Compare commits

..

6 Commits

Author SHA1 Message Date
djuarezgf
90d6993877 mtba: fallback to keycloak test server pending migration 2025-07-24 09:25:16 +02:00
djuarezgf
e037d8a8bc feat: migrate PSP to Authentik (#329) 2025-07-24 09:25:16 +02:00
Jan
930612221d feat(dnpm): allow setting custom dnpm image tag (#326) 2025-07-24 09:25:16 +02:00
djuarezgf
03e3260f68 Fixed: Authentik URL for Opal (#328)
* Fixed: Authentik URL for Opal

* Removed: Unnecessary OIDC config in CCE and BBMRI

* KR with basic auth instead of OIDC
2025-07-24 09:25:16 +02:00
djuarezgf
64e53f0905 feat: migrate OIDC Configuration from Keycloak to Authentik (#327)
* Change: Authentik instead of Keycloak in CCP

Co-authored-by: Jan <59206115+Threated@users.noreply.github.com>

---------

Co-authored-by: Jan <59206115+Threated@users.noreply.github.com>
2025-07-24 09:25:16 +02:00
p.delpy@dkfz-heidelberg.de
1da0a35626 fix: add pscc changes 2025-07-03 07:27:15 +02:00
24 changed files with 236 additions and 28 deletions

View File

@@ -85,8 +85,6 @@ The following URLs need to be accessible (prefix with `https://`):
* hub.docker.com
* registry-1.docker.io
* production.cloudflare.docker.com
* GitHub Container Registry - (for use of DNPM:DIP)
* ghcr.io
* To report bridgeheads operational status
* healthchecks.verbis.dkfz.de
* only for DKTK/CCP
@@ -97,7 +95,7 @@ The following URLs need to be accessible (prefix with `https://`):
* only for German Biobank Node
* broker.bbmri.de
> 📝 This URL list is subject to change. Instead of the individual names, we highly recommend whitelisting wildcard domains: *.dkfz.de, github.com, *.docker.com, *.docker.io, *.ghcr.io, *.samply.de, *.bbmri.de.
> 📝 This URL list is subject to change. Instead of the individual names, we highly recommend whitelisting wildcard domains: *.dkfz.de, github.com, *.docker.com, *.docker.io, *.samply.de, *.bbmri.de.
> 📝 Ubuntu's pre-installed uncomplicated firewall (ufw) is known to conflict with Docker, more info [here](https://github.com/chaifeng/ufw-docker).

View File

@@ -19,7 +19,7 @@ services:
HTTP_RELATIVE_PATH: "/bbmri-teiler"
teiler-dashboard:
image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:${TEILER_DASHBOARD_TAG}
image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
container_name: bridgehead-teiler-dashboard
labels:
- "traefik.enable=true"

View File

@@ -35,6 +35,9 @@ case "$PROJECT" in
cce)
#nothing extra to do
;;
pscc)
#nothing extra to do
;;
itcc)
#nothing extra to do
;;

View File

@@ -0,0 +1,65 @@
version: "3.7"
services:
blaze-pscc:
image: docker.verbis.dkfz.de/cache/samply/blaze:${BLAZE_TAG}
container_name: bridgehead-pscc-blaze
environment:
BASE_URL: "http://bridgehead-pscc-blaze:8080"
JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
DB_BLOCK_CACHE_SIZE: ${BLAZE_MEMORY_CAP}
CQL_EXPR_CACHE_SIZE: ${BLAZE_CQL_CACHE_CAP:-32}
ENFORCE_REFERENTIAL_INTEGRITY: "false"
volumes:
- "blaze-data-pscc:/app/data"
labels:
- "traefik.enable=true"
- "traefik.http.routers.blaze_pscc.rule=PathPrefix(`/pscc-localdatamanagement`)"
- "traefik.http.middlewares.pscc_b_strip.stripprefix.prefixes=/pscc-localdatamanagement"
- "traefik.http.services.blaze_pscc.loadbalancer.server.port=8080"
- "traefik.http.routers.blaze_pscc.middlewares=pscc_b_strip"
- "traefik.http.routers.blaze_pscc.tls=true"
focus-pscc:
image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
container_name: bridgehead-pscc-focus
environment:
API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
BEAM_APP_ID_LONG: focus.${PROXY_ID_PSCC}
PROXY_ID: ${PROXY_ID_PSCC}
BLAZE_URL: "http://bridgehead-pscc-blaze:8080/fhir/"
BEAM_PROXY_URL: http://beam-proxy-pscc:8081
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
EPSILON: 0.28
ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
depends_on:
- "beam-proxy"
- "blaze"
beam-proxy-pscc:
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
container_name: bridgehead-pscc-beam-proxy
environment:
BROKER_URL: ${BROKER_URL_PSCC}
PROXY_ID: ${PROXY_ID_PSCC}
APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
PRIVKEY_FILE: /run/secrets/proxy.pem
ALL_PROXY: http://forward_proxy:3128
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
ROOTCERT_FILE: /conf/root.crt.pem
secrets:
- proxy.pem
depends_on:
- "forward_proxy"
volumes:
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
- /srv/docker/bridgehead/pscc/root.crt.pem:/conf/root.crt.pem:ro
volumes:
blaze-data-pscc:
secrets:
proxy.pem:
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

View File

@@ -0,0 +1,5 @@
#!/bin/bash
if [ -n "$ENABLE_PSCC" ];then
OVERRIDE+=" -f ./$PROJECT/modules/pscc-compose.yml"
fi

View File

@@ -19,7 +19,7 @@ services:
HTTP_RELATIVE_PATH: "/cce-teiler"
teiler-dashboard:
image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:${TEILER_DASHBOARD_TAG}
image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
container_name: bridgehead-teiler-dashboard
labels:
- "traefik.enable=true"

View File

@@ -1,6 +1,9 @@
BROKER_ID=test-no-real-data.broker.samply.de
BROKER_ID_PSCC=test-no-real-data.broker.samply.de
BROKER_URL=https://${BROKER_ID}
BROKER_URL_PSCC=https://${BROKER_ID}
PROXY_ID=${SITE_ID}.${BROKER_ID}
PROXY_ID_PSCC=${SITE_ID}.${BROKER_ID_PSCC}
FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
SUPPORT_EMAIL=manoj.waikar@dkfz-heidelberg.de

View File

@@ -43,7 +43,7 @@ services:
- "traefik.http.routers.dnpm-auth.tls=true"
dnpm-portal:
image: ghcr.io/dnpm-dip/portal:${DNPM_IMAGE_TAG:-latest}
image: ghcr.io/dnpm-dip/portal:{DNPM_IMAGE_TAG:-latest}
container_name: bridgehead-dnpm-portal
environment:
- NUXT_API_URL=http://dnpm-backend:9000/
@@ -58,7 +58,7 @@ services:
dnpm-backend:
container_name: bridgehead-dnpm-backend
image: ghcr.io/dnpm-dip/backend:${DNPM_IMAGE_TAG:-latest}
image: ghcr.io/dnpm-dip/backend:{DNPM_IMAGE_TAG:-latest}
environment:
- LOCAL_SITE=${ZPM_SITE}:${SITE_NAME} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen
- RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}

View File

@@ -2,7 +2,7 @@ version: "3.7"
services:
mtba:
image: docker.verbis.dkfz.de/cache/samply/mtba:${MTBA_TAG}
image: docker.verbis.dkfz.de/cache/samply/mtba:develop
container_name: bridgehead-mtba
environment:
BLAZE_STORE_URL: http://blaze:8080

View File

@@ -19,7 +19,7 @@ services:
HTTP_RELATIVE_PATH: "/ccp-teiler"
teiler-dashboard:
image: docker.verbis.dkfz.de/ccp/samply/teiler-dashboard:test
image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
container_name: bridgehead-teiler-dashboard
labels:
- "traefik.enable=true"
@@ -42,12 +42,14 @@ services:
EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
TEILER_ORCHESTRATOR_URL: "/ccp-teiler"
TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/ccp-teiler"
TEILER_USER: "${OIDC_USER_GROUP}"
TEILER_ADMIN: "${OIDC_ADMIN_GROUP}"
REPORTER_DEFAULT_TEMPLATE_ID: "ccp-qb"
EXPORTER_DEFAULT_TEMPLATE_ID: "ccp"
teiler-backend:
image: docker.verbis.dkfz.de/ccp/dktk-teiler-backend:test
image: docker.verbis.dkfz.de/ccp/dktk-teiler-backend:latest
container_name: bridgehead-teiler-backend
labels:
- "traefik.enable=true"
@@ -68,7 +70,3 @@ services:
ENABLE_MTBA: "${ENABLE_MTBA}"
ENABLE_DATASHIELD: "${ENABLE_DATASHIELD}"
IDMANAGER_UPLOAD_APIKEY: "${IDMANAGER_UPLOAD_APIKEY}" # Only used to check if the ID Manager is active
TEILER_ROLE_USER: "${OIDC_USER_GROUP}"
TEILER_ROLE_ADMIN: "${OIDC_ADMIN_GROUP}"
TEILER_ROLE_PSP: "${OIDC_PSP_GROUP}"

View File

@@ -39,7 +39,7 @@ services:
- "blaze"
beam-proxy:
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
container_name: bridgehead-beam-proxy
environment:
BROKER_URL: ${BROKER_URL}

View File

@@ -40,7 +40,7 @@ services:
- "blaze"
beam-proxy:
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
container_name: bridgehead-beam-proxy
environment:
BROKER_URL: ${BROKER_URL}

View File

@@ -19,7 +19,7 @@ services:
HTTP_RELATIVE_PATH: "/kr-teiler"
teiler-dashboard:
image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:${TEILER_DASHBOARD_TAG}
image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
container_name: bridgehead-teiler-dashboard
labels:
- "traefik.enable=true"

View File

@@ -55,6 +55,9 @@ case "$PROJECT" in
cce)
site_configuration_repository_middle="git.verbis.dkfz.de/cce-sites/"
;;
pscc)
site_configuration_repository_middle="git.verbis.dkfz.de/pscc-sites/"
;;
itcc)
site_configuration_repository_middle="git.verbis.dkfz.de/itcc-sites/"
;;

View File

@@ -59,3 +59,4 @@ services:
PROJECT: ${PROJECT}
SITE_NAME: ${SITE_NAME}
ENVIRONMENT: ${ENVIRONMENT}
profiles: [deactivated]

View File

@@ -43,7 +43,7 @@ services:
- "traefik.http.routers.dnpm-auth.tls=true"
dnpm-portal:
image: ghcr.io/dnpm-dip/portal:${DNPM_IMAGE_TAG:-latest}
image: ghcr.io/dnpm-dip/portal:{DNPM_IMAGE_TAG:-latest}
container_name: bridgehead-dnpm-portal
environment:
- NUXT_API_URL=http://dnpm-backend:9000/
@@ -58,7 +58,7 @@ services:
dnpm-backend:
container_name: bridgehead-dnpm-backend
image: ghcr.io/dnpm-dip/backend:${DNPM_IMAGE_TAG:-latest}
image: ghcr.io/dnpm-dip/backend:{DNPM_IMAGE_TAG:-latest}
environment:
- LOCAL_SITE=${ZPM_SITE}:${SITE_NAME} # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen
- RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}

65
pscc/docker-compose.yml Normal file
View File

@@ -0,0 +1,65 @@
version: "3.7"
services:
blaze:
image: docker.verbis.dkfz.de/cache/samply/blaze:${BLAZE_TAG}
container_name: bridgehead-pscc-blaze
environment:
BASE_URL: "http://bridgehead-pscc-blaze:8080"
JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
DB_BLOCK_CACHE_SIZE: ${BLAZE_MEMORY_CAP}
CQL_EXPR_CACHE_SIZE: ${BLAZE_CQL_CACHE_CAP:-32}
ENFORCE_REFERENTIAL_INTEGRITY: "false"
volumes:
- "blaze-data:/app/data"
labels:
- "traefik.enable=true"
- "traefik.http.routers.blaze_pscc.rule=PathPrefix(`/pscc-localdatamanagement`)"
- "traefik.http.middlewares.pscc_b_strip.stripprefix.prefixes=/pscc-localdatamanagement"
- "traefik.http.services.blaze_pscc.loadbalancer.server.port=8080"
- "traefik.http.routers.blaze_pscc.middlewares=pscc_b_strip,auth"
- "traefik.http.routers.blaze_pscc.tls=true"
focus:
image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
container_name: bridgehead-focus
environment:
API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
BEAM_APP_ID_LONG: focus.${PROXY_ID}
PROXY_ID: ${PROXY_ID}
BLAZE_URL: "http://bridgehead-pscc-blaze:8080/fhir/"
BEAM_PROXY_URL: http://beam-proxy:8081
RETRY_COUNT: ${FOCUS_RETRY_COUNT}
EPSILON: 0.28
ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
depends_on:
- "beam-proxy"
- "blaze"
beam-proxy:
image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
container_name: bridgehead-beam-proxy
environment:
BROKER_URL: ${BROKER_URL}
PROXY_ID: ${PROXY_ID}
APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
PRIVKEY_FILE: /run/secrets/proxy.pem
ALL_PROXY: http://forward_proxy:3128
TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
ROOTCERT_FILE: /conf/root.crt.pem
secrets:
- proxy.pem
depends_on:
- "forward_proxy"
volumes:
- /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
- /srv/docker/bridgehead/pscc/root.crt.pem:/conf/root.crt.pem:ro
volumes:
blaze-data:
secrets:
proxy.pem:
file: /etc/bridgehead/pki/${SITE_ID}.priv.pem

View File

@@ -0,0 +1,34 @@
version: "3.7"
services:
landing:
container_name: lens_federated-search
image: docker.verbis.dkfz.de/dashboard/pscc-explorer
labels:
- "traefik.enable=true"
- "traefik.http.routers.landing.rule=PathPrefix(`/`)"
- "traefik.http.services.landing.loadbalancer.server.port=5173"
- "traefik.http.routers.landing.middlewares=auth"
- "traefik.http.routers.landing.tls=true"
# spot:
# image: docker.verbis.dkfz.de/ccp-private/central-spot
# environment:
# BEAM_SECRET: "${FOCUS_BEAM_SECRET_SHORT}"
# BEAM_URL: http://beam-proxy:8081
# BEAM_PROXY_ID: ${SITE_ID}
# BEAM_BROKER_ID: ${BROKER_ID}
# BEAM_APP_ID: "focus"
# PROJECT_METADATA: "cce_supervisors"
# depends_on:
# - "beam-proxy"
# labels:
# - "traefik.enable=true"
# - "traefik.http.services.spot.loadbalancer.server.port=8080"
# - "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
# - "traefik.http.middlewares.corsheaders2.headers.accesscontrolalloworiginlist=https://${HOST}"
# - "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowcredentials=true"
# - "traefik.http.middlewares.corsheaders2.headers.accesscontrolmaxage=-1"
# - "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/backend`)"
# - "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/backend"
# - "traefik.http.routers.spot.tls=true"
# - "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot"

View File

@@ -0,0 +1,5 @@
#!/bin/bash
if [ -n "$ENABLE_LENS" ];then
OVERRIDE+=" -f ./$PROJECT/modules/lens-compose.yml"
fi

20
pscc/root.crt.pem Normal file
View File

@@ -0,0 +1,20 @@
-----BEGIN CERTIFICATE-----
MIIDNTCCAh2gAwIBAgIUW34NEb7bl0+Ywx+I1VKtY5vpAOowDQYJKoZIhvcNAQEL
BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjQwMTIyMTMzNzEzWhcNMzQw
MTE5MTMzNzQzWjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBAL5UegLXTlq3XRRj8LyFs3aF0tpRPVoW9RXp5kFI
TnBvyO6qjNbMDT/xK+4iDtEX4QQUvsxAKxfXbe9i1jpdwjgH7JHaSGm2IjAiKLqO
OXQQtguWwfNmmp96Ql13ArLj458YH08xMO/w2NFWGwB/hfARa4z/T0afFuc/tKJf
XbGCG9xzJ9tmcG45QN8NChGhVvaTweNdVxGWlpHxmi0Mn8OM9CEuB7nPtTTiBuiu
pRC2zVVmNjVp4ktkAqL7IHOz+/F5nhiz6tOika9oD3376Xj055lPznLcTQn2+4d7
K7ZrBopCFxIQPjkgmYRLfPejbpdUjK1UVJw7hbWkqWqH7JMCAwEAAaN7MHkwDgYD
VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFGjvRcaIP4HM
poIguUAK9YL2n7fbMB8GA1UdIwQYMBaAFGjvRcaIP4HMpoIguUAK9YL2n7fbMBYG
A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCbzycJSaDm
AXXNJqQ88djrKs5MDXS8RIjS/cu2ayuLaYDe+BzVmUXNA0Vt9nZGdaz63SLLcjpU
fNSxBfKbwmf7s30AK8Cnfj9q4W/BlBeVizUHQsg1+RQpDIdMrRQrwkXv8mfLw+w5
3oaXNW6W/8KpBp/H8TBZ6myl6jCbeR3T8EMXBwipMGop/1zkbF01i98Xpqmhx2+l
n+80ofPsSspOo5XmgCZym8CD/m/oFHmjcvOfpOCvDh4PZ+i37pmbSlCYoMpla3u/
7MJMP5lugfLBYNDN2p+V4KbHP/cApCDT5UWLOeAWjgiZQtHH5ilDeYqEc1oPjyJt
Rtup0MTxSJtN
-----END CERTIFICATE-----

14
pscc/vars Normal file
View File

@@ -0,0 +1,14 @@
BROKER_ID=test-no-real-data.broker.samply.de
BROKER_URL=https://${BROKER_ID}
PROXY_ID=${SITE_ID}.${BROKER_ID}
FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
SUPPORT_EMAIL=denis.koether@dkfz-heidelberg.de
PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
BROKER_URL_FOR_PREREQ=$BROKER_URL
for module in $PROJECT/modules/*.sh
do
log DEBUG "sourcing $module"
source $module
done

View File

@@ -1,6 +1,4 @@
FOCUS_TAG=develop
BEAM_TAG=develop
BLAZE_TAG=main
POSTGRES_TAG=15.13-alpine
TEILER_DASHBOARD_TAG=develop
MTBA_TAG=develop
POSTGRES_TAG=15.13-alpine

View File

@@ -1,6 +1,4 @@
FOCUS_TAG=main
BEAM_TAG=main
BLAZE_TAG=0.32
POSTGRES_TAG=15.13-alpine
TEILER_DASHBOARD_TAG=main
MTBA_TAG=main
POSTGRES_TAG=15.13-alpine

View File

@@ -1,6 +1,4 @@
FOCUS_TAG=develop
BEAM_TAG=develop
BLAZE_TAG=main
POSTGRES_TAG=15.13-alpine
TEILER_DASHBOARD_TAG=develop
MTBA_TAG=develop
POSTGRES_TAG=15.13-alpine