From 7e172faf5f6a87265828060491ab921a0b7276d2 Mon Sep 17 00:00:00 2001 From: David Juarez Date: Mon, 27 Jul 2026 16:36:08 +0200 Subject: [PATCH] chore: add project manager, exporter and teiler to cce --- cce/modules/exporter-compose.yml | 6 +- cce/modules/project-manager-compose.yml | 163 ++++++++++++++++++++++++ cce/modules/project-manager-setup.sh | 20 +++ cce/modules/teiler-compose.yml | 8 ++ cce/modules/teiler-setup.sh | 1 + cce/vars | 8 ++ 6 files changed, 205 insertions(+), 1 deletion(-) create mode 100644 cce/modules/project-manager-compose.yml create mode 100644 cce/modules/project-manager-setup.sh diff --git a/cce/modules/exporter-compose.yml b/cce/modules/exporter-compose.yml index af31465..2945bad 100644 --- a/cce/modules/exporter-compose.yml +++ b/cce/modules/exporter-compose.yml @@ -16,7 +16,7 @@ services: HTTP_RELATIVE_PATH: "/cce-exporter" SITE: "${SITE_ID}" HTTP_SERVLET_REQUEST_SCHEME: "https" - OPAL_PASSWORD: "${EXPORTER_OPAL_PASSWORD}" + OPAL_PASSWORD: "XXX" # Opal not configured labels: - "traefik.enable=true" - "traefik.http.routers.exporter_cce.rule=PathPrefix(`/cce-exporter`)" @@ -85,3 +85,7 @@ services: - "traefik.http.routers.reporter_cce_api.tls=true" - "traefik.http.routers.reporter_cce_api.priority=25" + focus: + environment: + EXPORTER_URL: "http://exporter:8092" + EXPORTER_API_KEY: "${EXPORTER_API_KEY}" diff --git a/cce/modules/project-manager-compose.yml b/cce/modules/project-manager-compose.yml new file mode 100644 index 0000000..957dcee --- /dev/null +++ b/cce/modules/project-manager-compose.yml @@ -0,0 +1,163 @@ +version: "3.9" + +services: + + beam-proxy: + environment: + APP_project-manager_KEY: ${BEAM_SECRET_PROJECT_MANAGER} + + project-manager-api: + container_name: project-manager-api + image: docker.verbis.dkfz.de/ccp/cce-project-manager:latest + environment: + ROOT_LOG_LEVEL: "${PM_ROOT_LOG_LEVEL:-INFO}" # Default to INFO if not set + LOG_LEVEL: "${PM_LOG_LEVEL:-INFO}" # Use LOG_LEVEL, or ROOT_LOG_LEVEL if LOG_LEVEL is not set + BEAM_API_KEY: "${BEAM_SECRET_PROJECT_MANAGER}" + BEAM_PROJECT_MANAGER_ID: "project-manager.${PROXY_ID}" + BEAM_URL: "http://beam-proxy:8081" + FRONTEND_BASEURL: "https://${HOST}/requester" + BACKEND_BASEURL: "https://${HOST}/requester-api" + PROJECT_MANAGER_DB_URL: "jdbc:postgresql://project-manager-api-db:5432/project_manager" + PROJECT_MANAGER_DB_USER: "project_manager" + PROJECT_MANAGER_DB_PASSWORD: "${PROJECT_MANAGER_DB_PASSWORD}" + ENABLE_CODER: "false" + ENABLE_EMAILS: "true" + ENABLE_EXPORTER: "${ENABLE_EXPORTER:-false}" + ENABLE_TOKEN_MANAGER: "false" + ENABLE_APP_REGISTER: "false" + SERVER_SERVLET_CONTEXT_PATH: "/project-manager-api" + # https://docs.spring.io/spring-boot/docs/2.7.15/reference/html/howto.html#howto.webserver.configure-access-logs + # The follwing variable allows to redirect to OIDC server using https instead of http + SERVER_FORWARD_HEADERS_STRATEGY: "framework" + HTTP_PROXY_URL: "http://forward_proxy:3128" + HTTP_PROXY_NOPROXY: "beam-proxy,token-manager,beam-register" + SPRING_MAIL_TEST_HOST: "test-smtp-server" + SPRING_MAIL_TEST_PORT: "1025" + TEST_EMAIL_DOMAINS: "test.dkfz.de" + DB_ENCRYPTION_PRIVATE_KEY_IN_BASE64: "${PROJECT_MANAGER_DB_ENCRYPTION_PRIVATE_KEY_IN_BASE64}" + OIDC_CLIENT_ID: "${OIDC_PUBLIC_CLIENT_ID}" + OIDC_CLIENT_SECRET: "${OIDC_PUBLIC}" + OIDC_URL: "${OIDC_URL}" + + # Ignore these variables. Remove after disable module in project manager doesn't require disabled module variables + APP_REGISTER_BASE_URL: "http://beam-register:3000" + APP_REGISTER_API_KEY: "XXX" + CODER_MEMBER_ID: "XXX" + CODER_ORGANISATION_ID: "XXX" + CODER_SESSION_TOKEN: "XXX" + CODER_BEAM_ID_SUFFIX: "XXX" + TOKEN_MANAGER_URL: "http://token-manager:3030" # Ignore me for the moment. Later remove me. + + labels: + - "traefik.enable=true" + - "traefik.http.routers.project-manager-api.rule=PathPrefix(`/requester-api`)" + - "traefik.http.services.project-manager-api.loadbalancer.server.port=8097" + - "traefik.http.routers.project-manager-api.tls=true" + volumes: + - project-manager-api:/app/documents + depends_on: + project-manager-api-db: + condition: service_healthy + networks: + - traefik + - default + + project-manager-api-db: + container_name: project-manager-api-db + image: postgres:${POSTGRES_VERSION} + environment: + POSTGRES_USER: "project_manager" + POSTGRES_PASSWORD: "${PROJECT_MANAGER_DB_PASSWORD}" + POSTGRES_DB: "project_manager" + PGDATA: "/var/lib/postgresql/data/pgdata" # Prevent corruption during abrupt shutdowns + POSTGRES_INITDB_ARGS: "--encoding=UTF8 --lc-collate=C --lc-ctype=C" # Better sorting + command: > + postgres -c max_connections=200 + -c shared_buffers=1GB + -c work_mem=64MB + -c effective_cache_size=2GB + -c random_page_cost=1.1 + -c log_min_duration_statement=500 + -c idle_in_transaction_session_timeout=60000 + volumes: + - project-manager-db:/var/lib/postgresql/data + ports: + - "5432:5432" + healthcheck: + test: ["CMD-SHELL", "pg_isready -U project_manager"] + interval: 5s + timeout: 5s + retries: 5 + deploy: + resources: + limits: + cpus: "2" + memory: "2GB" + reservations: + cpus: "1" + memory: "512MB" + restart: unless-stopped + networks: + - traefik + + + project-manager-ui: + container_name: project-manager-ui + image: samply/project-manager-ui:develop + environment: + STANDALONE_SINGLE_SPA: "true" + VUE_APP_OIDC_URL: "${OIDC_URL}" + VUE_APP_OIDC_CLIENT_ID: "${OIDC_PUBLIC_CLIENT_ID}" + VUE_APP_PROJECT_MANAGER_BACKEND_URL: "https://${HOST}/requester-api" + VUE_APP_FRONTEND_NAME: "CCE BioDataHub Requester" + labels: + - "traefik.enable=true" + - "traefik.http.routers.project-manager-ui.rule=PathPrefix(`/requester`)" + - "traefik.http.services.project-manager-ui.loadbalancer.server.port=80" + - "traefik.http.routers.project-manager-ui.tls=true" + - "traefik.http.middlewares.project-manager-ui-headers.headers.customRequestHeaders.X-Forwarded-Proto=https" + - "traefik.http.routers.project-manager-ui.middlewares=project-manager-ui-headers" + networks: + - traefik + + test-smtp-server: + container_name: test-smtp-server + image: axllent/mailpit:${MAILPIT_VERSION} + labels: + - "traefik.enable=true" + - "traefik.http.routers.test-smtp-server.rule=PathPrefix(`/smtp`)" + - "traefik.http.services.test-smtp-server.loadbalancer.server.port=8025" + - "traefik.http.routers.test-smtp-server.tls=true" + - "traefik.http.routers.test-smtp-server.middlewares=auth-test-smtp-server" + - "traefik.http.middlewares.auth-test-smtp-server.basicauth.users=${TEST_SMTP_AUTH}" + environment: + MP_WEBROOT: "/smtp" # https://mailpit.axllent.org/docs/configuration/runtime-options/ + networks: + - traefik + + # GUI for administrating project-manager-api database + sql-gui: + container_name: sql-gui + image: dbeaver/cloudbeaver:${DBEAVER_VERSION} + environment: # https://dbeaver.com/docs/cloudbeaver/Server-configuration/ + CLOUDBEAVER_ROOT_URI: "/sql" + CB_ADMIN_NAME: "${DBEAVER_USER}" + CB_ADMIN_PASSWORD: "${DBEAVER_PASSWORD}" + CB_SERVER_URL: "https://${HOST}" + CB_SERVER_NAME: "Project Manager API Database" + volumes: + - cloudbeaver-data:/opt/cloudbeaver/workspace + labels: + - "traefik.enable=true" + - "traefik.http.routers.dbeaver.rule=PathPrefix(`/sql`)" + - "traefik.http.services.dbeaver.loadbalancer.server.port=8978" + - "traefik.http.routers.dbeaver.tls=true" + - "traefik.http.routers.dbeaver.middlewares=auth-dbeaver" + - "traefik.http.middlewares.auth-dbeaver.basicauth.users=${SQL_GUI_AUTH}" + networks: + - traefik + +volumes: + project-manager-db: + project-manager-api: + cloudbeaver-data: diff --git a/cce/modules/project-manager-setup.sh b/cce/modules/project-manager-setup.sh new file mode 100644 index 0000000..78efbd0 --- /dev/null +++ b/cce/modules/project-manager-setup.sh @@ -0,0 +1,20 @@ +#!/bin/bash -e + +if [ "$ENABLE_PROJECT_MANAGER" == true ]; then + log INFO "Project Manager setup detected -- will start Project Manager services." + OVERRIDE+=" -f ./$PROJECT/modules/project-manager-compose.yml" + + POSTGRES_VERSION="${POSTGRES_VERSION:-$POSTGRES_TAG}" + MAILPIT_VERSION="${MAILPIT_VERSION:-latest}" + DBEAVER_VERSION="${DBEAVER_VERSION:-latest}" + DBEAVER_USER="${DBEAVER_USER:-admin}" + + BEAM_SECRET_PROJECT_MANAGER="$(echo \"This is a salt string to generate one consistent beam secret for the project manager. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 64)" + PROJECT_MANAGER_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password for the project manager database. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)" + PROJECT_MANAGER_DB_ENCRYPTION_PRIVATE_KEY_IN_BASE64="$(echo \"This is a salt string to generate one encriptyion privae key for the project manager. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 64)" + DBEAVER_PASSWORD="$(echo \"This is a salt string to generate one consistent password for the project manager database GUI. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)" + SQL_GUI_AUTH="$(echo \"This is a salt string to generate one consistent basic authentication password for the project manager database GUI. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)" + TEST_SMTP_AUTH="$(echo \"This is a salt string to generate one consistent basic authentication password for the project manager test SMTP server. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)" + + add_public_oidc_redirect_url "/requester/*" +fi diff --git a/cce/modules/teiler-compose.yml b/cce/modules/teiler-compose.yml index 5bfcd2d..c5bf5a8 100644 --- a/cce/modules/teiler-compose.yml +++ b/cce/modules/teiler-compose.yml @@ -32,6 +32,9 @@ services: DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}" TEILER_BACKEND_URL: "/cce-teiler-backend" TEILER_DASHBOARD_URL: "/cce-teiler-dashboard" + OIDC_URL: "${OIDC_URL}" + OIDC_CLIENT_ID: "${OIDC_PUBLIC_CLIENT_ID}" + OIDC_TOKEN_GROUP: "${OIDC_GROUP_CLAIM}" TEILER_ADMIN_NAME: "${OPERATOR_FIRST_NAME} ${OPERATOR_LAST_NAME}" TEILER_ADMIN_EMAIL: "${OPERATOR_EMAIL}" TEILER_ADMIN_PHONE: "${OPERATOR_PHONE}" @@ -39,6 +42,8 @@ services: EXPORTER_API_KEY: "${EXPORTER_API_KEY}" TEILER_ORCHESTRATOR_URL: "/cce-teiler" TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/cce-teiler" + TEILER_USER: "${OIDC_USER_GROUP}" + TEILER_ADMIN: "${OIDC_ADMIN_GROUP}" REPORTER_DEFAULT_TEMPLATE_ID: "cce-qb" EXPORTER_DEFAULT_TEMPLATE_ID: "cce" @@ -62,3 +67,6 @@ services: TEILER_DASHBOARD_DE_URL: "/cce-teiler-dashboard/de" TEILER_DASHBOARD_EN_URL: "/cce-teiler-dashboard/en" HTTP_PROXY: "http://forward_proxy:3128" + ENABLE_MTBA: "false" + ENABLE_DATASHIELD: "false" + IDMANAGER_UPLOAD_APIKEY: "false" # Only used to check if the ID Manager is active diff --git a/cce/modules/teiler-setup.sh b/cce/modules/teiler-setup.sh index dc8dfc4..7c281cf 100644 --- a/cce/modules/teiler-setup.sh +++ b/cce/modules/teiler-setup.sh @@ -5,4 +5,5 @@ if [ "$ENABLE_TEILER" == true ];then OVERRIDE+=" -f ./$PROJECT/modules/teiler-compose.yml" TEILER_DEFAULT_LANGUAGE=EN TEILER_DEFAULT_LANGUAGE_LOWER_CASE=${TEILER_DEFAULT_LANGUAGE,,} + add_public_oidc_redirect_url "/cce-teiler/*" fi diff --git a/cce/vars b/cce/vars index 9338bd5..d798c16 100644 --- a/cce/vars +++ b/cce/vars @@ -7,6 +7,14 @@ SUPPORT_EMAIL=manoj.waikar@dkfz-heidelberg.de PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem BROKER_URL_FOR_PREREQ=$BROKER_URL +OIDC_USER_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})" +OIDC_ADMIN_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})_Verwalter" +OIDC_PRIVATE_CLIENT_ID=${SITE_ID}-private +OIDC_PUBLIC_CLIENT_ID=${SITE_ID}-public +OIDC_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PUBLIC_CLIENT_ID}/" +OIDC_PRIVATE_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PRIVATE_CLIENT_ID}/" +OIDC_GROUP_CLAIM="groups" + for module in $PROJECT/modules/*.sh do log DEBUG "sourcing $module"