Deploy Password only

Deploy: password only

The simplest deployment — email/password accounts, no external identity provider involved at all. This is what you get by default if you just never fill in the OIDC_* variables.

Good fit if you don't have (or don't want to depend on) an OIDC provider, or you're just trying the app out before deciding on anything else.

What you need

• SESSION_SECRET — openssl rand -base64 48
• A Postgres password

That's it — no OIDC provider, no client registration.

docker-compose.yml

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: voting_game
      POSTGRES_PASSWORD: a-real-password-here
      POSTGRES_DB: voting_game
    volumes:
      - db-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U voting_game"]
      interval: 5s
      timeout: 5s
      retries: 10

  app:
    image: ghcr.io/scotcw/vgde:latest
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      NODE_ENV: production
      PORT: 3000
      HOST: 0.0.0.0
      DATABASE_URL: postgresql://voting_game:a-real-password-here@db:5432/voting_game
      SESSION_SECRET: a-real-64-char-secret-from-openssl-rand--base64-48
      COOKIE_SECURE: "true"
      ALLOWED_ORIGINS: https://voting.example.com
    ports:
      - "127.0.0.1:3000:3000"

volumes:
  db-data:

Notes

• No OIDC_* or AUTH_MODE lines at all — the app checks whether all four OIDC_* variables are set to decide if OIDC is available (oidcEnabled() in env.ts); with them absent, /auth/oidc/* never registers and GET /auth/config reports oidcEnabled: false, so the frontend never shows the SSO button. This is equivalent to setting them to "" — see the README if you'd rather do that for explicitness.
• AUTH_MODE defaults to password_and_oidc; setting it to oidc_only with no OIDC configured is refused at startup on purpose (see the OIDC-only guide) — don't add that line here.
• POSTGRES_PASSWORD and the password inside DATABASE_URL are two separate literals here — keep them in sync by hand, or use .env + the repo's own docker-compose.yml instead of hardcoding (see the README for that tradeoff).
• Nothing stops you from adding OIDC later — fill in the four variables and redeploy, and you're in password + OIDC territory instead.
• Once this is up and running, see Updating a Deployment for how to pull in new changes later.