docker-compose.yml

# Full topology in one network. NOTE: the authorizer image below is a
# placeholder — build it from main first:
#   cd <authorizer repo> && make build-local-image VERSION=local
# which produces quay.io/authorizer/authorizer:local (or docker build . -t
# authorizer:local and adjust the image name).
#
# Inside this network every party reaches Authorizer as http://authorizer:8080,
# so token `iss` claims are consistent (Authorizer derives `iss` from the
# request host — see README "The issuer pitfall"). Run the demo from inside
# the network too:
#   docker compose run --rm setup
#   docker compose exec gateway node scripts/demo.js
services:
  authorizer:
    image: quay.io/authorizer/authorizer:local # placeholder — build from main
    command:
      - --database-type=sqlite
      # The image runs as uid 1000 (`authorizer`). A named volume mounted at a
      # path the image does not already own is created root-owned, and the
      # process then cannot create the SQLite file. Keep the database inside
      # /authorizer, which the image chowns to that uid. Demo-only: the data
      # goes away with the container.
      - --database-url=/authorizer/authorizer.db
      # RS256 requires an explicit keypair (the server refuses to boot without
      # one). This is the SAME well-known dev keypair `make dev` uses in the
      # server repo — public knowledge, demo only, NEVER deploy it.
      - --jwt-type=RS256
      - --encryption-key=insecure-local-demo-encryption-key
      - |-
        --jwt-private-key=-----BEGIN RSA PRIVATE KEY-----
        MIIEowIBAAKCAQEA5dC50fVvQIDm66bBYW+qI+MypP9Pv9SMoHIz9cpcOj9sNhXI
        HTllAM5dhi/+HIaJdPugVQt1rlTJVSFR+ynSmwa89RPHs0o7CBytskGaaf2RJ6zD
        AY3TXKQQVAT3Qvb6ZOQh3+Hh8EOguqdE2iORo9s0KMk7tqS+/y4H3qrC6ngyt2QT
        6VqWbs92N/aO0p/FaL/Q7rGZ+9hTlu3L/T70r3nyeA636kM48XUSqcjDrs4/E+Vx
        XL2Y9Wo4kuaDmMPvMkdl6/wGOwAuIuHpmdfGh0hyLMdgpMqvFyEHuagCy+yFV6ES
        gVi2rOp1g28iISbjpMTkNikbCBuL/TeaSdmEPwIDAQABAoIBABDpeCXmI2Ps+HwN
        VKbNzQirZA3gsfw3xoovd/kVsA14nwcojtuZCStILyQRrRK+qH1A39l8/ecwhckW
        KiPLE0dloAstrkut4e6PZGLn/AE3xUeqVDFtlUkjKQZzKm+1oCiY4eX0B/335BXy
        +u34ocjxTS3Wh+aWyhgaSZROdF3vtcH0PHDroDd8oT/H0xN8fX/T1JozLN3jbxXz
        G4KznKNmx74SrV/y6/wmmQqIsghJBNRZGbg5bn/xcExkcRhWQ3Eka8yAlu31XBQV
        G5AtHEVO8lEi+a2PCA7t1xquw/8b48lc226aaN0pjaySNtyLB7EaKUxBDB2aGx3s
        nVIuOsUCgYEA5xWJ67BKy6MyHphhltTLvre/AGXKDhoV3IR3Hm1cu/iXCT/oOFje
        SYAAqqHXKEB+HZ4xKk7PnBzXkyLXqkCbEIBsv+GZpmboqZrPMfRgS6QcPWWMV9pZ
        f1h68hWpXfyY+yEhAvPKFFhjAt0f5uMiRaAUskZJTFiRJqxz+z0AdD0CgYEA/pgq
        Tk8WMKJBTic3m224FrR4qDok8tQp8FCerS7T5fFnSXZx64ucREn+Wm9ym5UTtbQz
        pne4diIsNIIlVFOjOV7jHjzBS5oly2N/2AT5+ST7O4GZfh/I9VKQWuIh+i3p3s9x
        7PSIlaql9ddV582gCMiL7/QDkHDFBVEz+vq31isCgYB2UoQFZ4ZU0OI34kSN67XL
        mOA2/ue/4sFw4W7w6ISERxxnAw8P0wk2z1EIDchSdvtchQSdqi8Ju4bycvPE3EHJ
        6EhG0+hN2QGm3nrbFEs+T/CZy2ZaEZaj6xVA4bCQTGe0ptj1XwkI89z2uWy9V23U
        Asy2H+EmM29XQxQ7/5c87QKBgQCUO+i1+5pB6tb3OCJKXxHGNoHiASiuMhXRFD+v
        OgqqYWnv/gTKTllH8YUlBqrGJ4B4VVmVXTOLpM30LKqrdJ8esj6uxlUNPc0vpNk0
        34DkLUISHZ1PMBaDr/TY1b1OuxjmYAZHHwG/ksJaZ2xfMPwy4QGJTpwcp2wvcl4/
        jWcoTQKBgALNq5XD/ufvZO2YQq9phF0EQza9zr45zSENF0cOsyVcEG4wfFv4Sg03
        JjTG57oYDCWeLrFCRQpysFi1pDUUCQ1Z/Kf9xKZ/OoE1mXGCKGilBGUijQasuO5Q
        GU+S3Xlk6TWCb2jTgc9UTjlp1FOgQSad4M6TW8vXGkSMODEj5g0S
        -----END RSA PRIVATE KEY-----
      - |-
        --jwt-public-key=-----BEGIN RSA PUBLIC KEY-----
        MIIBCgKCAQEA5dC50fVvQIDm66bBYW+qI+MypP9Pv9SMoHIz9cpcOj9sNhXIHTll
        AM5dhi/+HIaJdPugVQt1rlTJVSFR+ynSmwa89RPHs0o7CBytskGaaf2RJ6zDAY3T
        XKQQVAT3Qvb6ZOQh3+Hh8EOguqdE2iORo9s0KMk7tqS+/y4H3qrC6ngyt2QT6VqW
        bs92N/aO0p/FaL/Q7rGZ+9hTlu3L/T70r3nyeA636kM48XUSqcjDrs4/E+VxXL2Y
        9Wo4kuaDmMPvMkdl6/wGOwAuIuHpmdfGh0hyLMdgpMqvFyEHuagCy+yFV6ESgVi2
        rOp1g28iISbjpMTkNikbCBuL/TeaSdmEPwIDAQAB
        -----END RSA PUBLIC KEY-----
      # Demo-only secrets — never reuse.
      - --admin-secret=admin
      - --client-id=kbyuFDidLLm280LIwVFiazOqjO3ty8KH
      - --client-secret=demo-instance-client-secret-do-not-use
      # allowed-origins gates both CORS and CSRF Origin checks on /graphql.
      - --allowed-origins=authorizer:8080,localhost:8080
    ports:
      - "8080:8080"

  setup:
    image: node:22-alpine
    working_dir: /app
    volumes:
      - .:/app
    environment:
      AUTHORIZER_URL: http://authorizer:8080
      AUTHORIZER_ADMIN_SECRET: admin
      AUTHORIZER_CLIENT_ID: kbyuFDidLLm280LIwVFiazOqjO3ty8KH
    command: sh -c "npm install && node setup.js"
    depends_on:
      - authorizer
    profiles: ["setup"] # run explicitly: docker compose run --rm setup

  gateway:
    image: node:22-alpine
    working_dir: /app
    volumes:
      - .:/app
    environment:
      AUTHORIZER_URL: http://authorizer:8080
      ORDERS_URL: http://orders:4001
      BILLING_URL: http://billing:4002
      GATEWAY_URL: http://localhost:4000
    command: sh -c "npm install && node gateway/server.js"
    ports:
      - "4000:4000"
    depends_on:
      - authorizer

  orders:
    image: node:22-alpine
    working_dir: /app
    volumes:
      - .:/app
    environment:
      AUTHORIZER_URL: http://authorizer:8080
      BILLING_URL: http://billing:4002
    command: sh -c "npm install && node orders-service/server.js"
    # no ports: — internal only; the trust boundary is the compose network
    depends_on:
      - authorizer

  billing:
    image: node:22-alpine
    working_dir: /app
    volumes:
      - .:/app
    environment:
      AUTHORIZER_URL: http://authorizer:8080
    command: sh -c "npm install && node billing-service/server.js"
    # no ports: — internal only
    depends_on:
      - authorizer