{
  "name": "wp-engine-test",
  "build": {
    "dockerfile": "Dockerfile",
    "context": "."
  },

  // systemd as PID 1 requires a privileged container (UFW/Fail2ban/DinD too)
  "runArgs": ["--privileged"],

  // Let /sbin/init be PID 1 instead of the default sleep-loop
  "overrideCommand": false,
  "remoteUser": "root",

  // Ports wp-engine.sh opens, surfaced on the host for manual verification
  "forwardPorts": [80, 443, 81, 8080, 3000, 48222],
  "portsAttributes": {
    "80":    { "label": "HTTP (ingress)" },
    "443":   { "label": "HTTPS (ingress)" },
    "81":    { "label": "Nginx Proxy Manager admin" },
    "8080":  { "label": "Traefik dashboard" },
    "3000":  { "label": "Grafana" },
    "48222": { "label": "SSH (hardened port)" }
  },

  "postCreateCommand": "chmod +x wp-engine.sh tests/smoke.sh && bash tests/smoke.sh static; echo ''; echo 'Dev container ready. Run:  STAGE=all bash tests/smoke.sh'",

  "customizations": {
    "vscode": {
      "extensions": ["timonwong.shellcheck"]
    }
  }
}