Changes to make deployed CCE explorer work properly. (#368 )

* Changes to make deployed CCE explorer work properly. In the lens environment section in services: - add PUBLIC_SPOT_URL value
update beam proxy server used for oauth enrollment (#366 )
2026-04-17 17:20:15 +02:00 · 2026-01-28 13:40:51 +01:00 · 2026-01-28 13:40:51 +01:00 · 2026-01-28 13:40:51 +01:00 · 2026-01-28 13:40:51 +01:00 · 2026-01-28 13:40:51 +01:00
28 changed files with 519 additions and 28 deletions
--- a/README.md
+++ b/README.md
@@ -318,6 +318,12 @@ To enable it, you will need to explicitly set the username and password variable
 DS_DIRECTORY_USER_NAME=your_directory_username
 DS_DIRECTORY_USER_PASS=your_directory_password
 ```
+Alternatively, if you have obtained a token from the Directory, you can insert the following into the configuration file:
+```
+DS_DIRECTORY_USER_TOKEN=your_directory_token
+```
+If you don't supply any authentification information (either login credentials or a token), Directory sync will not start.
+
 Please contact your National Node or Directory support (directory-dev@helpdesk.bbmri-eric.eu) to obtain these credentials.

 The following environment variables can be used from within your config file to control the behavior of Directory sync:
@@ -325,12 +331,13 @@ The following environment variables can be used from within your config file to
 | Variable                           | Purpose                                                                                                                                                              | Default if not specified               |
 |:-----------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------|
 | DS_DIRECTORY_URL                   | Base URL of the Directory                                                                                                                                            | https://directory-backend.molgenis.net |
-| DS_DIRECTORY_USER_NAME             | User name for logging in to Directory **Mandatory**                                                                                                                  |                                        |
-| DS_DIRECTORY_USER_PASS             | Password for logging in to Directory **Mandatory**                                                                                                                   |                                        |
+| DS_DIRECTORY_USER_NAME             | User name for logging in to Directory                                                                                                                                |                                        |
+| DS_DIRECTORY_USER_PASS             | Password for logging in to Directory                                                                                                                                 |                                        |
+| DS_DIRECTORY_USER_TOKEN            | Token for logging in to Directory                                                                                                                                    |                                        |
 | DS_DIRECTORY_DEFAULT_COLLECTION_ID | ID of collection to be used if not in samples                                                                                                                        |                                        |
 | DS_DIRECTORY_ALLOW_STAR_MODEL      | Set to 'True' to send star model info to Directory                                                                                                                   | True                                  |
 | DS_FHIR_STORE_URL                  | URL for FHIR store                                                                                                                                                   | http://bridgehead-bbmri-blaze:8080     |
-| DS_TIMER_CRON                      | Execution interval for Directory sync, [cron](https://crontab.guru) format                                                                                           | 0 22 * * *                             |
+| DS_TIMER_CRON                      | Execution interval for Directory sync, [cron](https://crontab.guru) format                                                                                           | 30 22 * * *                            |
 | DS_IMPORT_BIOBANKS                 | Set to 'True' to import biobank metadata from Directory                                                                                                              | True                                  |
 | DS_IMPORT_COLLECTIONS              | Set to 'True' to import collection metadata from Directory                                                                                                           | True                                  |

--- a/bbmri/modules/directory-sync-compose.yml
+++ b/bbmri/modules/directory-sync-compose.yml
@@ -7,7 +7,8 @@ services:
      DS_DIRECTORY_URL: ${DS_DIRECTORY_URL:-https://directory.bbmri-eric.eu}
      DS_DIRECTORY_USER_NAME: ${DS_DIRECTORY_USER_NAME}
      DS_DIRECTORY_USER_PASS: ${DS_DIRECTORY_USER_PASS}
-      DS_TIMER_CRON: ${DS_TIMER_CRON:-0 22 * * *}
+      DS_DIRECTORY_USER_TOKEN: ${DS_DIRECTORY_USER_TOKEN}
+      DS_TIMER_CRON: ${DS_TIMER_CRON:-30 22 * * *}
      DS_DIRECTORY_ALLOW_STAR_MODEL: ${DS_DIRECTORY_ALLOW_STAR_MODEL:-true}
      DS_DIRECTORY_MOCK: ${DS_DIRECTORY_MOCK}
      DS_DIRECTORY_DEFAULT_COLLECTION_ID: ${DS_DIRECTORY_DEFAULT_COLLECTION_ID}
@@ -16,3 +17,6 @@ services:
      DS_IMPORT_COLLECTIONS: ${DS_IMPORT_COLLECTIONS:-true}
    depends_on:
      - "blaze"
+    volumes:
+      - /etc/localtime:/etc/localtime:ro # inherit host timezone
+      - /etc/timezone:/etc/timezone:ro   # inherit host timezone name
--- a/bbmri/modules/eric-compose.yml
+++ b/bbmri/modules/eric-compose.yml
@@ -11,6 +11,7 @@ services:
      BLAZE_URL: "http://blaze:8080/fhir/"
      BEAM_PROXY_URL: http://beam-proxy-eric:8081
      RETRY_COUNT: ${FOCUS_RETRY_COUNT}
+      OBFUSCATE_BBMRI_ERIC_WAY: "true"
    depends_on:
      - "beam-proxy-eric"
      - "blaze"
--- a/6
+++ b/6
@@ -35,6 +35,9 @@ case "$PROJECT" in
 	cce)
 		#nothing extra to do
 		;;
+	pscc)
+		#nothing extra to do
+		;;
 	itcc)
 		#nothing extra to do
 		;;
@@ -44,6 +47,9 @@ case "$PROJECT" in
 	dhki)
 		#nothing extra to do
 		;;
+	nngm)
+		#nothing extra to do
+		;;
 	minimal)
 		#nothing extra to do
 		;;
--- a/cce/docker-compose.yml
+++ b/cce/docker-compose.yml
@@ -22,7 +22,7 @@ services:
      - "traefik.http.routers.blaze_cce.tls=true"

  focus:
-    image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}-dktk
+    image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
    container_name: bridgehead-focus
    environment:
      API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
@@ -34,7 +34,6 @@ services:
      EPSILON: 0.28
      QUERIES_TO_CACHE: '/queries_to_cache.conf'
      ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
-      CQL_PROJECTS_ENABLED: "cce"
    volumes:
      - /srv/docker/bridgehead/cce/queries_to_cache.conf:/queries_to_cache.conf:ro
    depends_on:
--- a/cce/modules/airgapped-blaze-compose.yml
+++ b/cce/modules/airgapped-blaze-compose.yml
@@ -0,0 +1,25 @@
+version: "3.7"
+
+services:
+  blaze-airgapped:
+    image: docker.verbis.dkfz.de/cache/samply/blaze:${BLAZE_TAG}
+    container_name: bridgehead-cce-blaze-airgapped
+    environment:
+      BASE_URL: "http://bridgehead-cce-blaze-airgapped:8080"
+      JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
+      DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
+      DB_BLOCK_CACHE_SIZE: ${BLAZE_MEMORY_CAP}
+      CQL_EXPR_CACHE_SIZE: ${BLAZE_CQL_CACHE_CAP:-32}
+      ENFORCE_REFERENTIAL_INTEGRITY: "false"
+    volumes:
+      - "blaze-airgapped-data:/app/data"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.blaze-airgapped_cce.rule=PathPrefix(`/cce-localdatamanagement-airgapped`)"
+      - "traefik.http.middlewares.cce_b-a_strip.stripprefix.prefixes=/cce-localdatamanagement-airgapped"
+      - "traefik.http.services.blaze-airgapped_cce.loadbalancer.server.port=8080"
+      - "traefik.http.routers.blaze-airgapped_cce.middlewares=cce_b-a_strip,auth"
+      - "traefik.http.routers.blaze-airgapped_cce.tls=true"
+
+volumes:
+  blaze-airgapped-data:
--- a/cce/modules/airgapped-blaze-setup.sh
+++ b/cce/modules/airgapped-blaze-setup.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+OVERRIDE+=" -f ./$PROJECT/modules/airgapped-blaze-compose.yml"
--- a/cce/modules/lens-compose.yml
+++ b/cce/modules/lens-compose.yml
@@ -1,33 +1,46 @@
 version: "3.7"
 services:
-  landing:
+  lens:
    container_name: lens_federated-search
-    image: docker.verbis.dkfz.de/ccp/lens:${SITE_ID}
+    image: samply/cce-explorer:main
+    environment:
+      PUBLIC_SPOT_URL: https://${HOST}/prod
    labels:
+      - "traefik.http.services.lens.loadbalancer.server.port=3000"
      - "traefik.enable=true"
-      - "traefik.http.routers.landing.rule=PathPrefix(`/`)"
-      - "traefik.http.services.landing.loadbalancer.server.port=80"
-      - "traefik.http.routers.landing.tls=true"
+      - "traefik.http.routers.lens.rule=Host(`${HOST}`)"
+      - "traefik.http.routers.lens.tls=true"

  spot:
-    image: docker.verbis.dkfz.de/ccp-private/central-spot
+    image: samply/rustyspot:latest
    environment:
+      HTTP_PROXY: ${HTTP_PROXY_URL}
+      HTTPS_PROXY: ${HTTPS_PROXY_URL}
+      NO_PROXY: beam-proxy
      BEAM_SECRET: "${FOCUS_BEAM_SECRET_SHORT}"
-      BEAM_URL: http://beam-proxy:8081
-      BEAM_PROXY_ID: ${SITE_ID}
-      BEAM_BROKER_ID: ${BROKER_ID}
-      BEAM_APP_ID: "focus"
-      PROJECT_METADATA: "cce"
+      BEAM_PROXY_URL: http://beam-proxy:8081
+      BEAM_APP_ID: "spot.${SITE_ID}.${BROKER_ID}"
+      CORS_ORIGIN: "https://${HOST}"
+      SITES: ${SITES}
+      TRANSFORM: LENS
+      PROJECT: cce
+      BIND_ADDR: 0.0.0.0:8055
    depends_on:
      - "beam-proxy"
    labels:
      - "traefik.enable=true"
-      - "traefik.http.services.spot.loadbalancer.server.port=8080"
+      - "traefik.http.services.spot.loadbalancer.server.port=8055"
      - "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
+      - "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowheaders=content-type"
      - "traefik.http.middlewares.corsheaders2.headers.accesscontrolalloworiginlist=https://${HOST}"
      - "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowcredentials=true"
      - "traefik.http.middlewares.corsheaders2.headers.accesscontrolmaxage=-1"
-      - "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/backend`)"
-      - "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/backend"
+      - "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/prod`)"
+      - "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/prod"
      - "traefik.http.routers.spot.tls=true"
      - "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot,auth"
+
+  beam-proxy:
+    environment:
+      APP_spot_KEY: ${FOCUS_BEAM_SECRET_SHORT}
+      
--- a/cce/vars
+++ b/cce/vars
@@ -11,4 +11,4 @@ for module in $PROJECT/modules/*.sh
 do
    log DEBUG "sourcing $module"
    source $module
-done
+done
--- a/ccp/modules/dnpm-node-compose.yml
+++ b/ccp/modules/dnpm-node-compose.yml
@@ -66,6 +66,7 @@ services:
      - HATEOAS_HOST=https://${HOST}
      - CONNECTOR_TYPE=broker
      - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
+      - TZ=Europe/Berlin
    volumes:
      - /etc/bridgehead/dnpm/config:/dnpm_config
      - /var/cache/bridgehead/dnpm/backend-data:/dnpm_data
--- a/itcc/docker-compose.yml
+++ b/itcc/docker-compose.yml
@@ -22,7 +22,7 @@ services:
      - "traefik.http.routers.blaze_itcc.tls=true"

  focus:
-    image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}-dktk
+    image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
    container_name: bridgehead-focus
    environment:
      API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
--- a/lib/functions.sh
+++ b/lib/functions.sh
@@ -54,7 +54,7 @@ checkOwner(){

 printUsage() {
 	echo "Usage: bridgehead start|stop|logs|docker-logs|is-running|update|check|install|uninstall|adduser|enroll PROJECTNAME"
-	echo "PROJECTNAME should be one of ccp|bbmri|cce|itcc|kr|dhki"
+	echo "PROJECTNAME should be one of ccp|bbmri|cce|itcc|kr|dhki|nngm"
 }

 checkRequirements() {
@@ -327,7 +327,7 @@ function sync_secrets() {
        -e ALL_PROXY=$HTTPS_PROXY_FULL_URL \
        -e PROXY_ID=$proxy_id \
        -e BROKER_URL=$broker_url \
-        -e OIDC_PROVIDER=secret-sync-central.test-secret-sync.$broker_id \
+        -e OIDC_PROVIDER=secret-sync-central.central-secret-sync.$broker_id \
        -e SECRET_DEFINITIONS=$secret_sync_args \
        docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest

@@ -338,6 +338,7 @@ function sync_secrets() {

 function secret_sync_gitlab_token() {
    if [[ "$PROJECT" != "dktk" && "$PROJECT" != "bbmri" ]]; then
+        log "INFO" "Not running Secret Sync for project minimal"
        return
    fi
    # Map the origin of the git repository /etc/bridgehead to the prefix recognized by Secret Sync
@@ -397,7 +398,7 @@ function secret_sync_gitlab_token() {
    else
        log "WARN" "Secret Sync failed"
        # Remove the git credential helper
-        git -C /etc/bridgehead config --unset credential.helpera
+        git -C /etc/bridgehead config --unset credential.helper
    fi

    # In the past the git credential helper was also set for /srv/docker/bridgehead but never used.
--- a/lib/prepare-system.sh
+++ b/lib/prepare-system.sh
@@ -55,6 +55,9 @@ case "$PROJECT" in
 	cce)
 		site_configuration_repository_middle="git.verbis.dkfz.de/cce-sites/"
 		;;
+	pscc)
+		site_configuration_repository_middle="git.verbis.dkfz.de/pscc-sites/"
+		;;
 	itcc)
 		site_configuration_repository_middle="git.verbis.dkfz.de/itcc-sites/"
        ;;
@@ -67,6 +70,9 @@ case "$PROJECT" in
 	dhki)
 		site_configuration_repository_middle="git.verbis.dkfz.de/dhki/"
 		;;
+	nngm)
+		site_configuration_repository_middle="git.verbis.dkfz.de/nngm/"
+		;;
 	minimal)
 		site_configuration_repository_middle="git.verbis.dkfz.de/minimal-bridgehead-configs/"
 		;;
--- a/minimal/modules/dnpm-node-compose.yml
+++ b/minimal/modules/dnpm-node-compose.yml
@@ -66,6 +66,7 @@ services:
      - HATEOAS_HOST=https://${HOST}
      - CONNECTOR_TYPE=broker
      - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
+      - TZ=Europe/Berlin
    volumes:
      - /etc/bridgehead/dnpm/config:/dnpm_config
      - /var/cache/bridgehead/dnpm/backend-data:/dnpm_data
--- a/nngm/docker-compose.yml
+++ b/nngm/docker-compose.yml
@@ -0,0 +1,65 @@
+version: "3.7"
+
+services:
+  blaze:
+    image: docker.verbis.dkfz.de/cache/samply/blaze:${BLAZE_TAG}
+    container_name: bridgehead-nngm-blaze
+    environment:
+      BASE_URL: "http://bridgehead-nngm-blaze:8080"
+      JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
+      DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
+      DB_BLOCK_CACHE_SIZE: ${BLAZE_MEMORY_CAP}
+      CQL_EXPR_CACHE_SIZE: ${BLAZE_CQL_CACHE_CAP:-32}
+      ENFORCE_REFERENTIAL_INTEGRITY: "false"
+    volumes:
+      - "blaze-data:/app/data"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.blaze_nngm.rule=PathPrefix(`/nngm-localdatamanagement`)"
+      - "traefik.http.middlewares.nngm_b_strip.stripprefix.prefixes=/nngm-localdatamanagement"
+      - "traefik.http.services.blaze_nngm.loadbalancer.server.port=8080"
+      - "traefik.http.routers.blaze_nngm.middlewares=nngm_b_strip,auth"
+      - "traefik.http.routers.blaze_nngm.tls=true"
+
+  focus:
+    image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
+    container_name: bridgehead-focus
+    environment:
+    - API_KEY=${FOCUS_BEAM_SECRET_SHORT}
+    - BEAM_APP_ID_LONG=focus.${PROXY_ID}
+    - PROXY_ID=${PROXY_ID}
+    - BLAZE_URL=http://bridgehead-nngm-blaze:8080/fhir/
+    - BEAM_PROXY_URL=http://beam-proxy:8081
+    - RETRY_COUNT=${FOCUS_RETRY_COUNT}
+    - EPSILON=0.28
+    - ENDPOINT_TYPE=${FOCUS_ENDPOINT_TYPE:-blaze}
+    - CQL_PROJECTS_ENABLED
+    depends_on:
+      - "beam-proxy"
+      - "blaze"
+
+  beam-proxy:
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
+    container_name: bridgehead-beam-proxy
+    environment:
+      BROKER_URL: ${BROKER_URL}
+      PROXY_ID: ${PROXY_ID}
+      APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
+      PRIVKEY_FILE: /run/secrets/proxy.pem
+      ALL_PROXY: http://forward_proxy:3128
+      TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
+      ROOTCERT_FILE: /conf/root.crt.pem
+    secrets:
+      - proxy.pem
+    depends_on:
+      - "forward_proxy"
+    volumes:
+      - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
+      - /srv/docker/bridgehead/nngm/root.crt.pem:/conf/root.crt.pem:ro
+
+volumes:
+  blaze-data:
+
+secrets:
+  proxy.pem:
+    file: /etc/bridgehead/pki/${SITE_ID}.priv.pem
--- a/nngm/modules/exporter-compose.yml
+++ b/nngm/modules/exporter-compose.yml
@@ -0,0 +1,72 @@
+version: "3.7"
+
+services:
+  exporter:
+    image: docker.verbis.dkfz.de/ccp/dktk-exporter:latest
+    container_name: bridgehead-nngm-exporter
+    environment:
+      JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
+      LOG_LEVEL: "INFO"
+      EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh
+      CROSS_ORIGINS: "https://${HOST}"
+      EXPORTER_DB_USER: "exporter"
+      EXPORTER_DB_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
+      EXPORTER_DB_URL: "jdbc:postgresql://exporter-db:5432/exporter"
+      HTTP_RELATIVE_PATH: "/nngm-exporter"
+      SITE: "${SITE_ID}"
+      HTTP_SERVLET_REQUEST_SCHEME: "https"
+      OPAL_PASSWORD: "${EXPORTER_OPAL_PASSWORD}"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.exporter_nngm.rule=PathPrefix(`/nngm-exporter`)"
+      - "traefik.http.services.exporter_nngm.loadbalancer.server.port=8092"
+      - "traefik.http.routers.exporter_nngm.tls=true"
+      - "traefik.http.middlewares.exporter_nngm_strip.stripprefix.prefixes=/nngm-exporter"
+      - "traefik.http.routers.exporter_nngm.middlewares=exporter_nngm_strip"
+    volumes:
+      - "/var/cache/bridgehead/nngm/exporter-files:/app/exporter-files/output"
+
+  exporter-db:
+    image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
+    container_name: bridgehead-nngm-exporter-db
+    environment:
+      POSTGRES_USER: "exporter"
+      POSTGRES_PASSWORD: "${EXPORTER_DB_PASSWORD}" # Set in exporter-setup.sh
+      POSTGRES_DB: "exporter"
+    volumes:
+      # Consider removing this volume once we find a solution to save Lens-queries to be executed in the explorer.
+      - "/var/cache/bridgehead/nngm/exporter-db:/var/lib/postgresql/data"
+
+  reporter:
+    image: docker.verbis.dkfz.de/ccp/dktk-reporter:latest
+    container_name: bridgehead-nngm-reporter
+    environment:
+      JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC"
+      LOG_LEVEL: "INFO"
+      CROSS_ORIGINS: "https://${HOST}"
+      HTTP_RELATIVE_PATH: "/nngm-reporter"
+      SITE: "${SITE_ID}"
+      EXPORTER_API_KEY: "${EXPORTER_API_KEY}" # Set in exporter-setup.sh
+      EXPORTER_URL: "http://exporter:8092"
+      LOG_FHIR_VALIDATION: "false"
+      HTTP_SERVLET_REQUEST_SCHEME: "https"
+
+    # In this initial development state of the bridgehead, we are trying to have so many volumes as possible.
+    # However, in the first executions in the CCP sites, this volume seems to be very important. A report is
+    # a process that can take several hours, because it depends on the exporter.
+    # There is a risk that the bridgehead restarts, losing the already created export.
+
+    volumes:
+      - "/var/cache/bridgehead/nngm/reporter-files:/app/reports"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.reporter_nngm.rule=PathPrefix(`/nngm-reporter`)"
+      - "traefik.http.services.reporter_nngm.loadbalancer.server.port=8095"
+      - "traefik.http.routers.reporter_nngm.tls=true"
+      - "traefik.http.middlewares.reporter_nngm_strip.stripprefix.prefixes=/nngm-reporter"
+      - "traefik.http.routers.reporter_nngm.middlewares=reporter_nngm_strip"
+
+  focus:
+    environment:
+      EXPORTER_URL: "http://exporter:8092"
+      EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
--- a/nngm/modules/exporter-setup.sh
+++ b/nngm/modules/exporter-setup.sh
@@ -0,0 +1,8 @@
+#!/bin/bash -e
+
+if [ "$ENABLE_EXPORTER" == true ]; then
+  log INFO "Exporter setup detected -- will start Exporter service."
+  OVERRIDE+=" -f ./$PROJECT/modules/exporter-compose.yml"
+  EXPORTER_DB_PASSWORD="$(echo \"This is a salt string to generate one consistent password for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
+  EXPORTER_API_KEY="$(echo \"This is a salt string to generate one consistent API KEY for the exporter. It is not required to be secret.\" | sha1sum | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 64)"
+fi
--- a/nngm/modules/teiler-compose.yml
+++ b/nngm/modules/teiler-compose.yml
@@ -0,0 +1,73 @@
+version: "3.7"
+
+services:
+
+  teiler-orchestrator:
+    image: docker.verbis.dkfz.de/cache/samply/teiler-orchestrator:latest
+    container_name: bridgehead-teiler-orchestrator
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.teiler_orchestrator_nngm.rule=PathPrefix(`/nngm-teiler`)"
+      - "traefik.http.services.teiler_orchestrator_nngm.loadbalancer.server.port=9000"
+      - "traefik.http.routers.teiler_orchestrator_nngm.tls=true"
+      - "traefik.http.middlewares.teiler_orchestrator_nngm_strip.stripprefix.prefixes=/nngm-teiler"
+      - "traefik.http.routers.teiler_orchestrator_nngm.middlewares=teiler_orchestrator_nngm_strip"
+    environment:
+      TEILER_BACKEND_URL: "/nngm-teiler-backend"
+      TEILER_DASHBOARD_URL: "/nngm-teiler-dashboard"
+      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE_LOWER_CASE}"
+      HTTP_RELATIVE_PATH: "/nngm-teiler"
+
+  teiler-dashboard:
+    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:${TEILER_DASHBOARD_TAG}
+    container_name: bridgehead-teiler-dashboard
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.teiler_dashboard_nngm.rule=PathPrefix(`/nngm-teiler-dashboard`)"
+      - "traefik.http.services.teiler_dashboard_nngm.loadbalancer.server.port=80"
+      - "traefik.http.routers.teiler_dashboard_nngm.tls=true"
+      - "traefik.http.middlewares.teiler_dashboard_nngm_strip.stripprefix.prefixes=/nngm-teiler-dashboard"
+      - "traefik.http.routers.teiler_dashboard_nngm.middlewares=teiler_dashboard_nngm_strip"
+    environment:
+      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
+      TEILER_BACKEND_URL: "/nngm-teiler-backend"
+      TEILER_DASHBOARD_URL: "/nngm-teiler-dashboard"
+      OIDC_URL: "${OIDC_URL}"
+      OIDC_CLIENT_ID: "${OIDC_PUBLIC_CLIENT_ID}"
+      OIDC_TOKEN_GROUP: "${OIDC_GROUP_CLAIM}"
+      TEILER_ADMIN_NAME: "${OPERATOR_FIRST_NAME} ${OPERATOR_LAST_NAME}"
+      TEILER_ADMIN_EMAIL: "${OPERATOR_EMAIL}"
+      TEILER_ADMIN_PHONE: "${OPERATOR_PHONE}"
+      TEILER_PROJECT: "${PROJECT}"
+      EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
+      TEILER_ORCHESTRATOR_URL: "/nngm-teiler"
+      TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/nngm-teiler"
+      TEILER_USER: "${OIDC_USER_GROUP}"
+      TEILER_ADMIN: "${OIDC_ADMIN_GROUP}"
+      REPORTER_DEFAULT_TEMPLATE_ID: "ccp-qb"
+      EXPORTER_DEFAULT_TEMPLATE_ID: "ccp"
+
+
+# TODO: Replace dktk-teiler-backend with nngm-teiler-backend
+  teiler-backend:
+    image: docker.verbis.dkfz.de/ccp/dktk-teiler-backend:latest
+    container_name: bridgehead-teiler-backend
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.teiler_backend_nngm.rule=PathPrefix(`/nngm-teiler-backend`)"
+      - "traefik.http.services.teiler_backend_nngm.loadbalancer.server.port=8085"
+      - "traefik.http.routers.teiler_backend_nngm.tls=true"
+      - "traefik.http.middlewares.teiler_backend_nngm_strip.stripprefix.prefixes=/nngm-teiler-backend"
+      - "traefik.http.routers.teiler_backend_nngm.middlewares=teiler_backend_nngm_strip"
+    environment:
+      LOG_LEVEL: "INFO"
+      APPLICATION_PORT: "8085"
+      DEFAULT_LANGUAGE: "${TEILER_DEFAULT_LANGUAGE}"
+      TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/nngm-teiler"
+      TEILER_ORCHESTRATOR_URL: "/nngm-teiler"
+      TEILER_DASHBOARD_DE_URL: "/nngm-teiler-dashboard/de"
+      TEILER_DASHBOARD_EN_URL: "/nngm-teiler-dashboard/en"
+      HTTP_PROXY: "http://forward_proxy:3128"
+      ENABLE_MTBA: "${ENABLE_MTBA}"
+      ENABLE_DATASHIELD: "${ENABLE_DATASHIELD}"
+      IDMANAGER_UPLOAD_APIKEY: "${IDMANAGER_UPLOAD_APIKEY}" # Only used to check if the ID Manager is active
--- a/nngm/modules/teiler-setup.sh
+++ b/nngm/modules/teiler-setup.sh
@@ -0,0 +1,8 @@
+#!/bin/bash -e
+
+if [ "$ENABLE_TEILER" == true ];then
+  log INFO "Teiler setup detected -- will start Teiler services."
+  OVERRIDE+=" -f ./$PROJECT/modules/teiler-compose.yml"
+  TEILER_DEFAULT_LANGUAGE=DE
+  TEILER_DEFAULT_LANGUAGE_LOWER_CASE=${TEILER_DEFAULT_LANGUAGE,,}
+fi
--- a/nngm/root.crt.pem
+++ b/nngm/root.crt.pem
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAh2gAwIBAgIUWHMDQFPJR5y8RKZ5FC72iOOla4kwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjUxMDI3MTQwMjU1WhcNMzUx
+MDI1MTQwMzI1WjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAKoghRqAo6s9xjDao+ZC9HpZDBgzOgRMRHrl352k
+Y0Gti1p3m8ldwVQV+nlBE6g/Dowo+iaOwUBiHMHOI2BK7vqkGNp0tZ63ZKR4cyOD
+hCDOl71lWxjYD5XmF7l/SbrLFfET0EEorhLDDOMuWrNpxKFfKdvhld6K5BZ3oSfH
+/5W5y5jWRFWEYRzddzil2GOiU2vzAygA0I1nr5oHCgZoteDDXztAYHJ5vnPA9RNQ
+YFoe/5fVOiJo869zYyBwMuY/dV5ff7eIe/HRKzFLZ6iJEOJcBFWx/aWEvj5gSWxS
+x4OzkwoHsZOkRN9wSTXvdO5kPFzmPq8Nq7Hmw4tLVzP1eRECAwEAAaN7MHkwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFP9BHa86rz94
+nvMj2JhM5V3L3TWCMB8GA1UdIwQYMBaAFP9BHa86rz94nvMj2JhM5V3L3TWCMBYG
+A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQCkWBXRUGx5
+XFWEEAVbAMcEuXAr6+HtSs+NTORQ01LhNST8Z9HhOaAjfH/dJiLvOjHvOuiOK9y9
+ZGkIIwqkkbhlv1ZcfQBWXh+xDNbq9Q2MaIWY3ZzPTKFgNkxFcEF43MMB+o5pK1Bf
+jJIiSxuEfM0yHg9o+jc3V3XRhU9leXNPkfJezTGfVuWr/B/kTmnQ8zrOCapB+NnX
+vuu1ayNyXflDkj8Gg0X4TarxGhSP6Dpxd9ViEQD9DFG8q42bH0mYveHcAIUN0FJX
+4F2NChiL7dCSFFe6xKdRFDtNe12JrHRjU1rMAcxhYjBRbqt2o2HfDPajSJrhRheY
+T35rRWxDupkP
+-----END CERTIFICATE-----
--- a/nngm/vars
+++ b/nngm/vars
@@ -0,0 +1,32 @@
+BROKER_ID=broker.nngm.dkfz.de
+BROKER_URL=https://${BROKER_ID}
+PROXY_ID=${SITE_ID}.${BROKER_ID}
+FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
+FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
+# TODO: Add real nNGM-Support email
+SUPPORT_EMAIL=support-nngm@dkfz-heidelberg.de
+PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
+
+BROKER_URL_FOR_PREREQ=$BROKER_URL
+
+# TODO: Replace with nNGM OIDC Server
+OIDC_USER_GROUP="NNGM_$(capitalize_first_letter ${SITE_ID})"
+OIDC_ADMIN_GROUP="NNGM_$(capitalize_first_letter ${SITE_ID})_Verwalter"
+OIDC_PSP_GROUP="NNGM_$(capitalize_first_letter ${SITE_ID})_PSP"
+OIDC_PRIVATE_CLIENT_ID=${SITE_ID}-private
+OIDC_PUBLIC_CLIENT_ID=${SITE_ID}-public
+OIDC_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PUBLIC_CLIENT_ID}/"
+OIDC_PRIVATE_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PRIVATE_CLIENT_ID}/"
+OIDC_GROUP_CLAIM="groups"
+
+for module in $PROJECT/modules/*.sh
+do
+    log DEBUG "sourcing $module"
+    source $module
+done
+
+for module in modules/*.sh
+do
+    log DEBUG "sourcing $module"
+    source $module
+done
--- a/pscc/docker-compose.yml
+++ b/pscc/docker-compose.yml
@@ -0,0 +1,67 @@
+version: "3.7"
+
+services:
+  blaze:
+    image: docker.verbis.dkfz.de/cache/samply/blaze:${BLAZE_TAG}
+    container_name: bridgehead-pscc-blaze
+    environment:
+      BASE_URL: "http://bridgehead-pscc-blaze:8080"
+      JAVA_TOOL_OPTIONS: "-Xmx${BLAZE_MEMORY_CAP:-4096}m"
+      DB_RESOURCE_CACHE_SIZE: ${BLAZE_RESOURCE_CACHE_CAP:-2500000}
+      DB_BLOCK_CACHE_SIZE: ${BLAZE_MEMORY_CAP}
+      CQL_EXPR_CACHE_SIZE: ${BLAZE_CQL_CACHE_CAP:-32}
+      ENFORCE_REFERENTIAL_INTEGRITY: "false"
+    volumes:
+      - "blaze-data:/app/data"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.blaze_pscc.rule=PathPrefix(`/pscc-localdatamanagement`)"
+      - "traefik.http.middlewares.pscc_b_strip.stripprefix.prefixes=/pscc-localdatamanagement"
+      - "traefik.http.services.blaze_pscc.loadbalancer.server.port=8080"
+      - "traefik.http.routers.blaze_pscc.middlewares=pscc_b_strip,auth"
+      - "traefik.http.routers.blaze_pscc.tls=true"
+
+  focus:
+    image: docker.verbis.dkfz.de/cache/samply/focus:${FOCUS_TAG}
+    container_name: bridgehead-focus
+    environment:
+      API_KEY: ${FOCUS_BEAM_SECRET_SHORT}
+      BEAM_APP_ID_LONG: focus.${PROXY_ID}
+      PROXY_ID: ${PROXY_ID}
+      BLAZE_URL: "http://bridgehead-pscc-blaze:8080/fhir/"
+      BEAM_PROXY_URL: http://beam-proxy:8081
+      RETRY_COUNT: ${FOCUS_RETRY_COUNT}
+      EPSILON: 0.28
+      ENDPOINT_TYPE: ${FOCUS_ENDPOINT_TYPE:-blaze}
+    depends_on:
+      - "beam-proxy"
+      - "blaze"
+
+  beam-proxy:
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
+    container_name: bridgehead-beam-proxy
+    environment:
+      BROKER_URL: ${BROKER_URL}
+      PROXY_ID: ${PROXY_ID}
+      APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
+      PRIVKEY_FILE: /run/secrets/proxy.pem
+      ALL_PROXY: http://forward_proxy:3128
+      TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs
+      ROOTCERT_FILE: /conf/root.crt.pem
+    secrets:
+      - proxy.pem
+    depends_on:
+      - "forward_proxy"
+    volumes:
+      - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro
+      - /srv/docker/bridgehead/pscc/root.crt.pem:/conf/root.crt.pem:ro
+
+  landing:
+    profiles: [deactivated]
+
+volumes:
+  blaze-data:
+
+secrets:
+  proxy.pem:
+    file: /etc/bridgehead/pki/${SITE_ID}.priv.pem
--- a/pscc/modules/lens-compose.yml
+++ b/pscc/modules/lens-compose.yml
@@ -0,0 +1,40 @@
+version: "3.7"
+services:
+  lens:
+    container_name: lens-federated-search
+    image: docker.verbis.dkfz.de/ccp/lens:${SITE_ID}
+    labels:
+      - "traefik.http.services.lens.loadbalancer.server.port=3000"
+      - "traefik.enable=true"
+      - "traefik.http.routers.lens.rule=Host(`${HOST}`)"
+      - "traefik.http.routers.lens.tls=true"
+
+  spot:
+    image: samply/rustyspot:latest
+    platform: linux/amd64
+    environment:
+      HTTP_PROXY: ${HTTP_PROXY_URL}
+      HTTPS_PROXY: ${HTTPS_PROXY_URL}
+      NO_PROXY: beam-proxy
+      BEAM_SECRET: "${FOCUS_BEAM_SECRET_SHORT}"
+      BEAM_PROXY_URL: http://beam-proxy:8081
+      BEAM_APP_ID: "spot.${SITE_ID}.${BROKER_ID}"
+      CORS_ORIGIN: "https://${HOST}"
+      SITES: ${SITES}
+      TRANSFORM: LENS
+      PROJECT: pscc
+      BIND_ADDR: 0.0.0.0:8055
+    depends_on:
+      - "beam-proxy"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.spot.loadbalancer.server.port=8055"
+      - "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowmethods=GET,OPTIONS,POST"
+      - "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowheaders=content-type"
+      - "traefik.http.middlewares.corsheaders2.headers.accesscontrolalloworiginlist=https://${HOST}"
+      - "traefik.http.middlewares.corsheaders2.headers.accesscontrolallowcredentials=true"
+      - "traefik.http.middlewares.corsheaders2.headers.accesscontrolmaxage=-1"
+      - "traefik.http.routers.spot.rule=Host(`${HOST}`) && PathPrefix(`/prod`)"
+      - "traefik.http.middlewares.stripprefix_spot.stripprefix.prefixes=/prod"
+      - "traefik.http.routers.spot.tls=true"
+      - "traefik.http.routers.spot.middlewares=corsheaders2,stripprefix_spot,auth"
--- a/pscc/modules/lens-setup.sh
+++ b/pscc/modules/lens-setup.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+if [ -n "$ENABLE_LENS" ];then
+  OVERRIDE+=" -f ./$PROJECT/modules/lens-compose.yml"
+fi
--- a/pscc/root.crt.pem
+++ b/pscc/root.crt.pem
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAh2gAwIBAgIUVC1Y1tx0q5PNR33gArAyyBm8PMQwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAxMLQnJva2VyLVJvb3QwHhcNMjUxMTAzMTQxODQ5WhcNMzUx
+MTAxMTQxOTE5WjAWMRQwEgYDVQQDEwtCcm9rZXItUm9vdDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAMB1yd7zkh7Io/ReQYindBcAdA1b4ogdVnrdSLRN
+N3zLSh6jN5KIXgs34BdRXx0so0m96q+9xlgacTXGRBn1Tu5SKMRyXdxnCLMzHAYU
+rNKhqF5HeZCYkVyh/tsAyFfDwZDVzsdX64V+0r5+raev2X0gJnlgmF83DIKjkVUS
+2+c+3BnXa9LOdXks0qygJjvaFyi+5MA3DinLnmMLCQ3yAvaZYWyP3xCnGIoVrZFq
+a+YioMCmHrbByuXPoZsXcFY7Z85LQkCtSVt1dH4kkN2/JehXG099nqwMqO8FpLZZ
+xG7/U3P/slX1MMLs97nqRCRoW7Cha2ci1NBYLll+34ekhxMCAwEAAaN7MHkwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJHTpnuyIGHw
+yvC/mmh+S/JKYVrAMB8GA1UdIwQYMBaAFJHTpnuyIGHwyvC/mmh+S/JKYVrAMBYG
+A1UdEQQPMA2CC0Jyb2tlci1Sb290MA0GCSqGSIb3DQEBCwUAA4IBAQAeDc/k28yb
+I5MLC/LdaA+MKsW2FWF9HT+tsbtltTaQIRnnkwfU/40Ius3gzUU5z+kPqq5+kxhy
+3T646Rbau85Zw24gdNmiVKAAG5ntKoQ7XnyR/06PYyXNGLqnb6aKvbcIPoWtU/+2
+8f5hHdQ/4271aHws7dKcBNWu9V5WmxMZ3YTfnBR5lEda+DhVwHqtmun8EpSbwthD
+aLLIOHJpetr+KWUVFHQdGbO23Qg1Else0Akcn5Gzf/sKkVCVxjHE6jeo4ZwHtstG
+KMoff+ETC+DL5kMZ4CV5VaQ4HxVK7N0qiUxmijWe+EyRZseum1c0s2OEi2L52Q9K
+P4N3yD4ed4p/
+-----END CERTIFICATE-----
--- a/pscc/vars
+++ b/pscc/vars
@@ -0,0 +1,14 @@
+BROKER_ID=broker.pscc.org
+BROKER_URL=https://${BROKER_ID}
+PROXY_ID=${SITE_ID}.${BROKER_ID}
+FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
+FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
+SUPPORT_EMAIL=denis.koether@dkfz-heidelberg.de
+PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
+BROKER_URL_FOR_PREREQ=$BROKER_URL
+
+for module in $PROJECT/modules/*.sh
+do
+    log DEBUG "sourcing $module"
+    source $module
+done
--- a/versions/acceptance
+++ b/versions/acceptance
@@ -1,6 +1,6 @@
 FOCUS_TAG=develop
 BEAM_TAG=develop
-BLAZE_TAG=main
+BLAZE_TAG=0.32
 POSTGRES_TAG=15.13-alpine
 TEILER_DASHBOARD_TAG=develop
 MTBA_TAG=develop
--- a/versions/test
+++ b/versions/test
@@ -1,6 +1,6 @@
 FOCUS_TAG=develop
 BEAM_TAG=develop
-BLAZE_TAG=main
+BLAZE_TAG=0.32
 POSTGRES_TAG=15.13-alpine
 TEILER_DASHBOARD_TAG=develop
-MTBA_TAG=develop
+MTBA_TAG=develop
Author	SHA1	Message	Date
Manoj Waikar	d18e56f381	Changes to make deployed CCE explorer work properly. (#368 ) * Changes to make deployed CCE explorer work properly. In the lens environment section in services: - add PUBLIC_SPOT_URL value	2026-01-28 13:40:51 +01:00
Jan	dba80052a2	update beam proxy server used for oauth enrollment (#366 )	2026-01-28 13:40:51 +01:00
Enola Knezevic	03673ff1ac	test version blaze (#364 ) This is the one we need urgently	2026-01-28 13:40:51 +01:00
Enola Knezevic	663709b569	obfuscate BBMRI ERIC way, test blaze version (#363 )	2026-01-28 13:40:51 +01:00
Manoj Waikar	6f6be2d30e	Use the cce-explorer:main image from docker hub (instead of ghcr). (#362 )	2026-01-28 13:40:51 +01:00
Pierre Delpy	11d5b0efdd	feat: migrate pscc to orange cloud broker (#361 )	2026-01-28 13:40:51 +01:00
Manoj Waikar	5b5f7b7ffc	Use the main image name for cce explorer. (#360 ) - instead of pr1 name	2026-01-28 13:40:51 +01:00
Manoj Waikar	59d64c39a4	Add APP_spot_KEY env var under the beam-proxy section. (#358 )	2026-01-28 13:40:51 +01:00
Niklas Reimer	2e78f5a033	feat(dnpm): set timezone to Europe/Berlin (#359 )	2026-01-28 13:40:51 +01:00
DavidCroftDKFZ	06b44382f8	Directory sync: token login and cron change (#351 ) The Directory team have requested that we allow token login to the Directory, where a user uses LSAAI credentials to obtain a token from the Directory, and then uses this to authenticate Directory sync. This has been implemented via an environment variable, in an analogous way to the already existing username/password method. The default start time for the Directory sync has been shifted to 22:30, to prevent conflicts with the Bridgehead auto-update. Relevant changes have been made to the documentation. Co-authored-by: Torben Brenner <76154651+torbrenner@users.noreply.github.com> Co-authored-by: Jan <59206115+Threated@users.noreply.github.com> Co-authored-by: Martin Lablans <6804500+lablans@users.noreply.github.com>	2026-01-28 13:40:51 +01:00
djuarezgf	713a7f951a	feat: add nNGM project (#340 )	2026-01-28 13:40:50 +01:00
Pierre Delpy	d5fe238460	feat: add PSCC * add pscc and prepare lens2 deployment --------- Co-authored-by: p.delpy@dkfz-heidelberg.de <p.delpy@dkfz-heidelberg.de> Co-authored-by: Jan <59206115+Threated@users.noreply.github.com>	2026-01-28 13:40:50 +01:00
DavidCroftDKFZ	863aa52f1d	Directory sync: inherit host timezone (#354 ) Directory sync needs to be able to launch at specific times of day, and in order to do this in a predictable way, the timezone used inside the Docker container should be the same as the host. To do this, two files need to be mounted from the host. One file contains information about the time zone, the other file contains the file zone name.	2026-01-28 13:40:50 +01:00
djuarezgf	7924dfab87	docs: add initial documentation for Samply.Exporter and Samply.Teiler (#350 )	2026-01-28 13:40:50 +01:00
Tim Schumacher	4e134e7e95	Update focus tags: no project specific images anymore	2026-01-28 13:40:50 +01:00
Jan	2afbb99de6	fix: don't run secret sync for minimal (#349 )	2026-01-28 13:40:50 +01:00
Jan	099ccac238	feat: add bridgehead check command (#342 )	2026-01-28 13:40:50 +01:00
Jan	35d6b3d155	fix: only pass CQL_PROJECTS_ENABLED to focus if set (#344 )	2026-01-28 13:40:50 +01:00
Jan	b7a47475a0	feat: allow cql queries for exliquid (#343 )	2026-01-28 13:40:50 +01:00
Tim Schumacher	2029ca30ca	feat: add scout module (#339 )	2026-01-28 13:40:50 +01:00
Jan	4d3ee91acc	feat(dnpm): change to new `api-gateway` image (#337 )	2026-01-28 13:40:50 +01:00
Jan	f0095cf629	chore: add more options to transfair (#325 )	2026-01-28 13:40:50 +01:00
Jan	f151c19f5e	fix: adapt to transfair cli changes (#319 )	2026-01-28 13:40:50 +01:00
djuarezgf	528c8c85ea	Replace hardcoded image: ...:develop references with version variables (#335 ) * added: Teiler Dashboard Version * added: MTBA Version * added: beam proxy tag version	2026-01-28 13:40:50 +01:00
Paul-Christian Volkmer	f43ab20e75	docs: Add ghcr.io to URL list (#321 )	2026-01-28 13:40:50 +01:00
Jan	4c33c2d58e	fix(dnpm): fix env subsitution (#333 )	2026-01-28 13:40:50 +01:00
djuarezgf	001df6d384	mtba: fallback to keycloak test server pending migration	2026-01-28 13:40:50 +01:00
djuarezgf	ced6791f26	feat: migrate PSP to Authentik (#329 )	2026-01-28 13:40:50 +01:00
Jan	6694c0a28e	feat(dnpm): allow setting custom dnpm image tag (#326 )	2026-01-28 13:40:50 +01:00
djuarezgf	b4d13bff62	Fixed: Authentik URL for Opal (#328 ) * Fixed: Authentik URL for Opal * Removed: Unnecessary OIDC config in CCE and BBMRI * KR with basic auth instead of OIDC	2026-01-28 13:40:50 +01:00
djuarezgf	3d33fd6778	feat: migrate OIDC Configuration from Keycloak to Authentik (#327 ) * Change: Authentik instead of Keycloak in CCP Co-authored-by: Jan <59206115+Threated@users.noreply.github.com> --------- Co-authored-by: Jan <59206115+Threated@users.noreply.github.com>	2026-01-28 13:40:50 +01:00
Jan	281a1b2cb6	feat: remove local rstudio (#322 )	2026-01-28 13:40:50 +01:00
djuarezgf	4ddc906fcd	CCE Teiler and Export (#323 ) * Added Exporter to CCE * Add Teiler to CCE * Add EXPORTER_USER to adduser function	2026-01-28 13:40:50 +01:00
Pierre Delpy	fa36558d2e	fix: add obfuscation and basic auth to spot in cce and itcc (#324 ) Co-authored-by: p.delpy@dkfz-heidelberg.de <p.delpy@dkfz-heidelberg.de>	2026-01-28 13:40:50 +01:00
djuarezgf	af8ad48e2c	Use relative paths in teiler (#320 )	2026-01-28 13:40:50 +01:00
Tobias Kussel	ecd8d60e99	docs: close Exporter code block in readme (#318 )	2026-01-28 13:40:50 +01:00
djuarezgf	0a5da028db	fix: Create Exporter User only if Exporter is enabled (#317 )	2026-01-28 13:40:50 +01:00
Enola Knezevic	c45c6eb0ea	chore: update eric.acc.root.crt.pem (#316 )	2026-01-28 13:40:50 +01:00
djuarezgf	01173c9857	docs: add Teiler and Exporter to the main README.md (#315 ) Co-authored-by: Tobias Kussel <TKussel@users.noreply.github.com>	2026-01-28 13:40:50 +01:00
djuarezgf	ac0c37cba3	feat: add Teiler and Exporter in BBMRI (#312 ) Co-authored-by: Jan <59206115+Threated@users.noreply.github.com>	2026-01-28 13:40:50 +01:00
Martin Lablans	31b6c3bee3	chore: externalize POSTGRES_TAG and bump postgres to 15.13 (#313 )	2026-01-28 13:40:50 +01:00
Tim Schumacher	8ddcfc123f	Cache public organoid dashboard SQL query (#309 )	2026-01-28 13:40:50 +01:00
DavidCroftDKFZ	9e23059ef2	docs: add faq (#288 )	2026-01-28 13:40:50 +01:00
DavidCroftDKFZ	87e4ad595f	docs: Control import from Directory, improve README (#297 )	2026-01-28 13:40:50 +01:00
DavidCroftDKFZ	4d7ba813e0	Added section relating to clearing data from Blaze (#303 )	2026-01-28 13:40:50 +01:00
djuarezgf	84f73fc1fb	chore: change some teiler variables (#307 )	2026-01-28 13:40:50 +01:00
djuarezgf	7d177a0b03	fix: add own url to teiler dashboard to make it offline compatible (#305 )	2026-01-28 13:40:50 +01:00
Torben Brenner	5caaad26f2	fix: Ensure transfair can properly communicate with the fhir server for requests (#304 )	2026-01-28 13:40:50 +01:00
Jan	b778da3f56	feat: allow transfair to talk to services behind the proxy (#296 )	2026-01-28 13:40:50 +01:00
Jan	f9586f27b1	chore(transfair): update transfair config (#298 )	2026-01-28 13:40:50 +01:00
Martin Lablans	8846efde85	Code review: Move to /tmp/bridgehead/...	2026-01-28 13:40:50 +01:00
Tim Schumacher	46ff2e9882	Use temp directory for secret sync cache	2026-01-28 13:40:50 +01:00
Jan	50263c767d	chore(transfair): add option to disable tls verification (#295 )	2026-01-28 13:40:50 +01:00
Enola Knezevic	7b3327ec24	chore: add BBMRI ERIC acceptance env (#294 )	2026-01-28 13:40:50 +01:00
Jan	2c9a50149b	fix: ssh-tunnel-setup.sh (#293 )	2026-01-28 13:40:50 +01:00
Jan	e0c21625cc	feat: ssh tunnel (#292 ) * Added ccp module for a ssh tunnel Usage details under https://github.com/samply/ssh-tunnel * chore: update ssh-tunnel image to harbor * feat: ssh tunnel support diffrent port * chore: fix indentation * chore: move to top level modules * docs: add ssh-tunnel docs --------- Co-authored-by: Tobias Kussel <tobias.kussel@dkfz-heidelberg.de>	2026-01-28 13:40:50 +01:00
Jan	5ac8042742	chore(transfair): add new gw option (#291 )	2026-01-28 13:40:50 +01:00
Jan	3267dd088c	feat: expose transfair via traefik (#290 ) Note: Requires a bridgehead install to generate the basic auth user	2026-01-28 13:40:50 +01:00
Tim Schumacher	9cd5042ebc	Fix GitLab token syncing for BBMRI	2026-01-28 13:40:50 +01:00
janskiba	265c7bee33	feat: add transfair setup to ccp	2026-01-28 13:40:50 +01:00
janskiba	d79e74ca90	chore!: update transfair config	2026-01-28 13:40:50 +01:00
Manoj Waikar	82841a6f04	Fix airgapped-blaze-compose.yml file. - BASE_URL & traefik settings	2025-03-25 15:23:16 +01:00
Manoj Waikar	ba6f2c3b11	Modify container name (as it was a duplicate).	2025-03-24 09:50:06 +01:00
Manoj Waikar	39a4231c1f	Add airgapped-blaze-{compose,setup} files in cce modules. - for testing out airgapped-blaze at VHIO	2025-03-21 15:15:03 +01:00