Installation & Deployment

# =============================================================================
# HikariCP Connection Pools
# =============================================================================

# Shared pool defaults (apply to all datasources unless overridden below)
DB_MAX_POOL_SIZE=10
DB_MIN_IDLE=5
DB_CONNECTION_TIMEOUT_MS=30000

# Main FTACS datasource pool. Handles CPE management, parameters,
# provisioning operations. Needs a larger pool due to high concurrency.
FTACS_MAX_POOL=30
FTACS_MIN_POOL=5

# Quartz job scheduler datasource. Used for scheduled task persistence
# (UpdateGroup, QoE, Events). Lower load than the main datasource.
QUARTZ_MAX_POOL=10
QUARTZ_MIN_POOL=2

# ClickHouse analytics datasource. Used for QoE data and statistics.
CLICKHOUSE_MAX_POOL=10
CLICKHOUSE_MIN_POOL=2

# =============================================================================
# ACS Deployment Mode
# Controls which functionality is active. Used for distributed deployments
# where provisioning and management run on separate nodes.
# =============================================================================

# ALL    = full functionality (provisioning + management) -- single-node default
# PROV   = provisioning only (device bootstrap, session handling)
# MNGMNT = management only (device monitoring, configuration)
# In MNGMNT mode, FTACS connects to a separate Hazelcast "provision" cluster.
# FTACS_MODE=ALL

# =============================================================================
# Server IP Address
# Advertised to CPE devices for callbacks and connection requests.
# Auto-detected from the hostname if not set. Set explicitly in Docker/NAT
# environments where auto-detection returns an unreachable address.
# =============================================================================

# IPv4 address advertised to CPE devices (e.g. 192.168.1.100)
# FTACS_IP_ADDRESS=

# IPv6 address for dual-stack deployments. Brackets are added automatically.
# FTACS_IPV6_ADDRESS=

# =============================================================================
# Event Subscription Parameters
# Control when parameter change notifications are sent to subscriber URLs.
# =============================================================================

# 0 = notify on every parameter update (EACH_VALUE trigger)
# 1 = notify only when the value actually changes (VALUE_CHANGE trigger)
# FTACS_SUBSCRIPTION_PARAMETER_ONLY_VALUE_CHANGE=0

# 0 = include all parameter values (including null/empty)
# 1 = skip notifications for null or empty values
# FTACS_SUBSCRIPTION_PARAMETER_NOT_NULL_ONLY=0

# =============================================================================
# TR-069 Endpoint URL Mappings
# Each defines the servlet URL path for a different authentication mode.
# Multiple paths can be comma-separated.
# =============================================================================

# No authentication -- CPE connects without credentials
WEB_TR069_NO_AUTH=/ftacs/ACS

# HTTP Basic Authentication (RFC 7617) -- CPE sends base64(user:password)
WEB_TR069_BASIC=/ftacs-basic/ACS

# HTTP Digest Authentication (RFC 2617) -- challenge-response, no plaintext password
WEB_TR069_DIGEST=/ftacs-digest/ACS

# =============================================================================
# MQTT Protocol (optional)
# Activates the embedded MQTT broker for TR-369/USP MQTT-MTP transport.
# =============================================================================

MQTT_ENABLE=false

# Additional MQTT transport connector URI (ActiveMQ format).
# Format: mqtt+nio://<host>:<port> or mqtt+nio+ssl://<host>:<port>
# FT_MQTT_ADDITIONAL_CONNECTOR_URI=

# Active MQTT API versions. Incoming requests are validated against this list.
# MQTT_ACTIVE_API=api-v1,api-v2

# =============================================================================
# USP Protocol (optional)
# =============================================================================

# Path to the USP data model XML specification (BBF TR-181-2).
# Loaded from the filesystem first; falls back to a classpath resource.
# USP_SERVER_DM_PATH=tr-181-2-16-0-usp-full.xml

# =============================================================================
# X509 Certificates -- USP TLS/DTLS (optional)
# Used for secure USP MTP connections (WebSocket, STOMP, CoAP over DTLS).
# Format: JKS or PKCS12 keystore files.
# =============================================================================
# FT_USP_X509_KEYSTORE_PATH=        # Server keystore with private key and certificate
# FT_USP_X509_KEYSTORE_PASSWORD=    # Keystore file password
# FT_USP_X509_KEYSTORE_PK_PASSWORD= # Private key password (if it differs)
# FT_USP_X509_TRUSTSTORE_PATH=      # Truststore with trusted CA certificates
# FT_USP_X509_TRUSTSTORE_PASSWORD=  # Truststore file password

# =============================================================================
# X509 Certificates -- MQTT TLS (optional)
# Used for MQTTS on port 8883. Enables mutual TLS when a truststore is set.
# =============================================================================
# FT_MQTT_X509_KEYSTORE_PATH=
# FT_MQTT_X509_KEYSTORE_PASSWORD=
# FT_MQTT_X509_PK_PASSWORD=
# FT_MQTT_X509_TRUSTSTORE_PATH=
# FT_MQTT_X509_TRUSTSTORE_PASSWORD=

# =============================================================================
# General Async Executor (used by @Async methods without an explicit executor)
# =============================================================================

# Minimum threads always running. Idle core threads are reclaimed after
# ASYNC_KEEPALIVE seconds (allowCoreThreadTimeout=true).
ASYNC_CORE=10

# Maximum threads under load. When ASYNC_QUEUE=0, threads spawn immediately
# up to this limit before tasks go to an external 10,000-task overflow queue.
ASYNC_MAX=200

# Internal queue capacity before spawning new threads.
# 0 = no internal queue (SynchronousQueue); tasks spawn threads immediately.
# An external OverflowingExecutor with a 10,000-task queue wraps the pool as a
# safety net, blocking on overflow to provide backpressure.
ASYNC_QUEUE=0

# Seconds an idle thread stays alive before termination.
ASYNC_KEEPALIVE=60

# Thread pool size for @Scheduled methods (virtual threads enabled).
# Handles periodic tasks: statistics flush (every 60s), counter reset (daily).
# Quartz jobs use a separate JDBC-based scheduler, not this pool.
SCHED_POOL=300

# =============================================================================
# HikariCP Tuning (optional)
# Applies to ALL three datasources (ftacs, quartz, clickhouse).
# =============================================================================

# Max time (ms) a connection can sit idle before removal. Default: 60000
# HIKARI_IDLE_TIMEOUT_MS=60000

# Max time (ms) to wait for a connection from the pool. Default: 45000
# HIKARI_CONN_TIMEOUT_MS=45000

# Max age (ms) of a connection before forced rotation. Default: 180000
# Must be greater than HIKARI_IDLE_TIMEOUT_MS.
# HIKARI_MAX_LIFETIME_MS=180000

# Max time (ms) for the connection validation query (SELECT 1). Default: 3000
# HIKARI_VALIDATION_TIMEOUT_MS=3000

# Register HikariCP pool metrics as JMX MBeans (true/false).
# HIKARI_REGISTER_MBEANS=false

x-db-env: &db-env
  DB_VENDOR: ${DB_PROFILE}
  DB_HOST: ${DB_HOST}
  MYSQL_PORT: ${DB_PORT}
  MYSQL_USER: ${DB_USER}
  MYSQL_SCHEMA_FTACS: ftacs
  MYSQL_SCHEMA_QUARTZ: ftacs_quartz
  FTACS_PASSWORD: ${DB_PASSWORD}
  QUARTZ_PASSWORD: ${DB_PASSWORD}

services:

  ftacs:
    image: hub.friendly-tech.com/ftacs/ftacs:latest
    container_name: ftacs
    # The database, ClickHouse and Hazelcast are external to this stack, so there
    # is no depends_on. They must be healthy before ftacs starts -- DB_HOST,
    # CLICKHOUSE_HOST and HZ_MEMBERS in .env point at them.
    env_file:
      - .env
      - ./ftacs/.env
    environment:
      <<: *db-env
      USE_NOHUP: 0
      # ftacs uses the clickhouse-java HTTP client, so it must target the HTTP
      # port (8123), not the native TCP port (9000) that CLICKHOUSE_PORT defaults
      # to in the shared .env. Without this remap, ClickHouse connections fail.
      CLICKHOUSE_PORT: "${CLICKHOUSE_HTTP_PORT:-8123}"
      JAVA_OPTS: "${FT_ACS_JAVA_RAM:--Xms1g -Xmx4g} -Duser.timezone=${TZ:-Europe/Kyiv}"
    ports:
      # TR-069 / REST / SOAP
      - "${FTACS_HTTP_PORT:-8080}:8080"
      - "${FTACS_HTTPS_PORT:-8443}:8443"
      - "${ACS_HTTP_ADDITIONAL:-8181}:8181"
      # MQTT
      - "${ACS_MQTT:-1883}:1883"
      - "${ACS_MQTT_TLS:-8883}:8883"
      # USP (TR-369)
      - "${ACS_USP_WS:-8025}:8025"
      - "${ACS_USP_WSS:-4430}:4430"
      - "${ACS_USP_MQTT:-18881}:18881"
      - "${ACS_USP_MQTT_TLS:-18882}:18882"
      - "${ACS_USP_BULK:-18891}:18891"
      - "${ACS_USP_STOMP:-61617}:61617"
      - "${ACS_USP_STOMP_TLS:-61618}:61618"
      - "${ACS_USP_CoAP:-5783}:5783/udp"
      - "5784:5784/udp"
      # LWM2M Bootstrap
      - "${BS_PORT_NOSEC:-5680}:5680/udp"
      - "${BS_PORT_PSK:-5681}:5681/udp"
      - "${BS_PORT_X509:-5682}:5682/udp"
      - "${BS_TCP_PORT_NOSEC:-5880}:5880"
      # LWM2M Server
      - "${LWM2M_PORT_NOSEC:-5683}:5683/udp"
      - "${LWM2M_PORT_PSK:-5684}:5684/udp"
      - "${LWM2M_PORT_X509:-5685}:5685/udp"
      - "${LWM2M_TCP_PORT_NOSEC:-5883}:5883"
    volumes:
      - ./ftacs/config:/opt/FTACS/conf:ro
      - ./ftacs/logs:/opt/FTACS/logs
    healthcheck:
      test: ["CMD", "pgrep", "-f", "com.friendly.acs.FtAcsApp"]
      interval: 20s
      timeout: 5s
      retries: 10
      start_period: 60s
    restart: unless-stopped
    stop_grace_period: 45s
    extra_hosts:
      - "host.docker.internal:host-gateway"   # peers running on this host outside Docker
    networks:
      - ft-network