diff --git a/.gitignore b/.gitignore index a884b44..655ca90 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,7 @@ ##Ignore site configuration .gitmodules site-config/* - +.idea ## Ignore site configuration */docker-compose.override.yml diff --git a/bbmri/modules/directory-sync-compose.yml b/bbmri/modules/directory-sync-compose.yml index 9776ecb..178f46c 100644 --- a/bbmri/modules/directory-sync-compose.yml +++ b/bbmri/modules/directory-sync-compose.yml @@ -1,3 +1,5 @@ +version: "3.7" + services: directory_sync_service: image: "docker.verbis.dkfz.de/cache/samply/directory_sync_service" diff --git a/bridgehead b/bridgehead index 62cb38e..dc82d80 100755 --- a/bridgehead +++ b/bridgehead @@ -50,6 +50,7 @@ loadVars() { source /etc/bridgehead/$PROJECT.local.conf || fail_and_report 1 "Found /etc/bridgehead/$PROJECT.local.conf but failed to import" fi fetchVarsFromVaultByFile /etc/bridgehead/$PROJECT.conf || fail_and_report 1 "Unable to fetchVarsFromVaultByFile" + setHostname optimizeBlazeMemoryUsage [ -e ./$PROJECT/vars ] && source ./$PROJECT/vars set +a @@ -65,7 +66,6 @@ loadVars() { OVERRIDE+=" -f ./$PROJECT/docker-compose.override.yml" fi detectCompose - setHostname setupProxy # Set some project-independent default values @@ -90,6 +90,7 @@ case "$ACTION" in loadVars hc_send log "Bridgehead $PROJECT startup: Checking requirements ..." checkRequirements + sync_secrets hc_send log "Bridgehead $PROJECT startup: Requirements checked out. Now starting bridgehead ..." exec $COMPOSE -p $PROJECT -f ./minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE up --abort-on-container-exit ;; diff --git a/ccp/modules/datashield-compose.yml b/ccp/modules/datashield-compose.yml new file mode 100644 index 0000000..6426145 --- /dev/null +++ b/ccp/modules/datashield-compose.yml @@ -0,0 +1,171 @@ +version: "3.7" + +services: + rstudio: + container_name: bridgehead-rstudio + image: docker.verbis.dkfz.de/ccp/dktk-rstudio:latest + environment: + #DEFAULT_USER: "rstudio" # This line is kept for informational purposes + PASSWORD: "${RSTUDIO_ADMIN_PASSWORD}" # It is required, even if the authentication is disabled + DISABLE_AUTH: "true" # https://rocker-project.org/images/versioned/rstudio.html#how-to-use + HTTP_RELATIVE_PATH: "/rstudio" + ALL_PROXY: "http://forward_proxy:3128" # https://rocker-project.org/use/networking.html + labels: + - "traefik.enable=true" + - "traefik.http.routers.rstudio_ccp.rule=PathPrefix(`/rstudio`)" + - "traefik.http.services.rstudio_ccp.loadbalancer.server.port=8787" + - "traefik.http.middlewares.rstudio_ccp_strip.stripprefix.prefixes=/rstudio" + - "traefik.http.routers.rstudio_ccp.tls=true" + - "traefik.http.routers.rstudio_ccp.middlewares=oidcAuth,rstudio_ccp_strip" + networks: + - rstudio + + opal: + container_name: bridgehead-opal + image: docker.verbis.dkfz.de/ccp/dktk-opal:latest + labels: + - "traefik.enable=true" + - "traefik.http.routers.opal_ccp.rule=PathPrefix(`/opal`)" + - "traefik.http.services.opal_ccp.loadbalancer.server.port=8080" + - "traefik.http.routers.opal_ccp.tls=true" + links: + - opal-rserver + - opal-db + environment: + JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC -Dhttps.proxyHost=forward_proxy -Dhttps.proxyPort=3128" + # OPAL_ADMINISTRATOR_USER: "administrator" # This line is kept for informational purposes + OPAL_ADMINISTRATOR_PASSWORD: "${OPAL_ADMIN_PASSWORD}" + POSTGRESDATA_HOST: "opal-db" + POSTGRESDATA_DATABASE: "opal" + POSTGRESDATA_USER: "opal" + POSTGRESDATA_PASSWORD: "${OPAL_DB_PASSWORD}" + ROCK_HOSTS: "opal-rserver:8085" + APP_URL: "https://${HOST}/opal" + APP_CONTEXT_PATH: "/opal" + OPAL_PRIVATE_KEY: "/run/secrets/opal-key.pem" + OPAL_CERTIFICATE: "/run/secrets/opal-cert.pem" + OIDC_URL: "${OIDC_URL}" + OIDC_REALM: "${OIDC_REALM}" + OIDC_CLIENT_ID: "${OIDC_PRIVATE_CLIENT_ID}" + OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}" + OIDC_ADMIN_GROUP: "${OIDC_ADMIN_GROUP}" + TOKEN_MANAGER_PASSWORD: "${TOKEN_MANAGER_OPAL_PASSWORD}" + EXPORTER_PASSWORD: "${EXPORTER_OPAL_PASSWORD}" + BEAM_APP_ID: token-manager.${PROXY_ID} + BEAM_SECRET: ${TOKEN_MANAGER_SECRET} + BEAM_DATASHIELD_PROXY: request-manager + volumes: + - "/var/cache/bridgehead/ccp/opal-metadata-db:/srv" # Opal metadata + secrets: + - opal-cert.pem + - opal-key.pem + + opal-db: + container_name: bridgehead-opal-db + image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG} + environment: + POSTGRES_PASSWORD: "${OPAL_DB_PASSWORD}" # Set in datashield-setup.sh + POSTGRES_USER: "opal" + POSTGRES_DB: "opal" + volumes: + - "/var/cache/bridgehead/ccp/opal-db:/var/lib/postgresql/data" # Opal project data (imported from exporter) + + opal-rserver: + container_name: bridgehead-opal-rserver + image: docker.verbis.dkfz.de/ccp/dktk-rserver # datashield/rock-base + dsCCPhos + tmpfs: + - /srv + + beam-connect: + image: docker.verbis.dkfz.de/cache/samply/beam-connect:develop + container_name: bridgehead-datashield-connect + environment: + PROXY_URL: "http://beam-proxy:8081" + TLS_CA_CERTIFICATES_DIR: /run/secrets + APP_ID: datashield-connect.${SITE_ID}.${BROKER_ID} + PROXY_APIKEY: ${DATASHIELD_CONNECT_SECRET} + DISCOVERY_URL: "./map/central.json" + LOCAL_TARGETS_FILE: "./map/local.json" + NO_AUTH: "true" + secrets: + - opal-cert.pem + depends_on: + - beam-proxy + volumes: + - /tmp/bridgehead/opal-map/:/map/:ro + networks: + - default + - rstudio + + traefik: + labels: + - "traefik.http.middlewares.oidcAuth.forwardAuth.address=http://oauth2-proxy:4180/" + - "traefik.http.middlewares.oidcAuth.forwardAuth.trustForwardHeader=true" + - "traefik.http.middlewares.oidcAuth.forwardAuth.authResponseHeaders=X-Auth-Request-Access-Token,Authorization" + networks: + - default + - rstudio + forward_proxy: + networks: + - default + - rstudio + + beam-proxy: + environment: + APP_datashield-connect_KEY: ${DATASHIELD_CONNECT_SECRET} + APP_token-manager_KEY: ${TOKEN_MANAGER_SECRET} + + # TODO: Allow users of group /DataSHIELD and OIDC_USER_GROUP at the same time: + # Maybe a solution would be (https://oauth2-proxy.github.io/oauth2-proxy/configuration/oauth_provider): + # --allowed-groups=/DataSHIELD,OIDC_USER_GROUP + oauth2-proxy: + image: docker.verbis.dkfz.de/cache/oauth2-proxy/oauth2-proxy:latest + container_name: bridgehead-oauth2proxy + command: >- + --allowed-group=DataSHIELD + --oidc-groups-claim=${OIDC_GROUP_CLAIM} + --auth-logging=true + --whitelist-domain=${HOST} + --http-address="0.0.0.0:4180" + --reverse-proxy=true + --upstream="static://202" + --email-domain="*" + --cookie-name="_BRIDGEHEAD_oauth2" + --cookie-secret="${OAUTH2_PROXY_SECRET}" + --cookie-expire="12h" + --cookie-secure="true" + --cookie-httponly="true" + #OIDC settings + --provider="keycloak-oidc" + --provider-display-name="VerbIS Login" + --client-id="${OIDC_PRIVATE_CLIENT_ID}" + --client-secret="${OIDC_CLIENT_SECRET}" + --redirect-url="https://${HOST}${OAUTH2_CALLBACK}" + --oidc-issuer-url="${OIDC_ISSUER_URL}" + --scope="openid email profile" + --code-challenge-method="S256" + --skip-provider-button=true + #X-Forwarded-Header settings - true/false depending on your needs + --pass-basic-auth=true + --pass-user-headers=false + --pass-access-token=false + labels: + - "traefik.enable=true" + - "traefik.http.routers.oauth2_proxy.rule=Host(`${HOST}`) && PathPrefix(`/oauth2`, `/oauth2/callback`)" + - "traefik.http.services.oauth2_proxy.loadbalancer.server.port=4180" + - "traefik.http.routers.oauth2_proxy.tls=true" + environment: + http_proxy: "http://forward_proxy:3128" + https_proxy: "http://forward_proxy:3128" + depends_on: + forward_proxy: + condition: service_healthy + +secrets: + opal-cert.pem: + file: /tmp/bridgehead/opal-cert.pem + opal-key.pem: + file: /tmp/bridgehead/opal-key.pem + +networks: + rstudio: diff --git a/ccp/modules/datashield-import-template.xml b/ccp/modules/datashield-import-template.xml new file mode 100644 index 0000000..1de9c91 --- /dev/null +++ b/ccp/modules/datashield-import-template.xml @@ -0,0 +1,157 @@ + diff --git a/ccp/modules/datashield-setup.sh b/ccp/modules/datashield-setup.sh new file mode 100644 index 0000000..7a22050 --- /dev/null +++ b/ccp/modules/datashield-setup.sh @@ -0,0 +1,44 @@ +#!/bin/bash -e + +if [ "$ENABLE_DATASHIELD" == true ]; then + # HACK: This only works because exporter-setup.sh and teiler-setup.sh are sourced after datashield-setup.sh + if [ -z "${ENABLE_EXPORTER}" ] || [ "${ENABLE_EXPORTER}" != "true" ]; then + log WARN "The ENABLE_EXPORTER variable is either not set or not set to 'true'." + fi + OAUTH2_CALLBACK=/oauth2/callback + OAUTH2_PROXY_SECRET="$(echo \"This is a salt string to generate one consistent encryption key for the oauth2_proxy. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 32)" + add_private_oidc_redirect_url "${OAUTH2_CALLBACK}" + + log INFO "DataSHIELD setup detected -- will start DataSHIELD services." + OVERRIDE+=" -f ./$PROJECT/modules/datashield-compose.yml" + EXPORTER_OPAL_PASSWORD="$(generate_password \"exporter in Opal\")" + TOKEN_MANAGER_OPAL_PASSWORD="$(generate_password \"Token Manager in Opal\")" + OPAL_DB_PASSWORD="$(echo \"Opal DB\" | generate_simple_password)" + OPAL_ADMIN_PASSWORD="$(generate_password \"admin password for Opal\")" + RSTUDIO_ADMIN_PASSWORD="$(generate_password \"admin password for R-Studio\")" + DATASHIELD_CONNECT_SECRET="$(echo \"DataShield Connect\" | generate_simple_password)" + TOKEN_MANAGER_SECRET="$(echo \"Token Manager\" | generate_simple_password)" + if [ ! -e /tmp/bridgehead/opal-cert.pem ]; then + mkdir -p /tmp/bridgehead/ + openssl req -x509 -newkey rsa:4096 -nodes -keyout /tmp/bridgehead/opal-key.pem -out /tmp/bridgehead/opal-cert.pem -days 3650 -subj "/CN=opal/C=DE" + fi + mkdir -p /tmp/bridgehead/opal-map + sites="$(cat ./$PROJECT/modules/datashield-sites.json)" + echo "$sites" | docker_jq -n --args '{"sites": input | map({ + "name": ., + "id": ., + "virtualhost": "\(.):443", + "beamconnect": "datashield-connect.\(.).'"$BROKER_ID"'" + })}' $sites >/tmp/bridgehead/opal-map/central.json + echo "$sites" | docker_jq -n --args '[{ + "external": "'"$SITE_ID"':443", + "internal": "opal:8443", + "allowed": input | map("datashield-connect.\(.).'"$BROKER_ID"'") + }]' >/tmp/bridgehead/opal-map/local.json + if [ "$USER" == "root" ]; then + chown -R bridgehead:docker /tmp/bridgehead + chmod g+wr /tmp/bridgehead/opal-map/* + chmod g+r /tmp/bridgehead/opal-key.pem + fi + add_private_oidc_redirect_url "/opal/*" +fi diff --git a/ccp/modules/datashield-sites.json b/ccp/modules/datashield-sites.json new file mode 100644 index 0000000..07e2966 --- /dev/null +++ b/ccp/modules/datashield-sites.json @@ -0,0 +1,14 @@ +[ + "berlin", + "muenchen-lmu", + "dresden", + "freiburg", + "muenchen-tum", + "tuebingen", + "mainz", + "frankfurt", + "essen", + "dktk-datashield-test", + "dktk-test", + "mannheim" +] diff --git a/ccp/modules/datashield.md b/ccp/modules/datashield.md new file mode 100644 index 0000000..aa2c4cb --- /dev/null +++ b/ccp/modules/datashield.md @@ -0,0 +1,28 @@ +# DataSHIELD +This module constitutes the infrastructure to run DataSHIELD within the bridghead. +For more information about DataSHIELD, please visit https://www.datashield.org/ + +## R-Studio +To connect to the different bridgeheads of the CCP through DataSHIELD, you can use your own R-Studio environment. +However, this R-Studio has already installed the DataSHIELD libraries and is integrated within the bridgehead. +This can save you some time for extra configuration of your R-Studio environment. + +## Opal +This is the core of DataSHIELD. It is made up of Opal, a Postgres database and an R-server. +For more information about Opal, please visit https://opaldoc.obiba.org + +### Opal +Opal is OBiBa’s core database application for biobanks. + +### Opal-DB +Opal requires a database to import the data for DataSHIELD. We use a Postgres instance as database. +The data is imported within the bridgehead through the exporter. + +### Opal-R-Server +R-Server to execute R scripts in DataSHIELD. + +## Beam +### Beam-Connect +Beam-Connect is used to route http(s) traffic through beam to enable R-Studio to access data from other bridgeheads that have datashield enabled. +### Beam-Proxy +The usual beam proxy used for communication. diff --git a/ccp/modules/dnpm-setup.sh b/ccp/modules/dnpm-setup.sh index 21d356c..9ca4767 100644 --- a/ccp/modules/dnpm-setup.sh +++ b/ccp/modules/dnpm-setup.sh @@ -1,4 +1,4 @@ -#!/bin/bash +#!/bin/bash -e if [ -n "${ENABLE_DNPM}" ]; then log INFO "DNPM setup detected (Beam.Connect) -- will start Beam.Connect for DNPM." diff --git a/ccp/modules/export-and-qb.curl-templates b/ccp/modules/export-and-qb.curl-templates new file mode 100644 index 0000000..739c5af --- /dev/null +++ b/ccp/modules/export-and-qb.curl-templates @@ -0,0 +1,6 @@ +# Full Excel Export +curl --location --request POST 'https://${HOST}/ccp-exporter/request?query=Patient&query-format=FHIR_PATH&template-id=ccp&output-format=EXCEL' \ +--header 'x-api-key: ${EXPORT_API_KEY}' + +# QB +curl --location --request POST 'https://${HOST}/ccp-reporter/generate?template-id=ccp' diff --git a/ccp/modules/exporter-compose.yml b/ccp/modules/exporter-compose.yml new file mode 100644 index 0000000..d5eb227 --- /dev/null +++ b/ccp/modules/exporter-compose.yml @@ -0,0 +1,67 @@ +version: "3.7" + +services: + exporter: + image: docker.verbis.dkfz.de/ccp/dktk-exporter:latest + container_name: bridgehead-ccp-exporter + environment: + JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC" + LOG_LEVEL: "INFO" + EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh + CROSS_ORIGINS: "https://${HOST}" + EXPORTER_DB_USER: "exporter" + EXPORTER_DB_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh + EXPORTER_DB_URL: "jdbc:postgresql://exporter-db:5432/exporter" + HTTP_RELATIVE_PATH: "/ccp-exporter" + SITE: "${SITE_ID}" + HTTP_SERVLET_REQUEST_SCHEME: "https" + OPAL_PASSWORD: "${EXPORTER_OPAL_PASSWORD}" + labels: + - "traefik.enable=true" + - "traefik.http.routers.exporter_ccp.rule=PathPrefix(`/ccp-exporter`)" + - "traefik.http.services.exporter_ccp.loadbalancer.server.port=8092" + - "traefik.http.routers.exporter_ccp.tls=true" + - "traefik.http.middlewares.exporter_ccp_strip.stripprefix.prefixes=/ccp-exporter" + - "traefik.http.routers.exporter_ccp.middlewares=exporter_ccp_strip" + volumes: + - "/var/cache/bridgehead/ccp/exporter-files:/app/exporter-files/output" + + exporter-db: + image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG} + container_name: bridgehead-ccp-exporter-db + environment: + POSTGRES_USER: "exporter" + POSTGRES_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh + POSTGRES_DB: "exporter" + volumes: + # Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer. + - "/var/cache/bridgehead/ccp/exporter-db:/var/lib/postgresql/data" + + reporter: + image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest + container_name: bridgehead-ccp-reporter + environment: + JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC" + LOG_LEVEL: "INFO" + CROSS_ORIGINS: "https://${HOST}" + HTTP_RELATIVE_PATH: "/ccp-reporter" + SITE: "${SITE_ID}" + EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh + EXPORTER_URL: "http://exporter:8092" + LOG_FHIR_VALIDATION: "false" + HTTP_SERVLET_REQUEST_SCHEME: "https" + + # In this initial development state of the bridgehead, we are trying to have so many volumes as possible. + # However, in the first executions in the CCP sites, this volume seems to be very important. A report is + # a process that can take several hours, because it depends on the exporter. + # There is a risk that the bridgehead restarts, losing the already created export. + + volumes: + - "/var/cache/bridgehead/ccp/reporter-files:/app/reports" + labels: + - "traefik.enable=true" + - "traefik.http.routers.reporter_ccp.rule=PathPrefix(`/ccp-reporter`)" + - "traefik.http.services.reporter_ccp.loadbalancer.server.port=8095" + - "traefik.http.routers.reporter_ccp.tls=true" + - "traefik.http.middlewares.reporter_ccp_strip.stripprefix.prefixes=/ccp-reporter" + - "traefik.http.routers.reporter_ccp.middlewares=reporter_ccp_strip" diff --git a/ccp/modules/exporter-setup.sh b/ccp/modules/exporter-setup.sh new file mode 100644 index 0000000..9b947a6 --- /dev/null +++ b/ccp/modules/exporter-setup.sh @@ -0,0 +1,8 @@ +#!/bin/bash -e + +if [ "$ENABLE_EXPORTER" == true ]; then + log INFO "Exporter setup detected -- will start Exporter service." + OVERRIDE+=" -f ./$PROJECT/modules/exporter-compose.yml" + EXPORTER_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)" + EXPORTER_API_KEY="$(echo \"This is a salt string to generate one consistent API KEY for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 64)" +fi diff --git a/ccp/modules/exporter.md b/ccp/modules/exporter.md new file mode 100644 index 0000000..24e81b0 --- /dev/null +++ b/ccp/modules/exporter.md @@ -0,0 +1,15 @@ +# Exporter and Reporter + + +## Exporter +The exporter is a REST API that exports the data of the different databases of the bridgehead in a set of tables. +It can accept different output formats as CSV, Excel, JSON or XML. It can also export data into Opal. + +## Exporter-DB +It is a database to save queries for its execution in the exporter. +The exporter manages also the different executions of the same query in through the database. + +## Reporter +This component is a plugin of the exporter that allows to create more complex Excel reports described in templates. +It is compatible with different template engines as Groovy, Thymeleaf,... +It is perfect to generate a document as our traditional CCP quality report. diff --git a/ccp/modules/id-management-compose.yml b/ccp/modules/id-management-compose.yml index 11d45cb..06d408f 100644 --- a/ccp/modules/id-management-compose.yml +++ b/ccp/modules/id-management-compose.yml @@ -1,4 +1,5 @@ version: "3.7" + services: id-manager: image: docker.verbis.dkfz.de/bridgehead/magicpl @@ -43,7 +44,7 @@ services: - patientlist-db patientlist-db: - image: docker.verbis.dkfz.de/cache/postgres:15.6-alpine + image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG} container_name: bridgehead-patientlist-db environment: POSTGRES_USER: "mainzelliste" diff --git a/ccp/modules/id-management-setup.sh b/ccp/modules/id-management-setup.sh index 1b347e7..3165956 100644 --- a/ccp/modules/id-management-setup.sh +++ b/ccp/modules/id-management-setup.sh @@ -1,4 +1,4 @@ -#!/bin/bash +#!/bin/bash -e function idManagementSetup() { if [ -n "$IDMANAGER_UPLOAD_APIKEY" ]; then diff --git a/ccp/modules/mtba-compose.yml b/ccp/modules/mtba-compose.yml index 60845f5..56bb015 100644 --- a/ccp/modules/mtba-compose.yml +++ b/ccp/modules/mtba-compose.yml @@ -2,7 +2,7 @@ version: "3.7" services: mtba: - image: docker.verbis.dkfz.de/cache/samply/mtba:1.0.0 + image: docker.verbis.dkfz.de/cache/samply/mtba:develop container_name: bridgehead-mtba environment: BLAZE_STORE_URL: http://blaze:8080 @@ -11,22 +11,30 @@ services: ID_MANAGER_API_KEY: ${IDMANAGER_UPLOAD_APIKEY} ID_MANAGER_PSEUDONYM_ID_TYPE: BK_${IDMANAGEMENT_FRIENDLY_ID}_L-ID ID_MANAGER_URL: http://id-manager:8080/id-manager - PATIENT_CSV_FIRST_NAME_HEADER: ${MTBA_PATIENT_CSV_FIRST_NAME_HEADER} - PATIENT_CSV_LAST_NAME_HEADER: ${MTBA_PATIENT_CSV_LAST_NAME_HEADER} - PATIENT_CSV_GENDER_HEADER: ${MTBA_PATIENT_CSV_GENDER_HEADER} - PATIENT_CSV_BIRTHDAY_HEADER: ${MTBA_PATIENT_CSV_BIRTHDAY_HEADER} + PATIENT_CSV_FIRST_NAME_HEADER: ${MTBA_PATIENT_CSV_FIRST_NAME_HEADER:-FIRST_NAME} + PATIENT_CSV_LAST_NAME_HEADER: ${MTBA_PATIENT_CSV_LAST_NAME_HEADER:-LAST_NAME} + PATIENT_CSV_GENDER_HEADER: ${MTBA_PATIENT_CSV_GENDER_HEADER:-GENDER} + PATIENT_CSV_BIRTHDAY_HEADER: ${MTBA_PATIENT_CSV_BIRTHDAY_HEADER:-BIRTHDAY} CBIOPORTAL_URL: http://cbioportal:8080 - FILE_CHARSET: ${MTBA_FILE_CHARSET} - FILE_END_OF_LINE: ${MTBA_FILE_END_OF_LINE} - CSV_DELIMITER: ${MTBA_CSV_DELIMITER} + FILE_CHARSET: ${MTBA_FILE_CHARSET:-UTF-8} + FILE_END_OF_LINE: ${MTBA_FILE_END_OF_LINE:-LF} + CSV_DELIMITER: ${MTBA_CSV_DELIMITER:-TAB} + HTTP_RELATIVE_PATH: "/mtba" + OIDC_ADMIN_GROUP: "${OIDC_ADMIN_GROUP}" + OIDC_CLIENT_ID: "${OIDC_PRIVATE_CLIENT_ID}" + OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}" + OIDC_REALM: "${OIDC_REALM}" + OIDC_URL: "${OIDC_URL}" + labels: - "traefik.enable=true" - - "traefik.http.routers.mtba.rule=PathPrefix(`/`)" - - "traefik.http.services.mtba.loadbalancer.server.port=80" - - "traefik.http.routers.mtba.tls=true" + - "traefik.http.routers.mtba_ccp.rule=PathPrefix(`/mtba`)" + - "traefik.http.services.mtba_ccp.loadbalancer.server.port=8480" + - "traefik.http.routers.mtba_ccp.tls=true" + volumes: - - /tmp/bridgehead/mtba/input:/app/input - - /tmp/bridgehead/mtba/persist:/app/persist + - /var/cache/bridgehead/ccp/mtba/input:/app/input + - /var/cache/bridgehead/ccp/mtba/persist:/app/persist # TODO: Include CBioPortal in Deployment ... # NOTE: CBioPortal can't load data while the system is running. So after import of data bridgehead needs to be restarted! diff --git a/ccp/modules/mtba-setup.sh b/ccp/modules/mtba-setup.sh index ac050e0..cdf0f31 100644 --- a/ccp/modules/mtba-setup.sh +++ b/ccp/modules/mtba-setup.sh @@ -1,4 +1,4 @@ -#!/bin/bash +#!/bin/bash -e function mtbaSetup() { if [ -n "$ENABLE_MTBA" ];then @@ -8,5 +8,6 @@ function mtbaSetup() { exit 1; fi OVERRIDE+=" -f ./$PROJECT/modules/mtba-compose.yml" + add_private_oidc_redirect_url "/mtba/*" fi -} \ No newline at end of file +} diff --git a/ccp/modules/mtba.md b/ccp/modules/mtba.md new file mode 100644 index 0000000..400cb4d --- /dev/null +++ b/ccp/modules/mtba.md @@ -0,0 +1,6 @@ +# Molecular Tumor Board Alliance (MTBA) + +In this module, the genetic data to import is stored in a directory (/tmp/bridgehead/mtba/input). A process checks +regularly if there are files in the directory. The files are pseudonomized when the IDAT is provided. The files are +combined with clinical data of the blaze and imported in cBioPortal. On the other hand, this files are also imported in +Blaze. diff --git a/ccp/modules/nngm-compose.yml b/ccp/modules/nngm-compose.yml index e61532d..7ffa190 100644 --- a/ccp/modules/nngm-compose.yml +++ b/ccp/modules/nngm-compose.yml @@ -1,4 +1,5 @@ version: "3.7" + volumes: nngm-rest: @@ -21,9 +22,6 @@ services: - "traefik.http.routers.connector.middlewares=connector_strip,auth-nngm" volumes: - nngm-rest:/var/log - traefik: labels: - "traefik.http.middlewares.auth-nngm.basicauth.users=${NNGM_AUTH}" - - diff --git a/ccp/modules/nngm-setup.sh b/ccp/modules/nngm-setup.sh index 56be949..48fc45e 100644 --- a/ccp/modules/nngm-setup.sh +++ b/ccp/modules/nngm-setup.sh @@ -1,4 +1,4 @@ -#!/bin/bash +#!/bin/bash -e if [ -n "$NNGM_CTS_APIKEY" ]; then log INFO "nNGM setup detected -- will start nNGM Connector." diff --git a/ccp/modules/teiler-compose.yml b/ccp/modules/teiler-compose.yml new file mode 100644 index 0000000..f415ee9 --- /dev/null +++ b/ccp/modules/teiler-compose.yml @@ -0,0 +1,81 @@ +version: "3.7" + +services: + + teiler-orchestrator: + image: docker.verbis.dkfz.de/cache/samply/teiler-orchestrator:latest + container_name: bridgehead-teiler-orchestrator + labels: + - "traefik.enable=true" + - "traefik.http.routers.teiler_orchestrator_ccp.rule=PathPrefix(`/ccp-teiler`)" + - "traefik.http.services.teiler_orchestrator_ccp.loadbalancer.server.port=9000" + - "traefik.http.routers.teiler_orchestrator_ccp.tls=true" + - "traefik.http.middlewares.teiler_orchestrator_ccp_strip.stripprefix.prefixes=/ccp-teiler" + - "traefik.http.routers.teiler_orchestrator_ccp.middlewares=teiler_orchestrator_ccp_strip" + environment: + TEILER_BACKEND_URL: "https://${HOST}/ccp-teiler-backend" + TEILER_DASHBOARD_URL: "https://${HOST}/ccp-teiler-dashboard" + DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE_LOWER_CASE}" + HTTP_RELATIVE_PATH: "/ccp-teiler" + + teiler-dashboard: + image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop + container_name: bridgehead-teiler-dashboard + labels: + - "traefik.enable=true" + - "traefik.http.routers.teiler_dashboard_ccp.rule=PathPrefix(`/ccp-teiler-dashboard`)" + - "traefik.http.services.teiler_dashboard_ccp.loadbalancer.server.port=80" + - "traefik.http.routers.teiler_dashboard_ccp.tls=true" + - "traefik.http.middlewares.teiler_dashboard_ccp_strip.stripprefix.prefixes=/ccp-teiler-dashboard" + - "traefik.http.routers.teiler_dashboard_ccp.middlewares=teiler_dashboard_ccp_strip" + environment: + DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}" + TEILER_BACKEND_URL: "https://${HOST}/ccp-teiler-backend" + OIDC_URL: "${OIDC_URL}" + OIDC_REALM: "${OIDC_REALM}" + OIDC_CLIENT_ID: "${OIDC_PUBLIC_CLIENT_ID}" + OIDC_TOKEN_GROUP: "${OIDC_GROUP_CLAIM}" + TEILER_ADMIN_NAME: "${OPERATOR_FIRST_NAME} ${OPERATOR_LAST_NAME}" + TEILER_ADMIN_EMAIL: "${OPERATOR_EMAIL}" + TEILER_ADMIN_PHONE: "${OPERATOR_PHONE}" + TEILER_PROJECT: "${PROJECT}" + EXPORTER_API_KEY: "${EXPORTER_API_KEY}" + TEILER_ORCHESTRATOR_URL: "https://${HOST}/ccp-teiler" + TEILER_DASHBOARD_HTTP_RELATIVE_PATH: "/ccp-teiler-dashboard" + TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/ccp-teiler" + TEILER_USER: "${OIDC_USER_GROUP}" + TEILER_ADMIN: "${OIDC_ADMIN_GROUP}" + REPORTER_DEFAULT_TEMPLATE_ID: "ccp-qb" + EXPORTER_DEFAULT_TEMPLATE_ID: "ccp" + + + teiler-backend: + image: docker.verbis.dkfz.de/ccp/dktk-teiler-backend:latest + container_name: bridgehead-teiler-backend + labels: + - "traefik.enable=true" + - "traefik.http.routers.teiler_backend_ccp.rule=PathPrefix(`/ccp-teiler-backend`)" + - "traefik.http.services.teiler_backend_ccp.loadbalancer.server.port=8085" + - "traefik.http.routers.teiler_backend_ccp.tls=true" + - "traefik.http.middlewares.teiler_backend_ccp_strip.stripprefix.prefixes=/ccp-teiler-backend" + - "traefik.http.routers.teiler_backend_ccp.middlewares=teiler_backend_ccp_strip" + environment: + LOG_LEVEL: "INFO" + APPLICATION_PORT: "8085" + APPLICATION_ADDRESS: "${HOST}" + DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}" + CONFIG_ENV_VAR_PATH: "/run/secrets/ccp.conf" + TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/ccp-teiler" + TEILER_ORCHESTRATOR_URL: "https://${HOST}/ccp-teiler" + TEILER_DASHBOARD_DE_URL: "https://${HOST}/ccp-teiler-dashboard/de" + TEILER_DASHBOARD_EN_URL: "https://${HOST}/ccp-teiler-dashboard/en" + CENTRAX_URL: "${CENTRAXX_URL}" + HTTP_PROXY: "http://forward_proxy:3128" + ENABLE_MTBA: "${ENABLE_MTBA}" + ENABLE_DATASHIELD: "${ENABLE_DATASHIELD}" + secrets: + - ccp.conf + +secrets: + ccp.conf: + file: /etc/bridgehead/ccp.conf diff --git a/ccp/modules/teiler-setup.sh b/ccp/modules/teiler-setup.sh new file mode 100644 index 0000000..eed3f81 --- /dev/null +++ b/ccp/modules/teiler-setup.sh @@ -0,0 +1,9 @@ +#!/bin/bash -e + +if [ "$ENABLE_TEILER" == true ];then + log INFO "Teiler setup detected -- will start Teiler services." + OVERRIDE+=" -f ./$PROJECT/modules/teiler-compose.yml" + TEILER_DEFAULT_LANGUAGE=DE + TEILER_DEFAULT_LANGUAGE_LOWER_CASE=${TEILER_DEFAULT_LANGUAGE,,} + add_public_oidc_redirect_url "/ccp-teiler/*" +fi diff --git a/ccp/modules/teiler.md b/ccp/modules/teiler.md new file mode 100644 index 0000000..51e94e4 --- /dev/null +++ b/ccp/modules/teiler.md @@ -0,0 +1,19 @@ +# Teiler +This module orchestrates the different microfrontends of the bridgehead as a single page application. + +## Teiler Orchestrator +Single SPA component that consists on the root HTML site of the single page application and a javascript code that +gets the information about the microfrontend calling the teiler backend and is responsible for registering them. With the +resulting mapping, it can initialize, mount and unmount the required microfrontends on the fly. + +The microfrontends run independently in different containers and can be based on different frameworks (Angular, Vue, React,...) +This microfrontends can run as single alone but need an extension with Single-SPA (https://single-spa.js.org/docs/ecosystem). +There are also available three templates (Angular, Vue, React) to be directly extended to be used directly in the teiler. + +## Teiler Dashboard +It consists on the main dashboard and a set of embedded services. +### Login +user and password in ccp.local.conf + +## Teiler Backend +In this component, the microfrontends are configured. diff --git a/ccp/vars b/ccp/vars index 7cfb7db..fa3f5a2 100644 --- a/ccp/vars +++ b/ccp/vars @@ -8,6 +8,17 @@ PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem BROKER_URL_FOR_PREREQ=$BROKER_URL +OIDC_USER_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})" +OIDC_ADMIN_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})_Verwalter" +OIDC_PRIVATE_CLIENT_ID=${SITE_ID}-private +OIDC_PUBLIC_CLIENT_ID=${SITE_ID}-public +# Use "test-realm-01" for testing +OIDC_REALM="${OIDC_REALM:-master}" +OIDC_URL="https://login.verbis.dkfz.de" +OIDC_ISSUER_URL="${OIDC_URL}/realms/${OIDC_REALM}" +OIDC_GROUP_CLAIM="groups" + +POSTGRES_TAG=15.6-alpine for module in $PROJECT/modules/*.sh do @@ -17,4 +28,4 @@ done idManagementSetup mtbaSetup -adt2fhirRestSetup \ No newline at end of file +adt2fhirRestSetup diff --git a/lib/functions.sh b/lib/functions.sh index b4dc876..f277368 100644 --- a/lib/functions.sh +++ b/lib/functions.sh @@ -261,3 +261,113 @@ add_basic_auth_user() { log DEBUG "Saving clear text credentials in $FILE. If wanted, delete them manually." sed -i "/^$NAME/ s|$|\n# User: $USER\n# Password: $PASSWORD|" $FILE } + +OIDC_PUBLIC_REDIRECT_URLS=${OIDC_PUBLIC_REDIRECT_URLS:-""} +OIDC_PRIVATE_REDIRECT_URLS=${OIDC_PRIVATE_REDIRECT_URLS:-""} + +# Add a redirect url to the public oidc client of the bridgehead +function add_public_oidc_redirect_url() { + if [[ $OIDC_PUBLIC_REDIRECT_URLS == "" ]]; then + OIDC_PUBLIC_REDIRECT_URLS+="$(generate_redirect_urls $1)" + else + OIDC_PUBLIC_REDIRECT_URLS+=",$(generate_redirect_urls $1)" + fi +} + +# Add a redirect url to the private oidc client of the bridgehead +function add_private_oidc_redirect_url() { + if [[ $OIDC_PRIVATE_REDIRECT_URLS == "" ]]; then + OIDC_PRIVATE_REDIRECT_URLS+="$(generate_redirect_urls $1)" + else + OIDC_PRIVATE_REDIRECT_URLS+=",$(generate_redirect_urls $1)" + fi +} + +function sync_secrets() { + local delimiter=$'\x1E' + local secret_sync_args="" + if [[ $OIDC_PRIVATE_REDIRECT_URLS != "" ]]; then + secret_sync_args="OIDC:OIDC_CLIENT_SECRET:private;$OIDC_PRIVATE_REDIRECT_URLS" + fi + if [[ $OIDC_PRIVATE_REDIRECT_URLS != "" ]]; then + if [[ $secret_sync_args == "" ]]; then + secret_sync_args="OIDC:OIDC_PUBLIC:public;$OIDC_PUBLIC_REDIRECT_URLS" + else + secret_sync_args+="${delimiter}OIDC:OIDC_PUBLIC:public;$OIDC_PUBLIC_REDIRECT_URLS" + fi + fi + if [[ $secret_sync_args == "" ]]; then + return + fi + mkdir -p /var/cache/bridgehead/secrets/ || fail_and_report 1 "Failed to create '/var/cache/bridgehead/secrets/'. Please run sudo './bridgehead install $PROJECT' again." + touch /var/cache/bridgehead/secrets/oidc + docker run --rm \ + -v /var/cache/bridgehead/secrets/oidc:/usr/local/cache \ + -v $PRIVATEKEYFILENAME:/run/secrets/privkey.pem:ro \ + -v /srv/docker/bridgehead/$PROJECT/root.crt.pem:/run/secrets/root.crt.pem:ro \ + -v /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro \ + -e TLS_CA_CERTIFICATES_DIR=/conf/trusted-ca-certs \ + -e NO_PROXY=localhost,127.0.0.1 \ + -e ALL_PROXY=$HTTPS_PROXY_FULL_URL \ + -e PROXY_ID=$PROXY_ID \ + -e BROKER_URL=$BROKER_URL \ + -e OIDC_PROVIDER=secret-sync-central.oidc-client-enrollment.$BROKER_ID \ + -e SECRET_DEFINITIONS=$secret_sync_args \ + docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest + + set -a # Export variables as environment variables + source /var/cache/bridgehead/secrets/* + set +a # Export variables in the regular way +} + +capitalize_first_letter() { + input="$1" + capitalized="$(tr '[:lower:]' '[:upper:]' <<< ${input:0:1})${input:1}" + echo "$capitalized" +} + +# Generate a string of ',' separated string of redirect urls relative to $HOST. +# $1 will be appended to the url +# If the host looks like dev-jan.inet.dkfz-heidelberg.de it will generate urls with dev-jan and the original $HOST as url Authorities +function generate_redirect_urls(){ + local redirect_urls="https://${HOST}$1" + local host_without_proxy="$(echo "$HOST" | cut -d '.' -f1)" + # Only append second url if its different and the host is not an ip address + if [[ "$HOST" != "$host_without_proxy" && ! "$HOST" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + redirect_urls+=",https://$host_without_proxy$1" + fi + echo "$redirect_urls" +} + +# This password contains at least one special char, a random number and a random upper and lower case letter +generate_password(){ + local seed_text="$1" + local seed_num=$(awk 'BEGIN{FS=""} NR==1{print $10}' /etc/bridgehead/pki/${SITE_ID}.priv.pem | od -An -tuC) + local nums="1234567890" + local n=$(echo "$seed_num" | awk '{print $1 % 10}') + local random_digit=${nums:$n:1} + local n=$(echo "$seed_num" | awk '{print $1 % 26}') + local upper="ABCDEFGHIJKLMNOPQRSTUVWXYZ" + local lower="abcdefghijklmnopqrstuvwxyz" + local random_upper=${upper:$n:1} + local random_lower=${lower:$n:1} + local n=$(echo "$seed_num" | awk '{print $1 % 8}') + local special='@#$%^&+=' + local random_special=${special:$n:1} + + local combined_text="This is a salt string to generate one consistent password for ${seed_text}. It is not required to be secret." + local main_password=$(echo "${combined_text}" | sha1sum | openssl pkeyutl -sign -inkey "/etc/bridgehead/pki/${SITE_ID}.priv.pem" 2> /dev/null | base64 | head -c 26 | sed 's/\//A/g') + + echo "${main_password}${random_digit}${random_upper}${random_lower}${random_special}" +} + +# This password only contains alphanumeric characters +generate_simple_password(){ + local seed_text="$1" + local combined_text="This is a salt string to generate one consistent password for ${seed_text}. It is not required to be secret." + echo "${combined_text}" | sha1sum | openssl pkeyutl -sign -inkey "/etc/bridgehead/pki/${SITE_ID}.priv.pem" 2> /dev/null | base64 | head -c 26 | sed 's/[+\/]/A/g' +} + +docker_jq() { + docker run --rm -i docker.verbis.dkfz.de/cache/jqlang/jq:latest "$@" +} diff --git a/lib/prepare-system.sh b/lib/prepare-system.sh index cd470b2..156f7c8 100755 --- a/lib/prepare-system.sh +++ b/lib/prepare-system.sh @@ -89,6 +89,9 @@ elif [[ "$DEV_MODE" == "DEV" ]]; then fi chown -R bridgehead /etc/bridgehead /srv/docker/bridgehead +mkdir -p /tmp/bridgehead /var/cache/bridgehead +chown -R bridgehead:docker /tmp/bridgehead /var/cache/bridgehead +chmod -R g+wr /var/cache/bridgehead /tmp/bridgehead log INFO "System preparation is completed and configuration is present." diff --git a/minimal/docker-compose.yml b/minimal/docker-compose.yml index 9a43953..e9f53d6 100644 --- a/minimal/docker-compose.yml +++ b/minimal/docker-compose.yml @@ -42,6 +42,9 @@ services: - /var/spool/squid volumes: - /etc/bridgehead/trusted-ca-certs:/docker/custom-certs/:ro + healthcheck: + # Wait 1s before marking this service healthy. Required for the oauth2-proxy to talk to the OIDC provider on startup which will fail if the forward proxy is not started yet. + test: ["CMD", "sleep", "1"] landing: container_name: bridgehead-landingpage @@ -55,5 +58,3 @@ services: HOST: ${HOST} PROJECT: ${PROJECT} SITE_NAME: ${SITE_NAME} - -