# broker-control — internal control sidecar (spec §29)
#
# Runs in the mosquitto container's PID namespace (compose `pid: "service:mosquitto"`)
# so it can signal the broker process (PID 1) without docker.sock access.
# The backend calls its HTTP API over the backend-net network.
#
# Responsibilities (deliberately minimal, spec §29):
#   - validate staged configuration (mosquitto -c <staged> --test-config)
#   - activate a configuration revision (atomic rename into place)
#   - signal config reload (mosquitto_signal -p 1 config-reload == SIGHUP)
#   - check broker process state
#
# Release 1 ships validate/activate/reload/status only; restarts are a
# Release 2 concern (reload-vs-restart classification, spec §28).

FROM eclipse-mosquitto:2.1.2-alpine

# Same image as the broker → --test-config validates with the exact
# broker binary that will load the config.

# The base image ships NO Python. control.py is stdlib-only, so the
# distro package is sufficient (no pip, no venv needed).
RUN apk add --no-cache python3

COPY control.py /app/control.py

# The base image has no USER directive, so this sidecar runs as root.
# Deliberate: it writes /mosquitto/config (owned by uid 1883 in the fresh
# volume) and signals the broker via the shared PID namespace. The API
# is token-guarded, internal-network-only, and no docker.sock is mounted
# (spec §29).

# Clear the CMD inherited from the base image — its default CMD
# (`mosquitto -c ...`) would otherwise be appended to our entrypoint.
CMD []

EXPOSE 8090

ENTRYPOINT ["python3", "/app/control.py"]