version: '3.8'

services:
  # PostgreSQL Database
  postgres:
    image: postgres:15-alpine
    container_name: oidc_postgres
    env_file:
      - .env
    environment:
      POSTGRES_DB: oidc_db
      POSTGRES_USER: oidc_user
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./backups:/backups  # Mount for database backups
    # Only accessible internally - no port exposure
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U oidc_user -d oidc_db"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - oidc_network

  # OIDC Identity Provider
  oidc_server:
    build: .
    container_name: oidc_server
    env_file:
      - .env
    # Expose only to host for your existing nginx to proxy to
    ports:
      - "0.0.0.0:5000:5000"  # Only accessible from localhost
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - oidc_network
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  postgres_data:
    driver: local

networks:
  oidc_network:
    driver: bridge