Test

README.md

@@ -85,8 +85,6 @@ The following URLs need to be accessible (prefix with `https://`):
     * hub.docker.com
     * registry-1.docker.io
     * production.cloudflare.docker.com
-  * GitHub Container Registry - (for use of DNPM:DIP)
-    * ghcr.io
 * To report bridgeheads operational status
   * healthchecks.verbis.dkfz.de
 * only for DKTK/CCP
@@ -97,7 +95,7 @@ The following URLs need to be accessible (prefix with `https://`):
 * only for German Biobank Node
   * broker.bbmri.de
 
-> 📝 This URL list is subject to change. Instead of the individual names, we highly recommend whitelisting wildcard domains: *.dkfz.de, github.com, *.docker.com, *.docker.io, *.ghcr.io, *.samply.de, *.bbmri.de.
+> 📝 This URL list is subject to change. Instead of the individual names, we highly recommend whitelisting wildcard domains: *.dkfz.de, github.com, *.docker.com, *.docker.io, *.samply.de, *.bbmri.de.
 
 > 📝 Ubuntu's pre-installed uncomplicated firewall (ufw) is known to conflict with Docker, more info [here](https://github.com/chaifeng/ufw-docker).
 

bbmri/modules/teiler-compose.yml

@@ -19,7 +19,7 @@ services:
       HTTP_RELATIVE_PATH: "/bbmri-teiler"
 
   teiler-dashboard:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:${TEILER_DASHBOARD_TAG}
+    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
     container_name: bridgehead-teiler-dashboard
     labels:
       - "traefik.enable=true"

bridgehead

@@ -176,13 +176,6 @@ case "$ACTION" in
 		;;
 	postRun | postUpdate)
 		;;
-	send-file)
-		loadVars
-		log "WARNING" "Your are about to send a file to another bridgehead in your network!"
-		read -p "Please name the bridgehead you want to send the file to (proxy-id): " RECEIVER_PROXY_ID
-        read -p "Continue? (Y/N): " confirm && [[ $confirm == [yY] || $confirm == [yY][eE][sS] ]] || exit 1
-		exec $COMPOSE -p $PROJECT -f ./modules/beam-file-compose.yml --profile beam-file-sender run beam-file-sender send --to beamfile.$RECEIVER_PROXY_ID /data/outfile
-		;;
 	*)
 		printUsage
 		exit 1

cce/modules/teiler-compose.yml

@@ -19,7 +19,7 @@ services:
       HTTP_RELATIVE_PATH: "/cce-teiler"
 
   teiler-dashboard:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:${TEILER_DASHBOARD_TAG}
+    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
     container_name: bridgehead-teiler-dashboard
     labels:
       - "traefik.enable=true"

ccp/modules/dnpm-node-compose.yml

@@ -43,7 +43,7 @@ services:
       - "traefik.http.routers.dnpm-auth.tls=true"
 
   dnpm-portal:
-    image: ghcr.io/dnpm-dip/portal:${DNPM_IMAGE_TAG:-latest}
+    image: ghcr.io/dnpm-dip/portal:{DNPM_IMAGE_TAG:-latest}
     container_name: bridgehead-dnpm-portal
     environment:
       - NUXT_API_URL=http://dnpm-backend:9000/
@@ -58,7 +58,7 @@ services:
 
   dnpm-backend:
     container_name: bridgehead-dnpm-backend
-    image: ghcr.io/dnpm-dip/api-gateway:latest
+    image: ghcr.io/dnpm-dip/backend:{DNPM_IMAGE_TAG:-latest}
     environment:
       - LOCAL_SITE=${ZPM_SITE}:${SITE_NAME}   # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen
       - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}

ccp/modules/id-management-compose.yml

@@ -14,7 +14,6 @@ services:
       MAGICPL_CONNECTOR_APIKEY: ${IDMANAGER_READ_APIKEY}
       MAGICPL_CENTRAL_PATIENTLIST_APIKEY: ${IDMANAGER_CENTRAL_PATIENTLIST_APIKEY}
       MAGICPL_CONTROLNUMBERGENERATOR_APIKEY: ${IDMANAGER_CONTROLNUMBERGENERATOR_APIKEY}
-      MAGICPL_OIDC_PROVIDER: ${OIDC_PRIVATE_URL}
     depends_on:
       - patientlist
       - traefik-forward-auth
@@ -72,14 +71,12 @@ services:
       - https_proxy=http://forward_proxy:3128
       - OAUTH2_PROXY_PROVIDER=oidc
       - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
-      - OAUTH2_PROXY_OIDC_ISSUER_URL=${OIDC_PRIVATE_URL}
-      - OAUTH2_PROXY_CLIENT_ID=${OIDC_PRIVATE_CLIENT_ID}
-      - OAUTH2_PROXY_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
+      - OAUTH2_PROXY_OIDC_ISSUER_URL=https://login.verbis.dkfz.de/realms/master
+      - OAUTH2_PROXY_CLIENT_ID=bridgehead-${SITE_ID}
+      - OAUTH2_PROXY_CLIENT_SECRET=${IDMANAGER_AUTH_CLIENT_SECRET}
       - OAUTH2_PROXY_COOKIE_SECRET=${IDMANAGER_AUTH_COOKIE_SECRET}
       - OAUTH2_PROXY_COOKIE_NAME=_BRIDGEHEAD_oauth2_idm
       - OAUTH2_PROXY_COOKIE_DOMAINS=.${HOST}
-      - OAUTH2_PROXY_COOKIE_REFRESH=4m
-      - OAUTH2_PROXY_COOKIE_EXPIRE=24h
       - OAUTH2_PROXY_HTTP_ADDRESS=:4180
       - OAUTH2_PROXY_REVERSE_PROXY=true
       - OAUTH2_PROXY_WHITELIST_DOMAINS=.${HOST}
@@ -90,8 +87,8 @@ services:
       - OAUTH2_PROXY_SET_AUTHORIZATION_HEADER=true
       - OAUTH2_PROXY_SET_XAUTHREQUEST=true
       # Keycloak has an expiration time of 60s therefore oauth2-proxy needs to refresh after that
-      - OAUTH2_PROXY_ALLOWED_GROUPS=${OIDC_PSP_GROUP}
-      - OAUTH2_PROXY_OIDC_GROUPS_CLAIM=${OIDC_GROUP_CLAIM}
+      - OAUTH2_PROXY_COOKIE_REFRESH=60s
+      - OAUTH2_PROXY_ALLOWED_GROUPS=DKTK-CCP-PPSN
       - OAUTH2_PROXY_PROXY_PREFIX=/oauth2-idm
     labels:
       - "traefik.enable=true"

ccp/modules/id-management-setup.sh

@@ -14,8 +14,6 @@ function idManagementSetup() {
 
 		# Ensure old ids are working !!!
 		export IDMANAGEMENT_FRIENDLY_ID=$(legacyIdMapping "$SITE_ID")
-
-		add_private_oidc_redirect_url "/oauth2-idm/callback"
 	fi
 }
 

ccp/modules/mtba-compose.yml

@@ -2,7 +2,7 @@ version: "3.7"
 
 services:
   mtba:
-    image: docker.verbis.dkfz.de/cache/samply/mtba:${MTBA_TAG}
+    image: docker.verbis.dkfz.de/cache/samply/mtba:develop
     container_name: bridgehead-mtba
     environment:
       BLAZE_STORE_URL: http://blaze:8080
@@ -22,14 +22,8 @@ services:
       HTTP_RELATIVE_PATH: "/mtba"
       OIDC_ADMIN_GROUP: "${OIDC_ADMIN_GROUP}"
       OIDC_CLIENT_ID: "${OIDC_PRIVATE_CLIENT_ID}"
-      # TODO: Add following variables after moving to Authentik:
-      #OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
-      #OIDC_URL: "${OIDC_URL}"
-      # TODO: Remove following variables after moving to Authentik:
-      # Please add KECLOAK_CLIENT_SECRET in ccp.conf
-      OIDC_CLIENT_SECRET: "${KEYCLOAK_CLIENT_SECRET}"
-      OIDC_URL: "https://login.verbis.dkfz.de/realms/test-realm-01"
-      OIDC_ADMIN_URL: "https://login.verbis.dkfz.de/admin/realms/test-realm-01"
+      OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
+      OIDC_URL: "${OIDC_URL}"
 
     labels:
       - "traefik.enable=true"

ccp/modules/teiler-compose.yml

@@ -19,7 +19,7 @@ services:
       HTTP_RELATIVE_PATH: "/ccp-teiler"
 
   teiler-dashboard:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:${TEILER_DASHBOARD_TAG}
+    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
     container_name: bridgehead-teiler-dashboard
     labels:
       - "traefik.enable=true"

ccp/vars

@@ -10,11 +10,12 @@ BROKER_URL_FOR_PREREQ=$BROKER_URL
 
 OIDC_USER_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})"
 OIDC_ADMIN_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})_Verwalter"
-OIDC_PSP_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})_PSP"
 OIDC_PRIVATE_CLIENT_ID=${SITE_ID}-private
 OIDC_PUBLIC_CLIENT_ID=${SITE_ID}-public
-OIDC_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PUBLIC_CLIENT_ID}/"
-OIDC_PRIVATE_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PRIVATE_CLIENT_ID}/"
+#OIDC_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PUBLIC_CLIENT_ID}/"
+#OIDC_PRIVATE_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PRIVATE_CLIENT_ID}/"
+OIDC_URL="https://login.verbis.dkfz.de/realms/test-realm-01"
+OIDC_PRIVATE_URL="https://login.verbis.dkfz.de/realms/test-realm-01"
 OIDC_GROUP_CLAIM="groups"
 
 for module in $PROJECT/modules/*.sh

dhki/docker-compose.yml

@@ -39,13 +39,12 @@ services:
       - "blaze"
 
   beam-proxy:
-    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
     container_name: bridgehead-beam-proxy
     environment:
       BROKER_URL: ${BROKER_URL}
       PROXY_ID: ${PROXY_ID}
       APP_focus_KEY: ${FOCUS_BEAM_SECRET_SHORT}
-      APP_beamfilesend_KEY: ${BEAM_FILE_SEND_SECRET}
       PRIVKEY_FILE: /run/secrets/proxy.pem
       ALL_PROXY: http://forward_proxy:3128
       TLS_CA_CERTIFICATES_DIR: /conf/trusted-ca-certs

dhki/vars

@@ -5,7 +5,6 @@ FOCUS_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | h
 FOCUS_RETRY_COUNT=${FOCUS_RETRY_COUNT:-64}
 SUPPORT_EMAIL=support-ccp@dkfz-heidelberg.de
 PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
-BEAM_FILE_SEND_SECRET="$(echo \"beam-file-send-salt\" | openssl pkeyutl -sign -inkey /etc/bridgehead/pki/${SITE_ID}.priv.pem | base64 | head -c 30)"
 
 BROKER_URL_FOR_PREREQ=$BROKER_URL
 
@@ -24,6 +23,4 @@ do
     source $module
 done
 
-transfairSetup
-scoutSetup
-beamFileSetup
+transfairSetup

kr/docker-compose.yml

@@ -40,7 +40,7 @@ services:
       - "blaze"
 
   beam-proxy:
-    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
     container_name: bridgehead-beam-proxy
     environment:
       BROKER_URL: ${BROKER_URL}

kr/modules/teiler-compose.yml

@@ -19,7 +19,7 @@ services:
       HTTP_RELATIVE_PATH: "/kr-teiler"
 
   teiler-dashboard:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:${TEILER_DASHBOARD_TAG}
+    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
     container_name: bridgehead-teiler-dashboard
     labels:
       - "traefik.enable=true"

lib/functions.sh

@@ -327,7 +327,7 @@ function sync_secrets() {
         -e ALL_PROXY=$HTTPS_PROXY_FULL_URL \
         -e PROXY_ID=$proxy_id \
         -e BROKER_URL=$broker_url \
-        -e OIDC_PROVIDER=secret-sync-central.test-secret-sync.$broker_id \
+        -e OIDC_PROVIDER=secret-sync-central.secret-sync.$broker_id \
         -e SECRET_DEFINITIONS=$secret_sync_args \
         docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest
 

minimal/modules/dnpm-node-compose.yml

@@ -43,7 +43,7 @@ services:
       - "traefik.http.routers.dnpm-auth.tls=true"
 
   dnpm-portal:
-    image: ghcr.io/dnpm-dip/portal:${DNPM_IMAGE_TAG:-latest}
+    image: ghcr.io/dnpm-dip/portal:{DNPM_IMAGE_TAG:-latest}
     container_name: bridgehead-dnpm-portal
     environment:
       - NUXT_API_URL=http://dnpm-backend:9000/
@@ -58,7 +58,7 @@ services:
 
   dnpm-backend:
     container_name: bridgehead-dnpm-backend
-    image: ghcr.io/dnpm-dip/api-gateway:latest
+    image: ghcr.io/dnpm-dip/backend:{DNPM_IMAGE_TAG:-latest}
     environment:
       - LOCAL_SITE=${ZPM_SITE}:${SITE_NAME}   # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen
       - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}

modules/beam-file-compose.yml

@@ -1,35 +0,0 @@
-# NOTE: Current implementation is restricted to a bridgehead only being able to either upload or download data
-services:
-  beam-file-sender:
-    image: samply/beam-file:${BEAM_FILE_TAG}
-    container_name: bridgehead-beam-file-sender
-    environment:
-      - BEAM_ID=beamfilesend.${PROXY_ID}
-      - BEAM_SECRET=${BEAM_FILE_SEND_SECRET}
-      - BEAM_URL=http://beam-proxy:8081
-      - BIND_ADDR=0.0.0.0:8085
-      - API_KEY=${BEAM_FILE_API_KEY}
-    # Only uncomment if your are sure what to do
-    # ports:
-    #   - 8085:8085
-    volumes:
-      - /var/cache/bridgehead/beam-file-out/:/data
-    profiles: ["beam-file-sender"]
-
-  beam-file-receiver:
-    image: samply/beam-file:${BEAM_FILE_TAG}
-    container_name: bridgehead-beam-file-receiver
-    environment:
-      - BEAM_ID=beamfile.${PROXY_ID}
-      - BEAM_SECRET=${BEAM_FILE_SECRET}
-      - BEAM_URL=http://beam-proxy:8081
-      - API_KEY=${BEAM_FILE_API_KEY}
-    command: ["receive", "save", "--outdir", "/data"]
-    volumes:
-      - /var/cache/bridgehead/beam-file/:/data
-    profiles: ["beam-file-receiver"]
-
-  beam-proxy:
-    environment:
-      APP_beamfile_KEY: ${BEAM_FILE_SECRET}
-    profiles: ["beam-file-receiver"]

modules/beam-file-setup.sh

@@ -1,11 +0,0 @@
-#!/bin/bash -e
-
-function beamFileSetup() {
-    if [ -n "$ENABLE_BEAM_FILE_RECEIVER" ]; then
-       echo "Starting beam file in receiver mode"
-       OVERRIDE+=" -f ./modules/beam-file-compose.yml --profile beam-file-receiver"
-       BEAM_FILE_SECRET="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
-       BEAM_FILE_API_KEY="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
-       log INFO "Beam File in Receiver Mode available uses ApiKey ${BEAM_FILE_API_KEY}"
-    fi
-}

modules/scout-compose.yml

@@ -1,40 +0,0 @@
-volumes:
-  scout-blaze-data:
-
-services:
-  traefik:
-    labels:
-      - "traefik.http.middlewares.additional-users-auth.basicauth.users=${SCOUT_BASIC_AUTH_USERS}"
-
-  scout-blaze:
-    image: docker.verbis.dkfz.de/cache/samply/blaze:${BLAZE_TAG}
-    container_name: bridgehead-scout-blaze
-    environment:
-      BASE_URL: "http://bridgehead-scout-blaze:8080"
-      ENFORCE_REFERENTIAL_INTEGRITY: "false"
-    volumes:
-      - "scout-blaze-data:/app/data"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.scout-blaze.rule=PathPrefix(`/scout-blaze`)"
-      - "traefik.http.middlewares.scout-blaze-stripprefix.stripprefix.prefixes=/scout-blaze"
-      - "traefik.http.services.scout-blaze.loadbalancer.server.port=8080"
-      - "traefik.http.routers.scout-blaze.middlewares=scout-blaze-stripprefix,additional-users-auth"
-      - "traefik.http.routers.scout-blaze.tls=true"
-
-  scout:
-    image: samply/scout:main
-    container_name: bridgehead-scout
-    configs:
-      - scout.toml
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.scout.rule=PathPrefix(`/scout`)"
-      - "traefik.http.services.scout.loadbalancer.server.port=8080"
-      - "traefik.http.routers.scout.middlewares=additional-users-auth"
-      - "traefik.http.routers.scout.tls=true"
-
-configs:
-  scout.toml:
-    content: |
-      fhir_base_url = "http://scout-blaze:8080/fhir"

modules/scout-setup.sh

@@ -1,8 +0,0 @@
-#!/bin/bash -e
-
-function scoutSetup() {
-    if [[ -n "$ENABLE_SCOUT" && -n "$SCOUT_BASIC_AUTH_USERS" ]]; then
-        echo "Starting scout."
-	    OVERRIDE+=" -f ./modules/scout-compose.yml"
-    fi
-}

modules/transfair-compose.yml

@@ -10,7 +10,7 @@ services:
       - TTP_GW_SOURCE
       - TTP_GW_EPIX_DOMAIN
       - TTP_GW_GPAS_DOMAIN
-      - TTP_GW_GPAS_URL
+      - TTP_TYPE
       - TTP_AUTH
       - PROJECT_ID_SYSTEM
       - FHIR_REQUEST_URL=${FHIR_REQUEST_URL}
@@ -26,7 +26,6 @@ services:
       - TLS_DISABLE=${TRANSFAIR_TLS_DISABLE:-false}
       - NO_PROXY=${TRANSFAIR_NO_PROXIES}
       - ALL_PROXY=http://forward_proxy:3128
-    command: dic ${TTP_TYPE}
     volumes:
       - /var/cache/bridgehead/${PROJECT}/transfair:/transfair
       - /etc/bridgehead/trusted-ca-certs:/conf/trusted-ca-certs:ro

versions/acceptance

@@ -1,6 +1,4 @@
 FOCUS_TAG=develop
 BEAM_TAG=develop
 BLAZE_TAG=main
-POSTGRES_TAG=15.13-alpine
-TEILER_DASHBOARD_TAG=develop
-MTBA_TAG=develop
+POSTGRES_TAG=15.13-alpine

versions/prod

@@ -1,6 +1,4 @@
 FOCUS_TAG=main
 BEAM_TAG=main
 BLAZE_TAG=0.32
-POSTGRES_TAG=15.13-alpine
-TEILER_DASHBOARD_TAG=main
-MTBA_TAG=main
+POSTGRES_TAG=15.13-alpine

versions/test

@@ -1,7 +1,4 @@
 FOCUS_TAG=develop
 BEAM_TAG=develop
 BLAZE_TAG=main
-POSTGRES_TAG=15.13-alpine
-TEILER_DASHBOARD_TAG=develop
-MTBA_TAG=develop
-BEAM_FILE_TAG=task-based-files
+POSTGRES_TAG=15.13-alpine