version: '3.8'

services:
  # PostgreSQL Database
  postgres:
    image: postgres:15-alpine
    container_name: oidc_postgres
    environment:
      POSTGRES_DB: oidc_db
      POSTGRES_USER: oidc_user
      POSTGRES_PASSWORD: change_me_in_production
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U oidc_user -d oidc_db"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - oidc_network

  # OIDC Identity Provider
  oidc_server:
    build: .
    container_name: oidc_server
    environment:
      # Flask
      FLASK_ENV: production
      SECRET_KEY: ${SECRET_KEY:-please-change-this-secret-key-in-production}

      # Database - PostgreSQL
      DATABASE_URL: postgresql://oidc_user:change_me_in_production@postgres:5432/oidc_db

      # OIDC Config
      OIDC_ISSUER: ${OIDC_ISSUER:-http://localhost:5000}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-test-client}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-test-secret}

      # Token Lifetimes (seconds)
      ACCESS_TOKEN_LIFETIME: ${ACCESS_TOKEN_LIFETIME:-3600}
      AUTHORIZATION_CODE_LIFETIME: ${AUTHORIZATION_CODE_LIFETIME:-600}
      ID_TOKEN_LIFETIME: ${ID_TOKEN_LIFETIME:-3600}
    ports:
      - "5000:5000"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    networks:
      - oidc_network

volumes:
  postgres_data:
    driver: local

networks:
  oidc_network:
    driver: bridge