# Authentik (plus its Postgres) for OIDC development, opt-in because most work
# needs neither:
#   docker compose -f docker-compose.oidc.yml up -d
#
# Its own compose project, so a `down --remove-orphans` here can never reach the
# dev stack. Joins romm_default, so bring the dev stack up first: Authentik
# reaches the dev Valkey and the backend reaches the issuer by name, while the
# browser uses the published port.
# Point RomM at it with the OIDC_* variables in .env.
name: romm-oidc

services:
  romm-postgres-dev:
    image: postgres:18-alpine
    container_name: romm-postgresql-dev
    restart: unless-stopped
    env_file: .env
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-authentik}
      POSTGRES_USER: ${POSTGRES_USER:-romm}
      POSTGRES_DB: ${POSTGRES_DB:-authentik}
    volumes:
      - postgres-db:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    networks:
      - romm_default

  romm-authentik-server:
    image: ghcr.io/goauthentik/server:2024.12.5
    container_name: romm-authentik-server
    restart: unless-stopped
    command: server
    env_file: .env
    environment:
      AUTHENTIK_REDIS__HOST: romm-valkey-dev
      AUTHENTIK_POSTGRESQL__HOST: romm-postgres-dev
      AUTHENTIK_POSTGRESQL__USER: ${POSTGRES_USER:-romm}
      AUTHENTIK_POSTGRESQL__NAME: ${POSTGRES_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${POSTGRES_PASSWORD:-authentik}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-secret-key-default}
      AUTHENTIK_BOOTSTRAP_PASSWORD: ${AUTHENTIK_BOOTSTRAP_PASSWORD:-password}
    volumes:
      - authentik-media:/media
      - authentik-templates:/templates
    ports:
      - "9001:9000"
      - "9444:9443"
    depends_on:
      - romm-postgres-dev
    networks:
      - romm_default

  romm-authentik-worker:
    image: ghcr.io/goauthentik/server:2024.12.5
    container_name: romm-authentik-worker
    restart: unless-stopped
    command: worker
    env_file: .env
    environment:
      AUTHENTIK_REDIS__HOST: romm-valkey-dev
      AUTHENTIK_POSTGRESQL__HOST: romm-postgres-dev
      AUTHENTIK_POSTGRESQL__USER: ${POSTGRES_USER:-romm}
      AUTHENTIK_POSTGRESQL__NAME: ${POSTGRES_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${POSTGRES_PASSWORD:-authentik}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-secret-key-default}
      AUTHENTIK_BOOTSTRAP_PASSWORD: ${AUTHENTIK_BOOTSTRAP_PASSWORD:-password}
    volumes:
      - authentik-media:/media
      - authentik-templates:/templates
    depends_on:
      - romm-postgres-dev
    networks:
      - romm_default

volumes:
  postgres-db:
  authentik-media:
  authentik-templates:

networks:
  romm_default:
    external: true