Deploy Password and OIDC

Deploy: password + OIDC

Both login paths active at once — anyone can register with an email/password, and "continue with single sign-on" also works against your OIDC provider. This is the default (AUTH_MODE=password_and_oidc) with the OIDC variables actually filled in, as opposed to left empty.

Good fit if you're onboarding people gradually onto SSO, or want SSO for most of the group but a password fallback for anyone who isn't in your identity provider.

What you need

• SESSION_SECRET — openssl rand -base64 48
• A Postgres password
• OIDC client credentials from your provider (issuer URL, client ID, client secret, and the exact redirect URI you registered with it) — see the Pocket ID section in the main README if that's your provider

docker-compose.yml

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: voting_game
      POSTGRES_PASSWORD: a-real-password-here
      POSTGRES_DB: voting_game
    volumes:
      - db-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U voting_game"]
      interval: 5s
      timeout: 5s
      retries: 10

  app:
    image: ghcr.io/scotcw/vgde:latest
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      NODE_ENV: production
      PORT: 3000
      HOST: 0.0.0.0
      DATABASE_URL: postgresql://voting_game:a-real-password-here@db:5432/voting_game
      SESSION_SECRET: a-real-64-char-secret-from-openssl-rand--base64-48
      COOKIE_SECURE: "true"
      ALLOWED_ORIGINS: https://voting.example.com
      OIDC_ISSUER_URL: https://id.example.com
      OIDC_CLIENT_ID: your-client-id
      OIDC_CLIENT_SECRET: your-client-secret
      OIDC_REDIRECT_URI: https://voting.example.com/auth/oidc/callback
      AUTH_MODE: password_and_oidc
    ports:
      - "127.0.0.1:3000:3000"

volumes:
  db-data:

Notes

• AUTH_MODE: password_and_oidc is the default — it's spelled out here for clarity, but omitting it does the same thing.
• All four OIDC_* variables need real values, or the app treats OIDC as unconfigured and only the password form shows up (that's the password-only guide, not this one).
• A first-time OIDC login auto-provisions an account. If someone already registered with a password using the same verified email, the OIDC login links to that existing account instead of creating a second one — make sure "email verified" is on in your provider (see the Pocket ID section) or that linking silently won't happen.
• POSTGRES_PASSWORD and the password inside DATABASE_URL are two separate literals here — keep them in sync by hand, or use .env + the repo's own docker-compose.yml instead of hardcoding (see the README for that tradeoff).
• Once this is up and running, see Updating a Deployment for how to pull in new changes later.