name: enelix-netplan-v4-shadow
services:
  netplan-v4:
    build: .
    restart: unless-stopped
    init: true
    user: "1000:1000"
    read_only: true
    env_file:
      - /home/agent/services/prognosis-integration.env
    environment:
      NETPLAN_V4_DB: /data/netplan-v4.sqlite
      NETPLAN_V4_PLANTS: ${NETPLAN_V4_PLANTS:?Explicit installation ID required}
      NETPLAN_V4_TEST_REPORT_DIR: /tmp/test-results
    volumes:
      - ./data:/data
    tmpfs:
      - /tmp:size=64m,mode=1777,noexec,nosuid
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      prognosis_integration:
        aliases:
          - netplan-v4
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:9100/health', timeout=3).read()"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s
    # No public port, no Docker socket, no access to legacy databases.
networks:
  prognosis_integration:
    external: true
    name: enelix-platform-internal