# The whole `novox` server's converted service set, installed together on ONE node behind the mesh
# substrate — the whole-catalogue install the rebuild has never actually run. First stage of a
# whole-mesh rehearsal (novox/hq).
#
# Topology, proven by test/integration/assigned-two-node-db.test.ts: the substrate (store, broker,
# control) rides `anchor` and NOTHING else; ALL of novox's services ride the `novox` node — its own
# postgres provider owns 5432 there, so it cannot co-locate with the substrate store on 5432. Both
# machines sit on one public segment and enrol into the one mesh; an overlay is placed so a
# consumer's binding `at` resolves to novox's private address and every consumer reaches the
# providers co-located with it.
#
# The service SET (novox/hq ADR 0039/0048/0052, all converted in mesh-catalog/modules/):
#   providers   postgres redis minio mongodb mssql
#   consumers   keycloak gitea nextcloud umami photos invoicing
#   apps        portainer verdaccio registry route-proxy mailu
#   node-level  firewall fail2ban
#
#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
# The runtimes are built by scripts/build-module-runtime.sh (one per module that has code) and the
# route-proxy image by scripts/build-route-proxy-image.sh; every server image must be in the local
# daemon to be stocked. The test loads each committed module.json from mesh-catalog and rewrites its
# image references to what this scenario's own registry serves by digest.
scenario: whole-mesh-novox

segments:
  hosting:
    kind: public
    cidr: [192.0.2.0/24]

machines:
  # The substrate ONLY: store, broker, control. Nothing else lands here.
  anchor:
    at: { segment: hosting, address: [192.0.2.10] }
    inbound: allow
    memory: 4GiB
    cpus: 4
    disk: 20GiB
  # The whole novox service set — ~38 containers (five providers with runtimes, six consumers with
  # runtimes, portainer/verdaccio/registry/route-proxy, the nine-container Mailu stack and its
  # runtime) plus two node-level modules. mssql alone wants ~2GiB; Mailu, Nextcloud and Keycloak are
  # each heavy. Sized well past the two-node-db bed's second node.
  novox:
    at: { segment: hosting, address: [192.0.2.20] }
    inbound: allow
    memory: 16GiB
    cpus: 8
    # ~14GiB of images are pulled from the scenario's own registry by digest, several of them large
    # (mssql 1.7GiB, invoicing-api 1.9GiB, nextcloud 1.5GiB, umami/mongo ~0.9GiB), plus writable
    # layers and the runtimes. A hundred gigabytes holds the whole set without exhausting the disk
    # mid-apply.
    disk: 100GiB

images:
  # The first-node substrate: store, broker, control. postgres:17-alpine doubles as the postgres
  # provider's own service image (and Mailu's internal admin DB).
  - postgres:17-alpine
  - cloudamqp/lavinmq:latest
  - mesh-control:development
  # The module server images. Each is stocked under the repository path its module.json names, so the
  # test's rewrite (pinned(repositoryFor(image))) finds it.
  - redis:7-alpine
  - minio/minio:latest
  - mongo:7
  - mcr.microsoft.com/mssql/server:2022-latest
  - quay.io/keycloak/keycloak:mesh
  - gitea/gitea:1.22
  - nextcloud:stable
  - ghcr.io/umami-software/umami:postgresql-latest
  - alpine:latest
  - portainer/portainer-ce:latest
  - verdaccio/verdaccio:6
  - registry:2
  - registry-api.novox.be/novox/invoicing-app:latest
  - registry-api.novox.be/novox/invoicing-api:latest
  # The Mailu stack (pulled by digest, tagged :mesh so repositoryFor matches the module.json paths).
  - ghcr.io/mailu/unbound:mesh
  - ghcr.io/mailu/admin:mesh
  - ghcr.io/mailu/dovecot:mesh
  - ghcr.io/mailu/postfix:mesh
  - ghcr.io/mailu/rspamd:mesh
  - ghcr.io/mailu/webmail:mesh
  - ghcr.io/mailu/nginx:mesh
  # The per-module runtimes (built by scripts/build-module-runtime.sh). registry, route-proxy,
  # invoicing, firewall and fail2ban carry no mesh-runtime image; route-proxy ships its own.
  - mesh-runtime-postgres:development
  - mesh-runtime-redis:development
  - mesh-runtime-minio:development
  - mesh-runtime-mongodb:development
  - mesh-runtime-mssql:development
  - mesh-runtime-keycloak:development
  - mesh-runtime-gitea:development
  - mesh-runtime-nextcloud:development
  - mesh-runtime-umami:development
  - mesh-runtime-photos:development
  - mesh-runtime-portainer:development
  - mesh-runtime-verdaccio:development
  - mesh-runtime-mailu:development
  - mesh-route-proxy:development

place:
  all: [host, runtime]