# Docker Runbook

This repo ships a local full-stack Compose setup for athena-auth plus PostgreSQL.

## Start

```bash
docker compose up --build
```

Run detached:

```bash
docker compose up -d --build
```

The default stack exposes:

- athena-auth: `http://localhost:3000`
- auth health: `http://localhost:3000/api/auth/health`
- auth OpenAPI: `http://localhost:3000/api/auth/reference/openapi.json`
- metrics: `http://localhost:3000/metrics`
- PostgreSQL: `localhost:5432`

## Stop

```bash
docker compose down
```

Remove the database volume too:

```bash
docker compose down -v
```

## Logs

Tail all services:

```bash
docker compose logs -f
```

Tail just the auth server:

```bash
docker compose logs -f athena-auth
```

## Overrides

The Compose file runs without extra configuration, but these namespaced override vars are supported:

- `ATHENA_AUTH_DOCKER_JWT_SECRET`
- `ATHENA_AUTH_DOCKER_POSTGRES_DB`
- `ATHENA_AUTH_DOCKER_POSTGRES_USER`
- `ATHENA_AUTH_DOCKER_POSTGRES_PASSWORD`
- `ATHENA_AUTH_DOCKER_POSTGRES_PORT`
- `ATHENA_AUTH_DOCKER_PORT`
- `ATHENA_AUTH_DOCKER_BASE_URL`
- `ATHENA_AUTH_DOCKER_AUTH_BASE_PATH`
- `ATHENA_AUTH_DOCKER_PUBLIC_AUTH_BASE_PATH`
- `ATHENA_AUTH_DOCKER_PRIMARY_TRUSTED_ORIGIN`
- `ATHENA_AUTH_DOCKER_PASSKEY_ORIGIN`
- `ATHENA_AUTH_DOCKER_PASSKEY_RP_ID`
- `ATHENA_AUTH_DOCKER_PASSKEY_RP_NAME`
- `ATHENA_AUTH_DOCKER_PASSKEY_ALLOW_INSECURE`
- `ATHENA_AUTH_DOCKER_RUST_LOG`
- `ATHENA_AUTH_DOCKER_DATABASE_KEY`
- `ATHENA_AUTH_DOCKER_IMAGE_VERSION`

If you change the published auth port, also update `ATHENA_AUTH_DOCKER_BASE_URL`, `ATHENA_AUTH_DOCKER_PRIMARY_TRUSTED_ORIGIN`, and `ATHENA_AUTH_DOCKER_PASSKEY_ORIGIN` so generated links and cookie/passkey settings stay aligned.

## Runtime Notes

- The container image uses `[ops/docker/config.yaml](../ops/docker/config.yaml)` as its default runtime config.
- The image does not copy the repo's local `config.yaml`.
- The server self-heals the auth schema at startup from the embedded `sql/provision.sql`, so the Compose stack does not mount `schema.sql` into Postgres.
- The local Docker config sets `cookie_secure: false` so browser sessions work over plain `http://localhost`.

## Verification

Quick health check:

```bash
curl http://localhost:3000/api/auth/health
```

Quick OpenAPI check:

```bash
curl http://localhost:3000/api/auth/reference/openapi.json
```

## Troubleshooting

- If `docker compose up` fails before the app starts, run `docker compose logs postgres` and confirm the database healthcheck passes.
- If the auth server exits immediately, check `docker compose logs athena-auth` for config parsing or database connection errors.
- If browser login works in API clients but not the browser, confirm you are using `http://localhost:3000` and did not override the config to force secure cookies on HTTP.
- If Docker is not running locally, start Docker Desktop first; `docker compose config` can still validate the Compose file shape without the daemon, but `up` and `build` require the daemon.
