# Single-node datastores: MySQL + Redis, bound to loopback only (the control
# plane runs on the same host). Credentials come from db.env (generated by
# deploy.sh, gitignored). Standard ports — this is a dedicated box.
services:
  mysql:
    image: mysql:8.0
    container_name: pangolin-mysql
    restart: unless-stopped
    command: ["--default-authentication-plugin=caching_sha2_password"]
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?set in db.env}
      MYSQL_DATABASE: pangolin
    ports:
      - "127.0.0.1:3306:3306"
    volumes:
      - pangolin-mysql-data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-uroot", "-p${MYSQL_ROOT_PASSWORD}", "--silent"]
      interval: 5s
      timeout: 5s
      retries: 20

  redis:
    image: redis:7-alpine
    container_name: pangolin-redis
    restart: unless-stopped
    ports:
      - "127.0.0.1:6379:6379"
    volumes:
      - pangolin-redis-data:/data

volumes:
  pangolin-mysql-data:
  pangolin-redis-data: