x-client-libs-image: &client-libs-image
  image: "${CLIENT_LIBS_TEST_IMAGE}:${CLIENT_LIBS_TEST_IMAGE_TAG:-${REDIS_VERSION:-}}"
x-client-libs-stack-image: &client-libs-stack-image
  image: "${CLIENT_LIBS_TEST_IMAGE}:${CLIENT_LIBS_TEST_IMAGE_TAG:-${REDIS_STACK_VERSION:-${REDIS_VERSION:-}}}"

services:
  toxiproxy:
    image: ghcr.io/shopify/toxiproxy:2.8.0
    ports:
      - "8474:8474"   # Admin API
      - "29379:29379" # redis-failover-1 proxy
      - "29380:29380" # redis-failover-2 proxy
      - "26400:26400" # redis-unavailable proxy
  redis-failover-1:
    <<: *client-libs-image
    container_name: redis-failover-1
    environment:
      - PORT=9379
    ports:
      - 9379:9379
  redis-failover-2:
    <<: *client-libs-image
    container_name: redis-failover-2
    environment:
      - PORT=9380
    ports:
      - 9380:9380
  redis1-2-5-8-sentinel:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    <<: *client-libs-image
    container_name: redis1-2-5-8-sentinel
    #network_mode: host
    environment:
      - REDIS_CLUSTER=no
      - REDIS_CLIENT_USER=deploy
      - REDIS_CLIENT_PASSWORD=verify
      - TLS_ENABLED=yes
    ports:
      - "6379:6379"
      - "6380:6380"
      - "6383:6383"
      - "6386:6386"
      - "6390:6390"
      - "6391:6391"
      - "26379:26379" # sentinel
      - "36379:36379" # sentinel tls
    command: ${ENABLE_MODULE_COMMAND_DIRECTIVE}
    volumes:
      -  ${REDIS_ENV_CONF_DIR}/redis1-2-5-8-sentinel/config:/redis/config:r
      -  ${REDIS_ENV_WORK_DIR}/redis1-2-5-8-sentinel/work:/redis/work:rw
  standalone2-sentinel:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    <<: *client-libs-image
    container_name: standalone2-sentinel
    #network_mode: host
    environment:
      - REDIS_CLUSTER=no
      - TLS_ENABLED=yes
      - REDIS_PASSWORD=foobared
    ports:
      - "6381:6381"
      - "16381:16381"
      - "6382:6382"
      - "16382:16382"
      - "26380:26380" # sentinel-standalone2-1
      - "36380:36380" # sentinel tls
      - "26382:26382" # sentinel-standalone2-3
      - "36382:36382" # sentinel tls
    volumes:
      -  ${REDIS_ENV_CONF_DIR}/standalone2-sentinel/config:/redis/config:r
      -  ${REDIS_ENV_WORK_DIR}/standalone2-sentinel/work:/redis/work:rw

  sentinel-failover:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    <<: *client-libs-image
    container_name: sentinel-standalone2-failover
    #network_mode: host
    environment:
      - REDIS_CLUSTER=no
      - REDIS_PASSWORD=foobared
    ports:
      - "6384:6384"
      - "6385:6385"
      - "26381:26381" # sentinel
      - "36381:36381" # sentinel tls
    volumes:
      -  ${REDIS_ENV_CONF_DIR}/sentinel-standalone2-failover/config:/redis/config:r
      -  ${REDIS_ENV_WORK_DIR}/sentinel-standalone2-failover/work:/redis/work:rw

  redis9-10:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    <<: *client-libs-image
    container_name: redis9-10
    #network_mode: host
    environment:
      - REDIS_CLUSTER=no
    ports:
      - "6388:6388"
      - "6389:6389"
    volumes:
      - ${REDIS_ENV_CONF_DIR}/redis9-10/config:/redis/config:r
      - ${REDIS_ENV_WORK_DIR}/redis9-10/work:/redis/work:rw
  redis-unavailable:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    <<: *client-libs-image
    container_name: redis-unavailable-1
    #network_mode: host
    environment:
      - REDIS_CLUSTER=no
      - PORT=6400
    ports:
      - "6400:6400"
    volumes:
      -  ${REDIS_ENV_WORK_DIR}/redis-unavailable/work:/redis/work:rw

  cluster-unbound:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    <<: *client-libs-image
    container_name: cluster-unbound-1
    environment:
      - REDIS_PASSWORD=cluster
    ports:
      - "7379-7383:7379-7383"
    volumes:
      - ${REDIS_ENV_CONF_DIR}/cluster-unbound/config:/redis/config:r
      - ${REDIS_ENV_WORK_DIR}/cluster-unbound/work:/redis/work:rw

  #TLS endpoints of Cluster stable are used for TLS tests that do not require client authentication
  cluster-stable:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    <<: *client-libs-image
    container_name: cluster-stable-1
    #network_mode: host
    # cluster-node-timeout must be generous here: this env has no failover tests, and a low
    # value lets brief main-thread stalls (e.g. bulk vector indexing) trigger a transient
    # CLUSTERDOWN that silently rejects writes mid-test.
    command: --cluster-preferred-endpoint-type hostname --cluster-announce-hostname "localhost" --cluster-node-timeout 5000 --tls-auth-clients no --save ""
    environment:
      - REDIS_CLUSTER=yes
      - REDIS_PASSWORD=cluster
      - PORT=7479
      - TLS_PORT=8479
      - NODES=6
      - REPLICAS=1
      - TLS_ENABLED=yes
      - TLS_AUTH_CLIENTS_USER=off
    ports:
      - "7479-7484:7479-7484"
      - "8479-8484:8479-8484"
    volumes:
      - ${REDIS_ENV_CONF_DIR}/cluster-stable/config:/redis/config:r
      - ${REDIS_ENV_WORK_DIR}/cluster-stable/work:/redis/work:rw

  jedis-stack:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    <<: *client-libs-stack-image
    container_name: jedis-stack
    command: --save ""
    environment:
      - REDIS_CLUSTER=no
      - PORT=6479
    ports:
      - "6479:6479"
    volumes:
      -  ${REDIS_ENV_WORK_DIR}/jedis-stack/work:/redis/work:rw
#todo find a way to connect from mac os host to exposed unix socket in container
#  redis_uds:
#    <<: *client-libs-image
#    container_name: redis_uds
#    #network_mode: host
#    command: redis-server /etc/redis.conf
#    volumes:
#      - "./redis_uds/config/node-0/redis.conf:/etc/redis.conf"
#      - "./work/redis_uds/work:/tmp/docker/"

  # Standalone Redis instance with mTLS (mutual TLS) authentication
  # Uses TLS_CLIENT_CNS to generate client certificates for mTLS users
  # TLS_AUTH_CLIENTS_USER=CN (default) extracts username from client certificate CN
  # ACL users matching client certificate CNs are configured via --user directives
  standalone-mtls:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    <<: *client-libs-image
    container_name: standalone-mtls
    command:
      - "--save"
      - ""
      - "--user"
      - "mtls-user1"
      - "on"
      - "nopass"
      - "~*"
      - "&*"
      - "+@all"
      - "--user"
      - "mtls-user2"
      - "on"
      - "nopass"
      - "~*"
      - "&*"
      - "+@all"
    environment:
      - REDIS_CLUSTER=no
      - TLS_ENABLED=yes
      - TLS_PORT=6790
      - PORT=6789
      - TLS_CLIENT_CNS=mtls-user1 mtls-user2 mtls-user-without-acl
    ports:
      # We don't expose non-TLS port on purpose
      - "6790:6790"
    volumes:
      - ${REDIS_ENV_WORK_DIR}/standalone-mtls/work:/redis/work:rw

  # Redis cluster with mTLS (mutual TLS) authentication
  # 3 nodes without replicas to minimize memory footprint
  # TLS_AUTH_CLIENTS_USER=CN (default) extracts username from client certificate CN
  # ACL users matching client certificate CNs are configured via --user directives
  cluster-mtls:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    <<: *client-libs-image
    container_name: cluster-mtls
    command:
      - "--cluster-preferred-endpoint-type"
      - "hostname"
      - "--cluster-announce-hostname"
      - "localhost"
      - "--cluster-node-timeout"
      - "150"
      - "--save"
      - ""
      - "--user"
      - "mtls-user1"
      - "on"
      - "nopass"
      - "~*"
      - "&*"
      - "+@all"
      - "--user"
      - "mtls-user2"
      - "on"
      - "nopass"
      - "~*"
      - "&*"
      - "+@all"
    environment:
      - REDIS_CLUSTER=yes
      - TLS_ENABLED=yes
      - TLS_PORT=8579
      - PORT=7579
      - NODES=3
      - REPLICAS=0
      - TLS_CLIENT_CNS=mtls-user1 mtls-user2 mtls-user-without-acl
    ports:
      # We don't expose non-TLS ports on purpose
      - "8579-8581:8579-8581"
    volumes:
      - ${REDIS_ENV_WORK_DIR}/cluster-mtls/work:/redis/work:rw