services:
  traefik:
    image: traefik:v3.7.1
    container_name: e2e-captcha-traefik
    command:
      - "--log.level=INFO"
      - "--accesslog"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entryPoints.web.address=:80"
      - "--entryPoints.web.forwardedHeaders.insecure=true"
      - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ../../../..:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
      - ./captcha.html:/captcha.html:ro
    ports:
      - "8000:80"
    depends_on:
      crowdsec:
        condition: service_healthy

  whoami:
    image: traefik/whoami
    container_name: e2e-captcha-whoami
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.r.rule=PathPrefix(`/foo`)"
      - "traefik.http.routers.r.entrypoints=web"
      - "traefik.http.routers.r.middlewares=bouncer@docker"
      - "traefik.http.services.s.loadbalancer.server.port=80"
      - "traefik.http.middlewares.bouncer.plugin.bouncer.enabled=true"
      - "traefik.http.middlewares.bouncer.plugin.bouncer.crowdsecmode=stream"
      - "traefik.http.middlewares.bouncer.plugin.bouncer.updateintervalseconds=3"
      - "traefik.http.middlewares.bouncer.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
      - "traefik.http.middlewares.bouncer.plugin.bouncer.forwardedheaderstrustedips=172.16.0.0/12"
      - "traefik.http.middlewares.bouncer.plugin.bouncer.captchaprovider=turnstile"
      # Cloudflare Turnstile public test keys (always pass / always fail variants exist).
      # These render a valid widget without contacting any real API key.
      - "traefik.http.middlewares.bouncer.plugin.bouncer.captchasitekey=1x00000000000000000000AA"
      - "traefik.http.middlewares.bouncer.plugin.bouncer.captchasecretkey=1x0000000000000000000000000000000AA"
      - "traefik.http.middlewares.bouncer.plugin.bouncer.captchahtmlfilepath=/captcha.html"
      - "traefik.http.middlewares.bouncer.plugin.bouncer.captchagraceperiodseconds=10"

  crowdsec:
    image: crowdsecurity/crowdsec:v1.7.8
    container_name: crowdsec
    environment:
      DISABLE_ONLINE_API: "true"
      BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5
      CUSTOM_HOSTNAME: crowdsec
    healthcheck:
      test: ["CMD", "cscli", "lapi", "status"]
      interval: 2s
      timeout: 3s
      retries: 30
      start_period: 5s