# Locked-down CBOMkit 2.3.0 run for the pyca/cryptography comparison.
# - API bound to 127.0.0.1 only; Postgres not published; no frontend, no OPA.
# - pyca/cryptography bare mirror (branch cbomkit-pin = d45b7930) mounted read-only.
name: cbomkit-pyca
services:
  db:
    image: docker.io/library/postgres:16-alpine
    user: postgres
    environment:
      POSTGRES_DB: postgres
      POSTGRES_USER: cbomkit
      POSTGRES_PASSWORD: cbomkit
    volumes:
      - pg:/var/lib/postgresql/data/
  backend:
    image: ghcr.io/cbomkit/cbomkit:2.3.0
    depends_on:
      - db
    environment:
      CBOMKIT_DB_TYPE: postgresql
      CBOMKIT_DB_JDBC_URL: jdbc:postgresql://db:5432/postgres
      CBOMKIT_PORT: 8081
      CBOMKIT_DB_USERNAME: cbomkit
      CBOMKIT_DB_PASSWORD: cbomkit
      CBOMKIT_FRONTEND_URL_CORS: "http://localhost:8001"
    ports:
      - "127.0.0.1:8081:8081"
    volumes:
      - ../ext/git/cryptography.git:/repos/cryptography:ro
      - work:/home/user/.cbomkit
    mem_limit: 6g
volumes:
  pg:
  work: