compose.yml

name: ${NETWORK}
services:
  initialize-openssl:
    image: ${OPEN_SSL_IMAGE}:${OPEN_SSL_TAG}
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        if [ ! -f /jwt/jwt.hex ]; then
          echo 'INFO Generating jwt secret'
          openssl rand -hex 32 | tr -d '\n' > /jwt/jwt.hex
        else
          echo 'INFO JWT secret already exists'
        fi
        if [ ! -f /consensus/ec-secp256k1-non-validator.pem ]; then
          echo 'INFO Generating secp256k1 keypair for non-validator'
          openssl ecparam -name secp256k1 -genkey -noout -out /consensus/ec-secp256k1-non-validator.pem
          openssl ec -in /consensus/ec-secp256k1-non-validator.pem -outform DER -no_public -out /consensus/ec-secp256k1-non-validator.der
        else
          echo 'INFO secp256k1 keypair for non-validator already exists'
        fi
        echo 'INFO OpenSSL initialization completed'
    env_file: config/${NETWORK}/.env
    container_name: ${NETWORK}-initialize-openssl
    volumes:
      - consensus-data:/consensus:rw
      - jwt-secret:/jwt:rw

  # Consensus snapshot is a single LMDB file. initialize-consensus only detects
  # /consensus/data.mdb, so the archive member is renamed to data.mdb. Any
  # existing database/lock is cleared first; node identity files (generated by
  # initialize-openssl) are left untouched. The restore runs before the init below
  # so a snapshot is used when present, falling back to a fresh database otherwise.
  initialize-consensus:
    image: ${CONSENSUS_IMAGE}:${CONSENSUS_TAG}
    user: "0:0"
    entrypoint: ["/bin/bash", "-c"]
    command:
      - |
        set -euo pipefail
        if [ -f /consensus/data.mdb ]; then
          echo "INFO Consensus database already exists at /consensus/data.mdb; skipping restore" >&2
        else
          archive="$$(ls -1 /snapshots/consensus-*.tar.gz 2>/dev/null | sort | tail -n 1 || true)"
          if [ -z "$$archive" ]; then
            echo "INFO No consensus-*.tar.gz found in /snapshots (SNAPSHOT_DIRECTORY=$$SNAPSHOT_DIRECTORY)" >&2
            echo "INFO Skipping consensus database restore" >&2
          else
            echo "INFO Restoring consensus database from $$(basename "$$archive")"
            rm -f /consensus/data.mdb /consensus/lock.mdb
            tar -xzf "$$archive" -C /consensus \
              --numeric-owner --same-owner --same-permissions \
              --transform "s,^.*consensus-[^/]*$$,data.mdb,"
            if [ ! -f /consensus/data.mdb ]; then
              echo "ERROR Restore did not produce /consensus/data.mdb" >&2
              exit 1
            fi
            echo "INFO Consensus database restored to /consensus/data.mdb"
          fi
        fi

        if [ ! -f /consensus/data.mdb ]; then
          echo "INFO Generating consensus database for $$NETWORK network"
          if [ -n "$${NODE_ROLE:-}" ]; then
            if [ "$$NODE_ROLE" = "validator" ]; then
              config_file=validator
            else
              config_file=non-validator
            fi
            plasma-cli init \
              --data-dir /consensus \
              --chain /node/genesis.json \
              "$$NODE_ROLE" \
              --config-path "/tmp/$$config_file.toml"
          else
            plasma-cli init \
              --chain /node/genesis.json \
              --data-dir /consensus
          fi
        fi

        if [ ! -f /config/peer-id.txt ]; then
          echo "INFO Generating peer ID for non-validator"
          plasma-cli peer-id \
            --identity-file-path /consensus/ec-secp256k1-non-validator.der > /config/peer-id.txt
        else
          echo "INFO Peer ID for non-validator already exists"
        fi
    env_file: config/${NETWORK}/.env
    container_name: ${NETWORK}-initialize-consensus
    volumes:
      - consensus-data:/consensus:rw
      - genesis:/config:rw
      - ${SNAPSHOT_DIRECTORY}:/snapshots:ro
      - ./config/${NETWORK}/genesis.json:/node/genesis.json:ro
      - ./config/${NETWORK}/non-validator.toml:/tmp/non-validator.toml:ro
      - ./config/${NETWORK}/validator.toml:/tmp/validator.toml:ro
    depends_on:
      initialize-openssl:
        condition: service_completed_successfully

  # Execution snapshot is a tar of the reth data/ directory. Stripping one leading
  # component drops the data/ prefix so contents land directly under the reth
  # datadir (/execution/db, /execution/static_files, ...). A pre-existing reth
  # discovery secret is preserved if the snapshot does not carry one. The restore
  # runs before the init below so a snapshot is used when present, falling back to
  # a fresh database otherwise.
  initialize-execution:
    image: ${EXECUTION_IMAGE}:${EXECUTION_TAG}
    user: "0:0"
    entrypoint: ["/bin/bash", "-c"]
    command:
      - |
        set -euo pipefail
        if [ -d /execution/db ]; then
          echo "INFO Execution database already exists at /execution/db; skipping restore" >&2
        else
          archive="$$(ls -1 /snapshots/execution-*.tar.gz 2>/dev/null | sort | tail -n 1 || true)"
          if [ -z "$$archive" ]; then
            echo "INFO No execution-*.tar.gz found in /snapshots (SNAPSHOT_DIRECTORY=$$SNAPSHOT_DIRECTORY)" >&2
            echo "INFO Skipping execution database restore" >&2
          else
            echo "INFO Restoring execution database from $$(basename "$$archive")"
            secret=/tmp/discovery-secret
            if [ -f /execution/discovery-secret ]; then cp -p /execution/discovery-secret "$$secret"; fi
            find /execution -mindepth 1 -maxdepth 1 -exec rm -rf {} +
            tar -xzf "$$archive" -C /execution \
              --strip-components=1 --numeric-owner --same-owner --same-permissions
            if [ -f "$$secret" ] && [ ! -f /execution/discovery-secret ]; then
              cp -p "$$secret" /execution/discovery-secret
            fi
            if [ ! -d /execution/db ]; then
              echo "ERROR Restore did not produce /execution/db" >&2
              exit 1
            fi
            echo "INFO Execution database restored to /execution"
          fi
        fi

        if [ ! -f /execution/db/mdbx.dat ]; then
          echo "INFO Generating execution database for $$NETWORK network"
          reth init \
            --chain /node/genesis.json \
            --datadir /execution \
            --log.file.directory /execution/log
        fi
    env_file: config/${NETWORK}/.env
    container_name: ${NETWORK}-initialize-execution
    volumes:
      - execution-data:/execution:rw
      - jwt-secret:/jwt:ro
      - ${SNAPSHOT_DIRECTORY}:/snapshots:ro
      - ./config/${NETWORK}/genesis.json:/node/genesis.json:ro
    depends_on:
      initialize-consensus:
        condition: service_completed_successfully

  execution:
    image: ${EXECUTION_IMAGE}:${EXECUTION_TAG}
    restart: unless-stopped
    user: "0:0"
    entrypoint: ["/bin/bash", "-c"]
    command:
      - |
        reth node \
          --chain /node/genesis.json \
          --datadir /execution \
          --trusted-peers "$$EXECUTION_TRUSTED_PEERS" \
          --authrpc.jwtsecret /jwt/jwt.hex \
          --authrpc.addr 0.0.0.0 \
          --authrpc.port 8551 \
          --http \
          --http.addr 0.0.0.0 \
          --http.api eth,net,web3,txpool,debug \
          --http.corsdomain '*' \
          -vvv \
          --metrics 0.0.0.0:9001 \
          --color never \
          --rpc.gascap "600000000" \
          --txpool.gas-limit "36000000" \
          --txpool.blobpool-max-count "0" \
          --txpool.blobpool-max-size "0" \
          --txpool.blob-cache-size "0" \
          --log.file.directory /execution/log
    env_file: config/${NETWORK}/.env
    container_name: ${NETWORK}-execution
    ports:
      - "${EXECUTION_P2P_PORT}:30303"
      - "${EXECUTION_P2P_PORT}:30303/udp"
      - "${EXECUTION_RPC_PORT}:8545"
    expose:
      - "9001" # metrics
    healthcheck:
      test:
        [
          "CMD",
          "bash",
          "-c",
          "exec 6<> /dev/tcp/localhost/8545 && exec 6<> /dev/tcp/localhost/8551",
        ]
      interval: 10s
      timeout: 10s
      retries: 30
    volumes:
      - execution-data:/execution:rw
      - jwt-secret:/jwt:ro
      - ./config/${NETWORK}/genesis.json:/node/genesis.json:ro
    depends_on:
      initialize-execution:
        condition: service_completed_successfully
    networks:
      - plasma

  consensus:
    image: ${CONSENSUS_IMAGE}:${CONSENSUS_TAG}
    restart: unless-stopped
    user: "0:0"
    entrypoint: ["/bin/bash", "-c"]
    command:
      - |
        if [ "$${NODE_ROLE:-observer}" = "validator" ]; then
          role=node
          config_file=validator
        else
          role=observer
          config_file=non-validator
        fi
        plasma-cli "$$role" \
          --config-path "/tmp/$$config_file.toml" \
          --no-color \
          --timeout-stream-manager 10ms \
          --telemetry.enable-metrics \
          --telemetry.enable-health \
          --telemetry.host 0.0.0.0 \
          --telemetry.port 9001 \
          -vvv
    ports:
      - "${CONSENSUS_P2P_PORT}:34070"
    expose:
      - "9001" # metrics
    env_file:
      - config/${NETWORK}/.env
      - path: config/${NETWORK}/.env.secret
        required: false
    container_name: ${NETWORK}-consensus
    volumes:
      - consensus-data:/consensus:rw
      - ./config/${NETWORK}/non-validator.toml:/tmp/non-validator.toml:ro
      - ./config/${NETWORK}/validator.toml:/tmp/validator.toml:ro
      - ${VALIDATOR_KEYSTORE_FILE:-/dev/null}:/consensus-secrets/validator-keystore.json:ro
      - jwt-secret:/jwt:ro
      - ./config/${NETWORK}/genesis.json:/node/genesis.json:ro
    depends_on:
      initialize-consensus:
        condition: service_completed_successfully
      execution:
        condition: service_healthy
    networks:
      - plasma

volumes:
  consensus-data:
  execution-data:
  jwt-secret:
  genesis:

networks:
  plasma:
    # Shared docker bridge network, used by all nodes and the monitoring stack.
    # Created externally once with `docker network create plasma`, then reused.
    external: true
    name: plasma