# Docker Compose for Ritual dKMS on GCP TDX
# This template is deployed to GCP TDX VMs to run dKMS in TEE
#
# dKMS provides:
#   - TEE attestation (Intel TDX)
#   - Deterministic key derivation for executors
#   - mTLS certificate registration with TEEServiceRegistry
#   - Ephemeral root key management (trustless - key generated inside TEE)
#
# PORTS: Main=8000, Ops=8001 (standardized across all TEE services)
#
# IMPORTANT: In production mode (ENVIRONMENT=production):
#   - DKMS_ROOT_KEY must NOT be set (generated inside TEE for trustless operation)
#   - TEE_PRIVATE_KEY must NOT be set (generated inside TEE)
#   - TLS_ENABLED must be true
#   - REGISTRATION_ENABLED must be true

services:
  dkms:
    restart: always
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "5"
    image: ritualnetwork/dkms:3a52ac9-95ebaec-amd64@sha256:132b436f49d2b99c9a3157652859e787dc03d82c65e0e7d1f6e9943a122054a5
    container_name: dkms
    ports:
      - "8000:8000"   # Main API port (mTLS) - /v1/get_key
      - "8001:8001"   # Ops port (/status, /health, /metrics, /attestationEnv - no TLS)
    volumes:
      # TDX attestation requires these volumes:
      - /etc/tdx-attest.conf:/etc/tdx-attest.conf:ro
      # TSM report generation needs write access to /sys/kernel/config
      - /sys/kernel/config:/sys/kernel/config:rw
    environment:
      # Production mode - enforces security constraints
      - ENVIRONMENT=production
      
      # Core configuration (required, canonical chainclient env contract)
      - MULTICAST_URLS=${MULTICAST_URLS}
      - TRUSTED_READ_RPC_URL=${TRUSTED_READ_RPC_URL}
      - RPC_CERT_HASH=${RPC_CERT_HASH}
      - TEE_SERVICE_REGISTRY_CONTRACT_ADDRESS=${TEE_SERVICE_REGISTRY_CONTRACT_ADDRESS}
      - AGENT_HEARTBEAT_CONTRACT_ADDRESS=${AGENT_HEARTBEAT_CONTRACT_ADDRESS:?required}
      - ASYNC_JOB_TRACKER_CONTRACT_ADDRESS=${ASYNC_JOB_TRACKER_CONTRACT_ADDRESS:?required}
      - DKMS_ROOT_MODE=${DKMS_ROOT_MODE:?Set genesis or retrieve explicitly}
      - DKMS_PEER_ENDPOINT=${DKMS_PEER_ENDPOINT:-}
      - DKMS_PEER_TEE_ADDRESS=${DKMS_PEER_TEE_ADDRESS:-}
      - PORT=8000
      - OPS_ADDR=:8001
      
      # TLS configuration
      - TLS_ENABLED=true

      # dKMS root source
      
      # On-chain registration with TEEServiceRegistry
      - REGISTRATION_ENABLED=${REGISTRATION_ENABLED:-true}
      - REGISTRATION_DEBUG_MODE=false
      - DKMS_ENDPOINT=https://${SERVICE_IP}:8000
      - DKMS_PAYMENT_ADDRESS=${DKMS_PAYMENT_ADDRESS}
      - REGISTRATION_VALUE_WEI=${REGISTRATION_VALUE_WEI:-0}
      - REGISTRATION_GAS_LIMIT=${REGISTRATION_GAS_LIMIT:-30000000}
      
      # Attestation configuration (real TDX attestation)
    
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    
    # TDX devices required for attestation
    devices:
      - /dev/tdx_guest:/dev/tdx_guest
      - /dev/tpm0:/dev/tpm0
      - /dev/tpmrm0:/dev/tpmrm0
    
    # Privileged mode required for TDX device access
    privileged: true
