docker-compose.auth.yml

# Local "real proxy" overlay: nginx + oauth2-proxy in front of the Quarkus app, exercising the
# actual GitHub gate / login redirect / header sanitization locally.
#
# Linux-first: network_mode host so nginx reaches Quarkus at 127.0.0.1:8080 and oauth2-proxy at
# 127.0.0.1:4180. The app itself runs on the host via `./gradlew quarkusDev` (not containerized),
# so the containers must share the host network to reach it. On macOS/Windows host networking
# differs — containers would reach the host via host.docker.internal and you'd publish ports.
#
# Started by `make run`; requires a local .env.auth (copy from .env.auth.example). See docs/auth.md.

services:
  oauth2-proxy:
    image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
    network_mode: host
    restart: unless-stopped
    # Secrets (client id/secret, cookie secret) — gitignored, copied from .env.auth.example.
    env_file:
      - .env.auth
    environment:
      OAUTH2_PROXY_PROVIDER: github
      OAUTH2_PROXY_HTTP_ADDRESS: 127.0.0.1:4180
      # auth-subrequest mode: nginx calls /oauth2/auth; the static upstream is just a placeholder.
      OAUTH2_PROXY_REVERSE_PROXY: "true"
      OAUTH2_PROXY_UPSTREAMS: static://200
      OAUTH2_PROXY_SET_XAUTHREQUEST: "true"
      # read:org is required to read the user's team membership.
      OAUTH2_PROXY_SCOPE: user:email read:org
      # <org>:<team-slug> whose members are the app's MapAdmins (write access). Same env var the app
      # reads for app.auth.map-admin-group, so the proxy gate and the app check can never drift. Set by
      # `make run`; the format and the emitted X-Auth-Groups string are identical (oauth2-proxy
      # both accepts and emits <org>:<slug>).
      OAUTH2_PROXY_GITHUB_TEAM: ${GITHUB_ADMIN_TEAM:?set GITHUB_ADMIN_TEAM (use make run)}
      OAUTH2_PROXY_EMAIL_DOMAINS: "*"
      # http locally — must be true (secure cookies) once TLS terminates in front (prod).
      OAUTH2_PROXY_COOKIE_SECURE: "false"
      OAUTH2_PROXY_COOKIE_SAMESITE: lax
      OAUTH2_PROXY_REDIRECT_URL: http://localhost:8000/oauth2/callback
      OAUTH2_PROXY_WHITELIST_DOMAINS: localhost:8000

  nginx:
    image: nginx:1.27-alpine
    network_mode: host
    restart: unless-stopped
    depends_on:
      - oauth2-proxy
    volumes:
      - ./auth/nginx.conf:/etc/nginx/conf.d/default.conf:ro