# This compose file is for demonstration only, do not use in prod.
services:
  app:
    depends_on:
      postgres:
        condition: service_healthy
    image: svhd/logto:${TAG-latest}
    entrypoint: ["sh", "-c", "npm run cli db seed -- --swe && npm start"]
    ports:
      - 3001:3001
      - 3002:3002
    environment:
      - TRUST_PROXY_HEADER=1
      - DB_URL=postgres://postgres:p0stgr3s@postgres:5432/logto
      # Optional default grace period, in seconds, for OIDC private key rotation when the API
      # request omits `rotationGracePeriod`.
      - PRIVATE_KEY_ROTATION_GRACE_PERIOD
      # SSRF protection for outbound requests is enabled by default. To reach a trusted webhook,
      # SSO, or OIDC relying-party endpoint on a private network, list its address or CIDR range in
      # `SSRF_ALLOWED_ADDRESSES` (for example `10.0.0.0/8`). Setting `SSRF_PROTECTION_DISABLED=true`
      # turns the protection off entirely and also disables features that require it, such as CIMD.
      # `OIDC_PROVIDER_SSRF_PROTECTION_DISABLED` is supported as a legacy alias.
      - SSRF_ALLOWED_ADDRESSES
      - SSRF_PROTECTION_DISABLED
      - OIDC_PROVIDER_SSRF_PROTECTION_DISABLED
      # Mandatory for GitPod to map host env to the container, thus GitPod can dynamically configure the public URL of Logto;
      # Or, you can leverage it for local testing.
      - ENDPOINT
      - ADMIN_ENDPOINT
  postgres:
    image: postgres:17-alpine
    user: postgres
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: p0stgr3s
    healthcheck:
      test: ["CMD-SHELL", "pg_isready"]
      interval: 5s
      timeout: 5s
      retries: 5