samply/bridgehead
1
0
Fork 0
mirror of https://github.com/samply/bridgehead.git synced 2025-11-04 15:20:17 +01:00
Code Issues Packages Projects Releases Wiki Activity

Set SELinux labels for bind mounts, replace secrets with bind mounts

Browse Source
This commit is contained in:
tobiaskussel
2025-07-03 14:09:01 +00:00
parent 98e0512a61
commit 078c16e8dd
22 changed files with 62 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
bbmri/docker-compose.yml
View File

@@ -26,7 +26,3 @@ services:
volumes:
blaze-data:
# used in modules *-locator.yml
secrets:
proxy.pem:
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

6
bbmri/modules/eric-compose.yml
View File

@@ -26,11 +26,11 @@ services:
ALL_PROXY: http://forward_proxy:3128
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
ROOTCERT_FILE: /conf/root.crt.pem
secrets:
- proxy.pem
depends_on:
- "forward_proxy"
volumes:
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
- /srv/docker/bridgehead/bbmri/modules/${ERIC_ROOT_CERT}.root.crt.pem:/conf/root.crt.pem:ro
- /srv/docker/bridgehead/bbmri/modules/${ERIC_ROOT_CERT}.root.crt.pem:/conf/root.crt.pem:ro,Z
# secrets don't seem to allow us to specify Z
- /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro

6
bbmri/modules/exporter-compose.yml
View File

@@ -36,7 +36,7 @@ services:
- "traefik.http.middlewares.exporter_auth.basicauth.users=${EXPORTER_USER}"
volumes:
- "/var/cache/bridgehead/bbmri/exporter-files:/app/exporter-files/output"
- "/var/cache/bridgehead/bbmri/exporter-files:/app/exporter-files/output:z"
exporter-db:
image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
@@ -47,7 +47,7 @@ services:
POSTGRES_DB: "exporter"
volumes:
# Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer.
- "/var/cache/bridgehead/bbmri/exporter-db:/var/lib/postgresql/data"
- "/var/cache/bridgehead/bbmri/exporter-db:/var/lib/postgresql/data:Z"
reporter:
image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest
@@ -69,7 +69,7 @@ services:
# There is a risk that the bridgehead restarts, losing the already created export.
volumes:
- "/var/cache/bridgehead/bbmri/reporter-files:/app/reports"
- "/var/cache/bridgehead/bbmri/reporter-files:/app/reports:z"
labels:
- "traefik.enable=true"
- "traefik.http.routers.reporter_bbmri.rule=PathPrefix(`/bbmri-reporter`)"

6
bbmri/modules/gbn-compose.yml
View File

@@ -26,11 +26,11 @@ services:
ALL_PROXY: http://forward_proxy:3128
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
ROOTCERT_FILE: /conf/root.crt.pem
secrets:
- proxy.pem
depends_on:
- "forward_proxy"
volumes:
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
- /srv/docker/bridgehead/bbmri/modules/${GBN_ROOT_CERT}.root.crt.pem:/conf/root.crt.pem:ro
- /srv/docker/bridgehead/bbmri/modules/${GBN_ROOT_CERT}.root.crt.pem:/conf/root.crt.pem:ro,Z
# secrets don't seem to allow us to specify Z
- /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro

10
cce/docker-compose.yml
View File

@@ -35,7 +35,7 @@ services:
QUERIES_TO_CACHE: '/queries_to_cache.conf'
ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
volumes:
- /srv/docker/bridgehead/cce/queries_to_cache.conf:/queries_to_cache.conf:ro
- /srv/docker/bridgehead/cce/queries_to_cache.conf:/queries_to_cache.conf:ro,Z
depends_on:
- "beam-proxy"
- "blaze"
@@ -57,12 +57,10 @@ services:
- "forward_proxy"
volumes:
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
- /srv/docker/bridgehead/cce/root.crt.pem:/conf/root.crt.pem:ro
- /srv/docker/bridgehead/cce/root.crt.pem:/conf/root.crt.pem:ro,Z
# secrets don't seem to allow us to specify Z
- /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
volumes:
blaze-data:
secrets:
proxy.pem:
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

6
cce/modules/exporter-compose.yml
View File

@@ -37,7 +37,7 @@ services:
- "traefik.http.middlewares.exporter_auth.basicauth.users=${EXPORTER_USER}"
volumes:
- "/var/cache/bridgehead/cce/exporter-files:/app/exporter-files/output"
- "/var/cache/bridgehead/cce/exporter-files:/app/exporter-files/output:z"
exporter-db:
image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
@@ -48,7 +48,7 @@ services:
POSTGRES_DB: "exporter"
volumes:
# Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer.
- "/var/cache/bridgehead/cce/exporter-db:/var/lib/postgresql/data"
- "/var/cache/bridgehead/cce/exporter-db:/var/lib/postgresql/data:Z"
reporter:
image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest
@@ -70,7 +70,7 @@ services:
# There is a risk that the bridgehead restarts, losing the already created export.
volumes:
- "/var/cache/bridgehead/cce/reporter-files:/app/reports"
- "/var/cache/bridgehead/cce/reporter-files:/app/reports:z"
labels:
- "traefik.enable=true"
- "traefik.http.routers.reporter_cce.rule=PathPrefix(`/cce-reporter`)"

10
ccp/docker-compose.yml
View File

@@ -35,7 +35,7 @@ services:
QUERIES_TO_CACHE: '/queries_to_cache.conf'
ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
volumes:
- /srv/docker/bridgehead/ccp/queries_to_cache.conf:/queries_to_cache.conf:ro
- /srv/docker/bridgehead/ccp/queries_to_cache.conf:/queries_to_cache.conf:ro,Z
depends_on:
- "beam-proxy"
- "blaze"
@@ -57,11 +57,9 @@ services:
- "forward_proxy"
volumes:
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
- /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro
- /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro,Z
# secrets don't seem to allow us to specify Z
- /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
volumes:
blaze-data:
secrets:
proxy.pem:
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

22
ccp/modules/datashield-compose.yml
View File

@@ -35,10 +35,10 @@ services:
BEAM_SECRET: ${TOKEN_MANAGER_SECRET}
BEAM_DATASHIELD_PROXY: request-manager
volumes:
- "/var/cache/bridgehead/ccp/opal-metadata-db:/srv" # Opal metadata
secrets:
- opal-cert.pem
- opal-key.pem
- "/var/cache/bridgehead/ccp/opal-metadata-db:/srv:Z" # Opal metadata
# secrets don't seem to allow us to specify Z/z
- /tmp/bridgehead/opal-cert.pem:/run/secrets/opal-cert.pem:z
- /tmp/bridgehead/opal-key.pem:/run/secrets/opal-key.pem:Z
opal-db:
container_name: bridgehead-opal-db
@@ -48,7 +48,7 @@ services:
POSTGRES_USER: "opal"
POSTGRES_DB: "opal"
volumes:
- "/var/cache/bridgehead/ccp/opal-db:/var/lib/postgresql/data" # Opal project data (imported from exporter)
- "/var/cache/bridgehead/ccp/opal-db:/var/lib/postgresql/data:Z" # Opal project data (imported from exporter)
opal-rserver:
container_name: bridgehead-opal-rserver
@@ -67,20 +67,14 @@ services:
DISCOVERY_URL: "./map/central.json"
LOCAL_TARGETS_FILE: "./map/local.json"
NO_AUTH: "true"
secrets:
- opal-cert.pem
depends_on:
- beam-proxy
volumes:
- /tmp/bridgehead/opal-map/:/map/:ro
- /tmp/bridgehead/opal-map/:/map/:ro,Z
# secrets don't seem to allow us to specify Z/z
- /tmp/bridgehead/opal-cert.pem:/run/secrets/opal-cert.pem:z
beam-proxy:
environment:
APP_datashield-connect_KEY: ${DATASHIELD_CONNECT_SECRET}
APP_token-manager_KEY: ${TOKEN_MANAGER_SECRET}
secrets:
opal-cert.pem:
file: /tmp/bridgehead/opal-cert.pem
opal-key.pem:
file: /tmp/bridgehead/opal-key.pem

2
ccp/modules/dnpm-compose.yml
View File

@@ -25,7 +25,7 @@ services:
volumes:
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
- /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
- /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro
- /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro,Z
labels:
- "traefik.enable=true"
- "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)"

6
ccp/modules/dnpm-node-compose.yml
View File

@@ -12,13 +12,13 @@ services:
MYSQL_ROOT_HOST: "%"
MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD}
volumes:
- /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql
- /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql:Z
dnpm-authup:
image: authup/authup:latest
container_name: bridgehead-dnpm-authup
volumes:
- /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable
- /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable:Z
depends_on:
dnpm-mysql:
condition: service_healthy
@@ -68,7 +68,7 @@ services:
- AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
volumes:
- /etc/bridgehead/dnpm/config:/dnpm_config
- /var/cache/bridgehead/dnpm/backend-data:/dnpm_data
- /var/cache/bridgehead/dnpm/backend-data:/dnpm_data:Z
depends_on:
dnpm-authup:
condition: service_healthy

6
ccp/modules/exporter-compose.yml
View File

@@ -24,7 +24,7 @@ services:
- "traefik.http.middlewares.exporter_ccp_strip.stripprefix.prefixes=/ccp-exporter"
- "traefik.http.routers.exporter_ccp.middlewares=exporter_ccp_strip"
volumes:
- "/var/cache/bridgehead/ccp/exporter-files:/app/exporter-files/output"
- "/var/cache/bridgehead/ccp/exporter-files:/app/exporter-files/output:z"
exporter-db:
image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
@@ -35,7 +35,7 @@ services:
POSTGRES_DB: "exporter"
volumes:
# Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer.
- "/var/cache/bridgehead/ccp/exporter-db:/var/lib/postgresql/data"
- "/var/cache/bridgehead/ccp/exporter-db:/var/lib/postgresql/data:Z"
reporter:
image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest
@@ -57,7 +57,7 @@ services:
# There is a risk that the bridgehead restarts, losing the already created export.
volumes:
- "/var/cache/bridgehead/ccp/reporter-files:/app/reports"
- "/var/cache/bridgehead/ccp/reporter-files:/app/reports:z"
labels:
- "traefik.enable=true"
- "traefik.http.routers.reporter_ccp.rule=PathPrefix(`/ccp-reporter`)"

2
ccp/modules/fhir2sql-compose.yml
View File

@@ -22,7 +22,7 @@ services:
POSTGRES_PASSWORD: "${DASHBOARD_DB_PASSWORD}" # Set in dashboard-setup.sh
POSTGRES_DB: "dashboard"
volumes:
- "/var/cache/bridgehead/ccp/dashboard-db:/var/lib/postgresql/data"
- "/var/cache/bridgehead/ccp/dashboard-db:/var/lib/postgresql/data:Z"
focus:
environment:

2
ccp/modules/id-management-compose.yml
View File

@@ -62,7 +62,7 @@ services:
volumes:
- "patientlist-db-data:/var/lib/postgresql/data"
# NOTE: Add backups here. This is only imported if /var/lib/bridgehead/data/patientlist/ is empty!!!
- "/tmp/bridgehead/patientlist/:/docker-entrypoint-initdb.d/"
- "/tmp/bridgehead/patientlist/:/docker-entrypoint-initdb.d/:Z"
traefik-forward-auth:
image: docker.verbis.dkfz.de/cache/oauth2-proxy/oauth2-proxy:latest

4
ccp/modules/mtba-compose.yml
View File

@@ -32,8 +32,8 @@ services:
- "traefik.http.routers.mtba_ccp.tls=true"
volumes:
- /var/cache/bridgehead/ccp/mtba/input:/app/input
- /var/cache/bridgehead/ccp/mtba/persist:/app/persist
- /var/cache/bridgehead/ccp/mtba/input:/app/input:z
- /var/cache/bridgehead/ccp/mtba/persist:/app/persist:z
# TODO: Include CBioPortal in Deployment ...
# NOTE: CBioPortal can't load data while the system is running. So after import of data bridgehead needs to be restarted!

10
dhki/docker-compose.yml
View File

@@ -33,7 +33,7 @@ services:
EPSILON: 0.28
QUERIES_TO_CACHE: '/queries_to_cache.conf'
volumes:
- /srv/docker/bridgehead/dhki/queries_to_cache.conf:/queries_to_cache.conf:ro
- /srv/docker/bridgehead/dhki/queries_to_cache.conf:/queries_to_cache.conf:ro,Z
depends_on:
- "beam-proxy"
- "blaze"
@@ -55,12 +55,10 @@ services:
- "forward_proxy"
volumes:
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
- /srv/docker/bridgehead/dhki/root.crt.pem:/conf/root.crt.pem:ro
- /srv/docker/bridgehead/dhki/root.crt.pem:/conf/root.crt.pem:ro,Z
# secrets don't seem to allow us to specify Z
- /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
volumes:
blaze-data:
secrets:
proxy.pem:
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

10
itcc/docker-compose.yml
View File

@@ -35,7 +35,7 @@ services:
QUERIES_TO_CACHE: '/queries_to_cache.conf'
ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
volumes:
- /srv/docker/bridgehead/itcc/queries_to_cache.conf:/queries_to_cache.conf:ro
- /srv/docker/bridgehead/itcc/queries_to_cache.conf:/queries_to_cache.conf:ro,Z
depends_on:
- "beam-proxy"
- "blaze"
@@ -57,12 +57,10 @@ services:
- "forward_proxy"
volumes:
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
- /srv/docker/bridgehead/itcc/root.crt.pem:/conf/root.crt.pem:ro
- /srv/docker/bridgehead/itcc/root.crt.pem:/conf/root.crt.pem:ro,Z
# secrets don't seem to allow us to specify Z
- /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
volumes:
blaze-data:
secrets:
proxy.pem:
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

8
kr/docker-compose.yml
View File

@@ -56,12 +56,10 @@ services:
- "forward_proxy"
volumes:
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
- /srv/docker/bridgehead/kr/root.crt.pem:/conf/root.crt.pem:ro
- /srv/docker/bridgehead/kr/root.crt.pem:/conf/root.crt.pem:ro,Z
# secrets don't seem to allow us to specify Z
- /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
volumes:
blaze-data:
secrets:
proxy.pem:
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

6
kr/modules/exporter-compose.yml
View File

@@ -24,7 +24,7 @@ services:
- "traefik.http.middlewares.exporter_ccp_strip.stripprefix.prefixes=/ccp-exporter"
- "traefik.http.routers.exporter_ccp.middlewares=exporter_ccp_strip"
volumes:
- "/var/cache/bridgehead/ccp/exporter-files:/app/exporter-files/output"
- "/var/cache/bridgehead/ccp/exporter-files:/app/exporter-files/output:z"
exporter-db:
image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
@@ -35,7 +35,7 @@ services:
POSTGRES_DB: "exporter"
volumes:
# Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer.
- "/var/cache/bridgehead/ccp/exporter-db:/var/lib/postgresql/data"
- "/var/cache/bridgehead/ccp/exporter-db:/var/lib/postgresql/data:Z"
reporter:
image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest
@@ -57,7 +57,7 @@ services:
# There is a risk that the bridgehead restarts, losing the already created export.
volumes:
- "/var/cache/bridgehead/ccp/reporter-files:/app/reports"
- "/var/cache/bridgehead/ccp/reporter-files:/app/reports:z"
labels:
- "traefik.enable=true"
- "traefik.http.routers.reporter_ccp.rule=PathPrefix(`/ccp-reporter`)"

9
kr/modules/teiler-compose.yml
View File

@@ -71,9 +71,6 @@ services:
HTTP_PROXY: "http://forward_proxy:3128"
ENABLE_MTBA: "${ENABLE_MTBA}"
ENABLE_DATASHIELD: "${ENABLE_DATASHIELD}"
secrets:
- ccp.conf
secrets:
ccp.conf:
file: /etc/bridgehead/ccp.conf
volumes:
# secrets don't seem to allow us to specify Z
- /etc/bridgehead/ccp.conf:/run/secrets/ccp.conf:ro

3
minimal/docker-compose.yml
View File

@@ -28,6 +28,9 @@ services:
security_opt:
# allow access to the docker socket on systems with SELinux
- "label:type:container_runtime_t"
cap_add:
# Allow binding to ports <1024 without root
- NET_BIND_SERVICE
volumes:
- /etc/bridgehead/traefik-tls:/certs:ro
- ../lib/traefik-configuration/:/configuration:ro

6
modules/ssh-tunnel-compose.yml
View File

@@ -10,8 +10,4 @@ services:
SSH_TUNNEL_PORT: "${SSH_TUNNEL_PORT:-22}"
volumes:
- "/etc/bridgehead/ssh-tunnel.conf:/ssh-tunnel.conf:ro"
secrets:
- privkey
secrets:
privkey:
file: /etc/bridgehead/pki/ssh-tunnel.priv.pem
- "/etc/bridgehead/pki/ssh-tunnel.priv.pem:/run/secrets/privkey:ro"

2
modules/transfair-compose.yml
View File

@@ -27,7 +27,7 @@ services:
- NO_PROXY=${TRANSFAIR_NO_PROXIES}
- ALL_PROXY=http://forward_proxy:3128
volumes:
- /var/cache/bridgehead/${PROJECT}/transfair:/transfair
- /var/cache/bridgehead/${PROJECT}/transfair:/transfair:Z
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
labels:
- "traefik.enable=true"