# Core Compose

This compose file mirrors the current Mattermost-based runtime shape inside the
`services/core` module.

## Local Runtime

```sh
cd services/core/compose
cp -n .env.example .env
docker compose pull
docker compose up -d
```

`latest` is the verified stable pointer for nexo-owned runtime images.
When running or updating, you should run `docker compose pull && docker compose up -d` to fetch the latest stable images.

Runtime state is written to `services/core/data/`, which is ignored by git.
Place push-proxy configuration under
`services/core/data/push-proxy/config/mattermost-push-proxy.json` when FCM smoke
testing is needed.

The default host ports are `18065` for core and `18066` for push-proxy so this
test deployment can run beside the existing Mattermost service.

The Docker network subnet is fixed to `172.38.0.0/16`. Treat this range as
reserved for nexo and do not reuse it for other Docker networks.

## Secret Boundary

Commit only `.env.example`. Keep `.env`, runtime data, logs, push-proxy
credentials, certificates, and license files out of git. If a new credential or
runtime path is added, first add the example variable or documented path here,
then confirm the concrete value or generated file is ignored.

## Smoke Checks

Run these checks after `docker compose up -d`.

```sh
curl -fsS "http://localhost:${NEXO_CORE_PORT:-18065}/api/v4/system/ping"
docker compose exec db pg_isready -U mmuser -d mattermost
curl -fsSI "http://localhost:${NEXO_CORE_PORT:-18065}"
```

The core ping response should report `status` as `OK`, Postgres should accept
connections for the `mattermost` database, and the Mattermost app should return
an HTTP response from the mapped core port.

For the minimum push-proxy smoke, confirm the service is running and the core
service still points at the compose-network DNS name:

```sh
docker compose ps push-proxy
docker compose config | rg --fixed-strings \
  "MM_EMAILSETTINGS_PUSHNOTIFICATIONSERVER=http://push-proxy:8066"
```

FCM/APNS credential validation is not part of the default smoke. Run it only
when a real push-proxy config is present outside git.

## Remote Parity

The remote development copy lives under `~/docker/services/nexo/compose`. Local
and remote compose inputs should match unless a work report explicitly records
an intentional temporary drift.

```sh
cd services/core/compose
sha256sum docker-compose.yml .env.example
ssh <host> 'cd ~/docker/services/nexo/compose && sha256sum docker-compose.yml .env.example'
```

The two `sha256sum` outputs should match for both files before remote runtime
smoke is treated as equivalent to local compose smoke.