feat: refractor CIE auth stack configuration for improved environment variable management and docker compatibility

README.md

@@ -1,60 +1,58 @@
-# Visione Local CIE Stack
+# Visione CIE Auth Stack
 
-This folder is a ready-to-run local stack for CIE auth integration with Visione.
-
-Included services:
+This folder contains deployable CIE auth services for Visione:
 - `federation-authority`
 - `provider`
 - `relying-party`
 
-They run through one compose file and use the modified relying party bridge for Visione.
+It is now structured to work with Docker Compose and Dokploy without host networking.
 
-## Prerequisites
-- Visione backend running on `http://127.0.0.1:5555`
-- Docker with Compose
+## Configuration
+Copy [.env.example](/workspace/cie-auth/.env.example) to `.env` and set only what changes in real deploy:
+- public domains / internal URLs
+- Django secret keys
+- shared secret between relying party and Visione backend
 
-## Visione config
-Set in `config.json`:
+Main variables:
+- `CIE_AUTH_ALLOWED_HOSTS`
+- `DJANGO_TRUST_ANCHOR`
+- `DJANGO_PROVIDER_ISSUER`
+- `DJANGO_RP_BACKEND_EXCHANGE_URL`
+- `DJANGO_RP_SHARED_SECRET`
+- `FEDERATION_AUTHORITY_SECRET_KEY`
+- `PROVIDER_SECRET_KEY`
+- `RELYING_PARTY_SECRET_KEY`
 
-```json
-"cie_auth": {
-  "service_base_url": "http://127.0.0.1:8001",
-  "start_path": "/visione/start",
-  "shared_secret": "change-me-for-local-dev",
-  "state_ttl_minutes": 10,
-  "default_frontend_redirect_uri": "http://localhost:3000/auth/cie/callback"
-}
-```
+## Deploy with Dokploy
+Use [docker-compose.yml](/workspace/cie-auth/docker-compose.yml) as compose source.
+Expose:
+- `federation-authority` on port `8000`
+- `provider` on port `8002`
+- `relying-party` on port `8001`
 
-Keep same secret also in:
-- `relying_party/relying_party/settingslocal.py`
-  `VISIONE_SHARED_SECRET`
+Each service persists its own SQLite DB in a named volume.
 
-## Start stack
-From repo root:
+## Local start
 
 ```bash
-docker compose up -d
-docker compose -f infra/cie-auth/docker-compose.yml up --build -d
+docker compose up --build -d
 ```
 
-This starts:
-- MySQL + Mailpit from root compose
-- authority on `127.0.0.1:8000`
-- provider on `127.0.0.1:8002`
-- relying party on `127.0.0.1:8001`
+## Visione backend
+Visione backend must expose exchange endpoint configured in `DJANGO_RP_BACKEND_EXCHANGE_URL`.
+Shared secret must match backend `cie_auth.shared_secret`.
 
-## Start Visione
-From repo root:
+## Bootstrap behavior
+On first boot, each Django service:
+1. runs migrations
+2. loads `dumps/example.json` only if DB is empty
 
-```bash
-cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug
-cmake --build build
-./build/visione-backend
-```
+Disable fixture import per service with:
+- `FEDERATION_AUTHORITY_LOAD_FIXTURE_ON_EMPTY_DB=false`
+- `PROVIDER_LOAD_FIXTURE_ON_EMPTY_DB=false`
+- `RELYING_PARTY_LOAD_FIXTURE_ON_EMPTY_DB=false`
 
 ## Smoke test
-Start login:
 
 ```bash
 curl -sS -X POST http://127.0.0.1:5555/api/v1/auth/cie/start \
@@ -62,45 +60,19 @@ curl -sS -X POST http://127.0.0.1:5555/api/v1/auth/cie/start \
   -d '{"frontend_redirect_uri":"http://localhost:3000/auth/cie/callback"}'
 ```
 
-Expected JSON:
-- `authorization_url`
-- `state`
-
-Then:
-1. open `authorization_url` in browser
-2. complete demo CIE login
-3. browser lands on `http://localhost:3000/auth/cie/callback?state=...`
-
-Poll result:
+Then complete login and poll:
 
 ```bash
 curl -sS http://127.0.0.1:5555/api/v1/auth/cie/session/<state>
 ```
 
-Expected success:
-- `status = "authenticated"`
-- `auth.token` present
-
-## Frontend flow
-1. call `POST /api/v1/auth/cie/start`
-2. redirect browser to `authorization_url`
-3. callback page reads `state`
-4. poll `GET /api/v1/auth/cie/session/{state}`
-5. when authenticated, save `auth.token`
-6. call `GET /api/v1/me`
-
-## Reset local auth DBs
-If you want a clean auth stack:
+## Reset data
 
 ```bash
-rm -f infra/cie-auth/federation_authority/db.sqlite3
-rm -f infra/cie-auth/provider/db.sqlite3
-rm -f infra/cie-auth/relying_party/db.sqlite3
-docker compose -f infra/cie-auth/docker-compose.yml down
-docker compose -f infra/cie-auth/docker-compose.yml up --build -d
+docker compose down -v
 ```
 
 ## Logs
 ```bash
-docker compose -f infra/cie-auth/docker-compose.yml logs -f
+docker compose logs -f
 ```