feat: add control panel

docker-compose.control-panel.yml

@@ -0,0 +1,69 @@
+# Production-oriented Control Panel scaffold.
+# Requires:
+#   - TLS cert/key mounted at /opt/casan-control-panel/tls/tls.crt|tls.key
+#   - OIDC env file at /opt/casan-control-panel/oauth2-proxy.env
+#   - CASAN state/artifacts mounted read-write/read-only as appropriate
+#
+# oauth2-proxy must emit X-Auth-Request-User and X-Auth-Request-Groups.
+# Nginx overwrites X-CASAN-* headers before proxying to the API; the API maps
+# groups such as casan-approver -> approver via rbac-check.py map-claim.
+
+services:
+  control-panel-api:
+    build:
+      context: .
+      dockerfile: Dockerfile.control-panel-api
+    image: casan-control-panel-api:latest
+    restart: unless-stopped
+    environment:
+      CASAN_PROFILE: prod
+      CASAN_CP_STRICT: "1"
+      CASAN_CP_TRUST_AUTH_PROXY: "1"
+      CP_BIND: 0.0.0.0
+      CP_PORT: "3010"
+      CASAN_APP_ROOT: /app
+    volumes:
+      - ./.specify:/app/.specify
+      - ./docs/output:/app/docs/output:ro
+    expose:
+      - "3010"
+    networks:
+      - casan-control
+
+  control-panel-ui:
+    build:
+      context: .
+      dockerfile: Dockerfile.control-panel-ui
+    image: casan-control-panel-ui:latest
+    restart: unless-stopped
+    depends_on:
+      - control-panel-api
+      - oauth2-proxy
+    ports:
+      - "8443:443"
+    volumes:
+      - /opt/casan-control-panel/tls:/etc/nginx/tls:ro
+    networks:
+      - casan-control
+
+  oauth2-proxy:
+    image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+    restart: unless-stopped
+    env_file:
+      - path: /opt/casan-control-panel/oauth2-proxy.env
+        required: false
+    command:
+      - --http-address=0.0.0.0:4180
+      - --reverse-proxy=true
+      - --set-xauthrequest=true
+      - --pass-access-token=false
+      - --pass-authorization-header=false
+      - --skip-provider-button=true
+    expose:
+      - "4180"
+    networks:
+      - casan-control
+
+networks:
+  casan-control:
+    driver: bridge