# Local mail server for email-connect integration tests (EMAIL-WP-0005-T02).
#
# GreenMail serves SMTP and IMAP from one container and creates the declared
# accounts at startup, which is what the scanner's IMAP source and the
# transactional service's SMTP provider need.
#
# Everything here is test-only. The credentials below are deliberately
# non-secret and belong in the repo; real provider material is routed through
# OpenBao (see .claude/rules/credential-routing.md) and must never appear here.
services:
  greenmail:
    image: greenmail/standalone:2.1.12@sha256:9f32971b4f25d32b4de6fa2e297423768441c65e4541f6aecd7631c890a229a7
    container_name: email-connect-harness
    # Loopback-only bindings. The harness accepts unauthenticated-ish test
    # traffic and must never be reachable from the network.
    ports:
      - "127.0.0.1:3025:3025"   # SMTP
      - "127.0.0.1:3143:3143"   # IMAP
      - "127.0.0.1:8080:8080"   # GreenMail API (readiness, purge)
    environment:
      GREENMAIL_OPTS: >-
        -Dgreenmail.setup.test.smtp
        -Dgreenmail.setup.test.imap
        -Dgreenmail.hostname=0.0.0.0
        -Dgreenmail.auth.disabled
        -Dgreenmail.verbose
    # The image ships no curl/wget/nc, so readiness is probed with bash's
    # /dev/tcp against both mail ports.
    healthcheck:
      test:
        - CMD
        - bash
        - -c
        - "exec 3<>/dev/tcp/127.0.0.1/3025 && exec 4<>/dev/tcp/127.0.0.1/3143"
      interval: 2s
      timeout: 3s
      retries: 30
      start_period: 5s