# MQTT integration-test fixture — Eclipse Mosquitto (auth + TLS) + a JSON publisher.
#
# PREREQUISITE — run this first, in this directory:
#
#   MQTT_FIXTURE_PASSWORD='<pick-one>' ./gen-fixture-material.sh
#
# It writes ./secrets/ (password file + CA + server certificate/key), which is
# gitignored and which both services below mount. Without it the broker will not
# start: there is no anonymous fallback, by design.
#
# Bring up (on the shared Docker host — see infra/README.md §1):
#
#   ssh dohertj2@10.100.0.35 'cd /opt/otopcua-mqtt \
#       && MQTT_FIXTURE_USERNAME=otopcua MQTT_FIXTURE_PASSWORD=<same> docker compose up -d'
#
# Endpoints: 10.100.0.35:8883 (TLS + auth) · 10.100.0.35:1883 (plaintext + auth, smoke)
#
# Unlike the Modbus / S7 fixtures there are no compose profiles: both services are
# always wanted together (a broker with nothing publishing into it tests nothing), and
# they bind different ports so nothing contends.
services:
  mosquitto:
    image: eclipse-mosquitto:2.0.22
    container_name: otopcua-mosquitto
    restart: unless-stopped
    # Every lmxopcua fixture container carries this so the shared Docker host stays
    # discoverable with `docker ps --filter label=project=lmxopcua`.
    labels:
      project: lmxopcua
    ports:
      - "1883:1883"
      - "8883:8883"
    volumes:
      - ./mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
      - ./secrets:/mosquitto/secrets:ro
    healthcheck:
      # Authenticated round-trip against the broker's own $SYS tree ($$ escapes the
      # compose variable syntax). Proves the password file loaded and the listener
      # accepts a real session — a bare port check would go green on a broker that
      # rejects every CONNECT.
      test:
        - CMD-SHELL
        - >-
          mosquitto_sub -h 127.0.0.1 -p 1883
          -u "$$MQTT_FIXTURE_USERNAME" -P "$$MQTT_FIXTURE_PASSWORD"
          -t '$$SYS/broker/uptime' -C 1 -W 3
      interval: 5s
      timeout: 8s
      retries: 12
      start_period: 5s
    environment:
      # Consumed only by the healthcheck above; the broker itself reads the hashed
      # password file. Supplied by the operator's environment at `docker compose up` —
      # never defaulted here, so a missing value fails loudly instead of silently
      # provisioning a known-password broker.
      MQTT_FIXTURE_USERNAME: ${MQTT_FIXTURE_USERNAME:?set MQTT_FIXTURE_USERNAME (must match gen-fixture-material.sh)}
      MQTT_FIXTURE_PASSWORD: ${MQTT_FIXTURE_PASSWORD:?set MQTT_FIXTURE_PASSWORD (must match gen-fixture-material.sh)}

  publisher:
    image: eclipse-mosquitto:2.0.22
    container_name: otopcua-mqtt-publisher
    restart: unless-stopped
    labels:
      project: lmxopcua
    depends_on:
      mosquitto:
        condition: service_healthy
    volumes:
      - ./publisher/publish.sh:/publish.sh:ro
    environment:
      BROKER_HOST: mosquitto
      BROKER_PORT: "1883"
      TOPIC_PREFIX: ${MQTT_FIXTURE_TOPIC_PREFIX:-otopcua/fixture}
      PUBLISH_INTERVAL: ${MQTT_FIXTURE_PUBLISH_INTERVAL:-2}
      MQTT_FIXTURE_USERNAME: ${MQTT_FIXTURE_USERNAME:?set MQTT_FIXTURE_USERNAME}
      MQTT_FIXTURE_PASSWORD: ${MQTT_FIXTURE_PASSWORD:?set MQTT_FIXTURE_PASSWORD}
    entrypoint: ["/bin/sh", "/publish.sh"]