# Optional overlay for an HTTPS control plane signed by a private CA.
# Keep the CA certificate public-only; never place a CA private key on a compute node.
services:
  node-agent:
    environment:
      SSL_CERT_FILE: /run/secrets/modelforge-control-plane-ca.crt
    extra_hosts:
      - "${MODELFORGE_AGENT_CONTROL_PLANE_HOST_ALIAS:-modelforge-control-plane}:${MODELFORGE_AGENT_CONTROL_PLANE_HOST_ADDRESS:?set the control-plane address}"
    volumes:
      - ${MODELFORGE_AGENT_CA_CERT_PATH:?set the private CA certificate path}:/run/secrets/modelforge-control-plane-ca.crt:ro