docker-compose.yml

networks:
  hotosm:

volumes:
  certs:
  hanko-db-data:

services:
  # ==========================================
  # Traefik - Reverse Proxy
  # ==========================================

  traefik:
    image: traefik:v3.4.3
    container_name: login-traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.endpoint=unix:///var/run/user/1000/docker.sock"
      - "--entrypoints.http=true"
      - "--entrypoints.http.address=:80"
      - "--entrypoints.http.http.redirections.entrypoint.to=https"
      - "--entrypoints.http.http.redirections.entrypoint.scheme=https"
      - "--entryPoints.https.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=sysadmin@hotosm.org"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - certs:/letsencrypt
      - /var/run/user/1000/docker.sock:/var/run/user/1000/docker.sock:ro
    networks:
      - hotosm
    restart: unless-stopped

  # ==========================================
  # Hanko - Authentication Service
  # ==========================================

  # Hanko database migrations (runs once before Hanko starts)
  hanko-migrate:
    image: ghcr.io/teamhanko/hanko:v2.5.0
    container_name: login-hanko-migrate
    volumes:
      - ./hanko-config.yaml:/etc/config/config.yaml:ro
    command: migrate up --config /etc/config/config.yaml
    environment:
      - DATABASE_URL=postgres://hanko:${POSTGRES_PASSWORD:-hanko}@hanko-db:5432/hanko?sslmode=disable
    depends_on:
      hanko-db:
        condition: service_healthy
    networks:
      - hotosm
    restart: "no"

  hanko:
    image: ghcr.io/teamhanko/hanko:v2.5.0
    container_name: login-hanko
    volumes:
      - ./hanko-config.yaml:/etc/config/config.yaml:ro
    command: serve --config /etc/config/config.yaml public
    environment:
      - DATABASE_URL=postgres://hanko:${POSTGRES_PASSWORD:-hanko}@hanko-db:5432/hanko?sslmode=disable
      # Cookie configuration for cross-subdomain SSO
      - SESSION_COOKIE_DOMAIN=.hotosm.org
      - SESSION_COOKIE_HTTP_ONLY=true
      - SESSION_COOKIE_SAME_SITE=lax
      - SESSION_COOKIE_SECURE=true
      - THIRD_PARTY_COOKIE_DOMAIN=.hotosm.org
    networks:
      - hotosm
    labels:
      - "traefik.enable=true"
      # Hanko API endpoints with different priorities
      - "traefik.http.routers.hanko-wellknown.rule=Host(`dev.login.hotosm.org`) && PathPrefix(`/.well-known`)"
      - "traefik.http.routers.hanko-wellknown.entrypoints=https"
      - "traefik.http.routers.hanko-wellknown.tls=true"
      - "traefik.http.routers.hanko-wellknown.tls.certresolver=letsencrypt"
      - "traefik.http.routers.hanko-wellknown.priority=50"
      - "traefik.http.routers.hanko-wellknown.service=hanko"
      # Hanko API routes (registration, login POST, users, etc.)
      - "traefik.http.routers.hanko-api.rule=Host(`dev.login.hotosm.org`) && (PathPrefix(`/registration`) || PathPrefix(`/logout`) || PathPrefix(`/sessions`) || PathPrefix(`/users`) || PathPrefix(`/passcode`) || PathPrefix(`/webauthn`) || PathPrefix(`/token`) || PathPrefix(`/thirdparty`) || PathPrefix(`/profile`) || PathPrefix(`/emails`) || PathPrefix(`/password`) || PathPrefix(`/flow`))"
      - "traefik.http.routers.hanko-api.entrypoints=https"
      - "traefik.http.routers.hanko-api.tls=true"
      - "traefik.http.routers.hanko-api.tls.certresolver=letsencrypt"
      - "traefik.http.routers.hanko-api.priority=10"
      - "traefik.http.routers.hanko-api.service=hanko"
      # Hanko /login endpoint for POST requests - higher priority than frontend
      - "traefik.http.routers.hanko-login-post.rule=Host(`dev.login.hotosm.org`) && Path(`/login`) && Method(`POST`)"
      - "traefik.http.routers.hanko-login-post.entrypoints=https"
      - "traefik.http.routers.hanko-login-post.tls=true"
      - "traefik.http.routers.hanko-login-post.tls.certresolver=letsencrypt"
      - "traefik.http.routers.hanko-login-post.priority=20"
      - "traefik.http.routers.hanko-login-post.service=hanko"
      - "traefik.http.services.hanko.loadbalancer.server.port=8000"
    depends_on:
      hanko-db:
        condition: service_healthy
      hanko-migrate:
        condition: service_completed_successfully
    restart: unless-stopped

  hanko-db:
    image: postgres:17-alpine
    container_name: login-hanko-db
    environment:
      - POSTGRES_USER=hanko
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-hanko}
      - POSTGRES_DB=hanko
    volumes:
      - hanko-db-data:/var/lib/postgresql/data
    networks:
      - hotosm
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U hanko -d hanko"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  # ==========================================
  # OSM Userinfo Service - Sidecar for Hanko
  # ==========================================

  osm-userinfo:
    image: ghcr.io/hotosm/login-osm-userinfo:latest
    container_name: login-osm-userinfo
    volumes:
      - ./hanko-config.yaml:/etc/config/config.yaml:ro
    networks:
      - hotosm
    restart: unless-stopped

  # ==========================================
  # Backend - FastAPI Application
  # ==========================================

  backend:
    image: ghcr.io/hotosm/login-backend:latest
    container_name: login-backend
    environment:
      - AUTH_PROVIDER=hanko
      - HANKO_API_URL=${HANKO_API_URL:-http://hanko:8000}
      - HANKO_DB_URL=postgresql://hanko:${POSTGRES_PASSWORD:-hanko}@hanko-db:5432/hanko
      - DATABASE_URL=postgresql+asyncpg://hanko:${POSTGRES_PASSWORD:-hanko}@hanko-db:5432/hanko
      - JWT_ISSUER=https://dev.login.hotosm.org
      - COOKIE_SECRET=${COOKIE_SECRET}
      - BACKEND_URL=https://dev.login.hotosm.org
      - FRONTEND_URL=https://dev.login.hotosm.org
      - OSM_CLIENT_ID=${OSM_CLIENT_ID}
      - OSM_CLIENT_SECRET=${OSM_CLIENT_SECRET}
      - OSM_REDIRECT_URI=${OSM_REDIRECT_URI}
      - OSM_URL=${OSM_URL:-https://www.openstreetmap.org}
      - OSM_SCOPE=${OSM_SCOPE:-read_prefs}
      - LOG_LEVEL=INFO
      - LOGIN_INTERNAL_API_KEY=${LOGIN_INTERNAL_API_KEY}
      - ADMIN_EMAILS=hernangigena@gmail.com,justina@animus.com.ar,andreatchirillano@hotmail.com,emilio.mariscal@hotosm.org,dakota.benjamin@hotosm.org,sam.woodcock@hotosm.org
      # App URLs for admin proxy (public URLs, not internal Docker)
      - DRONETM_BACKEND_URL=https://dev.drone.hotosm.org
      - FAIR_BACKEND_URL=https://fair-dev.hotosm.org
      - PORTAL_BACKEND_URL=https://portal.hotosm.org
      - OAM_BACKEND_URL=https://openaerialmap.org
      - UMAP_BACKEND_URL=https://umap-dev.hotosm.org
      - EXPORT_TOOL_BACKEND_URL=https://export.testlogin.hotosm.org
      - FIELDTM_BACKEND_URL=https://fieldtm.testlogin.hotosm.org
    networks:
      - hotosm
    labels:
      - "traefik.enable=true"
      # Route /me endpoint to login-backend (matches local dev config)
      - "traefik.http.routers.login-backend-me.rule=Host(`dev.login.hotosm.org`) && Path(`/me`)"
      - "traefik.http.routers.login-backend-me.entrypoints=https"
      - "traefik.http.routers.login-backend-me.tls=true"
      - "traefik.http.routers.login-backend-me.tls.certresolver=letsencrypt"
      - "traefik.http.routers.login-backend-me.priority=20"
      - "traefik.http.routers.login-backend-me.service=login-backend"
      # Route /api endpoints to login-backend
      - "traefik.http.routers.login-backend.rule=Host(`dev.login.hotosm.org`) && PathPrefix(`/api`)"
      - "traefik.http.routers.login-backend.entrypoints=https"
      - "traefik.http.routers.login-backend.tls=true"
      - "traefik.http.routers.login-backend.tls.certresolver=letsencrypt"
      - "traefik.http.routers.login-backend.priority=15"
      - "traefik.http.services.login-backend.loadbalancer.server.port=8000"
    depends_on:
      - hanko
    restart: unless-stopped

  # ==========================================
  # Frontend - React + Vite Application
  # ==========================================

  frontend:
    image: ghcr.io/hotosm/login-frontend:latest
    container_name: login-frontend
    networks:
      - hotosm
    labels:
      - "traefik.enable=true"
      # Redirect root / to /app
      - "traefik.http.routers.login-root.rule=Host(`dev.login.hotosm.org`) && Path(`/`)"
      - "traefik.http.routers.login-root.entrypoints=https"
      - "traefik.http.routers.login-root.tls=true"
      - "traefik.http.routers.login-root.tls.certresolver=letsencrypt"
      - "traefik.http.routers.login-root.priority=1"
      - "traefik.http.routers.login-root.middlewares=login-root-redirect"
      - "traefik.http.middlewares.login-root-redirect.redirectregex.regex=^https://([^/]+)/?$$"
      - "traefik.http.middlewares.login-root-redirect.redirectregex.replacement=https://$${1}/app"
      - "traefik.http.routers.login-root.service=login-frontend"
      # Frontend serves /app and /login paths (GET /login goes to frontend, POST /login has higher priority to Hanko)
      - "traefik.http.routers.login-frontend.rule=Host(`dev.login.hotosm.org`) && (PathPrefix(`/app`) || Path(`/login`))"
      - "traefik.http.routers.login-frontend.entrypoints=https"
      - "traefik.http.routers.login-frontend.tls=true"
      - "traefik.http.routers.login-frontend.tls.certresolver=letsencrypt"
      - "traefik.http.routers.login-frontend.priority=2"
      - "traefik.http.routers.login-frontend.middlewares=login-frontend-stripprefix"
      - "traefik.http.middlewares.login-frontend-stripprefix.stripprefix.prefixes=/app,/login"
      - "traefik.http.services.login-frontend.loadbalancer.server.port=80"
    depends_on:
      - backend
    restart: unless-stopped