonpath=/root/.lnd/data/chain/bitcoin/regtest/admin.macaroon openchannel --node_key=$$LND2_PUBKEY --local_amt=10000000 --push_amt=5000000 --sat_per_vbyte=1 --block=false || echo "openchannel failed, proceeding to mine"
        fi
        
        # Mine 6 blocks to confirm the channel
        echo "Mining 6 blocks to confirm channel..."
        # Use curl because bitcoin-cli is not available in lnd image
        curl --user ${BITCOIN_RPC_USER}:${BITCOIN_RPC_PASS} --data-binary "{\"jsonrpc\": \"1.0\", \"id\": \"confirm_channel\", \"method\": \"generatetoaddress\", \"params\": [6, \"bcrt1q3sck5rg043qnz98mtfx74dcctv7sukkkl9e35h\"]}" -H 'content-type: text/plain;' http://bitcoind:18443/
        
        echo "LND channel setup complete"

  miner:
    image: lncm/bitcoind:v26.0
    restart: unless-stopped
    entrypoint:
      - /bin/sh
      - -c
      - |
        set -e
        # Wait for bitcoind to be ready (although depends_on helps, explicit wait is safer)
        sleep 5
        bitcoin-cli -regtest -rpcconnect=bitcoind -rpcuser=${BITCOIN_RPC_USER} -rpcpassword=${BITCOIN_RPC_PASS} createwallet miner || true
        ADDR=$$(bitcoin-cli -regtest -rpcconnect=bitcoind -rpcuser=${BITCOIN_RPC_USER} -rpcpassword=${BITCOIN_RPC_PASS} getnewaddress)

        # Burst mine if needed to mature coins (coinbase requires 100 confirmations)
        HEIGHT=$$(bitcoin-cli -regtest -rpcconnect=bitcoind -rpcuser=${BITCOIN_RPC_USER} -rpcpassword=${BITCOIN_RPC_PASS} getblockcount)
        if [ "$$HEIGHT" -lt 101 ]; then
           echo "Burst mining 101 blocks to mature coinbase..."
           bitcoin-cli -regtest -rpcconnect=bitcoind -rpcuser=${BITCOIN_RPC_USER} -rpcpassword=${BITCOIN_RPC_PASS} generatetoaddress 101 $$ADDR
        fi

        while true; do
          bitcoin-cli -regtest -rpcconnect=bitcoind -rpcuser=${BITCOIN_RPC_USER} -rpcpassword=${BITCOIN_RPC_PASS} generatetoaddress 1 $$ADDR
          sleep 10
        done

  prometheus:
    profiles: ["monitoring"]
    image: prom/prometheus:v2.48.0
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    command: --config.file=/etc/prometheus/prometheus.yml --storage.tsdb.retention.time=15d
    ports:
      - "9090:9090"

  grafana:
    profiles: ["monitoring"]
    image: grafana/grafana:10.2.0
    depends_on:
      - prometheus
    volumes:
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./monitoring/grafana/dashboards:/var/lib/grafana/dashboards:ro
      - grafana-data:/var/lib/grafana
    environment:
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH: /var/lib/grafana/dashboards/arcmint-security.json
    ports:
      - "3000:3000"

  arcmint-loadtest:
    profiles: ["loadtest"]
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE_BIN: arcmint-loadtest
    depends_on:
      coordinator:
        condition: service_healthy
      gateway:
        condition: service_healthy
      merchant:
        condition: service_healthy
      lnd-init:
        condition: service_completed_successfully
    volumes:
      - tls-certs:/certs:ro
      - loadtest-output:/output
      - lnd-data:/root/.lnd:ro
      - lnd-2-data:/lnd-2:ro
    environment:
      COORDINATOR_URL: "https://coordinator:7000"
      GATEWAY_URL: "https://gateway:7002"
      MERCHANT_URL: "https://merchant:7003"
      SIGNER_URLS: "https://signer-1:7001,https://signer-2:7002,https://signer-3:7003"
      CA_CERT_PATH: /certs/ca_cert.pem
      OUTPUT: /output/report.json
      # LND Credentials for real testing
      LND1_HOST: "lnd"
      LND1_PORT: "8080"
      LND1_MACAROON_PATH: "/root/.lnd/data/chain/bitcoin/regtest/admin.macaroon"
      LND1_TLS_PATH: "/certs/lnd_cert.pem"
      LND2_HOST: "lnd-2"
      LND2_PORT: "8080"
      LND2_MACAROON_PATH: "/lnd-2/data/chain/bitcoin/regtest/admin.macaroon"
      LND2_TLS_PATH: "/certs/lnd-2_cert.pem"
    command: >
      arcmint-loadtest
      run-all

  arcmint-monitor:
    profiles: ["monitor"]
    build:
      context: .
      dockerfile: Dockerfile
      args:
        SERVICE_BIN: arcmint-monitor
    network_mode: host
    environment:
      BITCOIN_RPC_URL: "http://127.0.0.1:8332"
      BITCOIN_RPC_USER: ${BITCOIN_RPC_USER}
      BITCOIN_RPC_PASS: ${BITCOIN_RPC_PASS}
      COORDINATOR_URL: "https://127.0.0.1:7000"
      GATEWAY_URL: "https://127.0.0.1:7002"
      MERCHANT_URL: "https://127.0.0.1:7003"
      SIGNER_URLS: "https://127.0.0.1:7001,https://127.0.0.1:7004,https://127.0.0.1:7005"
      OPERATOR_SECRET: ${OPERATOR_SECRET}
      MONITOR_REFRESH_SECS: "10"
    stdin_open: true
    tty: true

volumes:
  signer1-db:
  signer2-db:
  signer3-db:
  gateway-db:
  merchant-db:
  frost-keys:
  tls-certs:
  bitcoind-data:
  lnd-data:
  lnd-2-data:
  lnd-init:
  dkg-output:
  prometheus-data:
  grafana-data:
  loadtest-output:
  coordinator-data: