Deploy OIDC only

Deploy: OIDC only

Single sign-on is the only way in. /auth/register and /auth/login don't exist (real 404s, not a hidden form), and the local-login form never renders client-side — for every account, including any that already had a password set before the cutover. This is a global switch, not a per-account one.

Good fit once you've confirmed OIDC login actually works end to end and want to stop maintaining a second auth path.

What you need

• SESSION_SECRET — openssl rand -base64 48
• A Postgres password
• OIDC client credentials from your provider (issuer URL, client ID, client secret, redirect URI) — see the Pocket ID section in the main README if that's your provider

docker-compose.yml

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: voting_game
      POSTGRES_PASSWORD: a-real-password-here
      POSTGRES_DB: voting_game
    volumes:
      - db-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U voting_game"]
      interval: 5s
      timeout: 5s
      retries: 10

  app:
    image: ghcr.io/scotcw/vgde:latest
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      NODE_ENV: production
      PORT: 3000
      HOST: 0.0.0.0
      DATABASE_URL: postgresql://voting_game:a-real-password-here@db:5432/voting_game
      SESSION_SECRET: a-real-64-char-secret-from-openssl-rand--base64-48
      COOKIE_SECURE: "true"
      ALLOWED_ORIGINS: https://voting.example.com
      OIDC_ISSUER_URL: https://id.example.com
      OIDC_CLIENT_ID: your-client-id
      OIDC_CLIENT_SECRET: your-client-secret
      OIDC_REDIRECT_URI: https://voting.example.com/auth/oidc/callback
      AUTH_MODE: oidc_only
    ports:
      - "127.0.0.1:3000:3000"

volumes:
  db-data:

Notes

• The server refuses to start with AUTH_MODE: oidc_only unless all four OIDC_* variables are set — it can't lock everyone out by mistake. If you see the container exit immediately, check those four first.
• Recommended rollout: deploy first with AUTH_MODE: password_and_oidc, confirm a real OIDC login round-trips correctly, then flip to oidc_only and redeploy. Going straight to oidc_only on a first deploy works too, but gives you no fallback if the OIDC setup itself has a mistake in it.
• A first-time OIDC login still auto-provisions an account the same way it does in the combined mode — there's just no password path left once it exists.
• POSTGRES_PASSWORD and the password inside DATABASE_URL are two separate literals here — keep them in sync by hand, or use .env + the repo's own docker-compose.yml instead of hardcoding (see the README for that tradeoff).
• Once this is up and running, see Updating a Deployment for how to pull in new changes later.