# Production-oriented Control Panel scaffold.
# Requires:
#   - TLS cert/key mounted at /opt/casan-control-panel/tls/tls.crt|tls.key
#   - OIDC env file at /opt/casan-control-panel/oauth2-proxy.env
#   - CASAN state/artifacts mounted read-write/read-only as appropriate
#
# oauth2-proxy must emit X-Auth-Request-User and X-Auth-Request-Groups.
# Nginx overwrites X-CASAN-* headers before proxying to the API; the API maps
# groups such as casan-approver -> approver via rbac-check.py map-claim.

services:
  control-panel-api:
    build:
      context: .
      dockerfile: Dockerfile.control-panel-api
    image: casan-control-panel-api:latest
    restart: unless-stopped
    environment:
      CASAN_PROFILE: prod
      CASAN_CP_STRICT: "1"
      CASAN_CP_TRUST_AUTH_PROXY: "1"
      CP_BIND: 0.0.0.0
      CP_PORT: "3010"
      CASAN_APP_ROOT: /app
    volumes:
      - ./.specify:/app/.specify
      - ./docs/output:/app/docs/output:ro
    expose:
      - "3010"
    networks:
      - casan-control

  control-panel-ui:
    build:
      context: .
      dockerfile: Dockerfile.control-panel-ui
    image: casan-control-panel-ui:latest
    restart: unless-stopped
    depends_on:
      - control-panel-api
      - oauth2-proxy
    ports:
      - "8443:443"
    volumes:
      - /opt/casan-control-panel/tls:/etc/nginx/tls:ro
    networks:
      - casan-control

  oauth2-proxy:
    image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
    restart: unless-stopped
    env_file:
      - path: /opt/casan-control-panel/oauth2-proxy.env
        required: false
    command:
      - --http-address=0.0.0.0:4180
      - --reverse-proxy=true
      - --set-xauthrequest=true
      - --pass-access-token=false
      - --pass-authorization-header=false
      - --skip-provider-button=true
    expose:
      - "4180"
    networks:
      - casan-control

networks:
  casan-control:
    driver: bridge