# Docker Compose for the SSO Manager all-in-one image (app + OpenLDAP in one container).
#
# The image (Dockerfile.openldap) bundles a slapd that the app talks to over
# localhost. The app reads its configuration from conf/base.js + conf/secrets.js
# (deep-merged by @simpleworkjs/conf). The operator-edited secrets live in a
# bind-mounted ./config/sso-secrets.js, which docker-entrypoint.sh symlinks into
# /app/conf/secrets.js on startup. No app_* env vars are passed here: any app_*
# env would override secrets.js (env beats the file in @simpleworkjs/conf), so
# the file must be the only source.
#
# Compose only interpolates the port defaults below — there is no .env file.
# Override a port on the command line if needed:
#   PORT=3002 LDAPS_PORT=1636 docker compose up -d
#
# Requires @simpleworkjs/conf >= 1.1.0 in the image. Refresh
# nodejs/package-lock.json with `npm install @simpleworkjs/conf@^1.1.0` before
# building.

services:
  sso-manager:
    build:
      context: .
      dockerfile: Dockerfile.openldap
    container_name: sso-manager
    restart: unless-stopped
    ports:
      # SSO Manager web UI (HTTP inside the container; terminate TLS at the
      # front proxy — e.g. the theta42/proxy). Don't expose 3001 to the open
      # internet; bind it to localhost or leave it on the docker network only.
      - "${PORT:-3001}:3001"
      # LDAPS — direct LDAP binds from legacy apps / the proxy over the network
      # (TLS, self-signed cert by default; mount your own at LDAP_CERT_DIR).
      - "${LDAPS_PORT:-636}:636"
      # LDAP plain (389) is NOT mapped to the host by default — it would allow
      # cleartext password binds over the LAN. Uncomment to permit StartTLS or
      # plain binds from the LAN (not recommended):
      # - "${LDAP_PORT:-389}:389"
    environment:
      # Config (LDAP, OAuth, SMTP, ...) comes from ./config/sso-secrets.js (see
      # volumes below), not from env. NODE_ENV/NODE_PORT are the only env the app
      # reads that are not part of its conf tree.
      - NODE_ENV=production
      - NODE_PORT=3001
    volumes:
      # Operator-edited secrets (sso-secrets.js). The entrypoint symlinks
      # /config/sso-secrets.js -> /app/conf/secrets.js so @simpleworkjs/conf reads
      # it. See secrets.js.example / config.example/ for the shape.
      - ./config:/config:ro
      # Persist the LDAP database across container recreation.
      - ldap-data:/var/lib/ldap
      # Persist the auto-generated self-signed TLS cert so clients don't have to
      # re-trust it on every rebuild. To use your own CA-signed cert instead,
      # replace this with a bind mount of your cert dir, e.g.:
      #   - ./certs:/etc/openldap/certs
      # (must contain ldap.crt + ldap.key; the entrypoint leaves them untouched).
      - ldap-certs:/etc/openldap/certs
      # Persist Redis (AOF + RDB) so OAuth clients, tokens, and other
      # Redis-backed state survive container recreation. Restoring Redis also
      # restores lua-resty-auto-ssl cert state if this image fronts a proxy.
      - sso-data:/data
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3001/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s

volumes:
  ldap-data:
  ldap-certs:
  sso-data: