feat: i18n 개선 및 userfront 로그인/로케일 보완

docker/compose.ory.yaml

@@ -1,135 +1,136 @@
 services:
-  postgres_ory:
-    image: postgres:${ORY_POSTGRES_TAG:-17-alpine}
-    container_name: ory_postgres
-    environment:
-      - POSTGRES_USER=${ORY_POSTGRES_USER:-ory}
-      - POSTGRES_PASSWORD=${ORY_POSTGRES_PASSWORD:-secret}
-      - POSTGRES_DB=${ORY_POSTGRES_DB:-ory}
-    volumes:
-      - ./docker/ory/init-db:/docker-entrypoint-initdb.d
-      - ory_postgres_data:/var/lib/postgresql/data
-    networks:
-      - ory-net
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "pg_isready -U ${ORY_POSTGRES_USER:-ory} -d ${KRATOS_DB:-ory_kratos}",
-        ]
-      interval: 5s
-      timeout: 5s
-      retries: 5
+    postgres_ory:
+        image: postgres:${ORY_POSTGRES_TAG:-17-alpine}
+        container_name: ory_postgres
+        environment:
+            - POSTGRES_USER=${ORY_POSTGRES_USER:-ory}
+            - POSTGRES_PASSWORD=${ORY_POSTGRES_PASSWORD:-secret}
+            - POSTGRES_DB=${ORY_POSTGRES_DB:-ory}
+        volumes:
+            - ./docker/ory/init-db:/docker-entrypoint-initdb.d
+            - ory_postgres_data:/var/lib/postgresql/data
+        networks:
+            - ory-net
+        healthcheck:
+            test:
+                [
+                    "CMD-SHELL",
+                    "pg_isready -U ${ORY_POSTGRES_USER:-ory} -d ${KRATOS_DB:-ory_kratos}",
+                ]
+            interval: 5s
+            timeout: 5s
+            retries: 5
 
-  kratos-migrate:
-    image: oryd/kratos:${KRATOS_VERSION:-v25.4.0}
-    environment:
-      - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
-      - KRATOS_SERVE_PUBLIC_BASE_URL="${KRATOS_BROWSER_URL:-http://localhost:4433}"
-      - KRATOS_SERVE_ADMIN_BASE_URL="${KRATOS_ADMIN_URL:-http://kratos:4434}"
-      - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL="${KRATOS_UI_URL:-http://localhost:5000}"
-      - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS='["${KRATOS_UI_URL:-http://localhost:5000}","${USERFRONT_URL:-http://localhost:5000}"]'
-    volumes:
-      - ./docker/ory/kratos:/etc/config/kratos
-    command: migrate sql up -e -c /etc/config/kratos/kratos.yml --yes
-    depends_on:
-      postgres_ory:
-        condition: service_healthy
-    networks:
-      - ory-net
+    kratos-migrate:
+        image: oryd/kratos:${KRATOS_VERSION:-v25.4.0}
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
+            - KRATOS_SERVE_PUBLIC_BASE_URL="${KRATOS_BROWSER_URL:-http://localhost:4433}"
+            - KRATOS_SERVE_ADMIN_BASE_URL="${KRATOS_ADMIN_URL:-http://kratos:4434}"
+            - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL="${KRATOS_UI_URL:-http://localhost:5000}"
+            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS='["${KRATOS_UI_URL:-http://localhost:5000}","${USERFRONT_URL:-http://localhost:5000}"]'
+        volumes:
+            - ./docker/ory/kratos:/etc/config/kratos
+        command: migrate sql up -e -c /etc/config/kratos/kratos.yml --yes
+        depends_on:
+            postgres_ory:
+                condition: service_healthy
+        networks:
+            - ory-net
 
-  kratos:
-    image: oryd/kratos:${KRATOS_VERSION:-v25.4.0}
-    container_name: ory_kratos
-    environment:
-      - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
-      - COOKIE_SECRET="${COOKIE_SECRET:-localcookie123}"
-      - KRATOS_SERVE_PUBLIC_BASE_URL="${KRATOS_BROWSER_URL:-http://localhost:4433}"
-      - KRATOS_SERVE_ADMIN_BASE_URL="${KRATOS_ADMIN_URL:-http://kratos:4434}"
-      - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL="${KRATOS_UI_URL:-http://localhost:5000}"
-      - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS='["${KRATOS_UI_URL:-http://localhost:5000}","${USERFRONT_URL:-http://localhost:5000}"]'
-    volumes:
-      - ./docker/ory/kratos:/etc/config/kratos
-    command: serve -c /etc/config/kratos/kratos.yml
-    depends_on:
-      kratos-migrate:
-        condition: service_completed_successfully
-    networks:
-      - ory-net
-      - kratosnet
+    kratos:
+        image: oryd/kratos:${KRATOS_VERSION:-v25.4.0}
+        container_name: ory_kratos
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
+            - COOKIE_SECRET="${COOKIE_SECRET:-localcookie123}"
+            - KRATOS_SERVE_PUBLIC_BASE_URL="${KRATOS_BROWSER_URL:-http://localhost:4433}"
+            - KRATOS_SERVE_ADMIN_BASE_URL="${KRATOS_ADMIN_URL:-http://kratos:4434}"
+            - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL="${KRATOS_UI_URL:-http://localhost:5000}"
+            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS='["${KRATOS_UI_URL:-http://localhost:5000}","${USERFRONT_URL:-http://localhost:5000}"]'
+        volumes:
+            - ./docker/ory/kratos:/etc/config/kratos
+        command: serve -c /etc/config/kratos/kratos.yml
+        depends_on:
+            kratos-migrate:
+                condition: service_completed_successfully
+        networks:
+            - ory-net
+            - kratosnet
 
-  hydra-migrate:
-    image: oryd/hydra:${HYDRA_VERSION:-v25.4.0}
-    environment:
-      - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
-    command: migrate sql up -e --yes
-    depends_on:
-      postgres_ory:
-        condition: service_healthy
-    networks:
-      - ory-net
+    hydra-migrate:
+        image: oryd/hydra:${HYDRA_VERSION:-v25.4.0}
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
+        command: migrate sql up -e --yes
+        depends_on:
+            postgres_ory:
+                condition: service_healthy
+        networks:
+            - ory-net
 
-  hydra:
-    image: oryd/hydra:${HYDRA_VERSION:-v25.4.0}
-    container_name: ory_hydra
-    environment:
-      - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
-      - URLS_SELF_ISSUER=${USERFRONT_URL:-http://localhost:5000}/oidc
-      - URLS_LOGIN=${USERFRONT_URL:-http://localhost:5000}/login
-      - URLS_CONSENT=${USERFRONT_URL:-http://localhost:5000}/consent
-      - SECRETS_SYSTEM=${ORY_POSTGRES_PASSWORD}
-    volumes:
-      - ./docker/ory/hydra:/etc/config/hydra
-    command: serve -c /etc/config/hydra/hydra.yml all --dev
-    depends_on:
-      hydra-migrate:
-        condition: service_completed_successfully
-    networks:
-      - ory-net
-      - hydranet
+    hydra:
+        image: oryd/hydra:${HYDRA_VERSION:-v25.4.0}
+        container_name: ory_hydra
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
+            - URLS_SELF_ISSUER=${USERFRONT_URL:-http://localhost:5000}/oidc
+            - URLS_LOGIN=${USERFRONT_URL:-http://localhost:5000}/login
+            - URLS_CONSENT=${USERFRONT_URL:-http://localhost:5000}/consent
+            - SECRETS_SYSTEM=${ORY_POSTGRES_PASSWORD}
+        volumes:
+            - ./docker/ory/hydra:/etc/config/hydra
+        command: serve -c /etc/config/hydra/hydra.yml all --dev
+        depends_on:
+            hydra-migrate:
+                condition: service_completed_successfully
+        networks:
+            - ory-net
+            - hydranet
 
-  # [수정됨] Oathkeeper 서비스 추가 (Backend 연결 문제 해결)
-  oathkeeper:
-    image: oryd/oathkeeper:${OATHKEEPER_VERSION:-v0.40.6}
-    container_name: oathkeeper
-    restart: unless-stopped
-    depends_on:
-      kratos:
-        condition: service_started
-    environment:
-      - LOG_LEVEL=debug
-    command: serve proxy --config /etc/config/oathkeeper/oathkeeper.yml
-    volumes:
-      - ./docker/ory/oathkeeper:/etc/config/oathkeeper
-    networks:
-      - ory-net
-      - baron_net  # Backend가 통신하기 위해 필수
-      - public_net
-    ports:
-      - "4455:4455" # Proxy
-      - "4456:4456" # API (Backend 헬스체크용)
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:4456/health/ready"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
+    # [수정됨] Oathkeeper 서비스 추가 (Backend 연결 문제 해결)
+    oathkeeper:
+        image: oryd/oathkeeper:${OATHKEEPER_VERSION:-v0.40.6}
+        container_name: oathkeeper
+        restart: unless-stopped
+        depends_on:
+            kratos:
+                condition: service_started
+        environment:
+            - LOG_LEVEL=debug
+        command: serve proxy --config /etc/config/oathkeeper/oathkeeper.yml
+        volumes:
+            - ./docker/ory/oathkeeper:/etc/config/oathkeeper
+            - oathkeeper_logs:/var/log/oathkeeper
+        networks:
+            - ory-net
+            - baron_net # Backend가 통신하기 위해 필수
+            - public_net
+        ports:
+            - "4455:4455" # Proxy
+            - "4456:4456" # API (Backend 헬스체크용)
+        healthcheck:
+            test: ["CMD", "wget", "-qO-", "http://127.0.0.1:4456/health/ready"]
+            interval: 5s
+            timeout: 5s
+            retries: 5
 volumes:
-  ory_postgres_data:
+    ory_postgres_data:
 
 networks:
-  ory-net:
-    external: true
-    name: ory-net
-  hydranet:
-    external: true
-    name: hydranet
-  kratosnet:
-    external: true
-    name: kratosnet
-  public_net:
-    external: true
-    name: public_net
-  # [수정됨] Baron Net 추가 정의 (Oathkeeper 연결용)
-  baron_net:
-    external: true
-    name: baron_net
+    ory-net:
+        external: true
+        name: ory-net
+    hydranet:
+        external: true
+        name: hydranet
+    kratosnet:
+        external: true
+        name: kratosnet
+    public_net:
+        external: true
+        name: public_net
+    # [수정됨] Baron Net 추가 정의 (Oathkeeper 연결용)
+    baron_net:
+        external: true
+        name: baron_net

docker/docker-compose.staging.template.yaml

@@ -64,7 +64,7 @@ services:
     env_file:
       - .env
     environment:
-      - BACKEND_URL=${BACKEND_URL}
+      - BACKEND_URL=${BACKEND_URL:-}
       - USERFRONT_URL=${USERFRONT_URL}
       - APP_ENV=stage
     networks:
@@ -75,7 +75,7 @@ services:
         condition: service_healthy
     command: >
       /bin/sh -c "mkdir -p /usr/share/nginx/html/assets &&
-                  echo \"BACKEND_URL=${BACKEND_URL}\" >> /usr/share/nginx/html/assets/.env &&
+                  echo \"BACKEND_URL=${BACKEND_URL:-}\" >> /usr/share/nginx/html/assets/.env &&
                   echo \"USERFRONT_URL=${USERFRONT_URL}\" >> /usr/share/nginx/html/assets/.env &&
                   echo \"APP_ENV=stage\" >> /usr/share/nginx/html/assets/.env &&
                   cp /usr/share/nginx/html/assets/.env /usr/share/nginx/html/.env &&

docker/ory/kratos/kratos.yml

@@ -1,4 +1,4 @@
-version: v1.3.0
+version: v25.4.0
 
 dsn: ${DSN}
 
@@ -7,19 +7,26 @@ serve:
         base_url: http://localhost:4433/
         cors:
             enabled: true
+            allowed_origins:
+                - http://backend:3000
+                - http://baron_backend:3000
     admin:
         base_url: http://localhost:4434/
 
 selfservice:
     default_browser_return_url: http://localhost:5000/
     allowed_return_urls:
+        - http://baron_backend:3000
+        - http://baron_backend:3000/
         - http://localhost:5000
+        - https://app.brsw.kr
+        - https://app.brsw.kr/
         - https://sss.hmac.kr
         - https://sss.hmac.kr/
         - https://sso.hmac.kr
         - https://sso.hmac.kr/
-        - https://app.hmac.kr
-        - https://app.hmac.kr/
+        - https://ssologin.hmac.kr
+        - https://ssologin.hmac.kr/
 
     methods:
         password:

docker/ory/oathkeeper/entrypoint.sh

@@ -37,7 +37,11 @@ mkdir -p "$LOG_DIR"
 if ! touch "$LOG_FILE" 2>/dev/null; then
   echo "[oathkeeper] log file not writable: $LOG_FILE"
   ls -ld "$LOG_DIR" || true
-  exit 1
+  LOG_FILE=""
 fi
 
-exec /bin/sh -c "oathkeeper serve proxy -c /etc/config/oathkeeper/oathkeeper.yml 2>&1 | tee \"$LOG_FILE\""
+if [ -n "$LOG_FILE" ]; then
+  exec /bin/sh -c "oathkeeper serve proxy -c /etc/config/oathkeeper/oathkeeper.yml 2>&1 | tee \"$LOG_FILE\""
+fi
+
+exec /bin/sh -c "oathkeeper serve proxy -c /etc/config/oathkeeper/oathkeeper.yml"

docker/staging_pull_compose.template.yaml

@@ -0,0 +1,400 @@
+services:
+  postgres:
+    image: postgres:17-alpine
+    container_name: baron_postgres
+    environment:
+      POSTGRES_USER: "${DB_USER:-baron}"
+      POSTGRES_PASSWORD: "${DB_PASSWORD:-password}"
+      POSTGRES_DB: "${DB_NAME:-baron_sso}"
+    ports:
+      - "${DB_PORT:-5432}:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+      - ./docker/init-metadata:/docker-entrypoint-initdb.d
+    networks:
+      - baron_net
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "pg_isready -U ${DB_USER:-baron} -d ${DB_NAME:-baron_sso}",
+        ]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: always
+
+  clickhouse:
+    image: clickhouse/clickhouse-server:latest
+    container_name: baron_clickhouse
+    restart: always
+    volumes:
+      - clickhouse_data:/var/lib/clickhouse
+    environment:
+      CLICKHOUSE_USER: "${CLICKHOUSE_USER:-baron}"
+      CLICKHOUSE_PASSWORD: "${CLICKHOUSE_PASSWORD:-password}"
+    networks:
+      - baron_net
+    healthcheck:
+      test: ["CMD", "clickhouse-client", "--query", "SELECT 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  redis:
+    image: redis:7-alpine
+    container_name: baron_redis
+    restart: always
+    command: redis-server --port 6389
+    ports:
+      - "6389:6389"
+    volumes:
+      - redis_data:/data
+    networks:
+      - baron_net
+    healthcheck:
+      test: ["CMD", "redis-cli", "-p", "6389", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  gateway:
+    image: nginx:alpine
+    container_name: baron_gateway
+    restart: always
+    ports:
+      - "${USERFRONT_PORT:-5000}:5000"
+    volumes:
+      - ./gateway/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    networks:
+      - baron_net
+      - public_net
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:5000/"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  postgres_ory:
+    image: postgres:${ORY_POSTGRES_TAG:-17-alpine}
+    container_name: ory_postgres
+    environment:
+      - POSTGRES_USER=${ORY_POSTGRES_USER:-ory}
+      - POSTGRES_PASSWORD=${ORY_POSTGRES_PASSWORD:-secret}
+      - POSTGRES_DB=${ORY_POSTGRES_DB:-ory}
+    volumes:
+      - ./docker/ory/init-db:/docker-entrypoint-initdb.d
+      - ory_postgres_data:/var/lib/postgresql/data
+    networks:
+      - ory-net
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "pg_isready -U ${ORY_POSTGRES_USER:-ory} -d ${KRATOS_DB:-ory_kratos}",
+        ]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  kratos-migrate:
+    image: oryd/kratos:${KRATOS_VERSION:-v25.4.0}
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
+      - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL:-http://localhost:4433}
+      - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL:-http://kratos:4434}
+      - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL:-http://localhost:5000}
+      - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=["${KRATOS_UI_URL:-http://localhost:5000}","${USERFRONT_URL:-http://localhost:5000}"]
+      - KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/error
+      - KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/error?error=settings_disabled
+      - KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/recovery
+      - KRATOS_SELFSERVICE_FLOWS_VERIFICATION_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/verification
+      - KRATOS_SELFSERVICE_FLOWS_LOGIN_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/login
+      - KRATOS_SELFSERVICE_FLOWS_REGISTRATION_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/registration
+      - KRATOS_SELFSERVICE_FLOWS_LOGOUT_AFTER_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL:-http://localhost:5000}/login
+    volumes:
+      - ./docker/ory/kratos:/etc/config/kratos
+    command: migrate sql up -e -c /etc/config/kratos/kratos.yml --yes
+    depends_on:
+      postgres_ory:
+        condition: service_healthy
+    networks:
+      - ory-net
+
+  kratos:
+    image: oryd/kratos:${KRATOS_VERSION:-v25.4.0}
+    container_name: ory_kratos
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
+      - COOKIE_SECRET=${COOKIE_SECRET:-localcookie123}
+      - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL:-http://localhost:4433}
+      - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL:-http://kratos:4434}
+      - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL:-http://localhost:5000}
+      - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=["${KRATOS_UI_URL:-http://localhost:5000}","${USERFRONT_URL:-http://localhost:5000}"]
+      - KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/error
+      - KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/error?error=settings_disabled
+      - KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/recovery
+      - KRATOS_SELFSERVICE_FLOWS_VERIFICATION_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/verification
+      - KRATOS_SELFSERVICE_FLOWS_LOGIN_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/login
+      - KRATOS_SELFSERVICE_FLOWS_REGISTRATION_UI_URL=${KRATOS_UI_URL:-http://localhost:5000}/registration
+      - KRATOS_SELFSERVICE_FLOWS_LOGOUT_AFTER_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL:-http://localhost:5000}/login
+    volumes:
+      - ./docker/ory/kratos:/etc/config/kratos
+    command: serve -c /etc/config/kratos/kratos.yml --dev --watch-courier
+    depends_on:
+      kratos-migrate:
+        condition: service_completed_successfully
+    networks:
+      - ory-net
+      - kratosnet
+
+  hydra-migrate:
+    image: oryd/hydra:${HYDRA_VERSION:-v25.4.0}
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
+    command: migrate sql up -e --yes
+    depends_on:
+      postgres_ory:
+        condition: service_healthy
+    networks:
+      - ory-net
+
+  hydra:
+    image: oryd/hydra:${HYDRA_VERSION:-v25.4.0}
+    container_name: ory_hydra
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
+      - URLS_SELF_ISSUER=${USERFRONT_URL:-http://localhost:5000}/oidc
+      - URLS_LOGIN=${USERFRONT_URL:-http://localhost:5000}/login
+      - URLS_CONSENT=${USERFRONT_URL:-http://localhost:5000}/consent
+      - SECRETS_SYSTEM=${ORY_POSTGRES_PASSWORD}
+    volumes:
+      - ./docker/ory/hydra:/etc/config/hydra
+    command: serve -c /etc/config/hydra/hydra.yml all --dev
+    depends_on:
+      hydra-migrate:
+        condition: service_completed_successfully
+    networks:
+      - ory-net
+      - hydranet
+
+  keto-migrate:
+    image: oryd/keto:${KETO_VERSION:-v25.4.0}
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
+    volumes:
+      - ./docker/ory/keto:/etc/config/keto
+    command: ["migrate", "up", "-c", "/etc/config/keto/keto.yml", "--yes"]
+    depends_on:
+      postgres_ory:
+        condition: service_healthy
+    networks:
+      - ory-net
+
+  keto:
+    image: oryd/keto:${KETO_VERSION:-v25.4.0}
+    container_name: ory_keto
+    environment:
+      - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
+    volumes:
+      - ./docker/ory/keto:/etc/config/keto
+    command: serve -c /etc/config/keto/keto.yml
+    depends_on:
+      keto-migrate:
+        condition: service_completed_successfully
+    networks:
+      - ory-net
+
+  oathkeeper:
+    image: oryd/oathkeeper:${OATHKEEPER_VERSION:-v0.40.6}
+    container_name: oathkeeper
+    restart: unless-stopped
+    depends_on:
+      kratos:
+        condition: service_started
+    environment:
+      - LOG_LEVEL=debug
+    command: serve proxy --config /etc/config/oathkeeper/oathkeeper.yml
+    volumes:
+      - ./docker/ory/oathkeeper:/etc/config/oathkeeper
+      - oathkeeper_logs:/var/log/oathkeeper
+    networks:
+      - ory-net
+      - baron_net
+      - public_net
+    ports:
+      - "4455:4455"
+      - "4456:4456"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:4456/health/ready"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  ory_clickhouse:
+    image: clickhouse/clickhouse-server:latest
+    container_name: ory_clickhouse
+    environment:
+      - CLICKHOUSE_USER=${ORY_CLICKHOUSE_USER:-ory}
+      - CLICKHOUSE_PASSWORD=${ORY_CLICKHOUSE_PASSWORD:-orypass}
+    volumes:
+      - ory_clickhouse_data:/var/lib/clickhouse
+      - ./docker/ory/clickhouse:/docker-entrypoint-initdb.d
+    networks:
+      - ory-net
+
+  backend:
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+    container_name: baron_backend
+    env_file:
+      - .env
+    environment:
+      - APP_ENV=${APP_ENV:-development}
+      - GO_ENV=${APP_ENV:-development}
+      - COOKIE_SECRET=${COOKIE_SECRET}
+      - JWT_SECRET=${JWT_SECRET}
+      - DESCOPE_PROJECT_ID=${DESCOPE_PROJECT_ID:-}
+      - DESCOPE_MANAGEMENT_KEY=${DESCOPE_MANAGEMENT_KEY:-}
+      - NAVER_CLOUD_ACCESS_KEY=${NAVER_CLOUD_ACCESS_KEY}
+      - NAVER_CLOUD_SECRET_KEY=${NAVER_CLOUD_SECRET_KEY}
+      - NAVER_CLOUD_SERVICE_ID=${NAVER_CLOUD_SERVICE_ID}
+      - NAVER_SENDER_PHONE_NUMBER=${NAVER_SENDER_PHONE_NUMBER}
+      - USERFRONT_URL=${USERFRONT_URL}
+      - REDIS_ADDR=${REDIS_ADDR}
+      - IDP_PROVIDER=${IDP_PROVIDER:-ory}
+      - KRATOS_ADMIN_URL=${KRATOS_ADMIN_URL:-http://kratos:4434}
+      - HYDRA_ADMIN_URL=${HYDRA_ADMIN_URL:-http://hydra:4445}
+      - HYDRA_PUBLIC_URL=${HYDRA_PUBLIC_URL:-http://hydra:4444}
+      - DB_HOST=postgres
+      - CLICKHOUSE_HOST=clickhouse
+      - CLICKHOUSE_PORT=${CLICKHOUSE_PORT_NATIVE:-9000}
+      - CLICKHOUSE_USER=${CLICKHOUSE_USER:-baron}
+      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD:-password}
+    depends_on:
+      clickhouse:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      oathkeeper:
+        condition: service_healthy
+      kratos:
+        condition: service_started
+      hydra:
+        condition: service_started
+      keto:
+        condition: service_started
+      infra_check:
+        condition: service_started
+    networks:
+      - baron_net
+      - ory-net
+    volumes:
+      - ./backend:/app
+    command: ["go", "run", "./cmd/server"]
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  adminfront:
+    build:
+      context: ./adminfront
+      dockerfile: Dockerfile
+    container_name: baron_adminfront
+    env_file:
+      - .env
+    environment:
+      - APP_ENV=${APP_ENV:-development}
+      - API_PROXY_TARGET=http://baron_backend:3000
+    ports:
+      - "${ADMIN_PORT:-5173}:5173"
+    volumes:
+      - ./adminfront:/app
+      - /app/node_modules
+    networks:
+      - baron_net
+
+  devfront:
+    build:
+      context: ./devfront
+      dockerfile: Dockerfile
+    container_name: baron_devfront
+    env_file:
+      - .env
+    environment:
+      - APP_ENV=${APP_ENV:-development}
+      - API_PROXY_TARGET=http://baron_backend:3000
+    ports:
+      - "${DEVFRONT_PORT:-5174}:5173"
+    volumes:
+      - ./devfront:/app
+      - /app/node_modules
+    networks:
+      - baron_net
+
+  userfront:
+    build:
+      context: .
+      dockerfile: userfront/Dockerfile
+    container_name: baron_userfront
+    env_file:
+      - .env
+    environment:
+      - BACKEND_URL=${BACKEND_URL:-}
+      - USERFRONT_URL=${USERFRONT_URL}
+      - APP_ENV=${APP_ENV}
+    networks:
+      - baron_net
+      - ory-net
+    depends_on:
+      backend:
+        condition: service_healthy
+    command: >
+      /bin/sh -c "mkdir -p /usr/share/nginx/html/assets &&
+                  echo \"BACKEND_URL=$${BACKEND_URL}\" >> /usr/share/nginx/html/assets/.env &&
+                  echo \"USERFRONT_URL=$${USERFRONT_URL}\" >> /usr/share/nginx/html/assets/.env &&
+                  echo \"APP_ENV=$${APP_ENV}\" >> /usr/share/nginx/html/assets/.env &&
+                  cp /usr/share/nginx/html/assets/.env /usr/share/nginx/html/.env &&
+                  nginx -g 'daemon off;'"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:5000/"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  infra_check:
+    image: alpine
+    command: ["echo", "Infrastructure assumed running"]
+    networks:
+      - baron_net
+
+volumes:
+  postgres_data:
+  clickhouse_data:
+  redis_data:
+  ory_postgres_data:
+  ory_clickhouse_data:
+  oathkeeper_logs:
+
+networks:
+  baron_net:
+    external: true
+    name: baron_net
+  public_net:
+    external: true
+    name: public_net
+  ory-net:
+    external: true
+    name: ory-net
+  hydranet:
+    external: true
+    name: hydranet
+  kratosnet:
+    external: true
+    name: kratosnet