analogcloud-common 0.1.4__py3-none-any.whl

anabrid/cloud/deploy/generate.py

@@ -0,0 +1,503 @@
+"""Deploy configuration generator for Analog Cloud services.
+
+Renders Docker Compose YAML and supervisord.conf from a ``AnalogCloudConfig``
+instance. Two compose targets are supported:
+
+* The main ``docker-compose.yaml`` (postgres + rabbitmq + server). The only
+  template parameter is the server image reference; all other services and
+  environment-variable interpolations are fixed by the bundled template.
+
+* The ``docker-compose.workers.yaml`` worker fragment — one service per
+  compile instance plus one per device-worker slot.
+
+Both compose YAMLs are rendered from Jinja2 templates packaged under
+``anabrid.cloud.deploy.templates``. The supervisord sidecar is emitted
+alongside the worker compose only.
+
+The database DSN is never baked into the generated files. The compose
+fragment emits a compose-level ``${POSTGRES_PASSWORD}`` interpolation so
+docker resolves the secret from ``.env`` at container start; the
+supervisord fragment emits ``%(ENV_POSTGRES_PASSWORD)s`` so supervisord
+resolves the secret from its own environment at program-start. No
+plaintext password appears in either artefact.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+import yaml
+from jinja2 import Environment, PackageLoader
+
+from anabrid.cloud.models.config import AnalogCloudConfig
+from anabrid.cloud.models.enums import DeviceTypeEnum
+
+DEFAULT_WORKER_IMAGE = "analogcloud-worker:latest"
+
+# Supervisord runs in the dev-host-API topology only; the API and workers
+# reach postgres via the published port on the loopback. Supervisord's
+# %(ENV_X)s syntax has no default-value form, so non-secret fields are
+# inlined here and only the password remains a placeholder resolved from
+# the shell (which sources .env before launching supervisord).
+_SUPERVISORD_DATABASE_URL = (
+    "postgresql+asyncpg://analogcloud:%(ENV_POSTGRES_PASSWORD)s"
+    "@localhost:5432/analogcloud"
+)
+_SUPERVISORD_BROKER_URL = "amqp://localhost:5672//"
+_SUPERVISORD_SOCK = "/tmp/supervisor.sock"
+
+_API_COMMAND = (
+    "uv run uvicorn anabrid.cloud.server.main:app"
+    " --reload"
+    " --reload-dir %(ENV_ANALOGCLOUD_BASE_DIR)s/components/server/src"
+    " --reload-dir %(ENV_ANALOGCLOUD_BASE_DIR)s/components/common/src"
+    " --port 8000"
+)
+_WORKER_COMMAND = (
+    "uv run watchfiles --filter python"
+    ' "python -m anabrid.cloud.worker.main"'
+    " %(ENV_ANALOGCLOUD_BASE_DIR)s/components/worker/src"
+    " %(ENV_ANALOGCLOUD_BASE_DIR)s/components/common/src"
+)
+
+_TEMPLATE_ENV = Environment(
+    loader=PackageLoader("anabrid.cloud.deploy"),
+    autoescape=False,
+    keep_trailing_newline=True,
+)
+
+
+def _check_duplicate_simulator_ports(config: AnalogCloudConfig) -> None:
+    """Raise ``ValueError`` if two SIMULATOR devices share the same (host, port).
+
+    This guard fires before any output is produced, so a misconfigured file
+    fails fast with a clear message naming both devices and the conflicting
+    address.
+    """
+    port_map: dict[tuple[str, int], list[str]] = {}
+    for entry in config.devices.available:
+        if entry.type == DeviceTypeEnum.SIMULATOR:
+            key = (entry.host, entry.port)
+            port_map.setdefault(key, []).append(entry.name)
+
+    for (host, port), names in port_map.items():
+        if len(names) > 1:
+            first, second = names[0], names[1]
+            suffix = f" and {len(names) - 2} others" if len(names) > 2 else ""
+            raise ValueError(
+                f"SIMULATOR devices {first!r} and {second!r}{suffix} share"
+                f" host:port {host}:{port}"
+            )
+
+
+def render_server_compose(
+    server_image: str,
+    compile_remote: bool = False,
+) -> str:
+    """Render the main ``docker-compose.yaml`` with the given server image.
+
+    All other services (postgres, rabbitmq) and environment-variable
+    interpolations are fixed by the bundled template; only the server
+    image reference is substituted. When ``compile_remote`` is true the
+    template additionally emits the SeaweedFS S3 sidecar. The returned
+    string is valid Compose YAML.
+    """
+    template = _TEMPLATE_ENV.get_template("docker-compose.yaml.j2")
+    return template.render(
+        server_image=server_image,
+        compile_remote=compile_remote,
+    )
+
+
+def render_worker_compose(
+    config: AnalogCloudConfig,
+    worker_image: str = DEFAULT_WORKER_IMAGE,
+    compile_remote: bool = False,
+) -> str:
+    """Render ``docker-compose.workers.yaml`` for all worker services.
+
+    Emits one service per compile instance (unless ``compile_remote`` is
+    ``True``, in which case no compile-worker services are emitted) and
+    one per device-worker slot. Raises ``ValueError`` if two SIMULATOR
+    devices share the same ``(host, port)`` pair.
+
+    ``worker_image`` controls the image tag on every generated service.
+    Defaults to the local ``analogcloud-worker:latest`` tag built by the dev
+    init script; production bundles pass a registry-qualified reference
+    so the prod host can pull directly from the registry.
+
+    ``compile_remote`` is a deploy-time topology signal passed in by the
+    caller (``ci/build.sh``, derived from ``environments.yaml``). When
+    ``True``, compile-worker services are omitted from this bundle because
+    they are shipped to a separate host via the ``workers/compile`` bundle.
+
+    Security:
+        The generated file carries the DB DSN as a compose-level
+        interpolation literal (``${POSTGRES_PASSWORD}`` etc). Docker
+        resolves the secret from the ``.env`` file at container start,
+        so no plaintext password is ever written to disk by this
+        generator.
+    """
+    _check_duplicate_simulator_ports(config)
+
+    devices = [
+        {
+            "name": entry.name,
+            "workers": entry.workers,
+            "is_simulator": entry.type == DeviceTypeEnum.SIMULATOR,
+        }
+        for entry in config.devices.available
+    ]
+    template = _TEMPLATE_ENV.get_template("docker-compose.workers.yaml.j2")
+    return template.render(
+        worker_image=worker_image,
+        compile_instances=config.workers.compile.num_instances,
+        compile_remote=compile_remote,
+        compile_timeout=config.workers.compile.instance_timeout,
+        compile_cpu_cores=config.workers.compile.instance_cpu_cores,
+        compile_memory_gb=config.workers.compile.instance_memory_gb,
+        run_op_time_limit=config.workers.run_op_time_limit,
+        devices=devices,
+    )
+
+
+def render_compile_remote_workers_compose(
+    config: AnalogCloudConfig,
+    env_host: str,
+    worker_image: str = DEFAULT_WORKER_IMAGE,
+) -> str:
+    """Render the compile-worker docker-compose YAML for a remote host.
+
+    Emits one ``worker-compile-{i}`` service per
+    ``config.workers.compile.num_instances``. All broker, database, and
+    blob URLs target ``env_host`` — the main host's address as seen by
+    the remote compile-worker machine. In practice this must be the
+    main host's VPN interface IP (e.g. WireGuard), not the public
+    FQDN, since Postgres (5432), RabbitMQ (5672), and SeaweedFS (8333)
+    are bound to the VPN address and never exposed publicly. The
+    generated services attach to the default bridge network on the
+    remote host; no ``analogcloud_internal`` bridge exists there.
+
+    ``worker_image`` controls the image tag on every generated service.
+    Defaults to the local ``analogcloud-worker:latest`` tag built by the dev
+    init script; production bundles pass a registry-qualified reference
+    so the remote host can pull directly from the registry.
+
+    Raises ``ValueError`` if ``config.workers.compile.num_instances`` is
+    less than 1; the remote bundle has no meaning at zero and must fail
+    fast rather than emit an empty compose file.
+    """
+    if config.workers.compile.num_instances < 1:
+        raise ValueError(
+            "workers/compile bundle requires compile.num_instances >= 1, got"
+            f" {config.workers.compile.num_instances}"
+        )
+    template = _TEMPLATE_ENV.get_template(
+        "docker-compose.workers-compile-remote.yaml.j2"
+    )
+    return template.render(
+        worker_image=worker_image,
+        env_host=env_host,
+        compile_instances=config.workers.compile.num_instances,
+        compile_timeout=config.workers.compile.instance_timeout,
+        compile_cpu_cores=config.workers.compile.instance_cpu_cores,
+        compile_memory_gb=config.workers.compile.instance_memory_gb,
+    )
+
+
+def generate_supervisord(config: AnalogCloudConfig) -> str:
+    """Generate a supervisord.conf string for the dev-host-API topology.
+
+    Emits four harness stanzas (supervisord, unix_http_server,
+    rpcinterface:supervisor, supervisorctl), one ``[program:api]`` stanza
+    running uvicorn with --reload, one ``[program:worker-compile-N]`` per
+    compile instance running the worker entrypoint wrapped by watchfiles,
+    and one ``[program:worker-run-<device>-N]`` per device-worker slot.
+
+    All program paths reference ``%(ENV_ANALOGCLOUD_BASE_DIR)s`` so the
+    generated file is independent of where the project is checked out.
+    Log files are written to
+    ``%(ENV_ANALOGCLOUD_BASE_DIR)s/logs/<program-name>.{out,err}``.
+
+    Raises ``ValueError`` if two SIMULATOR devices share the same
+    ``(host, port)`` pair.
+    """
+    _check_duplicate_simulator_ports(config)
+
+    common_env_pairs = [
+        f'BROKER_URL="{_SUPERVISORD_BROKER_URL}"',
+        f'ANALOGCLOUD_DATABASE_URL="{_SUPERVISORD_DATABASE_URL}"',
+        'ANALOGCLOUD_BASE_DIR="%(ENV_ANALOGCLOUD_BASE_DIR)s"',
+    ]
+
+    def _log_base(name: str) -> str:
+        return "%(ENV_ANALOGCLOUD_BASE_DIR)s/logs/" + name
+
+    def _program_block(
+        name: str,
+        command: str,
+        directory: str,
+        extra_env_pairs: list[str] | None = None,
+    ) -> str:
+        env_pairs = list(extra_env_pairs or []) + common_env_pairs
+        env_line = ",".join(env_pairs)
+        lines = [
+            f"[program:{name}]",
+            f"command={command}",
+            f"directory={directory}",
+            "autostart=true",
+            "autorestart=true",
+            f"stdout_logfile={_log_base(name)}.out",
+            f"stderr_logfile={_log_base(name)}.err",
+            f"environment={env_line}",
+            "",
+        ]
+        return "\n".join(lines)
+
+    base_dir = "%(ENV_ANALOGCLOUD_BASE_DIR)s"
+    server_dir = f"{base_dir}/components/server"
+    worker_dir = f"{base_dir}/components/worker"
+
+    sections: list[str] = []
+
+    sections.append(
+        "[supervisord]\n"
+        "nodaemon=true\n"
+        "\n"
+    )
+    sections.append(
+        "[unix_http_server]\n"
+        f"file={_SUPERVISORD_SOCK}\n"
+        "\n"
+    )
+    sections.append(
+        "[rpcinterface:supervisor]\n"
+        "supervisor.rpcinterface_factory=supervisor.rpcinterface:make_main_rpcinterface\n"
+        "\n"
+    )
+    sections.append(
+        "[supervisorctl]\n"
+        f"serverurl=unix://{_SUPERVISORD_SOCK}\n"
+        "\n"
+    )
+
+    sections.append(
+        _program_block(
+            name="api",
+            command=_API_COMMAND,
+            directory=server_dir,
+        )
+    )
+
+    for i in range(config.workers.compile.num_instances):
+        name = f"worker-compile-{i}"
+        compile_env_pairs = [
+            'WORKER_TYPE="compile"',
+            'REDACC_EXECUTABLE="%(ENV_ANALOGCLOUD_BASE_DIR)s/bin/redacc"',
+            f'ANALOGCLOUD_COMPILE_TIMEOUT="{config.workers.compile.instance_timeout}"',
+        ]
+        if config.workers.compile.instance_cpu_cores is not None:
+            compile_env_pairs.append(
+                f'ANALOGCLOUD_COMPILE_CPU_CORES="{config.workers.compile.instance_cpu_cores}"'
+            )
+        if config.workers.compile.instance_memory_gb is not None:
+            compile_env_pairs.append(
+                f'ANALOGCLOUD_COMPILE_MEMORY_GB="{config.workers.compile.instance_memory_gb}"'
+            )
+        sections.append(
+            _program_block(
+                name=name,
+                command=_WORKER_COMMAND,
+                directory=worker_dir,
+                extra_env_pairs=compile_env_pairs,
+            )
+        )
+
+    for entry in config.devices.available:
+        for i in range(entry.workers):
+            name = f"worker-run-{entry.name}-{i}"
+            env_pairs = [
+                'WORKER_TYPE="run"',
+                f'DEVICE_NAME="{entry.name}"',
+                f'ANALOGCLOUD_RUN_OP_TIME_LIMIT="{config.workers.run_op_time_limit}"',
+            ]
+            sections.append(
+                _program_block(
+                    name=name,
+                    command=_WORKER_COMMAND,
+                    directory=worker_dir,
+                    extra_env_pairs=env_pairs,
+                )
+            )
+
+    return "\n".join(sections)
+
+
+def main() -> None:
+    """Entry point for the ``analogcloud-deploy`` CLI tool."""
+    parser = argparse.ArgumentParser(
+        description=(
+            "Generate Docker Compose configuration from an Analog Cloud config file."
+        )
+    )
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    gen = subparsers.add_parser(
+        "generate",
+        help=(
+            "Generate a compose file. Pass --bundle-target "
+            "{main, workers, workers/compile} to select the bundle "
+            "(default: main)."
+        ),
+    )
+    gen.add_argument("-c", "--config", required=True, help="Path to analogcloud.yaml.")
+    gen.add_argument(
+        "-o", "--output", required=True, help="Path for the output compose file."
+    )
+    target_group = gen.add_mutually_exclusive_group()
+    target_group.add_argument(
+        "--worker",
+        action="store_true",
+        help=(
+            "Render docker-compose.workers.yaml (plus the supervisord.conf "
+            "sidecar) instead of the main docker-compose.yaml. Synonym for "
+            "--bundle-target workers."
+        ),
+    )
+    target_group.add_argument(
+        "--bundle-target",
+        choices=("main", "workers", "workers/compile"),
+        default=None,
+        help=(
+            "Which bundle to render. 'main' (default) emits the main "
+            "docker-compose.yaml; 'workers' emits the local worker "
+            "fragment plus supervisord.conf; 'workers/compile' emits the "
+            "remote compile-worker compose targeted at --env-host."
+        ),
+    )
+    gen.add_argument(
+        "--worker-image",
+        default=None,
+        help=(
+            "Worker image reference to emit on every worker service. "
+            f"Defaults to {DEFAULT_WORKER_IMAGE!r}. Only meaningful with "
+            "--bundle-target workers or workers/compile."
+        ),
+    )
+    gen.add_argument(
+        "--server-image",
+        default=None,
+        help=(
+            "Server image reference to emit on the server service. "
+            "Required when generating the main compose; rejected for "
+            "worker bundle targets."
+        ),
+    )
+    gen.add_argument(
+        "--env-host",
+        default=None,
+        help=(
+            "Address of the env's main host as reachable from the "
+            "remote compile-worker machine. In practice this is the "
+            "main host's VPN interface IP (e.g. WireGuard), since "
+            "Postgres/RabbitMQ/SeaweedFS are bound to the VPN address "
+            "and not exposed on the public FQDN. Required with "
+            "--bundle-target workers/compile; rejected otherwise."
+        ),
+    )
+    gen.add_argument(
+        "--compile-remote",
+        action="store_true",
+        default=False,
+        help=(
+            "Signal that this env runs compile workers on a separate host "
+            "(derived by ci/build.sh from environments.yaml: the env has at "
+            "least one additional_hosts[type=compile] entry). Affects the "
+            "main and workers bundles: the main compose gains the SeaweedFS "
+            "sidecar and the workers compose omits compile-worker services. "
+            "Valid only with --bundle-target main or workers; rejected for "
+            "--bundle-target workers/compile (that target is intrinsically "
+            "the remote-compile path)."
+        ),
+    )
+
+    args = parser.parse_args()
+
+    # Resolve the effective bundle target. --worker is a synonym for
+    # --bundle-target workers (the two are already mutually exclusive
+    # at the argparse layer).
+    if args.worker:
+        bundle_target = "workers"
+    elif args.bundle_target is not None:
+        bundle_target = args.bundle_target
+    else:
+        bundle_target = "main"
+
+    if bundle_target == "main":
+        if args.server_image is None:
+            parser.error(
+                "--server-image is required when generating the main compose"
+            )
+        if args.env_host is not None:
+            parser.error("--env-host is only valid with --bundle-target workers/compile")
+        if args.worker_image is not None:
+            parser.error(
+                "--worker-image is not valid with --bundle-target main"
+            )
+    elif bundle_target == "workers":
+        if args.server_image is not None:
+            parser.error("--server-image is not valid for the workers bundle")
+        if args.env_host is not None:
+            parser.error("--env-host is only valid with --bundle-target workers/compile")
+    elif bundle_target == "workers/compile":
+        if args.server_image is not None:
+            parser.error(
+                "--server-image is not valid for the workers/compile bundle"
+            )
+        if args.env_host is None:
+            parser.error(
+                "--env-host is required with --bundle-target workers/compile"
+            )
+        if args.compile_remote:
+            parser.error(
+                "--compile-remote is not valid with --bundle-target workers/compile "
+                "(that target is intrinsically the remote-compile path)"
+            )
+
+    config_path = Path(args.config)
+    config = AnalogCloudConfig.model_validate(
+        yaml.safe_load(config_path.read_text(encoding="utf-8"))
+    )
+
+    worker_image = args.worker_image or DEFAULT_WORKER_IMAGE
+
+    output_path = Path(args.output)
+    try:
+        if bundle_target == "workers":
+            yaml_text = render_worker_compose(
+                config,
+                worker_image=worker_image,
+                compile_remote=args.compile_remote,
+            )
+            supervisord_text = generate_supervisord(config)
+            output_path.write_text(yaml_text, encoding="utf-8")
+            supervisord_path = output_path.parent / "supervisord.conf"
+            supervisord_path.write_text(supervisord_text, encoding="utf-8")
+        elif bundle_target == "workers/compile":
+            yaml_text = render_compile_remote_workers_compose(
+                config,
+                env_host=args.env_host,
+                worker_image=worker_image,
+            )
+            output_path.write_text(yaml_text, encoding="utf-8")
+        else:
+            yaml_text = render_server_compose(
+                server_image=args.server_image,
+                compile_remote=args.compile_remote,
+            )
+            output_path.write_text(yaml_text, encoding="utf-8")
+    except ValueError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        sys.exit(2)

anabrid/cloud/deploy/templates/docker-compose.workers-compile-remote.yaml.j2

@@ -0,0 +1,30 @@
+services:
+{% for i in range(compile_instances) %}
+  worker-compile-{{ i }}:
+    image: {{ worker_image }}
+    restart: unless-stopped
+    user: "${ANALOGCLOUD_UID:?ANALOGCLOUD_UID is not set in .env}:${ANALOGCLOUD_GID:?ANALOGCLOUD_GID is not set in .env}"
+    volumes:
+      - ./config:/config:ro
+      - ./data:/data
+      - ./logs:/logs
+    environment:
+      WORKER_TYPE: compile
+      ANALOGCLOUD_BASE_DIR: "/"
+      ANALOGCLOUD_LOG_NAME: worker-compile-{{ i }}
+      REDACC_EXECUTABLE: /usr/local/bin/redacc
+      ANALOGCLOUD_COMPILE_TIMEOUT: "{{ compile_timeout }}"
+{%- if compile_cpu_cores is not none %}
+      ANALOGCLOUD_COMPILE_CPU_CORES: "{{ compile_cpu_cores }}"
+{%- endif %}
+{%- if compile_memory_gb is not none %}
+      ANALOGCLOUD_COMPILE_MEMORY_GB: "{{ compile_memory_gb }}"
+{%- endif %}
+      BROKER_URL: "amqp://${RABBITMQ_DEFAULT_USER:-analogcloud}:${RABBITMQ_DEFAULT_PASS:?RABBITMQ_DEFAULT_PASS is not set in .env}@{{ env_host }}:5672//"
+      ANALOGCLOUD_DATABASE_URL: "postgresql+asyncpg://${POSTGRES_USER:-analogcloud}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is not set in .env}@{{ env_host }}:5432/${POSTGRES_DB:-analogcloud}"
+      ANALOGCLOUD_BLOB_BACKEND: s3
+      S3_BLOB_ENDPOINT: "http://{{ env_host }}:8333"
+      S3_BLOB_BUCKET: ${S3_BLOB_BUCKET:-analogcloud}
+      S3_BLOB_ACCESS_KEY: ${S3_BLOB_ACCESS_KEY:?S3_BLOB_ACCESS_KEY is not set in .env}
+      S3_BLOB_SECRET_KEY: ${S3_BLOB_SECRET_KEY:?S3_BLOB_SECRET_KEY is not set in .env}
+{% endfor %}

anabrid/cloud/deploy/templates/docker-compose.workers.yaml.j2

@@ -0,0 +1,66 @@
+services:
+{% if not compile_remote %}
+{% for i in range(compile_instances) %}
+  worker-compile-{{ i }}:
+    image: {{ worker_image }}
+    restart: unless-stopped
+    user: "${ANALOGCLOUD_UID:?ANALOGCLOUD_UID is not set in .env}:${ANALOGCLOUD_GID:?ANALOGCLOUD_GID is not set in .env}"
+    networks:
+      - internal
+    volumes:
+      - "${ANALOGCLOUD_BASE_DIR:?ANALOGCLOUD_BASE_DIR is not set in .env}/config:/config:ro"
+      - "${ANALOGCLOUD_BASE_DIR:?ANALOGCLOUD_BASE_DIR is not set in .env}/data:/data"
+      - "${ANALOGCLOUD_BASE_DIR:?ANALOGCLOUD_BASE_DIR is not set in .env}/logs:/logs"
+    environment:
+      WORKER_TYPE: compile
+      BROKER_URL: "amqp://${RABBITMQ_DEFAULT_USER:-analogcloud}:${RABBITMQ_DEFAULT_PASS:?RABBITMQ_DEFAULT_PASS is not set in .env}@rabbitmq:5672//"
+      ANALOGCLOUD_DATABASE_URL: "postgresql+asyncpg://${POSTGRES_USER:-analogcloud}:${POSTGRES_PASSWORD}@postgres:${POSTGRES_PORT:-5432}/${POSTGRES_DB:-analogcloud}"
+      ANALOGCLOUD_BASE_DIR: "/"
+      ANALOGCLOUD_LOG_NAME: worker-compile-{{ i }}
+      REDACC_EXECUTABLE: /usr/local/bin/redacc
+      ANALOGCLOUD_COMPILE_TIMEOUT: "{{ compile_timeout }}"
+{%- if compile_cpu_cores is not none %}
+      ANALOGCLOUD_COMPILE_CPU_CORES: "{{ compile_cpu_cores }}"
+{%- endif %}
+{%- if compile_memory_gb is not none %}
+      ANALOGCLOUD_COMPILE_MEMORY_GB: "{{ compile_memory_gb }}"
+{%- endif %}
+{% endfor %}
+{% endif %}
+{%- for entry in devices %}
+{%- for i in range(entry.workers) %}
+  worker-run-{{ entry.name }}-{{ i }}:
+    image: {{ worker_image }}
+    restart: unless-stopped
+    user: "${ANALOGCLOUD_UID:?ANALOGCLOUD_UID is not set in .env}:${ANALOGCLOUD_GID:?ANALOGCLOUD_GID is not set in .env}"
+    networks:
+      - internal
+    volumes:
+      - "${ANALOGCLOUD_BASE_DIR:?ANALOGCLOUD_BASE_DIR is not set in .env}/config:/config:ro"
+      - "${ANALOGCLOUD_BASE_DIR:?ANALOGCLOUD_BASE_DIR is not set in .env}/data:/data"
+      - "${ANALOGCLOUD_BASE_DIR:?ANALOGCLOUD_BASE_DIR is not set in .env}/logs:/logs"
+    environment:
+      WORKER_TYPE: run
+      BROKER_URL: "amqp://${RABBITMQ_DEFAULT_USER:-analogcloud}:${RABBITMQ_DEFAULT_PASS:?RABBITMQ_DEFAULT_PASS is not set in .env}@rabbitmq:5672//"
+      ANALOGCLOUD_DATABASE_URL: "postgresql+asyncpg://${POSTGRES_USER:-analogcloud}:${POSTGRES_PASSWORD}@postgres:${POSTGRES_PORT:-5432}/${POSTGRES_DB:-analogcloud}"
+      ANALOGCLOUD_BASE_DIR: "/"
+      ANALOGCLOUD_LOG_NAME: worker-run-{{ entry.name }}-{{ i }}
+      DEVICE_NAME: "{{ entry.name }}"
+      ANALOGCLOUD_RUN_OP_TIME_LIMIT: "{{ run_op_time_limit }}"
+{%- if entry.is_simulator %}
+      ANALOGCLOUD_SIMULATOR_BINARY: /usr/local/bin/compiler_sim
+{%- endif %}
+{%- if compile_remote %}
+      ANALOGCLOUD_BLOB_BACKEND: s3
+      S3_BLOB_ENDPOINT: "http://seaweedfs:8333"
+      S3_BLOB_BUCKET: ${S3_BLOB_BUCKET:-analogcloud}
+      S3_BLOB_ACCESS_KEY: ${S3_BLOB_ACCESS_KEY:?S3_BLOB_ACCESS_KEY is not set in .env}
+      S3_BLOB_SECRET_KEY: ${S3_BLOB_SECRET_KEY:?S3_BLOB_SECRET_KEY is not set in .env}
+{%- endif %}
+
+{% endfor %}
+{%- endfor %}
+networks:
+  internal:
+    external: true
+    name: analogcloud_internal