mirror of
https://github.com/samply/bridgehead.git
synced 2026-08-14 00:02:36 +02:00
1b4a290216
This is a squash of 62 commits integrating ovis into the Bridgehead; authors see below. --------- Co-authored-by: janskiba <jan.skiba@dkfz-heidelberg.de> Co-authored-by: Torben Brenner <76154651+torbrenner@users.noreply.github.com> Co-authored-by: Tobias Kussel <tobias.kussel@dkfz-heidelberg.de> Co-authored-by: Torben Brenner <t.brenner@dkfz-heidelberg.de> Co-authored-by: Martin Lablans <m.lablans@dkfz-heidelberg.de>
103 lines
4.6 KiB
YAML
103 lines
4.6 KiB
YAML
services:
|
|
ovis-traefik-forward-auth:
|
|
container_name: bridgehead-ccp-ovis-forward-auth
|
|
image: docker.verbis.dkfz.de/cache/oauth2-proxy/oauth2-proxy:latest
|
|
environment:
|
|
- http_proxy=http://forward_proxy:3128
|
|
- https_proxy=http://forward_proxy:3128
|
|
- OAUTH2_PROXY_PROVIDER=oidc
|
|
- OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
|
|
- OAUTH2_PROXY_OIDC_ISSUER_URL=${OIDC_PRIVATE_URL}
|
|
- OAUTH2_PROXY_CLIENT_ID=${OIDC_PRIVATE_CLIENT_ID}
|
|
- OAUTH2_PROXY_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
|
|
- OAUTH2_PROXY_COOKIE_SECRET=${OVIS_AUTH_COOKIE_SECRET}
|
|
- OAUTH2_PROXY_COOKIE_NAME=_BRIDGEHEAD_oauth2_ovis
|
|
- OAUTH2_PROXY_COOKIE_DOMAINS=.${HOST}
|
|
- OAUTH2_PROXY_COOKIE_REFRESH=4m
|
|
- OAUTH2_PROXY_COOKIE_EXPIRE=24h
|
|
- OAUTH2_PROXY_HTTP_ADDRESS=:4180
|
|
- OAUTH2_PROXY_REVERSE_PROXY=true
|
|
- OAUTH2_PROXY_WHITELIST_DOMAINS=.${HOST}
|
|
- OAUTH2_PROXY_UPSTREAMS=static://202
|
|
- OAUTH2_PROXY_EMAIL_DOMAINS=*
|
|
- OAUTH2_PROXY_SCOPE=openid profile email
|
|
- OAUTH2_PROXY_SET_AUTHORIZATION_HEADER=true
|
|
- OAUTH2_PROXY_SET_XAUTHREQUEST=true
|
|
- OAUTH2_PROXY_ALLOWED_GROUPS=${OIDC_USER_GROUP}
|
|
- OAUTH2_PROXY_OIDC_GROUPS_CLAIM=${OIDC_GROUP_CLAIM}
|
|
- OAUTH2_PROXY_PROXY_PREFIX=/oauth2-ovis
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.services.ovis-traefik-forward-auth.loadbalancer.server.port=4180"
|
|
- "traefik.http.routers.ovis-traefik-forward-auth.rule=Host(`${HOST}`) && PathPrefix(`/oauth2-ovis`)"
|
|
- "traefik.http.routers.ovis-traefik-forward-auth.tls=true"
|
|
- "traefik.http.middlewares.traefik-forward-auth-ovis.forwardauth.address=http://ovis-traefik-forward-auth:4180"
|
|
- "traefik.http.middlewares.traefik-forward-auth-ovis.forwardauth.authResponseHeaders=Authorization,X-Auth-Request-Email,X-Auth-Request-User,X-Auth-Request-Preferred-Username"
|
|
depends_on:
|
|
forward_proxy:
|
|
condition: service_healthy
|
|
|
|
ovis-backend-database-mongodb:
|
|
image: docker.verbis.dkfz.de/cache/samply/ovis-backend-mongodb:${OVIS_TAG}
|
|
container_name: bridgehead-ccp-ovis-mongo
|
|
volumes:
|
|
- /var/cache/bridgehead/ccp/ovis-mongodb:/data/db
|
|
|
|
ovis-backend-mongodb-data-preprocessing:
|
|
image: docker.verbis.dkfz.de/cache/samply/ovis-backend-preprocessor:${OVIS_TAG}
|
|
container_name: bridgehead-ccp-ovis-preprocessing
|
|
environment:
|
|
ADDRESS: mongodb://ovis-backend-database-mongodb:27017
|
|
depends_on:
|
|
- ovis-backend-database-mongodb
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-fsS", "http://localhost:9000/health"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 6
|
|
start_period: 5s
|
|
|
|
ovis-backend-data-import:
|
|
image: docker.verbis.dkfz.de/cache/samply/ovis-backend-data-import:${OVIS_TAG}
|
|
container_name: bridgehead-ccp-ovis-import
|
|
depends_on:
|
|
ovis-backend-mongodb-data-preprocessing:
|
|
condition: service_healthy
|
|
environment:
|
|
FHIR_SERVER_URL: http://bridgehead-ccp-blaze:8080/fhir
|
|
|
|
ovis-backend-apollo:
|
|
image: docker.verbis.dkfz.de/cache/samply/ovis-backend-apollo:${OVIS_TAG}
|
|
container_name: bridgehead-ccp-ovis-backend
|
|
environment:
|
|
ADDRESS: mongodb://ovis-backend-database-mongodb:27017
|
|
OVIS_SUPERADMIN_EMAILS: ${OVIS_SUPERADMIN_EMAILS:-}
|
|
depends_on:
|
|
- ovis-backend-database-mongodb
|
|
- ovis-backend-mongodb-data-preprocessing
|
|
- ovis-backend-data-import
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-fsS", "-X", "POST", "-H", "content-type: application/json", "-d", "{\"query\":\"{__typename}\"}", "http://localhost:4001/graphql"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
# Internal only - no direct Traefik exposure. GraphQL is accessed via frontend internal proxy.
|
|
|
|
ovis-frontend:
|
|
image: docker.verbis.dkfz.de/cache/samply/ovis-frontend:${OVIS_TAG}
|
|
container_name: bridgehead-ccp-ovis-frontend
|
|
environment:
|
|
ORIGIN: https://${HOST}
|
|
depends_on:
|
|
ovis-backend-apollo:
|
|
condition: service_healthy
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.middlewares.ovis-frontend-ccp-slash-redirect.redirectregex.regex=^https?://([^/]+)/ccp-ovis$"
|
|
- "traefik.http.middlewares.ovis-frontend-ccp-slash-redirect.redirectregex.replacement=https://$${1}/ccp-ovis/"
|
|
- "traefik.http.middlewares.ovis-frontend-ccp-slash-redirect.redirectregex.permanent=true"
|
|
- "traefik.http.routers.ovis-frontend-ccp.tls=true"
|
|
- "traefik.http.routers.ovis-frontend-ccp.rule=PathPrefix(`/ccp-ovis`)"
|
|
- "traefik.http.routers.ovis-frontend-ccp.middlewares=traefik-forward-auth-ovis,ovis-frontend-ccp-slash-redirect"
|
|
- "traefik.http.services.ovis-frontend-ccp.loadbalancer.server.port=5173"
|