# psyc — company-network deployment (cockpit + mock destination receiver).
#
#   docker compose up -d --build
#
# WARNING: psyc has no built-in authentication. The cockpit exposes cases, the
# ledger, and sealed-package metadata to anyone who can reach port 8767. Deploy
# behind the company reverse proxy / SSO / VPN, or firewall the ports to the
# SOC subnet. See docs/deploy.md.

services:
  cockpit:
    build: .
    image: psyc:latest
    command: ["psyc", "serve", "--host", "0.0.0.0", "--port", "8767"]
    ports:
      - "8767:8767"
    volumes:
      - psyc-data:/data
    restart: unless-stopped
    # Behind a company egress proxy, uncomment and set:
    # environment:
    #   HTTPS_PROXY: http://proxy.corp:3128
    #   HTTP_PROXY: http://proxy.corp:3128

  mock-cert:
    image: psyc:latest
    command: ["psyc", "mock-cert", "--host", "0.0.0.0", "--port", "8770"]
    ports:
      - "8770:8770"
    volumes:
      - psyc-data:/data
    depends_on:
      - cockpit
    restart: unless-stopped

volumes:
  psyc-data: