Test

changed: move teiler groups to teiler backend
Replace hardcoded image: ...:develop references with version variables (#335 )
2025-09-11 11:31:22 +02:00 · 2025-07-30 11:36:18 +02:00 · 2025-07-30 11:25:19 +02:00 · 2025-07-30 11:21:10 +02:00 · 2025-07-25 10:58:56 +02:00 · 2025-07-25 10:58:07 +02:00
17 changed files with 50 additions and 30 deletions
--- a/README.md
+++ b/README.md
@@ -85,6 +85,8 @@ The following URLs need to be accessible (prefix with `https://`):
    * hub.docker.com
    * registry-1.docker.io
    * production.cloudflare.docker.com
+  * GitHub Container Registry - (for use of DNPM:DIP)
+    * ghcr.io
 * To report bridgeheads operational status
  * healthchecks.verbis.dkfz.de
 * only for DKTK/CCP
@@ -95,7 +97,7 @@ The following URLs need to be accessible (prefix with `https://`):
 * only for German Biobank Node
  * broker.bbmri.de

-> 📝 This URL list is subject to change. Instead of the individual names, we highly recommend whitelisting wildcard domains: *.dkfz.de, github.com, *.docker.com, *.docker.io, *.samply.de, *.bbmri.de.
+> 📝 This URL list is subject to change. Instead of the individual names, we highly recommend whitelisting wildcard domains: *.dkfz.de, github.com, *.docker.com, *.docker.io, *.ghcr.io, *.samply.de, *.bbmri.de.

 > 📝 Ubuntu's pre-installed uncomplicated firewall (ufw) is known to conflict with Docker, more info [here](https://github.com/chaifeng/ufw-docker).

--- a/bbmri/modules/teiler-compose.yml
+++ b/bbmri/modules/teiler-compose.yml
@@ -19,7 +19,7 @@ services:
      HTTP_RELATIVE_PATH: "/bbmri-teiler"

  teiler-dashboard:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
+    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:${TEILER_DASHBOARD_TAG}
    container_name: bridgehead-teiler-dashboard
    labels:
      - "traefik.enable=true"
--- a/cce/modules/teiler-compose.yml
+++ b/cce/modules/teiler-compose.yml
@@ -19,7 +19,7 @@ services:
      HTTP_RELATIVE_PATH: "/cce-teiler"

  teiler-dashboard:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
+    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:${TEILER_DASHBOARD_TAG}
    container_name: bridgehead-teiler-dashboard
    labels:
      - "traefik.enable=true"
--- a/ccp/modules/dnpm-node-compose.yml
+++ b/ccp/modules/dnpm-node-compose.yml
@@ -43,7 +43,7 @@ services:
      - "traefik.http.routers.dnpm-auth.tls=true"

  dnpm-portal:
-    image: ghcr.io/dnpm-dip/portal:{DNPM_IMAGE_TAG:-latest}
+    image: ghcr.io/dnpm-dip/portal:${DNPM_IMAGE_TAG:-latest}
    container_name: bridgehead-dnpm-portal
    environment:
      - NUXT_API_URL=http://dnpm-backend:9000/
@@ -58,7 +58,7 @@ services:

  dnpm-backend:
    container_name: bridgehead-dnpm-backend
-    image: ghcr.io/dnpm-dip/backend:{DNPM_IMAGE_TAG:-latest}
+    image: ghcr.io/dnpm-dip/backend:${DNPM_IMAGE_TAG:-latest}
    environment:
      - LOCAL_SITE=${ZPM_SITE}:${SITE_NAME}   # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen
      - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
--- a/ccp/modules/id-management-compose.yml
+++ b/ccp/modules/id-management-compose.yml
@@ -14,6 +14,7 @@ services:
      MAGICPL_CONNECTOR_APIKEY: ${IDMANAGER_READ_APIKEY}
      MAGICPL_CENTRAL_PATIENTLIST_APIKEY: ${IDMANAGER_CENTRAL_PATIENTLIST_APIKEY}
      MAGICPL_CONTROLNUMBERGENERATOR_APIKEY: ${IDMANAGER_CONTROLNUMBERGENERATOR_APIKEY}
+      MAGICPL_OIDC_PROVIDER: ${OIDC_PRIVATE_URL}
    depends_on:
      - patientlist
      - traefik-forward-auth
@@ -71,12 +72,14 @@ services:
      - https_proxy=http://forward_proxy:3128
      - OAUTH2_PROXY_PROVIDER=oidc
      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
-      - OAUTH2_PROXY_OIDC_ISSUER_URL=https://login.verbis.dkfz.de/realms/master
-      - OAUTH2_PROXY_CLIENT_ID=bridgehead-${SITE_ID}
-      - OAUTH2_PROXY_CLIENT_SECRET=${IDMANAGER_AUTH_CLIENT_SECRET}
+      - OAUTH2_PROXY_OIDC_ISSUER_URL=${OIDC_PRIVATE_URL}
+      - OAUTH2_PROXY_CLIENT_ID=${OIDC_PRIVATE_CLIENT_ID}
+      - OAUTH2_PROXY_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
      - OAUTH2_PROXY_COOKIE_SECRET=${IDMANAGER_AUTH_COOKIE_SECRET}
      - OAUTH2_PROXY_COOKIE_NAME=_BRIDGEHEAD_oauth2_idm
      - OAUTH2_PROXY_COOKIE_DOMAINS=.${HOST}
+      - OAUTH2_PROXY_COOKIE_REFRESH=4m
+      - OAUTH2_PROXY_COOKIE_EXPIRE=24h
      - OAUTH2_PROXY_HTTP_ADDRESS=:4180
      - OAUTH2_PROXY_REVERSE_PROXY=true
      - OAUTH2_PROXY_WHITELIST_DOMAINS=.${HOST}
@@ -87,8 +90,8 @@ services:
      - OAUTH2_PROXY_SET_AUTHORIZATION_HEADER=true
      - OAUTH2_PROXY_SET_XAUTHREQUEST=true
      # Keycloak has an expiration time of 60s therefore oauth2-proxy needs to refresh after that
-      - OAUTH2_PROXY_COOKIE_REFRESH=60s
-      - OAUTH2_PROXY_ALLOWED_GROUPS=DKTK-CCP-PPSN
+      - OAUTH2_PROXY_ALLOWED_GROUPS=${OIDC_PSP_GROUP}
+      - OAUTH2_PROXY_OIDC_GROUPS_CLAIM=${OIDC_GROUP_CLAIM}
      - OAUTH2_PROXY_PROXY_PREFIX=/oauth2-idm
    labels:
      - "traefik.enable=true"
--- a/ccp/modules/id-management-setup.sh
+++ b/ccp/modules/id-management-setup.sh
@@ -14,6 +14,8 @@ function idManagementSetup() {

 		# Ensure old ids are working !!!
 		export IDMANAGEMENT_FRIENDLY_ID=$(legacyIdMapping "$SITE_ID")
+
+		add_private_oidc_redirect_url "/oauth2-idm/callback"
 	fi
 }

--- a/ccp/modules/mtba-compose.yml
+++ b/ccp/modules/mtba-compose.yml
@@ -2,7 +2,7 @@ version: "3.7"

 services:
  mtba:
-    image: docker.verbis.dkfz.de/cache/samply/mtba:develop
+    image: docker.verbis.dkfz.de/cache/samply/mtba:${MTBA_TAG}
    container_name: bridgehead-mtba
    environment:
      BLAZE_STORE_URL: http://blaze:8080
@@ -22,8 +22,14 @@ services:
      HTTP_RELATIVE_PATH: "/mtba"
      OIDC_ADMIN_GROUP: "${OIDC_ADMIN_GROUP}"
      OIDC_CLIENT_ID: "${OIDC_PRIVATE_CLIENT_ID}"
-      OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
-      OIDC_URL: "${OIDC_URL}"
+      # TODO: Add following variables after moving to Authentik:
+      #OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
+      #OIDC_URL: "${OIDC_URL}"
+      # TODO: Remove following variables after moving to Authentik:
+      # Please add KECLOAK_CLIENT_SECRET in ccp.conf
+      OIDC_CLIENT_SECRET: "${KEYCLOAK_CLIENT_SECRET}"
+      OIDC_URL: "https://login.verbis.dkfz.de/realms/test-realm-01"
+      OIDC_ADMIN_URL: "https://login.verbis.dkfz.de/admin/realms/test-realm-01"

    labels:
      - "traefik.enable=true"
--- a/ccp/modules/teiler-compose.yml
+++ b/ccp/modules/teiler-compose.yml
@@ -19,7 +19,7 @@ services:
      HTTP_RELATIVE_PATH: "/ccp-teiler"

  teiler-dashboard:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
+    image: docker.verbis.dkfz.de/ccp/samply/teiler-dashboard:test
    container_name: bridgehead-teiler-dashboard
    labels:
      - "traefik.enable=true"
@@ -42,14 +42,12 @@ services:
      EXPORTER_API_KEY: "${EXPORTER_API_KEY}"
      TEILER_ORCHESTRATOR_URL: "/ccp-teiler"
      TEILER_ORCHESTRATOR_HTTP_RELATIVE_PATH: "/ccp-teiler"
-      TEILER_USER: "${OIDC_USER_GROUP}"
-      TEILER_ADMIN: "${OIDC_ADMIN_GROUP}"
      REPORTER_DEFAULT_TEMPLATE_ID: "ccp-qb"
      EXPORTER_DEFAULT_TEMPLATE_ID: "ccp"


  teiler-backend:
-    image: docker.verbis.dkfz.de/ccp/dktk-teiler-backend:latest
+    image: docker.verbis.dkfz.de/ccp/dktk-teiler-backend:test
    container_name: bridgehead-teiler-backend
    labels:
      - "traefik.enable=true"
@@ -70,3 +68,7 @@ services:
      ENABLE_MTBA: "${ENABLE_MTBA}"
      ENABLE_DATASHIELD: "${ENABLE_DATASHIELD}"
      IDMANAGER_UPLOAD_APIKEY: "${IDMANAGER_UPLOAD_APIKEY}" # Only used to check if the ID Manager is active
+      TEILER_ROLE_USER: "${OIDC_USER_GROUP}"
+      TEILER_ROLE_ADMIN: "${OIDC_ADMIN_GROUP}"
+      TEILER_ROLE_PSP: "${OIDC_PSP_GROUP}"
+
--- a/ccp/vars
+++ b/ccp/vars
@@ -10,12 +10,11 @@ BROKER_URL_FOR_PREREQ=$BROKER_URL

 OIDC_USER_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})"
 OIDC_ADMIN_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})_Verwalter"
+OIDC_PSP_GROUP="DKTK_CCP_$(capitalize_first_letter ${SITE_ID})_PSP"
 OIDC_PRIVATE_CLIENT_ID=${SITE_ID}-private
 OIDC_PUBLIC_CLIENT_ID=${SITE_ID}-public
-#OIDC_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PUBLIC_CLIENT_ID}/"
-#OIDC_PRIVATE_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PRIVATE_CLIENT_ID}/"
-OIDC_URL="https://login.verbis.dkfz.de/realms/test-realm-01"
-OIDC_PRIVATE_URL="https://login.verbis.dkfz.de/realms/test-realm-01"
+OIDC_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PUBLIC_CLIENT_ID}/"
+OIDC_PRIVATE_URL="https://sso.verbis.dkfz.de/application/o/${OIDC_PRIVATE_CLIENT_ID}/"
 OIDC_GROUP_CLAIM="groups"

 for module in $PROJECT/modules/*.sh
--- a/dhki/docker-compose.yml
+++ b/dhki/docker-compose.yml
@@ -39,7 +39,7 @@ services:
      - "blaze"

  beam-proxy:
-    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
    container_name: bridgehead-beam-proxy
    environment:
      BROKER_URL: ${BROKER_URL}
--- a/kr/docker-compose.yml
+++ b/kr/docker-compose.yml
@@ -40,7 +40,7 @@ services:
      - "blaze"

  beam-proxy:
-    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:develop
+    image: docker.verbis.dkfz.de/cache/samply/beam-proxy:${BEAM_TAG}
    container_name: bridgehead-beam-proxy
    environment:
      BROKER_URL: ${BROKER_URL}
--- a/kr/modules/teiler-compose.yml
+++ b/kr/modules/teiler-compose.yml
@@ -19,7 +19,7 @@ services:
      HTTP_RELATIVE_PATH: "/kr-teiler"

  teiler-dashboard:
-    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:develop
+    image: docker.verbis.dkfz.de/cache/samply/teiler-dashboard:${TEILER_DASHBOARD_TAG}
    container_name: bridgehead-teiler-dashboard
    labels:
      - "traefik.enable=true"
--- a/lib/functions.sh
+++ b/lib/functions.sh
@@ -327,7 +327,7 @@ function sync_secrets() {
        -e ALL_PROXY=$HTTPS_PROXY_FULL_URL \
        -e PROXY_ID=$proxy_id \
        -e BROKER_URL=$broker_url \
-        -e OIDC_PROVIDER=secret-sync-central.secret-sync.$broker_id \
+        -e OIDC_PROVIDER=secret-sync-central.test-secret-sync.$broker_id \
        -e SECRET_DEFINITIONS=$secret_sync_args \
        docker.verbis.dkfz.de/cache/samply/secret-sync-local:latest

--- a/minimal/modules/dnpm-node-compose.yml
+++ b/minimal/modules/dnpm-node-compose.yml
@@ -43,7 +43,7 @@ services:
      - "traefik.http.routers.dnpm-auth.tls=true"

  dnpm-portal:
-    image: ghcr.io/dnpm-dip/portal:{DNPM_IMAGE_TAG:-latest}
+    image: ghcr.io/dnpm-dip/portal:${DNPM_IMAGE_TAG:-latest}
    container_name: bridgehead-dnpm-portal
    environment:
      - NUXT_API_URL=http://dnpm-backend:9000/
@@ -58,7 +58,7 @@ services:

  dnpm-backend:
    container_name: bridgehead-dnpm-backend
-    image: ghcr.io/dnpm-dip/backend:{DNPM_IMAGE_TAG:-latest}
+    image: ghcr.io/dnpm-dip/backend:${DNPM_IMAGE_TAG:-latest}
    environment:
      - LOCAL_SITE=${ZPM_SITE}:${SITE_NAME}   # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen
      - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
--- a/versions/acceptance
+++ b/versions/acceptance
@@ -1,4 +1,6 @@
 FOCUS_TAG=develop
 BEAM_TAG=develop
 BLAZE_TAG=main
-POSTGRES_TAG=15.13-alpine
+POSTGRES_TAG=15.13-alpine
+TEILER_DASHBOARD_TAG=develop
+MTBA_TAG=develop
--- a/versions/prod
+++ b/versions/prod
@@ -1,4 +1,6 @@
 FOCUS_TAG=main
 BEAM_TAG=main
 BLAZE_TAG=0.32
-POSTGRES_TAG=15.13-alpine
+POSTGRES_TAG=15.13-alpine
+TEILER_DASHBOARD_TAG=main
+MTBA_TAG=main
--- a/versions/test
+++ b/versions/test
@@ -1,4 +1,6 @@
 FOCUS_TAG=develop
 BEAM_TAG=develop
 BLAZE_TAG=main
-POSTGRES_TAG=15.13-alpine
+POSTGRES_TAG=15.13-alpine
+TEILER_DASHBOARD_TAG=develop
+MTBA_TAG=develop
Author	SHA1	Message	Date
David Juarez	5dbceba8eb	Test	2025-07-30 11:36:18 +02:00
David Juarez	a3a979c522	changed: move teiler groups to teiler backend	2025-07-30 11:25:19 +02:00
djuarezgf	ada3226044	Replace hardcoded image: ...:develop references with version variables (#335 ) * added: Teiler Dashboard Version * added: MTBA Version * added: beam proxy tag version	2025-07-30 11:21:10 +02:00
Paul-Christian Volkmer	a2e7330cee	docs: Add ghcr.io to URL list (#321 )	2025-07-25 10:58:56 +02:00
Jan	9c8d0ee8f5	fix(dnpm): fix env subsitution (#333 )	2025-07-25 10:58:07 +02:00
djuarezgf	fcad7104f0	mtba: fallback to keycloak test server pending migration	2025-07-23 09:53:14 +02:00
djuarezgf	7e13e251f8	feat: migrate PSP to Authentik (#329 )	2025-07-22 11:34:49 +02:00