mirror of
https://github.com/samply/bridgehead.git
synced 2025-11-04 16:30:18 +01:00
43b24c2a62
* Fixed: Authentik URL for Opal * Removed: Unnecessary OIDC config in CCE and BBMRI * KR with basic auth instead of OIDC
87 lines
3.0 KiB
YAML
87 lines
3.0 KiB
YAML
version: "3.7"
|
|
|
|
services:
|
|
opal:
|
|
container_name: bridgehead-opal
|
|
image: docker.verbis.dkfz.de/ccp/dktk-opal:latest
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.opal_ccp.rule=PathPrefix(`/opal`)"
|
|
- "traefik.http.services.opal_ccp.loadbalancer.server.port=8080"
|
|
- "traefik.http.routers.opal_ccp.tls=true"
|
|
links:
|
|
- opal-rserver
|
|
- opal-db
|
|
environment:
|
|
JAVA_OPTS: "-Xms1G -Xmx8G -XX:+UseG1GC -Dhttps.proxyHost=forward_proxy -Dhttps.proxyPort=3128"
|
|
# OPAL_ADMINISTRATOR_USER: "administrator" # This line is kept for informational purposes
|
|
OPAL_ADMINISTRATOR_PASSWORD: "${OPAL_ADMIN_PASSWORD}"
|
|
POSTGRESDATA_HOST: "opal-db"
|
|
POSTGRESDATA_DATABASE: "opal"
|
|
POSTGRESDATA_USER: "opal"
|
|
POSTGRESDATA_PASSWORD: "${OPAL_DB_PASSWORD}"
|
|
ROCK_HOSTS: "opal-rserver:8085"
|
|
APP_URL: "https://${HOST}/opal"
|
|
APP_CONTEXT_PATH: "/opal"
|
|
OPAL_PRIVATE_KEY: "/run/secrets/opal-key.pem"
|
|
OPAL_CERTIFICATE: "/run/secrets/opal-cert.pem"
|
|
OIDC_URL: "${OIDC_PRIVATE_URL}"
|
|
OIDC_CLIENT_ID: "${OIDC_PRIVATE_CLIENT_ID}"
|
|
OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
|
|
OIDC_ADMIN_GROUP: "${OIDC_ADMIN_GROUP}"
|
|
TOKEN_MANAGER_PASSWORD: "${TOKEN_MANAGER_OPAL_PASSWORD}"
|
|
EXPORTER_PASSWORD: "${EXPORTER_OPAL_PASSWORD}"
|
|
BEAM_APP_ID: token-manager.${PROXY_ID}
|
|
BEAM_SECRET: ${TOKEN_MANAGER_SECRET}
|
|
BEAM_DATASHIELD_PROXY: request-manager
|
|
volumes:
|
|
- "/var/cache/bridgehead/ccp/opal-metadata-db:/srv" # Opal metadata
|
|
secrets:
|
|
- opal-cert.pem
|
|
- opal-key.pem
|
|
|
|
opal-db:
|
|
container_name: bridgehead-opal-db
|
|
image: docker.verbis.dkfz.de/cache/postgres:${POSTGRES_TAG}
|
|
environment:
|
|
POSTGRES_PASSWORD: "${OPAL_DB_PASSWORD}" # Set in datashield-setup.sh
|
|
POSTGRES_USER: "opal"
|
|
POSTGRES_DB: "opal"
|
|
volumes:
|
|
- "/var/cache/bridgehead/ccp/opal-db:/var/lib/postgresql/data" # Opal project data (imported from exporter)
|
|
|
|
opal-rserver:
|
|
container_name: bridgehead-opal-rserver
|
|
image: docker.verbis.dkfz.de/ccp/dktk-rserver # datashield/rock-base + dsCCPhos
|
|
tmpfs:
|
|
- /srv
|
|
|
|
beam-connect:
|
|
image: docker.verbis.dkfz.de/cache/samply/beam-connect:develop
|
|
container_name: bridgehead-datashield-connect
|
|
environment:
|
|
PROXY_URL: "http://beam-proxy:8081"
|
|
TLS_CA_CERTIFICATES_DIR: /run/secrets
|
|
APP_ID: datashield-connect.${SITE_ID}.${BROKER_ID}
|
|
PROXY_APIKEY: ${DATASHIELD_CONNECT_SECRET}
|
|
DISCOVERY_URL: "./map/central.json"
|
|
LOCAL_TARGETS_FILE: "./map/local.json"
|
|
NO_AUTH: "true"
|
|
secrets:
|
|
- opal-cert.pem
|
|
depends_on:
|
|
- beam-proxy
|
|
volumes:
|
|
- /tmp/bridgehead/opal-map/:/map/:ro
|
|
|
|
beam-proxy:
|
|
environment:
|
|
APP_datashield-connect_KEY: ${DATASHIELD_CONNECT_SECRET}
|
|
APP_token-manager_KEY: ${TOKEN_MANAGER_SECRET}
|
|
|
|
secrets:
|
|
opal-cert.pem:
|
|
file: /tmp/bridgehead/opal-cert.pem
|
|
opal-key.pem:
|
|
file: /tmp/bridgehead/opal-key.pem
|