version: '3.9'

services:
  oauth-broker:
    build:
      context: ./app
      # Build-time network access must not depend on Docker's iptables/NAT on this server.
      network: host
    env_file:
      - ./.env
    environment:
      PORT: ${PORT:-8088}
      BASE_URL: ${BASE_URL:-http://localhost:8088}
      # Host networking avoids Docker iptables/NAT issues on this server.
      DATABASE_URL: ${DATABASE_URL:-postgres://oauth:oauth@127.0.0.1:5433/oauth}
    depends_on:
      - oauth-db
    restart: unless-stopped
    network_mode: host

  oauth-db:
    image: postgres:15
    environment:
      POSTGRES_USER: oauth
      POSTGRES_PASSWORD: oauth
      POSTGRES_DB: oauth
    # Bind only to localhost when using host networking.
    command: ["postgres", "-c", "listen_addresses=127.0.0.1", "-c", "port=5433"]
    volumes:
      - oauth-db-data:/var/lib/postgresql/data
      - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    restart: unless-stopped
    network_mode: host

volumes:
  oauth-db-data:
