fix secret sync in dktk

cce/modules/lens-compose.yml

@@ -3,8 +3,6 @@ services:
   lens:
     container_name: lens_federated-search
     image: samply/cce-explorer:main
-    environment:
-      PUBLIC_SPOT_URL: https://${HOST}/prod
     labels:
       - "traefik.http.services.lens.loadbalancer.server.port=3000"
       - "traefik.enable=true"

itcc/docker-compose.yml

@@ -15,7 +15,7 @@ services:
       - "blaze-data:/app/data"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.blaze_itcc.rule=Host(`${HOST}`) && PathPrefix(`/itcc-localdatamanagement`)"
+      - "traefik.http.routers.blaze_itcc.rule=PathPrefix(`/itcc-localdatamanagement`)"
       - "traefik.http.middlewares.itcc_b_strip.stripprefix.prefixes=/itcc-localdatamanagement"
       - "traefik.http.services.blaze_itcc.loadbalancer.server.port=8080"
       - "traefik.http.routers.blaze_itcc.middlewares=itcc_b_strip,auth"
@@ -32,8 +32,9 @@ services:
       BEAM_PROXY_URL: http://beam-proxy:8081
       RETRY_COUNT: ${FOCUS_RETRY_COUNT}
       EPSILON: 0.28
-      QUERIES_TO_CACHE: "/queries_to_cache.conf"
+      QUERIES_TO_CACHE: '/queries_to_cache.conf'
       ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
+      CQL_PROJECTS_ENABLED: "itcc"
     volumes:
       - /srv/docker/bridgehead/itcc/queries_to_cache.conf:/queries_to_cache.conf:ro
     depends_on:
@@ -41,13 +42,12 @@ services:
       - "blaze"
 
   beam-proxy:
-    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop-sockets
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
     container_name: bridgehead-beam-proxy
     environment:
       BROKER_URL: ${BROKER_URL}
       PROXY_ID: ${PROXY_ID}
       APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
-      APP_omics-endpoint_KEY: ${FOCUS_BEAM_SECRET_SHORT}
       PRIVKEY_FILE: /run/secrets/proxy.pem
       ALL_PROXY: http://forward_proxy:3128
       TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
@@ -60,6 +60,7 @@ services:
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
       - /srv/docker/bridgehead/itcc/root.crt.pem:/conf/root.crt.pem:ro
 
+
 volumes:
   blaze-data:
 

itcc/modules/itcc-omics-ingest.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-
-if [ -n "$ENABLE_OMICS" ];then
-  OVERRIDE+=" -f ./$PROJECT/modules/itcc-omics-ingest.yaml"
-  GENERATE_API_KEY="$(generate_simple_password 'omics')"
-  PATIENTLIST_POSTGRES_PASSWORD=="$(generate_simple_password 'mainzelliste')"
-fi

itcc/modules/itcc-omics-ingest.yaml

@@ -1,81 +0,0 @@
-services:
-  omics-endpoint:
-    image: ghcr.io/samply/itcc-omics-ingest:fix-task
-    environment:
-      API_KEY: ${GENERATE_API_KEY}
-      RUST_LOG: debug
-      BEAM_ID: "omics-endpoint.${PROXY_ID}"
-      BEAM_SECRET: "${FOCUS_BEAM_SECRET_SHORT}"
-      BEAM_URL: http://beam-proxy:8081
-      ML_URL: http://mainzelliste:8080
-      BLAZE_URL: http://bridgehead-itcc-blaze:8080/fhir/
-      DWH_SOCKET_ID: "${DWH_SOCKET_ID}"
-      DWH_TASK_ID: "${DWH_TASK_ID}"
-      ENABLE_SOCKETS: true
-      PARTNER_ID: itcc-inform
-      ML_API_KEY: ${GENERATE_API_KEY}
-
-    volumes:
-      - /var/cache/bridgehead/omics/data:/data/uploads
-    labels:
-      - "traefik.http.routers.omics.rule=Host(`${HOST}`) && PathPrefix(`/api/omics`)"
-      - "traefik.enable=true"
-      - "traefik.http.services.omics.loadbalancer.server.port=6080"
-      - "traefik.http.routers.omics.tls=true"
-      - "traefik.http.middlewares.omics-stripprefix.stripprefix.prefixes=/api"
-      - "traefik.http.routers.omics.middlewares=omics-stripprefix"
-
-  db:
-    image: postgres:15
-    container_name: db
-    restart: unless-stopped
-    environment:
-      POSTGRES_DB: mainzelliste
-      POSTGRES_USER: ${ML_DB_USER}
-      POSTGRES_PASSWORD: ${PATIENTLIST_POSTGRES_PASSWORD}
-    ports:
-      - "5432:5432"
-    volumes:
-      - db_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${ML_DB_USER} -d mainzelliste"]
-      interval: 5s
-      timeout: 5s
-      retries: 10
-      start_period: 10s
-
-  mainzelliste:
-    image: medicalinformatics/mainzelliste:latest
-    container_name: mainzelliste
-    restart: unless-stopped
-    depends_on:
-      db:
-        condition: service_healthy
-    ports:
-      - 7887:8080
-
-    environment:
-      ML_API_KEY: ${GENERATE_API_KEY}
-      ML_DB_HOST: db
-      ML_DB_PORT: "5432"
-      ML_DB_NAME: mainzelliste
-      ML_DB_USER: ${ML_DB_USER}
-      ML_DB_PASS: ${PATIENTLIST_POSTGRES_PASSWORD}
-      ML_DB_DRIVER: org.postgresql.Driver
-      ML_DB_TYPE: postgresql
-      ML_LOG_LEVEL: INFO
-      ML_ALLOWEDREMOTEADDRESSES: "127.0.0.1,::1,172.16.0.0/12"
-
-    secrets:
-      - mainzelliste.docker.conf
-      - source: symmetric_key
-        target: /etc/resources/keys/symmetric_key.der
-
-volumes:
-  db_data:
-secrets:
-  mainzelliste.docker.conf:
-    file: /etc/bridgehead/mainzelliste/mainzelliste.docker.conf
-
-  symmetric_key:
-    file: /etc/bridgehead/mainzelliste/keyset_siv.json

itcc/modules/lens-compose.yml

@@ -1,47 +1,33 @@
 version: "3.7"
 services:
-  itcc-explorer:
+  landing:
-    container_name: lens_itcc_explorer
+    container_name: lens_federated-search
-    image: samply/itcc-explorer:main
+    image: docker.verbis.dkfz.de/ccp/lens:${SITE_ID}
-    environment:
-      HOST: "0.0.0.0"
-      BIND_ADDR: "0.0.0.0:3000"
-      PUBLIC_ENVIRONMENT: ${PUBLIC_ENVIRONMENT}
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.itcc.rule=Host(`${HOST}`) && PathPrefix(`/`)"
+      - "traefik.http.routers.landing.rule=PathPrefix(`/`)"
-      - "traefik.http.routers.itcc.entrypoints=websecure"
+      - "traefik.http.services.landing.loadbalancer.server.port=80"
-      - "traefik.http.services.itcc.loadbalancer.server.port=3000"
+      - "traefik.http.routers.landing.tls=true"
-      - "traefik.http.routers.itcc.tls=true"
 
   spot:
-    image: samply/rustyspot:latest
+    image: docker.verbis.dkfz.de/ccp-private/central-spot
     environment:
       BEAM_SECRET: "${FOCUS_BEAM_SECRET_SHORT}"
-      BEAM_PROXY_URL: http://beam-proxy:8081
+      BEAM_URL: http://beam-proxy:8081
       BEAM_PROXY_ID: ${SITE_ID}
       BEAM_BROKER_ID: ${BROKER_ID}
-      BEAM_APP_ID: "spot.${SITE_ID}.${BROKER_ID}"
+      BEAM_APP_ID: "focus"
-      CORS_ORIGIN: "https://${HOST}"
+      PROJECT_METADATA: "itcc"
-      SITES: ${SITES}
-      TRANSFORM: LENS
-      PROJECT: "itcc"
-      BIND_ADDR: 0.0.0.0:8055
     depends_on:
       - "beam-proxy"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.services.spot.loadbalancer.server.port=8055"
+      - "traefik.http.services.spot.loadbalancer.server.port=8080"
       - "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
-      - "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowheaders=content-type"
       - "traefik.http.middlewares.corsheaders2.headers.accesscontrolalloworiginlist=https://${HOST}"
       - "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowcredentials=true"
       - "traefik.http.middlewares.corsheaders2.headers.accesscontrolmaxage=-1"
-      - "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/prod`)"
+      - "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/backend`)"
-      - "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/prod"
+      - "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/backend"
       - "traefik.http.routers.spot.tls=true"
       - "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot,auth"
-
-  beam-proxy:
-    environment:
-      APP_spot_KEY: ${FOCUS_BEAM_SECRET_SHORT}

itcc/vars

@@ -6,10 +6,6 @@ FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
 SUPPORT_EMAIL=arturo.macias@dkfz-heidelberg.de
 PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
 BROKER_URL_FOR_PREREQ=$BROKER_URL
-PUBLIC_ENVIRONMENT=prod
-DWH_SOCKET_ID=socket.itcc-datalake.${BROKER_ID}
-DWH_TASK_ID=task.itcc-datalake.${BROKER_ID}
-ML_DB_USER=mainzelliste
 
 for module in $PROJECT/modules/*.sh
 do

lib/functions.sh

@@ -327,7 +327,7 @@ function sync_secrets() {
         -e ALL_PROXY=$HTTPS_PROXY_FULL_URL \
         -e PROXY_ID=$proxy_id \
         -e BROKER_URL=$broker_url \
-        -e OIDC_PROVIDER=secret-sync-central.central-secret-sync.$broker_id \
+        -e OIDC_PROVIDER=secret-sync-central.test-secret-sync.$broker_id \
         -e SECRET_DEFINITIONS=$secret_sync_args \
         docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest
 
@@ -337,8 +337,8 @@ function sync_secrets() {
 }
 
 function secret_sync_gitlab_token() {
-    if [[ "$PROJECT" != "dktk" && "$PROJECT" != "bbmri" ]]; then
+    if [[ "$PROJECT" != "ccp" && "$PROJECT" != "bbmri" ]]; then
-        log "INFO" "Not running Secret Sync for project minimal"
+        log "INFO" "Not running Secret Sync for project $PROJECT"
         return
     fi
     # Map the origin of the git repository /etc/bridgehead to the prefix recognized by Secret Sync