# albok-service — the fleet knowledgebase service (vh/albok, packages/albok-service). The only
# writer of the buildings-and-wings store. Requested by albok-dev 2026-10-02 (operator-approved).
# Host: nh3-albok (VM 110 on nh3-pve-2, 10.100.50.44) since 2026-10-04, a VM that runs ONLY this.
#       It moved off nh3-docker, where portainer/dockge/the agent and dockerd on tcp/2375 were all root
#       over the store (servers/nh3-albok/README.md).
#
# Deploy:  scripts/elway infra-ops@10.100.50.44 --playbook playbooks/albok-service-host.yaml   (host prep, config)
#          scripts/deploy-stack.sh nh3-albok albok-service                                     (this file + conf/)
# Image:   built from a clean `git archive` of vh/albok, pushed to the pfi org (see README.md).
#
# ⚠ Host port 8392 (kept from nh3-docker, where 8390 was the post office) so clients did not change.
# ⚠ Exactly ONE instance per private root: a second one exits 75 on the lease. Never scale this.
# ⚠ Nothing else may mount /srv/albok/store read-write. Viewers mount it :ro with group_add by gid
#   (1510 albok-read, 1511 albok-personal) and need GIT_OPTIONAL_LOCKS=0 + a safe.directory entry.
#   1512 albok-feedback (restricted wing personal/agent-feedback) is default-deny: no viewer gets it.
services:
  albok-service:
    image: gitea.phasefinal.com/pfi/albok-service:0.1.22@sha256:82328fb10fdc674d7e3da5059d56d0aa47259af9ddc57c2b4fb82b013fa3bffc
    container_name: albok-service
    restart: unless-stopped
    ports:
      - "8392:8390"
    # Membership the service needs to chgrp wing dirs to the read groups (it runs as uid 1500, not root).
    group_add:
      - "1510"
      - "1511"
      - "1512"   # albok-feedback: restricted wing personal/agent-feedback
    volumes:
      - /srv/albok/store:/srv/albok/store
      - /srv/albok/private:/srv/albok/private
      - /srv/albok/etc/albok.yaml:/etc/albok/albok.yaml:ro
      # the read groups must RESOLVE BY NAME inside the container (layout.py uses grp.getgrnam)
      - /opt/docker/conf/albok-service/group:/etc/group:ro
    mem_limit: 8g   # 4g on nh3-docker (7.7 GiB shared host); 12 GiB VM to itself now
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8390/health', timeout=5).status == 200 else 1)"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    networks:
      - tnet
    # No homepage.* labels: Homepage discovers containers over a host's tcp/2375, and this host must not
    # expose its Docker API. The Albok tile is a static entry in stacks/homepage/conf/services.yaml.

networks:
  tnet:
    name: traefik-net
    external: true