Adapt changes in teiler, exporter and reporter for CCP

README.md

@@ -24,9 +24,6 @@ This repository is the starting point for any information and tools you will nee
     - [BBMRI-ERIC Directory entry needed](#bbmri-eric-directory-entry-needed)
     - [Directory sync tool](#directory-sync-tool)
     - [Loading data](#loading-data)
-    - [Teiler (Frontend)](#teiler-frontend)
-    - [Data Exporter Service](#data-exporter-service)
-      - [Data Quality Report](#data-quality-report)
 4. [Things you should know](#things-you-should-know)
     - [Auto-Updates](#auto-updates)
     - [Auto-Backups](#auto-backups)
@@ -382,37 +379,6 @@ Normally, you will need to build your own ETL to feed the Bridgehead. However, t
 
 You can find the profiles for generating FHIR in [Simplifier](https://simplifier.net/bbmri.de/~resources?category=Profile).
 
-### Teiler (Frontend)
-
-Teiler is the web-based frontend of the Bridgehead, providing access to its various internal, and external services and components.   
-To learn how to integrate your custom module into Teiler, please refer to https://github.com/samply/teiler-dashboard.
-- To activate Teiler, set the following environment variable in your `<PROJECT>.conf` file:  
-
-```bash
-ENABLE_TEILER=true
-```
-
-### Data Exporter Service
-
-The Exporter is a dedicated service for extracting and exporting Bridgehead data in (tabular) formats such as Excel, CSV, Opal, JSON, XML, ...  
-- To enable the Exporter service, set the following environment variable in your `<PROJECT>.conf` file:  
-
-```bash
-ENABLE_EXPORTER=true
-```
-
-#### Data Quality Report
-To assess the quality and plausibility of your imported data, the Reporter component is pre-configured to generate Excel reports with data quality metrics and statistical analyses. Reporter is part of the Exporter and can be enabled by setting the same environment variable in your `<PROJECT>.conf` file:
-```bash
-ENABLE_EXPORTER=true
-```
-
-For convenience, it's recommended to enable the Teiler web frontend alongside the Exporter to access export and quality control features via a web interface: set the following environment varibles in your `<PROJECT>.conf` file:
-```bash
-ENABLE_TEILER=true
-ENABLE_EXPORTER=true
-```
-
 ## Things you should know
 
 ### Auto-Updates

bbmri/docker-compose.yml

@@ -26,3 +26,7 @@ services:
 volumes:
   blaze-data:
 
+# used in modules *-locator.yml
+secrets:
+  proxy.pem:
+    file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

bbmri/modules/eric-compose.yml

@@ -26,11 +26,11 @@ services:
       ALL_PROXY: http://forward_proxy:3128
       TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
       ROOTCERT_FILE: /conf/root.crt.pem
+    secrets:
+      - proxy.pem
     depends_on:
       - "forward_proxy"
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
-      - /srv/docker/bridgehead/bbmri/modules/${ERIC_ROOT_CERT}.root.crt.pem:/conf/root.crt.pem:ro,Z
-      # secrets don't seem to allow us to specify Z
-      - /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
+      - /srv/docker/bridgehead/bbmri/modules/${ERIC_ROOT_CERT}.root.crt.pem:/conf/root.crt.pem:ro
 

bbmri/modules/eric.acc.root.crt.pem

@@ -1,20 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIDNTCCAh2gAwIBAgIUFzdpDi1OLdXyogtCsktHFhCILtMwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjUwNjEwMTQzNjE1WhcNMzUw
-NjA4MTQzNjQ1WjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBALpJCWE9Qe19R9DqotdkPV6jfiuJSKI3UYkCWdWG
-nRfkKB6OaY5t3JCHDqaEME9FwSd2nFXhTp5F6snG/K7g8MCLIEzGzuSnrdjGqINq
-zXLfgqnxvQpPR4ARLNNgnKxZaq7m4Q3T/l+QAshK6CnCUWFQ6q5x3g/pZHFP2USd
-/G2FtDHX6YK4bHbbnigIPG6PdY2RYy60i30XGdIPBNf82XGkAtPUBz731gHOV5Vg
-d+jfAqTwZAhYC2CcNmswFw1H9GrvTI/9KZWKcZNUIqemc0A/FyEyONUM18/vjQ7D
-lUwOcQsgAg44QTOUPgqXv3sJPQM5EnGuv3yYV9u6Y2i78M8CAwEAAaN7MHkwDgYD
-VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFPrDeNWgtEyZ
-VM0yeoRZdK2QGjyvMB8GA1UdIwQYMBaAFPrDeNWgtEyZVM0yeoRZdK2QGjyvMBYG
-A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQAD2S0kqL18
-laewh+qnyZ0WMq12mLV/Rwll6ZuShCx2uAu3UZuIGWk3l7gG5zlws+i+zbaNcn4o
-HsS3WG9kiNLOMKp8LXGkjErl6RaQr+kb8qgYFTPjOr6v0OdVn6ve9RDNYB5Hd+zE
-9jAWmS8PfS2AldE4VAd0C4pWTAinhnKGrKdn1YAX5x+LMq1y0lc1Pd4CDgsjD6SS
-3td7JtenXqCX0mN0XSeck7vvFGa6QpcQoVcN9tRENctHZTwyeGA21IkXylpFPUkE
-LT60k48fNC8TZkBlfvtVGRebpm5krXIKEaVy5LniEpSuOR4hTqsgoQDntBjW4zHA
-GeWQ1wQNTEBX
+MIIDNTCCAh2gAwIBAgIUE/wu6FmI+KSMOalI65b+lI3HI4cwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjQwOTE2MTUyMzU0WhcNMzQw
+OTE0MTUyNDI0WjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAOt1I1FQt2bI4Nnjtg8JBYid29cBIkDT4MMb45Jr
+ays24y4R3WO7VJK9UjNduSq/A1jlA0W0A/szDf8Ojq6bBtg+uL92PTDjYH1QXwX0
+c7eMo2tvvyyrs/cb2/ovDBQ1lpibcxVmVAv042ASmil3SdqKKXpv3ATnF9I7V4cv
+fwB56FChaGIov5EK+9JOMjTx6oMlBEgUFR6qq/lSqM9my0HYwUFbX2W+nT9EKEIP
+9UP1eyfRZR3E/+oticnm/cS20BGCbjoYrNgLthXKyaASuhGoElKs8EZ3h9MiI+u0
+DpR0KpePhAkMLugBrgYWqkMwwD1684LfC4YVQrsLwzo5OW8CAwEAAaN7MHkwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFPbXs3g3lMjH
+1JMe0a5aVbN7lB92MB8GA1UdIwQYMBaAFPbXs3g3lMjH1JMe0a5aVbN7lB92MBYG
+A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQBM5RsXb2HN
+FpC1mYfocXAn20Zu4d603qmc/IqkiOWbp36pWo+jk1AxejyRS9hEpQalgSnvcRPQ
+1hPEhGU+wvI0WWVi/01iNjVbXmJNPQEouXQWAT17dyp9vqQkPw8LNzpSV/qdPgbT
+Z9o3sZrjUsSLsK7A7Q5ky4ePkiJBaMsHeAD+wqGwpiJ4D2Xhp8e1v36TWM0qt2EA
+gySx9isx/jeGGPBmDqYB9BCal5lrihPN56jd+5pCkyXeZqKWiiXFJKXwcwxctYZc
+ADHIiTLLPXE8LHTUJAO51it1NAZ1S24aMzax4eWDXcWO7/ybbx5pkYkMd6EqlKHd
+8riQJIhY4huX
 -----END CERTIFICATE-----

bbmri/modules/exporter-compose.yml

@@ -1,86 +0,0 @@
-version: "3.7"
-
-services:
-  exporter:
-    image: docker.verbis.dkfz.de/ccp/dktk-exporter:latest
-    container_name: bridgehead-bbmri-exporter
-    environment:
-      JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
-      LOG_LEVEL: "INFO"
-      EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh
-      CROSS_ORIGINS: "https://${HOST}"
-      EXPORTER_DB_USER: "exporter"
-      EXPORTER_DB_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
-      EXPORTER_DB_URL: "jdbc:postgresql://exporter-db:5432/exporter"
-      HTTP_RELATIVE_PATH: "/bbmri-exporter"
-      SITE: "${SITE_ID}"
-      HTTP_SERVLET_REQUEST_SCHEME: "https"
-      OPAL_PASSWORD: "${EXPORTER_OPAL_PASSWORD}"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.exporter_bbmri.rule=PathPrefix(`/bbmri-exporter`)"
-      - "traefik.http.services.exporter_bbmri.loadbalancer.server.port=8092"
-      - "traefik.http.routers.exporter_bbmri.tls=true"
-      - "traefik.http.middlewares.exporter_bbmri_strip.stripprefix.prefixes=/bbmri-exporter"
-      - "traefik.http.routers.exporter_bbmri.middlewares=exporter_bbmri_strip"
-      # Main router
-      - "traefik.http.routers.exporter_bbmri.priority=20"
-
-      # API router
-      - "traefik.http.routers.exporter_bbmri_api.middlewares=exporter_bbmri_strip,exporter_auth"
-      - "traefik.http.routers.exporter_bbmri_api.rule=PathRegexp(`/bbmri-exporter/.+`)"
-      - "traefik.http.routers.exporter_bbmri_api.tls=true"
-      - "traefik.http.routers.exporter_bbmri_api.priority=25"
-
-      # Shared middlewares
-      - "traefik.http.middlewares.exporter_auth.basicauth.users=${EXPORTER_USER}"
-
-    volumes:
-      - "/var/cache/bridgehead/bbmri/exporter-files:/app/exporter-files/output:z"
-
-  exporter-db:
-    image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
-    container_name: bridgehead-bbmri-exporter-db
-    environment:
-      POSTGRES_USER: "exporter"
-      POSTGRES_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
-      POSTGRES_DB: "exporter"
-    volumes:
-      # Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer.
-      - "/var/cache/bridgehead/bbmri/exporter-db:/var/lib/postgresql/data:Z"
-
-  reporter:
-    image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest
-    container_name: bridgehead-bbmri-reporter
-    environment:
-      JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
-      LOG_LEVEL: "INFO"
-      CROSS_ORIGINS: "https://${HOST}"
-      HTTP_RELATIVE_PATH: "/bbmri-reporter"
-      SITE: "${SITE_ID}"
-      EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh
-      EXPORTER_URL: "http://exporter:8092"
-      LOG_FHIR_VALIDATION: "false"
-      HTTP_SERVLET_REQUEST_SCHEME: "https"
-
-    # In this initial development state of the bridgehead, we are trying to have so many volumes as possible.
-    # However, in the first executions in the bbmri sites, this volume seems to be very important. A report is
-    # a process that can take several hours, because it depends on the exporter.
-    # There is a risk that the bridgehead restarts, losing the already created export.
-
-    volumes:
-      - "/var/cache/bridgehead/bbmri/reporter-files:/app/reports:z"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.reporter_bbmri.rule=PathPrefix(`/bbmri-reporter`)"
-      - "traefik.http.services.reporter_bbmri.loadbalancer.server.port=8095"
-      - "traefik.http.routers.reporter_bbmri.tls=true"
-      - "traefik.http.middlewares.reporter_bbmri_strip.stripprefix.prefixes=/bbmri-reporter"
-      - "traefik.http.routers.reporter_bbmri.middlewares=reporter_bbmri_strip"
-      - "traefik.http.routers.reporter_bbmri.priority=20"
-
-      - "traefik.http.routers.reporter_bbmri_api.middlewares=reporter_bbmri_strip,exporter_auth"
-      - "traefik.http.routers.reporter_bbmri_api.rule=PathRegexp(`/bbmri-reporter/.+`)"
-      - "traefik.http.routers.reporter_bbmri_api.tls=true"
-      - "traefik.http.routers.reporter_bbmri_api.priority=25"
-

bbmri/modules/exporter-setup.sh

@@ -1,8 +0,0 @@
-#!/bin/bash -e
-
-if [ "$ENABLE_EXPORTER" == true ]; then
-  log INFO "Exporter setup detected -- will start Exporter service."
-  OVERRIDE+=" -f ./$PROJECT/modules/exporter-compose.yml"
-  EXPORTER_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
-  EXPORTER_API_KEY="$(echo \"This is a salt string to generate one consistent API KEY for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 64)"
-fi

bbmri/modules/gbn-compose.yml

@@ -26,11 +26,11 @@ services:
       ALL_PROXY: http://forward_proxy:3128
       TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
       ROOTCERT_FILE: /conf/root.crt.pem
+    secrets:
+      - proxy.pem
     depends_on:
       - "forward_proxy"
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
-      - /srv/docker/bridgehead/bbmri/modules/${GBN_ROOT_CERT}.root.crt.pem:/conf/root.crt.pem:ro,Z
-      # secrets don't seem to allow us to specify Z
-      - /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
+      - /srv/docker/bridgehead/bbmri/modules/${GBN_ROOT_CERT}.root.crt.pem:/conf/root.crt.pem:ro
 

bbmri/modules/teiler-compose.yml

@@ -1,69 +0,0 @@
-version: "3.7"
-
-services:
-
-  teiler-orchestrator:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-orchestrator:latest
-    container_name: bridgehead-teiler-orchestrator
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.teiler_orchestrator_bbmri.rule=PathPrefix(`/bbmri-teiler`)"
-      - "traefik.http.services.teiler_orchestrator_bbmri.loadbalancer.server.port=9000"
-      - "traefik.http.routers.teiler_orchestrator_bbmri.tls=true"
-      - "traefik.http.middlewares.teiler_orchestrator_bbmri_strip.stripprefix.prefixes=/bbmri-teiler"
-      - "traefik.http.routers.teiler_orchestrator_bbmri.middlewares=teiler_orchestrator_bbmri_strip"
-    environment:
-      TEILER_BACKEND_URL: "/bbmri-teiler-backend"
-      TEILER_DASHBOARD_URL: "/bbmri-teiler-dashboard"
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE_LOWER_CASE}"
-      HTTP_RELATIVE_PATH: "/bbmri-teiler"
-
-  teiler-dashboard:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
-    container_name: bridgehead-teiler-dashboard
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.teiler_dashboard_bbmri.rule=PathPrefix(`/bbmri-teiler-dashboard`)"
-      - "traefik.http.services.teiler_dashboard_bbmri.loadbalancer.server.port=80"
-      - "traefik.http.routers.teiler_dashboard_bbmri.tls=true"
-      - "traefik.http.middlewares.teiler_dashboard_bbmri_strip.stripprefix.prefixes=/bbmri-teiler-dashboard"
-      - "traefik.http.routers.teiler_dashboard_bbmri.middlewares=teiler_dashboard_bbmri_strip"
-    environment:
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
-      TEILER_BACKEND_URL: "/bbmri-teiler-backend"
-      TEILER_DASHBOARD_URL: "/bbmri-teiler-dashboard"
-      OIDC_URL: "${OIDC_URL}"
-      OIDC_CLIENT_ID: "${OIDC_PUBLIC_CLIENT_ID}"
-      OIDC_TOKEN_GROUP: "${OIDC_GROUP_CLAIM}"
-      TEILER_ADMIN_NAME: "${OPERATOR_FIRST_NAME} ${OPERATOR_LAST_NAME}"
-      TEILER_ADMIN_EMAIL: "${OPERATOR_EMAIL}"
-      TEILER_ADMIN_PHONE: "${OPERATOR_PHONE}"
-      TEILER_PROJECT: "${PROJECT}"
-      EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
-      TEILER_ORCHESTRATOR_URL: "/bbmri-teiler"
-      TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/bbmri-teiler"
-      TEILER_USER: "${OIDC_USER_GROUP}"
-      TEILER_ADMIN: "${OIDC_ADMIN_GROUP}"
-      REPORTER_DEFAULT_TEMPLATE_ID: "bbmri-qb"
-      EXPORTER_DEFAULT_TEMPLATE_ID: "bbmri"
-
-
-  teiler-backend:
-    image: docker.verbis.dkfz.de/ccp/bbmri-teiler-backend:latest
-    container_name: bridgehead-teiler-backend
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.teiler_backend_bbmri.rule=PathPrefix(`/bbmri-teiler-backend`)"
-      - "traefik.http.services.teiler_backend_bbmri.loadbalancer.server.port=8085"
-      - "traefik.http.routers.teiler_backend_bbmri.tls=true"
-      - "traefik.http.middlewares.teiler_backend_bbmri_strip.stripprefix.prefixes=/bbmri-teiler-backend"
-      - "traefik.http.routers.teiler_backend_bbmri.middlewares=teiler_backend_bbmri_strip"
-    environment:
-      LOG_LEVEL: "INFO"
-      APPLICATION_PORT: "8085"
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
-      TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/bbmri-teiler"
-      TEILER_ORCHESTRATOR_URL: "/bbmri-teiler"
-      TEILER_DASHBOARD_DE_URL: "/bbmri-teiler-dashboard/de"
-      TEILER_DASHBOARD_EN_URL: "/bbmri-teiler-dashboard/en"
-      HTTP_PROXY: "http://forward_proxy:3128"

bbmri/modules/teiler-setup.sh

@@ -1,8 +0,0 @@
-#!/bin/bash -e
-
-if [ "$ENABLE_TEILER" == true ];then
-  log INFO "Teiler setup detected -- will start Teiler services."
-  OVERRIDE+=" -f ./$PROJECT/modules/teiler-compose.yml"
-  TEILER_DEFAULT_LANGUAGE=EN
-  TEILER_DEFAULT_LANGUAGE_LOWER_CASE=${TEILER_DEFAULT_LANGUAGE,,}
-fi

bbmri/vars

@@ -1,9 +1,25 @@
+DEFAULT_LANGUAGE=EN
+DEFAULT_LANGUAGE_LOWER_CASE=${DEFAULT_LANGUAGE,,}
+
 BROKER_ID=broker-test.bbmri-test.samply.de
 BROKER_URL=https://${BROKER_ID}
 PROXY_ID=${SITE_ID}.${BROKER_ID}
 PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
+PLATFORM=bbmri
+
 BROKER_URL_FOR_PREREQ=$BROKER_URL
 
+OIDC_USER_GROUP="BBMRI_$(capitalize_first_letter ${SITE_ID})"
+OIDC_ADMIN_GROUP="BBMRI_$(capitalize_first_letter ${SITE_ID})_Verwalter"
+OIDC_PUBLIC_CLIENT_ID="BBMRI_${SITE_ID}-public"
+# Use "test-realm-01" for testing
+OIDC_REALM="${OIDC_REALM:-test-realm-01}"
+OIDC_URL="https://login.verbis.dkfz.de"
+OIDC_ISSUER_URL="${OIDC_URL}/realms/${OIDC_REALM}"
+OIDC_GROUP_CLAIM="groups"
+
+POSTGRES_TAG=15.6-alpine
+
 # Makes sense for all European Biobanks
 : ${ENABLE_ERIC:=true}
 
@@ -11,6 +27,7 @@ BROKER_URL_FOR_PREREQ=$BROKER_URL
 : ${ENABLE_GBN:=false}
 
 FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
+PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
 
 for module in $PROJECT/modules/*.sh
 do
@@ -18,6 +35,13 @@ do
     source $module
 done
 
+log DEBUG "sourcing ccp/modules/exporter-setup.sh"
+source ccp/modules/exporter-setup.sh
+
+log DEBUG "sourcing ccp/modules/teiler-setup.sh"
+source ccp/modules/teiler-setup.sh
+
+
 SUPPORT_EMAIL=$ERIC_SUPPORT_EMAIL
 BROKER_URL_FOR_PREREQ="${ERIC_BROKER_URL:-$GBN_BROKER_URL}"
 

bridgehead

@@ -116,6 +116,8 @@ case "$ACTION" in
 		loadVars
 		hc_send log "Bridgehead $PROJECT startup: Checking requirements ..."
 		checkRequirements
+		# NOTE: for testing only, we will need to properly setup secret sync if we want to use this code
+		# TODO: Adapt it for BBMRI (sync_secrets)
 		sync_secrets
 		hc_send log "Bridgehead $PROJECT startup: Requirements checked out. Now starting bridgehead ..."
 		exec $COMPOSE -p $PROJECT -f ./minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE up --abort-on-container-exit
@@ -162,7 +164,7 @@ case "$ACTION" in
 	adduser)
 		loadVars
 		log "INFO" "Adding encrypted credentials in /etc/bridgehead/$PROJECT.local.conf"
-    		read -p "Please choose the component (LDM_AUTH|NNGM_AUTH|EXPORTER_USER) you want to add a user to : " COMPONENT
+    		read -p "Please choose the component (LDM_AUTH|NNGM_AUTH) you want to add a user to : " COMPONENT
     		read -p "Please enter a username: " USER
     		read -s -p "Please enter a password (will not be echoed): "$'\n' PASSWORD
     		add_basic_auth_user $USER $PASSWORD $COMPONENT $PROJECT

cce/docker-compose.yml

@@ -35,7 +35,7 @@ services:
       QUERIES_TO_CACHE: '/queries_to_cache.conf'
       ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
     volumes:
-      - /srv/docker/bridgehead/cce/queries_to_cache.conf:/queries_to_cache.conf:ro,Z
+      - /srv/docker/bridgehead/cce/queries_to_cache.conf:/queries_to_cache.conf:ro
     depends_on:
       - "beam-proxy"
       - "blaze"
@@ -57,10 +57,12 @@ services:
       - "forward_proxy"
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
-      - /srv/docker/bridgehead/cce/root.crt.pem:/conf/root.crt.pem:ro,Z
-      # secrets don't seem to allow us to specify Z
-      - /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
+      - /srv/docker/bridgehead/cce/root.crt.pem:/conf/root.crt.pem:ro
 
 
 volumes:
   blaze-data:
+
+secrets:
+  proxy.pem:
+    file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

cce/modules/exporter-compose.yml

@@ -1,87 +0,0 @@
-version: "3.7"
-
-services:
-
-  exporter:
-    image: docker.verbis.dkfz.de/ccp/dktk-exporter:latest
-    container_name: bridgehead-cce-exporter
-    environment:
-      JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
-      LOG_LEVEL: "INFO"
-      EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh
-      CROSS_ORIGINS: "https://${HOST}"
-      EXPORTER_DB_USER: "exporter"
-      EXPORTER_DB_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
-      EXPORTER_DB_URL: "jdbc:postgresql://exporter-db:5432/exporter"
-      HTTP_RELATIVE_PATH: "/cce-exporter"
-      SITE: "${SITE_ID}"
-      HTTP_SERVLET_REQUEST_SCHEME: "https"
-      OPAL_PASSWORD: "${EXPORTER_OPAL_PASSWORD}"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.exporter_cce.rule=PathPrefix(`/cce-exporter`)"
-      - "traefik.http.services.exporter_cce.loadbalancer.server.port=8092"
-      - "traefik.http.routers.exporter_cce.tls=true"
-      - "traefik.http.middlewares.exporter_cce_strip.stripprefix.prefixes=/cce-exporter"
-      - "traefik.http.routers.exporter_cce.middlewares=exporter_cce_strip"
-      # Main router
-      - "traefik.http.routers.exporter_cce.priority=20"
-
-      # API router
-      - "traefik.http.routers.exporter_cce_api.middlewares=exporter_cce_strip,exporter_auth"
-      - "traefik.http.routers.exporter_cce_api.rule=PathRegexp(`/cce-exporter/.+`)"
-      - "traefik.http.routers.exporter_cce_api.tls=true"
-      - "traefik.http.routers.exporter_cce_api.priority=25"
-
-      # Shared middlewares
-      - "traefik.http.middlewares.exporter_auth.basicauth.users=${EXPORTER_USER}"
-
-    volumes:
-      - "/var/cache/bridgehead/cce/exporter-files:/app/exporter-files/output:z"
-
-  exporter-db:
-    image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
-    container_name: bridgehead-cce-exporter-db
-    environment:
-      POSTGRES_USER: "exporter"
-      POSTGRES_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
-      POSTGRES_DB: "exporter"
-    volumes:
-      # Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer.
-      - "/var/cache/bridgehead/cce/exporter-db:/var/lib/postgresql/data:Z"
-
-  reporter:
-    image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest
-    container_name: bridgehead-cce-reporter
-    environment:
-      JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
-      LOG_LEVEL: "INFO"
-      CROSS_ORIGINS: "https://${HOST}"
-      HTTP_RELATIVE_PATH: "/cce-reporter"
-      SITE: "${SITE_ID}"
-      EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh
-      EXPORTER_URL: "http://exporter:8092"
-      LOG_FHIR_VALIDATION: "false"
-      HTTP_SERVLET_REQUEST_SCHEME: "https"
-
-    # In this initial development state of the bridgehead, we are trying to have so many volumes as possible.
-    # However, in the first executions in the cce sites, this volume seems to be very important. A report is
-    # a process that can take several hours, because it depends on the exporter.
-    # There is a risk that the bridgehead restarts, losing the already created export.
-
-    volumes:
-      - "/var/cache/bridgehead/cce/reporter-files:/app/reports:z"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.reporter_cce.rule=PathPrefix(`/cce-reporter`)"
-      - "traefik.http.services.reporter_cce.loadbalancer.server.port=8095"
-      - "traefik.http.routers.reporter_cce.tls=true"
-      - "traefik.http.middlewares.reporter_cce_strip.stripprefix.prefixes=/cce-reporter"
-      - "traefik.http.routers.reporter_cce.middlewares=reporter_cce_strip"
-      - "traefik.http.routers.reporter_cce.priority=20"
-
-      - "traefik.http.routers.reporter_cce_api.middlewares=reporter_cce_strip,exporter_auth"
-      - "traefik.http.routers.reporter_cce_api.rule=PathRegexp(`/cce-reporter/.+`)"
-      - "traefik.http.routers.reporter_cce_api.tls=true"
-      - "traefik.http.routers.reporter_cce_api.priority=25"
-

cce/modules/exporter-setup.sh

@@ -1,8 +0,0 @@
-#!/bin/bash -e
-
-if [ "$ENABLE_EXPORTER" == true ]; then
-  log INFO "Exporter setup detected -- will start Exporter service."
-  OVERRIDE+=" -f ./$PROJECT/modules/exporter-compose.yml"
-  EXPORTER_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
-  EXPORTER_API_KEY="$(echo \"This is a salt string to generate one consistent API KEY for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 64)"
-fi

cce/modules/lens-compose.yml

@@ -17,6 +17,7 @@ services:
       BEAM_PROXY_ID: ${SITE_ID}
       BEAM_BROKER_ID: ${BROKER_ID}
       BEAM_APP_ID: "focus"
+      PROJECT_METADATA: "cce_supervisors"
     depends_on:
       - "beam-proxy"
     labels:
@@ -29,4 +30,4 @@ services:
       - "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/backend`)"
       - "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/backend"
       - "traefik.http.routers.spot.tls=true"
-      - "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot,auth"
+      - "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot"

cce/modules/teiler-compose.yml

@@ -1,69 +0,0 @@
-version: "3.7"
-
-services:
-
-  teiler-orchestrator:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-orchestrator:latest
-    container_name: bridgehead-teiler-orchestrator
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.teiler_orchestrator_cce.rule=PathPrefix(`/cce-teiler`)"
-      - "traefik.http.services.teiler_orchestrator_cce.loadbalancer.server.port=9000"
-      - "traefik.http.routers.teiler_orchestrator_cce.tls=true"
-      - "traefik.http.middlewares.teiler_orchestrator_cce_strip.stripprefix.prefixes=/cce-teiler"
-      - "traefik.http.routers.teiler_orchestrator_cce.middlewares=teiler_orchestrator_cce_strip"
-    environment:
-      TEILER_BACKEND_URL: "/cce-teiler-backend"
-      TEILER_DASHBOARD_URL: "/cce-teiler-dashboard"
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE_LOWER_CASE}"
-      HTTP_RELATIVE_PATH: "/cce-teiler"
-
-  teiler-dashboard:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
-    container_name: bridgehead-teiler-dashboard
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.teiler_dashboard_cce.rule=PathPrefix(`/cce-teiler-dashboard`)"
-      - "traefik.http.services.teiler_dashboard_cce.loadbalancer.server.port=80"
-      - "traefik.http.routers.teiler_dashboard_cce.tls=true"
-      - "traefik.http.middlewares.teiler_dashboard_cce_strip.stripprefix.prefixes=/cce-teiler-dashboard"
-      - "traefik.http.routers.teiler_dashboard_cce.middlewares=teiler_dashboard_cce_strip"
-    environment:
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
-      TEILER_BACKEND_URL: "/cce-teiler-backend"
-      TEILER_DASHBOARD_URL: "/cce-teiler-dashboard"
-      OIDC_URL: "${OIDC_URL}"
-      OIDC_CLIENT_ID: "${OIDC_PUBLIC_CLIENT_ID}"
-      OIDC_TOKEN_GROUP: "${OIDC_GROUP_CLAIM}"
-      TEILER_ADMIN_NAME: "${OPERATOR_FIRST_NAME} ${OPERATOR_LAST_NAME}"
-      TEILER_ADMIN_EMAIL: "${OPERATOR_EMAIL}"
-      TEILER_ADMIN_PHONE: "${OPERATOR_PHONE}"
-      TEILER_PROJECT: "${PROJECT}"
-      EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
-      TEILER_ORCHESTRATOR_URL: "/cce-teiler"
-      TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/cce-teiler"
-      TEILER_USER: "${OIDC_USER_GROUP}"
-      TEILER_ADMIN: "${OIDC_ADMIN_GROUP}"
-      REPORTER_DEFAULT_TEMPLATE_ID: "cce-qb"
-      EXPORTER_DEFAULT_TEMPLATE_ID: "cce"
-
-
-  teiler-backend:
-    image: docker.verbis.dkfz.de/ccp/cce-teiler-backend:latest
-    container_name: bridgehead-teiler-backend
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.teiler_backend_cce.rule=PathPrefix(`/cce-teiler-backend`)"
-      - "traefik.http.services.teiler_backend_cce.loadbalancer.server.port=8085"
-      - "traefik.http.routers.teiler_backend_cce.tls=true"
-      - "traefik.http.middlewares.teiler_backend_cce_strip.stripprefix.prefixes=/cce-teiler-backend"
-      - "traefik.http.routers.teiler_backend_cce.middlewares=teiler_backend_cce_strip"
-    environment:
-      LOG_LEVEL: "INFO"
-      APPLICATION_PORT: "8085"
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
-      TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/cce-teiler"
-      TEILER_ORCHESTRATOR_URL: "/cce-teiler"
-      TEILER_DASHBOARD_DE_URL: "/cce-teiler-dashboard/de"
-      TEILER_DASHBOARD_EN_URL: "/cce-teiler-dashboard/en"
-      HTTP_PROXY: "http://forward_proxy:3128"

cce/modules/teiler-setup.sh

@@ -1,8 +0,0 @@
-#!/bin/bash -e
-
-if [ "$ENABLE_TEILER" == true ];then
-  log INFO "Teiler setup detected -- will start Teiler services."
-  OVERRIDE+=" -f ./$PROJECT/modules/teiler-compose.yml"
-  TEILER_DEFAULT_LANGUAGE=EN
-  TEILER_DEFAULT_LANGUAGE_LOWER_CASE=${TEILER_DEFAULT_LANGUAGE,,}
-fi

ccp/docker-compose.yml

@@ -35,7 +35,7 @@ services:
       QUERIES_TO_CACHE: '/queries_to_cache.conf'
       ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
     volumes:
-      - /srv/docker/bridgehead/ccp/queries_to_cache.conf:/queries_to_cache.conf:ro,Z
+      - /srv/docker/bridgehead/ccp/queries_to_cache.conf:/queries_to_cache.conf:ro
     depends_on:
       - "beam-proxy"
       - "blaze"
@@ -57,9 +57,11 @@ services:
       - "forward_proxy"
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
-      - /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro,Z
-      # secrets don't seem to allow us to specify Z
-      - /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
+      - /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro
 
 volumes:
   blaze-data:
+
+secrets:
+  proxy.pem:
+    file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

ccp/modules/datashield-compose.yml

@@ -1,6 +1,25 @@
 version: "3.7"
 
 services:
+  rstudio:
+    container_name: bridgehead-rstudio
+    image: docker.verbis.dkfz.de/ccp/dktk-rstudio:latest
+    environment:
+      #DEFAULT_USER: "rstudio" # This line is kept for informational purposes
+      PASSWORD: "${RSTUDIO_ADMIN_PASSWORD}" # It is required, even if the authentication is disabled
+      DISABLE_AUTH: "true" # https://rocker-project.org/images/versioned/rstudio.html#how-to-use
+      HTTP_RELATIVE_PATH: "/rstudio"
+      ALL_PROXY: "http://forward_proxy:3128" # https://rocker-project.org/use/networking.html
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.rstudio_ccp.rule=PathPrefix(`/rstudio`)"
+      - "traefik.http.services.rstudio_ccp.loadbalancer.server.port=8787"
+      - "traefik.http.middlewares.rstudio_ccp_strip.stripprefix.prefixes=/rstudio"
+      - "traefik.http.routers.rstudio_ccp.tls=true"
+      - "traefik.http.routers.rstudio_ccp.middlewares=oidcAuth,rstudio_ccp_strip"
+    networks:
+      - rstudio
+
   opal:
     container_name: bridgehead-opal
     image: docker.verbis.dkfz.de/ccp/dktk-opal:latest
@@ -26,6 +45,7 @@ services:
       OPAL_PRIVATE_KEY: "/run/secrets/opal-key.pem"
       OPAL_CERTIFICATE: "/run/secrets/opal-cert.pem"
       OIDC_URL: "${OIDC_URL}"
+      OIDC_REALM: "${OIDC_REALM}"
       OIDC_CLIENT_ID: "${OIDC_PRIVATE_CLIENT_ID}"
       OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
       OIDC_ADMIN_GROUP: "${OIDC_ADMIN_GROUP}"
@@ -35,10 +55,10 @@ services:
       BEAM_SECRET: ${TOKEN_MANAGER_SECRET}
       BEAM_DATASHIELD_PROXY: request-manager
     volumes:
-      - "/var/cache/bridgehead/ccp/opal-metadata-db:/srv:Z" # Opal metadata
-      # secrets don't seem to allow us to specify Z/z
-      - /tmp/bridgehead/opal-cert.pem:/run/secrets/opal-cert.pem:z
-      - /tmp/bridgehead/opal-key.pem:/run/secrets/opal-key.pem:Z
+      - "/var/cache/bridgehead/ccp/opal-metadata-db:/srv" # Opal metadata
+    secrets:
+      - opal-cert.pem
+      - opal-key.pem
 
   opal-db:
     container_name: bridgehead-opal-db
@@ -48,7 +68,7 @@ services:
       POSTGRES_USER: "opal"
       POSTGRES_DB: "opal"
     volumes:
-      - "/var/cache/bridgehead/ccp/opal-db:/var/lib/postgresql/data:Z" # Opal project data (imported from exporter)
+      - "/var/cache/bridgehead/ccp/opal-db:/var/lib/postgresql/data" # Opal project data (imported from exporter)
 
   opal-rserver:
     container_name: bridgehead-opal-rserver
@@ -67,14 +87,85 @@ services:
       DISCOVERY_URL: "./map/central.json"
       LOCAL_TARGETS_FILE: "./map/local.json"
       NO_AUTH: "true"
+    secrets:
+      - opal-cert.pem
     depends_on:
       - beam-proxy
     volumes:
-      - /tmp/bridgehead/opal-map/:/map/:ro,Z
-      # secrets don't seem to allow us to specify Z/z
-      - /tmp/bridgehead/opal-cert.pem:/run/secrets/opal-cert.pem:z
+      - /tmp/bridgehead/opal-map/:/map/:ro
+    networks:
+      - default
+      - rstudio
+
+  traefik:
+    labels:
+      - "traefik.http.middlewares.oidcAuth.forwardAuth.address=http://oauth2-proxy:4180/"
+      - "traefik.http.middlewares.oidcAuth.forwardAuth.trustForwardHeader=true"
+      - "traefik.http.middlewares.oidcAuth.forwardAuth.authResponseHeaders=X-Auth-Request-Access-Token,Authorization"
+    networks:
+      - default
+      - rstudio
+  forward_proxy:
+    networks:
+      - default
+      - rstudio
 
   beam-proxy:
     environment:
       APP_datashield-connect_KEY: ${DATASHIELD_CONNECT_SECRET}
       APP_token-manager_KEY: ${TOKEN_MANAGER_SECRET}
+
+  # TODO: Allow users of group /DataSHIELD and OIDC_USER_GROUP at the same time:
+  # Maybe a solution would be (https://oauth2-proxy.github.io/oauth2-proxy/configuration/oauth_provider):
+  # --allowed-groups=/DataSHIELD,OIDC_USER_GROUP
+  oauth2-proxy:
+    image: docker.verbis.dkfz.de/cache/oauth2-proxy/oauth2-proxy:latest
+    container_name: bridgehead-oauth2proxy
+    command: >-
+      --allowed-group=DataSHIELD
+      --oidc-groups-claim=${OIDC_GROUP_CLAIM}
+      --auth-logging=true
+      --whitelist-domain=${HOST}
+      --http-address="0.0.0.0:4180"
+      --reverse-proxy=true
+      --upstream="static://202"
+      --email-domain="*"
+      --cookie-name="_BRIDGEHEAD_oauth2"
+      --cookie-secret="${OAUTH2_PROXY_SECRET}"
+      --cookie-expire="12h"
+      --cookie-secure="true"
+      --cookie-httponly="true"
+      #OIDC settings
+      --provider="keycloak-oidc"
+      --provider-display-name="VerbIS Login"
+      --client-id="${OIDC_PRIVATE_CLIENT_ID}"
+      --client-secret="${OIDC_CLIENT_SECRET}"
+      --redirect-url="https://${HOST}${OAUTH2_CALLBACK}"
+      --oidc-issuer-url="${OIDC_ISSUER_URL}"
+      --scope="openid email profile"
+      --code-challenge-method="S256"
+      --skip-provider-button=true
+      #X-Forwarded-Header settings - true/false depending on your needs
+      --pass-basic-auth=true
+      --pass-user-headers=false
+      --pass-access-token=false
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.oauth2_proxy.rule=PathPrefix(`/oauth2`)"
+      - "traefik.http.services.oauth2_proxy.loadbalancer.server.port=4180"
+      - "traefik.http.routers.oauth2_proxy.tls=true"
+    environment:
+      http_proxy: "http://forward_proxy:3128"
+      https_proxy: "http://forward_proxy:3128"
+    depends_on:
+      forward_proxy:
+        condition: service_healthy
+
+secrets:
+  opal-cert.pem:
+    file: /tmp/bridgehead/opal-cert.pem
+  opal-key.pem:
+    file: /tmp/bridgehead/opal-key.pem
+
+networks:
+  rstudio:

ccp/modules/datashield-setup.sh

@@ -5,12 +5,17 @@ if [ "$ENABLE_DATASHIELD" == true ]; then
   if [ -z "${ENABLE_EXPORTER}" ] || [ "${ENABLE_EXPORTER}" != "true" ]; then
     log WARN "The ENABLE_EXPORTER variable is either not set or not set to 'true'."
   fi
+  OAUTH2_CALLBACK=/oauth2/callback
+  OAUTH2_PROXY_SECRET="$(echo \"This is a salt string to generate one consistent encryption key for the oauth2_proxy. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 32)"
+  add_private_oidc_redirect_url "${OAUTH2_CALLBACK}"
+
   log INFO "DataSHIELD setup detected -- will start DataSHIELD services."
   OVERRIDE+=" -f ./$PROJECT/modules/datashield-compose.yml"
   EXPORTER_OPAL_PASSWORD="$(generate_password \"exporter in Opal\")"
   TOKEN_MANAGER_OPAL_PASSWORD="$(generate_password \"Token Manager in Opal\")"
   OPAL_DB_PASSWORD="$(echo \"Opal DB\" | generate_simple_password)"
   OPAL_ADMIN_PASSWORD="$(generate_password \"admin password for Opal\")"
+  RSTUDIO_ADMIN_PASSWORD="$(generate_password \"admin password for R-Studio\")"
   DATASHIELD_CONNECT_SECRET="$(echo \"DataShield Connect\" | generate_simple_password)"
   TOKEN_MANAGER_SECRET="$(echo \"Token Manager\" | generate_simple_password)"
   if [ ! -e /tmp/bridgehead/opal-cert.pem ]; then
@@ -18,13 +23,18 @@ if [ "$ENABLE_DATASHIELD" == true ]; then
     openssl req -x509 -newkey rsa:4096 -nodes -keyout /tmp/bridgehead/opal-key.pem -out /tmp/bridgehead/opal-cert.pem -days 3650 -subj "/CN=opal/C=DE"
   fi
   mkdir -p /tmp/bridgehead/opal-map
-  echo '{"sites": []}' >/tmp/bridgehead/opal-map/central.json
-  # Only allow connections from the central beam proxy that is used by all coder workspaces
-  echo '[{
-    "external": "'$SITE_ID':443",
+  sites="$(cat ./$PROJECT/modules/datashield-sites.json)"
+  echo "$sites" | docker_jq -n --args '{"sites": input | map({
+    "name": .,
+    "id": .,
+    "virtualhost": "\(.):443",
+    "beamconnect": "datashield-connect.\(.).'"$BROKER_ID"'"
+  })}' $sites >/tmp/bridgehead/opal-map/central.json
+  echo "$sites" | docker_jq -n --args '[{
+    "external": "'"$SITE_ID"':443",
     "internal": "opal:8443",
-    "allowed": ["central-ds-orchestrator.'$BROKER_ID'"]
-  }]' > /tmp/bridgehead/opal-map/local.json
+    "allowed": input | map("\(.).'"$BROKER_ID"'")
+  }]' >/tmp/bridgehead/opal-map/local.json
   if [ "$USER" == "root" ]; then
     chown -R bridgehead:docker /tmp/bridgehead
     chmod g+wr /tmp/bridgehead/opal-map/*

ccp/modules/datashield-sites.json

@@ -0,0 +1,15 @@
+[
+    "berlin",
+    "muenchen-lmu",
+    "dresden",
+    "freiburg",
+    "muenchen-tum",
+    "tuebingen",
+    "mainz",
+    "frankfurt",
+    "essen",
+    "dktk-datashield-test",
+    "dktk-test",
+    "mannheim",
+    "central-ds-orchestrator"
+]

ccp/modules/dnpm-compose.yml

@@ -25,7 +25,7 @@ services:
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
       - /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
-      - /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro,Z
+      - /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)"

ccp/modules/dnpm-node-compose.yml

@@ -12,13 +12,13 @@ services:
       MYSQL_ROOT_HOST: "%"
       MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD}
     volumes:
-      - /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql:Z
+      - /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql
 
   dnpm-authup:
     image: authup/authup:latest
     container_name: bridgehead-dnpm-authup
     volumes:
-      - /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable:Z
+      - /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable
     depends_on:
       dnpm-mysql:
         condition: service_healthy
@@ -68,7 +68,7 @@ services:
       - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
     volumes:
       - /etc/bridgehead/dnpm/config:/dnpm_config
-      - /var/cache/bridgehead/dnpm/backend-data:/dnpm_data:Z
+      - /var/cache/bridgehead/dnpm/backend-data:/dnpm_data
     depends_on:
       dnpm-authup:
         condition: service_healthy

ccp/modules/exporter-auth-compose.yml

@@ -0,0 +1,30 @@
+version: "3.7"
+
+services:
+  exporter:
+    labels:
+      # Main router
+      - "traefik.http.routers.exporter_${PLATFORM}.priority=20"
+
+      # API router
+      - "traefik.http.routers.exporter_${PLATFORM}_api.middlewares=exporter_${PLATFORM}_strip,exporter_auth"
+      - "traefik.http.routers.exporter_${PLATFORM}_api.rule=PathRegexp(`/${PLATFORM}-exporter/.+`)"
+      - "traefik.http.routers.exporter_${PLATFORM}_api.tls=true"
+      - "traefik.http.routers.exporter_${PLATFORM}_api.priority=25"
+
+      # Shared middlewares
+      - "traefik.http.middlewares.exporter_auth.basicauth.users=${EXPORTER_USER}"
+
+  reporter:
+    labels:
+      - "traefik.http.routers.reporter_${PLATFORM}.priority=20"
+
+      #- "traefik.http.routers.reporter_${PLATFORM}.middlewares=reporter_${PLATFORM}_strip,exporter_auth"
+      - "traefik.http.routers.reporter_${PLATFORM}_api.middlewares=reporter_${PLATFORM}_strip,exporter_auth"
+      - "traefik.http.routers.reporter_${PLATFORM}_api.rule=PathRegexp(`/${PLATFORM}-reporter/.+`)"
+      - "traefik.http.routers.reporter_${PLATFORM}_api.tls=true"
+      - "traefik.http.routers.reporter_${PLATFORM}_api.priority=25"
+      #- "traefik.http.middlewares.reporter_auth.basicauth.users=${EXPORTER_USER}"
+
+
+

ccp/modules/exporter-compose.yml

@@ -3,7 +3,7 @@ version: "3.7"
 services:
   exporter:
     image: docker.verbis.dkfz.de/ccp/dktk-exporter:latest
-    container_name: bridgehead-ccp-exporter
+    container_name: bridgehead-${PLATFORM}-exporter
     environment:
       JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
       LOG_LEVEL: "INFO"
@@ -12,39 +12,39 @@ services:
       EXPORTER_DB_USER: "exporter"
       EXPORTER_DB_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
       EXPORTER_DB_URL: "jdbc:postgresql://exporter-db:5432/exporter"
-      HTTP_RELATIVE_PATH: "/ccp-exporter"
+      HTTP_RELATIVE_PATH: "/${PLATFORM}-exporter"
       SITE: "${SITE_ID}"
       HTTP_SERVLET_REQUEST_SCHEME: "https"
       OPAL_PASSWORD: "${EXPORTER_OPAL_PASSWORD}"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.exporter_ccp.rule=PathPrefix(`/ccp-exporter`)"
-      - "traefik.http.services.exporter_ccp.loadbalancer.server.port=8092"
-      - "traefik.http.routers.exporter_ccp.tls=true"
-      - "traefik.http.middlewares.exporter_ccp_strip.stripprefix.prefixes=/ccp-exporter"
-      - "traefik.http.routers.exporter_ccp.middlewares=exporter_ccp_strip"
+      - "traefik.http.routers.exporter_${PLATFORM}.rule=Path(`/${PLATFORM}-exporter/`)"
+      - "traefik.http.services.exporter_${PLATFORM}.loadbalancer.server.port=8092"
+      - "traefik.http.routers.exporter_${PLATFORM}.tls=true"
+      - "traefik.http.middlewares.exporter_${PLATFORM}_strip.stripprefix.prefixes=/${PLATFORM}-exporter"
+      - "traefik.http.routers.exporter_${PLATFORM}.middlewares=exporter_${PLATFORM}_strip"
     volumes:
-      - "/var/cache/bridgehead/ccp/exporter-files:/app/exporter-files/output:z"
+      - "/var/cache/bridgehead/${PLATFORM}/exporter-files:/app/exporter-files/output"
 
   exporter-db:
     image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
-    container_name: bridgehead-ccp-exporter-db
+    container_name: bridgehead-${PLATFORM}-exporter-db
     environment:
       POSTGRES_USER: "exporter"
       POSTGRES_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
       POSTGRES_DB: "exporter"
     volumes:
       # Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer.
-      - "/var/cache/bridgehead/ccp/exporter-db:/var/lib/postgresql/data:Z"
+      - "/var/cache/bridgehead/${PLATFORM}/exporter-db:/var/lib/postgresql/data"
 
   reporter:
     image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest
-    container_name: bridgehead-ccp-reporter
+    container_name: bridgehead-${PLATFORM}-reporter
     environment:
       JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
       LOG_LEVEL: "INFO"
       CROSS_ORIGINS: "https://${HOST}"
-      HTTP_RELATIVE_PATH: "/ccp-reporter"
+      HTTP_RELATIVE_PATH: "/${PLATFORM}-reporter"
       SITE: "${SITE_ID}"
       EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh
       EXPORTER_URL: "http://exporter:8092"
@@ -57,16 +57,17 @@ services:
     # There is a risk that the bridgehead restarts, losing the already created export.
 
     volumes:
-      - "/var/cache/bridgehead/ccp/reporter-files:/app/reports:z"
+      - "/var/cache/bridgehead/${PLATFORM}/reporter-files:/app/reports"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.reporter_ccp.rule=PathPrefix(`/ccp-reporter`)"
-      - "traefik.http.services.reporter_ccp.loadbalancer.server.port=8095"
-      - "traefik.http.routers.reporter_ccp.tls=true"
-      - "traefik.http.middlewares.reporter_ccp_strip.stripprefix.prefixes=/ccp-reporter"
-      - "traefik.http.routers.reporter_ccp.middlewares=reporter_ccp_strip"
+      - "traefik.http.routers.reporter_${PLATFORM}.rule=Path(`/${PLATFORM}-reporter`)"
+      - "traefik.http.services.reporter_${PLATFORM}.loadbalancer.server.port=8095"
+      - "traefik.http.routers.reporter_${PLATFORM}.tls=true"
+      - "traefik.http.middlewares.reporter_${PLATFORM}_strip.stripprefix.prefixes=/${PLATFORM}-reporter"
+      - "traefik.http.routers.reporter_${PLATFORM}.middlewares=reporter_${PLATFORM}_strip"
 
-  focus:
-    environment:
-      EXPORTER_URL: "http://exporter:8092"
-      EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
+
+#  focus:
+#    environment:
+#      EXPORTER_URL: "http://exporter:8092"
+#      EXPORTER_API_KEY: "${EXPORTER_API_KEY}"

ccp/modules/exporter-setup.sh

@@ -2,7 +2,10 @@
 
 if [ "$ENABLE_EXPORTER" == true ]; then
   log INFO "Exporter setup detected -- will start Exporter service."
-  OVERRIDE+=" -f ./$PROJECT/modules/exporter-compose.yml"
+  OVERRIDE+=" -f ./ccp/modules/exporter-compose.yml"
   EXPORTER_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
   EXPORTER_API_KEY="$(echo \"This is a salt string to generate one consistent API KEY for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 64)"
+  if [ "$EXPORTER_USER" == true ]; then
+    OVERRIDE+=" -f ./ccp/modules/exporter-auth-compose.yml"
+  fi
 fi

ccp/modules/fhir2sql-compose.yml

@@ -22,7 +22,7 @@ services:
       POSTGRES_PASSWORD: "${DASHBOARD_DB_PASSWORD}" # Set in dashboard-setup.sh
       POSTGRES_DB: "dashboard"
     volumes:
-      - "/var/cache/bridgehead/ccp/dashboard-db:/var/lib/postgresql/data:Z"
+      - "/var/cache/bridgehead/ccp/dashboard-db:/var/lib/postgresql/data"
 
   focus:
     environment:

ccp/modules/id-management-compose.yml

@@ -62,7 +62,7 @@ services:
     volumes:
       - "patientlist-db-data:/var/lib/postgresql/data"
       # NOTE: Add backups here. This is only imported if /var/lib/bridgehead/data/patientlist/ is empty!!!
-      - "/tmp/bridgehead/patientlist/:/docker-entrypoint-initdb.d/:Z"
+      - "/tmp/bridgehead/patientlist/:/docker-entrypoint-initdb.d/"
 
   traefik-forward-auth:
     image: docker.verbis.dkfz.de/cache/oauth2-proxy/oauth2-proxy:latest

ccp/modules/mtba-compose.yml

@@ -23,6 +23,7 @@ services:
       OIDC_ADMIN_GROUP: "${OIDC_ADMIN_GROUP}"
       OIDC_CLIENT_ID: "${OIDC_PRIVATE_CLIENT_ID}"
       OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
+      OIDC_REALM: "${OIDC_REALM}"
       OIDC_URL: "${OIDC_URL}"
 
     labels:
@@ -32,8 +33,8 @@ services:
       - "traefik.http.routers.mtba_ccp.tls=true"
 
     volumes:
-      - /var/cache/bridgehead/ccp/mtba/input:/app/input:z
-      - /var/cache/bridgehead/ccp/mtba/persist:/app/persist:z
+      - /var/cache/bridgehead/ccp/mtba/input:/app/input
+      - /var/cache/bridgehead/ccp/mtba/persist:/app/persist
 
   # TODO: Include CBioPortal in Deployment ...
   # NOTE: CBioPortal can't load data while the system is running. So after import of data bridgehead needs to be restarted!

ccp/modules/teiler-compose.yml

@@ -7,32 +7,33 @@ services:
     container_name: bridgehead-teiler-orchestrator
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.teiler_orchestrator_ccp.rule=PathPrefix(`/ccp-teiler`)"
-      - "traefik.http.services.teiler_orchestrator_ccp.loadbalancer.server.port=9000"
-      - "traefik.http.routers.teiler_orchestrator_ccp.tls=true"
-      - "traefik.http.middlewares.teiler_orchestrator_ccp_strip.stripprefix.prefixes=/ccp-teiler"
-      - "traefik.http.routers.teiler_orchestrator_ccp.middlewares=teiler_orchestrator_ccp_strip"
+      - "traefik.http.routers.teiler_orchestrator_${PLATFORM}.rule=PathPrefix(`/${PLATFORM}-teiler`)"
+      - "traefik.http.services.teiler_orchestrator_${PLATFORM}.loadbalancer.server.port=9000"
+      - "traefik.http.routers.teiler_orchestrator_${PLATFORM}.tls=true"
+      - "traefik.http.middlewares.teiler_orchestrator_${PLATFORM}_strip.stripprefix.prefixes=/${PLATFORM}-teiler"
+      - "traefik.http.routers.teiler_orchestrator_${PLATFORM}.middlewares=teiler_orchestrator_${PLATFORM}_strip"
     environment:
-      TEILER_BACKEND_URL: "/ccp-teiler-backend"
-      TEILER_DASHBOARD_URL: "/ccp-teiler-dashboard"
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE_LOWER_CASE}"
-      HTTP_RELATIVE_PATH: "/ccp-teiler"
+      TEILER_BACKEND_URL: "https://${HOST}/${PLATFORM}-teiler-backend"
+      TEILER_DASHBOARD_URL: "https://${HOST}/${PLATFORM}-teiler-dashboard"
+      DEFAULT_LANGUAGE: "${DEFAULT_LANGUAGE_LOWER_CASE}"
+      HTTP_RELATIVE_PATH: "/${PLATFORM}-teiler"
 
   teiler-dashboard:
     image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
     container_name: bridgehead-teiler-dashboard
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.teiler_dashboard_ccp.rule=PathPrefix(`/ccp-teiler-dashboard`)"
-      - "traefik.http.services.teiler_dashboard_ccp.loadbalancer.server.port=80"
-      - "traefik.http.routers.teiler_dashboard_ccp.tls=true"
-      - "traefik.http.middlewares.teiler_dashboard_ccp_strip.stripprefix.prefixes=/ccp-teiler-dashboard"
-      - "traefik.http.routers.teiler_dashboard_ccp.middlewares=teiler_dashboard_ccp_strip"
+      - "traefik.http.routers.teiler_dashboard_${PLATFORM}.rule=PathPrefix(`/${PLATFORM}-teiler-dashboard`)"
+      - "traefik.http.services.teiler_dashboard_${PLATFORM}.loadbalancer.server.port=80"
+      - "traefik.http.routers.teiler_dashboard_${PLATFORM}.tls=true"
+      - "traefik.http.middlewares.teiler_dashboard_${PLATFORM}_strip.stripprefix.prefixes=/${PLATFORM}-teiler-dashboard"
+      - "traefik.http.routers.teiler_dashboard_${PLATFORM}.middlewares=teiler_dashboard_${PLATFORM}_strip"
     environment:
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
-      TEILER_BACKEND_URL: "/ccp-teiler-backend"
-      TEILER_DASHBOARD_URL: "/ccp-teiler-dashboard"
+      DEFAULT_LANGUAGE: "${DEFAULT_LANGUAGE}"
+      TEILER_BACKEND_URL: "https://${HOST}/${PLATFORM}-teiler-backend"
+      TEILER_DASHBOARD_URL: "https://${HOST}/${PLATFORM}-teiler-dashboard"
       OIDC_URL: "${OIDC_URL}"
+      OIDC_REALM: "${OIDC_REALM}"
       OIDC_CLIENT_ID: "${OIDC_PUBLIC_CLIENT_ID}"
       OIDC_TOKEN_GROUP: "${OIDC_GROUP_CLAIM}"
       TEILER_ADMIN_NAME: "${OPERATOR_FIRST_NAME} ${OPERATOR_LAST_NAME}"
@@ -40,32 +41,33 @@ services:
       TEILER_ADMIN_PHONE: "${OPERATOR_PHONE}"
       TEILER_PROJECT: "${PROJECT}"
       EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
-      TEILER_ORCHESTRATOR_URL: "/ccp-teiler"
-      TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/ccp-teiler"
+      TEILER_ORCHESTRATOR_URL: "https://${HOST}/${PLATFORM}-teiler"
+      TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/${PLATFORM}-teiler"
       TEILER_USER: "${OIDC_USER_GROUP}"
       TEILER_ADMIN: "${OIDC_ADMIN_GROUP}"
-      REPORTER_DEFAULT_TEMPLATE_ID: "ccp-qb"
-      EXPORTER_DEFAULT_TEMPLATE_ID: "ccp"
+      REPORTER_DEFAULT_TEMPLATE_ID: "${PLATFORM}-qb"
+      EXPORTER_DEFAULT_TEMPLATE_ID: "${PLATFORM}"
 
 
   teiler-backend:
-    image: docker.verbis.dkfz.de/ccp/dktk-teiler-backend:latest
+    image: docker.verbis.dkfz.de/ccp/${PROJECT}-teiler-backend:latest
     container_name: bridgehead-teiler-backend
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.teiler_backend_ccp.rule=PathPrefix(`/ccp-teiler-backend`)"
-      - "traefik.http.services.teiler_backend_ccp.loadbalancer.server.port=8085"
-      - "traefik.http.routers.teiler_backend_ccp.tls=true"
-      - "traefik.http.middlewares.teiler_backend_ccp_strip.stripprefix.prefixes=/ccp-teiler-backend"
-      - "traefik.http.routers.teiler_backend_ccp.middlewares=teiler_backend_ccp_strip"
+      - "traefik.http.routers.teiler_backend_${PLATFORM}.rule=PathPrefix(`/${PLATFORM}-teiler-backend`)"
+      - "traefik.http.services.teiler_backend_${PLATFORM}.loadbalancer.server.port=8085"
+      - "traefik.http.routers.teiler_backend_${PLATFORM}.tls=true"
+      - "traefik.http.middlewares.teiler_backend_${PLATFORM}_strip.stripprefix.prefixes=/${PLATFORM}-teiler-backend"
+      - "traefik.http.routers.teiler_backend_${PLATFORM}.middlewares=teiler_backend_${PLATFORM}_strip"
     environment:
       LOG_LEVEL: "INFO"
       APPLICATION_PORT: "8085"
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
-      TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/ccp-teiler"
-      TEILER_ORCHESTRATOR_URL: "/ccp-teiler"
-      TEILER_DASHBOARD_DE_URL: "/ccp-teiler-dashboard/de"
-      TEILER_DASHBOARD_EN_URL: "/ccp-teiler-dashboard/en"
+      APPLICATION_ADDRESS: "${HOST}"
+      DEFAULT_LANGUAGE: "${DEFAULT_LANGUAGE}"
+      TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/${PLATFORM}-teiler"
+      TEILER_ORCHESTRATOR_URL: "https://${HOST}/${PLATFORM}-teiler"
+      TEILER_DASHBOARD_DE_URL: "https://${HOST}/${PLATFORM}-teiler-dashboard/de"
+      TEILER_DASHBOARD_EN_URL: "https://${HOST}/${PLATFORM}-teiler-dashboard/en"
       HTTP_PROXY: "http://forward_proxy:3128"
       ENABLE_MTBA: "${ENABLE_MTBA}"
       ENABLE_DATASHIELD: "${ENABLE_DATASHIELD}"

ccp/modules/teiler-setup.sh

@@ -2,8 +2,6 @@
 
 if [ "$ENABLE_TEILER" == true ];then
   log INFO "Teiler setup detected -- will start Teiler services."
-  OVERRIDE+=" -f ./$PROJECT/modules/teiler-compose.yml"
-  TEILER_DEFAULT_LANGUAGE=DE
-  TEILER_DEFAULT_LANGUAGE_LOWER_CASE=${TEILER_DEFAULT_LANGUAGE,,}
+  OVERRIDE+=" -f ./ccp/modules/teiler-compose.yml"
   add_public_oidc_redirect_url "/ccp-teiler/*"
 fi

ccp/vars

@@ -1,3 +1,6 @@
+DEFAULT_LANGUAGE=EN
+DEFAULT_LANGUAGE_LOWER_CASE=${DEFAULT_LANGUAGE,,}
+
 BROKER_ID=broker.ccp-it.dktk.dkfz.de
 BROKER_URL=https://${BROKER_ID}
 PROXY_ID=${SITE_ID}.${BROKER_ID}
@@ -5,6 +8,7 @@ FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | h
 FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
 SUPPORT_EMAIL=support-ccp@dkfz-heidelberg.de
 PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
+PLATFORM=ccp
 
 BROKER_URL_FOR_PREREQ=$BROKER_URL
 
@@ -12,9 +16,14 @@ OIDC_USER_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})"
 OIDC_ADMIN_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})_Verwalter"
 OIDC_PRIVATE_CLIENT_ID=${SITE_ID}-private
 OIDC_PUBLIC_CLIENT_ID=${SITE_ID}-public
-OIDC_URL="https://login.verbis.dkfz.de/realms/test-realm-01"
+# Use "test-realm-01" for testing
+OIDC_REALM="${OIDC_REALM:-master}"
+OIDC_URL="https://login.verbis.dkfz.de"
+OIDC_ISSUER_URL="${OIDC_URL}/realms/${OIDC_REALM}"
 OIDC_GROUP_CLAIM="groups"
 
+POSTGRES_TAG=15.6-alpine
+
 for module in $PROJECT/modules/*.sh
 do
     log DEBUG "sourcing $module"
@@ -26,6 +35,7 @@ mtbaSetup
 obds2fhirRestSetup
 blazeSecondarySetup
 
+
 for module in modules/*.sh
 do
     log DEBUG "sourcing $module"

dhki/docker-compose.yml

@@ -33,7 +33,7 @@ services:
       EPSILON: 0.28
       QUERIES_TO_CACHE: '/queries_to_cache.conf'
     volumes:
-      - /srv/docker/bridgehead/dhki/queries_to_cache.conf:/queries_to_cache.conf:ro,Z
+      - /srv/docker/bridgehead/dhki/queries_to_cache.conf:/queries_to_cache.conf:ro
     depends_on:
       - "beam-proxy"
       - "blaze"
@@ -55,10 +55,12 @@ services:
       - "forward_proxy"
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
-      - /srv/docker/bridgehead/dhki/root.crt.pem:/conf/root.crt.pem:ro,Z
-      # secrets don't seem to allow us to specify Z
-      - /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
+      - /srv/docker/bridgehead/dhki/root.crt.pem:/conf/root.crt.pem:ro
 
 
 volumes:
   blaze-data:
+
+secrets:
+  proxy.pem:
+    file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

dhki/vars

@@ -8,6 +8,8 @@ PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
 
 BROKER_URL_FOR_PREREQ=$BROKER_URL
 
+POSTGRES_TAG=15.6-alpine
+
 for module in ccp/modules/*.sh
 do
     log DEBUG "sourcing $module"

itcc/docker-compose.yml

@@ -35,7 +35,7 @@ services:
       QUERIES_TO_CACHE: '/queries_to_cache.conf'
       ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
     volumes:
-      - /srv/docker/bridgehead/itcc/queries_to_cache.conf:/queries_to_cache.conf:ro,Z
+      - /srv/docker/bridgehead/itcc/queries_to_cache.conf:/queries_to_cache.conf:ro
     depends_on:
       - "beam-proxy"
       - "blaze"
@@ -51,14 +51,18 @@ services:
       ALL_PROXY: http://forward_proxy:3128
       TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
       ROOTCERT_FILE: /conf/root.crt.pem
+    secrets:
+      - proxy.pem
     depends_on:
       - "forward_proxy"
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
-      - /srv/docker/bridgehead/itcc/root.crt.pem:/conf/root.crt.pem:ro,Z
-      # secrets don't seem to allow us to specify Z
-      - /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
+      - /srv/docker/bridgehead/itcc/root.crt.pem:/conf/root.crt.pem:ro
 
 
 volumes:
   blaze-data:
+
+secrets:
+  proxy.pem:
+    file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

itcc/modules/lens-compose.yml

@@ -17,6 +17,7 @@ services:
       BEAM_PROXY_ID: ${SITE_ID}
       BEAM_BROKER_ID: ${BROKER_ID}
       BEAM_APP_ID: "focus"
+      PROJECT_METADATA: "dktk_supervisors"
     depends_on:
       - "beam-proxy"
     labels:
@@ -29,4 +30,4 @@ services:
       - "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/backend`)"
       - "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/backend"
       - "traefik.http.routers.spot.tls=true"
-      - "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot,auth"
+      - "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot"

kr/docker-compose.yml

@@ -56,10 +56,12 @@ services:
       - "forward_proxy"
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
-      - /srv/docker/bridgehead/kr/root.crt.pem:/conf/root.crt.pem:ro,Z
-      # secrets don't seem to allow us to specify Z
-      - /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
+      - /srv/docker/bridgehead/kr/root.crt.pem:/conf/root.crt.pem:ro
 
 
 volumes:
   blaze-data:
+
+secrets:
+  proxy.pem:
+    file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

kr/modules/exporter-compose.yml

@@ -24,7 +24,7 @@ services:
       - "traefik.http.middlewares.exporter_ccp_strip.stripprefix.prefixes=/ccp-exporter"
       - "traefik.http.routers.exporter_ccp.middlewares=exporter_ccp_strip"
     volumes:
-      - "/var/cache/bridgehead/ccp/exporter-files:/app/exporter-files/output:z"
+      - "/var/cache/bridgehead/ccp/exporter-files:/app/exporter-files/output"
 
   exporter-db:
     image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
@@ -35,7 +35,7 @@ services:
       POSTGRES_DB: "exporter"
     volumes:
       # Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer.
-      - "/var/cache/bridgehead/ccp/exporter-db:/var/lib/postgresql/data:Z"
+      - "/var/cache/bridgehead/ccp/exporter-db:/var/lib/postgresql/data"
 
   reporter:
     image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest
@@ -57,7 +57,7 @@ services:
     # There is a risk that the bridgehead restarts, losing the already created export.
 
     volumes:
-      - "/var/cache/bridgehead/ccp/reporter-files:/app/reports:z"
+      - "/var/cache/bridgehead/ccp/reporter-files:/app/reports"
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.reporter_ccp.rule=PathPrefix(`/ccp-reporter`)"

kr/modules/teiler-compose.yml

@@ -15,7 +15,7 @@ services:
     environment:
       TEILER_BACKEND_URL: "https://${HOST}/ccp-teiler-backend"
       TEILER_DASHBOARD_URL: "https://${HOST}/ccp-teiler-dashboard"
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE_LOWER_CASE}"
+      DEFAULT_LANGUAGE: "${DEFAULT_LANGUAGE_LOWER_CASE}"
       HTTP_RELATIVE_PATH: "/ccp-teiler"
 
   teiler-dashboard:
@@ -29,10 +29,11 @@ services:
       - "traefik.http.middlewares.teiler_dashboard_ccp_strip.stripprefix.prefixes=/ccp-teiler-dashboard"
       - "traefik.http.routers.teiler_dashboard_ccp.middlewares=teiler_dashboard_ccp_strip"
     environment:
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
+      DEFAULT_LANGUAGE: "${DEFAULT_LANGUAGE}"
       TEILER_BACKEND_URL: "https://${HOST}/ccp-teiler-backend"
       TEILER_DASHBOARD_URL: "https://${HOST}/ccp-teiler-dashboard"
       OIDC_URL: "${OIDC_URL}"
+      OIDC_REALM: "${OIDC_REALM}"
       OIDC_CLIENT_ID: "${OIDC_PUBLIC_CLIENT_ID}"
       OIDC_TOKEN_GROUP: "${OIDC_GROUP_CLAIM}"
       TEILER_ADMIN_NAME: "${OPERATOR_FIRST_NAME} ${OPERATOR_LAST_NAME}"
@@ -62,7 +63,7 @@ services:
       LOG_LEVEL: "INFO"
       APPLICATION_PORT: "8085"
       APPLICATION_ADDRESS: "${HOST}"
-      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
+      DEFAULT_LANGUAGE: "${DEFAULT_LANGUAGE}"
       CONFIG_ENV_VAR_PATH: "/run/secrets/ccp.conf"
       TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/ccp-teiler"
       TEILER_ORCHESTRATOR_URL: "https://${HOST}/ccp-teiler"
@@ -71,6 +72,9 @@ services:
       HTTP_PROXY: "http://forward_proxy:3128"
       ENABLE_MTBA: "${ENABLE_MTBA}"
       ENABLE_DATASHIELD: "${ENABLE_DATASHIELD}"
-    volumes:
-      # secrets don't seem to allow us to specify Z
-      - /etc/bridgehead/ccp.conf:/run/secrets/ccp.conf:ro
+    secrets:
+      - ccp.conf
+
+secrets:
+  ccp.conf:
+    file: /etc/bridgehead/ccp.conf

kr/modules/teiler-setup.sh

@@ -3,7 +3,5 @@
 if [ "$ENABLE_TEILER" == true ];then
   log INFO "Teiler setup detected -- will start Teiler services."
   OVERRIDE+=" -f ./$PROJECT/modules/teiler-compose.yml"
-  TEILER_DEFAULT_LANGUAGE=DE
-  TEILER_DEFAULT_LANGUAGE_LOWER_CASE=${TEILER_DEFAULT_LANGUAGE,,}
   add_public_oidc_redirect_url "/ccp-teiler/*"
 fi

lib/functions.sh

@@ -36,32 +36,6 @@ setupProxy() {
 	export HTTPS_PROXY_HOST HTTPS_PROXY_PORT HTTPS_PROXY_FULL_URL
 }
 
-checkAndSetSelinux() {
-	# This is needed for the systemd service to start on SELinux systems.
-	if ! command -v sestatus > /dev/null 2>&1; then
-	 	echo "SELinux not available; nothing to do"
-	 	return
-	fi
-	if ! sestatus | grep "SELinux status:" | grep enabled > /dev/null; then
-		echo "SELinux disabled; nothing to do"
-		return
-	fi
-	current_mode="$(sestatus | grep 'Current mode:' | tr -s ' ' | cut -d' ' -f 3)"
-	echo "SELinux is active and ${current_mode}, checking for labels..."
-	# TODO: perhaps split this into checkSelinux (without the need for root) and setSelinux (needing root)
-	# "stat /srv/docker/bridgehead/bridgehead --printf %C" could be used for a check that doesn't need root
-	exitIfNotRoot
-	labels_for_srv="$(semanage fcontext --list | grep -e ^/srv)"
-	echo "Found the following labels for /srv:"
-	echo "${labels_for_srv}"
-	if ! echo "${labels_for_srv}" | grep -e ^/srv/docker/bridgehead/bridgehead > /dev/null; then
-		echo "Adding a label for /srv/docker/bridgehead/bridgehead..."
-		semanage fcontext --add --type bin_t /srv/docker/bridgehead/bridgehead
-	fi
-	restorecon -v /srv/docker/bridgehead/bridgehead  # this survives a reboot
-	# TODO: check if this survives updates
-}
-
 exitIfNotRoot() {
   if [ "$EUID" -ne 0 ]; then
     log "ERROR" "Please run as root"
@@ -462,3 +436,7 @@ generate_simple_password(){
   local combined_text="This is a salt string to generate one consistent password for ${seed_text}. It is not required to be secret."
   echo "${combined_text}" | sha1sum | openssl pkeyutl -sign -inkey "/etc/bridgehead/pki/${SITE_ID}.priv.pem" 2> /dev/null | base64 | head -c 26 | sed 's/[+\/]/A/g'
 }
+
+docker_jq() {
+    docker run --rm -i docker.verbis.dkfz.de/cache/jqlang/jq:latest "$@"
+}

lib/install-bridgehead.sh

@@ -3,7 +3,6 @@
 source lib/functions.sh
 
 exitIfNotRoot
-checkAndSetSelinux
 
 if [ $# -eq 0 ]; then
     log "ERROR" "Please provide a Project as argument"
@@ -50,12 +49,6 @@ if [ -z "$TRANSFAIR_AUTH" ]; then
   fi
 fi
 
-if [ "$ENABLE_EXPORTER" == "true" ] && [ -z "$EXPORTER_USER" ]; then
-  log "INFO" "Now generating basic auth for the exporter and reporter (see adduser in bridgehead for more information)."
-  generated_passwd="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 32)"
-  add_basic_auth_user $PROJECT $generated_passwd "EXPORTER_USER" $PROJECT
-fi
-
 log "INFO" "Registering system units for bridgehead and bridgehead-update"
 cp -v \
     lib/systemd/bridgehead\@.service \

lib/prerequisites.sh

@@ -70,6 +70,7 @@ source "${CONFIG_DIR}${PROJECT}".conf
 source ${PROJECT}/vars
 
 if [ "${PROJECT}" != "minimal" ]; then
+#if false; then # TODO: Adapt it for BBMRI
   set +e
   SERVERTIME="$(https_proxy=$HTTPS_PROXY_FULL_URL curl -m 5 -s -I $BROKER_URL_FOR_PREREQ 2>&1 | grep -i -e '^Date: ' | sed -e 's/^Date: //i')"
   RET=$?

minimal/docker-compose.yml

@@ -10,7 +10,7 @@ services:
       - --providers.docker=true
       - --providers.docker.exposedbydefault=false
       - --providers.file.directory=/configuration/
-      - --api.dashboard=false
+      - --api.dashboard=true # TODO: Adapt it for CCP
       - --accesslog=true
       - --entrypoints.web.http.redirections.entrypoint.to=websecure
       - --entrypoints.web.http.redirections.entrypoint.scheme=https
@@ -25,12 +25,6 @@ services:
     ports:
       - 80:80
       - 443:443
-    security_opt:
-      # allow access to the docker socket on systems with SELinux
-      - "label:type:container_runtime_t"
-    cap_add:
-      # Allow binding to ports <1024 without root
-      - NET_BIND_SERVICE
     volumes:
       - /etc/bridgehead/traefik-tls:/certs:ro
       - ../lib/traefik-configuration/:/configuration:ro

minimal/modules/dnpm-compose.yml

@@ -12,13 +12,13 @@ services:
       ALL_PROXY: http://forward_proxy:3128
       TLS_CA_CERTIFICATES_DIR: ./conf/trusted-ca-certs
       ROOTCERT_FILE: ./conf/root.crt.pem
+    secrets:
+      - proxy.pem
     depends_on:
       - "forward_proxy"
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
-      - /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro,Z
-      # secrets don't seem to allow us to specify Z
-      - /etc/bridgehead/pki/${SITE_ID}.priv.pem:/run/secrets/proxy.pem:ro
+      - /srv/docker/bridgehead/ccp/root.crt.pem:/conf/root.crt.pem:ro
 
   dnpm-beam-connect:
     depends_on: [ dnpm-beam-proxy ]
@@ -41,7 +41,7 @@ services:
     volumes:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
       - /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
-      - /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro,Z
+      - /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)"
@@ -53,3 +53,7 @@ services:
   dnpm-echo:
     image: docker.verbis.dkfz.de/cache/samply/bridgehead-echo:latest
     container_name: bridgehead-dnpm-echo
+
+secrets:
+  proxy.pem:
+    file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

minimal/modules/dnpm-node-compose.yml

@@ -12,13 +12,13 @@ services:
       MYSQL_ROOT_HOST: "%"
       MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD}
     volumes:
-      - /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql:Z
+      - /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql
 
   dnpm-authup:
     image: authup/authup:latest
     container_name: bridgehead-dnpm-authup
     volumes:
-      - /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable:Z
+      - /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable
     depends_on:
       dnpm-mysql:
         condition: service_healthy
@@ -68,7 +68,7 @@ services:
       - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
     volumes:
       - /etc/bridgehead/dnpm/config:/dnpm_config
-      - /var/cache/bridgehead/dnpm/backend-data:/dnpm_data:Z
+      - /var/cache/bridgehead/dnpm/backend-data:/dnpm_data
     depends_on:
       dnpm-authup:
         condition: service_healthy

modules/ssh-tunnel-compose.yml

@@ -10,4 +10,8 @@ services:
       SSH_TUNNEL_PORT: "${SSH_TUNNEL_PORT:-22}"
     volumes:
       - "/etc/bridgehead/ssh-tunnel.conf:/ssh-tunnel.conf:ro"
-      - "/etc/bridgehead/pki/ssh-tunnel.priv.pem:/run/secrets/privkey:ro"
+    secrets:
+      - privkey
+secrets:
+  privkey:
+    file: /etc/bridgehead/pki/ssh-tunnel.priv.pem

modules/transfair-compose.yml

@@ -27,7 +27,7 @@ services:
       - NO_PROXY=${TRANSFAIR_NO_PROXIES}
       - ALL_PROXY=http://forward_proxy:3128
     volumes:
-      - /var/cache/bridgehead/${PROJECT}/transfair:/transfair:Z
+      - /var/cache/bridgehead/${PROJECT}/transfair:/transfair
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
     labels:
       - "traefik.enable=true"

versions/acceptance

@@ -1,4 +1,3 @@
 FOCUS_TAG=develop
 BEAM_TAG=develop
 BLAZE_TAG=main
-POSTGRES_TAG=15.13-alpine

versions/prod

@@ -1,4 +1,3 @@
 FOCUS_TAG=main
 BEAM_TAG=main
 BLAZE_TAG=0.32
-POSTGRES_TAG=15.13-alpine

versions/test

@@ -1,4 +1,3 @@
 FOCUS_TAG=develop
 BEAM_TAG=develop
 BLAZE_TAG=main
-POSTGRES_TAG=15.13-alpine