# HostStack native Rust deployment for MessageWeave.
#
# Set REDIS_URL and CONFIG_ENCRYPTION_KEY as encrypted HostStack dashboard
# secrets; never put their values in this repository.
#
# Business config (JMAP URL + credentials, Telegram bot token, worker token,
# chat allowlist, LLM settings) is NOT read from environment variables at all.
# It is written to Redis via /api/bootstrap or admin PUT on /api/config.
#
# Precedence (verified in the HostStack agent source, deploy-executor.ts).
# Three layers, in order:
#   1. the values already stored on the dashboard services row -> payload
#   2. a field DECLARED here unconditionally overwrites that (guard is
#      `if (svcConfig.start?.command)`, with no `&& !payload.x`), so this
#      file wins over the dashboard for the fields it declares
#   3. a field OMITTED here keeps the dashboard value; the per-runtime
#      framework default then fills in only if that is still empty, which
#      for an existing service it never is -- the agent's own comment reads
#      "trigger-payload always populates payload.x from the DB", so that
#      branch is effectively dead code
#
# For runtime: rust those framework defaults are `cargo fetch` /
# `cargo build --release` / `./target/release/app`.
#
# Consequence: deleting this file does NOT fall back to safe defaults. It
# makes the dashboard's stored values take effect as-is, and that stored
# Start Command is HostStack's Rust default `./target/release/app` -- which
# is not this package's binary name. Cargo.toml declares
# [[bin]] name = "message-weave" with path = "src/main.rs"; there is no
# `app` target and no app.rs. The next deploy would exit with
# `./target/release/app: not found` before binding the port.
# To drop this file, first correct all three commands in the dashboard UI,
# then delete and redeploy to verify. See docs/deployment.md §5.1.
#
# Do NOT add --debug here for production. See the note above start.command.
services:
  web:
    type: web_service
    runtime: rust
    install:
      command: cargo fetch --locked
    build:
      # --locked on both steps: fail rather than rewriting Cargo.lock mid-deploy.
      command: cargo build --release --locked
    start:
      # Binary is named after the Cargo package: `message-weave`, not `app`.
      # Do NOT add --debug here for production.
      command: ./target/release/message-weave
      # Temporary diagnosis only: change the line above to
      #   command: ./target/release/message-weave --debug
      # and set the DEBUG_TOKEN secret. The debug surface is gated by BOTH
      # factors — the argv flag AND a non-empty DEBUG_TOKEN — read once at
      # process start. Then probe it from inside the container, never through
      # the public domain:
      #   curl -s -i -H "Authorization: Bearer <token>" http://127.0.0.1:8080/debug/config
      # See docs/deployment.md §2.1 for the double-factor gate.
    healthCheck:
      # /healthz only, never /ready. /ready also probes redis, the JMAP session
      # and Telegram getMe, so a transient upstream blip would restart the
      # container. See docs/deployment.md §2.1.
      path: /healthz
      interval: 30
      timeout: 5