okengine 0.2.8 → 0.3.4

package/src/docker/compose.ts

@@ -18,7 +18,7 @@ import type {
 } from "./types.ts";
 import { DEFAULT_DOCKER_DIR } from "./types.ts";
 import { generateCredentials } from "./credentials.ts";
-import { hostPortForInstance, instancePortOffset } from "./stack-id.ts";
+import { extraHostPortForInstance, hostPortForInstance, STACK_CONTROL_KEYS } from "./stack-id.ts";
 import { APP_PORT } from "../runtime/types.ts";
 
 /** Canonical layer-4 filename — never written by derivation. */
@@ -110,13 +110,17 @@ export function emitComposeLayers(
   files.push({ path: "compose.yml", content: `${toYaml(base)}\n` });
 
   // Layer 2 — per-role
-  const extraHostOffset = options.instanceId ? instancePortOffset(options.instanceId) : 0;
   for (const spec of specs) {
     const recipe = recipeFor(spec.image, recipes);
     const applied = recipe.apply(spec);
     const ports = [
       `${spec.hostPort}:${spec.port}`,
-      ...(applied.extraPorts ?? []).map((p) => `${p.host + extraHostOffset}:${p.container}`),
+      ...(applied.extraPorts ?? []).map((p) => {
+        const hostPort = options.instanceId
+          ? extraHostPortForInstance(spec.role, p.host, options.instanceId)
+          : p.host;
+        return `${hostPort}:${p.container}`;
+      }),
     ];
     const service: Record<string, unknown> = {
       image: spec.image,
@@ -126,6 +130,7 @@ export function emitComposeLayers(
     };
     if (applied.environment) service.environment = applied.environment;
     if (applied.command) service.command = applied.command;
+    if (applied.entrypoint) service.entrypoint = applied.entrypoint;
     if (applied.healthcheck) service.healthcheck = applied.healthcheck;
     if (applied.volumes) service.volumes = applied.volumes;
     if (applied.user) service.user = applied.user;
@@ -194,13 +199,12 @@ export function buildStackEnv(
   specs: readonly ServiceSpec[],
   recipes: readonly ImageRecipe[] = [],
   host = "127.0.0.1",
+  controls: Readonly<Record<string, string>> = {},
+  instanceId?: string,
 ): Record<string, string> {
   const env: Record<string, string> = {};
   for (const spec of specs) {
     const prefix = envPrefix(spec.role);
-    env[`${prefix}_USER`] = spec.credentials.user;
-    env[`${prefix}_PASSWORD`] = spec.credentials.password;
-    env[`${prefix}_DB`] = spec.credentials.database;
     const recipe = recipeFor(spec.image, recipes);
     const url = recipe.url(spec, {
       host,
@@ -209,10 +213,53 @@ export function buildStackEnv(
       password: spec.credentials.password,
       database: spec.credentials.database,
     });
-    env[`${prefix}_URL`] = url;
-    // Friendly alias for the common sql role
-    if (spec.role === "store.sql") env.DATABASE_URL = url;
-    if (spec.role === "store.kv") env.REDIS_URL = url;
+    const applied = recipe.apply(spec);
+    const uiExtra = applied.extraPorts?.[0];
+    const uiHost =
+      uiExtra === undefined
+        ? undefined
+        : instanceId
+          ? extraHostPortForInstance(spec.role, uiExtra.host, instanceId)
+          : uiExtra.host;
+    if (spec.role === "store.sql") {
+      env[`${prefix}_USER`] = spec.credentials.user;
+      env[`${prefix}_PASSWORD`] = spec.credentials.password;
+      env[`${prefix}_DB`] = spec.credentials.database;
+      env[`${prefix}_URL`] = url;
+      env.DATABASE_URL = url;
+    } else if (spec.role === "store.kv") {
+      env[`${prefix}_PASSWORD`] = spec.credentials.password;
+      env[`${prefix}_URL`] = url;
+      env.REDIS_URL = url;
+    } else if (spec.role === "store.files") {
+      env[`${prefix}_URL`] = url;
+      env.S3_ACCESS_KEY_ID = spec.credentials.user;
+      env.S3_SECRET_ACCESS_KEY = spec.credentials.password;
+      env.S3_BUCKET = spec.credentials.database;
+      env.S3_URL = url;
+      env.S3_ENDPOINT = new URL(url).origin;
+      env.S3_REGION = "us-east-1";
+      if (uiHost !== undefined) env.S3_CONSOLE_URL = `http://${host}:${uiHost}`;
+    } else if (spec.role === "channel.email") {
+      env[`${prefix}_URL`] = url;
+      env.SMTP_URL = url;
+      env.SMTP_HOST = host;
+      env.SMTP_PORT = String(spec.hostPort);
+      if (uiHost !== undefined) env.MAILPIT_UI_URL = `http://${host}:${uiHost}`;
+    } else if (spec.role === "vault") {
+      // Token is minted by the bootstrap — never a generated password here.
+      env[`${prefix}_URL`] = url;
+      env.OKE_VAULT_URL = url;
+    } else {
+      env[`${prefix}_USER`] = spec.credentials.user;
+      env[`${prefix}_PASSWORD`] = spec.credentials.password;
+      env[`${prefix}_DB`] = spec.credentials.database;
+      env[`${prefix}_URL`] = url;
+    }
+  }
+  for (const key of STACK_CONTROL_KEYS) {
+    const value = controls[key];
+    if (value !== undefined) env[key] = value;
   }
   return env;
 }
@@ -225,12 +272,48 @@ const ROLE_SECTION_TITLE: Readonly<Record<string, string>> = {
   "store.index": "store.index — search index",
   "channel.email": "channel.email — Mailpit (SMTP + UI)",
   signal: "signal — message bus",
+  vault: "vault — OpenBao",
 };
 
 /** Friendly aliases emitted beside their role block. */
 const ROLE_ALIASES: Readonly<Record<string, readonly string[]>> = {
-  "store.sql": ["DATABASE_URL"],
-  "store.kv": ["REDIS_URL"],
+  "store.sql": ["DATABASE_URL", "PGDATA", "POSTGRES_INITDB_ARGS"],
+  "store.kv": ["REDIS_URL", "OKE_STORE_KV_MAXMEMORY", "OKE_STORE_KV_MAXMEMORY_POLICY"],
+  "store.files": [
+    "S3_ACCESS_KEY_ID",
+    "S3_SECRET_ACCESS_KEY",
+    "S3_BUCKET",
+    "S3_URL",
+    "S3_ENDPOINT",
+    "S3_CONSOLE_URL",
+    "S3_REGION",
+    "S3_SESSION_TOKEN",
+  ],
+  "channel.email": [
+    "SMTP_URL",
+    "SMTP_HOST",
+    "SMTP_PORT",
+    "MAILPIT_UI_URL",
+    "SMTP_USER",
+    "SMTP_PASSWORD",
+    "MP_MAX_MESSAGES",
+    "MP_SMTP_AUTH_ACCEPT_ANY",
+    "MP_SMTP_AUTH_ALLOW_INSECURE",
+  ],
+};
+
+/** Optional controls documented in `.env.docker` and preserved on regeneration. */
+const ROLE_CONTROL_EXAMPLES: Readonly<Record<string, readonly string[]>> = {
+  "store.sql": ["PGDATA=/var/lib/postgresql/data/pgdata", "POSTGRES_INITDB_ARGS=--data-checksums"],
+  "store.kv": ["OKE_STORE_KV_MAXMEMORY=256mb", "OKE_STORE_KV_MAXMEMORY_POLICY=allkeys-lru"],
+  "store.files": ["S3_SESSION_TOKEN="],
+  "channel.email": [
+    "SMTP_USER=",
+    "SMTP_PASSWORD=",
+    "MP_MAX_MESSAGES=500",
+    "MP_SMTP_AUTH_ACCEPT_ANY=1",
+    "MP_SMTP_AUTH_ALLOW_INSECURE=1",
+  ],
 };
 
 /**
@@ -240,8 +323,14 @@ const ROLE_ALIASES: Readonly<Record<string, readonly string[]>> = {
  */
 function roleFromEnvKey(key: string): string | undefined {
   const m = /^OKE_(.+)_(USER|PASSWORD|DB|URL)$/.exec(key);
-  if (!m) return undefined;
-  return m[1]!.toLowerCase().replaceAll("_", ".");
+  if (m) return m[1]!.toLowerCase().replaceAll("_", ".");
+  if (key.startsWith("S3_")) return "store.files";
+  if (key.startsWith("SMTP_") || key.startsWith("MP_") || key === "MAILPIT_UI_URL") {
+    return "channel.email";
+  }
+  if (key === "PGDATA" || key === "POSTGRES_INITDB_ARGS") return "store.sql";
+  if (key.startsWith("OKE_STORE_KV_MAXMEMORY")) return "store.kv";
+  return undefined;
 }
 
 /**
@@ -272,8 +361,7 @@ export function formatStackEnv(env: Readonly<Record<string, string>>): string {
     const prefix = envPrefix(role);
     const title = ROLE_SECTION_TITLE[role] ?? role;
     lines.push(`# ── ${title} ${"─".repeat(Math.max(4, 56 - title.length))}`);
-    for (const field of ["USER", "PASSWORD", "DB", "URL"] as const) {
-      const key = `${prefix}_${field}`;
+    for (const key of [`${prefix}_USER`, `${prefix}_PASSWORD`, `${prefix}_DB`, `${prefix}_URL`]) {
       const value = env[key];
       if (value === undefined) continue;
       lines.push(`${key}=${escapeEnv(value)}`);
@@ -285,6 +373,14 @@ export function formatStackEnv(env: Readonly<Record<string, string>>): string {
       lines.push(`${alias}=${escapeEnv(value)}`);
       used.add(alias);
     }
+    const controls = ROLE_CONTROL_EXAMPLES[role] ?? [];
+    const inactive = controls.filter(
+      (example) => env[example.slice(0, example.indexOf("="))] === undefined,
+    );
+    if (inactive.length > 0) {
+      lines.push("# Optional controls (uncomment to override; preserved on regeneration):");
+      for (const example of inactive) lines.push(`# ${example}`);
+    }
     lines.push("");
   }
 

package/src/docker/derive.ts

@@ -54,7 +54,13 @@ export function deriveInfrastructure(options: DeriveOptions): DeriveResult {
     }
   }
 
-  const stackEnv = buildStackEnv(specs, normalised.recipes ?? [], normalised.host ?? "127.0.0.1");
+  const stackEnv = buildStackEnv(
+    specs,
+    normalised.recipes ?? [],
+    normalised.host ?? "127.0.0.1",
+    normalised.controls,
+    normalised.instanceId,
+  );
 
   return { specs, files, stackEnv, composeFiles };
 }

package/src/docker/docker.test.ts

@@ -197,6 +197,78 @@ describe("deriveInfrastructure", () => {
     expect(formatStackEnv(result.stackEnv)).toContain("OKE_STORE_SQL_PASSWORD=");
   });
 
+  test("emits protocol-specific env keys plus optional control notes", () => {
+    const result = deriveInfrastructure({
+      images: {
+        "store.sql": "postgres:18-alpine",
+        "store.kv": "redis:8-alpine",
+        "store.files": "rustfs/rustfs:1.0.0-beta.11",
+        "channel.email": "axllent/mailpit:v1.22.3",
+      },
+      credentials: {
+        ...fixedCreds,
+        "store.files": {
+          user: "files-key",
+          password: "files-secret",
+          database: "oke",
+        },
+        "channel.email": {
+          user: "unused",
+          password: "unused-secret",
+          database: "oke",
+        },
+      },
+    });
+    expect(result.stackEnv.S3_ACCESS_KEY_ID).toBe("files-key");
+    expect(result.stackEnv.S3_SECRET_ACCESS_KEY).toBe("files-secret");
+    expect(result.stackEnv.S3_BUCKET).toBe("oke");
+    expect(result.stackEnv.S3_URL).toContain("http://files-key:");
+    expect(result.stackEnv.S3_ENDPOINT).toBe("http://127.0.0.1:9000");
+    expect(result.stackEnv.S3_CONSOLE_URL).toBe("http://127.0.0.1:9001");
+    expect(result.stackEnv.SMTP_URL).toBe("smtp://127.0.0.1:1025");
+    expect(result.stackEnv.SMTP_HOST).toBe("127.0.0.1");
+    expect(result.stackEnv.SMTP_PORT).toBe("1025");
+    expect(result.stackEnv.MAILPIT_UI_URL).toBe("http://127.0.0.1:8025");
+    expect(result.stackEnv.OKE_STORE_KV_PASSWORD).toBe(fixedCreds["store.kv"].password);
+    expect(result.stackEnv.OKE_STORE_KV_USER).toBeUndefined();
+    expect(result.stackEnv.OKE_STORE_KV_DB).toBeUndefined();
+    expect(result.stackEnv.OKE_CHANNEL_EMAIL_PASSWORD).toBeUndefined();
+
+    const text = formatStackEnv(result.stackEnv);
+    expect(text).toContain("# OKE_STORE_KV_MAXMEMORY=256mb");
+    expect(text).toContain("# S3_SESSION_TOKEN=");
+    expect(text).toContain("# SMTP_USER=");
+    expect(text).toContain("# POSTGRES_INITDB_ARGS=--data-checksums");
+  });
+
+  test("instance-offset UI aliases land in stack env", () => {
+    const id = "a3f791";
+    const n = Number.parseInt(id.slice(0, 4), 16) % 1000;
+    const result = deriveInfrastructure({
+      images: {
+        "channel.email": "axllent/mailpit:v1.22.3",
+        "store.files": "rustfs/rustfs:1.0.0-beta.11",
+      },
+      instanceId: id,
+      credentials: {
+        "channel.email": {
+          user: "oke",
+          password: "unused-mail-password",
+          database: "oke",
+        },
+        "store.files": {
+          user: "files-key",
+          password: "files-secret",
+          database: "oke",
+        },
+      },
+    });
+    expect(result.stackEnv.SMTP_PORT).toBe(String(20_000 + n));
+    expect(result.stackEnv.MAILPIT_UI_URL).toBe(`http://127.0.0.1:${21_000 + n}`);
+    expect(result.stackEnv.S3_ENDPOINT).toBe(`http://127.0.0.1:${18_000 + n}`);
+    expect(result.stackEnv.S3_CONSOLE_URL).toBe(`http://127.0.0.1:${19_000 + n}`);
+  });
+
   test("resolveStack previews without writing", () => {
     const rows = resolveStack({
       images: { "store.sql": "postgres:16" },
@@ -205,5 +277,36 @@ describe("deriveInfrastructure", () => {
     expect(rows).toHaveLength(1);
     expect(rows[0]!.recipe).toBe("postgres");
     expect(rows[0]!.hostPort).toBe(5432);
+    expect(rows[0]!.extraPorts).toEqual([]);
+  });
+
+  test("resolveStack includes instance-offset Mailpit UI / RustFS console", () => {
+    const id = "a3f791";
+    const n = Number.parseInt(id.slice(0, 4), 16) % 1000;
+    const rows = resolveStack({
+      images: {
+        "channel.email": "axllent/mailpit:v1.22.3",
+        "store.files": "rustfs/rustfs:1.0.0-beta.11",
+      },
+      instanceId: id,
+      credentials: {
+        "channel.email": {
+          user: "oke",
+          password: "stack-preview-mail-password",
+          database: "oke",
+        },
+        "store.files": {
+          user: "oke",
+          password: "stack-preview-files-password",
+          database: "oke",
+        },
+      },
+    });
+    const mail = rows.find((r) => r.role === "channel.email")!;
+    const files = rows.find((r) => r.role === "store.files")!;
+    expect(mail.hostPort).toBe(20_000 + n);
+    expect(mail.extraPorts).toEqual([{ hostPort: 21_000 + n, containerPort: 8025 }]);
+    expect(files.hostPort).toBe(18_000 + n);
+    expect(files.extraPorts).toEqual([{ hostPort: 19_000 + n, containerPort: 9001 }]);
   });
 });

package/src/docker/index.ts

@@ -37,12 +37,22 @@ export { emitDockerfile } from "./dockerfile.ts";
 export { credEnv, envPrefix, serviceNameFor } from "./helpers.ts";
 export { generateCredentials } from "./credentials.ts";
 export { builtinRecipes, mailpit, postgres, recipeFor, redis, rustfs } from "./recipes/index.ts";
-export { formatStackPreview, resolveStack, type StackRow } from "./stack.ts";
 export {
+  formatStackPreview,
+  resolveExtraPorts,
+  resolveStack,
+  type StackExtraPort,
+  type StackRow,
+} from "./stack.ts";
+export {
+  extraHostPortForInstance,
   hostPortForInstance,
   instancePortOffset,
+  loadExistingStackControls,
   loadExistingStackCredentials,
+  parseStackControls,
   parseStackCredentials,
+  STACK_CONTROL_KEYS,
   stackAppSlug,
   stackInstanceId,
 } from "./stack-id.ts";

package/src/docker/recipes/index.ts

@@ -4,14 +4,15 @@
 
 import type { ImageRecipe } from "../types.ts";
 import { mailpit } from "./mailpit.ts";
+import { openbao } from "./openbao.ts";
 import { postgres } from "./postgres.ts";
 import { redis } from "./redis.ts";
 import { rustfs } from "./rustfs.ts";
 
 /** Default recipe catalogue. */
-export const builtinRecipes: readonly ImageRecipe[] = [postgres, redis, mailpit, rustfs];
+export const builtinRecipes: readonly ImageRecipe[] = [postgres, redis, mailpit, rustfs, openbao];
 
-export { mailpit, postgres, redis, rustfs };
+export { mailpit, openbao, postgres, redis, rustfs };
 
 /**
  * Resolve the recipe for an image reference.

package/src/docker/recipes/openbao.ts

@@ -0,0 +1,47 @@
+/**
+ * OpenBao image recipe — durable single-node secrets service (Raft storage).
+ *
+ * Never `-dev`: data lives on a named volume under `/openbao/data`; init +
+ * unseal is handled by the CLI bootstrap (keys stay on the host).
+ */
+
+import type { ImageRecipe } from "../types.ts";
+
+/**
+ * Server config passed via `BAO_LOCAL_CONFIG` (official image). Single-node
+ * Raft still requires `cluster_addr` / `api_addr` per the OpenBao docs.
+ */
+const OPENBAO_LOCAL_CONFIG = JSON.stringify({
+  listener: { tcp: { address: "0.0.0.0:8200", tls_disable: true } },
+  // Raft under /openbao/file — the stock entrypoint chowns that dir for the
+  // `openbao` user; a root-owned fresh named volume stays writable. Raft does
+  // not create nested dirs, so the path must be the chowned dir itself.
+  storage: { raft: { path: "/openbao/file", node_id: "oke" } },
+  api_addr: "http://0.0.0.0:8200",
+  cluster_addr: "http://127.0.0.1:8201",
+  disable_mlock: true,
+});
+
+/** OpenBao secrets service. API on 8200. */
+export const openbao: ImageRecipe = {
+  id: "openbao",
+  port: 8200,
+  match: (i) => /openbao/i.test(i),
+  apply: (s) => ({
+    environment: {
+      BAO_LOCAL_CONFIG: OPENBAO_LOCAL_CONFIG,
+    },
+    command: ["server"],
+    volumes: [`${s.serviceName}-data:/openbao/file`],
+    healthcheck: {
+      // `/sys/init` answers 200 even while sealed — only proves the server
+      // process is up; bootstrap owns the real unseal step.
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8200/v1/sys/init >/dev/null 2>&1 || exit 1"],
+      interval: "5s",
+      timeout: "5s",
+      retries: 12,
+      start_period: "5s",
+    },
+  }),
+  url: (_s, c) => `http://${c.host}:${c.port}`,
+};

package/src/docker/recipes/redis.ts

@@ -11,7 +11,11 @@ export const redis: ImageRecipe = {
   port: 6379,
   match: (i) => /redis|valkey|dragonfly|keydb/i.test(i),
   apply: (s) => ({
-    command: ["redis-server", "--requirepass", credEnv(s, "PASSWORD")],
+    command: [
+      "sh",
+      "-c",
+      'exec redis-server --requirepass "$$OKE_STORE_KV_PASSWORD" --maxmemory "$${OKE_STORE_KV_MAXMEMORY:-0}" --maxmemory-policy "$${OKE_STORE_KV_MAXMEMORY_POLICY:-noeviction}"',
+    ],
     healthcheck: {
       test: ["CMD", "redis-cli", "-a", credEnv(s, "PASSWORD"), "ping"],
       interval: "5s",

package/src/docker/recipes/rustfs.ts

@@ -2,7 +2,6 @@
  * RustFS image recipe — S3-compatible object store (Apache 2.0 MinIO alternative).
  */
 
-import { credEnv } from "../helpers.ts";
 import type { ImageRecipe } from "../types.ts";
 
 /** S3-protocol object storage (RustFS). Console on 9001. */
@@ -12,8 +11,8 @@ export const rustfs: ImageRecipe = {
   match: (i) => /rustfs/i.test(i),
   apply: (s) => ({
     environment: {
-      RUSTFS_ACCESS_KEY: credEnv(s, "USER"),
-      RUSTFS_SECRET_KEY: credEnv(s, "PASSWORD"),
+      RUSTFS_ACCESS_KEY: "${S3_ACCESS_KEY_ID}",
+      RUSTFS_SECRET_KEY: "${S3_SECRET_ACCESS_KEY}",
       RUSTFS_CONSOLE_ENABLE: "true",
       RUSTFS_ADDRESS: ":9000",
     },

package/src/docker/stack-id.test.ts

@@ -4,8 +4,10 @@
 
 import { describe, expect, test } from "bun:test";
 import {
+  extraHostPortForInstance,
   hostPortForInstance,
   instancePortOffset,
+  parseStackControls,
   parseStackCredentials,
   stackAppSlug,
   stackInstanceId,
@@ -29,14 +31,23 @@ describe("stackInstanceId", () => {
 });
 
 describe("hostPortForInstance", () => {
-  test("offsets sql and kv into separate ranges", () => {
+  test("assigns built-in roles disjoint per-project ranges", () => {
     const id = "abcd12";
+    const n = instancePortOffset(id);
     const sql = hostPortForInstance("store.sql", 5432, id);
     const kv = hostPortForInstance("store.kv", 6379, id);
-    expect(sql).toBeGreaterThanOrEqual(15_000);
-    expect(sql).toBeLessThan(16_000);
-    expect(kv).toBeGreaterThanOrEqual(16_000);
-    expect(kv).toBeLessThan(17_000);
+    const files = hostPortForInstance("store.files", 9000, id);
+    const filesConsole = extraHostPortForInstance("store.files", 9001, id);
+    const email = hostPortForInstance("channel.email", 1025, id);
+    const emailUi = extraHostPortForInstance("channel.email", 8025, id);
+    expect([sql, kv, files, filesConsole, email, emailUi]).toEqual([
+      15_000 + n,
+      16_000 + n,
+      18_000 + n,
+      19_000 + n,
+      20_000 + n,
+      21_000 + n,
+    ]);
   });
 });
 
@@ -54,6 +65,26 @@ OKE_STORE_KV_DB=oke
     expect(creds["store.sql"]?.password).toBe("s3cret");
     expect(creds["store.kv"]?.password).toBe("kvpass");
   });
+
+  test("reads service-specific S3 credentials and optional controls", () => {
+    const text = `
+S3_ACCESS_KEY_ID=files-key
+S3_SECRET_ACCESS_KEY=files-secret
+S3_REGION=eu-central-1
+OKE_STORE_KV_MAXMEMORY=512mb
+# SMTP_USER=commented-out
+`;
+    const creds = parseStackCredentials(text, ["store.files"]);
+    expect(creds["store.files"]).toEqual({
+      user: "files-key",
+      password: "files-secret",
+      database: "oke",
+    });
+    expect(parseStackControls(text)).toEqual({
+      OKE_STORE_KV_MAXMEMORY: "512mb",
+      S3_REGION: "eu-central-1",
+    });
+  });
 });
 
 describe("deriveInfrastructure instanceId", () => {
@@ -86,7 +117,8 @@ describe("deriveInfrastructure instanceId", () => {
   });
 
   test("offsets Mailpit UI and RustFS console so stacks do not share 8025/9001", () => {
-    const id = "abcd12";
+    // Regression: offset 975 previously mapped Mailpit's 8025 UI onto RustFS's 9000 API.
+    const id = "a3f791";
     const n = instancePortOffset(id);
     const result = deriveInfrastructure({
       images: {
@@ -111,9 +143,12 @@ describe("deriveInfrastructure instanceId", () => {
     });
     const mailYml = result.files.find((f) => f.path === "compose.channel.email.yml")!.content;
     const filesYml = result.files.find((f) => f.path === "compose.store.files.yml")!.content;
-    expect(mailYml).toContain(`${8025 + n}:8025`);
+    expect(mailYml).toContain(`${20_000 + n}:1025`);
+    expect(mailYml).toContain(`${21_000 + n}:8025`);
     expect(mailYml).not.toContain("8025:8025");
-    expect(filesYml).toContain(`${9001 + n}:9001`);
+    expect(filesYml).toContain(`${18_000 + n}:9000`);
+    expect(filesYml).toContain(`${19_000 + n}:9001`);
     expect(filesYml).not.toContain("9001:9001");
+    expect(mailYml).not.toContain("9000:8025");
   });
 });