docker-compose.test.yml

services:
  xray:
    image: ${XRAY_IMAGE:-ghcr.io/xtls/xray-core:latest}
    command: ["run", "-confdir", "/etc/xray/config.d"]
    volumes:
      - ${XRAY_CONFIG_DIR:-./docker/xray/config.d}:/etc/xray/config.d:ro
    ports:
      - "${XRAY_HOST_PORT:-18443}:18443"
    restart: unless-stopped

  app:
    image: alpine:3.20
    command: ["/usr/local/bin/xray-subscription", "-config", "/etc/xray-subscription/config.json"]
    volumes:
      # Raven-subscribe reads the config_dir to discover users/inbounds. By
      # default this is the same directory mounted into the xray service.
      # The bridge-chain variant overrides RAVEN_XRAY_CONFIG_DIR so raven
      # sees the bridge inbound (with the test user) while xray runs the
      # EU config (with the chain-only user).
      - ${RAVEN_XRAY_CONFIG_DIR:-${XRAY_CONFIG_DIR:-./docker/xray/config.d}}:/etc/xray/config.d:ro
      - ${APP_CONFIG_PATH:-./docker/xray-subscription/config.json}:/etc/xray-subscription/config.json:ro
      - ${APP_BIN_PATH:-./build/xray-subscription}:/usr/local/bin/xray-subscription:ro
      - raven_subscribe_db:/var/lib/xray-subscription
    ports:
      - "${APP_HOST_PORT:-18080}:8080"
    depends_on:
      - xray
    restart: unless-stopped

  # User-connection E2E (Tier 3) — gated by profile "e2e-user".
  # Activate with `docker compose --profile e2e-user up -d`.
  # XRAY_CLIENT_CONFIG_PATH must point to a Raven-subscribe-generated client
  # config rendered by the test harness before compose up.
  xray-client:
    image: ${XRAY_IMAGE:-ghcr.io/xtls/xray-core:latest}
    profiles: ["e2e-user"]
    command: ["run", "-c", "/etc/xray-client/config.json"]
    volumes:
      - ${XRAY_CLIENT_CONFIG_PATH:-./docker/xray-client/placeholder.json}:/etc/xray-client/config.json:ro
    ports:
      - "${XRAY_CLIENT_HOST_PORT:-11080}:2080"
    depends_on:
      - xray
      - app
    restart: "no"

  test-target:
    image: kennethreitz/httpbin
    profiles: ["e2e-user"]
    expose:
      - "80"
    restart: unless-stopped

  # Tier 4 edge-eu variant only. Mounts the snapshot of nginx_frontend's
  # stream.conf in front of mock TLS upstreams; the test sends openssl
  # s_client probes with different SNIs and verifies each lands on the
  # right upstream by inspecting the cert subject CN. Activate with
  # profile "e2e-edge-eu".
  nginx-frontend:
    image: nginx:1.27-alpine
    profiles: ["e2e-edge-eu"]
    command: ["nginx", "-g", "daemon off;"]
    volumes:
      - ./docker/nginx-frontend/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./testdata/ansible-rendered/nginx-frontend/stream.conf:/etc/nginx/stream.d/stream.conf:ro
    ports:
      - "${NGINX_FRONTEND_HOST_PORT:-18444}:443"
    depends_on:
      - mock-reality
      - mock-xhttp
      - mock-fallback
    restart: "no"

  mock-reality:
    image: alpine/openssl:latest
    profiles: ["e2e-edge-eu"]
    # alpine/openssl entrypoint is `openssl`; pass s_server args directly.
    # No -quiet so startup + accept lines surface in `compose logs` for
    # diagnostics on CI failures.
    command:
      - "s_server"
      - "-accept"
      - "4444"
      - "-cert"
      - "/certs/cert.pem"
      - "-key"
      - "/certs/key.pem"
      - "-www"
    volumes:
      - ${MOCK_REALITY_CERT_DIR:-./docker/nginx-frontend/placeholder-certs}:/certs:ro
    expose:
      - "4444"
    restart: "no"

  mock-xhttp:
    image: alpine/openssl:latest
    profiles: ["e2e-edge-eu"]
    command:
      - "s_server"
      - "-accept"
      - "2054"
      - "-cert"
      - "/certs/cert.pem"
      - "-key"
      - "/certs/key.pem"
      - "-www"
    volumes:
      - ${MOCK_XHTTP_CERT_DIR:-./docker/nginx-frontend/placeholder-certs}:/certs:ro
    expose:
      - "2054"
    restart: "no"

  mock-fallback:
    image: alpine/openssl:latest
    profiles: ["e2e-edge-eu"]
    command:
      - "s_server"
      - "-accept"
      - "5443"
      - "-cert"
      - "/certs/cert.pem"
      - "-key"
      - "/certs/key.pem"
      - "-www"
    volumes:
      - ${MOCK_FALLBACK_CERT_DIR:-./docker/nginx-frontend/placeholder-certs}:/certs:ro
    expose:
      - "5443"
    restart: "no"

  # Tier 4 edge-ru variant: RU relay nginx in front of the EU
  # nginx-frontend. relay's stream.conf forwards SNIs that don't match
  # local rules to nginx-frontend over TCP — exercising the prod 2-hop
  # SNI propagation path. Activate with profile "e2e-edge-ru".
  nginx-relay:
    image: nginx:1.27-alpine
    profiles: ["e2e-edge-ru"]
    command: ["nginx", "-g", "daemon off;"]
    volumes:
      - ./docker/nginx-relay/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./testdata/ansible-rendered/nginx-relay/stream.conf:/etc/nginx/stream.d/stream.conf:ro
    ports:
      - "${NGINX_RELAY_HOST_PORT:-18445}:443"
    depends_on:
      - nginx-frontend
      - mock-relay-local
    restart: "no"

  mock-relay-local:
    image: alpine/openssl:latest
    profiles: ["e2e-edge-ru"]
    command:
      - "s_server"
      - "-accept"
      - "8443"
      - "-cert"
      - "/certs/cert.pem"
      - "-key"
      - "/certs/key.pem"
      - "-www"
    volumes:
      - ${MOCK_RELAY_LOCAL_CERT_DIR:-./docker/nginx-frontend/placeholder-certs}:/certs:ro
    expose:
      - "8443"
    restart: "no"

  # Tier 3 bridge-chain variant only. Mirrors the prod RU-bridge → EU-xray
  # topology: xray-bridge accepts client traffic and chains it to the xray
  # service via a VLESS outbound. Activate with profile "e2e-user-bridge".
  xray-bridge:
    image: ${XRAY_IMAGE:-ghcr.io/xtls/xray-core:latest}
    profiles: ["e2e-user-bridge"]
    command: ["run", "-confdir", "/etc/xray-bridge/config.d"]
    volumes:
      - ${XRAY_BRIDGE_CONFIG_DIR:-./docker/xray-bridge/placeholder.d}:/etc/xray-bridge/config.d:ro
    ports:
      # Host-mapped only so the test harness can probe readiness — xray-client
      # in the same compose network reaches the bridge by service name.
      - "${XRAY_BRIDGE_HOST_PORT:-28443}:28443"
    depends_on:
      - xray
    restart: unless-stopped

volumes:
  raven_subscribe_db: