mirror of
https://github.com/samply/bridgehead.git
synced 2025-06-16 20:40:15 +02:00
Compare commits
1 Commits
feature/qr
...
feature/au
| Author | SHA1 | Date | |
|---|---|---|---|
| 16d478e85b |
39
.github/scripts/rename_inactive_branches.py
vendored
39
.github/scripts/rename_inactive_branches.py
vendored
@ -1,39 +0,0 @@
|
||||
import os
|
||||
import requests
|
||||
from datetime import datetime, timedelta
|
||||
|
||||
# Configuration
|
||||
GITHUB_TOKEN = os.getenv('GITHUB_TOKEN')
|
||||
REPO = 'samply/bridgehead'
|
||||
HEADERS = {'Authorization': f'token {GITHUB_TOKEN}', 'Accept': 'application/vnd.github.v3+json'}
|
||||
API_URL = f'https://api.github.com/repos/{REPO}/branches'
|
||||
INACTIVE_DAYS = 365
|
||||
CUTOFF_DATE = datetime.now() - timedelta(days=INACTIVE_DAYS)
|
||||
|
||||
# Fetch all branches
|
||||
def get_branches():
|
||||
response = requests.get(API_URL, headers=HEADERS)
|
||||
response.raise_for_status()
|
||||
return response.json() if response.status_code == 200 else []
|
||||
|
||||
# Rename inactive branches
|
||||
def rename_branch(old_name, new_name):
|
||||
rename_url = f'https://api.github.com/repos/{REPO}/branches/{old_name}/rename'
|
||||
response = requests.post(rename_url, json={'new_name': new_name}, headers=HEADERS)
|
||||
response.raise_for_status()
|
||||
print(f"Renamed branch {old_name} to {new_name}" if response.status_code == 201 else f"Failed to rename {old_name}: {response.status_code}")
|
||||
|
||||
# Check if the branch is inactive
|
||||
def is_inactive(commit_url):
|
||||
last_commit_date = requests.get(commit_url, headers=HEADERS).json()['commit']['committer']['date']
|
||||
return datetime.strptime(last_commit_date, '%Y-%m-%dT%H:%M:%SZ') < CUTOFF_DATE
|
||||
|
||||
# Rename inactive branches
|
||||
def main():
|
||||
for branch in get_branches():
|
||||
if is_inactive(branch['commit']['url']):
|
||||
#rename_branch(branch['name'], f"archived/{branch['name']}")
|
||||
print(f"[LOG] Branch '{branch['name']}' is inactive and would be renamed to 'archived/{branch['name']}'")
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
21
.github/workflows/auto-pr.yml
vendored
Normal file
21
.github/workflows/auto-pr.yml
vendored
Normal file
@ -0,0 +1,21 @@
|
||||
name: Automatically generate Pull Requests for feature/pilot-projects
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [closed]
|
||||
branches:
|
||||
- main
|
||||
|
||||
jobs:
|
||||
create_pr:
|
||||
if: github.event.pull_request.merged == true
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Create Pull Request to feature/pilot-projects branch
|
||||
run: gh pr create -B feature/pilot-projects -H main --title 'Create Pull Request to feature/pilot-projects branch' --body 'Created by Github action'
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
27
.github/workflows/rename-inactive-branches.yml
vendored
27
.github/workflows/rename-inactive-branches.yml
vendored
@ -1,27 +0,0 @@
|
||||
name: Cleanup - Rename Inactive Branches
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 0 * * 0' # Runs every Sunday at midnight
|
||||
|
||||
jobs:
|
||||
archive-stale-branches:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout Repository
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.x'
|
||||
|
||||
- name: Install Libraries
|
||||
run: pip install requests
|
||||
|
||||
- name: Run Script to Rename Inactive Branches
|
||||
run: |
|
||||
python .github/scripts/rename_inactive_branches.py
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
@ -34,7 +34,7 @@ This repository is the starting point for any information and tools you will nee
|
||||
|
||||
## Requirements
|
||||
|
||||
The data protection officer at your site will probably want to know exactly what our software does with patient data, and you may need to get their approval before you are allowed to install a Bridgehead. To help you with this, we have provided some data protection concepts:
|
||||
The data protection group at your site will probably want to know exactly what our software does with patient data, and you may need to get their approval before you are allowed to install a Bridgehead. To help you with this, we have provided some data protection concepts:
|
||||
|
||||
- [Germany](https://www.bbmri.de/biobanking/it/infrastruktur/datenschutzkonzept/)
|
||||
|
||||
@ -46,8 +46,6 @@ Hardware requirements strongly depend on the specific use-cases of your network
|
||||
- 32 GB RAM
|
||||
- 160GB Hard Drive, SSD recommended
|
||||
|
||||
We recommend using a dedicated VM for the Bridgehead, with no other applications running on it. While the Bridgehead can, in principle, run on a shared VM, you might run into surprising problems such as resource conflicts (e.g., two apps using tcp port 443).
|
||||
|
||||
### Software
|
||||
|
||||
You are strongly recommended to install the Bridgehead under a Linux operating system (but see the section [Non-Linux OS](#non-linux-os)). You will need root (administrator) priveleges on this machine in order to perform the deployment. We recommend the newest Ubuntu LTS server release.
|
||||
|
||||
@ -10,8 +10,7 @@ services:
|
||||
BASE_URL: "http://bridgehead-bbmri-blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
|
||||
DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
|
||||
DB_BLOCK_CACHE_SIZE: ${BLAZE_MEMORY_CAP}
|
||||
CQL_EXPR_CACHE_SIZE: ${BLAZE_CQL_CACHE_CAP:-32}
|
||||
DB_BLOCK_CACHE_SIZE: $BLAZE_MEMORY_CAP
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "blaze-data:/app/data"
|
||||
|
||||
@ -16,7 +16,7 @@ services:
|
||||
- "blaze"
|
||||
|
||||
beam-proxy-eric:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
container_name: bridgehead-beam-proxy-eric
|
||||
environment:
|
||||
BROKER_URL: ${ERIC_BROKER_URL}
|
||||
|
||||
@ -16,7 +16,7 @@ services:
|
||||
- "blaze"
|
||||
|
||||
beam-proxy-gbn:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
container_name: bridgehead-beam-proxy-gbn
|
||||
environment:
|
||||
BROKER_URL: ${GBN_BROKER_URL}
|
||||
|
||||
19
bbmri/vars
19
bbmri/vars
@ -1,21 +1,3 @@
|
||||
BROKER_ID=broker-test.bbmri-test.samply.de
|
||||
BROKER_URL=https://${BROKER_ID}
|
||||
PROXY_ID=${SITE_ID}.${BROKER_ID}
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
|
||||
BROKER_URL_FOR_PREREQ=$BROKER_URL
|
||||
|
||||
OIDC_USER_GROUP="BBMRI_$(capitalize_first_letter ${SITE_ID})"
|
||||
OIDC_ADMIN_GROUP="BBMRI_$(capitalize_first_letter ${SITE_ID})_Verwalter"
|
||||
OIDC_PUBLIC_CLIENT_ID="BBMRI_${SITE_ID}-public"
|
||||
# Use "test-realm-01" for testing
|
||||
OIDC_REALM="${OIDC_REALM:-test-realm-01}"
|
||||
OIDC_URL="https://login.verbis.dkfz.de"
|
||||
OIDC_ISSUER_URL="${OIDC_URL}/realms/${OIDC_REALM}"
|
||||
OIDC_GROUP_CLAIM="groups"
|
||||
|
||||
POSTGRES_TAG=15.6-alpine
|
||||
|
||||
# Makes sense for all European Biobanks
|
||||
: ${ENABLE_ERIC:=true}
|
||||
|
||||
@ -31,7 +13,6 @@ do
|
||||
source $module
|
||||
done
|
||||
|
||||
|
||||
SUPPORT_EMAIL=$ERIC_SUPPORT_EMAIL
|
||||
BROKER_URL_FOR_PREREQ="${ERIC_BROKER_URL:-$GBN_BROKER_URL}"
|
||||
|
||||
|
||||
18
bridgehead
18
bridgehead
@ -32,18 +32,6 @@ case "$PROJECT" in
|
||||
bbmri)
|
||||
#nothing extra to do
|
||||
;;
|
||||
cce)
|
||||
#nothing extra to do
|
||||
;;
|
||||
itcc)
|
||||
#nothing extra to do
|
||||
;;
|
||||
kr)
|
||||
#nothing extra to do
|
||||
;;
|
||||
dhki)
|
||||
#nothing extra to do
|
||||
;;
|
||||
minimal)
|
||||
#nothing extra to do
|
||||
;;
|
||||
@ -87,16 +75,13 @@ loadVars() {
|
||||
case "$ENVIRONMENT" in
|
||||
"production")
|
||||
export FOCUS_TAG=main
|
||||
export BEAM_TAG=main
|
||||
;;
|
||||
"test")
|
||||
export FOCUS_TAG=develop
|
||||
export BEAM_TAG=develop
|
||||
;;
|
||||
*)
|
||||
report_error 7 "Environment \"$ENVIRONMENT\" is unknown. Assuming production. FIX THIS!"
|
||||
export FOCUS_TAG=main
|
||||
export BEAM_TAG=main
|
||||
;;
|
||||
esac
|
||||
}
|
||||
@ -106,8 +91,7 @@ case "$ACTION" in
|
||||
loadVars
|
||||
hc_send log "Bridgehead $PROJECT startup: Checking requirements ..."
|
||||
checkRequirements
|
||||
# NOTE: for testing only, we will need to properly setup secret sync if we want to use this code
|
||||
# sync_secrets
|
||||
sync_secrets
|
||||
hc_send log "Bridgehead $PROJECT startup: Requirements checked out. Now starting bridgehead ..."
|
||||
exec $COMPOSE -p $PROJECT -f ./minimal/docker-compose.yml -f ./$PROJECT/docker-compose.yml $OVERRIDE up --abort-on-container-exit
|
||||
;;
|
||||
|
||||
@ -1,63 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
blaze:
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:0.28
|
||||
container_name: bridgehead-cce-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-cce-blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
|
||||
DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
|
||||
DB_BLOCK_CACHE_SIZE: $BLAZE_MEMORY_CAP
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "blaze-data:/app/data"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.blaze_cce.rule=PathPrefix(`/cce-localdatamanagement`)"
|
||||
- "traefik.http.middlewares.cce_b_strip.stripprefix.prefixes=/cce-localdatamanagement"
|
||||
- "traefik.http.services.blaze_cce.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.blaze_cce.middlewares=cce_b_strip,auth"
|
||||
- "traefik.http.routers.blaze_cce.tls=true"
|
||||
|
||||
focus:
|
||||
image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
|
||||
container_name: bridgehead-focus
|
||||
environment:
|
||||
API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
BEAM_APP_ID_LONG: focus.${PROXY_ID}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
BLAZE_URL: "http://bridgehead-cce-blaze:8080/fhir/"
|
||||
BEAM_PROXY_URL: http://beam-proxy:8081
|
||||
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
|
||||
EPSILON: 0.28
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
|
||||
beam-proxy:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
|
||||
container_name: bridgehead-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${BROKER_URL}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
ROOTCERT_FILE: /conf/root.crt.pem
|
||||
secrets:
|
||||
- proxy.pem
|
||||
depends_on:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/cce/root.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
|
||||
volumes:
|
||||
blaze-data:
|
||||
|
||||
secrets:
|
||||
proxy.pem:
|
||||
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
@ -1,33 +0,0 @@
|
||||
version: "3.7"
|
||||
services:
|
||||
landing:
|
||||
container_name: lens_federated-search
|
||||
image: docker.verbis.dkfz.de/ccp/lens:${SITE_ID}
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.landing.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.landing.tls=true"
|
||||
|
||||
spot:
|
||||
image: docker.verbis.dkfz.de/ccp-private/central-spot
|
||||
environment:
|
||||
BEAM_SECRET: "${FOCUS_BEAM_SECRET_SHORT}"
|
||||
BEAM_URL: http://beam-proxy:8081
|
||||
BEAM_PROXY_ID: ${SITE_ID}
|
||||
BEAM_BROKER_ID: ${BROKER_ID}
|
||||
BEAM_APP_ID: "focus"
|
||||
PROJECT_METADATA: "cce_supervisors"
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.services.spot.loadbalancer.server.port=8080"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolalloworiginlist=https://${HOST}"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowcredentials=true"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolmaxage=-1"
|
||||
- "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/backend`)"
|
||||
- "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/backend"
|
||||
- "traefik.http.routers.spot.tls=true"
|
||||
- "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot"
|
||||
@ -1,5 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -n "$ENABLE_LENS" ];then
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/lens-compose.yml"
|
||||
fi
|
||||
@ -1,20 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUW34NEb7bl0+Ywx+I1VKtY5vpAOowDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjQwMTIyMTMzNzEzWhcNMzQw
|
||||
MTE5MTMzNzQzWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAL5UegLXTlq3XRRj8LyFs3aF0tpRPVoW9RXp5kFI
|
||||
TnBvyO6qjNbMDT/xK+4iDtEX4QQUvsxAKxfXbe9i1jpdwjgH7JHaSGm2IjAiKLqO
|
||||
OXQQtguWwfNmmp96Ql13ArLj458YH08xMO/w2NFWGwB/hfARa4z/T0afFuc/tKJf
|
||||
XbGCG9xzJ9tmcG45QN8NChGhVvaTweNdVxGWlpHxmi0Mn8OM9CEuB7nPtTTiBuiu
|
||||
pRC2zVVmNjVp4ktkAqL7IHOz+/F5nhiz6tOika9oD3376Xj055lPznLcTQn2+4d7
|
||||
K7ZrBopCFxIQPjkgmYRLfPejbpdUjK1UVJw7hbWkqWqH7JMCAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFGjvRcaIP4HM
|
||||
poIguUAK9YL2n7fbMB8GA1UdIwQYMBaAFGjvRcaIP4HMpoIguUAK9YL2n7fbMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCbzycJSaDm
|
||||
AXXNJqQ88djrKs5MDXS8RIjS/cu2ayuLaYDe+BzVmUXNA0Vt9nZGdaz63SLLcjpU
|
||||
fNSxBfKbwmf7s30AK8Cnfj9q4W/BlBeVizUHQsg1+RQpDIdMrRQrwkXv8mfLw+w5
|
||||
3oaXNW6W/8KpBp/H8TBZ6myl6jCbeR3T8EMXBwipMGop/1zkbF01i98Xpqmhx2+l
|
||||
n+80ofPsSspOo5XmgCZym8CD/m/oFHmjcvOfpOCvDh4PZ+i37pmbSlCYoMpla3u/
|
||||
7MJMP5lugfLBYNDN2p+V4KbHP/cApCDT5UWLOeAWjgiZQtHH5ilDeYqEc1oPjyJt
|
||||
Rtup0MTxSJtN
|
||||
-----END CERTIFICATE-----
|
||||
14
cce/vars
14
cce/vars
@ -1,14 +0,0 @@
|
||||
BROKER_ID=test-no-real-data.broker.samply.de
|
||||
BROKER_URL=https://${BROKER_ID}
|
||||
PROXY_ID=${SITE_ID}.${BROKER_ID}
|
||||
FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
|
||||
SUPPORT_EMAIL=manoj.waikar@dkfz-heidelberg.de
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
BROKER_URL_FOR_PREREQ=$BROKER_URL
|
||||
|
||||
for module in $PROJECT/modules/*.sh
|
||||
do
|
||||
log DEBUG "sourcing $module"
|
||||
source $module
|
||||
done
|
||||
@ -8,8 +8,7 @@ services:
|
||||
BASE_URL: "http://bridgehead-ccp-blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
|
||||
DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
|
||||
DB_BLOCK_CACHE_SIZE: ${BLAZE_MEMORY_CAP}
|
||||
CQL_EXPR_CACHE_SIZE: ${BLAZE_CQL_CACHE_CAP:-32}
|
||||
DB_BLOCK_CACHE_SIZE: $BLAZE_MEMORY_CAP
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "blaze-data:/app/data"
|
||||
@ -40,7 +39,7 @@ services:
|
||||
- "blaze"
|
||||
|
||||
beam-proxy:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
container_name: bridgehead-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${BROKER_URL}
|
||||
|
||||
@ -151,7 +151,7 @@ services:
|
||||
--pass-access-token=false
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.oauth2_proxy.rule=PathPrefix(`/oauth2`)"
|
||||
- "traefik.http.routers.oauth2_proxy.rule=Host(`${HOST}`) && PathPrefix(`/oauth2`)"
|
||||
- "traefik.http.services.oauth2_proxy.loadbalancer.server.port=4180"
|
||||
- "traefik.http.routers.oauth2_proxy.tls=true"
|
||||
environment:
|
||||
|
||||
@ -33,7 +33,7 @@ if [ "$ENABLE_DATASHIELD" == true ]; then
|
||||
echo "$sites" | docker_jq -n --args '[{
|
||||
"external": "'"$SITE_ID"':443",
|
||||
"internal": "opal:8443",
|
||||
"allowed": input | map("\(.).'"$BROKER_ID"'")
|
||||
"allowed": input | map("datashield-connect.\(.).'"$BROKER_ID"'")
|
||||
}]' >/tmp/bridgehead/opal-map/local.json
|
||||
if [ "$USER" == "root" ]; then
|
||||
chown -R bridgehead:docker /tmp/bridgehead
|
||||
|
||||
@ -10,6 +10,5 @@
|
||||
"essen",
|
||||
"dktk-datashield-test",
|
||||
"dktk-test",
|
||||
"mannheim",
|
||||
"central-ds-orchestrator"
|
||||
"mannheim"
|
||||
]
|
||||
|
||||
@ -3,5 +3,5 @@
|
||||
if [ "$ENABLE_FHIR2SQL" == true ]; then
|
||||
log INFO "Dashboard setup detected -- will start Dashboard backend and FHIR2SQL service."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/fhir2sql-compose.yml"
|
||||
DASHBOARD_DB_PASSWORD="$(generate_simple_password 'fhir2sql')"
|
||||
DASHBOARD_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password for the Dashboard database. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
fi
|
||||
|
||||
@ -19,18 +19,10 @@ services:
|
||||
- traefik-forward-auth
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# Router with Authentication
|
||||
- "traefik.http.routers.id-manager.rule=PathPrefix(`/id-manager`)"
|
||||
- "traefik.http.services.id-manager.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.id-manager.tls=true"
|
||||
- "traefik.http.routers.id-manager.middlewares=traefik-forward-auth-idm"
|
||||
- "traefik.http.routers.id-manager.service=id-manager-service"
|
||||
# Router without Authentication
|
||||
- "traefik.http.routers.id-manager-compatibility.rule=PathPrefix(`/id-manager/paths/translator/getIds`)"
|
||||
- "traefik.http.routers.id-manager-compatibility.tls=true"
|
||||
- "traefik.http.routers.id-manager-compatibility.service=id-manager-service"
|
||||
# Definition of Service
|
||||
- "traefik.http.services.id-manager-service.loadbalancer.server.port=8080"
|
||||
- "traefik.http.services.id-manager-service.loadbalancer.server.scheme=http"
|
||||
|
||||
patientlist:
|
||||
image: docker.verbis.dkfz.de/bridgehead/mainzelliste
|
||||
@ -65,7 +57,7 @@ services:
|
||||
- "/tmp/bridgehead/patientlist/:/docker-entrypoint-initdb.d/"
|
||||
|
||||
traefik-forward-auth:
|
||||
image: docker.verbis.dkfz.de/cache/oauth2-proxy/oauth2-proxy:latest
|
||||
image: docker.verbis.dkfz.de/cache/oauth2-proxy/oauth2-proxy:v7.6.0
|
||||
environment:
|
||||
- http_proxy=http://forward_proxy:3128
|
||||
- https_proxy=http://forward_proxy:3128
|
||||
@ -75,7 +67,6 @@ services:
|
||||
- OAUTH2_PROXY_CLIENT_ID=bridgehead-${SITE_ID}
|
||||
- OAUTH2_PROXY_CLIENT_SECRET=${IDMANAGER_AUTH_CLIENT_SECRET}
|
||||
- OAUTH2_PROXY_COOKIE_SECRET=${IDMANAGER_AUTH_COOKIE_SECRET}
|
||||
- OAUTH2_PROXY_COOKIE_NAME=_BRIDGEHEAD_oauth2_idm
|
||||
- OAUTH2_PROXY_COOKIE_DOMAINS=.${HOST}
|
||||
- OAUTH2_PROXY_HTTP_ADDRESS=:4180
|
||||
- OAUTH2_PROXY_REVERSE_PROXY=true
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
function idManagementSetup() {
|
||||
if [ -n "$IDMANAGER_UPLOAD_APIKEY" ]; then
|
||||
log INFO "id-management setup detected -- will start id-management (mainzelliste & magicpl)."
|
||||
OVERRIDE+=" -f ./ccp/modules/id-management-compose.yml"
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/id-management-compose.yml"
|
||||
|
||||
# Auto Generate local Passwords
|
||||
PATIENTLIST_POSTGRES_PASSWORD="$(echo \"id-management-module-db-password-salt\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
|
||||
@ -7,7 +7,7 @@ function obds2fhirRestSetup() {
|
||||
log ERROR "Missing ID-Management Module! Fix this by setting up ID Management:"
|
||||
PATIENTLIST_URL=" "
|
||||
fi
|
||||
OVERRIDE+=" -f ./ccp/modules/obds2fhir-rest-compose.yml"
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/obds2fhir-rest-compose.yml"
|
||||
LOCAL_SALT="$(echo \"local-random-salt\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
fi
|
||||
}
|
||||
|
||||
3
ccp/vars
3
ccp/vars
@ -5,7 +5,6 @@ FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | h
|
||||
FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
|
||||
SUPPORT_EMAIL=support-ccp@dkfz-heidelberg.de
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
PLATFORM=ccp
|
||||
|
||||
BROKER_URL_FOR_PREREQ=$BROKER_URL
|
||||
|
||||
@ -30,4 +29,4 @@ done
|
||||
idManagementSetup
|
||||
mtbaSetup
|
||||
obds2fhirRestSetup
|
||||
blazeSecondarySetup
|
||||
blazeSecondarySetup
|
||||
@ -1,66 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
blaze:
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:0.28
|
||||
container_name: bridgehead-dhki-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-dhki-blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
|
||||
DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
|
||||
DB_BLOCK_CACHE_SIZE: $BLAZE_MEMORY_CAP
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "blaze-data:/app/data"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.blaze_dhki.rule=PathPrefix(`/dhki-localdatamanagement`)"
|
||||
- "traefik.http.middlewares.dhki_b_strip.stripprefix.prefixes=/dhki-localdatamanagement"
|
||||
- "traefik.http.services.blaze_dhki.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.blaze_dhki.middlewares=dhki_b_strip,auth"
|
||||
- "traefik.http.routers.blaze_dhki.tls=true"
|
||||
|
||||
focus:
|
||||
image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
|
||||
container_name: bridgehead-focus
|
||||
environment:
|
||||
API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
BEAM_APP_ID_LONG: focus.${PROXY_ID}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
BLAZE_URL: "http://bridgehead-dhki-blaze:8080/fhir/"
|
||||
BEAM_PROXY_URL: http://beam-proxy:8081
|
||||
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
|
||||
EPSILON: 0.28
|
||||
QUERIES_TO_CACHE: '/queries_to_cache.conf'
|
||||
volumes:
|
||||
- /srv/docker/bridgehead/dhki/queries_to_cache.conf:/queries_to_cache.conf
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
|
||||
beam-proxy:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
container_name: bridgehead-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${BROKER_URL}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
ROOTCERT_FILE: /conf/root.crt.pem
|
||||
secrets:
|
||||
- proxy.pem
|
||||
depends_on:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/dhki/root.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
|
||||
volumes:
|
||||
blaze-data:
|
||||
|
||||
secrets:
|
||||
proxy.pem:
|
||||
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
@ -1,2 +0,0 @@
|
||||
bGlicmFyeSBSZXRyaWV2ZQp1c2luZyBGSElSIHZlcnNpb24gJzQuMC4wJwppbmNsdWRlIEZISVJIZWxwZXJzIHZlcnNpb24gJzQuMC4wJwpjb2Rlc3lzdGVtIFNhbXBsZU1hdGVyaWFsVHlwZTogJ2h0dHBzOi8vZmhpci5iYm1yaS5kZS9Db2RlU3lzdGVtL1NhbXBsZU1hdGVyaWFsVHlwZScKCmNvZGVzeXN0ZW0gbG9pbmM6ICdodHRwOi8vbG9pbmMub3JnJwoKY29udGV4dCBQYXRpZW50CgpES1RLX1NUUkFUX0dFTkRFUl9TVFJBVElGSUVSCgpES1RLX1NUUkFUX0FHRV9TVFJBVElGSUVSCgpES1RLX1NUUkFUX0RFQ0VBU0VEX1NUUkFUSUZJRVIKCkRLVEtfU1RSQVRfRElBR05PU0lTX1NUUkFUSUZJRVIKCkRIS0lfU1RSQVRfU1BFQ0lNRU5fU1RSQVRJRklFUgoKREtUS19TVFJBVF9QUk9DRURVUkVfU1RSQVRJRklFUgoKREhLSV9TVFJBVF9NRURJQ0FUSU9OX1NUUkFUSUZJRVIKCkRIS0lfU1RSQVRfRU5DT1VOVEVSX1NUUkFUSUZJRVIKREtUS19TVFJBVF9ERUZfSU5fSU5JVElBTF9QT1BVTEFUSU9OCnRydWU=
|
||||
bGlicmFyeSBSZXRyaWV2ZQp1c2luZyBGSElSIHZlcnNpb24gJzQuMC4wJwppbmNsdWRlIEZISVJIZWxwZXJzIHZlcnNpb24gJzQuMC4wJwpjb2Rlc3lzdGVtIFNhbXBsZU1hdGVyaWFsVHlwZTogJ2h0dHBzOi8vZmhpci5iYm1yaS5kZS9Db2RlU3lzdGVtL1NhbXBsZU1hdGVyaWFsVHlwZScKCmNvZGVzeXN0ZW0gbG9pbmM6ICdodHRwOi8vbG9pbmMub3JnJwpjb2Rlc3lzdGVtIGljZDEwOiAnaHR0cDovL2ZoaXIuZGUvQ29kZVN5c3RlbS9iZmFybS9pY2QtMTAtZ20nCmNvZGVzeXN0ZW0gbW9ycGg6ICd1cm46b2lkOjIuMTYuODQwLjEuMTEzODgzLjYuNDMuMScKCmNvbnRleHQgUGF0aWVudAoKREtUS19TVFJBVF9HRU5ERVJfU1RSQVRJRklFUgoKREtUS19TVFJBVF9BR0VfU1RSQVRJRklFUgoKREtUS19TVFJBVF9ERUNFQVNFRF9TVFJBVElGSUVSCgpES1RLX1NUUkFUX0RJQUdOT1NJU19TVFJBVElGSUVSCgpESEtJX1NUUkFUX1NQRUNJTUVOX1NUUkFUSUZJRVIKCkRLVEtfU1RSQVRfUFJPQ0VEVVJFX1NUUkFUSUZJRVIKCkRIS0lfU1RSQVRfTUVESUNBVElPTl9TVFJBVElGSUVSCgpESEtJX1NUUkFUX0VOQ09VTlRFUl9TVFJBVElGSUVSCkRLVEtfU1RSQVRfREVGX0lOX0lOSVRJQUxfUE9QVUxBVElPTgooKChleGlzdHMgW0NvbmRpdGlvbjogQ29kZSAnQzM0LjknIGZyb20gaWNkMTBdKSBvcgooZXhpc3RzIFtDb25kaXRpb246IENvZGUgJ0MzNC44JyBmcm9tIGljZDEwXSkgb3IKKGV4aXN0cyBbQ29uZGl0aW9uOiBDb2RlICdDMzQuMCcgZnJvbSBpY2QxMF0pIG9yCihleGlzdHMgW0NvbmRpdGlvbjogQ29kZSAnQzM0LjInIGZyb20gaWNkMTBdKSBvcgooZXhpc3RzIFtDb25kaXRpb246IENvZGUgJ0MzNC4xJyBmcm9tIGljZDEwXSkgb3IKKGV4aXN0cyBbQ29uZGl0aW9uOiBDb2RlICdDMzQuMycgZnJvbSBpY2QxMF0pKSBhbmQKKChleGlzdHMgZnJvbSBbT2JzZXJ2YXRpb246IENvZGUgJzU5ODQ3LTQnIGZyb20gbG9pbmNdIE8Kd2hlcmUgTy52YWx1ZS5jb2RpbmcuY29kZSBjb250YWlucyAnODE0MC8zJykgb3IKKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNTk4NDctNCcgZnJvbSBsb2luY10gTwp3aGVyZSBPLnZhbHVlLmNvZGluZy5jb2RlIGNvbnRhaW5zICc4MTQxLzMnKSBvcgooZXhpc3RzIGZyb20gW09ic2VydmF0aW9uOiBDb2RlICc1OTg0Ny00JyBmcm9tIGxvaW5jXSBPCndoZXJlIE8udmFsdWUuY29kaW5nLmNvZGUgY29udGFpbnMgJzgxNDMvMycpIG9yCihleGlzdHMgZnJvbSBbT2JzZXJ2YXRpb246IENvZGUgJzU5ODQ3LTQnIGZyb20gbG9pbmNdIE8Kd2hlcmUgTy52YWx1ZS5jb2RpbmcuY29kZSBjb250YWlucyAnODE0Ny8zJykgb3IKKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNTk4NDctNCcgZnJvbSBsb2luY10gTwp3aGVyZSBPLnZhbHVlLmNvZGluZy5jb2RlIGNvbnRhaW5zICc4MjUwLzMnKSBvcgooZXhpc3RzIGZyb20gW09ic2VydmF0aW9uOiBDb2RlICc1OTg0Ny00JyBmcm9tIGxvaW5jXSBPCndoZXJlIE8udmFsdWUuY29kaW5nLmNvZGUgY29udGFpbnMgJzgyNTEvMycpIG9yCihleGlzdHMgZnJvbSBbT2JzZXJ2YXRpb246IENvZGUgJzU5ODQ3LTQnIGZyb20gbG9pbmNdIE8Kd2hlcmUgTy52YWx1ZS5jb2RpbmcuY29kZSBjb250YWlucyAnODI1Mi8zJykgb3IKKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNTk4NDctNCcgZnJvbSBsb2luY10gTwp3aGVyZSBPLnZhbHVlLmNvZGluZy5jb2RlIGNvbnRhaW5zICc4MjUzLzMnKSBvcgooZXhpc3RzIGZyb20gW09ic2VydmF0aW9uOiBDb2RlICc1OTg0Ny00JyBmcm9tIGxvaW5jXSBPCndoZXJlIE8udmFsdWUuY29kaW5nLmNvZGUgY29udGFpbnMgJzgyNTUvMycpIG9yCihleGlzdHMgZnJvbSBbT2JzZXJ2YXRpb246IENvZGUgJzU5ODQ3LTQnIGZyb20gbG9pbmNdIE8Kd2hlcmUgTy52YWx1ZS5jb2RpbmcuY29kZSBjb250YWlucyAnODI2MC8zJykgb3IKKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNTk4NDctNCcgZnJvbSBsb2luY10gTwp3aGVyZSBPLnZhbHVlLmNvZGluZy5jb2RlIGNvbnRhaW5zICc4MzEwLzMnKSBvcgooZXhpc3RzIGZyb20gW09ic2VydmF0aW9uOiBDb2RlICc1OTg0Ny00JyBmcm9tIGxvaW5jXSBPCndoZXJlIE8udmFsdWUuY29kaW5nLmNvZGUgY29udGFpbnMgJzgzMzMvMycpIG9yCihleGlzdHMgZnJvbSBbT2JzZXJ2YXRpb246IENvZGUgJzU5ODQ3LTQnIGZyb20gbG9pbmNdIE8Kd2hlcmUgTy52YWx1ZS5jb2RpbmcuY29kZSBjb250YWlucyAnODQ3MC8zJykgb3IKKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNTk4NDctNCcgZnJvbSBsb2luY10gTwp3aGVyZSBPLnZhbHVlLmNvZGluZy5jb2RlIGNvbnRhaW5zICc4NDgwLzMnKSBvcgooZXhpc3RzIGZyb20gW09ic2VydmF0aW9uOiBDb2RlICc1OTg0Ny00JyBmcm9tIGxvaW5jXSBPCndoZXJlIE8udmFsdWUuY29kaW5nLmNvZGUgY29udGFpbnMgJzg0OTAvMycpIG9yCihleGlzdHMgZnJvbSBbT2JzZXJ2YXRpb246IENvZGUgJzU5ODQ3LTQnIGZyb20gbG9pbmNdIE8Kd2hlcmUgTy52YWx1ZS5jb2RpbmcuY29kZSBjb250YWlucyAnODU1MC8zJykgb3IKKGV4aXN0cyBmcm9tIFtPYnNlcnZhdGlvbjogQ29kZSAnNTk4NDctNCcgZnJvbSBsb2luY10gTwp3aGVyZSBPLnZhbHVlLmNvZGluZy5jb2RlIGNvbnRhaW5zICc4MDUyLzMnKSkp
|
||||
@ -1,20 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUSWUPebUMNfJvPKMjdgX+WiH+OXgwDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjQwMTA1MDg1NTM4WhcNMzQw
|
||||
MTAyMDg1NjA4WjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAL/nvo9Bn1/6Z/K4BKoLM6/mVziM4cmXTVx4npVz
|
||||
pnptwPPFU4rz47akRZ6ZMD5MO0bsyvaxG1nwVrW3aAGC42JIGTdZHKwMKrd35sxw
|
||||
k3YlGJagGUs+bKHUCL55OcSmyDWlh/UhA8+eeJWjOt9u0nYXv+vi+N4JSHA0oC9D
|
||||
bTF1v+7blrTQagf7PTPSF3pe22iXOjJYdOkZMWoMoNAjn6F958fkLNLY3csOZwvP
|
||||
/3eyNNawyAEPWeIm33Zk630NS8YHggz6WCqwXvuaKb6910mRP8jgauaYsqgsOyDt
|
||||
pbWuvk//aZWdGeN9RNsAA8eGppygiwm/m9eRC6I0shDwv6ECAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFFn/dbW1J3ry
|
||||
7TBzbKo3H4vJr2MiMB8GA1UdIwQYMBaAFFn/dbW1J3ry7TBzbKo3H4vJr2MiMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCa2V8B8aad
|
||||
XNDS1EUIi9oMdvGvkolcdFwx9fI++qu9xSIaZs5GETHck3oYKZF0CFP5ESnKDn5w
|
||||
enWgm5M0y+hVZppzB163WmET1efBXwrdyn8j4336NjX352h63JGWCaI2CfZ1qG1p
|
||||
kf5W9CVXllSFaJe5r994ovgyHvK2ucWwe8l8iMJbQhH79oKi/9uJMCD6aUXnpg1K
|
||||
nPHW1lsVx6foqYWijdBdtFU2i7LSH2OYo0nb1PgRnY/SABV63JHfJnqW9dZy4f7G
|
||||
rpsvvrmFrKmEnCZH0n6qveY3Z5bMD94Yx0ebkCTYEqAw3pV65gwxrzBTpEg6dgF0
|
||||
eG0eKFUS0REJ
|
||||
-----END CERTIFICATE-----
|
||||
20
dhki/vars
20
dhki/vars
@ -1,20 +0,0 @@
|
||||
BROKER_ID=broker.hector.dkfz.de
|
||||
BROKER_URL=https://${BROKER_ID}
|
||||
PROXY_ID=${SITE_ID}.${BROKER_ID}
|
||||
FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
|
||||
SUPPORT_EMAIL=support-ccp@dkfz-heidelberg.de
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
|
||||
BROKER_URL_FOR_PREREQ=$BROKER_URL
|
||||
|
||||
POSTGRES_TAG=15.6-alpine
|
||||
|
||||
for module in ccp/modules/*.sh
|
||||
do
|
||||
log DEBUG "sourcing $module"
|
||||
source $module
|
||||
done
|
||||
|
||||
idManagementSetup
|
||||
obds2fhirRestSetup
|
||||
@ -1,63 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
blaze:
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:0.28
|
||||
container_name: bridgehead-itcc-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-itcc-blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
|
||||
DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
|
||||
DB_BLOCK_CACHE_SIZE: $BLAZE_MEMORY_CAP
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "blaze-data:/app/data"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.blaze_itcc.rule=PathPrefix(`/itcc-localdatamanagement`)"
|
||||
- "traefik.http.middlewares.itcc_b_strip.stripprefix.prefixes=/itcc-localdatamanagement"
|
||||
- "traefik.http.services.blaze_itcc.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.blaze_itcc.middlewares=itcc_b_strip,auth"
|
||||
- "traefik.http.routers.blaze_itcc.tls=true"
|
||||
|
||||
focus:
|
||||
image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
|
||||
container_name: bridgehead-focus
|
||||
environment:
|
||||
API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
BEAM_APP_ID_LONG: focus.${PROXY_ID}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
BLAZE_URL: "http://bridgehead-itcc-blaze:8080/fhir/"
|
||||
BEAM_PROXY_URL: http://beam-proxy:8081
|
||||
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
|
||||
EPSILON: 0.28
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
|
||||
beam-proxy:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
|
||||
container_name: bridgehead-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${BROKER_URL}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
ROOTCERT_FILE: /conf/root.crt.pem
|
||||
secrets:
|
||||
- proxy.pem
|
||||
depends_on:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/itcc/root.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
|
||||
volumes:
|
||||
blaze-data:
|
||||
|
||||
secrets:
|
||||
proxy.pem:
|
||||
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
@ -1,33 +0,0 @@
|
||||
version: "3.7"
|
||||
services:
|
||||
landing:
|
||||
container_name: lens_federated-search
|
||||
image: docker.verbis.dkfz.de/ccp/lens:${SITE_ID}
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.landing.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.landing.tls=true"
|
||||
|
||||
spot:
|
||||
image: docker.verbis.dkfz.de/ccp-private/central-spot
|
||||
environment:
|
||||
BEAM_SECRET: "${FOCUS_BEAM_SECRET_SHORT}"
|
||||
BEAM_URL: http://beam-proxy:8081
|
||||
BEAM_PROXY_ID: ${SITE_ID}
|
||||
BEAM_BROKER_ID: ${BROKER_ID}
|
||||
BEAM_APP_ID: "focus"
|
||||
PROJECT_METADATA: "dktk_supervisors"
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.services.spot.loadbalancer.server.port=8080"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolalloworiginlist=https://${HOST}"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowcredentials=true"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolmaxage=-1"
|
||||
- "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/backend`)"
|
||||
- "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/backend"
|
||||
- "traefik.http.routers.spot.tls=true"
|
||||
- "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot"
|
||||
@ -1,5 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -n "$ENABLE_LENS" ];then
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/lens-compose.yml"
|
||||
fi
|
||||
@ -1,20 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUW34NEb7bl0+Ywx+I1VKtY5vpAOowDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjQwMTIyMTMzNzEzWhcNMzQw
|
||||
MTE5MTMzNzQzWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAL5UegLXTlq3XRRj8LyFs3aF0tpRPVoW9RXp5kFI
|
||||
TnBvyO6qjNbMDT/xK+4iDtEX4QQUvsxAKxfXbe9i1jpdwjgH7JHaSGm2IjAiKLqO
|
||||
OXQQtguWwfNmmp96Ql13ArLj458YH08xMO/w2NFWGwB/hfARa4z/T0afFuc/tKJf
|
||||
XbGCG9xzJ9tmcG45QN8NChGhVvaTweNdVxGWlpHxmi0Mn8OM9CEuB7nPtTTiBuiu
|
||||
pRC2zVVmNjVp4ktkAqL7IHOz+/F5nhiz6tOika9oD3376Xj055lPznLcTQn2+4d7
|
||||
K7ZrBopCFxIQPjkgmYRLfPejbpdUjK1UVJw7hbWkqWqH7JMCAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFGjvRcaIP4HM
|
||||
poIguUAK9YL2n7fbMB8GA1UdIwQYMBaAFGjvRcaIP4HMpoIguUAK9YL2n7fbMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCbzycJSaDm
|
||||
AXXNJqQ88djrKs5MDXS8RIjS/cu2ayuLaYDe+BzVmUXNA0Vt9nZGdaz63SLLcjpU
|
||||
fNSxBfKbwmf7s30AK8Cnfj9q4W/BlBeVizUHQsg1+RQpDIdMrRQrwkXv8mfLw+w5
|
||||
3oaXNW6W/8KpBp/H8TBZ6myl6jCbeR3T8EMXBwipMGop/1zkbF01i98Xpqmhx2+l
|
||||
n+80ofPsSspOo5XmgCZym8CD/m/oFHmjcvOfpOCvDh4PZ+i37pmbSlCYoMpla3u/
|
||||
7MJMP5lugfLBYNDN2p+V4KbHP/cApCDT5UWLOeAWjgiZQtHH5ilDeYqEc1oPjyJt
|
||||
Rtup0MTxSJtN
|
||||
-----END CERTIFICATE-----
|
||||
14
itcc/vars
14
itcc/vars
@ -1,14 +0,0 @@
|
||||
BROKER_ID=test-no-real-data.broker.samply.de
|
||||
BROKER_URL=https://${BROKER_ID}
|
||||
PROXY_ID=${SITE_ID}.${BROKER_ID}
|
||||
FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
|
||||
SUPPORT_EMAIL=arturo.macias@dkfz-heidelberg.de
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
BROKER_URL_FOR_PREREQ=$BROKER_URL
|
||||
|
||||
for module in $PROJECT/modules/*.sh
|
||||
do
|
||||
log DEBUG "sourcing $module"
|
||||
source $module
|
||||
done
|
||||
@ -1,67 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
landing:
|
||||
deploy:
|
||||
replicas: 0 #deactivate landing page
|
||||
|
||||
blaze:
|
||||
image: docker.verbis.dkfz.de/cache/samply/blaze:0.28
|
||||
container_name: bridgehead-kr-blaze
|
||||
environment:
|
||||
BASE_URL: "http://bridgehead-kr-blaze:8080"
|
||||
JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
|
||||
DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
|
||||
DB_BLOCK_CACHE_SIZE: $BLAZE_MEMORY_CAP
|
||||
ENFORCE_REFERENTIAL_INTEGRITY: "false"
|
||||
volumes:
|
||||
- "blaze-data:/app/data"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.blaze_kr.rule=PathPrefix(`/kr-localdatamanagement`)"
|
||||
- "traefik.http.middlewares.kr_b_strip.stripprefix.prefixes=/kr-localdatamanagement"
|
||||
- "traefik.http.services.blaze_kr.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.blaze_kr.middlewares=kr_b_strip,auth"
|
||||
- "traefik.http.routers.blaze_kr.tls=true"
|
||||
|
||||
focus:
|
||||
image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
|
||||
container_name: bridgehead-focus
|
||||
environment:
|
||||
API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
BEAM_APP_ID_LONG: focus.${PROXY_ID}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
BLAZE_URL: "http://bridgehead-kr-blaze:8080/fhir/"
|
||||
BEAM_PROXY_URL: http://beam-proxy:8081
|
||||
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
|
||||
EPSILON: 0.28
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
- "blaze"
|
||||
|
||||
beam-proxy:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
container_name: bridgehead-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${BROKER_URL}
|
||||
PROXY_ID: ${PROXY_ID}
|
||||
APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
|
||||
PRIVKEY_FILE: /run/secrets/proxy.pem
|
||||
ALL_PROXY: http://forward_proxy:3128
|
||||
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
|
||||
ROOTCERT_FILE: /conf/root.crt.pem
|
||||
secrets:
|
||||
- proxy.pem
|
||||
depends_on:
|
||||
- "forward_proxy"
|
||||
volumes:
|
||||
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
|
||||
- /srv/docker/bridgehead/kr/root.crt.pem:/conf/root.crt.pem:ro
|
||||
|
||||
|
||||
volumes:
|
||||
blaze-data:
|
||||
|
||||
secrets:
|
||||
proxy.pem:
|
||||
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
@ -1,35 +0,0 @@
|
||||
version: "3.7"
|
||||
services:
|
||||
landing:
|
||||
deploy:
|
||||
replicas: 1 #reactivate if lens is in use
|
||||
container_name: lens_federated-search
|
||||
image: docker.verbis.dkfz.de/ccp/lens:${SITE_ID}
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
|
||||
- "traefik.http.services.landing.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.landing.tls=true"
|
||||
|
||||
spot:
|
||||
image: docker.verbis.dkfz.de/ccp-private/central-spot
|
||||
environment:
|
||||
BEAM_SECRET: "${FOCUS_BEAM_SECRET_SHORT}"
|
||||
BEAM_URL: http://beam-proxy:8081
|
||||
BEAM_PROXY_ID: ${SITE_ID}
|
||||
BEAM_BROKER_ID: ${BROKER_ID}
|
||||
BEAM_APP_ID: "focus"
|
||||
PROJECT_METADATA: "kr_supervisors"
|
||||
depends_on:
|
||||
- "beam-proxy"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.services.spot.loadbalancer.server.port=8080"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolalloworiginlist=https://${HOST}"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowcredentials=true"
|
||||
- "traefik.http.middlewares.corsheaders2.headers.accesscontrolmaxage=-1"
|
||||
- "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/backend`)"
|
||||
- "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/backend"
|
||||
- "traefik.http.routers.spot.tls=true"
|
||||
- "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot"
|
||||
@ -1,5 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ -n "$ENABLE_LENS" ];then
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/lens-compose.yml"
|
||||
fi
|
||||
@ -1,20 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
obds2fhir-rest:
|
||||
container_name: bridgehead-obds2fhir-rest
|
||||
image: docker.verbis.dkfz.de/ccp/obds2fhir-rest:main
|
||||
environment:
|
||||
IDTYPE: BK_${IDMANAGEMENT_FRIENDLY_ID}_L-ID
|
||||
MAINZELLISTE_APIKEY: ${IDMANAGER_LOCAL_PATIENTLIST_APIKEY}
|
||||
SALT: ${LOCAL_SALT}
|
||||
KEEP_INTERNAL_ID: ${KEEP_INTERNAL_ID:-false}
|
||||
MAINZELLISTE_URL: ${PATIENTLIST_URL:-http://patientlist:8080/patientlist}
|
||||
restart: always
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.obds2fhir-rest.rule=PathPrefix(`/obds2fhir-rest`) || PathPrefix(`/adt2fhir-rest`)"
|
||||
- "traefik.http.middlewares.obds2fhir-rest_strip.stripprefix.prefixes=/obds2fhir-rest,/adt2fhir-rest"
|
||||
- "traefik.http.services.obds2fhir-rest.loadbalancer.server.port=8080"
|
||||
- "traefik.http.routers.obds2fhir-rest.tls=true"
|
||||
- "traefik.http.routers.obds2fhir-rest.middlewares=obds2fhir-rest_strip,auth"
|
||||
@ -1,13 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
function obds2fhirRestSetup() {
|
||||
if [ -n "$ENABLE_OBDS2FHIR_REST" ]; then
|
||||
log INFO "oBDS2FHIR-REST setup detected -- will start obds2fhir-rest module."
|
||||
if [ ! -n "$IDMANAGER_UPLOAD_APIKEY" ]; then
|
||||
log ERROR "Missing ID-Management Module! Fix this by setting up ID Management:"
|
||||
PATIENTLIST_URL=" "
|
||||
fi
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/obds2fhir-rest-compose.yml"
|
||||
LOCAL_SALT="$(echo \"local-random-salt\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
fi
|
||||
}
|
||||
@ -1,20 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDNTCCAh2gAwIBAgIUW34NEb7bl0+Ywx+I1VKtY5vpAOowDQYJKoZIhvcNAQEL
|
||||
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjQwMTIyMTMzNzEzWhcNMzQw
|
||||
MTE5MTMzNzQzWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAL5UegLXTlq3XRRj8LyFs3aF0tpRPVoW9RXp5kFI
|
||||
TnBvyO6qjNbMDT/xK+4iDtEX4QQUvsxAKxfXbe9i1jpdwjgH7JHaSGm2IjAiKLqO
|
||||
OXQQtguWwfNmmp96Ql13ArLj458YH08xMO/w2NFWGwB/hfARa4z/T0afFuc/tKJf
|
||||
XbGCG9xzJ9tmcG45QN8NChGhVvaTweNdVxGWlpHxmi0Mn8OM9CEuB7nPtTTiBuiu
|
||||
pRC2zVVmNjVp4ktkAqL7IHOz+/F5nhiz6tOika9oD3376Xj055lPznLcTQn2+4d7
|
||||
K7ZrBopCFxIQPjkgmYRLfPejbpdUjK1UVJw7hbWkqWqH7JMCAwEAAaN7MHkwDgYD
|
||||
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFGjvRcaIP4HM
|
||||
poIguUAK9YL2n7fbMB8GA1UdIwQYMBaAFGjvRcaIP4HMpoIguUAK9YL2n7fbMBYG
|
||||
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCbzycJSaDm
|
||||
AXXNJqQ88djrKs5MDXS8RIjS/cu2ayuLaYDe+BzVmUXNA0Vt9nZGdaz63SLLcjpU
|
||||
fNSxBfKbwmf7s30AK8Cnfj9q4W/BlBeVizUHQsg1+RQpDIdMrRQrwkXv8mfLw+w5
|
||||
3oaXNW6W/8KpBp/H8TBZ6myl6jCbeR3T8EMXBwipMGop/1zkbF01i98Xpqmhx2+l
|
||||
n+80ofPsSspOo5XmgCZym8CD/m/oFHmjcvOfpOCvDh4PZ+i37pmbSlCYoMpla3u/
|
||||
7MJMP5lugfLBYNDN2p+V4KbHP/cApCDT5UWLOeAWjgiZQtHH5ilDeYqEc1oPjyJt
|
||||
Rtup0MTxSJtN
|
||||
-----END CERTIFICATE-----
|
||||
16
kr/vars
16
kr/vars
@ -1,16 +0,0 @@
|
||||
BROKER_ID=test-no-real-data.broker.samply.de
|
||||
BROKER_URL=https://${BROKER_ID}
|
||||
PROXY_ID=${SITE_ID}.${BROKER_ID}
|
||||
FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
|
||||
FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
|
||||
SUPPORT_EMAIL=arturo.macias@dkfz-heidelberg.de
|
||||
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
|
||||
BROKER_URL_FOR_PREREQ=$BROKER_URL
|
||||
|
||||
for module in $PROJECT/modules/*.sh
|
||||
do
|
||||
log DEBUG "sourcing $module"
|
||||
source $module
|
||||
done
|
||||
|
||||
obds2fhirRestSetup
|
||||
@ -54,7 +54,7 @@ checkOwner(){
|
||||
|
||||
printUsage() {
|
||||
echo "Usage: bridgehead start|stop|logs|docker-logs|is-running|update|install|uninstall|adduser|enroll PROJECTNAME"
|
||||
echo "PROJECTNAME should be one of ccp|bbmri|cce|itcc|kr|dhki"
|
||||
echo "PROJECTNAME should be one of ccp|bbmri"
|
||||
}
|
||||
|
||||
checkRequirements() {
|
||||
@ -171,10 +171,8 @@ optimizeBlazeMemoryUsage() {
|
||||
if [ $available_system_memory_chunks -eq 0 ]; then
|
||||
log WARN "Only ${BLAZE_MEMORY_CAP} system memory available for Blaze. If your Blaze stores more than 128000 fhir ressources it will run significally slower."
|
||||
export BLAZE_RESOURCE_CACHE_CAP=128000;
|
||||
export BLAZE_CQL_CACHE_CAP=32;
|
||||
else
|
||||
export BLAZE_RESOURCE_CACHE_CAP=$((available_system_memory_chunks * 312500))
|
||||
export BLAZE_CQL_CACHE_CAP=$((($system_memory_in_mb/4)/16));
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
@ -35,12 +35,6 @@ if [ -z "$LDM_AUTH" ]; then
|
||||
add_basic_auth_user $PROJECT $generated_passwd "LDM_AUTH" $PROJECT
|
||||
fi
|
||||
|
||||
if [ "$ENABLE_EXPORTER" == true ]; then
|
||||
log "INFO" "Now generating basic auth for the quality reports. "
|
||||
generated_passwd="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 32)"
|
||||
add_basic_auth_user $PROJECT $generated_passwd "QR_AUTH" $PROJECT
|
||||
fi
|
||||
|
||||
if [ ! -z "$NNGM_CTS_APIKEY" ] && [ -z "$NNGM_AUTH" ]; then
|
||||
log "INFO" "Now generating basic auth for nNGM upload API (see adduser in bridgehead for more information). "
|
||||
generated_passwd="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 32)"
|
||||
|
||||
@ -52,21 +52,6 @@ case "$PROJECT" in
|
||||
bbmri)
|
||||
site_configuration_repository_middle="git.verbis.dkfz.de/bbmri-bridgehead-configs/"
|
||||
;;
|
||||
cce)
|
||||
site_configuration_repository_middle="git.verbis.dkfz.de/cce-sites/"
|
||||
;;
|
||||
itcc)
|
||||
site_configuration_repository_middle="git.verbis.dkfz.de/itcc-sites/"
|
||||
;;
|
||||
dhki)
|
||||
site_configuration_repository_middle="git.verbis.dkfz.de/dhki/"
|
||||
;;
|
||||
kr)
|
||||
site_configuration_repository_middle="git.verbis.dkfz.de/krebsregister-sites/"
|
||||
;;
|
||||
dhki)
|
||||
site_configuration_repository_middle="git.verbis.dkfz.de/dhki/"
|
||||
;;
|
||||
minimal)
|
||||
site_configuration_repository_middle="git.verbis.dkfz.de/minimal-bridgehead-configs/"
|
||||
;;
|
||||
|
||||
@ -3,16 +3,14 @@
|
||||
source lib/functions.sh
|
||||
|
||||
detectCompose
|
||||
CONFIG_DIR="/etc/bridgehead/"
|
||||
COMPONENT_DIR="/srv/docker/bridgehead/"
|
||||
|
||||
if ! id "bridgehead" &>/dev/null; then
|
||||
log ERROR "User bridgehead does not exist. Please run bridgehead install $PROJECT"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
checkOwner "${CONFIG_DIR}" bridgehead || exit 1
|
||||
checkOwner "${COMPONENT_DIR}" bridgehead || exit 1
|
||||
checkOwner /srv/docker/bridgehead bridgehead || exit 1
|
||||
checkOwner /etc/bridgehead bridgehead || exit 1
|
||||
|
||||
## Check if user is a su
|
||||
log INFO "Checking if all prerequisites are met ..."
|
||||
@ -34,31 +32,31 @@ fi
|
||||
log INFO "Checking configuration ..."
|
||||
|
||||
## Download submodule
|
||||
if [ ! -d "${CONFIG_DIR}" ]; then
|
||||
fail_and_report 1 "Please set up the config folder at ${CONFIG_DIR}. Instruction are in the readme."
|
||||
if [ ! -d "/etc/bridgehead/" ]; then
|
||||
fail_and_report 1 "Please set up the config folder at /etc/bridgehead. Instruction are in the readme."
|
||||
fi
|
||||
|
||||
# TODO: Check all required variables here in a generic loop
|
||||
|
||||
#check if project env is present
|
||||
if [ -d "${CONFIG_DIR}${PROJECT}.conf" ]; then
|
||||
fail_and_report 1 "Project config not found. Please copy the template from ${PROJECT} and put it under ${CONFIG_DIR}${PROJECT}.conf."
|
||||
if [ -d "/etc/bridgehead/${PROJECT}.conf" ]; then
|
||||
fail_and_report 1 "Project config not found. Please copy the template from ${PROJECT} and put it under /etc/bridgehead-config/${PROJECT}.conf."
|
||||
fi
|
||||
|
||||
# TODO: Make sure you're in the right directory, or, even better, be independent from the working directory.
|
||||
|
||||
log INFO "Checking ssl cert for accessing bridgehead via https"
|
||||
|
||||
if [ ! -d "${CONFIG_DIR}traefik-tls" ]; then
|
||||
if [ ! -d "/etc/bridgehead/traefik-tls" ]; then
|
||||
log WARN "TLS certs for accessing bridgehead via https missing, we'll now create a self-signed one. Please consider getting an officially signed one (e.g. via Let's Encrypt ...) and put into /etc/bridgehead/traefik-tls"
|
||||
mkdir -p /etc/bridgehead/traefik-tls
|
||||
fi
|
||||
|
||||
if [ ! -e "${CONFIG_DIR}traefik-tls/fullchain.pem" ]; then
|
||||
if [ ! -e "/etc/bridgehead/traefik-tls/fullchain.pem" ]; then
|
||||
openssl req -x509 -newkey rsa:4096 -nodes -keyout /etc/bridgehead/traefik-tls/privkey.pem -out /etc/bridgehead/traefik-tls/fullchain.pem -days 3650 -subj "/CN=$HOST"
|
||||
fi
|
||||
|
||||
if [ -e "${CONFIG_DIR}"vault.conf ]; then
|
||||
if [ -e /etc/bridgehead/vault.conf ]; then
|
||||
if [ "$(stat -c "%a %U" /etc/bridgehead/vault.conf)" != "600 bridgehead" ]; then
|
||||
fail_and_report 1 "/etc/bridgehead/vault.conf has wrong owner/permissions. To correct this issue, run chmod 600 /etc/bridgehead/vault.conf && chown bridgehead /etc/bridgehead/vault.conf."
|
||||
fi
|
||||
@ -66,7 +64,7 @@ fi
|
||||
|
||||
log INFO "Checking network access ($BROKER_URL_FOR_PREREQ) ..."
|
||||
|
||||
source "${CONFIG_DIR}${PROJECT}".conf
|
||||
source /etc/bridgehead/${PROJECT}.conf
|
||||
source ${PROJECT}/vars
|
||||
|
||||
if [ "${PROJECT}" != "minimal" ]; then
|
||||
@ -94,10 +92,10 @@ if [ "${PROJECT}" != "minimal" ]; then
|
||||
fi
|
||||
fi
|
||||
checkPrivKey() {
|
||||
if [ -e "${CONFIG_DIR}pki/${SITE_ID}.priv.pem" ]; then
|
||||
if [ -e /etc/bridgehead/pki/${SITE_ID}.priv.pem ]; then
|
||||
log INFO "Success - private key found."
|
||||
else
|
||||
log ERROR "Unable to find private key at ${CONFIG_DIR}pki/${SITE_ID}.priv.pem. To fix, please run\n bridgehead enroll ${PROJECT}\nand follow the instructions."
|
||||
log ERROR "Unable to find private key at /etc/bridgehead/pki/${SITE_ID}.priv.pem. To fix, please run\n bridgehead enroll ${PROJECT}\nand follow the instructions."
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
@ -109,11 +107,6 @@ else
|
||||
checkPrivKey || exit 1
|
||||
fi
|
||||
|
||||
for dir in "${CONFIG_DIR}" "${COMPONENT_DIR}"; do
|
||||
log INFO "Checking branch: $(cd $dir && echo "$dir $(git branch --show-current)")"
|
||||
hc_send log "Checking branch: $(cd $dir && echo "$dir $(git branch --show-current)")"
|
||||
done
|
||||
|
||||
log INFO "Success - all prerequisites are met!"
|
||||
hc_send log "Success - all prerequisites are met!"
|
||||
|
||||
|
||||
@ -10,17 +10,18 @@ services:
|
||||
- --providers.docker=true
|
||||
- --providers.docker.exposedbydefault=false
|
||||
- --providers.file.directory=/configuration/
|
||||
- --api.dashboard=false
|
||||
- --api.dashboard=true
|
||||
- --accesslog=true
|
||||
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
||||
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard/`)"
|
||||
- "traefik.http.routers.dashboard.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
- "traefik.http.routers.dashboard.entrypoints=websecure"
|
||||
- "traefik.http.routers.dashboard.service=api@internal"
|
||||
- "traefik.http.routers.dashboard.tls=true"
|
||||
- "traefik.http.routers.dashboard.middlewares=auth"
|
||||
- "traefik.http.middlewares.auth.basicauth.users=${LDM_AUTH}"
|
||||
ports:
|
||||
- 80:80
|
||||
- 443:443
|
||||
|
||||
@ -2,7 +2,7 @@ version: "3.7"
|
||||
|
||||
services:
|
||||
dnpm-beam-proxy:
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
|
||||
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
|
||||
container_name: bridgehead-dnpm-beam-proxy
|
||||
environment:
|
||||
BROKER_URL: ${DNPM_BROKER_URL}
|
||||
|
||||
@ -1,6 +0,0 @@
|
||||
# Full Excel Export
|
||||
curl --location --request POST 'https://${HOST}/${PROJECT}-exporter/request?query=Patient&query-format=FHIR_PATH&template-id=${PROJECT}&output-format=EXCEL' \
|
||||
--header 'x-api-key: ${EXPORT_API_KEY}'
|
||||
|
||||
# QB
|
||||
curl --location --request POST 'https://${HOST}/${PROJECT}-reporter/generate?template-id=${PROJECT}'
|
||||
@ -1,73 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
exporter:
|
||||
image: docker.verbis.dkfz.de/ccp/dktk-exporter:latest
|
||||
container_name: bridgehead-${PROJECT}-exporter
|
||||
environment:
|
||||
JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
|
||||
LOG_LEVEL: "INFO"
|
||||
EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh
|
||||
CROSS_ORIGINS: "https://${HOST}"
|
||||
EXPORTER_DB_USER: "exporter"
|
||||
EXPORTER_DB_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
|
||||
EXPORTER_DB_URL: "jdbc:postgresql://exporter-db:5432/exporter"
|
||||
HTTP_RELATIVE_PATH: "/${PROJECT}-exporter"
|
||||
SITE: "${SITE_ID}"
|
||||
HTTP_SERVLET_REQUEST_SCHEME: "https"
|
||||
OPAL_PASSWORD: "${EXPORTER_OPAL_PASSWORD}"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.exporter_${PROJECT}.rule=PathPrefix(`/${PROJECT}-exporter`)"
|
||||
- "traefik.http.services.exporter_${PROJECT}.loadbalancer.server.port=8092"
|
||||
- "traefik.http.routers.exporter_${PROJECT}.tls=true"
|
||||
- "traefik.http.middlewares.exporter_${PROJECT}_strip.stripprefix.prefixes=/${PROJECT}-exporter"
|
||||
- "traefik.http.routers.exporter_${PROJECT}.middlewares=exporter_${PROJECT}_strip"
|
||||
- "traefik.http.routers.connector.middlewares=connector_strip,auth-qr"
|
||||
volumes:
|
||||
- "/var/cache/bridgehead/${PROJECT}/exporter-files:/app/exporter-files/output"
|
||||
|
||||
|
||||
exporter-db:
|
||||
image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
|
||||
container_name: bridgehead-${PROJECT}-exporter-db
|
||||
environment:
|
||||
POSTGRES_USER: "exporter"
|
||||
POSTGRES_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
|
||||
POSTGRES_DB: "exporter"
|
||||
volumes:
|
||||
# Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer.
|
||||
- "/var/cache/bridgehead/${PROJECT}/exporter-db:/var/lib/postgresql/data"
|
||||
|
||||
reporter:
|
||||
image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest
|
||||
container_name: bridgehead-${PROJECT}-reporter
|
||||
environment:
|
||||
JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
|
||||
LOG_LEVEL: "INFO"
|
||||
CROSS_ORIGINS: "https://${HOST}"
|
||||
HTTP_RELATIVE_PATH: "/${PROJECT}-reporter"
|
||||
SITE: "${SITE_ID}"
|
||||
EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh
|
||||
EXPORTER_URL: "http://exporter:8092"
|
||||
LOG_FHIR_VALIDATION: "false"
|
||||
HTTP_SERVLET_REQUEST_SCHEME: "https"
|
||||
|
||||
# In this initial development state of the bridgehead, we are trying to have so many volumes as possible.
|
||||
# However, in the first executions in the CCP sites, this volume seems to be very important. A report is
|
||||
# a process that can take several hours, because it depends on the exporter.
|
||||
# There is a risk that the bridgehead restarts, losing the already created export.
|
||||
|
||||
volumes:
|
||||
- "/var/cache/bridgehead/${PROJECT}/reporter-files:/app/reports"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.reporter_${PROJECT}.rule=PathPrefix(`/${PROJECT}-reporter`)"
|
||||
- "traefik.http.services.reporter_${PROJECT}.loadbalancer.server.port=8095"
|
||||
- "traefik.http.routers.reporter_${PROJECT}.tls=true"
|
||||
- "traefik.http.middlewares.reporter_${PROJECT}_strip.stripprefix.prefixes=/${PROJECT}-reporter"
|
||||
- "traefik.http.routers.reporter_${PROJECT}.middlewares=reporter_${PROJECT}_strip"
|
||||
|
||||
traefik:
|
||||
labels:
|
||||
- "traefik.http.middlewares.auth-qr.basicauth.users=${QR_AUTH}"
|
||||
@ -1,8 +0,0 @@
|
||||
#!/bin/bash -e
|
||||
|
||||
if [ "$ENABLE_EXPORTER" == true ]; then
|
||||
log INFO "Exporter setup detected -- will start Exporter service."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/exporter-compose.yml"
|
||||
EXPORTER_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
|
||||
EXPORTER_API_KEY="$(echo \"This is a salt string to generate one consistent API KEY for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 64)"
|
||||
fi
|
||||
@ -1,15 +0,0 @@
|
||||
# Exporter and Reporter
|
||||
|
||||
|
||||
## Exporter
|
||||
The exporter is a REST API that exports the data of the different databases of the bridgehead in a set of tables.
|
||||
It can accept different output formats as CSV, Excel, JSON or XML. It can also export data into Opal.
|
||||
|
||||
## Exporter-DB
|
||||
It is a database to save queries for its execution in the exporter.
|
||||
The exporter manages also the different executions of the same query in through the database.
|
||||
|
||||
## Reporter
|
||||
This component is a plugin of the exporter that allows to create more complex Excel reports described in templates.
|
||||
It is compatible with different template engines as Groovy, Thymeleaf,...
|
||||
It is perfect to generate a document as our traditional CCP quality report.
|
||||
@ -1,82 +0,0 @@
|
||||
version: "3.7"
|
||||
|
||||
services:
|
||||
|
||||
teiler-orchestrator:
|
||||
image: docker.verbis.dkfz.de/cache/samply/teiler-orchestrator:latest
|
||||
container_name: bridgehead-teiler-orchestrator
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.teiler_orchestrator_${PROJECT}.rule=PathPrefix(`/${PROJECT}-teiler`)"
|
||||
- "traefik.http.services.teiler_orchestrator_${PROJECT}.loadbalancer.server.port=9000"
|
||||
- "traefik.http.routers.teiler_orchestrator_${PROJECT}.tls=true"
|
||||
- "traefik.http.middlewares.teiler_orchestrator_${PROJECT}_strip.stripprefix.prefixes=/${PROJECT}-teiler"
|
||||
- "traefik.http.routers.teiler_orchestrator_${PROJECT}.middlewares=teiler_orchestrator_${PROJECT}_strip"
|
||||
environment:
|
||||
TEILER_BACKEND_URL: "https://${HOST}/${PROJECT}-teiler-backend"
|
||||
TEILER_DASHBOARD_URL: "https://${HOST}/${PROJECT}-teiler-dashboard"
|
||||
DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE_LOWER_CASE}"
|
||||
HTTP_RELATIVE_PATH: "/${PROJECT}-teiler"
|
||||
|
||||
teiler-dashboard:
|
||||
#image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
|
||||
image: docker.verbis.dkfz.de/ccp/samply/teiler-dashboard:bbmri
|
||||
container_name: bridgehead-teiler-dashboard
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.teiler_dashboard_${PROJECT}.rule=PathPrefix(`/${PROJECT}-teiler-dashboard`)"
|
||||
- "traefik.http.services.teiler_dashboard_${PROJECT}.loadbalancer.server.port=80"
|
||||
- "traefik.http.routers.teiler_dashboard_${PROJECT}.tls=true"
|
||||
- "traefik.http.middlewares.teiler_dashboard_${PROJECT}_strip.stripprefix.prefixes=/${PROJECT}-teiler-dashboard"
|
||||
- "traefik.http.routers.teiler_dashboard_${PROJECT}.middlewares=teiler_dashboard_${PROJECT}_strip"
|
||||
environment:
|
||||
DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
|
||||
TEILER_BACKEND_URL: "https://${HOST}/${PROJECT}-teiler-backend"
|
||||
OIDC_URL: "${OIDC_URL}"
|
||||
OIDC_REALM: "${OIDC_REALM}"
|
||||
OIDC_CLIENT_ID: "${OIDC_PUBLIC_CLIENT_ID}"
|
||||
OIDC_TOKEN_GROUP: "${OIDC_GROUP_CLAIM}"
|
||||
TEILER_ADMIN_NAME: "${OPERATOR_FIRST_NAME} ${OPERATOR_LAST_NAME}"
|
||||
TEILER_ADMIN_EMAIL: "${OPERATOR_EMAIL}"
|
||||
TEILER_ADMIN_PHONE: "${OPERATOR_PHONE}"
|
||||
TEILER_PROJECT: "${PROJECT}"
|
||||
EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
|
||||
TEILER_ORCHESTRATOR_URL: "https://${HOST}/${PROJECT}-teiler"
|
||||
TEILER_DASHBOARD_HTTP_RELATIVE_PATH: "/${PROJECT}-teiler-dashboard"
|
||||
TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/${PROJECT}-teiler"
|
||||
TEILER_USER: "${OIDC_USER_GROUP}"
|
||||
TEILER_ADMIN: "${OIDC_ADMIN_GROUP}"
|
||||
REPORTER_DEFAULT_TEMPLATE_ID: "${PROJECT}-qb"
|
||||
EXPORTER_DEFAULT_TEMPLATE_ID: "${PROJECT}"
|
||||
|
||||
|
||||
teiler-backend:
|
||||
image: docker.verbis.dkfz.de/ccp/${PROJECT}-teiler-backend:latest
|
||||
container_name: bridgehead-teiler-backend
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.teiler_backend_${PROJECT}.rule=PathPrefix(`/${PROJECT}-teiler-backend`)"
|
||||
- "traefik.http.services.teiler_backend_${PROJECT}.loadbalancer.server.port=8085"
|
||||
- "traefik.http.routers.teiler_backend_${PROJECT}.tls=true"
|
||||
- "traefik.http.middlewares.teiler_backend_${PROJECT}_strip.stripprefix.prefixes=/${PROJECT}-teiler-backend"
|
||||
- "traefik.http.routers.teiler_backend_${PROJECT}.middlewares=teiler_backend_${PROJECT}_strip"
|
||||
environment:
|
||||
LOG_LEVEL: "INFO"
|
||||
APPLICATION_PORT: "8085"
|
||||
APPLICATION_ADDRESS: "${HOST}"
|
||||
DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
|
||||
CONFIG_ENV_VAR_PATH: "/run/secrets/project-conf"
|
||||
TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/${PROJECT}-teiler"
|
||||
TEILER_ORCHESTRATOR_URL: "https://${HOST}/${PROJECT}-teiler"
|
||||
TEILER_DASHBOARD_DE_URL: "https://${HOST}/${PROJECT}-teiler-dashboard/de"
|
||||
TEILER_DASHBOARD_EN_URL: "https://${HOST}/${PROJECT}-teiler-dashboard/en"
|
||||
CENTRAX_URL: "${CENTRAXX_URL}"
|
||||
HTTP_PROXY: "http://forward_proxy:3128"
|
||||
ENABLE_MTBA: "${ENABLE_MTBA}"
|
||||
ENABLE_DATASHIELD: "${ENABLE_DATASHIELD}"
|
||||
secrets:
|
||||
- project-conf
|
||||
|
||||
secrets:
|
||||
project-conf:
|
||||
file: "/etc/bridgehead/${PROJECT}.conf"
|
||||
@ -1,9 +0,0 @@
|
||||
#!/bin/bash -e
|
||||
|
||||
if [ "$ENABLE_TEILER" == true ];then
|
||||
log INFO "Teiler setup detected -- will start Teiler services."
|
||||
OVERRIDE+=" -f ./$PROJECT/modules/teiler-compose.yml"
|
||||
TEILER_DEFAULT_LANGUAGE=DE
|
||||
TEILER_DEFAULT_LANGUAGE_LOWER_CASE=${TEILER_DEFAULT_LANGUAGE,,}
|
||||
add_public_oidc_redirect_url "/${PROJECT}-teiler/*"
|
||||
fi
|
||||
@ -1,19 +0,0 @@
|
||||
# Teiler
|
||||
This module orchestrates the different microfrontends of the bridgehead as a single page application.
|
||||
|
||||
## Teiler Orchestrator
|
||||
Single SPA component that consists on the root HTML site of the single page application and a javascript code that
|
||||
gets the information about the microfrontend calling the teiler backend and is responsible for registering them. With the
|
||||
resulting mapping, it can initialize, mount and unmount the required microfrontends on the fly.
|
||||
|
||||
The microfrontends run independently in different containers and can be based on different frameworks (Angular, Vue, React,...)
|
||||
This microfrontends can run as single alone but need an extension with Single-SPA (https://single-spa.js.org/docs/ecosystem).
|
||||
There are also available three templates (Angular, Vue, React) to be directly extended to be used directly in the teiler.
|
||||
|
||||
## Teiler Dashboard
|
||||
It consists on the main dashboard and a set of embedded services.
|
||||
### Login
|
||||
user and password in ccp.local.conf
|
||||
|
||||
## Teiler Backend
|
||||
In this component, the microfrontends are configured.
|
||||
Reference in New Issue
Block a user