From abc06f57dab583589abbf99ec7abe831df18c8bc Mon Sep 17 00:00:00 2001
From: hsiegeln <37154749+hsiegeln@users.noreply.github.com>
Date: Sat, 4 Apr 2026 18:04:42 +0200
Subject: [PATCH] feat: update Docker Compose, CI, and add runtime-base
 Dockerfile

Add jardata volume, CAMELEER_AUTH_TOKEN/CAMELEER3_SERVER_ENDPOINT/CLICKHOUSE_URL env vars to cameleer-saas, CAMELEER_AUTH_TOKEN to cameleer3-server, runtime-base Dockerfile for agent-instrumented customer apps, and expand CI surefire excludes for new integration test classes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .env.example                   |  4 ++++
 .gitea/workflows/ci.yml        |  2 +-
 docker-compose.yml             |  6 ++++++
 docker/runtime-base/Dockerfile | 19 +++++++++++++++++++
 4 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 docker/runtime-base/Dockerfile

diff --git a/.env.example b/.env.example
index 9ad5966..c7ac9be 100644
--- a/.env.example
+++ b/.env.example
@@ -23,3 +23,7 @@ CAMELEER_JWT_PUBLIC_KEY_PATH=/etc/cameleer/keys/ed25519.pub
 
 # Domain (for Traefik TLS)
 DOMAIN=localhost
+
+CAMELEER_AUTH_TOKEN=change_me_bootstrap_token
+CAMELEER_CONTAINER_MEMORY_LIMIT=512m
+CAMELEER_CONTAINER_CPU_SHARES=512
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f6bb039..46a4c32 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
       - name: Build and Test (unit tests only)
         run: >-
           mvn clean verify -B
-          -Dsurefire.excludes="**/AuthControllerTest.java,**/TenantControllerTest.java,**/LicenseControllerTest.java,**/AuditRepositoryTest.java,**/CameleerSaasApplicationTest.java"
+          -Dsurefire.excludes="**/AuthControllerTest.java,**/TenantControllerTest.java,**/LicenseControllerTest.java,**/AuditRepositoryTest.java,**/CameleerSaasApplicationTest.java,**/EnvironmentControllerTest.java,**/AppControllerTest.java,**/DeploymentControllerTest.java"
 
   docker:
     needs: build
diff --git a/docker-compose.yml b/docker-compose.yml
index 089ee5a..9e6e693 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -58,6 +58,7 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./keys:/etc/cameleer/keys:ro
+      - jardata:/data/jars
     environment:
       SPRING_DATASOURCE_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB:-cameleer_saas}
       SPRING_DATASOURCE_USERNAME: ${POSTGRES_USER:-cameleer}
@@ -69,6 +70,9 @@ services:
       LOGTO_M2M_CLIENT_SECRET: ${LOGTO_M2M_CLIENT_SECRET:-}
       CAMELEER_JWT_PRIVATE_KEY_PATH: ${CAMELEER_JWT_PRIVATE_KEY_PATH:-}
       CAMELEER_JWT_PUBLIC_KEY_PATH: ${CAMELEER_JWT_PUBLIC_KEY_PATH:-}
+      CAMELEER_AUTH_TOKEN: ${CAMELEER_AUTH_TOKEN:-default-bootstrap-token}
+      CAMELEER3_SERVER_ENDPOINT: http://cameleer3-server:8081
+      CLICKHOUSE_URL: jdbc:clickhouse://clickhouse:8123/cameleer
     labels:
       - traefik.enable=true
       - traefik.http.routers.api.rule=PathPrefix(`/api`)
@@ -89,6 +93,7 @@ services:
     environment:
       SPRING_DATASOURCE_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB:-cameleer_saas}
       CLICKHOUSE_URL: jdbc:clickhouse://clickhouse:8123/cameleer
+      CAMELEER_AUTH_TOKEN: ${CAMELEER_AUTH_TOKEN:-default-bootstrap-token}
     labels:
       - traefik.enable=true
       - traefik.http.routers.observe.rule=PathPrefix(`/observe`)
@@ -120,3 +125,4 @@ volumes:
   pgdata:
   chdata:
   acme:
+  jardata:
diff --git a/docker/runtime-base/Dockerfile b/docker/runtime-base/Dockerfile
new file mode 100644
index 0000000..35cf4e0
--- /dev/null
+++ b/docker/runtime-base/Dockerfile
@@ -0,0 +1,19 @@
+FROM eclipse-temurin:21-jre-alpine
+WORKDIR /app
+
+# Agent JAR is copied during CI build from Gitea Maven registry
+# ARG AGENT_JAR=cameleer3-agent-1.0-SNAPSHOT-shaded.jar
+COPY agent.jar /app/agent.jar
+
+ENTRYPOINT exec java \
+  -Dcameleer.export.type=${CAMELEER_EXPORT_TYPE:-HTTP} \
+  -Dcameleer.export.endpoint=${CAMELEER_EXPORT_ENDPOINT} \
+  -Dcameleer.agent.name=${HOSTNAME} \
+  -Dcameleer.agent.application=${CAMELEER_APPLICATION_ID:-default} \
+  -Dcameleer.agent.environment=${CAMELEER_ENVIRONMENT_ID:-default} \
+  -Dcameleer.routeControl.enabled=${CAMELEER_ROUTE_CONTROL_ENABLED:-false} \
+  -Dcameleer.replay.enabled=${CAMELEER_REPLAY_ENABLED:-false} \
+  -Dcameleer.health.enabled=true \
+  -Dcameleer.health.port=9464 \
+  -javaagent:/app/agent.jar \
+  -jar /app/app.jar