mirror of
https://github.com/samply/bridgehead.git
synced 2025-06-16 20:40:15 +02:00
Compare commits
5 Commits
ehds2
...
feature/co
| Author | SHA1 | Date | |
|---|---|---|---|
| 7837d3b542 | |||
| d832cfdd43 | |||
| 4537617cd0 | |||
| 6fa587fe4f | |||
| 48d9a034c7 |
189
README.md
189
README.md
@ -9,7 +9,6 @@ This repository is the starting point for any information and tools you will nee
|
||||
- [Software](#software)
|
||||
- [Network](#network)
|
||||
2. [Deployment](#deployment)
|
||||
- [EHDS2/ECDC](#ehds2-ecdc)
|
||||
- [Site name](#site-name)
|
||||
- [Projects](#projects)
|
||||
- [GitLab repository](#gitlab-repository)
|
||||
@ -23,7 +22,6 @@ This repository is the starting point for any information and tools you will nee
|
||||
- [TLS terminating proxies](#tls-terminating-proxies)
|
||||
- [File structure](#file-structure)
|
||||
- [BBMRI-ERIC Directory entry needed](#bbmri-eric-directory-entry-needed)
|
||||
- [Loading data](#loading-data)
|
||||
4. [Things you should know](#things-you-should-know)
|
||||
- [Auto-Updates](#auto-updates)
|
||||
- [Auto-Backups](#auto-backups)
|
||||
@ -35,10 +33,6 @@ This repository is the starting point for any information and tools you will nee
|
||||
|
||||
## Requirements
|
||||
|
||||
The data protection group at your site will probably want to know exactly what our software does with patient data, and you may need to get their approval before you are allowed to install a Bridgehead. To help you with this, we have provided some data protection concepts:
|
||||
|
||||
- [Germany](https://www.bbmri.de/biobanking/it/infrastruktur/datenschutzkonzept/)
|
||||
|
||||
### Hardware
|
||||
|
||||
Hardware requirements strongly depend on the specific use-cases of your network as well as on the data it is going to serve. Most use-cases are well-served with the following configuration:
|
||||
@ -57,74 +51,27 @@ Ensure the following software (or newer) is installed:
|
||||
- docker >= 20.10.1
|
||||
- docker-compose >= 2.xx (`docker-compose` and `docker compose` are both supported).
|
||||
- systemd
|
||||
- curl
|
||||
|
||||
We recommend to install Docker(-compose) from its official sources as described on the [Docker website](https://docs.docker.com).
|
||||
|
||||
> 📝 Note for Ubuntu: Snap versions of Docker are not supported.
|
||||
Note for Ubuntu: Please note that snap versions of Docker are not supported.
|
||||
|
||||
Note for git and Docker: if you have a local proxy, you will need to adjust your setup appropriately, see [git proxy](https://gist.github.com/evantoli/f8c23a37eb3558ab8765) and [docker proxy](https://docs.docker.com/network/proxy/).
|
||||
|
||||
### Network
|
||||
|
||||
A Bridgehead communicates to all central components via outgoing HTTPS connections.
|
||||
A running Bridgehead requires an outgoing HTTPS proxy to communicate with the central components.
|
||||
|
||||
Your site might require an outgoing proxy (i.e. HTTPS forward proxy) to connect to external servers; you should discuss this with your local systems administration. In that case, you will need to note down the URL of the proxy. If the proxy requires authentication, you will also need to make a note of its username and password. This information will be used later on during the installation process. TLS terminating proxies are also supported, see [here](#tls-terminating-proxies). Apart from the Bridgehead itself, you may also need to configure the proxy server in [git](https://gist.github.com/evantoli/f8c23a37eb3558ab8765) and [docker](https://docs.docker.com/network/proxy/).
|
||||
Additionally, your site might use its own proxy. You should discuss this with your local systems administration. If a proxy is being used, you will need to note down the URL of the proxy. If it is a secure proxy, then you will also need to make a note of its username and password. This information will be used later on during the installation process.
|
||||
|
||||
The following URLs need to be accessible (prefix with `https://`):
|
||||
* To fetch code and configuration from git repositories
|
||||
* github.com
|
||||
* git.verbis.dkfz.de
|
||||
* To fetch docker images
|
||||
* docker.verbis.dkfz.de
|
||||
* Official Docker, Inc. URLs (subject to change, see [official list](https://docs.docker.com/desktop/all))
|
||||
* hub.docker.com
|
||||
* registry-1.docker.io
|
||||
* production.cloudflare.docker.com
|
||||
* To report bridgeheads operational status
|
||||
* healthchecks.verbis.dkfz.de
|
||||
* only for DKTK/CCP
|
||||
* broker.ccp-it.dktk.dkfz.de
|
||||
* only for BBMRI-ERIC
|
||||
* broker.bbmri.samply.de
|
||||
* gitlab.bbmri-eric.eu
|
||||
* only for German Biobank Node
|
||||
* broker.bbmri.de
|
||||
* only for EHDS2/ECDC
|
||||
* ecdc-vm-ehds-test1.swedencentral.cloudapp.azure.com
|
||||
Note that git and Docker may also need to be configured to use this proxy. This is a job for your systems administrators.
|
||||
|
||||
> 📝 This URL list is subject to change. Instead of the individual names, we highly recommend whitelisting wildcard domains: *.dkfz.de, github.com, *.docker.com, *.docker.io, *.samply.de, *.bbmri.de.
|
||||
If there is a site firewall, this needs to be configured so that outgoing calls to the following URLs are allowed: *.dkfz.de, github.com, docker.io, *.docker.io, *.samply.de.
|
||||
|
||||
> 📝 Ubuntu's pre-installed uncomplicated firewall (ufw) is known to conflict with Docker, more info [here](https://github.com/chaifeng/ufw-docker).
|
||||
Note for Ubuntu: Please note that the uncomplicated firewall (ufw) is known to conflict with Docker [here](https://github.com/chaifeng/ufw-docker).
|
||||
|
||||
## Deployment
|
||||
|
||||
### EHDS2/ECDC
|
||||
|
||||
The ECDC Bridgehead allows you to connect your site/node to the [AMR Explorer](http://ehds2-lens.swedencentral.cloudapp.azure.com/), a non-public central web site that allow certified researchers to search for information relating to antiobiotic resistance, Europe-wide. You can supply the Bridgehead with data from your site in the form of CSV files, which will then be made available to the Explorer for searching purposes.
|
||||
|
||||
You will need to set up some configuration before you can start a Bridgehead. This can be done as follows:
|
||||
|
||||
```shell
|
||||
sudo mkdir -p /etc/bridgehead
|
||||
sudo cp /srv/docker/bridgehead/bbmri/modules/bbmri.conf /etc/bridgehead
|
||||
```
|
||||
|
||||
Now edit ```/etc/bridgehead/bbmri.conf``` and customize the following variables for your site:
|
||||
|
||||
- SITE_NAME
|
||||
- SITE_ID
|
||||
- OPERATOR_FIRST_NAME
|
||||
- OPERATOR_LAST_NAME
|
||||
- OPERATOR_EMAIL
|
||||
|
||||
If you run a proxy at your site, you will also need to give values to the ```HTTP*_PROXY*``` variables.
|
||||
|
||||
When you first start the Bridgehead, it will clone two extra repositories into /srv/docker, namely, ```focus``` and ```transfair```. It will automatically build local images of these repositories for you. These components have the following functionality that has been customized for ECDC:
|
||||
|
||||
- *focus.* This component is responsible for completing the CQL that is used for running queries against the Blaze FHIR store. It uses a set of templates for doing this. Extra templates have been written for the ECDC use case. They can be found in /srv/docker/focus/resources/cql/EHDS2*.
|
||||
- *transfair.* This is an ETL component. It takes the CSV data that you provide, converts it to FHIR, and loads it to Blaze. This will be run once, if there is data in /srv/docker/ecdc/data. A lock file in the data directory ensures that it does not get run again. Remove this lock file and restart the Bridgehead if you want to load new data.
|
||||
|
||||
These images will normally be rebuilt every time you restart the Bridgehead. This is a workaround to fix a bug: if you don't rebuild these images for every start, then legacy versions will be used and you will lose the new ECDC functionality. The reason for this is still under investigation.
|
||||
|
||||
### Site name
|
||||
|
||||
You will need to choose a short name for your site. This is not a URL, just a simple identifying string. For the examples below, we will use "your-site-name", but you should obviously choose something that is meaningful to you and which is unique.
|
||||
@ -139,8 +86,6 @@ Site names should adhere to the following conventions:
|
||||
|
||||
### GitLab repository
|
||||
|
||||
You can skip this section if you are doing an ECDC/EHDS2 installation.
|
||||
|
||||
In order to be able to install, you will need to have your own repository in GitLab for your site's configuration settings. This allows automated updates of the Bridgehead software.
|
||||
|
||||
To request a new repository, please contact your research network administration or send an email to one of the project specific addresses:
|
||||
@ -156,31 +101,14 @@ Mention:
|
||||
We will set the repository up for you. We will then send you:
|
||||
|
||||
- A Repository Short Name (RSN). Beware: this is distinct from your site name.
|
||||
- Repository URL containing the acces token eg. https://BH_Dummy:dummy_token@git.verbis.dkfz.de/<project>-bridgehead-configs/dummy.git
|
||||
- Repository URL containing the acces token eg. https://BH_Dummy:dummy_token@git.verbis.dkfz.de/bbmri-bridgehead-configs/dummy.git
|
||||
|
||||
During the installation, your Bridgehead will download your site's configuration from GitLab and you can review the details provided to us by email.
|
||||
|
||||
|
||||
### Base Installation
|
||||
|
||||
Clone the bridgehead repository:
|
||||
```shell
|
||||
sudo mkdir -p /srv/docker/
|
||||
sudo git clone https://github.com/samply/bridgehead.git /srv/docker/bridgehead
|
||||
```
|
||||
|
||||
If this is an ECDC/EHDS2 installation, switch to the ```ehds2``` branch and copy the configuration file to the required location:
|
||||
```shell
|
||||
cd /srv/docker/bridgehead
|
||||
sudo git checkout ehds2
|
||||
sudo mkdir -p /etc/bridgehead/
|
||||
sudo cp bbmri/modules/bbmri.conf /etc/bridgehead/
|
||||
sudo vi /etc/bridgehead/bbmri.conf # Modify to include national node name and admin contact details
|
||||
```
|
||||
|
||||
For an ECDC/EHDS2 installation, you will also need to copy your data in a comma-separated value (CSV) formatted file to ```/srv/docker/ecdc/data```. Make sure it is readable by all. Only files with the ending ```.csv``` will be read in, all other files will be ignored.
|
||||
|
||||
If this is not an ECDC/EHDS2 installation, then download your site specific configuration repository:
|
||||
First, download your site specific configuration repository:
|
||||
```shell
|
||||
sudo mkdir -p /etc/bridgehead/
|
||||
sudo git clone <REPO_URL_FROM_EMAIL> /etc/bridgehead/
|
||||
@ -199,6 +127,12 @@ Pay special attention to:
|
||||
- OPERATOR_LAST_NAME
|
||||
- OPERATOR_EMAIL
|
||||
|
||||
Clone the bridgehead repository:
|
||||
```shell
|
||||
sudo mkdir -p /srv/docker/
|
||||
sudo git clone https://github.com/samply/bridgehead.git /srv/docker/bridgehead
|
||||
```
|
||||
|
||||
Then, run the installation script:
|
||||
|
||||
```shell
|
||||
@ -217,38 +151,8 @@ sudo ./bridgehead enroll <PROJECT>
|
||||
|
||||
... and follow the instructions on the screen. Please send your default Collection ID and the display name of your site together with the certificate request when you enroll. You should then be prompted to do the next step:
|
||||
|
||||
Note: if you are doing an ECDC/EHDS2 installation, you will need to perform the Beam certificate signing yourself. Do not send an email to either of the email addreesses suggested by the bridgehead enroll procedure. Instead, log on to the VM where Beam is running and perform the following (you will need root permissions):
|
||||
```shell
|
||||
cd /srv/docker/beam-broker
|
||||
sudo mkdir -p csr
|
||||
sudo vi csr/ecdc-bridgehead-<national node name>.csr # Copy and paste the certificate printed during the enroll
|
||||
sudo pki-scripts/managepki sign --csr-file csr/ecdc-bridgehead-<national node name>.csr --common-name=ecdc-bridgehead-<national node name>.broker.bbmri.samply.de
|
||||
```
|
||||
|
||||
You can check that the Bridgehead has connected to Beam with the following command:
|
||||
```shell
|
||||
pki-scripts/managepki list
|
||||
|
||||
```
|
||||
|
||||
### Starting and stopping your Bridgehead
|
||||
|
||||
For an ECDC/EHDS2 installation, this is done with the help of specialized scripts:
|
||||
|
||||
To start:
|
||||
|
||||
```shell
|
||||
sudo /srv/docker/bridgehead/run.sh
|
||||
```
|
||||
|
||||
To stop (you generally won't need to do this):
|
||||
|
||||
```shell
|
||||
sudo /srv/docker/bridgehead/stop.sh
|
||||
```
|
||||
|
||||
For regular installations, read on.
|
||||
|
||||
If you followed the above steps, your Bridgehead should already be configured to autostart (via systemd). If you would like to start/stop manually:
|
||||
|
||||
To start, run
|
||||
@ -390,45 +294,6 @@ Once you edited the gitlab config, the bridgehead will autoupdate the config wit
|
||||
|
||||
There will be a delay before the effects of Directory sync become visible. First, you will need to wait until the time you have specified in ```TIMER_CRON```. Second, the information will then be synchronized from your national node with the central European Directory. This can take up to 24 hours.
|
||||
|
||||
### Loading data
|
||||
|
||||
The data accessed by the federated search is held in the Bridgehead in a FHIR store (we use Blaze).
|
||||
|
||||
For an ECDC/EHDS2 installation, you need to provide your data as a table in a CSV (comma-separated value) files and place it in the directory /srv/docker/ecdc/data. You can provide as many data files as you like, and you can add new files incrementally over time.
|
||||
|
||||
In order for this new data to be loaded, you will need to execute the ```run.sh``` script with the appropriate arguments:
|
||||
|
||||
- To read just the most recently added data files: ```/srv/docker/bridgehead run.sh --upload```.
|
||||
- To read in all data from scratch: ```/srv/docker/bridgehead run.sh --upload-all```.
|
||||
|
||||
These two variants give you the choice between uploading data in an incremental way that preserves the date used for statistics or as a single upload that date stamps everything with the current date.
|
||||
|
||||
The Bridgehead can be started without data, but obviously, any searches run from the Explorer will return zero results for your site if you do that. Note that an empty data directory will automatically be inserted on the first start of the Bridgehead if you don't set one up yourself.
|
||||
|
||||
For non-ECDC setups, read on.
|
||||
|
||||
You can load data into this store by using its FHIR API:
|
||||
|
||||
```
|
||||
https://<Name of your server>/bbmri-localdatamanagement/fhir
|
||||
```
|
||||
The name of your server will generally be the full name of the VM that the Bridgehead runs on. You can alternatively supply an IP address.
|
||||
|
||||
The FHIR API uses basic auth. You can find the credentials in `/etc/bridgehead/<project>.local.conf`.
|
||||
|
||||
Note that if you don't have a DNS certificate for the Bridgehead, you will need to allow an insecure connection. E.g. with curl, use the `-k` flag.
|
||||
|
||||
The storage space on your hard drive will depend on the number of FHIR resources that you intend to generate. This will be the sum of the number of patients/subjects, the number of samples, the number of conditions/diseases and the number of observations. As a general rule of thumb, you can assume that each resource will consume about 2 kilobytes of disk space.
|
||||
|
||||
For more information on Blaze performance, please refer to [import performance](https://github.com/samply/blaze/blob/master/docs/performance/import.md).
|
||||
|
||||
#### ETL for BBMRI and GBA
|
||||
|
||||
Normally, you will need to build your own ETL to feed the Bridgehead. However, there is one case where a short cut might be available:
|
||||
- If you are using CentraXX as a BIMS and you have a FHIR-Export License, then you can employ standard mapping scripts that access the CentraXX-internal data structures and map the data onto the BBMRI FHIR profile. It may be necessary to adjust a few parameters, but this is nonetheless significantly easier than writing your own ETL.
|
||||
|
||||
You can find the profiles for generating FHIR in [Simplifier](https://simplifier.net/bbmri.de/~resources?category=Profile).
|
||||
|
||||
## Things you should know
|
||||
|
||||
### Auto-Updates
|
||||
@ -472,28 +337,8 @@ Installation under WSL ought to work, but we have not tested this.
|
||||
|
||||
### Docker Daemon Proxy Configuration
|
||||
|
||||
Docker has a background daemon, responsible for downloading images and starting them. Sometimes, proxy configuration from your system won't carry over and it will fail to download images. In that case, you'll need to configure the proxy inside the system unit of docker by creating the file `/etc/systemd/system/docker.service.d/proxy.conf` with the following content:
|
||||
Docker has a background daemon, responsible for downloading images and starting them. Sometimes, proxy configuration from your system won't carry over and it will fail to download images. In that case, configure the proxy for this daemon as described in the [official documentation](https://docs.docker.com).
|
||||
|
||||
``` ini
|
||||
[Service]
|
||||
Environment="HTTP_PROXY=http://proxy.example.com:3128"
|
||||
Environment="HTTPS_PROXY=https://proxy.example.com:3128"
|
||||
Environment="NO_PROXY=localhost,127.0.0.1,some-local-docker-registry.example.com,.corp"
|
||||
```
|
||||
|
||||
After saving the configuration file, you'll need to reload the system daemon for the changes to take effect:
|
||||
|
||||
``` shell
|
||||
sudo systemctl daemon-reload
|
||||
```
|
||||
|
||||
and restart the docker daemon:
|
||||
|
||||
``` shell
|
||||
sudo systemctl restart docker
|
||||
```
|
||||
|
||||
For more information, please consult the [official documentation](https://docs.docker.com/config/daemon/systemd/#httphttps-proxy).
|
||||
|
||||
### Monitoring
|
||||
|
||||
|
||||
@ -1,13 +1,10 @@
|
||||
version: "3.7"
|
||||
|
||||
# This includes only the shared persistence for BBMRI-ERIC and GBN and EHDS2. Federation components are included as modules, see vars.
|
||||
# This includes only the shared persistence for BBMRI-ERIC and GBN. Federation components are included as modules, see vars.
|
||||
|
||||
services:
|
||||
blaze:
|
||||
#image: docker.verbis.dkfz.de/cache/samply/blaze:latest
|
||||
# Blaze versions 0.26 and 0.27 do not return anything when you run a
|
||||
# CQL query, so I am pinning the version at 0.25.
|
||||
image: samply/blaze:0.25
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:latest
|
||||
container_name: bridgehead-bbmri-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-bbmri-blaze:8080"
|
||||
@ -23,8 +20,6 @@ services:
|
||||
- "traefik.http.services.blaze_ccp.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.blaze_ccp.middlewares=ccp_b_strip,auth"
|
||||
- "traefik.http.routers.blaze_ccp.tls=true"
|
||||
ports:
|
||||
- "8081:8080"
|
||||
|
||||
volumes:
|
||||
blaze-data:
|
||||
|
||||
@ -1,81 +0,0 @@
|
||||
### DO NOT EDIT THIS FILE DIRECTLY.
|
||||
###
|
||||
### This file is collaboratively managed by yourself and the CCP-IT team at DKFZ.
|
||||
### The Bridgehead will pull it from git every night and restart if required.
|
||||
### To make any changes (or review changes by CCP-IT), please login here:
|
||||
### [URL_TO_SITE_SPECIFIC_GIT_REPO]
|
||||
###
|
||||
### DO NOT EDIT THIS FILE DIRECTLY.
|
||||
|
||||
### A note on Secrets:
|
||||
###
|
||||
### Variable with a value of <VAULT> will be fetched from a central component
|
||||
### upon each bridgehead startup.
|
||||
### Using the proven Vaultwarden password manager puts you in full control of
|
||||
### who can read the passwords. In particular, as long as you don't declare a
|
||||
### secret as shared ("SITE+DKFZ"), DKFZ cannot read these strings.
|
||||
### We recommend putting credentials such as local passwords into the password
|
||||
### store, not the git repo. Please keep your master password safe (vault.conf).
|
||||
|
||||
|
||||
### Common Configuration of all Components
|
||||
## This is a descriptive human readable name of your site (e.g. Belgium)
|
||||
SITE_NAME=<National node>
|
||||
## This is the id for your site used in machine to machine communication (should be
|
||||
## lower-case, e.g. belgium)
|
||||
SITE_ID=<National node>
|
||||
## This server's hostname, for access from other computers within your institution
|
||||
## (e.g. mybridgehead.intern.myinstitution.org)
|
||||
## Optional. If left empty, this is auto-generated via the `hostname` command.
|
||||
HOST=
|
||||
|
||||
## Proxy Configuration
|
||||
# leave empty if not applicable
|
||||
# eg.: http://my-proxy-host:my-proxy-port
|
||||
HTTP_PROXY_URL=
|
||||
HTTP_PROXY_USERNAME=
|
||||
HTTP_PROXY_PASSWORD=
|
||||
HTTPS_PROXY_URL=$HTTP_PROXY_URL
|
||||
HTTPS_PROXY_USERNAME=$HTTP_PROXY_USERNAME
|
||||
HTTPS_PROXY_PASSWORD=$HTTP_PROXY_PASSWORD
|
||||
|
||||
## Maintenance Configuration
|
||||
# By default, the bridgehead regularly performs certain housekeeping tasks such as pruning of old docker images to not run out of disk space.
|
||||
# Set the following to false to opt-out. (Default: true)
|
||||
#AUTO_HOUSEKEEPING=
|
||||
|
||||
### Connector Configuration
|
||||
## The operator of the specific site.
|
||||
OPERATOR_FIRST_NAME=
|
||||
OPERATOR_LAST_NAME=
|
||||
OPERATOR_EMAIL=
|
||||
OPERATOR_PHONE=
|
||||
## SMTP Server
|
||||
# ex.: mailhost.intern.klinik.de
|
||||
MAIL_HOST=
|
||||
MAIL_PORT=
|
||||
# ex.: no-reply@bridgehead.intern.klinik.de
|
||||
MAIL_FROM_ADDRESS=
|
||||
MAIL_FROM_NAME=
|
||||
|
||||
### Monitoring
|
||||
# The apikey used for reporting to the central DKFZ monitoring. Leave empty to opt out.
|
||||
MONITOR_APIKEY=
|
||||
|
||||
### Biobanking (BBMRI) specifics
|
||||
## We consider BBMRI as BBMRI-ERIC (European) and German Biobank Node (Germany).
|
||||
## Obviously, all German biobanks are by definition also European. Thus,
|
||||
## any Bridgehead will by default connect to the BBMRI-ERIC services but not
|
||||
## the national ones. We aim to proceed similarly for other BBMRI-ERIC National Nodes.
|
||||
##
|
||||
## The default values are correct for biobanks outside Germany.
|
||||
## For a biobank inside Germany, set ENABLE_GBN=true.
|
||||
# Connect to the European services, e.g. BBMRI-ERIC Sample Locator (Default: true)
|
||||
ENABLE_ERIC=false
|
||||
# Connect to the German services, e.g. Biobank Node Sample Locator (Default: false)
|
||||
# Set this to true in German biobanks!
|
||||
ENABLE_GBN=false
|
||||
# Connect to the ECDC services, e.g. ECDC Sample Locator (Default: false)
|
||||
# Set this to true in ECDC national nodes!
|
||||
ENABLE_EHDS2=true
|
||||
|
||||
@ -18,7 +18,7 @@ services:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro
|
||||
- /srv/docker/bridgehead/ccp/root-new.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
dnpm-beam-connect:
|
||||
depends_on: [ dnpm-beam-proxy ]
|
||||
@ -32,11 +32,9 @@ services:
|
||||
LOCAL_TARGETS_FILE: "./conf/connect_targets.json"
|
||||
HTTP_PROXY: http://forward_proxy:3128
|
||||
HTTPS_PROXY: http://forward_proxy:3128
|
||||
NO_PROXY: dnpm-beam-proxy,dnpm-backend, host.docker.internal
|
||||
NO_PROXY: dnpm-beam-proxy,dnpm-backend
|
||||
RUST_LOG: ${RUST_LOG:-info}
|
||||
NO_AUTH: "true"
|
||||
extra_host:
|
||||
- "host.docker.internal:host-gateway"
|
||||
volumes:
|
||||
- /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
|
||||
- /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro
|
||||
|
||||
@ -1,33 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
dnpm-backend:
|
||||
image: ghcr.io/kohlbacherlab/bwhc-backend:1.0-snapshot-broker-connector
|
||||
container_name: bridgehead-dnpm-backend
|
||||
environment:
|
||||
- ZPM_SITE=${ZPM_SITE}
|
||||
volumes:
|
||||
- /etc/bridgehead/dnpm:/bwhc_config:ro
|
||||
- ${DNPM_DATA_DIR}:/bwhc_data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.bwhc-backend.rule=PathPrefix(`/bwhc`)"
|
||||
- "traefik.http.services.bwhc-backend.loadbalancer.server.port=9000"
|
||||
- "traefik.http.routers.bwhc-backend.tls=true"
|
||||
|
||||
dnpm-frontend:
|
||||
image: ghcr.io/kohlbacherlab/bwhc-frontend:2209
|
||||
container_name: bridgehead-dnpm-frontend
|
||||
links:
|
||||
- dnpm-backend
|
||||
environment:
|
||||
- NUXT_HOST=0.0.0.0
|
||||
- NUXT_PORT=8080
|
||||
- BACKEND_PROTOCOL=https
|
||||
- BACKEND_HOSTNAME=$HOST
|
||||
- BACKEND_PORT=443
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.bwhc-frontend.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.bwhc-frontend.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.bwhc-frontend.tls=true"
|
||||
@ -1,27 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -n "${ENABLE_DNPM_NODE}" ]; then
|
||||
log INFO "DNPM setup detected (BwHC Node) -- will start BwHC node."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/dnpm-node-compose.yml"
|
||||
|
||||
# Set variables required for BwHC Node. ZPM_SITE is assumed to be set in /etc/bridgehead/<project>.conf
|
||||
DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
if [ -z "${ZPM_SITE+x}" ]; then
|
||||
log ERROR "Mandatory variable ZPM_SITE not defined!"
|
||||
exit 1
|
||||
fi
|
||||
if [ -z "${DNPM_DATA_DIR+x}" ]; then
|
||||
log ERROR "Mandatory variable DNPM_DATA_DIR not defined!"
|
||||
exit 1
|
||||
fi
|
||||
if grep -q 'traefik.http.routers.landing.rule=PathPrefix(`/landing`)' /srv/docker/bridgehead/minimal/docker-compose.override.yml 2>/dev/null; then
|
||||
echo "Override of landing page url already in place"
|
||||
else
|
||||
echo "Adding override of landing page url"
|
||||
if [ -f /srv/docker/bridgehead/minimal/docker-compose.override.yml ]; then
|
||||
echo -e ' landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml
|
||||
else
|
||||
echo -e 'version: "3.7"\nservices:\n landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
@ -5,6 +5,7 @@ if [ -n "${ENABLE_DNPM}" ]; then
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/dnpm-compose.yml"
|
||||
|
||||
# Set variables required for Beam-Connect
|
||||
DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
DNPM_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
DNPM_BROKER_ID="broker.ccp-it.dktk.dkfz.de"
|
||||
DNPM_BROKER_URL="https://${DNPM_BROKER_ID}"
|
||||
|
||||
@ -1,82 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
focus-ehds2:
|
||||
#image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
|
||||
image: samply/focus
|
||||
container_name: bridgehead-focus-ehds2
|
||||
environment:
|
||||
API_KEY: ${EHDS2_FOCUS_BEAM_SECRET_SHORT}
|
||||
BEAM_APP_ID_LONG: focus.${EHDS2_PROXY_ID}
|
||||
PROXY_ID: ${EHDS2_PROXY_ID}
|
||||
BLAZE_URL: "http://blaze:8080/fhir/"
|
||||
BEAM_PROXY_URL: http://beam-proxy-ehds2:8081
|
||||
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
|
||||
OBFUSCATE: "no"
|
||||
depends_on:
|
||||
- "beam-proxy-ehds2"
|
||||
- "blaze"
|
||||
|
||||
beam-proxy-ehds2:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
container_name: bridgehead-beam-proxy-ehds2
|
||||
environment:
|
||||
BROKER_URL: ${EHDS2_BROKER_URL}
|
||||
PROXY_ID: ${EHDS2_PROXY_ID}
|
||||
APP_focus_KEY: ${EHDS2_FOCUS_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
ROOTCERT_FILE: /conf/root.crt.pem
|
||||
secrets:
|
||||
- proxy.pem
|
||||
depends_on:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/bbmri/modules/${EHDS2_ROOT_CERT}.root.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
# Convert ECDC CSV file into FHIR and push to Blaze
|
||||
transfair:
|
||||
container_name: transfair
|
||||
image: samply/transfair
|
||||
environment:
|
||||
FHIR_INPUT_URL: "http://source_blaze:8080/fhir"
|
||||
FHIR_OUTPUT_URL: "http://bridgehead-bbmri-blaze:8080/fhir"
|
||||
PROFILE: "amr2fhir"
|
||||
#WRITE_BUNDLES_TO_FILE: "true"
|
||||
AMR_FILE_PATH: "/app/data"
|
||||
restart: on-failure
|
||||
# The start up logic for TransFAIR is kind of complicated for the ECDC/EHDS2
|
||||
# pilot. This is because we only want to run it if 1. there are source data
|
||||
# files to be transformed and 2. if there is no lock file. We also need to
|
||||
# wait for Blaze to start, TransFAIR does not check for this. And finally,
|
||||
# once TransFAIR has finished loading data, a lock file is created, to stop
|
||||
# a time-consuming repeat run.
|
||||
command: bash -c " \
|
||||
echo listing /app/data && \
|
||||
ls -la /app/data && \
|
||||
ls /app/data/*.[cC][sS][vV] 1> /dev/null 2>&1 && \
|
||||
[ ! -f /app/data/lock ] && \
|
||||
( \
|
||||
echo 'Wait for Blaze to finish initializing' ; \
|
||||
sleep 360 ; \
|
||||
echo 'Remove old output files' ; \
|
||||
rm -rf /app/test/* ; \
|
||||
cd /app ; \
|
||||
echo 'Run TransFAIR' ; \
|
||||
java -jar transFAIR.jar ; \
|
||||
echo 'Touching lock file' ; \
|
||||
touch /app/data/lock \
|
||||
) & tail -f /dev/null"
|
||||
# If you put .csv files into ./../ecdc/data, TransFAIR will try to process them.
|
||||
volumes:
|
||||
- ../../ecdc/test:/app/test/
|
||||
- ../../ecdc/data:/app/data/
|
||||
|
||||
# Report on the data pushed to Blaze by TransFAIR
|
||||
test-data-loader:
|
||||
container_name: test-data-loader
|
||||
image: samply/test-data-loader
|
||||
command: sh -c "sleep 420 && echo Listing all resources in FHIR store && blazectl --server http://bridgehead-bbmri-blaze:8080/fhir count-resources && tail -f /dev/null"
|
||||
|
||||
@ -1,28 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ "${ENABLE_EHDS2}" == "true" ]; then
|
||||
log INFO "EHDS2 setup detected -- will start services for German Biobank Node."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/ehds2-compose.yml"
|
||||
|
||||
# The environment needs to be defined in /etc/bridgehead
|
||||
case "$ENVIRONMENT" in
|
||||
"production")
|
||||
export EHDS2_BROKER_ID=ecdc-vm-ehds-test1.swedencentral.cloudapp.azure.com
|
||||
export EHDS2_ROOT_CERT=ehds2
|
||||
;;
|
||||
"test")
|
||||
export EHDS2_BROKER_ID=ecdc-vm-ehds-test1.swedencentral.cloudapp.azure.com
|
||||
export EHDS2_ROOT_CERT=ehds2.test
|
||||
;;
|
||||
*)
|
||||
report_error 6 "Environment \"$ENVIRONMENT\" is unknown. Assuming production. FIX THIS!"
|
||||
export EHDS2_BROKER_ID=ecdc-vm-ehds-test1.swedencentral.cloudapp.azure.com
|
||||
export EHDS2_ROOT_CERT=ehds2
|
||||
;;
|
||||
esac
|
||||
|
||||
EHDS2_BROKER_URL=https://${EHDS2_BROKER_ID}
|
||||
EHDS2_PROXY_ID=${SITE_ID}.${EHDS2_BROKER_ID}
|
||||
EHDS2_FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
EHDS2_SUPPORT_EMAIL=feedback@germanbiobanknode.de
|
||||
fi
|
||||
@ -1,22 +0,0 @@
|
||||
# EHDS2/ECDC certificate
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUamQJB/Uevzf3+qrDQOqA8mwkwX8wDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjQwMjA3MTQ1MTQxWhcNMzQw
|
||||
MjA0MTQ1MjExWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAKvI2XT0os20vG7d8FjRuMq9mALcQgLZvjAbQZbm
|
||||
JyeVxRQP5HsSrBlBwaZWgmXWFfIPlwsEsTAUsCneAl4ZL3gQ6831nbmmpgThOEVy
|
||||
rGBsbL6qlEWWplD/AGpcdEbAuDmuMSO9tKR6iRm+acTHJcXqsDm2HUUS7U+ManWY
|
||||
S0dG10beJE2eVtEv5/fnFlVSn72VgAVgXVl7UA5E77zXK9GUAyQ6Oo7MET9zifZ/
|
||||
EifeSoEvLk+U7HRLgQbKz2ti6ABh0wnK7Ec2DjekMBXyeQz0tR+8dS53s5pqti7c
|
||||
SUQMHmL4jKxvfQr7fr5wbJpFDu37Vif9GdND9WSDRcufuM8CAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFKMF6QgDV4cV
|
||||
WyQZn3EHKLUumXzuMB8GA1UdIwQYMBaAFKMF6QgDV4cVWyQZn3EHKLUumXzuMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQAhhE0ht7Sp
|
||||
inKLJSVZrdFHbAbRXnYcUz/3oyy/uw0YvF0dJAHz2sgbtCLMHzKU7NwotaEqZedA
|
||||
I7688nI42aHggIkwa1CzmFo9ybQ2afgrYNeF+TcTQI6G+fFpeRT5I+FvA9hUI3r4
|
||||
Kp63Si7cpQS5uiHs90sv2SNMedo2Gf9VyJKB7NOReQJWsrw32ITi4QLNKHcHciKm
|
||||
cpi/OqbR1YTJRoUrcC655G7bSKENzccdTWo8kBJgYLVbe+FohqgheqPqWpdH2zoR
|
||||
OxOwviutfJTNvDyhXu8FrDc5tr9f5VjXv1hK2szYuvggwbybUBB9bLsx+fV79oZe
|
||||
3zR0j5YwB28G
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
@ -1,22 +0,0 @@
|
||||
# EHDS2/ECDC certificate
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUamQJB/Uevzf3+qrDQOqA8mwkwX8wDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjQwMjA3MTQ1MTQxWhcNMzQw
|
||||
MjA0MTQ1MjExWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAKvI2XT0os20vG7d8FjRuMq9mALcQgLZvjAbQZbm
|
||||
JyeVxRQP5HsSrBlBwaZWgmXWFfIPlwsEsTAUsCneAl4ZL3gQ6831nbmmpgThOEVy
|
||||
rGBsbL6qlEWWplD/AGpcdEbAuDmuMSO9tKR6iRm+acTHJcXqsDm2HUUS7U+ManWY
|
||||
S0dG10beJE2eVtEv5/fnFlVSn72VgAVgXVl7UA5E77zXK9GUAyQ6Oo7MET9zifZ/
|
||||
EifeSoEvLk+U7HRLgQbKz2ti6ABh0wnK7Ec2DjekMBXyeQz0tR+8dS53s5pqti7c
|
||||
SUQMHmL4jKxvfQr7fr5wbJpFDu37Vif9GdND9WSDRcufuM8CAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFKMF6QgDV4cV
|
||||
WyQZn3EHKLUumXzuMB8GA1UdIwQYMBaAFKMF6QgDV4cVWyQZn3EHKLUumXzuMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQAhhE0ht7Sp
|
||||
inKLJSVZrdFHbAbRXnYcUz/3oyy/uw0YvF0dJAHz2sgbtCLMHzKU7NwotaEqZedA
|
||||
I7688nI42aHggIkwa1CzmFo9ybQ2afgrYNeF+TcTQI6G+fFpeRT5I+FvA9hUI3r4
|
||||
Kp63Si7cpQS5uiHs90sv2SNMedo2Gf9VyJKB7NOReQJWsrw32ITi4QLNKHcHciKm
|
||||
cpi/OqbR1YTJRoUrcC655G7bSKENzccdTWo8kBJgYLVbe+FohqgheqPqWpdH2zoR
|
||||
OxOwviutfJTNvDyhXu8FrDc5tr9f5VjXv1hK2szYuvggwbybUBB9bLsx+fV79oZe
|
||||
3zR0j5YwB28G
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
@ -2,7 +2,7 @@ version: "3.7"
|
||||
|
||||
services:
|
||||
focus-eric:
|
||||
image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
|
||||
image: docker.verbis.dkfz.de/cache/samply/focus:main
|
||||
container_name: bridgehead-focus-eric
|
||||
environment:
|
||||
API_KEY: ${ERIC_FOCUS_BEAM_SECRET_SHORT}
|
||||
@ -22,6 +22,7 @@ services:
|
||||
BROKER_URL: ${ERIC_BROKER_URL}
|
||||
PROXY_ID: ${ERIC_PROXY_ID}
|
||||
APP_focus_KEY: ${ERIC_FOCUS_BEAM_SECRET_SHORT}
|
||||
APP_monitoring_KEY: ${ERIC_MONITORING_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
@ -32,5 +33,14 @@ services:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/bbmri/modules/${ERIC_ROOT_CERT}.root.crt.pem:/conf/root.crt.pem:ro
|
||||
- /srv/docker/bridgehead/bbmri/modules/eric.root.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
bridgehead-monitoring:
|
||||
image: docker.verbis.dkfz.de/cache/samply/bridgehead-monitoring:latest
|
||||
container_name: bridgehead-monitoring-eric
|
||||
environment:
|
||||
- BEAM_ID=monitoring.${ERIC_PROXY_ID}
|
||||
- BEAM_API_KEY=${ERIC_MONITORING_BEAM_SECRET_SHORT}
|
||||
- BEAM_PROXY_URL=http://beam-proxy-eric:8081
|
||||
depends_on:
|
||||
- beam-proxy-eric
|
||||
|
||||
@ -4,25 +4,13 @@ if [ "${ENABLE_ERIC}" == "true" ]; then
|
||||
log INFO "BBMRI-ERIC setup detected -- will start services for BBMRI-ERIC."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/eric-compose.yml"
|
||||
|
||||
# The environment needs to be defined in /etc/bridgehead
|
||||
case "$ENVIRONMENT" in
|
||||
"production")
|
||||
export ERIC_BROKER_ID=broker.bbmri.samply.de
|
||||
export ERIC_ROOT_CERT=eric
|
||||
;;
|
||||
"test")
|
||||
export ERIC_BROKER_ID=broker-test.bbmri-test.samply.de
|
||||
export ERIC_ROOT_CERT=eric.test
|
||||
;;
|
||||
*)
|
||||
report_error 6 "Environment \"$ENVIRONMENT\" is unknown. Assuming production. FIX THIS!"
|
||||
export ERIC_BROKER_ID=broker.bbmri.samply.de
|
||||
export ERIC_ROOT_CERT=eric
|
||||
;;
|
||||
esac
|
||||
|
||||
# Set required variables
|
||||
ERIC_BROKER_ID=broker.bbmri.samply.de
|
||||
ERIC_BROKER_URL=https://${ERIC_BROKER_ID}
|
||||
ERIC_PROXY_ID=${SITE_ID}.${ERIC_BROKER_ID}
|
||||
ERIC_FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
ERIC_SUPPORT_EMAIL=bridgehead@helpdesk.bbmri-eric.eu
|
||||
|
||||
#Monitoring
|
||||
ERIC_MONITORING_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
fi
|
||||
|
||||
@ -1,20 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUJ0g7k2vrdAwNTU38S1/mU8NO26MwDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjMwNzEwMTIyMzQxWhcNMzMw
|
||||
NzA3MTIyNDExWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBALMvc/fApbsAl+/NXDszNgffNR5llAb9CfxzdnRn
|
||||
ryoBqZdPevBYZZfKBARRKjFbXRDdPWbE7erDeo1LiCM6PObXCuT9wmGWJtvfkmqW
|
||||
3Z/a75e4r360kceMEGVn4kWpi9dz8s7+oXVZURjW2r13h6pq6xQNZDNlXmpR8wHG
|
||||
58TSrQC4n1vzdSwMWdptgOA8Sw8adR7ZJI1yNZpmynB2QolKKNESI7FcSKC/+b+H
|
||||
LoPkseAwQG9yJo23qEw1GZS67B47iKIqX2wp9VLQobHw7ncrhKXQLSWq973k/Swp
|
||||
7lBdfOsTouf72flLiF1HbdOLcFDmWgIbf5scj2HaQe8b/UcCAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHYxBJiJZieW
|
||||
e6G1vwn6Q36/crgNMB8GA1UdIwQYMBaAFHYxBJiJZieWe6G1vwn6Q36/crgNMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCN6WVNYpWJ
|
||||
6Z1Ee+otLZYMXhjyR6NUQ5s0aHiug97gB8mTiNlgXiiTgipCbofEmENgh1inYrPC
|
||||
WfdXxqOaekSXCQW6nSO1KtBzEYtkN5LrN1cjKqt51P2DbkllinK37wwCS2Kfup1+
|
||||
yjhTRxrehSIfsMVK6bTUeSoc8etkgwErZpORhlpqZKWhmOwcMpgsYJJOLhUetqc1
|
||||
UNe/254bc0vqHEPT6VI/86c7qAmk1xR0RUfrnKAEqZtUeuoj2fe1L/6yOB16fxt5
|
||||
3V3oim7EO6eZCTjDo9fU5DaFiqSMe7WVdr03Na0cWet60XKRH/xaiC6gMWdHWcbh
|
||||
vZdXnV1qjlM2
|
||||
-----END CERTIFICATE-----
|
||||
@ -2,7 +2,7 @@ version: "3.7"
|
||||
|
||||
services:
|
||||
focus-gbn:
|
||||
image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
|
||||
image: docker.verbis.dkfz.de/cache/samply/focus:main
|
||||
container_name: bridgehead-focus-gbn
|
||||
environment:
|
||||
API_KEY: ${GBN_FOCUS_BEAM_SECRET_SHORT}
|
||||
@ -22,6 +22,7 @@ services:
|
||||
BROKER_URL: ${GBN_BROKER_URL}
|
||||
PROXY_ID: ${GBN_PROXY_ID}
|
||||
APP_focus_KEY: ${GBN_FOCUS_BEAM_SECRET_SHORT}
|
||||
APP_monitoring_KEY: ${GBN_MONITORING_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
@ -32,5 +33,15 @@ services:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/bbmri/modules/${GBN_ROOT_CERT}.root.crt.pem:/conf/root.crt.pem:ro
|
||||
- /srv/docker/bridgehead/bbmri/modules/gbn.root.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
bridgehead-monitoring:
|
||||
image: docker.verbis.dkfz.de/cache/samply/bridgehead-monitoring:latest
|
||||
container_name: bridgehead-monitoring-gbn
|
||||
environment:
|
||||
- BEAM_ID=monitoring.${GBN_PROXY_ID}
|
||||
- BEAM_API_KEY=${GBN_MONITORING_BEAM_SECRET_SHORT}
|
||||
- BEAM_PROXY_URL=http://beam-proxy-gbn:8081
|
||||
depends_on:
|
||||
- beam-proxy-gbn
|
||||
|
||||
|
||||
@ -4,25 +4,13 @@ if [ "${ENABLE_GBN}" == "true" ]; then
|
||||
log INFO "GBN setup detected -- will start services for German Biobank Node."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/gbn-compose.yml"
|
||||
|
||||
# The environment needs to be defined in /etc/bridgehead
|
||||
case "$ENVIRONMENT" in
|
||||
"production")
|
||||
export GBN_BROKER_ID=broker.bbmri.de
|
||||
export GBN_ROOT_CERT=gbn
|
||||
;;
|
||||
"test")
|
||||
export GBN_BROKER_ID=broker.test.bbmri.de
|
||||
export GBN_ROOT_CERT=gbn.test
|
||||
;;
|
||||
*)
|
||||
report_error 6 "Environment \"$ENVIRONMENT\" is unknown. Assuming production. FIX THIS!"
|
||||
export GBN_BROKER_ID=broker.bbmri.de
|
||||
export GBN_ROOT_CERT=gbn
|
||||
;;
|
||||
esac
|
||||
|
||||
# Set required variables
|
||||
GBN_BROKER_ID=broker.bbmri.de
|
||||
GBN_BROKER_URL=https://${GBN_BROKER_ID}
|
||||
GBN_PROXY_ID=${SITE_ID}.${GBN_BROKER_ID}
|
||||
GBN_FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
GBN_SUPPORT_EMAIL=feedback@germanbiobanknode.de
|
||||
|
||||
#Monitoring
|
||||
GBN_MONITORING_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
fi
|
||||
|
||||
@ -1,20 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUQJjusHYR89Xas+kRbg41aHZxfmcwDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjMwODIxMDk1MDI1WhcNMzMw
|
||||
ODE4MDk1MDU1WjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAMP0jt2tSk23Bu+QeogqlFwjbMnqwRcWGKAOF4ch
|
||||
aOK2B5u/BnpqIZDZbhfSIJTv8DPe3+nA2VqRfSiW3HbV0auqxx1ii2ZmHYbvO2P/
|
||||
Jj6hyIiYYGqCMRVXk7iB+DfMysQEaSJO/7lJSprlVQCl0u7MAQ4q/szVNwcCm2Xi
|
||||
iE00Wlota2xTYjnJHYjeaLZL4kQsjqW2aCWHG4q77Z4NXT+lXN9XXedgoXLhuwWl
|
||||
UyHhXPjyCVu1iFzsXwSTodPAETGoInRYMqMA7PrbHZu1b2Jz0BwCQ+bark1td+Mf
|
||||
l3uP0QduhZnH6zGO0KyUFRzeiesgabv5bgUeSSsIOVjnLJUCAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFME99nPh1Vuo
|
||||
7eRaymL2Ps7qGxIdMB8GA1UdIwQYMBaAFME99nPh1Vuo7eRaymL2Ps7qGxIdMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQB0WG0xT00R
|
||||
5CA0tVHaNo8bQuAXytu566TspKc5vVd3r6mglj/MiSSQG2MVz+GUU6LnnApgln1P
|
||||
pvZuyaldB0QdTTLeJVMr/eFtZonlxqcxkj+VW2Y7mRHT7Xx9GQvzKYvSK5m/+xzH
|
||||
pAQl8AirgkoZ5b+ltlzM0pDAH204xj3/skmGqM/o0FKzRtpetHYkZPiquHCmO2Cp
|
||||
nTMkv7c2qu5t2Dm5q0Tmb7ZRoA1yIYhDn/UfhTAVWQnoMfXK8oB9nkRRb7pAfOXo
|
||||
W1K4A+oWqKrJwfIH/Ycnw7hu8hPuGOyIN/PLnLpJp9M2I67vywp5lIvFib4UukyJ
|
||||
wJw6/iTienIA
|
||||
-----END CERTIFICATE-----
|
||||
15
bbmri/vars
15
bbmri/vars
@ -4,10 +4,7 @@
|
||||
# Makes only sense for German Biobanks
|
||||
: ${ENABLE_GBN:=false}
|
||||
|
||||
# Makes only sense for EHDS2 project
|
||||
: ${ENABLE_EHDS2:=false}
|
||||
|
||||
FOCUS_RETRY_COUNT=128
|
||||
FOCUS_RETRY_COUNT=32
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
|
||||
for module in $PROJECT/modules/*.sh
|
||||
@ -17,16 +14,12 @@ do
|
||||
done
|
||||
|
||||
SUPPORT_EMAIL=$ERIC_SUPPORT_EMAIL
|
||||
BROKER_URL_FOR_PREREQ="https://ecdc-vm-ehds-test1.swedencentral.cloudapp.azure.com"
|
||||
BROKER_URL_FOR_PREREQ=$ERIC_BROKER_URL
|
||||
|
||||
if [ -n "$GBN_SUPPORT_EMAIL" ]; then
|
||||
SUPPORT_EMAIL=$GBN_SUPPORT_EMAIL
|
||||
fi
|
||||
|
||||
if [ -n "$EHDS2_SUPPORT_EMAIL" ]; then
|
||||
SUPPORT_EMAIL=$EHDS2_SUPPORT_EMAIL
|
||||
fi
|
||||
|
||||
function do_enroll {
|
||||
COUNT=0
|
||||
if [ "$ENABLE_ERIC" == "true" ]; then
|
||||
@ -37,10 +30,6 @@ function do_enroll {
|
||||
do_enroll_inner $GBN_PROXY_ID $GBN_SUPPORT_EMAIL
|
||||
COUNT=$((COUNT+1))
|
||||
fi
|
||||
if [ "$ENABLE_EHDS2" == "true" ]; then
|
||||
do_enroll_inner $EHDS2_PROXY_ID $EHDS2_SUPPORT_EMAIL
|
||||
COUNT=$((COUNT+1))
|
||||
fi
|
||||
if [ $COUNT -ge 2 ]; then
|
||||
echo
|
||||
echo "You just received $COUNT certificate signing requests (CSR). Please send $COUNT e-mails, with 1 CSR each, to the respective e-mail address."
|
||||
|
||||
30
bridgehead
30
bridgehead
@ -65,43 +65,13 @@ loadVars() {
|
||||
fi
|
||||
detectCompose
|
||||
setHostname
|
||||
setupProxy
|
||||
|
||||
# Set some project-independent default values
|
||||
: ${ENVIRONMENT:=production}
|
||||
|
||||
case "$ENVIRONMENT" in
|
||||
"production")
|
||||
export FOCUS_TAG=main
|
||||
;;
|
||||
"test")
|
||||
export FOCUS_TAG=develop
|
||||
;;
|
||||
*)
|
||||
report_error 7 "Environment \"$ENVIRONMENT\" is unknown. Assuming production. FIX THIS!"
|
||||
export FOCUS_TAG=main
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
case "$ACTION" in
|
||||
start)
|
||||
loadVars
|
||||
hc_send log "Bridgehead $PROJECT startup: Checking requirements ..."
|
||||
chown -R bridgehead ${BASE}
|
||||
checkRequirements
|
||||
# Note: changes to "bridgehead" script will only take effect after next start.
|
||||
su bridgehead -c "git pull"
|
||||
chown -R bridgehead ${BASE}
|
||||
# Local versions of focus and transfair are needed by EHDS2
|
||||
clone_focus_if_nonexistent ${BASE}/..
|
||||
build_focus ${BASE}/..
|
||||
clone_transfair_if_nonexistent ${BASE}/..
|
||||
build_transfair ${BASE}/..
|
||||
# Location for input data and results for EHDS2
|
||||
mkdir -p ${BASE}/../ecdc/test
|
||||
mkdir -p ${BASE}/../ecdc/data
|
||||
chown -R bridgehead ${BASE}/../ecdc
|
||||
hc_send log "Bridgehead $PROJECT startup: Requirements checked out. Now starting bridgehead ..."
|
||||
exec $COMPOSE -p $PROJECT -f ./minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE up --abort-on-container-exit
|
||||
;;
|
||||
|
||||
@ -28,7 +28,7 @@ services:
|
||||
BLAZE_URL: "http://bridgehead-ccp-blaze:8080/fhir/"
|
||||
BEAM_PROXY_URL: http://beam-proxy:8081
|
||||
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
|
||||
EPSILON: 0.28
|
||||
OBFUSCATE: "no"
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
@ -40,6 +40,7 @@ services:
|
||||
BROKER_URL: ${BROKER_URL}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
APP_monitoring_KEY: ${CCP_MONITORING_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
@ -52,6 +53,16 @@ services:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
bridgehead-monitoring:
|
||||
image: docker.verbis.dkfz.de/cache/samply/bridgehead-monitoring:latest
|
||||
container_name: bridgehead-monitoring-ccp
|
||||
environment:
|
||||
- BEAM_ID=monitoring.${PROXY_ID}
|
||||
- BEAM_API_KEY=${CCP_MONITORING_BEAM_SECRET_SHORT}
|
||||
- BEAM_PROXY_URL=http://beam-proxy:8081
|
||||
depends_on:
|
||||
- beam-proxy
|
||||
|
||||
|
||||
volumes:
|
||||
blaze-data:
|
||||
|
||||
@ -1,18 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
adt2fhir-rest:
|
||||
container_name: bridgehead-adt2fhir-rest
|
||||
image: docker.verbis.dkfz.de/ccp/adt2fhir-rest:main
|
||||
environment:
|
||||
IDTYPE: BK_${IDMANAGEMENT_FRIENDLY_ID}_L-ID
|
||||
MAINZELLISTE_APIKEY: ${IDMANAGER_LOCAL_PATIENTLIST_APIKEY}
|
||||
SALT: ${LOCAL_SALT}
|
||||
restart: always
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.adt2fhir-rest.rule=PathPrefix(`/adt2fhir-rest`)"
|
||||
- "traefik.http.middlewares.adt2fhir-rest_strip.stripprefix.prefixes=/adt2fhir-rest"
|
||||
- "traefik.http.services.adt2fhir-rest.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.adt2fhir-rest.tls=true"
|
||||
- "traefik.http.routers.adt2fhir-rest.middlewares=adt2fhir-rest_strip,auth"
|
||||
@ -1,13 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
function adt2fhirRestSetup() {
|
||||
if [ -n "$ENABLE_ADT2FHIR_REST" ]; then
|
||||
log INFO "ADT2FHIR-REST setup detected -- will start adt2fhir-rest API."
|
||||
if [ ! -n "$IDMANAGER_LOCAL_PATIENTLIST_APIKEY" ]; then
|
||||
log ERROR "Missing ID-Management Module! Fix this by setting up ID Management:"
|
||||
exit 1;
|
||||
fi
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/adt2fhir-rest-compose.yml"
|
||||
LOCAL_SALT="$(echo \"local-random-salt\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
fi
|
||||
}
|
||||
2
ccp/modules/ccp-setup.sh
Normal file
2
ccp/modules/ccp-setup.sh
Normal file
@ -0,0 +1,2 @@
|
||||
#Monitoring
|
||||
CCP_MONITORING_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
@ -16,11 +16,9 @@ services:
|
||||
LOCAL_TARGETS_FILE: "./conf/connect_targets.json"
|
||||
HTTP_PROXY: "http://forward_proxy:3128"
|
||||
HTTPS_PROXY: "http://forward_proxy:3128"
|
||||
NO_PROXY: beam-proxy,dnpm-backend,host.docker.internal
|
||||
NO_PROXY: beam-proxy,dnpm-backend
|
||||
RUST_LOG: ${RUST_LOG:-info}
|
||||
NO_AUTH: "true"
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway"
|
||||
volumes:
|
||||
- /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
|
||||
- /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro
|
||||
|
||||
@ -1,33 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
dnpm-backend:
|
||||
image: ghcr.io/kohlbacherlab/bwhc-backend:1.0-snapshot-broker-connector
|
||||
container_name: bridgehead-dnpm-backend
|
||||
environment:
|
||||
- ZPM_SITE=${ZPM_SITE}
|
||||
volumes:
|
||||
- /etc/bridgehead/dnpm:/bwhc_config:ro
|
||||
- ${DNPM_DATA_DIR}:/bwhc_data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.bwhc-backend.rule=PathPrefix(`/bwhc`)"
|
||||
- "traefik.http.services.bwhc-backend.loadbalancer.server.port=9000"
|
||||
- "traefik.http.routers.bwhc-backend.tls=true"
|
||||
|
||||
dnpm-frontend:
|
||||
image: ghcr.io/kohlbacherlab/bwhc-frontend:2209
|
||||
container_name: bridgehead-dnpm-frontend
|
||||
links:
|
||||
- dnpm-backend
|
||||
environment:
|
||||
- NUXT_HOST=0.0.0.0
|
||||
- NUXT_PORT=8080
|
||||
- BACKEND_PROTOCOL=https
|
||||
- BACKEND_HOSTNAME=$HOST
|
||||
- BACKEND_PORT=443
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.bwhc-frontend.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.bwhc-frontend.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.bwhc-frontend.tls=true"
|
||||
@ -1,27 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -n "${ENABLE_DNPM_NODE}" ]; then
|
||||
log INFO "DNPM setup detected (BwHC Node) -- will start BwHC node."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/dnpm-node-compose.yml"
|
||||
|
||||
# Set variables required for BwHC Node. ZPM_SITE is assumed to be set in /etc/bridgehead/<project>.conf
|
||||
DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
if [ -z "${ZPM_SITE+x}" ]; then
|
||||
log ERROR "Mandatory variable ZPM_SITE not defined!"
|
||||
exit 1
|
||||
fi
|
||||
if [ -z "${DNPM_DATA_DIR+x}" ]; then
|
||||
log ERROR "Mandatory variable DNPM_DATA_DIR not defined!"
|
||||
exit 1
|
||||
fi
|
||||
if grep -q 'traefik.http.routers.landing.rule=PathPrefix(`/landing`)' /srv/docker/bridgehead/minimal/docker-compose.override.yml 2>/dev/null; then
|
||||
echo "Override of landing page url already in place"
|
||||
else
|
||||
echo "Adding override of landing page url"
|
||||
if [ -f /srv/docker/bridgehead/minimal/docker-compose.override.yml ]; then
|
||||
echo -e ' landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml
|
||||
else
|
||||
echo -e 'version: "3.7"\nservices:\n landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
@ -5,5 +5,6 @@ if [ -n "${ENABLE_DNPM}" ]; then
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/dnpm-compose.yml"
|
||||
|
||||
# Set variables required for Beam-Connect
|
||||
DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
DNPM_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
fi
|
||||
|
||||
@ -43,7 +43,7 @@ services:
|
||||
- patientlist-db
|
||||
|
||||
patientlist-db:
|
||||
image: docker.verbis.dkfz.de/cache/postgres:15.4-alpine
|
||||
image: docker.verbis.dkfz.de/cache/postgres:15.1-alpine
|
||||
container_name: bridgehead-patientlist-db
|
||||
environment:
|
||||
POSTGRES_USER: "mainzelliste"
|
||||
|
||||
@ -39,7 +39,6 @@ function applySpecialCases() {
|
||||
result="$1";
|
||||
result="${result/Lmu/LMU}";
|
||||
result="${result/Tum/TUM}";
|
||||
result="${result/Dktk Test/Teststandort}";
|
||||
echo "$result";
|
||||
}
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@ version: "3.7"
|
||||
|
||||
services:
|
||||
mtba:
|
||||
image: docker.verbis.dkfz.de/cache/samply/mtba:1.0.0
|
||||
image: docker.verbis.dkfz.de/cache/samply/mtba:develop
|
||||
container_name: bridgehead-mtba
|
||||
environment:
|
||||
BLAZE_STORE_URL: http://blaze:8080
|
||||
|
||||
@ -1,10 +1,11 @@
|
||||
#!/bin/bash
|
||||
|
||||
function mtbaSetup() {
|
||||
# TODO: Check if ID-Management Module is activated!
|
||||
if [ -n "$ENABLE_MTBA" ];then
|
||||
log INFO "MTBA setup detected -- will start MTBA Service and CBioPortal."
|
||||
if [ ! -n "$IDMANAGER_UPLOAD_APIKEY" ]; then
|
||||
log ERROR "Missing ID-Management Module! Fix this by setting up ID Management:"
|
||||
log ERROR "Detected MTBA Module configuration but ID-Management Module seems not to be configured!"
|
||||
exit 1;
|
||||
fi
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/mtba-compose.yml"
|
||||
|
||||
@ -1,6 +1,8 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -n "$NNGM_CTS_APIKEY" ]; then
|
||||
function nngmSetup() {
|
||||
if [ -n "$NNGM_CTS_APIKEY" ]; then
|
||||
log INFO "nNGM setup detected -- will start nNGM Connector."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/nngm-compose.yml"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
20
ccp/root-new.crt.pem
Normal file
20
ccp/root-new.crt.pem
Normal file
@ -0,0 +1,20 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUN7yzueIZzwpe8PaPEIMY8zoH+eMwDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjMwNTIzMTAxNzIzWhcNMzMw
|
||||
NTIwMTAxNzUzWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAN5JAj+HydSGaxvA0AOcrXVTZ9FfsH0cMVBlQb72
|
||||
bGZgrRvkqtB011TNXZfsHl7rPxCY61DcsDJfFq3+8VHT+S9HE0qV1bEwP+oA3xc4
|
||||
Opq77av77cNNOqDC7h+jyPhHcUaE33iddmrH9Zn2ofWTSkKHHu3PAe5udCrc2QnD
|
||||
4PLRF6gqiEY1mcGknJrXj1ff/X0nRY/m6cnHNXz0Cvh8oPOtbdfGgfZjID2/fJNP
|
||||
fNoNKqN+5oJAZ+ZZ9id9rBvKj1ivW3F2EoGjZF268SgZzc5QrM/D1OpSBQf5SF/V
|
||||
qUPcQTgt9ry3YR+SZYazLkfKMEOWEa0WsqJVgXdQ6FyergcCAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEa70kcseqU5
|
||||
bHx2zSt4bG21HokhMB8GA1UdIwQYMBaAFEa70kcseqU5bHx2zSt4bG21HokhMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCGmE7NXW4T
|
||||
6J4mV3b132cGEMD7grx5JeiXK5EHMlswUS+Odz0NcBNzhUHdG4WVMbrilHbI5Ua+
|
||||
6jdKx5WwnqzjQvElP0MCw6sH/35gbokWgk1provOP99WOFRsQs+9Sm8M2XtMf9HZ
|
||||
m3wABwU/O+dhZZ1OT1PjSZD0OKWKqH/KvlsoF5R6P888KpeYFiIWiUNS5z21Jm8A
|
||||
ZcllJjiRJ60EmDwSUOQVJJSMOvtr6xTZDZLtAKSN8zN08lsNGzyrFwqjDwU0WTqp
|
||||
scMXEGBsWQjlvxqDnXyljepR0oqRIjOvgrWaIgbxcnu98tK/OdBGwlAPKNUW7Crr
|
||||
vO+eHxl9iqd4
|
||||
-----END CERTIFICATE-----
|
||||
2
ccp/vars
2
ccp/vars
@ -16,5 +16,5 @@ do
|
||||
done
|
||||
|
||||
idManagementSetup
|
||||
nngmSetup
|
||||
mtbaSetup
|
||||
adt2fhirRestSetup
|
||||
14
ecdc.service
14
ecdc.service
@ -1,14 +0,0 @@
|
||||
[Unit]
|
||||
Description=Start ECDC Bridgehead
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStart=/srv/docker/bridgehead/restart_service.sh
|
||||
ExecStop=/srv/docker/bridgehead/shutdown_service.sh
|
||||
Restart=always
|
||||
RestartSec=36000
|
||||
KillMode=mixed
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
|
||||
@ -9,33 +9,6 @@ detectCompose() {
|
||||
fi
|
||||
}
|
||||
|
||||
setupProxy() {
|
||||
### Note: As the current data protection concepts do not allow communication via HTTP,
|
||||
### we are not setting a proxy for HTTP requests.
|
||||
|
||||
local http="no"
|
||||
local https="no"
|
||||
if [ $HTTPS_PROXY_URL ]; then
|
||||
local proto="$(echo $HTTPS_PROXY_URL | grep :// | sed -e 's,^\(.*://\).*,\1,g')"
|
||||
local fqdn="$(echo ${HTTPS_PROXY_URL/$proto/})"
|
||||
local hostport=$(echo $HTTPS_PROXY_URL | sed -e "s,$proto,,g" | cut -d/ -f1)
|
||||
HTTPS_PROXY_HOST="$(echo $hostport | sed -e 's,:.*,,g')"
|
||||
HTTPS_PROXY_PORT="$(echo $hostport | sed -e 's,^.*:,:,g' -e 's,.*:\([0-9]*\).*,\1,g' -e 's,[^0-9],,g')"
|
||||
if [[ ! -z "$HTTPS_PROXY_USERNAME" && ! -z "$HTTPS_PROXY_PASSWORD" ]]; then
|
||||
local proto="$(echo $HTTPS_PROXY_URL | grep :// | sed -e 's,^\(.*://\).*,\1,g')"
|
||||
local fqdn="$(echo ${HTTPS_PROXY_URL/$proto/})"
|
||||
HTTPS_PROXY_FULL_URL="$(echo $proto$HTTPS_PROXY_USERNAME:$HTTPS_PROXY_PASSWORD@$fqdn)"
|
||||
https="authenticated"
|
||||
else
|
||||
HTTPS_PROXY_FULL_URL=$HTTPS_PROXY_URL
|
||||
https="unauthenticated"
|
||||
fi
|
||||
fi
|
||||
|
||||
log INFO "Configuring proxy servers: $http http proxy (we're not supporting unencrypted comms), $https https proxy"
|
||||
export HTTPS_PROXY_HOST HTTPS_PROXY_PORT HTTPS_PROXY_FULL_URL
|
||||
}
|
||||
|
||||
exitIfNotRoot() {
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
log "ERROR" "Please run as root"
|
||||
@ -76,7 +49,7 @@ fetchVarsFromVault() {
|
||||
|
||||
set +e
|
||||
|
||||
PASS=$(BW_MASTERPASS="$BW_MASTERPASS" BW_CLIENTID="$BW_CLIENTID" BW_CLIENTSECRET="$BW_CLIENTSECRET" docker run --rm -e BW_MASTERPASS -e BW_CLIENTID -e BW_CLIENTSECRET -e http_proxy docker.verbis.dkfz.de/cache/samply/bridgehead-vaultfetcher:latest $@)
|
||||
PASS=$(BW_MASTERPASS="$BW_MASTERPASS" BW_CLIENTID="$BW_CLIENTID" BW_CLIENTSECRET="$BW_CLIENTSECRET" docker run --rm -e BW_MASTERPASS -e BW_CLIENTID -e BW_CLIENTSECRET -e http_proxy samply/bridgehead-vaultfetcher $@)
|
||||
RET=$?
|
||||
|
||||
if [ $RET -ne 0 ]; then
|
||||
@ -215,7 +188,7 @@ function do_enroll_inner {
|
||||
PARAMS+="--admin-email $SUPPORT_EMAIL"
|
||||
fi
|
||||
|
||||
docker run --rm -v /etc/bridgehead/pki:/etc/bridgehead/pki docker.verbis.dkfz.de/cache/samply/beam-enroll:latest --output-file $PRIVATEKEYFILENAME --proxy-id $MANUAL_PROXY_ID $PARAMS
|
||||
docker run --rm -v /etc/bridgehead/pki:/etc/bridgehead/pki samply/beam-enroll:latest --output-file $PRIVATEKEYFILENAME --proxy-id $MANUAL_PROXY_ID $PARAMS
|
||||
chmod 600 $PRIVATEKEYFILENAME
|
||||
}
|
||||
|
||||
@ -239,67 +212,3 @@ add_basic_auth_user() {
|
||||
log DEBUG "Saving clear text credentials in $FILE. If wanted, delete them manually."
|
||||
sed -i "/^$NAME/ s|$|\n# User: $USER\n# Password: $PASSWORD|" $FILE
|
||||
}
|
||||
|
||||
function clone_repo_if_nonexistent() {
|
||||
local repo_url="$1" # First argument: Repository URL
|
||||
local target_dir="$2" # Second argument: Target directory
|
||||
local branch_name="$3" # Third argument: Branch name
|
||||
|
||||
echo Repo directory: $target_dir
|
||||
|
||||
# Check if the target directory exists
|
||||
if [ ! -d "$target_dir" ]; then
|
||||
echo "Directory '$target_dir' does not exist. Cloning the repository..."
|
||||
# Clone the repository
|
||||
git clone "$repo_url" "$target_dir"
|
||||
fi
|
||||
|
||||
# Change to the cloned directory
|
||||
cd "$target_dir"
|
||||
|
||||
# Checkout the specified branch
|
||||
chown -R bridgehead .
|
||||
su bridgehead -c "git checkout $branch_name"
|
||||
|
||||
cd -
|
||||
}
|
||||
|
||||
function clone_transfair_if_nonexistent() {
|
||||
local base_dir="$1"
|
||||
|
||||
clone_repo_if_nonexistent https://github.com/samply/transFAIR.git $base_dir/transfair ehds2
|
||||
}
|
||||
|
||||
function clone_focus_if_nonexistent() {
|
||||
local base_dir="$1"
|
||||
|
||||
clone_repo_if_nonexistent https://github.com/samply/focus.git $base_dir/focus ehds2
|
||||
}
|
||||
|
||||
|
||||
function build_transfair() {
|
||||
local base_dir="$1"
|
||||
|
||||
# We only take the touble to build transfair if:
|
||||
#
|
||||
# 1. There is data available (any CSV files) and
|
||||
# 2. There is no data lock file (which means that no ETL has yet been run).
|
||||
if ls ../ecdc/data/*.[cC][sS][vV] 1> /dev/null 2>&1 && [ ! -f ../ecdc/data/lock ]; then
|
||||
cd $base_dir/transfair
|
||||
su bridgehead -c "git pull"
|
||||
docker build --progress=plain -t samply/transfair --no-cache .
|
||||
chown -R bridgehead .
|
||||
cd -
|
||||
fi
|
||||
}
|
||||
|
||||
function build_focus() {
|
||||
local base_dir="$1"
|
||||
|
||||
cd $base_dir/focus
|
||||
su bridgehead -c "git pull"
|
||||
docker build --progress=plain -f DockerfileWithBuild -t samply/focus --no-cache .
|
||||
chown -R bridgehead .
|
||||
cd -
|
||||
}
|
||||
|
||||
|
||||
@ -47,8 +47,8 @@ function hc_send(){
|
||||
|
||||
if [ -n "$2" ]; then
|
||||
MSG="$2\n\nDocker stats:\n$UPTIME"
|
||||
echo -e "$MSG" | https_proxy=$HTTPS_PROXY_FULL_URL curl --max-time 5 -A "$USER_AGENT" -s -o /dev/null -X POST --data-binary @- "$HCURL"/"$1" || log WARN "Monitoring failed: Unable to send data to $HCURL/$1"
|
||||
echo -e "$MSG" | https_proxy=$HTTPS_PROXY_URL curl --max-time 5 -A "$USER_AGENT" -s -o /dev/null -X POST --data-binary @- "$HCURL"/"$1" || log WARN "Monitoring failed: Unable to send data to $HCURL/$1"
|
||||
else
|
||||
https_proxy=$HTTPS_PROXY_FULL_URL curl --max-time 5 -A "$USER_AGENT" -s -o /dev/null "$HCURL"/"$1" || log WARN "Monitoring failed: Unable to send data to $HCURL/$1"
|
||||
https_proxy=$HTTPS_PROXY_URL curl --max-time 5 -A "$USER_AGENT" -s -o /dev/null "$HCURL"/"$1" || log WARN "Monitoring failed: Unable to send data to $HCURL/$1"
|
||||
fi
|
||||
}
|
||||
|
||||
@ -14,7 +14,7 @@ checkOwner /etc/bridgehead bridgehead || exit 1
|
||||
|
||||
## Check if user is a su
|
||||
log INFO "Checking if all prerequisites are met ..."
|
||||
prerequisites="git docker curl"
|
||||
prerequisites="git docker"
|
||||
for prerequisite in $prerequisites; do
|
||||
$prerequisite --version 2>&1
|
||||
is_available=$?
|
||||
@ -68,7 +68,7 @@ source /etc/bridgehead/${PROJECT}.conf
|
||||
source ${PROJECT}/vars
|
||||
|
||||
set +e
|
||||
SERVERTIME="$(https_proxy=$HTTPS_PROXY_FULL_URL curl -m 5 -s -I $BROKER_URL_FOR_PREREQ 2>&1 | grep -i -e '^Date: ' | sed -e 's/^Date: //i')"
|
||||
SERVERTIME="$(https_proxy=$HTTPS_PROXY_URL curl -m 5 -s -I $BROKER_URL_FOR_PREREQ 2>&1 | grep -i -e '^Date: ' | sed -e 's/^Date: //i')"
|
||||
RET=$?
|
||||
set -e
|
||||
if [ $RET -ne 0 ]; then
|
||||
@ -84,7 +84,7 @@ else
|
||||
SYNCTEXT="For example, consider entering a correct NTP server (e.g. your institution's Active Directory Domain Controller in /etc/systemd/timesyncd.conf (option NTP=) and restart systemd-timesyncd."
|
||||
if [ $SKEW -ge 300 ]; then
|
||||
report_error 5 "Your clock is not synchronized (${SKEW}s off). This will cause Samply.Beam's certificate will fail. Please setup time synchronization. $SYNCTEXT"
|
||||
log WARN "Server Time Error"
|
||||
exit 1
|
||||
elif [ $SKEW -ge 60 ]; then
|
||||
log WARN "Your clock is more than a minute off (${SKEW}s). Consider syncing to a time server. $SYNCTEXT"
|
||||
fi
|
||||
|
||||
@ -30,7 +30,7 @@ source $CONFFILE
|
||||
assertVarsNotEmpty SITE_ID || fail_and_report 1 "Update failed: SITE_ID empty"
|
||||
export SITE_ID
|
||||
|
||||
checkOwner /srv/docker/bridgehead bridgehead || fail_and_report 1 "Update failed: Wrong permissions in /srv/docker/bridgehead"
|
||||
checkOwner . bridgehead || fail_and_report 1 "Update failed: Wrong permissions in $(pwd)"
|
||||
checkOwner /etc/bridgehead bridgehead || fail_and_report 1 "Update failed: Wrong permissions in /etc/bridgehead"
|
||||
|
||||
CREDHELPER="/srv/docker/bridgehead/lib/gitpassword.sh"
|
||||
@ -50,12 +50,12 @@ for DIR in /etc/bridgehead $(pwd); do
|
||||
git -C $DIR config credential.helper "$CREDHELPER"
|
||||
fi
|
||||
old_git_hash="$(git -C $DIR rev-parse --verify HEAD)"
|
||||
if [ -z "$HTTPS_PROXY_FULL_URL" ]; then
|
||||
if [ -z "$HTTP_PROXY_URL" ]; then
|
||||
log "INFO" "Git is using no proxy!"
|
||||
OUT=$(retry 5 git -C $DIR fetch 2>&1 && retry 5 git -C $DIR pull 2>&1)
|
||||
else
|
||||
log "INFO" "Git is using proxy ${HTTPS_PROXY_URL} from ${CONFFILE}"
|
||||
OUT=$(retry 5 git -c http.proxy=$HTTPS_PROXY_FULL_URL -c https.proxy=$HTTPS_PROXY_FULL_URL -C $DIR fetch 2>&1 && retry 5 git -c http.proxy=$HTTPS_PROXY_FULL_URL -c https.proxy=$HTTPS_PROXY_FULL_URL -C $DIR pull 2>&1)
|
||||
log "INFO" "Git is using proxy ${HTTP_PROXY_URL} from ${CONFFILE}"
|
||||
OUT=$(retry 5 git -c http.proxy=$HTTP_PROXY_URL -c https.proxy=$HTTPS_PROXY_URL -C $DIR fetch 2>&1 && retry 5 git -c http.proxy=$HTTP_PROXY_URL -c https.proxy=$HTTPS_PROXY_URL -C $DIR pull 2>&1)
|
||||
fi
|
||||
if [ $? -ne 0 ]; then
|
||||
report_error log "Unable to update git $DIR: $OUT"
|
||||
@ -116,7 +116,7 @@ if [ -n "${BACKUP_DIRECTORY}" ]; then
|
||||
mkdir -p "$BACKUP_DIRECTORY"
|
||||
chown -R "$BACKUP_DIRECTORY" bridgehead;
|
||||
fi
|
||||
checkOwner "$BACKUP_DIRECTORY" bridgehead || fail_and_report 1 "Automatic maintenance failed: Wrong permissions for backup directory $BACKUP_DIRECTORY"
|
||||
checkOwner "$BACKUP_DIRECTORY" bridgehead || fail_and_report 1 "Automatic maintenance failed: Wrong permissions for backup directory $(pwd)"
|
||||
# Collect all container names that contain '-db'
|
||||
BACKUP_SERVICES="$(docker ps --filter name=-db --format "{{.Names}}" | tr "\n" "\ ")"
|
||||
log INFO "Performing automatic maintenance: Creating Backups for $BACKUP_SERVICES";
|
||||
|
||||
@ -35,8 +35,8 @@ services:
|
||||
image: docker.verbis.dkfz.de/cache/samply/bridgehead-forward-proxy:latest
|
||||
environment:
|
||||
HTTPS_PROXY: ${HTTPS_PROXY_URL}
|
||||
HTTPS_PROXY_USERNAME: ${HTTPS_PROXY_USERNAME}
|
||||
HTTPS_PROXY_PASSWORD: ${HTTPS_PROXY_PASSWORD}
|
||||
USERNAME: ${HTTPS_PROXY_USERNAME}
|
||||
PASSWORD: ${HTTPS_PROXY_PASSWORD}
|
||||
tmpfs:
|
||||
- /var/log/squid
|
||||
- /var/spool/squid
|
||||
|
||||
@ -18,7 +18,7 @@ services:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro
|
||||
- /srv/docker/bridgehead/ccp/root-new.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
dnpm-beam-connect:
|
||||
depends_on: [ dnpm-beam-proxy ]
|
||||
@ -32,11 +32,9 @@ services:
|
||||
LOCAL_TARGETS_FILE: "./conf/connect_targets.json"
|
||||
HTTP_PROXY: http://forward_proxy:3128
|
||||
HTTPS_PROXY: http://forward_proxy:3128
|
||||
NO_PROXY: dnpm-beam-proxy,dnpm-backend, host.docker.internal
|
||||
NO_PROXY: dnpm-beam-proxy,dnpm-backend
|
||||
RUST_LOG: ${RUST_LOG:-info}
|
||||
NO_AUTH: "true"
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway"
|
||||
volumes:
|
||||
- /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
|
||||
- /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro
|
||||
|
||||
@ -1,33 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
dnpm-backend:
|
||||
image: ghcr.io/kohlbacherlab/bwhc-backend:1.0-snapshot-broker-connector
|
||||
container_name: bridgehead-dnpm-backend
|
||||
environment:
|
||||
- ZPM_SITE=${ZPM_SITE}
|
||||
volumes:
|
||||
- /etc/bridgehead/dnpm:/bwhc_config:ro
|
||||
- ${DNPM_DATA_DIR}:/bwhc_data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.bwhc-backend.rule=PathPrefix(`/bwhc`)"
|
||||
- "traefik.http.services.bwhc-backend.loadbalancer.server.port=9000"
|
||||
- "traefik.http.routers.bwhc-backend.tls=true"
|
||||
|
||||
dnpm-frontend:
|
||||
image: ghcr.io/kohlbacherlab/bwhc-frontend:2209
|
||||
container_name: bridgehead-dnpm-frontend
|
||||
links:
|
||||
- dnpm-backend
|
||||
environment:
|
||||
- NUXT_HOST=0.0.0.0
|
||||
- NUXT_PORT=8080
|
||||
- BACKEND_PROTOCOL=https
|
||||
- BACKEND_HOSTNAME=$HOST
|
||||
- BACKEND_PORT=443
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.bwhc-frontend.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.bwhc-frontend.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.bwhc-frontend.tls=true"
|
||||
@ -1,27 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -n "${ENABLE_DNPM_NODE}" ]; then
|
||||
log INFO "DNPM setup detected (BwHC Node) -- will start BwHC node."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/dnpm-node-compose.yml"
|
||||
|
||||
# Set variables required for BwHC Node. ZPM_SITE is assumed to be set in /etc/bridgehead/<project>.conf
|
||||
DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
if [ -z "${ZPM_SITE+x}" ]; then
|
||||
log ERROR "Mandatory variable ZPM_SITE not defined!"
|
||||
exit 1
|
||||
fi
|
||||
if [ -z "${DNPM_DATA_DIR+x}" ]; then
|
||||
log ERROR "Mandatory variable DNPM_DATA_DIR not defined!"
|
||||
exit 1
|
||||
fi
|
||||
if grep -q 'traefik.http.routers.landing.rule=PathPrefix(`/landing`)' /srv/docker/bridgehead/minimal/docker-compose.override.yml 2>/dev/null; then
|
||||
echo "Override of landing page url already in place"
|
||||
else
|
||||
echo "Adding override of landing page url"
|
||||
if [ -f /srv/docker/bridgehead/minimal/docker-compose.override.yml ]; then
|
||||
echo -e ' landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml
|
||||
else
|
||||
echo -e 'version: "3.7"\nservices:\n landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
@ -5,12 +5,9 @@ if [ -n "${ENABLE_DNPM}" ]; then
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/dnpm-compose.yml"
|
||||
|
||||
# Set variables required for Beam-Connect
|
||||
DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
DNPM_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
DNPM_BROKER_ID="broker.ccp-it.dktk.dkfz.de"
|
||||
DNPM_BROKER_URL="https://${DNPM_BROKER_ID}"
|
||||
if [ -z ${BROKER_URL_FOR_PREREQ+x} ]; then
|
||||
BROKER_URL_FOR_PREREQ=$DNPM_BROKER_URL
|
||||
log DEBUG "No Broker for clock check set; using $DNPM_BROKER_URL"
|
||||
fi
|
||||
DNPM_PROXY_ID="${SITE_ID}.${DNPM_BROKER_ID}"
|
||||
fi
|
||||
|
||||
@ -1,29 +0,0 @@
|
||||
version: "3.7"
|
||||
volumes:
|
||||
nngm-rest:
|
||||
|
||||
services:
|
||||
connector:
|
||||
container_name: bridgehead-connector
|
||||
image: docker.verbis.dkfz.de/ccp/nngm-rest:main
|
||||
environment:
|
||||
CTS_MAGICPL_API_KEY: ${NNGM_MAGICPL_APIKEY}
|
||||
CTS_API_KEY: ${NNGM_CTS_APIKEY}
|
||||
CRYPT_KEY: ${NNGM_CRYPTKEY}
|
||||
#CTS_MAGICPL_SITE: ${SITE_ID}TODO
|
||||
restart: always
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.connector.rule=PathPrefix(`/nngm-connector`)"
|
||||
- "traefik.http.middlewares.connector_strip.stripprefix.prefixes=/nngm-connector"
|
||||
- "traefik.http.services.connector.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.connector.tls=true"
|
||||
- "traefik.http.routers.connector.middlewares=connector_strip,auth-nngm"
|
||||
volumes:
|
||||
- nngm-rest:/var/log
|
||||
|
||||
traefik:
|
||||
labels:
|
||||
- "traefik.http.middlewares.auth-nngm.basicauth.users=${NNGM_AUTH}"
|
||||
|
||||
|
||||
@ -1,6 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -n "$NNGM_CTS_APIKEY" ]; then
|
||||
log INFO "nNGM setup detected -- will start nNGM Connector."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/nngm-compose.yml"
|
||||
fi
|
||||
@ -1,30 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Start a running Bridgehead. If there is already a Bridgehead running,
|
||||
# stop it first.
|
||||
# This is intended to be used by systemctl.
|
||||
|
||||
cd /srv/docker/bridgehead
|
||||
|
||||
echo "git status before stop"
|
||||
git status
|
||||
|
||||
echo "Stopping running Bridgehead, if present"
|
||||
./bridgehead stop bbmri
|
||||
|
||||
# If "flush_blaze" is present, delete the Blaze volume before starting
|
||||
# the Bridgehead again. This allows a user to upload all data, if
|
||||
# requested.
|
||||
if [ -f "/srv/docker/ecdc/data/flush_blaze" ]; then
|
||||
docker volume rm bbmri_blaze-data
|
||||
rm -f /srv/docker/ecdc/data/flush_blaze
|
||||
fi
|
||||
|
||||
echo "git status before start"
|
||||
git status | systemd-cat -p info
|
||||
|
||||
echo "Start the Bridgehead anew"
|
||||
./bridgehead start bbmri
|
||||
|
||||
echo "Bridgehead has unexpectedly terminated"
|
||||
|
||||
83
run.sh
83
run.sh
@ -1,83 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Start a Bridgehead from the command line. Upload data if requested.
|
||||
# Behind the scenes we use systemctl to do the work.
|
||||
|
||||
# Function to print usage
|
||||
print_usage() {
|
||||
echo "Start a Bridghead, optionally upload data"
|
||||
echo "Usage: $0 [--upload | --upload-all | --help | -h]"
|
||||
echo "Options:"
|
||||
echo " --upload Run Bridgehead and upload just the new CSV data files."
|
||||
echo " --upload-all Run Bridgehead and upload all CSV data files."
|
||||
echo " --help, -h Display this help message."
|
||||
echo " No options Run Bridgehead only."
|
||||
}
|
||||
|
||||
# Initialize variables
|
||||
UPLOAD=false
|
||||
UPLOAD_ALL=false
|
||||
|
||||
# Parse arguments
|
||||
while [[ "$#" -gt 0 ]]; do
|
||||
case $1 in
|
||||
--upload)
|
||||
UPLOAD=true
|
||||
;;
|
||||
--upload-all)
|
||||
UPLOAD_ALL=true
|
||||
;;
|
||||
--help|-h)
|
||||
print_usage
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
echo "Error: Unknown argument '$1'"
|
||||
print_usage
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
# Check for conflicting options
|
||||
if [ "$UPLOAD" = true ] && [ "$UPLOAD_ALL" = true ]; then
|
||||
echo "Error: you must specify either --upload or --upload-all, specifying both is not permitted."
|
||||
print_usage
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Disable/stop standard Bridgehead systemctl services, if present
|
||||
sudo systemctl disable bridgehead@bbmri.service >& /dev/null
|
||||
sudo systemctl disable system-bridgehead.slice >& /dev/null
|
||||
sudo systemctl disable bridgehead-update@bbmri.timer >& /dev/null
|
||||
sudo systemctl stop bridgehead@bbmri.service >& /dev/null
|
||||
sudo systemctl stop system-bridgehead.slice >& /dev/null
|
||||
sudo systemctl stop bridgehead-update@bbmri.timer >& /dev/null
|
||||
|
||||
# Set up systemctl for EHDS2/ECDC if necessary
|
||||
cp /srv/docker/bridgehead/ecdc.service /etc/systemd/system
|
||||
systemctl daemon-reload
|
||||
systemctl enable ecdc.service
|
||||
|
||||
# Use systemctl to stop the Bridgehead if it is running
|
||||
sudo systemctl stop ecdc.service
|
||||
|
||||
# Use files to tell the Bridgehead what to do with any data present
|
||||
if [ "$UPLOAD" = true ] || [ "$UPLOAD_ALL" = true ]; then
|
||||
if [ -f /srv/docker/ecdc/data/lock ]; then
|
||||
rm /srv/docker/ecdc/data/lock
|
||||
fi
|
||||
fi
|
||||
if [ "$UPLOAD_ALL" = true ]; then
|
||||
echo "All CSV files in /srv/docker/ecdc/data will be uploaded"
|
||||
touch /srv/docker/ecdc/data/flush_blaze
|
||||
fi
|
||||
|
||||
# Start up the Bridgehead
|
||||
sudo systemctl start ecdc.service
|
||||
|
||||
# Show status of Bridgehead service
|
||||
sleep 10
|
||||
systemctl status ecdc.service
|
||||
|
||||
@ -1,13 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Shut down a running Bridgehead.
|
||||
# This is intended to be used by systemctl.
|
||||
|
||||
cd /srv/docker/bridgehead
|
||||
|
||||
echo "git status before stop"
|
||||
git status
|
||||
|
||||
echo "Stopping running Bridgehead, if present"
|
||||
./bridgehead stop bbmri
|
||||
|
||||
43
stop.sh
43
stop.sh
@ -1,43 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Shut down a running Bridgehead.
|
||||
# Behind the scenes we use systemctl to do the work.
|
||||
|
||||
# Function to print usage
|
||||
print_usage() {
|
||||
echo "Stop the running Bridgehead"
|
||||
echo "Usage: $0 [--help | -h]"
|
||||
echo "Options:"
|
||||
echo " --help, -h Display this help message."
|
||||
echo " No options Stop Bridgehead only."
|
||||
}
|
||||
|
||||
# Parse arguments
|
||||
while [[ "$#" -gt 0 ]]; do
|
||||
case $1 in
|
||||
--help|-h)
|
||||
print_usage
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
echo "Error: Unknown argument '$1'"
|
||||
print_usage
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
# Set up systemctl for EHDS2/ECDC if necessary
|
||||
cp /srv/docker/bridgehead/ecdc.service /etc/systemd/system
|
||||
systemctl daemon-reload
|
||||
systemctl enable ecdc.service
|
||||
|
||||
# Use systemctl to stop the Bridgehead if it is running
|
||||
sudo systemctl stop ecdc.service
|
||||
|
||||
# Show status of Bridgehead service
|
||||
sleep 20
|
||||
systemctl status ecdc.service
|
||||
docker ps
|
||||
|
||||
Reference in New Issue
Block a user