docker-compose.override.yml

services:
  node:
    image: node:20
    profiles:
      - dev
    networks:
      - app
    volumes:
      - .:/app:delegated
    working_dir: /app

  phpfpm:
    environment:
      - PHP_MAX_EXECUTION_TIME=300
      - PHP_MEMORY_LIMIT=512M

  nginx:
    environment:
      # Match PHP_MAX_EXECUTION_TIME above
      - NGINX_FASTCGI_READ_TIMEOUT=300

  idp-citizen:
    image: ghcr.io/soluto/oidc-server-mock:0.8.6
    profiles:
      - oidc
      - test
    # Let this container be accessible both internally and externally on the same domain.
    container_name: idp-citizen.${COMPOSE_DOMAIN}
    networks:
      - app
      - frontend
    ports:
      # https://github.com/Soluto/oidc-server-mock?tab=readme-ov-file#https
      # - '80'
      - '443'
    volumes:
      - .:/tmp/config:ro
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=frontend"
      - "traefik.http.routers.${COMPOSE_PROJECT_NAME}_idp-citizen.rule=Host(`idp-citizen.${COMPOSE_DOMAIN}`)"
      - "traefik.http.services.${COMPOSE_PROJECT_NAME}_idp-citizen.loadbalancer.server.port=443"
      - "traefik.http.services.${COMPOSE_PROJECT_NAME}_idp-citizen.loadbalancer.server.scheme=https"
      - "traefik.http.routers.${COMPOSE_PROJECT_NAME}_idp-citizen.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

    environment:
      # https://github.com/Soluto/oidc-server-mock?tab=readme-ov-file#https
      ASPNETCORE_URLS: https://+:443;http://+:80
      ASPNETCORE_Kestrel__Certificates__Default__Password: mock
      ASPNETCORE_Kestrel__Certificates__Default__Path: /tmp/config/.docker/oidc-server-mock/cert/docker.pfx

      ASPNETCORE_ENVIRONMENT: Development
      SERVER_OPTIONS_INLINE: |
        AccessTokenJwtType: JWT
        Discovery:
          ShowKeySet: true
        Authentication:
          CookieSameSiteMode: Lax
          CheckSessionCookieSameSiteMode: Lax

      LOGIN_OPTIONS_INLINE: |
        {
          "AllowRememberLogin": false
        }

      LOGOUT_OPTIONS_INLINE: |
        {
          "AutomaticRedirectAfterSignOut": true
        }

      CLIENTS_CONFIGURATION_INLINE: |
        - ClientId: client-id
          ClientSecrets: [client-secret]
          Description: Mock IdP
          AllowedGrantTypes:
            # - client_credentials
            # - implicit
            - authorization_code
          # https://github.com/Soluto/oidc-server-mock/issues/46#issuecomment-704963181
          RequireClientSecret: false
          AllowAccessTokensViaBrowser: true
          # https://github.com/Soluto/oidc-server-mock/issues/26#issuecomment-705022941
          AlwaysIncludeUserClaimsInIdToken: true
          AllowedScopes:
            - openid
            - profile
            - email
          ClientClaimsPrefix: ''
          RedirectUris:
            - '*'
          # https://github.com/Soluto/oidc-server-mock/issues/60
          PostLogoutRedirectUris:
            - '*'
          # https://github.com/Soluto/oidc-server-mock/issues/46#issuecomment-704845375
          RequirePkce: false

      # Needed to set custom claim types in "profile"
      # https://github.com/Soluto/oidc-server-mock/issues/123#issuecomment-1427129278
      # https://github.com/Soluto/oidc-server-mock/blob/master/README.md#simple-configuration
      # https://docs.docker.com/compose/compose-file/compose-file-v3/#environment
      OVERRIDE_STANDARD_IDENTITY_RESOURCES: 'true'
      IDENTITY_RESOURCES_INLINE: |
        # https://auth0.com/docs/get-started/apis/scopes/openid-connect-scopes#standard-claims
        - Name: openid
          ClaimTypes:
            - sub
        - Name: email
          ClaimTypes:
            - email
        - Name: profile
          ClaimTypes:
            # Add your custom claims here
            - dk_ssn
            - name
            - email
            - zip
            - uuid

      USERS_CONFIGURATION_INLINE: |
        - SubjectId: 1
          Username: citizen1
          Password: citizen1
          Claims:
            # Claims added here must be defined above in IDENTITY_RESOURCES_INLINE
          - Type: dk_ssn
            Value: '1111111111'
            ValueType: string
          - Type: name
            Value: 'Anders And'
            ValueType: string
          - Type: email
            Value: admin@example.com
            ValueType: string
          - Type: zip
            Value: '1111'
            ValueType: string
          - Type: uuid
            Value: '11111111-1111-1111-1111-111111111111'
            ValueType: string