# Meerkat, Enterprise edition, with the DEVELOPER TUNNEL open.
#
#   docker compose -f docker-compose.ee.yml up -d
#
# The tunnel (DEV-11) plugs a developer's machine into this stack: a service
# they run on their laptop answers, for them, under its cluster name, and the
# other services keep talking to it as if it were still deployed. It is the
# plug agent (https://github.com/softwarity/plug) compiled INTO the gateway.
#
# Three things have to be true for it to open:
#
#   1. the tunnel is switched on (Infra, Plug in the console - it ships OFF;
#      the page also hands out the install commands per OS);
#   2. developer mode is on (Application, General - it is on by default);
#   3. the gateway can reach an orchestrator AND is a container that
#      orchestrator knows - which is what the socket below grants.
#
# Where it cannot work, it does not open a port: it writes one line saying
# which resource it lacks, and the gateway serves as usual.
services:
  meerkat:
    # MEERKAT_IMAGE picks another edition or a pinned version without editing
    # this file: softwarity/meerkat:eval, or the image built for your licence.
    image: ${MEERKAT_IMAGE:-ghcr.io/softwarity/meerkat:latest}
    ports:
      - "8080:8080" # application plane
      - "9090:9090" # control plane (admin console) - keep this one internal
      # 7070, the internal plane, is left unpublished on purpose: the services
      # on this network call it by name (http://meerkat:7070).
      # The developer tunnel. Which port you publish is yours to choose; the
      # gateway listens on 22222 inside. Publish it where your developers can
      # reach it, and nowhere else.
      - "22222:22222"
    environment:
      MEERKAT_ADMIN_PASSWORD: ${MEERKAT_ADMIN_PASSWORD:?set a password for the first admin}
    volumes:
      - meerkat-data:/data
      # What lets the agent give a name to a developer's machine: it creates a
      # small signpost container carrying the DNS alias, for the length of the
      # session. Without this mount the gateway runs exactly as before and the
      # tunnel simply says it cannot start.
      #
      # The same socket feeds the route editor's discovery and the routes
      # screen (whether each target runs, and on which image, from Docker's
      # events). Without the tunnel, prefer the read-only proxy of
      # docker-compose.yml to this mount.
      #
      # It is a real grant: whoever can act as this container can act on this
      # Docker daemon. Mount it on the clusters your developers already trust,
      # not in front of customers.
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped

volumes:
  meerkat-data: