version: '3'
services:
  boulder:
    # CAUTION: Changing the Go version in this tag changes the version of Go
    # used for release builds. make-deb.sh relies on being able to parse the
    # numeric version between 'go' and the underscore-prefixed date. If you make
    # changes to these tokens, please update this parsing logic.
    image: &boulder_image letsencrypt/boulder-tools:${BOULDER_TOOLS_TAG:-go1.18.1_2022-05-19}
    environment:
      FAKE_DNS: 10.77.77.77
      BOULDER_CONFIG_DIR: test/config
      GOFLAGS: -mod=vendor
      # Go 1.18 turns off SHA-1 validation on CSRs (and certs, but that doesn't
      # affect us). It also turns off TLS 1.0 and TLS 1.1. Temporarily go back
      # to allowing these so we can upgrade to Go 1.18 while doing a deprecation
      # window. These overrides will stop working in Go 1.19.
      GODEBUG: x509sha1=1,tls10default=1
    volumes:
      - .:/boulder:cached
      - ./.gocache:/root/.cache/go-build:cached
      - ./.hierarchy:/hierarchy/:cached
      - ./.softhsm-tokens/:/var/lib/softhsm/tokens/:cached
    networks:
      bluenet:
        ipv4_address: 10.77.77.77
      rednet:
        ipv4_address: 10.88.88.88
      redisnet:
        ipv4_address: 10.33.33.33
    extra_hosts:
      # This is used by TestOldTLS in va/http_test.go
      # TODO(#6011): Remove once TLS 1.0 and 1.1 support is gone.
      - "example.com:127.0.0.1"
    # Use sd-test-srv as a backup to Docker's embedded DNS server
    # (https://docs.docker.com/config/containers/container-networking/#dns-services).
    # If there's a name Docker's DNS server doesn't know about, it will
    # forward the query to this IP (running sd-test-srv). We have
    # special logic there that will return multiple IP addresses for
    # service names.
    dns: 10.77.77.77
    ports:
      - 4001:4001 # ACMEv2
      - 4002:4002 # OCSP
      - 4003:4003 # OCSP
    depends_on:
      - bmysql
      - bredis_clusterer
    entrypoint: test/entrypoint.sh
    working_dir: &boulder_working_dir /boulder

  bmysql:
    image: mariadb:10.5
    networks:
      bluenet:
        aliases:
          - boulder-mysql
    environment:
        MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
    # Send slow queries to a table so we can check for them in the
    # integration tests. For now we ignore queries not using indexes,
    # because that seems to trigger based on the optimizer's choice to not
    # use an index for certain queries, particularly when tables are still
    # small.
    command: mysqld --bind-address=0.0.0.0 --slow-query-log --log-output=TABLE --log-queries-not-using-indexes=ON
    logging:
        driver: none

  bredis_1:
    image: redis:6.2.7
    volumes:
      - ./test/:/test/:cached
    command: redis-server /test/redis.config
    networks:
      redisnet:
          ipv4_address: 10.33.33.2

  bredis_2:
    image: redis:6.2.7
    volumes:
      - ./test/:/test/:cached
    command: redis-server /test/redis.config
    networks:
      redisnet:
          ipv4_address: 10.33.33.3

  bredis_3:
    image: redis:6.2.7
    volumes:
      - ./test/:/test/:cached
    command: redis-server /test/redis.config
    networks:
      redisnet:
          ipv4_address: 10.33.33.4

  bredis_4:
    image: redis:6.2.7
    volumes:
      - ./test/:/test/:cached
    command: redis-server /test/redis.config
    networks:
      redisnet:
          ipv4_address: 10.33.33.5

  bredis_5:
    image: redis:6.2.7
    volumes:
      - ./test/:/test/:cached
    command: redis-server /test/redis.config
    networks:
      redisnet:
          ipv4_address: 10.33.33.6

  bredis_6:
    image: redis:6.2.7
    volumes:
      - ./test/:/test/:cached
    command: redis-server /test/redis.config
    networks:
      redisnet:
          ipv4_address: 10.33.33.7

  bredis_clusterer:
    image: redis:6.2.7
    volumes:
      - ./test/:/test/:cached
      - ./cluster/:/cluster/:cached
    command: /test/wait-for-it.sh 10.33.33.2 4218 /test/redis-create.sh
    depends_on:
      - bredis_1
      - bredis_2
      - bredis_3
      - bredis_4
      - bredis_5
      - bredis_6
    networks:
        redisnet:
          ipv4_address: 10.33.33.10
          aliases:
            - boulder-redis-clusterer

  netaccess:
    image: *boulder_image
    environment:
        GO111MODULE: "on"
        GOFLAGS: -mod=vendor
        BOULDER_CONFIG_DIR: test/config
    networks:
      - bluenet
    volumes:
      - .:/boulder
    working_dir: *boulder_working_dir
    entrypoint: test/entrypoint-netaccess.sh

networks:
  bluenet:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 10.77.77.0/24
  rednet:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 10.88.88.0/24

  redisnet:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 10.33.33.0/24