# CP2A1 — Trusted Gate Evaluator (External Gate Enforcement Foundation)
# STRICTLY NON-PRODUCTIVE / NO AUTONOMY.
#
# Netzwerk: eigenes internal-Netz (keine Egress, keine Internet-Erreichbarkeit).
# RQ wird per `docker network connect` an dieses Netz angebunden (RQ <-> Evaluator).
# State-Mount: RO (read-only) auf /opt/control-plane/state.
# Härtung: --cap-drop ALL, --no-new-privileges, --read-only, kein Docker-Socket.
services:
  gate-evaluator:
    build: .
    image: gate-evaluator:cp2a1
    container_name: gate-evaluator
    restart: unless-stopped
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp
    volumes:
      # RO-State-Mount: autoritativer CP1-State (root-owned, 0700/600)
      - /opt/control-plane/state:/opt/control-plane/state:ro
      # Audit-Volume (append-only, gegen RQ-Manipulation geschuetzt)
      - gate-audit:/audit
    networks:
      - gate-internal
    environment:
      - GATE_EVALUATOR_PORT=8080
    # Kein Docker-Socket, keine Credentials, keine Egress (internal-Netz)

networks:
  gate-internal:
    driver: bridge
    internal: true

volumes:
  gate-audit: