# Local production-like smoke for Plan-13 Control Panel:
# self-signed TLS + mock OIDC IdP + oauth2-proxy + nginx auth_request.

services:
  control-panel-api:
    build:
      context: .
      dockerfile: Dockerfile.control-panel-api
    image: casan-control-panel-api:local
    restart: unless-stopped
    environment:
      CASAN_PROFILE: prod
      CASAN_CP_STRICT: "1"
      CASAN_CP_TRUST_AUTH_PROXY: "1"
      CP_BIND: 0.0.0.0
      CP_PORT: "3010"
      CASAN_APP_ROOT: /app
      CASAN_DASHBOARD_STALE_S: "315360000"
      # Optional local model gateway. Values come from infra/local-prod/casan.local.env
      # via local-full.sh and are never committed with credentials.
      # The Mac-hosted Ornith/Ollama model is the local default.  If it is not
      # reachable, the governed chat falls back safely to deterministic answers.
      CASAN_CHAT_MODEL_MODE: ${CASAN_CHAT_MODEL_MODE:-model}
      CASAN_CHAT_MODEL_PROVIDER: ${CASAN_CHAT_MODEL_PROVIDER:-local}
      CASAN_OLLAMA_HOST: host.docker.internal:11434
      CASAN_ALLOW_DOCKER_HOST_OLLAMA: "1"
      OLLAMA_HOST: host.docker.internal:11434
      CASAN_OPENAI_COMPATIBLE_BASE_URL: ${CASAN_OPENAI_COMPATIBLE_BASE_URL:-}
      CASAN_OPENAI_COMPATIBLE_API_KEY: ${CASAN_OPENAI_COMPATIBLE_API_KEY:-}
      CASAN_OPENAI_COMPATIBLE_ALLOWED_HOSTS: ${CASAN_OPENAI_COMPATIBLE_ALLOWED_HOSTS:-}
      CASAN_PREFLIGHT: ${CASAN_PREFLIGHT:-0}
      CASAN_AUTH_BRIDGE_URL: http://host.docker.internal:20130
      CASAN_AUTH_BRIDGE_TOKEN: ${CASAN_AUTH_BRIDGE_TOKEN:-}
    volumes:
      - ./.specify:/app/.specify
      - ./docs/output:/app/docs/output:ro
    expose:
      - "3010"
    networks:
      - casan-control-local

  control-panel-ui:
    build:
      context: .
      dockerfile: Dockerfile.control-panel-ui
    image: casan-control-panel-ui:local
    restart: unless-stopped
    depends_on:
      - control-panel-api
      - oauth2-proxy
    ports:
      - "18443:443"
    volumes:
      - ./tmp/control-panel-local/tls:/etc/nginx/tls:ro
    networks:
      - casan-control-local

  oauth2-proxy:
    image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
    restart: unless-stopped
    command:
      - --http-address=0.0.0.0:4180
      - --provider=oidc
      - --skip-oidc-discovery=true
      - --oidc-issuer-url=http://localhost:18082
      - --login-url=http://localhost:18082/authorize
      - --redeem-url=http://idp:8080/token
      - --profile-url=http://idp:8080/userinfo
      - --oidc-jwks-url=http://idp:8080/.well-known/jwks.json
      - --client-id=casan-control-panel
      - --client-secret=local-secret
      - --redirect-url=https://localhost:18443/oauth2/callback
      - --whitelist-domain=localhost:18443
      - --cookie-secret=0123456789abcdef0123456789abcdef
      - --cookie-secure=true
      - --email-domain=*
      - --scope=openid email profile groups
      - --oidc-groups-claim=groups
      - --reverse-proxy=true
      - --set-xauthrequest=true
      - --pass-access-token=false
      - --pass-authorization-header=false
      - --skip-provider-button=true
      - --ssl-insecure-skip-verify=true
    expose:
      - "4180"
    networks:
      - casan-control-local

  idp:
    build:
      context: ./infra/local-prod/idp
    environment:
      CASAN_IDP_PORT: "8080"
      CASAN_IDP_ISSUER: http://localhost:18082
      CASAN_IDP_SUB: oidc-ops
      CASAN_IDP_EMAIL: oidc-ops@example.com
      CASAN_IDP_GROUPS: casan-org-admin,casan-approver
    ports:
      - "18082:8080"
    networks:
      - casan-control-local

networks:
  casan-control-local:
    driver: bridge