compose.yaml

# encoding: ascii-8bit

# Copyright 2022 Ball Aerospace & Technologies Corp.
# All Rights Reserved.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See LICENSE.md for more details.

# Modified by OpenC3, Inc.
# All changes Copyright 2026, OpenC3, Inc.
# All Rights Reserved
#
# This file may also be used under the terms of a commercial license
# if purchased from OpenC3, Inc.

# ===========================================================================
# DO NOT EDIT THIS FILE for local customization.
# ---------------------------------------------------------------------------
# This file ships the upstream COSMOS defaults. Editing it causes conflicts
# when pulling in future COSMOS updates. To customize your deployment
# (override a value, change ports, add services/volumes, toggle install
# flags), edit compose.override.yaml instead - openc3.sh merges it on top of
# this file automatically, and a value set there wins over the value here.
# ===========================================================================

services:
  openc3-buckets:
    read_only: true
    user: "${OPENC3_USER_ID:-1001}:${OPENC3_GROUP_ID:-1001}"
    image: "${OPENC3_REGISTRY}/${OPENC3_NAMESPACE}/openc3-buckets${OPENC3_IMAGE_SUFFIX}:${OPENC3_TAG}"
    volumes:
      - "openc3-object-v:/data"
      - "./cacert.pem:/devel/cacert.pem:z"
    restart: "unless-stopped"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    environment:
      ROOT_ACCESS_KEY: "${OPENC3_BUCKET_USERNAME}"
      ROOT_SECRET_KEY: "${OPENC3_BUCKET_PASSWORD}"
      OPENC3_SR_BUCKET_USERNAME: "${OPENC3_SR_BUCKET_USERNAME}"
      OPENC3_SR_BUCKET_PASSWORD: "${OPENC3_SR_BUCKET_PASSWORD}"
      SSL_CERT_FILE: "/devel/cacert.pem"
      CURL_CA_BUNDLE: "/devel/cacert.pem"
      REQUESTS_CA_BUNDLE: "/devel/cacert.pem"
      NODE_EXTRA_CA_CERTS: "/devel/cacert.pem"
    healthcheck:
      # Test that S3-compatible storage (versitygw) is listening on port 9000
      test: ["CMD-SHELL", "nc -z 127.0.0.1 9000 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  openc3-tsdb:
    read_only: true
    image: "${OPENC3_REGISTRY}/${OPENC3_NAMESPACE}/openc3-tsdb${OPENC3_IMAGE_SUFFIX}:${OPENC3_TAG}"
    platform: "${OPENC3_TSDB_PLATFORM:-}"
    # ports:
    #   # This gives complete access to the QuestDB instance, which is useful for testing and development.
    #   - "127.0.0.1:9000:9000" # OPENC3_TSDB_INGEST_PORT & QuestDB Console
    #   - "127.0.0.1:9003:9003" # QuestDB health endpoint
    #   # The Postgresql port doesn't typically need to be exposed to the host
    #   # but if you have external software that needs to connect to QuestDB
    #   # you can uncomment the following line to expose it.
    #   - "127.0.0.1:8812:8812" # OPENC3_TSDB_QUERY_PORT
    volumes:
      - "openc3-tsdb-tmp-v:/tmp"
      - "openc3-tsdb-v:/var/lib/questdb"
    restart: "unless-stopped"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    environment:
      QDB_PG_USER: "${OPENC3_TSDB_USERNAME}"
      QDB_PG_PASSWORD: "${OPENC3_TSDB_PASSWORD}"
      QDB_HTTP_USER: "${OPENC3_TSDB_USERNAME}"
      QDB_HTTP_PASSWORD: "${OPENC3_TSDB_PASSWORD}"
    ulimits:
      # Set 'nofile' with different soft and hard limits
      nofile:
        soft: 1048576
        hard: 1048576
      # Set 'memlock' to unlimited using -1
      memlock:
        soft: -1
        hard: -1
    healthcheck:
      # Test that QuestDB can actually execute queries via the REST API
      # This verifies both the HTTP server and the database engine are working
      test:
        [
          "CMD-SHELL",
          'curl -f -u "$${QDB_HTTP_USER}:$${QDB_HTTP_PASSWORD}" ''http://localhost:9000/exec?query=SELECT+1'' | grep -q ''"query":"SELECT 1"'' || exit 1',
        ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  openc3-redis:
    read_only: true
    user: "${OPENC3_USER_ID:-1001}:${OPENC3_GROUP_ID:-1001}"
    image: "${OPENC3_REGISTRY}/${OPENC3_NAMESPACE}/openc3-redis${OPENC3_IMAGE_SUFFIX}:${OPENC3_TAG}"
    volumes:
      - "openc3-redis-v:/data"
      - "./cacert.pem:/devel/cacert.pem:z"
      - "./openc3-redis/users.acl:/config/users.acl:z"
    restart: "unless-stopped"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    environment:
      SSL_CERT_FILE: "/devel/cacert.pem"
      CURL_CA_BUNDLE: "/devel/cacert.pem"
      REQUESTS_CA_BUNDLE: "/devel/cacert.pem"
      NODE_EXTRA_CA_CERTS: "/devel/cacert.pem"
    healthcheck:
      # Test Redis with PING command - use default connection (no auth in healthcheck)
      # Redis will respond with NOAUTH if it's running, which is sufficient for health
      test:
        ["CMD-SHELL", "redis-cli ping 2>&1 | grep -E 'PONG|NOAUTH' || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s

  openc3-redis-ephemeral:
    read_only: true
    user: "${OPENC3_USER_ID:-1001}:${OPENC3_GROUP_ID:-1001}"
    image: "${OPENC3_REGISTRY}/${OPENC3_NAMESPACE}/openc3-redis${OPENC3_IMAGE_SUFFIX}:${OPENC3_TAG}"
    volumes:
      - "openc3-redis-ephemeral-v:/data"
      - "./cacert.pem:/devel/cacert.pem:z"
      - "./openc3-redis/users.acl:/config/users.acl:z"
    restart: "unless-stopped"
    command: ["redis-server", "/config/redis_ephemeral.conf"]
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    environment:
      SSL_CERT_FILE: "/devel/cacert.pem"
      CURL_CA_BUNDLE: "/devel/cacert.pem"
      REQUESTS_CA_BUNDLE: "/devel/cacert.pem"
      NODE_EXTRA_CA_CERTS: "/devel/cacert.pem"
    healthcheck:
      # Test ephemeral Redis with PING command on port 6380
      # Redis will respond with NOAUTH if it's running, which is sufficient for health
      test:
        [
          "CMD-SHELL",
          "redis-cli -p 6380 ping 2>&1 | grep -E 'PONG|NOAUTH' || exit 1",
        ]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s

  openc3-cosmos-cmd-tlm-api:
    read_only: true
    user: "${OPENC3_USER_ID:-1001}:${OPENC3_GROUP_ID:-1001}"
    image: "${OPENC3_REGISTRY}/${OPENC3_NAMESPACE}/openc3-cosmos-cmd-tlm-api${OPENC3_IMAGE_SUFFIX}:${OPENC3_TAG}"
    restart: "unless-stopped"
    depends_on:
      - "openc3-redis"
      - "openc3-redis-ephemeral"
      - "openc3-buckets"
    volumes:
      - "openc3-cmd-tlm-api-tmp-v:/tmp"
      - "openc3-gems-v:/gems"
      - "./plugins:/plugins:z"
      - "./cacert.pem:/devel/cacert.pem:z"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    # Values are interpolated from .env by compose; only the vars this
    # container actually reads at runtime are passed in (was env_file: .env).
    environment:
      - RAILS_ENV=production
      - GEM_HOME=/gems
      - PYTHONUSERBASE=/gems/python_packages
      - ANYCABLE_REDIS_URL=redis://${OPENC3_REDIS_USERNAME}:${OPENC3_REDIS_PASSWORD}@${OPENC3_REDIS_HOSTNAME}:${OPENC3_REDIS_PORT}
      - SECRET_KEY_BASE=${SECRET_KEY_BASE}
      - WEB_CONCURRENCY=8 # Set to number of cores on your machine
      # Redis
      - OPENC3_REDIS_HOSTNAME=${OPENC3_REDIS_HOSTNAME}
      - OPENC3_REDIS_PORT=${OPENC3_REDIS_PORT}
      - OPENC3_REDIS_USERNAME=${OPENC3_REDIS_USERNAME}
      - OPENC3_REDIS_PASSWORD=${OPENC3_REDIS_PASSWORD}
      - OPENC3_REDIS_EPHEMERAL_HOSTNAME=${OPENC3_REDIS_EPHEMERAL_HOSTNAME}
      - OPENC3_REDIS_EPHEMERAL_PORT=${OPENC3_REDIS_EPHEMERAL_PORT}
      # Buckets / storage
      - OPENC3_BUCKET_URL=${OPENC3_BUCKET_URL}
      - OPENC3_BUCKET_USERNAME=${OPENC3_BUCKET_USERNAME}
      - OPENC3_BUCKET_PASSWORD=${OPENC3_BUCKET_PASSWORD}
      - OPENC3_CONFIG_BUCKET=${OPENC3_CONFIG_BUCKET}
      - OPENC3_LOGS_BUCKET=${OPENC3_LOGS_BUCKET}
      - OPENC3_TOOLS_BUCKET=${OPENC3_TOOLS_BUCKET}
      - OPENC3_GEMS_VOLUME=${OPENC3_GEMS_VOLUME}
      - OPENC3_PLUGIN_DEFAULT_VOLUME=${OPENC3_PLUGIN_DEFAULT_VOLUME}
      - OPENC3_CLOUD=${OPENC3_CLOUD}
      - OPENC3_AWS_ARN_PREFIX=${OPENC3_AWS_ARN_PREFIX}
      - AWS_REGION=${AWS_REGION}
      # TSDB
      - OPENC3_TSDB_HOSTNAME=${OPENC3_TSDB_HOSTNAME}
      - OPENC3_TSDB_INGEST_PORT=${OPENC3_TSDB_INGEST_PORT}
      - OPENC3_TSDB_QUERY_PORT=${OPENC3_TSDB_QUERY_PORT}
      - OPENC3_TSDB_USERNAME=${OPENC3_TSDB_USERNAME}
      - OPENC3_TSDB_PASSWORD=${OPENC3_TSDB_PASSWORD}
      # Misc
      - OPENC3_LOCAL_MODE=${OPENC3_LOCAL_MODE}
      - OPENC3_SERVICE_PASSWORD=${OPENC3_SERVICE_PASSWORD}
      # Optional: bare pass-through (only forwarded if set in host env or .env)
      - OPENC3_DEFAULT_QUEUE
      - OPENC3_AUTH_RATE_LIMIT_TO
      - OPENC3_AUTH_RATE_LIMIT_WITHIN
      - OPENC3_LOG_STDERR
    extra_hosts:
      - host.docker.internal:host-gateway

  openc3-cosmos-script-runner-api:
    read_only: true
    user: "${OPENC3_USER_ID:-1001}:${OPENC3_GROUP_ID:-1001}"
    image: "${OPENC3_REGISTRY}/${OPENC3_NAMESPACE}/openc3-cosmos-script-runner-api${OPENC3_IMAGE_SUFFIX}:${OPENC3_TAG}"
    restart: "unless-stopped"
    depends_on:
      - "openc3-redis"
      - "openc3-redis-ephemeral"
      - "openc3-buckets"
    volumes:
      - "openc3-script-runner-api-tmp-v:/tmp"
      - "openc3-gems-v:/gems:ro"
      - "./plugins:/plugins:z"
      - "./cacert.pem:/devel/cacert.pem:z"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    # Values are interpolated from .env by compose; only the vars this
    # container actually reads at runtime are passed in (was env_file: .env).
    environment:
      - RAILS_ENV=production
      - GEM_HOME=/gems
      - PYTHONUSERBASE=/gems/python_packages
      - OPENC3_USE_UV=true
      - ANYCABLE_REDIS_URL=redis://${OPENC3_REDIS_USERNAME}:${OPENC3_REDIS_PASSWORD}@${OPENC3_REDIS_HOSTNAME}:${OPENC3_REDIS_PORT}
      - SECRET_KEY_BASE=${SECRET_KEY_BASE}
      - WEB_CONCURRENCY=2 # Can be increased if you run many scripts concurrently
      # Redis
      - OPENC3_REDIS_HOSTNAME=${OPENC3_REDIS_HOSTNAME}
      - OPENC3_REDIS_PORT=${OPENC3_REDIS_PORT}
      - OPENC3_REDIS_USERNAME=${OPENC3_REDIS_USERNAME}
      - OPENC3_REDIS_PASSWORD=${OPENC3_REDIS_PASSWORD}
      - OPENC3_REDIS_EPHEMERAL_HOSTNAME=${OPENC3_REDIS_EPHEMERAL_HOSTNAME}
      - OPENC3_REDIS_EPHEMERAL_PORT=${OPENC3_REDIS_EPHEMERAL_PORT}
      # Script Runner reduced-privilege credentials
      - OPENC3_SR_REDIS_USERNAME=${OPENC3_SR_REDIS_USERNAME}
      - OPENC3_SR_REDIS_PASSWORD=${OPENC3_SR_REDIS_PASSWORD}
      - OPENC3_SR_BUCKET_USERNAME=${OPENC3_SR_BUCKET_USERNAME}
      - OPENC3_SR_BUCKET_PASSWORD=${OPENC3_SR_BUCKET_PASSWORD}
      # Buckets / storage
      - OPENC3_BUCKET_URL=${OPENC3_BUCKET_URL}
      - OPENC3_BUCKET_USERNAME=${OPENC3_BUCKET_USERNAME}
      - OPENC3_BUCKET_PASSWORD=${OPENC3_BUCKET_PASSWORD}
      - OPENC3_CONFIG_BUCKET=${OPENC3_CONFIG_BUCKET}
      - OPENC3_LOGS_BUCKET=${OPENC3_LOGS_BUCKET}
      - OPENC3_TOOLS_BUCKET=${OPENC3_TOOLS_BUCKET}
      - OPENC3_GEMS_VOLUME=${OPENC3_GEMS_VOLUME}
      - OPENC3_PLUGIN_DEFAULT_VOLUME=${OPENC3_PLUGIN_DEFAULT_VOLUME}
      - OPENC3_CLOUD=${OPENC3_CLOUD}
      - OPENC3_AWS_ARN_PREFIX=${OPENC3_AWS_ARN_PREFIX}
      - AWS_REGION=${AWS_REGION}
      # TSDB
      - OPENC3_TSDB_HOSTNAME=${OPENC3_TSDB_HOSTNAME}
      - OPENC3_TSDB_INGEST_PORT=${OPENC3_TSDB_INGEST_PORT}
      - OPENC3_TSDB_QUERY_PORT=${OPENC3_TSDB_QUERY_PORT}
      - OPENC3_TSDB_USERNAME=${OPENC3_TSDB_USERNAME}
      - OPENC3_TSDB_PASSWORD=${OPENC3_TSDB_PASSWORD}
      # Misc
      - OPENC3_LOCAL_MODE=${OPENC3_LOCAL_MODE}
      - OPENC3_SERVICE_PASSWORD=${OPENC3_SERVICE_PASSWORD}
      # Optional: bare pass-through (only forwarded if set in host env or .env)
      - OPENC3_LOG_STDERR

  openc3-operator:
    read_only: true
    user: "${OPENC3_USER_ID:-1001}:${OPENC3_GROUP_ID:-1001}"
    image: "${OPENC3_REGISTRY}/${OPENC3_NAMESPACE}/openc3-operator${OPENC3_IMAGE_SUFFIX}:${OPENC3_TAG}"
    restart: "unless-stopped"
    # ports:
    #   - "127.0.0.1:7779:7779" # Open port for the demo router
    #   - "127.0.0.1:8081:8081/udp" # Open a udp port
    depends_on:
      - "openc3-redis"
      - "openc3-redis-ephemeral"
      - "openc3-buckets"
    volumes:
      - "openc3-operator-tmp-v:/tmp"
      - "openc3-gems-v:/gems:ro"
      - "./plugins:/plugins:z"
      - "./cacert.pem:/devel/cacert.pem:z"
      # Add access to the entire C drive on Windows
      # - "/c:/c"
      # Create a dropbox and archive folder for ingest by FileInterface and PreidentifiedRouter
      # - /Users/jmthomas/dropbox:/dropbox
      # - /Users/jmthomas/archive:/archive
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    # Values are interpolated from .env by compose; only the vars this
    # container actually reads at runtime are passed in (was env_file: .env).
    environment:
      # CI is set in Github actions, changes the Demo TLM_LOG_CYCLE_TIME
      # List syntax passes through host CI only if set, omits it otherwise
      - CI
      - GEM_HOME=/gems
      - PYTHONUSERBASE=/gems/python_packages
      - OPENC3_USE_UV=true
      # Redis
      - OPENC3_REDIS_HOSTNAME=${OPENC3_REDIS_HOSTNAME}
      - OPENC3_REDIS_PORT=${OPENC3_REDIS_PORT}
      - OPENC3_REDIS_USERNAME=${OPENC3_REDIS_USERNAME}
      - OPENC3_REDIS_PASSWORD=${OPENC3_REDIS_PASSWORD}
      - OPENC3_REDIS_EPHEMERAL_HOSTNAME=${OPENC3_REDIS_EPHEMERAL_HOSTNAME}
      - OPENC3_REDIS_EPHEMERAL_PORT=${OPENC3_REDIS_EPHEMERAL_PORT}
      # Buckets / storage
      - OPENC3_BUCKET_URL=${OPENC3_BUCKET_URL}
      - OPENC3_BUCKET_USERNAME=${OPENC3_BUCKET_USERNAME}
      - OPENC3_BUCKET_PASSWORD=${OPENC3_BUCKET_PASSWORD}
      - OPENC3_CONFIG_BUCKET=${OPENC3_CONFIG_BUCKET}
      - OPENC3_LOGS_BUCKET=${OPENC3_LOGS_BUCKET}
      - OPENC3_TOOLS_BUCKET=${OPENC3_TOOLS_BUCKET}
      - OPENC3_CLOUD=${OPENC3_CLOUD}
      - OPENC3_AWS_ARN_PREFIX=${OPENC3_AWS_ARN_PREFIX}
      - AWS_REGION=${AWS_REGION}
      # TSDB
      - OPENC3_TSDB_HOSTNAME=${OPENC3_TSDB_HOSTNAME}
      - OPENC3_TSDB_INGEST_PORT=${OPENC3_TSDB_INGEST_PORT}
      - OPENC3_TSDB_QUERY_PORT=${OPENC3_TSDB_QUERY_PORT}
      - OPENC3_TSDB_USERNAME=${OPENC3_TSDB_USERNAME}
      - OPENC3_TSDB_PASSWORD=${OPENC3_TSDB_PASSWORD}
      # Misc
      - OPENC3_LOCAL_MODE=${OPENC3_LOCAL_MODE}
      - OPENC3_SERVICE_PASSWORD=${OPENC3_SERVICE_PASSWORD}
      # Optional: bare pass-through (only forwarded if set in host env or .env)
      - OPENC3_LOG_STDERR
    extra_hosts:
      - host.docker.internal:host-gateway

  openc3-traefik:
    read_only: true
    user: "${OPENC3_USER_ID:-1001}:${OPENC3_GROUP_ID:-1001}"
    image: "${OPENC3_REGISTRY}/${OPENC3_NAMESPACE}/openc3-traefik${OPENC3_IMAGE_SUFFIX}:${OPENC3_TAG}"
    volumes:
      - "./cacert.pem:/devel/cacert.pem:z"
      - "./openc3-traefik/traefik.yaml:/etc/traefik/traefik.yaml:z"
      # To allow HTTP, uncomment OPENC3_ALLOW_HTTP in .env
      # - "./openc3-traefik/traefik-ssl.yaml:/etc/traefik/traefik.yaml:z"
      # - "./openc3-traefik/traefik-letsencrypt.yaml:/etc/traefik/traefik.yaml:z"
      # - "./openc3-traefik/cert.key:/etc/traefik/cert.key:z"
      # - "./openc3-traefik/cert.crt:/etc/traefik/cert.crt:z"
    ports:
      - "127.0.0.1:2900:2900"
      - "127.0.0.1:2943:2943"
      # - "80:2900"
      # - "443:2943"
    restart: "unless-stopped"
    depends_on:
      - "openc3-redis"
      - "openc3-redis-ephemeral"
      - "openc3-buckets"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    environment:
      OPENC3_TOOLS_BUCKET: "${OPENC3_TOOLS_BUCKET}"
      OPENC3_BUCKET_URL: "${OPENC3_BUCKET_URL}"
      OPENC3_ALLOW_HTTP: "${OPENC3_ALLOW_HTTP:-}"
      SSL_CERT_FILE: "/devel/cacert.pem"
      CURL_CA_BUNDLE: "/devel/cacert.pem"
      REQUESTS_CA_BUNDLE: "/devel/cacert.pem"
      NODE_EXTRA_CA_CERTS: "/devel/cacert.pem"
    healthcheck:
      # Use traefik's built-in healthcheck which uses the ping entrypoint
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s

  openc3-cosmos-init:
    read_only: true
    user: "${OPENC3_USER_ID:-1001}:${OPENC3_GROUP_ID:-1001}"
    image: "${OPENC3_REGISTRY}/${OPENC3_NAMESPACE}/openc3-cosmos-init${OPENC3_IMAGE_SUFFIX}:${OPENC3_TAG}"
    restart: on-failure
    depends_on:
      - "openc3-traefik"
      - "openc3-redis"
      - "openc3-redis-ephemeral"
      - "openc3-buckets"
    volumes:
      - "openc3-init-tmp-v:/tmp"
      - "openc3-gems-v:/gems"
      - "./plugins:/plugins:z"
      - "./cacert.pem:/devel/cacert.pem:z"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    # Values are interpolated from .env by compose; only the vars this
    # container actually reads at runtime are passed in (was env_file: .env).
    environment:
      # CI is set in Github actions, changes the Demo TLM_LOG_CYCLE_TIME
      # List syntax passes through host CI only if set, omits it otherwise
      - CI
      - GEM_HOME=/gems
      - PYTHONUSERBASE=/gems/python_packages
      - OPENC3_USE_UV=true
      # Redis
      - OPENC3_REDIS_HOSTNAME=${OPENC3_REDIS_HOSTNAME}
      - OPENC3_REDIS_PORT=${OPENC3_REDIS_PORT}
      - OPENC3_REDIS_USERNAME=${OPENC3_REDIS_USERNAME}
      - OPENC3_REDIS_PASSWORD=${OPENC3_REDIS_PASSWORD}
      - OPENC3_REDIS_EPHEMERAL_HOSTNAME=${OPENC3_REDIS_EPHEMERAL_HOSTNAME}
      - OPENC3_REDIS_EPHEMERAL_PORT=${OPENC3_REDIS_EPHEMERAL_PORT}
      # Buckets / storage
      - OPENC3_BUCKET_URL=${OPENC3_BUCKET_URL}
      - OPENC3_BUCKET_USERNAME=${OPENC3_BUCKET_USERNAME}
      - OPENC3_BUCKET_PASSWORD=${OPENC3_BUCKET_PASSWORD}
      - OPENC3_CONFIG_BUCKET=${OPENC3_CONFIG_BUCKET}
      - OPENC3_LOGS_BUCKET=${OPENC3_LOGS_BUCKET}
      - OPENC3_TOOLS_BUCKET=${OPENC3_TOOLS_BUCKET}
      # initbuckets reads this to grant the reduced-privilege ScriptRunner
      # bucket user read access to the config/logs buckets (ensure_scriptrunner_policy)
      - OPENC3_SR_BUCKET_USERNAME=${OPENC3_SR_BUCKET_USERNAME}
      - OPENC3_CLOUD=${OPENC3_CLOUD}
      - OPENC3_AWS_ARN_PREFIX=${OPENC3_AWS_ARN_PREFIX}
      - AWS_REGION=${AWS_REGION}
      # TSDB
      - OPENC3_TSDB_HOSTNAME=${OPENC3_TSDB_HOSTNAME}
      - OPENC3_TSDB_INGEST_PORT=${OPENC3_TSDB_INGEST_PORT}
      - OPENC3_TSDB_QUERY_PORT=${OPENC3_TSDB_QUERY_PORT}
      - OPENC3_TSDB_USERNAME=${OPENC3_TSDB_USERNAME}
      - OPENC3_TSDB_PASSWORD=${OPENC3_TSDB_PASSWORD}
      # Misc
      - OPENC3_LOCAL_MODE=${OPENC3_LOCAL_MODE}
      - OPENC3_SERVICE_PASSWORD=${OPENC3_SERVICE_PASSWORD}
      # Install-time flags consumed by init.sh / openc3cli.
      # Bare pass-through: only forwarded if set in host env or .env.
      - OPENC3_DEMO
      - OPENC3_FORCE_INSTALL
      - OPENC3_NO_MIGRATE
      - OPENC3_NO_BUCKET_POLICY
      - OPENC3_DEFAULT_QUEUE
      - OPENC3_INIT_WAIT_TIMEOUT
      - OPENC3_ISTIO_ENABLED
      - OPENC3_LOG_STDERR
      # Per-tool install opt-outs
      - OPENC3_NO_CMDTLMSERVER
      - OPENC3_NO_LIMITSMONITOR
      - OPENC3_NO_CMDSENDER
      - OPENC3_NO_SCRIPTRUNNER
      - OPENC3_NO_PACKETVIEWER
      - OPENC3_NO_TLMVIEWER
      - OPENC3_NO_TLMGRAPHER
      - OPENC3_NO_DATAEXTRACTOR
      - OPENC3_NO_DATAVIEWER
      - OPENC3_NO_HANDBOOKS
      - OPENC3_NO_TABLEMANAGER
      - OPENC3_NO_TOOLADMIN
      - OPENC3_NO_BUCKETEXPLORER
      - OPENC3_NO_DOCS

volumes:
  openc3-tsdb-tmp-v: {}
  openc3-tsdb-v: {}
  openc3-redis-v: {}
  openc3-redis-ephemeral-v: {}
  openc3-object-v: {}
  openc3-gems-v: {}
  openc3-cmd-tlm-api-tmp-v: {}
  openc3-script-runner-api-tmp-v: {}
  openc3-operator-tmp-v: {}
  openc3-init-tmp-v: {}