# {{ ansible_managed }}
# Sites de test du PoC BunkerWeb, mode {{ poc_mode }}
{% if poc_mode == 'split' %}
# Ports publiés sur {{ ansible_host }}, filtrés par la chaîne iptables BWPOC :
# seul le WAF ({{ waf_ip }}) peut les joindre.
{% else %}
# Aucun port publié : BunkerWeb joint les conteneurs par le réseau bw-services.
{% endif %}

services:
  www:
    image: {{ nginx_image }}
    container_name: poc-www
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /run
      - /tmp
    volumes:
      - ./www:/usr/share/nginx/html:ro
{% if poc_mode == 'split' %}
    ports:
      - "{{ ansible_host }}:{{ apps_ports.www }}:80"
{% endif %}
    networks: [apps]

  shop:
    image: {{ juiceshop_image }}
    container_name: poc-shop
    restart: unless-stopped
{% if poc_mode == 'split' %}
    ports:
      - "{{ ansible_host }}:{{ apps_ports.shop }}:3000"
{% endif %}
    networks: [apps]

  api:
    image: {{ httpbin_image }}
    container_name: poc-api
    restart: unless-stopped
    read_only: true
{% if poc_mode == 'split' %}
    ports:
      - "{{ ansible_host }}:{{ apps_ports.api }}:8080"
{% endif %}
    networks: [apps]

networks:
  apps:
{% if poc_mode == 'single' %}
    name: bw-services
    external: true
{% else %}
    name: poc-apps
{% endif %}