"""Docker Compose generator — app + egress proxy sidecar.

Produces a docker-compose.yml that runs the application behind a Squid
egress proxy with a domain allowlist. The app container is on an isolated
internal network with no direct internet access; only the egress proxy
bridges to the external network.
"""

from ..analyzer.models import AppAnalysis


def generate_compose(analysis: AppAnalysis) -> str:
    """Generate a docker-compose.yml with app + egress proxy sidecar.

    Args:
        analysis: Application analysis results

    Returns:
        docker-compose.yml content as a string
    """
    framework = analysis.framework.name.lower() if analysis.framework else "script"

    app_port_map = {
        "fastapi": 8000,
        "streamlit": 8501,
        "gradio": 7860,
        "flask": 5000,
        "django": 8000,
        "script": 8000,
    }
    app_port = app_port_map.get(framework, 8000)
    if analysis.app_spec and analysis.app_spec.listen_port:
        app_port = analysis.app_spec.listen_port

    return f'''# Docker Compose with egress proxy sidecar
# Generated by harden CLI (OSS)
#
# Architecture:
#   [you] --> localhost:{app_port} --> [app container] --HTTP_PROXY--> [egress-proxy:3128] --> [internet]
#
# The app container is on an isolated network with NO direct internet access.
# All outbound HTTP(S) traffic is routed through the Squid egress proxy,
# which enforces a domain allowlist derived from static analysis.
#
# To see which domains are allowed, check squid.conf in this directory.

services:
  # ==========================================================================
  # Application
  # ==========================================================================
  app:
    build:
      context: ..
      dockerfile: .harden/Dockerfile
    container_name: harden-app
    restart: unless-stopped
    ports:
      - "{app_port}:{app_port}"
    networks:
      - internal
      - default
    env_file:
      - ../.env
    environment:
      - PYTHONUNBUFFERED=1
      # Route all outbound HTTP through the egress proxy sidecar
      - HTTP_PROXY=http://egress-proxy:3128
      - HTTPS_PROXY=http://egress-proxy:3128
      - NO_PROXY=localhost,127.0.0.1,0.0.0.0
    depends_on:
      egress-proxy:
        condition: service_healthy

  # ==========================================================================
  # Egress Proxy: Squid forward proxy with domain allowlist
  # ==========================================================================
  # Only domains listed in squid.conf are reachable from the app container.
  # All other outbound traffic is blocked (fail-closed).
  egress-proxy:
    image: ubuntu/squid:6.6-24.04_edge
    container_name: harden-egress-proxy
    restart: unless-stopped
    networks:
      - internal
      - external
    volumes:
      - ./squid.conf:/etc/squid/squid.conf:ro
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/localhost/3128' 2>/dev/null || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 5s

# ==========================================================================
# Networks
# ==========================================================================
networks:
  # Internal: app + egress-proxy. No direct internet access.
  internal:
    driver: bridge
    internal: true
  # External: only the egress-proxy is on this network.
  external:
    driver: bridge
'''
