services:

  jlinc-server:
    image: jlinclabs/jlinc-server
    container_name: jlinc-server
    environment:
      # BASE CONFIGURATION
      # ==================
      # If you wish to display debug logging
      # DEBUG: "true"
      #
      # DB URL
      POSTGRES_URL: postgresql://jlinc:password@jlinc-db/jlinc
      # Public URLs, callback URLS will be PUBLIC_CALLBACK_URL + '/callback/<module>'
      PUBLIC_CORE_URL: http://localhost:9090
      PUBLIC_ARCHIVE_URL: http://localhost:9090
      PUBLIC_CALLBACK_URL: http://localhost:9090
      # Enabled app modules (dashboard = the read-only operator console)
      APP_MODULES: core, archive, dashboard
      # Optional: source dashboard data from remote core/audit servers instead of
      # the local DB (federation). Unset => serve from the local DB.
      # DASHBOARD_CORE_URL: https://core.example.com
      # DASHBOARD_CORE_KEY: <api-key>
      # DASHBOARD_AUDIT_URL: https://api.jlinc.io
      # DASHBOARD_AUDIT_KEY: <api-key>
      # Validated-API-key cache (per process). TTL 0 disables caching entirely;
      # MAX bounds how many validated keys are held before the least recently
      # used is evicted. Defaults: 30 min / 10000 entries.
      # DASHBOARD_KEY_CACHE_TTL_MS: 1800000
      # DASHBOARD_KEY_CACHE_MAX: 10000
      # Enabled authentication modules
      AUTH_MODULES: single, oidc, github, google
      # Secure secret for memory store, generate with `openssl rand -hex 64`
      SECURE_SECRET: 9ed678e6da3333a53c635039a5f53015ba3d4c841a0ade4e46f31c2d42c9b3e71edcdda7e1d75d066a39a8f56f9eb325d556a90195c6e7f45c6e2fffd0e98a7a
      # Default FedID server to use for identity management
      DEFAULT_FEDID_URL: https://fedid-test.jlinc.io

      # AUTH MODULES
      # ============

      # Single User
      # -----------
      # Use for local development to auto-create a test user
      # SINGLE_API_KEY_CORE: OGExYWE2ZjMwYjdhZjQyZWE4MmE1YTUwO
      # SINGLE_API_KEY_ARCHIVE: MDY5ZDMyZjMyZDAzYTU0ZDQwZWJiM2I4M

      # OpenID Connect
      # --------------
      # Works with any OIDC provider
      # OIDC_BUTTON_LABEL: FedID
      # OIDC_CLIENT_ID: 
      # OIDC_CLIENT_SECRET: 
      # OIDC_ISSUER: https://fedid-test.jlinc.io/oidc
      # OIDC_AUTHORIZATION_URL: https://fedid-test.jlinc.io/oidc/auth
      # OIDC_TOKEN_URL: https://fedid-test.jlinc.io/oidc/token
      # OIDC_USERINFO_URL: https://fedid-test.jlinc.io/oidc/me
      # OIDC_LOGOUT_URL: https://fedid-test.jlinc.io/oidc/session/end

      # GitHub
      # --------------
      # Set up your GitHub app: https://github.com/settings/applications/new
      # GITHUB_CLIENT_ID: 
      # GITHUB_CLIENT_SECRET: 

      # Google
      # --------------
      # Set up your Google app: https://console.developers.google.com/
      #   - Create a new app
      #   - Set up auth: https://console.cloud.google.com/auth/overview
      # GOOGLE_CLIENT_ID: 
      # GOOGLE_CLIENT_SECRET: 

      # PDP MODULES
      # ===========
      PDP_TYPE: cerbos

      # Cerbos
      # -----------
      PDP_URL: http://jlinc-pdp:3592
    restart: unless-stopped
    depends_on:
      - jlinc-db
    networks:
      - jlinc
    # White-label: mount a custom.css to re-skin the dashboard (see custom.example.css)
    # volumes:
    #   - ./custom.example.css:/app/http/public/custom.css:ro
    # For dev
    ports:
      - 9090:9090

  jlinc-db:
    image: postgres:17-alpine
    container_name: jlinc-db
    environment:
      - POSTGRES_USER=jlinc
      - POSTGRES_PASSWORD=password
      - POSTGRES_DB=jlinc
    ports:
      - 127.0.0.1:5432:5432
    volumes:
      - ./data/db:/var/lib/postgresql/data
    restart: unless-stopped
    networks:
      - jlinc      

  jlinc-pdp:
    image: cerbos/cerbos:0.47.0
    container_name: jlinc-pdp
    ports:
      - 127.0.0.1:3592:3592
    volumes:
      - ./policies:/policies
    restart: unless-stopped
    networks:
      - jlinc

networks:
  jlinc: