# The whole `novox` server's converted service set, installed together on ONE node behind the mesh
# foundation — the whole-catalogue install the rebuild has never actually run. First stage of a
# whole-mesh rehearsal (novox/hq).
#
# Topology, proven by test/integration/assigned-two-node-db.test.ts: the foundation (store, broker,
# control) rides `anchor` and NOTHING else; ALL of novox's services ride the `novox` node — its own
# postgres provider owns 5432 there, so it cannot co-locate with the foundation store on 5432. Both
# machines sit on one public segment and enrol into the one mesh; an overlay is placed so a
# consumer's binding `at` resolves to novox's private address and every consumer reaches the
# providers co-located with it.
#
# The service SET (novox/hq ADR 0039/0048/0052, all converted in mesh-catalog/modules/):
#   providers   postgres redis minio mongodb mssql
#   consumers   keycloak gitea nextcloud umami photos invoicing
#   apps        portainer verdaccio registry route-proxy mailu
#   node-level  firewall fail2ban
#
#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
# The runtimes are built by scripts/build-module-runtime.sh (one per module that has code) and the
# route-proxy image by scripts/build-route-proxy-image.sh; those must be in the local daemon,
# because nothing serves them and nothing can. Every third-party image is pulled from the internet
# over each node's uplink. The test loads each committed module.json from mesh-catalog and rewrites
# only OUR image references, to the ID the machine holds each one under.
scenario: whole-mesh-novox

segments:
  hosting:
    kind: public
    cidr: [192.0.2.0/24]

machines:
  # The foundation ONLY: store, broker, control. Nothing else lands here.
  anchor:
    at: { segment: hosting, address: [192.0.2.10] }
    egress: true
    inbound: allow
    memory: 4GiB
    cpus: 4
    disk: 20GiB
    # The foundation only, so the control plane's image only. Handing this machine the whole set of
    # runtimes would fill a 20GiB disk with images nothing on it will ever start.
    images: [mesh-controller:development]
  # The whole novox service set — ~38 containers (five providers with runtimes, six consumers with
  # runtimes, portainer/verdaccio/registry/route-proxy, the nine-container Mailu stack and its
  # runtime) plus two node-level modules. mssql alone wants ~2GiB; Mailu, Nextcloud and Keycloak are
  # each heavy. Sized well past the two-node-db bed's second node.
  novox:
    at: { segment: hosting, address: [192.0.2.20] }
    egress: true
    inbound: allow
    memory: 16GiB
    cpus: 8
    # ~14GiB of images are pulled from the internet over the uplink, several of them large
    # (mssql 1.7GiB, invoicing-api 1.9GiB, nextcloud 1.5GiB, umami/mongo ~0.9GiB), plus writable
    # layers and the runtimes. A hundred gigabytes holds the whole set without exhausting the disk
    # mid-apply.
    disk: 100GiB
    # Every runtime, and the proxy. Not mesh-controller: the control plane runs on the anchor.
    images:
      - mesh-runtime-postgres:development
      - mesh-runtime-redis:development
      - mesh-runtime-minio:development
      - mesh-runtime-mongodb:development
      - mesh-runtime-mssql:development
      - mesh-runtime-keycloak:development
      - mesh-runtime-gitea:development
      - mesh-runtime-nextcloud:development
      - mesh-runtime-umami:development
      - mesh-runtime-photos:development
      - mesh-runtime-portainer:development
      - mesh-runtime-verdaccio:development
      - mesh-runtime-mailu:development
      - mesh-route-proxy:development

images:
  - mesh-controller:development
  # The per-module runtimes (built by scripts/build-module-runtime.sh). registry, route-proxy,
  # invoicing, firewall and fail2ban carry no mesh-runtime image; route-proxy ships its own.
  - mesh-runtime-postgres:development
  - mesh-runtime-redis:development
  - mesh-runtime-minio:development
  - mesh-runtime-mongodb:development
  - mesh-runtime-mssql:development
  - mesh-runtime-keycloak:development
  - mesh-runtime-gitea:development
  - mesh-runtime-nextcloud:development
  - mesh-runtime-umami:development
  - mesh-runtime-photos:development
  - mesh-runtime-portainer:development
  - mesh-runtime-verdaccio:development
  - mesh-runtime-mailu:development
  - mesh-route-proxy:development

place:
  all: [host, runtime]