mirror of
https://github.com/samply/bridgehead.git
synced 2025-06-16 21:50:14 +02:00
Compare commits
1 Commits
feature/ad
...
bugfix/tes
| Author | SHA1 | Date | |
|---|---|---|---|
| da069b7473 |
1
.github/CODEOWNERS
vendored
1
.github/CODEOWNERS
vendored
@ -1 +0,0 @@
|
||||
* @samply/bridgehead-developers
|
||||
@ -154,7 +154,7 @@ Pay special attention to:
|
||||
Clone the bridgehead repository:
|
||||
```shell
|
||||
sudo mkdir -p /srv/docker/
|
||||
sudo git clone -b main https://github.com/samply/bridgehead.git /srv/docker/bridgehead
|
||||
sudo git clone https://github.com/samply/bridgehead.git /srv/docker/bridgehead
|
||||
```
|
||||
|
||||
Then, run the installation script:
|
||||
|
||||
@ -8,8 +8,7 @@ services:
|
||||
BASE_URL: "http://bridgehead-cce-blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
|
||||
DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
|
||||
DB_BLOCK_CACHE_SIZE: ${BLAZE_MEMORY_CAP}
|
||||
CQL_EXPR_CACHE_SIZE: ${BLAZE_CQL_CACHE_CAP:-32}
|
||||
DB_BLOCK_CACHE_SIZE: $BLAZE_MEMORY_CAP
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "blaze-data:/app/data"
|
||||
@ -32,10 +31,6 @@ services:
|
||||
BEAM_PROXY_URL: http://beam-proxy:8081
|
||||
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
|
||||
EPSILON: 0.28
|
||||
QUERIES_TO_CACHE: '/queries_to_cache.conf'
|
||||
ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
|
||||
volumes:
|
||||
- /srv/docker/bridgehead/cce/queries_to_cache.conf:/queries_to_cache.conf:ro
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
|
||||
@ -1,6 +0,0 @@
|
||||
# Full Excel Export
|
||||
curl --location --request POST 'https://${HOST}/cce-exporter/request?query=Patient&query-format=FHIR_PATH&template-id=ccp&output-format=EXCEL' \
|
||||
--header 'x-api-key: ${EXPORT_API_KEY}'
|
||||
|
||||
# QB
|
||||
curl --location --request POST 'https://${HOST}/cce-reporter/generate?template-id=ccp'
|
||||
@ -1,72 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
exporter:
|
||||
image: docker.verbis.dkfz.de/ccp/dktk-exporter:latest
|
||||
container_name: bridgehead-cce-exporter
|
||||
environment:
|
||||
JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
|
||||
LOG_LEVEL: "INFO"
|
||||
EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh
|
||||
CROSS_ORIGINS: "https://${HOST}"
|
||||
EXPORTER_DB_USER: "exporter"
|
||||
EXPORTER_DB_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
|
||||
EXPORTER_DB_URL: "jdbc:postgresql://exporter-db:5432/exporter"
|
||||
HTTP_RELATIVE_PATH: "/cce-exporter"
|
||||
SITE: "${SITE_ID}"
|
||||
HTTP_SERVLET_REQUEST_SCHEME: "https"
|
||||
OPAL_PASSWORD: "${EXPORTER_OPAL_PASSWORD}"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.exporter_cce.rule=PathPrefix(`/cce-exporter`)"
|
||||
- "traefik.http.services.exporter_cce.loadbalancer.server.port=8092"
|
||||
- "traefik.http.routers.exporter_cce.tls=true"
|
||||
- "traefik.http.middlewares.exporter_cce_strip.stripprefix.prefixes=/cce-exporter"
|
||||
- "traefik.http.routers.exporter_cce.middlewares=exporter_cce_strip"
|
||||
volumes:
|
||||
- "/var/cache/bridgehead/cce/exporter-files:/app/exporter-files/output"
|
||||
|
||||
exporter-db:
|
||||
image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
|
||||
container_name: bridgehead-cce-exporter-db
|
||||
environment:
|
||||
POSTGRES_USER: "exporter"
|
||||
POSTGRES_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
|
||||
POSTGRES_DB: "exporter"
|
||||
volumes:
|
||||
# Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer.
|
||||
- "/var/cache/bridgehead/cce/exporter-db:/var/lib/postgresql/data"
|
||||
|
||||
reporter:
|
||||
image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest
|
||||
container_name: bridgehead-cce-reporter
|
||||
environment:
|
||||
JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
|
||||
LOG_LEVEL: "INFO"
|
||||
CROSS_ORIGINS: "https://${HOST}"
|
||||
HTTP_RELATIVE_PATH: "/cce-reporter"
|
||||
SITE: "${SITE_ID}"
|
||||
EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh
|
||||
EXPORTER_URL: "http://exporter:8092"
|
||||
LOG_FHIR_VALIDATION: "false"
|
||||
HTTP_SERVLET_REQUEST_SCHEME: "https"
|
||||
|
||||
# In this initial development state of the bridgehead, we are trying to have so many volumes as possible.
|
||||
# However, in the first executions in the CCE sites, this volume seems to be very important. A report is
|
||||
# a process that can take several hours, because it depends on the exporter.
|
||||
# There is a risk that the bridgehead restarts, losing the already created export.
|
||||
|
||||
volumes:
|
||||
- "/var/cache/bridgehead/cce/reporter-files:/app/reports"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.reporter_cce.rule=PathPrefix(`/cce-reporter`)"
|
||||
- "traefik.http.services.reporter_cce.loadbalancer.server.port=8095"
|
||||
- "traefik.http.routers.reporter_cce.tls=true"
|
||||
- "traefik.http.middlewares.reporter_cce_strip.stripprefix.prefixes=/cce-reporter"
|
||||
- "traefik.http.routers.reporter_cce.middlewares=reporter_cce_strip"
|
||||
|
||||
focus:
|
||||
environment:
|
||||
EXPORTER_URL: "http://exporter:8092"
|
||||
EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
|
||||
@ -1,8 +0,0 @@
|
||||
#!/bin/bash -e
|
||||
|
||||
if [ "$ENABLE_EXPORTER" == true ]; then
|
||||
log INFO "Exporter setup detected -- will start Exporter service."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/exporter-compose.yml"
|
||||
EXPORTER_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
EXPORTER_API_KEY="$(echo \"This is a salt string to generate one consistent API KEY for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 64)"
|
||||
fi
|
||||
@ -1,89 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
|
||||
teiler-orchestrator:
|
||||
image: docker.verbis.dkfz.de/cache/samply/teiler-orchestrator:latest
|
||||
container_name: bridgehead-teiler-orchestrator
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.teiler_orchestrator_cce.rule=PathPrefix(`/cce-teiler`)"
|
||||
- "traefik.http.services.teiler_orchestrator_cce.loadbalancer.server.port=9000"
|
||||
- "traefik.http.routers.teiler_orchestrator_cce.tls=true"
|
||||
- "traefik.http.middlewares.teiler_orchestrator_cce_strip.stripprefix.prefixes=/cce-teiler"
|
||||
- "traefik.http.routers.teiler_orchestrator_cce.middlewares=teiler_orchestrator_cce_strip"
|
||||
environment:
|
||||
TEILER_BACKEND_URL: "https://${HOST}/cce-teiler-backend"
|
||||
TEILER_DASHBOARD_URL: "https://${HOST}/cce-teiler-dashboard"
|
||||
DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE_LOWER_CASE}"
|
||||
HTTP_RELATIVE_PATH: "/cce-teiler"
|
||||
|
||||
teiler-dashboard:
|
||||
image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
|
||||
container_name: bridgehead-teiler-dashboard
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.teiler_dashboard_cce.rule=PathPrefix(`/cce-teiler-dashboard`)"
|
||||
- "traefik.http.services.teiler_dashboard_cce.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.teiler_dashboard_cce.tls=true"
|
||||
- "traefik.http.middlewares.teiler_dashboard_cce_strip.stripprefix.prefixes=/cce-teiler-dashboard"
|
||||
- "traefik.http.routers.teiler_dashboard_cce.middlewares=teiler_dashboard_cce_strip"
|
||||
environment:
|
||||
DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
|
||||
TEILER_BACKEND_URL: "https://${HOST}/cce-teiler-backend"
|
||||
OIDC_URL: "${OIDC_URL}"
|
||||
OIDC_REALM: "${OIDC_REALM}"
|
||||
OIDC_CLIENT_ID: "${OIDC_PUBLIC_CLIENT_ID}"
|
||||
OIDC_TOKEN_GROUP: "${OIDC_GROUP_CLAIM}"
|
||||
TEILER_ADMIN_NAME: "${OPERATOR_FIRST_NAME} ${OPERATOR_LAST_NAME}"
|
||||
TEILER_ADMIN_EMAIL: "${OPERATOR_EMAIL}"
|
||||
TEILER_ADMIN_PHONE: "${OPERATOR_PHONE}"
|
||||
TEILER_PROJECT: "${PROJECT}"
|
||||
EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
|
||||
TEILER_ORCHESTRATOR_URL: "https://${HOST}/cce-teiler"
|
||||
TEILER_DASHBOARD_HTTP_RELATIVE_PATH: "/cce-teiler-dashboard"
|
||||
TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/cce-teiler"
|
||||
TEILER_USER: "${OIDC_USER_GROUP}"
|
||||
TEILER_ADMIN: "${OIDC_ADMIN_GROUP}"
|
||||
REPORTER_DEFAULT_TEMPLATE_ID: "cce-qb"
|
||||
EXPORTER_DEFAULT_TEMPLATE_ID: "cce"
|
||||
|
||||
|
||||
teiler-backend:
|
||||
image: docker.verbis.dkfz.de/ccp/dktk-teiler-backend:latest
|
||||
container_name: bridgehead-teiler-backend
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.teiler_backend_cce.rule=PathPrefix(`/cce-teiler-backend`)"
|
||||
- "traefik.http.services.teiler_backend_cce.loadbalancer.server.port=8085"
|
||||
- "traefik.http.routers.teiler_backend_cce.tls=true"
|
||||
- "traefik.http.middlewares.teiler_backend_cce_strip.stripprefix.prefixes=/cce-teiler-backend"
|
||||
- "traefik.http.routers.teiler_backend_cce.middlewares=teiler_backend_cce_strip"
|
||||
environment:
|
||||
LOG_LEVEL: "INFO"
|
||||
APPLICATION_PORT: "8085"
|
||||
APPLICATION_ADDRESS: "${HOST}"
|
||||
DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
|
||||
CONFIG_ENV_VAR_PATH: "/run/secrets/cce.conf"
|
||||
TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/cce-teiler"
|
||||
TEILER_ORCHESTRATOR_URL: "https://${HOST}/cce-teiler"
|
||||
TEILER_DASHBOARD_DE_URL: "https://${HOST}/cce-teiler-dashboard/de"
|
||||
TEILER_DASHBOARD_EN_URL: "https://${HOST}/cce-teiler-dashboard/en"
|
||||
CENTRAX_URL: "${CENTRAXX_URL}"
|
||||
HTTP_PROXY: "http://forward_proxy:3128"
|
||||
ENABLE_MTBA: "${ENABLE_MTBA}"
|
||||
ENABLE_DATASHIELD: "${ENABLE_DATASHIELD}"
|
||||
TEILER_APP16_BACKENDURL: "https://${HOST}/cce-exporter"
|
||||
TEILER_APP17_BACKENDURL: "https://${HOST}/cce-exporter"
|
||||
TEILER_APP18_BACKENDURL: "https://${HOST}/cce-exporter"
|
||||
TEILER_APP35_BACKENDURL: "https://${HOST}/cce-exporter"
|
||||
TEILER_APP36_BACKENDURL: "https://${HOST}/cce-exporter"
|
||||
TEILER_APP26_BACKENDURL: "https://${HOST}/cce-reporter"
|
||||
|
||||
|
||||
secrets:
|
||||
- cce.conf
|
||||
|
||||
secrets:
|
||||
cce.conf:
|
||||
file: /etc/bridgehead/cce.conf
|
||||
@ -1,9 +0,0 @@
|
||||
#!/bin/bash -e
|
||||
|
||||
if [ "$ENABLE_TEILER" == true ];then
|
||||
log INFO "Teiler setup detected -- will start Teiler services."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/teiler-compose.yml"
|
||||
TEILER_DEFAULT_LANGUAGE=DE
|
||||
TEILER_DEFAULT_LANGUAGE_LOWER_CASE=${TEILER_DEFAULT_LANGUAGE,,}
|
||||
add_public_oidc_redirect_url "/cce-teiler/*"
|
||||
fi
|
||||
@ -1,2 +0,0 @@
|
||||
bGlicmFyeSBSZXRyaWV2ZQp1c2luZyBGSElSIHZlcnNpb24gJzQuMC4wJwppbmNsdWRlIEZISVJIZWxwZXJzIHZlcnNpb24gJzQuMC4wJwpjb2Rlc3lzdGVtIFNhbXBsZU1hdGVyaWFsVHlwZTogJ2h0dHBzOi8vZmhpci5iYm1yaS5kZS9Db2RlU3lzdGVtL1NhbXBsZU1hdGVyaWFsVHlwZScKCmNvZGVzeXN0ZW0gbG9pbmM6ICdodHRwOi8vbG9pbmMub3JnJwoKY29udGV4dCBQYXRpZW50CgpES1RLX1NUUkFUX0dFTkRFUl9TVFJBVElGSUVSCgpES1RLX1NUUkFUX0FHRV9TVFJBVElGSUVSCgpES1RLX1NUUkFUX0RFQ0VBU0VEX1NUUkFUSUZJRVIKCkRLVEtfU1RSQVRfRElBR05PU0lTX1NUUkFUSUZJRVIKCkRLVEtfU1RSQVRfU1BFQ0lNRU5fU1RSQVRJRklFUgoKREtUS19TVFJBVF9QUk9DRURVUkVfU1RSQVRJRklFUgoKREtUS19TVFJBVF9NRURJQ0FUSU9OX1NUUkFUSUZJRVIKREtUS19TVFJBVF9ERUZfSU5fSU5JVElBTF9QT1BVTEFUSU9OCnRydWU=
|
||||
bGlicmFyeSBSZXRyaWV2ZQp1c2luZyBGSElSIHZlcnNpb24gJzQuMC4wJwppbmNsdWRlIEZISVJIZWxwZXJzIHZlcnNpb24gJzQuMC4wJwpjb2Rlc3lzdGVtIFNhbXBsZU1hdGVyaWFsVHlwZTogJ2h0dHBzOi8vZmhpci5iYm1yaS5kZS9Db2RlU3lzdGVtL1NhbXBsZU1hdGVyaWFsVHlwZScKCmNvZGVzeXN0ZW0gbG9pbmM6ICdodHRwOi8vbG9pbmMub3JnJwpjb2Rlc3lzdGVtIGljZDEwOiAnaHR0cDovL2ZoaXIuZGUvQ29kZVN5c3RlbS9iZmFybS9pY2QtMTAtZ20nCmNvZGVzeXN0ZW0gbW9ycGg6ICd1cm46b2lkOjIuMTYuODQwLjEuMTEzODgzLjYuNDMuMScKCmNvbnRleHQgUGF0aWVudAoKREtUS19TVFJBVF9HRU5ERVJfU1RSQVRJRklFUgoKREtUS19TVFJBVF9BR0VfU1RSQVRJRklFUgoKREtUS19TVFJBVF9ERUNFQVNFRF9TVFJBVElGSUVSCgpES1RLX1NUUkFUX0RJQUdOT1NJU19TVFJBVElGSUVSCgpES1RLX1NUUkFUX1NQRUNJTUVOX1NUUkFUSUZJRVIKCkRLVEtfU1RSQVRfUFJPQ0VEVVJFX1NUUkFUSUZJRVIKCkRLVEtfU1RSQVRfTUVESUNBVElPTl9TVFJBVElGSUVSCkRLVEtfU1RSQVRfREVGX0lOX0lOSVRJQUxfUE9QVUxBVElPTgooKGV4aXN0cyBbQ29uZGl0aW9uOiBDb2RlICdDNjEnIGZyb20gaWNkMTBdKSBhbmQKKChleGlzdHMgZnJvbSBbT2JzZXJ2YXRpb246IENvZGUgJzU5ODQ3LTQnIGZyb20gbG9pbmNdIE8Kd2hlcmUgTy52YWx1ZS5jb2RpbmcuY29kZSBjb250YWlucyAnODE0MC8zJykgb3IKKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNTk4NDctNCcgZnJvbSBsb2luY10gTwp3aGVyZSBPLnZhbHVlLmNvZGluZy5jb2RlIGNvbnRhaW5zICc4MTQ3LzMnKSBvcgooZXhpc3RzIGZyb20gW09ic2VydmF0aW9uOiBDb2RlICc1OTg0Ny00JyBmcm9tIGxvaW5jXSBPCndoZXJlIE8udmFsdWUuY29kaW5nLmNvZGUgY29udGFpbnMgJzg0ODAvMycpIG9yCihleGlzdHMgZnJvbSBbT2JzZXJ2YXRpb246IENvZGUgJzU5ODQ3LTQnIGZyb20gbG9pbmNdIE8Kd2hlcmUgTy52YWx1ZS5jb2RpbmcuY29kZSBjb250YWlucyAnODUwMC8zJykpKQ==
|
||||
12
cce/vars
12
cce/vars
@ -7,18 +7,6 @@ SUPPORT_EMAIL=manoj.waikar@dkfz-heidelberg.de
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
BROKER_URL_FOR_PREREQ=$BROKER_URL
|
||||
|
||||
POSTGRES_TAG=15.6-alpine
|
||||
|
||||
OIDC_USER_GROUP="CCE_$(capitalize_first_letter ${SITE_ID})"
|
||||
OIDC_ADMIN_GROUP="CCE_$(capitalize_first_letter ${SITE_ID})_Verwalter"
|
||||
OIDC_PRIVATE_CLIENT_ID=${SITE_ID}-private
|
||||
OIDC_PUBLIC_CLIENT_ID=${SITE_ID}-public
|
||||
# Use "test-realm-01" for testing
|
||||
OIDC_REALM="${OIDC_REALM:-test-realm-01}"
|
||||
OIDC_URL="https://login.verbis.dkfz.de"
|
||||
OIDC_ISSUER_URL="${OIDC_URL}/realms/${OIDC_REALM}"
|
||||
OIDC_GROUP_CLAIM="groups"
|
||||
|
||||
for module in $PROJECT/modules/*.sh
|
||||
do
|
||||
log DEBUG "sourcing $module"
|
||||
|
||||
@ -2,7 +2,7 @@ version: "3.7"
|
||||
|
||||
services:
|
||||
blaze:
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:0.31
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:0.28
|
||||
container_name: bridgehead-ccp-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-ccp-blaze:8080"
|
||||
@ -35,7 +35,7 @@ services:
|
||||
QUERIES_TO_CACHE: '/queries_to_cache.conf'
|
||||
ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
|
||||
volumes:
|
||||
- /srv/docker/bridgehead/ccp/queries_to_cache.conf:/queries_to_cache.conf:ro
|
||||
- /srv/docker/bridgehead/ccp/queries_to_cache.conf:/queries_to_cache.conf
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
|
||||
@ -13,7 +13,7 @@ services:
|
||||
PROXY_APIKEY: ${DNPM_BEAM_SECRET_SHORT}
|
||||
APP_ID: dnpm-connect.${PROXY_ID}
|
||||
DISCOVERY_URL: "./conf/central_targets.json"
|
||||
LOCAL_TARGETS_FILE: "/conf/connect_targets.json"
|
||||
LOCAL_TARGETS_FILE: "./conf/connect_targets.json"
|
||||
HTTP_PROXY: "http://forward_proxy:3128"
|
||||
HTTPS_PROXY: "http://forward_proxy:3128"
|
||||
NO_PROXY: beam-proxy,dnpm-backend,host.docker.internal${DNPM_ADDITIONAL_NO_PROXY}
|
||||
@ -25,7 +25,7 @@ services:
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
|
||||
- /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro
|
||||
- /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)"
|
||||
|
||||
@ -1,99 +1,34 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
dnpm-mysql:
|
||||
image: mysql:9
|
||||
healthcheck:
|
||||
test: [ "CMD", "mysqladmin" ,"ping", "-h", "localhost" ]
|
||||
interval: 3s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
environment:
|
||||
MYSQL_ROOT_HOST: "%"
|
||||
MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD}
|
||||
volumes:
|
||||
- /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql
|
||||
|
||||
dnpm-authup:
|
||||
image: authup/authup:latest
|
||||
container_name: bridgehead-dnpm-authup
|
||||
volumes:
|
||||
- /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable
|
||||
depends_on:
|
||||
dnpm-mysql:
|
||||
condition: service_healthy
|
||||
command: server/core start
|
||||
environment:
|
||||
- PUBLIC_URL=https://${HOST}/auth/
|
||||
- AUTHORIZE_REDIRECT_URL=https://${HOST}
|
||||
- ROBOT_ADMIN_ENABLED=true
|
||||
- ROBOT_ADMIN_SECRET=${DNPM_AUTHUP_SECRET}
|
||||
- ROBOT_ADMIN_SECRET_RESET=true
|
||||
- DB_TYPE=mysql
|
||||
- DB_HOST=dnpm-mysql
|
||||
- DB_USERNAME=root
|
||||
- DB_PASSWORD=${DNPM_MYSQL_ROOT_PASSWORD}
|
||||
- DB_DATABASE=auth
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.middlewares.authup-strip.stripprefix.prefixes=/auth"
|
||||
- "traefik.http.routers.dnpm-auth.middlewares=authup-strip"
|
||||
- "traefik.http.routers.dnpm-auth.rule=PathPrefix(`/auth`)"
|
||||
- "traefik.http.services.dnpm-auth.loadbalancer.server.port=3000"
|
||||
- "traefik.http.routers.dnpm-auth.tls=true"
|
||||
|
||||
dnpm-portal:
|
||||
image: ghcr.io/dnpm-dip/portal:latest
|
||||
container_name: bridgehead-dnpm-portal
|
||||
environment:
|
||||
- NUXT_API_URL=http://dnpm-backend:9000/
|
||||
- NUXT_PUBLIC_API_URL=https://${HOST}/api/
|
||||
- NUXT_AUTHUP_URL=http://dnpm-authup:3000/
|
||||
- NUXT_PUBLIC_AUTHUP_URL=https://${HOST}/auth/
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dnpm-frontend.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.dnpm-frontend.loadbalancer.server.port=3000"
|
||||
- "traefik.http.routers.dnpm-frontend.tls=true"
|
||||
|
||||
dnpm-backend:
|
||||
image: ghcr.io/kohlbacherlab/bwhc-backend:1.0-snapshot-broker-connector
|
||||
container_name: bridgehead-dnpm-backend
|
||||
image: ghcr.io/dnpm-dip/backend:latest
|
||||
environment:
|
||||
- LOCAL_SITE=${ZPM_SITE}:${SITE_NAME} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen
|
||||
- RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
|
||||
- MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
|
||||
- HATEOAS_HOST=https://${HOST}
|
||||
- CONNECTOR_TYPE=broker
|
||||
- AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
|
||||
- ZPM_SITE=${ZPM_SITE}
|
||||
- N_RANDOM_FILES=${DNPM_SYNTH_NUM}
|
||||
volumes:
|
||||
- /etc/bridgehead/dnpm/config:/dnpm_config
|
||||
- /var/cache/bridgehead/dnpm/backend-data:/dnpm_data
|
||||
depends_on:
|
||||
dnpm-authup:
|
||||
condition: service_healthy
|
||||
- /etc/bridgehead/dnpm:/bwhc_config:ro
|
||||
- ${DNPM_DATA_DIR}:/bwhc_data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.services.dnpm-backend.loadbalancer.server.port=9000"
|
||||
# expose everything
|
||||
- "traefik.http.routers.dnpm-backend.rule=PathPrefix(`/api`)"
|
||||
- "traefik.http.routers.dnpm-backend.tls=true"
|
||||
- "traefik.http.routers.dnpm-backend.service=dnpm-backend"
|
||||
# except ETL
|
||||
- "traefik.http.routers.dnpm-backend-etl.rule=PathRegexp(`^/api(/.*)?etl(/.*)?$`)"
|
||||
- "traefik.http.routers.dnpm-backend-etl.tls=true"
|
||||
- "traefik.http.routers.dnpm-backend-etl.service=dnpm-backend"
|
||||
# this needs an ETL processor with support for basic auth
|
||||
- "traefik.http.routers.dnpm-backend-etl.middlewares=auth"
|
||||
# except peer-to-peer
|
||||
- "traefik.http.routers.dnpm-backend-peer.rule=PathRegexp(`^/api(/.*)?/peer2peer(/.*)?$`)"
|
||||
- "traefik.http.routers.dnpm-backend-peer.tls=true"
|
||||
- "traefik.http.routers.dnpm-backend-peer.service=dnpm-backend"
|
||||
- "traefik.http.routers.dnpm-backend-peer.middlewares=dnpm-backend-peer"
|
||||
# this effectively denies all requests
|
||||
# this is okay, because requests from peers don't go through Traefik
|
||||
- "traefik.http.middlewares.dnpm-backend-peer.ipWhiteList.sourceRange=0.0.0.0/32"
|
||||
- "traefik.http.routers.bwhc-backend.rule=PathPrefix(`/bwhc`)"
|
||||
- "traefik.http.services.bwhc-backend.loadbalancer.server.port=9000"
|
||||
- "traefik.http.routers.bwhc-backend.tls=true"
|
||||
|
||||
landing:
|
||||
dnpm-frontend:
|
||||
image: ghcr.io/kohlbacherlab/bwhc-frontend:2209
|
||||
container_name: bridgehead-dnpm-frontend
|
||||
links:
|
||||
- dnpm-backend
|
||||
environment:
|
||||
- NUXT_HOST=0.0.0.0
|
||||
- NUXT_PORT=8080
|
||||
- BACKEND_PROTOCOL=https
|
||||
- BACKEND_HOSTNAME=$HOST
|
||||
- BACKEND_PORT=443
|
||||
labels:
|
||||
- "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.bwhc-frontend.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.bwhc-frontend.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.bwhc-frontend.tls=true"
|
||||
|
||||
@ -1,16 +1,28 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -n "${ENABLE_DNPM_NODE}" ]; then
|
||||
log INFO "DNPM setup detected -- will start DNPM:DIP node."
|
||||
log INFO "DNPM setup detected (BwHC Node) -- will start BwHC node."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/dnpm-node-compose.yml"
|
||||
|
||||
# Set variables required for BwHC Node. ZPM_SITE is assumed to be set in /etc/bridgehead/<project>.conf
|
||||
DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
if [ -z "${ZPM_SITE+x}" ]; then
|
||||
log ERROR "Mandatory variable ZPM_SITE not defined!"
|
||||
exit 1
|
||||
fi
|
||||
mkdir -p /var/cache/bridgehead/dnpm/ || fail_and_report 1 "Failed to create '/var/cache/bridgehead/dnpm/'. Please run sudo './bridgehead install $PROJECT' again to fix the permissions."
|
||||
DNPM_SYNTH_NUM=${DNPM_SYNTH_NUM:--1}
|
||||
DNPM_MYSQL_ROOT_PASSWORD="$(generate_simple_password 'dnpm mysql')"
|
||||
DNPM_AUTHUP_SECRET="$(generate_simple_password 'dnpm authup')"
|
||||
if [ -z "${DNPM_DATA_DIR+x}" ]; then
|
||||
log ERROR "Mandatory variable DNPM_DATA_DIR not defined!"
|
||||
exit 1
|
||||
fi
|
||||
DNPM_SYNTH_NUM=${DNPM_SYNTH_NUM:-0}
|
||||
if grep -q 'traefik.http.routers.landing.rule=PathPrefix(`/landing`)' /srv/docker/bridgehead/minimal/docker-compose.override.yml 2>/dev/null; then
|
||||
echo "Override of landing page url already in place"
|
||||
else
|
||||
echo "Adding override of landing page url"
|
||||
if [ -f /srv/docker/bridgehead/minimal/docker-compose.override.yml ]; then
|
||||
echo -e ' landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml
|
||||
else
|
||||
echo -e 'version: "3.7"\nservices:\n landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
@ -3,7 +3,7 @@ version: "3.7"
|
||||
services:
|
||||
obds2fhir-rest:
|
||||
container_name: bridgehead-obds2fhir-rest
|
||||
image: docker.verbis.dkfz.de/samply/obds2fhir-rest:main
|
||||
image: docker.verbis.dkfz.de/ccp/obds2fhir-rest:main
|
||||
environment:
|
||||
IDTYPE: BK_${IDMANAGEMENT_FRIENDLY_ID}_L-ID
|
||||
MAINZELLISTE_APIKEY: ${IDMANAGER_LOCAL_PATIENTLIST_APIKEY}
|
||||
|
||||
@ -1,2 +1,2 @@
|
||||
bGlicmFyeSBSZXRyaWV2ZQp1c2luZyBGSElSIHZlcnNpb24gJzQuMC4wJwppbmNsdWRlIEZISVJIZWxwZXJzIHZlcnNpb24gJzQuMC4wJwoKY29kZXN5c3RlbSBsb2luYzogJ2h0dHA6Ly9sb2luYy5vcmcnCgpjb250ZXh0IFBhdGllbnQKCgpES1RLX1NUUkFUX0dFTkRFUl9TVFJBVElGSUVSCgpES1RLX1NUUkFUX1BSSU1BUllfRElBR05PU0lTX05PX1NPUlRfU1RSQVRJRklFUgpES1RLX1NUUkFUX0FHRV9DTEFTU19TVFJBVElGSUVSCgpES1RLX1NUUkFUX0RFQ0VBU0VEX1NUUkFUSUZJRVIKCkRLVEtfU1RSQVRfRElBR05PU0lTX1NUUkFUSUZJRVIKCkRLVEtfUkVQTEFDRV9TUEVDSU1FTl9TVFJBVElGSUVSaWYgSW5Jbml0aWFsUG9wdWxhdGlvbiB0aGVuIFtTcGVjaW1lbl0gZWxzZSB7fSBhcyBMaXN0PFNwZWNpbWVuPgpES1RLX1NUUkFUX1BST0NFRFVSRV9TVFJBVElGSUVSCgpES1RLX1NUUkFUX01FRElDQVRJT05fU1RSQVRJRklFUgoKICBES1RLX1JFUExBQ0VfSElTVE9MT0dZX1NUUkFUSUZJRVIKIGlmIGhpc3RvLmNvZGUuY29kaW5nLndoZXJlKGNvZGUgPSAnNTk4NDctNCcpLmNvZGUuZmlyc3QoKSBpcyBudWxsIHRoZW4gMCBlbHNlIDEKREtUS19TVFJBVF9ERUZfSU5fSU5JVElBTF9QT1BVTEFUSU9OCnRydWU=
|
||||
bGlicmFyeSBSZXRyaWV2ZQp1c2luZyBGSElSIHZlcnNpb24gJzQuMC4wJwppbmNsdWRlIEZISVJIZWxwZXJzIHZlcnNpb24gJzQuMC4wJwoKY29kZXN5c3RlbSBsb2luYzogJ2h0dHA6Ly9sb2luYy5vcmcnCmNvZGVzeXN0ZW0gaWNkMTA6ICdodHRwOi8vZmhpci5kZS9Db2RlU3lzdGVtL2JmYXJtL2ljZC0xMC1nbScKY29kZXN5c3RlbSBtb3JwaDogJ3VybjpvaWQ6Mi4xNi44NDAuMS4xMTM4ODMuNi40My4xJwoKY29udGV4dCBQYXRpZW50CgoKREtUS19TVFJBVF9HRU5ERVJfU1RSQVRJRklFUgoKREtUS19TVFJBVF9QUklNQVJZX0RJQUdOT1NJU19OT19TT1JUX1NUUkFUSUZJRVIKREtUS19TVFJBVF9BR0VfQ0xBU1NfU1RSQVRJRklFUgoKREtUS19TVFJBVF9ERUNFQVNFRF9TVFJBVElGSUVSCgpES1RLX1NUUkFUX0RJQUdOT1NJU19TVFJBVElGSUVSCgpES1RLX1JFUExBQ0VfU1BFQ0lNRU5fU1RSQVRJRklFUmlmIEluSW5pdGlhbFBvcHVsYXRpb24gdGhlbiBbU3BlY2ltZW5dIGVsc2Uge30gYXMgTGlzdDxTcGVjaW1lbj4KREtUS19TVFJBVF9QUk9DRURVUkVfU1RSQVRJRklFUgoKREtUS19TVFJBVF9NRURJQ0FUSU9OX1NUUkFUSUZJRVIKCiAgREtUS19SRVBMQUNFX0hJU1RPTE9HWV9TVFJBVElGSUVSCiBpZiBoaXN0by5jb2RlLmNvZGluZy53aGVyZShjb2RlID0gJzU5ODQ3LTQnKS5jb2RlLmZpcnN0KCkgaXMgbnVsbCB0aGVuIDAgZWxzZSAxCkRLVEtfU1RSQVRfREVGX0lOX0lOSVRJQUxfUE9QVUxBVElPTihleGlzdHMgW0NvbmRpdGlvbjogQ29kZSAnQzYxJyBmcm9tIGljZDEwXSkgYW5kIAooKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNTk4NDctNCcgZnJvbSBsb2luY10gTwp3aGVyZSBPLnZhbHVlLmNvZGluZy5jb2RlIGNvbnRhaW5zICc4MTQwLzMnKSBvciAKKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNTk4NDctNCcgZnJvbSBsb2luY10gTwp3aGVyZSBPLnZhbHVlLmNvZGluZy5jb2RlIGNvbnRhaW5zICc4MTQ3LzMnKSBvciAKKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNTk4NDctNCcgZnJvbSBsb2luY10gTwp3aGVyZSBPLnZhbHVlLmNvZGluZy5jb2RlIGNvbnRhaW5zICc4NDgwLzMnKSBvciAKKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNTk4NDctNCcgZnJvbSBsb2luY10gTwp3aGVyZSBPLnZhbHVlLmNvZGluZy5jb2RlIGNvbnRhaW5zICc4NTAwLzMnKSk=
|
||||
bGlicmFyeSBSZXRyaWV2ZQp1c2luZyBGSElSIHZlcnNpb24gJzQuMC4wJwppbmNsdWRlIEZISVJIZWxwZXJzIHZlcnNpb24gJzQuMC4wJwoKY29kZXN5c3RlbSBsb2luYzogJ2h0dHA6Ly9sb2luYy5vcmcnCgpjb250ZXh0IFBhdGllbnQKCgpES1RLX1NUUkFUX0dFTkRFUl9TVFJBVElGSUVSCgpES1RLX1NUUkFUX1BSSU1BUllfRElBR05PU0lTX05PX1NPUlRfU1RSQVRJRklFUgpES1RLX1NUUkFUX0FHRV9DTEFTU19TVFJBVElGSUVSCgpES1RLX1NUUkFUX0RFQ0VBU0VEX1NUUkFUSUZJRVIKCkRLVEtfU1RSQVRfRElBR05PU0lTX1NUUkFUSUZJRVIKCkRLVEtfU1RSQVRfU1BFQ0lNRU5fU1RSQVRJRklFUgoKREtUS19TVFJBVF9QUk9DRURVUkVfU1RSQVRJRklFUgoKREtUS19TVFJBVF9NRURJQ0FUSU9OX1NUUkFUSUZJRVIKCiAgREtUS19TVFJBVF9ISVNUT0xPR1lfU1RSQVRJRklFUgpES1RLX1NUUkFUX0RFRl9JTl9JTklUSUFMX1BPUFVMQVRJT04KdHJ1ZQ==
|
||||
bGlicmFyeSBSZXRyaWV2ZQp1c2luZyBGSElSIHZlcnNpb24gJzQuMC4wJwppbmNsdWRlIEZISVJIZWxwZXJzIHZlcnNpb24gJzQuMC4wJwoKY29kZXN5c3RlbSBsb2luYzogJ2h0dHA6Ly9sb2luYy5vcmcnCmNvZGVzeXN0ZW0gaWNkMTA6ICdodHRwOi8vZmhpci5kZS9Db2RlU3lzdGVtL2JmYXJtL2ljZC0xMC1nbScKY29kZXN5c3RlbSBtb3JwaDogJ3VybjpvaWQ6Mi4xNi44NDAuMS4xMTM4ODMuNi40My4xJwoKY29udGV4dCBQYXRpZW50CgoKREtUS19TVFJBVF9HRU5ERVJfU1RSQVRJRklFUgoKREtUS19TVFJBVF9QUklNQVJZX0RJQUdOT1NJU19OT19TT1JUX1NUUkFUSUZJRVIKREtUS19TVFJBVF9BR0VfQ0xBU1NfU1RSQVRJRklFUgoKREtUS19TVFJBVF9ERUNFQVNFRF9TVFJBVElGSUVSCgpES1RLX1NUUkFUX0RJQUdOT1NJU19TVFJBVElGSUVSCgpES1RLX1NUUkFUX1NQRUNJTUVOX1NUUkFUSUZJRVIKCkRLVEtfU1RSQVRfUFJPQ0VEVVJFX1NUUkFUSUZJRVIKCkRLVEtfU1RSQVRfTUVESUNBVElPTl9TVFJBVElGSUVSCgogIERLVEtfU1RSQVRfSElTVE9MT0dZX1NUUkFUSUZJRVIKREtUS19TVFJBVF9ERUZfSU5fSU5JVElBTF9QT1BVTEFUSU9OKGV4aXN0cyBbQ29uZGl0aW9uOiBDb2RlICdDNjEnIGZyb20gaWNkMTBdKSBhbmQgCigoZXhpc3RzIGZyb20gW09ic2VydmF0aW9uOiBDb2RlICc1OTg0Ny00JyBmcm9tIGxvaW5jXSBPCndoZXJlIE8udmFsdWUuY29kaW5nLmNvZGUgY29udGFpbnMgJzgxNDAvMycpIG9yIAooZXhpc3RzIGZyb20gW09ic2VydmF0aW9uOiBDb2RlICc1OTg0Ny00JyBmcm9tIGxvaW5jXSBPCndoZXJlIE8udmFsdWUuY29kaW5nLmNvZGUgY29udGFpbnMgJzgxNDcvMycpIG9yIAooZXhpc3RzIGZyb20gW09ic2VydmF0aW9uOiBDb2RlICc1OTg0Ny00JyBmcm9tIGxvaW5jXSBPCndoZXJlIE8udmFsdWUuY29kaW5nLmNvZGUgY29udGFpbnMgJzg0ODAvMycpIG9yIAooZXhpc3RzIGZyb20gW09ic2VydmF0aW9uOiBDb2RlICc1OTg0Ny00JyBmcm9tIGxvaW5jXSBPCndoZXJlIE8udmFsdWUuY29kaW5nLmNvZGUgY29udGFpbnMgJzg1MDAvMycpKQ==
|
||||
@ -33,7 +33,7 @@ services:
|
||||
EPSILON: 0.28
|
||||
QUERIES_TO_CACHE: '/queries_to_cache.conf'
|
||||
volumes:
|
||||
- /srv/docker/bridgehead/dhki/queries_to_cache.conf:/queries_to_cache.conf:ro
|
||||
- /srv/docker/bridgehead/dhki/queries_to_cache.conf:/queries_to_cache.conf
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
|
||||
10
dhki/vars
10
dhki/vars
@ -17,12 +17,4 @@ do
|
||||
done
|
||||
|
||||
idManagementSetup
|
||||
obds2fhirRestSetup
|
||||
|
||||
for module in modules/*.sh
|
||||
do
|
||||
log DEBUG "sourcing $module"
|
||||
source $module
|
||||
done
|
||||
|
||||
transfairSetup
|
||||
obds2fhirRestSetup
|
||||
@ -8,8 +8,7 @@ services:
|
||||
BASE_URL: "http://bridgehead-itcc-blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
|
||||
DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
|
||||
DB_BLOCK_CACHE_SIZE: ${BLAZE_MEMORY_CAP}
|
||||
CQL_EXPR_CACHE_SIZE: ${BLAZE_CQL_CACHE_CAP:-32}
|
||||
DB_BLOCK_CACHE_SIZE: $BLAZE_MEMORY_CAP
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "blaze-data:/app/data"
|
||||
@ -32,10 +31,6 @@ services:
|
||||
BEAM_PROXY_URL: http://beam-proxy:8081
|
||||
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
|
||||
EPSILON: 0.28
|
||||
QUERIES_TO_CACHE: '/queries_to_cache.conf'
|
||||
ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
|
||||
volumes:
|
||||
- /srv/docker/bridgehead/itcc/queries_to_cache.conf:/queries_to_cache.conf:ro
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
|
||||
@ -1,2 +0,0 @@
|
||||
bGlicmFyeSBSZXRyaWV2ZQp1c2luZyBGSElSIHZlcnNpb24gJzQuMC4wJwppbmNsdWRlIEZISVJIZWxwZXJzIHZlcnNpb24gJzQuMC4wJwpjb2Rlc3lzdGVtIFNhbXBsZU1hdGVyaWFsVHlwZTogJ2h0dHBzOi8vZmhpci5iYm1yaS5kZS9Db2RlU3lzdGVtL1NhbXBsZU1hdGVyaWFsVHlwZScKCmNvZGVzeXN0ZW0gbG9pbmM6ICdodHRwOi8vbG9pbmMub3JnJwoKY29udGV4dCBQYXRpZW50CkRLVEtfU1RSQVRfR0VOREVSX1NUUkFUSUZJRVIKICBES1RLX1NUUkFUX0RJQUdOT1NJU19TVFJBVElGSUVSCiAgSVRDQ19TVFJBVF9BR0VfQ0xBU1NfU1RSQVRJRklFUgogIERLVEtfU1RSQVRfREVGX0lOX0lOSVRJQUxfUE9QVUxBVElPTgp0cnVl
|
||||
bGlicmFyeSBSZXRyaWV2ZQp1c2luZyBGSElSIHZlcnNpb24gJzQuMC4wJwppbmNsdWRlIEZISVJIZWxwZXJzIHZlcnNpb24gJzQuMC4wJwpjb2Rlc3lzdGVtIFNhbXBsZU1hdGVyaWFsVHlwZTogJ2h0dHBzOi8vZmhpci5iYm1yaS5kZS9Db2RlU3lzdGVtL1NhbXBsZU1hdGVyaWFsVHlwZScKCmNvZGVzeXN0ZW0gbG9pbmM6ICdodHRwOi8vbG9pbmMub3JnJwpjb2Rlc3lzdGVtIG1vbGVjdWxhck1hcmtlcjogJ2h0dHA6Ly93d3cuZ2VuZW5hbWVzLm9yZycKCmNvbnRleHQgUGF0aWVudApES1RLX1NUUkFUX0dFTkRFUl9TVFJBVElGSUVSCiAgREtUS19TVFJBVF9ESUFHTk9TSVNfU1RSQVRJRklFUgogIElUQ0NfU1RSQVRfQUdFX0NMQVNTX1NUUkFUSUZJRVIKICBES1RLX1NUUkFUX0RFRl9JTl9JTklUSUFMX1BPUFVMQVRJT04KKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNjk1NDgtNicgZnJvbSBsb2luY10gTwp3aGVyZSBPLmNvbXBvbmVudC53aGVyZShjb2RlLmNvZGluZyBjb250YWlucyBDb2RlICc0ODAxOC02JyBmcm9tIGxvaW5jKS52YWx1ZS5jb2RpbmcgY29udGFpbnMgQ29kZSAnQlJBRicgZnJvbSBtb2xlY3VsYXJNYXJrZXIp
|
||||
@ -313,7 +313,7 @@ function sync_secrets() {
|
||||
-e ALL_PROXY=$HTTPS_PROXY_FULL_URL \
|
||||
-e PROXY_ID=$PROXY_ID \
|
||||
-e BROKER_URL=$BROKER_URL \
|
||||
-e OIDC_PROVIDER=secret-sync-central.central-secret-sync.$BROKER_ID \
|
||||
-e OIDC_PROVIDER=secret-sync-central.oidc-client-enrollment.$BROKER_ID \
|
||||
-e SECRET_DEFINITIONS=$secret_sync_args \
|
||||
docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest
|
||||
|
||||
@ -322,57 +322,6 @@ function sync_secrets() {
|
||||
set +a # Export variables in the regular way
|
||||
}
|
||||
|
||||
function secret_sync_gitlab_token() {
|
||||
# Map the origin of the git repository /etc/bridgehead to the prefix recognized by Secret Sync
|
||||
local gitlab
|
||||
case "$(git -C /etc/bridgehead remote get-url origin)" in
|
||||
*git.verbis.dkfz.de*) gitlab=verbis;;
|
||||
*gitlab.bbmri-eric.eu*) gitlab=bbmri;;
|
||||
*)
|
||||
log "WARN" "Not running Secret Sync because the git repository /etc/bridgehead has unknown origin"
|
||||
return
|
||||
;;
|
||||
esac
|
||||
|
||||
# Use Secret Sync to validate the GitLab token in /var/cache/bridgehead/secrets/gitlab_token.
|
||||
# If it is missing or expired, Secret Sync will create a new token and write it to the file.
|
||||
# The git credential helper reads the token from the file during git pull.
|
||||
mkdir -p /var/cache/bridgehead/secrets
|
||||
touch /var/cache/bridgehead/secrets/gitlab_token # the file has to exist to be mounted correctly in the Docker container
|
||||
log "INFO" "Running Secret Sync for the GitLab token (gitlab=$gitlab)"
|
||||
docker pull docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest # make sure we have the latest image
|
||||
docker run --rm \
|
||||
-v /var/cache/bridgehead/secrets/gitlab_token:/usr/local/cache \
|
||||
-v $PRIVATEKEYFILENAME:/run/secrets/privkey.pem:ro \
|
||||
-v /srv/docker/bridgehead/$PROJECT/root.crt.pem:/run/secrets/root.crt.pem:ro \
|
||||
-v /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro \
|
||||
-e TLS_CA_CERTIFICATES_DIR=/conf/trusted-ca-certs \
|
||||
-e NO_PROXY=localhost,127.0.0.1 \
|
||||
-e ALL_PROXY=$HTTPS_PROXY_FULL_URL \
|
||||
-e PROXY_ID=$PROXY_ID \
|
||||
-e BROKER_URL=$BROKER_URL \
|
||||
-e GITLAB_PROJECT_ACCESS_TOKEN_PROVIDER=secret-sync-central.central-secret-sync.$BROKER_ID \
|
||||
-e SECRET_DEFINITIONS=GitLabProjectAccessToken:BRIDGEHEAD_CONFIG_REPO_TOKEN:$gitlab \
|
||||
docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest
|
||||
if [ $? -eq 0 ]; then
|
||||
log "INFO" "Secret Sync was successful"
|
||||
# In the past we used to hardcode tokens into the repository URL. We have to remove those now for the git credential helper to become effective.
|
||||
CLEAN_REPO="$(git -C /etc/bridgehead remote get-url origin | sed -E 's|https://[^@]+@|https://|')"
|
||||
git -C /etc/bridgehead remote set-url origin "$CLEAN_REPO"
|
||||
# Set the git credential helper
|
||||
git -C /etc/bridgehead config credential.helper /srv/docker/bridgehead/lib/gitlab-token-helper.sh
|
||||
else
|
||||
log "WARN" "Secret Sync failed"
|
||||
# Remove the git credential helper
|
||||
git -C /etc/bridgehead config --unset credential.helper
|
||||
fi
|
||||
|
||||
# In the past the git credential helper was also set for /srv/docker/bridgehead but never used.
|
||||
# Let's remove it to avoid confusion. This line can be removed at some point the future when we
|
||||
# believe that it was removed on all/most production servers.
|
||||
git -C /srv/docker/bridgehead config --unset credential.helper
|
||||
}
|
||||
|
||||
capitalize_first_letter() {
|
||||
input="$1"
|
||||
capitalized="$(tr '[:lower:]' '[:upper:]' <<< ${input:0:1})${input:1}"
|
||||
|
||||
@ -33,7 +33,43 @@ export SITE_ID
|
||||
checkOwner /srv/docker/bridgehead bridgehead || fail_and_report 1 "Update failed: Wrong permissions in /srv/docker/bridgehead"
|
||||
checkOwner /etc/bridgehead bridgehead || fail_and_report 1 "Update failed: Wrong permissions in /etc/bridgehead"
|
||||
|
||||
secret_sync_gitlab_token
|
||||
# Use Secret Sync to validate the GitLab token in /var/cache/bridgehead/secrets/gitlab_token.
|
||||
# If it is missing or expired, Secret Sync will create a new token and write it to the file.
|
||||
# The git credential helper reads the token from the file during git pull.
|
||||
mkdir -p /var/cache/bridgehead/secrets
|
||||
touch /var/cache/bridgehead/secrets/gitlab_token # the file has to exist to be mounted correctly in the Docker container
|
||||
log "INFO" "Running Secret Sync for the GitLab token"
|
||||
docker pull docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest # make sure we have the latest image
|
||||
docker run --rm \
|
||||
-v /var/cache/bridgehead/secrets/gitlab_token:/usr/local/cache \
|
||||
-v $PRIVATEKEYFILENAME:/run/secrets/privkey.pem:ro \
|
||||
-v /srv/docker/bridgehead/$PROJECT/root.crt.pem:/run/secrets/root.crt.pem:ro \
|
||||
-v /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro \
|
||||
-e TLS_CA_CERTIFICATES_DIR=/conf/trusted-ca-certs \
|
||||
-e NO_PROXY=localhost,127.0.0.1 \
|
||||
-e ALL_PROXY=$HTTPS_PROXY_FULL_URL \
|
||||
-e PROXY_ID=$PROXY_ID \
|
||||
-e BROKER_URL=$BROKER_URL \
|
||||
-e GITLAB_PROJECT_ACCESS_TOKEN_PROVIDER=secret-sync-central.oidc-client-enrollment.$BROKER_ID \
|
||||
-e SECRET_DEFINITIONS=GitLabProjectAccessToken:BRIDGEHEAD_CONFIG_REPO_TOKEN: \
|
||||
docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest
|
||||
if [ $? -eq 0 ]; then
|
||||
log "INFO" "Secret Sync was successful"
|
||||
# In the past we used to hardcode tokens into the repository URL. We have to remove those now for the git credential helper to become effective.
|
||||
CLEAN_REPO="$(git -C /etc/bridgehead remote get-url origin | sed -E 's|https://[^@]+@|https://|')"
|
||||
git -C /etc/bridgehead remote set-url origin "$CLEAN_REPO"
|
||||
# Set the git credential helper
|
||||
git -C /etc/bridgehead config credential.helper /srv/docker/bridgehead/lib/gitlab-token-helper.sh
|
||||
else
|
||||
log "WARN" "Secret Sync failed"
|
||||
# Remove the git credential helper
|
||||
git -C /etc/bridgehead config --unset credential.helper
|
||||
fi
|
||||
|
||||
# In the past the git credential helper was also set for /srv/docker/bridgehead but never used.
|
||||
# Let's remove it to avoid confusion. This line can be removed at some point the future when we
|
||||
# believe that it was removed on all/most production servers.
|
||||
git -C /srv/docker/bridgehead config --unset credential.helper
|
||||
|
||||
CHANGES=""
|
||||
|
||||
|
||||
@ -16,7 +16,7 @@ services:
|
||||
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dashboard.rule=PathPrefix(`/dashboard/`)"
|
||||
- "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard/`)"
|
||||
- "traefik.http.routers.dashboard.entrypoints=websecure"
|
||||
- "traefik.http.routers.dashboard.service=api@internal"
|
||||
- "traefik.http.routers.dashboard.tls=true"
|
||||
|
||||
@ -1,142 +0,0 @@
|
||||
{
|
||||
"sites": [
|
||||
{
|
||||
"id": "UKFR",
|
||||
"name": "Freiburg",
|
||||
"virtualhost": "ukfr.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKHD",
|
||||
"name": "Heidelberg",
|
||||
"virtualhost": "ukhd.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKT",
|
||||
"name": "Tübingen",
|
||||
"virtualhost": "ukt.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKU",
|
||||
"name": "Ulm",
|
||||
"virtualhost": "uku.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UM",
|
||||
"name": "Mainz",
|
||||
"virtualhost": "um.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKMR",
|
||||
"name": "Marburg",
|
||||
"virtualhost": "ukmr.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKE",
|
||||
"name": "Hamburg",
|
||||
"virtualhost": "uke.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKA",
|
||||
"name": "Aachen",
|
||||
"virtualhost": "uka.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "Charite",
|
||||
"name": "Berlin",
|
||||
"virtualhost": "charite.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.berlin-test.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "MRI",
|
||||
"name": "Muenchen-tum",
|
||||
"virtualhost": "mri.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.muenchen-tum.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "KUM",
|
||||
"name": "Muenchen-lmu",
|
||||
"virtualhost": "kum.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.muenchen-lmu.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "MHH",
|
||||
"name": "Hannover",
|
||||
"virtualhost": "mhh.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.hannover.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKDD",
|
||||
"name": "dresden-dnpm",
|
||||
"virtualhost": "ukdd.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.dresden-dnpm.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKB",
|
||||
"name": "Bonn",
|
||||
"virtualhost": "ukb.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.bonn-dnpm.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKD",
|
||||
"name": "Duesseldorf",
|
||||
"virtualhost": "ukd.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.duesseldorf-dnpm.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKK",
|
||||
"name": "Koeln",
|
||||
"virtualhost": "ukk.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.dnpm-bridge.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UME",
|
||||
"name": "Essen",
|
||||
"virtualhost": "ume.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.essen.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKM",
|
||||
"name": "Muenster",
|
||||
"virtualhost": "ukm.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.muenster-dnpm.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKF",
|
||||
"name": "Frankfurt",
|
||||
"virtualhost": "ukf.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.frankfurt.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UMG",
|
||||
"name": "Goettingen",
|
||||
"virtualhost": "umg.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.goettingen.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKW",
|
||||
"name": "Würzburg",
|
||||
"virtualhost": "ukw.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.wuerzburg-dnpm.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "UKSH",
|
||||
"name": "Schleswig-Holstein",
|
||||
"virtualhost": "uksh.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.uksh-dnpm.broker.ccp-it.dktk.dkfz.de"
|
||||
},
|
||||
{
|
||||
"id": "TKT",
|
||||
"name": "Test",
|
||||
"virtualhost": "tkt.dnpm.de",
|
||||
"beamconnect": "dnpm-connect.tobias-develop.broker.ccp-it.dktk.dkfz.de"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -29,7 +29,7 @@ services:
|
||||
PROXY_APIKEY: ${DNPM_BEAM_SECRET_SHORT}
|
||||
APP_ID: dnpm-connect.${DNPM_PROXY_ID}
|
||||
DISCOVERY_URL: "./conf/central_targets.json"
|
||||
LOCAL_TARGETS_FILE: "/conf/connect_targets.json"
|
||||
LOCAL_TARGETS_FILE: "./conf/connect_targets.json"
|
||||
HTTP_PROXY: http://forward_proxy:3128
|
||||
HTTPS_PROXY: http://forward_proxy:3128
|
||||
NO_PROXY: dnpm-beam-proxy,dnpm-backend, host.docker.internal${DNPM_ADDITIONAL_NO_PROXY}
|
||||
@ -41,7 +41,7 @@ services:
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /etc/bridgehead/dnpm/local_targets.json:/conf/connect_targets.json:ro
|
||||
- /srv/docker/bridgehead/minimal/modules/dnpm-central-targets.json:/conf/central_targets.json:ro
|
||||
- /etc/bridgehead/dnpm/central_targets.json:/conf/central_targets.json:ro
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dnpm-connect.rule=PathPrefix(`/dnpm-connect`)"
|
||||
|
||||
@ -1,99 +1,34 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
dnpm-mysql:
|
||||
image: mysql:9
|
||||
healthcheck:
|
||||
test: [ "CMD", "mysqladmin" ,"ping", "-h", "localhost" ]
|
||||
interval: 3s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
environment:
|
||||
MYSQL_ROOT_HOST: "%"
|
||||
MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD}
|
||||
volumes:
|
||||
- /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql
|
||||
|
||||
dnpm-authup:
|
||||
image: authup/authup:latest
|
||||
container_name: bridgehead-dnpm-authup
|
||||
volumes:
|
||||
- /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable
|
||||
depends_on:
|
||||
dnpm-mysql:
|
||||
condition: service_healthy
|
||||
command: server/core start
|
||||
environment:
|
||||
- PUBLIC_URL=https://${HOST}/auth/
|
||||
- AUTHORIZE_REDIRECT_URL=https://${HOST}
|
||||
- ROBOT_ADMIN_ENABLED=true
|
||||
- ROBOT_ADMIN_SECRET=${DNPM_AUTHUP_SECRET}
|
||||
- ROBOT_ADMIN_SECRET_RESET=true
|
||||
- DB_TYPE=mysql
|
||||
- DB_HOST=dnpm-mysql
|
||||
- DB_USERNAME=root
|
||||
- DB_PASSWORD=${DNPM_MYSQL_ROOT_PASSWORD}
|
||||
- DB_DATABASE=auth
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.middlewares.authup-strip.stripprefix.prefixes=/auth/"
|
||||
- "traefik.http.routers.dnpm-auth.middlewares=authup-strip"
|
||||
- "traefik.http.routers.dnpm-auth.rule=PathPrefix(`/auth`)"
|
||||
- "traefik.http.services.dnpm-auth.loadbalancer.server.port=3000"
|
||||
- "traefik.http.routers.dnpm-auth.tls=true"
|
||||
|
||||
dnpm-portal:
|
||||
image: ghcr.io/dnpm-dip/portal:latest
|
||||
container_name: bridgehead-dnpm-portal
|
||||
environment:
|
||||
- NUXT_API_URL=http://dnpm-backend:9000/
|
||||
- NUXT_PUBLIC_API_URL=https://${HOST}/api/
|
||||
- NUXT_AUTHUP_URL=http://dnpm-authup:3000/
|
||||
- NUXT_PUBLIC_AUTHUP_URL=https://${HOST}/auth/
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dnpm-frontend.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.dnpm-frontend.loadbalancer.server.port=3000"
|
||||
- "traefik.http.routers.dnpm-frontend.tls=true"
|
||||
|
||||
dnpm-backend:
|
||||
image: ghcr.io/kohlbacherlab/bwhc-backend:1.0-snapshot-broker-connector
|
||||
container_name: bridgehead-dnpm-backend
|
||||
image: ghcr.io/dnpm-dip/backend:latest
|
||||
environment:
|
||||
- LOCAL_SITE=${ZPM_SITE}:${SITE_NAME} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen
|
||||
- RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
|
||||
- MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
|
||||
- HATEOAS_HOST=https://${HOST}
|
||||
- CONNECTOR_TYPE=broker
|
||||
- AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
|
||||
- ZPM_SITE=${ZPM_SITE}
|
||||
- N_RANDOM_FILES=${DNPM_SYNTH_NUM}
|
||||
volumes:
|
||||
- /etc/bridgehead/dnpm/config:/dnpm_config
|
||||
- /var/cache/bridgehead/dnpm/backend-data:/dnpm_data
|
||||
depends_on:
|
||||
dnpm-authup:
|
||||
condition: service_healthy
|
||||
- /etc/bridgehead/dnpm:/bwhc_config:ro
|
||||
- ${DNPM_DATA_DIR}:/bwhc_data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.services.dnpm-backend.loadbalancer.server.port=9000"
|
||||
# expose everything
|
||||
- "traefik.http.routers.dnpm-backend.rule=PathPrefix(`/api`)"
|
||||
- "traefik.http.routers.dnpm-backend.tls=true"
|
||||
- "traefik.http.routers.dnpm-backend.service=dnpm-backend"
|
||||
# except ETL
|
||||
- "traefik.http.routers.dnpm-backend-etl.rule=PathRegexp(`^/api(/.*)?etl(/.*)?$`)"
|
||||
- "traefik.http.routers.dnpm-backend-etl.tls=true"
|
||||
- "traefik.http.routers.dnpm-backend-etl.service=dnpm-backend"
|
||||
# this needs an ETL processor with support for basic auth
|
||||
- "traefik.http.routers.dnpm-backend-etl.middlewares=auth"
|
||||
# except peer-to-peer
|
||||
- "traefik.http.routers.dnpm-backend-peer.rule=PathRegexp(`^/api(/.*)?/peer2peer(/.*)?$`)"
|
||||
- "traefik.http.routers.dnpm-backend-peer.tls=true"
|
||||
- "traefik.http.routers.dnpm-backend-peer.service=dnpm-backend"
|
||||
- "traefik.http.routers.dnpm-backend-peer.middlewares=dnpm-backend-peer"
|
||||
# this effectively denies all requests
|
||||
# this is okay, because requests from peers don't go through Traefik
|
||||
- "traefik.http.middlewares.dnpm-backend-peer.ipWhiteList.sourceRange=0.0.0.0/32"
|
||||
- "traefik.http.routers.bwhc-backend.rule=PathPrefix(`/bwhc`)"
|
||||
- "traefik.http.services.bwhc-backend.loadbalancer.server.port=9000"
|
||||
- "traefik.http.routers.bwhc-backend.tls=true"
|
||||
|
||||
landing:
|
||||
dnpm-frontend:
|
||||
image: ghcr.io/kohlbacherlab/bwhc-frontend:2209
|
||||
container_name: bridgehead-dnpm-frontend
|
||||
links:
|
||||
- dnpm-backend
|
||||
environment:
|
||||
- NUXT_HOST=0.0.0.0
|
||||
- NUXT_PORT=8080
|
||||
- BACKEND_PROTOCOL=https
|
||||
- BACKEND_HOSTNAME=$HOST
|
||||
- BACKEND_PORT=443
|
||||
labels:
|
||||
- "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.bwhc-frontend.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.bwhc-frontend.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.bwhc-frontend.tls=true"
|
||||
|
||||
@ -1,16 +1,28 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -n "${ENABLE_DNPM_NODE}" ]; then
|
||||
log INFO "DNPM setup detected -- will start DNPM:DIP node."
|
||||
log INFO "DNPM setup detected (BwHC Node) -- will start BwHC node."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/dnpm-node-compose.yml"
|
||||
|
||||
# Set variables required for BwHC Node. ZPM_SITE is assumed to be set in /etc/bridgehead/<project>.conf
|
||||
DNPM_APPLICATION_SECRET="$(echo \"This is a salt string to generate one consistent password for DNPM. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
if [ -z "${ZPM_SITE+x}" ]; then
|
||||
log ERROR "Mandatory variable ZPM_SITE not defined!"
|
||||
exit 1
|
||||
fi
|
||||
mkdir -p /var/cache/bridgehead/dnpm/ || fail_and_report 1 "Failed to create '/var/cache/bridgehead/dnpm/'. Please run sudo './bridgehead install $PROJECT' again to fix the permissions."
|
||||
DNPM_SYNTH_NUM=${DNPM_SYNTH_NUM:--1}
|
||||
DNPM_MYSQL_ROOT_PASSWORD="$(generate_simple_password 'dnpm mysql')"
|
||||
DNPM_AUTHUP_SECRET="$(generate_simple_password 'dnpm authup')"
|
||||
if [ -z "${DNPM_DATA_DIR+x}" ]; then
|
||||
log ERROR "Mandatory variable DNPM_DATA_DIR not defined!"
|
||||
exit 1
|
||||
fi
|
||||
DNPM_SYNTH_NUM=${DNPM_SYNTH_NUM:-0}
|
||||
if grep -q 'traefik.http.routers.landing.rule=PathPrefix(`/landing`)' /srv/docker/bridgehead/minimal/docker-compose.override.yml 2>/dev/null; then
|
||||
echo "Override of landing page url already in place"
|
||||
else
|
||||
echo "Adding override of landing page url"
|
||||
if [ -f /srv/docker/bridgehead/minimal/docker-compose.override.yml ]; then
|
||||
echo -e ' landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml
|
||||
else
|
||||
echo -e 'version: "3.7"\nservices:\n landing:\n labels:\n - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"' >> /srv/docker/bridgehead/minimal/docker-compose.override.yml
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
@ -1,51 +0,0 @@
|
||||
|
||||
services:
|
||||
transfair:
|
||||
image: docker.verbis.dkfz.de/cache/samply/transfair:latest
|
||||
container_name: bridgehead-transfair
|
||||
environment:
|
||||
# NOTE: Those 3 variables need only to be passed if their set, otherwise transfair will complain about empty url values
|
||||
- INSTITUTE_TTP_URL
|
||||
- INSTITUTE_TTP_API_KEY
|
||||
- PROJECT_ID_SYSTEM
|
||||
- FHIR_REQUEST_URL=${FHIR_REQUEST_URL}
|
||||
- FHIR_INPUT_URL=${FHIR_INPUT_URL}
|
||||
- FHIR_OUTPUT_URL=${FHIR_OUTPUT_URL:-http://blaze:8080}
|
||||
- FHIR_REQUEST_CREDENTIALS=${FHIR_REQUEST_CREDENTIALS}
|
||||
- FHIR_INPUT_CREDENTIALS=${FHIR_INPUT_CREDENTIALS}
|
||||
- FHIR_OUTPUT_CREDENTIALS=${FHIR_OUTPUT_CREDENTIALS}
|
||||
- EXCHANGE_ID_SYSTEM=${EXCHANGE_ID_SYSTEM:-SESSION_ID}
|
||||
- DATABASE_URL=sqlite://transfair/data_requests.sql?mode=rwc
|
||||
- RUST_LOG=${RUST_LOG:-info}
|
||||
volumes:
|
||||
- /var/cache/bridgehead/${PROJECT}/transfair:/transfair
|
||||
|
||||
transfair-input-blaze:
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:0.28
|
||||
container_name: bridgehead-transfair-input-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-transfair-input-blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx1024m"
|
||||
DB_BLOCK_CACHE_SIZE: 1024
|
||||
CQL_EXPR_CACHE_SIZE: 8
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "transfair-input-blaze-data:/app/data"
|
||||
profiles: ["transfair-input-blaze"]
|
||||
|
||||
transfair-request-blaze:
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:0.28
|
||||
container_name: bridgehead-transfair-requests-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-transfair-requests-blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx1024m"
|
||||
DB_BLOCK_CACHE_SIZE: 1024
|
||||
CQL_EXPR_CACHE_SIZE: 8
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "transfair-request-blaze-data:/app/data"
|
||||
profiles: ["transfair-request-blaze"]
|
||||
|
||||
volumes:
|
||||
transfair-input-blaze-data:
|
||||
transfair-request-blaze-data:
|
||||
@ -1,22 +0,0 @@
|
||||
#!/bin/bash -e
|
||||
|
||||
function transfairSetup() {
|
||||
if [[ -n "$INSTITUTE_TTP_URL" || -n "$EXCHANGE_ID_SYSTEM" ]]; then
|
||||
echo "Starting transfair."
|
||||
OVERRIDE+=" -f ./modules/transfair-compose.yml"
|
||||
if [ -n "$FHIR_INPUT_URL" ]; then
|
||||
log INFO "TransFAIR input fhir store set to external $FHIR_INPUT_URL"
|
||||
else
|
||||
log INFO "TransFAIR input fhir store not set writing to internal blaze"
|
||||
FHIR_INPUT_URL="http://transfair-input-blaze:8080"
|
||||
OVERRIDE+=" --profile transfair-input-blaze"
|
||||
fi
|
||||
if [ -n "$FHIR_REQUEST_URL" ]; then
|
||||
log INFO "TransFAIR request fhir store set to external $FHIR_REQUEST_URL"
|
||||
else
|
||||
log INFO "TransFAIR request fhir store not set writing to internal blaze"
|
||||
FHIR_REQUEST_URL="http://transfair-requests-blaze:8080"
|
||||
OVERRIDE+=" --profile transfair-request-blaze"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
Reference in New Issue
Block a user