mirror of https://github.com/samply/bridgehead.git
Merge branch 'main' into checkClockSync
This commit is contained in:
Martin Lablans
GitHub
commit
11bfd94f2a
|
|
@ -3,10 +3,4 @@
|
|||
site-config/*
|
||||
|
||||
## Ignore site configuration
|
||||
config/**/*
|
||||
!config/**/*.default
|
||||
landing/*
|
||||
docker-compose.override.yml
|
||||
site.conf
|
||||
auth/*
|
||||
certs/*
|
||||
*/docker-compose.override.yml
|
||||
|
|
|
|||
665
README.md
665
README.md
|
|
@ -1,532 +1,335 @@
|
|||
# Bridgehead
|
||||
|
||||
This repository contains all information and tools to deploy a bridgehead. If you have any questions about deploying a bridgehead, please [contact us](mailto:verbis-support@dkfz-heidelberg.de).
|
||||
The Bridgehead is a secure, low-effort solution to connect your research institution to a federated research network. It bundles interoperable, open-source software components into a turnkey package for installation on one of your secure servers. The Bridgehead is pre-configured with sane defaults, centrally monitored and with an absolute minimum of "moving parts" on your side, making it an extremely low-maintenance gateway to data sharing.
|
||||
|
||||
This repository is the starting point for any information and tools you will need to deploy a Bridgehead. If you have questions, please [contact us](mailto:verbis-support@dkfz-heidelberg.de).
|
||||
|
||||
TOC
|
||||
|
||||
1. [About](#about)
|
||||
- [Projects](#projects)
|
||||
- [GBA/BBMRI-ERIC](#gbabbmri-eric)
|
||||
- [CCP(DKTK/C4)](#ccpdktkc4)
|
||||
- [NNGM](#nngm)
|
||||
- [Bridgehead Components](#bridgehead-components)
|
||||
- [Blaze Server](#blaze-serverhttpsgithubcomsamplyblaze)
|
||||
- [Connector](#connector)
|
||||
1. [Requirements](#requirements)
|
||||
- [Hardware](#hardware)
|
||||
- [System](#system-requirements)
|
||||
- [git](#git)
|
||||
- [docker](#dockerhttpsdocsdockercomget-docker)
|
||||
- [systemd](#systemd)
|
||||
2. [Getting Started](#getting-started)
|
||||
- [DKTK](#dktkc4)
|
||||
- [C4](#c4)
|
||||
- [GBA/BBMRI-ERIC](#gbabbmri-eric)
|
||||
3. [Configuration](#configuration)
|
||||
4. [Managing your Bridgehead](#managing-your-bridgehead)
|
||||
- [Systemd](#on-a-server)
|
||||
- [Without Systemd](#on-developers-machine)
|
||||
4. [Pitfalls](#pitfalls)
|
||||
5. [Migration-guide](#migration-guide)
|
||||
7. [License](#license)
|
||||
|
||||
|
||||
## About
|
||||
|
||||
TODO: Insert comprehensive feature list of the bridgehead? Why would anyone install it?
|
||||
|
||||
## Projects
|
||||
|
||||
### GBA/BBMRI-ERIC
|
||||
|
||||
The **Sample Locator** is a tool that allows researchers to make searches for samples over a large number of geographically distributed biobanks. Each biobank runs a so-called **Bridgehead** at its site, which makes it visible to the Sample Locator. The Bridgehead is designed to give a high degree of protection to patient data. Additionally, a tool called the [Negotiator][negotiator] puts you in complete control over which samples and which data are delivered to which researcher.
|
||||
|
||||
You will most likely want to make your biobanks visible via the [publicly accessible Sample Locator][sl], but the possibility also exists to install your own Sample Locator for your site or organization, see the GitHub pages for [the server][sl-server-src] and [the GUI][sl-ui-src].
|
||||
|
||||
The Bridgehead has two primary components:
|
||||
* The **Blaze Store**. This is a highly responsive FHIR data store, which you will need to fill with your data via an ETL chain.
|
||||
* The **Connector**. This is the communication portal to the Sample Locator, with specially designed features that make it possible to run it behind a corporate firewall without making any compromises on security.
|
||||
|
||||
### CCP(DKTK/C4)
|
||||
|
||||
TODO:
|
||||
|
||||
### nNGM
|
||||
|
||||
TODO:
|
||||
|
||||
### Bridgehead Components
|
||||
|
||||
#### [Blaze Server](https://github.com/samply/blaze)
|
||||
|
||||
This holds the actual data being searched. This store must be filled by you, generally by running an ETL on your locally stored data to turn it into the standardized FHIR format that we require.
|
||||
|
||||
#### [Connector]
|
||||
|
||||
TODO:
|
||||
- [Software](#software)
|
||||
- [Network](#network)
|
||||
2. [Deployment](#deployment)
|
||||
- [Site name](#site-name)
|
||||
- [Projects](#projects)
|
||||
- [GitLab repository](#gitlab-repository)
|
||||
- [Base Installation](#base-installation)
|
||||
- [Register with Samply.Beam](#register-with-samplybeam)
|
||||
- [Starting and stopping your Bridgehead](#starting-and-stopping-your-bridgehead)
|
||||
- [Testing your new Bridgehead](#testing-your-new-bridgehead)
|
||||
- [De-installing a Bridgehead](#de-installing-a-bridgehead)
|
||||
3. [Site-specific configuration](#site-specific-configuration)
|
||||
- [HTTPS Access](#https-access)
|
||||
- [TLS terminating proxies](#tls-terminating-proxies)
|
||||
- [File structure](#file-structure)
|
||||
- [BBMRI-ERIC Directory](#bbmri-eric-directory)
|
||||
4. [Things you should know](#things-you-should-know)
|
||||
- [Auto-Updates](#auto-updates)
|
||||
- [Auto-Backups](#auto-backups)
|
||||
- [Non-Linux OS](#non-linux-os)
|
||||
5. [Troubleshooting](#troubleshooting)
|
||||
- [Docker Daemon Proxy Configuration](#docker-daemon-proxy-configuration)
|
||||
- [Monitoring](#monitoring)
|
||||
6. [License](#license)
|
||||
|
||||
## Requirements
|
||||
|
||||
### Hardware
|
||||
|
||||
For running your bridgehead we recommend the follwing Hardware:
|
||||
Hardware requirements strongly depend on the specific use-cases of your network as well as on the data it is going to serve. Most use-cases are well-served with the following configuration:
|
||||
|
||||
- 4 CPU cores
|
||||
- At least 8 GB Ram
|
||||
- 100GB Hard Drive, SSD recommended
|
||||
- 32 GB RAM
|
||||
- 160GB Hard Drive, SSD recommended
|
||||
|
||||
### Software
|
||||
|
||||
You are strongly recommended to install the Bridgehead under a Linux operating system (but see the section [Non-Linux OS](#non-linux-os)). You will need root (administrator) priveleges on this machine in order to perform the deployment. We recommend the newest Ubuntu LTS server release.
|
||||
|
||||
Ensure the following software (or newer) is installed:
|
||||
|
||||
- git >= 2.0
|
||||
- docker >= 20.10.1
|
||||
- docker-compose >= 2.xx (`docker-compose` and `docker compose` are both supported).
|
||||
- systemd
|
||||
|
||||
We recommend to install Docker(-compose) from its official sources as described on the [Docker website](https://docs.docker.com).
|
||||
|
||||
Note for Ubuntu: Please note that snap versions of Docker are not supported.
|
||||
|
||||
### Network
|
||||
|
||||
A running Bridgehead requires an outgoing HTTPS proxy to communicate with the central components.
|
||||
|
||||
Additionally, your site might use its own proxy. You should discuss this with your local systems administration. If a proxy is being used, you will need to note down the URL of the proxy. If it is a secure proxy, then you will also need to make a note of its username and password. This information will be used later on during the installation process.
|
||||
|
||||
Note that git and Docker may also need to be configured to use this proxy. This is a job for your systems administrators.
|
||||
|
||||
If there is a site firewall, this needs to be configured so that git and Docker can reach the outside world. Another job for the systems administrators.
|
||||
|
||||
Note for Ubuntu: Please note that the uncomplicated firewall (ufw) is known to conflict with Docker [here](https://github.com/chaifeng/ufw-docker).
|
||||
|
||||
## Deployment
|
||||
|
||||
### Site name
|
||||
|
||||
You will need to choose a short name for your site. This is not a URL, just a simple identifying string. For the examples below, we will use "your-site-name", but you should obviously choose something that is meaningful to you and which is unique.
|
||||
|
||||
Site names should adhere to the following conventions:
|
||||
|
||||
- They should be lower-case.
|
||||
- They should generally be named after the city where your site is based, e.g. ```karlsruhe```.
|
||||
- If you have a multi-part name, please use a hypen ("-") as separator, e.g. ```le-havre```.
|
||||
- If your site is for testing purposes, rather than production, please append "-test", e.g. ```zaragoza-test```.
|
||||
- If you are a developer and you are making changes to the Bridgehead, please use your name and prepend "dev-", e.g. ```dev-joe-doe```.
|
||||
|
||||
### GitLab repository
|
||||
|
||||
In order to be able to install, you will need to have your own repository in GitLab for your site's configuration settings. This allows automated updates of the Bridgehead software.
|
||||
|
||||
To request a new repository, please contact your research network administration or send an email to one of the project specific addresses:
|
||||
|
||||
- For the bbmri project: bridgehead@helpdesk.bbmri-eric.eu.
|
||||
- For the ccp project: support-ccp@dkfz-heidelberg.de
|
||||
|
||||
Mention:
|
||||
- which project you belong to, i.e. "bbmri" or "ccp"
|
||||
- site name (According to conventions listed above)
|
||||
- operator name and email
|
||||
|
||||
We will set the repository up for you. We will then send you:
|
||||
|
||||
- A Repository Short Name (RSN). Beware: this is distinct from your site name.
|
||||
- Repository URL containing the acces token eg. https://BH_Dummy:dummy_token@git.verbis.dkfz.de/bbmri-bridgehead-configs/dummy.git
|
||||
|
||||
During the installation, your Bridgehead will download your site's configuration from GitLab and you can review the details provided to us by email.
|
||||
|
||||
|
||||
### System Requirements
|
||||
### Base Installation
|
||||
|
||||
Before starting the installation process, please ensure that following software is available on your system:
|
||||
First, download your site specific configuration repository:
|
||||
```shell
|
||||
sudo mkdir -p /etc/bridgehead/
|
||||
sudo git clone <REPO_URL_FROM_EMAIL> /etc/bridgehead/
|
||||
```
|
||||
|
||||
#### Git
|
||||
Review the site configuration:
|
||||
```shell
|
||||
sudo cat /etc/bridgehead/bbmri.conf
|
||||
```
|
||||
|
||||
Check if you have at leat git 2.0 installed on the system with:
|
||||
Pay special attention to:
|
||||
|
||||
- SITE_NAME
|
||||
- SITE_ID
|
||||
- OPERATOR_FIRST_NAME
|
||||
- OPERATOR_LAST_NAME
|
||||
- OPERATOR_EMAIL
|
||||
|
||||
Clone the bridgehead repository:
|
||||
```shell
|
||||
sudo mkdir -p /srv/docker/
|
||||
sudo git clone https://github.com/samply/bridgehead.git /srv/docker/bridgehead
|
||||
```
|
||||
|
||||
Then, run the installation script:
|
||||
|
||||
```shell
|
||||
cd /srv/docker/bridgehead
|
||||
sudo ./bridgehead install <PROJECT>
|
||||
```
|
||||
|
||||
### Register with Samply.Beam
|
||||
|
||||
Many Bridgehead services rely on the secure, performant and flexible messaging middleware called [Samply.Beam](https://github.com/samply/beam). You will need to register ("enroll") with Samply.Beam by creating a cryptographic key pair for your bridgehead:
|
||||
|
||||
``` shell
|
||||
git --version
|
||||
cd /srv/docker/bridgehead
|
||||
sudo ./bridgehead enroll <PROJECT>
|
||||
```
|
||||
|
||||
#### [Docker](https://docs.docker.com/get-docker/)
|
||||
... and follow the instructions on the screen. Please send your default Collection ID and the display name of your site together with the certificate request when you enroll. You should then be prompted to do the next step:
|
||||
|
||||
To check your docker installation, you should execute the docker with --version:
|
||||
### Starting and stopping your Bridgehead
|
||||
|
||||
``` shell
|
||||
docker --version
|
||||
If you followed the above steps, your Bridgehead should already be configured to autostart (via systemd). If you would like to start/stop manually:
|
||||
|
||||
To start, run
|
||||
|
||||
```shell
|
||||
sudo systemctl start bridgehead@<PROJECT>.service
|
||||
```
|
||||
|
||||
The Version should be higher than "20.10.1". Otherwise you will have problems starting the bridgehead. The next step is to check ``` docker-compose``` with:
|
||||
To stop, run
|
||||
|
||||
``` shell
|
||||
docker-compose --version
|
||||
```shell
|
||||
sudo systemctl stop bridgehead@<PROJECT>.service
|
||||
```
|
||||
|
||||
The recomended version is "2.XX" and higher. If docker-compose was not installed with docker follow these [instructions](https://docs.docker.com/compose/install/#install-compose-as-standalone-binary-on-linux-systems). To futher check your docker and docker-compose installation, please run the following command.
|
||||
To enable/disable autostart, run
|
||||
|
||||
``` shell
|
||||
docker-compose -f - up <<EOF
|
||||
version: "3.7"
|
||||
services:
|
||||
hello-world:
|
||||
image: hello-world
|
||||
EOF
|
||||
```
|
||||
Docker will now download the "hello-world" docker image and try to execute it. After the download you should see a message starting with "Hello from Docker!".
|
||||
|
||||
> NOTE: If the download of the image fails (e.g with "connection timed out" message), ensure that you have correctly set the proxy for the docker daemon. Refer to ["Docker Daemon Proxy Configuration" in the "Pitfalls" section](#docker-daemon-proxy-configuration)
|
||||
|
||||
#### [systemd](https://systemd.io/)
|
||||
|
||||
You shouldn't need to install it yourself, If systemd is not available on your system you should get another system.
|
||||
To check if systemd is available on your system, please execute
|
||||
|
||||
``` shell
|
||||
systemctl --version
|
||||
```shell
|
||||
sudo systemctl [enable|disable] bridgehead@<PROJECT>.service
|
||||
```
|
||||
|
||||
If systemd is not installed, you can start the bridgehead. However, for productive use we recomend using systemd.
|
||||
### Testing your new Bridgehead
|
||||
|
||||
---
|
||||
After starting the Bridgehead, you can watch the initialization process with the following command:
|
||||
|
||||
## Getting Started
|
||||
|
||||
### Installation
|
||||
|
||||
If your system passed all checks from ["Requirements" section], you are now ready to download the bridgehead.
|
||||
|
||||
First, clone the repository to the directory "/srv/docker/bridgehead":
|
||||
|
||||
``` shell
|
||||
sudo mkdir -p /srv/docker/;
|
||||
sudo git clone https://github.com/samply/bridgehead.git /srv/docker/bridgehead;
|
||||
```shell
|
||||
journalctl -u bridgehead@bbmri -f
|
||||
```
|
||||
|
||||
It is recomended to create a user for the bridgehead service. This should be done after clone the repository. Since not all linux distros support ```adduser```, we provide an action for the systemcall ```useradd```. You should try the first one, when the systm can't create the user you should try the second one.
|
||||
if this exits with something similar to the following:
|
||||
|
||||
``` shell
|
||||
adduser --no-create-home --disabled-login --ingroup docker --gecos "" bridgehead
|
||||
```
|
||||
bridgehead@bbmri.service: Main process exited, code=exited, status=1/FAILURE
|
||||
```
|
||||
|
||||
``` shell
|
||||
useradd -M -g docker -N -s /sbin/nologin bridgehead
|
||||
Then you know that there was a problem with starting the Bridgehead. Scroll up the printout to find the cause of the error.
|
||||
|
||||
Once the Bridgehead is running, you can also view the individual Docker processes with:
|
||||
|
||||
```shell
|
||||
docker ps
|
||||
```
|
||||
|
||||
After adding the User you need to change the ownership of the directory to the bridgehead user.
|
||||
There should be 6 - 10 Docker proceses. If there are fewer, then you know that something has gone wrong. To see what is going on, run:
|
||||
|
||||
``` shell
|
||||
chown bridgehead /srv/docker/bridgehead/ -R
|
||||
```shell
|
||||
journalctl -u bridgehead@bbmri -f
|
||||
```
|
||||
|
||||
### Configuration
|
||||
Once the Bridgehead has passed these checks, take a look at the landing page:
|
||||
|
||||
> NOTE: If you are part of the CCP-IT we will provide you another link for the configuration.
|
||||
|
||||
Next, you need to configure a set of variables, specific for your site with not so high security concerns. You can clone the configuration template at [GitHub](https://github.com/samply/bridgehead-config). The confiugration of the bridgehead should be located in /etc/bridghead.
|
||||
|
||||
``` shell
|
||||
sudo git clone https://github.com/samply/bridgehead-config.git /etc/bridgehead;
|
||||
```
|
||||
https://localhost
|
||||
```
|
||||
|
||||
After cloning or forking the repository you need to add value to the template. If you are a part of the CCP-IT you will get an already filled out config repo.
|
||||
You can either do this in a browser or with curl. If you visit the URL in the browser, you will neet to click through several warnings, because you will initially be using a self-signed certificate. With curl, you can bypass these checks:
|
||||
|
||||
### Testing your bridgehead
|
||||
|
||||
We recomend to run first with the start and stop script. If you have trouble starting the bridghead have a look at the troubleshooting section.
|
||||
|
||||
Now you ready to run a bridgehead instance. The bridgehead scripts checks if your configuration is correct. To check if everything works, execute the following:
|
||||
``` shell
|
||||
/srv/docker/bridgehead/bridgehead start <Project>
|
||||
```shell
|
||||
curl -k https://localhost
|
||||
```
|
||||
|
||||
You should now be able to access the landing page on your system, e.g "https://<your-host>/".
|
||||
If you get errors when you do this, you need to use ```docker logs``` to examine your landing page container in order to determine what is going wrong.
|
||||
|
||||
To shutdown the bridgehead just run.
|
||||
``` shell
|
||||
/srv/docker/bridgehead/bridgehead stop <Project>
|
||||
If you have chosen to take part in our monitoring program (by setting the ```MONITOR_APIKEY``` variable in the configuration), you will be informed by email when problems are detected in your Bridgehead.
|
||||
|
||||
### De-installing a Bridgehead
|
||||
|
||||
You may decide that you want to remove a Bridgehead installation from your machine, e.g. if you want to migrate it to a new location or if you want to start a fresh installation because the initial attempts did not work.
|
||||
|
||||
To do this, run:
|
||||
|
||||
```shell
|
||||
sh bridgehead uninstall
|
||||
```
|
||||
|
||||
### Systemd service configuration
|
||||
|
||||
For a server, we highly recommend that you install the system units for managing the bridgehead, provided by us. You can do this by executing the [bridgehead](./bridgehead) script:
|
||||
``` shell
|
||||
sudo /srv/docker/bridgehead/bridgehead install <Project>
|
||||
```
|
||||
|
||||
This will install the systemd units to run and update the bridghead.
|
||||
|
||||
Finally, you need to configure your sites secrets. These are places as configuration for each bridgehead system unit. Refer to the section for your specific project:
|
||||
|
||||
For Every project you need to set the proxy this way, if you have one. This is done with the ```systemctl edit``` comand.
|
||||
|
||||
``` shell
|
||||
sudo systemctl edit bridgehead@<project>.service;
|
||||
sudo systemctl edit bridgehead-update@<project>.service;
|
||||
```
|
||||
|
||||
``` conf
|
||||
[Service]
|
||||
Environment=http_proxy=<proxy-url>
|
||||
Environment=https_proxy=<proxy-url>
|
||||
```
|
||||
|
||||
There a further configurations for each project.
|
||||
|
||||
#### CCP(DKTK/C4)
|
||||
|
||||
For the federate search please follow the basic auth configuration step.
|
||||
|
||||
### DKTK/C4
|
||||
|
||||
You can create the site specific configuration with:
|
||||
|
||||
|
||||
This will open your default editor allowing you to edit the docker system units configuration. Insert the following lines in the editor and define your machines secrets. You share some of the ID-Management secrets with the central patientlist (Mainz) and controlnumbergenerator (Frankfurt). Refer to the ["Configuration" section](#configuration) for this.
|
||||
|
||||
``` conf
|
||||
[Service]
|
||||
Environment=http_proxy=
|
||||
Environment=https_proxy=
|
||||
```
|
||||
|
||||
To make the configuration effective, you need to tell systemd to reload the configuration and restart the docker service:
|
||||
|
||||
``` shell
|
||||
sudo systemctl daemon-reload;
|
||||
sudo systemctl bridgehead@ccp.service;
|
||||
```
|
||||
|
||||
You can create the site specific configuration with:
|
||||
|
||||
``` shell
|
||||
sudo systemctl edit bridgehead@c4.service;
|
||||
```
|
||||
|
||||
This will open your default editor allowing you to edit the docker system units configuration. Insert the following lines in the editor and define your machines secrets. You share some of the ID-Management secrets with the central patientlist (Mainz) and controlnumbergenerator (Frankfurt). Refer to the ["Configuration" section](#configuration) for this.
|
||||
|
||||
``` conf
|
||||
[Service]
|
||||
Environment=http_proxy=
|
||||
Environment=https_proxy=
|
||||
Environment=HOSTIP=
|
||||
Environment=HOST=
|
||||
Environment=HTTP_PROXY_USER=
|
||||
Environment=HTTP_PROXY_PASSWORD=
|
||||
Environment=HTTPS_PROXY_USER=
|
||||
Environment=HTTPS_PROXY_PASSWORD=
|
||||
Environment=CONNECTOR_POSTGRES_PASS=
|
||||
Environment=ML_DB_PASS=
|
||||
Environment=MAGICPL_API_KEY=
|
||||
Environment=MAGICPL_MAINZELLISTE_API_KEY=
|
||||
Environment=MAGICPL_API_KEY_CONNECTOR=
|
||||
Environment=MAGICPL_MAINZELLISTE_CENTRAL_API_KEY=
|
||||
Environment=MAGICPL_CENTRAL_API_KEY=
|
||||
Environment=MAGICPL_OIDC_CLIENT_ID=
|
||||
Environment=MAGICPL_OIDC_CLIENT_SECRET=
|
||||
```
|
||||
|
||||
To make the configuration effective, you need to tell systemd to reload the configuration and restart the docker service:
|
||||
|
||||
``` shell
|
||||
sudo systemctl daemon-reload;
|
||||
sudo systemctl bridgehead@c4.service;
|
||||
```
|
||||
### GBA/BBMRI-ERIC
|
||||
|
||||
You can create the site specific configuration with:
|
||||
|
||||
``` shell
|
||||
sudo systemctl edit bridgehead@gbn.service;
|
||||
```
|
||||
|
||||
This will open your default editor allowing you to edit the docker system units configuration. Insert the following lines in the editor and define your machines secrets.
|
||||
|
||||
``` conf
|
||||
[Service]
|
||||
Environment=HOSTIP=
|
||||
Environment=HOST=
|
||||
Environment=HTTP_PROXY_USER=
|
||||
Environment=HTTP_PROXY_PASSWORD=
|
||||
Environment=HTTPS_PROXY_USER=
|
||||
Environment=HTTPS_PROXY_PASSWORD=
|
||||
Environment=CONNECTOR_POSTGRES_PASS=
|
||||
```
|
||||
|
||||
To make the configuration effective, you need to tell systemd to reload the configuration and restart the docker service:
|
||||
|
||||
``` shell
|
||||
sudo systemctl daemon-reload;
|
||||
sudo systemctl bridgehead@gbn.service;
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
### Basic Auth
|
||||
|
||||
For Data protection we use basic authenfication for some services. To access those services you need an username and password combination. If you start the bridgehead without basic auth, then those services are not accesbile. We provide a script which set the needed config for you, just run the script and follow the instructions.
|
||||
|
||||
``` shell
|
||||
add_user.sh
|
||||
```
|
||||
|
||||
The result needs to be set in either in the systemd service or in your console.
|
||||
|
||||
|
||||
#### Console
|
||||
|
||||
When just running the bridgehead you need to export the auth variable. Be aware that this export is only for the current session in the environment and after exit it will not be accessible anymore.
|
||||
|
||||
``` shell
|
||||
export bc_auth_user=<output>
|
||||
```
|
||||
|
||||
Cation: you need to escape occrring dollar signs.
|
||||
|
||||
#### systemd
|
||||
|
||||
|
||||
## Site-specific configuration
|
||||
|
||||
### HTTPS Access
|
||||
|
||||
We advise to use https for all service of your bridgehead. HTTPS is enabled on default. For starting the bridghead you need a ssl certificate. You can either create it yourself or get a signed one. You need to drop the certificates in /certs.
|
||||
Even within your internal network, the Bridgehead enforces HTTPS for all services. During the installation, a self-signed, long-lived certificate was created for you. To increase security, you can simply replace the files under `/etc/bridgehead/traefik-tls` with ones from established certification authorities such as [Let's Encrypt](https://letsencrypt.org) or [DFN-AAI](https://www.aai.dfn.de).
|
||||
|
||||
The bridgehead create one autotmatic on the first start. However, it will be unsigned and we recomend to get a signed one.
|
||||
### TLS terminating proxies
|
||||
|
||||
All of the Bridgehead's outgoing connections are secured by transport encryption (TLS) and a Bridgehead will refuse to connect if certificate verification fails. If your local forward proxy server performs TLS termination, please place its CA certificate in `/etc/bridgehead/trusted-ca-certs` as a `.pem` file, e.g. `/etc/bridgehead/trusted-ca-certs/mylocalca.pem`. Then, all Bridgehead components will pick up this certificate and trust it for outgoing connections.
|
||||
|
||||
### Locally Managed Secrets
|
||||
### File structure
|
||||
|
||||
This section describes the secrets you need to configure locally through the configuration
|
||||
- `/srv/docker/bridgehead` contains this git repository with the shell scripts and *project-specific configuration*. In here, all files are identical for all sites. You should not make any changes here.
|
||||
- `/etc/bridgehead` contains your *site-specific configuration* synchronized from your site-specific git repository as part of the [base installation](#base-installation). To change anything here, please consult your git repository (find out its URL via `git -C /etc/bridgehead remote -v`).
|
||||
- `/etc/bridgehead/<PROJECT>.conf` is your main site-specific configuration, all bundled into one concise config file. Do not change it here but via the central git repository.
|
||||
- `/etc/bridgehead/<PROJECT>.local.conf` contains site-specific parameters to be known to your Bridgehead only, e.g. local access credentials. The file is ignored via git, and you may edit it here via a text editor.
|
||||
- `/etc/bridgehead/traefik-tls` contains your Bridgehead's reverse proxies TLS certificates for [HTTPS access](#https-access).
|
||||
- `/etc/bridgehead/pki` contains your Bridgehead's private key (e.g., but not limited to Samply.Beam), generated as part of the [Samply.Beam enrollment](#register-with-samplybeam).
|
||||
- `/etc/bridgehead/trusted-ca-certs` contains third-party certificates to be trusted by the Bridgehead. For example, you want to place the certificates of your [TLS-terminating proxy](#network) here.
|
||||
|
||||
| Name | Recommended Value | Description |
|
||||
|--------------------------------------|---------------------------------------------------------------------------------------------------| ----------- |
|
||||
| HTTP_PROXY_USER | | Your local http proxy user |
|
||||
| HOSTIP | Compute with: `docker run --rm --add-host=host.docker.internal:host-gateway ubuntu cat /etc/hosts | grep 'host.docker.internal' | awk '{print $1}'` | The ip from which docker containers can reach your host system. |
|
||||
| HOST | Compute with: `hostname` |The hostname from which all components will eventually be available|
|
||||
| HTTP_PROXY_PASSWORD | |Your local http proxy user's password|
|
||||
| HTTPS_PROXY_USER | |Your local https proxy user|
|
||||
| HTTPS_PROXY_PASSWORD || Your local https proxy user's password |
|
||||
| CONNECTOR_POSTGRES_PASS | Random String |The password for your project specific connector.|
|
||||
| STORE_POSTGRES_PASS | Random String |The password for your local datamanagements database (only relevant in c4)|
|
||||
| ML_DB_PASS | Random String |The password for your local patientlist database|
|
||||
| MAGICPL_API_KEY | Random String |The apiKey used by the local datamanagement to create pseudonymes.|
|
||||
| MAGICPL_MAINZELLISTE_API_KEY | Random String |The apiKey used by the local id-manager to communicate with the local patientlist|
|
||||
| MAGICPL_API_KEY_CONNECTOR | Random String |The apiKey used by the connector to communicate with the local patientlist|
|
||||
| MAGICPL_MAINZELLISTE_CENTRAL_API_KEY | You need to ask the central patientlists admin for this. |The apiKey for your machine to communicate with the central patientlist|
|
||||
| MAGICPL_CENTRAL_API_KEY | You need to ask the central controlnumbergenerator admin for this. |The apiKey for your machine to communicate with the central controlnumbergenerator|
|
||||
| MAGICPL_OIDC_CLIENT_ID || The client id used for your machine, to connect with the central authentication service |
|
||||
| MAGICPL_OIDC_CLIENT_SECRET || The client secret used for your machine, to connect with the central authentication service |
|
||||
Your Bridgehead's actual data is not stored in the above directories, but in named docker volumes, see `docker volume ls` and `docker volume inspect <volume_name>`.
|
||||
|
||||
### Cooperatively Managed Secrets
|
||||
### BBMRI-ERIC Directory
|
||||
|
||||
> TODO: Describe secrets from site-config
|
||||
If you run a biobank, you should register with the [Directory](https://directory.bbmri-eric.eu), a BBMRI-ERIC project that catalogs biobanks.
|
||||
|
||||
## Managing your Bridgehead
|
||||
To do this, contact the BBMRI-ERIC national node for the country where your biobank is based, see [the list of nodes](http://www.bbmri-eric.eu/national-nodes/).
|
||||
|
||||
> TODO: Rewrite this section (restart, stop, uninstall, manual updates)
|
||||
Once you have registered, **you should choose one of your sample collections as a default collection for your biobank**. This is the collection that will be automatically used to label any samples that have not been assigned a collection ID in your ETL process. Make a note of this ID, you will need it later on in the installation process.
|
||||
|
||||
### On a Server
|
||||
The Bridgehead's **Directory Sync** is an optional feature that keeps the Directory up to date with your local data, e.g. number of samples. Conversely, it also updates the local FHIR store with the latest contact details etc. from the Directory. You must explicitly set your country specific directory url, username and password to enable this feature.
|
||||
|
||||
#### Start
|
||||
Full details can be found in [directory_sync_service](https://github.com/samply/directory_sync_service).
|
||||
|
||||
To enable it, you will need to set these variables to the ```bbmri.conf``` file of your GitLab repository. Here is an example config:
|
||||
|
||||
This will start a not running bridgehead system unit:
|
||||
``` shell
|
||||
sudo systemctl start bridgehead@<dktk/c4/gbn>
|
||||
```
|
||||
|
||||
#### Stop
|
||||
|
||||
This will stop a running bridgehead system unit:
|
||||
``` shell
|
||||
sudo systemctl stop bridgehead@<dktk/c4/gbn>
|
||||
### Directory sync service
|
||||
DS_DIRECTORY_URL=https://directory.bbmri-eric.eu
|
||||
DS_DIRECTORY_USER_NAME=your_directory_username
|
||||
DS_DIRECTORY_USER_PASS=qwdnqwswdvqHBVGFR9887
|
||||
DS_TIMER_CRON="0 22 * * *"
|
||||
```
|
||||
You must contact the Directory for your national node to find the URL, and to register as a user.
|
||||
|
||||
#### Update
|
||||
Additionally, you should choose when you want Directory sync to run. In the example above, this is set to happen at 10 pm every evening. You can modify this to suit your requirements. The timer specification should follow the [cron](https://crontab.guru) convention.
|
||||
|
||||
This will update bridgehead system unit:
|
||||
``` shell
|
||||
sudo systemctl start bridgehead-update@<dktk/c4/gbn>
|
||||
```
|
||||
Once you edited the gitlab config, the bridgehead will autoupdate the config with the values and will sync the data.
|
||||
|
||||
#### Remove the Bridgehead System Units
|
||||
There will be a delay before the effects of Directory sync become visible. First, you will need to wait until the time you have specified in ```TIMER_CRON```. Second, the information will then be synchronized from your national node with the central European Directory. This can take up to 24 hours.
|
||||
|
||||
If, for some reason you want to remove the installed bridgehead units, we added a command to [bridgehead](./bridgehead):
|
||||
``` shell
|
||||
sudo /srv/docker/bridgehead/bridgehead uninstall <project>
|
||||
```
|
||||
## Things you should know
|
||||
|
||||
### On Developers Machine
|
||||
### Auto-Updates
|
||||
|
||||
For developers, we provide additional scripts for starting and stopping the specif bridgehead:
|
||||
Your Bridgehead will automatically and regularly check for updates. Whenever something has been updates (e.g., one of the git repositories or one of the docker images), your Bridgehead is automatically restarted. This should happen automatically and does not need any configuration.
|
||||
|
||||
#### Start or stop
|
||||
If you would like to understand what happens exactly and when, please check the systemd units deployed during the [installation](#base-installation) via `systemctl cat bridgehead-update@<PROJECT>.service` and `systemctl cat bridgehead-update@<PROJECT>.timer`.
|
||||
|
||||
This command starts a specified bridgehead. Choose between "dktk", "c4" and "gbn".
|
||||
``` shell
|
||||
/srv/docker/bridgehead/bridgehead start <dktk/c4/gbn>
|
||||
```
|
||||
### Auto-Backups
|
||||
|
||||
#### Stop
|
||||
Some of the components in the bridgehead will store persistent data. For those components, we integrated an automated backup solution in the bridgehead updates. It will automatically save the backup in multiple files
|
||||
|
||||
This command stops a specified bridgehead. Choose between "dktk", "c4" and "gbn".
|
||||
``` shell
|
||||
/srv/docker/bridgehead/bridgehead stop <dktk/c4/gbn>
|
||||
```
|
||||
1) Last-XX, were XX represents a weekday to allow re-import of at least one version of the database for each of the past seven days.
|
||||
2) Year-KW-XX, were XX represents the calendar week to allow re-import of at least one version per calendar week
|
||||
3) Year-Month, to allow re-import of at least one version per month
|
||||
|
||||
#### Update
|
||||
To enable the Auto-Backup feature, please set the Variable `BACKUP_DIRECTORY` in your sites configuration.
|
||||
|
||||
This shell script updates the configuration for all bridgeheads installed on your system.
|
||||
``` shell
|
||||
/srv/docker/bridgehead/bridgehead update
|
||||
```
|
||||
> NOTE: If you want to regularly update your developing instance, you can create a CRON job that executes this script.
|
||||
### Development Installation
|
||||
|
||||
## Migration Guide
|
||||
By using `./bridgehead dev-install <projectname>` instead of `install`, you can install a developer bridgehead. The difference is, that you can provide an arbitrary configuration repository during the installation, meaning that it does not have to adhere to the usual naming scheme. This allows for better decoupling between development and production configurations.
|
||||
|
||||
> TODO: How to transfer from windows/gbn
|
||||
### Non-Linux OS
|
||||
|
||||
## Pitfalls
|
||||
The installation procedures described above have only been tested under Linux.
|
||||
|
||||
### [Git Proxy Configuration](https://gist.github.com/evantoli/f8c23a37eb3558ab8765)
|
||||
Below are some suggestions for getting the installation to work on other operating systems. Note that we are not able to provide support for these routes!
|
||||
|
||||
Unlike most other tools, git doesn't use the default proxy variables "http_proxy" and "https_proxy". To make git use a proxy, you will need to adjust the global git configuration:
|
||||
We believe that it is likely that installation would also work with FreeBSD and MacOS.
|
||||
|
||||
``` shell
|
||||
sudo git config --global http.proxy http://<your-proxy-host>:<your-proxy-port>;
|
||||
sudo git config --global https.proxy http://<your-proxy-host>:<your-proxy-port>;
|
||||
```
|
||||
> NOTE: Some proxies may require user and password authentication. You can adjust the settings like this: "http://<your-proxy-user>:<your-proxy-user-password>@<your-proxy-host>:<your-proxy-port>".
|
||||
> NOTE: It is also possible that a proxy requires https protocol, so you can replace this to.
|
||||
Under Windows, you have 2 options:
|
||||
|
||||
You can check that the updated configuration with
|
||||
- Virtual machine
|
||||
- WSL
|
||||
|
||||
``` shell
|
||||
sudo git config --global --list;
|
||||
```
|
||||
We have tested the installation procedure with an Ubuntu 22.04 guest system running on a VMware virtual machine. That worked flawlessly.
|
||||
|
||||
Installation under WSL ought to work, but we have not tested this.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Docker Daemon Proxy Configuration
|
||||
|
||||
Docker has a background daemon, responsible for downloading images and starting them. To configure the proxy for this daemon, use the systemctl command:
|
||||
Docker has a background daemon, responsible for downloading images and starting them. Sometimes, proxy configuration from your system won't carry over and it will fail to download images. In that case, configure the proxy for this daemon as described in the [official documentation](https://docs.docker.com).
|
||||
|
||||
``` shell
|
||||
sudo systemctl edit docker
|
||||
```
|
||||
|
||||
This will open your default editor allowing you to edit the docker system units configuration. Insert the following lines in the editor, replace <your-proxy-host> and <your-proxy-port> with the corresponding values for your machine and save the file:
|
||||
``` conf
|
||||
[Service]
|
||||
Environment=HTTP_PROXY=http://<your-proxy-host>:<your-proxy-port>
|
||||
Environment=HTTPS_PROXY=http://<your-proxy-host>:<your-proxy-port>
|
||||
Environment=FTP_PROXY=http://<your-proxy-host>:<your-proxy-port>
|
||||
```
|
||||
> NOTE: Some proxies may require user and password authentication. You can adjust the settings like this: "http://<your-proxy-user>:<your-proxy-user-password>@<your-proxy-host>:<your-proxy-port>".
|
||||
> NOTE: It is also possible that a proxy requires https protocol, so you can replace this to.
|
||||
### Monitoring
|
||||
|
||||
The file should now be at the location "/etc/systemd/system/docker.service.d/override.conf". You can proof check with
|
||||
``` shell
|
||||
cat /etc/systemd/system/docker.service.d/override.conf;
|
||||
```
|
||||
To keep all Bridgeheads up and working and detect any errors before a user does, a central monitoring
|
||||
|
||||
To make the configuration effective, you need to tell systemd to reload the configuration and restart the docker service:
|
||||
|
||||
``` shell
|
||||
sudo systemctl daemon-reload;
|
||||
sudo systemctl restart docker;
|
||||
```
|
||||
|
||||
## After the Installtion
|
||||
|
||||
After starting your bridgehead, visit the landing page under the hostname. If you singed your own ssl certificate, there is probable an error message. However, you can accept it as exception.
|
||||
|
||||
On this page, there are all important links to each component, central and local.
|
||||
|
||||
### Connector Administration
|
||||
|
||||
The Connector administration panel allows you to set many of the parameters regulating your Bridgehead. Most especially, it is the place where you can register your site with the Sample Locator. To access this page, proceed as follows:
|
||||
|
||||
* Open the Connector page: https://<hostname>/<project>-connector/
|
||||
* In the "Local components" box, click the "Samply Share" button.
|
||||
* A new page will be opened, where you will need to log in using the administrator credentials (admin/adminpass by default).
|
||||
* After log in, you will be taken to the administration dashboard, allowing you to configure the Connector.
|
||||
* If this is the first time you have logged in as an administrator, you are strongly recommended to set a more secure password! You can use the "Users" button on the dashboard to do this.
|
||||
|
||||
### GBA/BBMRI-ERIC
|
||||
|
||||
#### Register with a Directory
|
||||
|
||||
The [Directory][directory] is a BBMRI project that aims to catalog all biobanks in Europe and beyond. Each biobank is given its own unique ID and the Directory maintains counts of the number of donors and the number of samples held at each biobank. You are strongly encouraged to register with the Directory, because this opens the door to further services, such as the [Negotiator][negotiator].
|
||||
|
||||
Generally, you should register with the BBMRI national node for the country where your biobank is based. You can find a list of contacts for the national nodes [here](http://www.bbmri-eric.eu/national-nodes/). If your country is not in this list, or you have any questions, please contact the [BBMRI helpdesk](mailto:directory@helpdesk.bbmri-eric.eu). If your biobank is for COVID samples, you can also take advantage of an accelerated registration process [here](https://docs.google.com/forms/d/e/1FAIpQLSdIFfxADikGUf1GA0M16J0HQfc2NHJ55M_E47TXahju5BlFIQ).
|
||||
|
||||
Your national node will give you detailed instructions for registering, but for your information, here are the basic steps:
|
||||
|
||||
* Log in to the Directory for your country.
|
||||
* Add your biobank and enter its details, including contact information for a person involved in running the biobank.
|
||||
* You will need to create at least one collection.
|
||||
* Note the biobank ID and the collection ID that you have created - these will be needed when you register with the Locator (see below).
|
||||
|
||||
#### Register with a Locator
|
||||
|
||||
* Go to the registration page http://localhost:8082/admin/broker_list.xhtml.
|
||||
* To register with a Locator, enter the following values in the three fields under "Join new Searchbroker":
|
||||
* "Address": Depends on which Locator you want to register with:
|
||||
* `https://locator.bbmri-eric.eu/broker/`: BBMRI Locator production service (European).
|
||||
* `http://147.251.124.125:8088/broker/`: BBMRI Locator test service (European).
|
||||
* `https://samplelocator.bbmri.de/broker/`: GBA Sample Locator production service (German).
|
||||
* `https://samplelocator.test.bbmri.de/broker/`: GBA Sample Locator test service (German).
|
||||
* "Your email address": this is the email to which the registration token will be returned.
|
||||
* "Automatic reply": Set this to be `Total Size`
|
||||
* Click "Join" to start the registration process.
|
||||
* You should now have a list containing exactly one broker. You will notice that the "Status" box is empty.
|
||||
* Send an email to `feedback@germanbiobanknode.de` and let us know which of our Sample Locators you would like to register to. Please include the biobank ID and the collection ID from your Directory registration, if you have these available.
|
||||
* We will send you a registration token per email.
|
||||
* You will then re-open the Connector and enter the token into the "Status" box.
|
||||
* You should send us an email to let us know that you have done this.
|
||||
* We will then complete the registration process
|
||||
* We will email you to let you know that your biobank is now visible in the Sample Locator.
|
||||
|
||||
If you are a Sample Locator administrator, you will need to understand the [registration process](./SampleLocatorRegistration.md). Normal bridgehead admins do not need to worry about this.
|
||||
- Your Bridgehead itself will report relevant system events, such as successful/failed updates, restarts, performance metrics or version numbers.
|
||||
- Your Bridgehead is also monitored from the outside by your network's central components. For example, the federated search will regularly perform a black-box test by sending an empty query to your Bridgehead and checking if the results make sense.
|
||||
|
||||
In all monitoring cases, obviously no sensitive information is transmitted, in particular not any patient-related data. Aggregated data, e.g. total amount of datasets, may be transmitted for diagnostic purposes.
|
||||
|
||||
## License
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,8 @@
|
|||
services:
|
||||
directory_sync_service:
|
||||
image: "docker.verbis.dkfz.de/cache/samply/directory_sync_service"
|
||||
environment:
|
||||
DS_DIRECTORY_URL: ${DS_DIRECTORY_URL}
|
||||
DS_DIRECTORY_USER_NAME: ${DS_DIRECTORY_USER_NAME}
|
||||
DS_DIRECTORY_PASS_CODE: ${DS_DIRECTORY_PASS_CODE}
|
||||
DS_TIMER_CRON: ${DS_TIMER_CRON}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
#!/bin/bash
|
||||
|
||||
function dirSetup() {
|
||||
if [ -n "$DS_DIRECTORY_USER_NAME" ]; then
|
||||
log INFO "Directory sync setup detected -- will start directory sync service."
|
||||
OVERRIDE+=" -f ./$PROJECT/directory-sync-compose.yml"
|
||||
fi
|
||||
}
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
version: "3.7"
|
||||
|
||||
services:
|
||||
blaze:
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:latest
|
||||
container_name: bridgehead-bbmri-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-bbmri-blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx4g"
|
||||
LOG_LEVEL: "debug"
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "blaze-data:/app/data"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.blaze_ccp.rule=PathPrefix(`/bbmri-localdatamanagement`)"
|
||||
- "traefik.http.middlewares.ccp_b_strip.stripprefix.prefixes=/bbmri-localdatamanagement"
|
||||
- "traefik.http.services.blaze_ccp.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.blaze_ccp.middlewares=ccp_b_strip,auth"
|
||||
- "traefik.http.routers.blaze_ccp.tls=true"
|
||||
|
||||
focus:
|
||||
image: docker.verbis.dkfz.de/cache/samply/focus:main
|
||||
container_name: bridgehead-focus
|
||||
environment:
|
||||
API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
BEAM_APP_ID_LONG: focus.${PROXY_ID}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
BLAZE_URL: "http://bridgehead-bbmri-blaze:8080/fhir/"
|
||||
BEAM_PROXY_URL: http://beam-proxy:8081
|
||||
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
|
||||
beam-proxy:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
container_name: bridgehead-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${BROKER_URL}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
ROOTCERT_FILE: /conf/root.crt.pem
|
||||
secrets:
|
||||
- proxy.pem
|
||||
depends_on:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/bbmri/root.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
volumes:
|
||||
blaze-data:
|
||||
|
||||
secrets:
|
||||
proxy.pem:
|
||||
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
version: "3.7"
|
||||
|
||||
services:
|
||||
dnpm-beam-proxy:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
container_name: bridgehead-dnpm-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${DNPM_BROKER_URL}
|
||||
PROXY_ID: ${DNPM_PROXY_ID}
|
||||
APP_dnpm-connect_KEY: ${DNPM_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
ROOTCERT_FILE: /conf/root.crt.pem
|
||||
secrets:
|
||||
- proxy.pem
|
||||
depends_on:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/ccp/root-new.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
dnpm-beam-connect:
|
||||
depends_on: [ dnpm-beam-proxy ]
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-connect:dnpm
|
||||
container_name: bridgehead-dnpm-beam-connect
|
||||
environment:
|
||||
PROXY_URL: http://dnpm-beam-proxy:8081
|
||||
PROXY_APIKEY: ${DNPM_BEAM_SECRET_SHORT}
|
||||
APP_ID: dnpm-connect.${DNPM_PROXY_ID}
|
||||
DISCOVERY_URL: "./conf/central_targets.json"
|
||||
LOCAL_TARGETS_FILE: "./conf/connect_targets.json"
|
||||
HTTP_PROXY: http://forward_proxy:3128
|
||||
HTTPS_PROXY: http://forward_proxy:3128
|
||||
NO_PROXY: dnpm-beam-proxy,dnpm-backend
|
||||
RUST_LOG: ${RUST_LOG:-info}
|
||||
volumes:
|
||||
- /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
|
||||
- /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)"
|
||||
- "traefik.http.middlewares.dnpm-connect-strip.stripprefix.prefixes=/dnpm-connect"
|
||||
- "traefik.http.routers.dnpm-connect.middlewares=dnpm-connect-strip"
|
||||
- "traefik.http.services.dnpm-connect.loadbalancer.server.port=8062"
|
||||
- "traefik.http.routers.dnpm-connect.tls=true"
|
||||
|
||||
secrets:
|
||||
proxy.pem:
|
||||
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
#!/bin/bash
|
||||
|
||||
if [ -n "${ENABLE_DNPM}" ]; then
|
||||
log DEBUG "DNPM setup detected (Beam.Connect) -- will start Beam and Beam.Connect for DNPM."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/dnpm-compose.yml"
|
||||
|
||||
# Set variables required for Beam-Connect
|
||||
DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
DNPM_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
DNPM_BROKER_ID="broker.ccp-it.dktk.dkfz.de"
|
||||
DNPM_BROKER_URL="https://${DNPM_BROKER_ID}"
|
||||
DNPM_PROXY_ID="${SITE_ID}.${DNPM_BROKER_ID}"
|
||||
fi
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUMy/n0zFRihhVR3aAD54LumzeYdwwDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjIxMDI1MDczNTA4WhcNMzIx
|
||||
MDIyMDczNTM3WjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAL3qWliHIlIT1Qlsyq/NKJ1uj6/AF0STNg5NTNpb
|
||||
Xqe5rmUqs6jmQepputGStBVe5TthFw56whISv9FqD5s1PZUGyFikW1pJUnF7ZYRf
|
||||
MfrJHRi1vUnD3Gw36FCot+i6BAxfw/rdp9hoqFZ6erRkULLaYZ5S2cDHN0DWc18V
|
||||
3VgZ66ah8QXSx7ERRNa/eWRkHrPIYhyVSoKuyZfvbVgsYZADSlviCgIHPrGLerLr
|
||||
ylNUyuTxJ5RKStOwPn7A+Jp7nRT+MRh9BphA7s6NuK9h+eVe1DiLbIETWyCEfN3Y
|
||||
INpunatn3QDhqOIfNcuBArjsAj7mg8l5KNba8nUP4v0EJYECAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMvc5Fizz1vO
|
||||
MEG3MIsy7UY69ZNIMB8GA1UdIwQYMBaAFMvc5Fizz1vOMEG3MIsy7UY69ZNIMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQBb8a5su820
|
||||
h8JStJC+KpvXmDrGkwx9bHlEZMgQQejIrwPLEbA32KBvNxdoUxF9q1Y773MKdqbc
|
||||
cCJwzQXE/NPZ13hCGrEIXs8DgH52GhEB5592k5/bRNcAvUwbZSXPPiT0rgq/eUOt
|
||||
BYhgN0ov7h1MC5L6CYB/rQwqck7JPlmrXTkh2gix4/dEdBRzsHsn/xlo8ay5QYHG
|
||||
rx2Adit76eZu/MJoJNzl1r8MPxLqyAie3KcIU54A+UMozLrWEQP/TyOyWZdjUjJt
|
||||
cBYgkKJTjwdRhc+ehI3kFo7b/a/Z/jl9szKsAPHozMixSi8lGnsYwN80oqeRvT7h
|
||||
wcMUK+igv3/K
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
BROKER_ID=broker.bbmri.samply.de
|
||||
BROKER_URL=https://${BROKER_ID}
|
||||
PROXY_ID=${SITE_ID}.${BROKER_ID}
|
||||
FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
FOCUS_RETRY_COUNT=32
|
||||
SUPPORT_EMAIL=bridgehead@helpdesk.bbmri-eric.eu
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
|
||||
for module in $PROJECT/modules/*.sh
|
||||
do
|
||||
log DEBUG "sourcing $module"
|
||||
source $module
|
||||
done
|
||||
|
||||
# This will load directory-sync setup.
|
||||
source $PROJECT/directory-sync.sh
|
||||
dirSetup
|
||||
87
bridgehead
87
bridgehead
|
|
@ -29,10 +29,10 @@ case "$PROJECT" in
|
|||
ccp)
|
||||
#nothing extra to do
|
||||
;;
|
||||
nngm)
|
||||
bbmri)
|
||||
#nothing extra to do
|
||||
;;
|
||||
gbn)
|
||||
minimal)
|
||||
#nothing extra to do
|
||||
;;
|
||||
*)
|
||||
|
|
@ -41,29 +41,92 @@ case "$PROJECT" in
|
|||
;;
|
||||
esac
|
||||
|
||||
# Load variables from /etc/bridgehead and /srv/docker/bridgehead
|
||||
set -a
|
||||
source /etc/bridgehead/$PROJECT.conf
|
||||
fetchVarsFromVaultByFile /etc/bridgehead/$PROJECT.conf || exit 1
|
||||
[ -e ./$PROJECT/vars ] && source ./$PROJECT/vars
|
||||
set +a
|
||||
loadVars() {
|
||||
# Load variables from /etc/bridgehead and /srv/docker/bridgehead
|
||||
set -a
|
||||
source /etc/bridgehead/$PROJECT.conf || fail_and_report 1 "/etc/bridgehead/$PROJECT.conf not found"
|
||||
if [ -e /etc/bridgehead/$PROJECT.local.conf ]; then
|
||||
log INFO "Applying /etc/bridgehead/$PROJECT.local.conf"
|
||||
source /etc/bridgehead/$PROJECT.local.conf || fail_and_report 1 "Found /etc/bridgehead/$PROJECT.local.conf but failed to import"
|
||||
fi
|
||||
fetchVarsFromVaultByFile /etc/bridgehead/$PROJECT.conf || fail_and_report 1 "Unable to fetchVarsFromVaultByFile"
|
||||
[ -e ./$PROJECT/vars ] && source ./$PROJECT/vars
|
||||
set +a
|
||||
|
||||
OVERRIDE=${OVERRIDE:=""}
|
||||
# minimal contains shared components, so potential overrides must be applied in every project
|
||||
if [ -f "minimal/docker-compose.override.yml" ]; then
|
||||
log INFO "Applying Bridgehead common components override (minimal/docker-compose.override.yml)"
|
||||
OVERRIDE+=" -f ./minimal/docker-compose.override.yml"
|
||||
fi
|
||||
if [ -f "$PROJECT/docker-compose.override.yml" ]; then
|
||||
log INFO "Applying $PROJECT/docker-compose.override.yml"
|
||||
OVERRIDE+=" -f ./$PROJECT/docker-compose.override.yml"
|
||||
fi
|
||||
detectCompose
|
||||
setHostname
|
||||
}
|
||||
|
||||
case "$ACTION" in
|
||||
start)
|
||||
loadVars
|
||||
hc_send log "Bridgehead $PROJECT startup: Checking requirements ..."
|
||||
checkRequirements
|
||||
exec docker-compose -f ./$PROJECT/docker-compose.yml up
|
||||
hc_send log "Bridgehead $PROJECT startup: Requirements checked out. Now starting bridgehead ..."
|
||||
export LDM_LOGIN=$(getLdmPassword)
|
||||
exec $COMPOSE -p $PROJECT -f ./minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE up --abort-on-container-exit
|
||||
;;
|
||||
stop)
|
||||
exec docker-compose -f ./$PROJECT/docker-compose.yml down
|
||||
loadVars
|
||||
# HACK: This is temporarily to properly shut down false bridgehead instances (bridgehead-ccp instead ccp)
|
||||
$COMPOSE -p bridgehead-$PROJECT -f ./minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE down
|
||||
exec $COMPOSE -p $PROJECT -f ./minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE down
|
||||
;;
|
||||
is-running)
|
||||
bk_is_running
|
||||
exit $?
|
||||
;;
|
||||
update)
|
||||
loadVars
|
||||
exec ./lib/update-bridgehead.sh $PROJECT
|
||||
;;
|
||||
install)
|
||||
exec ./lib/setup-bridgehead-units.sh $PROJECT
|
||||
source ./lib/prepare-system.sh NODEV
|
||||
loadVars
|
||||
exec ./lib/install-bridgehead.sh $PROJECT
|
||||
;;
|
||||
dev-install)
|
||||
exec ./lib/prepare-system.sh DEV
|
||||
loadVars
|
||||
exec ./lib/install-bridgehead.sh $PROJECT
|
||||
;;
|
||||
uninstall)
|
||||
exec ./lib/remove-bridgehead-units.sh $PROJECT
|
||||
exec ./lib/uninstall-bridgehead.sh $PROJECT
|
||||
;;
|
||||
enroll)
|
||||
loadVars
|
||||
|
||||
MANUAL_PROXY_ID="${3:-$PROXY_ID}"
|
||||
if [ -z "$MANUAL_PROXY_ID" ]; then
|
||||
log ERROR "No Proxy ID set"
|
||||
exit 1
|
||||
else
|
||||
log INFO "Enrolling Beam Proxy Id $MANUAL_PROXY_ID"
|
||||
fi
|
||||
|
||||
if [ -z "$SUPPORT_EMAIL" ]; then
|
||||
EMAIL_PARAM=""
|
||||
else
|
||||
EMAIL_PARAM="--admin-email $SUPPORT_EMAIL"
|
||||
fi
|
||||
|
||||
docker run --rm -ti -v /etc/bridgehead/pki:/etc/bridgehead/pki samply/beam-enroll:latest --output-file $PRIVATEKEYFILENAME --proxy-id $MANUAL_PROXY_ID $EMAIL_PARAM
|
||||
chmod 600 $PRIVATEKEYFILENAME
|
||||
;;
|
||||
preRun | preUpdate)
|
||||
fixPermissions
|
||||
;;
|
||||
postRun | postUpdate)
|
||||
;;
|
||||
*)
|
||||
printUsage
|
||||
|
|
|
|||
|
|
@ -1,58 +1,8 @@
|
|||
version: "3.7"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
container_name: bridgehead-traefik
|
||||
image: traefik:latest
|
||||
command:
|
||||
- --entrypoints.web.address=:80
|
||||
- --entrypoints.websecure.address=:443
|
||||
- --providers.docker=true
|
||||
- --providers.file.watch=true
|
||||
- --providers.file.directory=/configuration/
|
||||
- --api.dashboard=true
|
||||
- --accesslog=true # print access-logs
|
||||
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
||||
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
||||
labels:
|
||||
- "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
- "traefik.http.routers.dashboard.entrypoints=websecure"
|
||||
- "traefik.http.routers.dashboard.service=api@internal"
|
||||
- "traefik.http.routers.dashboard.tls=true"
|
||||
- "traefik.http.routers.dashboard.middlewares=auth"
|
||||
- "traefik.http.middlewares.auth.basicauth.users=${bc_auth_users}"
|
||||
ports:
|
||||
- 80:80
|
||||
- 443:443
|
||||
volumes:
|
||||
- ../certs:/tools/certs
|
||||
- ../lib/traefik-configuration/:/configuration
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
|
||||
forward_proxy:
|
||||
container_name: bridgehead-forward-proxy
|
||||
image: samply/bridgehead-forward-proxy:develop
|
||||
environment:
|
||||
http_proxy: ${HTTP_PROXY_URL}
|
||||
https_proxy: ${HTTPS_PROXY_URL}
|
||||
volumes:
|
||||
- "bridgehead-proxy:/var/log/squid"
|
||||
|
||||
landing:
|
||||
container_name: bridgehead-landingpage
|
||||
image: samply/bridgehead-landingpage:master
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.landing.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.landing.tls=true"
|
||||
environment:
|
||||
HOST: ${HOST}
|
||||
PROJECT: ${PROJECT}
|
||||
SITE_NAME: ${SITE_NAME}
|
||||
|
||||
blaze:
|
||||
image: "samply/blaze:0.17"
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:latest
|
||||
container_name: bridgehead-ccp-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-ccp-blaze:8080"
|
||||
|
|
@ -60,54 +10,52 @@ services:
|
|||
LOG_LEVEL: "debug"
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "blaze-data:/app/data"
|
||||
- "blaze-data:/app/data"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.middlewares.ccp-auth.basicauth.users=${bc_auth_users}"
|
||||
- "traefik.http.routers.blaze_ccp.rule=PathPrefix(`/ccp-localdatamanagement`)"
|
||||
- "traefik.http.middlewares.ccp_b_strip.stripprefix.prefixes=/ccp-localdatamanagement"
|
||||
- "traefik.http.services.blaze_ccp.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.blaze_ccp.middlewares=ccp_b_strip,ccp-auth"
|
||||
- "traefik.http.routers.blaze_ccp.middlewares=ccp_b_strip,auth"
|
||||
- "traefik.http.routers.blaze_ccp.tls=true"
|
||||
|
||||
spot:
|
||||
image: samply/spot:latest
|
||||
focus:
|
||||
image: docker.verbis.dkfz.de/cache/samply/focus:main
|
||||
container_name: bridgehead-focus
|
||||
environment:
|
||||
SECRET: ${SPOT_BEAM_SECRET_LONG}
|
||||
APPID: spot
|
||||
API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
BEAM_APP_ID_LONG: focus.${PROXY_ID}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
LDM_URL: http://bridgehead-ccp-blaze:8080/fhir
|
||||
BEAM_PROXY: http://beam-proxy:8081
|
||||
BLAZE_URL: "http://bridgehead-ccp-blaze:8080/fhir/"
|
||||
BEAM_PROXY_URL: http://beam-proxy:8081
|
||||
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
|
||||
OBFUSCATE: "no"
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
beam-proxy:
|
||||
image: "samply/beam-proxy:develop"
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
container_name: bridgehead-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${BROKER_URL}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
APP_0_ID: spot
|
||||
APP_0_KEY: ${SPOT_BEAM_SECRET_SHORT}
|
||||
APP_1_ID: report-hub
|
||||
APP_1_KEY: ${REPORTHUB_BEAM_SECRET_SHORT}
|
||||
APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
RUST_LOG: debug
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
ROOTCERT_FILE: /conf/root.crt.pem
|
||||
secrets:
|
||||
- proxy.pem
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
depends_on:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
|
||||
volumes:
|
||||
blaze-data:
|
||||
bridgehead-proxy:
|
||||
|
||||
secrets:
|
||||
proxy.pem:
|
||||
|
|
|
|||
|
|
@ -0,0 +1,30 @@
|
|||
version: "3.7"
|
||||
|
||||
services:
|
||||
beam-proxy:
|
||||
environment:
|
||||
APP_dnpm-connect_KEY: ${DNPM_BEAM_SECRET_SHORT}
|
||||
dnpm-beam-connect:
|
||||
depends_on: [ beam-proxy ]
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-connect:dnpm
|
||||
container_name: bridgehead-dnpm-beam-connect
|
||||
environment:
|
||||
PROXY_URL: http://beam-proxy:8081
|
||||
PROXY_APIKEY: ${DNPM_BEAM_SECRET_SHORT}
|
||||
APP_ID: dnpm-connect.${PROXY_ID}
|
||||
DISCOVERY_URL: "./conf/central_targets.json"
|
||||
LOCAL_TARGETS_FILE: "./conf/connect_targets.json"
|
||||
HTTP_PROXY: "http://forward_proxy:3128"
|
||||
HTTPS_PROXY: "http://forward_proxy:3128"
|
||||
NO_PROXY: beam-proxy,dnpm-backend
|
||||
RUST_LOG: ${RUST_LOG:-info}
|
||||
volumes:
|
||||
- /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
|
||||
- /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)"
|
||||
- "traefik.http.middlewares.dnpm-connect-strip.stripprefix.prefixes=/dnpm-connect"
|
||||
- "traefik.http.routers.dnpm-connect.middlewares=dnpm-connect-strip"
|
||||
- "traefik.http.services.dnpm-connect.loadbalancer.server.port=8062"
|
||||
- "traefik.http.routers.dnpm-connect.tls=true"
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
#!/bin/bash
|
||||
|
||||
if [ -n "${ENABLE_DNPM}" ]; then
|
||||
log DEBUG "DNPM setup detected (Beam.Connect) -- will start Beam.Connect for DNPM."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/dnpm-compose.yml"
|
||||
|
||||
# Set variables required for Beam-Connect
|
||||
DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
DNPM_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
fi
|
||||
|
|
@ -0,0 +1,58 @@
|
|||
version: "3.7"
|
||||
services:
|
||||
id-manager:
|
||||
image: docker.verbis.dkfz.de/bridgehead/magicpl
|
||||
container_name: bridgehead-id-manager
|
||||
environment:
|
||||
TOMCAT_REVERSEPROXY_FQDN: ${HOST}
|
||||
TOMCAT_REVERSEPROXY_SSL: "true"
|
||||
MAGICPL_SITE: ${IDMANAGEMENT_FRIENDLY_ID}
|
||||
MAGICPL_ALLOWED_ORIGINS: https://${HOST}
|
||||
MAGICPL_LOCAL_PATIENTLIST_APIKEY: ${IDMANAGER_LOCAL_PATIENTLIST_APIKEY}
|
||||
MAGICPL_CENTRAXX_APIKEY: ${IDMANAGER_UPLOAD_APIKEY}
|
||||
MAGICPL_CONNECTOR_APIKEY: ${IDMANAGER_READ_APIKEY}
|
||||
MAGICPL_CENTRAL_PATIENTLIST_APIKEY: ${IDMANAGER_CENTRAL_PATIENTLIST_APIKEY}
|
||||
MAGICPL_CONTROLNUMBERGENERATOR_APIKEY: ${IDMANAGER_CONTROLNUMBERGENERATOR_APIKEY}
|
||||
MAGICPL_OIDC_CLIENT_ID: ${IDMANAGER_AUTH_CLIENT_ID}
|
||||
MAGICPL_OIDC_CLIENT_SECRET: ${IDMANAGER_AUTH_CLIENT_SECRET}
|
||||
depends_on:
|
||||
- patientlist
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.id-manager.rule=PathPrefix(`/id-manager`)"
|
||||
- "traefik.http.services.id-manager.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.id-manager.tls=true"
|
||||
|
||||
patientlist:
|
||||
image: docker.verbis.dkfz.de/bridgehead/mainzelliste
|
||||
container_name: bridgehead-patientlist
|
||||
environment:
|
||||
- TOMCAT_REVERSEPROXY_FQDN=${HOST}
|
||||
- ML_SITE=${IDMANAGEMENT_FRIENDLY_ID}
|
||||
- ML_DB_PASS=${PATIENTLIST_POSTGRES_PASSWORD}
|
||||
- ML_API_KEY=${IDMANAGER_LOCAL_PATIENTLIST_APIKEY}
|
||||
- ML_UPLOAD_API_KEY=${IDMANAGER_UPLOAD_APIKEY}
|
||||
# Add Variables from /etc/patientlist-id-generators.env
|
||||
- PATIENTLIST_SEEDS_TRANSFORMED
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.patientlist.rule=PathPrefix(`/patientlist`)"
|
||||
- "traefik.http.services.patientlist.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.patientlist.tls=true"
|
||||
depends_on:
|
||||
- patientlist-db
|
||||
|
||||
patientlist-db:
|
||||
image: docker.verbis.dkfz.de/cache/postgres:15.1-alpine
|
||||
container_name: bridgehead-patientlist-db
|
||||
environment:
|
||||
POSTGRES_USER: "mainzelliste"
|
||||
POSTGRES_DB: "mainzelliste"
|
||||
POSTGRES_PASSWORD: ${PATIENTLIST_POSTGRES_PASSWORD}
|
||||
volumes:
|
||||
- "patientlist-db-data:/var/lib/postgresql/data"
|
||||
# NOTE: Add backups here. This is only imported if /var/lib/bridgehead/data/patientlist/ is empty!!!
|
||||
- "/tmp/bridgehead/patientlist/:/docker-entrypoint-initdb.d/"
|
||||
|
||||
volumes:
|
||||
patientlist-db-data:
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
#!/bin/bash
|
||||
|
||||
function idManagementSetup() {
|
||||
if [ -n "$IDMANAGER_UPLOAD_APIKEY" ]; then
|
||||
log INFO "id-management setup detected -- will start id-management (mainzelliste & magicpl)."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/id-management-compose.yml"
|
||||
|
||||
# Auto Generate local Passwords
|
||||
PATIENTLIST_POSTGRES_PASSWORD="$(echo \"id-management-module-db-password-salt\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
IDMANAGER_LOCAL_PATIENTLIST_APIKEY="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
|
||||
# Transform Seeds Configuration to pass it to the Mainzelliste Container
|
||||
PATIENTLIST_SEEDS_TRANSFORMED="$(declare -p PATIENTLIST_SEEDS | tr -d '\"' | sed 's/\[/\[\"/g' | sed 's/\]/\"\]/g')"
|
||||
|
||||
# Ensure old ids are working !!!
|
||||
export IDMANAGEMENT_FRIENDLY_ID=$(legacyIdMapping "$SITE_ID")
|
||||
fi
|
||||
}
|
||||
|
||||
# Transform into single string array, e.g. 'dktk-test' to 'dktk test'
|
||||
# Usage: transformToSingleStringArray 'dktk-test' -> 'dktk test'
|
||||
function transformToSingleStringArray() {
|
||||
echo "${1//-/ }";
|
||||
}
|
||||
|
||||
# Ensure all Words are Uppercase
|
||||
# Usage: transformToUppercase 'dktk test' -> 'Dktk Test'
|
||||
function transformToUppercase() {
|
||||
result="";
|
||||
for word in $1; do
|
||||
result+=" ${word^}";
|
||||
done
|
||||
echo "$result";
|
||||
}
|
||||
|
||||
# Handle all execeptions from the norm (e.g LMU, TUM)
|
||||
# Usage: applySpecialCases 'Muenchen Lmu Test' -> 'Muenchen LMU Test'
|
||||
function applySpecialCases() {
|
||||
result="$1";
|
||||
result="${result/Lmu/LMU}";
|
||||
result="${result/Tum/TUM}";
|
||||
echo "$result";
|
||||
}
|
||||
|
||||
# Transform current siteids to legacy version
|
||||
# Usage: legacyIdMapping "dktk-test" -> "DktkTest"
|
||||
function legacyIdMapping() {
|
||||
single_string_array=$(transformToSingleStringArray "$1");
|
||||
uppercase_string=$(transformToUppercase "$single_string_array");
|
||||
normalized_string=$(applySpecialCases "$uppercase_string");
|
||||
echo "$normalized_string" | tr -d ' '
|
||||
}
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
# Module: Id-Management
|
||||
This module provides integration with the CCP-Pseudonymiziation Service. To learn more on the backgrounds of this service, you can refer to the [CCP Data Protection Concept](https://dktk.dkfz.de/klinische-plattformen/documents-download).
|
||||
|
||||
## Getting Started
|
||||
The following configuration variables are added to your sites-configuration repository:
|
||||
|
||||
```
|
||||
IDMANAGER_UPLOAD_APIKEY="<random-string>"
|
||||
IDMANAGER_READ_APIKEY="<random-string>"
|
||||
IDMANAGER_CENTRAL_PATIENTLIST_APIKEY="<given-to-you-by-ccp-it>"
|
||||
IDMANAGER_CONTROLNUMBERGENERATOR_APIKEY="<given-to-you-by-ccp-it>"
|
||||
IDMANAGER_AUTH_CLIENT_ID="<given-to-you-by-ccp-it>"
|
||||
IDMANAGER_AUTH_CLIENT_SECRET="<given-to-you-by-ccp-it>"
|
||||
|
||||
IDMANAGER_SEEDS_BK="<three-numbers>"
|
||||
IDMANAGER_SEEDS_MDS="<three-numbers>"
|
||||
IDMANAGER_SEEDS_DKTK000001985="<three-numbers>"
|
||||
```
|
||||
> NOTE: Additionally, the CCP-IT adds lines declaring the `PATIENTLIST_SEEDS` array in your site configuration. This will contain the seeds for the different id-generators used in all projects.
|
||||
|
||||
Once your Bridgehead is updated and restarted, you're all set!
|
||||
|
||||
## Additional information you may want to know
|
||||
|
||||
### Services
|
||||
|
||||
Upon configuration, the Bridgehead will spawn the following services:
|
||||
|
||||
- The `bridgehead-id-manager` at https://bridgehead.local/id-manager, provides a common interface for creating pseudonyms in the bridgehead.
|
||||
- The `bridgehead-patientlist` at https://bridgehead.local/patientlist is a local instance of the open-source software [Mainzelliste](https://mainzelliste.de). This service's primary task is to map patients IDAT to pseudonyms identifying them along the different CCP projects.
|
||||
- The `bridgehead-patientlist-db` is only accessible within the Bridgehead itself. This is a local postgresql instance storing the database for `bridgehead-patientlist`. The data is persisted as a named volume `patientlist-db-data`.
|
||||
|
||||
### How to import an existing database (e.g from Legacy Windows or from Backups)
|
||||
First you must shutdown your local bridgehead instance:
|
||||
```
|
||||
systemctl stop bridgehead@ccp
|
||||
```
|
||||
|
||||
Next you need to remove the current patientlist database:
|
||||
```
|
||||
docker volume rm patientlist-db-data;
|
||||
```
|
||||
|
||||
Third, you need to place your postgres dump in the import directory `/tmp/bridgehead/patientlist/some-dump.sql`. This will only be imported, then the volume `patientlist-db-data` was removed previously.
|
||||
> NOTE: Please create the postgres dump with the options "--no-owner" and "--no-privileges". Additionally ensure the dump is created in the plain format (SQL).
|
||||
|
||||
After this, you can restart your bridgehead and the dump will be imported:
|
||||
```
|
||||
systemctl start bridgehead@ccp
|
||||
```
|
||||
|
||||
### How to connect your local data-management
|
||||
Typically, the sites connect their local data-management for the pseudonym creation with the id-management in the bridgehead. In the following two sections, you can read where you can change the configuration:
|
||||
#### Sites using CentraXX
|
||||
On your CentraXX Server, you need to change following settings in the "centraxx-dev.properties" file.
|
||||
```
|
||||
dktk.idmanagement.url=https://<your-linux-bk-host>/id-manager/translator/getId
|
||||
dktk.idmanagement.apiKey=<your-setting-for-IDMANAGER_UPLOAD_APIKEY>
|
||||
```
|
||||
They typically already exist, but need to be changed to the new values!
|
||||
#### Sites using ADT2FHIR
|
||||
@Pierre
|
||||
|
||||
|
||||
### How to connect the legacy windows bridgehead
|
||||
You need to change the configuration file "..." of your Windows Bridgehead. TODO...
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
version: "3.7"
|
||||
|
||||
services:
|
||||
mtba:
|
||||
image: docker.verbis.dkfz.de/cache/samply/mtba:develop
|
||||
container_name: bridgehead-mtba
|
||||
environment:
|
||||
BLAZE_STORE_URL: http://blaze:8080
|
||||
# NOTE: Aktuell Berechtigungen wie MagicPL!!!
|
||||
# TODO: Add separate ApiKey to MagicPL only for MTBA!
|
||||
ID_MANAGER_API_KEY: ${IDMANAGER_UPLOAD_APIKEY}
|
||||
ID_MANAGER_PSEUDONYM_ID_TYPE: BK_${IDMANAGEMENT_FRIENDLY_ID}_L-ID
|
||||
ID_MANAGER_URL: http://id-manager:8080/id-manager
|
||||
PATIENT_CSV_FIRST_NAME_HEADER: ${MTBA_PATIENT_CSV_FIRST_NAME_HEADER}
|
||||
PATIENT_CSV_LAST_NAME_HEADER: ${MTBA_PATIENT_CSV_LAST_NAME_HEADER}
|
||||
PATIENT_CSV_GENDER_HEADER: ${MTBA_PATIENT_CSV_GENDER_HEADER}
|
||||
PATIENT_CSV_BIRTHDAY_HEADER: ${MTBA_PATIENT_CSV_BIRTHDAY_HEADER}
|
||||
CBIOPORTAL_URL: http://cbioportal:8080
|
||||
FILE_CHARSET: ${MTBA_FILE_CHARSET}
|
||||
FILE_END_OF_LINE: ${MTBA_FILE_END_OF_LINE}
|
||||
CSV_DELIMITER: ${MTBA_CSV_DELIMITER}
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.mtba.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.mtba.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.mtba.tls=true"
|
||||
volumes:
|
||||
- /tmp/bridgehead/mtba/input:/app/input
|
||||
- /tmp/bridgehead/mtba/persist:/app/persist
|
||||
|
||||
# TODO: Include CBioPortal in Deployment ...
|
||||
# NOTE: CBioPortal can't load data while the system is running. So after import of data bridgehead needs to be restarted!
|
||||
# TODO: Find a trigger to let mtba signal a restart for CBioPortal
|
||||
|
||||
volumes:
|
||||
mtba-data:
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
version: "3.7"
|
||||
volumes:
|
||||
nngm-rest:
|
||||
|
||||
services:
|
||||
connector:
|
||||
container_name: bridgehead-connector
|
||||
image: docker.verbis.dkfz.de/ccp/nngm-rest:main
|
||||
environment:
|
||||
CTS_MAGICPL_API_KEY: ${NNGM_MAGICPL_APIKEY}
|
||||
CTS_API_KEY: ${NNGM_CTS_APIKEY}
|
||||
CRYPT_KEY: ${NNGM_CRYPTKEY}
|
||||
#CTS_MAGICPL_SITE: ${SITE_ID}TODO
|
||||
restart: always
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.connector.rule=PathPrefix(`/nngm-connector`)"
|
||||
- "traefik.http.middlewares.connector_strip.stripprefix.prefixes=/nngm-connector"
|
||||
- "traefik.http.services.connector.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.connector.tls=true"
|
||||
- "traefik.http.routers.connector.middlewares=connector_strip,auth"
|
||||
volumes:
|
||||
- nngm-rest:/var/log
|
||||
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
#!/bin/bash
|
||||
##nNGM vars:
|
||||
#NNGM_MAGICPL_APIKEY
|
||||
#NNGM_CTS_APIKEY
|
||||
#NNGM_CRYPTKEY
|
||||
|
||||
function nngmSetup() {
|
||||
if [ -n "$NNGM_CTS_APIKEY" ]; then
|
||||
log INFO "nNGM setup detected -- will start nNGM Connector."
|
||||
OVERRIDE+=" -f ./$PROJECT/nngm-compose.yml"
|
||||
fi
|
||||
}
|
||||
|
||||
function mtbaSetup() {
|
||||
# TODO: Check if ID-Management Module is activated!
|
||||
if [ -n "$ENABLE_MTBA" ];then
|
||||
log INFO "MTBA setup detected -- will start MTBA Service and CBioPortal."
|
||||
if [ ! -n "$IDMANAGER_UPLOAD_APIKEY" ]; then
|
||||
log ERROR "Detected MTBA Module configuration but ID-Management Module seems not to be configured!"
|
||||
exit 1;
|
||||
fi
|
||||
OVERRIDE+=" -f ./$PROJECT/mtba-compose.yml"
|
||||
fi
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUN7yzueIZzwpe8PaPEIMY8zoH+eMwDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjMwNTIzMTAxNzIzWhcNMzMw
|
||||
NTIwMTAxNzUzWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAN5JAj+HydSGaxvA0AOcrXVTZ9FfsH0cMVBlQb72
|
||||
bGZgrRvkqtB011TNXZfsHl7rPxCY61DcsDJfFq3+8VHT+S9HE0qV1bEwP+oA3xc4
|
||||
Opq77av77cNNOqDC7h+jyPhHcUaE33iddmrH9Zn2ofWTSkKHHu3PAe5udCrc2QnD
|
||||
4PLRF6gqiEY1mcGknJrXj1ff/X0nRY/m6cnHNXz0Cvh8oPOtbdfGgfZjID2/fJNP
|
||||
fNoNKqN+5oJAZ+ZZ9id9rBvKj1ivW3F2EoGjZF268SgZzc5QrM/D1OpSBQf5SF/V
|
||||
qUPcQTgt9ry3YR+SZYazLkfKMEOWEa0WsqJVgXdQ6FyergcCAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEa70kcseqU5
|
||||
bHx2zSt4bG21HokhMB8GA1UdIwQYMBaAFEa70kcseqU5bHx2zSt4bG21HokhMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCGmE7NXW4T
|
||||
6J4mV3b132cGEMD7grx5JeiXK5EHMlswUS+Odz0NcBNzhUHdG4WVMbrilHbI5Ua+
|
||||
6jdKx5WwnqzjQvElP0MCw6sH/35gbokWgk1provOP99WOFRsQs+9Sm8M2XtMf9HZ
|
||||
m3wABwU/O+dhZZ1OT1PjSZD0OKWKqH/KvlsoF5R6P888KpeYFiIWiUNS5z21Jm8A
|
||||
ZcllJjiRJ60EmDwSUOQVJJSMOvtr6xTZDZLtAKSN8zN08lsNGzyrFwqjDwU0WTqp
|
||||
scMXEGBsWQjlvxqDnXyljepR0oqRIjOvgrWaIgbxcnu98tK/OdBGwlAPKNUW7Crr
|
||||
vO+eHxl9iqd4
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUMeGRSrNPhRdQ1tU7uK5+lUa4f38wDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjIwOTI5MTQxMjU1WhcNMzIw
|
||||
OTI2MTQxMzI1WjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAMYyroOUeb27mYzClOrjCmgIceLalsFA0aVCh5mZ
|
||||
KtP8+1U3oq/7exP30gXiJojxW7xoerfyQY9s0Sz5YYbxYbuskFOYEtyAILB/pxgd
|
||||
+k+J3tlZKolpfmo7WT5tZiHxH/zjrtAYGnuB2xPHRMCWh/tHYrELgXQuilNol24y
|
||||
GBa1plTlARy0aKEDUHp87WLhD2qH7B8sFlLgo0+gunE1UtR2HMSPF45w3VXszyG6
|
||||
fJNrAj0yPnKy3Dm1BMO3jDO2e0A9lCQ71a4j4TeKePfCk1xCArSu6PpiwiacKplF
|
||||
c6CRR6KrWVm2g+8Y2hFcOBG/Py2xusm3PWbpylGq6vtFRkkCAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEFxD6BQwQO5
|
||||
xsJ+3cvZypsnh6dDMB8GA1UdIwQYMBaAFEFxD6BQwQO5xsJ+3cvZypsnh6dDMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQB5zTeIhV/3
|
||||
3Am6O144EFtnIeaZ2w0D6aEHqHAZp50vJv3+uQfOliCOzgw7VDxI4Zz2JALjlR/i
|
||||
uOYHsu3YIRMIOmPOjqrdDJa6auB0ufL4oUPfCRln7Fh0f3JVlz3BUoHsSDt949p4
|
||||
g0nnsciL2JHuzlqjn7Jyt3L7dAHrlFKulCcuidG5D3cqXrRCbF83f+k3TC/HRiNd
|
||||
25oMi7I4MP/SOCdfQGUGIsHIf/0hSm3pNjDOrC/XuI/8gh2f5io+Y8V+hMwMBcm4
|
||||
JbH8bdyBB+EIhsNbTwf2MWntD5bmg47sf7hh23aNvKXI67Li1pTI2t1CqiGnFR0U
|
||||
fCEpeaEAHs0k
|
||||
-----END CERTIFICATE-----
|
||||
23
ccp/vars
23
ccp/vars
|
|
@ -1,7 +1,22 @@
|
|||
BROKER_ID=broker.dev.ccp-it.dktk.dkfz.de
|
||||
BROKER_URL=https://${BROKER_ID}
|
||||
PROXY_ID=${SITE_ID}.${BROKER_ID}
|
||||
SPOT_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
SPOT_BEAM_SECRET_LONG="ApiKey spot.${PROXY_ID} ${SPOT_BEAM_SECRET_SHORT}"
|
||||
REPORTHUB_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
REPORTHUB_BEAM_SECRET_LONG="ApiKey report-hub.${PROXY_ID} ${REPORTHUB_BEAM_SECRET_SHORT}"
|
||||
FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
FOCUS_RETRY_COUNT=32
|
||||
SUPPORT_EMAIL=support-ccp@dkfz-heidelberg.de
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
|
||||
# This will load id-management setup. Effective only if id-management configuration is defined.
|
||||
source $PROJECT/modules/id-management-setup.sh
|
||||
idManagementSetup
|
||||
# This will load nngm setup. Effective only if nngm configuration is defined.
|
||||
source $PROJECT/nngm-setup.sh
|
||||
nngmSetup
|
||||
|
||||
mtbaSetup
|
||||
|
||||
for module in $PROJECT/modules/*.sh
|
||||
do
|
||||
log DEBUG "sourcing $module"
|
||||
source $module
|
||||
done
|
||||
|
|
|
|||
|
|
@ -1,100 +0,0 @@
|
|||
version: '3.7'
|
||||
|
||||
volumes:
|
||||
gbn-connector-logs:
|
||||
gbn-connector-db-data:
|
||||
gbn-store-db-data:
|
||||
|
||||
services:
|
||||
traefik:
|
||||
container_name: bridgehead-traefik
|
||||
image: traefik:2
|
||||
command:
|
||||
- --entrypoints.web.address=:80
|
||||
- --entrypoints.websecure.address=:443
|
||||
- --providers.docker=true
|
||||
- --api.dashboard=true
|
||||
- --accesslog=true # print access-logs
|
||||
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
||||
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
||||
labels:
|
||||
- "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
- "traefik.http.routers.dashboard.entrypoints=websecure"
|
||||
- "traefik.http.routers.dashboard.service=api@internal"
|
||||
- "traefik.http.routers.dashboard.tls=true"
|
||||
- "traefik.http.routers.dashboard.middlewares=auth"
|
||||
- "traefik.http.middlewares.auth.basicauth.users=${bc_auth_users}"
|
||||
ports:
|
||||
- 80:80
|
||||
- 443:443
|
||||
volumes:
|
||||
- ../certs:/tools/certs
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway"
|
||||
|
||||
forward_proxy:
|
||||
container_name: bridgehead-forward-proxy
|
||||
image: ubuntu/squid
|
||||
environment:
|
||||
http_proxy: ${http_proxy}
|
||||
https_proxy: ${https_proxy}
|
||||
volumes:
|
||||
- "bridgehead-proxy:/var/log/squid"
|
||||
|
||||
landing:
|
||||
container_name: bridgehead-landingpage
|
||||
image: samply/bridgehead-landingpage
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.landing.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.landing.tls=true"
|
||||
environment:
|
||||
HOST: ${HOST}
|
||||
PROJECT: ${PROJECT}
|
||||
SITE_NAME: ${SITE_NAME}
|
||||
|
||||
blaze:
|
||||
image: "samply/blaze:0.17"
|
||||
container_name: bridgehead-gbn-blaze
|
||||
environment:
|
||||
BASE_URL: "http://blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx4g"
|
||||
LOG_LEVEL: "debug"
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "blaze-data:/app/data"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.middlewares.gbn-auth.basicauth.users=${bc_auth_users}"
|
||||
- "traefik.http.routers.blaze_gbn.rule=PathPrefix(`/gbn-localdatamanagement`)"
|
||||
- "traefik.http.middlewares.gbn_b_strip.stripprefix.prefixes=/gbn-localdatamanagement"
|
||||
- "traefik.http.services.blaze_gbn.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.blaze_gbn.middlewares=gbn_b_strip,gbn-auth"
|
||||
- "traefik.http.routers.blaze_gbn.tls=true"
|
||||
|
||||
gbn-connector:
|
||||
container_name: bridgehead-gbn-connector
|
||||
image: "samply/share-client:gbn-feature-environmentPreconfiguration"
|
||||
environment:
|
||||
POSTGRES_PASSWORD: ${CONNECTOR_POSTGRES_PASS}
|
||||
volumes:
|
||||
- "gbn-connector-logs:/usr/local/tomcat/logs"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.gbn_connector.rule=PathPrefix(`/gbn-connector`)"
|
||||
- "traefik.http.services.gbn_connector.loadbalancer.server.port=8080"
|
||||
depends_on:
|
||||
- "gbn-connector-db"
|
||||
restart: "always"
|
||||
|
||||
gbn-connector-db:
|
||||
image: "postgres:10.17"
|
||||
environment:
|
||||
POSTGRES_DB: "samply.connector"
|
||||
POSTGRES_USER: "samply"
|
||||
POSTGRES_PASSWORD: ${CONNECTOR_POSTGRES_PASS}
|
||||
volumes:
|
||||
- "gbn-connector-db-data:/var/lib/postgresql/data"
|
||||
restart: "always"
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
#!/bin/bash -e
|
||||
source lib/functions.sh
|
||||
|
||||
log "INFO" "This script add's a user with password to the bridghead"
|
||||
|
||||
read -p 'Username: ' bc_user
|
||||
read -sp 'Password: ' bc_password
|
||||
|
||||
log "INFO" "\nPlease export the line in the your environment. Please replace the dollar signs with with \\\$"
|
||||
docker run --rm -it httpd:latest htpasswd -nb $bc_user $bc_password
|
||||
|
|
@ -1,9 +1,26 @@
|
|||
#!/bin/bash -e
|
||||
|
||||
detectCompose() {
|
||||
if [[ "$(docker compose version 2>/dev/null)" == *"Docker Compose version"* ]]; then
|
||||
COMPOSE="docker compose"
|
||||
else
|
||||
COMPOSE="docker-compose"
|
||||
# This is intended to fail on startup in the next prereq check.
|
||||
fi
|
||||
}
|
||||
|
||||
getLdmPassword() {
|
||||
if [ -n "$LDM_PASSWORD" ]; then
|
||||
docker run --rm docker.verbis.dkfz.de/cache/httpd:alpine htpasswd -nb $PROJECT $LDM_PASSWORD | tr -d '\n' | tr -d '\r'
|
||||
else
|
||||
echo -n ""
|
||||
fi
|
||||
}
|
||||
|
||||
exitIfNotRoot() {
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
log "ERROR" "Please run as root"
|
||||
exit 1
|
||||
fail_and_report 1 "Please run as root"
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -16,19 +33,15 @@ checkOwner(){
|
|||
return 0
|
||||
}
|
||||
|
||||
log() {
|
||||
echo -e "$(date +'%Y-%m-%d %T')" "$1:" "$2"
|
||||
}
|
||||
|
||||
printUsage() {
|
||||
echo "Usage: bridgehead start|stop|update|install|uninstall PROJECTNAME"
|
||||
echo "PROJECTNAME should be one of ccp|nngm|gbn"
|
||||
echo "Usage: bridgehead start|stop|is-running|update|install|uninstall|enroll PROJECTNAME"
|
||||
echo "PROJECTNAME should be one of ccp|bbmri"
|
||||
}
|
||||
|
||||
checkRequirements() {
|
||||
if ! lib/prerequisites.sh; then
|
||||
if ! lib/prerequisites.sh $@; then
|
||||
log "ERROR" "Validating Prerequisites failed, please fix the error(s) above this line."
|
||||
exit 1
|
||||
fail_and_report 1 "Validating prerequisites failed."
|
||||
else
|
||||
return 0
|
||||
fi
|
||||
|
|
@ -97,10 +110,76 @@ assertVarsNotEmpty() {
|
|||
return 0
|
||||
}
|
||||
|
||||
fixPermissions() {
|
||||
CHOWN=$(which chown)
|
||||
sudo $CHOWN -R bridgehead /etc/bridgehead /srv/docker/bridgehead
|
||||
}
|
||||
|
||||
source lib/monitoring.sh
|
||||
|
||||
report_error() {
|
||||
CODE=$1
|
||||
shift
|
||||
log ERROR "$@"
|
||||
hc_send $CODE "$@"
|
||||
}
|
||||
|
||||
fail_and_report() {
|
||||
report_error $@
|
||||
exit $1
|
||||
}
|
||||
|
||||
setHostname() {
|
||||
if [ -z "$HOST" ]; then
|
||||
export HOST=$(hostname -f | tr "[:upper:]" "[:lower:]")
|
||||
log DEBUG "Using auto-detected hostname $HOST."
|
||||
fi
|
||||
}
|
||||
|
||||
# Takes 1) The Backup Directory Path 2) The name of the Service to be backuped
|
||||
# Creates 3 Backups: 1) For the past seven days 2) For the current month and 3) for each calendar week
|
||||
createEncryptedPostgresBackup(){
|
||||
docker exec "$2" bash -c 'pg_dump -U $POSTGRES_USER $POSTGRES_DB --format=p --no-owner --no-privileges' | \
|
||||
# TODO: Encrypt using /etc/bridgehead/pki/${SITE_ID}.priv.pem | \
|
||||
tee "$1/$2/$(date +Last-%A).sql" | \
|
||||
tee "$1/$2/$(date +%Y-%m).sql" > \
|
||||
"$1/$2/$(date +%Y-KW%V).sql"
|
||||
}
|
||||
|
||||
|
||||
# from: https://gist.github.com/sj26/88e1c6584397bb7c13bd11108a579746
|
||||
# ex. use: retry 5 /bin/false
|
||||
function retry {
|
||||
local retries=$1
|
||||
shift
|
||||
|
||||
local count=0
|
||||
until "$@"; do
|
||||
exit=$?
|
||||
wait=$((2 ** $count))
|
||||
count=$(($count + 1))
|
||||
if [ $count -lt $retries ]; then
|
||||
echo "Retry $count/$retries exited with code $exit, retrying in $wait seconds..."
|
||||
sleep $wait
|
||||
else
|
||||
echo "Retry $count/$retries exited with code $exit, giving up."
|
||||
return $exit
|
||||
fi
|
||||
done
|
||||
return 0
|
||||
}
|
||||
|
||||
function bk_is_running {
|
||||
detectCompose
|
||||
RUNNING="$($COMPOSE -p $PROJECT -f minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE ps -q)"
|
||||
NUMBEROFRUNNING=$(echo "$RUNNING" | wc -l)
|
||||
if [ $NUMBEROFRUNNING -ge 2 ]; then
|
||||
return 0
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
##Setting Network properties
|
||||
export HOSTIP=$(MSYS_NO_PATHCONV=1 docker run --rm --add-host=host.docker.internal:host-gateway ubuntu cat /etc/hosts | grep 'host.docker.internal' | awk '{print $1}');
|
||||
export HOST=$(hostname)
|
||||
export PRODUCTION="false";
|
||||
if [ "$(git branch --show-current)" == "main" ]; then
|
||||
export PRODUCTION="true";
|
||||
fi
|
||||
# currently not needed
|
||||
#export HOSTIP=$(MSYS_NO_PATHCONV=1 docker run --rm --add-host=host.docker.internal:host-gateway ubuntu cat /etc/hosts | grep 'host.docker.internal' | awk '{print $1}');
|
||||
|
|
|
|||
116
lib/generate.sh
116
lib/generate.sh
|
|
@ -1,116 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
if [ ! -d ./landing ]
|
||||
then
|
||||
mkdir landing
|
||||
fi
|
||||
|
||||
if [ ! -f ./landing/index.html ]
|
||||
then
|
||||
touch index.html
|
||||
fi
|
||||
|
||||
CENTRAL_SERVICES=" <tr>
|
||||
<td>CCP-IT</td>
|
||||
<td><a href=\"https://monitor.vmitro.de/icingaweb2/dashboard\">Monitoring Service</td>
|
||||
</tr>"
|
||||
|
||||
LOCAL_SERVICES=" <tr>
|
||||
<td>Bridgehead</td>
|
||||
<td>Reverse Proxy <a href=\"http://${HOST}:8080/\">Traefik</a></td>
|
||||
</tr>"
|
||||
|
||||
if [ "$project" = "dktk" ] || [ "$project" = "c4" ] || [ "$project" = "dktk-fed" ]
|
||||
then
|
||||
CENTRAL_SERVICES+=" <tr>
|
||||
<td>CCP-IT</td>
|
||||
<td><a href=\"https://patientlist.ccp-it.dktk.dkfz.de\">Zentrale Patientenliste</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>CCP-IT</td>
|
||||
<td><a href=\"https://decentralsearch.ccp-it.dktk.dkfz.de\">Dezentrale Suche</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>CCP-IT</td>
|
||||
<td><a href=\"https://centralsearch.ccp-it.dktk.dkfz.de\">Zentrale Suche</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>CCP-IT</td>
|
||||
<td><a href=\"https://deployment.ccp-it.dktk.dkfz.de\">Deployment-Server</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>CCP-IT</td>
|
||||
<td><a href=\"https://dktk-kne.kgu.de\">Zentraler Kontrollnummernerzeuger</td>
|
||||
</tr>
|
||||
"
|
||||
fi
|
||||
|
||||
if [ "$project" = "dktk-fed" ]
|
||||
then
|
||||
LOCAL_SERVICES+=" <tr>
|
||||
<td>DKTK</td>
|
||||
<td><a href=\"https://${HOST}/dktk-localdatamanagement/fhir/\">Blaze</a></td>
|
||||
</tr>
|
||||
"
|
||||
fi
|
||||
|
||||
cat > ./landing/index.html <<EOL
|
||||
<html lang="en">
|
||||
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<meta name="description" content="">
|
||||
<title>Bridgehead Overview</title>
|
||||
<!-- Bootstrap core CSS -->
|
||||
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet"
|
||||
integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">
|
||||
<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js"
|
||||
integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p"
|
||||
crossorigin="anonymous"></script>
|
||||
|
||||
</head>
|
||||
|
||||
<body class="d-flex flex-column min-vh-100">
|
||||
|
||||
<nav class="navbar navbar-light" style="background-color: #aad7f6;">
|
||||
<h2 class="pb-2 border-bottom">Bridgehead ${site_name}</h2>
|
||||
</nav>
|
||||
<div class="container px-4 py-5" id="featured-3">
|
||||
<div>
|
||||
<h2>Components</h2>
|
||||
<h3>Central</h3>
|
||||
<table class="table">
|
||||
<thead class="thead-dark">
|
||||
<tr>
|
||||
<th style="width: 50%">Group</th>
|
||||
<th style="width: 50%">Service</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
${CENTRAL_SERVICES}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<h3>Local</h3>
|
||||
<table class="table">
|
||||
<thead class="thead-dark">
|
||||
<tr>
|
||||
<th style="width: 50%">Project</th>
|
||||
<th style="width: 50%">Services</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
${LOCAL_SERVICES}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<footer class="footer mt-auto py-3">
|
||||
<a href="https://dktk.dkfz.de/"><img src="https://www.oncoray.de/fileadmin/files/bilder_gruppen/DKTK/Logo_DKTK_neu_2016.jpg" style="max-width: 30%; height: auto;"></a> DKTK 2022<span style="float: right;"><a href="https://github.com/samply/bridgehead"><button type="button" class="btn btn-primary">Documentaion</button></a></span>
|
||||
</footer>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
EOL
|
||||
|
|
@ -22,7 +22,7 @@ cd $BASE
|
|||
|
||||
source lib/functions.sh
|
||||
|
||||
assertVarsNotEmpty SITE_ID || exit 1
|
||||
assertVarsNotEmpty SITE_ID || fail_and_report 1 "gitpassword.sh failed: SITE_ID is empty."
|
||||
|
||||
PARAMS="$(cat)"
|
||||
GITHOST=$(echo "$PARAMS" | grep "^host=" | sed 's/host=\(.*\)/\1/g')
|
||||
|
|
@ -30,8 +30,7 @@ GITHOST=$(echo "$PARAMS" | grep "^host=" | sed 's/host=\(.*\)/\1/g')
|
|||
fetchVarsFromVault GIT_PASSWORD
|
||||
|
||||
if [ -z "${GIT_PASSWORD}" ]; then
|
||||
log ERROR "Git password not found."
|
||||
exit 1
|
||||
fail_and_report 1 "gitpassword.sh failed: Git password not found."
|
||||
fi
|
||||
|
||||
cat <<EOF
|
||||
|
|
|
|||
|
|
@ -0,0 +1,66 @@
|
|||
#!/bin/bash -e
|
||||
|
||||
source lib/functions.sh
|
||||
|
||||
exitIfNotRoot
|
||||
|
||||
if [ $# -eq 0 ]; then
|
||||
log "ERROR" "Please provide a Project as argument"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
export PROJECT=$1
|
||||
|
||||
checkRequirements noprivkey
|
||||
|
||||
log "INFO" "Allowing the bridgehead user to start/stop the bridgehead."
|
||||
|
||||
cat <<EOF > /etc/sudoers.d/bridgehead-"${PROJECT}"
|
||||
# This has been added by the Bridgehead installer. Remove with bridgehead uninstall.
|
||||
Cmnd_Alias BRIDGEHEAD${PROJECT^^} = \\
|
||||
/bin/systemctl start bridgehead@${PROJECT}.service, \\
|
||||
/bin/systemctl stop bridgehead@${PROJECT}.service, \\
|
||||
/bin/systemctl restart bridgehead@${PROJECT}.service, \\
|
||||
/bin/systemctl restart bridgehead@*.service, \\
|
||||
/bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead, \\
|
||||
/usr/bin/chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead
|
||||
|
||||
bridgehead ALL= NOPASSWD: BRIDGEHEAD${PROJECT^^}
|
||||
EOF
|
||||
|
||||
# TODO: Determine whether this should be located in setup-bridgehead (triggered through bridgehead install) or in update bridgehead (triggered every hour)
|
||||
if [ -z "$LDM_PASSWORD" ]; then
|
||||
log "INFO" "Now generating a password for the local data management. Please save the password for your ETL process!"
|
||||
generated_passwd="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 32)"
|
||||
|
||||
log "INFO" "Your generated credentials are:\n user: $PROJECT\n password: $generated_passwd"
|
||||
echo -e "## Local Data Management Basic Authentication\n# User: $PROJECT\nLDM_PASSWORD=$generated_passwd" >> /etc/bridgehead/${PROJECT}.local.conf;
|
||||
fi
|
||||
|
||||
log "INFO" "Registering system units for bridgehead and bridgehead-update"
|
||||
cp -v \
|
||||
lib/systemd/bridgehead\@.service \
|
||||
lib/systemd/bridgehead-update\@.service \
|
||||
lib/systemd/bridgehead-update\@.timer \
|
||||
/etc/systemd/system/
|
||||
|
||||
systemctl daemon-reload
|
||||
|
||||
log INFO "Trying to update your bridgehead ..."
|
||||
|
||||
systemctl start bridgehead-update@"${PROJECT}".service
|
||||
|
||||
log "INFO" "Enabling autostart of bridgehead@${PROJECT}.service"
|
||||
systemctl enable bridgehead@"${PROJECT}".service
|
||||
|
||||
log "INFO" "Enabling auto-updates for bridgehead@${PROJECT}.service ..."
|
||||
systemctl enable --now bridgehead-update@"${PROJECT}".timer
|
||||
|
||||
STR="\n\n systemctl start bridgehead@${PROJECT}.service\n\nor by rebooting your machine."
|
||||
if [ -e /etc/bridgehead/pki/${SITE_ID}.priv.pem ]; then
|
||||
STR="Success. Next, start your bridgehead by running$STR"
|
||||
else
|
||||
STR="Success. Next, enroll into the $PROJECT broker by creating a cryptographic certificate. To do so, run\n\n /srv/docker/bridgehead/bridgehead enroll $PROJECT\n\nThen, you may start the bridgehead by running$STR"
|
||||
fi
|
||||
|
||||
log "INFO" "$STR"
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
#!/bin/bash
|
||||
|
||||
log() {
|
||||
SEVERITY="$1"
|
||||
shift
|
||||
echo -e "$(date +'%Y-%m-%d %T')" "$SEVERITY:" "$@"
|
||||
}
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
#!/bin/bash
|
||||
|
||||
source lib/log.sh
|
||||
|
||||
function hc_set_uuid(){
|
||||
HCUUID="$1"
|
||||
}
|
||||
|
||||
function hc_set_service(){
|
||||
HCSERVICE="$1"
|
||||
}
|
||||
|
||||
UPTIME=
|
||||
USER_AGENT=
|
||||
|
||||
function hc_send(){
|
||||
BASEURL="https://healthchecks.verbis.dkfz.de/ping"
|
||||
if [ -n "$MONITOR_APIKEY" ]; then
|
||||
hc_set_uuid $MONITOR_APIKEY
|
||||
fi
|
||||
|
||||
if [ -n "$HCSERVICE" ]; then
|
||||
HCURL="$BASEURL/$PING_KEY/$HCSERVICE"
|
||||
fi
|
||||
if [ -n "$HCUUID" ]; then
|
||||
HCURL="$BASEURL/$HCUUID"
|
||||
fi
|
||||
if [ ! -n "$HCURL" ]; then
|
||||
log WARN "Did not report Healthcheck: Neither Healthcheck UUID nor service set. Please define MONITOR_APIKEY in /etc/bridgehead."
|
||||
return 0
|
||||
fi
|
||||
|
||||
if [ -z "$UPTIME" ]; then
|
||||
UPTIME=$(docker ps -a --format 'table {{.Names}} \t{{.RunningFor}} \t {{.Status}} \t {{.Image}}' --filter name=bridgehead || echo "Unable to get docker statistics")
|
||||
fi
|
||||
|
||||
if [ -z "$USER_AGENT" ]; then
|
||||
if [ "$USER" != "root" ]; then
|
||||
COMMIT_ETC=$(git -C /etc/bridgehead rev-parse HEAD | cut -c -8)
|
||||
COMMIT_SRV=$(git -C /srv/docker/bridgehead rev-parse HEAD | cut -c -8)
|
||||
else
|
||||
COMMIT_ETC=$(su -c 'git -C /etc/bridgehead rev-parse HEAD' bridgehead | cut -c -8)
|
||||
COMMIT_SRV=$(su -c 'git -C /srv/docker/bridgehead rev-parse HEAD' bridgehead | cut -c -8)
|
||||
fi
|
||||
USER_AGENT="srv:$COMMIT_SRV etc:$COMMIT_ETC"
|
||||
fi
|
||||
|
||||
if [ -n "$2" ]; then
|
||||
MSG="$2\n\nDocker stats:\n$UPTIME"
|
||||
echo -e "$MSG" | https_proxy=$HTTPS_PROXY_URL curl --max-time 5 -A "$USER_AGENT" -s -o /dev/null -X POST --data-binary @- "$HCURL"/"$1" || log WARN "Monitoring failed: Unable to send data to $HCURL/$1"
|
||||
else
|
||||
https_proxy=$HTTPS_PROXY_URL curl --max-time 5 -A "$USER_AGENT" -s -o /dev/null "$HCURL"/"$1" || log WARN "Monitoring failed: Unable to send data to $HCURL/$1"
|
||||
fi
|
||||
}
|
||||
|
|
@ -0,0 +1,90 @@
|
|||
#!/bin/bash -e
|
||||
|
||||
DEV_MODE="${1:-NODEV}"
|
||||
|
||||
source lib/log.sh
|
||||
source lib/functions.sh
|
||||
|
||||
log "INFO" "Preparing your system for bridgehead installation ..."
|
||||
|
||||
# Check, if running in WSL
|
||||
if [[ $(grep -i Microsoft /proc/version) ]]; then
|
||||
# Check, if systemd is available
|
||||
if [ "$(systemctl is-system-running)" = "offline" ]; then
|
||||
log "ERROR" "It seems you have no active systemd environment in your WSL environment. Please follow the guide in https://devblogs.microsoft.com/commandline/systemd-support-is-now-available-in-wsl/"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Create the bridgehead user
|
||||
if id bridgehead &>/dev/null; then
|
||||
log "INFO" "Existing user with id $(id -u bridgehead) will be used by the bridgehead system units."
|
||||
else
|
||||
log "INFO" "Now creating a system user to own the bridgehead's files."
|
||||
useradd -M -g docker -N bridgehead || fail_and_report ""
|
||||
fi
|
||||
|
||||
# Clone the OpenSource repository of bridgehead
|
||||
set +e
|
||||
bridgehead_repository_url=$(git remote get-url origin)
|
||||
if [ $? -ne 0 ]; then
|
||||
bridgehead_repository_url="https://github.com/samply/bridgehead.git"
|
||||
fi
|
||||
set -e
|
||||
if [ -d "/srv/docker/bridgehead" ]; then
|
||||
current_owner=$(stat -c '%U' /srv/docker/bridgehead)
|
||||
if [ "$(su -c 'git -C /srv/docker/bridgehead remote get-url origin' $current_owner)" == "$bridgehead_repository_url" ]; then
|
||||
log "INFO" "Bridgehead's open-source repository has been found at /srv/docker/bridgehead"
|
||||
else
|
||||
log "ERROR" "The directory /srv/docker/bridgehead seems to exist, but doesn't contain a clone of $bridgehead_repository_url\nPlease delete the directory and try again."
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
log "INFO" "Cloning $bridgehead_repository_url to /srv/docker/bridgehead"
|
||||
mkdir -p /srv/docker/
|
||||
git clone $bridgehead_repository_url /srv/docker/bridgehead
|
||||
fi
|
||||
|
||||
case "$PROJECT" in
|
||||
ccp)
|
||||
site_configuration_repository_middle="git.verbis.dkfz.de/bridgehead-configurations/bridgehead-config-"
|
||||
;;
|
||||
bbmri)
|
||||
site_configuration_repository_middle="git.verbis.dkfz.de/bbmri-bridgehead-configs/"
|
||||
;;
|
||||
minimal)
|
||||
site_configuration_repository_middle="git.verbis.dkfz.de/minimal-bridgehead-configs/"
|
||||
;;
|
||||
*)
|
||||
log ERROR "Internal error, this should not happen."
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# Clone the site-configuration
|
||||
if [ -d /etc/bridgehead ]; then
|
||||
current_owner=$(stat -c '%U' /etc/bridgehead)
|
||||
if [ "$(su -c 'git -C /etc/bridgehead remote get-url origin' $current_owner | grep $site_configuration_repository_middle)" ]; then
|
||||
log "INFO" "Your site config repository in /etc/bridgehead seems to be installed correctly."
|
||||
else
|
||||
log "WARN" "Your site configuration repository in /etc/bridgehead seems to have another origin than git.verbis.dkfz.de. Please check if the repository is correctly cloned!"
|
||||
fi
|
||||
elif [[ "$DEV_MODE" == "NODEV" ]]; then
|
||||
log "INFO" "Now cloning your site configuration repository for you."
|
||||
read -p "Please enter your site: " site
|
||||
read -s -p "Please enter the bridgehead's access token for your site configuration repository (will not be echoed): " access_token
|
||||
site_configuration_repository_url="https://bytoken:${access_token}@${site_configuration_repository_middle}$(echo $site | tr '[:upper:]' '[:lower:]').git"
|
||||
git clone $site_configuration_repository_url /etc/bridgehead
|
||||
if [ $? -gt 0 ]; then
|
||||
log "ERROR" "Unable to clone your configuration repository. Please obtain correct access data and try again."
|
||||
fi
|
||||
elif [[ "$DEV_MODE" == "DEV" ]]; then
|
||||
log "INFO" "Now cloning your developer configuration repository for you."
|
||||
read -p "Please enter your config repository URL: " url
|
||||
git clone "$url" /etc/bridgehead
|
||||
fi
|
||||
|
||||
chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead
|
||||
|
||||
log INFO "System preparation is completed and configuration is present."
|
||||
|
||||
|
|
@ -2,67 +2,64 @@
|
|||
|
||||
source lib/functions.sh
|
||||
|
||||
detectCompose
|
||||
|
||||
if ! id "bridgehead" &>/dev/null; then
|
||||
log ERROR "User bridgehead does not exist. Please consult readme for installation."
|
||||
log ERROR "User bridgehead does not exist. Please run bridgehead install $PROJECT"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
checkOwner . bridgehead || exit 1
|
||||
checkOwner /srv/docker/bridgehead bridgehead || exit 1
|
||||
checkOwner /etc/bridgehead bridgehead || exit 1
|
||||
|
||||
## Check if user is a su
|
||||
log INFO "Checking if all prerequisites are met ..."
|
||||
prerequisites="git docker docker-compose"
|
||||
prerequisites="git docker"
|
||||
for prerequisite in $prerequisites; do
|
||||
$prerequisite --version 2>&1
|
||||
is_available=$?
|
||||
if [ $is_available -gt 0 ]; then
|
||||
log "ERROR" "Prerequisite not fulfilled - $prerequisite is not available!"
|
||||
exit 79
|
||||
fail_and_report 79 "Prerequisite not fulfilled - $prerequisite is not available!"
|
||||
fi
|
||||
# TODO: Check for specific version
|
||||
done
|
||||
|
||||
log INFO "Checking if sudo is installed ..."
|
||||
if [ ! -d /etc/sudoers.d ]; then
|
||||
log ERROR "/etc/sudoers.d does not exist. Please install sudo package."
|
||||
exit 1
|
||||
fail_and_report 1 "/etc/sudoers.d does not exist. Please install sudo package."
|
||||
fi
|
||||
|
||||
log INFO "Checking configuration ..."
|
||||
|
||||
## Download submodule
|
||||
if [ ! -d "/etc/bridgehead/" ]; then
|
||||
log ERROR "Please set up the config folder at /etc/bridgehead. Instruction are in the readme."
|
||||
exit 1
|
||||
fail_and_report 1 "Please set up the config folder at /etc/bridgehead. Instruction are in the readme."
|
||||
fi
|
||||
|
||||
# TODO: Check all required variables here in a generic loop
|
||||
|
||||
#check if project env is present
|
||||
if [ -d "/etc/bridgehead/${PROJECT}.conf" ]; then
|
||||
log ERROR "Project config not found. Please copy the template from ${PROJECT} and put it under /etc/bridgehead-config/${PROJECT}.conf."
|
||||
exit 1
|
||||
fail_and_report 1 "Project config not found. Please copy the template from ${PROJECT} and put it under /etc/bridgehead-config/${PROJECT}.conf."
|
||||
fi
|
||||
|
||||
# TODO: Make sure you're in the right directory, or, even better, be independent from the working directory.
|
||||
|
||||
log INFO "Checking ssl cert"
|
||||
log INFO "Checking ssl cert for accessing bridgehead via https"
|
||||
|
||||
if [ ! -d "certs" ]; then
|
||||
log WARN "TLS cert missing, we'll now create a self-signed one. Please consider getting an officially signed one (e.g. via Let's Encrypt ...)"
|
||||
mkdir -p certs
|
||||
if [ ! -d "/etc/bridgehead/traefik-tls" ]; then
|
||||
log WARN "TLS certs for accessing bridgehead via https missing, we'll now create a self-signed one. Please consider getting an officially signed one (e.g. via Let's Encrypt ...) and put into /etc/bridgehead/traefik-tls"
|
||||
mkdir -p /etc/bridgehead/traefik-tls
|
||||
fi
|
||||
|
||||
if [ ! -e "certs/traefik.crt" ]; then
|
||||
openssl req -x509 -newkey rsa:4096 -nodes -keyout certs/traefik.key -out certs/traefik.crt -days 3650 -subj "/CN=$HOST"
|
||||
if [ ! -e "/etc/bridgehead/traefik-tls/fullchain.pem" ]; then
|
||||
openssl req -x509 -newkey rsa:4096 -nodes -keyout /etc/bridgehead/traefik-tls/privkey.pem -out /etc/bridgehead/traefik-tls/fullchain.pem -days 3650 -subj "/CN=$HOST"
|
||||
fi
|
||||
|
||||
if [ -e /etc/bridgehead/vault.conf ]; then
|
||||
if [ "$(stat -c "%a %U" /etc/bridgehead/vault.conf)" != "600 bridgehead" ]; then
|
||||
log ERROR "/etc/bridgehead/vault.conf has wrong owner/permissions. To correct this issue, run chmod 600 /etc/bridgehead/vault.conf && chown bridgehead /etc/bridgehead/vault.conf."
|
||||
exit 1
|
||||
fi
|
||||
if [ "$(stat -c "%a %U" /etc/bridgehead/vault.conf)" != "600 bridgehead" ]; then
|
||||
fail_and_report 1 "/etc/bridgehead/vault.conf has wrong owner/permissions. To correct this issue, run chmod 600 /etc/bridgehead/vault.conf && chown bridgehead /etc/bridgehead/vault.conf."
|
||||
fi
|
||||
fi
|
||||
|
||||
log INFO "Checking network access ($BROKER_URL) ..."
|
||||
|
|
@ -94,6 +91,24 @@ else
|
|||
fi
|
||||
fi
|
||||
|
||||
checkPrivKey() {
|
||||
if [ -e /etc/bridgehead/pki/${SITE_ID}.priv.pem ]; then
|
||||
log INFO "Success - private key found."
|
||||
else
|
||||
log ERROR "Unable to find private key at /etc/bridgehead/pki/${SITE_ID}.priv.pem. To fix, please run\n bridgehead enroll ${PROJECT}\nand follow the instructions."
|
||||
return 1
|
||||
fi
|
||||
log INFO "Success - all prerequisites are met!"
|
||||
hc_send log "Success - all prerequisites are met!"
|
||||
return 0
|
||||
}
|
||||
|
||||
if [[ "$@" =~ "noprivkey" ]]; then
|
||||
log INFO "Skipping check for private key for now."
|
||||
else
|
||||
checkPrivKey || exit 1
|
||||
fi
|
||||
|
||||
log INFO "Success - all prerequisites are met!"
|
||||
|
||||
exit 0
|
||||
|
|
|
|||
|
|
@ -1,53 +0,0 @@
|
|||
#!/bin/bash -e
|
||||
|
||||
source lib/functions.sh
|
||||
|
||||
exitIfNotRoot
|
||||
|
||||
if [ $# -eq 0 ]; then
|
||||
log "ERROR" "Please provide a Project as argument"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ $1 != "ccp" ] && [ $1 != "nngm" ] && [ $1 != "gbn" ]; then
|
||||
log "ERROR" "Please provide a supported project like ccp, gbn or nngm"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
export PROJECT=$1
|
||||
|
||||
checkRequirements
|
||||
|
||||
log "INFO" "Allowing the bridgehead user to start/stop the bridgehead."
|
||||
|
||||
cat <<EOF > /etc/sudoers.d/bridgehead-"${PROJECT}"
|
||||
# This has been added by the Bridgehead installer. Remove with bridgehead uninstall.
|
||||
Cmnd_Alias BRIDGEHEAD${PROJECT^^} = \\
|
||||
/bin/systemctl start bridgehead@${PROJECT}.service, \\
|
||||
/bin/systemctl stop bridgehead@${PROJECT}.service, \\
|
||||
/bin/systemctl restart bridgehead@${PROJECT}.service, \\
|
||||
/bin/systemctl restart bridgehead@*.service
|
||||
|
||||
bridgehead ALL= NOPASSWD: BRIDGEHEAD${PROJECT^^}
|
||||
EOF
|
||||
|
||||
log "INFO" "Register system units for bridgehead and bridgehead-update"
|
||||
cp -v \
|
||||
lib/systemd/bridgehead\@.service \
|
||||
lib/systemd/bridgehead-update\@.service \
|
||||
lib/systemd/bridgehead-update\@.timer \
|
||||
/etc/systemd/system/
|
||||
|
||||
systemctl daemon-reload
|
||||
|
||||
log INFO "Trying to update your bridgehead ..."
|
||||
|
||||
systemctl start bridgehead-update@"${PROJECT}".service
|
||||
|
||||
log "INFO" "Enabling autostart of bridgehead@${PROJECT}.service"
|
||||
systemctl enable bridgehead@"${PROJECT}".service
|
||||
|
||||
log "INFO" "Enabling auto-updates for bridgehead@${PROJECT}.service ..."
|
||||
systemctl enable --now bridgehead-update@"${PROJECT}".timer
|
||||
|
||||
log "INFO" "\nSuccess - now start your bridgehead by running\n systemctl start bridgehead@${PROJECT}.service\n or by rebooting your machine."
|
||||
|
|
@ -4,7 +4,9 @@ Description=Bridgehead (%i) Update Service
|
|||
[Service]
|
||||
Type=oneshot
|
||||
User=bridgehead
|
||||
ExecStartPre=-/srv/docker/bridgehead/bridgehead preUpdate %i
|
||||
ExecStart=/srv/docker/bridgehead/bridgehead update %i
|
||||
ExecStopPost=-/srv/docker/bridgehead/bridgehead postUpdate %i
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
|
|||
|
|
@ -6,8 +6,10 @@ Requires=docker.service
|
|||
User=bridgehead
|
||||
Restart=always
|
||||
RestartSec=30
|
||||
ExecStartPre=-/srv/docker/bridgehead/bridgehead preRun %i
|
||||
ExecStart=/srv/docker/bridgehead/bridgehead start %i
|
||||
ExecStop=/srv/docker/bridgehead/bridgehead stop %i
|
||||
ExecStopPost=-/srv/docker/bridgehead/bridgehead postRun %i
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
|
|||
|
|
@ -1,4 +1,6 @@
|
|||
tls:
|
||||
certificates:
|
||||
- certFile: /certs/traefik.crt
|
||||
keyFile: /certs/traefik.key
|
||||
stores:
|
||||
default:
|
||||
defaultCertificate:
|
||||
certFile: /certs/fullchain.pem
|
||||
keyFile: /certs/privkey.pem
|
||||
|
|
|
|||
|
|
@ -7,11 +7,6 @@ if [ $# -eq 0 ]; then
|
|||
exit 1
|
||||
fi
|
||||
|
||||
if [ $1 != "ccp" ] && [ $1 != "nngm" ] && [ $1 != "gbn" ]; then
|
||||
log "ERROR" "Please provide a supported project like ccp, gbn or nngm"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
export PROJECT=$1
|
||||
|
||||
#checkRequirements // not needed when uninstalling
|
||||
|
|
@ -1,26 +1,50 @@
|
|||
#!/bin/bash
|
||||
source lib/functions.sh
|
||||
|
||||
AUTO_HOUSEKEEPING=${AUTO_HOUSEKEEPING:-true}
|
||||
|
||||
if [ "$AUTO_HOUSEKEEPING" == "true" ]; then
|
||||
A="Performing automatic maintenance: "
|
||||
if bk_is_running; then
|
||||
A="$A Cleaning docker images."
|
||||
docker system prune -a -f
|
||||
else
|
||||
A="$A Not cleaning docker images since BK is not running."
|
||||
fi
|
||||
hc_send log "$A"
|
||||
log INFO "$A"
|
||||
else
|
||||
log WARN "Automatic housekeeping disabled (variable AUTO_HOUSEKEEPING != \"true\")"
|
||||
fi
|
||||
|
||||
hc_send log "Checking for bridgehead updates ..."
|
||||
|
||||
CONFFILE=/etc/bridgehead/$1.conf
|
||||
|
||||
if [ ! -e $CONFFILE ]; then
|
||||
log ERROR "Configuration file $CONFFILE not found."
|
||||
exit 1
|
||||
fail_and_report 1 "Configuration file $CONFFILE not found."
|
||||
fi
|
||||
|
||||
source $CONFFILE
|
||||
|
||||
assertVarsNotEmpty SITE_ID || exit 1
|
||||
assertVarsNotEmpty SITE_ID || fail_and_report 1 "Update failed: SITE_ID empty"
|
||||
export SITE_ID
|
||||
|
||||
checkOwner . bridgehead || exit 1
|
||||
checkOwner /etc/bridgehead bridgehead || exit 1
|
||||
checkOwner . bridgehead || fail_and_report 1 "Update failed: Wrong permissions in $(pwd)"
|
||||
checkOwner /etc/bridgehead bridgehead || fail_and_report 1 "Update failed: Wrong permissions in /etc/bridgehead"
|
||||
|
||||
CREDHELPER="/srv/docker/bridgehead/lib/gitpassword.sh"
|
||||
|
||||
CHANGES=""
|
||||
|
||||
# Check git updates
|
||||
git_updated="false"
|
||||
for DIR in /etc/bridgehead $(pwd); do
|
||||
log "INFO" "Checking for updates to git repo $DIR ..."
|
||||
OUT="$(git -C $DIR status --porcelain)"
|
||||
if [ -n "$OUT" ]; then
|
||||
report_error log "The working directory $DIR is modified. Changed files: $OUT"
|
||||
fi
|
||||
if [ "$(git -C $DIR config --get credential.helper)" != "$CREDHELPER" ]; then
|
||||
log "INFO" "Configuring repo to use bridgehead git credential helper."
|
||||
git -C $DIR config credential.helper "$CREDHELPER"
|
||||
|
|
@ -28,17 +52,20 @@ for DIR in /etc/bridgehead $(pwd); do
|
|||
old_git_hash="$(git -C $DIR rev-parse --verify HEAD)"
|
||||
if [ -z "$HTTP_PROXY_URL" ]; then
|
||||
log "INFO" "Git is using no proxy!"
|
||||
git -C $DIR fetch 2>&1
|
||||
git -C $DIR pull 2>&1
|
||||
OUT=$(retry 5 git -C $DIR fetch 2>&1 && retry 5 git -C $DIR pull 2>&1)
|
||||
else
|
||||
log "INFO" "Git is using proxy ${HTTP_PROXY_URL} from ${CONFFILE}"
|
||||
git -c http.proxy=$HTTP_PROXY_URL -c http.proxy=$HTTP_PROXY_URL -C $DIR fetch 2>&1
|
||||
git -c http.proxy=$HTTP_PROXY_URL -c http.proxy=$HTTP_PROXY_URL -C $DIR pull 2>&1
|
||||
OUT=$(retry 5 git -c http.proxy=$HTTP_PROXY_URL -c https.proxy=$HTTPS_PROXY_URL -C $DIR fetch 2>&1 && retry 5 git -c http.proxy=$HTTP_PROXY_URL -c https.proxy=$HTTPS_PROXY_URL -C $DIR pull 2>&1)
|
||||
fi
|
||||
if [ $? -ne 0 ]; then
|
||||
report_error log "Unable to update git $DIR: $OUT"
|
||||
fi
|
||||
|
||||
new_git_hash="$(git -C $DIR rev-parse --verify HEAD)"
|
||||
git_updated="false"
|
||||
if [ "$old_git_hash" != "$new_git_hash" ]; then
|
||||
log "INFO" "Updated git repository in ${DIR} from commit $old_git_hash to $new_git_hash"
|
||||
CHANGE="Updated git repository in ${DIR} from commit $old_git_hash to $new_git_hash"
|
||||
CHANGES+="- $CHANGE\n"
|
||||
log "INFO" "$CHANGE"
|
||||
# NOTE: Link generation doesn't work on repositories placed at an self-hosted instance of bitbucket.
|
||||
# See: https://community.atlassian.com/t5/Bitbucket-questions/BitBucket-4-14-diff-between-any-two-commits/qaq-p/632974
|
||||
git_repository_url="$(git -C $DIR remote get-url origin)"
|
||||
|
|
@ -59,20 +86,57 @@ done
|
|||
# Check docker updates
|
||||
log "INFO" "Checking for updates to running docker images ..."
|
||||
docker_updated="false"
|
||||
for IMAGE in $(docker ps --filter "name=bridgehead" --format {{.Image}}); do
|
||||
for IMAGE in $(cat $PROJECT/docker-compose.yml ${OVERRIDE//-f/} minimal/docker-compose.yml | grep -v "^#" | grep "image:" | sed -e 's_^.*image: \(.*\).*$_\1_g; s_\"__g'); do
|
||||
log "INFO" "Checking for Updates of Image: $IMAGE"
|
||||
if docker pull $IMAGE | grep "Downloaded newer image"; then
|
||||
log "INFO" "$IMAGE updated."
|
||||
CHANGE="Image $IMAGE updated."
|
||||
CHANGES+="- $CHANGE\n"
|
||||
log "INFO" "$CHANGE"
|
||||
docker_updated="true"
|
||||
fi
|
||||
done
|
||||
|
||||
# If anything is updated, restart service
|
||||
if [ $git_updated = "true" ] || [ $docker_updated = "true" ]; then
|
||||
log "INFO" "Update detected, now restarting bridgehead"
|
||||
RES="Updates detected, now restarting bridgehead:\n$CHANGES"
|
||||
log "INFO" "$RES"
|
||||
hc_send log "$RES"
|
||||
sudo /bin/systemctl restart bridgehead@*.service
|
||||
else
|
||||
log "INFO" "Nothing updated, nothing to restart."
|
||||
RES="Nothing updated, nothing to restart."
|
||||
log "INFO" "$RES"
|
||||
hc_send log "$RES"
|
||||
fi
|
||||
|
||||
if [ -n "${BACKUP_DIRECTORY}" ]; then
|
||||
if [ ! -d "$BACKUP_DIRECTORY" ]; then
|
||||
message="Performing automatic maintenance: Attempting to create backup directory $BACKUP_DIRECTORY."
|
||||
hc_send log "$message"
|
||||
log INFO "$message"
|
||||
mkdir -p "$BACKUP_DIRECTORY"
|
||||
chown -R "$BACKUP_DIRECTORY" bridgehead;
|
||||
fi
|
||||
checkOwner "$BACKUP_DIRECTORY" bridgehead || fail_and_report 1 "Automatic maintenance failed: Wrong permissions for backup directory $(pwd)"
|
||||
# Collect all container names that contain '-db'
|
||||
BACKUP_SERVICES="$(docker ps --filter name=-db --format "{{.Names}}" | tr "\n" "\ ")"
|
||||
log INFO "Performing automatic maintenance: Creating Backups for $BACKUP_SERVICES";
|
||||
for service in $BACKUP_SERVICES; do
|
||||
if [ ! -d "$BACKUP_DIRECTORY/$service" ]; then
|
||||
message="Performing automatic maintenance: Attempting to create backup directory for $service in $BACKUP_DIRECTORY."
|
||||
hc_send log "$message"
|
||||
log INFO "$message"
|
||||
mkdir -p "$BACKUP_DIRECTORY/$service"
|
||||
fi
|
||||
if createEncryptedPostgresBackup "$BACKUP_DIRECTORY" "$service"; then
|
||||
message="Performing automatic maintenance: Stored encrypted backup for $service in $BACKUP_DIRECTORY."
|
||||
hc_send log "$message"
|
||||
log INFO "$message"
|
||||
else
|
||||
fail_and_report 5 "Failed to create encrypted update for $service"
|
||||
fi
|
||||
done
|
||||
else
|
||||
log WARN "Automated backups are disabled (variable AUTO_BACKUPS != \"true\")"
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
|
|
|||
|
|
@ -0,0 +1,56 @@
|
|||
version: "3.7"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
container_name: bridgehead-traefik
|
||||
image: docker.verbis.dkfz.de/cache/traefik:latest
|
||||
command:
|
||||
- --entrypoints.web.address=:80
|
||||
- --entrypoints.websecure.address=:443
|
||||
- --providers.docker=true
|
||||
- --providers.docker.exposedbydefault=false
|
||||
- --providers.file.directory=/configuration/
|
||||
- --api.dashboard=true
|
||||
- --accesslog=true
|
||||
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
||||
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
- "traefik.http.routers.dashboard.entrypoints=websecure"
|
||||
- "traefik.http.routers.dashboard.service=api@internal"
|
||||
- "traefik.http.routers.dashboard.tls=true"
|
||||
- "traefik.http.routers.dashboard.middlewares=auth"
|
||||
- "traefik.http.middlewares.auth.basicauth.users=${LDM_LOGIN}"
|
||||
ports:
|
||||
- 80:80
|
||||
- 443:443
|
||||
volumes:
|
||||
- /etc/bridgehead/traefik-tls:/certs:ro
|
||||
- ../lib/traefik-configuration/:/configuration:ro
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
|
||||
forward_proxy:
|
||||
container_name: bridgehead-forward-proxy
|
||||
image: docker.verbis.dkfz.de/cache/samply/bridgehead-forward-proxy:latest
|
||||
environment:
|
||||
HTTPS_PROXY: ${HTTPS_PROXY_URL}
|
||||
USERNAME: ${HTTPS_PROXY_USERNAME}
|
||||
PASSWORD: ${HTTPS_PROXY_PASSWORD}
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/docker/custom-certs/:ro
|
||||
|
||||
landing:
|
||||
container_name: bridgehead-landingpage
|
||||
image: docker.verbis.dkfz.de/cache/samply/bridgehead-landingpage:master
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.landing.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.landing.tls=true"
|
||||
environment:
|
||||
HOST: ${HOST}
|
||||
PROJECT: ${PROJECT}
|
||||
SITE_NAME: ${SITE_NAME}
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
version: "3.7"
|
||||
|
||||
services:
|
||||
dnpm-beam-proxy:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
container_name: bridgehead-dnpm-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${DNPM_BROKER_URL}
|
||||
PROXY_ID: ${DNPM_PROXY_ID}
|
||||
APP_dnpm-connect_KEY: ${DNPM_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: ./conf/trusted-ca-certs
|
||||
ROOTCERT_FILE: ./conf/root.crt.pem
|
||||
secrets:
|
||||
- proxy.pem
|
||||
depends_on:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/ccp/root-new.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
dnpm-beam-connect:
|
||||
depends_on: [ dnpm-beam-proxy ]
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-connect:dnpm
|
||||
container_name: bridgehead-dnpm-beam-connect
|
||||
environment:
|
||||
PROXY_URL: http://dnpm-beam-proxy:8081
|
||||
PROXY_APIKEY: ${DNPM_BEAM_SECRET_SHORT}
|
||||
APP_ID: dnpm-connect.${DNPM_PROXY_ID}
|
||||
DISCOVERY_URL: "./conf/central_targets.json"
|
||||
LOCAL_TARGETS_FILE: "./conf/connect_targets.json"
|
||||
HTTP_PROXY: http://forward_proxy:3128
|
||||
HTTPS_PROXY: http://forward_proxy:3128
|
||||
NO_PROXY: dnpm-beam-proxy,dnpm-backend
|
||||
RUST_LOG: ${RUST_LOG:-info}
|
||||
volumes:
|
||||
- /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
|
||||
- /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)"
|
||||
- "traefik.http.middlewares.dnpm-connect-strip.stripprefix.prefixes=/dnpm-connect"
|
||||
- "traefik.http.routers.dnpm-connect.middlewares=dnpm-connect-strip"
|
||||
- "traefik.http.services.dnpm-connect.loadbalancer.server.port=8062"
|
||||
- "traefik.http.routers.dnpm-connect.tls=true"
|
||||
|
||||
secrets:
|
||||
proxy.pem:
|
||||
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
#!/bin/bash
|
||||
|
||||
if [ -n "${ENABLE_DNPM}" ]; then
|
||||
log DEBUG "DNPM setup detected (Beam.Connect) -- will start Beam and Beam.Connect for DNPM."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/dnpm-compose.yml"
|
||||
|
||||
# Set variables required for Beam-Connect
|
||||
DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
DNPM_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
DNPM_BROKER_ID="broker.ccp-it.dktk.dkfz.de"
|
||||
DNPM_BROKER_URL="https://${DNPM_BROKER_ID}"
|
||||
DNPM_PROXY_ID="${SITE_ID}.${DNPM_BROKER_ID}"
|
||||
fi
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
for module in $PROJECT/modules/*.sh
|
||||
do
|
||||
log DEBUG "sourcing $module"
|
||||
source $module
|
||||
done
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
|
|
@ -1,86 +0,0 @@
|
|||
version: "3.7"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
container_name: bridgehead-traefik
|
||||
image: traefik:2.4
|
||||
command:
|
||||
- --api.insecure=true
|
||||
- --entrypoints.web.address=:80
|
||||
- --entrypoints.websecure.address=:443
|
||||
- --providers.docker=true
|
||||
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
||||
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
||||
ports:
|
||||
- 80:80
|
||||
- 443:443
|
||||
- 8080:8080
|
||||
volumes:
|
||||
- ../certs:/tools/certs
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway"
|
||||
|
||||
### Does need to know the outside proxy to connect central components
|
||||
forward_proxy:
|
||||
container_name: bridgehead-squid
|
||||
image: ubuntu/squid
|
||||
environment:
|
||||
http_proxy: ${http_proxy}
|
||||
https_proxy: ${https_proxy}
|
||||
volumes:
|
||||
- "bridgehead-proxy:/var/log/squid"
|
||||
|
||||
## Needs internal proxy config
|
||||
landing:
|
||||
container_name: bridgehead-landingpage
|
||||
image: samply/bridgehead-landingpage
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.landing.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.landing.tls=true"
|
||||
environment:
|
||||
HOST: ${HOST}
|
||||
PROJECT: ${PROJECT}
|
||||
SITE_NAME: ${SITE_NAME}
|
||||
|
||||
nngm-connector:
|
||||
container_name: bridgehead-nngm-connector
|
||||
image: "samply/share-client:nngm-feature-environmentPreconfiguration"
|
||||
environment:
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
NNGM_MAGICPL_APIKEY: ${NNGM_MAGICPL_APIKEY}
|
||||
NNGM_MAINZELLISTE_APIKEY: ${NNGM_MAINZELLISTE_APIKEY}
|
||||
NNGM_CTS_APIKEY: ${NNGM_CTS_APIKEY}
|
||||
NNGM_CRYPTKEY: ${NNGM_CRYPTKEY}
|
||||
volumes:
|
||||
- "nngm-connector-logs:/usr/local/tomcat/logs"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.nngm_connector.rule=PathPrefix(`/nngm-connector`)"
|
||||
- "traefik.http.services.nngm_connector.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.nngm_connector.tls=true"
|
||||
|
||||
depends_on:
|
||||
- "nngm-connector-db"
|
||||
- "forward_proxy"
|
||||
ports:
|
||||
- 5005:5005
|
||||
restart: "always"
|
||||
|
||||
nngm-connector-db:
|
||||
container_name: bridgehead-nngm-connector-db
|
||||
image: "postgres:10.17"
|
||||
environment:
|
||||
POSTGRES_DB: "share_v2"
|
||||
POSTGRES_USER: "samplyweb"
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
||||
volumes:
|
||||
- "nngm-connector-db-data:/var/lib/postgresql/data"
|
||||
restart: "always"
|
||||
|
||||
volumes:
|
||||
nngm-connector-db-data:
|
||||
nngm-connector-logs:
|
||||
bridgehead-proxy:
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
#!/bin/bash
|
||||
### This is the configuration file for secrets, only your site should know
|
||||
|
||||
##Setting Network properties
|
||||
export HOSTIP=$(MSYS_NO_PATHCONV=1 docker run --rm --add-host=host.docker.internal:host-gateway ubuntu cat /etc/hosts | grep 'host.docker.internal' | awk '{print $1}');
|
||||
export HOST=
|
||||
|
||||
export site_name=
|
||||
### Write the Project you want to start with the brigdehead
|
||||
##Exmaple project=dktk-fed
|
||||
export project=
|
||||
Loading…
Reference in New Issue