app:
  id: conduit-market
  name: Conduit Market
  version: 1.0.0
  # Built by this project from a pinned upstream commit (Conduit ships no
  # Dockerfile of its own) — there is no upstream release feed/tag to watch,
  # so re-pin CONDUIT_COMMIT in the Dockerfile deliberately, by hand.
  upstream:
    kind: github
    repo: Conduit-BTC/conduit-mono
  description: |
    Decentralized Nostr + Lightning marketplace (apps/market from
    Conduit-BTC/conduit-mono). Pure client-side SPA — listings are NIP-99
    events, orders are encrypted DMs, payments settle over Lightning via
    NWC — confirmed by reading packages/core/src/config.ts and
    apps/market/package.json directly; there is no custom backend to run.

    Public/private is a genuine runtime toggle, not two separate builds:
    Vite bakes VITE_* relay env vars into the bundle at compile time (see
    the comment on getViteEnv() in config.ts), so a single image built once
    could never be reconfigured afterward via ordinary env vars. This
    package patches config.ts (docker/conduit-market/apply-runtime-override.py)
    to merge in a window.__CONDUIT_RUNTIME_ENV__ override object, written by
    docker-entrypoint.sh from CONDUIT_MODE/CONDUIT_PRIVATE_RELAY_URLS at
    container *start*. Flipping CONDUIT_MODE and restarting the container is
    enough — no rebuild required. CONDUIT_MODE=private with no relay URL set
    refuses to start rather than silently falling back to the public network.
  category: money

  container:
    build:
      context: /opt/archipelago/docker/conduit-market
      dockerfile: Dockerfile
      tag: localhost/conduit-market:local
    network: archy-net

  dependencies: []

  resources:
    memory_limit: 64Mi

  security:
    capabilities: []
    # false, not true: docker-entrypoint.sh regenerates runtime-env.js under
    # /usr/share/nginx/html (part of the image root fs, not a volume) on
    # every container start — that's the actual public/private switch, so
    # the root fs must stay writable for the mode flip to take effect.
    readonly_root: false
    no_new_privileges: true
    network_policy: bridge

  ports:
    - host: 8091
      container: 8080
      protocol: tcp
      bind: 127.0.0.1
      auth: none
      auth_rationale: >-
        Public storefront meant for anonymous shoppers, not an admin
        surface — Conduit has no login of its own (identity is a Nostr
        keypair held client-side) and a cookie/session gate in front of it
        would just block real customers from browsing or checking out.

  volumes: []

  # CONDUIT_MODE (public|private) and CONDUIT_PRIVATE_RELAY_URLS are the
  # actual public/private switch, read by docker-entrypoint.sh at container
  # start — see the description above. Defaults here are the safe/inert
  # choice (public, using Conduit's own canonical relay network); an
  # operator who wants an isolated single-relay storefront sets both.
  environment:
    - CONDUIT_MODE=public
    - CONDUIT_PRIVATE_RELAY_URLS=
    - CONDUIT_LIGHTNING_NETWORK=mainnet

  health_check:
    type: http
    endpoint: http://127.0.0.1:8091
    path: /health
    interval: 30s
    timeout: 5s
    retries: 3

  interfaces:
    main:
      name: Storefront
      description: Conduit Market storefront
      type: ui
      port: 8091
      protocol: http
      path: /

  metadata:
    category: money
    tier: optional
    author: Conduit-BTC
    repo: https://github.com/Conduit-BTC/conduit-mono
    features:
      - Nostr-native marketplace listings (NIP-99)
      - Encrypted order flow over Nostr DMs
      - Lightning checkout via Nostr Wallet Connect
      - Runtime-configurable public or private relay mode, no rebuild