# One machine that becomes a mesh and is then assigned confluence — a tools-only, outbound-only
# external-SaaS integration (novox/hq ADR 0039), the same shape gitlab proved. confluence has NO
# service container, NO listener, NO provisioner — just a broker-bound runtime that serves the
# module's Confluence tools under a scoped account. It only ever calls out to a Confluence instance.
#
# The sharp point this bed proves is the Servarr lesson: the runtime MUST come up and serve its full
# tool surface even with NO valid Confluence credentials — the lab has no real Confluence, and
# confluence's own token is a mesh-minted own-secret that points at nothing. confluence's client is
# built lazily and never throws at registration, so the runtime logs `[mesh-tools] serving 3 tool(s)`
# and binds its serve queues regardless; a tool would only fail if it were actually invoked.
#
#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
#   scripts/build-module-runtime.sh confluence builds mesh-runtime-confluence:development into the
#   local daemon, which this scenario stocks and serves by digest from its own registry. confluence
#   needs no service image — it is tools-only.
scenario: tools-confluence

segments:
  hosting:
    kind: public
    cidr: [192.0.2.0/24]

machines:
  anchor:
    at: { segment: hosting, address: [192.0.2.10] }
    inbound: allow
    memory: 3GiB
    cpus: 2

images:
  # The first-node substrate: store, broker, control.
  - postgres:17-alpine
  - cloudamqp/lavinmq:latest
  - mesh-control:development
  # confluence's runtime, built by scripts/build-module-runtime.sh confluence into the local daemon
  # and stocked into the scenario's own registry, which is where the host pulls it from. There is no
  # service image: confluence is tools-only and outbound-only.
  - mesh-runtime-confluence:development

place:
  all: [host, runtime]