# Production Control Panel deployment. This file intentionally has no build
# directives: production must run the digest-pinned images attested by CI.
# `production-preflight.sh` validates all files, endpoints, Object Lock and
# images before `docker compose up` is allowed.
#
# oauth2-proxy must emit a signed OIDC access token. Nginx removes caller-supplied
# identity headers and forwards only that bearer token; the API verifies issuer,
# audience, expiry and signature in-process before deriving CASAN identity.

services:
  control-panel-api:
    image: ${CASAN_CP_API_IMAGE:?Set a digest-pinned CASAN_CP_API_IMAGE}
    restart: unless-stopped
    env_file:
      - path: ${CASAN_CP_RUNTIME_ENV:?Set CASAN_CP_RUNTIME_ENV}
        required: true
      - path: ${CASAN_CP_VAULT_ENV:?Set CASAN_CP_VAULT_ENV}
        required: true
    environment:
      CASAN_PROFILE: prod
      CASAN_CP_STRICT: "1"
      CP_BIND: 0.0.0.0
      CP_PORT: "3010"
      CASAN_APP_ROOT: /app
      # Browser-login CLIs are workstation-only. Production uses managed API
      # credentials/workload identity and must not call a developer host bridge.
      CASAN_PROVIDER_ACCOUNT_AUTH_ENABLED: "0"
    volumes:
      - ${CASAN_CP_STATE_DIR:?Set CASAN_CP_STATE_DIR}:/app/.specify
      - ${CASAN_CP_OUTPUT_DIR:?Set CASAN_CP_OUTPUT_DIR}:/app/docs/output:ro
      - ${CASAN_CP_IDP_PUBLIC_KEY:?Set CASAN_CP_IDP_PUBLIC_KEY}:/run/casan-idp/idp-public.pem:ro
    expose:
      - "3010"
    networks:
      - casan-control

  control-panel-ui:
    image: ${CASAN_CP_UI_IMAGE:?Set a digest-pinned CASAN_CP_UI_IMAGE}
    restart: unless-stopped
    depends_on:
      - control-panel-api
      - oauth2-proxy
    ports:
      - "${CASAN_CP_HTTPS_PORT:-443}:443"
    volumes:
      - ${CASAN_CP_TLS_DIR:?Set CASAN_CP_TLS_DIR}:/etc/nginx/tls:ro
    networks:
      - casan-control

  oauth2-proxy:
    image: ${CASAN_CP_OAUTH2_PROXY_IMAGE:?Set a digest-pinned CASAN_CP_OAUTH2_PROXY_IMAGE}
    restart: unless-stopped
    env_file:
      - path: ${CASAN_CP_OAUTH_ENV:?Set CASAN_CP_OAUTH_ENV}
        required: true
    command:
      - --http-address=0.0.0.0:4180
      - --reverse-proxy=true
      - --set-xauthrequest=true
      - --pass-access-token=true
      - --pass-authorization-header=true
      - --skip-provider-button=true
      - --cookie-secure=true
      - --cookie-httponly=true
      - --cookie-samesite=lax
      - --cookie-expire=8h
      - --cookie-refresh=1h
    expose:
      - "4180"
    networks:
      - casan-control

networks:
  casan-control:
    driver: bridge